Merge branch 'pci/msi-affinity' into next

Conflicts:
	drivers/nvme/host/pci.c

1008 files changed, 9995 insertions, 6387 deletions

diff --git a/.mailmap b/.mailmap
index 08b80428f583..52489f564069 100644
--- a/.mailmap
+++ b/.mailmap
@@ -21,6 +21,7 @@ Andrey Ryabinin <ryabinin.a.a@gmail.com> <a.ryabinin@samsung.com>
 Andrew Morton <akpm@linux-foundation.org>
 Andrew Vasquez <andrew.vasquez@qlogic.com>
 Andy Adamson <andros@citi.umich.edu>
+Antoine Tenart <antoine.tenart@free-electrons.com>
 Antonio Ospite <ao2@ao2.it> <ao2@amarulasolutions.com>
 Archit Taneja <archit@ti.com>
 Arnaud Patard <arnaud.patard@rtp-net.org>
@@ -30,6 +31,9 @@ Axel Lin <axel.lin@gmail.com>
 Ben Gardner <bgardner@wabtec.com>
 Ben M Cahill <ben.m.cahill@intel.com>
 Björn Steinbrink <B.Steinbrink@gmx.de>
+Boris Brezillon <boris.brezillon@free-electrons.com>
+Boris Brezillon <boris.brezillon@free-electrons.com> <b.brezillon.dev@gmail.com>
+Boris Brezillon <boris.brezillon@free-electrons.com> <b.brezillon@overkiz.com>
 Brian Avery <b.avery@hp.com>
 Brian King <brking@us.ibm.com>
 Christoph Hellwig <hch@lst.de>
@@ -89,6 +93,7 @@ Leonid I Ananiev <leonid.i.ananiev@intel.com>
 Linas Vepstas <linas@austin.ibm.com>
 Mark Brown <broonie@sirena.org.uk>
 Matthieu CASTET <castet.matthieu@free.fr>
+Mauro Carvalho Chehab <mchehab@kernel.org> <maurochehab@gmail.com> <mchehab@infradead.org> <mchehab@redhat.com> <m.chehab@samsung.com> <mchehab@osg.samsung.com> <mchehab@s-opensource.com>
 Mayuresh Janorkar <mayur@ti.com>
 Michael Buesch <m@bues.ch>
 Michel Dänzer <michel@tungstengraphics.com>
@@ -122,6 +127,7 @@ Santosh Shilimkar <santosh.shilimkar@oracle.org>
 Sascha Hauer <s.hauer@pengutronix.de>
 S.Çağlar Onur <caglar@pardus.org.tr>
 Shiraz Hashim <shiraz.linux.kernel@gmail.com> <shiraz.hashim@st.com>
+Shuah Khan <shuah@kernel.org> <shuahkhan@gmail.com> <shuah.khan@hp.com> <shuahkh@osg.samsung.com> <shuah.kh@samsung.com>
 Simon Kelley <simon@thekelleys.org.uk>
 Stéphane Witzmann <stephane.witzmann@ubpmes.univ-bpclermont.fr>
 Stephen Hemminger <shemminger@osdl.org>
diff --git a/CREDITS b/CREDITS
index 0f0bf22afe0c..2a3fbcd229e6 100644
--- a/CREDITS
+++ b/CREDITS
@@ -649,6 +649,7 @@ D: Configure, Menuconfig, xconfig
 
 N: Mauro Carvalho Chehab
 E: m.chehab@samsung.org
+E: mchehab@osg.samsung.com
 E: mchehab@infradead.org
 D: Media subsystem (V4L/DVB) drivers and core
 D: EDAC drivers and EDAC 3.0 core rework
diff --git a/Documentation/ABI/testing/configfs-usb-gadget-uvc b/Documentation/ABI/testing/configfs-usb-gadget-uvc
index 2f4a0051b32d..1ba0d0fda9c0 100644
--- a/Documentation/ABI/testing/configfs-usb-gadget-uvc
+++ b/Documentation/ABI/testing/configfs-usb-gadget-uvc
@@ -1,6 +1,6 @@
 What:           /config/usb-gadget/gadget/functions/uvc.name
 Date:           Dec 2014
-KernelVersion:  3.20
+KernelVersion:  4.0
 Description:    UVC function directory
 
                 streaming_maxburst      - 0..15 (ss only)
@@ -9,37 +9,37 @@ Description:	UVC function directory
 
 What:           /config/usb-gadget/gadget/functions/uvc.name/control
 Date:           Dec 2014
-KernelVersion:  3.20
+KernelVersion:  4.0
 Description:    Control descriptors
 
 What:           /config/usb-gadget/gadget/functions/uvc.name/control/class
 Date:           Dec 2014
-KernelVersion:  3.20
+KernelVersion:  4.0
 Description:    Class descriptors
 
 What:           /config/usb-gadget/gadget/functions/uvc.name/control/class/ss
 Date:           Dec 2014
-KernelVersion:  3.20
+KernelVersion:  4.0
 Description:    Super speed control class descriptors
 
 What:           /config/usb-gadget/gadget/functions/uvc.name/control/class/fs
 Date:           Dec 2014
-KernelVersion:  3.20
+KernelVersion:  4.0
 Description:    Full speed control class descriptors
 
 What:           /config/usb-gadget/gadget/functions/uvc.name/control/terminal
 Date:           Dec 2014
-KernelVersion:  3.20
+KernelVersion:  4.0
 Description:    Terminal descriptors
 
 What:           /config/usb-gadget/gadget/functions/uvc.name/control/terminal/output
 Date:           Dec 2014
-KernelVersion:  3.20
+KernelVersion:  4.0
 Description:    Output terminal descriptors
 
 What:           /config/usb-gadget/gadget/functions/uvc.name/control/terminal/output/default
 Date:           Dec 2014
-KernelVersion:  3.20
+KernelVersion:  4.0
 Description:    Default output terminal descriptors
 
                 All attributes read only:
@@ -53,12 +53,12 @@ Description:	Default output terminal descriptors
 
 What:           /config/usb-gadget/gadget/functions/uvc.name/control/terminal/camera
 Date:           Dec 2014
-KernelVersion:  3.20
+KernelVersion:  4.0
 Description:    Camera terminal descriptors
 
 What:           /config/usb-gadget/gadget/functions/uvc.name/control/terminal/camera/default
 Date:           Dec 2014
-KernelVersion:  3.20
+KernelVersion:  4.0
 Description:    Default camera terminal descriptors
 
                 All attributes read only:
@@ -75,12 +75,12 @@ Description:	Default camera terminal descriptors
 
 What:           /config/usb-gadget/gadget/functions/uvc.name/control/processing
 Date:           Dec 2014
-KernelVersion:  3.20
+KernelVersion:  4.0
 Description:    Processing unit descriptors
 
 What:           /config/usb-gadget/gadget/functions/uvc.name/control/processing/default
 Date:           Dec 2014
-KernelVersion:  3.20
+KernelVersion:  4.0
 Description:    Default processing unit descriptors
 
                 All attributes read only:
@@ -94,49 +94,49 @@ Description:	Default processing unit descriptors
 
 What:           /config/usb-gadget/gadget/functions/uvc.name/control/header
 Date:           Dec 2014
-KernelVersion:  3.20
+KernelVersion:  4.0
 Description:    Control header descriptors
 
 What:           /config/usb-gadget/gadget/functions/uvc.name/control/header/name
 Date:           Dec 2014
-KernelVersion:  3.20
+KernelVersion:  4.0
 Description:    Specific control header descriptors
 
 dwClockFrequency
 bcdUVC
 What:           /config/usb-gadget/gadget/functions/uvc.name/streaming
 Date:           Dec 2014
-KernelVersion:  3.20
+KernelVersion:  4.0
 Description:    Streaming descriptors
 
 What:           /config/usb-gadget/gadget/functions/uvc.name/streaming/class
 Date:           Dec 2014
-KernelVersion:  3.20
+KernelVersion:  4.0
 Description:    Streaming class descriptors
 
 What:           /config/usb-gadget/gadget/functions/uvc.name/streaming/class/ss
 Date:           Dec 2014
-KernelVersion:  3.20
+KernelVersion:  4.0
 Description:    Super speed streaming class descriptors
 
 What:           /config/usb-gadget/gadget/functions/uvc.name/streaming/class/hs
 Date:           Dec 2014
-KernelVersion:  3.20
+KernelVersion:  4.0
 Description:    High speed streaming class descriptors
 
 What:           /config/usb-gadget/gadget/functions/uvc.name/streaming/class/fs
 Date:           Dec 2014
-KernelVersion:  3.20
+KernelVersion:  4.0
 Description:    Full speed streaming class descriptors
 
 What:           /config/usb-gadget/gadget/functions/uvc.name/streaming/color_matching
 Date:           Dec 2014
-KernelVersion:  3.20
+KernelVersion:  4.0
 Description:    Color matching descriptors
 
 What:           /config/usb-gadget/gadget/functions/uvc.name/streaming/color_matching/default
 Date:           Dec 2014
-KernelVersion:  3.20
+KernelVersion:  4.0
 Description:    Default color matching descriptors
 
                 All attributes read only:
@@ -150,12 +150,12 @@ Description:	Default color matching descriptors
 
 What:           /config/usb-gadget/gadget/functions/uvc.name/streaming/mjpeg
 Date:           Dec 2014
-KernelVersion:  3.20
+KernelVersion:  4.0
 Description:    MJPEG format descriptors
 
 What:           /config/usb-gadget/gadget/functions/uvc.name/streaming/mjpeg/name
 Date:           Dec 2014
-KernelVersion:  3.20
+KernelVersion:  4.0
 Description:    Specific MJPEG format descriptors
 
                 All attributes read only,
@@ -174,7 +174,7 @@ Description:	Specific MJPEG format descriptors
 
 What:           /config/usb-gadget/gadget/functions/uvc.name/streaming/mjpeg/name/name
 Date:           Dec 2014
-KernelVersion:  3.20
+KernelVersion:  4.0
 Description:    Specific MJPEG frame descriptors
 
                 dwFrameInterval         - indicates how frame interval can be
@@ -196,12 +196,12 @@ Description:	Specific MJPEG frame descriptors
 
 What:           /config/usb-gadget/gadget/functions/uvc.name/streaming/uncompressed
 Date:           Dec 2014
-KernelVersion:  3.20
+KernelVersion:  4.0
 Description:    Uncompressed format descriptors
 
 What:           /config/usb-gadget/gadget/functions/uvc.name/streaming/uncompressed/name
 Date:           Dec 2014
-KernelVersion:  3.20
+KernelVersion:  4.0
 Description:    Specific uncompressed format descriptors
 
                 bmaControls             - this format's data for bmaControls in
@@ -221,7 +221,7 @@ Description:	Specific uncompressed format descriptors
 
 What:           /config/usb-gadget/gadget/functions/uvc.name/streaming/uncompressed/name/name
 Date:           Dec 2014
-KernelVersion:  3.20
+KernelVersion:  4.0
 Description:    Specific uncompressed frame descriptors
 
                 dwFrameInterval         - indicates how frame interval can be
@@ -243,12 +243,12 @@ Description:	Specific uncompressed frame descriptors
 
 What:           /config/usb-gadget/gadget/functions/uvc.name/streaming/header
 Date:           Dec 2014
-KernelVersion:  3.20
+KernelVersion:  4.0
 Description:    Streaming header descriptors
 
 What:           /config/usb-gadget/gadget/functions/uvc.name/streaming/header/name
 Date:           Dec 2014
-KernelVersion:  3.20
+KernelVersion:  4.0
 Description:    Specific streaming header descriptors
 
                 All attributes read only:
diff --git a/Documentation/ABI/testing/sysfs-bus-iio-proximity-as3935 b/Documentation/ABI/testing/sysfs-bus-iio-proximity-as3935
index 6708c5e264aa..33e96f740639 100644
--- a/Documentation/ABI/testing/sysfs-bus-iio-proximity-as3935
+++ b/Documentation/ABI/testing/sysfs-bus-iio-proximity-as3935
@@ -1,4 +1,4 @@
-What            /sys/bus/iio/devices/iio:deviceX/in_proximity_raw
+What            /sys/bus/iio/devices/iio:deviceX/in_proximity_input
 Date:           March 2014
 KernelVersion:  3.15
 Contact:        Matt Ranostay <mranostay@gmail.com>
diff --git a/Documentation/PCI/MSI-HOWTO.txt b/Documentation/PCI/MSI-HOWTO.txt
index 1179850f453c..c55df2911136 100644
--- a/Documentation/PCI/MSI-HOWTO.txt
+++ b/Documentation/PCI/MSI-HOWTO.txt
@@ -78,422 +78,111 @@ CONFIG_PCI_MSI option.
 
 4.2 Using MSI
 
-Most of the hard work is done for the driver in the PCI layer.  It simply
-has to request that the PCI layer set up the MSI capability for this
+Most of the hard work is done for the driver in the PCI layer.  The driver
+simply has to request that the PCI layer set up the MSI capability for this
 device.
 
-4.2.1 pci_enable_msi
+To automatically use MSI or MSI-X interrupt vectors, use the following
+function:
 
-int pci_enable_msi(struct pci_dev *dev)
+  int pci_alloc_irq_vectors(struct pci_dev *dev, unsigned int min_vecs,
+                unsigned int max_vecs, unsigned int flags);
 
-A successful call allocates ONE interrupt to the device, regardless
-of how many MSIs the device supports.  The device is switched from
-pin-based interrupt mode to MSI mode.  The dev->irq number is changed
-to a new number which represents the message signaled interrupt;
-consequently, this function should be called before the driver calls
-request_irq(), because an MSI is delivered via a vector that is
-different from the vector of a pin-based interrupt.
+which allocates up to max_vecs interrupt vectors for a PCI device.  It
+returns the number of vectors allocated or a negative error.  If the device
+has a requirements for a minimum number of vectors the driver can pass a
+min_vecs argument set to this limit, and the PCI core will return -ENOSPC
+if it can't meet the minimum number of vectors.
 
-4.2.2 pci_enable_msi_range
+The flags argument should normally be set to 0, but can be used to pass the
+PCI_IRQ_NOMSI and PCI_IRQ_NOMSIX flag in case a device claims to support
+MSI or MSI-X, but the support is broken, or to pass PCI_IRQ_NOLEGACY in
+case the device does not support legacy interrupt lines.
 
-int pci_enable_msi_range(struct pci_dev *dev, int minvec, int maxvec)
+By default this function will spread the interrupts around the available
+CPUs, but this feature can be disabled by passing the PCI_IRQ_NOAFFINITY
+flag.
 
-This function allows a device driver to request any number of MSI
-interrupts within specified range from 'minvec' to 'maxvec'.
+To get the Linux IRQ numbers passed to request_irq() and free_irq() and the
+vectors, use the following function:
 
-If this function returns a positive number it indicates the number of
-MSI interrupts that have been successfully allocated.  In this case
-the device is switched from pin-based interrupt mode to MSI mode and
-updates dev->irq to be the lowest of the new interrupts assigned to it.
-The other interrupts assigned to the device are in the range dev->irq
-to dev->irq + returned value - 1.  Device driver can use the returned
-number of successfully allocated MSI interrupts to further allocate
-and initialize device resources.
+  int pci_irq_vector(struct pci_dev *dev, unsigned int nr);
 
-If this function returns a negative number, it indicates an error and
-the driver should not attempt to request any more MSI interrupts for
-this device.
+Any allocated resources should be freed before removing the device using
+the following function:
 
-This function should be called before the driver calls request_irq(),
-because MSI interrupts are delivered via vectors that are different
-from the vector of a pin-based interrupt.
+  void pci_free_irq_vectors(struct pci_dev *dev);
 
-It is ideal if drivers can cope with a variable number of MSI interrupts;
-there are many reasons why the platform may not be able to provide the
-exact number that a driver asks for.
+If a device supports both MSI-X and MSI capabilities, this API will use the
+MSI-X facilities in preference to the MSI facilities.  MSI-X supports any
+number of interrupts between 1 and 2048.  In contrast, MSI is restricted to
+a maximum of 32 interrupts (and must be a power of two).  In addition, the
+MSI interrupt vectors must be allocated consecutively, so the system might
+not be able to allocate as many vectors for MSI as it could for MSI-X.  On
+some platforms, MSI interrupts must all be targeted at the same set of CPUs
+whereas MSI-X interrupts can all be targeted at different CPUs.
 
-There could be devices that can not operate with just any number of MSI
-interrupts within a range.  See chapter 4.3.1.3 to get the idea how to
-handle such devices for MSI-X - the same logic applies to MSI.
+If a device supports neither MSI-X or MSI it will fall back to a single
+legacy IRQ vector.
 
-4.2.1.1 Maximum possible number of MSI interrupts
+The typical usage of MSI or MSI-X interrupts is to allocate as many vectors
+as possible, likely up to the limit supported by the device.  If nvec is
+larger than the number supported by the device it will automatically be
+capped to the supported limit, so there is no need to query the number of
+vectors supported beforehand:
 
-The typical usage of MSI interrupts is to allocate as many vectors as
-possible, likely up to the limit returned by pci_msi_vec_count() function:
-
-static int foo_driver_enable_msi(struct pci_dev *pdev, int nvec)
-{
-        return pci_enable_msi_range(pdev, 1, nvec);
-}
-
-Note the value of 'minvec' parameter is 1.  As 'minvec' is inclusive,
-the value of 0 would be meaningless and could result in error.
-
-Some devices have a minimal limit on number of MSI interrupts.
-In this case the function could look like this:
-
-static int foo_driver_enable_msi(struct pci_dev *pdev, int nvec)
-{
-        return pci_enable_msi_range(pdev, FOO_DRIVER_MINIMUM_NVEC, nvec);
-}
-
-4.2.1.2 Exact number of MSI interrupts
+        nvec = pci_alloc_irq_vectors(pdev, 1, nvec, 0);
+        if (nvec < 0)
+                goto out_err;
 
 If a driver is unable or unwilling to deal with a variable number of MSI
-interrupts it could request a particular number of interrupts by passing
-that number to pci_enable_msi_range() function as both 'minvec' and 'maxvec'
-parameters:
-
-static int foo_driver_enable_msi(struct pci_dev *pdev, int nvec)
-{
-        return pci_enable_msi_range(pdev, nvec, nvec);
-}
-
-Note, unlike pci_enable_msi_exact() function, which could be also used to
-enable a particular number of MSI-X interrupts, pci_enable_msi_range()
-returns either a negative errno or 'nvec' (not negative errno or 0 - as
-pci_enable_msi_exact() does).
-
-4.2.1.3 Single MSI mode
-
-The most notorious example of the request type described above is
-enabling the single MSI mode for a device.  It could be done by passing
-two 1s as 'minvec' and 'maxvec':
-
-static int foo_driver_enable_single_msi(struct pci_dev *pdev)
-{
-        return pci_enable_msi_range(pdev, 1, 1);
-}
-
-Note, unlike pci_enable_msi() function, which could be also used to
-enable the single MSI mode, pci_enable_msi_range() returns either a
-negative errno or 1 (not negative errno or 0 - as pci_enable_msi()
-does).
-
-4.2.3 pci_enable_msi_exact
-
-int pci_enable_msi_exact(struct pci_dev *dev, int nvec)
-
-This variation on pci_enable_msi_range() call allows a device driver to
-request exactly 'nvec' MSIs.
-
-If this function returns a negative number, it indicates an error and
-the driver should not attempt to request any more MSI interrupts for
-this device.
-
-By contrast with pci_enable_msi_range() function, pci_enable_msi_exact()
-returns zero in case of success, which indicates MSI interrupts have been
-successfully allocated.
-
-4.2.4 pci_disable_msi
-
-void pci_disable_msi(struct pci_dev *dev)
-
-This function should be used to undo the effect of pci_enable_msi_range().
-Calling it restores dev->irq to the pin-based interrupt number and frees
-the previously allocated MSIs.  The interrupts may subsequently be assigned
-to another device, so drivers should not cache the value of dev->irq.
-
-Before calling this function, a device driver must always call free_irq()
-on any interrupt for which it previously called request_irq().
-Failure to do so results in a BUG_ON(), leaving the device with
-MSI enabled and thus leaking its vector.
-
-4.2.4 pci_msi_vec_count
-
-int pci_msi_vec_count(struct pci_dev *dev)
-
-This function could be used to retrieve the number of MSI vectors the
-device requested (via the Multiple Message Capable register). The MSI
-specification only allows the returned value to be a power of two,
-up to a maximum of 2^5 (32).
-
-If this function returns a negative number, it indicates the device is
-not capable of sending MSIs.
-
-If this function returns a positive number, it indicates the maximum
-number of MSI interrupt vectors that could be allocated.
-
-4.3 Using MSI-X
-
-The MSI-X capability is much more flexible than the MSI capability.
-It supports up to 2048 interrupts, each of which can be controlled
-independently.  To support this flexibility, drivers must use an array of
-`struct msix_entry':
-
-struct msix_entry {
-        u16     vector; /* kernel uses to write alloc vector */
-        u16     entry; /* driver uses to specify entry */
-};
-
-This allows for the device to use these interrupts in a sparse fashion;
-for example, it could use interrupts 3 and 1027 and yet allocate only a
-two-element array.  The driver is expected to fill in the 'entry' value
-in each element of the array to indicate for which entries the kernel
-should assign interrupts; it is invalid to fill in two entries with the
-same number.
-
-4.3.1 pci_enable_msix_range
-
-int pci_enable_msix_range(struct pci_dev *dev, struct msix_entry *entries,
-                          int minvec, int maxvec)
-
-Calling this function asks the PCI subsystem to allocate any number of
-MSI-X interrupts within specified range from 'minvec' to 'maxvec'.
-The 'entries' argument is a pointer to an array of msix_entry structs
-which should be at least 'maxvec' entries in size.
-
-On success, the device is switched into MSI-X mode and the function
-returns the number of MSI-X interrupts that have been successfully
-allocated.  In this case the 'vector' member in entries numbered from
-0 to the returned value - 1 is populated with the interrupt number;
-the driver should then call request_irq() for each 'vector' that it
-decides to use.  The device driver is responsible for keeping track of the
-interrupts assigned to the MSI-X vectors so it can free them again later.
-Device driver can use the returned number of successfully allocated MSI-X
-interrupts to further allocate and initialize device resources.
-
-If this function returns a negative number, it indicates an error and
-the driver should not attempt to allocate any more MSI-X interrupts for
-this device.
-
-This function, in contrast with pci_enable_msi_range(), does not adjust
-dev->irq.  The device will not generate interrupts for this interrupt
-number once MSI-X is enabled.
-
-Device drivers should normally call this function once per device
-during the initialization phase.
-
-It is ideal if drivers can cope with a variable number of MSI-X interrupts;
-there are many reasons why the platform may not be able to provide the
-exact number that a driver asks for.
-
-There could be devices that can not operate with just any number of MSI-X
-interrupts within a range.  E.g., an network adapter might need let's say
-four vectors per each queue it provides.  Therefore, a number of MSI-X
-interrupts allocated should be a multiple of four.  In this case interface
-pci_enable_msix_range() can not be used alone to request MSI-X interrupts
-(since it can allocate any number within the range, without any notion of
-the multiple of four) and the device driver should master a custom logic
-to request the required number of MSI-X interrupts.
-
-4.3.1.1 Maximum possible number of MSI-X interrupts
-
-The typical usage of MSI-X interrupts is to allocate as many vectors as
-possible, likely up to the limit returned by pci_msix_vec_count() function:
-
-static int foo_driver_enable_msix(struct foo_adapter *adapter, int nvec)
-{
-        return pci_enable_msix_range(adapter->pdev, adapter->msix_entries,
-                                     1, nvec);
-}
-
-Note the value of 'minvec' parameter is 1.  As 'minvec' is inclusive,
-the value of 0 would be meaningless and could result in error.
-
-Some devices have a minimal limit on number of MSI-X interrupts.
-In this case the function could look like this:
-
-static int foo_driver_enable_msix(struct foo_adapter *adapter, int nvec)
-{
-        return pci_enable_msix_range(adapter->pdev, adapter->msix_entries,
-                                     FOO_DRIVER_MINIMUM_NVEC, nvec);
-}
-
-4.3.1.2 Exact number of MSI-X interrupts
-
-If a driver is unable or unwilling to deal with a variable number of MSI-X
-interrupts it could request a particular number of interrupts by passing
-that number to pci_enable_msix_range() function as both 'minvec' and 'maxvec'
-parameters:
-
-static int foo_driver_enable_msix(struct foo_adapter *adapter, int nvec)
-{
-        return pci_enable_msix_range(adapter->pdev, adapter->msix_entries,
-                                     nvec, nvec);
-}
-
-Note, unlike pci_enable_msix_exact() function, which could be also used to
-enable a particular number of MSI-X interrupts, pci_enable_msix_range()
-returns either a negative errno or 'nvec' (not negative errno or 0 - as
-pci_enable_msix_exact() does).
-
-4.3.1.3 Specific requirements to the number of MSI-X interrupts
-
-As noted above, there could be devices that can not operate with just any
-number of MSI-X interrupts within a range.  E.g., let's assume a device that
-is only capable sending the number of MSI-X interrupts which is a power of
-two.  A routine that enables MSI-X mode for such device might look like this:
-
-/*
- * Assume 'minvec' and 'maxvec' are non-zero
- */
-static int foo_driver_enable_msix(struct foo_adapter *adapter,
-                                  int minvec, int maxvec)
-{
-        int rc;
-
-        minvec = roundup_pow_of_two(minvec);
-        maxvec = rounddown_pow_of_two(maxvec);
-
-        if (minvec > maxvec)
-                return -ERANGE;
-
-retry:
-        rc = pci_enable_msix_range(adapter->pdev, adapter->msix_entries,
-                                   maxvec, maxvec);
-        /*
-         * -ENOSPC is the only error code allowed to be analyzed
-         */
-        if (rc == -ENOSPC) {
-                if (maxvec == 1)
-                        return -ENOSPC;
-
-                maxvec /= 2;
-
-                if (minvec > maxvec)
-                        return -ENOSPC;
-
-                goto retry;
-        }
-
-        return rc;
-}
-
-Note how pci_enable_msix_range() return value is analyzed for a fallback -
-any error code other than -ENOSPC indicates a fatal error and should not
-be retried.
-
-4.3.2 pci_enable_msix_exact
-
-int pci_enable_msix_exact(struct pci_dev *dev,
-                          struct msix_entry *entries, int nvec)
-
-This variation on pci_enable_msix_range() call allows a device driver to
-request exactly 'nvec' MSI-Xs.
-
-If this function returns a negative number, it indicates an error and
-the driver should not attempt to allocate any more MSI-X interrupts for
-this device.
-
-By contrast with pci_enable_msix_range() function, pci_enable_msix_exact()
-returns zero in case of success, which indicates MSI-X interrupts have been
-successfully allocated.
-
-Another version of a routine that enables MSI-X mode for a device with
-specific requirements described in chapter 4.3.1.3 might look like this:
-
-/*
- * Assume 'minvec' and 'maxvec' are non-zero
- */
-static int foo_driver_enable_msix(struct foo_adapter *adapter,
-                                  int minvec, int maxvec)
-{
-        int rc;
-
-        minvec = roundup_pow_of_two(minvec);
-        maxvec = rounddown_pow_of_two(maxvec);
-
-        if (minvec > maxvec)
-                return -ERANGE;
-
-retry:
-        rc = pci_enable_msix_exact(adapter->pdev,
-                                   adapter->msix_entries, maxvec);
-
-        /*
-         * -ENOSPC is the only error code allowed to be analyzed
-         */
-        if (rc == -ENOSPC) {
-                if (maxvec == 1)
-                        return -ENOSPC;
-
-                maxvec /= 2;
-
-                if (minvec > maxvec)
-                        return -ENOSPC;
-
-                goto retry;
-        } else if (rc < 0) {
-                return rc;
-        }
-
-        return maxvec;
-}
-
-4.3.3 pci_disable_msix
-
-void pci_disable_msix(struct pci_dev *dev)
-
-This function should be used to undo the effect of pci_enable_msix_range().
-It frees the previously allocated MSI-X interrupts. The interrupts may
-subsequently be assigned to another device, so drivers should not cache
-the value of the 'vector' elements over a call to pci_disable_msix().
-
-Before calling this function, a device driver must always call free_irq()
-on any interrupt for which it previously called request_irq().
-Failure to do so results in a BUG_ON(), leaving the device with
-MSI-X enabled and thus leaking its vector.
-
-4.3.3 The MSI-X Table
-
-The MSI-X capability specifies a BAR and offset within that BAR for the
-MSI-X Table.  This address is mapped by the PCI subsystem, and should not
-be accessed directly by the device driver.  If the driver wishes to
-mask or unmask an interrupt, it should call disable_irq() / enable_irq().
+interrupts it can request a particular number of interrupts by passing that
+number to pci_alloc_irq_vectors() function as both 'min_vecs' and
+'max_vecs' parameters:
 
-4.3.4 pci_msix_vec_count
+        ret = pci_alloc_irq_vectors(pdev, nvec, nvec, 0);
+        if (ret < 0)
+                goto out_err;
 
-int pci_msix_vec_count(struct pci_dev *dev)
+The most notorious example of the request type described above is enabling
+the single MSI mode for a device.  It could be done by passing two 1s as
+'min_vecs' and 'max_vecs':
 
-This function could be used to retrieve number of entries in the device
-MSI-X table.
+        ret = pci_alloc_irq_vectors(pdev, 1, 1, 0);
+        if (ret < 0)
+                goto out_err;
 
-If this function returns a negative number, it indicates the device is
-not capable of sending MSI-Xs.
+Some devices might not support using legacy line interrupts, in which case
+the PCI_IRQ_NOLEGACY flag can be used to fail the request if the platform
+can't provide MSI or MSI-X interrupts:
 
-If this function returns a positive number, it indicates the maximum
-number of MSI-X interrupt vectors that could be allocated.
+        nvec = pci_alloc_irq_vectors(pdev, 1, nvec, PCI_IRQ_NOLEGACY);
+        if (nvec < 0)
+                goto out_err;
 
-4.4 Handling devices implementing both MSI and MSI-X capabilities
+4.3 Legacy APIs
 
-If a device implements both MSI and MSI-X capabilities, it can
-run in either MSI mode or MSI-X mode, but not both simultaneously.
-This is a requirement of the PCI spec, and it is enforced by the
-PCI layer.  Calling pci_enable_msi_range() when MSI-X is already
-enabled or pci_enable_msix_range() when MSI is already enabled
-results in an error.  If a device driver wishes to switch between MSI
-and MSI-X at runtime, it must first quiesce the device, then switch
-it back to pin-interrupt mode, before calling pci_enable_msi_range()
-or pci_enable_msix_range() and resuming operation.  This is not expected
-to be a common operation but may be useful for debugging or testing
-during development.
+The following old APIs to enable and disable MSI or MSI-X interrupts should
+not be used in new code:
 
-4.5 Considerations when using MSIs
+  pci_enable_msi()              /* deprecated */
+  pci_enable_msi_range()        /* deprecated */
+  pci_enable_msi_exact()        /* deprecated */
+  pci_disable_msi()             /* deprecated */
+  pci_enable_msix_range()       /* deprecated */
+  pci_enable_msix_exact()       /* deprecated */
+  pci_disable_msix()            /* deprecated */
 
-4.5.1 Choosing between MSI-X and MSI
+Additionally there are APIs to provide the number of supported MSI or MSI-X
+vectors: pci_msi_vec_count() and pci_msix_vec_count().  In general these
+should be avoided in favor of letting pci_alloc_irq_vectors() cap the
+number of vectors.  If you have a legitimate special use case for the count
+of vectors we might have to revisit that decision and add a
+pci_nr_irq_vectors() helper that handles MSI and MSI-X transparently.
 
-If your device supports both MSI-X and MSI capabilities, you should use
-the MSI-X facilities in preference to the MSI facilities.  As mentioned
-above, MSI-X supports any number of interrupts between 1 and 2048.
-In contrast, MSI is restricted to a maximum of 32 interrupts (and
-must be a power of two).  In addition, the MSI interrupt vectors must
-be allocated consecutively, so the system might not be able to allocate
-as many vectors for MSI as it could for MSI-X.  On some platforms, MSI
-interrupts must all be targeted at the same set of CPUs whereas MSI-X
-interrupts can all be targeted at different CPUs.
+4.4 Considerations when using MSIs
 
-4.5.2 Spinlocks
+4.4.1 Spinlocks
 
 Most device drivers have a per-device spinlock which is taken in the
 interrupt handler.  With pin-based interrupts or a single MSI, it is not
@@ -505,7 +194,7 @@ acquire the spinlock.  Such deadlocks can be avoided by using
 spin_lock_irqsave() or spin_lock_irq() which disable local interrupts
 and acquire the lock (see Documentation/DocBook/kernel-locking).
 
-4.6 How to tell whether MSI/MSI-X is enabled on a device
+4.5 How to tell whether MSI/MSI-X is enabled on a device
 
 Using 'lspci -v' (as root) may show some devices with "MSI", "Message
 Signalled Interrupts" or "MSI-X" capabilities.  Each of these capabilities
diff --git a/Documentation/devicetree/bindings/hwmon/ina2xx.txt b/Documentation/devicetree/bindings/hwmon/ina2xx.txt
index 9bcd5e87830d..02af0d94e921 100644
--- a/Documentation/devicetree/bindings/hwmon/ina2xx.txt
+++ b/Documentation/devicetree/bindings/hwmon/ina2xx.txt
@@ -7,6 +7,7 @@ Required properties:
         - "ti,ina220" for ina220
         - "ti,ina226" for ina226
         - "ti,ina230" for ina230
+        - "ti,ina231" for ina231
 - reg: I2C address
 
 Optional properties:
diff --git a/Documentation/devicetree/bindings/i2c/i2c-arb-gpio-challenge.txt b/Documentation/devicetree/bindings/i2c/i2c-arb-gpio-challenge.txt
index bfeabb843941..71191ff0e781 100644
--- a/Documentation/devicetree/bindings/i2c/i2c-arb-gpio-challenge.txt
+++ b/Documentation/devicetree/bindings/i2c/i2c-arb-gpio-challenge.txt
@@ -44,8 +44,8 @@ Required properties:
 - our-claim-gpio: The GPIO that we use to claim the bus.
 - their-claim-gpios: The GPIOs that the other sides use to claim the bus.
   Note that some implementations may only support a single other master.
-- Standard I2C mux properties. See mux.txt in this directory.
-- Single I2C child bus node at reg 0. See mux.txt in this directory.
+- Standard I2C mux properties. See i2c-mux.txt in this directory.
+- Single I2C child bus node at reg 0. See i2c-mux.txt in this directory.
 
 Optional properties:
 - slew-delay-us: microseconds to wait for a GPIO to go high. Default is 10 us.
diff --git a/Documentation/devicetree/bindings/i2c/i2c-demux-pinctrl.txt b/Documentation/devicetree/bindings/i2c/i2c-demux-pinctrl.txt
index 6078aefe7ed4..7ce23ac61308 100644
--- a/Documentation/devicetree/bindings/i2c/i2c-demux-pinctrl.txt
+++ b/Documentation/devicetree/bindings/i2c/i2c-demux-pinctrl.txt
@@ -27,7 +27,8 @@ Required properties:
 - i2c-bus-name: The name of this bus. Also needed as pinctrl-name for the I2C
                 parents.
 
-Furthermore, I2C mux properties and child nodes. See mux.txt in this directory.
+Furthermore, I2C mux properties and child nodes. See i2c-mux.txt in this
+directory.
 
 Example:
 
diff --git a/Documentation/devicetree/bindings/i2c/i2c-mux-gpio.txt b/Documentation/devicetree/bindings/i2c/i2c-mux-gpio.txt
index 66709a825541..21da3ecbb370 100644
--- a/Documentation/devicetree/bindings/i2c/i2c-mux-gpio.txt
+++ b/Documentation/devicetree/bindings/i2c/i2c-mux-gpio.txt
@@ -22,8 +22,8 @@ Required properties:
 - i2c-parent: The phandle of the I2C bus that this multiplexer's master-side
   port is connected to.
 - mux-gpios: list of gpios used to control the muxer
-* Standard I2C mux properties. See mux.txt in this directory.
-* I2C child bus nodes. See mux.txt in this directory.
+* Standard I2C mux properties. See i2c-mux.txt in this directory.
+* I2C child bus nodes. See i2c-mux.txt in this directory.
 
 Optional properties:
 - idle-state: value to set the muxer to when idle. When no value is
@@ -33,7 +33,7 @@ For each i2c child node, an I2C child bus will be created. They will
 be numbered based on their order in the device tree.
 
 Whenever an access is made to a device on a child bus, the value set
-in the revelant node's reg property will be output using the list of
+in the relevant node's reg property will be output using the list of
 GPIOs, the first in the list holding the least-significant value.
 
 If an idle state is defined, using the idle-state (optional) property,
diff --git a/Documentation/devicetree/bindings/i2c/i2c-mux-pinctrl.txt b/Documentation/devicetree/bindings/i2c/i2c-mux-pinctrl.txt
index ae8af1694e95..33119a98e144 100644
--- a/Documentation/devicetree/bindings/i2c/i2c-mux-pinctrl.txt
+++ b/Documentation/devicetree/bindings/i2c/i2c-mux-pinctrl.txt
@@ -28,9 +28,9 @@ Also required are:
 * Standard pinctrl properties that specify the pin mux state for each child
   bus. See ../pinctrl/pinctrl-bindings.txt.
 
-* Standard I2C mux properties. See mux.txt in this directory.
+* Standard I2C mux properties. See i2c-mux.txt in this directory.
 
-* I2C child bus nodes. See mux.txt in this directory.
+* I2C child bus nodes. See i2c-mux.txt in this directory.
 
 For each named state defined in the pinctrl-names property, an I2C child bus
 will be created. I2C child bus numbers are assigned based on the index into
diff --git a/Documentation/devicetree/bindings/i2c/i2c-mux-reg.txt b/Documentation/devicetree/bindings/i2c/i2c-mux-reg.txt
index 688783fbe696..de00d7fc450b 100644
--- a/Documentation/devicetree/bindings/i2c/i2c-mux-reg.txt
+++ b/Documentation/devicetree/bindings/i2c/i2c-mux-reg.txt
@@ -7,8 +7,8 @@ Required properties:
 - compatible: i2c-mux-reg
 - i2c-parent: The phandle of the I2C bus that this multiplexer's master-side
   port is connected to.
-* Standard I2C mux properties. See mux.txt in this directory.
-* I2C child bus nodes. See mux.txt in this directory.
+* Standard I2C mux properties. See i2c-mux.txt in this directory.
+* I2C child bus nodes. See i2c-mux.txt in this directory.
 
 Optional properties:
 - reg: this pair of <offset size> specifies the register to control the mux.
@@ -24,7 +24,7 @@ Optional properties:
   given, it defaults to the last value used.
 
 Whenever an access is made to a device on a child bus, the value set
-in the revelant node's reg property will be output to the register.
+in the relevant node's reg property will be output to the register.
 
 If an idle state is defined, using the idle-state (optional) property,
 whenever an access is not being made to a device on a child bus, the
diff --git a/Documentation/devicetree/bindings/net/marvell-bt-sd8xxx.txt b/Documentation/devicetree/bindings/net/marvell-bt-sd8xxx.txt
index 14aa6cf58201..6a9a63cb0543 100644
--- a/Documentation/devicetree/bindings/net/marvell-bt-sd8xxx.txt
+++ b/Documentation/devicetree/bindings/net/marvell-bt-sd8xxx.txt
@@ -13,10 +13,10 @@ Optional properties:
                       initialization. This is an array of 28 values(u8).
 
   - marvell,wakeup-pin: It represents wakeup pin number of the bluetooth chip.
-                        firmware will use the pin to wakeup host system.
+                        firmware will use the pin to wakeup host system (u16).
   - marvell,wakeup-gap-ms: wakeup gap represents wakeup latency of the host
                       platform. The value will be configured to firmware. This
-                      is needed to work chip's sleep feature as expected.
+                      is needed to work chip's sleep feature as expected (u16).
   - interrupt-parent: phandle of the parent interrupt controller
   - interrupts : interrupt pin number to the cpu. Driver will request an irq based
                  on this interrupt number. During system suspend, the irq will be
@@ -50,7 +50,7 @@ calibration data is also available in below example.
                         0x37 0x01 0x1c 0x00 0xff 0xff 0xff 0xff 0x01 0x7f 0x04 0x02
                         0x00 0x00 0xba 0xce 0xc0 0xc6 0x2d 0x00 0x00 0x00 0x00 0x00
                         0x00 0x00 0xf0 0x00>;
-                marvell,wakeup-pin = <0x0d>;
-                marvell,wakeup-gap-ms = <0x64>;
+                marvell,wakeup-pin = /bits/ 16 <0x0d>;
+                marvell,wakeup-gap-ms = /bits/ 16 <0x64>;
         };
 };
diff --git a/Documentation/devicetree/bindings/vendor-prefixes.txt b/Documentation/devicetree/bindings/vendor-prefixes.txt
index a7440bcd67ff..2c2500df0dce 100644
--- a/Documentation/devicetree/bindings/vendor-prefixes.txt
+++ b/Documentation/devicetree/bindings/vendor-prefixes.txt
@@ -255,6 +255,7 @@ synology	Synology, Inc.
 SUNW    Sun Microsystems, Inc
 tbs     TBS Technologies
 tcl     Toby Churchill Ltd.
+technexion      TechNexion
 technologic     Technologic Systems
 thine   THine Electronics, Inc.
 ti      Texas Instruments
@@ -269,6 +270,7 @@ tronsmart	Tronsmart
 truly   Truly Semiconductors Limited
 tyan    Tyan Computer Corporation
 upisemi uPI Semiconductor Corp.
+uniwest United Western Technologies Corp (UniWest)
 urt     United Radiant Technology Corporation
 usi     Universal Scientific Industrial Co., Ltd.
 v3      V3 Semiconductor
diff --git a/Documentation/leds/leds-class.txt b/Documentation/leds/leds-class.txt
index d406d98339b2..44f5e6bccd97 100644
--- a/Documentation/leds/leds-class.txt
+++ b/Documentation/leds/leds-class.txt
@@ -74,8 +74,8 @@ blink_set() function (see <linux/leds.h>). To set an LED to blinking,
 however, it is better to use the API function led_blink_set(), as it
 will check and implement software fallback if necessary.
 
-To turn off blinking again, use the API function led_brightness_set()
-as that will not just set the LED brightness but also stop any software
+To turn off blinking, use the API function led_brightness_set()
+with brightness value LED_OFF, which should stop any software
 timers that may have been required for blinking.
 
 The blink_set() function should choose a user friendly blinking value
diff --git a/Documentation/scsi/scsi_eh.txt b/Documentation/scsi/scsi_eh.txt
index 8638f61c8c9d..37eca00796ee 100644
--- a/Documentation/scsi/scsi_eh.txt
+++ b/Documentation/scsi/scsi_eh.txt
@@ -263,19 +263,23 @@ scmd->allowed.
 
  3. scmd recovered
     ACTION: scsi_eh_finish_cmd() is invoked to EH-finish scmd
-        - shost->host_failed--
         - clear scmd->eh_eflags
         - scsi_setup_cmd_retry()
         - move from local eh_work_q to local eh_done_q
     LOCKING: none
+    CONCURRENCY: at most one thread per separate eh_work_q to
+                 keep queue manipulation lockless
 
  4. EH completes
     ACTION: scsi_eh_flush_done_q() retries scmds or notifies upper
-            layer of failure.
+            layer of failure. May be called concurrently but must have
+            a no more than one thread per separate eh_work_q to
+            manipulate the queue locklessly
         - scmd is removed from eh_done_q and scmd->eh_entry is cleared
         - if retry is necessary, scmd is requeued using
           scsi_queue_insert()
         - otherwise, scsi_finish_command() is invoked for scmd
+        - zero shost->host_failed
     LOCKING: queue or finish function performs appropriate locking
 
 
diff --git a/MAINTAINERS b/MAINTAINERS
index b5aa111b0331..a4f32b5ee8f8 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -595,6 +595,10 @@ S:	Odd Fixes
 L:      linux-alpha@vger.kernel.org
 F:      arch/alpha/
 
+ALPS PS/2 TOUCHPAD DRIVER
+R:      Pali Rohár <pali.rohar@gmail.com>
+F:      drivers/input/mouse/alps.*
+
 ALTERA MAILBOX DRIVER
 M:      Ley Foon Tan <lftan@altera.com>
 L:      nios2-dev@lists.rocketboards.org (moderated for non-subscribers)
@@ -1159,6 +1163,7 @@ F:	arch/arm/mach-footbridge/
 ARM/FREESCALE IMX / MXC ARM ARCHITECTURE
 M:      Shawn Guo <shawnguo@kernel.org>
 M:      Sascha Hauer <kernel@pengutronix.de>
+R:      Fabio Estevam <fabio.estevam@nxp.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux.git
@@ -2242,7 +2247,8 @@ F:	include/net/ax25.h
 F:      net/ax25/
 
 AZ6007 DVB DRIVER
-M:      Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
+M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-media@vger.kernel.org
 W:      https://linuxtv.org
 T:      git git://linuxtv.org/media_tree.git
@@ -2709,7 +2715,8 @@ F:	Documentation/filesystems/btrfs.txt
 F:      fs/btrfs/
 
 BTTV VIDEO4LINUX DRIVER
-M:      Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
+M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-media@vger.kernel.org
 W:      https://linuxtv.org
 T:      git git://linuxtv.org/media_tree.git
@@ -2773,9 +2780,9 @@ F:	include/net/caif/
 F:      net/caif/
 
 CALGARY x86-64 IOMMU
-M:      Muli Ben-Yehuda <muli@il.ibm.com>
-M:      "Jon D. Mason" <jdmason@kudzu.us>
-L:      discuss@x86-64.org
+M:      Muli Ben-Yehuda <mulix@mulix.org>
+M:      Jon Mason <jdmason@kudzu.us>
+L:      iommu@lists.linux-foundation.org
 S:      Maintained
 F:      arch/x86/kernel/pci-calgary_64.c
 F:      arch/x86/kernel/tce_64.c
@@ -3086,6 +3093,7 @@ M:	Stephen Boyd <sboyd@codeaurora.org>
 L:      linux-clk@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux.git
 S:      Maintained
+F:      Documentation/devicetree/bindings/clock/
 F:      drivers/clk/
 X:      drivers/clk/clkdev.c
 F:      include/linux/clk-pr*
@@ -3343,7 +3351,8 @@ S:	Maintained
 F:      drivers/media/dvb-frontends/cx24120*
 
 CX88 VIDEO4LINUX DRIVER
-M:      Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
+M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-media@vger.kernel.org
 W:      https://linuxtv.org
 T:      git git://linuxtv.org/media_tree.git
@@ -3773,6 +3782,7 @@ Q:	https://patchwork.kernel.org/project/linux-dmaengine/list/
 S:      Maintained
 F:      drivers/dma/
 F:      include/linux/dmaengine.h
+F:      Documentation/devicetree/bindings/dma/
 F:      Documentation/dmaengine/
 T:      git git://git.infradead.org/users/vkoul/slave-dma.git
 
@@ -4290,7 +4300,8 @@ F:	fs/ecryptfs/
 EDAC-CORE
 M:      Doug Thompson <dougthompson@xmission.com>
 M:      Borislav Petkov <bp@alien8.de>
-M:      Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
+M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-edac@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp.git for-next
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-edac.git linux_next
@@ -4335,7 +4346,8 @@ S:	Maintained
 F:      drivers/edac/e7xxx_edac.c
 
 EDAC-GHES
-M:      Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
+M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-edac@vger.kernel.org
 S:      Maintained
 F:      drivers/edac/ghes_edac.c
@@ -4359,19 +4371,22 @@ S:	Maintained
 F:      drivers/edac/i5000_edac.c
 
 EDAC-I5400
-M:      Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
+M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-edac@vger.kernel.org
 S:      Maintained
 F:      drivers/edac/i5400_edac.c
 
 EDAC-I7300
-M:      Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
+M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-edac@vger.kernel.org
 S:      Maintained
 F:      drivers/edac/i7300_edac.c
 
 EDAC-I7CORE
-M:      Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
+M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-edac@vger.kernel.org
 S:      Maintained
 F:      drivers/edac/i7core_edac.c
@@ -4408,7 +4423,8 @@ S:	Maintained
 F:      drivers/edac/r82600_edac.c
 
 EDAC-SBRIDGE
-M:      Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
+M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-edac@vger.kernel.org
 S:      Maintained
 F:      drivers/edac/sb_edac.c
@@ -4467,7 +4483,8 @@ S:	Maintained
 F:      drivers/net/ethernet/ibm/ehea/
 
 EM28XX VIDEO4LINUX DRIVER
-M:      Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
+M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-media@vger.kernel.org
 W:      https://linuxtv.org
 T:      git git://linuxtv.org/media_tree.git
@@ -6486,6 +6503,7 @@ F:	include/uapi/linux/sunrpc/
 
 KERNEL SELFTEST FRAMEWORK
 M:      Shuah Khan <shuahkh@osg.samsung.com>
+M:      Shuah Khan <shuah@kernel.org>
 L:      linux-kselftest@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/shuah/linux-kselftest
 S:      Maintained
@@ -7357,7 +7375,8 @@ S:	Supported
 F:      drivers/media/pci/netup_unidvb/*
 
 MEDIA INPUT INFRASTRUCTURE (V4L/DVB)
-M:      Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
+M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 P:      LinuxTV.org Project
 L:      linux-media@vger.kernel.org
 W:      https://linuxtv.org
@@ -7405,7 +7424,7 @@ F:	drivers/scsi/megaraid.*
 F:      drivers/scsi/megaraid/
 
 MELLANOX ETHERNET DRIVER (mlx4_en)
-M:      Eugenia Emantayev <eugenia@mellanox.com>
+M:      Tariq Toukan <tariqt@mellanox.com>
 L:      netdev@vger.kernel.org
 S:      Supported
 W:      http://www.mellanox.com
@@ -8008,6 +8027,7 @@ Q:	http://patchwork.kernel.org/project/linux-wireless/list/
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers.git
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next.git
 S:      Maintained
+F:      Documentation/devicetree/bindings/net/wireless/
 F:      drivers/net/wireless/
 
 NETXEN (1/10) GbE SUPPORT
@@ -8405,10 +8425,9 @@ F:	drivers/i2c/busses/i2c-ocores.c
 OPEN FIRMWARE AND FLATTENED DEVICE TREE
 M:      Rob Herring <robh+dt@kernel.org>
 M:      Frank Rowand <frowand.list@gmail.com>
-M:      Grant Likely <grant.likely@linaro.org>
 L:      devicetree@vger.kernel.org
 W:      http://www.devicetree.org/
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/glikely/linux.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux.git
 S:      Maintained
 F:      drivers/of/
 F:      include/linux/of*.h
@@ -8416,12 +8435,10 @@ F:	scripts/dtc/
 
 OPEN FIRMWARE AND FLATTENED DEVICE TREE BINDINGS
 M:      Rob Herring <robh+dt@kernel.org>
-M:      Pawel Moll <pawel.moll@arm.com>
 M:      Mark Rutland <mark.rutland@arm.com>
-M:      Ian Campbell <ijc+devicetree@hellion.org.uk>
-M:      Kumar Gala <galak@codeaurora.org>
 L:      devicetree@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux.git
+Q:      http://patchwork.ozlabs.org/project/devicetree-bindings/list/
 S:      Maintained
 F:      Documentation/devicetree/
 F:      arch/*/boot/dts/
@@ -8963,6 +8980,7 @@ L:	linux-gpio@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl.git
 S:      Maintained
 F:      Documentation/devicetree/bindings/pinctrl/
+F:      Documentation/pinctrl.txt
 F:      drivers/pinctrl/
 F:      include/linux/pinctrl/
 
@@ -9870,7 +9888,8 @@ S:	Odd Fixes
 F:      drivers/media/i2c/saa6588*
 
 SAA7134 VIDEO4LINUX DRIVER
-M:      Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
+M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-media@vger.kernel.org
 W:      https://linuxtv.org
 T:      git git://linuxtv.org/media_tree.git
@@ -10389,7 +10408,8 @@ S:	Maintained
 F:      drivers/media/radio/si4713/radio-usb-si4713.c
 
 SIANO DVB DRIVER
-M:      Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
+M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-media@vger.kernel.org
 W:      https://linuxtv.org
 T:      git git://linuxtv.org/media_tree.git
@@ -11155,7 +11175,8 @@ S:	Maintained
 F:      drivers/media/i2c/tda9840*
 
 TEA5761 TUNER DRIVER
-M:      Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
+M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-media@vger.kernel.org
 W:      https://linuxtv.org
 T:      git git://linuxtv.org/media_tree.git
@@ -11163,7 +11184,8 @@ S:	Odd fixes
 F:      drivers/media/tuners/tea5761.*
 
 TEA5767 TUNER DRIVER
-M:      Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
+M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-media@vger.kernel.org
 W:      https://linuxtv.org
 T:      git git://linuxtv.org/media_tree.git
@@ -11550,7 +11572,8 @@ F:	include/linux/shmem_fs.h
 F:      mm/shmem.c
 
 TM6000 VIDEO4LINUX DRIVER
-M:      Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
+M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-media@vger.kernel.org
 W:      https://linuxtv.org
 T:      git git://linuxtv.org/media_tree.git
@@ -11904,7 +11927,8 @@ F:	drivers/usb/common/usb-otg-fsm.c
 
 USB OVER IP DRIVER
 M:      Valentina Manea <valentina.manea.m@gmail.com>
-M:      Shuah Khan <shuah.kh@samsung.com>
+M:      Shuah Khan <shuahkh@osg.samsung.com>
+M:      Shuah Khan <shuah@kernel.org>
 L:      linux-usb@vger.kernel.org
 S:      Maintained
 F:      Documentation/usb/usbip_protocol.txt
@@ -11975,6 +11999,7 @@ L:	linux-usb@vger.kernel.org
 W:      http://www.linux-usb.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
 S:      Supported
+F:      Documentation/devicetree/bindings/usb/
 F:      Documentation/usb/
 F:      drivers/usb/
 F:      include/linux/usb.h
@@ -12148,6 +12173,7 @@ VIRTIO CORE, NET AND BLOCK DRIVERS
 M:      "Michael S. Tsirkin" <mst@redhat.com>
 L:      virtualization@lists.linux-foundation.org
 S:      Maintained
+F:      Documentation/devicetree/bindings/virtio/
 F:      drivers/virtio/
 F:      tools/virtio/
 F:      drivers/net/virtio_net.c
@@ -12536,7 +12562,8 @@ S:	Maintained
 F:      arch/x86/entry/vdso/
 
 XC2028/3028 TUNER DRIVER
-M:      Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
+M:      Mauro Carvalho Chehab <mchehab@kernel.org>
 L:      linux-media@vger.kernel.org
 W:      https://linuxtv.org
 T:      git git://linuxtv.org/media_tree.git
diff --git a/Makefile b/Makefile
index 8d1301ab59fd..0d504893df6e 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 4
 PATCHLEVEL = 7
 SUBLEVEL = 0
-EXTRAVERSION = -rc2
+EXTRAVERSION = -rc6
 NAME = Psychotic Stoned Sheep
 
 # *DOCUMENTATION*
@@ -363,11 +363,13 @@ CHECK		= sparse
 
 CHECKFLAGS     := -D__linux__ -Dlinux -D__STDC__ -Dunix -D__unix__ \
                   -Wbitwise -Wno-return-void $(CF)
+NOSTDINC_FLAGS  =
 CFLAGS_MODULE   =
 AFLAGS_MODULE   =
 LDFLAGS_MODULE  =
 CFLAGS_KERNEL   =
 AFLAGS_KERNEL   =
+LDFLAGS_vmlinux =
 CFLAGS_GCOV     = -fprofile-arcs -ftest-coverage -fno-tree-loop-im -Wno-maybe-uninitialized
 CFLAGS_KCOV     = -fsanitize-coverage=trace-pc
 
diff --git a/arch/Kconfig b/arch/Kconfig
index d794384a0404..15996290fed4 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -226,8 +226,8 @@ config ARCH_INIT_TASK
 config ARCH_TASK_STRUCT_ALLOCATOR
         bool
 
-# Select if arch has its private alloc_thread_info() function
-config ARCH_THREAD_INFO_ALLOCATOR
+# Select if arch has its private alloc_thread_stack() function
+config ARCH_THREAD_STACK_ALLOCATOR
         bool
 
 # Select if arch wants to size task_struct dynamically via arch_task_struct_size:
@@ -606,6 +606,9 @@ config HAVE_ARCH_HASH
           file which provides platform-specific implementations of some
           functions in <linux/hash.h> or fs/namei.c.
 
+config ISA_BUS_API
+        def_bool ISA
+
 #
 # ABI hall of shame
 #
diff --git a/arch/alpha/include/asm/pgalloc.h b/arch/alpha/include/asm/pgalloc.h
index aab14a019c20..c2ebb6f36c9d 100644
--- a/arch/alpha/include/asm/pgalloc.h
+++ b/arch/alpha/include/asm/pgalloc.h
@@ -40,7 +40,7 @@ pgd_free(struct mm_struct *mm, pgd_t *pgd)
 static inline pmd_t *
 pmd_alloc_one(struct mm_struct *mm, unsigned long address)
 {
-        pmd_t *ret = (pmd_t *)__get_free_page(GFP_KERNEL|__GFP_REPEAT|__GFP_ZERO);
+        pmd_t *ret = (pmd_t *)__get_free_page(GFP_KERNEL|__GFP_ZERO);
         return ret;
 }
 
@@ -53,7 +53,7 @@ pmd_free(struct mm_struct *mm, pmd_t *pmd)
 static inline pte_t *
 pte_alloc_one_kernel(struct mm_struct *mm, unsigned long address)
 {
-        pte_t *pte = (pte_t *)__get_free_page(GFP_KERNEL|__GFP_REPEAT|__GFP_ZERO);
+        pte_t *pte = (pte_t *)__get_free_page(GFP_KERNEL|__GFP_ZERO);
         return pte;
 }
 
diff --git a/arch/arc/Kconfig b/arch/arc/Kconfig
index 0dcbacfdea4b..0d3e59f56974 100644
--- a/arch/arc/Kconfig
+++ b/arch/arc/Kconfig
@@ -61,7 +61,7 @@ config RWSEM_GENERIC_SPINLOCK
         def_bool y
 
 config ARCH_DISCONTIGMEM_ENABLE
-        def_bool y
+        def_bool n
 
 config ARCH_FLATMEM_ENABLE
         def_bool y
@@ -186,9 +186,6 @@ if SMP
 config ARC_HAS_COH_CACHES
         def_bool n
 
-config ARC_HAS_REENTRANT_IRQ_LV2
-        def_bool n
-
 config ARC_MCIP
         bool "ARConnect Multicore IP (MCIP) Support "
         depends on ISA_ARCV2
@@ -366,25 +363,10 @@ config NODES_SHIFT
 if ISA_ARCOMPACT
 
 config ARC_COMPACT_IRQ_LEVELS
-        bool "ARCompact IRQ Priorities: High(2)/Low(1)"
+        bool "Setup Timer IRQ as high Priority"
         default n
-        # Timer HAS to be high priority, for any other high priority config
-        select ARC_IRQ3_LV2
         # if SMP, LV2 enabled ONLY if ARC implementation has LV2 re-entrancy
-        depends on !SMP || ARC_HAS_REENTRANT_IRQ_LV2
-
-if ARC_COMPACT_IRQ_LEVELS
-
-config ARC_IRQ3_LV2
-        bool
-
-config ARC_IRQ5_LV2
-        bool
-
-config ARC_IRQ6_LV2
-        bool
-
-endif   #ARC_COMPACT_IRQ_LEVELS
+        depends on !SMP
 
 config ARC_FPU_SAVE_RESTORE
         bool "Enable FPU state persistence across context switch"
@@ -407,11 +389,6 @@ config ARC_HAS_LLSC
         default y
         depends on !ARC_CANT_LLSC
 
-config ARC_STAR_9000923308
-        bool "Workaround for llock/scond livelock"
-        default n
-        depends on ISA_ARCV2 && SMP && ARC_HAS_LLSC
-
 config ARC_HAS_SWAPE
         bool "Insn: SWAPE (endian-swap)"
         default y
@@ -471,7 +448,7 @@ config LINUX_LINK_BASE
 
 config HIGHMEM
         bool "High Memory Support"
-        select DISCONTIGMEM
+        select ARCH_DISCONTIGMEM_ENABLE
         help
           With ARC 2G:2G address split, only upper 2G is directly addressable by
           kernel. Enable this to potentially allow access to rest of 2G and PAE
diff --git a/arch/arc/Makefile b/arch/arc/Makefile
index 02fabef2891c..85814e74677d 100644
--- a/arch/arc/Makefile
+++ b/arch/arc/Makefile
@@ -66,8 +66,6 @@ endif
 
 endif
 
-cflags-$(CONFIG_ARC_DW2_UNWIND)         += -fasynchronous-unwind-tables
-
 # By default gcc 4.8 generates dwarf4 which kernel unwinder can't grok
 ifeq ($(atleast_gcc48),y)
 cflags-$(CONFIG_ARC_DW2_UNWIND)         += -gdwarf-2
@@ -127,7 +125,7 @@ libs-y		+= arch/arc/lib/ $(LIBGCC)
 
 boot            := arch/arc/boot
 
-#default target for make without any arguements.
+#default target for make without any arguments.
 KBUILD_IMAGE    := bootpImage
 
 all:    $(KBUILD_IMAGE)
diff --git a/arch/arc/boot/dts/abilis_tb100.dtsi b/arch/arc/boot/dts/abilis_tb100.dtsi
index 3942634f805a..02410b211433 100644
--- a/arch/arc/boot/dts/abilis_tb100.dtsi
+++ b/arch/arc/boot/dts/abilis_tb100.dtsi
@@ -23,8 +23,6 @@
 
 
 / {
-        clock-frequency         = <500000000>;  /* 500 MHZ */
-
         soc100 {
                 bus-frequency   = <166666666>;
 
diff --git a/arch/arc/boot/dts/abilis_tb101.dtsi b/arch/arc/boot/dts/abilis_tb101.dtsi
index b0467229a5c4..f9e7686044eb 100644
--- a/arch/arc/boot/dts/abilis_tb101.dtsi
+++ b/arch/arc/boot/dts/abilis_tb101.dtsi
@@ -23,8 +23,6 @@
 
 
 / {
-        clock-frequency         = <500000000>;  /* 500 MHZ */
-
         soc100 {
                 bus-frequency   = <166666666>;
 
diff --git a/arch/arc/boot/dts/axc001.dtsi b/arch/arc/boot/dts/axc001.dtsi
index 3e02f152edcb..6ae2c476ad82 100644
--- a/arch/arc/boot/dts/axc001.dtsi
+++ b/arch/arc/boot/dts/axc001.dtsi
@@ -15,7 +15,6 @@
 
 / {
         compatible = "snps,arc";
-        clock-frequency = <750000000>;  /* 750 MHZ */
         #address-cells = <1>;
         #size-cells = <1>;
 
diff --git a/arch/arc/boot/dts/axc003.dtsi b/arch/arc/boot/dts/axc003.dtsi
index 378e455a94c4..14df46f141bf 100644
--- a/arch/arc/boot/dts/axc003.dtsi
+++ b/arch/arc/boot/dts/axc003.dtsi
@@ -14,7 +14,6 @@
 
 / {
         compatible = "snps,arc";
-        clock-frequency = <90000000>;
         #address-cells = <1>;
         #size-cells = <1>;
 
diff --git a/arch/arc/boot/dts/axc003_idu.dtsi b/arch/arc/boot/dts/axc003_idu.dtsi
index 64c94b2860ab..3d6cfa32bf51 100644
--- a/arch/arc/boot/dts/axc003_idu.dtsi
+++ b/arch/arc/boot/dts/axc003_idu.dtsi
@@ -14,7 +14,6 @@
 
 / {
         compatible = "snps,arc";
-        clock-frequency = <90000000>;
         #address-cells = <1>;
         #size-cells = <1>;
 
diff --git a/arch/arc/boot/dts/eznps.dts b/arch/arc/boot/dts/eznps.dts
index b89f6c3eb352..1e0d225791c1 100644
--- a/arch/arc/boot/dts/eznps.dts
+++ b/arch/arc/boot/dts/eznps.dts
@@ -18,7 +18,6 @@
 
 / {
         compatible = "ezchip,arc-nps";
-        clock-frequency = <83333333>;   /* 83.333333 MHZ */
         #address-cells = <1>;
         #size-cells = <1>;
         interrupt-parent = <&intc>;
diff --git a/arch/arc/boot/dts/nsim_700.dts b/arch/arc/boot/dts/nsim_700.dts
index 5d5e373e0ebc..63970513e4ae 100644
--- a/arch/arc/boot/dts/nsim_700.dts
+++ b/arch/arc/boot/dts/nsim_700.dts
@@ -11,7 +11,6 @@
 
 / {
         compatible = "snps,nsim";
-        clock-frequency = <80000000>;   /* 80 MHZ */
         #address-cells = <1>;
         #size-cells = <1>;
         interrupt-parent = <&core_intc>;
diff --git a/arch/arc/boot/dts/nsimosci.dts b/arch/arc/boot/dts/nsimosci.dts
index b5b060adce8a..763d66c883da 100644
--- a/arch/arc/boot/dts/nsimosci.dts
+++ b/arch/arc/boot/dts/nsimosci.dts
@@ -11,7 +11,6 @@
 
 / {
         compatible = "snps,nsimosci";
-        clock-frequency = <20000000>;   /* 20 MHZ */
         #address-cells = <1>;
         #size-cells = <1>;
         interrupt-parent = <&core_intc>;
diff --git a/arch/arc/boot/dts/nsimosci_hs.dts b/arch/arc/boot/dts/nsimosci_hs.dts
index 325e73090a18..4eb97c584b18 100644
--- a/arch/arc/boot/dts/nsimosci_hs.dts
+++ b/arch/arc/boot/dts/nsimosci_hs.dts
@@ -11,7 +11,6 @@
 
 / {
         compatible = "snps,nsimosci_hs";
-        clock-frequency = <20000000>;   /* 20 MHZ */
         #address-cells = <1>;
         #size-cells = <1>;
         interrupt-parent = <&core_intc>;
diff --git a/arch/arc/boot/dts/nsimosci_hs_idu.dts b/arch/arc/boot/dts/nsimosci_hs_idu.dts
index ee03d7126581..853f897eb2a3 100644
--- a/arch/arc/boot/dts/nsimosci_hs_idu.dts
+++ b/arch/arc/boot/dts/nsimosci_hs_idu.dts
@@ -11,7 +11,6 @@
 
 / {
         compatible = "snps,nsimosci_hs";
-        clock-frequency = <5000000>;    /* 5 MHZ */
         #address-cells = <1>;
         #size-cells = <1>;
         interrupt-parent = <&core_intc>;
diff --git a/arch/arc/boot/dts/skeleton.dtsi b/arch/arc/boot/dts/skeleton.dtsi
index 3a10cc633e2b..65808fe0a290 100644
--- a/arch/arc/boot/dts/skeleton.dtsi
+++ b/arch/arc/boot/dts/skeleton.dtsi
@@ -13,7 +13,6 @@
 
 / {
         compatible = "snps,arc";
-        clock-frequency = <80000000>;   /* 80 MHZ */
         #address-cells = <1>;
         #size-cells = <1>;
         chosen { };
diff --git a/arch/arc/boot/dts/skeleton_hs.dtsi b/arch/arc/boot/dts/skeleton_hs.dtsi
index 71fd308a9298..2dfe8037dfbb 100644
--- a/arch/arc/boot/dts/skeleton_hs.dtsi
+++ b/arch/arc/boot/dts/skeleton_hs.dtsi
@@ -8,7 +8,6 @@
 
 / {
         compatible = "snps,arc";
-        clock-frequency = <80000000>;   /* 80 MHZ */
         #address-cells = <1>;
         #size-cells = <1>;
         chosen { };
diff --git a/arch/arc/boot/dts/skeleton_hs_idu.dtsi b/arch/arc/boot/dts/skeleton_hs_idu.dtsi
index d1cb25a66989..4c11079f3565 100644
--- a/arch/arc/boot/dts/skeleton_hs_idu.dtsi
+++ b/arch/arc/boot/dts/skeleton_hs_idu.dtsi
@@ -8,7 +8,6 @@
 
 / {
         compatible = "snps,arc";
-        clock-frequency = <80000000>;   /* 80 MHZ */
         #address-cells = <1>;
         #size-cells = <1>;
         chosen { };
diff --git a/arch/arc/boot/dts/vdk_axc003.dtsi b/arch/arc/boot/dts/vdk_axc003.dtsi
index ad4ee43bd2ac..0fd6ba985b16 100644
--- a/arch/arc/boot/dts/vdk_axc003.dtsi
+++ b/arch/arc/boot/dts/vdk_axc003.dtsi
@@ -14,7 +14,6 @@
 
 / {
         compatible = "snps,arc";
-        clock-frequency = <50000000>;
         #address-cells = <1>;
         #size-cells = <1>;
 
diff --git a/arch/arc/boot/dts/vdk_axc003_idu.dtsi b/arch/arc/boot/dts/vdk_axc003_idu.dtsi
index a3cb6263c581..82214cd7ba0c 100644
--- a/arch/arc/boot/dts/vdk_axc003_idu.dtsi
+++ b/arch/arc/boot/dts/vdk_axc003_idu.dtsi
@@ -15,7 +15,6 @@
 
 / {
         compatible = "snps,arc";
-        clock-frequency = <50000000>;
         #address-cells = <1>;
         #size-cells = <1>;
 
diff --git a/arch/arc/include/asm/atomic.h b/arch/arc/include/asm/atomic.h
index 5f3dcbbc0cc9..dd683995bc9d 100644
--- a/arch/arc/include/asm/atomic.h
+++ b/arch/arc/include/asm/atomic.h
@@ -25,50 +25,17 @@
 
 #define atomic_set(v, i) WRITE_ONCE(((v)->counter), (i))
 
-#ifdef CONFIG_ARC_STAR_9000923308
-
-#define SCOND_FAIL_RETRY_VAR_DEF                                                \
-        unsigned int delay = 1, tmp;                                            \
-
-#define SCOND_FAIL_RETRY_ASM                                                    \
-        "       bz      4f                      \n"                             \
-        "   ; --- scond fail delay ---          \n"                             \
-        "       mov     %[tmp], %[delay]        \n"     /* tmp = delay */       \
-        "2:     brne.d  %[tmp], 0, 2b           \n"     /* while (tmp != 0) */  \
-        "       sub     %[tmp], %[tmp], 1       \n"     /* tmp-- */             \
-        "       rol     %[delay], %[delay]      \n"     /* delay *= 2 */        \
-        "       b       1b                      \n"     /* start over */        \
-        "4: ; --- success ---                   \n"                             \
-
-#define SCOND_FAIL_RETRY_VARS                                                   \
-          ,[delay] "+&r" (delay),[tmp] "=&r"    (tmp)                           \
-
-#else   /* !CONFIG_ARC_STAR_9000923308 */
-
-#define SCOND_FAIL_RETRY_VAR_DEF
-
-#define SCOND_FAIL_RETRY_ASM                                                    \
-        "       bnz     1b                      \n"                             \
-
-#define SCOND_FAIL_RETRY_VARS
-
-#endif
-
 #define ATOMIC_OP(op, c_op, asm_op)                                     \
 static inline void atomic_##op(int i, atomic_t *v)                      \
 {                                                                       \
-        unsigned int val;                                               \
-        SCOND_FAIL_RETRY_VAR_DEF                                        \
+        unsigned int val;                                               \
                                                                         \
         __asm__ __volatile__(                                           \
         "1:     llock   %[val], [%[ctr]]                \n"             \
         "       " #asm_op " %[val], %[val], %[i]        \n"             \
         "       scond   %[val], [%[ctr]]                \n"             \
-        "                                               \n"             \
-        SCOND_FAIL_RETRY_ASM                                            \
-                                                                        \
+        "       bnz     1b                              \n"             \
         : [val] "=&r"   (val) /* Early clobber to prevent reg reuse */  \
-          SCOND_FAIL_RETRY_VARS                                         \
         : [ctr] "r"     (&v->counter), /* Not "m": llock only supports reg direct addr mode */  \
           [i]   "ir"    (i)                                             \
         : "cc");                                                        \
@@ -77,8 +44,7 @@ static inline void atomic_##op(int i, atomic_t *v)			\
 #define ATOMIC_OP_RETURN(op, c_op, asm_op)                              \
 static inline int atomic_##op##_return(int i, atomic_t *v)              \
 {                                                                       \
-        unsigned int val;                                               \
-        SCOND_FAIL_RETRY_VAR_DEF                                        \
+        unsigned int val;                                               \
                                                                         \
         /*                                                              \
          * Explicit full memory barrier needed before/after as          \
@@ -90,11 +56,8 @@ static inline int atomic_##op##_return(int i, atomic_t *v)		\
         "1:     llock   %[val], [%[ctr]]                \n"             \
         "       " #asm_op " %[val], %[val], %[i]        \n"             \
         "       scond   %[val], [%[ctr]]                \n"             \
-        "                                               \n"             \
-        SCOND_FAIL_RETRY_ASM                                            \
-                                                                        \
+        "       bnz     1b                              \n"             \
         : [val] "=&r"   (val)                                           \
-          SCOND_FAIL_RETRY_VARS                                         \
         : [ctr] "r"     (&v->counter),                                  \
           [i]   "ir"    (i)                                             \
         : "cc");                                                        \
diff --git a/arch/arc/include/asm/entry-compact.h b/arch/arc/include/asm/entry-compact.h
index e0e1faf03c50..14c310f2e0b1 100644
--- a/arch/arc/include/asm/entry-compact.h
+++ b/arch/arc/include/asm/entry-compact.h
@@ -76,8 +76,8 @@
          * We need to be a bit more cautious here. What if a kernel bug in
          * L1 ISR, caused SP to go whaco (some small value which looks like
          * USER stk) and then we take L2 ISR.
-         * Above brlo alone would treat it as a valid L1-L2 sceanrio
-         * instead of shouting alound
+         * Above brlo alone would treat it as a valid L1-L2 scenario
+         * instead of shouting around
          * The only feasible way is to make sure this L2 happened in
          * L1 prelogue ONLY i.e. ilink2 is less than a pre-set marker in
          * L1 ISR before it switches stack
diff --git a/arch/arc/include/asm/mmu_context.h b/arch/arc/include/asm/mmu_context.h
index 1fd467ef658f..b0b87f2447f5 100644
--- a/arch/arc/include/asm/mmu_context.h
+++ b/arch/arc/include/asm/mmu_context.h
@@ -83,7 +83,7 @@ static inline void get_new_mmu_context(struct mm_struct *mm)
                 local_flush_tlb_all();
 
                 /*
-                 * Above checke for rollover of 8 bit ASID in 32 bit container.
+                 * Above check for rollover of 8 bit ASID in 32 bit container.
                  * If the container itself wrapped around, set it to a non zero
                  * "generation" to distinguish from no context
                  */
diff --git a/arch/arc/include/asm/pgalloc.h b/arch/arc/include/asm/pgalloc.h
index 86ed671286df..3749234b7419 100644
--- a/arch/arc/include/asm/pgalloc.h
+++ b/arch/arc/include/asm/pgalloc.h
@@ -95,7 +95,7 @@ static inline pte_t *pte_alloc_one_kernel(struct mm_struct *mm,
 {
         pte_t *pte;
 
-        pte = (pte_t *) __get_free_pages(GFP_KERNEL | __GFP_REPEAT | __GFP_ZERO,
+        pte = (pte_t *) __get_free_pages(GFP_KERNEL | __GFP_ZERO,
                                          __get_order_pte());
 
         return pte;
@@ -107,7 +107,7 @@ pte_alloc_one(struct mm_struct *mm, unsigned long address)
         pgtable_t pte_pg;
         struct page *page;
 
-        pte_pg = (pgtable_t)__get_free_pages(GFP_KERNEL | __GFP_REPEAT, __get_order_pte());
+        pte_pg = (pgtable_t)__get_free_pages(GFP_KERNEL, __get_order_pte());
         if (!pte_pg)
                 return 0;
         memzero((void *)pte_pg, PTRS_PER_PTE * sizeof(pte_t));
diff --git a/arch/arc/include/asm/pgtable.h b/arch/arc/include/asm/pgtable.h
index 034bbdc0ff61..858f98ef7f1b 100644
--- a/arch/arc/include/asm/pgtable.h
+++ b/arch/arc/include/asm/pgtable.h
@@ -47,7 +47,7 @@
  * Page Tables are purely for Linux VM's consumption and the bits below are
  * suited to that (uniqueness). Hence some are not implemented in the TLB and
  * some have different value in TLB.
- * e.g. MMU v2: K_READ bit is 8 and so is GLOBAL (possible becoz they live in
+ * e.g. MMU v2: K_READ bit is 8 and so is GLOBAL (possible because they live in
  *      seperate PD0 and PD1, which combined forms a translation entry)
  *      while for PTE perspective, they are 8 and 9 respectively
  * with MMU v3: Most bits (except SHARED) represent the exact hardware pos
diff --git a/arch/arc/include/asm/processor.h b/arch/arc/include/asm/processor.h
index f9048994b22f..16b630fbeb6a 100644
--- a/arch/arc/include/asm/processor.h
+++ b/arch/arc/include/asm/processor.h
@@ -78,7 +78,7 @@ struct task_struct;
 #define KSTK_ESP(tsk)   (task_pt_regs(tsk)->sp)
 
 /*
- * Where abouts of Task's sp, fp, blink when it was last seen in kernel mode.
+ * Where about of Task's sp, fp, blink when it was last seen in kernel mode.
  * Look in process.c for details of kernel stack layout
  */
 #define TSK_K_ESP(tsk)          (tsk->thread.ksp)
diff --git a/arch/arc/include/asm/smp.h b/arch/arc/include/asm/smp.h
index 991380438d6b..89fdd1b0a76e 100644
--- a/arch/arc/include/asm/smp.h
+++ b/arch/arc/include/asm/smp.h
@@ -86,7 +86,7 @@ static inline const char *arc_platform_smp_cpuinfo(void)
  * (1) These insn were introduced only in 4.10 release. So for older released
  *      support needed.
  *
- * (2) In a SMP setup, the LLOCK/SCOND atomiticity across CPUs needs to be
+ * (2) In a SMP setup, the LLOCK/SCOND atomicity across CPUs needs to be
  *      gaurantted by the platform (not something which core handles).
  *      Assuming a platform won't, SMP Linux needs to use spinlocks + local IRQ
  *      disabling for atomicity.
diff --git a/arch/arc/include/asm/spinlock.h b/arch/arc/include/asm/spinlock.h
index 800e7c430ca5..cded4a9b5438 100644
--- a/arch/arc/include/asm/spinlock.h
+++ b/arch/arc/include/asm/spinlock.h
@@ -20,11 +20,6 @@
 
 #ifdef CONFIG_ARC_HAS_LLSC
 
-/*
- * A normal LLOCK/SCOND based system, w/o need for livelock workaround
- */
-#ifndef CONFIG_ARC_STAR_9000923308
-
 static inline void arch_spin_lock(arch_spinlock_t *lock)
 {
         unsigned int val;
@@ -238,293 +233,6 @@ static inline void arch_write_unlock(arch_rwlock_t *rw)
         smp_mb();
 }
 
-#else   /* CONFIG_ARC_STAR_9000923308 */
-
-/*
- * HS38x4 could get into a LLOCK/SCOND livelock in case of multiple overlapping
- * coherency transactions in the SCU. The exclusive line state keeps rotating
- * among contenting cores leading to a never ending cycle. So break the cycle
- * by deferring the retry of failed exclusive access (SCOND). The actual delay
- * needed is function of number of contending cores as well as the unrelated
- * coherency traffic from other cores. To keep the code simple, start off with
- * small delay of 1 which would suffice most cases and in case of contention
- * double the delay. Eventually the delay is sufficient such that the coherency
- * pipeline is drained, thus a subsequent exclusive access would succeed.
- */
-
-#define SCOND_FAIL_RETRY_VAR_DEF                                                \
-        unsigned int delay, tmp;                                                \
-
-#define SCOND_FAIL_RETRY_ASM                                                    \
-        "   ; --- scond fail delay ---          \n"                             \
-        "       mov     %[tmp], %[delay]        \n"     /* tmp = delay */       \
-        "2:     brne.d  %[tmp], 0, 2b           \n"     /* while (tmp != 0) */  \
-        "       sub     %[tmp], %[tmp], 1       \n"     /* tmp-- */             \
-        "       rol     %[delay], %[delay]      \n"     /* delay *= 2 */        \
-        "       b       1b                      \n"     /* start over */        \
-        "                                       \n"                             \
-        "4: ; --- done ---                      \n"                             \
-
-#define SCOND_FAIL_RETRY_VARS                                                   \
-          ,[delay] "=&r" (delay), [tmp] "=&r"   (tmp)                           \
-
-static inline void arch_spin_lock(arch_spinlock_t *lock)
-{
-        unsigned int val;
-        SCOND_FAIL_RETRY_VAR_DEF;
-
-        smp_mb();
-
-        __asm__ __volatile__(
-        "0:     mov     %[delay], 1             \n"
-        "1:     llock   %[val], [%[slock]]      \n"
-        "       breq    %[val], %[LOCKED], 0b   \n"     /* spin while LOCKED */
-        "       scond   %[LOCKED], [%[slock]]   \n"     /* acquire */
-        "       bz      4f                      \n"     /* done */
-        "                                       \n"
-        SCOND_FAIL_RETRY_ASM
-
-        : [val]         "=&r"   (val)
-          SCOND_FAIL_RETRY_VARS
-        : [slock]       "r"     (&(lock->slock)),
-          [LOCKED]      "r"     (__ARCH_SPIN_LOCK_LOCKED__)
-        : "memory", "cc");
-
-        smp_mb();
-}
-
-/* 1 - lock taken successfully */
-static inline int arch_spin_trylock(arch_spinlock_t *lock)
-{
-        unsigned int val, got_it = 0;
-        SCOND_FAIL_RETRY_VAR_DEF;
-
-        smp_mb();
-
-        __asm__ __volatile__(
-        "0:     mov     %[delay], 1             \n"
-        "1:     llock   %[val], [%[slock]]      \n"
-        "       breq    %[val], %[LOCKED], 4f   \n"     /* already LOCKED, just bail */
-        "       scond   %[LOCKED], [%[slock]]   \n"     /* acquire */
-        "       bz.d    4f                      \n"
-        "       mov.z   %[got_it], 1            \n"     /* got it */
-        "                                       \n"
-        SCOND_FAIL_RETRY_ASM
-
-        : [val]         "=&r"   (val),
-          [got_it]      "+&r"   (got_it)
-          SCOND_FAIL_RETRY_VARS
-        : [slock]       "r"     (&(lock->slock)),
-          [LOCKED]      "r"     (__ARCH_SPIN_LOCK_LOCKED__)
-        : "memory", "cc");
-
-        smp_mb();
-
-        return got_it;
-}
-
-static inline void arch_spin_unlock(arch_spinlock_t *lock)
-{
-        smp_mb();
-
-        lock->slock = __ARCH_SPIN_LOCK_UNLOCKED__;
-
-        smp_mb();
-}
-
-/*
- * Read-write spinlocks, allowing multiple readers but only one writer.
- * Unfair locking as Writers could be starved indefinitely by Reader(s)
- */
-
-static inline void arch_read_lock(arch_rwlock_t *rw)
-{
-        unsigned int val;
-        SCOND_FAIL_RETRY_VAR_DEF;
-
-        smp_mb();
-
-        /*
-         * zero means writer holds the lock exclusively, deny Reader.
-         * Otherwise grant lock to first/subseq reader
-         *
-         *      if (rw->counter > 0) {
-         *              rw->counter--;
-         *              ret = 1;
-         *      }
-         */
-
-        __asm__ __volatile__(
-        "0:     mov     %[delay], 1             \n"
-        "1:     llock   %[val], [%[rwlock]]     \n"
-        "       brls    %[val], %[WR_LOCKED], 0b\n"     /* <= 0: spin while write locked */
-        "       sub     %[val], %[val], 1       \n"     /* reader lock */
-        "       scond   %[val], [%[rwlock]]     \n"
-        "       bz      4f                      \n"     /* done */
-        "                                       \n"
-        SCOND_FAIL_RETRY_ASM
-
-        : [val]         "=&r"   (val)
-          SCOND_FAIL_RETRY_VARS
-        : [rwlock]      "r"     (&(rw->counter)),
-          [WR_LOCKED]   "ir"    (0)
-        : "memory", "cc");
-
-        smp_mb();
-}
-
-/* 1 - lock taken successfully */
-static inline int arch_read_trylock(arch_rwlock_t *rw)
-{
-        unsigned int val, got_it = 0;
-        SCOND_FAIL_RETRY_VAR_DEF;
-
-        smp_mb();
-
-        __asm__ __volatile__(
-        "0:     mov     %[delay], 1             \n"
-        "1:     llock   %[val], [%[rwlock]]     \n"
-        "       brls    %[val], %[WR_LOCKED], 4f\n"     /* <= 0: already write locked, bail */
-        "       sub     %[val], %[val], 1       \n"     /* counter-- */
-        "       scond   %[val], [%[rwlock]]     \n"
-        "       bz.d    4f                      \n"
-        "       mov.z   %[got_it], 1            \n"     /* got it */
-        "                                       \n"
-        SCOND_FAIL_RETRY_ASM
-
-        : [val]         "=&r"   (val),
-          [got_it]      "+&r"   (got_it)
-          SCOND_FAIL_RETRY_VARS
-        : [rwlock]      "r"     (&(rw->counter)),
-          [WR_LOCKED]   "ir"    (0)
-        : "memory", "cc");
-
-        smp_mb();
-
-        return got_it;
-}
-
-static inline void arch_write_lock(arch_rwlock_t *rw)
-{
-        unsigned int val;
-        SCOND_FAIL_RETRY_VAR_DEF;
-
-        smp_mb();
-
-        /*
-         * If reader(s) hold lock (lock < __ARCH_RW_LOCK_UNLOCKED__),
-         * deny writer. Otherwise if unlocked grant to writer
-         * Hence the claim that Linux rwlocks are unfair to writers.
-         * (can be starved for an indefinite time by readers).
-         *
-         *      if (rw->counter == __ARCH_RW_LOCK_UNLOCKED__) {
-         *              rw->counter = 0;
-         *              ret = 1;
-         *      }
-         */
-
-        __asm__ __volatile__(
-        "0:     mov     %[delay], 1             \n"
-        "1:     llock   %[val], [%[rwlock]]     \n"
-        "       brne    %[val], %[UNLOCKED], 0b \n"     /* while !UNLOCKED spin */
-        "       mov     %[val], %[WR_LOCKED]    \n"
-        "       scond   %[val], [%[rwlock]]     \n"
-        "       bz      4f                      \n"
-        "                                       \n"
-        SCOND_FAIL_RETRY_ASM
-
-        : [val]         "=&r"   (val)
-          SCOND_FAIL_RETRY_VARS
-        : [rwlock]      "r"     (&(rw->counter)),
-          [UNLOCKED]    "ir"    (__ARCH_RW_LOCK_UNLOCKED__),
-          [WR_LOCKED]   "ir"    (0)
-        : "memory", "cc");
-
-        smp_mb();
-}
-
-/* 1 - lock taken successfully */
-static inline int arch_write_trylock(arch_rwlock_t *rw)
-{
-        unsigned int val, got_it = 0;
-        SCOND_FAIL_RETRY_VAR_DEF;
-
-        smp_mb();
-
-        __asm__ __volatile__(
-        "0:     mov     %[delay], 1             \n"
-        "1:     llock   %[val], [%[rwlock]]     \n"
-        "       brne    %[val], %[UNLOCKED], 4f \n"     /* !UNLOCKED, bail */
-        "       mov     %[val], %[WR_LOCKED]    \n"
-        "       scond   %[val], [%[rwlock]]     \n"
-        "       bz.d    4f                      \n"
-        "       mov.z   %[got_it], 1            \n"     /* got it */
-        "                                       \n"
-        SCOND_FAIL_RETRY_ASM
-
-        : [val]         "=&r"   (val),
-          [got_it]      "+&r"   (got_it)
-          SCOND_FAIL_RETRY_VARS
-        : [rwlock]      "r"     (&(rw->counter)),
-          [UNLOCKED]    "ir"    (__ARCH_RW_LOCK_UNLOCKED__),
-          [WR_LOCKED]   "ir"    (0)
-        : "memory", "cc");
-
-        smp_mb();
-
-        return got_it;
-}
-
-static inline void arch_read_unlock(arch_rwlock_t *rw)
-{
-        unsigned int val;
-
-        smp_mb();
-
-        /*
-         * rw->counter++;
-         */
-        __asm__ __volatile__(
-        "1:     llock   %[val], [%[rwlock]]     \n"
-        "       add     %[val], %[val], 1       \n"
-        "       scond   %[val], [%[rwlock]]     \n"
-        "       bnz     1b                      \n"
-        "                                       \n"
-        : [val]         "=&r"   (val)
-        : [rwlock]      "r"     (&(rw->counter))
-        : "memory", "cc");
-
-        smp_mb();
-}
-
-static inline void arch_write_unlock(arch_rwlock_t *rw)
-{
-        unsigned int val;
-
-        smp_mb();
-
-        /*
-         * rw->counter = __ARCH_RW_LOCK_UNLOCKED__;
-         */
-        __asm__ __volatile__(
-        "1:     llock   %[val], [%[rwlock]]     \n"
-        "       scond   %[UNLOCKED], [%[rwlock]]\n"
-        "       bnz     1b                      \n"
-        "                                       \n"
-        : [val]         "=&r"   (val)
-        : [rwlock]      "r"     (&(rw->counter)),
-          [UNLOCKED]    "r"     (__ARCH_RW_LOCK_UNLOCKED__)
-        : "memory", "cc");
-
-        smp_mb();
-}
-
-#undef SCOND_FAIL_RETRY_VAR_DEF
-#undef SCOND_FAIL_RETRY_ASM
-#undef SCOND_FAIL_RETRY_VARS
-
-#endif  /* CONFIG_ARC_STAR_9000923308 */
-
 #else   /* !CONFIG_ARC_HAS_LLSC */
 
 static inline void arch_spin_lock(arch_spinlock_t *lock)
diff --git a/arch/arc/include/asm/thread_info.h b/arch/arc/include/asm/thread_info.h
index 3af67455659a..2d79e527fa50 100644
--- a/arch/arc/include/asm/thread_info.h
+++ b/arch/arc/include/asm/thread_info.h
@@ -103,7 +103,7 @@ static inline __attribute_const__ struct thread_info *current_thread_info(void)
 
 /*
  * _TIF_ALLWORK_MASK includes SYSCALL_TRACE, but we don't need it.
- * SYSCALL_TRACE is anways seperately/unconditionally tested right after a
+ * SYSCALL_TRACE is anyway seperately/unconditionally tested right after a
  * syscall, so all that reamins to be tested is _TIF_WORK_MASK
  */
 
diff --git a/arch/arc/include/asm/uaccess.h b/arch/arc/include/asm/uaccess.h
index d1da6032b715..a78d5670884f 100644
--- a/arch/arc/include/asm/uaccess.h
+++ b/arch/arc/include/asm/uaccess.h
@@ -32,7 +32,7 @@
 #define __kernel_ok             (segment_eq(get_fs(), KERNEL_DS))
 
 /*
- * Algorthmically, for __user_ok() we want do:
+ * Algorithmically, for __user_ok() we want do:
  *      (start < TASK_SIZE) && (start+len < TASK_SIZE)
  * where TASK_SIZE could either be retrieved from thread_info->addr_limit or
  * emitted directly in code.
diff --git a/arch/arc/include/uapi/asm/swab.h b/arch/arc/include/uapi/asm/swab.h
index 095599a73195..71f3918b0fc3 100644
--- a/arch/arc/include/uapi/asm/swab.h
+++ b/arch/arc/include/uapi/asm/swab.h
@@ -74,7 +74,7 @@
         __tmp ^ __in;                                           \
 })
 
-#elif (ARC_BSWAP_TYPE == 2)     /* Custom single cycle bwap instruction */
+#elif (ARC_BSWAP_TYPE == 2)     /* Custom single cycle bswap instruction */
 
 #define __arch_swab32(x)                                                \
 ({                                                                      \
diff --git a/arch/arc/kernel/entry-compact.S b/arch/arc/kernel/entry-compact.S
index 0cb0abaa0479..98812c1248df 100644
--- a/arch/arc/kernel/entry-compact.S
+++ b/arch/arc/kernel/entry-compact.S
@@ -91,27 +91,13 @@ VECTOR   mem_service             ; 0x8, Mem exception   (0x1)
 VECTOR   instr_service           ; 0x10, Instrn Error   (0x2)
 
 ; ******************** Device ISRs **********************
-#ifdef CONFIG_ARC_IRQ3_LV2
-VECTOR   handle_interrupt_level2
-#else
-VECTOR   handle_interrupt_level1
-#endif
-
-VECTOR   handle_interrupt_level1
-
-#ifdef CONFIG_ARC_IRQ5_LV2
-VECTOR   handle_interrupt_level2
-#else
-VECTOR   handle_interrupt_level1
-#endif
-
-#ifdef CONFIG_ARC_IRQ6_LV2
+#ifdef CONFIG_ARC_COMPACT_IRQ_LEVELS
 VECTOR   handle_interrupt_level2
 #else
 VECTOR   handle_interrupt_level1
 #endif
 
-.rept   25
+.rept   28
 VECTOR   handle_interrupt_level1 ; Other devices
 .endr
 
diff --git a/arch/arc/kernel/intc-compact.c b/arch/arc/kernel/intc-compact.c
index c5cceca36118..ce9deb953ca9 100644
--- a/arch/arc/kernel/intc-compact.c
+++ b/arch/arc/kernel/intc-compact.c
@@ -28,10 +28,8 @@ void arc_init_IRQ(void)
 {
         int level_mask = 0;
 
-       /* setup any high priority Interrupts (Level2 in ARCompact jargon) */
-        level_mask |= IS_ENABLED(CONFIG_ARC_IRQ3_LV2) << 3;
-        level_mask |= IS_ENABLED(CONFIG_ARC_IRQ5_LV2) << 5;
-        level_mask |= IS_ENABLED(CONFIG_ARC_IRQ6_LV2) << 6;
+       /* Is timer high priority Interrupt (Level2 in ARCompact jargon) */
+        level_mask |= IS_ENABLED(CONFIG_ARC_COMPACT_IRQ_LEVELS) << TIMER0_IRQ;
 
         /*
          * Write to register, even if no LV2 IRQs configured to reset it
diff --git a/arch/arc/kernel/perf_event.c b/arch/arc/kernel/perf_event.c
index 6fd48021324b..08f03d9b5b3e 100644
--- a/arch/arc/kernel/perf_event.c
+++ b/arch/arc/kernel/perf_event.c
@@ -108,7 +108,7 @@ static void arc_perf_event_update(struct perf_event *event,
         int64_t delta = new_raw_count - prev_raw_count;
 
         /*
-         * We don't afaraid of hwc->prev_count changing beneath our feet
+         * We aren't afraid of hwc->prev_count changing beneath our feet
          * because there's no way for us to re-enter this function anytime.
          */
         local64_set(&hwc->prev_count, new_raw_count);
diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c
index f63b8bfefb0c..2ee7a4d758a8 100644
--- a/arch/arc/kernel/setup.c
+++ b/arch/arc/kernel/setup.c
@@ -392,7 +392,7 @@ void __init setup_arch(char **cmdline_p)
                 /*
                  * If we are here, it is established that @uboot_arg didn't
                  * point to DT blob. Instead if u-boot says it is cmdline,
-                 * Appent to embedded DT cmdline.
+                 * append to embedded DT cmdline.
                  * setup_machine_fdt() would have populated @boot_command_line
                  */
                 if (uboot_tag == 1) {
diff --git a/arch/arc/kernel/signal.c b/arch/arc/kernel/signal.c
index 004b7f0bc76c..6cb3736b6b83 100644
--- a/arch/arc/kernel/signal.c
+++ b/arch/arc/kernel/signal.c
@@ -34,7 +34,7 @@
  *  -ViXS were still seeing crashes when using insmod to load drivers.
  *   It turned out that the code to change Execute permssions for TLB entries
  *   of user was not guarded for interrupts (mod_tlb_permission)
- *   This was cauing TLB entries to be overwritten on unrelated indexes
+ *   This was causing TLB entries to be overwritten on unrelated indexes
  *
  * Vineetg: July 15th 2008: Bug #94183
  *  -Exception happens in Delay slot of a JMP, and before user space resumes,
diff --git a/arch/arc/kernel/stacktrace.c b/arch/arc/kernel/stacktrace.c
index e0efff15a5ae..b9192a653b7e 100644
--- a/arch/arc/kernel/stacktrace.c
+++ b/arch/arc/kernel/stacktrace.c
@@ -142,7 +142,7 @@ arc_unwind_core(struct task_struct *tsk, struct pt_regs *regs,
          * prelogue is setup (callee regs saved and then fp set and not other
          * way around
          */
-        pr_warn("CONFIG_ARC_DW2_UNWIND needs to be enabled\n");
+        pr_warn_once("CONFIG_ARC_DW2_UNWIND needs to be enabled\n");
         return 0;
 
 #endif
diff --git a/arch/arc/kernel/troubleshoot.c b/arch/arc/kernel/troubleshoot.c
index a6f91e88ce36..934150e7ac48 100644
--- a/arch/arc/kernel/troubleshoot.c
+++ b/arch/arc/kernel/troubleshoot.c
@@ -276,7 +276,7 @@ static int tlb_stats_open(struct inode *inode, struct file *file)
         return 0;
 }
 
-/* called on user read(): display the couters */
+/* called on user read(): display the counters */
 static ssize_t tlb_stats_output(struct file *file,      /* file descriptor */
                                 char __user *user_buf,  /* user buffer */
                                 size_t len,             /* length of buffer */
diff --git a/arch/arc/mm/cache.c b/arch/arc/mm/cache.c
index 9e5eddbb856f..5a294b2c3cb3 100644
--- a/arch/arc/mm/cache.c
+++ b/arch/arc/mm/cache.c
@@ -215,7 +215,7 @@ slc_chk:
  * ------------------
  * This ver of MMU supports variable page sizes (1k-16k): although Linux will
  * only support 8k (default), 16k and 4k.
- * However from hardware perspective, smaller page sizes aggrevate aliasing
+ * However from hardware perspective, smaller page sizes aggravate aliasing
  * meaning more vaddr bits needed to disambiguate the cache-line-op ;
  * the existing scheme of piggybacking won't work for certain configurations.
  * Two new registers IC_PTAG and DC_PTAG inttoduced.
@@ -302,7 +302,7 @@ void __cache_line_loop_v3(phys_addr_t paddr, unsigned long vaddr,
 
         /*
          * This is technically for MMU v4, using the MMU v3 programming model
-         * Special work for HS38 aliasing I-cache configuratino with PAE40
+         * Special work for HS38 aliasing I-cache configuration with PAE40
          *   - upper 8 bits of paddr need to be written into PTAG_HI
          *   - (and needs to be written before the lower 32 bits)
          * Note that PTAG_HI is hoisted outside the line loop
@@ -936,7 +936,7 @@ void arc_cache_init(void)
                               ic->ver, CONFIG_ARC_MMU_VER);
 
                 /*
-                 * In MMU v4 (HS38x) the alising icache config uses IVIL/PTAG
+                 * In MMU v4 (HS38x) the aliasing icache config uses IVIL/PTAG
                  * pair to provide vaddr/paddr respectively, just as in MMU v3
                  */
                 if (is_isa_arcv2() && ic->alias)
diff --git a/arch/arc/mm/dma.c b/arch/arc/mm/dma.c
index 8c8e36fa5659..73d7e4c75b7d 100644
--- a/arch/arc/mm/dma.c
+++ b/arch/arc/mm/dma.c
@@ -10,7 +10,7 @@
  * DMA Coherent API Notes
  *
  * I/O is inherently non-coherent on ARC. So a coherent DMA buffer is
- * implemented by accessintg it using a kernel virtual address, with
+ * implemented by accessing it using a kernel virtual address, with
  * Cache bit off in the TLB entry.
  *
  * The default DMA address == Phy address which is 0x8000_0000 based.
diff --git a/arch/arm/boot/dts/Makefile b/arch/arm/boot/dts/Makefile
index 06b6c2d695bf..414b42710a36 100644
--- a/arch/arm/boot/dts/Makefile
+++ b/arch/arm/boot/dts/Makefile
@@ -741,6 +741,7 @@ dtb-$(CONFIG_MACH_SUN7I) += \
         sun7i-a20-olimex-som-evb.dtb \
         sun7i-a20-olinuxino-lime.dtb \
         sun7i-a20-olinuxino-lime2.dtb \
+        sun7i-a20-olinuxino-lime2-emmc.dtb \
         sun7i-a20-olinuxino-micro.dtb \
         sun7i-a20-orangepi.dtb \
         sun7i-a20-orangepi-mini.dtb \
diff --git a/arch/arm/boot/dts/am437x-sk-evm.dts b/arch/arm/boot/dts/am437x-sk-evm.dts
index d82dd6e3f9b1..5687d6b4da60 100644
--- a/arch/arm/boot/dts/am437x-sk-evm.dts
+++ b/arch/arm/boot/dts/am437x-sk-evm.dts
@@ -418,7 +418,7 @@
         status = "okay";
         pinctrl-names = "default";
         pinctrl-0 = <&i2c0_pins>;
-        clock-frequency = <400000>;
+        clock-frequency = <100000>;
 
         tps@24 {
                 compatible = "ti,tps65218";
diff --git a/arch/arm/boot/dts/am57xx-idk-common.dtsi b/arch/arm/boot/dts/am57xx-idk-common.dtsi
index b01a5948cdd0..0e63b9dff6e7 100644
--- a/arch/arm/boot/dts/am57xx-idk-common.dtsi
+++ b/arch/arm/boot/dts/am57xx-idk-common.dtsi
@@ -60,10 +60,26 @@
 
                 tps659038_pmic {
                         compatible = "ti,tps659038-pmic";
+
+                        smps12-in-supply = <&vmain>;
+                        smps3-in-supply = <&vmain>;
+                        smps45-in-supply = <&vmain>;
+                        smps6-in-supply = <&vmain>;
+                        smps7-in-supply = <&vmain>;
+                        smps8-in-supply = <&vmain>;
+                        smps9-in-supply = <&vmain>;
+                        ldo1-in-supply = <&vmain>;
+                        ldo2-in-supply = <&vmain>;
+                        ldo3-in-supply = <&vmain>;
+                        ldo4-in-supply = <&vmain>;
+                        ldo9-in-supply = <&vmain>;
+                        ldoln-in-supply = <&vmain>;
+                        ldousb-in-supply = <&vmain>;
+                        ldortc-in-supply = <&vmain>;
+
                         regulators {
                                 smps12_reg: smps12 {
                                         /* VDD_MPU */
-                                        vin-supply = <&vmain>;
                                         regulator-name = "smps12";
                                         regulator-min-microvolt = <850000>;
                                         regulator-max-microvolt = <1250000>;
@@ -73,7 +89,6 @@
 
                                 smps3_reg: smps3 {
                                         /* VDD_DDR EMIF1 EMIF2 */
-                                        vin-supply = <&vmain>;
                                         regulator-name = "smps3";
                                         regulator-min-microvolt = <1350000>;
                                         regulator-max-microvolt = <1350000>;
@@ -84,7 +99,6 @@
                                 smps45_reg: smps45 {
                                         /* VDD_DSPEVE on AM572 */
                                         /* VDD_IVA + VDD_DSP on AM571 */
-                                        vin-supply = <&vmain>;
                                         regulator-name = "smps45";
                                         regulator-min-microvolt = <850000>;
                                         regulator-max-microvolt = <1250000>;
@@ -94,7 +108,6 @@
 
                                 smps6_reg: smps6 {
                                         /* VDD_GPU */
-                                        vin-supply = <&vmain>;
                                         regulator-name = "smps6";
                                         regulator-min-microvolt = <850000>;
                                         regulator-max-microvolt = <1250000>;
@@ -104,7 +117,6 @@
 
                                 smps7_reg: smps7 {
                                         /* VDD_CORE */
-                                        vin-supply = <&vmain>;
                                         regulator-name = "smps7";
                                         regulator-min-microvolt = <850000>;
                                         regulator-max-microvolt = <1150000>;
@@ -115,13 +127,11 @@
                                 smps8_reg: smps8 {
                                         /* 5728 - VDD_IVAHD */
                                         /* 5718 - N.C. test point */
-                                        vin-supply = <&vmain>;
                                         regulator-name = "smps8";
                                 };
 
                                 smps9_reg: smps9 {
                                         /* VDD_3_3D */
-                                        vin-supply = <&vmain>;
                                         regulator-name = "smps9";
                                         regulator-min-microvolt = <3300000>;
                                         regulator-max-microvolt = <3300000>;
@@ -132,7 +142,6 @@
                                 ldo1_reg: ldo1 {
                                         /* VDDSHV8 - VSDMMC  */
                                         /* NOTE: on rev 1.3a, data supply */
-                                        vin-supply = <&vmain>;
                                         regulator-name = "ldo1";
                                         regulator-min-microvolt = <1800000>;
                                         regulator-max-microvolt = <3300000>;
@@ -142,7 +151,6 @@
 
                                 ldo2_reg: ldo2 {
                                         /* VDDSH18V */
-                                        vin-supply = <&vmain>;
                                         regulator-name = "ldo2";
                                         regulator-min-microvolt = <1800000>;
                                         regulator-max-microvolt = <1800000>;
@@ -152,7 +160,6 @@
 
                                 ldo3_reg: ldo3 {
                                         /* R1.3a 572x V1_8PHY_LDO3: USB, SATA */
-                                        vin-supply = <&vmain>;
                                         regulator-name = "ldo3";
                                         regulator-min-microvolt = <1800000>;
                                         regulator-max-microvolt = <1800000>;
@@ -162,7 +169,6 @@
 
                                 ldo4_reg: ldo4 {
                                         /* R1.3a 572x V1_8PHY_LDO4: PCIE, HDMI*/
-                                        vin-supply = <&vmain>;
                                         regulator-name = "ldo4";
                                         regulator-min-microvolt = <1800000>;
                                         regulator-max-microvolt = <1800000>;
@@ -174,7 +180,6 @@
 
                                 ldo9_reg: ldo9 {
                                         /* VDD_RTC  */
-                                        vin-supply = <&vmain>;
                                         regulator-name = "ldo9";
                                         regulator-min-microvolt = <840000>;
                                         regulator-max-microvolt = <1160000>;
@@ -184,7 +189,6 @@
 
                                 ldoln_reg: ldoln {
                                         /* VDDA_1V8_PLL */
-                                        vin-supply = <&vmain>;
                                         regulator-name = "ldoln";
                                         regulator-min-microvolt = <1800000>;
                                         regulator-max-microvolt = <1800000>;
@@ -194,7 +198,6 @@
 
                                 ldousb_reg: ldousb {
                                         /* VDDA_3V_USB: VDDA_USBHS33 */
-                                        vin-supply = <&vmain>;
                                         regulator-name = "ldousb";
                                         regulator-min-microvolt = <3300000>;
                                         regulator-max-microvolt = <3300000>;
@@ -204,7 +207,6 @@
 
                                 ldortc_reg: ldortc {
                                         /* VDDA_RTC  */
-                                        vin-supply = <&vmain>;
                                         regulator-name = "ldortc";
                                         regulator-min-microvolt = <1800000>;
                                         regulator-max-microvolt = <1800000>;
diff --git a/arch/arm/boot/dts/dm8148-evm.dts b/arch/arm/boot/dts/dm8148-evm.dts
index cbc17b0794b1..4128fa91823c 100644
--- a/arch/arm/boot/dts/dm8148-evm.dts
+++ b/arch/arm/boot/dts/dm8148-evm.dts
@@ -93,6 +93,10 @@
         };
 };
 
+&mmc1 {
+        status = "disabled";
+};
+
 &mmc2 {
         pinctrl-names = "default";
         pinctrl-0 = <&sd1_pins>;
@@ -101,6 +105,10 @@
         cd-gpios = <&gpio2 6 GPIO_ACTIVE_LOW>;
 };
 
+&mmc3 {
+        status = "disabled";
+};
+
 &pincntl {
         sd1_pins: pinmux_sd1_pins {
                 pinctrl-single,pins = <
diff --git a/arch/arm/boot/dts/dm8148-t410.dts b/arch/arm/boot/dts/dm8148-t410.dts
index 5d4313fd5a46..3f184863e0c5 100644
--- a/arch/arm/boot/dts/dm8148-t410.dts
+++ b/arch/arm/boot/dts/dm8148-t410.dts
@@ -45,6 +45,14 @@
         phy-mode = "rgmii";
 };
 
+&mmc1 {
+        status = "disabled";
+};
+
+&mmc2 {
+        status = "disabled";
+};
+
 &mmc3 {
         pinctrl-names = "default";
         pinctrl-0 = <&sd2_pins>;
@@ -53,6 +61,7 @@
         dmas = <&edma_xbar 8 0 1        /* use SDTXEVT1 instead of MCASP0TX */
                 &edma_xbar 9 0 2>;      /* use SDRXEVT1 instead of MCASP0RX */
         dma-names = "tx", "rx";
+        non-removable;
 };
 
 &pincntl {
diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi
index e0074014385a..3a8f3976f6f9 100644
--- a/arch/arm/boot/dts/dra7.dtsi
+++ b/arch/arm/boot/dts/dra7.dtsi
@@ -1451,6 +1451,8 @@
                         ti,hwmods = "gpmc";
                         reg = <0x50000000 0x37c>;      /* device IO registers */
                         interrupts = <GIC_SPI 15 IRQ_TYPE_LEVEL_HIGH>;
+                        dmas = <&edma_xbar 4 0>;
+                        dma-names = "rxtx";
                         gpmc,num-cs = <8>;
                         gpmc,num-waitpins = <2>;
                         #address-cells = <2>;
diff --git a/arch/arm/boot/dts/dra74x.dtsi b/arch/arm/boot/dts/dra74x.dtsi
index 4220eeffc65a..5e06020f450b 100644
--- a/arch/arm/boot/dts/dra74x.dtsi
+++ b/arch/arm/boot/dts/dra74x.dtsi
@@ -107,8 +107,8 @@
         reg = <0x58000000 0x80>,
               <0x58004054 0x4>,
               <0x58004300 0x20>,
-              <0x58005054 0x4>,
-              <0x58005300 0x20>;
+              <0x58009054 0x4>,
+              <0x58009300 0x20>;
         reg-names = "dss", "pll1_clkctrl", "pll1",
                     "pll2_clkctrl", "pll2";
 
diff --git a/arch/arm/boot/dts/exynos5250-snow-common.dtsi b/arch/arm/boot/dts/exynos5250-snow-common.dtsi
index ddfe1f558c10..fa14f77df563 100644
--- a/arch/arm/boot/dts/exynos5250-snow-common.dtsi
+++ b/arch/arm/boot/dts/exynos5250-snow-common.dtsi
@@ -242,7 +242,7 @@
         hpd-gpios = <&gpx0 7 GPIO_ACTIVE_HIGH>;
 
         ports {
-                port0 {
+                port {
                         dp_out: endpoint {
                                 remote-endpoint = <&bridge_in>;
                         };
@@ -485,13 +485,20 @@
                 edid-emulation = <5>;
 
                 ports {
-                        port0 {
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+
+                        port@0 {
+                                reg = <0>;
+
                                 bridge_out: endpoint {
                                         remote-endpoint = <&panel_in>;
                                 };
                         };
 
-                        port1 {
+                        port@1 {
+                                reg = <1>;
+
                                 bridge_in: endpoint {
                                         remote-endpoint = <&dp_out>;
                                 };
diff --git a/arch/arm/boot/dts/exynos5420-peach-pit.dts b/arch/arm/boot/dts/exynos5420-peach-pit.dts
index f9d2e4f1a0e0..1de972d46a87 100644
--- a/arch/arm/boot/dts/exynos5420-peach-pit.dts
+++ b/arch/arm/boot/dts/exynos5420-peach-pit.dts
@@ -163,7 +163,7 @@
         hpd-gpios = <&gpx2 6 GPIO_ACTIVE_HIGH>;
 
         ports {
-                port0 {
+                port {
                         dp_out: endpoint {
                                 remote-endpoint = <&bridge_in>;
                         };
@@ -631,13 +631,20 @@
                 use-external-pwm;
 
                 ports {
-                        port0 {
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+
+                        port@0 {
+                                reg = <0>;
+
                                 bridge_out: endpoint {
                                         remote-endpoint = <&panel_in>;
                                 };
                         };
 
-                        port1 {
+                        port@1 {
+                                reg = <1>;
+
                                 bridge_in: endpoint {
                                         remote-endpoint = <&dp_out>;
                                 };
diff --git a/arch/arm/boot/dts/omap3-evm-37xx.dts b/arch/arm/boot/dts/omap3-evm-37xx.dts
index 76056ba92ced..ed449827c3d3 100644
--- a/arch/arm/boot/dts/omap3-evm-37xx.dts
+++ b/arch/arm/boot/dts/omap3-evm-37xx.dts
@@ -85,7 +85,7 @@
                         OMAP3_CORE1_IOPAD(0x2158, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc2_clk.sdmmc2_clk */
                         OMAP3_CORE1_IOPAD(0x215a, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc2_cmd.sdmmc2_cmd */
                         OMAP3_CORE1_IOPAD(0x215c, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc2_dat0.sdmmc2_dat0 */
-                        OMAP3_CORE1_IOPAD(0x215e, WAKEUP_EN | PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc2_dat1.sdmmc2_dat1 */
+                        OMAP3_CORE1_IOPAD(0x215e, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc2_dat1.sdmmc2_dat1 */
                         OMAP3_CORE1_IOPAD(0x2160, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc2_dat2.sdmmc2_dat2 */
                         OMAP3_CORE1_IOPAD(0x2162, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc2_dat3.sdmmc2_dat3 */
                 >;
diff --git a/arch/arm/boot/dts/omap3-igep.dtsi b/arch/arm/boot/dts/omap3-igep.dtsi
index 41f5d386f21f..f4f2ce46d681 100644
--- a/arch/arm/boot/dts/omap3-igep.dtsi
+++ b/arch/arm/boot/dts/omap3-igep.dtsi
@@ -188,6 +188,7 @@
         vmmc-supply = <&vmmc1>;
         vmmc_aux-supply = <&vsim>;
         bus-width = <4>;
+        cd-gpios = <&twl_gpio 0 GPIO_ACTIVE_LOW>;
 };
 
 &mmc3 {
diff --git a/arch/arm/boot/dts/omap3-igep0020-common.dtsi b/arch/arm/boot/dts/omap3-igep0020-common.dtsi
index d6f839cab649..b6971060648a 100644
--- a/arch/arm/boot/dts/omap3-igep0020-common.dtsi
+++ b/arch/arm/boot/dts/omap3-igep0020-common.dtsi
@@ -194,6 +194,12 @@
                         OMAP3630_CORE2_IOPAD(0x25f8, PIN_OUTPUT | MUX_MODE4) /* etk_d14.gpio_28 */
                 >;
         };
+
+        mmc1_wp_pins: pinmux_mmc1_cd_pins {
+                pinctrl-single,pins = <
+                        OMAP3630_CORE2_IOPAD(0x25fa, PIN_INPUT | MUX_MODE4)   /* etk_d15.gpio_29 */
+                >;
+        };
 };
 
 &i2c3 {
@@ -250,3 +256,8 @@
                 };
         };
 };
+
+&mmc1 {
+        pinctrl-0 = <&mmc1_pins &mmc1_wp_pins>;
+        wp-gpios = <&gpio1 29 GPIO_ACTIVE_LOW>; /* gpio_29 */
+};
diff --git a/arch/arm/boot/dts/omap3-n900.dts b/arch/arm/boot/dts/omap3-n900.dts
index d9e2d9c6e999..2b74a81d1de2 100644
--- a/arch/arm/boot/dts/omap3-n900.dts
+++ b/arch/arm/boot/dts/omap3-n900.dts
@@ -288,7 +288,7 @@
                 pinctrl-single,pins = <
                         OMAP3_CORE1_IOPAD(0x2180, PIN_INPUT_PULLUP | MUX_MODE1) /* ssi1_rdy_tx */
                         OMAP3_CORE1_IOPAD(0x217e, PIN_OUTPUT | MUX_MODE1)               /* ssi1_flag_tx */
-                        OMAP3_CORE1_IOPAD(0x2182, PIN_INPUT | WAKEUP_EN | MUX_MODE4) /* ssi1_wake_tx (cawake) */
+                        OMAP3_CORE1_IOPAD(0x2182, PIN_INPUT | MUX_MODE4)                /* ssi1_wake_tx (cawake) */
                         OMAP3_CORE1_IOPAD(0x217c, PIN_OUTPUT | MUX_MODE1)               /* ssi1_dat_tx */
                         OMAP3_CORE1_IOPAD(0x2184, PIN_INPUT | MUX_MODE1)                /* ssi1_dat_rx */
                         OMAP3_CORE1_IOPAD(0x2186, PIN_INPUT | MUX_MODE1)                /* ssi1_flag_rx */
@@ -300,7 +300,7 @@
         modem_pins: pinmux_modem {
                 pinctrl-single,pins = <
                         OMAP3_CORE1_IOPAD(0x20dc, PIN_OUTPUT | MUX_MODE4)               /* gpio 70 => cmt_apeslpx */
-                        OMAP3_CORE1_IOPAD(0x20e0, PIN_INPUT | WAKEUP_EN | MUX_MODE4) /* gpio 72 => ape_rst_rq */
+                        OMAP3_CORE1_IOPAD(0x20e0, PIN_INPUT | MUX_MODE4)                /* gpio 72 => ape_rst_rq */
                         OMAP3_CORE1_IOPAD(0x20e2, PIN_OUTPUT | MUX_MODE4)               /* gpio 73 => cmt_rst_rq */
                         OMAP3_CORE1_IOPAD(0x20e4, PIN_OUTPUT | MUX_MODE4)               /* gpio 74 => cmt_en */
                         OMAP3_CORE1_IOPAD(0x20e6, PIN_OUTPUT | MUX_MODE4)               /* gpio 75 => cmt_rst */
diff --git a/arch/arm/boot/dts/omap3-n950-n9.dtsi b/arch/arm/boot/dts/omap3-n950-n9.dtsi
index a00ca761675d..927b17fc4ed8 100644
--- a/arch/arm/boot/dts/omap3-n950-n9.dtsi
+++ b/arch/arm/boot/dts/omap3-n950-n9.dtsi
@@ -97,7 +97,7 @@
                         OMAP3_CORE1_IOPAD(0x217c, PIN_OUTPUT | MUX_MODE1)            /* ssi1_dat_tx */
                         OMAP3_CORE1_IOPAD(0x217e, PIN_OUTPUT | MUX_MODE1)            /* ssi1_flag_tx */
                         OMAP3_CORE1_IOPAD(0x2180, PIN_INPUT_PULLUP | MUX_MODE1)      /* ssi1_rdy_tx */
-                        OMAP3_CORE1_IOPAD(0x2182, PIN_INPUT | WAKEUP_EN | MUX_MODE4) /* ssi1_wake_tx (cawake) */
+                        OMAP3_CORE1_IOPAD(0x2182, PIN_INPUT | MUX_MODE4)        /* ssi1_wake_tx (cawake) */
                         OMAP3_CORE1_IOPAD(0x2184, PIN_INPUT | MUX_MODE1)             /* ssi1_dat_rx */
                         OMAP3_CORE1_IOPAD(0x2186, PIN_INPUT | MUX_MODE1)             /* ssi1_flag_rx */
                         OMAP3_CORE1_IOPAD(0x2188, PIN_OUTPUT | MUX_MODE1)            /* ssi1_rdy_rx */
@@ -110,7 +110,7 @@
                         OMAP3_CORE1_IOPAD(0x217c, PIN_OUTPUT | MUX_MODE7)            /* ssi1_dat_tx */
                         OMAP3_CORE1_IOPAD(0x217e, PIN_OUTPUT | MUX_MODE7)            /* ssi1_flag_tx */
                         OMAP3_CORE1_IOPAD(0x2180, PIN_INPUT_PULLDOWN | MUX_MODE7)    /* ssi1_rdy_tx */
-                        OMAP3_CORE1_IOPAD(0x2182, PIN_INPUT | WAKEUP_EN | MUX_MODE4) /* ssi1_wake_tx (cawake) */
+                        OMAP3_CORE1_IOPAD(0x2182, PIN_INPUT | MUX_MODE4)        /* ssi1_wake_tx (cawake) */
                         OMAP3_CORE1_IOPAD(0x2184, PIN_INPUT | MUX_MODE7)             /* ssi1_dat_rx */
                         OMAP3_CORE1_IOPAD(0x2186, PIN_INPUT | MUX_MODE7)             /* ssi1_flag_rx */
                         OMAP3_CORE1_IOPAD(0x2188, PIN_OUTPUT | MUX_MODE4)            /* ssi1_rdy_rx */
@@ -120,7 +120,7 @@
 
         modem_pins1: pinmux_modem_core1_pins {
                 pinctrl-single,pins = <
-                        OMAP3_CORE1_IOPAD(0x207a, PIN_INPUT | WAKEUP_EN | MUX_MODE4) /* gpio_34 (ape_rst_rq) */
+                        OMAP3_CORE1_IOPAD(0x207a, PIN_INPUT | MUX_MODE4)        /* gpio_34 (ape_rst_rq) */
                         OMAP3_CORE1_IOPAD(0x2100, PIN_OUTPUT | MUX_MODE4)            /* gpio_88 (cmt_rst_rq) */
                         OMAP3_CORE1_IOPAD(0x210a, PIN_OUTPUT | MUX_MODE4)            /* gpio_93 (cmt_apeslpx) */
                 >;
diff --git a/arch/arm/boot/dts/omap3-zoom3.dts b/arch/arm/boot/dts/omap3-zoom3.dts
index f19170bdcc1f..c29b41dc7b95 100644
--- a/arch/arm/boot/dts/omap3-zoom3.dts
+++ b/arch/arm/boot/dts/omap3-zoom3.dts
@@ -98,7 +98,7 @@
                 pinctrl-single,pins = <
                         OMAP3_CORE1_IOPAD(0x2174, PIN_INPUT_PULLUP | MUX_MODE0) /* uart2_cts.uart2_cts */
                         OMAP3_CORE1_IOPAD(0x2176, PIN_OUTPUT | MUX_MODE0)               /* uart2_rts.uart2_rts */
-                        OMAP3_CORE1_IOPAD(0x217a, WAKEUP_EN | PIN_INPUT | MUX_MODE0) /* uart2_rx.uart2_rx */
+                        OMAP3_CORE1_IOPAD(0x217a, PIN_INPUT | MUX_MODE0)                /* uart2_rx.uart2_rx */
                         OMAP3_CORE1_IOPAD(0x2178, PIN_OUTPUT | MUX_MODE0)               /* uart2_tx.uart2_tx */
                 >;
         };
@@ -107,7 +107,7 @@
                 pinctrl-single,pins = <
                         OMAP3_CORE1_IOPAD(0x219a, PIN_INPUT_PULLDOWN | MUX_MODE0)       /* uart3_cts_rctx.uart3_cts_rctx */
                         OMAP3_CORE1_IOPAD(0x219c, PIN_OUTPUT | MUX_MODE0)               /* uart3_rts_sd.uart3_rts_sd */
-                        OMAP3_CORE1_IOPAD(0x219e, WAKEUP_EN | PIN_INPUT | MUX_MODE0) /* uart3_rx_irrx.uart3_rx_irrx */
+                        OMAP3_CORE1_IOPAD(0x219e, PIN_INPUT | MUX_MODE0)                /* uart3_rx_irrx.uart3_rx_irrx */
                         OMAP3_CORE1_IOPAD(0x21a0, PIN_OUTPUT | MUX_MODE0)               /* uart3_tx_irtx.uart3_tx_irtx */
                 >;
         };
@@ -125,7 +125,7 @@
                 pinctrl-single,pins = <
                         OMAP3630_CORE2_IOPAD(0x25d8, PIN_INPUT_PULLUP | MUX_MODE2)      /* etk_clk.sdmmc3_clk */
                         OMAP3630_CORE2_IOPAD(0x25e4, PIN_INPUT_PULLUP | MUX_MODE2)      /* etk_d4.sdmmc3_dat0 */
-                        OMAP3630_CORE2_IOPAD(0x25e6, WAKEUP_EN | PIN_INPUT_PULLUP | MUX_MODE2) /* etk_d5.sdmmc3_dat1 */
+                        OMAP3630_CORE2_IOPAD(0x25e6, PIN_INPUT_PULLUP | MUX_MODE2)      /* etk_d5.sdmmc3_dat1 */
                         OMAP3630_CORE2_IOPAD(0x25e8, PIN_INPUT_PULLUP | MUX_MODE2)      /* etk_d6.sdmmc3_dat2 */
                         OMAP3630_CORE2_IOPAD(0x25e2, PIN_INPUT_PULLUP | MUX_MODE2)      /* etk_d3.sdmmc3_dat3 */
                 >;
diff --git a/arch/arm/boot/dts/omap5-board-common.dtsi b/arch/arm/boot/dts/omap5-board-common.dtsi
index dc759a3028b7..5d5b620b7d9b 100644
--- a/arch/arm/boot/dts/omap5-board-common.dtsi
+++ b/arch/arm/boot/dts/omap5-board-common.dtsi
@@ -14,6 +14,29 @@
                 display0 = &hdmi0;
         };
 
+        vmain: fixedregulator-vmain {
+                compatible = "regulator-fixed";
+                regulator-name = "vmain";
+                regulator-min-microvolt = <5000000>;
+                regulator-max-microvolt = <5000000>;
+        };
+
+        vsys_cobra: fixedregulator-vsys_cobra {
+                compatible = "regulator-fixed";
+                regulator-name = "vsys_cobra";
+                vin-supply = <&vmain>;
+                regulator-min-microvolt = <5000000>;
+                regulator-max-microvolt = <5000000>;
+        };
+
+        vdds_1v8_main: fixedregulator-vdds_1v8_main {
+                compatible = "regulator-fixed";
+                regulator-name = "vdds_1v8_main";
+                vin-supply = <&smps7_reg>;
+                regulator-min-microvolt = <1800000>;
+                regulator-max-microvolt = <1800000>;
+        };
+
         vmmcsd_fixed: fixedregulator-mmcsd {
                 compatible = "regulator-fixed";
                 regulator-name = "vmmcsd_fixed";
@@ -309,7 +332,7 @@
 
         wlcore_irq_pin: pinmux_wlcore_irq_pin {
                 pinctrl-single,pins = <
-                        OMAP5_IOPAD(0x40, WAKEUP_EN | PIN_INPUT_PULLUP | MUX_MODE6)     /* llia_wakereqin.gpio1_wk14 */
+                        OMAP5_IOPAD(0x40, PIN_INPUT_PULLUP | MUX_MODE6) /* llia_wakereqin.gpio1_wk14 */
                 >;
         };
 };
@@ -409,6 +432,26 @@
 
                         ti,ldo6-vibrator;
 
+                        smps123-in-supply = <&vsys_cobra>;
+                        smps45-in-supply = <&vsys_cobra>;
+                        smps6-in-supply = <&vsys_cobra>;
+                        smps7-in-supply = <&vsys_cobra>;
+                        smps8-in-supply = <&vsys_cobra>;
+                        smps9-in-supply = <&vsys_cobra>;
+                        smps10_out2-in-supply = <&vsys_cobra>;
+                        smps10_out1-in-supply = <&vsys_cobra>;
+                        ldo1-in-supply = <&vsys_cobra>;
+                        ldo2-in-supply = <&vsys_cobra>;
+                        ldo3-in-supply = <&vdds_1v8_main>;
+                        ldo4-in-supply = <&vdds_1v8_main>;
+                        ldo5-in-supply = <&vsys_cobra>;
+                        ldo6-in-supply = <&vdds_1v8_main>;
+                        ldo7-in-supply = <&vsys_cobra>;
+                        ldo8-in-supply = <&vsys_cobra>;
+                        ldo9-in-supply = <&vmmcsd_fixed>;
+                        ldoln-in-supply = <&vsys_cobra>;
+                        ldousb-in-supply = <&vsys_cobra>;
+
                         regulators {
                                 smps123_reg: smps123 {
                                         /* VDD_OPP_MPU */
@@ -600,7 +643,8 @@
                 pinctrl-0 = <&twl6040_pins>;
 
                 interrupts = <GIC_SPI 119 IRQ_TYPE_NONE>; /* IRQ_SYS_2N cascaded to gic */
-                ti,audpwron-gpio = <&gpio5 13 GPIO_ACTIVE_HIGH>;  /* gpio line 141 */
+
+                /* audpwron gpio defined in the board specific dts */
 
                 vio-supply = <&smps7_reg>;
                 v2v1-supply = <&smps9_reg>;
diff --git a/arch/arm/boot/dts/omap5-igep0050.dts b/arch/arm/boot/dts/omap5-igep0050.dts
index 46ecb1dd3b5c..f75ce02fb398 100644
--- a/arch/arm/boot/dts/omap5-igep0050.dts
+++ b/arch/arm/boot/dts/omap5-igep0050.dts
@@ -35,6 +35,22 @@
         };
 };
 
+/* LDO4 is VPP1 - ball AD9 */
+&ldo4_reg {
+        regulator-min-microvolt = <2000000>;
+        regulator-max-microvolt = <2000000>;
+};
+
+/*
+ * LDO7 is used for HDMI: VDDA_DSIPORTA - ball AA33, VDDA_DSIPORTC - ball AE33,
+ * VDDA_HDMI - ball AN25
+ */
+&ldo7_reg {
+        status = "okay";
+        regulator-min-microvolt = <1800000>;
+        regulator-max-microvolt = <1800000>;
+};
+
 &omap5_pmx_core {
         i2c4_pins: pinmux_i2c4_pins {
                 pinctrl-single,pins = <
@@ -52,3 +68,13 @@
                 <&gpio7 3 0>;           /* 195, SDA */
 };
 
+&twl6040 {
+        ti,audpwron-gpio = <&gpio5 16 GPIO_ACTIVE_HIGH>;  /* gpio line 144 */
+};
+
+&twl6040_pins {
+        pinctrl-single,pins = <
+                OMAP5_IOPAD(0x1c4, PIN_OUTPUT | MUX_MODE6)      /* mcspi1_somi.gpio5_144 */
+                OMAP5_IOPAD(0x1ca, PIN_OUTPUT | MUX_MODE6)      /* perslimbus2_clock.gpio5_145 */
+        >;
+};
diff --git a/arch/arm/boot/dts/omap5-uevm.dts b/arch/arm/boot/dts/omap5-uevm.dts
index 60b3fbb3bf07..a51e60518eb6 100644
--- a/arch/arm/boot/dts/omap5-uevm.dts
+++ b/arch/arm/boot/dts/omap5-uevm.dts
@@ -51,3 +51,13 @@
                 <&gpio9 1 GPIO_ACTIVE_HIGH>,    /* TCA6424A P00, LS OE */
                 <&gpio7 1 GPIO_ACTIVE_HIGH>;    /* GPIO 193, HPD */
 };
+
+&twl6040 {
+        ti,audpwron-gpio = <&gpio5 13 GPIO_ACTIVE_HIGH>;  /* gpio line 141 */
+};
+
+&twl6040_pins {
+        pinctrl-single,pins = <
+                OMAP5_IOPAD(0x1be, PIN_OUTPUT | MUX_MODE6)      /* mcspi1_somi.gpio5_141 */
+        >;
+};
diff --git a/arch/arm/boot/dts/socfpga_cyclone5_vining_fpga.dts b/arch/arm/boot/dts/socfpga_cyclone5_vining_fpga.dts
index a3601e4c0a2e..b844473601d2 100644
--- a/arch/arm/boot/dts/socfpga_cyclone5_vining_fpga.dts
+++ b/arch/arm/boot/dts/socfpga_cyclone5_vining_fpga.dts
@@ -136,6 +136,7 @@
 &gmac1 {
         status = "okay";
         phy-mode = "rgmii";
+        phy-handle = <&phy1>;
 
         snps,reset-gpio = <&porta 0 GPIO_ACTIVE_LOW>;
         snps,reset-active-low;
diff --git a/arch/arm/boot/dts/stih407-family.dtsi b/arch/arm/boot/dts/stih407-family.dtsi
index ad8ba10764a3..d294e82447a2 100644
--- a/arch/arm/boot/dts/stih407-family.dtsi
+++ b/arch/arm/boot/dts/stih407-family.dtsi
@@ -24,18 +24,21 @@
                         compatible = "shared-dma-pool";
                         reg = <0x40000000 0x01000000>;
                         no-map;
+                        status = "disabled";
                 };
 
                 gp1_reserved: rproc@41000000 {
                         compatible = "shared-dma-pool";
                         reg = <0x41000000 0x01000000>;
                         no-map;
+                        status = "disabled";
                 };
 
                 audio_reserved: rproc@42000000 {
                         compatible = "shared-dma-pool";
                         reg = <0x42000000 0x01000000>;
                         no-map;
+                        status = "disabled";
                 };
 
                 dmu_reserved: rproc@43000000 {
diff --git a/arch/arm/boot/dts/sun6i-a31s-primo81.dts b/arch/arm/boot/dts/sun6i-a31s-primo81.dts
index 68b479b8772c..73c133f5e79c 100644
--- a/arch/arm/boot/dts/sun6i-a31s-primo81.dts
+++ b/arch/arm/boot/dts/sun6i-a31s-primo81.dts
@@ -176,8 +176,6 @@
 };
 
 &reg_dc1sw {
-        regulator-min-microvolt = <3000000>;
-        regulator-max-microvolt = <3000000>;
         regulator-name = "vcc-lcd";
 };
 
diff --git a/arch/arm/boot/dts/sun6i-a31s-yones-toptech-bs1078-v2.dts b/arch/arm/boot/dts/sun6i-a31s-yones-toptech-bs1078-v2.dts
index 360adfb1e9ca..d6ad6196a768 100644
--- a/arch/arm/boot/dts/sun6i-a31s-yones-toptech-bs1078-v2.dts
+++ b/arch/arm/boot/dts/sun6i-a31s-yones-toptech-bs1078-v2.dts
@@ -135,8 +135,6 @@
 
 &reg_dc1sw {
         regulator-name = "vcc-lcd-usb2";
-        regulator-min-microvolt = <3000000>;
-        regulator-max-microvolt = <3000000>;
 };
 
 &reg_dc5ldo {
diff --git a/arch/arm/configs/exynos_defconfig b/arch/arm/configs/exynos_defconfig
index 10f49ab5328e..47195e8690b4 100644
--- a/arch/arm/configs/exynos_defconfig
+++ b/arch/arm/configs/exynos_defconfig
@@ -82,6 +82,7 @@ CONFIG_TOUCHSCREEN_MMS114=y
 CONFIG_INPUT_MISC=y
 CONFIG_INPUT_MAX77693_HAPTIC=y
 CONFIG_INPUT_MAX8997_HAPTIC=y
+CONFIG_KEYBOARD_SAMSUNG=y
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_SAMSUNG=y
 CONFIG_SERIAL_SAMSUNG_CONSOLE=y
diff --git a/arch/arm/configs/multi_v7_defconfig b/arch/arm/configs/multi_v7_defconfig
index 8f857564657f..8a5fff1b7f6f 100644
--- a/arch/arm/configs/multi_v7_defconfig
+++ b/arch/arm/configs/multi_v7_defconfig
@@ -264,6 +264,7 @@ CONFIG_KEYBOARD_TEGRA=y
 CONFIG_KEYBOARD_SPEAR=y
 CONFIG_KEYBOARD_ST_KEYSCAN=y
 CONFIG_KEYBOARD_CROS_EC=m
+CONFIG_KEYBOARD_SAMSUNG=m
 CONFIG_MOUSE_PS2_ELANTECH=y
 CONFIG_MOUSE_CYAPA=m
 CONFIG_MOUSE_ELAN_I2C=y
diff --git a/arch/arm/include/asm/pgalloc.h b/arch/arm/include/asm/pgalloc.h
index 19cfab526d13..20febb368844 100644
--- a/arch/arm/include/asm/pgalloc.h
+++ b/arch/arm/include/asm/pgalloc.h
@@ -29,7 +29,7 @@
 
 static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long addr)
 {
-        return (pmd_t *)get_zeroed_page(GFP_KERNEL | __GFP_REPEAT);
+        return (pmd_t *)get_zeroed_page(GFP_KERNEL);
 }
 
 static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
diff --git a/arch/arm/include/asm/pgtable-2level.h b/arch/arm/include/asm/pgtable-2level.h
index aeddd28b3595..92fd2c8a9af0 100644
--- a/arch/arm/include/asm/pgtable-2level.h
+++ b/arch/arm/include/asm/pgtable-2level.h
@@ -193,6 +193,7 @@ static inline pmd_t *pmd_offset(pud_t *pud, unsigned long addr)
 
 #define pmd_large(pmd)          (pmd_val(pmd) & 2)
 #define pmd_bad(pmd)            (pmd_val(pmd) & 2)
+#define pmd_present(pmd)        (pmd_val(pmd))
 
 #define copy_pmd(pmdpd,pmdps)           \
         do {                            \
diff --git a/arch/arm/include/asm/pgtable-3level.h b/arch/arm/include/asm/pgtable-3level.h
index fa70db7c714b..2a029bceaf2f 100644
--- a/arch/arm/include/asm/pgtable-3level.h
+++ b/arch/arm/include/asm/pgtable-3level.h
@@ -211,6 +211,7 @@ static inline pmd_t *pmd_offset(pud_t *pud, unsigned long addr)
                                                 : !!(pmd_val(pmd) & (val)))
 #define pmd_isclear(pmd, val)   (!(pmd_val(pmd) & (val)))
 
+#define pmd_present(pmd)        (pmd_isset((pmd), L_PMD_SECT_VALID))
 #define pmd_young(pmd)          (pmd_isset((pmd), PMD_SECT_AF))
 #define pte_special(pte)        (pte_isset((pte), L_PTE_SPECIAL))
 static inline pte_t pte_mkspecial(pte_t pte)
@@ -249,10 +250,10 @@ PMD_BIT_FUNC(mkyoung,   |= PMD_SECT_AF);
 #define pfn_pmd(pfn,prot)       (__pmd(((phys_addr_t)(pfn) << PAGE_SHIFT) | pgprot_val(prot)))
 #define mk_pmd(page,prot)       pfn_pmd(page_to_pfn(page),prot)
 
-/* represent a notpresent pmd by zero, this is used by pmdp_invalidate */
+/* represent a notpresent pmd by faulting entry, this is used by pmdp_invalidate */
 static inline pmd_t pmd_mknotpresent(pmd_t pmd)
 {
-        return __pmd(0);
+        return __pmd(pmd_val(pmd) & ~L_PMD_SECT_VALID);
 }
 
 static inline pmd_t pmd_modify(pmd_t pmd, pgprot_t newprot)
diff --git a/arch/arm/include/asm/pgtable.h b/arch/arm/include/asm/pgtable.h
index 348caabb7625..d62204060cbe 100644
--- a/arch/arm/include/asm/pgtable.h
+++ b/arch/arm/include/asm/pgtable.h
@@ -182,7 +182,6 @@ extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
 #define pgd_offset_k(addr)      pgd_offset(&init_mm, addr)
 
 #define pmd_none(pmd)           (!pmd_val(pmd))
-#define pmd_present(pmd)        (pmd_val(pmd))
 
 static inline pte_t *pmd_page_vaddr(pmd_t pmd)
 {
diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
index df90bc59bfce..861521606c6d 100644
--- a/arch/arm/kernel/smp.c
+++ b/arch/arm/kernel/smp.c
@@ -486,7 +486,7 @@ static const char *ipi_types[NR_IPI] __tracepoint_string = {
 
 static void smp_cross_call(const struct cpumask *target, unsigned int ipinr)
 {
-        trace_ipi_raise(target, ipi_types[ipinr]);
+        trace_ipi_raise_rcuidle(target, ipi_types[ipinr]);
         __smp_cross_call(target, ipinr);
 }
 
diff --git a/arch/arm/kvm/arm.c b/arch/arm/kvm/arm.c
index 893941ec98dc..f1bde7c4e736 100644
--- a/arch/arm/kvm/arm.c
+++ b/arch/arm/kvm/arm.c
@@ -263,6 +263,7 @@ void kvm_arch_vcpu_free(struct kvm_vcpu *vcpu)
         kvm_timer_vcpu_terminate(vcpu);
         kvm_vgic_vcpu_destroy(vcpu);
         kvm_pmu_vcpu_destroy(vcpu);
+        kvm_vcpu_uninit(vcpu);
         kmem_cache_free(kvm_vcpu_cache, vcpu);
 }
 
diff --git a/arch/arm/mach-exynos/Kconfig b/arch/arm/mach-exynos/Kconfig
index e65aa7d11b20..20dcf6e904b2 100644
--- a/arch/arm/mach-exynos/Kconfig
+++ b/arch/arm/mach-exynos/Kconfig
@@ -61,7 +61,6 @@ config ARCH_EXYNOS4
         select CLKSRC_SAMSUNG_PWM if CPU_EXYNOS4210
         select CPU_EXYNOS4210
         select GIC_NON_BANKED
-        select KEYBOARD_SAMSUNG if INPUT_KEYBOARD
         select MIGHT_HAVE_CACHE_L2X0
         help
           Samsung EXYNOS4 (Cortex-A9) SoC based systems
diff --git a/arch/arm/mach-imx/mach-imx6ul.c b/arch/arm/mach-imx/mach-imx6ul.c
index a38b16b69923..b56de4b8cdf2 100644
--- a/arch/arm/mach-imx/mach-imx6ul.c
+++ b/arch/arm/mach-imx/mach-imx6ul.c
@@ -46,7 +46,7 @@ static int ksz8081_phy_fixup(struct phy_device *dev)
 static void __init imx6ul_enet_phy_init(void)
 {
         if (IS_BUILTIN(CONFIG_PHYLIB))
-                phy_register_fixup_for_uid(PHY_ID_KSZ8081, 0xffffffff,
+                phy_register_fixup_for_uid(PHY_ID_KSZ8081, MICREL_PHY_ID_MASK,
                                            ksz8081_phy_fixup);
 }
 
diff --git a/arch/arm/mach-omap1/ams-delta-fiq-handler.S b/arch/arm/mach-omap1/ams-delta-fiq-handler.S
index 5d7fb596bf4a..bf608441b357 100644
--- a/arch/arm/mach-omap1/ams-delta-fiq-handler.S
+++ b/arch/arm/mach-omap1/ams-delta-fiq-handler.S
@@ -43,8 +43,8 @@
 #define OTHERS_MASK                     (MODEM_IRQ_MASK | HOOK_SWITCH_MASK)
 
 /* IRQ handler register bitmasks */
-#define DEFERRED_FIQ_MASK               (0x1 << (INT_DEFERRED_FIQ % IH2_BASE))
-#define GPIO_BANK1_MASK                 (0x1 << INT_GPIO_BANK1)
+#define DEFERRED_FIQ_MASK               OMAP_IRQ_BIT(INT_DEFERRED_FIQ)
+#define GPIO_BANK1_MASK                 OMAP_IRQ_BIT(INT_GPIO_BANK1)
 
 /* Driver buffer byte offsets */
 #define BUF_MASK                        (FIQ_MASK * 4)
@@ -110,7 +110,7 @@ ENTRY(qwerty_fiqin_start)
         mov r8, #2                              @ reset FIQ agreement
         str r8, [r12, #IRQ_CONTROL_REG_OFFSET]
 
-        cmp r10, #INT_GPIO_BANK1                @ is it GPIO bank interrupt?
+        cmp r10, #(INT_GPIO_BANK1 - NR_IRQS_LEGACY)     @ is it GPIO interrupt?
         beq gpio                                @ yes - process it
 
         mov r8, #1
diff --git a/arch/arm/mach-omap1/ams-delta-fiq.c b/arch/arm/mach-omap1/ams-delta-fiq.c
index d1f12095f315..ec760ae2f917 100644
--- a/arch/arm/mach-omap1/ams-delta-fiq.c
+++ b/arch/arm/mach-omap1/ams-delta-fiq.c
@@ -109,7 +109,8 @@ void __init ams_delta_init_fiq(void)
          * Since no set_type() method is provided by OMAP irq chip,
          * switch to edge triggered interrupt type manually.
          */
-        offset = IRQ_ILR0_REG_OFFSET + INT_DEFERRED_FIQ * 0x4;
+        offset = IRQ_ILR0_REG_OFFSET +
+                        ((INT_DEFERRED_FIQ - NR_IRQS_LEGACY) & 0x1f) * 0x4;
         val = omap_readl(DEFERRED_FIQ_IH_BASE + offset) & ~(1 << 1);
         omap_writel(val, DEFERRED_FIQ_IH_BASE + offset);
 
@@ -149,7 +150,7 @@ void __init ams_delta_init_fiq(void)
         /*
          * Redirect GPIO interrupts to FIQ
          */
-        offset = IRQ_ILR0_REG_OFFSET + INT_GPIO_BANK1 * 0x4;
+        offset = IRQ_ILR0_REG_OFFSET + (INT_GPIO_BANK1 - NR_IRQS_LEGACY) * 0x4;
         val = omap_readl(OMAP_IH1_BASE + offset) | 1;
         omap_writel(val, OMAP_IH1_BASE + offset);
 }
diff --git a/arch/arm/mach-omap1/include/mach/ams-delta-fiq.h b/arch/arm/mach-omap1/include/mach/ams-delta-fiq.h
index adb5e7649659..6dfc3e1210a3 100644
--- a/arch/arm/mach-omap1/include/mach/ams-delta-fiq.h
+++ b/arch/arm/mach-omap1/include/mach/ams-delta-fiq.h
@@ -14,6 +14,8 @@
 #ifndef __AMS_DELTA_FIQ_H
 #define __AMS_DELTA_FIQ_H
 
+#include <mach/irqs.h>
+
 /*
  * Interrupt number used for passing control from FIQ to IRQ.
  * IRQ12, described as reserved, has been selected.
diff --git a/arch/arm/mach-omap2/Kconfig b/arch/arm/mach-omap2/Kconfig
index 0517f0c1581a..1a648e9dfaa0 100644
--- a/arch/arm/mach-omap2/Kconfig
+++ b/arch/arm/mach-omap2/Kconfig
@@ -17,6 +17,7 @@ config ARCH_OMAP3
         select PM_OPP if PM
         select PM if CPU_IDLE
         select SOC_HAS_OMAP2_SDRC
+        select ARM_ERRATA_430973
 
 config ARCH_OMAP4
         bool "TI OMAP4"
@@ -36,6 +37,7 @@ config ARCH_OMAP4
         select PM if CPU_IDLE
         select ARM_ERRATA_754322
         select ARM_ERRATA_775420
+        select OMAP_INTERCONNECT
 
 config SOC_OMAP5
         bool "TI OMAP5"
@@ -67,6 +69,8 @@ config SOC_AM43XX
         select HAVE_ARM_SCU
         select GENERIC_CLOCKEVENTS_BROADCAST
         select HAVE_ARM_TWD
+        select ARM_ERRATA_754322
+        select ARM_ERRATA_775420
 
 config SOC_DRA7XX
         bool "TI DRA7XX"
@@ -240,4 +244,12 @@ endmenu
 
 endif
 
+config OMAP5_ERRATA_801819
+        bool "Errata 801819: An eviction from L1 data cache might stall indefinitely"
+        depends on SOC_OMAP5 || SOC_DRA7XX
+        help
+          A livelock can occur in the L2 cache arbitration that might prevent
+          a snoop from completing. Under certain conditions this can cause the
+          system to deadlock.
+
 endmenu
diff --git a/arch/arm/mach-omap2/omap-secure.h b/arch/arm/mach-omap2/omap-secure.h
index af2851fbcdf0..bae263fba640 100644
--- a/arch/arm/mach-omap2/omap-secure.h
+++ b/arch/arm/mach-omap2/omap-secure.h
@@ -46,6 +46,7 @@
 
 #define OMAP5_DRA7_MON_SET_CNTFRQ_INDEX 0x109
 #define OMAP5_MON_AMBA_IF_INDEX         0x108
+#define OMAP5_DRA7_MON_SET_ACR_INDEX    0x107
 
 /* Secure PPA(Primary Protected Application) APIs */
 #define OMAP4_PPA_L2_POR_INDEX          0x23
diff --git a/arch/arm/mach-omap2/omap-smp.c b/arch/arm/mach-omap2/omap-smp.c
index c625cc10d9f9..8cd1de914ee4 100644
--- a/arch/arm/mach-omap2/omap-smp.c
+++ b/arch/arm/mach-omap2/omap-smp.c
@@ -50,6 +50,39 @@ void __iomem *omap4_get_scu_base(void)
         return scu_base;
 }
 
+#ifdef CONFIG_OMAP5_ERRATA_801819
+void omap5_erratum_workaround_801819(void)
+{
+        u32 acr, revidr;
+        u32 acr_mask;
+
+        /* REVIDR[3] indicates erratum fix available on silicon */
+        asm volatile ("mrc p15, 0, %0, c0, c0, 6" : "=r" (revidr));
+        if (revidr & (0x1 << 3))
+                return;
+
+        asm volatile ("mrc p15, 0, %0, c1, c0, 1" : "=r" (acr));
+        /*
+         * BIT(27) - Disables streaming. All write-allocate lines allocate in
+         * the L1 or L2 cache.
+         * BIT(25) - Disables streaming. All write-allocate lines allocate in
+         * the L1 cache.
+         */
+        acr_mask = (0x3 << 25) | (0x3 << 27);
+        /* do we already have it done.. if yes, skip expensive smc */
+        if ((acr & acr_mask) == acr_mask)
+                return;
+
+        acr |= acr_mask;
+        omap_smc1(OMAP5_DRA7_MON_SET_ACR_INDEX, acr);
+
+        pr_debug("%s: ARM erratum workaround 801819 applied on CPU%d\n",
+                 __func__, smp_processor_id());
+}
+#else
+static inline void omap5_erratum_workaround_801819(void) { }
+#endif
+
 static void omap4_secondary_init(unsigned int cpu)
 {
         /*
@@ -64,12 +97,15 @@ static void omap4_secondary_init(unsigned int cpu)
                 omap_secure_dispatcher(OMAP4_PPA_CPU_ACTRL_SMP_INDEX,
                                                         4, 0, 0, 0, 0, 0);
 
-        /*
-         * Configure the CNTFRQ register for the secondary cpu's which
-         * indicates the frequency of the cpu local timers.
-         */
-        if (soc_is_omap54xx() || soc_is_dra7xx())
+        if (soc_is_omap54xx() || soc_is_dra7xx()) {
+                /*
+                 * Configure the CNTFRQ register for the secondary cpu's which
+                 * indicates the frequency of the cpu local timers.
+                 */
                 set_cntfreq();
+                /* Configure ACR to disable streaming WA for 801819 */
+                omap5_erratum_workaround_801819();
+        }
 
         /*
          * Synchronise with the boot thread.
@@ -218,6 +254,8 @@ static void __init omap4_smp_prepare_cpus(unsigned int max_cpus)
 
         if (cpu_is_omap446x())
                 startup_addr = omap4460_secondary_startup;
+        if (soc_is_dra74x() || soc_is_omap54xx())
+                omap5_erratum_workaround_801819();
 
         /*
          * Write the address of secondary startup routine into the
diff --git a/arch/arm/mach-omap2/powerdomain.c b/arch/arm/mach-omap2/powerdomain.c
index 78af6d8cf2e2..daf2753de7aa 100644
--- a/arch/arm/mach-omap2/powerdomain.c
+++ b/arch/arm/mach-omap2/powerdomain.c
@@ -186,8 +186,9 @@ static int _pwrdm_state_switch(struct powerdomain *pwrdm, int flag)
                         trace_state = (PWRDM_TRACE_STATES_FLAG |
                                        ((next & OMAP_POWERSTATE_MASK) << 8) |
                                        ((prev & OMAP_POWERSTATE_MASK) << 0));
-                        trace_power_domain_target(pwrdm->name, trace_state,
-                                                  smp_processor_id());
+                        trace_power_domain_target_rcuidle(pwrdm->name,
+                                                          trace_state,
+                                                          smp_processor_id());
                 }
                 break;
         default:
@@ -523,8 +524,8 @@ int pwrdm_set_next_pwrst(struct powerdomain *pwrdm, u8 pwrst)
 
         if (arch_pwrdm && arch_pwrdm->pwrdm_set_next_pwrst) {
                 /* Trace the pwrdm desired target state */
-                trace_power_domain_target(pwrdm->name, pwrst,
-                                          smp_processor_id());
+                trace_power_domain_target_rcuidle(pwrdm->name, pwrst,
+                                                  smp_processor_id());
                 /* Program the pwrdm desired target state */
                 ret = arch_pwrdm->pwrdm_set_next_pwrst(pwrdm, pwrst);
         }
diff --git a/arch/arm/mach-omap2/powerdomains7xx_data.c b/arch/arm/mach-omap2/powerdomains7xx_data.c
index 0ec2d00f4237..eb350a673133 100644
--- a/arch/arm/mach-omap2/powerdomains7xx_data.c
+++ b/arch/arm/mach-omap2/powerdomains7xx_data.c
@@ -36,14 +36,7 @@ static struct powerdomain iva_7xx_pwrdm = {
         .prcm_offs        = DRA7XX_PRM_IVA_INST,
         .prcm_partition   = DRA7XX_PRM_PARTITION,
         .pwrsts           = PWRSTS_OFF_ON,
-        .pwrsts_logic_ret = PWRSTS_OFF,
         .banks            = 4,
-        .pwrsts_mem_ret = {
-                [0] = PWRSTS_OFF_RET,   /* hwa_mem */
-                [1] = PWRSTS_OFF_RET,   /* sl2_mem */
-                [2] = PWRSTS_OFF_RET,   /* tcm1_mem */
-                [3] = PWRSTS_OFF_RET,   /* tcm2_mem */
-        },
         .pwrsts_mem_on  = {
                 [0] = PWRSTS_ON,        /* hwa_mem */
                 [1] = PWRSTS_ON,        /* sl2_mem */
@@ -76,12 +69,7 @@ static struct powerdomain ipu_7xx_pwrdm = {
         .prcm_offs        = DRA7XX_PRM_IPU_INST,
         .prcm_partition   = DRA7XX_PRM_PARTITION,
         .pwrsts           = PWRSTS_OFF_ON,
-        .pwrsts_logic_ret = PWRSTS_OFF,
         .banks            = 2,
-        .pwrsts_mem_ret = {
-                [0] = PWRSTS_OFF_RET,   /* aessmem */
-                [1] = PWRSTS_OFF_RET,   /* periphmem */
-        },
         .pwrsts_mem_on  = {
                 [0] = PWRSTS_ON,        /* aessmem */
                 [1] = PWRSTS_ON,        /* periphmem */
@@ -95,11 +83,7 @@ static struct powerdomain dss_7xx_pwrdm = {
         .prcm_offs        = DRA7XX_PRM_DSS_INST,
         .prcm_partition   = DRA7XX_PRM_PARTITION,
         .pwrsts           = PWRSTS_OFF_ON,
-        .pwrsts_logic_ret = PWRSTS_OFF,
         .banks            = 1,
-        .pwrsts_mem_ret = {
-                [0] = PWRSTS_OFF_RET,   /* dss_mem */
-        },
         .pwrsts_mem_on  = {
                 [0] = PWRSTS_ON,        /* dss_mem */
         },
@@ -111,13 +95,8 @@ static struct powerdomain l4per_7xx_pwrdm = {
         .name             = "l4per_pwrdm",
         .prcm_offs        = DRA7XX_PRM_L4PER_INST,
         .prcm_partition   = DRA7XX_PRM_PARTITION,
-        .pwrsts           = PWRSTS_RET_ON,
-        .pwrsts_logic_ret = PWRSTS_RET,
+        .pwrsts           = PWRSTS_ON,
         .banks            = 2,
-        .pwrsts_mem_ret = {
-                [0] = PWRSTS_OFF_RET,   /* nonretained_bank */
-                [1] = PWRSTS_OFF_RET,   /* retained_bank */
-        },
         .pwrsts_mem_on  = {
                 [0] = PWRSTS_ON,        /* nonretained_bank */
                 [1] = PWRSTS_ON,        /* retained_bank */
@@ -132,9 +111,6 @@ static struct powerdomain gpu_7xx_pwrdm = {
         .prcm_partition   = DRA7XX_PRM_PARTITION,
         .pwrsts           = PWRSTS_OFF_ON,
         .banks            = 1,
-        .pwrsts_mem_ret = {
-                [0] = PWRSTS_OFF_RET,   /* gpu_mem */
-        },
         .pwrsts_mem_on  = {
                 [0] = PWRSTS_ON,        /* gpu_mem */
         },
@@ -148,8 +124,6 @@ static struct powerdomain wkupaon_7xx_pwrdm = {
         .prcm_partition   = DRA7XX_PRM_PARTITION,
         .pwrsts           = PWRSTS_ON,
         .banks            = 1,
-        .pwrsts_mem_ret = {
-        },
         .pwrsts_mem_on  = {
                 [0] = PWRSTS_ON,        /* wkup_bank */
         },
@@ -161,15 +135,7 @@ static struct powerdomain core_7xx_pwrdm = {
         .prcm_offs        = DRA7XX_PRM_CORE_INST,
         .prcm_partition   = DRA7XX_PRM_PARTITION,
         .pwrsts           = PWRSTS_ON,
-        .pwrsts_logic_ret = PWRSTS_RET,
         .banks            = 5,
-        .pwrsts_mem_ret = {
-                [0] = PWRSTS_OFF_RET,   /* core_nret_bank */
-                [1] = PWRSTS_OFF_RET,   /* core_ocmram */
-                [2] = PWRSTS_OFF_RET,   /* core_other_bank */
-                [3] = PWRSTS_OFF_RET,   /* ipu_l2ram */
-                [4] = PWRSTS_OFF_RET,   /* ipu_unicache */
-        },
         .pwrsts_mem_on  = {
                 [0] = PWRSTS_ON,        /* core_nret_bank */
                 [1] = PWRSTS_ON,        /* core_ocmram */
@@ -226,11 +192,7 @@ static struct powerdomain vpe_7xx_pwrdm = {
         .prcm_offs        = DRA7XX_PRM_VPE_INST,
         .prcm_partition   = DRA7XX_PRM_PARTITION,
         .pwrsts           = PWRSTS_OFF_ON,
-        .pwrsts_logic_ret = PWRSTS_OFF,
         .banks            = 1,
-        .pwrsts_mem_ret = {
-                [0] = PWRSTS_OFF_RET,   /* vpe_bank */
-        },
         .pwrsts_mem_on  = {
                 [0] = PWRSTS_ON,        /* vpe_bank */
         },
@@ -260,14 +222,8 @@ static struct powerdomain l3init_7xx_pwrdm = {
         .name             = "l3init_pwrdm",
         .prcm_offs        = DRA7XX_PRM_L3INIT_INST,
         .prcm_partition   = DRA7XX_PRM_PARTITION,
-        .pwrsts           = PWRSTS_RET_ON,
-        .pwrsts_logic_ret = PWRSTS_RET,
+        .pwrsts           = PWRSTS_ON,
         .banks            = 3,
-        .pwrsts_mem_ret = {
-                [0] = PWRSTS_OFF_RET,   /* gmac_bank */
-                [1] = PWRSTS_OFF_RET,   /* l3init_bank1 */
-                [2] = PWRSTS_OFF_RET,   /* l3init_bank2 */
-        },
         .pwrsts_mem_on  = {
                 [0] = PWRSTS_ON,        /* gmac_bank */
                 [1] = PWRSTS_ON,        /* l3init_bank1 */
@@ -283,9 +239,6 @@ static struct powerdomain eve3_7xx_pwrdm = {
         .prcm_partition   = DRA7XX_PRM_PARTITION,
         .pwrsts           = PWRSTS_OFF_ON,
         .banks            = 1,
-        .pwrsts_mem_ret = {
-                [0] = PWRSTS_OFF_RET,   /* eve3_bank */
-        },
         .pwrsts_mem_on  = {
                 [0] = PWRSTS_ON,        /* eve3_bank */
         },
@@ -299,9 +252,6 @@ static struct powerdomain emu_7xx_pwrdm = {
         .prcm_partition   = DRA7XX_PRM_PARTITION,
         .pwrsts           = PWRSTS_OFF_ON,
         .banks            = 1,
-        .pwrsts_mem_ret = {
-                [0] = PWRSTS_OFF_RET,   /* emu_bank */
-        },
         .pwrsts_mem_on  = {
                 [0] = PWRSTS_ON,        /* emu_bank */
         },
@@ -314,11 +264,6 @@ static struct powerdomain dsp2_7xx_pwrdm = {
         .prcm_partition   = DRA7XX_PRM_PARTITION,
         .pwrsts           = PWRSTS_OFF_ON,
         .banks            = 3,
-        .pwrsts_mem_ret = {
-                [0] = PWRSTS_OFF_RET,   /* dsp2_edma */
-                [1] = PWRSTS_OFF_RET,   /* dsp2_l1 */
-                [2] = PWRSTS_OFF_RET,   /* dsp2_l2 */
-        },
         .pwrsts_mem_on  = {
                 [0] = PWRSTS_ON,        /* dsp2_edma */
                 [1] = PWRSTS_ON,        /* dsp2_l1 */
@@ -334,11 +279,6 @@ static struct powerdomain dsp1_7xx_pwrdm = {
         .prcm_partition   = DRA7XX_PRM_PARTITION,
         .pwrsts           = PWRSTS_OFF_ON,
         .banks            = 3,
-        .pwrsts_mem_ret = {
-                [0] = PWRSTS_OFF_RET,   /* dsp1_edma */
-                [1] = PWRSTS_OFF_RET,   /* dsp1_l1 */
-                [2] = PWRSTS_OFF_RET,   /* dsp1_l2 */
-        },
         .pwrsts_mem_on  = {
                 [0] = PWRSTS_ON,        /* dsp1_edma */
                 [1] = PWRSTS_ON,        /* dsp1_l1 */
@@ -354,9 +294,6 @@ static struct powerdomain cam_7xx_pwrdm = {
         .prcm_partition   = DRA7XX_PRM_PARTITION,
         .pwrsts           = PWRSTS_OFF_ON,
         .banks            = 1,
-        .pwrsts_mem_ret = {
-                [0] = PWRSTS_OFF_RET,   /* vip_bank */
-        },
         .pwrsts_mem_on  = {
                 [0] = PWRSTS_ON,        /* vip_bank */
         },
@@ -370,9 +307,6 @@ static struct powerdomain eve4_7xx_pwrdm = {
         .prcm_partition   = DRA7XX_PRM_PARTITION,
         .pwrsts           = PWRSTS_OFF_ON,
         .banks            = 1,
-        .pwrsts_mem_ret = {
-                [0] = PWRSTS_OFF_RET,   /* eve4_bank */
-        },
         .pwrsts_mem_on  = {
                 [0] = PWRSTS_ON,        /* eve4_bank */
         },
@@ -386,9 +320,6 @@ static struct powerdomain eve2_7xx_pwrdm = {
         .prcm_partition   = DRA7XX_PRM_PARTITION,
         .pwrsts           = PWRSTS_OFF_ON,
         .banks            = 1,
-        .pwrsts_mem_ret = {
-                [0] = PWRSTS_OFF_RET,   /* eve2_bank */
-        },
         .pwrsts_mem_on  = {
                 [0] = PWRSTS_ON,        /* eve2_bank */
         },
@@ -402,9 +333,6 @@ static struct powerdomain eve1_7xx_pwrdm = {
         .prcm_partition   = DRA7XX_PRM_PARTITION,
         .pwrsts           = PWRSTS_OFF_ON,
         .banks            = 1,
-        .pwrsts_mem_ret = {
-                [0] = PWRSTS_OFF_RET,   /* eve1_bank */
-        },
         .pwrsts_mem_on  = {
                 [0] = PWRSTS_ON,        /* eve1_bank */
         },
diff --git a/arch/arm/mach-omap2/timer.c b/arch/arm/mach-omap2/timer.c
index 5b385bb8aff9..cb9497a20fb3 100644
--- a/arch/arm/mach-omap2/timer.c
+++ b/arch/arm/mach-omap2/timer.c
@@ -496,8 +496,7 @@ void __init omap_init_time(void)
         __omap_sync32k_timer_init(1, "timer_32k_ck", "ti,timer-alwon",
                         2, "timer_sys_ck", NULL, false);
 
-        if (of_have_populated_dt())
-                clocksource_probe();
+        clocksource_probe();
 }
 
 #if defined(CONFIG_ARCH_OMAP3) || defined(CONFIG_SOC_AM43XX)
@@ -505,6 +504,8 @@ void __init omap3_secure_sync32k_timer_init(void)
 {
         __omap_sync32k_timer_init(12, "secure_32k_fck", "ti,timer-secure",
                         2, "timer_sys_ck", NULL, false);
+
+        clocksource_probe();
 }
 #endif /* CONFIG_ARCH_OMAP3 */
 
@@ -513,6 +514,8 @@ void __init omap3_gptimer_timer_init(void)
 {
         __omap_sync32k_timer_init(2, "timer_sys_ck", NULL,
                         1, "timer_sys_ck", "ti,timer-alwon", true);
+
+        clocksource_probe();
 }
 #endif
 
diff --git a/arch/arm/mach-vexpress/spc.c b/arch/arm/mach-vexpress/spc.c
index 5766ce2be32b..8409cab3f760 100644
--- a/arch/arm/mach-vexpress/spc.c
+++ b/arch/arm/mach-vexpress/spc.c
@@ -547,7 +547,7 @@ static struct clk *ve_spc_clk_register(struct device *cpu_dev)
 
         init.name = dev_name(cpu_dev);
         init.ops = &clk_spc_ops;
-        init.flags = CLK_IS_ROOT | CLK_GET_RATE_NOCACHE;
+        init.flags = CLK_GET_RATE_NOCACHE;
         init.num_parents = 0;
 
         return devm_clk_register(cpu_dev, &spc->hw);
diff --git a/arch/arm/plat-samsung/devs.c b/arch/arm/plat-samsung/devs.c
index 84baa16f4c0b..e93aa6734147 100644
--- a/arch/arm/plat-samsung/devs.c
+++ b/arch/arm/plat-samsung/devs.c
@@ -68,7 +68,7 @@
 #include <linux/platform_data/asoc-s3c.h>
 #include <linux/platform_data/spi-s3c64xx.h>
 
-static u64 samsung_device_dma_mask = DMA_BIT_MASK(32);
+#define samsung_device_dma_mask (*((u64[]) { DMA_BIT_MASK(32) }))
 
 /* AC97 */
 #ifdef CONFIG_CPU_S3C2440
diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile
index 7085e322dc42..648a32c89541 100644
--- a/arch/arm64/Makefile
+++ b/arch/arm64/Makefile
@@ -95,7 +95,7 @@ boot := arch/arm64/boot
 Image: vmlinux
         $(Q)$(MAKE) $(build)=$(boot) $(boot)/$@
 
-Image.%: vmlinux
+Image.%: Image
         $(Q)$(MAKE) $(build)=$(boot) $(boot)/$@
 
 zinstall install:
diff --git a/arch/arm64/boot/dts/lg/lg1312.dtsi b/arch/arm64/boot/dts/lg/lg1312.dtsi
index 3a4e9a2ab313..fbafa24cd533 100644
--- a/arch/arm64/boot/dts/lg/lg1312.dtsi
+++ b/arch/arm64/boot/dts/lg/lg1312.dtsi
@@ -125,7 +125,7 @@
                 #size-cells = <1>;
                 #interrupts-cells = <3>;
 
-                compatible = "arm,amba-bus";
+                compatible = "simple-bus";
                 interrupt-parent = <&gic>;
                 ranges;
 
diff --git a/arch/arm64/boot/dts/rockchip/rk3399.dtsi b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
index 46f325a143b0..d7f8e06910bc 100644
--- a/arch/arm64/boot/dts/rockchip/rk3399.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
@@ -163,7 +163,7 @@
         };
 
         amba {
-                compatible = "arm,amba-bus";
+                compatible = "simple-bus";
                 #address-cells = <2>;
                 #size-cells = <2>;
                 ranges;
diff --git a/arch/arm64/include/asm/kgdb.h b/arch/arm64/include/asm/kgdb.h
index f69f69c8120c..da84645525b9 100644
--- a/arch/arm64/include/asm/kgdb.h
+++ b/arch/arm64/include/asm/kgdb.h
@@ -38,25 +38,54 @@ extern int kgdb_fault_expected;
 #endif /* !__ASSEMBLY__ */
 
 /*
- * gdb is expecting the following registers layout.
+ * gdb remote procotol (well most versions of it) expects the following
+ * register layout.
  *
  * General purpose regs:
  *     r0-r30: 64 bit
  *     sp,pc : 64 bit
- *     pstate  : 64 bit
- *     Total: 34
+ *     pstate  : 32 bit
+ *     Total: 33 + 1
  * FPU regs:
  *     f0-f31: 128 bit
- *     Total: 32
- * Extra regs
  *     fpsr & fpcr: 32 bit
- *     Total: 2
+ *     Total: 32 + 2
  *
+ * To expand a little on the "most versions of it"... when the gdb remote
+ * protocol for AArch64 was developed it depended on a statement in the
+ * Architecture Reference Manual that claimed "SPSR_ELx is a 32-bit register".
+ * and, as a result, allocated only 32-bits for the PSTATE in the remote
+ * protocol. In fact this statement is still present in ARM DDI 0487A.i.
+ *
+ * Unfortunately "is a 32-bit register" has a very special meaning for
+ * system registers. It means that "the upper bits, bits[63:32], are
+ * RES0.". RES0 is heavily used in the ARM architecture documents as a
+ * way to leave space for future architecture changes. So to translate a
+ * little for people who don't spend their spare time reading ARM architecture
+ * manuals, what "is a 32-bit register" actually means in this context is
+ * "is a 64-bit register but one with no meaning allocated to any of the
+ * upper 32-bits... *yet*".
+ *
+ * Perhaps then we should not be surprised that this has led to some
+ * confusion. Specifically a patch, influenced by the above translation,
+ * that extended PSTATE to 64-bit was accepted into gdb-7.7 but the patch
+ * was reverted in gdb-7.8.1 and all later releases, when this was
+ * discovered to be an undocumented protocol change.
+ *
+ * So... it is *not* wrong for us to only allocate 32-bits to PSTATE
+ * here even though the kernel itself allocates 64-bits for the same
+ * state. That is because this bit of code tells the kernel how the gdb
+ * remote protocol (well most versions of it) describes the register state.
+ *
+ * Note that if you are using one of the versions of gdb that supports
+ * the gdb-7.7 version of the protocol you cannot use kgdb directly
+ * without providing a custom register description (gdb can load new
+ * protocol descriptions at runtime).
  */
 
-#define _GP_REGS                34
+#define _GP_REGS                33
 #define _FP_REGS                32
-#define _EXTRA_REGS             2
+#define _EXTRA_REGS             3
 /*
  * general purpose registers size in bytes.
  * pstate is only 4 bytes. subtract 4 bytes
diff --git a/arch/arm64/include/asm/pgalloc.h b/arch/arm64/include/asm/pgalloc.h
index ff98585d085a..d25f4f137c2a 100644
--- a/arch/arm64/include/asm/pgalloc.h
+++ b/arch/arm64/include/asm/pgalloc.h
@@ -26,7 +26,7 @@
 
 #define check_pgt_cache()               do { } while (0)
 
-#define PGALLOC_GFP     (GFP_KERNEL | __GFP_NOTRACK | __GFP_REPEAT | __GFP_ZERO)
+#define PGALLOC_GFP     (GFP_KERNEL | __GFP_NOTRACK | __GFP_ZERO)
 #define PGD_SIZE        (PTRS_PER_PGD * sizeof(pgd_t))
 
 #if CONFIG_PGTABLE_LEVELS > 2
diff --git a/arch/arm64/include/asm/smp.h b/arch/arm64/include/asm/smp.h
index 433e50405274..022644704a93 100644
--- a/arch/arm64/include/asm/smp.h
+++ b/arch/arm64/include/asm/smp.h
@@ -124,6 +124,18 @@ static inline void cpu_panic_kernel(void)
         cpu_park_loop();
 }
 
+/*
+ * If a secondary CPU enters the kernel but fails to come online,
+ * (e.g. due to mismatched features), and cannot exit the kernel,
+ * we increment cpus_stuck_in_kernel and leave the CPU in a
+ * quiesecent loop within the kernel text. The memory containing
+ * this loop must not be re-used for anything else as the 'stuck'
+ * core is executing it.
+ *
+ * This function is used to inhibit features like kexec and hibernate.
+ */
+bool cpus_are_stuck_in_kernel(void);
+
 #endif /* ifndef __ASSEMBLY__ */
 
 #endif /* ifndef __ASM_SMP_H */
diff --git a/arch/arm64/include/asm/spinlock.h b/arch/arm64/include/asm/spinlock.h
index fc9682bfe002..e875a5a551d7 100644
--- a/arch/arm64/include/asm/spinlock.h
+++ b/arch/arm64/include/asm/spinlock.h
@@ -30,22 +30,53 @@ static inline void arch_spin_unlock_wait(arch_spinlock_t *lock)
 {
         unsigned int tmp;
         arch_spinlock_t lockval;
+        u32 owner;
+
+        /*
+         * Ensure prior spin_lock operations to other locks have completed
+         * on this CPU before we test whether "lock" is locked.
+         */
+        smp_mb();
+        owner = READ_ONCE(lock->owner) << 16;
 
         asm volatile(
 "       sevl\n"
 "1:     wfe\n"
 "2:     ldaxr   %w0, %2\n"
+        /* Is the lock free? */
 "       eor     %w1, %w0, %w0, ror #16\n"
-"       cbnz    %w1, 1b\n"
+"       cbz     %w1, 3f\n"
+        /* Lock taken -- has there been a subsequent unlock->lock transition? */
+"       eor     %w1, %w3, %w0, lsl #16\n"
+"       cbz     %w1, 1b\n"
+        /*
+         * The owner has been updated, so there was an unlock->lock
+         * transition that we missed. That means we can rely on the
+         * store-release of the unlock operation paired with the
+         * load-acquire of the lock operation to publish any of our
+         * previous stores to the new lock owner and therefore don't
+         * need to bother with the writeback below.
+         */
+"       b       4f\n"
+"3:\n"
+        /*
+         * Serialise against any concurrent lockers by writing back the
+         * unlocked lock value
+         */
         ARM64_LSE_ATOMIC_INSN(
         /* LL/SC */
 "       stxr    %w1, %w0, %2\n"
-"       cbnz    %w1, 2b\n", /* Serialise against any concurrent lockers */
-        /* LSE atomics */
 "       nop\n"
-"       nop\n")
+"       nop\n",
+        /* LSE atomics */
+"       mov     %w1, %w0\n"
+"       cas     %w0, %w0, %2\n"
+"       eor     %w1, %w1, %w0\n")
+        /* Somebody else wrote to the lock, GOTO 10 and reload the value */
+"       cbnz    %w1, 2b\n"
+"4:"
         : "=&r" (lockval), "=&r" (tmp), "+Q" (*lock)
-        :
+        : "r" (owner)
         : "memory");
 }
 
@@ -148,6 +179,7 @@ static inline int arch_spin_value_unlocked(arch_spinlock_t lock)
 
 static inline int arch_spin_is_locked(arch_spinlock_t *lock)
 {
+        smp_mb(); /* See arch_spin_unlock_wait */
         return !arch_spin_value_unlocked(READ_ONCE(*lock));
 }
 
diff --git a/arch/arm64/kernel/hibernate.c b/arch/arm64/kernel/hibernate.c
index f8df75d740f4..21ab5df9fa76 100644
--- a/arch/arm64/kernel/hibernate.c
+++ b/arch/arm64/kernel/hibernate.c
@@ -33,6 +33,7 @@
 #include <asm/pgtable.h>
 #include <asm/pgtable-hwdef.h>
 #include <asm/sections.h>
+#include <asm/smp.h>
 #include <asm/suspend.h>
 #include <asm/virt.h>
 
@@ -236,6 +237,11 @@ int swsusp_arch_suspend(void)
         unsigned long flags;
         struct sleep_stack_data state;
 
+        if (cpus_are_stuck_in_kernel()) {
+                pr_err("Can't hibernate: no mechanism to offline secondary CPUs.\n");
+                return -EBUSY;
+        }
+
         local_dbg_save(flags);
 
         if (__cpu_suspend_enter(&state)) {
diff --git a/arch/arm64/kernel/kgdb.c b/arch/arm64/kernel/kgdb.c
index b67531a13136..b5f063e5eff7 100644
--- a/arch/arm64/kernel/kgdb.c
+++ b/arch/arm64/kernel/kgdb.c
@@ -58,7 +58,17 @@ struct dbg_reg_def_t dbg_reg_def[DBG_MAX_REG_NUM] = {
         { "x30", 8, offsetof(struct pt_regs, regs[30])},
         { "sp", 8, offsetof(struct pt_regs, sp)},
         { "pc", 8, offsetof(struct pt_regs, pc)},
-        { "pstate", 8, offsetof(struct pt_regs, pstate)},
+        /*
+         * struct pt_regs thinks PSTATE is 64-bits wide but gdb remote
+         * protocol disagrees. Therefore we must extract only the lower
+         * 32-bits. Look for the big comment in asm/kgdb.h for more
+         * detail.
+         */
+        { "pstate", 4, offsetof(struct pt_regs, pstate)
+#ifdef CONFIG_CPU_BIG_ENDIAN
+                                                        + 4
+#endif
+        },
         { "v0", 16, -1 },
         { "v1", 16, -1 },
         { "v2", 16, -1 },
@@ -128,6 +138,8 @@ sleeping_thread_to_gdb_regs(unsigned long *gdb_regs, struct task_struct *task)
         memset((char *)gdb_regs, 0, NUMREGBYTES);
         thread_regs = task_pt_regs(task);
         memcpy((void *)gdb_regs, (void *)thread_regs->regs, GP_REG_BYTES);
+        /* Special case for PSTATE (check comments in asm/kgdb.h for details) */
+        dbg_get_reg(33, gdb_regs + GP_REG_BYTES, thread_regs);
 }
 
 void kgdb_arch_set_pc(struct pt_regs *regs, unsigned long pc)
diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c
index 678e0842cb3b..62ff3c0622e2 100644
--- a/arch/arm64/kernel/smp.c
+++ b/arch/arm64/kernel/smp.c
@@ -909,3 +909,21 @@ int setup_profiling_timer(unsigned int multiplier)
 {
         return -EINVAL;
 }
+
+static bool have_cpu_die(void)
+{
+#ifdef CONFIG_HOTPLUG_CPU
+        int any_cpu = raw_smp_processor_id();
+
+        if (cpu_ops[any_cpu]->cpu_die)
+                return true;
+#endif
+        return false;
+}
+
+bool cpus_are_stuck_in_kernel(void)
+{
+        bool smp_spin_tables = (num_possible_cpus() > 1 && !have_cpu_die());
+
+        return !!cpus_stuck_in_kernel || smp_spin_tables;
+}
diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
index f7cf463107df..2a43012616b7 100644
--- a/arch/arm64/kernel/traps.c
+++ b/arch/arm64/kernel/traps.c
@@ -64,8 +64,7 @@ static void dump_mem(const char *lvl, const char *str, unsigned long bottom,
 
         /*
          * We need to switch to kernel mode so that we can use __get_user
-         * to safely read from kernel space.  Note that we now dump the
-         * code first, just in case the backtrace kills us.
+         * to safely read from kernel space.
          */
         fs = get_fs();
         set_fs(KERNEL_DS);
@@ -111,21 +110,12 @@ static void dump_backtrace_entry(unsigned long where)
         print_ip_sym(where);
 }
 
-static void dump_instr(const char *lvl, struct pt_regs *regs)
+static void __dump_instr(const char *lvl, struct pt_regs *regs)
 {
         unsigned long addr = instruction_pointer(regs);
-        mm_segment_t fs;
         char str[sizeof("00000000 ") * 5 + 2 + 1], *p = str;
         int i;
 
-        /*
-         * We need to switch to kernel mode so that we can use __get_user
-         * to safely read from kernel space.  Note that we now dump the
-         * code first, just in case the backtrace kills us.
-         */
-        fs = get_fs();
-        set_fs(KERNEL_DS);
-
         for (i = -4; i < 1; i++) {
                 unsigned int val, bad;
 
@@ -139,8 +129,18 @@ static void dump_instr(const char *lvl, struct pt_regs *regs)
                 }
         }
         printk("%sCode: %s\n", lvl, str);
+}
 
-        set_fs(fs);
+static void dump_instr(const char *lvl, struct pt_regs *regs)
+{
+        if (!user_mode(regs)) {
+                mm_segment_t fs = get_fs();
+                set_fs(KERNEL_DS);
+                __dump_instr(lvl, regs);
+                set_fs(fs);
+        } else {
+                __dump_instr(lvl, regs);
+        }
 }
 
 static void dump_backtrace(struct pt_regs *regs, struct task_struct *tsk)
diff --git a/arch/arm64/mm/context.c b/arch/arm64/mm/context.c
index b7b397802088..efcf1f7ef1e4 100644
--- a/arch/arm64/mm/context.c
+++ b/arch/arm64/mm/context.c
@@ -179,7 +179,7 @@ static u64 new_context(struct mm_struct *mm, unsigned int cpu)
                                                  &asid_generation);
         flush_context(cpu);
 
-        /* We have at least 1 ASID per CPU, so this will always succeed */
+        /* We have more ASIDs than CPUs, so this will always succeed */
         asid = find_next_zero_bit(asid_map, NUM_USER_ASIDS, 1);
 
 set_asid:
@@ -227,8 +227,11 @@ switch_mm_fastpath:
 static int asids_init(void)
 {
         asid_bits = get_cpu_asid_bits();
-        /* If we end up with more CPUs than ASIDs, expect things to crash */
-        WARN_ON(NUM_USER_ASIDS < num_possible_cpus());
+        /*
+         * Expect allocation after rollover to fail if we don't have at least
+         * one more ASID than CPUs. ASID #0 is reserved for init_mm.
+         */
+        WARN_ON(NUM_USER_ASIDS - 1 <= num_possible_cpus());
         atomic64_set(&asid_generation, ASID_FIRST_VERSION);
         asid_map = kzalloc(BITS_TO_LONGS(NUM_USER_ASIDS) * sizeof(*asid_map),
                            GFP_KERNEL);
diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
index 5954881a35ac..013e2cbe7924 100644
--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -109,7 +109,7 @@ int ptep_set_access_flags(struct vm_area_struct *vma,
          * PTE_RDONLY is cleared by default in the asm below, so set it in
          * back if necessary (read-only or clean PTE).
          */
-        if (!pte_write(entry) || !dirty)
+        if (!pte_write(entry) || !pte_sw_dirty(entry))
                 pte_val(entry) |= PTE_RDONLY;
 
         /*
@@ -441,7 +441,7 @@ static int do_bad(unsigned long addr, unsigned int esr, struct pt_regs *regs)
         return 1;
 }
 
-static struct fault_info {
+static const struct fault_info {
         int     (*fn)(unsigned long addr, unsigned int esr, struct pt_regs *regs);
         int     sig;
         int     code;
diff --git a/arch/arm64/mm/flush.c b/arch/arm64/mm/flush.c
index dbd12ea8ce68..43a76b07eb32 100644
--- a/arch/arm64/mm/flush.c
+++ b/arch/arm64/mm/flush.c
@@ -71,10 +71,6 @@ void __sync_icache_dcache(pte_t pte, unsigned long addr)
 {
         struct page *page = pte_page(pte);
 
-        /* no flushing needed for anonymous pages */
-        if (!page_mapping(page))
-                return;
-
         if (!test_and_set_bit(PG_dcache_clean, &page->flags))
                 sync_icache_aliases(page_address(page),
                                     PAGE_SIZE << compound_order(page));
diff --git a/arch/avr32/include/asm/pgalloc.h b/arch/avr32/include/asm/pgalloc.h
index 1aba19d68c5e..db039cb368be 100644
--- a/arch/avr32/include/asm/pgalloc.h
+++ b/arch/avr32/include/asm/pgalloc.h
@@ -43,7 +43,7 @@ static inline void pgd_ctor(void *x)
  */
 static inline pgd_t *pgd_alloc(struct mm_struct *mm)
 {
-        return quicklist_alloc(QUICK_PGD, GFP_KERNEL | __GFP_REPEAT, pgd_ctor);
+        return quicklist_alloc(QUICK_PGD, GFP_KERNEL, pgd_ctor);
 }
 
 static inline void pgd_free(struct mm_struct *mm, pgd_t *pgd)
@@ -54,7 +54,7 @@ static inline void pgd_free(struct mm_struct *mm, pgd_t *pgd)
 static inline pte_t *pte_alloc_one_kernel(struct mm_struct *mm,
                                           unsigned long address)
 {
-        return quicklist_alloc(QUICK_PT, GFP_KERNEL | __GFP_REPEAT, NULL);
+        return quicklist_alloc(QUICK_PT, GFP_KERNEL, NULL);
 }
 
 static inline pgtable_t pte_alloc_one(struct mm_struct *mm,
@@ -63,7 +63,7 @@ static inline pgtable_t pte_alloc_one(struct mm_struct *mm,
         struct page *page;
         void *pg;
 
-        pg = quicklist_alloc(QUICK_PT, GFP_KERNEL | __GFP_REPEAT, NULL);
+        pg = quicklist_alloc(QUICK_PT, GFP_KERNEL, NULL);
         if (!pg)
                 return NULL;
 
diff --git a/arch/cris/include/asm/pgalloc.h b/arch/cris/include/asm/pgalloc.h
index 235ece437ddd..42f1affb9c2d 100644
--- a/arch/cris/include/asm/pgalloc.h
+++ b/arch/cris/include/asm/pgalloc.h
@@ -24,14 +24,14 @@ static inline void pgd_free(struct mm_struct *mm, pgd_t *pgd)
 
 static inline pte_t *pte_alloc_one_kernel(struct mm_struct *mm, unsigned long address)
 {
-        pte_t *pte = (pte_t *)__get_free_page(GFP_KERNEL|__GFP_REPEAT|__GFP_ZERO);
+        pte_t *pte = (pte_t *)__get_free_page(GFP_KERNEL|__GFP_ZERO);
         return pte;
 }
 
 static inline pgtable_t pte_alloc_one(struct mm_struct *mm, unsigned long address)
 {
         struct page *pte;
-        pte = alloc_pages(GFP_KERNEL|__GFP_REPEAT|__GFP_ZERO, 0);
+        pte = alloc_pages(GFP_KERNEL|__GFP_ZERO, 0);
         if (!pte)
                 return NULL;
         if (!pgtable_page_ctor(pte)) {
diff --git a/arch/frv/mm/pgalloc.c b/arch/frv/mm/pgalloc.c
index 41907d25ed38..c9ed14f6c67d 100644
--- a/arch/frv/mm/pgalloc.c
+++ b/arch/frv/mm/pgalloc.c
@@ -22,7 +22,7 @@ pgd_t swapper_pg_dir[PTRS_PER_PGD] __attribute__((aligned(PAGE_SIZE)));
 
 pte_t *pte_alloc_one_kernel(struct mm_struct *mm, unsigned long address)
 {
-        pte_t *pte = (pte_t *)__get_free_page(GFP_KERNEL|__GFP_REPEAT);
+        pte_t *pte = (pte_t *)__get_free_page(GFP_KERNEL);
         if (pte)
                 clear_page(pte);
         return pte;
@@ -33,9 +33,9 @@ pgtable_t pte_alloc_one(struct mm_struct *mm, unsigned long address)
         struct page *page;
 
 #ifdef CONFIG_HIGHPTE
-        page = alloc_pages(GFP_KERNEL|__GFP_HIGHMEM|__GFP_REPEAT, 0);
+        page = alloc_pages(GFP_KERNEL|__GFP_HIGHMEM, 0);
 #else
-        page = alloc_pages(GFP_KERNEL|__GFP_REPEAT, 0);
+        page = alloc_pages(GFP_KERNEL, 0);
 #endif
         if (!page)
                 return NULL;
diff --git a/arch/hexagon/include/asm/pgalloc.h b/arch/hexagon/include/asm/pgalloc.h
index 77da3b0ae3c2..eeebf862c46c 100644
--- a/arch/hexagon/include/asm/pgalloc.h
+++ b/arch/hexagon/include/asm/pgalloc.h
@@ -64,7 +64,7 @@ static inline struct page *pte_alloc_one(struct mm_struct *mm,
 {
         struct page *pte;
 
-        pte = alloc_page(GFP_KERNEL | __GFP_REPEAT | __GFP_ZERO);
+        pte = alloc_page(GFP_KERNEL | __GFP_ZERO);
         if (!pte)
                 return NULL;
         if (!pgtable_page_ctor(pte)) {
@@ -78,7 +78,7 @@ static inline struct page *pte_alloc_one(struct mm_struct *mm,
 static inline pte_t *pte_alloc_one_kernel(struct mm_struct *mm,
                                           unsigned long address)
 {
-        gfp_t flags =  GFP_KERNEL | __GFP_REPEAT | __GFP_ZERO;
+        gfp_t flags =  GFP_KERNEL | __GFP_ZERO;
         return (pte_t *) __get_free_page(flags);
 }
 
diff --git a/arch/ia64/Kconfig b/arch/ia64/Kconfig
index f80758cb7157..e109ee95e919 100644
--- a/arch/ia64/Kconfig
+++ b/arch/ia64/Kconfig
@@ -45,7 +45,7 @@ config IA64
         select GENERIC_SMP_IDLE_THREAD
         select ARCH_INIT_TASK
         select ARCH_TASK_STRUCT_ALLOCATOR
-        select ARCH_THREAD_INFO_ALLOCATOR
+        select ARCH_THREAD_STACK_ALLOCATOR
         select ARCH_CLOCKSOURCE_DATA
         select GENERIC_TIME_VSYSCALL_OLD
         select SYSCTL_ARCH_UNALIGN_NO_WARN
diff --git a/arch/ia64/include/asm/thread_info.h b/arch/ia64/include/asm/thread_info.h
index aa995b67c3f5..d1212b84fb83 100644
--- a/arch/ia64/include/asm/thread_info.h
+++ b/arch/ia64/include/asm/thread_info.h
@@ -48,15 +48,15 @@ struct thread_info {
 #ifndef ASM_OFFSETS_C
 /* how to get the thread information struct from C */
 #define current_thread_info()   ((struct thread_info *) ((char *) current + IA64_TASK_SIZE))
-#define alloc_thread_info_node(tsk, node)       \
-                ((struct thread_info *) ((char *) (tsk) + IA64_TASK_SIZE))
+#define alloc_thread_stack_node(tsk, node)      \
+                ((unsigned long *) ((char *) (tsk) + IA64_TASK_SIZE))
 #define task_thread_info(tsk)   ((struct thread_info *) ((char *) (tsk) + IA64_TASK_SIZE))
 #else
 #define current_thread_info()   ((struct thread_info *) 0)
-#define alloc_thread_info_node(tsk, node)       ((struct thread_info *) 0)
+#define alloc_thread_stack_node(tsk, node)      ((unsigned long *) 0)
 #define task_thread_info(tsk)   ((struct thread_info *) 0)
 #endif
-#define free_thread_info(ti)    /* nothing */
+#define free_thread_stack(ti)   /* nothing */
 #define task_stack_page(tsk)    ((void *)(tsk))
 
 #define __HAVE_THREAD_FUNCTIONS
diff --git a/arch/ia64/kernel/init_task.c b/arch/ia64/kernel/init_task.c
index f9efe9739d3f..0eaa89f3defd 100644
--- a/arch/ia64/kernel/init_task.c
+++ b/arch/ia64/kernel/init_task.c
@@ -26,6 +26,7 @@ static struct sighand_struct init_sighand = INIT_SIGHAND(init_sighand);
  * handled. This is done by having a special ".data..init_task" section...
  */
 #define init_thread_info        init_task_mem.s.thread_info
+#define init_stack              init_task_mem.stack
 
 union {
         struct {
diff --git a/arch/m68k/include/asm/mcf_pgalloc.h b/arch/m68k/include/asm/mcf_pgalloc.h
index f9924fbcfe42..fb95aed5f428 100644
--- a/arch/m68k/include/asm/mcf_pgalloc.h
+++ b/arch/m68k/include/asm/mcf_pgalloc.h
@@ -14,7 +14,7 @@ extern const char bad_pmd_string[];
 extern inline pte_t *pte_alloc_one_kernel(struct mm_struct *mm,
         unsigned long address)
 {
-        unsigned long page = __get_free_page(GFP_DMA|__GFP_REPEAT);
+        unsigned long page = __get_free_page(GFP_DMA);
 
         if (!page)
                 return NULL;
@@ -51,7 +51,7 @@ static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t page,
 static inline struct page *pte_alloc_one(struct mm_struct *mm,
         unsigned long address)
 {
-        struct page *page = alloc_pages(GFP_DMA|__GFP_REPEAT, 0);
+        struct page *page = alloc_pages(GFP_DMA, 0);
         pte_t *pte;
 
         if (!page)
diff --git a/arch/m68k/include/asm/motorola_pgalloc.h b/arch/m68k/include/asm/motorola_pgalloc.h
index 24bcba496c75..c895b987202c 100644
--- a/arch/m68k/include/asm/motorola_pgalloc.h
+++ b/arch/m68k/include/asm/motorola_pgalloc.h
@@ -11,7 +11,7 @@ static inline pte_t *pte_alloc_one_kernel(struct mm_struct *mm, unsigned long ad
 {
         pte_t *pte;
 
-        pte = (pte_t *)__get_free_page(GFP_KERNEL|__GFP_REPEAT|__GFP_ZERO);
+        pte = (pte_t *)__get_free_page(GFP_KERNEL|__GFP_ZERO);
         if (pte) {
                 __flush_page_to_ram(pte);
                 flush_tlb_kernel_page(pte);
@@ -32,7 +32,7 @@ static inline pgtable_t pte_alloc_one(struct mm_struct *mm, unsigned long addres
         struct page *page;
         pte_t *pte;
 
-        page = alloc_pages(GFP_KERNEL|__GFP_REPEAT|__GFP_ZERO, 0);
+        page = alloc_pages(GFP_KERNEL|__GFP_ZERO, 0);
         if(!page)
                 return NULL;
         if (!pgtable_page_ctor(page)) {
diff --git a/arch/m68k/include/asm/sun3_pgalloc.h b/arch/m68k/include/asm/sun3_pgalloc.h
index 0931388de47f..1901f61f926f 100644
--- a/arch/m68k/include/asm/sun3_pgalloc.h
+++ b/arch/m68k/include/asm/sun3_pgalloc.h
@@ -37,7 +37,7 @@ do {							\
 static inline pte_t *pte_alloc_one_kernel(struct mm_struct *mm,
                                           unsigned long address)
 {
-        unsigned long page = __get_free_page(GFP_KERNEL|__GFP_REPEAT);
+        unsigned long page = __get_free_page(GFP_KERNEL);
 
         if (!page)
                 return NULL;
@@ -49,7 +49,7 @@ static inline pte_t *pte_alloc_one_kernel(struct mm_struct *mm,
 static inline pgtable_t pte_alloc_one(struct mm_struct *mm,
                                         unsigned long address)
 {
-        struct page *page = alloc_pages(GFP_KERNEL|__GFP_REPEAT, 0);
+        struct page *page = alloc_pages(GFP_KERNEL, 0);
 
         if (page == NULL)
                 return NULL;
diff --git a/arch/metag/include/asm/pgalloc.h b/arch/metag/include/asm/pgalloc.h
index 3104df0a4822..c2caa1ee4360 100644
--- a/arch/metag/include/asm/pgalloc.h
+++ b/arch/metag/include/asm/pgalloc.h
@@ -42,8 +42,7 @@ static inline void pgd_free(struct mm_struct *mm, pgd_t *pgd)
 static inline pte_t *pte_alloc_one_kernel(struct mm_struct *mm,
                                           unsigned long address)
 {
-        pte_t *pte = (pte_t *)__get_free_page(GFP_KERNEL | __GFP_REPEAT |
-                                              __GFP_ZERO);
+        pte_t *pte = (pte_t *)__get_free_page(GFP_KERNEL | __GFP_ZERO);
         return pte;
 }
 
@@ -51,7 +50,7 @@ static inline pgtable_t pte_alloc_one(struct mm_struct *mm,
                                       unsigned long address)
 {
         struct page *pte;
-        pte = alloc_pages(GFP_KERNEL | __GFP_REPEAT | __GFP_ZERO, 0);
+        pte = alloc_pages(GFP_KERNEL  | __GFP_ZERO, 0);
         if (!pte)
                 return NULL;
         if (!pgtable_page_ctor(pte)) {
diff --git a/arch/microblaze/include/asm/pgalloc.h b/arch/microblaze/include/asm/pgalloc.h
index 61436d69775c..7c89390c0c13 100644
--- a/arch/microblaze/include/asm/pgalloc.h
+++ b/arch/microblaze/include/asm/pgalloc.h
@@ -116,9 +116,9 @@ static inline struct page *pte_alloc_one(struct mm_struct *mm,
         struct page *ptepage;
 
 #ifdef CONFIG_HIGHPTE
-        int flags = GFP_KERNEL | __GFP_HIGHMEM | __GFP_REPEAT;
+        int flags = GFP_KERNEL | __GFP_HIGHMEM;
 #else
-        int flags = GFP_KERNEL | __GFP_REPEAT;
+        int flags = GFP_KERNEL;
 #endif
 
         ptepage = alloc_pages(flags, 0);
diff --git a/arch/microblaze/mm/pgtable.c b/arch/microblaze/mm/pgtable.c
index 4f4520e779a5..eb99fcc76088 100644
--- a/arch/microblaze/mm/pgtable.c
+++ b/arch/microblaze/mm/pgtable.c
@@ -239,8 +239,7 @@ __init_refok pte_t *pte_alloc_one_kernel(struct mm_struct *mm,
 {
         pte_t *pte;
         if (mem_init_done) {
-                pte = (pte_t *)__get_free_page(GFP_KERNEL |
-                                        __GFP_REPEAT | __GFP_ZERO);
+                pte = (pte_t *)__get_free_page(GFP_KERNEL | __GFP_ZERO);
         } else {
                 pte = (pte_t *)early_get_page();
                 if (pte)
diff --git a/arch/mips/include/asm/kvm_host.h b/arch/mips/include/asm/kvm_host.h
index 6733ac575da4..36a391d289aa 100644
--- a/arch/mips/include/asm/kvm_host.h
+++ b/arch/mips/include/asm/kvm_host.h
@@ -74,7 +74,7 @@
 #define KVM_GUEST_KUSEG                 0x00000000UL
 #define KVM_GUEST_KSEG0                 0x40000000UL
 #define KVM_GUEST_KSEG23                0x60000000UL
-#define KVM_GUEST_KSEGX(a)              ((_ACAST32_(a)) & 0x60000000)
+#define KVM_GUEST_KSEGX(a)              ((_ACAST32_(a)) & 0xe0000000)
 #define KVM_GUEST_CPHYSADDR(a)          ((_ACAST32_(a)) & 0x1fffffff)
 
 #define KVM_GUEST_CKSEG0ADDR(a)         (KVM_GUEST_CPHYSADDR(a) | KVM_GUEST_KSEG0)
@@ -338,6 +338,7 @@ struct kvm_mips_tlb {
 #define KVM_MIPS_GUEST_TLB_SIZE 64
 struct kvm_vcpu_arch {
         void *host_ebase, *guest_ebase;
+        int (*vcpu_run)(struct kvm_run *run, struct kvm_vcpu *vcpu);
         unsigned long host_stack;
         unsigned long host_gp;
 
diff --git a/arch/mips/include/asm/pgalloc.h b/arch/mips/include/asm/pgalloc.h
index b336037e8768..93c079a1cfc8 100644
--- a/arch/mips/include/asm/pgalloc.h
+++ b/arch/mips/include/asm/pgalloc.h
@@ -69,7 +69,7 @@ static inline pte_t *pte_alloc_one_kernel(struct mm_struct *mm,
 {
         pte_t *pte;
 
-        pte = (pte_t *) __get_free_pages(GFP_KERNEL|__GFP_REPEAT|__GFP_ZERO, PTE_ORDER);
+        pte = (pte_t *) __get_free_pages(GFP_KERNEL|__GFP_ZERO, PTE_ORDER);
 
         return pte;
 }
@@ -79,7 +79,7 @@ static inline struct page *pte_alloc_one(struct mm_struct *mm,
 {
         struct page *pte;
 
-        pte = alloc_pages(GFP_KERNEL | __GFP_REPEAT, PTE_ORDER);
+        pte = alloc_pages(GFP_KERNEL, PTE_ORDER);
         if (!pte)
                 return NULL;
         clear_highpage(pte);
@@ -113,7 +113,7 @@ static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long address)
 {
         pmd_t *pmd;
 
-        pmd = (pmd_t *) __get_free_pages(GFP_KERNEL|__GFP_REPEAT, PMD_ORDER);
+        pmd = (pmd_t *) __get_free_pages(GFP_KERNEL, PMD_ORDER);
         if (pmd)
                 pmd_init((unsigned long)pmd, (unsigned long)invalid_pte_table);
         return pmd;
diff --git a/arch/mips/include/asm/pgtable.h b/arch/mips/include/asm/pgtable.h
index a6b611f1da43..f53816744d60 100644
--- a/arch/mips/include/asm/pgtable.h
+++ b/arch/mips/include/asm/pgtable.h
@@ -24,7 +24,7 @@ struct mm_struct;
 struct vm_area_struct;
 
 #define PAGE_NONE       __pgprot(_PAGE_PRESENT | _PAGE_NO_READ | \
-                                 _CACHE_CACHABLE_NONCOHERENT)
+                                 _page_cachable_default)
 #define PAGE_SHARED     __pgprot(_PAGE_PRESENT | _PAGE_WRITE | \
                                  _page_cachable_default)
 #define PAGE_COPY       __pgprot(_PAGE_PRESENT | _PAGE_NO_EXEC | \
@@ -476,7 +476,7 @@ static inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
         pte.pte_low  &= (_PAGE_MODIFIED | _PAGE_ACCESSED | _PFNX_MASK);
         pte.pte_high &= (_PFN_MASK | _CACHE_MASK);
         pte.pte_low  |= pgprot_val(newprot) & ~_PFNX_MASK;
-        pte.pte_high |= pgprot_val(newprot) & ~_PFN_MASK;
+        pte.pte_high |= pgprot_val(newprot) & ~(_PFN_MASK | _CACHE_MASK);
         return pte;
 }
 #elif defined(CONFIG_PHYS_ADDR_T_64BIT) && defined(CONFIG_CPU_MIPS32)
@@ -491,7 +491,8 @@ static inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
 #else
 static inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
 {
-        return __pte((pte_val(pte) & _PAGE_CHG_MASK) | pgprot_val(newprot));
+        return __pte((pte_val(pte) & _PAGE_CHG_MASK) |
+                     (pgprot_val(newprot) & ~_PAGE_CHG_MASK));
 }
 #endif
 
@@ -632,7 +633,8 @@ static inline struct page *pmd_page(pmd_t pmd)
 
 static inline pmd_t pmd_modify(pmd_t pmd, pgprot_t newprot)
 {
-        pmd_val(pmd) = (pmd_val(pmd) & _PAGE_CHG_MASK) | pgprot_val(newprot);
+        pmd_val(pmd) = (pmd_val(pmd) & _PAGE_CHG_MASK) |
+                       (pgprot_val(newprot) & ~_PAGE_CHG_MASK);
         return pmd;
 }
 
diff --git a/arch/mips/kvm/emulate.c b/arch/mips/kvm/emulate.c
index 396df6eb0a12..645c8a1982a7 100644
--- a/arch/mips/kvm/emulate.c
+++ b/arch/mips/kvm/emulate.c
@@ -1636,6 +1636,7 @@ enum emulation_result kvm_mips_emulate_cache(uint32_t inst, uint32_t *opc,
                 if (index < 0) {
                         vcpu->arch.host_cp0_entryhi = (va & VPN2_MASK);
                         vcpu->arch.host_cp0_badvaddr = va;
+                        vcpu->arch.pc = curr_pc;
                         er = kvm_mips_emulate_tlbmiss_ld(cause, NULL, run,
                                                          vcpu);
                         preempt_enable();
@@ -1647,6 +1648,8 @@ enum emulation_result kvm_mips_emulate_cache(uint32_t inst, uint32_t *opc,
                          * invalid exception to the guest
                          */
                         if (!TLB_IS_VALID(*tlb, va)) {
+                                vcpu->arch.host_cp0_badvaddr = va;
+                                vcpu->arch.pc = curr_pc;
                                 er = kvm_mips_emulate_tlbinv_ld(cause, NULL,
                                                                 run, vcpu);
                                 preempt_enable();
@@ -1666,7 +1669,7 @@ enum emulation_result kvm_mips_emulate_cache(uint32_t inst, uint32_t *opc,
                         cache, op, base, arch->gprs[base], offset);
                 er = EMULATE_FAIL;
                 preempt_enable();
-                goto dont_update_pc;
+                goto done;
 
         }
 
@@ -1694,16 +1697,20 @@ skip_fault:
                 kvm_err("NO-OP CACHE (cache: %#x, op: %#x, base[%d]: %#lx, offset: %#x\n",
                         cache, op, base, arch->gprs[base], offset);
                 er = EMULATE_FAIL;
-                preempt_enable();
-                goto dont_update_pc;
         }
 
         preempt_enable();
+done:
+        /* Rollback PC only if emulation was unsuccessful */
+        if (er == EMULATE_FAIL)
+                vcpu->arch.pc = curr_pc;
 
 dont_update_pc:
-        /* Rollback PC */
-        vcpu->arch.pc = curr_pc;
-done:
+        /*
+         * This is for exceptions whose emulation updates the PC, so do not
+         * overwrite the PC under any circumstances
+         */
+
         return er;
 }
 
diff --git a/arch/mips/kvm/interrupt.h b/arch/mips/kvm/interrupt.h
index 4ab4bdfad703..2143884709e4 100644
--- a/arch/mips/kvm/interrupt.h
+++ b/arch/mips/kvm/interrupt.h
@@ -28,6 +28,7 @@
 #define MIPS_EXC_MAX                12
 /* XXXSL More to follow */
 
+extern char __kvm_mips_vcpu_run_end[];
 extern char mips32_exception[], mips32_exceptionEnd[];
 extern char mips32_GuestException[], mips32_GuestExceptionEnd[];
 
diff --git a/arch/mips/kvm/locore.S b/arch/mips/kvm/locore.S
index 3ef03009de5f..828fcfc1cd7f 100644
--- a/arch/mips/kvm/locore.S
+++ b/arch/mips/kvm/locore.S
@@ -202,6 +202,7 @@ FEXPORT(__kvm_mips_load_k0k1)
 
         /* Jump to guest */
         eret
+EXPORT(__kvm_mips_vcpu_run_end)
 
 VECTOR(MIPSX(exception), unknown)
 /* Find out what mode we came from and jump to the proper handler. */
diff --git a/arch/mips/kvm/mips.c b/arch/mips/kvm/mips.c
index dc052fb5c7a2..44da5259f390 100644
--- a/arch/mips/kvm/mips.c
+++ b/arch/mips/kvm/mips.c
@@ -315,6 +315,15 @@ struct kvm_vcpu *kvm_arch_vcpu_create(struct kvm *kvm, unsigned int id)
         memcpy(gebase + offset, mips32_GuestException,
                mips32_GuestExceptionEnd - mips32_GuestException);
 
+#ifdef MODULE
+        offset += mips32_GuestExceptionEnd - mips32_GuestException;
+        memcpy(gebase + offset, (char *)__kvm_mips_vcpu_run,
+               __kvm_mips_vcpu_run_end - (char *)__kvm_mips_vcpu_run);
+        vcpu->arch.vcpu_run = gebase + offset;
+#else
+        vcpu->arch.vcpu_run = __kvm_mips_vcpu_run;
+#endif
+
         /* Invalidate the icache for these ranges */
         local_flush_icache_range((unsigned long)gebase,
                                 (unsigned long)gebase + ALIGN(size, PAGE_SIZE));
@@ -404,7 +413,7 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *run)
         /* Disable hardware page table walking while in guest */
         htw_stop();
 
-        r = __kvm_mips_vcpu_run(run, vcpu);
+        r = vcpu->arch.vcpu_run(run, vcpu);
 
         /* Re-enable HTW before enabling interrupts */
         htw_start();
diff --git a/arch/mn10300/include/asm/thread_info.h b/arch/mn10300/include/asm/thread_info.h
index 4861a78c7160..f5f90bbf019d 100644
--- a/arch/mn10300/include/asm/thread_info.h
+++ b/arch/mn10300/include/asm/thread_info.h
@@ -115,7 +115,7 @@ static inline unsigned long current_stack_pointer(void)
 }
 
 #ifndef CONFIG_KGDB
-void arch_release_thread_info(struct thread_info *ti);
+void arch_release_thread_stack(unsigned long *stack);
 #endif
 #define get_thread_info(ti)     get_task_struct((ti)->task)
 #define put_thread_info(ti)     put_task_struct((ti)->task)
diff --git a/arch/mn10300/kernel/kgdb.c b/arch/mn10300/kernel/kgdb.c
index 99770823451a..2d7986c386fe 100644
--- a/arch/mn10300/kernel/kgdb.c
+++ b/arch/mn10300/kernel/kgdb.c
@@ -397,8 +397,9 @@ static bool kgdb_arch_undo_singlestep(struct pt_regs *regs)
  * single-step state is cleared.  At this point the breakpoints should have
  * been removed by __switch_to().
  */
-void arch_release_thread_info(struct thread_info *ti)
+void arch_release_thread_stack(unsigned long *stack)
 {
+        struct thread_info *ti = (void *)stack;
         if (kgdb_sstep_thread == ti) {
                 kgdb_sstep_thread = NULL;
 
diff --git a/arch/mn10300/mm/pgtable.c b/arch/mn10300/mm/pgtable.c
index e77a7c728081..9577cf768875 100644
--- a/arch/mn10300/mm/pgtable.c
+++ b/arch/mn10300/mm/pgtable.c
@@ -63,7 +63,7 @@ void set_pmd_pfn(unsigned long vaddr, unsigned long pfn, pgprot_t flags)
 
 pte_t *pte_alloc_one_kernel(struct mm_struct *mm, unsigned long address)
 {
-        pte_t *pte = (pte_t *)__get_free_page(GFP_KERNEL|__GFP_REPEAT);
+        pte_t *pte = (pte_t *)__get_free_page(GFP_KERNEL);
         if (pte)
                 clear_page(pte);
         return pte;
@@ -74,9 +74,9 @@ struct page *pte_alloc_one(struct mm_struct *mm, unsigned long address)
         struct page *pte;
 
 #ifdef CONFIG_HIGHPTE
-        pte = alloc_pages(GFP_KERNEL|__GFP_HIGHMEM|__GFP_REPEAT, 0);
+        pte = alloc_pages(GFP_KERNEL|__GFP_HIGHMEM, 0);
 #else
-        pte = alloc_pages(GFP_KERNEL|__GFP_REPEAT, 0);
+        pte = alloc_pages(GFP_KERNEL, 0);
 #endif
         if (!pte)
                 return NULL;
diff --git a/arch/nios2/include/asm/pgalloc.h b/arch/nios2/include/asm/pgalloc.h
index 6e2985e0a7b9..bb47d08c8ef7 100644
--- a/arch/nios2/include/asm/pgalloc.h
+++ b/arch/nios2/include/asm/pgalloc.h
@@ -42,8 +42,7 @@ static inline pte_t *pte_alloc_one_kernel(struct mm_struct *mm,
 {
         pte_t *pte;
 
-        pte = (pte_t *) __get_free_pages(GFP_KERNEL|__GFP_REPEAT|__GFP_ZERO,
-                                        PTE_ORDER);
+        pte = (pte_t *) __get_free_pages(GFP_KERNEL|__GFP_ZERO, PTE_ORDER);
 
         return pte;
 }
@@ -53,7 +52,7 @@ static inline pgtable_t pte_alloc_one(struct mm_struct *mm,
 {
         struct page *pte;
 
-        pte = alloc_pages(GFP_KERNEL | __GFP_REPEAT, PTE_ORDER);
+        pte = alloc_pages(GFP_KERNEL, PTE_ORDER);
         if (pte) {
                 if (!pgtable_page_ctor(pte)) {
                         __free_page(pte);
diff --git a/arch/openrisc/include/asm/pgalloc.h b/arch/openrisc/include/asm/pgalloc.h
index 21484e5b9e9a..87eebd185089 100644
--- a/arch/openrisc/include/asm/pgalloc.h
+++ b/arch/openrisc/include/asm/pgalloc.h
@@ -77,7 +77,7 @@ static inline struct page *pte_alloc_one(struct mm_struct *mm,
                                          unsigned long address)
 {
         struct page *pte;
-        pte = alloc_pages(GFP_KERNEL|__GFP_REPEAT, 0);
+        pte = alloc_pages(GFP_KERNEL, 0);
         if (!pte)
                 return NULL;
         clear_page(page_address(pte));
diff --git a/arch/openrisc/mm/ioremap.c b/arch/openrisc/mm/ioremap.c
index 62b08ef392be..5b2a95116e8f 100644
--- a/arch/openrisc/mm/ioremap.c
+++ b/arch/openrisc/mm/ioremap.c
@@ -122,7 +122,7 @@ pte_t __init_refok *pte_alloc_one_kernel(struct mm_struct *mm,
         pte_t *pte;
 
         if (likely(mem_init_done)) {
-                pte = (pte_t *) __get_free_page(GFP_KERNEL | __GFP_REPEAT);
+                pte = (pte_t *) __get_free_page(GFP_KERNEL);
         } else {
                 pte = (pte_t *) alloc_bootmem_low_pages(PAGE_SIZE);
 #if 0
diff --git a/arch/parisc/include/asm/pgalloc.h b/arch/parisc/include/asm/pgalloc.h
index f2fd327dce2e..f08dda3f0995 100644
--- a/arch/parisc/include/asm/pgalloc.h
+++ b/arch/parisc/include/asm/pgalloc.h
@@ -63,8 +63,7 @@ static inline void pgd_populate(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmd)
 
 static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long address)
 {
-        pmd_t *pmd = (pmd_t *)__get_free_pages(GFP_KERNEL|__GFP_REPEAT,
-                                               PMD_ORDER);
+        pmd_t *pmd = (pmd_t *)__get_free_pages(GFP_KERNEL, PMD_ORDER);
         if (pmd)
                 memset(pmd, 0, PAGE_SIZE<<PMD_ORDER);
         return pmd;
@@ -124,7 +123,7 @@ pmd_populate_kernel(struct mm_struct *mm, pmd_t *pmd, pte_t *pte)
 static inline pgtable_t
 pte_alloc_one(struct mm_struct *mm, unsigned long address)
 {
-        struct page *page = alloc_page(GFP_KERNEL|__GFP_REPEAT|__GFP_ZERO);
+        struct page *page = alloc_page(GFP_KERNEL|__GFP_ZERO);
         if (!page)
                 return NULL;
         if (!pgtable_page_ctor(page)) {
@@ -137,7 +136,7 @@ pte_alloc_one(struct mm_struct *mm, unsigned long address)
 static inline pte_t *
 pte_alloc_one_kernel(struct mm_struct *mm, unsigned long addr)
 {
-        pte_t *pte = (pte_t *)__get_free_page(GFP_KERNEL|__GFP_REPEAT|__GFP_ZERO);
+        pte_t *pte = (pte_t *)__get_free_page(GFP_KERNEL|__GFP_ZERO);
         return pte;
 }
 
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 01f7464d9fea..0a9d439bcda6 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -128,7 +128,7 @@ config PPC
         select IRQ_FORCED_THREADING
         select HAVE_RCU_TABLE_FREE if SMP
         select HAVE_SYSCALL_TRACEPOINTS
-        select HAVE_CBPF_JIT
+        select HAVE_CBPF_JIT if CPU_BIG_ENDIAN
         select HAVE_ARCH_JUMP_LABEL
         select ARCH_HAVE_NMI_SAFE_CMPXCHG
         select ARCH_HAS_GCOV_PROFILE_ALL
diff --git a/arch/powerpc/include/asm/book3s/32/pgalloc.h b/arch/powerpc/include/asm/book3s/32/pgalloc.h
index a2350194fc76..8e21bb492dca 100644
--- a/arch/powerpc/include/asm/book3s/32/pgalloc.h
+++ b/arch/powerpc/include/asm/book3s/32/pgalloc.h
@@ -102,7 +102,6 @@ static inline void pgtable_free_tlb(struct mmu_gather *tlb,
 static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t table,
                                   unsigned long address)
 {
-        tlb_flush_pgtable(tlb, address);
         pgtable_page_dtor(table);
         pgtable_free_tlb(tlb, page_address(table), 0);
 }
diff --git a/arch/powerpc/include/asm/book3s/64/mmu-hash.h b/arch/powerpc/include/asm/book3s/64/mmu-hash.h
index 290157e8d5b2..74839f24f412 100644
--- a/arch/powerpc/include/asm/book3s/64/mmu-hash.h
+++ b/arch/powerpc/include/asm/book3s/64/mmu-hash.h
@@ -88,6 +88,7 @@
 #define HPTE_R_RPN_SHIFT        12
 #define HPTE_R_RPN              ASM_CONST(0x0ffffffffffff000)
 #define HPTE_R_PP               ASM_CONST(0x0000000000000003)
+#define HPTE_R_PPP              ASM_CONST(0x8000000000000003)
 #define HPTE_R_N                ASM_CONST(0x0000000000000004)
 #define HPTE_R_G                ASM_CONST(0x0000000000000008)
 #define HPTE_R_M                ASM_CONST(0x0000000000000010)
diff --git a/arch/powerpc/include/asm/book3s/64/pgalloc.h b/arch/powerpc/include/asm/book3s/64/pgalloc.h
index 488279edb1f0..cd5e7aa8cc34 100644
--- a/arch/powerpc/include/asm/book3s/64/pgalloc.h
+++ b/arch/powerpc/include/asm/book3s/64/pgalloc.h
@@ -41,7 +41,7 @@ extern struct kmem_cache *pgtable_cache[];
                         pgtable_cache[(shift) - 1];     \
                 })
 
-#define PGALLOC_GFP GFP_KERNEL | __GFP_NOTRACK | __GFP_REPEAT | __GFP_ZERO
+#define PGALLOC_GFP GFP_KERNEL | __GFP_NOTRACK | __GFP_ZERO
 
 extern pte_t *pte_fragment_alloc(struct mm_struct *, unsigned long, int);
 extern void pte_fragment_free(unsigned long *, int);
@@ -56,7 +56,7 @@ static inline pgd_t *radix__pgd_alloc(struct mm_struct *mm)
         return (pgd_t *)__get_free_page(PGALLOC_GFP);
 #else
         struct page *page;
-        page = alloc_pages(PGALLOC_GFP, 4);
+        page = alloc_pages(PGALLOC_GFP | __GFP_REPEAT, 4);
         if (!page)
                 return NULL;
         return (pgd_t *) page_address(page);
@@ -93,8 +93,7 @@ static inline void pgd_populate(struct mm_struct *mm, pgd_t *pgd, pud_t *pud)
 
 static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long addr)
 {
-        return kmem_cache_alloc(PGT_CACHE(PUD_INDEX_SIZE),
-                                GFP_KERNEL|__GFP_REPEAT);
+        return kmem_cache_alloc(PGT_CACHE(PUD_INDEX_SIZE), GFP_KERNEL);
 }
 
 static inline void pud_free(struct mm_struct *mm, pud_t *pud)
@@ -110,13 +109,17 @@ static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
 static inline void __pud_free_tlb(struct mmu_gather *tlb, pud_t *pud,
                                   unsigned long address)
 {
+        /*
+         * By now all the pud entries should be none entries. So go
+         * ahead and flush the page walk cache
+         */
+        flush_tlb_pgtable(tlb, address);
         pgtable_free_tlb(tlb, pud, PUD_INDEX_SIZE);
 }
 
 static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long addr)
 {
-        return kmem_cache_alloc(PGT_CACHE(PMD_CACHE_INDEX),
-                                GFP_KERNEL|__GFP_REPEAT);
+        return kmem_cache_alloc(PGT_CACHE(PMD_CACHE_INDEX), GFP_KERNEL);
 }
 
 static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
@@ -127,6 +130,11 @@ static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
 static inline void __pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd,
                                   unsigned long address)
 {
+        /*
+         * By now all the pud entries should be none entries. So go
+         * ahead and flush the page walk cache
+         */
+        flush_tlb_pgtable(tlb, address);
         return pgtable_free_tlb(tlb, pmd, PMD_CACHE_INDEX);
 }
 
@@ -151,7 +159,7 @@ static inline pgtable_t pmd_pgtable(pmd_t pmd)
 static inline pte_t *pte_alloc_one_kernel(struct mm_struct *mm,
                                           unsigned long address)
 {
-        return (pte_t *)__get_free_page(GFP_KERNEL | __GFP_REPEAT | __GFP_ZERO);
+        return (pte_t *)__get_free_page(GFP_KERNEL | __GFP_ZERO);
 }
 
 static inline pgtable_t pte_alloc_one(struct mm_struct *mm,
@@ -198,7 +206,11 @@ static inline void pte_free(struct mm_struct *mm, pgtable_t ptepage)
 static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t table,
                                   unsigned long address)
 {
-        tlb_flush_pgtable(tlb, address);
+        /*
+         * By now all the pud entries should be none entries. So go
+         * ahead and flush the page walk cache
+         */
+        flush_tlb_pgtable(tlb, address);
         pgtable_free_tlb(tlb, table, 0);
 }
 
diff --git a/arch/powerpc/include/asm/book3s/64/pgtable.h b/arch/powerpc/include/asm/book3s/64/pgtable.h
index 88a5ecaa157b..ab84c89c9e98 100644
--- a/arch/powerpc/include/asm/book3s/64/pgtable.h
+++ b/arch/powerpc/include/asm/book3s/64/pgtable.h
@@ -230,6 +230,7 @@ extern unsigned long __kernel_virt_size;
 #define KERN_VIRT_SIZE  __kernel_virt_size
 extern struct page *vmemmap;
 extern unsigned long ioremap_bot;
+extern unsigned long pci_io_base;
 #endif /* __ASSEMBLY__ */
 
 #include <asm/book3s/64/hash.h>
diff --git a/arch/powerpc/include/asm/book3s/64/radix.h b/arch/powerpc/include/asm/book3s/64/radix.h
index 937d4e247ac3..df294224e280 100644
--- a/arch/powerpc/include/asm/book3s/64/radix.h
+++ b/arch/powerpc/include/asm/book3s/64/radix.h
@@ -228,5 +228,20 @@ extern void radix__vmemmap_remove_mapping(unsigned long start,
 
 extern int radix__map_kernel_page(unsigned long ea, unsigned long pa,
                                  pgprot_t flags, unsigned int psz);
+
+static inline unsigned long radix__get_tree_size(void)
+{
+        unsigned long rts_field;
+        /*
+         * we support 52 bits, hence 52-31 = 21, 0b10101
+         * RTS encoding details
+         * bits 0 - 3 of rts -> bits 6 - 8 unsigned long
+         * bits 4 - 5 of rts -> bits 62 - 63 of unsigned long
+         */
+        rts_field = (0x5UL << 5); /* 6 - 8 bits */
+        rts_field |= (0x2UL << 61);
+
+        return rts_field;
+}
 #endif /* __ASSEMBLY__ */
 #endif
diff --git a/arch/powerpc/include/asm/book3s/64/tlbflush-radix.h b/arch/powerpc/include/asm/book3s/64/tlbflush-radix.h
index 13ef38828dfe..3fa94fcac628 100644
--- a/arch/powerpc/include/asm/book3s/64/tlbflush-radix.h
+++ b/arch/powerpc/include/asm/book3s/64/tlbflush-radix.h
@@ -18,16 +18,19 @@ extern void radix__local_flush_tlb_mm(struct mm_struct *mm);
 extern void radix__local_flush_tlb_page(struct vm_area_struct *vma, unsigned long vmaddr);
 extern void radix___local_flush_tlb_page(struct mm_struct *mm, unsigned long vmaddr,
                                     unsigned long ap, int nid);
+extern void radix__local_flush_tlb_pwc(struct mmu_gather *tlb, unsigned long addr);
 extern void radix__tlb_flush(struct mmu_gather *tlb);
 #ifdef CONFIG_SMP
 extern void radix__flush_tlb_mm(struct mm_struct *mm);
 extern void radix__flush_tlb_page(struct vm_area_struct *vma, unsigned long vmaddr);
 extern void radix___flush_tlb_page(struct mm_struct *mm, unsigned long vmaddr,
                               unsigned long ap, int nid);
+extern void radix__flush_tlb_pwc(struct mmu_gather *tlb, unsigned long addr);
 #else
 #define radix__flush_tlb_mm(mm)         radix__local_flush_tlb_mm(mm)
 #define radix__flush_tlb_page(vma,addr) radix__local_flush_tlb_page(vma,addr)
 #define radix___flush_tlb_page(mm,addr,p,i)     radix___local_flush_tlb_page(mm,addr,p,i)
+#define radix__flush_tlb_pwc(tlb, addr) radix__local_flush_tlb_pwc(tlb, addr)
 #endif
 
 #endif
diff --git a/arch/powerpc/include/asm/book3s/64/tlbflush.h b/arch/powerpc/include/asm/book3s/64/tlbflush.h
index d98424ae356c..96e5769b18b0 100644
--- a/arch/powerpc/include/asm/book3s/64/tlbflush.h
+++ b/arch/powerpc/include/asm/book3s/64/tlbflush.h
@@ -72,5 +72,19 @@ static inline void flush_tlb_page(struct vm_area_struct *vma,
 #define flush_tlb_mm(mm)                local_flush_tlb_mm(mm)
 #define flush_tlb_page(vma, addr)       local_flush_tlb_page(vma, addr)
 #endif /* CONFIG_SMP */
+/*
+ * flush the page walk cache for the address
+ */
+static inline void flush_tlb_pgtable(struct mmu_gather *tlb, unsigned long address)
+{
+        /*
+         * Flush the page table walk cache on freeing a page table. We already
+         * have marked the upper/higher level page table entry none by now.
+         * So it is safe to flush PWC here.
+         */
+        if (!radix_enabled())
+                return;
 
+        radix__flush_tlb_pwc(tlb, address);
+}
 #endif /*  _ASM_POWERPC_BOOK3S_64_TLBFLUSH_H */
diff --git a/arch/powerpc/include/asm/book3s/pgalloc.h b/arch/powerpc/include/asm/book3s/pgalloc.h
index 54f591e9572e..c0a69ae92256 100644
--- a/arch/powerpc/include/asm/book3s/pgalloc.h
+++ b/arch/powerpc/include/asm/book3s/pgalloc.h
@@ -4,11 +4,6 @@
 #include <linux/mm.h>
 
 extern void tlb_remove_table(struct mmu_gather *tlb, void *table);
-static inline void tlb_flush_pgtable(struct mmu_gather *tlb,
-                                     unsigned long address)
-{
-
-}
 
 #ifdef CONFIG_PPC64
 #include <asm/book3s/64/pgalloc.h>
diff --git a/arch/powerpc/include/asm/nohash/64/pgalloc.h b/arch/powerpc/include/asm/nohash/64/pgalloc.h
index 0c12a3bfe2ab..897d2e1c8a9b 100644
--- a/arch/powerpc/include/asm/nohash/64/pgalloc.h
+++ b/arch/powerpc/include/asm/nohash/64/pgalloc.h
@@ -57,8 +57,7 @@ static inline void pgd_free(struct mm_struct *mm, pgd_t *pgd)
 
 static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long addr)
 {
-        return kmem_cache_alloc(PGT_CACHE(PUD_INDEX_SIZE),
-                                GFP_KERNEL|__GFP_REPEAT);
+        return kmem_cache_alloc(PGT_CACHE(PUD_INDEX_SIZE), GFP_KERNEL);
 }
 
 static inline void pud_free(struct mm_struct *mm, pud_t *pud)
@@ -88,7 +87,7 @@ static inline void pmd_populate(struct mm_struct *mm, pmd_t *pmd,
 static inline pte_t *pte_alloc_one_kernel(struct mm_struct *mm,
                                           unsigned long address)
 {
-        return (pte_t *)__get_free_page(GFP_KERNEL | __GFP_REPEAT | __GFP_ZERO);
+        return (pte_t *)__get_free_page(GFP_KERNEL | __GFP_ZERO);
 }
 
 static inline pgtable_t pte_alloc_one(struct mm_struct *mm,
@@ -172,7 +171,7 @@ static inline pgtable_t pte_alloc_one(struct mm_struct *mm,
 
 static inline void pte_free_kernel(struct mm_struct *mm, pte_t *pte)
 {
-        pte_fragment_fre((unsigned long *)pte, 1);
+        pte_fragment_free((unsigned long *)pte, 1);
 }
 
 static inline void pte_free(struct mm_struct *mm, pgtable_t ptepage)
@@ -190,8 +189,7 @@ static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t table,
 
 static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long addr)
 {
-        return kmem_cache_alloc(PGT_CACHE(PMD_CACHE_INDEX),
-                                GFP_KERNEL|__GFP_REPEAT);
+        return kmem_cache_alloc(PGT_CACHE(PMD_CACHE_INDEX), GFP_KERNEL);
 }
 
 static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c
index 2714a3b81d24..d70101e1e25c 100644
--- a/arch/powerpc/kernel/eeh_driver.c
+++ b/arch/powerpc/kernel/eeh_driver.c
@@ -642,13 +642,12 @@ static int eeh_reset_device(struct eeh_pe *pe, struct pci_bus *bus,
                 if (pe->type & EEH_PE_VF) {
                         eeh_pe_dev_traverse(pe, eeh_rmv_device, NULL);
                 } else {
-                        eeh_pe_state_clear(pe, EEH_PE_PRI_BUS);
                         pci_lock_rescan_remove();
                         pci_hp_remove_devices(bus);
                         pci_unlock_rescan_remove();
                 }
         } else if (frozen_bus) {
-                eeh_pe_dev_traverse(pe, eeh_rmv_device, &rmv_data);
+                eeh_pe_dev_traverse(pe, eeh_rmv_device, rmv_data);
         }
 
         /*
@@ -692,10 +691,12 @@ static int eeh_reset_device(struct eeh_pe *pe, struct pci_bus *bus,
                  */
                 edev = list_first_entry(&pe->edevs, struct eeh_dev, list);
                 eeh_pe_traverse(pe, eeh_pe_detach_dev, NULL);
-                if (pe->type & EEH_PE_VF)
+                if (pe->type & EEH_PE_VF) {
                         eeh_add_virt_device(edev, NULL);
-                else
+                } else {
+                        eeh_pe_state_clear(pe, EEH_PE_PRI_BUS);
                         pci_hp_add_devices(bus);
+                }
         } else if (frozen_bus && rmv_data->removed) {
                 pr_info("EEH: Sleep 5s ahead of partial hotplug\n");
                 ssleep(5);
diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index 4c9440629128..8bcc1b457115 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -1399,11 +1399,12 @@ END_MMU_FTR_SECTION_IFCLR(MMU_FTR_RADIX)
         lwz     r9,PACA_EXSLB+EX_CCR(r13)       /* get saved CR */
 
         mtlr    r10
-BEGIN_MMU_FTR_SECTION
-        b       2f
-END_MMU_FTR_SECTION_IFSET(MMU_FTR_RADIX)
         andi.   r10,r12,MSR_RI  /* check for unrecoverable exception */
+BEGIN_MMU_FTR_SECTION
         beq-    2f
+FTR_SECTION_ELSE
+        b       2f
+ALT_MMU_FTR_SECTION_END_IFCLR(MMU_FTR_RADIX)
 
 .machine        push
 .machine        "power4"
diff --git a/arch/powerpc/kernel/pci_64.c b/arch/powerpc/kernel/pci_64.c
index 3759df52bd67..a5ae49a2dcc4 100644
--- a/arch/powerpc/kernel/pci_64.c
+++ b/arch/powerpc/kernel/pci_64.c
@@ -47,7 +47,6 @@ static int __init pcibios_init(void)
 
         printk(KERN_INFO "PCI: Probing PCI hardware\n");
 
-        pci_io_base = ISA_IO_BASE;
         /* For now, override phys_mem_access_prot. If we need it,g
          * later, we may move that initialization to each ppc_md
          */
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index e2f12cbcade9..0b93893424f5 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -1505,6 +1505,16 @@ void start_thread(struct pt_regs *regs, unsigned long start, unsigned long sp)
                 current->thread.regs = regs - 1;
         }
 
+#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
+        /*
+         * Clear any transactional state, we're exec()ing. The cause is
+         * not important as there will never be a recheckpoint so it's not
+         * user visible.
+         */
+        if (MSR_TM_SUSPENDED(mfmsr()))
+                tm_reclaim_current(0);
+#endif
+
         memset(regs->gpr, 0, sizeof(regs->gpr));
         regs->ctr = 0;
         regs->link = 0;
diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c
index ccd2037c797f..6ee4b72cda42 100644
--- a/arch/powerpc/kernel/prom_init.c
+++ b/arch/powerpc/kernel/prom_init.c
@@ -719,7 +719,7 @@ unsigned char ibm_architecture_vec[] = {
          * must match by the macro below. Update the definition if
          * the structure layout changes.
          */
-#define IBM_ARCH_VEC_NRCORES_OFFSET     125
+#define IBM_ARCH_VEC_NRCORES_OFFSET     133
         W(NR_CPUS),                     /* number of cores supported */
         0,
         0,
diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c
index 30a03c03fe73..060b140f03c6 100644
--- a/arch/powerpc/kernel/ptrace.c
+++ b/arch/powerpc/kernel/ptrace.c
@@ -377,7 +377,7 @@ static int fpr_get(struct task_struct *target, const struct user_regset *regset,
 
 #else
         BUILD_BUG_ON(offsetof(struct thread_fp_state, fpscr) !=
-                     offsetof(struct thread_fp_state, fpr[32][0]));
+                     offsetof(struct thread_fp_state, fpr[32]));
 
         return user_regset_copyout(&pos, &count, &kbuf, &ubuf,
                                    &target->thread.fp_state, 0, -1);
@@ -405,7 +405,7 @@ static int fpr_set(struct task_struct *target, const struct user_regset *regset,
         return 0;
 #else
         BUILD_BUG_ON(offsetof(struct thread_fp_state, fpscr) !=
-                     offsetof(struct thread_fp_state, fpr[32][0]));
+                     offsetof(struct thread_fp_state, fpr[32]));
 
         return user_regset_copyin(&pos, &count, &kbuf, &ubuf,
                                   &target->thread.fp_state, 0, -1);
diff --git a/arch/powerpc/kernel/tm.S b/arch/powerpc/kernel/tm.S
index bf8f34a58670..b7019b559ddb 100644
--- a/arch/powerpc/kernel/tm.S
+++ b/arch/powerpc/kernel/tm.S
@@ -110,17 +110,11 @@ _GLOBAL(tm_reclaim)
         std     r3, STK_PARAM(R3)(r1)
         SAVE_NVGPRS(r1)
 
-        /* We need to setup MSR for VSX register save instructions.  Here we
-         * also clear the MSR RI since when we do the treclaim, we won't have a
-         * valid kernel pointer for a while.  We clear RI here as it avoids
-         * adding another mtmsr closer to the treclaim.  This makes the region
-         * maked as non-recoverable wider than it needs to be but it saves on
-         * inserting another mtmsrd later.
-         */
+        /* We need to setup MSR for VSX register save instructions. */
         mfmsr   r14
         mr      r15, r14
         ori     r15, r15, MSR_FP
-        li      r16, MSR_RI
+        li      r16, 0
         ori     r16, r16, MSR_EE /* IRQs hard off */
         andc    r15, r15, r16
         oris    r15, r15, MSR_VEC@h
@@ -176,7 +170,17 @@ dont_backup_fp:
 1:      tdeqi   r6, 0
         EMIT_BUG_ENTRY 1b,__FILE__,__LINE__,0
 
-        /* The moment we treclaim, ALL of our GPRs will switch
+        /* Clear MSR RI since we are about to change r1, EE is already off. */
+        li      r4, 0
+        mtmsrd  r4, 1
+
+        /*
+         * BE CAREFUL HERE:
+         * At this point we can't take an SLB miss since we have MSR_RI
+         * off. Load only to/from the stack/paca which are in SLB bolted regions
+         * until we turn MSR RI back on.
+         *
+         * The moment we treclaim, ALL of our GPRs will switch
          * to user register state.  (FPRs, CCR etc. also!)
          * Use an sprg and a tm_scratch in the PACA to shuffle.
          */
@@ -197,6 +201,11 @@ dont_backup_fp:
 
         /* Store the PPR in r11 and reset to decent value */
         std     r11, GPR11(r1)                  /* Temporary stash */
+
+        /* Reset MSR RI so we can take SLB faults again */
+        li      r11, MSR_RI
+        mtmsrd  r11, 1
+
         mfspr   r11, SPRN_PPR
         HMT_MEDIUM
 
@@ -397,11 +406,6 @@ restore_gprs:
         ld      r5, THREAD_TM_DSCR(r3)
         ld      r6, THREAD_TM_PPR(r3)
 
-        /* Clear the MSR RI since we are about to change R1.  EE is already off
-         */
-        li      r4, 0
-        mtmsrd  r4, 1
-
         REST_GPR(0, r7)                         /* GPR0 */
         REST_2GPRS(2, r7)                       /* GPR2-3 */
         REST_GPR(4, r7)                         /* GPR4 */
@@ -439,10 +443,33 @@ restore_gprs:
         ld      r6, _CCR(r7)
         mtcr    r6
 
-        REST_GPR(1, r7)                         /* GPR1 */
-        REST_GPR(5, r7)                         /* GPR5-7 */
         REST_GPR(6, r7)
-        ld      r7, GPR7(r7)
+
+        /*
+         * Store r1 and r5 on the stack so that we can access them
+         * after we clear MSR RI.
+         */
+
+        REST_GPR(5, r7)
+        std     r5, -8(r1)
+        ld      r5, GPR1(r7)
+        std     r5, -16(r1)
+
+        REST_GPR(7, r7)
+
+        /* Clear MSR RI since we are about to change r1. EE is already off */
+        li      r5, 0
+        mtmsrd  r5, 1
+
+        /*
+         * BE CAREFUL HERE:
+         * At this point we can't take an SLB miss since we have MSR_RI
+         * off. Load only to/from the stack/paca which are in SLB bolted regions
+         * until we turn MSR RI back on.
+         */
+
+        ld      r5, -8(r1)
+        ld      r1, -16(r1)
 
         /* Commit register state as checkpointed state: */
         TRECHKPT
diff --git a/arch/powerpc/mm/hash_native_64.c b/arch/powerpc/mm/hash_native_64.c
index d873f6507f72..f8a871a72985 100644
--- a/arch/powerpc/mm/hash_native_64.c
+++ b/arch/powerpc/mm/hash_native_64.c
@@ -316,8 +316,8 @@ static long native_hpte_updatepp(unsigned long slot, unsigned long newpp,
                         DBG_LOW(" -> hit\n");
                         /* Update the HPTE */
                         hptep->r = cpu_to_be64((be64_to_cpu(hptep->r) &
-                                                ~(HPTE_R_PP | HPTE_R_N)) |
-                                               (newpp & (HPTE_R_PP | HPTE_R_N |
+                                                ~(HPTE_R_PPP | HPTE_R_N)) |
+                                               (newpp & (HPTE_R_PPP | HPTE_R_N |
                                                          HPTE_R_C)));
                 }
                 native_unlock_hpte(hptep);
@@ -385,8 +385,8 @@ static void native_hpte_updateboltedpp(unsigned long newpp, unsigned long ea,
 
         /* Update the HPTE */
         hptep->r = cpu_to_be64((be64_to_cpu(hptep->r) &
-                        ~(HPTE_R_PP | HPTE_R_N)) |
-                (newpp & (HPTE_R_PP | HPTE_R_N)));
+                                ~(HPTE_R_PPP | HPTE_R_N)) |
+                               (newpp & (HPTE_R_PPP | HPTE_R_N)));
         /*
          * Ensure it is out of the tlb too. Bolted entries base and
          * actual page size will be same.
@@ -550,7 +550,11 @@ static void hpte_decode(struct hash_pte *hpte, unsigned long slot,
                 }
         }
         /* This works for all page sizes, and for 256M and 1T segments */
-        *ssize = hpte_v >> HPTE_V_SSIZE_SHIFT;
+        if (cpu_has_feature(CPU_FTR_ARCH_300))
+                *ssize = hpte_r >> HPTE_R_3_0_SSIZE_SHIFT;
+        else
+                *ssize = hpte_v >> HPTE_V_SSIZE_SHIFT;
+
         shift = mmu_psize_defs[size].shift;
 
         avpn = (HPTE_V_AVPN_VAL(hpte_v) & ~mmu_psize_defs[size].avpnm);
diff --git a/arch/powerpc/mm/hash_utils_64.c b/arch/powerpc/mm/hash_utils_64.c
index b2740c67e172..2971ea18c768 100644
--- a/arch/powerpc/mm/hash_utils_64.c
+++ b/arch/powerpc/mm/hash_utils_64.c
@@ -201,9 +201,8 @@ unsigned long htab_convert_pte_flags(unsigned long pteflags)
         /*
          * We can't allow hardware to update hpte bits. Hence always
          * set 'R' bit and set 'C' if it is a write fault
-         * Memory coherence is always enabled
          */
-        rflags |=  HPTE_R_R | HPTE_R_M;
+        rflags |=  HPTE_R_R;
 
         if (pteflags & _PAGE_DIRTY)
                 rflags |= HPTE_R_C;
@@ -213,10 +212,15 @@ unsigned long htab_convert_pte_flags(unsigned long pteflags)
 
         if ((pteflags & _PAGE_CACHE_CTL) == _PAGE_TOLERANT)
                 rflags |= HPTE_R_I;
-        if ((pteflags & _PAGE_CACHE_CTL ) == _PAGE_NON_IDEMPOTENT)
+        else if ((pteflags & _PAGE_CACHE_CTL) == _PAGE_NON_IDEMPOTENT)
                 rflags |= (HPTE_R_I | HPTE_R_G);
-        if ((pteflags & _PAGE_CACHE_CTL) == _PAGE_SAO)
-                rflags |= (HPTE_R_I | HPTE_R_W);
+        else if ((pteflags & _PAGE_CACHE_CTL) == _PAGE_SAO)
+                rflags |= (HPTE_R_W | HPTE_R_I | HPTE_R_M);
+        else
+                /*
+                 * Add memory coherence if cache inhibited is not set
+                 */
+                rflags |= HPTE_R_M;
 
         return rflags;
 }
@@ -918,6 +922,10 @@ void __init hash__early_init_mmu(void)
         vmemmap = (struct page *)H_VMEMMAP_BASE;
         ioremap_bot = IOREMAP_BASE;
 
+#ifdef CONFIG_PCI
+        pci_io_base = ISA_IO_BASE;
+#endif
+
         /* Initialize the MMU Hash table and create the linear mapping
          * of memory. Has to be done before SLB initialization as this is
          * currently where the page size encoding is obtained.
diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c
index 5aac1a3f86cd..119d18611500 100644
--- a/arch/powerpc/mm/hugetlbpage.c
+++ b/arch/powerpc/mm/hugetlbpage.c
@@ -73,7 +73,7 @@ static int __hugepte_alloc(struct mm_struct *mm, hugepd_t *hpdp,
         cachep = PGT_CACHE(pdshift - pshift);
 #endif
 
-        new = kmem_cache_zalloc(cachep, GFP_KERNEL|__GFP_REPEAT);
+        new = kmem_cache_zalloc(cachep, GFP_KERNEL);
 
         BUG_ON(pshift > HUGEPD_SHIFT_MASK);
         BUG_ON((unsigned long)new & HUGEPD_SHIFT_MASK);
diff --git a/arch/powerpc/mm/mmu_context_book3s64.c b/arch/powerpc/mm/mmu_context_book3s64.c
index 227b2a6c4544..196222227e82 100644
--- a/arch/powerpc/mm/mmu_context_book3s64.c
+++ b/arch/powerpc/mm/mmu_context_book3s64.c
@@ -65,7 +65,7 @@ static int radix__init_new_context(struct mm_struct *mm, int index)
         /*
          * set the process table entry,
          */
-        rts_field = 3ull << PPC_BITLSHIFT(2);
+        rts_field = radix__get_tree_size();
         process_tb[index].prtb0 = cpu_to_be64(rts_field | __pa(mm->pgd) | RADIX_PGD_INDEX_SIZE);
         return 0;
 }
diff --git a/arch/powerpc/mm/pgtable-radix.c b/arch/powerpc/mm/pgtable-radix.c
index c939e6e57a9e..7931e1496f0d 100644
--- a/arch/powerpc/mm/pgtable-radix.c
+++ b/arch/powerpc/mm/pgtable-radix.c
@@ -160,9 +160,8 @@ redo:
         process_tb = early_alloc_pgtable(1UL << PRTB_SIZE_SHIFT);
         /*
          * Fill in the process table.
-         * we support 52 bits, hence 52-28 = 24, 11000
          */
-        rts_field = 3ull << PPC_BITLSHIFT(2);
+        rts_field = radix__get_tree_size();
         process_tb->prtb0 = cpu_to_be64(rts_field | __pa(init_mm.pgd) | RADIX_PGD_INDEX_SIZE);
         /*
          * Fill in the partition table. We are suppose to use effective address
@@ -176,10 +175,8 @@ redo:
 static void __init radix_init_partition_table(void)
 {
         unsigned long rts_field;
-        /*
-         * we support 52 bits, hence 52-28 = 24, 11000
-         */
-        rts_field = 3ull << PPC_BITLSHIFT(2);
+
+        rts_field = radix__get_tree_size();
 
         BUILD_BUG_ON_MSG((PATB_SIZE_SHIFT > 24), "Partition table size too large.");
         partition_tb = early_alloc_pgtable(1UL << PATB_SIZE_SHIFT);
@@ -331,6 +328,11 @@ void __init radix__early_init_mmu(void)
         __vmalloc_end = RADIX_VMALLOC_END;
         vmemmap = (struct page *)RADIX_VMEMMAP_BASE;
         ioremap_bot = IOREMAP_BASE;
+
+#ifdef CONFIG_PCI
+        pci_io_base = ISA_IO_BASE;
+#endif
+
         /*
          * For now radix also use the same frag size
          */
diff --git a/arch/powerpc/mm/pgtable_32.c b/arch/powerpc/mm/pgtable_32.c
index bf7bf32b54f8..7f922f557936 100644
--- a/arch/powerpc/mm/pgtable_32.c
+++ b/arch/powerpc/mm/pgtable_32.c
@@ -84,7 +84,7 @@ __init_refok pte_t *pte_alloc_one_kernel(struct mm_struct *mm, unsigned long add
         pte_t *pte;
 
         if (slab_is_available()) {
-                pte = (pte_t *)__get_free_page(GFP_KERNEL|__GFP_REPEAT|__GFP_ZERO);
+                pte = (pte_t *)__get_free_page(GFP_KERNEL|__GFP_ZERO);
         } else {
                 pte = __va(memblock_alloc(PAGE_SIZE, PAGE_SIZE));
                 if (pte)
@@ -97,7 +97,7 @@ pgtable_t pte_alloc_one(struct mm_struct *mm, unsigned long address)
 {
         struct page *ptepage;
 
-        gfp_t flags = GFP_KERNEL | __GFP_REPEAT | __GFP_ZERO;
+        gfp_t flags = GFP_KERNEL | __GFP_ZERO;
 
         ptepage = alloc_pages(flags, 0);
         if (!ptepage)
diff --git a/arch/powerpc/mm/pgtable_64.c b/arch/powerpc/mm/pgtable_64.c
index e009e0604a8a..f5e8d4edb808 100644
--- a/arch/powerpc/mm/pgtable_64.c
+++ b/arch/powerpc/mm/pgtable_64.c
@@ -350,8 +350,7 @@ static pte_t *get_from_cache(struct mm_struct *mm)
 static pte_t *__alloc_for_cache(struct mm_struct *mm, int kernel)
 {
         void *ret = NULL;
-        struct page *page = alloc_page(GFP_KERNEL | __GFP_NOTRACK |
-                                       __GFP_REPEAT | __GFP_ZERO);
+        struct page *page = alloc_page(GFP_KERNEL | __GFP_NOTRACK | __GFP_ZERO);
         if (!page)
                 return NULL;
         if (!kernel && !pgtable_page_ctor(page)) {
diff --git a/arch/powerpc/mm/tlb-radix.c b/arch/powerpc/mm/tlb-radix.c
index 0fdaf93a3e09..ab2f60e812e2 100644
--- a/arch/powerpc/mm/tlb-radix.c
+++ b/arch/powerpc/mm/tlb-radix.c
@@ -18,16 +18,20 @@
 
 static DEFINE_RAW_SPINLOCK(native_tlbie_lock);
 
-static inline void __tlbiel_pid(unsigned long pid, int set)
+#define RIC_FLUSH_TLB 0
+#define RIC_FLUSH_PWC 1
+#define RIC_FLUSH_ALL 2
+
+static inline void __tlbiel_pid(unsigned long pid, int set,
+                                unsigned long ric)
 {
-        unsigned long rb,rs,ric,prs,r;
+        unsigned long rb,rs,prs,r;
 
         rb = PPC_BIT(53); /* IS = 1 */
         rb |= set << PPC_BITLSHIFT(51);
         rs = ((unsigned long)pid) << PPC_BITLSHIFT(31);
         prs = 1; /* process scoped */
         r = 1;   /* raidx format */
-        ric = 2;  /* invalidate all the caches */
 
         asm volatile("ptesync": : :"memory");
         asm volatile(".long 0x7c000224 | (%0 << 11) | (%1 << 16) |"
@@ -39,25 +43,24 @@ static inline void __tlbiel_pid(unsigned long pid, int set)
 /*
  * We use 128 set in radix mode and 256 set in hpt mode.
  */
-static inline void _tlbiel_pid(unsigned long pid)
+static inline void _tlbiel_pid(unsigned long pid, unsigned long ric)
 {
         int set;
 
         for (set = 0; set < POWER9_TLB_SETS_RADIX ; set++) {
-                __tlbiel_pid(pid, set);
+                __tlbiel_pid(pid, set, ric);
         }
         return;
 }
 
-static inline void _tlbie_pid(unsigned long pid)
+static inline void _tlbie_pid(unsigned long pid, unsigned long ric)
 {
-        unsigned long rb,rs,ric,prs,r;
+        unsigned long rb,rs,prs,r;
 
         rb = PPC_BIT(53); /* IS = 1 */
         rs = pid << PPC_BITLSHIFT(31);
         prs = 1; /* process scoped */
         r = 1;   /* raidx format */
-        ric = 2;  /* invalidate all the caches */
 
         asm volatile("ptesync": : :"memory");
         asm volatile(".long 0x7c000264 | (%0 << 11) | (%1 << 16) |"
@@ -67,16 +70,15 @@ static inline void _tlbie_pid(unsigned long pid)
 }
 
 static inline void _tlbiel_va(unsigned long va, unsigned long pid,
-                              unsigned long ap)
+                              unsigned long ap, unsigned long ric)
 {
-        unsigned long rb,rs,ric,prs,r;
+        unsigned long rb,rs,prs,r;
 
         rb = va & ~(PPC_BITMASK(52, 63));
         rb |= ap << PPC_BITLSHIFT(58);
         rs = pid << PPC_BITLSHIFT(31);
         prs = 1; /* process scoped */
         r = 1;   /* raidx format */
-        ric = 0;  /* no cluster flush yet */
 
         asm volatile("ptesync": : :"memory");
         asm volatile(".long 0x7c000224 | (%0 << 11) | (%1 << 16) |"
@@ -86,16 +88,15 @@ static inline void _tlbiel_va(unsigned long va, unsigned long pid,
 }
 
 static inline void _tlbie_va(unsigned long va, unsigned long pid,
-                             unsigned long ap)
+                             unsigned long ap, unsigned long ric)
 {
-        unsigned long rb,rs,ric,prs,r;
+        unsigned long rb,rs,prs,r;
 
         rb = va & ~(PPC_BITMASK(52, 63));
         rb |= ap << PPC_BITLSHIFT(58);
         rs = pid << PPC_BITLSHIFT(31);
         prs = 1; /* process scoped */
         r = 1;   /* raidx format */
-        ric = 0;  /* no cluster flush yet */
 
         asm volatile("ptesync": : :"memory");
         asm volatile(".long 0x7c000264 | (%0 << 11) | (%1 << 16) |"
@@ -117,25 +118,40 @@ static inline void _tlbie_va(unsigned long va, unsigned long pid,
  */
 void radix__local_flush_tlb_mm(struct mm_struct *mm)
 {
-        unsigned int pid;
+        unsigned long pid;
 
         preempt_disable();
         pid = mm->context.id;
         if (pid != MMU_NO_CONTEXT)
-                _tlbiel_pid(pid);
+                _tlbiel_pid(pid, RIC_FLUSH_ALL);
         preempt_enable();
 }
 EXPORT_SYMBOL(radix__local_flush_tlb_mm);
 
+void radix__local_flush_tlb_pwc(struct mmu_gather *tlb, unsigned long addr)
+{
+        unsigned long pid;
+        struct mm_struct *mm = tlb->mm;
+
+        preempt_disable();
+
+        pid = mm->context.id;
+        if (pid != MMU_NO_CONTEXT)
+                _tlbiel_pid(pid, RIC_FLUSH_PWC);
+
+        preempt_enable();
+}
+EXPORT_SYMBOL(radix__local_flush_tlb_pwc);
+
 void radix___local_flush_tlb_page(struct mm_struct *mm, unsigned long vmaddr,
                             unsigned long ap, int nid)
 {
-        unsigned int pid;
+        unsigned long pid;
 
         preempt_disable();
         pid = mm ? mm->context.id : 0;
         if (pid != MMU_NO_CONTEXT)
-                _tlbiel_va(vmaddr, pid, ap);
+                _tlbiel_va(vmaddr, pid, ap, RIC_FLUSH_TLB);
         preempt_enable();
 }
 
@@ -160,7 +176,7 @@ static int mm_is_core_local(struct mm_struct *mm)
 
 void radix__flush_tlb_mm(struct mm_struct *mm)
 {
-        unsigned int pid;
+        unsigned long pid;
 
         preempt_disable();
         pid = mm->context.id;
@@ -172,20 +188,46 @@ void radix__flush_tlb_mm(struct mm_struct *mm)
 
                 if (lock_tlbie)
                         raw_spin_lock(&native_tlbie_lock);
-                _tlbie_pid(pid);
+                _tlbie_pid(pid, RIC_FLUSH_ALL);
                 if (lock_tlbie)
                         raw_spin_unlock(&native_tlbie_lock);
         } else
-                _tlbiel_pid(pid);
+                _tlbiel_pid(pid, RIC_FLUSH_ALL);
 no_context:
         preempt_enable();
 }
 EXPORT_SYMBOL(radix__flush_tlb_mm);
 
+void radix__flush_tlb_pwc(struct mmu_gather *tlb, unsigned long addr)
+{
+        unsigned long pid;
+        struct mm_struct *mm = tlb->mm;
+
+        preempt_disable();
+
+        pid = mm->context.id;
+        if (unlikely(pid == MMU_NO_CONTEXT))
+                goto no_context;
+
+        if (!mm_is_core_local(mm)) {
+                int lock_tlbie = !mmu_has_feature(MMU_FTR_LOCKLESS_TLBIE);
+
+                if (lock_tlbie)
+                        raw_spin_lock(&native_tlbie_lock);
+                _tlbie_pid(pid, RIC_FLUSH_PWC);
+                if (lock_tlbie)
+                        raw_spin_unlock(&native_tlbie_lock);
+        } else
+                _tlbiel_pid(pid, RIC_FLUSH_PWC);
+no_context:
+        preempt_enable();
+}
+EXPORT_SYMBOL(radix__flush_tlb_pwc);
+
 void radix___flush_tlb_page(struct mm_struct *mm, unsigned long vmaddr,
                        unsigned long ap, int nid)
 {
-        unsigned int pid;
+        unsigned long pid;
 
         preempt_disable();
         pid = mm ? mm->context.id : 0;
@@ -196,11 +238,11 @@ void radix___flush_tlb_page(struct mm_struct *mm, unsigned long vmaddr,
 
                 if (lock_tlbie)
                         raw_spin_lock(&native_tlbie_lock);
-                _tlbie_va(vmaddr, pid, ap);
+                _tlbie_va(vmaddr, pid, ap, RIC_FLUSH_TLB);
                 if (lock_tlbie)
                         raw_spin_unlock(&native_tlbie_lock);
         } else
-                _tlbiel_va(vmaddr, pid, ap);
+                _tlbiel_va(vmaddr, pid, ap, RIC_FLUSH_TLB);
 bail:
         preempt_enable();
 }
@@ -224,7 +266,7 @@ void radix__flush_tlb_kernel_range(unsigned long start, unsigned long end)
 
         if (lock_tlbie)
                 raw_spin_lock(&native_tlbie_lock);
-        _tlbie_pid(0);
+        _tlbie_pid(0, RIC_FLUSH_ALL);
         if (lock_tlbie)
                 raw_spin_unlock(&native_tlbie_lock);
 }
diff --git a/arch/powerpc/platforms/512x/clock-commonclk.c b/arch/powerpc/platforms/512x/clock-commonclk.c
index c50ea76ba66c..6081fbd75330 100644
--- a/arch/powerpc/platforms/512x/clock-commonclk.c
+++ b/arch/powerpc/platforms/512x/clock-commonclk.c
@@ -221,7 +221,7 @@ static bool soc_has_mclk_mux0_canin(void)
 /* convenience wrappers around the common clk API */
 static inline struct clk *mpc512x_clk_fixed(const char *name, int rate)
 {
-        return clk_register_fixed_rate(NULL, name, NULL, CLK_IS_ROOT, rate);
+        return clk_register_fixed_rate(NULL, name, NULL, 0, rate);
 }
 
 static inline struct clk *mpc512x_clk_factor(
diff --git a/arch/powerpc/platforms/cell/spufs/coredump.c b/arch/powerpc/platforms/cell/spufs/coredump.c
index 84fb984f29c1..85c85eb3e245 100644
--- a/arch/powerpc/platforms/cell/spufs/coredump.c
+++ b/arch/powerpc/platforms/cell/spufs/coredump.c
@@ -172,7 +172,7 @@ static int spufs_arch_write_note(struct spu_context *ctx, int i,
         if (rc < 0)
                 goto out;
 
-        skip = roundup(cprm->file->f_pos - total + sz, 4) - cprm->file->f_pos;
+        skip = roundup(cprm->pos - total + sz, 4) - cprm->pos;
         if (!dump_skip(cprm, skip))
                 goto Eio;
 out:
diff --git a/arch/powerpc/platforms/pseries/iommu.c b/arch/powerpc/platforms/pseries/iommu.c
index b7dfc1359d01..3e8865b187de 100644
--- a/arch/powerpc/platforms/pseries/iommu.c
+++ b/arch/powerpc/platforms/pseries/iommu.c
@@ -927,7 +927,7 @@ static int query_ddw(struct pci_dev *dev, const u32 *ddw_avail,
         dn = pci_device_to_OF_node(dev);
         pdn = PCI_DN(dn);
         buid = pdn->phb->buid;
-        cfg_addr = (pdn->busno << 8) | pdn->devfn;
+        cfg_addr = ((pdn->busno << 16) | (pdn->devfn << 8));
 
         ret = rtas_call(ddw_avail[0], 3, 5, (u32 *)query,
                   cfg_addr, BUID_HI(buid), BUID_LO(buid));
@@ -956,7 +956,7 @@ static int create_ddw(struct pci_dev *dev, const u32 *ddw_avail,
         dn = pci_device_to_OF_node(dev);
         pdn = PCI_DN(dn);
         buid = pdn->phb->buid;
-        cfg_addr = (pdn->busno << 8) | pdn->devfn;
+        cfg_addr = ((pdn->busno << 16) | (pdn->devfn << 8));
 
         do {
                 /* extra outputs are LIOBN and dma-addr (hi, lo) */
diff --git a/arch/s390/include/asm/fpu/api.h b/arch/s390/include/asm/fpu/api.h
index 5e04f3cbd320..8ae236b0f80b 100644
--- a/arch/s390/include/asm/fpu/api.h
+++ b/arch/s390/include/asm/fpu/api.h
@@ -22,7 +22,7 @@ static inline int test_fp_ctl(u32 fpc)
                 "       la      %0,0\n"
                 "1:\n"
                 EX_TABLE(0b,1b)
-                : "=d" (rc), "=d" (orig_fpc)
+                : "=d" (rc), "=&d" (orig_fpc)
                 : "d" (fpc), "0" (-EINVAL));
         return rc;
 }
diff --git a/arch/s390/include/asm/kvm_host.h b/arch/s390/include/asm/kvm_host.h
index 37b9017c6a96..ac82e8eb936d 100644
--- a/arch/s390/include/asm/kvm_host.h
+++ b/arch/s390/include/asm/kvm_host.h
@@ -245,6 +245,7 @@ struct kvm_vcpu_stat {
         u32 exit_stop_request;
         u32 exit_validity;
         u32 exit_instruction;
+        u32 exit_pei;
         u32 halt_successful_poll;
         u32 halt_attempted_poll;
         u32 halt_poll_invalid;
diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c
index f20abdb5630a..d14069d4b88d 100644
--- a/arch/s390/kernel/ipl.c
+++ b/arch/s390/kernel/ipl.c
@@ -2064,12 +2064,5 @@ void s390_reset_system(void)
         S390_lowcore.program_new_psw.addr =
                 (unsigned long) s390_base_pgm_handler;
 
-        /*
-         * Clear subchannel ID and number to signal new kernel that no CCW or
-         * SCSI IPL has been done (for kexec and kdump)
-         */
-        S390_lowcore.subchannel_id = 0;
-        S390_lowcore.subchannel_nr = 0;
-
         do_reset_calls();
 }
diff --git a/arch/s390/kernel/perf_cpum_cf.c b/arch/s390/kernel/perf_cpum_cf.c
index 59215c518f37..7ec63b1d920d 100644
--- a/arch/s390/kernel/perf_cpum_cf.c
+++ b/arch/s390/kernel/perf_cpum_cf.c
@@ -649,6 +649,8 @@ static int cpumf_pmu_commit_txn(struct pmu *pmu)
 
 /* Performance monitoring unit for s390x */
 static struct pmu cpumf_pmu = {
+        .task_ctx_nr  = perf_sw_context,
+        .capabilities = PERF_PMU_CAP_NO_INTERRUPT,
         .pmu_enable   = cpumf_pmu_enable,
         .pmu_disable  = cpumf_pmu_disable,
         .event_init   = cpumf_pmu_event_init,
@@ -708,12 +710,6 @@ static int __init cpumf_pmu_init(void)
                 goto out;
         }
 
-        /* The CPU measurement counter facility does not have overflow
-         * interrupts to do sampling.  Sampling must be provided by
-         * external means, for example, by timers.
-         */
-        cpumf_pmu.capabilities |= PERF_PMU_CAP_NO_INTERRUPT;
-
         cpumf_pmu.attr_groups = cpumf_cf_event_group();
         rc = perf_pmu_register(&cpumf_pmu, "cpum_cf", PERF_TYPE_RAW);
         if (rc) {
diff --git a/arch/s390/kvm/intercept.c b/arch/s390/kvm/intercept.c
index 2e6b54e4d3f9..252157181302 100644
--- a/arch/s390/kvm/intercept.c
+++ b/arch/s390/kvm/intercept.c
@@ -341,6 +341,8 @@ static int handle_mvpg_pei(struct kvm_vcpu *vcpu)
 
 static int handle_partial_execution(struct kvm_vcpu *vcpu)
 {
+        vcpu->stat.exit_pei++;
+
         if (vcpu->arch.sie_block->ipa == 0xb254)        /* MVPG */
                 return handle_mvpg_pei(vcpu);
         if (vcpu->arch.sie_block->ipa >> 8 == 0xae)     /* SIGP */
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index 6d8ec3ac9dd8..43f2a2b80490 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -61,6 +61,7 @@ struct kvm_stats_debugfs_item debugfs_entries[] = {
         { "exit_external_request", VCPU_STAT(exit_external_request) },
         { "exit_external_interrupt", VCPU_STAT(exit_external_interrupt) },
         { "exit_instruction", VCPU_STAT(exit_instruction) },
+        { "exit_pei", VCPU_STAT(exit_pei) },
         { "exit_program_interruption", VCPU_STAT(exit_program_interruption) },
         { "exit_instr_and_program_int", VCPU_STAT(exit_instr_and_program) },
         { "halt_successful_poll", VCPU_STAT(halt_successful_poll) },
@@ -657,7 +658,7 @@ static int kvm_s390_set_processor(struct kvm *kvm, struct kvm_device_attr *attr)
                 kvm->arch.model.cpuid = proc->cpuid;
                 lowest_ibc = sclp.ibc >> 16 & 0xfff;
                 unblocked_ibc = sclp.ibc & 0xfff;
-                if (lowest_ibc) {
+                if (lowest_ibc && proc->ibc) {
                         if (proc->ibc > unblocked_ibc)
                                 kvm->arch.model.ibc = unblocked_ibc;
                         else if (proc->ibc < lowest_ibc)
diff --git a/arch/s390/mm/pgalloc.c b/arch/s390/mm/pgalloc.c
index e8b5962ac12a..e2565d2d0c32 100644
--- a/arch/s390/mm/pgalloc.c
+++ b/arch/s390/mm/pgalloc.c
@@ -169,7 +169,7 @@ unsigned long *page_table_alloc(struct mm_struct *mm)
                         return table;
         }
         /* Allocate a fresh page */
-        page = alloc_page(GFP_KERNEL|__GFP_REPEAT);
+        page = alloc_page(GFP_KERNEL);
         if (!page)
                 return NULL;
         if (!pgtable_page_ctor(page)) {
diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c
index 4324b87f9398..9f0ce0e6eeb4 100644
--- a/arch/s390/mm/pgtable.c
+++ b/arch/s390/mm/pgtable.c
@@ -437,7 +437,7 @@ void ptep_zap_unused(struct mm_struct *mm, unsigned long addr,
         pgste = pgste_get_lock(ptep);
         pgstev = pgste_val(pgste);
         pte = *ptep;
-        if (pte_swap(pte) &&
+        if (!reset && pte_swap(pte) &&
             ((pgstev & _PGSTE_GPS_USAGE_MASK) == _PGSTE_GPS_USAGE_UNUSED ||
              (pgstev & _PGSTE_GPS_ZERO))) {
                 ptep_zap_swap_entry(mm, pte_to_swp_entry(pte));
diff --git a/arch/score/include/asm/pgalloc.h b/arch/score/include/asm/pgalloc.h
index 2e067657db98..49b012d78c1a 100644
--- a/arch/score/include/asm/pgalloc.h
+++ b/arch/score/include/asm/pgalloc.h
@@ -42,8 +42,7 @@ static inline pte_t *pte_alloc_one_kernel(struct mm_struct *mm,
 {
         pte_t *pte;
 
-        pte = (pte_t *) __get_free_pages(GFP_KERNEL|__GFP_REPEAT|__GFP_ZERO,
-                                        PTE_ORDER);
+        pte = (pte_t *) __get_free_pages(GFP_KERNEL|__GFP_ZERO, PTE_ORDER);
 
         return pte;
 }
@@ -53,7 +52,7 @@ static inline struct page *pte_alloc_one(struct mm_struct *mm,
 {
         struct page *pte;
 
-        pte = alloc_pages(GFP_KERNEL | __GFP_REPEAT, PTE_ORDER);
+        pte = alloc_pages(GFP_KERNEL, PTE_ORDER);
         if (!pte)
                 return NULL;
         clear_highpage(pte);
diff --git a/arch/sh/include/asm/pgalloc.h b/arch/sh/include/asm/pgalloc.h
index a33673b3687d..f3f42c84c40f 100644
--- a/arch/sh/include/asm/pgalloc.h
+++ b/arch/sh/include/asm/pgalloc.h
@@ -34,7 +34,7 @@ static inline void pmd_populate(struct mm_struct *mm, pmd_t *pmd,
 static inline pte_t *pte_alloc_one_kernel(struct mm_struct *mm,
                                           unsigned long address)
 {
-        return quicklist_alloc(QUICK_PT, GFP_KERNEL | __GFP_REPEAT, NULL);
+        return quicklist_alloc(QUICK_PT, GFP_KERNEL, NULL);
 }
 
 static inline pgtable_t pte_alloc_one(struct mm_struct *mm,
@@ -43,7 +43,7 @@ static inline pgtable_t pte_alloc_one(struct mm_struct *mm,
         struct page *page;
         void *pg;
 
-        pg = quicklist_alloc(QUICK_PT, GFP_KERNEL | __GFP_REPEAT, NULL);
+        pg = quicklist_alloc(QUICK_PT, GFP_KERNEL, NULL);
         if (!pg)
                 return NULL;
         page = virt_to_page(pg);
diff --git a/arch/sh/mm/pgtable.c b/arch/sh/mm/pgtable.c
index 26e03a1f7ca4..a62bd8696779 100644
--- a/arch/sh/mm/pgtable.c
+++ b/arch/sh/mm/pgtable.c
@@ -1,7 +1,7 @@
 #include <linux/mm.h>
 #include <linux/slab.h>
 
-#define PGALLOC_GFP GFP_KERNEL | __GFP_REPEAT | __GFP_ZERO
+#define PGALLOC_GFP GFP_KERNEL | __GFP_ZERO
 
 static struct kmem_cache *pgd_cachep;
 #if PAGETABLE_LEVELS > 2
diff --git a/arch/sparc/include/asm/pgalloc_64.h b/arch/sparc/include/asm/pgalloc_64.h
index 5e3187185b4a..3529f1378cd8 100644
--- a/arch/sparc/include/asm/pgalloc_64.h
+++ b/arch/sparc/include/asm/pgalloc_64.h
@@ -41,8 +41,7 @@ static inline void __pud_populate(pud_t *pud, pmd_t *pmd)
 
 static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long addr)
 {
-        return kmem_cache_alloc(pgtable_cache,
-                                GFP_KERNEL|__GFP_REPEAT);
+        return kmem_cache_alloc(pgtable_cache, GFP_KERNEL);
 }
 
 static inline void pud_free(struct mm_struct *mm, pud_t *pud)
@@ -52,8 +51,7 @@ static inline void pud_free(struct mm_struct *mm, pud_t *pud)
 
 static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long addr)
 {
-        return kmem_cache_alloc(pgtable_cache,
-                                GFP_KERNEL|__GFP_REPEAT);
+        return kmem_cache_alloc(pgtable_cache, GFP_KERNEL);
 }
 
 static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
diff --git a/arch/sparc/kernel/irq_64.c b/arch/sparc/kernel/irq_64.c
index e22416ce56ea..34a7930b76ef 100644
--- a/arch/sparc/kernel/irq_64.c
+++ b/arch/sparc/kernel/irq_64.c
@@ -242,7 +242,7 @@ unsigned int irq_alloc(unsigned int dev_handle, unsigned int dev_ino)
 {
         int irq;
 
-        irq = __irq_alloc_descs(-1, 1, 1, numa_node_id(), NULL);
+        irq = __irq_alloc_descs(-1, 1, 1, numa_node_id(), NULL, NULL);
         if (irq <= 0)
                 goto out;
 
diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
index 14bb0d5ed3c6..aec508e37490 100644
--- a/arch/sparc/mm/init_64.c
+++ b/arch/sparc/mm/init_64.c
@@ -2704,8 +2704,7 @@ void __flush_tlb_all(void)
 pte_t *pte_alloc_one_kernel(struct mm_struct *mm,
                             unsigned long address)
 {
-        struct page *page = alloc_page(GFP_KERNEL | __GFP_NOTRACK |
-                                       __GFP_REPEAT | __GFP_ZERO);
+        struct page *page = alloc_page(GFP_KERNEL | __GFP_NOTRACK | __GFP_ZERO);
         pte_t *pte = NULL;
 
         if (page)
@@ -2717,8 +2716,7 @@ pte_t *pte_alloc_one_kernel(struct mm_struct *mm,
 pgtable_t pte_alloc_one(struct mm_struct *mm,
                         unsigned long address)
 {
-        struct page *page = alloc_page(GFP_KERNEL | __GFP_NOTRACK |
-                                       __GFP_REPEAT | __GFP_ZERO);
+        struct page *page = alloc_page(GFP_KERNEL | __GFP_NOTRACK | __GFP_ZERO);
         if (!page)
                 return NULL;
         if (!pgtable_page_ctor(page)) {
diff --git a/arch/tile/include/asm/thread_info.h b/arch/tile/include/asm/thread_info.h
index 4b7cef9e94e0..c1467ac59ce6 100644
--- a/arch/tile/include/asm/thread_info.h
+++ b/arch/tile/include/asm/thread_info.h
@@ -78,7 +78,7 @@ struct thread_info {
 
 #ifndef __ASSEMBLY__
 
-void arch_release_thread_info(struct thread_info *info);
+void arch_release_thread_stack(unsigned long *stack);
 
 /* How to get the thread information struct from C. */
 register unsigned long stack_pointer __asm__("sp");
diff --git a/arch/tile/kernel/process.c b/arch/tile/kernel/process.c
index 6b705ccc9cc1..a465d8372edd 100644
--- a/arch/tile/kernel/process.c
+++ b/arch/tile/kernel/process.c
@@ -73,8 +73,9 @@ void arch_cpu_idle(void)
 /*
  * Release a thread_info structure
  */
-void arch_release_thread_info(struct thread_info *info)
+void arch_release_thread_stack(unsigned long *stack)
 {
+        struct thread_info *info = (void *)stack;
         struct single_step_state *step_state = info->step_state;
 
         if (step_state) {
diff --git a/arch/tile/mm/pgtable.c b/arch/tile/mm/pgtable.c
index 7bf2491a9c1f..c4d5bf841a7f 100644
--- a/arch/tile/mm/pgtable.c
+++ b/arch/tile/mm/pgtable.c
@@ -231,7 +231,7 @@ void pgd_free(struct mm_struct *mm, pgd_t *pgd)
 struct page *pgtable_alloc_one(struct mm_struct *mm, unsigned long address,
                                int order)
 {
-        gfp_t flags = GFP_KERNEL|__GFP_REPEAT|__GFP_ZERO;
+        gfp_t flags = GFP_KERNEL|__GFP_ZERO;
         struct page *p;
         int i;
 
diff --git a/arch/um/kernel/mem.c b/arch/um/kernel/mem.c
index b2a2dff50b4e..e7437ec62710 100644
--- a/arch/um/kernel/mem.c
+++ b/arch/um/kernel/mem.c
@@ -204,7 +204,7 @@ pte_t *pte_alloc_one_kernel(struct mm_struct *mm, unsigned long address)
 {
         pte_t *pte;
 
-        pte = (pte_t *)__get_free_page(GFP_KERNEL|__GFP_REPEAT|__GFP_ZERO);
+        pte = (pte_t *)__get_free_page(GFP_KERNEL|__GFP_ZERO);
         return pte;
 }
 
@@ -212,7 +212,7 @@ pgtable_t pte_alloc_one(struct mm_struct *mm, unsigned long address)
 {
         struct page *pte;
 
-        pte = alloc_page(GFP_KERNEL|__GFP_REPEAT|__GFP_ZERO);
+        pte = alloc_page(GFP_KERNEL|__GFP_ZERO);
         if (!pte)
                 return NULL;
         if (!pgtable_page_ctor(pte)) {
diff --git a/arch/unicore32/include/asm/pgalloc.h b/arch/unicore32/include/asm/pgalloc.h
index 2e02d1356fdf..26775793c204 100644
--- a/arch/unicore32/include/asm/pgalloc.h
+++ b/arch/unicore32/include/asm/pgalloc.h
@@ -28,7 +28,7 @@ extern void free_pgd_slow(struct mm_struct *mm, pgd_t *pgd);
 #define pgd_alloc(mm)                   get_pgd_slow(mm)
 #define pgd_free(mm, pgd)               free_pgd_slow(mm, pgd)
 
-#define PGALLOC_GFP     (GFP_KERNEL | __GFP_NOTRACK | __GFP_REPEAT | __GFP_ZERO)
+#define PGALLOC_GFP     (GFP_KERNEL | __GFP_NOTRACK | __GFP_ZERO)
 
 /*
  * Allocate one PTE table.
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 0a7b885964ba..d9a94da0c29f 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -2439,6 +2439,15 @@ config PCI_CNB20LE_QUIRK
 
 source "drivers/pci/Kconfig"
 
+config ISA_BUS
+        bool "ISA-style bus support on modern systems" if EXPERT
+        select ISA_BUS_API
+        help
+          Enables ISA-style drivers on modern systems. This is necessary to
+          support PC/104 devices on X86_64 platforms.
+
+          If unsure, say N.
+
 # x86_64 have no ISA slots, but can have ISA-style DMA.
 config ISA_DMA_API
         bool "ISA-style DMA support" if (X86_64 && EXPERT)
diff --git a/arch/x86/boot/Makefile b/arch/x86/boot/Makefile
index 700a9c6e6159..be8e688fa0d4 100644
--- a/arch/x86/boot/Makefile
+++ b/arch/x86/boot/Makefile
@@ -162,6 +162,9 @@ isoimage: $(obj)/bzImage
         for i in lib lib64 share end ; do \
                 if [ -f /usr/$$i/syslinux/isolinux.bin ] ; then \
                         cp /usr/$$i/syslinux/isolinux.bin $(obj)/isoimage ; \
+                        if [ -f /usr/$$i/syslinux/ldlinux.c32 ]; then \
+                                cp /usr/$$i/syslinux/ldlinux.c32 $(obj)/isoimage ; \
+                        fi ; \
                         break ; \
                 fi ; \
                 if [ $$i = end ] ; then exit 1 ; fi ; \
diff --git a/arch/x86/events/intel/rapl.c b/arch/x86/events/intel/rapl.c
index 99c4bab123cd..e30eef4f29a6 100644
--- a/arch/x86/events/intel/rapl.c
+++ b/arch/x86/events/intel/rapl.c
@@ -714,7 +714,7 @@ static void cleanup_rapl_pmus(void)
         int i;
 
         for (i = 0; i < rapl_pmus->maxpkg; i++)
-                kfree(rapl_pmus->pmus + i);
+                kfree(rapl_pmus->pmus[i]);
         kfree(rapl_pmus);
 }
 
diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c
index b2625867ebd1..874e8bd64d1d 100644
--- a/arch/x86/events/intel/uncore_snbep.c
+++ b/arch/x86/events/intel/uncore_snbep.c
@@ -2868,27 +2868,10 @@ static struct intel_uncore_type bdx_uncore_cbox = {
         .format_group           = &hswep_uncore_cbox_format_group,
 };
 
-static struct intel_uncore_type bdx_uncore_sbox = {
-        .name                   = "sbox",
-        .num_counters           = 4,
-        .num_boxes              = 4,
-        .perf_ctr_bits          = 48,
-        .event_ctl              = HSWEP_S0_MSR_PMON_CTL0,
-        .perf_ctr               = HSWEP_S0_MSR_PMON_CTR0,
-        .event_mask             = HSWEP_S_MSR_PMON_RAW_EVENT_MASK,
-        .box_ctl                = HSWEP_S0_MSR_PMON_BOX_CTL,
-        .msr_offset             = HSWEP_SBOX_MSR_OFFSET,
-        .ops                    = &hswep_uncore_sbox_msr_ops,
-        .format_group           = &hswep_uncore_sbox_format_group,
-};
-
-#define BDX_MSR_UNCORE_SBOX     3
-
 static struct intel_uncore_type *bdx_msr_uncores[] = {
         &bdx_uncore_ubox,
         &bdx_uncore_cbox,
         &hswep_uncore_pcu,
-        &bdx_uncore_sbox,
         NULL,
 };
 
@@ -2897,10 +2880,6 @@ void bdx_uncore_cpu_init(void)
         if (bdx_uncore_cbox.num_boxes > boot_cpu_data.x86_max_cores)
                 bdx_uncore_cbox.num_boxes = boot_cpu_data.x86_max_cores;
         uncore_msr_uncores = bdx_msr_uncores;
-
-        /* BDX-DE doesn't have SBOX */
-        if (boot_cpu_data.x86_model == 86)
-                uncore_msr_uncores[BDX_MSR_UNCORE_SBOX] = NULL;
 }
 
 static struct intel_uncore_type bdx_uncore_ha = {
diff --git a/arch/x86/include/asm/intel-family.h b/arch/x86/include/asm/intel-family.h
new file mode 100644
index 000000000000..6999f7d01a0d
--- /dev/null
+++ b/arch/x86/include/asm/intel-family.h
@@ -0,0 +1,68 @@
+#ifndef _ASM_X86_INTEL_FAMILY_H
+#define _ASM_X86_INTEL_FAMILY_H
+
+/*
+ * "Big Core" Processors (Branded as Core, Xeon, etc...)
+ *
+ * The "_X" parts are generally the EP and EX Xeons, or the
+ * "Extreme" ones, like Broadwell-E.
+ *
+ * Things ending in "2" are usually because we have no better
+ * name for them.  There's no processor called "WESTMERE2".
+ */
+
+#define INTEL_FAM6_CORE_YONAH           0x0E
+#define INTEL_FAM6_CORE2_MEROM          0x0F
+#define INTEL_FAM6_CORE2_MEROM_L        0x16
+#define INTEL_FAM6_CORE2_PENRYN         0x17
+#define INTEL_FAM6_CORE2_DUNNINGTON     0x1D
+
+#define INTEL_FAM6_NEHALEM              0x1E
+#define INTEL_FAM6_NEHALEM_EP           0x1A
+#define INTEL_FAM6_NEHALEM_EX           0x2E
+#define INTEL_FAM6_WESTMERE             0x25
+#define INTEL_FAM6_WESTMERE2            0x1F
+#define INTEL_FAM6_WESTMERE_EP          0x2C
+#define INTEL_FAM6_WESTMERE_EX          0x2F
+
+#define INTEL_FAM6_SANDYBRIDGE          0x2A
+#define INTEL_FAM6_SANDYBRIDGE_X        0x2D
+#define INTEL_FAM6_IVYBRIDGE            0x3A
+#define INTEL_FAM6_IVYBRIDGE_X          0x3E
+
+#define INTEL_FAM6_HASWELL_CORE         0x3C
+#define INTEL_FAM6_HASWELL_X            0x3F
+#define INTEL_FAM6_HASWELL_ULT          0x45
+#define INTEL_FAM6_HASWELL_GT3E         0x46
+
+#define INTEL_FAM6_BROADWELL_CORE       0x3D
+#define INTEL_FAM6_BROADWELL_XEON_D     0x56
+#define INTEL_FAM6_BROADWELL_GT3E       0x47
+#define INTEL_FAM6_BROADWELL_X          0x4F
+
+#define INTEL_FAM6_SKYLAKE_MOBILE       0x4E
+#define INTEL_FAM6_SKYLAKE_DESKTOP      0x5E
+#define INTEL_FAM6_SKYLAKE_X            0x55
+#define INTEL_FAM6_KABYLAKE_MOBILE      0x8E
+#define INTEL_FAM6_KABYLAKE_DESKTOP     0x9E
+
+/* "Small Core" Processors (Atom) */
+
+#define INTEL_FAM6_ATOM_PINEVIEW        0x1C
+#define INTEL_FAM6_ATOM_LINCROFT        0x26
+#define INTEL_FAM6_ATOM_PENWELL         0x27
+#define INTEL_FAM6_ATOM_CLOVERVIEW      0x35
+#define INTEL_FAM6_ATOM_CEDARVIEW       0x36
+#define INTEL_FAM6_ATOM_SILVERMONT1     0x37 /* BayTrail/BYT / Valleyview */
+#define INTEL_FAM6_ATOM_SILVERMONT2     0x4D /* Avaton/Rangely */
+#define INTEL_FAM6_ATOM_AIRMONT         0x4C /* CherryTrail / Braswell */
+#define INTEL_FAM6_ATOM_MERRIFIELD1     0x4A /* Tangier */
+#define INTEL_FAM6_ATOM_MERRIFIELD2     0x5A /* Annidale */
+#define INTEL_FAM6_ATOM_GOLDMONT        0x5C
+#define INTEL_FAM6_ATOM_DENVERTON       0x5F /* Goldmont Microserver */
+
+/* Xeon Phi */
+
+#define INTEL_FAM6_XEON_PHI_KNL         0x57 /* Knights Landing */
+
+#endif /* _ASM_X86_INTEL_FAMILY_H */
diff --git a/arch/x86/include/asm/kprobes.h b/arch/x86/include/asm/kprobes.h
index 4421b5da409d..d1d1e5094c28 100644
--- a/arch/x86/include/asm/kprobes.h
+++ b/arch/x86/include/asm/kprobes.h
@@ -38,12 +38,11 @@ typedef u8 kprobe_opcode_t;
 #define RELATIVECALL_OPCODE 0xe8
 #define RELATIVE_ADDR_SIZE 4
 #define MAX_STACK_SIZE 64
-#define MIN_STACK_SIZE(ADDR)                                           \
-        (((MAX_STACK_SIZE) < (((unsigned long)current_thread_info()) + \
-                              THREAD_SIZE - (unsigned long)(ADDR)))    \
-         ? (MAX_STACK_SIZE)                                            \
-         : (((unsigned long)current_thread_info()) +                   \
-            THREAD_SIZE - (unsigned long)(ADDR)))
+#define CUR_STACK_SIZE(ADDR) \
+        (current_top_of_stack() - (unsigned long)(ADDR))
+#define MIN_STACK_SIZE(ADDR)                            \
+        (MAX_STACK_SIZE < CUR_STACK_SIZE(ADDR) ?        \
+         MAX_STACK_SIZE : CUR_STACK_SIZE(ADDR))
 
 #define flush_insn_slot(p)      do { } while (0)
 
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index e0fbe7e70dc1..69e62862b622 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -27,6 +27,7 @@
 #include <linux/irqbypass.h>
 #include <linux/hyperv.h>
 
+#include <asm/apic.h>
 #include <asm/pvclock-abi.h>
 #include <asm/desc.h>
 #include <asm/mtrr.h>
@@ -1368,4 +1369,14 @@ static inline void kvm_arch_vcpu_unblocking(struct kvm_vcpu *vcpu)
 
 static inline void kvm_arch_vcpu_block_finish(struct kvm_vcpu *vcpu) {}
 
+static inline int kvm_cpu_get_apicid(int mps_cpu)
+{
+#ifdef CONFIG_X86_LOCAL_APIC
+        return __default_cpu_present_to_apicid(mps_cpu);
+#else
+        WARN_ON_ONCE(1);
+        return BAD_APICID;
+#endif
+}
+
 #endif /* _ASM_X86_KVM_HOST_H */
diff --git a/arch/x86/include/asm/msr.h b/arch/x86/include/asm/msr.h
index 7dc1d8fef7fd..b5fee97813cd 100644
--- a/arch/x86/include/asm/msr.h
+++ b/arch/x86/include/asm/msr.h
@@ -122,7 +122,7 @@ notrace static inline void native_write_msr(unsigned int msr,
                      "2:\n"
                      _ASM_EXTABLE_HANDLE(1b, 2b, ex_handler_wrmsr_unsafe)
                      : : "c" (msr), "a"(low), "d" (high) : "memory");
-        if (msr_tracepoint_active(__tracepoint_read_msr))
+        if (msr_tracepoint_active(__tracepoint_write_msr))
                 do_trace_write_msr(msr, ((u64)high << 32 | low), 0);
 }
 
@@ -141,7 +141,7 @@ notrace static inline int native_write_msr_safe(unsigned int msr,
                      : "c" (msr), "0" (low), "d" (high),
                        [fault] "i" (-EIO)
                      : "memory");
-        if (msr_tracepoint_active(__tracepoint_read_msr))
+        if (msr_tracepoint_active(__tracepoint_write_msr))
                 do_trace_write_msr(msr, ((u64)high << 32 | low), err);
         return err;
 }
diff --git a/arch/x86/include/asm/pgalloc.h b/arch/x86/include/asm/pgalloc.h
index bf7f8b55b0f9..574c23cf761a 100644
--- a/arch/x86/include/asm/pgalloc.h
+++ b/arch/x86/include/asm/pgalloc.h
@@ -81,7 +81,7 @@ static inline void pmd_populate(struct mm_struct *mm, pmd_t *pmd,
 static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long addr)
 {
         struct page *page;
-        page = alloc_pages(GFP_KERNEL | __GFP_REPEAT | __GFP_ZERO, 0);
+        page = alloc_pages(GFP_KERNEL |  __GFP_ZERO, 0);
         if (!page)
                 return NULL;
         if (!pgtable_pmd_page_ctor(page)) {
@@ -125,7 +125,7 @@ static inline void pgd_populate(struct mm_struct *mm, pgd_t *pgd, pud_t *pud)
 
 static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long addr)
 {
-        return (pud_t *)get_zeroed_page(GFP_KERNEL|__GFP_REPEAT);
+        return (pud_t *)get_zeroed_page(GFP_KERNEL);
 }
 
 static inline void pud_free(struct mm_struct *mm, pud_t *pud)
diff --git a/arch/x86/include/asm/pvclock.h b/arch/x86/include/asm/pvclock.h
index fdcc04020636..7c1c89598688 100644
--- a/arch/x86/include/asm/pvclock.h
+++ b/arch/x86/include/asm/pvclock.h
@@ -69,29 +69,22 @@ static inline u64 pvclock_scale_delta(u64 delta, u32 mul_frac, int shift)
 }
 
 static __always_inline
-u64 pvclock_get_nsec_offset(const struct pvclock_vcpu_time_info *src)
-{
-        u64 delta = rdtsc_ordered() - src->tsc_timestamp;
-        return pvclock_scale_delta(delta, src->tsc_to_system_mul,
-                                   src->tsc_shift);
-}
-
-static __always_inline
 unsigned __pvclock_read_cycles(const struct pvclock_vcpu_time_info *src,
                                cycle_t *cycles, u8 *flags)
 {
         unsigned version;
-        cycle_t ret, offset;
-        u8 ret_flags;
+        cycle_t offset;
+        u64 delta;
 
         version = src->version;
+        /* Make the latest version visible */
+        smp_rmb();
 
-        offset = pvclock_get_nsec_offset(src);
-        ret = src->system_time + offset;
-        ret_flags = src->flags;
-
-        *cycles = ret;
-        *flags = ret_flags;
+        delta = rdtsc_ordered() - src->tsc_timestamp;
+        offset = pvclock_scale_delta(delta, src->tsc_to_system_mul,
+                                   src->tsc_shift);
+        *cycles = src->system_time + offset;
+        *flags = src->flags;
         return version;
 }
 
diff --git a/arch/x86/include/asm/stacktrace.h b/arch/x86/include/asm/stacktrace.h
index 7c247e7404be..0944218af9e2 100644
--- a/arch/x86/include/asm/stacktrace.h
+++ b/arch/x86/include/asm/stacktrace.h
@@ -14,7 +14,7 @@ extern int kstack_depth_to_print;
 struct thread_info;
 struct stacktrace_ops;
 
-typedef unsigned long (*walk_stack_t)(struct thread_info *tinfo,
+typedef unsigned long (*walk_stack_t)(struct task_struct *task,
                                       unsigned long *stack,
                                       unsigned long bp,
                                       const struct stacktrace_ops *ops,
@@ -23,13 +23,13 @@ typedef unsigned long (*walk_stack_t)(struct thread_info *tinfo,
                                       int *graph);
 
 extern unsigned long
-print_context_stack(struct thread_info *tinfo,
+print_context_stack(struct task_struct *task,
                     unsigned long *stack, unsigned long bp,
                     const struct stacktrace_ops *ops, void *data,
                     unsigned long *end, int *graph);
 
 extern unsigned long
-print_context_stack_bp(struct thread_info *tinfo,
+print_context_stack_bp(struct task_struct *task,
                        unsigned long *stack, unsigned long bp,
                        const struct stacktrace_ops *ops, void *data,
                        unsigned long *end, int *graph);
diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
index 84e33ff5a6d5..7c4f90dd4c2a 100644
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -981,7 +981,7 @@ static int alloc_irq_from_domain(struct irq_domain *domain, int ioapic, u32 gsi,
 
         return __irq_domain_alloc_irqs(domain, irq, 1,
                                        ioapic_alloc_attr_node(info),
-                                       info, legacy);
+                                       info, legacy, NULL);
 }
 
 /*
@@ -1014,7 +1014,8 @@ static int alloc_isa_irq_from_domain(struct irq_domain *domain,
                                           info->ioapic_pin))
                         return -ENOMEM;
         } else {
-                irq = __irq_domain_alloc_irqs(domain, irq, 1, node, info, true);
+                irq = __irq_domain_alloc_irqs(domain, irq, 1, node, info, true,
+                                              NULL);
                 if (irq >= 0) {
                         irq_data = irq_domain_get_irq_data(domain, irq);
                         data = irq_data->chip_data;
@@ -2588,8 +2589,8 @@ static struct resource * __init ioapic_setup_resources(void)
                 res[num].flags = IORESOURCE_MEM | IORESOURCE_BUSY;
                 snprintf(mem, IOAPIC_RESOURCE_NAME_SIZE, "IOAPIC %u", i);
                 mem += IOAPIC_RESOURCE_NAME_SIZE;
+                ioapics[i].iomem_res = &res[num];
                 num++;
-                ioapics[i].iomem_res = res;
         }
 
         ioapic_resources = res;
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index c343a54bed39..f5c69d8974e1 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -674,14 +674,14 @@ static void init_amd_bd(struct cpuinfo_x86 *c)
         u64 value;
 
         /* re-enable TopologyExtensions if switched off by BIOS */
-        if ((c->x86_model >= 0x10) && (c->x86_model <= 0x1f) &&
+        if ((c->x86_model >= 0x10) && (c->x86_model <= 0x6f) &&
             !cpu_has(c, X86_FEATURE_TOPOEXT)) {
 
                 if (msr_set_bit(0xc0011005, 54) > 0) {
                         rdmsrl(0xc0011005, value);
                         if (value & BIT_64(54)) {
                                 set_cpu_cap(c, X86_FEATURE_TOPOEXT);
-                                pr_info(FW_INFO "CPU: Re-enabling disabled Topology Extensions Support.\n");
+                                pr_info_once(FW_INFO "CPU: Re-enabling disabled Topology Extensions Support.\n");
                         }
                 }
         }
diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c
index 2bb25c3fe2e8..ef8017ca5ba9 100644
--- a/arch/x86/kernel/dumpstack.c
+++ b/arch/x86/kernel/dumpstack.c
@@ -42,16 +42,14 @@ void printk_address(unsigned long address)
 static void
 print_ftrace_graph_addr(unsigned long addr, void *data,
                         const struct stacktrace_ops *ops,
-                        struct thread_info *tinfo, int *graph)
+                        struct task_struct *task, int *graph)
 {
-        struct task_struct *task;
         unsigned long ret_addr;
         int index;
 
         if (addr != (unsigned long)return_to_handler)
                 return;
 
-        task = tinfo->task;
         index = task->curr_ret_stack;
 
         if (!task->ret_stack || index < *graph)
@@ -68,7 +66,7 @@ print_ftrace_graph_addr(unsigned long addr, void *data,
 static inline void
 print_ftrace_graph_addr(unsigned long addr, void *data,
                         const struct stacktrace_ops *ops,
-                        struct thread_info *tinfo, int *graph)
+                        struct task_struct *task, int *graph)
 { }
 #endif
 
@@ -79,10 +77,10 @@ print_ftrace_graph_addr(unsigned long addr, void *data,
  * severe exception (double fault, nmi, stack fault, debug, mce) hardware stack
  */
 
-static inline int valid_stack_ptr(struct thread_info *tinfo,
+static inline int valid_stack_ptr(struct task_struct *task,
                         void *p, unsigned int size, void *end)
 {
-        void *t = tinfo;
+        void *t = task_stack_page(task);
         if (end) {
                 if (p < end && p >= (end-THREAD_SIZE))
                         return 1;
@@ -93,14 +91,14 @@ static inline int valid_stack_ptr(struct thread_info *tinfo,
 }
 
 unsigned long
-print_context_stack(struct thread_info *tinfo,
+print_context_stack(struct task_struct *task,
                 unsigned long *stack, unsigned long bp,
                 const struct stacktrace_ops *ops, void *data,
                 unsigned long *end, int *graph)
 {
         struct stack_frame *frame = (struct stack_frame *)bp;
 
-        while (valid_stack_ptr(tinfo, stack, sizeof(*stack), end)) {
+        while (valid_stack_ptr(task, stack, sizeof(*stack), end)) {
                 unsigned long addr;
 
                 addr = *stack;
@@ -112,7 +110,7 @@ print_context_stack(struct thread_info *tinfo,
                         } else {
                                 ops->address(data, addr, 0);
                         }
-                        print_ftrace_graph_addr(addr, data, ops, tinfo, graph);
+                        print_ftrace_graph_addr(addr, data, ops, task, graph);
                 }
                 stack++;
         }
@@ -121,7 +119,7 @@ print_context_stack(struct thread_info *tinfo,
 EXPORT_SYMBOL_GPL(print_context_stack);
 
 unsigned long
-print_context_stack_bp(struct thread_info *tinfo,
+print_context_stack_bp(struct task_struct *task,
                        unsigned long *stack, unsigned long bp,
                        const struct stacktrace_ops *ops, void *data,
                        unsigned long *end, int *graph)
@@ -129,7 +127,7 @@ print_context_stack_bp(struct thread_info *tinfo,
         struct stack_frame *frame = (struct stack_frame *)bp;
         unsigned long *ret_addr = &frame->return_address;
 
-        while (valid_stack_ptr(tinfo, ret_addr, sizeof(*ret_addr), end)) {
+        while (valid_stack_ptr(task, ret_addr, sizeof(*ret_addr), end)) {
                 unsigned long addr = *ret_addr;
 
                 if (!__kernel_text_address(addr))
@@ -139,7 +137,7 @@ print_context_stack_bp(struct thread_info *tinfo,
                         break;
                 frame = frame->next_frame;
                 ret_addr = &frame->return_address;
-                print_ftrace_graph_addr(addr, data, ops, tinfo, graph);
+                print_ftrace_graph_addr(addr, data, ops, task, graph);
         }
 
         return (unsigned long)frame;
diff --git a/arch/x86/kernel/dumpstack_32.c b/arch/x86/kernel/dumpstack_32.c
index 464ffd69b92e..fef917e79b9d 100644
--- a/arch/x86/kernel/dumpstack_32.c
+++ b/arch/x86/kernel/dumpstack_32.c
@@ -61,15 +61,13 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
                 bp = stack_frame(task, regs);
 
         for (;;) {
-                struct thread_info *context;
                 void *end_stack;
 
                 end_stack = is_hardirq_stack(stack, cpu);
                 if (!end_stack)
                         end_stack = is_softirq_stack(stack, cpu);
 
-                context = task_thread_info(task);
-                bp = ops->walk_stack(context, stack, bp, ops, data,
+                bp = ops->walk_stack(task, stack, bp, ops, data,
                                      end_stack, &graph);
 
                 /* Stop if not on irq stack */
diff --git a/arch/x86/kernel/dumpstack_64.c b/arch/x86/kernel/dumpstack_64.c
index 5f1c6266eb30..d558a8a49016 100644
--- a/arch/x86/kernel/dumpstack_64.c
+++ b/arch/x86/kernel/dumpstack_64.c
@@ -153,7 +153,6 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
                 const struct stacktrace_ops *ops, void *data)
 {
         const unsigned cpu = get_cpu();
-        struct thread_info *tinfo;
         unsigned long *irq_stack = (unsigned long *)per_cpu(irq_stack_ptr, cpu);
         unsigned long dummy;
         unsigned used = 0;
@@ -179,7 +178,6 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
          * current stack address. If the stacks consist of nested
          * exceptions
          */
-        tinfo = task_thread_info(task);
         while (!done) {
                 unsigned long *stack_end;
                 enum stack_type stype;
@@ -202,7 +200,7 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
                         if (ops->stack(data, id) < 0)
                                 break;
 
-                        bp = ops->walk_stack(tinfo, stack, bp, ops,
+                        bp = ops->walk_stack(task, stack, bp, ops,
                                              data, stack_end, &graph);
                         ops->stack(data, "<EOE>");
                         /*
@@ -218,7 +216,7 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
 
                         if (ops->stack(data, "IRQ") < 0)
                                 break;
-                        bp = ops->walk_stack(tinfo, stack, bp,
+                        bp = ops->walk_stack(task, stack, bp,
                                      ops, data, stack_end, &graph);
                         /*
                          * We link to the next stack (which would be
@@ -240,7 +238,7 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
         /*
          * This handles the process stack:
          */
-        bp = ops->walk_stack(tinfo, stack, bp, ops, data, NULL, &graph);
+        bp = ops->walk_stack(task, stack, bp, ops, data, NULL, &graph);
         put_cpu();
 }
 EXPORT_SYMBOL(dump_trace);
diff --git a/arch/x86/kernel/espfix_64.c b/arch/x86/kernel/espfix_64.c
index 4d38416e2a7f..04f89caef9c4 100644
--- a/arch/x86/kernel/espfix_64.c
+++ b/arch/x86/kernel/espfix_64.c
@@ -57,7 +57,7 @@
 # error "Need more than one PGD for the ESPFIX hack"
 #endif
 
-#define PGALLOC_GFP (GFP_KERNEL | __GFP_NOTRACK | __GFP_REPEAT | __GFP_ZERO)
+#define PGALLOC_GFP (GFP_KERNEL | __GFP_NOTRACK | __GFP_ZERO)
 
 /* This contains the *bottom* address of the espfix stack */
 DEFINE_PER_CPU_READ_MOSTLY(unsigned long, espfix_stack);
diff --git a/arch/x86/kernel/irq_32.c b/arch/x86/kernel/irq_32.c
index 38da8f29a9c8..c627bf8d98ad 100644
--- a/arch/x86/kernel/irq_32.c
+++ b/arch/x86/kernel/irq_32.c
@@ -130,11 +130,9 @@ void irq_ctx_init(int cpu)
 
 void do_softirq_own_stack(void)
 {
-        struct thread_info *curstk;
         struct irq_stack *irqstk;
         u32 *isp, *prev_esp;
 
-        curstk = current_stack();
         irqstk = __this_cpu_read(softirq_stack);
 
         /* build the stack frame on the softirq stack */
diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
index 38cf7a741250..7847e5c0e0b5 100644
--- a/arch/x86/kernel/kprobes/core.c
+++ b/arch/x86/kernel/kprobes/core.c
@@ -961,7 +961,19 @@ int kprobe_fault_handler(struct pt_regs *regs, int trapnr)
                  * normal page fault.
                  */
                 regs->ip = (unsigned long)cur->addr;
+                /*
+                 * Trap flag (TF) has been set here because this fault
+                 * happened where the single stepping will be done.
+                 * So clear it by resetting the current kprobe:
+                 */
+                regs->flags &= ~X86_EFLAGS_TF;
+
+                /*
+                 * If the TF flag was set before the kprobe hit,
+                 * don't touch it:
+                 */
                 regs->flags |= kcb->kprobe_old_flags;
+
                 if (kcb->kprobe_status == KPROBE_REENTER)
                         restore_previous_kprobe(kcb);
                 else
diff --git a/arch/x86/kernel/pvclock.c b/arch/x86/kernel/pvclock.c
index 99bfc025111d..06c58ce46762 100644
--- a/arch/x86/kernel/pvclock.c
+++ b/arch/x86/kernel/pvclock.c
@@ -61,11 +61,16 @@ void pvclock_resume(void)
 u8 pvclock_read_flags(struct pvclock_vcpu_time_info *src)
 {
         unsigned version;
-        cycle_t ret;
         u8 flags;
 
         do {
-                version = __pvclock_read_cycles(src, &ret, &flags);
+                version = src->version;
+                /* Make the latest version visible */
+                smp_rmb();
+
+                flags = src->flags;
+                /* Make sure that the version double-check is last. */
+                smp_rmb();
         } while ((src->version & 1) || version != src->version);
 
         return flags & valid_flags;
@@ -80,6 +85,8 @@ cycle_t pvclock_clocksource_read(struct pvclock_vcpu_time_info *src)
 
         do {
                 version = __pvclock_read_cycles(src, &ret, &flags);
+                /* Make sure that the version double-check is last. */
+                smp_rmb();
         } while ((src->version & 1) || version != src->version);
 
         if (unlikely((flags & PVCLOCK_GUEST_STOPPED) != 0)) {
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index d1590486204a..00f03d82e69a 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -96,6 +96,12 @@ static inline void cond_local_irq_disable(struct pt_regs *regs)
                 local_irq_disable();
 }
 
+/*
+ * In IST context, we explicitly disable preemption.  This serves two
+ * purposes: it makes it much less likely that we would accidentally
+ * schedule in IST context and it will force a warning if we somehow
+ * manage to schedule by accident.
+ */
 void ist_enter(struct pt_regs *regs)
 {
         if (user_mode(regs)) {
@@ -110,13 +116,7 @@ void ist_enter(struct pt_regs *regs)
                 rcu_nmi_enter();
         }
 
-        /*
-         * We are atomic because we're on the IST stack; or we're on
-         * x86_32, in which case we still shouldn't schedule; or we're
-         * on x86_64 and entered from user mode, in which case we're
-         * still atomic unless ist_begin_non_atomic is called.
-         */
-        preempt_count_add(HARDIRQ_OFFSET);
+        preempt_disable();
 
         /* This code is a bit fragile.  Test it. */
         RCU_LOCKDEP_WARN(!rcu_is_watching(), "ist_enter didn't work");
@@ -124,7 +124,7 @@ void ist_enter(struct pt_regs *regs)
 
 void ist_exit(struct pt_regs *regs)
 {
-        preempt_count_sub(HARDIRQ_OFFSET);
+        preempt_enable_no_resched();
 
         if (!user_mode(regs))
                 rcu_nmi_exit();
@@ -155,7 +155,7 @@ void ist_begin_non_atomic(struct pt_regs *regs)
         BUG_ON((unsigned long)(current_top_of_stack() -
                                current_stack_pointer()) >= THREAD_SIZE);
 
-        preempt_count_sub(HARDIRQ_OFFSET);
+        preempt_enable_no_resched();
 }
 
 /**
@@ -165,7 +165,7 @@ void ist_begin_non_atomic(struct pt_regs *regs)
  */
 void ist_end_non_atomic(void)
 {
-        preempt_count_add(HARDIRQ_OFFSET);
+        preempt_disable();
 }
 
 static nokprobe_inline int
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index bbb5b283ff63..a397200281c1 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -1310,7 +1310,8 @@ void wait_lapic_expire(struct kvm_vcpu *vcpu)
 
         /* __delay is delay_tsc whenever the hardware has TSC, thus always.  */
         if (guest_tsc < tsc_deadline)
-                __delay(tsc_deadline - guest_tsc);
+                __delay(min(tsc_deadline - guest_tsc,
+                        nsec_to_cycles(vcpu, lapic_timer_advance_ns)));
 }
 
 static void start_apic_timer(struct kvm_lapic *apic)
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index 1163e8173e5a..16ef31b87452 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -238,7 +238,9 @@ module_param(nested, int, S_IRUGO);
 
 /* enable / disable AVIC */
 static int avic;
+#ifdef CONFIG_X86_LOCAL_APIC
 module_param(avic, int, S_IRUGO);
+#endif
 
 static void svm_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0);
 static void svm_flush_tlb(struct kvm_vcpu *vcpu);
@@ -981,11 +983,14 @@ static __init int svm_hardware_setup(void)
         } else
                 kvm_disable_tdp();
 
-        if (avic && (!npt_enabled || !boot_cpu_has(X86_FEATURE_AVIC)))
-                avic = false;
-
-        if (avic)
-                pr_info("AVIC enabled\n");
+        if (avic) {
+                if (!npt_enabled ||
+                    !boot_cpu_has(X86_FEATURE_AVIC) ||
+                    !IS_ENABLED(CONFIG_X86_LOCAL_APIC))
+                        avic = false;
+                else
+                        pr_info("AVIC enabled\n");
+        }
 
         return 0;
 
@@ -1324,7 +1329,7 @@ free_avic:
 static void avic_set_running(struct kvm_vcpu *vcpu, bool is_run)
 {
         u64 entry;
-        int h_physical_id = __default_cpu_present_to_apicid(vcpu->cpu);
+        int h_physical_id = kvm_cpu_get_apicid(vcpu->cpu);
         struct vcpu_svm *svm = to_svm(vcpu);
 
         if (!kvm_vcpu_apicv_active(vcpu))
@@ -1349,7 +1354,7 @@ static void avic_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
 {
         u64 entry;
         /* ID = 0xff (broadcast), ID > 0xff (reserved) */
-        int h_physical_id = __default_cpu_present_to_apicid(cpu);
+        int h_physical_id = kvm_cpu_get_apicid(cpu);
         struct vcpu_svm *svm = to_svm(vcpu);
 
         if (!kvm_vcpu_apicv_active(vcpu))
@@ -4236,7 +4241,7 @@ static void svm_deliver_avic_intr(struct kvm_vcpu *vcpu, int vec)
 
         if (avic_vcpu_is_running(vcpu))
                 wrmsrl(SVM_AVIC_DOORBELL,
-                       __default_cpu_present_to_apicid(vcpu->cpu));
+                       kvm_cpu_get_apicid(vcpu->cpu));
         else
                 kvm_vcpu_wake_up(vcpu);
 }
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index fb93010beaa4..64a79f271276 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -2072,7 +2072,8 @@ static void vmx_vcpu_pi_load(struct kvm_vcpu *vcpu, int cpu)
         unsigned int dest;
 
         if (!kvm_arch_has_assigned_device(vcpu->kvm) ||
-                !irq_remapping_cap(IRQ_POSTING_CAP))
+                !irq_remapping_cap(IRQ_POSTING_CAP)  ||
+                !kvm_vcpu_apicv_active(vcpu))
                 return;
 
         do {
@@ -2180,7 +2181,8 @@ static void vmx_vcpu_pi_put(struct kvm_vcpu *vcpu)
         struct pi_desc *pi_desc = vcpu_to_pi_desc(vcpu);
 
         if (!kvm_arch_has_assigned_device(vcpu->kvm) ||
-                !irq_remapping_cap(IRQ_POSTING_CAP))
+                !irq_remapping_cap(IRQ_POSTING_CAP)  ||
+                !kvm_vcpu_apicv_active(vcpu))
                 return;
 
         /* Set SN when the vCPU is preempted */
@@ -6669,7 +6671,13 @@ static int get_vmx_mem_address(struct kvm_vcpu *vcpu,
 
         /* Checks for #GP/#SS exceptions. */
         exn = false;
-        if (is_protmode(vcpu)) {
+        if (is_long_mode(vcpu)) {
+                /* Long mode: #GP(0)/#SS(0) if the memory address is in a
+                 * non-canonical form. This is the only check on the memory
+                 * destination for long mode!
+                 */
+                exn = is_noncanonical_address(*ret);
+        } else if (is_protmode(vcpu)) {
                 /* Protected mode: apply checks for segment validity in the
                  * following order:
                  * - segment type check (#GP(0) may be thrown)
@@ -6686,17 +6694,10 @@ static int get_vmx_mem_address(struct kvm_vcpu *vcpu,
                          * execute-only code segment
                          */
                         exn = ((s.type & 0xa) == 8);
-        }
-        if (exn) {
-                kvm_queue_exception_e(vcpu, GP_VECTOR, 0);
-                return 1;
-        }
-        if (is_long_mode(vcpu)) {
-                /* Long mode: #GP(0)/#SS(0) if the memory address is in a
-                 * non-canonical form. This is an only check for long mode.
-                 */
-                exn = is_noncanonical_address(*ret);
-        } else if (is_protmode(vcpu)) {
+                if (exn) {
+                        kvm_queue_exception_e(vcpu, GP_VECTOR, 0);
+                        return 1;
+                }
                 /* Protected mode: #GP(0)/#SS(0) if the segment is unusable.
                  */
                 exn = (s.unusable != 0);
@@ -10714,7 +10715,8 @@ static int vmx_pre_block(struct kvm_vcpu *vcpu)
         struct pi_desc *pi_desc = vcpu_to_pi_desc(vcpu);
 
         if (!kvm_arch_has_assigned_device(vcpu->kvm) ||
-                !irq_remapping_cap(IRQ_POSTING_CAP))
+                !irq_remapping_cap(IRQ_POSTING_CAP)  ||
+                !kvm_vcpu_apicv_active(vcpu))
                 return 0;
 
         vcpu->pre_pcpu = vcpu->cpu;
@@ -10780,7 +10782,8 @@ static void vmx_post_block(struct kvm_vcpu *vcpu)
         unsigned long flags;
 
         if (!kvm_arch_has_assigned_device(vcpu->kvm) ||
-                !irq_remapping_cap(IRQ_POSTING_CAP))
+                !irq_remapping_cap(IRQ_POSTING_CAP)  ||
+                !kvm_vcpu_apicv_active(vcpu))
                 return;
 
         do {
@@ -10833,7 +10836,8 @@ static int vmx_update_pi_irte(struct kvm *kvm, unsigned int host_irq,
         int idx, ret = -EINVAL;
 
         if (!kvm_arch_has_assigned_device(kvm) ||
-                !irq_remapping_cap(IRQ_POSTING_CAP))
+                !irq_remapping_cap(IRQ_POSTING_CAP) ||
+                !kvm_vcpu_apicv_active(kvm->vcpus[0]))
                 return 0;
 
         idx = srcu_read_lock(&kvm->irq_srcu);
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 902d9da12392..7da5dd2057a9 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -1244,12 +1244,6 @@ static atomic_t kvm_guest_has_master_clock = ATOMIC_INIT(0);
 static DEFINE_PER_CPU(unsigned long, cpu_tsc_khz);
 static unsigned long max_tsc_khz;
 
-static inline u64 nsec_to_cycles(struct kvm_vcpu *vcpu, u64 nsec)
-{
-        return pvclock_scale_delta(nsec, vcpu->arch.virtual_tsc_mult,
-                                   vcpu->arch.virtual_tsc_shift);
-}
-
 static u32 adjust_tsc_khz(u32 khz, s32 ppm)
 {
         u64 v = (u64)khz * (1000000 + ppm);
diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h
index 7ce3634ab5fe..a82ca466b62e 100644
--- a/arch/x86/kvm/x86.h
+++ b/arch/x86/kvm/x86.h
@@ -2,6 +2,7 @@
 #define ARCH_X86_KVM_X86_H
 
 #include <linux/kvm_host.h>
+#include <asm/pvclock.h>
 #include "kvm_cache_regs.h"
 
 #define MSR_IA32_CR_PAT_DEFAULT  0x0007040600070406ULL
@@ -195,6 +196,12 @@ extern unsigned int lapic_timer_advance_ns;
 
 extern struct static_key kvm_no_apic_vcpu;
 
+static inline u64 nsec_to_cycles(struct kvm_vcpu *vcpu, u64 nsec)
+{
+        return pvclock_scale_delta(nsec, vcpu->arch.virtual_tsc_mult,
+                                   vcpu->arch.virtual_tsc_shift);
+}
+
 /* Same "calling convention" as do_div:
  * - divide (n << 32) by base
  * - put result in n
diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
index 4eb287e25043..aa0ff4b02a96 100644
--- a/arch/x86/mm/pgtable.c
+++ b/arch/x86/mm/pgtable.c
@@ -6,7 +6,7 @@
 #include <asm/fixmap.h>
 #include <asm/mtrr.h>
 
-#define PGALLOC_GFP GFP_KERNEL | __GFP_NOTRACK | __GFP_REPEAT | __GFP_ZERO
+#define PGALLOC_GFP GFP_KERNEL | __GFP_NOTRACK | __GFP_ZERO
 
 #ifdef CONFIG_HIGHPTE
 #define PGALLOC_USER_GFP __GFP_HIGHMEM
diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
index 6e7242be1c87..b226b3f497f1 100644
--- a/arch/x86/platform/efi/efi_64.c
+++ b/arch/x86/platform/efi/efi_64.c
@@ -139,7 +139,7 @@ int __init efi_alloc_page_tables(void)
         if (efi_enabled(EFI_OLD_MEMMAP))
                 return 0;
 
-        gfp_mask = GFP_KERNEL | __GFP_NOTRACK | __GFP_REPEAT | __GFP_ZERO;
+        gfp_mask = GFP_KERNEL | __GFP_NOTRACK | __GFP_ZERO;
         efi_pgd = (pgd_t *)__get_free_page(gfp_mask);
         if (!efi_pgd)
                 return -ENOMEM;
diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
index 478a2de543a5..67433714b791 100644
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -1113,7 +1113,7 @@ static void __init xen_cleanhighmap(unsigned long vaddr,
 
         /* NOTE: The loop is more greedy than the cleanup_highmap variant.
          * We include the PMD passed in on _both_ boundaries. */
-        for (; vaddr <= vaddr_end && (pmd < (level2_kernel_pgt + PAGE_SIZE));
+        for (; vaddr <= vaddr_end && (pmd < (level2_kernel_pgt + PTRS_PER_PMD));
                         pmd++, vaddr += PMD_SIZE) {
                 if (pmd_none(*pmd))
                         continue;
@@ -1551,41 +1551,6 @@ static void xen_pgd_free(struct mm_struct *mm, pgd_t *pgd)
 #endif
 }
 
-#ifdef CONFIG_X86_32
-static pte_t __init mask_rw_pte(pte_t *ptep, pte_t pte)
-{
-        /* If there's an existing pte, then don't allow _PAGE_RW to be set */
-        if (pte_val_ma(*ptep) & _PAGE_PRESENT)
-                pte = __pte_ma(((pte_val_ma(*ptep) & _PAGE_RW) | ~_PAGE_RW) &
-                               pte_val_ma(pte));
-
-        return pte;
-}
-#else /* CONFIG_X86_64 */
-static pte_t __init mask_rw_pte(pte_t *ptep, pte_t pte)
-{
-        unsigned long pfn;
-
-        if (xen_feature(XENFEAT_writable_page_tables) ||
-            xen_feature(XENFEAT_auto_translated_physmap) ||
-            xen_start_info->mfn_list >= __START_KERNEL_map)
-                return pte;
-
-        /*
-         * Pages belonging to the initial p2m list mapped outside the default
-         * address range must be mapped read-only. This region contains the
-         * page tables for mapping the p2m list, too, and page tables MUST be
-         * mapped read-only.
-         */
-        pfn = pte_pfn(pte);
-        if (pfn >= xen_start_info->first_p2m_pfn &&
-            pfn < xen_start_info->first_p2m_pfn + xen_start_info->nr_p2m_frames)
-                pte = __pte_ma(pte_val_ma(pte) & ~_PAGE_RW);
-
-        return pte;
-}
-#endif /* CONFIG_X86_64 */
-
 /*
  * Init-time set_pte while constructing initial pagetables, which
  * doesn't allow RO page table pages to be remapped RW.
@@ -1600,13 +1565,37 @@ static pte_t __init mask_rw_pte(pte_t *ptep, pte_t pte)
  * so always write the PTE directly and rely on Xen trapping and
  * emulating any updates as necessary.
  */
-static void __init xen_set_pte_init(pte_t *ptep, pte_t pte)
+__visible pte_t xen_make_pte_init(pteval_t pte)
 {
-        if (pte_mfn(pte) != INVALID_P2M_ENTRY)
-                pte = mask_rw_pte(ptep, pte);
-        else
-                pte = __pte_ma(0);
+#ifdef CONFIG_X86_64
+        unsigned long pfn;
+
+        /*
+         * Pages belonging to the initial p2m list mapped outside the default
+         * address range must be mapped read-only. This region contains the
+         * page tables for mapping the p2m list, too, and page tables MUST be
+         * mapped read-only.
+         */
+        pfn = (pte & PTE_PFN_MASK) >> PAGE_SHIFT;
+        if (xen_start_info->mfn_list < __START_KERNEL_map &&
+            pfn >= xen_start_info->first_p2m_pfn &&
+            pfn < xen_start_info->first_p2m_pfn + xen_start_info->nr_p2m_frames)
+                pte &= ~_PAGE_RW;
+#endif
+        pte = pte_pfn_to_mfn(pte);
+        return native_make_pte(pte);
+}
+PV_CALLEE_SAVE_REGS_THUNK(xen_make_pte_init);
 
+static void __init xen_set_pte_init(pte_t *ptep, pte_t pte)
+{
+#ifdef CONFIG_X86_32
+        /* If there's an existing pte, then don't allow _PAGE_RW to be set */
+        if (pte_mfn(pte) != INVALID_P2M_ENTRY
+            && pte_val_ma(*ptep) & _PAGE_PRESENT)
+                pte = __pte_ma(((pte_val_ma(*ptep) & _PAGE_RW) | ~_PAGE_RW) &
+                               pte_val_ma(pte));
+#endif
         native_set_pte(ptep, pte);
 }
 
@@ -2407,6 +2396,7 @@ static void __init xen_post_allocator_init(void)
         pv_mmu_ops.alloc_pud = xen_alloc_pud;
         pv_mmu_ops.release_pud = xen_release_pud;
 #endif
+        pv_mmu_ops.make_pte = PV_CALLEE_SAVE(xen_make_pte);
 
 #ifdef CONFIG_X86_64
         pv_mmu_ops.write_cr3 = &xen_write_cr3;
@@ -2455,7 +2445,7 @@ static const struct pv_mmu_ops xen_mmu_ops __initconst = {
         .pte_val = PV_CALLEE_SAVE(xen_pte_val),
         .pgd_val = PV_CALLEE_SAVE(xen_pgd_val),
 
-        .make_pte = PV_CALLEE_SAVE(xen_make_pte),
+        .make_pte = PV_CALLEE_SAVE(xen_make_pte_init),
         .make_pgd = PV_CALLEE_SAVE(xen_make_pgd),
 
 #ifdef CONFIG_X86_PAE
diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c
index cab9f766bb06..dd2a49a8aacc 100644
--- a/arch/x86/xen/p2m.c
+++ b/arch/x86/xen/p2m.c
@@ -182,7 +182,7 @@ static void * __ref alloc_p2m_page(void)
         if (unlikely(!slab_is_available()))
                 return alloc_bootmem_align(PAGE_SIZE, PAGE_SIZE);
 
-        return (void *)__get_free_page(GFP_KERNEL | __GFP_REPEAT);
+        return (void *)__get_free_page(GFP_KERNEL);
 }
 
 static void __ref free_p2m_page(void *p)
diff --git a/arch/xtensa/include/asm/pgalloc.h b/arch/xtensa/include/asm/pgalloc.h
index d38eb9237e64..1065bc8bcae5 100644
--- a/arch/xtensa/include/asm/pgalloc.h
+++ b/arch/xtensa/include/asm/pgalloc.h
@@ -44,7 +44,7 @@ static inline pte_t *pte_alloc_one_kernel(struct mm_struct *mm,
         pte_t *ptep;
         int i;
 
-        ptep = (pte_t *)__get_free_page(GFP_KERNEL|__GFP_REPEAT);
+        ptep = (pte_t *)__get_free_page(GFP_KERNEL);
         if (!ptep)
                 return NULL;
         for (i = 0; i < 1024; i++)
diff --git a/block/blk-lib.c b/block/blk-lib.c
index 23d7f301a196..9e29dc351695 100644
--- a/block/blk-lib.c
+++ b/block/blk-lib.c
@@ -113,6 +113,7 @@ int blkdev_issue_discard(struct block_device *bdev, sector_t sector,
                 ret = submit_bio_wait(type, bio);
                 if (ret == -EOPNOTSUPP)
                         ret = 0;
+                bio_put(bio);
         }
         blk_finish_plug(&plug);
 
@@ -165,8 +166,10 @@ int blkdev_issue_write_same(struct block_device *bdev, sector_t sector,
                 }
         }
 
-        if (bio)
+        if (bio) {
                 ret = submit_bio_wait(REQ_WRITE | REQ_WRITE_SAME, bio);
+                bio_put(bio);
+        }
         return ret != -EOPNOTSUPP ? ret : 0;
 }
 EXPORT_SYMBOL(blkdev_issue_write_same);
@@ -206,8 +209,11 @@ static int __blkdev_issue_zeroout(struct block_device *bdev, sector_t sector,
                 }
         }
 
-        if (bio)
-                return submit_bio_wait(WRITE, bio);
+        if (bio) {
+                ret = submit_bio_wait(WRITE, bio);
+                bio_put(bio);
+                return ret;
+        }
         return 0;
 }
 
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 29cbc1b5fbdb..f9b9049b1284 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -1262,12 +1262,9 @@ static blk_qc_t blk_mq_make_request(struct request_queue *q, struct bio *bio)
 
         blk_queue_split(q, &bio, q->bio_split);
 
-        if (!is_flush_fua && !blk_queue_nomerges(q)) {
-                if (blk_attempt_plug_merge(q, bio, &request_count,
-                                           &same_queue_rq))
-                        return BLK_QC_T_NONE;
-        } else
-                request_count = blk_plug_queued_count(q);
+        if (!is_flush_fua && !blk_queue_nomerges(q) &&
+            blk_attempt_plug_merge(q, bio, &request_count, &same_queue_rq))
+                return BLK_QC_T_NONE;
 
         rq = blk_mq_map_request(q, bio, &data);
         if (unlikely(!rq))
@@ -1358,9 +1355,11 @@ static blk_qc_t blk_sq_make_request(struct request_queue *q, struct bio *bio)
 
         blk_queue_split(q, &bio, q->bio_split);
 
-        if (!is_flush_fua && !blk_queue_nomerges(q) &&
-            blk_attempt_plug_merge(q, bio, &request_count, NULL))
-                return BLK_QC_T_NONE;
+        if (!is_flush_fua && !blk_queue_nomerges(q)) {
+                if (blk_attempt_plug_merge(q, bio, &request_count, NULL))
+                        return BLK_QC_T_NONE;
+        } else
+                request_count = blk_plug_queued_count(q);
 
         rq = blk_mq_map_request(q, bio, &data);
         if (unlikely(!rq))
diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c
index 43fe85f20d57..7097a3395b25 100644
--- a/crypto/crypto_user.c
+++ b/crypto/crypto_user.c
@@ -455,6 +455,7 @@ static const int crypto_msg_min[CRYPTO_NR_MSGTYPES] = {
         [CRYPTO_MSG_NEWALG      - CRYPTO_MSG_BASE] = MSGSIZE(crypto_user_alg),
         [CRYPTO_MSG_DELALG      - CRYPTO_MSG_BASE] = MSGSIZE(crypto_user_alg),
         [CRYPTO_MSG_UPDATEALG   - CRYPTO_MSG_BASE] = MSGSIZE(crypto_user_alg),
+        [CRYPTO_MSG_GETALG      - CRYPTO_MSG_BASE] = MSGSIZE(crypto_user_alg),
         [CRYPTO_MSG_DELRNG      - CRYPTO_MSG_BASE] = 0,
 };
 
diff --git a/drivers/acpi/acpica/exconfig.c b/drivers/acpi/acpica/exconfig.c
index a1d177d58254..21932d640a41 100644
--- a/drivers/acpi/acpica/exconfig.c
+++ b/drivers/acpi/acpica/exconfig.c
@@ -108,7 +108,9 @@ acpi_ex_add_table(u32 table_index,
 
         /* Add the table to the namespace */
 
+        acpi_ex_exit_interpreter();
         status = acpi_ns_load_table(table_index, parent_node);
+        acpi_ex_enter_interpreter();
         if (ACPI_FAILURE(status)) {
                 acpi_ut_remove_reference(obj_desc);
                 *ddb_handle = NULL;
diff --git a/drivers/acpi/acpica/hwregs.c b/drivers/acpi/acpica/hwregs.c
index daceb80022b0..3b7fb99362b6 100644
--- a/drivers/acpi/acpica/hwregs.c
+++ b/drivers/acpi/acpica/hwregs.c
@@ -306,12 +306,6 @@ acpi_status acpi_hw_read(u32 *value, struct acpi_generic_address *reg)
 acpi_status acpi_hw_write(u32 value, struct acpi_generic_address *reg)
 {
         u64 address;
-        u8 access_width;
-        u32 bit_width;
-        u8 bit_offset;
-        u64 value64;
-        u32 new_value32, old_value32;
-        u8 index;
         acpi_status status;
 
         ACPI_FUNCTION_NAME(hw_write);
@@ -323,145 +317,23 @@ acpi_status acpi_hw_write(u32 value, struct acpi_generic_address *reg)
                 return (status);
         }
 
-        /* Convert access_width into number of bits based */
-
-        access_width = acpi_hw_get_access_bit_width(reg, 32);
-        bit_width = reg->bit_offset + reg->bit_width;
-        bit_offset = reg->bit_offset;
-
         /*
          * Two address spaces supported: Memory or IO. PCI_Config is
          * not supported here because the GAS structure is insufficient
          */
-        index = 0;
-        while (bit_width) {
-                /*
-                 * Use offset style bit reads because "Index * AccessWidth" is
-                 * ensured to be less than 32-bits by acpi_hw_validate_register().
-                 */
-                new_value32 = ACPI_GET_BITS(&value, index * access_width,
-                                            ACPI_MASK_BITS_ABOVE_32
-                                            (access_width));
-
-                if (bit_offset >= access_width) {
-                        bit_offset -= access_width;
-                } else {
-                        /*
-                         * Use offset style bit masks because access_width is ensured
-                         * to be less than 32-bits by acpi_hw_validate_register() and
-                         * bit_offset/bit_width is less than access_width here.
-                         */
-                        if (bit_offset) {
-                                new_value32 &= ACPI_MASK_BITS_BELOW(bit_offset);
-                        }
-                        if (bit_width < access_width) {
-                                new_value32 &= ACPI_MASK_BITS_ABOVE(bit_width);
-                        }
-
-                        if (reg->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY) {
-                                if (bit_offset || bit_width < access_width) {
-                                        /*
-                                         * Read old values in order not to modify the bits that
-                                         * are beyond the register bit_width/bit_offset setting.
-                                         */
-                                        status =
-                                            acpi_os_read_memory((acpi_physical_address)
-                                                                address +
-                                                                index *
-                                                                ACPI_DIV_8
-                                                                (access_width),
-                                                                &value64,
-                                                                access_width);
-                                        old_value32 = (u32)value64;
-
-                                        /*
-                                         * Use offset style bit masks because access_width is
-                                         * ensured to be less than 32-bits by
-                                         * acpi_hw_validate_register() and bit_offset/bit_width is
-                                         * less than access_width here.
-                                         */
-                                        if (bit_offset) {
-                                                old_value32 &=
-                                                    ACPI_MASK_BITS_ABOVE
-                                                    (bit_offset);
-                                                bit_offset = 0;
-                                        }
-                                        if (bit_width < access_width) {
-                                                old_value32 &=
-                                                    ACPI_MASK_BITS_BELOW
-                                                    (bit_width);
-                                        }
-
-                                        new_value32 |= old_value32;
-                                }
-
-                                value64 = (u64)new_value32;
-                                status =
-                                    acpi_os_write_memory((acpi_physical_address)
-                                                         address +
-                                                         index *
-                                                         ACPI_DIV_8
-                                                         (access_width),
-                                                         value64, access_width);
-                        } else {        /* ACPI_ADR_SPACE_SYSTEM_IO, validated earlier */
-
-                                if (bit_offset || bit_width < access_width) {
-                                        /*
-                                         * Read old values in order not to modify the bits that
-                                         * are beyond the register bit_width/bit_offset setting.
-                                         */
-                                        status =
-                                            acpi_hw_read_port((acpi_io_address)
-                                                              address +
-                                                              index *
-                                                              ACPI_DIV_8
-                                                              (access_width),
-                                                              &old_value32,
-                                                              access_width);
-
-                                        /*
-                                         * Use offset style bit masks because access_width is
-                                         * ensured to be less than 32-bits by
-                                         * acpi_hw_validate_register() and bit_offset/bit_width is
-                                         * less than access_width here.
-                                         */
-                                        if (bit_offset) {
-                                                old_value32 &=
-                                                    ACPI_MASK_BITS_ABOVE
-                                                    (bit_offset);
-                                                bit_offset = 0;
-                                        }
-                                        if (bit_width < access_width) {
-                                                old_value32 &=
-                                                    ACPI_MASK_BITS_BELOW
-                                                    (bit_width);
-                                        }
-
-                                        new_value32 |= old_value32;
-                                }
-
-                                status = acpi_hw_write_port((acpi_io_address)
-                                                            address +
-                                                            index *
-                                                            ACPI_DIV_8
-                                                            (access_width),
-                                                            new_value32,
-                                                            access_width);
-                        }
-                }
-
-                /*
-                 * Index * access_width is ensured to be less than 32-bits by
-                 * acpi_hw_validate_register().
-                 */
-                bit_width -=
-                    bit_width > access_width ? access_width : bit_width;
-                index++;
+        if (reg->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY) {
+                status = acpi_os_write_memory((acpi_physical_address)
+                                              address, (u64)value,
+                                              reg->bit_width);
+        } else {                /* ACPI_ADR_SPACE_SYSTEM_IO, validated earlier */
+
+                status = acpi_hw_write_port((acpi_io_address)
+                                            address, value, reg->bit_width);
         }
 
         ACPI_DEBUG_PRINT((ACPI_DB_IO,
                           "Wrote: %8.8X width %2d   to %8.8X%8.8X (%s)\n",
-                          value, access_width, ACPI_FORMAT_UINT64(address),
+                          value, reg->bit_width, ACPI_FORMAT_UINT64(address),
                           acpi_ut_get_region_name(reg->space_id)));
 
         return (status);
diff --git a/drivers/acpi/acpica/nsparse.c b/drivers/acpi/acpica/nsparse.c
index f631a47724f0..1783cd7e1446 100644
--- a/drivers/acpi/acpica/nsparse.c
+++ b/drivers/acpi/acpica/nsparse.c
@@ -47,6 +47,7 @@
 #include "acparser.h"
 #include "acdispat.h"
 #include "actables.h"
+#include "acinterp.h"
 
 #define _COMPONENT          ACPI_NAMESPACE
 ACPI_MODULE_NAME("nsparse")
@@ -170,6 +171,8 @@ acpi_ns_parse_table(u32 table_index, struct acpi_namespace_node *start_node)
 
         ACPI_FUNCTION_TRACE(ns_parse_table);
 
+        acpi_ex_enter_interpreter();
+
         /*
          * AML Parse, pass 1
          *
@@ -185,7 +188,7 @@ acpi_ns_parse_table(u32 table_index, struct acpi_namespace_node *start_node)
         status = acpi_ns_one_complete_parse(ACPI_IMODE_LOAD_PASS1,
                                             table_index, start_node);
         if (ACPI_FAILURE(status)) {
-                return_ACPI_STATUS(status);
+                goto error_exit;
         }
 
         /*
@@ -201,8 +204,10 @@ acpi_ns_parse_table(u32 table_index, struct acpi_namespace_node *start_node)
         status = acpi_ns_one_complete_parse(ACPI_IMODE_LOAD_PASS2,
                                             table_index, start_node);
         if (ACPI_FAILURE(status)) {
-                return_ACPI_STATUS(status);
+                goto error_exit;
         }
 
+error_exit:
+        acpi_ex_exit_interpreter();
         return_ACPI_STATUS(status);
 }
diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
index 31e8da648fff..262ca31b86d9 100644
--- a/drivers/acpi/bus.c
+++ b/drivers/acpi/bus.c
@@ -1051,7 +1051,7 @@ static int __init acpi_bus_init(void)
          * Maybe EC region is required at bus_scan/acpi_get_devices. So it
          * is necessary to enable it as early as possible.
          */
-        acpi_boot_ec_enable();
+        acpi_ec_dsdt_probe();
 
         printk(KERN_INFO PREFIX "Interpreter enabled\n");
 
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index 0e70181f150c..73c76d646064 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -1446,10 +1446,30 @@ ec_parse_io_ports(struct acpi_resource *resource, void *context)
         return AE_OK;
 }
 
-int __init acpi_boot_ec_enable(void)
+static const struct acpi_device_id ec_device_ids[] = {
+        {"PNP0C09", 0},
+        {"", 0},
+};
+
+int __init acpi_ec_dsdt_probe(void)
 {
-        if (!boot_ec)
+        acpi_status status;
+
+        if (boot_ec)
                 return 0;
+
+        /*
+         * Finding EC from DSDT if there is no ECDT EC available. When this
+         * function is invoked, ACPI tables have been fully loaded, we can
+         * walk namespace now.
+         */
+        boot_ec = make_acpi_ec();
+        if (!boot_ec)
+                return -ENOMEM;
+        status = acpi_get_devices(ec_device_ids[0].id,
+                                  ec_parse_device, boot_ec, NULL);
+        if (ACPI_FAILURE(status) || !boot_ec->handle)
+                return -ENODEV;
         if (!ec_install_handlers(boot_ec)) {
                 first_ec = boot_ec;
                 return 0;
@@ -1457,11 +1477,6 @@ int __init acpi_boot_ec_enable(void)
         return -EFAULT;
 }
 
-static const struct acpi_device_id ec_device_ids[] = {
-        {"PNP0C09", 0},
-        {"", 0},
-};
-
 #if 0
 /*
  * Some EC firmware variations refuses to respond QR_EC when SCI_EVT is not
diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h
index 9bb0773d39bf..27cc7feabfe4 100644
--- a/drivers/acpi/internal.h
+++ b/drivers/acpi/internal.h
@@ -181,7 +181,7 @@ typedef int (*acpi_ec_query_func) (void *data);
 
 int acpi_ec_init(void);
 int acpi_ec_ecdt_probe(void);
-int acpi_boot_ec_enable(void);
+int acpi_ec_dsdt_probe(void);
 void acpi_ec_block_transactions(void);
 void acpi_ec_unblock_transactions(void);
 void acpi_ec_unblock_transactions_early(void);
diff --git a/drivers/acpi/nfit.c b/drivers/acpi/nfit.c
index 2215fc847fa9..ac6ddcc080d4 100644
--- a/drivers/acpi/nfit.c
+++ b/drivers/acpi/nfit.c
@@ -928,7 +928,7 @@ static ssize_t format_show(struct device *dev,
 {
         struct acpi_nfit_control_region *dcr = to_nfit_dcr(dev);
 
-        return sprintf(buf, "0x%04x\n", be16_to_cpu(dcr->code));
+        return sprintf(buf, "0x%04x\n", le16_to_cpu(dcr->code));
 }
 static DEVICE_ATTR_RO(format);
 
@@ -961,8 +961,8 @@ static ssize_t format1_show(struct device *dev,
                                 continue;
                         if (nfit_dcr->dcr->code == dcr->code)
                                 continue;
-                        rc = sprintf(buf, "%#x\n",
-                                        be16_to_cpu(nfit_dcr->dcr->code));
+                        rc = sprintf(buf, "0x%04x\n",
+                                        le16_to_cpu(nfit_dcr->dcr->code));
                         break;
                 }
                 if (rc != ENXIO)
@@ -1131,11 +1131,11 @@ static int acpi_nfit_add_dimm(struct acpi_nfit_desc *acpi_desc,
 
         /*
          * Until standardization materializes we need to consider up to 3
-         * different command sets.  Note, that checking for function0 (bit0)
-         * tells us if any commands are reachable through this uuid.
+         * different command sets.  Note, that checking for zero functions
+         * tells us if any commands might be reachable through this uuid.
          */
         for (i = NVDIMM_FAMILY_INTEL; i <= NVDIMM_FAMILY_HPE2; i++)
-                if (acpi_check_dsm(adev_dimm->handle, to_nfit_uuid(i), 1, 1))
+                if (acpi_check_dsm(adev_dimm->handle, to_nfit_uuid(i), 1, 0))
                         break;
 
         /* limit the supported commands to those that are publicly documented */
diff --git a/drivers/acpi/nfit.h b/drivers/acpi/nfit.h
index 11cb38348aef..02b9ea1e8d2e 100644
--- a/drivers/acpi/nfit.h
+++ b/drivers/acpi/nfit.h
@@ -53,12 +53,12 @@ enum nfit_uuids {
 };
 
 /*
- * Region format interface codes are stored as an array of bytes in the
- * NFIT DIMM Control Region structure
+ * Region format interface codes are stored with the interface as the
+ * LSB and the function as the MSB.
  */
-#define NFIT_FIC_BYTE cpu_to_be16(0x101) /* byte-addressable energy backed */
-#define NFIT_FIC_BLK cpu_to_be16(0x201) /* block-addressable non-energy backed */
-#define NFIT_FIC_BYTEN cpu_to_be16(0x301) /* byte-addressable non-energy backed */
+#define NFIT_FIC_BYTE cpu_to_le16(0x101) /* byte-addressable energy backed */
+#define NFIT_FIC_BLK cpu_to_le16(0x201) /* block-addressable non-energy backed */
+#define NFIT_FIC_BYTEN cpu_to_le16(0x301) /* byte-addressable non-energy backed */
 
 enum {
         NFIT_BLK_READ_FLUSH = 1,
diff --git a/drivers/acpi/pci_link.c b/drivers/acpi/pci_link.c
index 8fc7323ed3e8..4ed4061813e6 100644
--- a/drivers/acpi/pci_link.c
+++ b/drivers/acpi/pci_link.c
@@ -839,7 +839,7 @@ void acpi_penalize_isa_irq(int irq, int active)
 {
         if ((irq >= 0) && (irq < ARRAY_SIZE(acpi_isa_irq_penalty)))
                 acpi_isa_irq_penalty[irq] = acpi_irq_get_penalty(irq) +
-                        active ? PIRQ_PENALTY_ISA_USED : PIRQ_PENALTY_PCI_USING;
+                  (active ? PIRQ_PENALTY_ISA_USED : PIRQ_PENALTY_PCI_USING);
 }
 
 bool acpi_isa_irq_available(int irq)
diff --git a/drivers/acpi/utils.c b/drivers/acpi/utils.c
index 22c09952e177..b4de130f2d57 100644
--- a/drivers/acpi/utils.c
+++ b/drivers/acpi/utils.c
@@ -680,9 +680,6 @@ bool acpi_check_dsm(acpi_handle handle, const u8 *uuid, u64 rev, u64 funcs)
         u64 mask = 0;
         union acpi_object *obj;
 
-        if (funcs == 0)
-                return false;
-
         obj = acpi_evaluate_dsm(handle, uuid, rev, 0, NULL);
         if (!obj)
                 return false;
@@ -695,6 +692,9 @@ bool acpi_check_dsm(acpi_handle handle, const u8 *uuid, u64 rev, u64 funcs)
                         mask |= (((u64)obj->buffer.pointer[i]) << (i * 8));
         ACPI_FREE(obj);
 
+        if (funcs == 0)
+                return true;
+
         /*
          * Bit 0 indicates whether there's support for any functions other than
          * function 0 for the specified UUID and revision.
diff --git a/drivers/ata/ahci_seattle.c b/drivers/ata/ahci_seattle.c
index 6e702ab57220..1d31c0c0fc20 100644
--- a/drivers/ata/ahci_seattle.c
+++ b/drivers/ata/ahci_seattle.c
@@ -137,7 +137,7 @@ static const struct ata_port_info *ahci_seattle_get_port_info(
         u32 val;
 
         plat_data = devm_kzalloc(dev, sizeof(*plat_data), GFP_KERNEL);
-        if (IS_ERR(plat_data))
+        if (!plat_data)
                 return &ahci_port_info;
 
         plat_data->sgpio_ctrl = devm_ioremap_resource(dev,
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index 61dc7a99e89a..c6f017458958 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -606,7 +606,7 @@ void ata_scsi_error(struct Scsi_Host *host)
         ata_scsi_port_error_handler(host, ap);
 
         /* finish or retry handled scmd's and clean up */
-        WARN_ON(host->host_failed || !list_empty(&eh_work_q));
+        WARN_ON(!list_empty(&eh_work_q));
 
         DPRINTK("EXIT\n");
 }
diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
index bd74ee555278..745489a1c86a 100644
--- a/drivers/ata/sata_mv.c
+++ b/drivers/ata/sata_mv.c
@@ -986,7 +986,7 @@ static inline void mv_write_cached_reg(void __iomem *addr, u32 *old, u32 new)
                  * Looks like a lot of fuss, but it avoids an unnecessary
                  * +1 usec read-after-write delay for unaffected registers.
                  */
-                laddr = (long)addr & 0xffff;
+                laddr = (unsigned long)addr & 0xffff;
                 if (laddr >= 0x300 && laddr <= 0x33c) {
                         laddr &= 0x000f;
                         if (laddr == 0x4 || laddr == 0xc) {
diff --git a/drivers/base/Makefile b/drivers/base/Makefile
index 6b2a84e7f2be..2609ba20b396 100644
--- a/drivers/base/Makefile
+++ b/drivers/base/Makefile
@@ -10,7 +10,7 @@ obj-$(CONFIG_DMA_CMA) += dma-contiguous.o
 obj-y                   += power/
 obj-$(CONFIG_HAS_DMA)   += dma-mapping.o
 obj-$(CONFIG_HAVE_GENERIC_DMA_COHERENT) += dma-coherent.o
-obj-$(CONFIG_ISA)       += isa.o
+obj-$(CONFIG_ISA_BUS_API)       += isa.o
 obj-$(CONFIG_FW_LOADER) += firmware_class.o
 obj-$(CONFIG_NUMA)      += node.o
 obj-$(CONFIG_MEMORY_HOTPLUG_SPARSE) += memory.o
diff --git a/drivers/base/isa.c b/drivers/base/isa.c
index 91dba65d7264..cd6ccdcf9df0 100644
--- a/drivers/base/isa.c
+++ b/drivers/base/isa.c
@@ -180,4 +180,4 @@ static int __init isa_bus_init(void)
         return error;
 }
 
-device_initcall(isa_bus_init);
+postcore_initcall(isa_bus_init);
diff --git a/drivers/base/module.c b/drivers/base/module.c
index db930d3ee312..2a215780eda2 100644
--- a/drivers/base/module.c
+++ b/drivers/base/module.c
@@ -24,10 +24,12 @@ static char *make_driver_name(struct device_driver *drv)
 
 static void module_create_drivers_dir(struct module_kobject *mk)
 {
-        if (!mk || mk->drivers_dir)
-                return;
+        static DEFINE_MUTEX(drivers_dir_mutex);
 
-        mk->drivers_dir = kobject_create_and_add("drivers", &mk->kobj);
+        mutex_lock(&drivers_dir_mutex);
+        if (mk && !mk->drivers_dir)
+                mk->drivers_dir = kobject_create_and_add("drivers", &mk->kobj);
+        mutex_unlock(&drivers_dir_mutex);
 }
 
 void module_add_driver(struct module *mod, struct device_driver *drv)
diff --git a/drivers/base/power/opp/cpu.c b/drivers/base/power/opp/cpu.c
index 83d6e7ba1a34..8c3434bdb26d 100644
--- a/drivers/base/power/opp/cpu.c
+++ b/drivers/base/power/opp/cpu.c
@@ -211,7 +211,7 @@ int dev_pm_opp_set_sharing_cpus(struct device *cpu_dev,
                 }
 
                 /* Mark opp-table as multiple CPUs are sharing it now */
-                opp_table->shared_opp = true;
+                opp_table->shared_opp = OPP_TABLE_ACCESS_SHARED;
         }
 unlock:
         mutex_unlock(&opp_table_lock);
@@ -227,7 +227,8 @@ EXPORT_SYMBOL_GPL(dev_pm_opp_set_sharing_cpus);
  *
  * This updates the @cpumask with CPUs that are sharing OPPs with @cpu_dev.
  *
- * Returns -ENODEV if OPP table isn't already present.
+ * Returns -ENODEV if OPP table isn't already present and -EINVAL if the OPP
+ * table's status is access-unknown.
  *
  * Locking: The internal opp_table and opp structures are RCU protected.
  * Hence this function internally uses RCU updater strategy with mutex locks
@@ -249,9 +250,14 @@ int dev_pm_opp_get_sharing_cpus(struct device *cpu_dev, struct cpumask *cpumask)
                 goto unlock;
         }
 
+        if (opp_table->shared_opp == OPP_TABLE_ACCESS_UNKNOWN) {
+                ret = -EINVAL;
+                goto unlock;
+        }
+
         cpumask_clear(cpumask);
 
-        if (opp_table->shared_opp) {
+        if (opp_table->shared_opp == OPP_TABLE_ACCESS_SHARED) {
                 list_for_each_entry(opp_dev, &opp_table->dev_list, node)
                         cpumask_set_cpu(opp_dev->dev->id, cpumask);
         } else {
diff --git a/drivers/base/power/opp/of.c b/drivers/base/power/opp/of.c
index 94d2010558e3..1dfd3dd92624 100644
--- a/drivers/base/power/opp/of.c
+++ b/drivers/base/power/opp/of.c
@@ -34,7 +34,10 @@ static struct opp_table *_managed_opp(const struct device_node *np)
                          * But the OPPs will be considered as shared only if the
                          * OPP table contains a "opp-shared" property.
                          */
-                        return opp_table->shared_opp ? opp_table : NULL;
+                        if (opp_table->shared_opp == OPP_TABLE_ACCESS_SHARED)
+                                return opp_table;
+
+                        return NULL;
                 }
         }
 
@@ -353,7 +356,10 @@ static int _of_add_opp_table_v2(struct device *dev, struct device_node *opp_np)
         }
 
         opp_table->np = opp_np;
-        opp_table->shared_opp = of_property_read_bool(opp_np, "opp-shared");
+        if (of_property_read_bool(opp_np, "opp-shared"))
+                opp_table->shared_opp = OPP_TABLE_ACCESS_SHARED;
+        else
+                opp_table->shared_opp = OPP_TABLE_ACCESS_EXCLUSIVE;
 
         mutex_unlock(&opp_table_lock);
 
diff --git a/drivers/base/power/opp/opp.h b/drivers/base/power/opp/opp.h
index 20f3be22e060..fabd5ca1a083 100644
--- a/drivers/base/power/opp/opp.h
+++ b/drivers/base/power/opp/opp.h
@@ -119,6 +119,12 @@ struct opp_device {
 #endif
 };
 
+enum opp_table_access {
+        OPP_TABLE_ACCESS_UNKNOWN = 0,
+        OPP_TABLE_ACCESS_EXCLUSIVE = 1,
+        OPP_TABLE_ACCESS_SHARED = 2,
+};
+
 /**
  * struct opp_table - Device opp structure
  * @node:       table node - contains the devices with OPPs that
@@ -166,7 +172,7 @@ struct opp_table {
         /* For backward compatibility with v1 bindings */
         unsigned int voltage_tolerance_v1;
 
-        bool shared_opp;
+        enum opp_table_access shared_opp;
         struct dev_pm_opp *suspend_opp;
 
         unsigned int *supported_hw;
diff --git a/drivers/block/aoe/aoecmd.c b/drivers/block/aoe/aoecmd.c
index d597e432e195..ab19adb07a12 100644
--- a/drivers/block/aoe/aoecmd.c
+++ b/drivers/block/aoe/aoecmd.c
@@ -1750,7 +1750,7 @@ aoecmd_init(void)
         int ret;
 
         /* get_zeroed_page returns page with ref count 1 */
-        p = (void *) get_zeroed_page(GFP_KERNEL | __GFP_REPEAT);
+        p = (void *) get_zeroed_page(GFP_KERNEL);
         if (!p)
                 return -ENOMEM;
         empty_page = virt_to_page(p);
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 31e73a7a40f2..6a48ed41963f 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -941,7 +941,7 @@ static int nbd_dev_dbg_init(struct nbd_device *nbd)
         debugfs_create_u64("size_bytes", 0444, dir, &nbd->bytesize);
         debugfs_create_u32("timeout", 0444, dir, &nbd->xmit_timeout);
         debugfs_create_u32("blocksize", 0444, dir, &nbd->blksize);
-        debugfs_create_file("flags", 0444, dir, &nbd, &nbd_dbg_flags_ops);
+        debugfs_create_file("flags", 0444, dir, nbd, &nbd_dbg_flags_ops);
 
         return 0;
 }
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index ca13df854639..2e6d1e9c3345 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -874,8 +874,12 @@ static int blkif_queue_rq(struct blk_mq_hw_ctx *hctx,
                           const struct blk_mq_queue_data *qd)
 {
         unsigned long flags;
-        struct blkfront_ring_info *rinfo = (struct blkfront_ring_info *)hctx->driver_data;
+        int qid = hctx->queue_num;
+        struct blkfront_info *info = hctx->queue->queuedata;
+        struct blkfront_ring_info *rinfo = NULL;
 
+        BUG_ON(info->nr_rings <= qid);
+        rinfo = &info->rinfo[qid];
         blk_mq_start_request(qd->rq);
         spin_lock_irqsave(&rinfo->ring_lock, flags);
         if (RING_FULL(&rinfo->ring))
@@ -901,20 +905,9 @@ out_busy:
         return BLK_MQ_RQ_QUEUE_BUSY;
 }
 
-static int blk_mq_init_hctx(struct blk_mq_hw_ctx *hctx, void *data,
-                            unsigned int index)
-{
-        struct blkfront_info *info = (struct blkfront_info *)data;
-
-        BUG_ON(info->nr_rings <= index);
-        hctx->driver_data = &info->rinfo[index];
-        return 0;
-}
-
 static struct blk_mq_ops blkfront_mq_ops = {
         .queue_rq = blkif_queue_rq,
         .map_queue = blk_mq_map_queue,
-        .init_hctx = blk_mq_init_hctx,
 };
 
 static int xlvbd_init_blk_queue(struct gendisk *gd, u16 sector_size,
@@ -950,6 +943,7 @@ static int xlvbd_init_blk_queue(struct gendisk *gd, u16 sector_size,
                 return PTR_ERR(rq);
         }
 
+        rq->queuedata = info;
         queue_flag_set_unlocked(QUEUE_FLAG_VIRT, rq);
 
         if (info->feature_discard) {
@@ -2149,6 +2143,8 @@ static int blkfront_resume(struct xenbus_device *dev)
                 return err;
 
         err = talk_to_blkback(dev, info);
+        if (!err)
+                blk_mq_update_nr_hw_queues(&info->tag_set, info->nr_rings);
 
         /*
          * We have to wait for the backend to switch to
@@ -2485,10 +2481,23 @@ static void blkback_changed(struct xenbus_device *dev,
                 break;
 
         case XenbusStateConnected:
-                if (dev->state != XenbusStateInitialised) {
+                /*
+                 * talk_to_blkback sets state to XenbusStateInitialised
+                 * and blkfront_connect sets it to XenbusStateConnected
+                 * (if connection went OK).
+                 *
+                 * If the backend (or toolstack) decides to poke at backend
+                 * state (and re-trigger the watch by setting the state repeatedly
+                 * to XenbusStateConnected (4)) we need to deal with this.
+                 * This is allowed as this is used to communicate to the guest
+                 * that the size of disk has changed!
+                 */
+                if ((dev->state != XenbusStateInitialised) &&
+                    (dev->state != XenbusStateConnected)) {
                         if (talk_to_blkback(dev, info))
                                 break;
                 }
+
                 blkfront_connect(info);
                 break;
 
diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index 94fb407d8561..44b1bd6baa38 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -3820,6 +3820,7 @@ static void handle_new_recv_msgs(ipmi_smi_t intf)
         while (!list_empty(&intf->waiting_rcv_msgs)) {
                 smi_msg = list_entry(intf->waiting_rcv_msgs.next,
                                      struct ipmi_smi_msg, link);
+                list_del(&smi_msg->link);
                 if (!run_to_completion)
                         spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock,
                                                flags);
@@ -3829,11 +3830,14 @@ static void handle_new_recv_msgs(ipmi_smi_t intf)
                 if (rv > 0) {
                         /*
                          * To preserve message order, quit if we
-                         * can't handle a message.
+                         * can't handle a message.  Add the message
+                         * back at the head, this is safe because this
+                         * tasklet is the only thing that pulls the
+                         * messages.
                          */
+                        list_add(&smi_msg->link, &intf->waiting_rcv_msgs);
                         break;
                 } else {
-                        list_del(&smi_msg->link);
                         if (rv == 0)
                                 /* Message handled */
                                 ipmi_free_smi_msg(smi_msg);
diff --git a/drivers/clk/Kconfig b/drivers/clk/Kconfig
index 53ddba26578c..98efbfcdb503 100644
--- a/drivers/clk/Kconfig
+++ b/drivers/clk/Kconfig
@@ -175,6 +175,7 @@ config COMMON_CLK_KEYSTONE
 config COMMON_CLK_NXP
         def_bool COMMON_CLK && (ARCH_LPC18XX || ARCH_LPC32XX)
         select REGMAP_MMIO if ARCH_LPC32XX
+        select MFD_SYSCON if ARCH_LPC18XX
         ---help---
           Support for clock providers on NXP platforms.
 
diff --git a/drivers/clk/clk-oxnas.c b/drivers/clk/clk-oxnas.c
index efba7d4dbcfc..79bcb2e42060 100644
--- a/drivers/clk/clk-oxnas.c
+++ b/drivers/clk/clk-oxnas.c
@@ -144,9 +144,9 @@ static int oxnas_stdclk_probe(struct platform_device *pdev)
                 return -ENOMEM;
 
         regmap = syscon_node_to_regmap(of_get_parent(np));
-        if (!regmap) {
+        if (IS_ERR(regmap)) {
                 dev_err(&pdev->dev, "failed to have parent regmap\n");
-                return -EINVAL;
+                return PTR_ERR(regmap);
         }
 
         for (i = 0; i < ARRAY_SIZE(clk_oxnas_init); i++) {
diff --git a/drivers/clk/microchip/clk-pic32mzda.c b/drivers/clk/microchip/clk-pic32mzda.c
index 020a29acc5b0..51f54380474b 100644
--- a/drivers/clk/microchip/clk-pic32mzda.c
+++ b/drivers/clk/microchip/clk-pic32mzda.c
@@ -180,15 +180,15 @@ static int pic32mzda_clk_probe(struct platform_device *pdev)
 
         /* register fixed rate clocks */
         clks[POSCCLK] = clk_register_fixed_rate(&pdev->dev, "posc_clk", NULL,
-                                                CLK_IS_ROOT, 24000000);
+                                                0, 24000000);
         clks[FRCCLK] =  clk_register_fixed_rate(&pdev->dev, "frc_clk", NULL,
-                                                CLK_IS_ROOT, 8000000);
+                                                0, 8000000);
         clks[BFRCCLK] = clk_register_fixed_rate(&pdev->dev, "bfrc_clk", NULL,
-                                                CLK_IS_ROOT, 8000000);
+                                                0, 8000000);
         clks[LPRCCLK] = clk_register_fixed_rate(&pdev->dev, "lprc_clk", NULL,
-                                                CLK_IS_ROOT, 32000);
+                                                0, 32000);
         clks[UPLLCLK] = clk_register_fixed_rate(&pdev->dev, "usbphy_clk", NULL,
-                                                CLK_IS_ROOT, 24000000);
+                                                0, 24000000);
         /* fixed rate (optional) clock */
         if (of_find_property(np, "microchip,pic32mzda-sosc", NULL)) {
                 pr_info("pic32-clk: dt requests SOSC.\n");
diff --git a/drivers/clk/rockchip/clk-cpu.c b/drivers/clk/rockchip/clk-cpu.c
index 4bb130cd0062..05b3d73bfefa 100644
--- a/drivers/clk/rockchip/clk-cpu.c
+++ b/drivers/clk/rockchip/clk-cpu.c
@@ -321,9 +321,9 @@ struct clk *rockchip_clk_register_cpuclk(const char *name,
         }
 
         cclk = clk_register(NULL, &cpuclk->hw);
-        if (IS_ERR(clk)) {
+        if (IS_ERR(cclk)) {
                 pr_err("%s: could not register cpuclk %s\n", __func__,  name);
-                ret = PTR_ERR(clk);
+                ret = PTR_ERR(cclk);
                 goto free_rate_table;
         }
 
diff --git a/drivers/clk/rockchip/clk-mmc-phase.c b/drivers/clk/rockchip/clk-mmc-phase.c
index bc856f21f6b2..077fcdc7908b 100644
--- a/drivers/clk/rockchip/clk-mmc-phase.c
+++ b/drivers/clk/rockchip/clk-mmc-phase.c
@@ -41,8 +41,6 @@ static unsigned long rockchip_mmc_recalc(struct clk_hw *hw,
 #define ROCKCHIP_MMC_DEGREE_MASK 0x3
 #define ROCKCHIP_MMC_DELAYNUM_OFFSET 2
 #define ROCKCHIP_MMC_DELAYNUM_MASK (0xff << ROCKCHIP_MMC_DELAYNUM_OFFSET)
-#define ROCKCHIP_MMC_INIT_STATE_RESET 0x1
-#define ROCKCHIP_MMC_INIT_STATE_SHIFT 1
 
 #define PSECS_PER_SEC 1000000000000LL
 
@@ -154,6 +152,7 @@ struct clk *rockchip_clk_register_mmc(const char *name,
                 return ERR_PTR(-ENOMEM);
 
         init.name = name;
+        init.flags = 0;
         init.num_parents = num_parents;
         init.parent_names = parent_names;
         init.ops = &rockchip_mmc_clk_ops;
@@ -162,15 +161,6 @@ struct clk *rockchip_clk_register_mmc(const char *name,
         mmc_clock->reg = reg;
         mmc_clock->shift = shift;
 
-        /*
-         * Assert init_state to soft reset the CLKGEN
-         * for mmc tuning phase and degree
-         */
-        if (mmc_clock->shift == ROCKCHIP_MMC_INIT_STATE_SHIFT)
-                writel(HIWORD_UPDATE(ROCKCHIP_MMC_INIT_STATE_RESET,
-                                     ROCKCHIP_MMC_INIT_STATE_RESET,
-                                     mmc_clock->shift), mmc_clock->reg);
-
         clk = clk_register(NULL, &mmc_clock->hw);
         if (IS_ERR(clk))
                 kfree(mmc_clock);
diff --git a/drivers/clk/rockchip/clk-rk3399.c b/drivers/clk/rockchip/clk-rk3399.c
index 291543f52caa..8059a8d3ea36 100644
--- a/drivers/clk/rockchip/clk-rk3399.c
+++ b/drivers/clk/rockchip/clk-rk3399.c
@@ -832,9 +832,9 @@ static struct rockchip_clk_branch rk3399_clk_branches[] __initdata = {
                         RK3399_CLKGATE_CON(13), 1, GFLAGS),
 
         /* perihp */
-        GATE(0, "cpll_aclk_perihp_src", "gpll", CLK_IGNORE_UNUSED,
+        GATE(0, "cpll_aclk_perihp_src", "cpll", CLK_IGNORE_UNUSED,
                         RK3399_CLKGATE_CON(5), 0, GFLAGS),
-        GATE(0, "gpll_aclk_perihp_src", "cpll", CLK_IGNORE_UNUSED,
+        GATE(0, "gpll_aclk_perihp_src", "gpll", CLK_IGNORE_UNUSED,
                         RK3399_CLKGATE_CON(5), 1, GFLAGS),
         COMPOSITE(ACLK_PERIHP, "aclk_perihp", mux_aclk_perihp_p, CLK_IGNORE_UNUSED,
                         RK3399_CLKSEL_CON(14), 7, 1, MFLAGS, 0, 5, DFLAGS,
@@ -1466,6 +1466,8 @@ static struct rockchip_clk_branch rk3399_clk_pmu_branches[] __initdata = {
 
 static const char *const rk3399_cru_critical_clocks[] __initconst = {
         "aclk_cci_pre",
+        "aclk_gic",
+        "aclk_gic_noc",
         "pclk_perilp0",
         "pclk_perilp0",
         "hclk_perilp0",
@@ -1508,6 +1510,7 @@ static void __init rk3399_clk_init(struct device_node *np)
         ctx = rockchip_clk_init(np, reg_base, CLK_NR_CLKS);
         if (IS_ERR(ctx)) {
                 pr_err("%s: rockchip clk init failed\n", __func__);
+                iounmap(reg_base);
                 return;
         }
 
@@ -1553,6 +1556,7 @@ static void __init rk3399_pmu_clk_init(struct device_node *np)
         ctx = rockchip_clk_init(np, reg_base, CLKPMU_NR_CLKS);
         if (IS_ERR(ctx)) {
                 pr_err("%s: rockchip pmu clk init failed\n", __func__);
+                iounmap(reg_base);
                 return;
         }
 
diff --git a/drivers/connector/cn_proc.c b/drivers/connector/cn_proc.c
index 15d06fcf0b50..b02f9c606e0b 100644
--- a/drivers/connector/cn_proc.c
+++ b/drivers/connector/cn_proc.c
@@ -56,11 +56,21 @@ static struct cb_id cn_proc_event_id = { CN_IDX_PROC, CN_VAL_PROC };
 /* proc_event_counts is used as the sequence number of the netlink message */
 static DEFINE_PER_CPU(__u32, proc_event_counts) = { 0 };
 
-static inline void get_seq(__u32 *ts, int *cpu)
+static inline void send_msg(struct cn_msg *msg)
 {
         preempt_disable();
-        *ts = __this_cpu_inc_return(proc_event_counts) - 1;
-        *cpu = smp_processor_id();
+
+        msg->seq = __this_cpu_inc_return(proc_event_counts) - 1;
+        ((struct proc_event *)msg->data)->cpu = smp_processor_id();
+
+        /*
+         * Preemption remains disabled during send to ensure the messages are
+         * ordered according to their sequence numbers.
+         *
+         * If cn_netlink_send() fails, the data is not sent.
+         */
+        cn_netlink_send(msg, 0, CN_IDX_PROC, GFP_NOWAIT);
+
         preempt_enable();
 }
 
@@ -77,7 +87,6 @@ void proc_fork_connector(struct task_struct *task)
         msg = buffer_to_cn_msg(buffer);
         ev = (struct proc_event *)msg->data;
         memset(&ev->event_data, 0, sizeof(ev->event_data));
-        get_seq(&msg->seq, &ev->cpu);
         ev->timestamp_ns = ktime_get_ns();
         ev->what = PROC_EVENT_FORK;
         rcu_read_lock();
@@ -92,8 +101,7 @@ void proc_fork_connector(struct task_struct *task)
         msg->ack = 0; /* not used */
         msg->len = sizeof(*ev);
         msg->flags = 0; /* not used */
-        /*  If cn_netlink_send() failed, the data is not sent */
-        cn_netlink_send(msg, 0, CN_IDX_PROC, GFP_KERNEL);
+        send_msg(msg);
 }
 
 void proc_exec_connector(struct task_struct *task)
@@ -108,7 +116,6 @@ void proc_exec_connector(struct task_struct *task)
         msg = buffer_to_cn_msg(buffer);
         ev = (struct proc_event *)msg->data;
         memset(&ev->event_data, 0, sizeof(ev->event_data));
-        get_seq(&msg->seq, &ev->cpu);
         ev->timestamp_ns = ktime_get_ns();
         ev->what = PROC_EVENT_EXEC;
         ev->event_data.exec.process_pid = task->pid;
@@ -118,7 +125,7 @@ void proc_exec_connector(struct task_struct *task)
         msg->ack = 0; /* not used */
         msg->len = sizeof(*ev);
         msg->flags = 0; /* not used */
-        cn_netlink_send(msg, 0, CN_IDX_PROC, GFP_KERNEL);
+        send_msg(msg);
 }
 
 void proc_id_connector(struct task_struct *task, int which_id)
@@ -150,14 +157,13 @@ void proc_id_connector(struct task_struct *task, int which_id)
                 return;
         }
         rcu_read_unlock();
-        get_seq(&msg->seq, &ev->cpu);
         ev->timestamp_ns = ktime_get_ns();
 
         memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
         msg->ack = 0; /* not used */
         msg->len = sizeof(*ev);
         msg->flags = 0; /* not used */
-        cn_netlink_send(msg, 0, CN_IDX_PROC, GFP_KERNEL);
+        send_msg(msg);
 }
 
 void proc_sid_connector(struct task_struct *task)
@@ -172,7 +178,6 @@ void proc_sid_connector(struct task_struct *task)
         msg = buffer_to_cn_msg(buffer);
         ev = (struct proc_event *)msg->data;
         memset(&ev->event_data, 0, sizeof(ev->event_data));
-        get_seq(&msg->seq, &ev->cpu);
         ev->timestamp_ns = ktime_get_ns();
         ev->what = PROC_EVENT_SID;
         ev->event_data.sid.process_pid = task->pid;
@@ -182,7 +187,7 @@ void proc_sid_connector(struct task_struct *task)
         msg->ack = 0; /* not used */
         msg->len = sizeof(*ev);
         msg->flags = 0; /* not used */
-        cn_netlink_send(msg, 0, CN_IDX_PROC, GFP_KERNEL);
+        send_msg(msg);
 }
 
 void proc_ptrace_connector(struct task_struct *task, int ptrace_id)
@@ -197,7 +202,6 @@ void proc_ptrace_connector(struct task_struct *task, int ptrace_id)
         msg = buffer_to_cn_msg(buffer);
         ev = (struct proc_event *)msg->data;
         memset(&ev->event_data, 0, sizeof(ev->event_data));
-        get_seq(&msg->seq, &ev->cpu);
         ev->timestamp_ns = ktime_get_ns();
         ev->what = PROC_EVENT_PTRACE;
         ev->event_data.ptrace.process_pid  = task->pid;
@@ -215,7 +219,7 @@ void proc_ptrace_connector(struct task_struct *task, int ptrace_id)
         msg->ack = 0; /* not used */
         msg->len = sizeof(*ev);
         msg->flags = 0; /* not used */
-        cn_netlink_send(msg, 0, CN_IDX_PROC, GFP_KERNEL);
+        send_msg(msg);
 }
 
 void proc_comm_connector(struct task_struct *task)
@@ -230,7 +234,6 @@ void proc_comm_connector(struct task_struct *task)
         msg = buffer_to_cn_msg(buffer);
         ev = (struct proc_event *)msg->data;
         memset(&ev->event_data, 0, sizeof(ev->event_data));
-        get_seq(&msg->seq, &ev->cpu);
         ev->timestamp_ns = ktime_get_ns();
         ev->what = PROC_EVENT_COMM;
         ev->event_data.comm.process_pid  = task->pid;
@@ -241,7 +244,7 @@ void proc_comm_connector(struct task_struct *task)
         msg->ack = 0; /* not used */
         msg->len = sizeof(*ev);
         msg->flags = 0; /* not used */
-        cn_netlink_send(msg, 0, CN_IDX_PROC, GFP_KERNEL);
+        send_msg(msg);
 }
 
 void proc_coredump_connector(struct task_struct *task)
@@ -256,7 +259,6 @@ void proc_coredump_connector(struct task_struct *task)
         msg = buffer_to_cn_msg(buffer);
         ev = (struct proc_event *)msg->data;
         memset(&ev->event_data, 0, sizeof(ev->event_data));
-        get_seq(&msg->seq, &ev->cpu);
         ev->timestamp_ns = ktime_get_ns();
         ev->what = PROC_EVENT_COREDUMP;
         ev->event_data.coredump.process_pid = task->pid;
@@ -266,7 +268,7 @@ void proc_coredump_connector(struct task_struct *task)
         msg->ack = 0; /* not used */
         msg->len = sizeof(*ev);
         msg->flags = 0; /* not used */
-        cn_netlink_send(msg, 0, CN_IDX_PROC, GFP_KERNEL);
+        send_msg(msg);
 }
 
 void proc_exit_connector(struct task_struct *task)
@@ -281,7 +283,6 @@ void proc_exit_connector(struct task_struct *task)
         msg = buffer_to_cn_msg(buffer);
         ev = (struct proc_event *)msg->data;
         memset(&ev->event_data, 0, sizeof(ev->event_data));
-        get_seq(&msg->seq, &ev->cpu);
         ev->timestamp_ns = ktime_get_ns();
         ev->what = PROC_EVENT_EXIT;
         ev->event_data.exit.process_pid = task->pid;
@@ -293,7 +294,7 @@ void proc_exit_connector(struct task_struct *task)
         msg->ack = 0; /* not used */
         msg->len = sizeof(*ev);
         msg->flags = 0; /* not used */
-        cn_netlink_send(msg, 0, CN_IDX_PROC, GFP_KERNEL);
+        send_msg(msg);
 }
 
 /*
@@ -325,7 +326,7 @@ static void cn_proc_ack(int err, int rcvd_seq, int rcvd_ack)
         msg->ack = rcvd_ack + 1;
         msg->len = sizeof(*ev);
         msg->flags = 0; /* not used */
-        cn_netlink_send(msg, 0, CN_IDX_PROC, GFP_KERNEL);
+        send_msg(msg);
 }
 
 /**
diff --git a/drivers/cpufreq/cpufreq-dt-platdev.c b/drivers/cpufreq/cpufreq-dt-platdev.c
index 3646b143bbf5..0bb44d5b5df4 100644
--- a/drivers/cpufreq/cpufreq-dt-platdev.c
+++ b/drivers/cpufreq/cpufreq-dt-platdev.c
@@ -79,15 +79,16 @@ static const struct of_device_id machines[] __initconst = {
 static int __init cpufreq_dt_platdev_init(void)
 {
         struct device_node *np = of_find_node_by_path("/");
+        const struct of_device_id *match;
 
         if (!np)
                 return -ENODEV;
 
-        if (!of_match_node(machines, np))
+        match = of_match_node(machines, np);
+        of_node_put(np);
+        if (!match)
                 return -ENODEV;
 
-        of_node_put(of_root);
-
         return PTR_ERR_OR_ZERO(platform_device_register_simple("cpufreq-dt", -1,
                                                                NULL, 0));
 }
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 9009295f5134..5617c7087d77 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -2261,6 +2261,10 @@ int cpufreq_update_policy(unsigned int cpu)
          * -> ask driver for current freq and notify governors about a change
          */
         if (cpufreq_driver->get && !cpufreq_driver->setpolicy) {
+                if (cpufreq_suspended) {
+                        ret = -EAGAIN;
+                        goto unlock;
+                }
                 new_policy.cur = cpufreq_update_current_freq(policy);
                 if (WARN_ON(!new_policy.cur)) {
                         ret = -EIO;
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index 0d159b513469..1fa1a32928d7 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -372,26 +372,9 @@ static bool intel_pstate_get_ppc_enable_status(void)
         return acpi_ppc;
 }
 
-/*
- * The max target pstate ratio is a 8 bit value in both PLATFORM_INFO MSR and
- * in TURBO_RATIO_LIMIT MSR, which pstate driver stores in max_pstate and
- * max_turbo_pstate fields. The PERF_CTL MSR contains 16 bit value for P state
- * ratio, out of it only high 8 bits are used. For example 0x1700 is setting
- * target ratio 0x17. The _PSS control value stores in a format which can be
- * directly written to PERF_CTL MSR. But in intel_pstate driver this shift
- * occurs during write to PERF_CTL (E.g. for cores core_set_pstate()).
- * This function converts the _PSS control value to intel pstate driver format
- * for comparison and assignment.
- */
-static int convert_to_native_pstate_format(struct cpudata *cpu, int index)
-{
-        return cpu->acpi_perf_data.states[index].control >> 8;
-}
-
 static void intel_pstate_init_acpi_perf_limits(struct cpufreq_policy *policy)
 {
         struct cpudata *cpu;
-        int turbo_pss_ctl;
         int ret;
         int i;
 
@@ -441,11 +424,10 @@ static void intel_pstate_init_acpi_perf_limits(struct cpufreq_policy *policy)
          * max frequency, which will cause a reduced performance as
          * this driver uses real max turbo frequency as the max
          * frequency. So correct this frequency in _PSS table to
-         * correct max turbo frequency based on the turbo ratio.
+         * correct max turbo frequency based on the turbo state.
          * Also need to convert to MHz as _PSS freq is in MHz.
          */
-        turbo_pss_ctl = convert_to_native_pstate_format(cpu, 0);
-        if (turbo_pss_ctl > cpu->pstate.max_pstate)
+        if (!limits->turbo_disabled)
                 cpu->acpi_perf_data.states[0].core_frequency =
                                         policy->cpuinfo.max_freq / 1000;
         cpu->valid_pss_table = true;
@@ -1418,6 +1400,9 @@ static void intel_pstate_set_update_util_hook(unsigned int cpu_num)
 {
         struct cpudata *cpu = all_cpu_data[cpu_num];
 
+        if (cpu->update_util_set)
+                return;
+
         /* Prevent intel_pstate_update_util() from using stale data. */
         cpu->sample.time = 0;
         cpufreq_add_update_util_hook(cpu_num, &cpu->update_util,
@@ -1458,7 +1443,8 @@ static int intel_pstate_set_policy(struct cpufreq_policy *policy)
         if (!policy->cpuinfo.max_freq)
                 return -ENODEV;
 
-        intel_pstate_clear_update_util_hook(policy->cpu);
+        pr_debug("set_policy cpuinfo.max %u policy->max %u\n",
+                 policy->cpuinfo.max_freq, policy->max);
 
         cpu = all_cpu_data[0];
         if (cpu->pstate.max_pstate_physical > cpu->pstate.max_pstate &&
@@ -1495,13 +1481,13 @@ static int intel_pstate_set_policy(struct cpufreq_policy *policy)
                                    limits->max_sysfs_pct);
         limits->max_perf_pct = max(limits->min_policy_pct,
                                    limits->max_perf_pct);
-        limits->max_perf = round_up(limits->max_perf, FRAC_BITS);
 
         /* Make sure min_perf_pct <= max_perf_pct */
         limits->min_perf_pct = min(limits->max_perf_pct, limits->min_perf_pct);
 
         limits->min_perf = div_fp(limits->min_perf_pct, 100);
         limits->max_perf = div_fp(limits->max_perf_pct, 100);
+        limits->max_perf = round_up(limits->max_perf, FRAC_BITS);
 
  out:
         intel_pstate_set_update_util_hook(policy->cpu);
@@ -1558,8 +1544,11 @@ static int intel_pstate_cpu_init(struct cpufreq_policy *policy)
 
         /* cpuinfo and default policy values */
         policy->cpuinfo.min_freq = cpu->pstate.min_pstate * cpu->pstate.scaling;
-        policy->cpuinfo.max_freq =
-                cpu->pstate.turbo_pstate * cpu->pstate.scaling;
+        update_turbo_state();
+        policy->cpuinfo.max_freq = limits->turbo_disabled ?
+                        cpu->pstate.max_pstate : cpu->pstate.turbo_pstate;
+        policy->cpuinfo.max_freq *= cpu->pstate.scaling;
+
         intel_pstate_init_acpi_perf_limits(policy);
         policy->cpuinfo.transition_latency = CPUFREQ_ETERNAL;
         cpumask_set_cpu(policy->cpu, policy->cpus);
diff --git a/drivers/cpufreq/pcc-cpufreq.c b/drivers/cpufreq/pcc-cpufreq.c
index 808a320e9d5d..a7ecb9a84c15 100644
--- a/drivers/cpufreq/pcc-cpufreq.c
+++ b/drivers/cpufreq/pcc-cpufreq.c
@@ -487,7 +487,7 @@ static int __init pcc_cpufreq_probe(void)
         doorbell.space_id = reg_resource->space_id;
         doorbell.bit_width = reg_resource->bit_width;
         doorbell.bit_offset = reg_resource->bit_offset;
-        doorbell.access_width = 64;
+        doorbell.access_width = 4;
         doorbell.address = reg_resource->address;
 
         pr_debug("probe: doorbell: space_id is %d, bit_width is %d, "
diff --git a/drivers/crypto/ux500/hash/hash_core.c b/drivers/crypto/ux500/hash/hash_core.c
index 574e87c7f2b8..9acccad26928 100644
--- a/drivers/crypto/ux500/hash/hash_core.c
+++ b/drivers/crypto/ux500/hash/hash_core.c
@@ -781,7 +781,7 @@ static int hash_process_data(struct hash_device_data *device_data,
                                                 &device_data->state);
                                 memmove(req_ctx->state.buffer,
                                         device_data->state.buffer,
-                                        HASH_BLOCK_SIZE / sizeof(u32));
+                                        HASH_BLOCK_SIZE);
                                 if (ret) {
                                         dev_err(device_data->dev,
                                                 "%s: hash_resume_state() failed!\n",
@@ -832,7 +832,7 @@ static int hash_process_data(struct hash_device_data *device_data,
 
                         memmove(device_data->state.buffer,
                                 req_ctx->state.buffer,
-                                HASH_BLOCK_SIZE / sizeof(u32));
+                                HASH_BLOCK_SIZE);
                         if (ret) {
                                 dev_err(device_data->dev, "%s: hash_save_state() failed!\n",
                                         __func__);
diff --git a/drivers/crypto/vmx/aes_cbc.c b/drivers/crypto/vmx/aes_cbc.c
index 495577b6d31b..94ad5c0adbcb 100644
--- a/drivers/crypto/vmx/aes_cbc.c
+++ b/drivers/crypto/vmx/aes_cbc.c
@@ -182,7 +182,7 @@ struct crypto_alg p8_aes_cbc_alg = {
         .cra_name = "cbc(aes)",
         .cra_driver_name = "p8_aes_cbc",
         .cra_module = THIS_MODULE,
-        .cra_priority = 1000,
+        .cra_priority = 2000,
         .cra_type = &crypto_blkcipher_type,
         .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER | CRYPTO_ALG_NEED_FALLBACK,
         .cra_alignmask = 0,
diff --git a/drivers/crypto/vmx/aes_ctr.c b/drivers/crypto/vmx/aes_ctr.c
index 0a3c1b04cf3c..38ed10d761d0 100644
--- a/drivers/crypto/vmx/aes_ctr.c
+++ b/drivers/crypto/vmx/aes_ctr.c
@@ -166,7 +166,7 @@ struct crypto_alg p8_aes_ctr_alg = {
         .cra_name = "ctr(aes)",
         .cra_driver_name = "p8_aes_ctr",
         .cra_module = THIS_MODULE,
-        .cra_priority = 1000,
+        .cra_priority = 2000,
         .cra_type = &crypto_blkcipher_type,
         .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER | CRYPTO_ALG_NEED_FALLBACK,
         .cra_alignmask = 0,
diff --git a/drivers/crypto/vmx/ppc-xlate.pl b/drivers/crypto/vmx/ppc-xlate.pl
index 9f4994cabcc7..b18e67d0e065 100644
--- a/drivers/crypto/vmx/ppc-xlate.pl
+++ b/drivers/crypto/vmx/ppc-xlate.pl
@@ -141,7 +141,7 @@ my $vmr = sub {
 
 # Some ABIs specify vrsave, special-purpose register #256, as reserved
 # for system use.
-my $no_vrsave = ($flavour =~ /aix|linux64le/);
+my $no_vrsave = ($flavour =~ /linux-ppc64le/);
 my $mtspr = sub {
     my ($f,$idx,$ra) = @_;
     if ($idx == 256 && $no_vrsave) {
diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c
index 1d6c803804d5..e92418facc92 100644
--- a/drivers/devfreq/devfreq.c
+++ b/drivers/devfreq/devfreq.c
@@ -268,8 +268,11 @@ int update_devfreq(struct devfreq *devfreq)
         devfreq_notify_transition(devfreq, &freqs, DEVFREQ_PRECHANGE);
 
         err = devfreq->profile->target(devfreq->dev.parent, &freq, flags);
-        if (err)
+        if (err) {
+                freqs.new = cur_freq;
+                devfreq_notify_transition(devfreq, &freqs, DEVFREQ_POSTCHANGE);
                 return err;
+        }
 
         freqs.new = freq;
         devfreq_notify_transition(devfreq, &freqs, DEVFREQ_POSTCHANGE);
@@ -552,6 +555,7 @@ struct devfreq *devfreq_add_device(struct device *dev,
         devfreq->profile = profile;
         strncpy(devfreq->governor_name, governor_name, DEVFREQ_NAME_LEN);
         devfreq->previous_freq = profile->initial_freq;
+        devfreq->last_status.current_frequency = profile->initial_freq;
         devfreq->data = data;
         devfreq->nb.notifier_call = devfreq_notifier_call;
 
@@ -561,23 +565,22 @@ struct devfreq *devfreq_add_device(struct device *dev,
                 mutex_lock(&devfreq->lock);
         }
 
-        devfreq->trans_table =  devm_kzalloc(dev, sizeof(unsigned int) *
-                                                devfreq->profile->max_state *
-                                                devfreq->profile->max_state,
-                                                GFP_KERNEL);
-        devfreq->time_in_state = devm_kzalloc(dev, sizeof(unsigned long) *
-                                                devfreq->profile->max_state,
-                                                GFP_KERNEL);
-        devfreq->last_stat_updated = jiffies;
-
         dev_set_name(&devfreq->dev, "%s", dev_name(dev));
         err = device_register(&devfreq->dev);
         if (err) {
-                put_device(&devfreq->dev);
                 mutex_unlock(&devfreq->lock);
                 goto err_out;
         }
 
+        devfreq->trans_table =  devm_kzalloc(&devfreq->dev, sizeof(unsigned int) *
+                                                devfreq->profile->max_state *
+                                                devfreq->profile->max_state,
+                                                GFP_KERNEL);
+        devfreq->time_in_state = devm_kzalloc(&devfreq->dev, sizeof(unsigned long) *
+                                                devfreq->profile->max_state,
+                                                GFP_KERNEL);
+        devfreq->last_stat_updated = jiffies;
+
         srcu_init_notifier_head(&devfreq->transition_notifier_list);
 
         mutex_unlock(&devfreq->lock);
@@ -603,7 +606,6 @@ struct devfreq *devfreq_add_device(struct device *dev,
 err_init:
         list_del(&devfreq->node);
         device_unregister(&devfreq->dev);
-        kfree(devfreq);
 err_out:
         return ERR_PTR(err);
 }
@@ -621,7 +623,6 @@ int devfreq_remove_device(struct devfreq *devfreq)
                 return -EINVAL;
 
         device_unregister(&devfreq->dev);
-        put_device(&devfreq->dev);
 
         return 0;
 }
diff --git a/drivers/devfreq/event/exynos-nocp.c b/drivers/devfreq/event/exynos-nocp.c
index 6b6a5f310486..a5841403bde8 100644
--- a/drivers/devfreq/event/exynos-nocp.c
+++ b/drivers/devfreq/event/exynos-nocp.c
@@ -220,9 +220,6 @@ static int exynos_nocp_parse_dt(struct platform_device *pdev,
 
         /* Maps the memory mapped IO to control nocp register */
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        if (IS_ERR(res))
-                return PTR_ERR(res);
-
         base = devm_ioremap_resource(dev, res);
         if (IS_ERR(base))
                 return PTR_ERR(base);
diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c
index 8e304b1befc5..75bd6621dc5d 100644
--- a/drivers/dma/at_xdmac.c
+++ b/drivers/dma/at_xdmac.c
@@ -242,7 +242,7 @@ struct at_xdmac_lld {
         u32             mbr_dus;        /* Destination Microblock Stride Register */
 };
 
-
+/* 64-bit alignment needed to update CNDA and CUBC registers in an atomic way. */
 struct at_xdmac_desc {
         struct at_xdmac_lld             lld;
         enum dma_transfer_direction     direction;
@@ -253,7 +253,7 @@ struct at_xdmac_desc {
         unsigned int                    xfer_size;
         struct list_head                descs_list;
         struct list_head                xfer_node;
-};
+} __aligned(sizeof(u64));
 
 static inline void __iomem *at_xdmac_chan_reg_base(struct at_xdmac *atxdmac, unsigned int chan_nb)
 {
@@ -1400,6 +1400,7 @@ at_xdmac_tx_status(struct dma_chan *chan, dma_cookie_t cookie,
         u32                     cur_nda, check_nda, cur_ubc, mask, value;
         u8                      dwidth = 0;
         unsigned long           flags;
+        bool                    initd;
 
         ret = dma_cookie_status(chan, cookie, txstate);
         if (ret == DMA_COMPLETE)
@@ -1424,7 +1425,16 @@ at_xdmac_tx_status(struct dma_chan *chan, dma_cookie_t cookie,
         residue = desc->xfer_size;
         /*
          * Flush FIFO: only relevant when the transfer is source peripheral
-         * synchronized.
+         * synchronized. Flush is needed before reading CUBC because data in
+         * the FIFO are not reported by CUBC. Reporting a residue of the
+         * transfer length while we have data in FIFO can cause issue.
+         * Usecase: atmel USART has a timeout which means I have received
+         * characters but there is no more character received for a while. On
+         * timeout, it requests the residue. If the data are in the DMA FIFO,
+         * we will return a residue of the transfer length. It means no data
+         * received. If an application is waiting for these data, it will hang
+         * since we won't have another USART timeout without receiving new
+         * data.
          */
         mask = AT_XDMAC_CC_TYPE | AT_XDMAC_CC_DSYNC;
         value = AT_XDMAC_CC_TYPE_PER_TRAN | AT_XDMAC_CC_DSYNC_PER2MEM;
@@ -1435,34 +1445,43 @@ at_xdmac_tx_status(struct dma_chan *chan, dma_cookie_t cookie,
         }
 
         /*
-         * When processing the residue, we need to read two registers but we
-         * can't do it in an atomic way. AT_XDMAC_CNDA is used to find where
-         * we stand in the descriptor list and AT_XDMAC_CUBC is used
-         * to know how many data are remaining for the current descriptor.
-         * Since the dma channel is not paused to not loose data, between the
-         * AT_XDMAC_CNDA and AT_XDMAC_CUBC read, we may have change of
-         * descriptor.
-         * For that reason, after reading AT_XDMAC_CUBC, we check if we are
-         * still using the same descriptor by reading a second time
-         * AT_XDMAC_CNDA. If AT_XDMAC_CNDA has changed, it means we have to
-         * read again AT_XDMAC_CUBC.
+         * The easiest way to compute the residue should be to pause the DMA
+         * but doing this can lead to miss some data as some devices don't
+         * have FIFO.
+         * We need to read several registers because:
+         * - DMA is running therefore a descriptor change is possible while
+         * reading these registers
+         * - When the block transfer is done, the value of the CUBC register
+         * is set to its initial value until the fetch of the next descriptor.
+         * This value will corrupt the residue calculation so we have to skip
+         * it.
+         *
+         * INITD --------                    ------------
+         *              |____________________|
+         *       _______________________  _______________
+         * NDA       @desc2             \/   @desc3
+         *       _______________________/\_______________
+         *       __________  ___________  _______________
+         * CUBC       0    \/ MAX desc1 \/  MAX desc2
+         *       __________/\___________/\_______________
+         *
+         * Since descriptors are aligned on 64 bits, we can assume that
+         * the update of NDA and CUBC is atomic.
          * Memory barriers are used to ensure the read order of the registers.
-         * A max number of retries is set because unlikely it can never ends if
-         * we are transferring a lot of data with small buffers.
+         * A max number of retries is set because unlikely it could never ends.
          */
-        cur_nda = at_xdmac_chan_read(atchan, AT_XDMAC_CNDA) & 0xfffffffc;
-        rmb();
-        cur_ubc = at_xdmac_chan_read(atchan, AT_XDMAC_CUBC);
         for (retry = 0; retry < AT_XDMAC_RESIDUE_MAX_RETRIES; retry++) {
-                rmb();
                 check_nda = at_xdmac_chan_read(atchan, AT_XDMAC_CNDA) & 0xfffffffc;
-
-                if (likely(cur_nda == check_nda))
-                        break;
-
-                cur_nda = check_nda;
+                rmb();
+                initd = !!(at_xdmac_chan_read(atchan, AT_XDMAC_CC) & AT_XDMAC_CC_INITD);
                 rmb();
                 cur_ubc = at_xdmac_chan_read(atchan, AT_XDMAC_CUBC);
+                rmb();
+                cur_nda = at_xdmac_chan_read(atchan, AT_XDMAC_CNDA) & 0xfffffffc;
+                rmb();
+
+                if ((check_nda == cur_nda) && initd)
+                        break;
         }
 
         if (unlikely(retry >= AT_XDMAC_RESIDUE_MAX_RETRIES)) {
@@ -1471,6 +1490,19 @@ at_xdmac_tx_status(struct dma_chan *chan, dma_cookie_t cookie,
         }
 
         /*
+         * Flush FIFO: only relevant when the transfer is source peripheral
+         * synchronized. Another flush is needed here because CUBC is updated
+         * when the controller sends the data write command. It can lead to
+         * report data that are not written in the memory or the device. The
+         * FIFO flush ensures that data are really written.
+         */
+        if ((desc->lld.mbr_cfg & mask) == value) {
+                at_xdmac_write(atxdmac, AT_XDMAC_GSWF, atchan->mask);
+                while (!(at_xdmac_chan_read(atchan, AT_XDMAC_CIS) & AT_XDMAC_CIS_FIS))
+                        cpu_relax();
+        }
+
+        /*
          * Remove size of all microblocks already transferred and the current
          * one. Then add the remaining size to transfer of the current
          * microblock.
diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
index 25d1dadcddd1..d0446a75990a 100644
--- a/drivers/dma/mv_xor.c
+++ b/drivers/dma/mv_xor.c
@@ -703,8 +703,9 @@ static int mv_chan_memcpy_self_test(struct mv_xor_chan *mv_chan)
                 goto free_resources;
         }
 
-        src_dma = dma_map_page(dma_chan->device->dev, virt_to_page(src), 0,
-                                 PAGE_SIZE, DMA_TO_DEVICE);
+        src_dma = dma_map_page(dma_chan->device->dev, virt_to_page(src),
+                               (size_t)src & ~PAGE_MASK, PAGE_SIZE,
+                               DMA_TO_DEVICE);
         unmap->addr[0] = src_dma;
 
         ret = dma_mapping_error(dma_chan->device->dev, src_dma);
@@ -714,8 +715,9 @@ static int mv_chan_memcpy_self_test(struct mv_xor_chan *mv_chan)
         }
         unmap->to_cnt = 1;
 
-        dest_dma = dma_map_page(dma_chan->device->dev, virt_to_page(dest), 0,
-                                  PAGE_SIZE, DMA_FROM_DEVICE);
+        dest_dma = dma_map_page(dma_chan->device->dev, virt_to_page(dest),
+                                (size_t)dest & ~PAGE_MASK, PAGE_SIZE,
+                                DMA_FROM_DEVICE);
         unmap->addr[1] = dest_dma;
 
         ret = dma_mapping_error(dma_chan->device->dev, dest_dma);
diff --git a/drivers/edac/edac_mc.c b/drivers/edac/edac_mc.c
index 6aa256b0a1ed..c3ee3ad98a63 100644
--- a/drivers/edac/edac_mc.c
+++ b/drivers/edac/edac_mc.c
@@ -565,7 +565,8 @@ void edac_mc_reset_delay_period(unsigned long value)
         list_for_each(item, &mc_devices) {
                 mci = list_entry(item, struct mem_ctl_info, link);
 
-                edac_mod_work(&mci->work, value);
+                if (mci->op_state == OP_RUNNING_POLL)
+                        edac_mod_work(&mci->work, value);
         }
         mutex_unlock(&mem_ctls_mutex);
 }
diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
index b4d0bf6534cf..6744d88bdea8 100644
--- a/drivers/edac/sb_edac.c
+++ b/drivers/edac/sb_edac.c
@@ -239,8 +239,11 @@ static const u32 rir_offset[MAX_RIR_RANGES][MAX_RIR_WAY] = {
         { 0x1a0, 0x1a4, 0x1a8, 0x1ac, 0x1b0, 0x1b4, 0x1b8, 0x1bc },
 };
 
-#define RIR_RNK_TGT(reg)                GET_BITFIELD(reg, 16, 19)
-#define RIR_OFFSET(reg)         GET_BITFIELD(reg,  2, 14)
+#define RIR_RNK_TGT(type, reg) (((type) == BROADWELL) ? \
+        GET_BITFIELD(reg, 20, 23) : GET_BITFIELD(reg, 16, 19))
+
+#define RIR_OFFSET(type, reg) (((type) == HASWELL || (type) == BROADWELL) ? \
+        GET_BITFIELD(reg,  2, 15) : GET_BITFIELD(reg,  2, 14))
 
 /* Device 16, functions 2-7 */
 
@@ -326,6 +329,7 @@ struct pci_id_descr {
 struct pci_id_table {
         const struct pci_id_descr       *descr;
         int                             n_devs;
+        enum type                       type;
 };
 
 struct sbridge_dev {
@@ -394,9 +398,14 @@ static const struct pci_id_descr pci_dev_descr_sbridge[] = {
         { PCI_DESCR(PCI_DEVICE_ID_INTEL_SBRIDGE_BR, 0)          },
 };
 
-#define PCI_ID_TABLE_ENTRY(A) { .descr=A, .n_devs = ARRAY_SIZE(A) }
+#define PCI_ID_TABLE_ENTRY(A, T) {      \
+        .descr = A,                     \
+        .n_devs = ARRAY_SIZE(A),        \
+        .type = T                       \
+}
+
 static const struct pci_id_table pci_dev_descr_sbridge_table[] = {
-        PCI_ID_TABLE_ENTRY(pci_dev_descr_sbridge),
+        PCI_ID_TABLE_ENTRY(pci_dev_descr_sbridge, SANDY_BRIDGE),
         {0,}                    /* 0 terminated list. */
 };
 
@@ -463,7 +472,7 @@ static const struct pci_id_descr pci_dev_descr_ibridge[] = {
 };
 
 static const struct pci_id_table pci_dev_descr_ibridge_table[] = {
-        PCI_ID_TABLE_ENTRY(pci_dev_descr_ibridge),
+        PCI_ID_TABLE_ENTRY(pci_dev_descr_ibridge, IVY_BRIDGE),
         {0,}                    /* 0 terminated list. */
 };
 
@@ -536,7 +545,7 @@ static const struct pci_id_descr pci_dev_descr_haswell[] = {
 };
 
 static const struct pci_id_table pci_dev_descr_haswell_table[] = {
-        PCI_ID_TABLE_ENTRY(pci_dev_descr_haswell),
+        PCI_ID_TABLE_ENTRY(pci_dev_descr_haswell, HASWELL),
         {0,}                    /* 0 terminated list. */
 };
 
@@ -580,7 +589,7 @@ static const struct pci_id_descr pci_dev_descr_knl[] = {
 };
 
 static const struct pci_id_table pci_dev_descr_knl_table[] = {
-        PCI_ID_TABLE_ENTRY(pci_dev_descr_knl),
+        PCI_ID_TABLE_ENTRY(pci_dev_descr_knl, KNIGHTS_LANDING),
         {0,}
 };
 
@@ -648,7 +657,7 @@ static const struct pci_id_descr pci_dev_descr_broadwell[] = {
 };
 
 static const struct pci_id_table pci_dev_descr_broadwell_table[] = {
-        PCI_ID_TABLE_ENTRY(pci_dev_descr_broadwell),
+        PCI_ID_TABLE_ENTRY(pci_dev_descr_broadwell, BROADWELL),
         {0,}                    /* 0 terminated list. */
 };
 
@@ -1894,14 +1903,14 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
                                 pci_read_config_dword(pvt->pci_tad[i],
                                                       rir_offset[j][k],
                                                       &reg);
-                                tmp_mb = RIR_OFFSET(reg) << 6;
+                                tmp_mb = RIR_OFFSET(pvt->info.type, reg) << 6;
 
                                 gb = div_u64_rem(tmp_mb, 1024, &mb);
                                 edac_dbg(0, "CH#%d RIR#%d INTL#%d, offset %u.%03u GB (0x%016Lx), tgt: %d, reg=0x%08x\n",
                                          i, j, k,
                                          gb, (mb*1000)/1024,
                                          ((u64)tmp_mb) << 20L,
-                                         (u32)RIR_RNK_TGT(reg),
+                                         (u32)RIR_RNK_TGT(pvt->info.type, reg),
                                          reg);
                         }
                 }
@@ -2234,7 +2243,7 @@ static int get_memory_error_data(struct mem_ctl_info *mci,
         pci_read_config_dword(pvt->pci_tad[ch_add + base_ch],
                               rir_offset[n_rir][idx],
                               &reg);
-        *rank = RIR_RNK_TGT(reg);
+        *rank = RIR_RNK_TGT(pvt->info.type, reg);
 
         edac_dbg(0, "RIR#%d: channel address 0x%08Lx < 0x%08Lx, RIR interleave %d, index %d\n",
                  n_rir,
@@ -3357,12 +3366,12 @@ fail0:
 #define ICPU(model, table) \
         { X86_VENDOR_INTEL, 6, model, 0, (unsigned long)&table }
 
-/* Order here must match "enum type" */
 static const struct x86_cpu_id sbridge_cpuids[] = {
         ICPU(0x2d, pci_dev_descr_sbridge_table),        /* SANDY_BRIDGE */
         ICPU(0x3e, pci_dev_descr_ibridge_table),        /* IVY_BRIDGE */
         ICPU(0x3f, pci_dev_descr_haswell_table),        /* HASWELL */
         ICPU(0x4f, pci_dev_descr_broadwell_table),      /* BROADWELL */
+        ICPU(0x56, pci_dev_descr_broadwell_table),      /* BROADWELL-DE */
         ICPU(0x57, pci_dev_descr_knl_table),            /* KNIGHTS_LANDING */
         { }
 };
@@ -3398,7 +3407,7 @@ static int sbridge_probe(const struct x86_cpu_id *id)
                          mc, mc + 1, num_mc);
 
                 sbridge_dev->mc = mc++;
-                rc = sbridge_register_mci(sbridge_dev, id - sbridge_cpuids);
+                rc = sbridge_register_mci(sbridge_dev, ptable->type);
                 if (unlikely(rc < 0))
                         goto fail1;
         }
diff --git a/drivers/extcon/extcon-palmas.c b/drivers/extcon/extcon-palmas.c
index 8b3226dca1d9..caff46c0e214 100644
--- a/drivers/extcon/extcon-palmas.c
+++ b/drivers/extcon/extcon-palmas.c
@@ -360,6 +360,8 @@ static int palmas_usb_probe(struct platform_device *pdev)
 
         palmas_enable_irq(palmas_usb);
         /* perform initial detection */
+        if (palmas_usb->enable_gpio_vbus_detection)
+                palmas_vbus_irq_handler(palmas_usb->gpio_vbus_irq, palmas_usb);
         palmas_gpio_id_detect(&palmas_usb->wq_detectid.work);
         device_set_wakeup_capable(&pdev->dev, true);
         return 0;
diff --git a/drivers/firmware/efi/arm-init.c b/drivers/firmware/efi/arm-init.c
index a850cbc48d8d..c49d50e68aee 100644
--- a/drivers/firmware/efi/arm-init.c
+++ b/drivers/firmware/efi/arm-init.c
@@ -174,6 +174,7 @@ static __init void reserve_regions(void)
 {
         efi_memory_desc_t *md;
         u64 paddr, npages, size;
+        int resv;
 
         if (efi_enabled(EFI_DBG))
                 pr_info("Processing EFI memory map:\n");
@@ -190,12 +191,14 @@ static __init void reserve_regions(void)
                 paddr = md->phys_addr;
                 npages = md->num_pages;
 
+                resv = is_reserve_region(md);
                 if (efi_enabled(EFI_DBG)) {
                         char buf[64];
 
-                        pr_info("  0x%012llx-0x%012llx %s",
+                        pr_info("  0x%012llx-0x%012llx %s%s\n",
                                 paddr, paddr + (npages << EFI_PAGE_SHIFT) - 1,
-                                efi_md_typeattr_format(buf, sizeof(buf), md));
+                                efi_md_typeattr_format(buf, sizeof(buf), md),
+                                resv ? "*" : "");
                 }
 
                 memrange_efi_to_native(&paddr, &npages);
@@ -204,14 +207,9 @@ static __init void reserve_regions(void)
                 if (is_normal_ram(md))
                         early_init_dt_add_memory_arch(paddr, size);
 
-                if (is_reserve_region(md)) {
+                if (resv)
                         memblock_mark_nomap(paddr, size);
-                        if (efi_enabled(EFI_DBG))
-                                pr_cont("*");
-                }
 
-                if (efi_enabled(EFI_DBG))
-                        pr_cont("\n");
         }
 
         set_bit(EFI_MEMMAP, &efi.flags);
diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
index 48da857f4774..cebcb405812e 100644
--- a/drivers/gpio/Kconfig
+++ b/drivers/gpio/Kconfig
@@ -33,6 +33,7 @@ config ARCH_REQUIRE_GPIOLIB
 
 menuconfig GPIOLIB
         bool "GPIO Support"
+        select ANON_INODES
         help
           This enables GPIO support through the generic GPIO library.
           You only need to enable this, if you also want to enable
@@ -530,7 +531,7 @@ menu "Port-mapped I/O GPIO drivers"
 
 config GPIO_104_DIO_48E
         tristate "ACCES 104-DIO-48E GPIO support"
-        depends on ISA
+        depends on ISA_BUS_API
         select GPIOLIB_IRQCHIP
         help
           Enables GPIO support for the ACCES 104-DIO-48E series (104-DIO-48E,
@@ -540,7 +541,7 @@ config GPIO_104_DIO_48E
 
 config GPIO_104_IDIO_16
         tristate "ACCES 104-IDIO-16 GPIO support"
-        depends on ISA
+        depends on ISA_BUS_API
         select GPIOLIB_IRQCHIP
         help
           Enables GPIO support for the ACCES 104-IDIO-16 family (104-IDIO-16,
@@ -551,7 +552,7 @@ config GPIO_104_IDIO_16
 
 config GPIO_104_IDI_48
         tristate "ACCES 104-IDI-48 GPIO support"
-        depends on ISA
+        depends on ISA_BUS_API
         select GPIOLIB_IRQCHIP
         help
           Enables GPIO support for the ACCES 104-IDI-48 family (104-IDI-48A,
@@ -627,7 +628,7 @@ config GPIO_TS5500
 
 config GPIO_WS16C48
         tristate "WinSystems WS16C48 GPIO support"
-        depends on ISA
+        depends on ISA_BUS_API
         select GPIOLIB_IRQCHIP
         help
           Enables GPIO support for the WinSystems WS16C48. The base port
diff --git a/drivers/gpio/gpio-104-dio-48e.c b/drivers/gpio/gpio-104-dio-48e.c
index 1a647c07be67..fcf776971ca9 100644
--- a/drivers/gpio/gpio-104-dio-48e.c
+++ b/drivers/gpio/gpio-104-dio-48e.c
@@ -75,7 +75,7 @@ static int dio48e_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
 {
         struct dio48e_gpio *const dio48egpio = gpiochip_get_data(chip);
         const unsigned io_port = offset / 8;
-        const unsigned control_port = io_port / 2;
+        const unsigned int control_port = io_port / 3;
         const unsigned control_addr = dio48egpio->base + 3 + control_port*4;
         unsigned long flags;
         unsigned control;
@@ -115,7 +115,7 @@ static int dio48e_gpio_direction_output(struct gpio_chip *chip, unsigned offset,
 {
         struct dio48e_gpio *const dio48egpio = gpiochip_get_data(chip);
         const unsigned io_port = offset / 8;
-        const unsigned control_port = io_port / 2;
+        const unsigned int control_port = io_port / 3;
         const unsigned mask = BIT(offset % 8);
         const unsigned control_addr = dio48egpio->base + 3 + control_port*4;
         const unsigned out_port = (io_port > 2) ? io_port + 1 : io_port;
diff --git a/drivers/gpio/gpio-104-idi-48.c b/drivers/gpio/gpio-104-idi-48.c
index 6c75c83baf5a..2d2763ea1a68 100644
--- a/drivers/gpio/gpio-104-idi-48.c
+++ b/drivers/gpio/gpio-104-idi-48.c
@@ -247,6 +247,7 @@ static int idi_48_probe(struct device *dev, unsigned int id)
         idi48gpio->irq = irq[id];
 
         spin_lock_init(&idi48gpio->lock);
+        spin_lock_init(&idi48gpio->ack_lock);
 
         dev_set_drvdata(dev, idi48gpio);
 
diff --git a/drivers/gpio/gpio-bcm-kona.c b/drivers/gpio/gpio-bcm-kona.c
index 9aabc48ff5de..953e4b829e32 100644
--- a/drivers/gpio/gpio-bcm-kona.c
+++ b/drivers/gpio/gpio-bcm-kona.c
@@ -547,11 +547,11 @@ static void bcm_kona_gpio_reset(struct bcm_kona_gpio *kona_gpio)
         /* disable interrupts and clear status */
         for (i = 0; i < kona_gpio->num_bank; i++) {
                 /* Unlock the entire bank first */
-                bcm_kona_gpio_write_lock_regs(kona_gpio, i, UNLOCK_CODE);
+                bcm_kona_gpio_write_lock_regs(reg_base, i, UNLOCK_CODE);
                 writel(0xffffffff, reg_base + GPIO_INT_MASK(i));
                 writel(0xffffffff, reg_base + GPIO_INT_STATUS(i));
                 /* Now re-lock the bank */
-                bcm_kona_gpio_write_lock_regs(kona_gpio, i, LOCK_CODE);
+                bcm_kona_gpio_write_lock_regs(reg_base, i, LOCK_CODE);
         }
 }
 
diff --git a/drivers/gpio/gpio-tegra.c b/drivers/gpio/gpio-tegra.c
index ec891a27952f..661b0e34e067 100644
--- a/drivers/gpio/gpio-tegra.c
+++ b/drivers/gpio/gpio-tegra.c
@@ -98,7 +98,6 @@ struct tegra_gpio_info {
         const struct tegra_gpio_soc_config      *soc;
         struct gpio_chip                        gc;
         struct irq_chip                         ic;
-        struct lock_class_key                   lock_class;
         u32                                     bank_count;
 };
 
@@ -547,6 +546,12 @@ static const struct dev_pm_ops tegra_gpio_pm_ops = {
         SET_SYSTEM_SLEEP_PM_OPS(tegra_gpio_suspend, tegra_gpio_resume)
 };
 
+/*
+ * This lock class tells lockdep that GPIO irqs are in a different category
+ * than their parents, so it won't report false recursion.
+ */
+static struct lock_class_key gpio_lock_class;
+
 static int tegra_gpio_probe(struct platform_device *pdev)
 {
         const struct tegra_gpio_soc_config *config;
@@ -660,7 +665,7 @@ static int tegra_gpio_probe(struct platform_device *pdev)
 
                 bank = &tgi->bank_info[GPIO_BANK(gpio)];
 
-                irq_set_lockdep_class(irq, &tgi->lock_class);
+                irq_set_lockdep_class(irq, &gpio_lock_class);
                 irq_set_chip_data(irq, bank);
                 irq_set_chip_and_handler(irq, &tgi->ic, handle_simple_irq);
         }
diff --git a/drivers/gpio/gpio-zynq.c b/drivers/gpio/gpio-zynq.c
index 75c6355b018d..e72794e463aa 100644
--- a/drivers/gpio/gpio-zynq.c
+++ b/drivers/gpio/gpio-zynq.c
@@ -709,7 +709,13 @@ static int zynq_gpio_probe(struct platform_device *pdev)
                 dev_err(&pdev->dev, "input clock not found.\n");
                 return PTR_ERR(gpio->clk);
         }
+        ret = clk_prepare_enable(gpio->clk);
+        if (ret) {
+                dev_err(&pdev->dev, "Unable to enable clock.\n");
+                return ret;
+        }
 
+        pm_runtime_set_active(&pdev->dev);
         pm_runtime_enable(&pdev->dev);
         ret = pm_runtime_get_sync(&pdev->dev);
         if (ret < 0)
@@ -747,6 +753,7 @@ err_pm_put:
         pm_runtime_put(&pdev->dev);
 err_pm_dis:
         pm_runtime_disable(&pdev->dev);
+        clk_disable_unprepare(gpio->clk);
 
         return ret;
 }
diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c
index d22dcc38179d..4aabddb38b59 100644
--- a/drivers/gpio/gpiolib-of.c
+++ b/drivers/gpio/gpiolib-of.c
@@ -16,6 +16,7 @@
 #include <linux/errno.h>
 #include <linux/module.h>
 #include <linux/io.h>
+#include <linux/io-mapping.h>
 #include <linux/gpio/consumer.h>
 #include <linux/of.h>
 #include <linux/of_address.h>
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 24f60d28f0c0..570771ed19e6 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -449,7 +449,6 @@ static void gpiodevice_release(struct device *dev)
 {
         struct gpio_device *gdev = dev_get_drvdata(dev);
 
-        cdev_del(&gdev->chrdev);
         list_del(&gdev->list);
         ida_simple_remove(&gpio_ida, gdev->id);
         kfree(gdev->label);
@@ -482,7 +481,6 @@ static int gpiochip_setup_dev(struct gpio_device *gdev)
 
         /* From this point, the .release() function cleans up gpio_device */
         gdev->dev.release = gpiodevice_release;
-        get_device(&gdev->dev);
         pr_debug("%s: registered GPIOs %d to %d on device: %s (%s)\n",
                  __func__, gdev->base, gdev->base + gdev->ngpio - 1,
                  dev_name(&gdev->dev), gdev->chip->label ? : "generic");
@@ -770,6 +768,8 @@ void gpiochip_remove(struct gpio_chip *chip)
          * be removed, else it will be dangling until the last user is
          * gone.
          */
+        cdev_del(&gdev->chrdev);
+        device_del(&gdev->dev);
         put_device(&gdev->dev);
 }
 EXPORT_SYMBOL_GPL(gpiochip_remove);
@@ -869,7 +869,7 @@ struct gpio_chip *gpiochip_find(void *data,
 
         spin_lock_irqsave(&gpio_lock, flags);
         list_for_each_entry(gdev, &gpio_devices, list)
-                if (match(gdev->chip, data))
+                if (gdev->chip && match(gdev->chip, data))
                         break;
 
         /* No match? */
@@ -1373,8 +1373,12 @@ done:
 #define VALIDATE_DESC(desc) do { \
         if (!desc) \
                 return 0; \
+        if (IS_ERR(desc)) {                                             \
+                pr_warn("%s: invalid GPIO (errorpointer)\n", __func__); \
+                return PTR_ERR(desc); \
+        } \
         if (!desc->gdev) { \
-                pr_warn("%s: invalid GPIO\n", __func__); \
+                pr_warn("%s: invalid GPIO (no device)\n", __func__); \
                 return -EINVAL; \
         } \
         if ( !desc->gdev->chip ) { \
@@ -1386,8 +1390,12 @@ done:
 #define VALIDATE_DESC_VOID(desc) do { \
         if (!desc) \
                 return; \
+        if (IS_ERR(desc)) {                                             \
+                pr_warn("%s: invalid GPIO (errorpointer)\n", __func__); \
+                return; \
+        } \
         if (!desc->gdev) { \
-                pr_warn("%s: invalid GPIO\n", __func__); \
+                pr_warn("%s: invalid GPIO (no device)\n", __func__); \
                 return; \
         } \
         if (!desc->gdev->chip) { \
@@ -2056,7 +2064,14 @@ int gpiod_to_irq(const struct gpio_desc *desc)
         struct gpio_chip *chip;
         int offset;
 
-        VALIDATE_DESC(desc);
+        /*
+         * Cannot VALIDATE_DESC() here as gpiod_to_irq() consumer semantics
+         * requires this function to not return zero on an invalid descriptor
+         * but rather a negative error number.
+         */
+        if (!desc || IS_ERR(desc) || !desc->gdev || !desc->gdev->chip)
+                return -EINVAL;
+
         chip = desc->gdev->chip;
         offset = gpio_chip_hwgpio(desc);
         if (chip->to_irq) {
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
index 992f00b65be4..e055d5be1c3c 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
@@ -1820,6 +1820,8 @@ struct amdgpu_asic_funcs {
         /* MM block clocks */
         int (*set_uvd_clocks)(struct amdgpu_device *adev, u32 vclk, u32 dclk);
         int (*set_vce_clocks)(struct amdgpu_device *adev, u32 evclk, u32 ecclk);
+        /* query virtual capabilities */
+        u32 (*get_virtual_caps)(struct amdgpu_device *adev);
 };
 
 /*
@@ -1914,8 +1916,12 @@ void amdgpu_cgs_destroy_device(struct cgs_device *cgs_device);
 
 
 /* GPU virtualization */
+#define AMDGPU_VIRT_CAPS_SRIOV_EN       (1 << 0)
+#define AMDGPU_VIRT_CAPS_IS_VF          (1 << 1)
 struct amdgpu_virtualization {
         bool supports_sr_iov;
+        bool is_virtual;
+        u32 caps;
 };
 
 /*
@@ -2204,6 +2210,7 @@ amdgpu_get_sdma_instance(struct amdgpu_ring *ring)
 #define amdgpu_asic_get_xclk(adev) (adev)->asic_funcs->get_xclk((adev))
 #define amdgpu_asic_set_uvd_clocks(adev, v, d) (adev)->asic_funcs->set_uvd_clocks((adev), (v), (d))
 #define amdgpu_asic_set_vce_clocks(adev, ev, ec) (adev)->asic_funcs->set_vce_clocks((adev), (ev), (ec))
+#define amdgpu_asic_get_virtual_caps(adev) ((adev)->asic_funcs->get_virtual_caps((adev)))
 #define amdgpu_asic_get_gpu_clock_counter(adev) (adev)->asic_funcs->get_gpu_clock_counter((adev))
 #define amdgpu_asic_read_disabled_bios(adev) (adev)->asic_funcs->read_disabled_bios((adev))
 #define amdgpu_asic_read_bios_from_rom(adev, b, l) (adev)->asic_funcs->read_bios_from_rom((adev), (b), (l))
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
index 199f76baf22c..cf6f49fc1c75 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
@@ -696,6 +696,17 @@ static uint32_t fw_type_convert(struct cgs_device *cgs_device, uint32_t fw_type)
         return result;
 }
 
+static int amdgpu_cgs_rel_firmware(struct cgs_device *cgs_device, enum cgs_ucode_id type)
+{
+        CGS_FUNC_ADEV;
+        if ((CGS_UCODE_ID_SMU == type) || (CGS_UCODE_ID_SMU_SK == type)) {
+                release_firmware(adev->pm.fw);
+                return 0;
+        }
+        /* cannot release other firmware because they are not created by cgs */
+        return -EINVAL;
+}
+
 static int amdgpu_cgs_get_firmware_info(struct cgs_device *cgs_device,
                                         enum cgs_ucode_id type,
                                         struct cgs_firmware_info *info)
@@ -898,7 +909,7 @@ static int amdgpu_cgs_acpi_eval_object(struct cgs_device *cgs_device,
         struct cgs_acpi_method_argument *argument = NULL;
         uint32_t i, count;
         acpi_status status;
-        int result;
+        int result = 0;
         uint32_t func_no = 0xFFFFFFFF;
 
         handle = ACPI_HANDLE(&adev->pdev->dev);
@@ -1125,6 +1136,7 @@ static const struct cgs_ops amdgpu_cgs_ops = {
         amdgpu_cgs_pm_query_clock_limits,
         amdgpu_cgs_set_camera_voltages,
         amdgpu_cgs_get_firmware_info,
+        amdgpu_cgs_rel_firmware,
         amdgpu_cgs_set_powergating_state,
         amdgpu_cgs_set_clockgating_state,
         amdgpu_cgs_get_active_displays_info,
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index bb8b149786d7..6e920086af46 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -827,8 +827,10 @@ static uint32_t cail_ioreg_read(struct card_info *info, uint32_t reg)
  */
 static void amdgpu_atombios_fini(struct amdgpu_device *adev)
 {
-        if (adev->mode_info.atom_context)
+        if (adev->mode_info.atom_context) {
                 kfree(adev->mode_info.atom_context->scratch);
+                kfree(adev->mode_info.atom_context->iio);
+        }
         kfree(adev->mode_info.atom_context);
         adev->mode_info.atom_context = NULL;
         kfree(adev->mode_info.atom_card_info);
@@ -1325,6 +1327,11 @@ static int amdgpu_fini(struct amdgpu_device *adev)
                 adev->ip_block_status[i].valid = false;
         }
 
+        for (i = adev->num_ip_blocks - 1; i >= 0; i--) {
+                if (adev->ip_blocks[i].funcs->late_fini)
+                        adev->ip_blocks[i].funcs->late_fini((void *)adev);
+        }
+
         return 0;
 }
 
@@ -1378,6 +1385,15 @@ static int amdgpu_resume(struct amdgpu_device *adev)
         return 0;
 }
 
+static bool amdgpu_device_is_virtual(void)
+{
+#ifdef CONFIG_X86
+        return boot_cpu_has(X86_FEATURE_HYPERVISOR);
+#else
+        return false;
+#endif
+}
+
 /**
  * amdgpu_device_init - initialize the driver
  *
@@ -1512,9 +1528,14 @@ int amdgpu_device_init(struct amdgpu_device *adev,
         adev->virtualization.supports_sr_iov =
                 amdgpu_atombios_has_gpu_virtualization_table(adev);
 
+        /* Check if we are executing in a virtualized environment */
+        adev->virtualization.is_virtual = amdgpu_device_is_virtual();
+        adev->virtualization.caps = amdgpu_asic_get_virtual_caps(adev);
+
         /* Post card if necessary */
         if (!amdgpu_card_posted(adev) ||
-            adev->virtualization.supports_sr_iov) {
+            (adev->virtualization.is_virtual &&
+             !(adev->virtualization.caps & AMDGPU_VIRT_CAPS_SRIOV_EN))) {
                 if (!adev->bios) {
                         dev_err(adev->dev, "Card not posted and no BIOS - ignoring\n");
                         return -EINVAL;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
index 40a23704a981..d851ea15059f 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
@@ -447,7 +447,8 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file
                         dev_info.max_memory_clock = adev->pm.default_mclk * 10;
                 }
                 dev_info.enabled_rb_pipes_mask = adev->gfx.config.backend_enable_mask;
-                dev_info.num_rb_pipes = adev->gfx.config.num_rbs;
+                dev_info.num_rb_pipes = adev->gfx.config.max_backends_per_se *
+                        adev->gfx.config.max_shader_engines;
                 dev_info.num_hw_gfx_contexts = adev->gfx.config.max_hw_contexts;
                 dev_info._pad = 0;
                 dev_info.ids_flags = 0;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
index 589b36e8c5cf..0e13d80d2a95 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
@@ -270,30 +270,28 @@ static ssize_t amdgpu_set_pp_force_state(struct device *dev,
         struct drm_device *ddev = dev_get_drvdata(dev);
         struct amdgpu_device *adev = ddev->dev_private;
         enum amd_pm_state_type state = 0;
-        long idx;
+        unsigned long idx;
         int ret;
 
         if (strlen(buf) == 1)
                 adev->pp_force_state_enabled = false;
-        else {
-                ret = kstrtol(buf, 0, &idx);
+        else if (adev->pp_enabled) {
+                struct pp_states_info data;
 
-                if (ret) {
+                ret = kstrtoul(buf, 0, &idx);
+                if (ret || idx >= ARRAY_SIZE(data.states)) {
                         count = -EINVAL;
                         goto fail;
                 }
 
-                if (adev->pp_enabled) {
-                        struct pp_states_info data;
-                        amdgpu_dpm_get_pp_num_states(adev, &data);
-                        state = data.states[idx];
-                        /* only set user selected power states */
-                        if (state != POWER_STATE_TYPE_INTERNAL_BOOT &&
-                                state != POWER_STATE_TYPE_DEFAULT) {
-                                amdgpu_dpm_dispatch_task(adev,
-                                                AMD_PP_EVENT_ENABLE_USER_STATE, &state, NULL);
-                                adev->pp_force_state_enabled = true;
-                        }
+                amdgpu_dpm_get_pp_num_states(adev, &data);
+                state = data.states[idx];
+                /* only set user selected power states */
+                if (state != POWER_STATE_TYPE_INTERNAL_BOOT &&
+                    state != POWER_STATE_TYPE_DEFAULT) {
+                        amdgpu_dpm_dispatch_task(adev,
+                                        AMD_PP_EVENT_ENABLE_USER_STATE, &state, NULL);
+                        adev->pp_force_state_enabled = true;
                 }
         }
 fail:
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_powerplay.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_powerplay.c
index 6bd961fb43dc..82256558e0f5 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_powerplay.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_powerplay.c
@@ -183,13 +183,6 @@ static int amdgpu_pp_sw_fini(void *handle)
         if (ret)
                 return ret;
 
-#ifdef CONFIG_DRM_AMD_POWERPLAY
-        if (adev->pp_enabled) {
-                amdgpu_pm_sysfs_fini(adev);
-                amd_powerplay_fini(adev->powerplay.pp_handle);
-        }
-#endif
-
         return ret;
 }
 
@@ -223,6 +216,22 @@ static int amdgpu_pp_hw_fini(void *handle)
         return ret;
 }
 
+static void amdgpu_pp_late_fini(void *handle)
+{
+#ifdef CONFIG_DRM_AMD_POWERPLAY
+        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+
+        if (adev->pp_enabled) {
+                amdgpu_pm_sysfs_fini(adev);
+                amd_powerplay_fini(adev->powerplay.pp_handle);
+        }
+
+        if (adev->powerplay.ip_funcs->late_fini)
+                adev->powerplay.ip_funcs->late_fini(
+                          adev->powerplay.pp_handle);
+#endif
+}
+
 static int amdgpu_pp_suspend(void *handle)
 {
         int ret = 0;
@@ -311,6 +320,7 @@ const struct amd_ip_funcs amdgpu_pp_ip_funcs = {
         .sw_fini = amdgpu_pp_sw_fini,
         .hw_init = amdgpu_pp_hw_init,
         .hw_fini = amdgpu_pp_hw_fini,
+        .late_fini = amdgpu_pp_late_fini,
         .suspend = amdgpu_pp_suspend,
         .resume = amdgpu_pp_resume,
         .is_idle = amdgpu_pp_is_idle,
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
index 3b02272db678..870f9494252c 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
@@ -343,6 +343,7 @@ void amdgpu_ring_fini(struct amdgpu_ring *ring)
         ring->ring = NULL;
         ring->ring_obj = NULL;
 
+        amdgpu_wb_free(ring->adev, ring->cond_exe_offs);
         amdgpu_wb_free(ring->adev, ring->fence_offs);
         amdgpu_wb_free(ring->adev, ring->rptr_offs);
         amdgpu_wb_free(ring->adev, ring->wptr_offs);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_sa.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_sa.c
index 8bf84efafb04..48618ee324eb 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_sa.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_sa.c
@@ -115,6 +115,7 @@ int amdgpu_sa_bo_manager_start(struct amdgpu_device *adev,
                 return r;
         }
         r = amdgpu_bo_kmap(sa_manager->bo, &sa_manager->cpu_ptr);
+        memset(sa_manager->cpu_ptr, 0, sa_manager->size);
         amdgpu_bo_unreserve(sa_manager->bo);
         return r;
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
index 01abfc21b4a2..d9c88d13f8db 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
@@ -253,19 +253,20 @@ int amdgpu_uvd_sw_fini(struct amdgpu_device *adev)
 {
         int r;
 
-        if (adev->uvd.vcpu_bo == NULL)
-                return 0;
+        kfree(adev->uvd.saved_bo);
 
         amd_sched_entity_fini(&adev->uvd.ring.sched, &adev->uvd.entity);
 
-        r = amdgpu_bo_reserve(adev->uvd.vcpu_bo, false);
-        if (!r) {
-                amdgpu_bo_kunmap(adev->uvd.vcpu_bo);
-                amdgpu_bo_unpin(adev->uvd.vcpu_bo);
-                amdgpu_bo_unreserve(adev->uvd.vcpu_bo);
-        }
+        if (adev->uvd.vcpu_bo) {
+                r = amdgpu_bo_reserve(adev->uvd.vcpu_bo, false);
+                if (!r) {
+                        amdgpu_bo_kunmap(adev->uvd.vcpu_bo);
+                        amdgpu_bo_unpin(adev->uvd.vcpu_bo);
+                        amdgpu_bo_unreserve(adev->uvd.vcpu_bo);
+                }
 
-        amdgpu_bo_unref(&adev->uvd.vcpu_bo);
+                amdgpu_bo_unref(&adev->uvd.vcpu_bo);
+        }
 
         amdgpu_ring_fini(&adev->uvd.ring);
 
@@ -1105,6 +1106,10 @@ static void amdgpu_uvd_idle_work_handler(struct work_struct *work)
         if (fences == 0 && handles == 0) {
                 if (adev->pm.dpm_enabled) {
                         amdgpu_dpm_enable_uvd(adev, false);
+                        /* just work around for uvd clock remain high even
+                         * when uvd dpm disabled on Polaris10 */
+                        if (adev->asic_type == CHIP_POLARIS10)
+                                amdgpu_asic_set_uvd_clocks(adev, 0, 0);
                 } else {
                         amdgpu_asic_set_uvd_clocks(adev, 0, 0);
                 }
diff --git a/drivers/gpu/drm/amd/amdgpu/ci_dpm.c b/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
index ea407db1fbcf..5ec1f1e9c983 100644
--- a/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
@@ -6221,6 +6221,9 @@ static int ci_dpm_sw_fini(void *handle)
         ci_dpm_fini(adev);
         mutex_unlock(&adev->pm.mutex);
 
+        release_firmware(adev->pm.fw);
+        adev->pm.fw = NULL;
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/amd/amdgpu/cik.c b/drivers/gpu/drm/amd/amdgpu/cik.c
index 07bc795a4ca9..910431808542 100644
--- a/drivers/gpu/drm/amd/amdgpu/cik.c
+++ b/drivers/gpu/drm/amd/amdgpu/cik.c
@@ -962,6 +962,12 @@ static bool cik_read_bios_from_rom(struct amdgpu_device *adev,
         return true;
 }
 
+static u32 cik_get_virtual_caps(struct amdgpu_device *adev)
+{
+        /* CIK does not support SR-IOV */
+        return 0;
+}
+
 static const struct amdgpu_allowed_register_entry cik_allowed_read_registers[] = {
         {mmGRBM_STATUS, false},
         {mmGB_ADDR_CONFIG, false},
@@ -2007,6 +2013,7 @@ static const struct amdgpu_asic_funcs cik_asic_funcs =
         .get_xclk = &cik_get_xclk,
         .set_uvd_clocks = &cik_set_uvd_clocks,
         .set_vce_clocks = &cik_set_vce_clocks,
+        .get_virtual_caps = &cik_get_virtual_caps,
         /* these should be moved to their own ip modules */
         .get_gpu_clock_counter = &gfx_v7_0_get_gpu_clock_counter,
         .wait_for_mc_idle = &gmc_v7_0_mc_wait_for_idle,
diff --git a/drivers/gpu/drm/amd/amdgpu/cik_sdma.c b/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
index 518dca43b133..9dc4e24e31e7 100644
--- a/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
+++ b/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
@@ -66,6 +66,16 @@ MODULE_FIRMWARE("radeon/mullins_sdma1.bin");
 
 u32 amdgpu_cik_gpu_check_soft_reset(struct amdgpu_device *adev);
 
+
+static void cik_sdma_free_microcode(struct amdgpu_device *adev)
+{
+        int i;
+        for (i = 0; i < adev->sdma.num_instances; i++) {
+                        release_firmware(adev->sdma.instance[i].fw);
+                        adev->sdma.instance[i].fw = NULL;
+        }
+}
+
 /*
  * sDMA - System DMA
  * Starting with CIK, the GPU has new asynchronous
@@ -419,6 +429,8 @@ static int cik_sdma_gfx_resume(struct amdgpu_device *adev)
                 /* Initialize the ring buffer's read and write pointers */
                 WREG32(mmSDMA0_GFX_RB_RPTR + sdma_offsets[i], 0);
                 WREG32(mmSDMA0_GFX_RB_WPTR + sdma_offsets[i], 0);
+                WREG32(mmSDMA0_GFX_IB_RPTR + sdma_offsets[i], 0);
+                WREG32(mmSDMA0_GFX_IB_OFFSET + sdma_offsets[i], 0);
 
                 /* set the wb address whether it's enabled or not */
                 WREG32(mmSDMA0_GFX_RB_RPTR_ADDR_HI + sdma_offsets[i],
@@ -446,7 +458,12 @@ static int cik_sdma_gfx_resume(struct amdgpu_device *adev)
                 WREG32(mmSDMA0_GFX_IB_CNTL + sdma_offsets[i], ib_cntl);
 
                 ring->ready = true;
+        }
+
+        cik_sdma_enable(adev, true);
 
+        for (i = 0; i < adev->sdma.num_instances; i++) {
+                ring = &adev->sdma.instance[i].ring;
                 r = amdgpu_ring_test_ring(ring);
                 if (r) {
                         ring->ready = false;
@@ -529,8 +546,8 @@ static int cik_sdma_start(struct amdgpu_device *adev)
         if (r)
                 return r;
 
-        /* unhalt the MEs */
-        cik_sdma_enable(adev, true);
+        /* halt the engine before programing */
+        cik_sdma_enable(adev, false);
 
         /* start the gfx rings and rlc compute queues */
         r = cik_sdma_gfx_resume(adev);
@@ -998,6 +1015,7 @@ static int cik_sdma_sw_fini(void *handle)
         for (i = 0; i < adev->sdma.num_instances; i++)
                 amdgpu_ring_fini(&adev->sdma.instance[i].ring);
 
+        cik_sdma_free_microcode(adev);
         return 0;
 }
 
diff --git a/drivers/gpu/drm/amd/amdgpu/fiji_dpm.c b/drivers/gpu/drm/amd/amdgpu/fiji_dpm.c
index 245cabf06575..ed03b75175d4 100644
--- a/drivers/gpu/drm/amd/amdgpu/fiji_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/fiji_dpm.c
@@ -72,6 +72,11 @@ static int fiji_dpm_sw_init(void *handle)
 
 static int fiji_dpm_sw_fini(void *handle)
 {
+        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+
+        release_firmware(adev->pm.fw);
+        adev->pm.fw = NULL;
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
index 7f18a53ab53a..fc8ff4d3ccf8 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
@@ -991,6 +991,22 @@ out:
         return err;
 }
 
+static void gfx_v7_0_free_microcode(struct amdgpu_device *adev)
+{
+        release_firmware(adev->gfx.pfp_fw);
+        adev->gfx.pfp_fw = NULL;
+        release_firmware(adev->gfx.me_fw);
+        adev->gfx.me_fw = NULL;
+        release_firmware(adev->gfx.ce_fw);
+        adev->gfx.ce_fw = NULL;
+        release_firmware(adev->gfx.mec_fw);
+        adev->gfx.mec_fw = NULL;
+        release_firmware(adev->gfx.mec2_fw);
+        adev->gfx.mec2_fw = NULL;
+        release_firmware(adev->gfx.rlc_fw);
+        adev->gfx.rlc_fw = NULL;
+}
+
 /**
  * gfx_v7_0_tiling_mode_table_init - init the hw tiling table
  *
@@ -4489,6 +4505,7 @@ static int gfx_v7_0_sw_fini(void *handle)
         gfx_v7_0_cp_compute_fini(adev);
         gfx_v7_0_rlc_fini(adev);
         gfx_v7_0_mec_fini(adev);
+        gfx_v7_0_free_microcode(adev);
 
         return 0;
 }
@@ -4816,7 +4833,7 @@ static int gfx_v7_0_eop_irq(struct amdgpu_device *adev,
         case 2:
                 for (i = 0; i < adev->gfx.num_compute_rings; i++) {
                         ring = &adev->gfx.compute_ring[i];
-                        if ((ring->me == me_id) & (ring->pipe == pipe_id))
+                        if ((ring->me == me_id) && (ring->pipe == pipe_id))
                                 amdgpu_fence_process(ring);
                 }
                 break;
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
index f19bab68fd83..b2ebd4fef6cf 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
@@ -47,6 +47,8 @@
 #include "dce/dce_10_0_d.h"
 #include "dce/dce_10_0_sh_mask.h"
 
+#include "smu/smu_7_1_3_d.h"
+
 #define GFX8_NUM_GFX_RINGS     1
 #define GFX8_NUM_COMPUTE_RINGS 8
 
@@ -297,7 +299,8 @@ static const u32 polaris11_golden_common_all[] =
 static const u32 golden_settings_polaris10_a11[] =
 {
         mmATC_MISC_CG, 0x000c0fc0, 0x000c0200,
-        mmCB_HW_CONTROL, 0xfffdf3cf, 0x00006208,
+        mmCB_HW_CONTROL, 0xfffdf3cf, 0x00007208,
+        mmCB_HW_CONTROL_2, 0, 0x0f000000,
         mmCB_HW_CONTROL_3, 0x000001ff, 0x00000040,
         mmDB_DEBUG2, 0xf00fffff, 0x00000400,
         mmPA_SC_ENHANCE, 0xffffffff, 0x20000001,
@@ -692,6 +695,7 @@ static void gfx_v8_0_init_golden_registers(struct amdgpu_device *adev)
                 amdgpu_program_register_sequence(adev,
                                                  polaris10_golden_common_all,
                                                  (const u32)ARRAY_SIZE(polaris10_golden_common_all));
+                WREG32_SMC(ixCG_ACLK_CNTL, 0x0000001C);
                 break;
         case CHIP_CARRIZO:
                 amdgpu_program_register_sequence(adev,
@@ -836,6 +840,26 @@ err1:
         return r;
 }
 
+
+static void gfx_v8_0_free_microcode(struct amdgpu_device *adev) {
+        release_firmware(adev->gfx.pfp_fw);
+        adev->gfx.pfp_fw = NULL;
+        release_firmware(adev->gfx.me_fw);
+        adev->gfx.me_fw = NULL;
+        release_firmware(adev->gfx.ce_fw);
+        adev->gfx.ce_fw = NULL;
+        release_firmware(adev->gfx.rlc_fw);
+        adev->gfx.rlc_fw = NULL;
+        release_firmware(adev->gfx.mec_fw);
+        adev->gfx.mec_fw = NULL;
+        if ((adev->asic_type != CHIP_STONEY) &&
+            (adev->asic_type != CHIP_TOPAZ))
+                release_firmware(adev->gfx.mec2_fw);
+        adev->gfx.mec2_fw = NULL;
+
+        kfree(adev->gfx.rlc.register_list_format);
+}
+
 static int gfx_v8_0_init_microcode(struct amdgpu_device *adev)
 {
         const char *chip_name;
@@ -1983,7 +2007,7 @@ static int gfx_v8_0_sw_fini(void *handle)
 
         gfx_v8_0_rlc_fini(adev);
 
-        kfree(adev->gfx.rlc.register_list_format);
+        gfx_v8_0_free_microcode(adev);
 
         return 0;
 }
@@ -3974,11 +3998,15 @@ static int gfx_v8_0_cp_gfx_start(struct amdgpu_device *adev)
                 amdgpu_ring_write(ring, 0x3a00161a);
                 amdgpu_ring_write(ring, 0x0000002e);
                 break;
-        case CHIP_TOPAZ:
         case CHIP_CARRIZO:
                 amdgpu_ring_write(ring, 0x00000002);
                 amdgpu_ring_write(ring, 0x00000000);
                 break;
+        case CHIP_TOPAZ:
+                amdgpu_ring_write(ring, adev->gfx.config.num_rbs == 1 ?
+                                0x00000000 : 0x00000002);
+                amdgpu_ring_write(ring, 0x00000000);
+                break;
         case CHIP_STONEY:
                 amdgpu_ring_write(ring, 0x00000000);
                 amdgpu_ring_write(ring, 0x00000000);
diff --git a/drivers/gpu/drm/amd/amdgpu/iceland_dpm.c b/drivers/gpu/drm/amd/amdgpu/iceland_dpm.c
index 460bc8ad37e6..825ccd63f2dc 100644
--- a/drivers/gpu/drm/amd/amdgpu/iceland_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/iceland_dpm.c
@@ -72,6 +72,11 @@ static int iceland_dpm_sw_init(void *handle)
 
 static int iceland_dpm_sw_fini(void *handle)
 {
+        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+
+        release_firmware(adev->pm.fw);
+        adev->pm.fw = NULL;
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v2_4.c b/drivers/gpu/drm/amd/amdgpu/sdma_v2_4.c
index f4c3130d3fdb..b556bd0a8797 100644
--- a/drivers/gpu/drm/amd/amdgpu/sdma_v2_4.c
+++ b/drivers/gpu/drm/amd/amdgpu/sdma_v2_4.c
@@ -105,6 +105,15 @@ static void sdma_v2_4_init_golden_registers(struct amdgpu_device *adev)
         }
 }
 
+static void sdma_v2_4_free_microcode(struct amdgpu_device *adev)
+{
+        int i;
+        for (i = 0; i < adev->sdma.num_instances; i++) {
+                release_firmware(adev->sdma.instance[i].fw);
+                adev->sdma.instance[i].fw = NULL;
+        }
+}
+
 /**
  * sdma_v2_4_init_microcode - load ucode images from disk
  *
@@ -461,6 +470,8 @@ static int sdma_v2_4_gfx_resume(struct amdgpu_device *adev)
                 /* Initialize the ring buffer's read and write pointers */
                 WREG32(mmSDMA0_GFX_RB_RPTR + sdma_offsets[i], 0);
                 WREG32(mmSDMA0_GFX_RB_WPTR + sdma_offsets[i], 0);
+                WREG32(mmSDMA0_GFX_IB_RPTR + sdma_offsets[i], 0);
+                WREG32(mmSDMA0_GFX_IB_OFFSET + sdma_offsets[i], 0);
 
                 /* set the wb address whether it's enabled or not */
                 WREG32(mmSDMA0_GFX_RB_RPTR_ADDR_HI + sdma_offsets[i],
@@ -489,7 +500,11 @@ static int sdma_v2_4_gfx_resume(struct amdgpu_device *adev)
                 WREG32(mmSDMA0_GFX_IB_CNTL + sdma_offsets[i], ib_cntl);
 
                 ring->ready = true;
+        }
 
+        sdma_v2_4_enable(adev, true);
+        for (i = 0; i < adev->sdma.num_instances; i++) {
+                ring = &adev->sdma.instance[i].ring;
                 r = amdgpu_ring_test_ring(ring);
                 if (r) {
                         ring->ready = false;
@@ -580,8 +595,8 @@ static int sdma_v2_4_start(struct amdgpu_device *adev)
                         return -EINVAL;
         }
 
-        /* unhalt the MEs */
-        sdma_v2_4_enable(adev, true);
+        /* halt the engine before programing */
+        sdma_v2_4_enable(adev, false);
 
         /* start the gfx rings and rlc compute queues */
         r = sdma_v2_4_gfx_resume(adev);
@@ -1012,6 +1027,7 @@ static int sdma_v2_4_sw_fini(void *handle)
         for (i = 0; i < adev->sdma.num_instances; i++)
                 amdgpu_ring_fini(&adev->sdma.instance[i].ring);
 
+        sdma_v2_4_free_microcode(adev);
         return 0;
 }
 
diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v3_0.c b/drivers/gpu/drm/amd/amdgpu/sdma_v3_0.c
index 31d99b0010f7..532ea88da66a 100644
--- a/drivers/gpu/drm/amd/amdgpu/sdma_v3_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/sdma_v3_0.c
@@ -236,6 +236,15 @@ static void sdma_v3_0_init_golden_registers(struct amdgpu_device *adev)
         }
 }
 
+static void sdma_v3_0_free_microcode(struct amdgpu_device *adev)
+{
+        int i;
+        for (i = 0; i < adev->sdma.num_instances; i++) {
+                release_firmware(adev->sdma.instance[i].fw);
+                adev->sdma.instance[i].fw = NULL;
+        }
+}
+
 /**
  * sdma_v3_0_init_microcode - load ucode images from disk
  *
@@ -672,6 +681,8 @@ static int sdma_v3_0_gfx_resume(struct amdgpu_device *adev)
                 /* Initialize the ring buffer's read and write pointers */
                 WREG32(mmSDMA0_GFX_RB_RPTR + sdma_offsets[i], 0);
                 WREG32(mmSDMA0_GFX_RB_WPTR + sdma_offsets[i], 0);
+                WREG32(mmSDMA0_GFX_IB_RPTR + sdma_offsets[i], 0);
+                WREG32(mmSDMA0_GFX_IB_OFFSET + sdma_offsets[i], 0);
 
                 /* set the wb address whether it's enabled or not */
                 WREG32(mmSDMA0_GFX_RB_RPTR_ADDR_HI + sdma_offsets[i],
@@ -711,7 +722,15 @@ static int sdma_v3_0_gfx_resume(struct amdgpu_device *adev)
                 WREG32(mmSDMA0_GFX_IB_CNTL + sdma_offsets[i], ib_cntl);
 
                 ring->ready = true;
+        }
+
+        /* unhalt the MEs */
+        sdma_v3_0_enable(adev, true);
+        /* enable sdma ring preemption */
+        sdma_v3_0_ctx_switch_enable(adev, true);
 
+        for (i = 0; i < adev->sdma.num_instances; i++) {
+                ring = &adev->sdma.instance[i].ring;
                 r = amdgpu_ring_test_ring(ring);
                 if (r) {
                         ring->ready = false;
@@ -804,10 +823,9 @@ static int sdma_v3_0_start(struct amdgpu_device *adev)
                 }
         }
 
-        /* unhalt the MEs */
-        sdma_v3_0_enable(adev, true);
-        /* enable sdma ring preemption */
-        sdma_v3_0_ctx_switch_enable(adev, true);
+        /* disble sdma engine before programing it */
+        sdma_v3_0_ctx_switch_enable(adev, false);
+        sdma_v3_0_enable(adev, false);
 
         /* start the gfx rings and rlc compute queues */
         r = sdma_v3_0_gfx_resume(adev);
@@ -1247,6 +1265,7 @@ static int sdma_v3_0_sw_fini(void *handle)
         for (i = 0; i < adev->sdma.num_instances; i++)
                 amdgpu_ring_fini(&adev->sdma.instance[i].ring);
 
+        sdma_v3_0_free_microcode(adev);
         return 0;
 }
 
diff --git a/drivers/gpu/drm/amd/amdgpu/tonga_dpm.c b/drivers/gpu/drm/amd/amdgpu/tonga_dpm.c
index b7615cefcac4..f06f6f4dc3a8 100644
--- a/drivers/gpu/drm/amd/amdgpu/tonga_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/tonga_dpm.c
@@ -71,6 +71,11 @@ static int tonga_dpm_sw_init(void *handle)
 
 static int tonga_dpm_sw_fini(void *handle)
 {
+        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+
+        release_firmware(adev->pm.fw);
+        adev->pm.fw = NULL;
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/amd/amdgpu/vi.c b/drivers/gpu/drm/amd/amdgpu/vi.c
index 2c88d0b66cf3..a65c96029476 100644
--- a/drivers/gpu/drm/amd/amdgpu/vi.c
+++ b/drivers/gpu/drm/amd/amdgpu/vi.c
@@ -421,6 +421,20 @@ static bool vi_read_bios_from_rom(struct amdgpu_device *adev,
         return true;
 }
 
+static u32 vi_get_virtual_caps(struct amdgpu_device *adev)
+{
+        u32 caps = 0;
+        u32 reg = RREG32(mmBIF_IOV_FUNC_IDENTIFIER);
+
+        if (REG_GET_FIELD(reg, BIF_IOV_FUNC_IDENTIFIER, IOV_ENABLE))
+                caps |= AMDGPU_VIRT_CAPS_SRIOV_EN;
+
+        if (REG_GET_FIELD(reg, BIF_IOV_FUNC_IDENTIFIER, FUNC_IDENTIFIER))
+                caps |= AMDGPU_VIRT_CAPS_IS_VF;
+
+        return caps;
+}
+
 static const struct amdgpu_allowed_register_entry tonga_allowed_read_registers[] = {
         {mmGB_MACROTILE_MODE7, true},
 };
@@ -1118,6 +1132,7 @@ static const struct amdgpu_asic_funcs vi_asic_funcs =
         .get_xclk = &vi_get_xclk,
         .set_uvd_clocks = &vi_set_uvd_clocks,
         .set_vce_clocks = &vi_set_vce_clocks,
+        .get_virtual_caps = &vi_get_virtual_caps,
         /* these should be moved to their own ip modules */
         .get_gpu_clock_counter = &gfx_v8_0_get_gpu_clock_counter,
         .wait_for_mc_idle = &gmc_v8_0_mc_wait_for_idle,
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process.c b/drivers/gpu/drm/amd/amdkfd/kfd_process.c
index ac005796b71c..7708d90b9da9 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_process.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_process.c
@@ -242,13 +242,19 @@ static void kfd_process_notifier_release(struct mmu_notifier *mn,
         pqm_uninit(&p->pqm);
 
         /* Iterate over all process device data structure and check
-         * if we should reset all wavefronts */
-        list_for_each_entry(pdd, &p->per_device_data, per_device_list)
+         * if we should delete debug managers and reset all wavefronts
+         */
+        list_for_each_entry(pdd, &p->per_device_data, per_device_list) {
+                if ((pdd->dev->dbgmgr) &&
+                                (pdd->dev->dbgmgr->pasid == p->pasid))
+                        kfd_dbgmgr_destroy(pdd->dev->dbgmgr);
+
                 if (pdd->reset_wavefronts) {
                         pr_warn("amdkfd: Resetting all wave fronts\n");
                         dbgdev_wave_reset_wavefronts(pdd->dev, p);
                         pdd->reset_wavefronts = false;
                 }
+        }
 
         mutex_unlock(&p->mutex);
 
@@ -404,42 +410,52 @@ void kfd_unbind_process_from_device(struct kfd_dev *dev, unsigned int pasid)
 
         idx = srcu_read_lock(&kfd_processes_srcu);
 
+        /*
+         * Look for the process that matches the pasid. If there is no such
+         * process, we either released it in amdkfd's own notifier, or there
+         * is a bug. Unfortunately, there is no way to tell...
+         */
         hash_for_each_rcu(kfd_processes_table, i, p, kfd_processes)
-                if (p->pasid == pasid)
-                        break;
+                if (p->pasid == pasid) {
 
-        srcu_read_unlock(&kfd_processes_srcu, idx);
+                        srcu_read_unlock(&kfd_processes_srcu, idx);
 
-        BUG_ON(p->pasid != pasid);
+                        pr_debug("Unbinding process %d from IOMMU\n", pasid);
 
-        mutex_lock(&p->mutex);
+                        mutex_lock(&p->mutex);
 
-        if ((dev->dbgmgr) && (dev->dbgmgr->pasid == p->pasid))
-                kfd_dbgmgr_destroy(dev->dbgmgr);
+                        if ((dev->dbgmgr) && (dev->dbgmgr->pasid == p->pasid))
+                                kfd_dbgmgr_destroy(dev->dbgmgr);
 
-        pqm_uninit(&p->pqm);
+                        pqm_uninit(&p->pqm);
 
-        pdd = kfd_get_process_device_data(dev, p);
+                        pdd = kfd_get_process_device_data(dev, p);
 
-        if (!pdd) {
-                mutex_unlock(&p->mutex);
-                return;
-        }
+                        if (!pdd) {
+                                mutex_unlock(&p->mutex);
+                                return;
+                        }
 
-        if (pdd->reset_wavefronts) {
-                dbgdev_wave_reset_wavefronts(pdd->dev, p);
-                pdd->reset_wavefronts = false;
-        }
+                        if (pdd->reset_wavefronts) {
+                                dbgdev_wave_reset_wavefronts(pdd->dev, p);
+                                pdd->reset_wavefronts = false;
+                        }
 
-        /*
-         * Just mark pdd as unbound, because we still need it to call
-         * amd_iommu_unbind_pasid() in when the process exits.
-         * We don't call amd_iommu_unbind_pasid() here
-         * because the IOMMU called us.
-         */
-        pdd->bound = false;
+                        /*
+                         * Just mark pdd as unbound, because we still need it
+                         * to call amd_iommu_unbind_pasid() in when the
+                         * process exits.
+                         * We don't call amd_iommu_unbind_pasid() here
+                         * because the IOMMU called us.
+                         */
+                        pdd->bound = false;
 
-        mutex_unlock(&p->mutex);
+                        mutex_unlock(&p->mutex);
+
+                        return;
+                }
+
+        srcu_read_unlock(&kfd_processes_srcu, idx);
 }
 
 struct kfd_process_device *kfd_get_first_process_device_data(struct kfd_process *p)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
index 74909e72a009..884c96f50c3d 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
@@ -666,7 +666,7 @@ static ssize_t node_show(struct kobject *kobj, struct attribute *attr,
                         dev->node_props.simd_count);
 
         if (dev->mem_bank_count < dev->node_props.mem_banks_count) {
-                pr_warn("kfd: mem_banks_count truncated from %d to %d\n",
+                pr_info_once("kfd: mem_banks_count truncated from %d to %d\n",
                                 dev->node_props.mem_banks_count,
                                 dev->mem_bank_count);
                 sysfs_show_32bit_prop(buffer, "mem_banks_count",
diff --git a/drivers/gpu/drm/amd/include/amd_shared.h b/drivers/gpu/drm/amd/include/amd_shared.h
index 6080951d539d..afce1edbe250 100644
--- a/drivers/gpu/drm/amd/include/amd_shared.h
+++ b/drivers/gpu/drm/amd/include/amd_shared.h
@@ -157,6 +157,7 @@ struct amd_ip_funcs {
         int (*hw_init)(void *handle);
         /* tears down the hw state */
         int (*hw_fini)(void *handle);
+        void (*late_fini)(void *handle);
         /* handles IP specific hw/sw changes for suspend */
         int (*suspend)(void *handle);
         /* handles IP specific hw/sw changes for resume */
diff --git a/drivers/gpu/drm/amd/include/atombios.h b/drivers/gpu/drm/amd/include/atombios.h
index 32f3e345de08..3493da5c8f0e 100644
--- a/drivers/gpu/drm/amd/include/atombios.h
+++ b/drivers/gpu/drm/amd/include/atombios.h
@@ -5538,6 +5538,78 @@ typedef struct  _ATOM_ASIC_PROFILING_INFO_V3_5
   ULONG  ulReserved[12];
 }ATOM_ASIC_PROFILING_INFO_V3_5;
 
+/* for Polars10/11 AVFS parameters */
+typedef struct  _ATOM_ASIC_PROFILING_INFO_V3_6
+{
+  ATOM_COMMON_TABLE_HEADER         asHeader;
+  ULONG  ulMaxVddc;
+  ULONG  ulMinVddc;
+  USHORT usLkgEuseIndex;
+  UCHAR  ucLkgEfuseBitLSB;
+  UCHAR  ucLkgEfuseLength;
+  ULONG  ulLkgEncodeLn_MaxDivMin;
+  ULONG  ulLkgEncodeMax;
+  ULONG  ulLkgEncodeMin;
+  EFUSE_LINEAR_FUNC_PARAM sRoFuse;
+  ULONG  ulEvvDefaultVddc;
+  ULONG  ulEvvNoCalcVddc;
+  ULONG  ulSpeed_Model;
+  ULONG  ulSM_A0;
+  ULONG  ulSM_A1;
+  ULONG  ulSM_A2;
+  ULONG  ulSM_A3;
+  ULONG  ulSM_A4;
+  ULONG  ulSM_A5;
+  ULONG  ulSM_A6;
+  ULONG  ulSM_A7;
+  UCHAR  ucSM_A0_sign;
+  UCHAR  ucSM_A1_sign;
+  UCHAR  ucSM_A2_sign;
+  UCHAR  ucSM_A3_sign;
+  UCHAR  ucSM_A4_sign;
+  UCHAR  ucSM_A5_sign;
+  UCHAR  ucSM_A6_sign;
+  UCHAR  ucSM_A7_sign;
+  ULONG  ulMargin_RO_a;
+  ULONG  ulMargin_RO_b;
+  ULONG  ulMargin_RO_c;
+  ULONG  ulMargin_fixed;
+  ULONG  ulMargin_Fmax_mean;
+  ULONG  ulMargin_plat_mean;
+  ULONG  ulMargin_Fmax_sigma;
+  ULONG  ulMargin_plat_sigma;
+  ULONG  ulMargin_DC_sigma;
+  ULONG  ulLoadLineSlop;
+  ULONG  ulaTDClimitPerDPM[8];
+  ULONG  ulaNoCalcVddcPerDPM[8];
+  ULONG  ulAVFS_meanNsigma_Acontant0;
+  ULONG  ulAVFS_meanNsigma_Acontant1;
+  ULONG  ulAVFS_meanNsigma_Acontant2;
+  USHORT usAVFS_meanNsigma_DC_tol_sigma;
+  USHORT usAVFS_meanNsigma_Platform_mean;
+  USHORT usAVFS_meanNsigma_Platform_sigma;
+  ULONG  ulGB_VDROOP_TABLE_CKSOFF_a0;
+  ULONG  ulGB_VDROOP_TABLE_CKSOFF_a1;
+  ULONG  ulGB_VDROOP_TABLE_CKSOFF_a2;
+  ULONG  ulGB_VDROOP_TABLE_CKSON_a0;
+  ULONG  ulGB_VDROOP_TABLE_CKSON_a1;
+  ULONG  ulGB_VDROOP_TABLE_CKSON_a2;
+  ULONG  ulAVFSGB_FUSE_TABLE_CKSOFF_m1;
+  USHORT usAVFSGB_FUSE_TABLE_CKSOFF_m2;
+  ULONG  ulAVFSGB_FUSE_TABLE_CKSOFF_b;
+  ULONG  ulAVFSGB_FUSE_TABLE_CKSON_m1;
+  USHORT usAVFSGB_FUSE_TABLE_CKSON_m2;
+  ULONG  ulAVFSGB_FUSE_TABLE_CKSON_b;
+  USHORT usMaxVoltage_0_25mv;
+  UCHAR  ucEnableGB_VDROOP_TABLE_CKSOFF;
+  UCHAR  ucEnableGB_VDROOP_TABLE_CKSON;
+  UCHAR  ucEnableGB_FUSE_TABLE_CKSOFF;
+  UCHAR  ucEnableGB_FUSE_TABLE_CKSON;
+  USHORT usPSM_Age_ComFactor;
+  UCHAR  ucEnableApplyAVFS_CKS_OFF_Voltage;
+  UCHAR  ucReserved;
+}ATOM_ASIC_PROFILING_INFO_V3_6;
+
 
 typedef struct _ATOM_SCLK_FCW_RANGE_ENTRY_V1{
   ULONG  ulMaxSclkFreq;
diff --git a/drivers/gpu/drm/amd/include/cgs_common.h b/drivers/gpu/drm/amd/include/cgs_common.h
index a461e155a160..7464daf89ca1 100644
--- a/drivers/gpu/drm/amd/include/cgs_common.h
+++ b/drivers/gpu/drm/amd/include/cgs_common.h
@@ -581,6 +581,9 @@ typedef int (*cgs_get_firmware_info)(struct cgs_device *cgs_device,
                                      enum cgs_ucode_id type,
                                      struct cgs_firmware_info *info);
 
+typedef int (*cgs_rel_firmware)(struct cgs_device *cgs_device,
+                                         enum cgs_ucode_id type);
+
 typedef int(*cgs_set_powergating_state)(struct cgs_device *cgs_device,
                                   enum amd_ip_block_type block_type,
                                   enum amd_powergating_state state);
@@ -645,6 +648,7 @@ struct cgs_ops {
         cgs_set_camera_voltages_t set_camera_voltages;
         /* Firmware Info */
         cgs_get_firmware_info get_firmware_info;
+        cgs_rel_firmware rel_firmware;
         /* cg pg interface*/
         cgs_set_powergating_state set_powergating_state;
         cgs_set_clockgating_state set_clockgating_state;
@@ -738,6 +742,8 @@ struct cgs_device
         CGS_CALL(set_camera_voltages,dev,mask,voltages)
 #define cgs_get_firmware_info(dev, type, info)  \
         CGS_CALL(get_firmware_info, dev, type, info)
+#define cgs_rel_firmware(dev, type)     \
+        CGS_CALL(rel_firmware, dev, type)
 #define cgs_set_powergating_state(dev, block_type, state)       \
         CGS_CALL(set_powergating_state, dev, block_type, state)
 #define cgs_set_clockgating_state(dev, block_type, state)       \
diff --git a/drivers/gpu/drm/amd/powerplay/amd_powerplay.c b/drivers/gpu/drm/amd/powerplay/amd_powerplay.c
index 8e345bfddb69..e629f8a9fe93 100644
--- a/drivers/gpu/drm/amd/powerplay/amd_powerplay.c
+++ b/drivers/gpu/drm/amd/powerplay/amd_powerplay.c
@@ -73,11 +73,14 @@ static int pp_sw_init(void *handle)
 
         ret = hwmgr->hwmgr_func->backend_init(hwmgr);
         if (ret)
-                goto err;
+                goto err1;
 
         pr_info("amdgpu: powerplay initialized\n");
 
         return 0;
+err1:
+        if (hwmgr->pptable_func->pptable_fini)
+                hwmgr->pptable_func->pptable_fini(hwmgr);
 err:
         pr_err("amdgpu: powerplay initialization failed\n");
         return ret;
@@ -100,6 +103,9 @@ static int pp_sw_fini(void *handle)
         if (hwmgr->hwmgr_func->backend_fini != NULL)
                 ret = hwmgr->hwmgr_func->backend_fini(hwmgr);
 
+        if (hwmgr->pptable_func->pptable_fini)
+                hwmgr->pptable_func->pptable_fini(hwmgr);
+
         return ret;
 }
 
diff --git a/drivers/gpu/drm/amd/powerplay/eventmgr/eventmgr.c b/drivers/gpu/drm/amd/powerplay/eventmgr/eventmgr.c
index 46410e3c7349..fb88e4e5d625 100644
--- a/drivers/gpu/drm/amd/powerplay/eventmgr/eventmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/eventmgr/eventmgr.c
@@ -58,9 +58,6 @@ static void pem_fini(struct pp_eventmgr *eventmgr)
         pem_unregister_interrupts(eventmgr);
 
         pem_handle_event(eventmgr, AMD_PP_EVENT_UNINITIALIZE, &event_data);
-
-        if (eventmgr != NULL)
-                kfree(eventmgr);
 }
 
 int eventmgr_init(struct pp_instance *handle)
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/fiji_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/fiji_hwmgr.c
index 24a16e49b571..92912ab20944 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/fiji_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/fiji_hwmgr.c
@@ -633,6 +633,8 @@ static int fiji_hwmgr_backend_init(struct pp_hwmgr *hwmgr)
         data->vddci_control = FIJI_VOLTAGE_CONTROL_NONE;
         data->mvdd_control = FIJI_VOLTAGE_CONTROL_NONE;
 
+        data->force_pcie_gen = PP_PCIEGenInvalid;
+
         if (atomctrl_is_voltage_controled_by_gpio_v3(hwmgr,
                         VOLTAGE_TYPE_VDDC, VOLTAGE_OBJ_SVID2))
                 data->voltage_control = FIJI_VOLTAGE_CONTROL_BY_SVID2;
@@ -1830,7 +1832,7 @@ static uint16_t fiji_find_closest_vddci(struct pp_hwmgr *hwmgr, uint16_t vddci)
 
         PP_ASSERT_WITH_CODE(false,
                         "VDDCI is larger than max VDDCI in VDDCI Voltage Table!",
-                        return vddci_table->entries[i].value);
+                        return vddci_table->entries[i-1].value);
 }
 
 static int fiji_get_dependency_volt_by_clk(struct pp_hwmgr *hwmgr,
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/hardwaremanager.c b/drivers/gpu/drm/amd/powerplay/hwmgr/hardwaremanager.c
index fa208ada6892..efb77eda7508 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/hardwaremanager.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/hardwaremanager.c
@@ -306,10 +306,14 @@ int phm_store_dal_configuration_data(struct pp_hwmgr *hwmgr,
 {
         PHM_FUNC_CHECK(hwmgr);
 
-        if (hwmgr->hwmgr_func->store_cc6_data == NULL)
+        if (display_config == NULL)
                 return -EINVAL;
 
         hwmgr->display_config = *display_config;
+
+        if (hwmgr->hwmgr_func->store_cc6_data == NULL)
+                return -EINVAL;
+
         /* to do pass other display configuration in furture */
 
         if (hwmgr->hwmgr_func->store_cc6_data)
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/hwmgr.c
index 1c48917da3cf..20f20e075588 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/hwmgr.c
@@ -93,6 +93,13 @@ int hwmgr_fini(struct pp_hwmgr *hwmgr)
         if (hwmgr == NULL || hwmgr->ps == NULL)
                 return -EINVAL;
 
+        /* do hwmgr finish*/
+        kfree(hwmgr->backend);
+
+        kfree(hwmgr->start_thermal_controller.function_list);
+
+        kfree(hwmgr->set_temperature_range.function_list);
+
         kfree(hwmgr->ps);
         kfree(hwmgr);
         return 0;
@@ -462,7 +469,7 @@ uint16_t phm_find_closest_vddci(struct pp_atomctrl_voltage_table *vddci_table, u
 
         PP_ASSERT_WITH_CODE(false,
                         "VDDCI is larger than max VDDCI in VDDCI Voltage Table!",
-                        return vddci_table->entries[i].value);
+                        return vddci_table->entries[i-1].value);
 }
 
 int phm_find_boot_level(void *table,
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/hwmgr_ppt.h b/drivers/gpu/drm/amd/powerplay/hwmgr/hwmgr_ppt.h
index 347fef127ce9..2930a3355948 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/hwmgr_ppt.h
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/hwmgr_ppt.h
@@ -39,6 +39,7 @@ struct phm_ppt_v1_clock_voltage_dependency_record {
         uint8_t phases;
         uint8_t cks_enable;
         uint8_t cks_voffset;
+        uint32_t sclk_offset;
 };
 
 typedef struct phm_ppt_v1_clock_voltage_dependency_record phm_ppt_v1_clock_voltage_dependency_record;
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/polaris10_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/polaris10_hwmgr.c
index aa6be033f21b..ec2a7ada346a 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/polaris10_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/polaris10_hwmgr.c
@@ -98,6 +98,7 @@
 #define PCIE_BUS_CLK                10000
 #define TCLK                        (PCIE_BUS_CLK / 10)
 
+#define CEILING_UCHAR(double) ((double-(uint8_t)(double)) > 0 ? (uint8_t)(double+1) : (uint8_t)(double))
 
 static const uint16_t polaris10_clock_stretcher_lookup_table[2][4] =
 { {600, 1050, 3, 0}, {600, 1050, 6, 1} };
@@ -999,7 +1000,7 @@ static int polaris10_get_dependency_volt_by_clk(struct pp_hwmgr *hwmgr,
                                 vddci = phm_find_closest_vddci(&(data->vddci_voltage_table),
                                                 (dep_table->entries[i].vddc -
                                                                 (uint16_t)data->vddc_vddci_delta));
-                                *voltage |= (vddci * VOLTAGE_SCALE) <<  VDDCI_SHIFT;
+                                *voltage |= (vddci * VOLTAGE_SCALE) << VDDCI_SHIFT;
                         }
 
                         if (POLARIS10_VOLTAGE_CONTROL_NONE == data->mvdd_control)
@@ -1296,7 +1297,6 @@ static int polaris10_populate_single_memory_level(struct pp_hwmgr *hwmgr,
         }
 
         mem_level->MclkFrequency = clock;
-        mem_level->StutterEnable = 0;
         mem_level->EnabledForThrottle = 1;
         mem_level->EnabledForActivity = 0;
         mem_level->UpHyst = 0;
@@ -1304,7 +1304,6 @@ static int polaris10_populate_single_memory_level(struct pp_hwmgr *hwmgr,
         mem_level->VoltageDownHyst = 0;
         mem_level->ActivityLevel = (uint16_t)data->mclk_activity_target;
         mem_level->StutterEnable = false;
-
         mem_level->DisplayWatermark = PPSMC_DISPLAY_WATERMARK_LOW;
 
         data->display_timing.num_existing_displays = info.display_count;
@@ -1363,7 +1362,7 @@ static int polaris10_populate_all_memory_levels(struct pp_hwmgr *hwmgr)
          * a higher state by default such that we are not effected by
          * up threshold or and MCLK DPM latency.
          */
-        levels[0].ActivityLevel = (uint16_t)data->mclk_dpm0_activity_target;
+        levels[0].ActivityLevel = 0x1f;
         CONVERT_FROM_HOST_TO_SMC_US(levels[0].ActivityLevel);
 
         data->smc_state_table.MemoryDpmLevelCount =
@@ -1424,22 +1423,19 @@ static int polaris10_populate_smc_acpi_level(struct pp_hwmgr *hwmgr,
 
         table->ACPILevel.Flags &= ~PPSMC_SWSTATE_FLAG_DC;
 
-        if (!data->sclk_dpm_key_disabled) {
-                /* Get MinVoltage and Frequency from DPM0,
-                 * already converted to SMC_UL */
-                sclk_frequency = data->dpm_table.sclk_table.dpm_levels[0].value;
-                result = polaris10_get_dependency_volt_by_clk(hwmgr,
-                                table_info->vdd_dep_on_sclk,
-                                table->ACPILevel.SclkFrequency,
-                                &table->ACPILevel.MinVoltage, &mvdd);
-                PP_ASSERT_WITH_CODE((0 == result),
-                                "Cannot find ACPI VDDC voltage value "
-                                "in Clock Dependency Table", );
-        } else {
-                sclk_frequency = data->vbios_boot_state.sclk_bootup_value;
-                table->ACPILevel.MinVoltage =
-                                data->vbios_boot_state.vddc_bootup_value * VOLTAGE_SCALE;
-        }
+
+        /* Get MinVoltage and Frequency from DPM0,
+         * already converted to SMC_UL */
+        sclk_frequency = data->dpm_table.sclk_table.dpm_levels[0].value;
+        result = polaris10_get_dependency_volt_by_clk(hwmgr,
+                        table_info->vdd_dep_on_sclk,
+                        sclk_frequency,
+                        &table->ACPILevel.MinVoltage, &mvdd);
+        PP_ASSERT_WITH_CODE((0 == result),
+                        "Cannot find ACPI VDDC voltage value "
+                        "in Clock Dependency Table",
+                        );
+
 
         result = polaris10_calculate_sclk_params(hwmgr, sclk_frequency,  &(table->ACPILevel.SclkSetting));
         PP_ASSERT_WITH_CODE(result == 0, "Error retrieving Engine Clock dividers from VBIOS.", return result);
@@ -1464,24 +1460,18 @@ static int polaris10_populate_smc_acpi_level(struct pp_hwmgr *hwmgr,
         CONVERT_FROM_HOST_TO_SMC_US(table->ACPILevel.SclkSetting.Fcw1_frac);
         CONVERT_FROM_HOST_TO_SMC_US(table->ACPILevel.SclkSetting.Sclk_ss_slew_rate);
 
-        if (!data->mclk_dpm_key_disabled) {
-                /* Get MinVoltage and Frequency from DPM0, already converted to SMC_UL */
-                table->MemoryACPILevel.MclkFrequency =
-                                data->dpm_table.mclk_table.dpm_levels[0].value;
-                result = polaris10_get_dependency_volt_by_clk(hwmgr,
-                                table_info->vdd_dep_on_mclk,
-                                table->MemoryACPILevel.MclkFrequency,
-                                &table->MemoryACPILevel.MinVoltage, &mvdd);
-                PP_ASSERT_WITH_CODE((0 == result),
-                                "Cannot find ACPI VDDCI voltage value "
-                                "in Clock Dependency Table",
-                                );
-        } else {
-                table->MemoryACPILevel.MclkFrequency =
-                                data->vbios_boot_state.mclk_bootup_value;
-                table->MemoryACPILevel.MinVoltage =
-                                data->vbios_boot_state.vddci_bootup_value * VOLTAGE_SCALE;
-        }
+
+        /* Get MinVoltage and Frequency from DPM0, already converted to SMC_UL */
+        table->MemoryACPILevel.MclkFrequency =
+                        data->dpm_table.mclk_table.dpm_levels[0].value;
+        result = polaris10_get_dependency_volt_by_clk(hwmgr,
+                        table_info->vdd_dep_on_mclk,
+                        table->MemoryACPILevel.MclkFrequency,
+                        &table->MemoryACPILevel.MinVoltage, &mvdd);
+        PP_ASSERT_WITH_CODE((0 == result),
+                        "Cannot find ACPI VDDCI voltage value "
+                        "in Clock Dependency Table",
+                        );
 
         us_mvdd = 0;
         if ((POLARIS10_VOLTAGE_CONTROL_NONE == data->mvdd_control) ||
@@ -1526,6 +1516,7 @@ static int polaris10_populate_smc_vce_level(struct pp_hwmgr *hwmgr,
         struct phm_ppt_v1_mm_clock_voltage_dependency_table *mm_table =
                         table_info->mm_dep_table;
         struct polaris10_hwmgr *data = (struct polaris10_hwmgr *)(hwmgr->backend);
+        uint32_t vddci;
 
         table->VceLevelCount = (uint8_t)(mm_table->count);
         table->VceBootLevel = 0;
@@ -1535,9 +1526,18 @@ static int polaris10_populate_smc_vce_level(struct pp_hwmgr *hwmgr,
                 table->VceLevel[count].MinVoltage = 0;
                 table->VceLevel[count].MinVoltage |=
                                 (mm_table->entries[count].vddc * VOLTAGE_SCALE) << VDDC_SHIFT;
+
+                if (POLARIS10_VOLTAGE_CONTROL_BY_GPIO == data->vddci_control)
+                        vddci = (uint32_t)phm_find_closest_vddci(&(data->vddci_voltage_table),
+                                                mm_table->entries[count].vddc - VDDC_VDDCI_DELTA);
+                else if (POLARIS10_VOLTAGE_CONTROL_BY_SVID2 == data->vddci_control)
+                        vddci = mm_table->entries[count].vddc - VDDC_VDDCI_DELTA;
+                else
+                        vddci = (data->vbios_boot_state.vddci_bootup_value * VOLTAGE_SCALE) << VDDCI_SHIFT;
+
+
                 table->VceLevel[count].MinVoltage |=
-                                ((mm_table->entries[count].vddc - data->vddc_vddci_delta) *
-                                                VOLTAGE_SCALE) << VDDCI_SHIFT;
+                                (vddci * VOLTAGE_SCALE) << VDDCI_SHIFT;
                 table->VceLevel[count].MinVoltage |= 1 << PHASES_SHIFT;
 
                 /*retrieve divider value for VBIOS */
@@ -1566,6 +1566,7 @@ static int polaris10_populate_smc_samu_level(struct pp_hwmgr *hwmgr,
         struct phm_ppt_v1_mm_clock_voltage_dependency_table *mm_table =
                         table_info->mm_dep_table;
         struct polaris10_hwmgr *data = (struct polaris10_hwmgr *)(hwmgr->backend);
+        uint32_t vddci;
 
         table->SamuBootLevel = 0;
         table->SamuLevelCount = (uint8_t)(mm_table->count);
@@ -1576,8 +1577,16 @@ static int polaris10_populate_smc_samu_level(struct pp_hwmgr *hwmgr,
                 table->SamuLevel[count].Frequency = mm_table->entries[count].samclock;
                 table->SamuLevel[count].MinVoltage |= (mm_table->entries[count].vddc *
                                 VOLTAGE_SCALE) << VDDC_SHIFT;
-                table->SamuLevel[count].MinVoltage |= ((mm_table->entries[count].vddc -
-                                data->vddc_vddci_delta) * VOLTAGE_SCALE) << VDDCI_SHIFT;
+
+                if (POLARIS10_VOLTAGE_CONTROL_BY_GPIO == data->vddci_control)
+                        vddci = (uint32_t)phm_find_closest_vddci(&(data->vddci_voltage_table),
+                                                mm_table->entries[count].vddc - VDDC_VDDCI_DELTA);
+                else if (POLARIS10_VOLTAGE_CONTROL_BY_SVID2 == data->vddci_control)
+                        vddci = mm_table->entries[count].vddc - VDDC_VDDCI_DELTA;
+                else
+                        vddci = (data->vbios_boot_state.vddci_bootup_value * VOLTAGE_SCALE) << VDDCI_SHIFT;
+
+                table->SamuLevel[count].MinVoltage |= (vddci * VOLTAGE_SCALE) << VDDCI_SHIFT;
                 table->SamuLevel[count].MinVoltage |= 1 << PHASES_SHIFT;
 
                 /* retrieve divider value for VBIOS */
@@ -1660,6 +1669,7 @@ static int polaris10_populate_smc_uvd_level(struct pp_hwmgr *hwmgr,
         struct phm_ppt_v1_mm_clock_voltage_dependency_table *mm_table =
                         table_info->mm_dep_table;
         struct polaris10_hwmgr *data = (struct polaris10_hwmgr *)(hwmgr->backend);
+        uint32_t vddci;
 
         table->UvdLevelCount = (uint8_t)(mm_table->count);
         table->UvdBootLevel = 0;
@@ -1670,8 +1680,16 @@ static int polaris10_populate_smc_uvd_level(struct pp_hwmgr *hwmgr,
                 table->UvdLevel[count].DclkFrequency = mm_table->entries[count].dclk;
                 table->UvdLevel[count].MinVoltage |= (mm_table->entries[count].vddc *
                                 VOLTAGE_SCALE) << VDDC_SHIFT;
-                table->UvdLevel[count].MinVoltage |= ((mm_table->entries[count].vddc -
-                                data->vddc_vddci_delta) * VOLTAGE_SCALE) << VDDCI_SHIFT;
+
+                if (POLARIS10_VOLTAGE_CONTROL_BY_GPIO == data->vddci_control)
+                        vddci = (uint32_t)phm_find_closest_vddci(&(data->vddci_voltage_table),
+                                                mm_table->entries[count].vddc - VDDC_VDDCI_DELTA);
+                else if (POLARIS10_VOLTAGE_CONTROL_BY_SVID2 == data->vddci_control)
+                        vddci = mm_table->entries[count].vddc - VDDC_VDDCI_DELTA;
+                else
+                        vddci = (data->vbios_boot_state.vddci_bootup_value * VOLTAGE_SCALE) << VDDCI_SHIFT;
+
+                table->UvdLevel[count].MinVoltage |= (vddci * VOLTAGE_SCALE) << VDDCI_SHIFT;
                 table->UvdLevel[count].MinVoltage |= 1 << PHASES_SHIFT;
 
                 /* retrieve divider value for VBIOS */
@@ -1692,8 +1710,8 @@ static int polaris10_populate_smc_uvd_level(struct pp_hwmgr *hwmgr,
                 CONVERT_FROM_HOST_TO_SMC_UL(table->UvdLevel[count].VclkFrequency);
                 CONVERT_FROM_HOST_TO_SMC_UL(table->UvdLevel[count].DclkFrequency);
                 CONVERT_FROM_HOST_TO_SMC_UL(table->UvdLevel[count].MinVoltage);
-
         }
+
         return result;
 }
 
@@ -1761,12 +1779,9 @@ static int polaris10_populate_smc_initailial_state(struct pp_hwmgr *hwmgr)
 
 static int polaris10_populate_clock_stretcher_data_table(struct pp_hwmgr *hwmgr)
 {
-        uint32_t ro, efuse, efuse2, clock_freq, volt_without_cks,
-                        volt_with_cks, value;
-        uint16_t clock_freq_u16;
+        uint32_t ro, efuse, volt_without_cks, volt_with_cks, value, max, min;
         struct polaris10_hwmgr *data = (struct polaris10_hwmgr *)(hwmgr->backend);
-        uint8_t type, i, j, cks_setting, stretch_amount, stretch_amount2,
-                        volt_offset = 0;
+        uint8_t i, stretch_amount, stretch_amount2, volt_offset = 0;
         struct phm_ppt_v1_information *table_info =
                         (struct phm_ppt_v1_information *)(hwmgr->pptable);
         struct phm_ppt_v1_clock_voltage_dependency_table *sclk_table =
@@ -1778,50 +1793,46 @@ static int polaris10_populate_clock_stretcher_data_table(struct pp_hwmgr *hwmgr)
          * if the part is SS or FF. if RO >= 1660MHz, part is FF.
          */
         efuse = cgs_read_ind_register(hwmgr->device, CGS_IND_REG__SMC,
-                        ixSMU_EFUSE_0 + (146 * 4));
-        efuse2 = cgs_read_ind_register(hwmgr->device, CGS_IND_REG__SMC,
-                        ixSMU_EFUSE_0 + (148 * 4));
+                        ixSMU_EFUSE_0 + (67 * 4));
         efuse &= 0xFF000000;
         efuse = efuse >> 24;
-        efuse2 &= 0xF;
-
-        if (efuse2 == 1)
-                ro = (2300 - 1350) * efuse / 255 + 1350;
-        else
-                ro = (2500 - 1000) * efuse / 255 + 1000;
 
-        if (ro >= 1660)
-                type = 0;
-        else
-                type = 1;
+        if (hwmgr->chip_id == CHIP_POLARIS10) {
+                min = 1000;
+                max = 2300;
+        } else {
+                min = 1100;
+                max = 2100;
+        }
 
-        /* Populate Stretch amount */
-        data->smc_state_table.ClockStretcherAmount = stretch_amount;
+        ro = efuse * (max -min)/255 + min;
 
-        /* Populate Sclk_CKS_masterEn0_7 and Sclk_voltageOffset */
+        /* Populate Sclk_CKS_masterEn0_7 and Sclk_voltageOffset
+         * there is a little difference in calculating
+         * volt_with_cks with windows */
         for (i = 0; i < sclk_table->count; i++) {
                 data->smc_state_table.Sclk_CKS_masterEn0_7 |=
                                 sclk_table->entries[i].cks_enable << i;
-                volt_without_cks = (uint32_t)((14041 *
-                        (sclk_table->entries[i].clk/100) / 10000 + 3571 + 75 - ro) * 1000 /
-                        (4026 - (13924 * (sclk_table->entries[i].clk/100) / 10000)));
-                volt_with_cks = (uint32_t)((13946 *
-                        (sclk_table->entries[i].clk/100) / 10000 + 3320 + 45 - ro) * 1000 /
-                        (3664 - (11454 * (sclk_table->entries[i].clk/100) / 10000)));
+                if (hwmgr->chip_id == CHIP_POLARIS10) {
+                        volt_without_cks = (uint32_t)((2753594000 + (sclk_table->entries[i].clk/100) * 136418 -(ro - 70) * 1000000) / \
+                                                (2424180 - (sclk_table->entries[i].clk/100) * 1132925/1000));
+                        volt_with_cks = (uint32_t)((279720200 + sclk_table->entries[i].clk * 3232 - (ro - 65) * 100000000) / \
+                                        (252248000 - sclk_table->entries[i].clk/100 * 115764));
+                } else {
+                        volt_without_cks = (uint32_t)((2416794800 + (sclk_table->entries[i].clk/100) * 1476925/10 -(ro - 50) * 1000000) / \
+                                                (2625416 - (sclk_table->entries[i].clk/100) * 12586807/10000));
+                        volt_with_cks = (uint32_t)((2999656000 + sclk_table->entries[i].clk * 392803/100 - (ro - 44) * 1000000) / \
+                                        (3422454 - sclk_table->entries[i].clk/100 * 18886376/10000));
+                }
+
                 if (volt_without_cks >= volt_with_cks)
-                        volt_offset = (uint8_t)(((volt_without_cks - volt_with_cks +
-                                        sclk_table->entries[i].cks_voffset) * 100 / 625) + 1);
+                        volt_offset = (uint8_t)CEILING_UCHAR((volt_without_cks - volt_with_cks +
+                                        sclk_table->entries[i].cks_voffset) * 100 / 625);
+
                 data->smc_state_table.Sclk_voltageOffset[i] = volt_offset;
         }
 
-        PHM_WRITE_INDIRECT_FIELD(hwmgr->device, CGS_IND_REG__SMC, PWR_CKS_ENABLE,
-                        STRETCH_ENABLE, 0x0);
-        PHM_WRITE_INDIRECT_FIELD(hwmgr->device, CGS_IND_REG__SMC, PWR_CKS_ENABLE,
-                        masterReset, 0x1);
-        /* PHM_WRITE_INDIRECT_FIELD(hwmgr->device, CGS_IND_REG__SMC, PWR_CKS_ENABLE, staticEnable, 0x1); */
-        PHM_WRITE_INDIRECT_FIELD(hwmgr->device, CGS_IND_REG__SMC, PWR_CKS_ENABLE,
-                        masterReset, 0x0);
-
+        data->smc_state_table.LdoRefSel = (table_info->cac_dtp_table->ucCKS_LDO_REFSEL != 0) ? table_info->cac_dtp_table->ucCKS_LDO_REFSEL : 6;
         /* Populate CKS Lookup Table */
         if (stretch_amount == 1 || stretch_amount == 2 || stretch_amount == 5)
                 stretch_amount2 = 0;
@@ -1835,69 +1846,6 @@ static int polaris10_populate_clock_stretcher_data_table(struct pp_hwmgr *hwmgr)
                                 return -EINVAL);
         }
 
-        value = cgs_read_ind_register(hwmgr->device, CGS_IND_REG__SMC,
-                        ixPWR_CKS_CNTL);
-        value &= 0xFFC2FF87;
-        data->smc_state_table.CKS_LOOKUPTable.CKS_LOOKUPTableEntry[0].minFreq =
-                        polaris10_clock_stretcher_lookup_table[stretch_amount2][0];
-        data->smc_state_table.CKS_LOOKUPTable.CKS_LOOKUPTableEntry[0].maxFreq =
-                        polaris10_clock_stretcher_lookup_table[stretch_amount2][1];
-        clock_freq_u16 = (uint16_t)(PP_SMC_TO_HOST_UL(data->smc_state_table.
-                        GraphicsLevel[data->smc_state_table.GraphicsDpmLevelCount - 1].SclkSetting.SclkFrequency) / 100);
-        if (polaris10_clock_stretcher_lookup_table[stretch_amount2][0] < clock_freq_u16
-        && polaris10_clock_stretcher_lookup_table[stretch_amount2][1] > clock_freq_u16) {
-                /* Program PWR_CKS_CNTL. CKS_USE_FOR_LOW_FREQ */
-                value |= (polaris10_clock_stretcher_lookup_table[stretch_amount2][3]) << 16;
-                /* Program PWR_CKS_CNTL. CKS_LDO_REFSEL */
-                value |= (polaris10_clock_stretcher_lookup_table[stretch_amount2][2]) << 18;
-                /* Program PWR_CKS_CNTL. CKS_STRETCH_AMOUNT */
-                value |= (polaris10_clock_stretch_amount_conversion
-                                [polaris10_clock_stretcher_lookup_table[stretch_amount2][3]]
-                                 [stretch_amount]) << 3;
-        }
-        CONVERT_FROM_HOST_TO_SMC_US(data->smc_state_table.CKS_LOOKUPTable.CKS_LOOKUPTableEntry[0].minFreq);
-        CONVERT_FROM_HOST_TO_SMC_US(data->smc_state_table.CKS_LOOKUPTable.CKS_LOOKUPTableEntry[0].maxFreq);
-        data->smc_state_table.CKS_LOOKUPTable.CKS_LOOKUPTableEntry[0].setting =
-                        polaris10_clock_stretcher_lookup_table[stretch_amount2][2] & 0x7F;
-        data->smc_state_table.CKS_LOOKUPTable.CKS_LOOKUPTableEntry[0].setting |=
-                        (polaris10_clock_stretcher_lookup_table[stretch_amount2][3]) << 7;
-
-        cgs_write_ind_register(hwmgr->device, CGS_IND_REG__SMC,
-                        ixPWR_CKS_CNTL, value);
-
-        /* Populate DDT Lookup Table */
-        for (i = 0; i < 4; i++) {
-                /* Assign the minimum and maximum VID stored
-                 * in the last row of Clock Stretcher Voltage Table.
-                 */
-                data->smc_state_table.ClockStretcherDataTable.ClockStretcherDataTableEntry[i].minVID =
-                                (uint8_t) polaris10_clock_stretcher_ddt_table[type][i][2];
-                data->smc_state_table.ClockStretcherDataTable.ClockStretcherDataTableEntry[i].maxVID =
-                                (uint8_t) polaris10_clock_stretcher_ddt_table[type][i][3];
-                /* Loop through each SCLK and check the frequency
-                 * to see if it lies within the frequency for clock stretcher.
-                 */
-                for (j = 0; j < data->smc_state_table.GraphicsDpmLevelCount; j++) {
-                        cks_setting = 0;
-                        clock_freq = PP_SMC_TO_HOST_UL(
-                                        data->smc_state_table.GraphicsLevel[j].SclkSetting.SclkFrequency);
-                        /* Check the allowed frequency against the sclk level[j].
-                         *  Sclk's endianness has already been converted,
-                         *  and it's in 10Khz unit,
-                         *  as opposed to Data table, which is in Mhz unit.
-                         */
-                        if (clock_freq >= (polaris10_clock_stretcher_ddt_table[type][i][0]) * 100) {
-                                cks_setting |= 0x2;
-                                if (clock_freq < (polaris10_clock_stretcher_ddt_table[type][i][1]) * 100)
-                                        cks_setting |= 0x1;
-                        }
-                        data->smc_state_table.ClockStretcherDataTable.ClockStretcherDataTableEntry[i].setting
-                                                        |= cks_setting << (j * 2);
-                }
-                CONVERT_FROM_HOST_TO_SMC_US(
-                        data->smc_state_table.ClockStretcherDataTable.ClockStretcherDataTableEntry[i].setting);
-        }
-
         value = cgs_read_ind_register(hwmgr->device, CGS_IND_REG__SMC, ixPWR_CKS_CNTL);
         value &= 0xFFFFFFFE;
         cgs_write_ind_register(hwmgr->device, CGS_IND_REG__SMC, ixPWR_CKS_CNTL, value);
@@ -1956,6 +1904,90 @@ static int polaris10_populate_vr_config(struct pp_hwmgr *hwmgr,
         return 0;
 }
 
+
+int polaris10_populate_avfs_parameters(struct pp_hwmgr *hwmgr)
+{
+        struct polaris10_hwmgr *data = (struct polaris10_hwmgr *)(hwmgr->backend);
+        SMU74_Discrete_DpmTable  *table = &(data->smc_state_table);
+        int result = 0;
+        struct pp_atom_ctrl__avfs_parameters avfs_params = {0};
+        AVFS_meanNsigma_t AVFS_meanNsigma = { {0} };
+        AVFS_Sclk_Offset_t AVFS_SclkOffset = { {0} };
+        uint32_t tmp, i;
+        struct pp_smumgr *smumgr = hwmgr->smumgr;
+        struct polaris10_smumgr *smu_data = (struct polaris10_smumgr *)(smumgr->backend);
+
+        struct phm_ppt_v1_information *table_info =
+                        (struct phm_ppt_v1_information *)hwmgr->pptable;
+        struct phm_ppt_v1_clock_voltage_dependency_table *sclk_table =
+                        table_info->vdd_dep_on_sclk;
+
+
+        if (smu_data->avfs.avfs_btc_status == AVFS_BTC_NOTSUPPORTED)
+                return result;
+
+        result = atomctrl_get_avfs_information(hwmgr, &avfs_params);
+
+        if (0 == result) {
+                table->BTCGB_VDROOP_TABLE[0].a0  = PP_HOST_TO_SMC_UL(avfs_params.ulGB_VDROOP_TABLE_CKSON_a0);
+                table->BTCGB_VDROOP_TABLE[0].a1  = PP_HOST_TO_SMC_UL(avfs_params.ulGB_VDROOP_TABLE_CKSON_a1);
+                table->BTCGB_VDROOP_TABLE[0].a2  = PP_HOST_TO_SMC_UL(avfs_params.ulGB_VDROOP_TABLE_CKSON_a2);
+                table->BTCGB_VDROOP_TABLE[1].a0  = PP_HOST_TO_SMC_UL(avfs_params.ulGB_VDROOP_TABLE_CKSOFF_a0);
+                table->BTCGB_VDROOP_TABLE[1].a1  = PP_HOST_TO_SMC_UL(avfs_params.ulGB_VDROOP_TABLE_CKSOFF_a1);
+                table->BTCGB_VDROOP_TABLE[1].a2  = PP_HOST_TO_SMC_UL(avfs_params.ulGB_VDROOP_TABLE_CKSOFF_a2);
+                table->AVFSGB_VDROOP_TABLE[0].m1 = PP_HOST_TO_SMC_UL(avfs_params.ulAVFSGB_FUSE_TABLE_CKSON_m1);
+                table->AVFSGB_VDROOP_TABLE[0].m2 = PP_HOST_TO_SMC_US(avfs_params.usAVFSGB_FUSE_TABLE_CKSON_m2);
+                table->AVFSGB_VDROOP_TABLE[0].b  = PP_HOST_TO_SMC_UL(avfs_params.ulAVFSGB_FUSE_TABLE_CKSON_b);
+                table->AVFSGB_VDROOP_TABLE[0].m1_shift = 24;
+                table->AVFSGB_VDROOP_TABLE[0].m2_shift  = 12;
+                table->AVFSGB_VDROOP_TABLE[1].m1 = PP_HOST_TO_SMC_UL(avfs_params.ulAVFSGB_FUSE_TABLE_CKSOFF_m1);
+                table->AVFSGB_VDROOP_TABLE[1].m2 = PP_HOST_TO_SMC_US(avfs_params.usAVFSGB_FUSE_TABLE_CKSOFF_m2);
+                table->AVFSGB_VDROOP_TABLE[1].b  = PP_HOST_TO_SMC_UL(avfs_params.ulAVFSGB_FUSE_TABLE_CKSOFF_b);
+                table->AVFSGB_VDROOP_TABLE[1].m1_shift = 24;
+                table->AVFSGB_VDROOP_TABLE[1].m2_shift  = 12;
+                table->MaxVoltage                = PP_HOST_TO_SMC_US(avfs_params.usMaxVoltage_0_25mv);
+                AVFS_meanNsigma.Aconstant[0]      = PP_HOST_TO_SMC_UL(avfs_params.ulAVFS_meanNsigma_Acontant0);
+                AVFS_meanNsigma.Aconstant[1]      = PP_HOST_TO_SMC_UL(avfs_params.ulAVFS_meanNsigma_Acontant1);
+                AVFS_meanNsigma.Aconstant[2]      = PP_HOST_TO_SMC_UL(avfs_params.ulAVFS_meanNsigma_Acontant2);
+                AVFS_meanNsigma.DC_tol_sigma      = PP_HOST_TO_SMC_US(avfs_params.usAVFS_meanNsigma_DC_tol_sigma);
+                AVFS_meanNsigma.Platform_mean     = PP_HOST_TO_SMC_US(avfs_params.usAVFS_meanNsigma_Platform_mean);
+                AVFS_meanNsigma.PSM_Age_CompFactor = PP_HOST_TO_SMC_US(avfs_params.usPSM_Age_ComFactor);
+                AVFS_meanNsigma.Platform_sigma     = PP_HOST_TO_SMC_US(avfs_params.usAVFS_meanNsigma_Platform_sigma);
+
+                for (i = 0; i < NUM_VFT_COLUMNS; i++) {
+                        AVFS_meanNsigma.Static_Voltage_Offset[i] = (uint8_t)(sclk_table->entries[i].cks_voffset * 100 / 625);
+                        AVFS_SclkOffset.Sclk_Offset[i] = PP_HOST_TO_SMC_US((uint16_t)(sclk_table->entries[i].sclk_offset) / 100);
+                }
+
+                result = polaris10_read_smc_sram_dword(smumgr,
+                                SMU7_FIRMWARE_HEADER_LOCATION + offsetof(SMU74_Firmware_Header, AvfsMeanNSigma),
+                                &tmp, data->sram_end);
+
+                polaris10_copy_bytes_to_smc(smumgr,
+                                        tmp,
+                                        (uint8_t *)&AVFS_meanNsigma,
+                                        sizeof(AVFS_meanNsigma_t),
+                                        data->sram_end);
+
+                result = polaris10_read_smc_sram_dword(smumgr,
+                                SMU7_FIRMWARE_HEADER_LOCATION + offsetof(SMU74_Firmware_Header, AvfsSclkOffsetTable),
+                                &tmp, data->sram_end);
+                polaris10_copy_bytes_to_smc(smumgr,
+                                        tmp,
+                                        (uint8_t *)&AVFS_SclkOffset,
+                                        sizeof(AVFS_Sclk_Offset_t),
+                                        data->sram_end);
+
+                data->avfs_vdroop_override_setting = (avfs_params.ucEnableGB_VDROOP_TABLE_CKSON << BTCGB0_Vdroop_Enable_SHIFT) |
+                                                (avfs_params.ucEnableGB_VDROOP_TABLE_CKSOFF << BTCGB1_Vdroop_Enable_SHIFT) |
+                                                (avfs_params.ucEnableGB_FUSE_TABLE_CKSON << AVFSGB0_Vdroop_Enable_SHIFT) |
+                                                (avfs_params.ucEnableGB_FUSE_TABLE_CKSOFF << AVFSGB1_Vdroop_Enable_SHIFT);
+                data->apply_avfs_cks_off_voltage = (avfs_params.ucEnableApplyAVFS_CKS_OFF_Voltage == 1) ? true : false;
+        }
+        return result;
+}
+
+
 /**
 * Initializes the SMC table and uploads it
 *
@@ -2056,6 +2088,10 @@ static int polaris10_init_smc_table(struct pp_hwmgr *hwmgr)
                                 "Failed to populate Clock Stretcher Data Table!",
                                 return result);
         }
+
+        result = polaris10_populate_avfs_parameters(hwmgr);
+        PP_ASSERT_WITH_CODE(0 == result, "Failed to populate AVFS Parameters!", return result;);
+
         table->CurrSclkPllRange = 0xff;
         table->GraphicsVoltageChangeEnable  = 1;
         table->GraphicsThermThrottleEnable  = 1;
@@ -2252,6 +2288,9 @@ static int polaris10_enable_deep_sleep_master_switch(struct pp_hwmgr *hwmgr)
 static int polaris10_enable_sclk_mclk_dpm(struct pp_hwmgr *hwmgr)
 {
         struct polaris10_hwmgr *data = (struct polaris10_hwmgr *)(hwmgr->backend);
+        uint32_t soft_register_value = 0;
+        uint32_t handshake_disables_offset = data->soft_regs_start
+                                + offsetof(SMU74_SoftRegisters, HandshakeDisables);
 
         /* enable SCLK dpm */
         if (!data->sclk_dpm_key_disabled)
@@ -2262,6 +2301,12 @@ static int polaris10_enable_sclk_mclk_dpm(struct pp_hwmgr *hwmgr)
 
         /* enable MCLK dpm */
         if (0 == data->mclk_dpm_key_disabled) {
+/* Disable UVD - SMU handshake for MCLK. */
+                soft_register_value = cgs_read_ind_register(hwmgr->device,
+                                        CGS_IND_REG__SMC, handshake_disables_offset);
+                soft_register_value |= SMU7_UVD_MCLK_HANDSHAKE_DISABLE;
+                cgs_write_ind_register(hwmgr->device, CGS_IND_REG__SMC,
+                                handshake_disables_offset, soft_register_value);
 
                 PP_ASSERT_WITH_CODE(
                                 (0 == smum_send_msg_to_smc(hwmgr->smumgr,
@@ -2269,7 +2314,6 @@ static int polaris10_enable_sclk_mclk_dpm(struct pp_hwmgr *hwmgr)
                                 "Failed to enable MCLK DPM during DPM Start Function!",
                                 return -1);
 
-
                 PHM_WRITE_FIELD(hwmgr->device, MC_SEQ_CNTL_3, CAC_EN, 0x1);
 
                 cgs_write_ind_register(hwmgr->device, CGS_IND_REG__SMC, ixLCAC_MC0_CNTL, 0x5);
@@ -2471,6 +2515,8 @@ int polaris10_enable_dpm_tasks(struct pp_hwmgr *hwmgr)
         PP_ASSERT_WITH_CODE((0 == tmp_result),
                         "Failed to enable VR hot GPIO interrupt!", result = tmp_result);
 
+        smum_send_msg_to_smc(hwmgr->smumgr, (PPSMC_Msg)PPSMC_HasDisplay);
+
         tmp_result = polaris10_enable_sclk_control(hwmgr);
         PP_ASSERT_WITH_CODE((0 == tmp_result),
                         "Failed to enable SCLK control!", result = tmp_result);
@@ -2606,6 +2652,7 @@ int polaris10_set_features_platform_caps(struct pp_hwmgr *hwmgr)
 
         phm_cap_set(hwmgr->platform_descriptor.platformCaps,
                                                 PHM_PlatformCaps_FanSpeedInTableIsRPM);
+
         if (hwmgr->chip_id == CHIP_POLARIS11)
                 phm_cap_set(hwmgr->platform_descriptor.platformCaps,
                                         PHM_PlatformCaps_SPLLShutdownSupport);
@@ -2896,6 +2943,31 @@ static int polaris10_set_private_data_based_on_pptable(struct pp_hwmgr *hwmgr)
         return 0;
 }
 
+int polaris10_patch_voltage_workaround(struct pp_hwmgr *hwmgr)
+{
+        struct phm_ppt_v1_information *table_info =
+                       (struct phm_ppt_v1_information *)(hwmgr->pptable);
+        struct phm_ppt_v1_clock_voltage_dependency_table *dep_mclk_table =
+                        table_info->vdd_dep_on_mclk;
+        struct phm_ppt_v1_voltage_lookup_table *lookup_table =
+                        table_info->vddc_lookup_table;
+        uint32_t i;
+
+        if (hwmgr->chip_id == CHIP_POLARIS10 && hwmgr->hw_revision == 0xC7) {
+                if (lookup_table->entries[dep_mclk_table->entries[dep_mclk_table->count-1].vddInd].us_vdd >= 1000)
+                        return 0;
+
+                for (i = 0; i < lookup_table->count; i++) {
+                        if (lookup_table->entries[i].us_vdd < 0xff01 && lookup_table->entries[i].us_vdd >= 1000) {
+                                dep_mclk_table->entries[dep_mclk_table->count-1].vddInd = (uint8_t) i;
+                                return 0;
+                        }
+                }
+        }
+        return 0;
+}
+
+
 int polaris10_hwmgr_backend_init(struct pp_hwmgr *hwmgr)
 {
         struct polaris10_hwmgr *data = (struct polaris10_hwmgr *)(hwmgr->backend);
@@ -2938,6 +3010,11 @@ int polaris10_hwmgr_backend_init(struct pp_hwmgr *hwmgr)
         data->vddci_control = POLARIS10_VOLTAGE_CONTROL_NONE;
         data->mvdd_control = POLARIS10_VOLTAGE_CONTROL_NONE;
 
+        data->enable_tdc_limit_feature = true;
+        data->enable_pkg_pwr_tracking_feature = true;
+        data->force_pcie_gen = PP_PCIEGenInvalid;
+        data->mclk_stutter_mode_threshold = 40000;
+
         if (atomctrl_is_voltage_controled_by_gpio_v3(hwmgr,
                         VOLTAGE_TYPE_VDDC, VOLTAGE_OBJ_SVID2))
                 data->voltage_control = POLARIS10_VOLTAGE_CONTROL_BY_SVID2;
@@ -2962,8 +3039,13 @@ int polaris10_hwmgr_backend_init(struct pp_hwmgr *hwmgr)
                         data->vddci_control = POLARIS10_VOLTAGE_CONTROL_BY_SVID2;
         }
 
+        if (table_info->cac_dtp_table->usClockStretchAmount != 0)
+                phm_cap_set(hwmgr->platform_descriptor.platformCaps,
+                                        PHM_PlatformCaps_ClockStretcher);
+
         polaris10_set_features_platform_caps(hwmgr);
 
+        polaris10_patch_voltage_workaround(hwmgr);
         polaris10_init_dpm_defaults(hwmgr);
 
         /* Get leakage voltage based on leakage ID. */
@@ -3520,10 +3602,11 @@ static int polaris10_get_pp_table_entry_callback_func(struct pp_hwmgr *hwmgr,
         ATOM_Tonga_State *state_entry = (ATOM_Tonga_State *)state;
         ATOM_Tonga_POWERPLAYTABLE *powerplay_table =
                         (ATOM_Tonga_POWERPLAYTABLE *)pp_table;
-        ATOM_Tonga_SCLK_Dependency_Table *sclk_dep_table =
-                        (ATOM_Tonga_SCLK_Dependency_Table *)
+        PPTable_Generic_SubTable_Header *sclk_dep_table =
+                        (PPTable_Generic_SubTable_Header *)
                         (((unsigned long)powerplay_table) +
                                 le16_to_cpu(powerplay_table->usSclkDependencyTableOffset));
+
         ATOM_Tonga_MCLK_Dependency_Table *mclk_dep_table =
                         (ATOM_Tonga_MCLK_Dependency_Table *)
                         (((unsigned long)powerplay_table) +
@@ -3575,7 +3658,11 @@ static int polaris10_get_pp_table_entry_callback_func(struct pp_hwmgr *hwmgr,
         /* Performance levels are arranged from low to high. */
         performance_level->memory_clock = mclk_dep_table->entries
                         [state_entry->ucMemoryClockIndexLow].ulMclk;
-        performance_level->engine_clock = sclk_dep_table->entries
+        if (sclk_dep_table->ucRevId == 0)
+                performance_level->engine_clock = ((ATOM_Tonga_SCLK_Dependency_Table *)sclk_dep_table)->entries
+                        [state_entry->ucEngineClockIndexLow].ulSclk;
+        else if (sclk_dep_table->ucRevId == 1)
+                performance_level->engine_clock = ((ATOM_Polaris_SCLK_Dependency_Table *)sclk_dep_table)->entries
                         [state_entry->ucEngineClockIndexLow].ulSclk;
         performance_level->pcie_gen = get_pcie_gen_support(data->pcie_gen_cap,
                         state_entry->ucPCIEGenLow);
@@ -3586,8 +3673,14 @@ static int polaris10_get_pp_table_entry_callback_func(struct pp_hwmgr *hwmgr,
                         [polaris10_power_state->performance_level_count++]);
         performance_level->memory_clock = mclk_dep_table->entries
                         [state_entry->ucMemoryClockIndexHigh].ulMclk;
-        performance_level->engine_clock = sclk_dep_table->entries
+
+        if (sclk_dep_table->ucRevId == 0)
+                performance_level->engine_clock = ((ATOM_Tonga_SCLK_Dependency_Table *)sclk_dep_table)->entries
+                        [state_entry->ucEngineClockIndexHigh].ulSclk;
+        else if (sclk_dep_table->ucRevId == 1)
+                performance_level->engine_clock = ((ATOM_Polaris_SCLK_Dependency_Table *)sclk_dep_table)->entries
                         [state_entry->ucEngineClockIndexHigh].ulSclk;
+
         performance_level->pcie_gen = get_pcie_gen_support(data->pcie_gen_cap,
                         state_entry->ucPCIEGenHigh);
         performance_level->pcie_lane = get_pcie_lane_support(data->pcie_lane_cap,
@@ -3645,7 +3738,6 @@ static int polaris10_get_pp_table_entry(struct pp_hwmgr *hwmgr,
                 switch (state->classification.ui_label) {
                 case PP_StateUILabel_Performance:
                         data->use_pcie_performance_levels = true;
-
                         for (i = 0; i < ps->performance_level_count; i++) {
                                 if (data->pcie_gen_performance.max <
                                                 ps->performance_levels[i].pcie_gen)
@@ -3661,7 +3753,6 @@ static int polaris10_get_pp_table_entry(struct pp_hwmgr *hwmgr,
                                                 ps->performance_levels[i].pcie_lane)
                                         data->pcie_lane_performance.max =
                                                         ps->performance_levels[i].pcie_lane;
-
                                 if (data->pcie_lane_performance.min >
                                                 ps->performance_levels[i].pcie_lane)
                                         data->pcie_lane_performance.min =
@@ -4187,12 +4278,9 @@ int polaris10_update_samu_dpm(struct pp_hwmgr *hwmgr, bool bgate)
 {
         struct polaris10_hwmgr *data = (struct polaris10_hwmgr *)(hwmgr->backend);
         uint32_t mm_boot_level_offset, mm_boot_level_value;
-        struct phm_ppt_v1_information *table_info =
-                        (struct phm_ppt_v1_information *)(hwmgr->pptable);
 
         if (!bgate) {
-                data->smc_state_table.SamuBootLevel =
-                                (uint8_t) (table_info->mm_dep_table->count - 1);
+                data->smc_state_table.SamuBootLevel = 0;
                 mm_boot_level_offset = data->dpm_table_start +
                                 offsetof(SMU74_Discrete_DpmTable, SamuBootLevel);
                 mm_boot_level_offset /= 4;
@@ -4327,6 +4415,15 @@ static int polaris10_notify_link_speed_change_after_state_change(
         return 0;
 }
 
+static int polaris10_notify_smc_display(struct pp_hwmgr *hwmgr)
+{
+        struct polaris10_hwmgr *data = (struct polaris10_hwmgr *)(hwmgr->backend);
+
+        smum_send_msg_to_smc_with_parameter(hwmgr->smumgr,
+                (PPSMC_Msg)PPSMC_MSG_SetVBITimeout, data->frame_time_x2);
+        return (smum_send_msg_to_smc(hwmgr->smumgr, (PPSMC_Msg)PPSMC_HasDisplay) == 0) ?  0 : -EINVAL;
+}
+
 static int polaris10_set_power_state_tasks(struct pp_hwmgr *hwmgr, const void *input)
 {
         int tmp_result, result = 0;
@@ -4375,6 +4472,11 @@ static int polaris10_set_power_state_tasks(struct pp_hwmgr *hwmgr, const void *i
                         "Failed to program memory timing parameters!",
                         result = tmp_result);
 
+        tmp_result = polaris10_notify_smc_display(hwmgr);
+        PP_ASSERT_WITH_CODE((0 == tmp_result),
+                        "Failed to notify smc display settings!",
+                        result = tmp_result);
+
         tmp_result = polaris10_unfreeze_sclk_mclk_dpm(hwmgr);
         PP_ASSERT_WITH_CODE((0 == tmp_result),
                         "Failed to unfreeze SCLK MCLK DPM!",
@@ -4409,6 +4511,7 @@ static int polaris10_set_max_fan_pwm_output(struct pp_hwmgr *hwmgr, uint16_t us_
                         PPSMC_MSG_SetFanPwmMax, us_max_fan_pwm);
 }
 
+
 int polaris10_notify_smc_display_change(struct pp_hwmgr *hwmgr, bool has_display)
 {
         PPSMC_Msg msg = has_display ? (PPSMC_Msg)PPSMC_HasDisplay : (PPSMC_Msg)PPSMC_NoDisplay;
@@ -4428,8 +4531,6 @@ int polaris10_notify_smc_display_config_after_ps_adjustment(struct pp_hwmgr *hwm
 
         if (num_active_displays > 1)  /* to do && (pHwMgr->pPECI->displayConfiguration.bMultiMonitorInSync != TRUE)) */
                 polaris10_notify_smc_display_change(hwmgr, false);
-        else
-                polaris10_notify_smc_display_change(hwmgr, true);
 
         return 0;
 }
@@ -4470,6 +4571,8 @@ int polaris10_program_display_gap(struct pp_hwmgr *hwmgr)
         frame_time_in_us = 1000000 / refresh_rate;
 
         pre_vbi_time_in_us = frame_time_in_us - 200 - mode_info.vblank_time_us;
+        data->frame_time_x2 = frame_time_in_us * 2 / 100;
+
         display_gap2 = pre_vbi_time_in_us * (ref_clock / 100);
 
         cgs_write_ind_register(hwmgr->device, CGS_IND_REG__SMC, ixCG_DISPLAY_GAP_CNTL2, display_gap2);
@@ -4478,8 +4581,6 @@ int polaris10_program_display_gap(struct pp_hwmgr *hwmgr)
 
         cgs_write_ind_register(hwmgr->device, CGS_IND_REG__SMC, data->soft_regs_start + offsetof(SMU74_SoftRegisters, VBlankTimeout), (frame_time_in_us - pre_vbi_time_in_us));
 
-        polaris10_notify_smc_display_change(hwmgr, num_active_displays != 0);
-
         return 0;
 }
 
@@ -4591,7 +4692,7 @@ int polaris10_upload_mc_firmware(struct pp_hwmgr *hwmgr)
                 return 0;
         }
 
-        data->need_long_memory_training = true;
+        data->need_long_memory_training = false;
 
 /*
  *      PPMCME_FirmwareDescriptorEntry *pfd = NULL;
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/polaris10_hwmgr.h b/drivers/gpu/drm/amd/powerplay/hwmgr/polaris10_hwmgr.h
index beedf35cbfa6..afc3434822d1 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/polaris10_hwmgr.h
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/polaris10_hwmgr.h
@@ -312,6 +312,10 @@ struct polaris10_hwmgr {
 
         /* soft pptable for re-uploading into smu */
         void *soft_pp_table;
+
+        uint32_t                              avfs_vdroop_override_setting;
+        bool                                  apply_avfs_cks_off_voltage;
+        uint32_t                              frame_time_x2;
 };
 
 /* To convert to Q8.8 format for firmware */
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/polaris10_powertune.c b/drivers/gpu/drm/amd/powerplay/hwmgr/polaris10_powertune.c
index 0b99ab3ba0c5..ae96f14b827c 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/polaris10_powertune.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/polaris10_powertune.c
@@ -286,7 +286,7 @@ int polaris10_populate_pm_fuses(struct pp_hwmgr *hwmgr)
 
                 if (polaris10_copy_bytes_to_smc(hwmgr->smumgr, pm_fuse_table_offset,
                                 (uint8_t *)&data->power_tune_table,
-                                sizeof(struct SMU74_Discrete_PmFuses), data->sram_end))
+                                (sizeof(struct SMU74_Discrete_PmFuses) - 92), data->sram_end))
                         PP_ASSERT_WITH_CODE(false,
                                         "Attempt to download PmFuseTable Failed!",
                                         return -EINVAL);
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/polaris10_thermal.c b/drivers/gpu/drm/amd/powerplay/hwmgr/polaris10_thermal.c
index aba167f7d167..b206632d4650 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/polaris10_thermal.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/polaris10_thermal.c
@@ -625,10 +625,14 @@ static int tf_polaris10_thermal_avfs_enable(struct pp_hwmgr *hwmgr,
         int ret;
         struct pp_smumgr *smumgr = (struct pp_smumgr *)(hwmgr->smumgr);
         struct polaris10_smumgr *smu_data = (struct polaris10_smumgr *)(smumgr->backend);
+        struct polaris10_hwmgr *data = (struct polaris10_hwmgr *)(hwmgr->backend);
 
-        if (smu_data->avfs.avfs_btc_status != AVFS_BTC_ENABLEAVFS)
+        if (smu_data->avfs.avfs_btc_status == AVFS_BTC_NOTSUPPORTED)
                 return 0;
 
+        ret = smum_send_msg_to_smc_with_parameter(hwmgr->smumgr,
+                        PPSMC_MSG_SetGBDroopSettings, data->avfs_vdroop_override_setting);
+
         ret = (smum_send_msg_to_smc(smumgr, PPSMC_MSG_EnableAvfs) == 0) ?
                         0 : -1;
 
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/pp_acpi.c b/drivers/gpu/drm/amd/powerplay/hwmgr/pp_acpi.c
index 58742e0d1492..a3c38bbd1e94 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/pp_acpi.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/pp_acpi.c
@@ -44,6 +44,20 @@ bool acpi_atcs_functions_supported(void *device, uint32_t index)
         return result == 0 ? (output_buf.function_bits & (1 << (index - 1))) != 0 : false;
 }
 
+bool acpi_atcs_notify_pcie_device_ready(void *device)
+{
+        int32_t temp_buffer = 1;
+
+        return cgs_call_acpi_method(device, CGS_ACPI_METHOD_ATCS,
+                                ATCS_FUNCTION_PCIE_DEVICE_READY_NOTIFICATION,
+                                                &temp_buffer,
+                                                NULL,
+                                                0,
+                                                sizeof(temp_buffer),
+                                                0);
+}
+
+
 int acpi_pcie_perf_request(void *device, uint8_t perf_req, bool advertise)
 {
         struct atcs_pref_req_input atcs_input;
@@ -52,7 +66,7 @@ int acpi_pcie_perf_request(void *device, uint8_t perf_req, bool advertise)
         int result;
         struct cgs_system_info info = {0};
 
-        if (!acpi_atcs_functions_supported(device, ATCS_FUNCTION_PCIE_PERFORMANCE_REQUEST))
+        if( 0 != acpi_atcs_notify_pcie_device_ready(device))
                 return -EINVAL;
 
         info.size = sizeof(struct cgs_system_info);
@@ -77,7 +91,7 @@ int acpi_pcie_perf_request(void *device, uint8_t perf_req, bool advertise)
                                                 ATCS_FUNCTION_PCIE_PERFORMANCE_REQUEST,
                                                 &atcs_input,
                                                 &atcs_output,
-                                                0,
+                                                1,
                                                 sizeof(atcs_input),
                                                 sizeof(atcs_output));
                 if (result != 0)
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c b/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c
index da9f5f1b6dc2..bf4e18fd3872 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c
@@ -1302,3 +1302,46 @@ int atomctrl_get_smc_sclk_range_table(struct pp_hwmgr *hwmgr, struct pp_atom_ctr
 
         return 0;
 }
+
+int atomctrl_get_avfs_information(struct pp_hwmgr *hwmgr, struct pp_atom_ctrl__avfs_parameters *param)
+{
+        ATOM_ASIC_PROFILING_INFO_V3_6 *profile = NULL;
+
+        if (param == NULL)
+                return -EINVAL;
+
+        profile = (ATOM_ASIC_PROFILING_INFO_V3_6 *)
+                        cgs_atom_get_data_table(hwmgr->device,
+                                        GetIndexIntoMasterTable(DATA, ASIC_ProfilingInfo),
+                                        NULL, NULL, NULL);
+        if (!profile)
+                return -1;
+
+        param->ulAVFS_meanNsigma_Acontant0 = profile->ulAVFS_meanNsigma_Acontant0;
+        param->ulAVFS_meanNsigma_Acontant1 = profile->ulAVFS_meanNsigma_Acontant1;
+        param->ulAVFS_meanNsigma_Acontant2 = profile->ulAVFS_meanNsigma_Acontant2;
+        param->usAVFS_meanNsigma_DC_tol_sigma = profile->usAVFS_meanNsigma_DC_tol_sigma;
+        param->usAVFS_meanNsigma_Platform_mean = profile->usAVFS_meanNsigma_Platform_mean;
+        param->usAVFS_meanNsigma_Platform_sigma = profile->usAVFS_meanNsigma_Platform_sigma;
+        param->ulGB_VDROOP_TABLE_CKSOFF_a0 = profile->ulGB_VDROOP_TABLE_CKSOFF_a0;
+        param->ulGB_VDROOP_TABLE_CKSOFF_a1 = profile->ulGB_VDROOP_TABLE_CKSOFF_a1;
+        param->ulGB_VDROOP_TABLE_CKSOFF_a2 = profile->ulGB_VDROOP_TABLE_CKSOFF_a2;
+        param->ulGB_VDROOP_TABLE_CKSON_a0 = profile->ulGB_VDROOP_TABLE_CKSON_a0;
+        param->ulGB_VDROOP_TABLE_CKSON_a1 = profile->ulGB_VDROOP_TABLE_CKSON_a1;
+        param->ulGB_VDROOP_TABLE_CKSON_a2 = profile->ulGB_VDROOP_TABLE_CKSON_a2;
+        param->ulAVFSGB_FUSE_TABLE_CKSOFF_m1 = profile->ulAVFSGB_FUSE_TABLE_CKSOFF_m1;
+        param->usAVFSGB_FUSE_TABLE_CKSOFF_m2 = profile->usAVFSGB_FUSE_TABLE_CKSOFF_m2;
+        param->ulAVFSGB_FUSE_TABLE_CKSOFF_b = profile->ulAVFSGB_FUSE_TABLE_CKSOFF_b;
+        param->ulAVFSGB_FUSE_TABLE_CKSON_m1 = profile->ulAVFSGB_FUSE_TABLE_CKSON_m1;
+        param->usAVFSGB_FUSE_TABLE_CKSON_m2 = profile->usAVFSGB_FUSE_TABLE_CKSON_m2;
+        param->ulAVFSGB_FUSE_TABLE_CKSON_b = profile->ulAVFSGB_FUSE_TABLE_CKSON_b;
+        param->usMaxVoltage_0_25mv = profile->usMaxVoltage_0_25mv;
+        param->ucEnableGB_VDROOP_TABLE_CKSOFF = profile->ucEnableGB_VDROOP_TABLE_CKSOFF;
+        param->ucEnableGB_VDROOP_TABLE_CKSON = profile->ucEnableGB_VDROOP_TABLE_CKSON;
+        param->ucEnableGB_FUSE_TABLE_CKSOFF = profile->ucEnableGB_FUSE_TABLE_CKSOFF;
+        param->ucEnableGB_FUSE_TABLE_CKSON = profile->ucEnableGB_FUSE_TABLE_CKSON;
+        param->usPSM_Age_ComFactor = profile->usPSM_Age_ComFactor;
+        param->ucEnableApplyAVFS_CKS_OFF_Voltage = profile->ucEnableApplyAVFS_CKS_OFF_Voltage;
+
+        return 0;
+}
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.h b/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.h
index d24ebb566905..248c5db5f380 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.h
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.h
@@ -250,6 +250,35 @@ struct pp_atomctrl_gpio_pin_assignment {
 };
 typedef struct pp_atomctrl_gpio_pin_assignment pp_atomctrl_gpio_pin_assignment;
 
+struct pp_atom_ctrl__avfs_parameters {
+        uint32_t  ulAVFS_meanNsigma_Acontant0;
+        uint32_t  ulAVFS_meanNsigma_Acontant1;
+        uint32_t  ulAVFS_meanNsigma_Acontant2;
+        uint16_t usAVFS_meanNsigma_DC_tol_sigma;
+        uint16_t usAVFS_meanNsigma_Platform_mean;
+        uint16_t usAVFS_meanNsigma_Platform_sigma;
+        uint32_t  ulGB_VDROOP_TABLE_CKSOFF_a0;
+        uint32_t  ulGB_VDROOP_TABLE_CKSOFF_a1;
+        uint32_t  ulGB_VDROOP_TABLE_CKSOFF_a2;
+        uint32_t  ulGB_VDROOP_TABLE_CKSON_a0;
+        uint32_t  ulGB_VDROOP_TABLE_CKSON_a1;
+        uint32_t  ulGB_VDROOP_TABLE_CKSON_a2;
+        uint32_t  ulAVFSGB_FUSE_TABLE_CKSOFF_m1;
+        uint16_t  usAVFSGB_FUSE_TABLE_CKSOFF_m2;
+        uint32_t  ulAVFSGB_FUSE_TABLE_CKSOFF_b;
+        uint32_t  ulAVFSGB_FUSE_TABLE_CKSON_m1;
+        uint16_t  usAVFSGB_FUSE_TABLE_CKSON_m2;
+        uint32_t  ulAVFSGB_FUSE_TABLE_CKSON_b;
+        uint16_t  usMaxVoltage_0_25mv;
+        uint8_t  ucEnableGB_VDROOP_TABLE_CKSOFF;
+        uint8_t  ucEnableGB_VDROOP_TABLE_CKSON;
+        uint8_t  ucEnableGB_FUSE_TABLE_CKSOFF;
+        uint8_t  ucEnableGB_FUSE_TABLE_CKSON;
+        uint16_t usPSM_Age_ComFactor;
+        uint8_t  ucEnableApplyAVFS_CKS_OFF_Voltage;
+        uint8_t  ucReserved;
+};
+
 extern bool atomctrl_get_pp_assign_pin(struct pp_hwmgr *hwmgr, const uint32_t pinId, pp_atomctrl_gpio_pin_assignment *gpio_pin_assignment);
 extern int atomctrl_get_voltage_evv_on_sclk(struct pp_hwmgr *hwmgr, uint8_t voltage_type, uint32_t sclk, uint16_t virtual_voltage_Id, uint16_t *voltage);
 extern uint32_t atomctrl_get_mpll_reference_clock(struct pp_hwmgr *hwmgr);
@@ -278,5 +307,8 @@ extern int atomctrl_set_ac_timing_ai(struct pp_hwmgr *hwmgr, uint32_t memory_clo
 extern int atomctrl_get_voltage_evv_on_sclk_ai(struct pp_hwmgr *hwmgr, uint8_t voltage_type,
                                 uint32_t sclk, uint16_t virtual_voltage_Id, uint16_t *voltage);
 extern int atomctrl_get_smc_sclk_range_table(struct pp_hwmgr *hwmgr, struct pp_atom_ctrl_sclk_range_table *table);
+
+extern int atomctrl_get_avfs_information(struct pp_hwmgr *hwmgr, struct pp_atom_ctrl__avfs_parameters *param);
+
 #endif
 
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/tonga_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/tonga_hwmgr.c
index 16fed487973b..233eb7f36c1d 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/tonga_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/tonga_hwmgr.c
@@ -2847,27 +2847,6 @@ static int tonga_setup_default_dpm_tables(struct pp_hwmgr *hwmgr)
                 }
         }
 
-        /* Initialize Vddc DPM table based on allow Vddc values.  And populate corresponding std values. */
-        for (i = 0; i < allowed_vdd_sclk_table->count; i++) {
-                data->dpm_table.vddc_table.dpm_levels[i].value = allowed_vdd_mclk_table->entries[i].vddc;
-                /* tonga_hwmgr->dpm_table.VddcTable.dpm_levels[i].param1 = stdVoltageTable->entries[i].Leakage; */
-                /* param1 is for corresponding std voltage */
-                data->dpm_table.vddc_table.dpm_levels[i].enabled = 1;
-        }
-        data->dpm_table.vddc_table.count = allowed_vdd_sclk_table->count;
-
-        if (NULL != allowed_vdd_mclk_table) {
-                /* Initialize Vddci DPM table based on allow Mclk values */
-                for (i = 0; i < allowed_vdd_mclk_table->count; i++) {
-                        data->dpm_table.vdd_ci_table.dpm_levels[i].value = allowed_vdd_mclk_table->entries[i].vddci;
-                        data->dpm_table.vdd_ci_table.dpm_levels[i].enabled = 1;
-                        data->dpm_table.mvdd_table.dpm_levels[i].value = allowed_vdd_mclk_table->entries[i].mvdd;
-                        data->dpm_table.mvdd_table.dpm_levels[i].enabled = 1;
-                }
-                data->dpm_table.vdd_ci_table.count = allowed_vdd_mclk_table->count;
-                data->dpm_table.mvdd_table.count = allowed_vdd_mclk_table->count;
-        }
-
         /* setup PCIE gen speed levels*/
         tonga_setup_default_pcie_tables(hwmgr);
 
@@ -4510,6 +4489,7 @@ int tonga_hwmgr_backend_init(struct pp_hwmgr *hwmgr)
         data->vdd_ci_control = TONGA_VOLTAGE_CONTROL_NONE;
         data->vdd_gfx_control = TONGA_VOLTAGE_CONTROL_NONE;
         data->mvdd_control = TONGA_VOLTAGE_CONTROL_NONE;
+        data->force_pcie_gen = PP_PCIEGenInvalid;
 
         if (atomctrl_is_voltage_controled_by_gpio_v3(hwmgr,
                                 VOLTAGE_TYPE_VDDC, VOLTAGE_OBJ_SVID2)) {
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/tonga_pptable.h b/drivers/gpu/drm/amd/powerplay/hwmgr/tonga_pptable.h
index 1b44f4e9b8f5..f127198aafc4 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/tonga_pptable.h
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/tonga_pptable.h
@@ -197,6 +197,22 @@ typedef struct _ATOM_Tonga_SCLK_Dependency_Table {
         ATOM_Tonga_SCLK_Dependency_Record entries[1];                            /* Dynamically allocate entries. */
 } ATOM_Tonga_SCLK_Dependency_Table;
 
+typedef struct _ATOM_Polaris_SCLK_Dependency_Record {
+        UCHAR  ucVddInd;                                                                                        /* Base voltage */
+        USHORT usVddcOffset;                                                                            /* Offset relative to base voltage */
+        ULONG ulSclk;
+        USHORT usEdcCurrent;
+        UCHAR  ucReliabilityTemperature;
+        UCHAR  ucCKSVOffsetandDisable;                  /* Bits 0~6: Voltage offset for CKS, Bit 7: Disable/enable for the SCLK level. */
+        ULONG  ulSclkOffset;
+} ATOM_Polaris_SCLK_Dependency_Record;
+
+typedef struct _ATOM_Polaris_SCLK_Dependency_Table {
+        UCHAR ucRevId;
+        UCHAR ucNumEntries;                                                     /* Number of entries. */
+        ATOM_Polaris_SCLK_Dependency_Record entries[1];                          /* Dynamically allocate entries. */
+} ATOM_Polaris_SCLK_Dependency_Table;
+
 typedef struct _ATOM_Tonga_PCIE_Record {
         UCHAR ucPCIEGenSpeed;
         UCHAR usPCIELaneWidth;
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/tonga_processpptables.c b/drivers/gpu/drm/amd/powerplay/hwmgr/tonga_processpptables.c
index 10e3630ee39d..671fdb4d615a 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/tonga_processpptables.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/tonga_processpptables.c
@@ -408,41 +408,78 @@ static int get_mclk_voltage_dependency_table(
 static int get_sclk_voltage_dependency_table(
                 struct pp_hwmgr *hwmgr,
                 phm_ppt_v1_clock_voltage_dependency_table **pp_tonga_sclk_dep_table,
-                const ATOM_Tonga_SCLK_Dependency_Table * sclk_dep_table
+                const PPTable_Generic_SubTable_Header *sclk_dep_table
                 )
 {
         uint32_t table_size, i;
         phm_ppt_v1_clock_voltage_dependency_table *sclk_table;
 
-        PP_ASSERT_WITH_CODE((0 != sclk_dep_table->ucNumEntries),
-                "Invalid PowerPlay Table!", return -1);
+        if (sclk_dep_table->ucRevId < 1) {
+                const ATOM_Tonga_SCLK_Dependency_Table *tonga_table =
+                            (ATOM_Tonga_SCLK_Dependency_Table *)sclk_dep_table;
 
-        table_size = sizeof(uint32_t) + sizeof(phm_ppt_v1_clock_voltage_dependency_record)
-                * sclk_dep_table->ucNumEntries;
+                PP_ASSERT_WITH_CODE((0 != tonga_table->ucNumEntries),
+                        "Invalid PowerPlay Table!", return -1);
 
-        sclk_table = (phm_ppt_v1_clock_voltage_dependency_table *)
-                kzalloc(table_size, GFP_KERNEL);
+                table_size = sizeof(uint32_t) + sizeof(phm_ppt_v1_clock_voltage_dependency_record)
+                        * tonga_table->ucNumEntries;
 
-        if (NULL == sclk_table)
-                return -ENOMEM;
+                sclk_table = (phm_ppt_v1_clock_voltage_dependency_table *)
+                        kzalloc(table_size, GFP_KERNEL);
 
-        memset(sclk_table, 0x00, table_size);
-
-        sclk_table->count = (uint32_t)sclk_dep_table->ucNumEntries;
-
-        for (i = 0; i < sclk_dep_table->ucNumEntries; i++) {
-                sclk_table->entries[i].vddInd =
-                        sclk_dep_table->entries[i].ucVddInd;
-                sclk_table->entries[i].vdd_offset =
-                        sclk_dep_table->entries[i].usVddcOffset;
-                sclk_table->entries[i].clk =
-                        sclk_dep_table->entries[i].ulSclk;
-                sclk_table->entries[i].cks_enable =
-                        (((sclk_dep_table->entries[i].ucCKSVOffsetandDisable & 0x80) >> 7) == 0) ? 1 : 0;
-                sclk_table->entries[i].cks_voffset =
-                        (sclk_dep_table->entries[i].ucCKSVOffsetandDisable & 0x7F);
-        }
+                if (NULL == sclk_table)
+                        return -ENOMEM;
+
+                memset(sclk_table, 0x00, table_size);
+
+                sclk_table->count = (uint32_t)tonga_table->ucNumEntries;
+
+                for (i = 0; i < tonga_table->ucNumEntries; i++) {
+                        sclk_table->entries[i].vddInd =
+                                tonga_table->entries[i].ucVddInd;
+                        sclk_table->entries[i].vdd_offset =
+                                tonga_table->entries[i].usVddcOffset;
+                        sclk_table->entries[i].clk =
+                                tonga_table->entries[i].ulSclk;
+                        sclk_table->entries[i].cks_enable =
+                                (((tonga_table->entries[i].ucCKSVOffsetandDisable & 0x80) >> 7) == 0) ? 1 : 0;
+                        sclk_table->entries[i].cks_voffset =
+                                (tonga_table->entries[i].ucCKSVOffsetandDisable & 0x7F);
+                }
+        } else {
+                const ATOM_Polaris_SCLK_Dependency_Table *polaris_table =
+                            (ATOM_Polaris_SCLK_Dependency_Table *)sclk_dep_table;
+
+                PP_ASSERT_WITH_CODE((0 != polaris_table->ucNumEntries),
+                        "Invalid PowerPlay Table!", return -1);
+
+                table_size = sizeof(uint32_t) + sizeof(phm_ppt_v1_clock_voltage_dependency_record)
+                        * polaris_table->ucNumEntries;
+
+                sclk_table = (phm_ppt_v1_clock_voltage_dependency_table *)
+                        kzalloc(table_size, GFP_KERNEL);
 
+                if (NULL == sclk_table)
+                        return -ENOMEM;
+
+                memset(sclk_table, 0x00, table_size);
+
+                sclk_table->count = (uint32_t)polaris_table->ucNumEntries;
+
+                for (i = 0; i < polaris_table->ucNumEntries; i++) {
+                        sclk_table->entries[i].vddInd =
+                                polaris_table->entries[i].ucVddInd;
+                        sclk_table->entries[i].vdd_offset =
+                                polaris_table->entries[i].usVddcOffset;
+                        sclk_table->entries[i].clk =
+                                polaris_table->entries[i].ulSclk;
+                        sclk_table->entries[i].cks_enable =
+                                (((polaris_table->entries[i].ucCKSVOffsetandDisable & 0x80) >> 7) == 0) ? 1 : 0;
+                        sclk_table->entries[i].cks_voffset =
+                                (polaris_table->entries[i].ucCKSVOffsetandDisable & 0x7F);
+                        sclk_table->entries[i].sclk_offset = polaris_table->entries[i].ulSclkOffset;
+                }
+        }
         *pp_tonga_sclk_dep_table = sclk_table;
 
         return 0;
@@ -708,8 +745,8 @@ static int init_clock_voltage_dependency(
         const ATOM_Tonga_MCLK_Dependency_Table *mclk_dep_table =
                 (const ATOM_Tonga_MCLK_Dependency_Table *)(((unsigned long) powerplay_table) +
                 le16_to_cpu(powerplay_table->usMclkDependencyTableOffset));
-        const ATOM_Tonga_SCLK_Dependency_Table *sclk_dep_table =
-                (const ATOM_Tonga_SCLK_Dependency_Table *)(((unsigned long) powerplay_table) +
+        const PPTable_Generic_SubTable_Header *sclk_dep_table =
+                (const PPTable_Generic_SubTable_Header *)(((unsigned long) powerplay_table) +
                 le16_to_cpu(powerplay_table->usSclkDependencyTableOffset));
         const ATOM_Tonga_Hard_Limit_Table *pHardLimits =
                 (const ATOM_Tonga_Hard_Limit_Table *)(((unsigned long) powerplay_table) +
@@ -1040,48 +1077,44 @@ int tonga_pp_tables_uninitialize(struct pp_hwmgr *hwmgr)
         struct phm_ppt_v1_information *pp_table_information =
                 (struct phm_ppt_v1_information *)(hwmgr->pptable);
 
-        if (NULL != hwmgr->soft_pp_table) {
-                kfree(hwmgr->soft_pp_table);
+        if (NULL != hwmgr->soft_pp_table)
                 hwmgr->soft_pp_table = NULL;
-        }
 
-        if (NULL != pp_table_information->vdd_dep_on_sclk)
-                pp_table_information->vdd_dep_on_sclk = NULL;
+        kfree(pp_table_information->vdd_dep_on_sclk);
+        pp_table_information->vdd_dep_on_sclk = NULL;
 
-        if (NULL != pp_table_information->vdd_dep_on_mclk)
-                pp_table_information->vdd_dep_on_mclk = NULL;
+        kfree(pp_table_information->vdd_dep_on_mclk);
+        pp_table_information->vdd_dep_on_mclk = NULL;
 
-        if (NULL != pp_table_information->valid_mclk_values)
-                pp_table_information->valid_mclk_values = NULL;
+        kfree(pp_table_information->valid_mclk_values);
+        pp_table_information->valid_mclk_values = NULL;
 
-        if (NULL != pp_table_information->valid_sclk_values)
-                pp_table_information->valid_sclk_values = NULL;
+        kfree(pp_table_information->valid_sclk_values);
+        pp_table_information->valid_sclk_values = NULL;
 
-        if (NULL != pp_table_information->vddc_lookup_table)
-                pp_table_information->vddc_lookup_table = NULL;
+        kfree(pp_table_information->vddc_lookup_table);
+        pp_table_information->vddc_lookup_table = NULL;
 
-        if (NULL != pp_table_information->vddgfx_lookup_table)
-                pp_table_information->vddgfx_lookup_table = NULL;
+        kfree(pp_table_information->vddgfx_lookup_table);
+        pp_table_information->vddgfx_lookup_table = NULL;
 
-        if (NULL != pp_table_information->mm_dep_table)
-                pp_table_information->mm_dep_table = NULL;
+        kfree(pp_table_information->mm_dep_table);
+        pp_table_information->mm_dep_table = NULL;
 
-        if (NULL != pp_table_information->cac_dtp_table)
-                pp_table_information->cac_dtp_table = NULL;
+        kfree(pp_table_information->cac_dtp_table);
+        pp_table_information->cac_dtp_table = NULL;
 
-        if (NULL != hwmgr->dyn_state.cac_dtp_table)
-                hwmgr->dyn_state.cac_dtp_table = NULL;
+        kfree(hwmgr->dyn_state.cac_dtp_table);
+        hwmgr->dyn_state.cac_dtp_table = NULL;
 
-        if (NULL != pp_table_information->ppm_parameter_table)
-                pp_table_information->ppm_parameter_table = NULL;
+        kfree(pp_table_information->ppm_parameter_table);
+        pp_table_information->ppm_parameter_table = NULL;
 
-        if (NULL != pp_table_information->pcie_table)
-                pp_table_information->pcie_table = NULL;
+        kfree(pp_table_information->pcie_table);
+        pp_table_information->pcie_table = NULL;
 
-        if (NULL != hwmgr->pptable) {
-                kfree(hwmgr->pptable);
-                hwmgr->pptable = NULL;
-        }
+        kfree(hwmgr->pptable);
+        hwmgr->pptable = NULL;
 
         return result;
 }
diff --git a/drivers/gpu/drm/amd/powerplay/inc/hwmgr.h b/drivers/gpu/drm/amd/powerplay/inc/hwmgr.h
index 28f571449495..77e8e33d5870 100644
--- a/drivers/gpu/drm/amd/powerplay/inc/hwmgr.h
+++ b/drivers/gpu/drm/amd/powerplay/inc/hwmgr.h
@@ -411,6 +411,8 @@ struct phm_cac_tdp_table {
         uint8_t  ucVr_I2C_Line;
         uint8_t  ucPlx_I2C_address;
         uint8_t  ucPlx_I2C_Line;
+        uint32_t usBoostPowerLimit;
+        uint8_t  ucCKS_LDO_REFSEL;
 };
 
 struct phm_ppm_table {
diff --git a/drivers/gpu/drm/amd/powerplay/inc/polaris10_ppsmc.h b/drivers/gpu/drm/amd/powerplay/inc/polaris10_ppsmc.h
index 0c6a413eaa5b..b8f4b73c322e 100644
--- a/drivers/gpu/drm/amd/powerplay/inc/polaris10_ppsmc.h
+++ b/drivers/gpu/drm/amd/powerplay/inc/polaris10_ppsmc.h
@@ -27,6 +27,7 @@
 
 #pragma pack(push, 1)
 
+#define PPSMC_MSG_SetGBDroopSettings          ((uint16_t) 0x305)
 
 #define PPSMC_SWSTATE_FLAG_DC                           0x01
 #define PPSMC_SWSTATE_FLAG_UVD                          0x02
@@ -391,6 +392,8 @@ typedef uint16_t PPSMC_Result;
 #define PPSMC_MSG_SetGpuPllDfsForSclk         ((uint16_t) 0x300)
 #define PPSMC_MSG_Didt_Block_Function             ((uint16_t) 0x301)
 
+#define PPSMC_MSG_SetVBITimeout               ((uint16_t) 0x306)
+
 #define PPSMC_MSG_SecureSRBMWrite             ((uint16_t) 0x600)
 #define PPSMC_MSG_SecureSRBMRead              ((uint16_t) 0x601)
 #define PPSMC_MSG_SetAddress                  ((uint16_t) 0x800)
diff --git a/drivers/gpu/drm/amd/powerplay/inc/pp_acpi.h b/drivers/gpu/drm/amd/powerplay/inc/pp_acpi.h
index 3bd5e69b9045..3df5de2cdab0 100644
--- a/drivers/gpu/drm/amd/powerplay/inc/pp_acpi.h
+++ b/drivers/gpu/drm/amd/powerplay/inc/pp_acpi.h
@@ -26,3 +26,4 @@ extern bool acpi_atcs_functions_supported(void *device,
 extern int acpi_pcie_perf_request(void *device,
                                                 uint8_t perf_req,
                                                 bool advertise);
+extern bool acpi_atcs_notify_pcie_device_ready(void *device);
diff --git a/drivers/gpu/drm/amd/powerplay/inc/smu74.h b/drivers/gpu/drm/amd/powerplay/inc/smu74.h
index 1a12d85b8e97..fd10a9fa843d 100644
--- a/drivers/gpu/drm/amd/powerplay/inc/smu74.h
+++ b/drivers/gpu/drm/amd/powerplay/inc/smu74.h
@@ -34,6 +34,30 @@
 #define SMU__NUM_LCLK_DPM_LEVELS 8
 #define SMU__NUM_PCIE_DPM_LEVELS 8
 
+#define EXP_M1  35
+#define EXP_M2  92821
+#define EXP_B   66629747
+
+#define EXP_M1_1  365
+#define EXP_M2_1  658700
+#define EXP_B_1   305506134
+
+#define EXP_M1_2  189
+#define EXP_M2_2  379692
+#define EXP_B_2   194609469
+
+#define EXP_M1_3  99
+#define EXP_M2_3  217915
+#define EXP_B_3   122255994
+
+#define EXP_M1_4  51
+#define EXP_M2_4  122643
+#define EXP_B_4   74893384
+
+#define EXP_M1_5  423
+#define EXP_M2_5  1103326
+#define EXP_B_5   728122621
+
 enum SID_OPTION {
         SID_OPTION_HI,
         SID_OPTION_LO,
@@ -548,20 +572,20 @@ struct SMU74_Firmware_Header {
         uint32_t CacConfigTable;
         uint32_t CacStatusTable;
 
-
         uint32_t mcRegisterTable;
 
-
         uint32_t mcArbDramTimingTable;
 
-
-
-
         uint32_t PmFuseTable;
         uint32_t Globals;
         uint32_t ClockStretcherTable;
         uint32_t VftTable;
-        uint32_t Reserved[21];
+        uint32_t Reserved1;
+        uint32_t AvfsTable;
+        uint32_t AvfsCksOffGbvTable;
+        uint32_t AvfsMeanNSigma;
+        uint32_t AvfsSclkOffsetTable;
+        uint32_t Reserved[16];
         uint32_t Signature;
 };
 
@@ -701,8 +725,6 @@ VR Config info is contained in dpmTable.VRConfig */
 struct SMU_ClockStretcherDataTableEntry {
         uint8_t minVID;
         uint8_t maxVID;
-
-
         uint16_t setting;
 };
 typedef struct SMU_ClockStretcherDataTableEntry SMU_ClockStretcherDataTableEntry;
@@ -769,6 +791,43 @@ struct VFT_TABLE_t {
 typedef struct VFT_TABLE_t VFT_TABLE_t;
 
 
+/* Total margin, root mean square of Fmax + DC + Platform */
+struct AVFS_Margin_t {
+        VFT_CELL_t Cell[NUM_VFT_COLUMNS];
+};
+typedef struct AVFS_Margin_t AVFS_Margin_t;
+
+#define BTCGB_VDROOP_TABLE_MAX_ENTRIES 2
+#define AVFSGB_VDROOP_TABLE_MAX_ENTRIES 2
+
+struct GB_VDROOP_TABLE_t {
+        int32_t a0;
+        int32_t a1;
+        int32_t a2;
+        uint32_t spare;
+};
+typedef struct GB_VDROOP_TABLE_t GB_VDROOP_TABLE_t;
+
+struct AVFS_CksOff_Gbv_t {
+        VFT_CELL_t Cell[NUM_VFT_COLUMNS];
+};
+typedef struct AVFS_CksOff_Gbv_t AVFS_CksOff_Gbv_t;
+
+struct AVFS_meanNsigma_t {
+        uint32_t Aconstant[3];
+        uint16_t DC_tol_sigma;
+        uint16_t Platform_mean;
+        uint16_t Platform_sigma;
+        uint16_t PSM_Age_CompFactor;
+        uint8_t  Static_Voltage_Offset[NUM_VFT_COLUMNS];
+};
+typedef struct AVFS_meanNsigma_t AVFS_meanNsigma_t;
+
+struct AVFS_Sclk_Offset_t {
+        uint16_t Sclk_Offset[8];
+};
+typedef struct AVFS_Sclk_Offset_t AVFS_Sclk_Offset_t;
+
 #endif
 
 
diff --git a/drivers/gpu/drm/amd/powerplay/inc/smu74_discrete.h b/drivers/gpu/drm/amd/powerplay/inc/smu74_discrete.h
index 0dfe82336dc7..899d6d8108c2 100644
--- a/drivers/gpu/drm/amd/powerplay/inc/smu74_discrete.h
+++ b/drivers/gpu/drm/amd/powerplay/inc/smu74_discrete.h
@@ -223,6 +223,16 @@ struct SMU74_Discrete_StateInfo {
 
 typedef struct SMU74_Discrete_StateInfo SMU74_Discrete_StateInfo;
 
+struct SMU_QuadraticCoeffs {
+        int32_t m1;
+        uint32_t b;
+
+        int16_t m2;
+        uint8_t m1_shift;
+        uint8_t m2_shift;
+};
+typedef struct SMU_QuadraticCoeffs SMU_QuadraticCoeffs;
+
 struct SMU74_Discrete_DpmTable {
 
         SMU74_PIDController                  GraphicsPIDController;
@@ -258,7 +268,15 @@ struct SMU74_Discrete_DpmTable {
         uint8_t                             ThermOutPolarity;
         uint8_t                             ThermOutMode;
         uint8_t                             BootPhases;
-        uint32_t                            Reserved[4];
+
+        uint8_t                             VRHotLevel;
+        uint8_t                             LdoRefSel;
+        uint8_t                             Reserved1[2];
+        uint16_t                            FanStartTemperature;
+        uint16_t                            FanStopTemperature;
+        uint16_t                            MaxVoltage;
+        uint16_t                            Reserved2;
+        uint32_t                            Reserved[1];
 
         SMU74_Discrete_GraphicsLevel        GraphicsLevel[SMU74_MAX_LEVELS_GRAPHICS];
         SMU74_Discrete_MemoryLevel          MemoryACPILevel;
@@ -347,6 +365,8 @@ struct SMU74_Discrete_DpmTable {
 
         uint32_t                            CurrSclkPllRange;
         sclkFcwRange_t                      SclkFcwRangeTable[NUM_SCLK_RANGE];
+        GB_VDROOP_TABLE_t                   BTCGB_VDROOP_TABLE[BTCGB_VDROOP_TABLE_MAX_ENTRIES];
+        SMU_QuadraticCoeffs                 AVFSGB_VDROOP_TABLE[AVFSGB_VDROOP_TABLE_MAX_ENTRIES];
 };
 
 typedef struct SMU74_Discrete_DpmTable SMU74_Discrete_DpmTable;
@@ -550,16 +570,6 @@ struct SMU7_AcpiScoreboard {
 
 typedef struct SMU7_AcpiScoreboard SMU7_AcpiScoreboard;
 
-struct SMU_QuadraticCoeffs {
-        int32_t m1;
-        uint32_t b;
-
-        int16_t m2;
-        uint8_t m1_shift;
-        uint8_t m2_shift;
-};
-typedef struct SMU_QuadraticCoeffs SMU_QuadraticCoeffs;
-
 struct SMU74_Discrete_PmFuses {
         uint8_t BapmVddCVidHiSidd[8];
         uint8_t BapmVddCVidLoSidd[8];
@@ -821,6 +831,17 @@ typedef struct SMU7_GfxCuPgScoreboard SMU7_GfxCuPgScoreboard;
 #define DB_PCC_SHIFT 26 
 #define DB_EDC_SHIFT 27
 
+#define BTCGB0_Vdroop_Enable_MASK  0x1
+#define BTCGB1_Vdroop_Enable_MASK  0x2
+#define AVFSGB0_Vdroop_Enable_MASK 0x4
+#define AVFSGB1_Vdroop_Enable_MASK 0x8
+
+#define BTCGB0_Vdroop_Enable_SHIFT  0
+#define BTCGB1_Vdroop_Enable_SHIFT  1
+#define AVFSGB0_Vdroop_Enable_SHIFT 2
+#define AVFSGB1_Vdroop_Enable_SHIFT 3
+
+
 #pragma pack(pop)
 
 
diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/fiji_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/fiji_smumgr.c
index 673a75c74e18..8e52a2e82db5 100644
--- a/drivers/gpu/drm/amd/powerplay/smumgr/fiji_smumgr.c
+++ b/drivers/gpu/drm/amd/powerplay/smumgr/fiji_smumgr.c
@@ -1006,10 +1006,16 @@ static int fiji_smu_init(struct pp_smumgr *smumgr)
 
 static int fiji_smu_fini(struct pp_smumgr *smumgr)
 {
+        struct fiji_smumgr *priv = (struct fiji_smumgr *)(smumgr->backend);
+
+        smu_free_memory(smumgr->device, (void *)priv->header_buffer.handle);
+
         if (smumgr->backend) {
                 kfree(smumgr->backend);
                 smumgr->backend = NULL;
         }
+
+        cgs_rel_firmware(smumgr->device, CGS_UCODE_ID_SMU);
         return 0;
 }
 
diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smumgr.c
index de618ead9db8..5dba7c509710 100644
--- a/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smumgr.c
+++ b/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smumgr.c
@@ -52,19 +52,18 @@
 static const SMU74_Discrete_GraphicsLevel avfs_graphics_level_polaris10[8] = {
         /*  Min      pcie   DeepSleep Activity  CgSpll      CgSpll    CcPwr  CcPwr  Sclk         Enabled      Enabled                       Voltage    Power */
         /* Voltage, DpmLevel, DivId,  Level,  FuncCntl3,  FuncCntl4,  DynRm, DynRm1 Did, Padding,ForActivity, ForThrottle, UpHyst, DownHyst, DownHyst, Throttle */
-        { 0x3c0fd047, 0x00, 0x03, 0x1e00, 0x00200410, 0x87020000, 0, 0, 0x16, 0, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, { 0x30750000, 0, 0, 0, 0, 0, 0, 0 } },
-        { 0xa00fd047, 0x01, 0x04, 0x1e00, 0x00800510, 0x87020000, 0, 0, 0x16, 0, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, { 0x409c0000, 0, 0, 0, 0, 0, 0, 0 } },
-        { 0x0410d047, 0x01, 0x00, 0x1e00, 0x00600410, 0x87020000, 0, 0, 0x0e, 0, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, { 0x50c30000, 0, 0, 0, 0, 0, 0, 0 } },
-        { 0x6810d047, 0x01, 0x00, 0x1e00, 0x00800410, 0x87020000, 0, 0, 0x0c, 0, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, { 0x60ea0000, 0, 0, 0, 0, 0, 0, 0 } },
-        { 0xcc10d047, 0x01, 0x00, 0x1e00, 0x00e00410, 0x87020000, 0, 0, 0x0c, 0, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, { 0xe8fd0000, 0, 0, 0, 0, 0, 0, 0 } },
-        { 0x3011d047, 0x01, 0x00, 0x1e00, 0x00400510, 0x87020000, 0, 0, 0x0c, 0, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, { 0x70110100, 0, 0, 0, 0, 0, 0, 0 } },
-        { 0x9411d047, 0x01, 0x00, 0x1e00, 0x00a00510, 0x87020000, 0, 0, 0x0c, 0, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, { 0xf8240100, 0, 0, 0, 0, 0, 0, 0 } },
-        { 0xf811d047, 0x01, 0x00, 0x1e00, 0x00000610, 0x87020000, 0, 0, 0x0c, 0, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, { 0x80380100, 0, 0, 0, 0, 0, 0, 0 } }
+        { 0x100ea446, 0x00, 0x03, 0x3200, 0, 0, 0, 0, 0, 0, 0x01, 0x01, 0x0a, 0x00, 0x00, 0x00, { 0x30750000, 0x3000, 0, 0x2600, 0, 0, 0x0004, 0x8f02, 0xffff, 0x2f00, 0x300e, 0x2700 } },
+        { 0x400ea446, 0x01, 0x04, 0x3200, 0, 0, 0, 0, 0, 0, 0x01, 0x01, 0x0a, 0x00, 0x00, 0x00, { 0x409c0000, 0x2000, 0, 0x1e00, 1, 1, 0x0004, 0x8300, 0xffff, 0x1f00, 0xcb5e, 0x1a00 } },
+        { 0x740ea446, 0x01, 0x00, 0x3200, 0, 0, 0, 0, 0, 0, 0x01, 0x01, 0x0a, 0x00, 0x00, 0x00, { 0x50c30000, 0x2800, 0, 0x2000, 1, 1, 0x0004, 0x0c02, 0xffff, 0x2700, 0x6433, 0x2100 } },
+        { 0xa40ea446, 0x01, 0x00, 0x3200, 0, 0, 0, 0, 0, 0, 0x01, 0x01, 0x0a, 0x00, 0x00, 0x00, { 0x60ea0000, 0x3000, 0, 0x2600, 1, 1, 0x0004, 0x8f02, 0xffff, 0x2f00, 0x300e, 0x2700 } },
+        { 0xd80ea446, 0x01, 0x00, 0x3200, 0, 0, 0, 0, 0, 0, 0x01, 0x01, 0x0a, 0x00, 0x00, 0x00, { 0x70110100, 0x3800, 0, 0x2c00, 1, 1, 0x0004, 0x1203, 0xffff, 0x3600, 0xc9e2, 0x2e00 } },
+        { 0x3c0fa446, 0x01, 0x00, 0x3200, 0, 0, 0, 0, 0, 0, 0x01, 0x01, 0x0a, 0x00, 0x00, 0x00, { 0x80380100, 0x2000, 0, 0x1e00, 2, 1, 0x0004, 0x8300, 0xffff, 0x1f00, 0xcb5e, 0x1a00 } },
+        { 0x6c0fa446, 0x01, 0x00, 0x3200, 0, 0, 0, 0, 0, 0, 0x01, 0x01, 0x0a, 0x00, 0x00, 0x00, { 0x905f0100, 0x2400, 0, 0x1e00, 2, 1, 0x0004, 0x8901, 0xffff, 0x2300, 0x314c, 0x1d00 } },
+        { 0xa00fa446, 0x01, 0x00, 0x3200, 0, 0, 0, 0, 0, 0, 0x01, 0x01, 0x0a, 0x00, 0x00, 0x00, { 0xa0860100, 0x2800, 0, 0x2000, 2, 1, 0x0004, 0x0c02, 0xffff, 0x2700, 0x6433, 0x2100 } }
 };
 
 static const SMU74_Discrete_MemoryLevel avfs_memory_level_polaris10 =
-        {0x50140000, 0x50140000, 0x00320000, 0x00, 0x00,
-         0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x0000, 0x00, 0x00};
+        {0x100ea446, 0, 0x30750000, 0x01, 0x01, 0x01, 0x00, 0x00, 0x64, 0x00, 0x00, 0x1f00, 0x00, 0x00};
 
 /**
 * Set the address for reading/writing the SMC SRAM space.
@@ -219,6 +218,18 @@ bool polaris10_is_smc_ram_running(struct pp_smumgr *smumgr)
         && (0x20100 <= cgs_read_ind_register(smumgr->device, CGS_IND_REG__SMC, ixSMC_PC_C)));
 }
 
+static bool polaris10_is_hw_avfs_present(struct pp_smumgr *smumgr)
+{
+        uint32_t efuse;
+
+        efuse = cgs_read_ind_register(smumgr->device, CGS_IND_REG__SMC, ixSMU_EFUSE_0 + (49*4));
+        efuse &= 0x00000001;
+        if (efuse)
+                return true;
+
+        return false;
+}
+
 /**
 * Send a message to the SMC, and wait for its response.
 *
@@ -228,21 +239,27 @@ bool polaris10_is_smc_ram_running(struct pp_smumgr *smumgr)
 */
 int polaris10_send_msg_to_smc(struct pp_smumgr *smumgr, uint16_t msg)
 {
+        int ret;
+
         if (!polaris10_is_smc_ram_running(smumgr))
                 return -1;
 
+
         SMUM_WAIT_FIELD_UNEQUAL(smumgr, SMC_RESP_0, SMC_RESP, 0);
 
-        if (1 != SMUM_READ_FIELD(smumgr->device, SMC_RESP_0, SMC_RESP))
-                printk("Failed to send Previous Message.\n");
+        ret = SMUM_READ_FIELD(smumgr->device, SMC_RESP_0, SMC_RESP);
 
+        if (ret != 1)
+                printk("\n failed to send pre message %x ret is %d \n",  msg, ret);
 
         cgs_write_register(smumgr->device, mmSMC_MESSAGE_0, msg);
 
         SMUM_WAIT_FIELD_UNEQUAL(smumgr, SMC_RESP_0, SMC_RESP, 0);
 
-        if (1 != SMUM_READ_FIELD(smumgr->device, SMC_RESP_0, SMC_RESP))
-                printk("Failed to send Message.\n");
+        ret = SMUM_READ_FIELD(smumgr->device, SMC_RESP_0, SMC_RESP);
+
+        if (ret != 1)
+                printk("\n failed to send message %x ret is %d \n",  msg, ret);
 
         return 0;
 }
@@ -469,6 +486,7 @@ int polaris10_smu_fini(struct pp_smumgr *smumgr)
                 kfree(smumgr->backend);
                 smumgr->backend = NULL;
         }
+        cgs_rel_firmware(smumgr->device, CGS_UCODE_ID_SMU);
         return 0;
 }
 
@@ -952,6 +970,11 @@ static int polaris10_smu_init(struct pp_smumgr *smumgr)
                 (cgs_handle_t)smu_data->smu_buffer.handle);
                 return -1;);
 
+        if (polaris10_is_hw_avfs_present(smumgr))
+                smu_data->avfs.avfs_btc_status = AVFS_BTC_BOOT;
+        else
+                smu_data->avfs.avfs_btc_status = AVFS_BTC_NOTSUPPORTED;
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/smumgr.c
index c483baf6b4fb..0728c1e3d97a 100644
--- a/drivers/gpu/drm/amd/powerplay/smumgr/smumgr.c
+++ b/drivers/gpu/drm/amd/powerplay/smumgr/smumgr.c
@@ -81,6 +81,7 @@ int smum_init(struct amd_pp_init *pp_init, struct pp_instance *handle)
 
 int smum_fini(struct pp_smumgr *smumgr)
 {
+        kfree(smumgr->device);
         kfree(smumgr);
         return 0;
 }
diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/tonga_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/tonga_smumgr.c
index 32820b680d88..b22722eabafc 100644
--- a/drivers/gpu/drm/amd/powerplay/smumgr/tonga_smumgr.c
+++ b/drivers/gpu/drm/amd/powerplay/smumgr/tonga_smumgr.c
@@ -328,10 +328,17 @@ int tonga_write_smc_sram_dword(struct pp_smumgr *smumgr,
 
 static int tonga_smu_fini(struct pp_smumgr *smumgr)
 {
+        struct tonga_smumgr *priv = (struct tonga_smumgr *)(smumgr->backend);
+
+        smu_free_memory(smumgr->device, (void *)priv->smu_buffer.handle);
+        smu_free_memory(smumgr->device, (void *)priv->header_buffer.handle);
+
         if (smumgr->backend != NULL) {
                 kfree(smumgr->backend);
                 smumgr->backend = NULL;
         }
+
+        cgs_rel_firmware(smumgr->device, CGS_UCODE_ID_SMU);
         return 0;
 }
 
diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_output.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_output.c
index 39802c0539b6..3d34fc4ca826 100644
--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_output.c
+++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_output.c
@@ -266,9 +266,10 @@ int atmel_hlcdc_create_outputs(struct drm_device *dev)
                 if (!ret)
                         ret = atmel_hlcdc_check_endpoint(dev, &ep);
 
-                of_node_put(ep_np);
-                if (ret)
+                if (ret) {
+                        of_node_put(ep_np);
                         return ret;
+                }
         }
 
         for_each_endpoint_of_node(dev->dev->of_node, ep_np) {
@@ -276,9 +277,10 @@ int atmel_hlcdc_create_outputs(struct drm_device *dev)
                 if (!ret)
                         ret = atmel_hlcdc_attach_endpoint(dev, &ep);
 
-                of_node_put(ep_np);
-                if (ret)
+                if (ret) {
+                        of_node_put(ep_np);
                         return ret;
+                }
         }
 
         return 0;
diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
index aef3ca8a81fa..016c191221f3 100644
--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
@@ -339,6 +339,8 @@ atmel_hlcdc_plane_update_pos_and_size(struct atmel_hlcdc_plane *plane,
 
                 atmel_hlcdc_layer_update_cfg(&plane->layer, 13, 0xffffffff,
                                              factor_reg);
+        } else {
+                atmel_hlcdc_layer_update_cfg(&plane->layer, 13, 0xffffffff, 0);
         }
 }
 
diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c
index c204ef32df16..9bb99e274d23 100644
--- a/drivers/gpu/drm/drm_atomic.c
+++ b/drivers/gpu/drm/drm_atomic.c
@@ -1296,14 +1296,39 @@ EXPORT_SYMBOL(drm_atomic_add_affected_planes);
  */
 void drm_atomic_legacy_backoff(struct drm_atomic_state *state)
 {
+        struct drm_device *dev = state->dev;
+        unsigned crtc_mask = 0;
+        struct drm_crtc *crtc;
         int ret;
+        bool global = false;
+
+        drm_for_each_crtc(crtc, dev) {
+                if (crtc->acquire_ctx != state->acquire_ctx)
+                        continue;
+
+                crtc_mask |= drm_crtc_mask(crtc);
+                crtc->acquire_ctx = NULL;
+        }
+
+        if (WARN_ON(dev->mode_config.acquire_ctx == state->acquire_ctx)) {
+                global = true;
+
+                dev->mode_config.acquire_ctx = NULL;
+        }
 
 retry:
         drm_modeset_backoff(state->acquire_ctx);
 
-        ret = drm_modeset_lock_all_ctx(state->dev, state->acquire_ctx);
+        ret = drm_modeset_lock_all_ctx(dev, state->acquire_ctx);
         if (ret)
                 goto retry;
+
+        drm_for_each_crtc(crtc, dev)
+                if (drm_crtc_mask(crtc) & crtc_mask)
+                        crtc->acquire_ctx = state->acquire_ctx;
+
+        if (global)
+                dev->mode_config.acquire_ctx = state->acquire_ctx;
 }
 EXPORT_SYMBOL(drm_atomic_legacy_backoff);
 
diff --git a/drivers/gpu/drm/drm_crtc_helper.c b/drivers/gpu/drm/drm_crtc_helper.c
index a6e42433ef0e..26feb2f8453f 100644
--- a/drivers/gpu/drm/drm_crtc_helper.c
+++ b/drivers/gpu/drm/drm_crtc_helper.c
@@ -528,11 +528,11 @@ drm_crtc_helper_disable(struct drm_crtc *crtc)
 int drm_crtc_helper_set_config(struct drm_mode_set *set)
 {
         struct drm_device *dev;
-        struct drm_crtc *new_crtc;
-        struct drm_encoder *save_encoders, *new_encoder, *encoder;
+        struct drm_crtc **save_encoder_crtcs, *new_crtc;
+        struct drm_encoder **save_connector_encoders, *new_encoder, *encoder;
         bool mode_changed = false; /* if true do a full mode set */
         bool fb_changed = false; /* if true and !mode_changed just do a flip */
-        struct drm_connector *save_connectors, *connector;
+        struct drm_connector *connector;
         int count = 0, ro, fail = 0;
         const struct drm_crtc_helper_funcs *crtc_funcs;
         struct drm_mode_set save_set;
@@ -574,15 +574,15 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
          * Allocate space for the backup of all (non-pointer) encoder and
          * connector data.
          */
-        save_encoders = kzalloc(dev->mode_config.num_encoder *
-                                sizeof(struct drm_encoder), GFP_KERNEL);
-        if (!save_encoders)
+        save_encoder_crtcs = kzalloc(dev->mode_config.num_encoder *
+                                sizeof(struct drm_crtc *), GFP_KERNEL);
+        if (!save_encoder_crtcs)
                 return -ENOMEM;
 
-        save_connectors = kzalloc(dev->mode_config.num_connector *
-                                sizeof(struct drm_connector), GFP_KERNEL);
-        if (!save_connectors) {
-                kfree(save_encoders);
+        save_connector_encoders = kzalloc(dev->mode_config.num_connector *
+                                sizeof(struct drm_encoder *), GFP_KERNEL);
+        if (!save_connector_encoders) {
+                kfree(save_encoder_crtcs);
                 return -ENOMEM;
         }
 
@@ -593,12 +593,12 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
          */
         count = 0;
         drm_for_each_encoder(encoder, dev) {
-                save_encoders[count++] = *encoder;
+                save_encoder_crtcs[count++] = encoder->crtc;
         }
 
         count = 0;
         drm_for_each_connector(connector, dev) {
-                save_connectors[count++] = *connector;
+                save_connector_encoders[count++] = connector->encoder;
         }
 
         save_set.crtc = set->crtc;
@@ -631,8 +631,12 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
                 mode_changed = true;
         }
 
-        /* take a reference on all connectors in set */
+        /* take a reference on all unbound connectors in set, reuse the
+         * already taken reference for bound connectors
+         */
         for (ro = 0; ro < set->num_connectors; ro++) {
+                if (set->connectors[ro]->encoder)
+                        continue;
                 drm_connector_reference(set->connectors[ro]);
         }
 
@@ -754,30 +758,28 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
                 }
         }
 
-        /* after fail drop reference on all connectors in save set */
-        count = 0;
-        drm_for_each_connector(connector, dev) {
-                drm_connector_unreference(&save_connectors[count++]);
-        }
-
-        kfree(save_connectors);
-        kfree(save_encoders);
+        kfree(save_connector_encoders);
+        kfree(save_encoder_crtcs);
         return 0;
 
 fail:
         /* Restore all previous data. */
         count = 0;
         drm_for_each_encoder(encoder, dev) {
-                *encoder = save_encoders[count++];
+                encoder->crtc = save_encoder_crtcs[count++];
         }
 
         count = 0;
         drm_for_each_connector(connector, dev) {
-                *connector = save_connectors[count++];
+                connector->encoder = save_connector_encoders[count++];
         }
 
-        /* after fail drop reference on all connectors in set */
+        /* after fail drop reference on all unbound connectors in set, let
+         * bound connectors keep their reference
+         */
         for (ro = 0; ro < set->num_connectors; ro++) {
+                if (set->connectors[ro]->encoder)
+                        continue;
                 drm_connector_unreference(set->connectors[ro]);
         }
 
@@ -787,8 +789,8 @@ fail:
                                       save_set.y, save_set.fb))
                 DRM_ERROR("failed to restore config after modeset failure\n");
 
-        kfree(save_connectors);
-        kfree(save_encoders);
+        kfree(save_connector_encoders);
+        kfree(save_encoder_crtcs);
         return ret;
 }
 EXPORT_SYMBOL(drm_crtc_helper_set_config);
diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
index a13edf5de2d6..6537908050d7 100644
--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -2927,11 +2927,9 @@ static void drm_dp_destroy_connector_work(struct work_struct *work)
                 drm_dp_port_teardown_pdt(port, port->pdt);
 
                 if (!port->input && port->vcpi.vcpi > 0) {
-                        if (mgr->mst_state) {
-                                drm_dp_mst_reset_vcpi_slots(mgr, port);
-                                drm_dp_update_payload_part1(mgr);
-                                drm_dp_mst_put_payload_id(mgr, port->vcpi.vcpi);
-                        }
+                        drm_dp_mst_reset_vcpi_slots(mgr, port);
+                        drm_dp_update_payload_part1(mgr);
+                        drm_dp_mst_put_payload_id(mgr, port->vcpi.vcpi);
                 }
 
                 kref_put(&port->kref, drm_dp_free_mst_port);
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_iommu.c b/drivers/gpu/drm/etnaviv/etnaviv_iommu.c
index 522cfd447892..16353ee81651 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_iommu.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_iommu.c
@@ -225,6 +225,7 @@ struct iommu_domain *etnaviv_iommu_domain_alloc(struct etnaviv_gpu *gpu)
 
         etnaviv_domain->domain.type = __IOMMU_DOMAIN_PAGING;
         etnaviv_domain->domain.ops = &etnaviv_iommu_ops.ops;
+        etnaviv_domain->domain.pgsize_bitmap = SZ_4K;
         etnaviv_domain->domain.geometry.aperture_start = GPU_MEM_START;
         etnaviv_domain->domain.geometry.aperture_end = GPU_MEM_START + PT_ENTRIES * SZ_4K - 1;
 
diff --git a/drivers/gpu/drm/exynos/exynos7_drm_decon.c b/drivers/gpu/drm/exynos/exynos7_drm_decon.c
index f6223f907c15..7f9901b7777b 100644
--- a/drivers/gpu/drm/exynos/exynos7_drm_decon.c
+++ b/drivers/gpu/drm/exynos/exynos7_drm_decon.c
@@ -31,7 +31,6 @@
 #include "exynos_drm_plane.h"
 #include "exynos_drm_drv.h"
 #include "exynos_drm_fb.h"
-#include "exynos_drm_fbdev.h"
 #include "exynos_drm_iommu.h"
 
 /*
diff --git a/drivers/gpu/drm/exynos/exynos_dp.c b/drivers/gpu/drm/exynos/exynos_dp.c
index 468498e3fec1..4c1fb3f8b5a6 100644
--- a/drivers/gpu/drm/exynos/exynos_dp.c
+++ b/drivers/gpu/drm/exynos/exynos_dp.c
@@ -34,7 +34,7 @@
 
 struct exynos_dp_device {
         struct drm_encoder         encoder;
-        struct drm_connector       connector;
+        struct drm_connector       *connector;
         struct drm_bridge          *ptn_bridge;
         struct drm_device          *drm_dev;
         struct device              *dev;
@@ -70,7 +70,7 @@ static int exynos_dp_poweroff(struct analogix_dp_plat_data *plat_data)
 static int exynos_dp_get_modes(struct analogix_dp_plat_data *plat_data)
 {
         struct exynos_dp_device *dp = to_dp(plat_data);
-        struct drm_connector *connector = &dp->connector;
+        struct drm_connector *connector = dp->connector;
         struct drm_display_mode *mode;
         int num_modes = 0;
 
@@ -103,6 +103,7 @@ static int exynos_dp_bridge_attach(struct analogix_dp_plat_data *plat_data,
         int ret;
 
         drm_connector_register(connector);
+        dp->connector = connector;
 
         /* Pre-empt DP connector creation if there's a bridge */
         if (dp->ptn_bridge) {
diff --git a/drivers/gpu/drm/exynos/exynos_drm_core.c b/drivers/gpu/drm/exynos/exynos_drm_core.c
index 011211e4167d..edbd98ff293e 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_core.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_core.c
@@ -15,7 +15,6 @@
 #include <drm/drmP.h>
 #include "exynos_drm_drv.h"
 #include "exynos_drm_crtc.h"
-#include "exynos_drm_fbdev.h"
 
 static LIST_HEAD(exynos_drm_subdrv_list);
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimd.c b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
index 3efe1aa89416..d47216488985 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fimd.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
@@ -30,7 +30,6 @@
 
 #include "exynos_drm_drv.h"
 #include "exynos_drm_fb.h"
-#include "exynos_drm_fbdev.h"
 #include "exynos_drm_crtc.h"
 #include "exynos_drm_plane.h"
 #include "exynos_drm_iommu.h"
@@ -120,7 +119,6 @@ static struct fimd_driver_data s3c64xx_fimd_driver_data = {
         .timing_base = 0x0,
         .has_clksel = 1,
         .has_limited_fmt = 1,
-        .has_hw_trigger = 1,
 };
 
 static struct fimd_driver_data exynos3_fimd_driver_data = {
@@ -171,14 +169,11 @@ static struct fimd_driver_data exynos5420_fimd_driver_data = {
         .lcdblk_vt_shift = 24,
         .lcdblk_bypass_shift = 15,
         .lcdblk_mic_bypass_shift = 11,
-        .trg_type = I80_HW_TRG,
         .has_shadowcon = 1,
         .has_vidoutcon = 1,
         .has_vtsel = 1,
         .has_mic_bypass = 1,
         .has_dp_clk = 1,
-        .has_hw_trigger = 1,
-        .has_trigger_per_te = 1,
 };
 
 struct fimd_context {
diff --git a/drivers/gpu/drm/exynos/exynos_drm_g2d.c b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
index 493552368295..8564c3da0d22 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_g2d.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
@@ -48,13 +48,13 @@
 
 /* registers for base address */
 #define G2D_SRC_BASE_ADDR               0x0304
-#define G2D_SRC_STRIDE_REG              0x0308
+#define G2D_SRC_STRIDE                  0x0308
 #define G2D_SRC_COLOR_MODE              0x030C
 #define G2D_SRC_LEFT_TOP                0x0310
 #define G2D_SRC_RIGHT_BOTTOM            0x0314
 #define G2D_SRC_PLANE2_BASE_ADDR        0x0318
 #define G2D_DST_BASE_ADDR               0x0404
-#define G2D_DST_STRIDE_REG              0x0408
+#define G2D_DST_STRIDE                  0x0408
 #define G2D_DST_COLOR_MODE              0x040C
 #define G2D_DST_LEFT_TOP                0x0410
 #define G2D_DST_RIGHT_BOTTOM            0x0414
@@ -563,7 +563,7 @@ static enum g2d_reg_type g2d_get_reg_type(int reg_offset)
 
         switch (reg_offset) {
         case G2D_SRC_BASE_ADDR:
-        case G2D_SRC_STRIDE_REG:
+        case G2D_SRC_STRIDE:
         case G2D_SRC_COLOR_MODE:
         case G2D_SRC_LEFT_TOP:
         case G2D_SRC_RIGHT_BOTTOM:
@@ -573,7 +573,7 @@ static enum g2d_reg_type g2d_get_reg_type(int reg_offset)
                 reg_type = REG_TYPE_SRC_PLANE2;
                 break;
         case G2D_DST_BASE_ADDR:
-        case G2D_DST_STRIDE_REG:
+        case G2D_DST_STRIDE:
         case G2D_DST_COLOR_MODE:
         case G2D_DST_LEFT_TOP:
         case G2D_DST_RIGHT_BOTTOM:
@@ -968,8 +968,8 @@ static int g2d_check_reg_offset(struct device *dev,
                         } else
                                 buf_info->types[reg_type] = BUF_TYPE_GEM;
                         break;
-                case G2D_SRC_STRIDE_REG:
-                case G2D_DST_STRIDE_REG:
+                case G2D_SRC_STRIDE:
+                case G2D_DST_STRIDE:
                         if (for_addr)
                                 goto err;
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_plane.c b/drivers/gpu/drm/exynos/exynos_drm_plane.c
index 55f1d37c666a..77f12c00abf9 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_plane.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_plane.c
@@ -242,7 +242,7 @@ exynos_drm_plane_check_size(const struct exynos_drm_plane_config *config,
             state->v_ratio == (1 << 15))
                 height_ok = true;
 
-        if (width_ok & height_ok)
+        if (width_ok && height_ok)
                 return 0;
 
         DRM_DEBUG_KMS("scaling mode is not supported");
diff --git a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c
index 0ec1ad961e0d..dc723f7ead7d 100644
--- a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c
+++ b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c
@@ -42,9 +42,10 @@ static const struct regmap_config fsl_dcu_regmap_config = {
         .reg_bits = 32,
         .reg_stride = 4,
         .val_bits = 32,
-        .cache_type = REGCACHE_RBTREE,
+        .cache_type = REGCACHE_FLAT,
 
         .volatile_reg = fsl_dcu_drm_is_volatile_reg,
+        .max_register = 0x11fc,
 };
 
 static int fsl_dcu_drm_irq_init(struct drm_device *dev)
diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index 32690332d441..103546834b60 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -2365,16 +2365,16 @@ static int i915_ppgtt_info(struct seq_file *m, void *data)
                 task = get_pid_task(file->pid, PIDTYPE_PID);
                 if (!task) {
                         ret = -ESRCH;
-                        goto out_put;
+                        goto out_unlock;
                 }
                 seq_printf(m, "\nproc: %s\n", task->comm);
                 put_task_struct(task);
                 idr_for_each(&file_priv->context_idr, per_file_ctx,
                              (void *)(unsigned long)m);
         }
+out_unlock:
         mutex_unlock(&dev->filelist_mutex);
 
-out_put:
         intel_runtime_pm_put(dev_priv);
         mutex_unlock(&dev->struct_mutex);
 
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 5faacc6e548d..7c334e902266 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -3481,6 +3481,7 @@ int intel_bios_init(struct drm_i915_private *dev_priv);
 bool intel_bios_is_valid_vbt(const void *buf, size_t size);
 bool intel_bios_is_tv_present(struct drm_i915_private *dev_priv);
 bool intel_bios_is_lvds_present(struct drm_i915_private *dev_priv, u8 *i2c_pin);
+bool intel_bios_is_port_present(struct drm_i915_private *dev_priv, enum port port);
 bool intel_bios_is_port_edp(struct drm_i915_private *dev_priv, enum port port);
 bool intel_bios_is_port_dp_dual_mode(struct drm_i915_private *dev_priv, enum port port);
 bool intel_bios_is_dsi_present(struct drm_i915_private *dev_priv, enum port *port);
diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
index b235b6e88ead..b9022fa053d6 100644
--- a/drivers/gpu/drm/i915/intel_bios.c
+++ b/drivers/gpu/drm/i915/intel_bios.c
@@ -139,6 +139,11 @@ fill_detail_timing_data(struct drm_display_mode *panel_fixed_mode,
         else
                 panel_fixed_mode->flags |= DRM_MODE_FLAG_NVSYNC;
 
+        panel_fixed_mode->width_mm = (dvo_timing->himage_hi << 8) |
+                dvo_timing->himage_lo;
+        panel_fixed_mode->height_mm = (dvo_timing->vimage_hi << 8) |
+                dvo_timing->vimage_lo;
+
         /* Some VBTs have bogus h/vtotal values */
         if (panel_fixed_mode->hsync_end > panel_fixed_mode->htotal)
                 panel_fixed_mode->htotal = panel_fixed_mode->hsync_end + 1;
@@ -1187,7 +1192,7 @@ parse_device_mapping(struct drm_i915_private *dev_priv,
         }
         if (bdb->version < 106) {
                 expected_size = 22;
-        } else if (bdb->version < 109) {
+        } else if (bdb->version < 111) {
                 expected_size = 27;
         } else if (bdb->version < 195) {
                 BUILD_BUG_ON(sizeof(struct old_child_dev_config) != 33);
@@ -1546,6 +1551,45 @@ bool intel_bios_is_lvds_present(struct drm_i915_private *dev_priv, u8 *i2c_pin)
 }
 
 /**
+ * intel_bios_is_port_present - is the specified digital port present
+ * @dev_priv:   i915 device instance
+ * @port:       port to check
+ *
+ * Return true if the device in %port is present.
+ */
+bool intel_bios_is_port_present(struct drm_i915_private *dev_priv, enum port port)
+{
+        static const struct {
+                u16 dp, hdmi;
+        } port_mapping[] = {
+                [PORT_B] = { DVO_PORT_DPB, DVO_PORT_HDMIB, },
+                [PORT_C] = { DVO_PORT_DPC, DVO_PORT_HDMIC, },
+                [PORT_D] = { DVO_PORT_DPD, DVO_PORT_HDMID, },
+                [PORT_E] = { DVO_PORT_DPE, DVO_PORT_HDMIE, },
+        };
+        int i;
+
+        /* FIXME maybe deal with port A as well? */
+        if (WARN_ON(port == PORT_A) || port >= ARRAY_SIZE(port_mapping))
+                return false;
+
+        if (!dev_priv->vbt.child_dev_num)
+                return false;
+
+        for (i = 0; i < dev_priv->vbt.child_dev_num; i++) {
+                const union child_device_config *p_child =
+                        &dev_priv->vbt.child_dev[i];
+                if ((p_child->common.dvo_port == port_mapping[port].dp ||
+                     p_child->common.dvo_port == port_mapping[port].hdmi) &&
+                    (p_child->common.device_type & (DEVICE_TYPE_TMDS_DVI_SIGNALING |
+                                                    DEVICE_TYPE_DISPLAYPORT_OUTPUT)))
+                        return true;
+        }
+
+        return false;
+}
+
+/**
  * intel_bios_is_port_edp - is the device in given port eDP
  * @dev_priv:   i915 device instance
  * @port:       port to check
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 2113f401f0ba..04452cf3eae8 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -8275,12 +8275,14 @@ static void ironlake_init_pch_refclk(struct drm_device *dev)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
         struct intel_encoder *encoder;
+        int i;
         u32 val, final;
         bool has_lvds = false;
         bool has_cpu_edp = false;
         bool has_panel = false;
         bool has_ck505 = false;
         bool can_ssc = false;
+        bool using_ssc_source = false;
 
         /* We need to take the global config into account */
         for_each_intel_encoder(dev, encoder) {
@@ -8307,8 +8309,22 @@ static void ironlake_init_pch_refclk(struct drm_device *dev)
                 can_ssc = true;
         }
 
-        DRM_DEBUG_KMS("has_panel %d has_lvds %d has_ck505 %d\n",
-                      has_panel, has_lvds, has_ck505);
+        /* Check if any DPLLs are using the SSC source */
+        for (i = 0; i < dev_priv->num_shared_dpll; i++) {
+                u32 temp = I915_READ(PCH_DPLL(i));
+
+                if (!(temp & DPLL_VCO_ENABLE))
+                        continue;
+
+                if ((temp & PLL_REF_INPUT_MASK) ==
+                    PLLB_REF_INPUT_SPREADSPECTRUMIN) {
+                        using_ssc_source = true;
+                        break;
+                }
+        }
+
+        DRM_DEBUG_KMS("has_panel %d has_lvds %d has_ck505 %d using_ssc_source %d\n",
+                      has_panel, has_lvds, has_ck505, using_ssc_source);
 
         /* Ironlake: try to setup display ref clock before DPLL
          * enabling. This is only under driver's control after
@@ -8345,9 +8361,9 @@ static void ironlake_init_pch_refclk(struct drm_device *dev)
                                 final |= DREF_CPU_SOURCE_OUTPUT_NONSPREAD;
                 } else
                         final |= DREF_CPU_SOURCE_OUTPUT_DISABLE;
-        } else {
-                final |= DREF_SSC_SOURCE_DISABLE;
-                final |= DREF_CPU_SOURCE_OUTPUT_DISABLE;
+        } else if (using_ssc_source) {
+                final |= DREF_SSC_SOURCE_ENABLE;
+                final |= DREF_SSC1_ENABLE;
         }
 
         if (final == val)
@@ -8393,7 +8409,7 @@ static void ironlake_init_pch_refclk(struct drm_device *dev)
                 POSTING_READ(PCH_DREF_CONTROL);
                 udelay(200);
         } else {
-                DRM_DEBUG_KMS("Disabling SSC entirely\n");
+                DRM_DEBUG_KMS("Disabling CPU source output\n");
 
                 val &= ~DREF_CPU_SOURCE_OUTPUT_MASK;
 
@@ -8404,16 +8420,20 @@ static void ironlake_init_pch_refclk(struct drm_device *dev)
                 POSTING_READ(PCH_DREF_CONTROL);
                 udelay(200);
 
-                /* Turn off the SSC source */
-                val &= ~DREF_SSC_SOURCE_MASK;
-                val |= DREF_SSC_SOURCE_DISABLE;
+                if (!using_ssc_source) {
+                        DRM_DEBUG_KMS("Disabling SSC source\n");
 
-                /* Turn off SSC1 */
-                val &= ~DREF_SSC1_ENABLE;
+                        /* Turn off the SSC source */
+                        val &= ~DREF_SSC_SOURCE_MASK;
+                        val |= DREF_SSC_SOURCE_DISABLE;
 
-                I915_WRITE(PCH_DREF_CONTROL, val);
-                POSTING_READ(PCH_DREF_CONTROL);
-                udelay(200);
+                        /* Turn off SSC1 */
+                        val &= ~DREF_SSC1_ENABLE;
+
+                        I915_WRITE(PCH_DREF_CONTROL, val);
+                        POSTING_READ(PCH_DREF_CONTROL);
+                        udelay(200);
+                }
         }
 
         BUG_ON(val != final);
@@ -8427,16 +8447,16 @@ static void lpt_reset_fdi_mphy(struct drm_i915_private *dev_priv)
         tmp |= FDI_MPHY_IOSFSB_RESET_CTL;
         I915_WRITE(SOUTH_CHICKEN2, tmp);
 
-        if (wait_for_atomic_us(I915_READ(SOUTH_CHICKEN2) &
-                               FDI_MPHY_IOSFSB_RESET_STATUS, 100))
+        if (wait_for_us(I915_READ(SOUTH_CHICKEN2) &
+                        FDI_MPHY_IOSFSB_RESET_STATUS, 100))
                 DRM_ERROR("FDI mPHY reset assert timeout\n");
 
         tmp = I915_READ(SOUTH_CHICKEN2);
         tmp &= ~FDI_MPHY_IOSFSB_RESET_CTL;
         I915_WRITE(SOUTH_CHICKEN2, tmp);
 
-        if (wait_for_atomic_us((I915_READ(SOUTH_CHICKEN2) &
-                                FDI_MPHY_IOSFSB_RESET_STATUS) == 0, 100))
+        if (wait_for_us((I915_READ(SOUTH_CHICKEN2) &
+                         FDI_MPHY_IOSFSB_RESET_STATUS) == 0, 100))
                 DRM_ERROR("FDI mPHY reset de-assert timeout\n");
 }
 
@@ -9420,8 +9440,8 @@ static void hsw_disable_lcpll(struct drm_i915_private *dev_priv,
                 val |= LCPLL_CD_SOURCE_FCLK;
                 I915_WRITE(LCPLL_CTL, val);
 
-                if (wait_for_atomic_us(I915_READ(LCPLL_CTL) &
-                                       LCPLL_CD_SOURCE_FCLK_DONE, 1))
+                if (wait_for_us(I915_READ(LCPLL_CTL) &
+                                LCPLL_CD_SOURCE_FCLK_DONE, 1))
                         DRM_ERROR("Switching to FCLK failed\n");
 
                 val = I915_READ(LCPLL_CTL);
@@ -9494,8 +9514,8 @@ static void hsw_restore_lcpll(struct drm_i915_private *dev_priv)
                 val &= ~LCPLL_CD_SOURCE_FCLK;
                 I915_WRITE(LCPLL_CTL, val);
 
-                if (wait_for_atomic_us((I915_READ(LCPLL_CTL) &
-                                        LCPLL_CD_SOURCE_FCLK_DONE) == 0, 1))
+                if (wait_for_us((I915_READ(LCPLL_CTL) &
+                                 LCPLL_CD_SOURCE_FCLK_DONE) == 0, 1))
                         DRM_ERROR("Switching back to LCPLL failed\n");
         }
 
@@ -14554,6 +14574,8 @@ static void intel_setup_outputs(struct drm_device *dev)
                 if (I915_READ(PCH_DP_D) & DP_DETECTED)
                         intel_dp_init(dev, PCH_DP_D, PORT_D);
         } else if (IS_VALLEYVIEW(dev) || IS_CHERRYVIEW(dev)) {
+                bool has_edp, has_port;
+
                 /*
                  * The DP_DETECTED bit is the latched state of the DDC
                  * SDA pin at boot. However since eDP doesn't require DDC
@@ -14562,27 +14584,37 @@ static void intel_setup_outputs(struct drm_device *dev)
                  * Thus we can't rely on the DP_DETECTED bit alone to detect
                  * eDP ports. Consult the VBT as well as DP_DETECTED to
                  * detect eDP ports.
+                 *
+                 * Sadly the straps seem to be missing sometimes even for HDMI
+                 * ports (eg. on Voyo V3 - CHT x7-Z8700), so check both strap
+                 * and VBT for the presence of the port. Additionally we can't
+                 * trust the port type the VBT declares as we've seen at least
+                 * HDMI ports that the VBT claim are DP or eDP.
                  */
-                if (I915_READ(VLV_HDMIB) & SDVO_DETECTED &&
-                    !intel_dp_is_edp(dev, PORT_B))
+                has_edp = intel_dp_is_edp(dev, PORT_B);
+                has_port = intel_bios_is_port_present(dev_priv, PORT_B);
+                if (I915_READ(VLV_DP_B) & DP_DETECTED || has_port)
+                        has_edp &= intel_dp_init(dev, VLV_DP_B, PORT_B);
+                if ((I915_READ(VLV_HDMIB) & SDVO_DETECTED || has_port) && !has_edp)
                         intel_hdmi_init(dev, VLV_HDMIB, PORT_B);
-                if (I915_READ(VLV_DP_B) & DP_DETECTED ||
-                    intel_dp_is_edp(dev, PORT_B))
-                        intel_dp_init(dev, VLV_DP_B, PORT_B);
 
-                if (I915_READ(VLV_HDMIC) & SDVO_DETECTED &&
-                    !intel_dp_is_edp(dev, PORT_C))
+                has_edp = intel_dp_is_edp(dev, PORT_C);
+                has_port = intel_bios_is_port_present(dev_priv, PORT_C);
+                if (I915_READ(VLV_DP_C) & DP_DETECTED || has_port)
+                        has_edp &= intel_dp_init(dev, VLV_DP_C, PORT_C);
+                if ((I915_READ(VLV_HDMIC) & SDVO_DETECTED || has_port) && !has_edp)
                         intel_hdmi_init(dev, VLV_HDMIC, PORT_C);
-                if (I915_READ(VLV_DP_C) & DP_DETECTED ||
-                    intel_dp_is_edp(dev, PORT_C))
-                        intel_dp_init(dev, VLV_DP_C, PORT_C);
 
                 if (IS_CHERRYVIEW(dev)) {
-                        /* eDP not supported on port D, so don't check VBT */
-                        if (I915_READ(CHV_HDMID) & SDVO_DETECTED)
-                                intel_hdmi_init(dev, CHV_HDMID, PORT_D);
-                        if (I915_READ(CHV_DP_D) & DP_DETECTED)
+                        /*
+                         * eDP not supported on port D,
+                         * so no need to worry about it
+                         */
+                        has_port = intel_bios_is_port_present(dev_priv, PORT_D);
+                        if (I915_READ(CHV_DP_D) & DP_DETECTED || has_port)
                                 intel_dp_init(dev, CHV_DP_D, PORT_D);
+                        if (I915_READ(CHV_HDMID) & SDVO_DETECTED || has_port)
+                                intel_hdmi_init(dev, CHV_HDMID, PORT_D);
                 }
 
                 intel_dsi_init(dev);
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index f192f58708c2..40745e38d438 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -663,7 +663,7 @@ intel_dp_aux_wait_done(struct intel_dp *intel_dp, bool has_aux_irq)
                 done = wait_event_timeout(dev_priv->gmbus_wait_queue, C,
                                           msecs_to_jiffies_timeout(10));
         else
-                done = wait_for_atomic(C, 10) == 0;
+                done = wait_for(C, 10) == 0;
         if (!done)
                 DRM_ERROR("dp aux hw did not signal timeout (has irq: %i)!\n",
                           has_aux_irq);
@@ -4899,13 +4899,15 @@ static void intel_edp_panel_vdd_sanitize(struct intel_dp *intel_dp)
 
 void intel_dp_encoder_reset(struct drm_encoder *encoder)
 {
-        struct intel_dp *intel_dp;
+        struct drm_i915_private *dev_priv = to_i915(encoder->dev);
+        struct intel_dp *intel_dp = enc_to_intel_dp(encoder);
+
+        if (!HAS_DDI(dev_priv))
+                intel_dp->DP = I915_READ(intel_dp->output_reg);
 
         if (to_intel_encoder(encoder)->type != INTEL_OUTPUT_EDP)
                 return;
 
-        intel_dp = enc_to_intel_dp(encoder);
-
         pps_lock(intel_dp);
 
         /*
@@ -4977,9 +4979,6 @@ intel_dp_hpd_pulse(struct intel_digital_port *intel_dig_port, bool long_hpd)
         intel_display_power_get(dev_priv, power_domain);
 
         if (long_hpd) {
-                /* indicate that we need to restart link training */
-                intel_dp->train_set_valid = false;
-
                 intel_dp_long_pulse(intel_dp->attached_connector);
                 if (intel_dp->is_mst)
                         ret = IRQ_HANDLED;
@@ -5725,8 +5724,11 @@ static bool intel_edp_init_connector(struct intel_dp *intel_dp,
         if (!fixed_mode && dev_priv->vbt.lfp_lvds_vbt_mode) {
                 fixed_mode = drm_mode_duplicate(dev,
                                         dev_priv->vbt.lfp_lvds_vbt_mode);
-                if (fixed_mode)
+                if (fixed_mode) {
                         fixed_mode->type |= DRM_MODE_TYPE_PREFERRED;
+                        connector->display_info.width_mm = fixed_mode->width_mm;
+                        connector->display_info.height_mm = fixed_mode->height_mm;
+                }
         }
         mutex_unlock(&dev->mode_config.mutex);
 
@@ -5923,9 +5925,9 @@ fail:
         return false;
 }
 
-void
-intel_dp_init(struct drm_device *dev,
-              i915_reg_t output_reg, enum port port)
+bool intel_dp_init(struct drm_device *dev,
+                   i915_reg_t output_reg,
+                   enum port port)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
         struct intel_digital_port *intel_dig_port;
@@ -5935,7 +5937,7 @@ intel_dp_init(struct drm_device *dev,
 
         intel_dig_port = kzalloc(sizeof(*intel_dig_port), GFP_KERNEL);
         if (!intel_dig_port)
-                return;
+                return false;
 
         intel_connector = intel_connector_alloc();
         if (!intel_connector)
@@ -5992,7 +5994,7 @@ intel_dp_init(struct drm_device *dev,
         if (!intel_dp_init_connector(intel_dig_port, intel_connector))
                 goto err_init_connector;
 
-        return;
+        return true;
 
 err_init_connector:
         drm_encoder_cleanup(encoder);
@@ -6000,8 +6002,7 @@ err_encoder_init:
         kfree(intel_connector);
 err_connector_alloc:
         kfree(intel_dig_port);
-
-        return;
+        return false;
 }
 
 void intel_dp_mst_suspend(struct drm_device *dev)
diff --git a/drivers/gpu/drm/i915/intel_dp_link_training.c b/drivers/gpu/drm/i915/intel_dp_link_training.c
index 0b8eefc2acc5..60fb39cd220b 100644
--- a/drivers/gpu/drm/i915/intel_dp_link_training.c
+++ b/drivers/gpu/drm/i915/intel_dp_link_training.c
@@ -85,8 +85,7 @@ static bool
 intel_dp_reset_link_train(struct intel_dp *intel_dp,
                         uint8_t dp_train_pat)
 {
-        if (!intel_dp->train_set_valid)
-                memset(intel_dp->train_set, 0, sizeof(intel_dp->train_set));
+        memset(intel_dp->train_set, 0, sizeof(intel_dp->train_set));
         intel_dp_set_signal_levels(intel_dp);
         return intel_dp_set_link_train(intel_dp, dp_train_pat);
 }
@@ -161,23 +160,6 @@ intel_dp_link_training_clock_recovery(struct intel_dp *intel_dp)
                         break;
                 }
 
-                /*
-                 * if we used previously trained voltage and pre-emphasis values
-                 * and we don't get clock recovery, reset link training values
-                 */
-                if (intel_dp->train_set_valid) {
-                        DRM_DEBUG_KMS("clock recovery not ok, reset");
-                        /* clear the flag as we are not reusing train set */
-                        intel_dp->train_set_valid = false;
-                        if (!intel_dp_reset_link_train(intel_dp,
-                                                       DP_TRAINING_PATTERN_1 |
-                                                       DP_LINK_SCRAMBLING_DISABLE)) {
-                                DRM_ERROR("failed to enable link training\n");
-                                return;
-                        }
-                        continue;
-                }
-
                 /* Check to see if we've tried the max voltage */
                 for (i = 0; i < intel_dp->lane_count; i++)
                         if ((intel_dp->train_set[i] & DP_TRAIN_MAX_SWING_REACHED) == 0)
@@ -284,7 +266,6 @@ intel_dp_link_training_channel_equalization(struct intel_dp *intel_dp)
                 /* Make sure clock is still ok */
                 if (!drm_dp_clock_recovery_ok(link_status,
                                               intel_dp->lane_count)) {
-                        intel_dp->train_set_valid = false;
                         intel_dp_link_training_clock_recovery(intel_dp);
                         intel_dp_set_link_train(intel_dp,
                                                 training_pattern |
@@ -301,7 +282,6 @@ intel_dp_link_training_channel_equalization(struct intel_dp *intel_dp)
 
                 /* Try 5 times, then try clock recovery if that fails */
                 if (tries > 5) {
-                        intel_dp->train_set_valid = false;
                         intel_dp_link_training_clock_recovery(intel_dp);
                         intel_dp_set_link_train(intel_dp,
                                                 training_pattern |
@@ -322,10 +302,8 @@ intel_dp_link_training_channel_equalization(struct intel_dp *intel_dp)
 
         intel_dp_set_idle_link_train(intel_dp);
 
-        if (channel_eq) {
-                intel_dp->train_set_valid = true;
+        if (channel_eq)
                 DRM_DEBUG_KMS("Channel EQ done. DP Training successful\n");
-        }
 }
 
 void intel_dp_stop_link_train(struct intel_dp *intel_dp)
diff --git a/drivers/gpu/drm/i915/intel_dpll_mgr.c b/drivers/gpu/drm/i915/intel_dpll_mgr.c
index 3ac705936b04..58f60b27837e 100644
--- a/drivers/gpu/drm/i915/intel_dpll_mgr.c
+++ b/drivers/gpu/drm/i915/intel_dpll_mgr.c
@@ -366,6 +366,9 @@ ibx_get_dpll(struct intel_crtc *crtc, struct intel_crtc_state *crtc_state,
                                              DPLL_ID_PCH_PLL_B);
         }
 
+        if (!pll)
+                return NULL;
+
         /* reference the pll */
         intel_reference_shared_dpll(pll, crtc_state);
 
@@ -1374,8 +1377,8 @@ static void bxt_ddi_pll_enable(struct drm_i915_private *dev_priv,
         I915_WRITE(BXT_PORT_PLL_ENABLE(port), temp);
         POSTING_READ(BXT_PORT_PLL_ENABLE(port));
 
-        if (wait_for_atomic_us((I915_READ(BXT_PORT_PLL_ENABLE(port)) &
-                        PORT_PLL_LOCK), 200))
+        if (wait_for_us((I915_READ(BXT_PORT_PLL_ENABLE(port)) & PORT_PLL_LOCK),
+                        200))
                 DRM_ERROR("PLL %d not locked\n", port);
 
         /*
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index a28b4aac1e02..f7f0f01814f6 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -863,8 +863,6 @@ struct intel_dp {
         /* This is called before a link training is starterd */
         void (*prepare_link_retrain)(struct intel_dp *intel_dp);
 
-        bool train_set_valid;
-
         /* Displayport compliance testing */
         unsigned long compliance_test_type;
         unsigned long compliance_test_data;
@@ -1284,7 +1282,7 @@ void intel_csr_ucode_suspend(struct drm_i915_private *);
 void intel_csr_ucode_resume(struct drm_i915_private *);
 
 /* intel_dp.c */
-void intel_dp_init(struct drm_device *dev, i915_reg_t output_reg, enum port port);
+bool intel_dp_init(struct drm_device *dev, i915_reg_t output_reg, enum port port);
 bool intel_dp_init_connector(struct intel_digital_port *intel_dig_port,
                              struct intel_connector *intel_connector);
 void intel_dp_set_link_params(struct intel_dp *intel_dp,
diff --git a/drivers/gpu/drm/i915/intel_dsi.c b/drivers/gpu/drm/i915/intel_dsi.c
index 366ad6c67ce4..4756ef639648 100644
--- a/drivers/gpu/drm/i915/intel_dsi.c
+++ b/drivers/gpu/drm/i915/intel_dsi.c
@@ -1545,6 +1545,9 @@ void intel_dsi_init(struct drm_device *dev)
                 goto err;
         }
 
+        connector->display_info.width_mm = fixed_mode->width_mm;
+        connector->display_info.height_mm = fixed_mode->height_mm;
+
         intel_panel_init(&intel_connector->panel, fixed_mode, NULL);
 
         intel_dsi_add_properties(intel_connector);
diff --git a/drivers/gpu/drm/i915/intel_fbc.c b/drivers/gpu/drm/i915/intel_fbc.c
index d5a7cfec589b..647127f3aaff 100644
--- a/drivers/gpu/drm/i915/intel_fbc.c
+++ b/drivers/gpu/drm/i915/intel_fbc.c
@@ -824,8 +824,7 @@ static bool intel_fbc_can_choose(struct intel_crtc *crtc)
 {
         struct drm_i915_private *dev_priv = crtc->base.dev->dev_private;
         struct intel_fbc *fbc = &dev_priv->fbc;
-        bool enable_by_default = IS_HASWELL(dev_priv) ||
-                                 IS_BROADWELL(dev_priv);
+        bool enable_by_default = IS_BROADWELL(dev_priv);
 
         if (intel_vgpu_active(dev_priv->dev)) {
                 fbc->no_fbc_reason = "VGPU is active";
diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
index 2c3bd9c2573e..a8844702d11b 100644
--- a/drivers/gpu/drm/i915/intel_hdmi.c
+++ b/drivers/gpu/drm/i915/intel_hdmi.c
@@ -2142,6 +2142,9 @@ void intel_hdmi_init_connector(struct intel_digital_port *intel_dig_port,
         enum port port = intel_dig_port->port;
         uint8_t alternate_ddc_pin;
 
+        DRM_DEBUG_KMS("Adding HDMI connector on port %c\n",
+                      port_name(port));
+
         if (WARN(intel_dig_port->max_lanes < 4,
                  "Not enough lanes (%d) for HDMI on port %c\n",
                  intel_dig_port->max_lanes, port_name(port)))
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index bc53c0dd34d0..96281e628d2a 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -1082,6 +1082,8 @@ void intel_lvds_init(struct drm_device *dev)
                 fixed_mode = drm_mode_duplicate(dev, dev_priv->vbt.lfp_lvds_vbt_mode);
                 if (fixed_mode) {
                         fixed_mode->type |= DRM_MODE_TYPE_PREFERRED;
+                        connector->display_info.width_mm = fixed_mode->width_mm;
+                        connector->display_info.height_mm = fixed_mode->height_mm;
                         goto out;
                 }
         }
diff --git a/drivers/gpu/drm/i915/intel_vbt_defs.h b/drivers/gpu/drm/i915/intel_vbt_defs.h
index c15051de8023..44fb0b35eed3 100644
--- a/drivers/gpu/drm/i915/intel_vbt_defs.h
+++ b/drivers/gpu/drm/i915/intel_vbt_defs.h
@@ -403,9 +403,10 @@ struct lvds_dvo_timing {
         u8 vsync_off:4;
         u8 rsvd0:6;
         u8 hsync_off_hi:2;
-        u8 h_image;
-        u8 v_image;
-        u8 max_hv;
+        u8 himage_lo;
+        u8 vimage_lo;
+        u8 vimage_hi:4;
+        u8 himage_hi:4;
         u8 h_border;
         u8 v_border;
         u8 rsvd1:3;
diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
index fbe304ee6c80..2aec27dbb5bb 100644
--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
@@ -408,7 +408,7 @@ int adreno_gpu_init(struct drm_device *drm, struct platform_device *pdev,
         }
 
         adreno_gpu->memptrs = msm_gem_vaddr(adreno_gpu->memptrs_bo);
-        if (!adreno_gpu->memptrs) {
+        if (IS_ERR(adreno_gpu->memptrs)) {
                 dev_err(drm->dev, "could not vmap memptrs\n");
                 return -ENOMEM;
         }
diff --git a/drivers/gpu/drm/msm/msm_fbdev.c b/drivers/gpu/drm/msm/msm_fbdev.c
index d9759bf3482e..c6cf837c5193 100644
--- a/drivers/gpu/drm/msm/msm_fbdev.c
+++ b/drivers/gpu/drm/msm/msm_fbdev.c
@@ -159,6 +159,10 @@ static int msm_fbdev_create(struct drm_fb_helper *helper,
         dev->mode_config.fb_base = paddr;
 
         fbi->screen_base = msm_gem_vaddr_locked(fbdev->bo);
+        if (IS_ERR(fbi->screen_base)) {
+                ret = PTR_ERR(fbi->screen_base);
+                goto fail_unlock;
+        }
         fbi->screen_size = fbdev->bo->size;
         fbi->fix.smem_start = paddr;
         fbi->fix.smem_len = fbdev->bo->size;
diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
index 7daf4054dd2b..69836f5685b1 100644
--- a/drivers/gpu/drm/msm/msm_gem.c
+++ b/drivers/gpu/drm/msm/msm_gem.c
@@ -398,6 +398,8 @@ void *msm_gem_vaddr_locked(struct drm_gem_object *obj)
                         return ERR_CAST(pages);
                 msm_obj->vaddr = vmap(pages, obj->size >> PAGE_SHIFT,
                                 VM_MAP, pgprot_writecombine(PAGE_KERNEL));
+                if (msm_obj->vaddr == NULL)
+                        return ERR_PTR(-ENOMEM);
         }
         return msm_obj->vaddr;
 }
diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c
index b89ca5174863..eb4bb8b2f3a5 100644
--- a/drivers/gpu/drm/msm/msm_gem_submit.c
+++ b/drivers/gpu/drm/msm/msm_gem_submit.c
@@ -40,12 +40,14 @@ static struct msm_gem_submit *submit_create(struct drm_device *dev,
 
         submit->dev = dev;
         submit->gpu = gpu;
+        submit->fence = NULL;
         submit->pid = get_pid(task_pid(current));
 
         /* initially, until copy_from_user() and bo lookup succeeds: */
         submit->nr_bos = 0;
         submit->nr_cmds = 0;
 
+        INIT_LIST_HEAD(&submit->node);
         INIT_LIST_HEAD(&submit->bo_list);
         ww_acquire_init(&submit->ticket, &reservation_ww_class);
 
@@ -75,6 +77,11 @@ static int submit_lookup_objects(struct msm_gem_submit *submit,
                 void __user *userptr =
                         u64_to_user_ptr(args->bos + (i * sizeof(submit_bo)));
 
+                /* make sure we don't have garbage flags, in case we hit
+                 * error path before flags is initialized:
+                 */
+                submit->bos[i].flags = 0;
+
                 ret = copy_from_user(&submit_bo, userptr, sizeof(submit_bo));
                 if (ret) {
                         ret = -EFAULT;
diff --git a/drivers/gpu/drm/msm/msm_rd.c b/drivers/gpu/drm/msm/msm_rd.c
index b48f73ac6389..0857710c2ff2 100644
--- a/drivers/gpu/drm/msm/msm_rd.c
+++ b/drivers/gpu/drm/msm/msm_rd.c
@@ -312,6 +312,9 @@ void msm_rd_dump_submit(struct msm_gem_submit *submit)
                 struct msm_gem_object *obj = submit->bos[idx].obj;
                 const char *buf = msm_gem_vaddr_locked(&obj->base);
 
+                if (IS_ERR(buf))
+                        continue;
+
                 buf += iova - submit->bos[idx].iova;
 
                 rd_write_section(rd, RD_GPUADDR,
diff --git a/drivers/gpu/drm/msm/msm_ringbuffer.c b/drivers/gpu/drm/msm/msm_ringbuffer.c
index 1f14b908b221..42f5359cf988 100644
--- a/drivers/gpu/drm/msm/msm_ringbuffer.c
+++ b/drivers/gpu/drm/msm/msm_ringbuffer.c
@@ -40,6 +40,10 @@ struct msm_ringbuffer *msm_ringbuffer_new(struct msm_gpu *gpu, int size)
         }
 
         ring->start = msm_gem_vaddr_locked(ring->bo);
+        if (IS_ERR(ring->start)) {
+                ret = PTR_ERR(ring->start);
+                goto fail;
+        }
         ring->end   = ring->start + (size / 4);
         ring->cur   = ring->start;
 
diff --git a/drivers/gpu/drm/nouveau/include/nvkm/core/device.h b/drivers/gpu/drm/nouveau/include/nvkm/core/device.h
index c612dc1f1eb4..126a85cc81bc 100644
--- a/drivers/gpu/drm/nouveau/include/nvkm/core/device.h
+++ b/drivers/gpu/drm/nouveau/include/nvkm/core/device.h
@@ -16,9 +16,9 @@ enum nvkm_devidx {
         NVKM_SUBDEV_MC,
         NVKM_SUBDEV_BUS,
         NVKM_SUBDEV_TIMER,
+        NVKM_SUBDEV_INSTMEM,
         NVKM_SUBDEV_FB,
         NVKM_SUBDEV_LTC,
-        NVKM_SUBDEV_INSTMEM,
         NVKM_SUBDEV_MMU,
         NVKM_SUBDEV_BAR,
         NVKM_SUBDEV_PMU,
diff --git a/drivers/gpu/drm/nouveau/include/nvkm/subdev/bios/disp.h b/drivers/gpu/drm/nouveau/include/nvkm/subdev/bios/disp.h
index db10c11f0595..c5a6ebd5a478 100644
--- a/drivers/gpu/drm/nouveau/include/nvkm/subdev/bios/disp.h
+++ b/drivers/gpu/drm/nouveau/include/nvkm/subdev/bios/disp.h
@@ -25,7 +25,8 @@ u16 nvbios_outp_match(struct nvkm_bios *, u16 type, u16 mask,
                       u8 *ver, u8 *hdr, u8 *cnt, u8 *len, struct nvbios_outp *);
 
 struct nvbios_ocfg {
-        u16 match;
+        u8  proto;
+        u8  flags;
         u16 clkcmp[2];
 };
 
@@ -33,7 +34,7 @@ u16 nvbios_ocfg_entry(struct nvkm_bios *, u16 outp, u8 idx,
                       u8 *ver, u8 *hdr, u8 *cnt, u8 *len);
 u16 nvbios_ocfg_parse(struct nvkm_bios *, u16 outp, u8 idx,
                       u8 *ver, u8 *hdr, u8 *cnt, u8 *len, struct nvbios_ocfg *);
-u16 nvbios_ocfg_match(struct nvkm_bios *, u16 outp, u16 type,
+u16 nvbios_ocfg_match(struct nvkm_bios *, u16 outp, u8 proto, u8 flags,
                       u8 *ver, u8 *hdr, u8 *cnt, u8 *len, struct nvbios_ocfg *);
 u16 nvbios_oclk_match(struct nvkm_bios *, u16 cmp, u32 khz);
 #endif
diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
index 57aaf98a26f9..d1f248fd3506 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -552,6 +552,8 @@ nouveau_fbcon_init(struct drm_device *dev)
         if (ret)
                 goto fini;
 
+        if (fbcon->helper.fbdev)
+                fbcon->helper.fbdev->pixmap.buf_align = 4;
         return 0;
 
 fini:
diff --git a/drivers/gpu/drm/nouveau/nv04_fbcon.c b/drivers/gpu/drm/nouveau/nv04_fbcon.c
index 0f3e4bb411cc..7d9248b8c664 100644
--- a/drivers/gpu/drm/nouveau/nv04_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nv04_fbcon.c
@@ -82,7 +82,6 @@ nv04_fbcon_imageblit(struct fb_info *info, const struct fb_image *image)
         uint32_t fg;
         uint32_t bg;
         uint32_t dsize;
-        uint32_t width;
         uint32_t *data = (uint32_t *)image->data;
         int ret;
 
@@ -93,9 +92,6 @@ nv04_fbcon_imageblit(struct fb_info *info, const struct fb_image *image)
         if (ret)
                 return ret;
 
-        width = ALIGN(image->width, 8);
-        dsize = ALIGN(width * image->height, 32) >> 5;
-
         if (info->fix.visual == FB_VISUAL_TRUECOLOR ||
             info->fix.visual == FB_VISUAL_DIRECTCOLOR) {
                 fg = ((uint32_t *) info->pseudo_palette)[image->fg_color];
@@ -111,10 +107,11 @@ nv04_fbcon_imageblit(struct fb_info *info, const struct fb_image *image)
                          ((image->dx + image->width) & 0xffff));
         OUT_RING(chan, bg);
         OUT_RING(chan, fg);
-        OUT_RING(chan, (image->height << 16) | width);
+        OUT_RING(chan, (image->height << 16) | image->width);
         OUT_RING(chan, (image->height << 16) | image->width);
         OUT_RING(chan, (image->dy << 16) | (image->dx & 0xffff));
 
+        dsize = ALIGN(image->width * image->height, 32) >> 5;
         while (dsize) {
                 int iter_len = dsize > 128 ? 128 : dsize;
 
diff --git a/drivers/gpu/drm/nouveau/nv50_fbcon.c b/drivers/gpu/drm/nouveau/nv50_fbcon.c
index 33d9ee0fac40..1aeb698e9707 100644
--- a/drivers/gpu/drm/nouveau/nv50_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nv50_fbcon.c
@@ -95,7 +95,7 @@ nv50_fbcon_imageblit(struct fb_info *info, const struct fb_image *image)
         struct nouveau_fbdev *nfbdev = info->par;
         struct nouveau_drm *drm = nouveau_drm(nfbdev->dev);
         struct nouveau_channel *chan = drm->channel;
-        uint32_t width, dwords, *data = (uint32_t *)image->data;
+        uint32_t dwords, *data = (uint32_t *)image->data;
         uint32_t mask = ~(~0 >> (32 - info->var.bits_per_pixel));
         uint32_t *palette = info->pseudo_palette;
         int ret;
@@ -107,9 +107,6 @@ nv50_fbcon_imageblit(struct fb_info *info, const struct fb_image *image)
         if (ret)
                 return ret;
 
-        width = ALIGN(image->width, 32);
-        dwords = (width * image->height) >> 5;
-
         BEGIN_NV04(chan, NvSub2D, 0x0814, 2);
         if (info->fix.visual == FB_VISUAL_TRUECOLOR ||
             info->fix.visual == FB_VISUAL_DIRECTCOLOR) {
@@ -128,6 +125,7 @@ nv50_fbcon_imageblit(struct fb_info *info, const struct fb_image *image)
         OUT_RING(chan, 0);
         OUT_RING(chan, image->dy);
 
+        dwords = ALIGN(image->width * image->height, 32) >> 5;
         while (dwords) {
                 int push = dwords > 2047 ? 2047 : dwords;
 
diff --git a/drivers/gpu/drm/nouveau/nvc0_fbcon.c b/drivers/gpu/drm/nouveau/nvc0_fbcon.c
index a0913359ac05..839f4c8c1805 100644
--- a/drivers/gpu/drm/nouveau/nvc0_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nvc0_fbcon.c
@@ -95,7 +95,7 @@ nvc0_fbcon_imageblit(struct fb_info *info, const struct fb_image *image)
         struct nouveau_fbdev *nfbdev = info->par;
         struct nouveau_drm *drm = nouveau_drm(nfbdev->dev);
         struct nouveau_channel *chan = drm->channel;
-        uint32_t width, dwords, *data = (uint32_t *)image->data;
+        uint32_t dwords, *data = (uint32_t *)image->data;
         uint32_t mask = ~(~0 >> (32 - info->var.bits_per_pixel));
         uint32_t *palette = info->pseudo_palette;
         int ret;
@@ -107,9 +107,6 @@ nvc0_fbcon_imageblit(struct fb_info *info, const struct fb_image *image)
         if (ret)
                 return ret;
 
-        width = ALIGN(image->width, 32);
-        dwords = (width * image->height) >> 5;
-
         BEGIN_NVC0(chan, NvSub2D, 0x0814, 2);
         if (info->fix.visual == FB_VISUAL_TRUECOLOR ||
             info->fix.visual == FB_VISUAL_DIRECTCOLOR) {
@@ -128,6 +125,7 @@ nvc0_fbcon_imageblit(struct fb_info *info, const struct fb_image *image)
         OUT_RING  (chan, 0);
         OUT_RING  (chan, image->dy);
 
+        dwords = ALIGN(image->width * image->height, 32) >> 5;
         while (dwords) {
                 int push = dwords > 2047 ? 2047 : dwords;
 
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/pci.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/pci.c
index 18fab3973ce5..62ad0300cfa5 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/pci.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/pci.c
@@ -1614,7 +1614,7 @@ nvkm_device_pci_func = {
         .fini = nvkm_device_pci_fini,
         .resource_addr = nvkm_device_pci_resource_addr,
         .resource_size = nvkm_device_pci_resource_size,
-        .cpu_coherent = !IS_ENABLED(CONFIG_ARM) && !IS_ENABLED(CONFIG_ARM64),
+        .cpu_coherent = !IS_ENABLED(CONFIG_ARM),
 };
 
 int
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/Kbuild b/drivers/gpu/drm/nouveau/nvkm/engine/disp/Kbuild
index a74c5dd27dc0..e2a64ed14b22 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/Kbuild
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/Kbuild
@@ -18,6 +18,7 @@ nvkm-y += nvkm/engine/disp/piornv50.o
 nvkm-y += nvkm/engine/disp/sornv50.o
 nvkm-y += nvkm/engine/disp/sorg94.o
 nvkm-y += nvkm/engine/disp/sorgf119.o
+nvkm-y += nvkm/engine/disp/sorgm107.o
 nvkm-y += nvkm/engine/disp/sorgm200.o
 nvkm-y += nvkm/engine/disp/dport.o
 
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/gf119.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/gf119.c
index f0314664349c..5dd34382f55a 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/gf119.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/gf119.c
@@ -76,6 +76,7 @@ exec_lookup(struct nv50_disp *disp, int head, int or, u32 ctrl,
         mask |= 0x0001 << or;
         mask |= 0x0100 << head;
 
+
         list_for_each_entry(outp, &disp->base.outp, head) {
                 if ((outp->info.hasht & 0xff) == type &&
                     (outp->info.hashm & mask) == mask) {
@@ -155,25 +156,21 @@ exec_clkcmp(struct nv50_disp *disp, int head, int id, u32 pclk, u32 *conf)
         if (!outp)
                 return NULL;
 
+        *conf = (ctrl & 0x00000f00) >> 8;
         switch (outp->info.type) {
         case DCB_OUTPUT_TMDS:
-                *conf = (ctrl & 0x00000f00) >> 8;
                 if (*conf == 5)
                         *conf |= 0x0100;
                 break;
         case DCB_OUTPUT_LVDS:
-                *conf = disp->sor.lvdsconf;
-                break;
-        case DCB_OUTPUT_DP:
-                *conf = (ctrl & 0x00000f00) >> 8;
+                *conf |= disp->sor.lvdsconf;
                 break;
-        case DCB_OUTPUT_ANALOG:
         default:
-                *conf = 0x00ff;
                 break;
         }
 
-        data = nvbios_ocfg_match(bios, data, *conf, &ver, &hdr, &cnt, &len, &info2);
+        data = nvbios_ocfg_match(bios, data, *conf & 0xff, *conf >> 8,
+                                 &ver, &hdr, &cnt, &len, &info2);
         if (data && id < 0xff) {
                 data = nvbios_oclk_match(bios, info2.clkcmp[id], pclk);
                 if (data) {
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/gm107.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/gm107.c
index b6944142d616..f4b9cf8574be 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/gm107.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/gm107.c
@@ -36,7 +36,7 @@ gm107_disp = {
         .outp.internal.crt = nv50_dac_output_new,
         .outp.internal.tmds = nv50_sor_output_new,
         .outp.internal.lvds = nv50_sor_output_new,
-        .outp.internal.dp = gf119_sor_dp_new,
+        .outp.internal.dp = gm107_sor_dp_new,
         .dac.nr = 3,
         .dac.power = nv50_dac_power,
         .dac.sense = nv50_dac_sense,
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c
index 4226d2153b9c..fcb1b0c46d64 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c
@@ -387,22 +387,17 @@ exec_clkcmp(struct nv50_disp *disp, int head, int id, u32 pclk, u32 *conf)
         if (!outp)
                 return NULL;
 
+        *conf = (ctrl & 0x00000f00) >> 8;
         if (outp->info.location == 0) {
                 switch (outp->info.type) {
                 case DCB_OUTPUT_TMDS:
-                        *conf = (ctrl & 0x00000f00) >> 8;
                         if (*conf == 5)
                                 *conf |= 0x0100;
                         break;
                 case DCB_OUTPUT_LVDS:
-                        *conf = disp->sor.lvdsconf;
+                        *conf |= disp->sor.lvdsconf;
                         break;
-                case DCB_OUTPUT_DP:
-                        *conf = (ctrl & 0x00000f00) >> 8;
-                        break;
-                case DCB_OUTPUT_ANALOG:
                 default:
-                        *conf = 0x00ff;
                         break;
                 }
         } else {
@@ -410,7 +405,8 @@ exec_clkcmp(struct nv50_disp *disp, int head, int id, u32 pclk, u32 *conf)
                 pclk = pclk / 2;
         }
 
-        data = nvbios_ocfg_match(bios, data, *conf, &ver, &hdr, &cnt, &len, &info2);
+        data = nvbios_ocfg_match(bios, data, *conf & 0xff, *conf >> 8,
+                                 &ver, &hdr, &cnt, &len, &info2);
         if (data && id < 0xff) {
                 data = nvbios_oclk_match(bios, info2.clkcmp[id], pclk);
                 if (data) {
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outpdp.h b/drivers/gpu/drm/nouveau/nvkm/engine/disp/outpdp.h
index e9067ba4e179..4e983f6d7032 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outpdp.h
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/outpdp.h
@@ -62,7 +62,12 @@ int g94_sor_dp_lnk_pwr(struct nvkm_output_dp *, int);
 int gf119_sor_dp_new(struct nvkm_disp *, int, struct dcb_output *,
                      struct nvkm_output **);
 int gf119_sor_dp_lnk_ctl(struct nvkm_output_dp *, int, int, bool);
+int gf119_sor_dp_drv_ctl(struct nvkm_output_dp *, int, int, int, int);
 
-int  gm200_sor_dp_new(struct nvkm_disp *, int, struct dcb_output *,
-                      struct nvkm_output **);
+int gm107_sor_dp_new(struct nvkm_disp *, int, struct dcb_output *,
+                     struct nvkm_output **);
+int gm107_sor_dp_pattern(struct nvkm_output_dp *, int);
+
+int gm200_sor_dp_new(struct nvkm_disp *, int, struct dcb_output *,
+                     struct nvkm_output **);
 #endif
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c
index b4b41b135643..22706c0a54b5 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgf119.c
@@ -40,8 +40,7 @@ static int
 gf119_sor_dp_pattern(struct nvkm_output_dp *outp, int pattern)
 {
         struct nvkm_device *device = outp->base.disp->engine.subdev.device;
-        const u32 loff = gf119_sor_loff(outp);
-        nvkm_mask(device, 0x61c110 + loff, 0x0f0f0f0f, 0x01010101 * pattern);
+        nvkm_mask(device, 0x61c110, 0x0f0f0f0f, 0x01010101 * pattern);
         return 0;
 }
 
@@ -64,7 +63,7 @@ gf119_sor_dp_lnk_ctl(struct nvkm_output_dp *outp, int nr, int bw, bool ef)
         return 0;
 }
 
-static int
+int
 gf119_sor_dp_drv_ctl(struct nvkm_output_dp *outp,
                      int ln, int vs, int pe, int pc)
 {
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgm107.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgm107.c
new file mode 100644
index 000000000000..37790b2617c5
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgm107.c
@@ -0,0 +1,53 @@
+/*
+ * Copyright 2016 Red Hat Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * Authors: Ben Skeggs <bskeggs@redhat.com>
+ */
+#include "nv50.h"
+#include "outpdp.h"
+
+int
+gm107_sor_dp_pattern(struct nvkm_output_dp *outp, int pattern)
+{
+        struct nvkm_device *device = outp->base.disp->engine.subdev.device;
+        const u32 soff = outp->base.or * 0x800;
+        const u32 data = 0x01010101 * pattern;
+        if (outp->base.info.sorconf.link & 1)
+                nvkm_mask(device, 0x61c110 + soff, 0x0f0f0f0f, data);
+        else
+                nvkm_mask(device, 0x61c12c + soff, 0x0f0f0f0f, data);
+        return 0;
+}
+
+static const struct nvkm_output_dp_func
+gm107_sor_dp_func = {
+        .pattern = gm107_sor_dp_pattern,
+        .lnk_pwr = g94_sor_dp_lnk_pwr,
+        .lnk_ctl = gf119_sor_dp_lnk_ctl,
+        .drv_ctl = gf119_sor_dp_drv_ctl,
+};
+
+int
+gm107_sor_dp_new(struct nvkm_disp *disp, int index,
+                 struct dcb_output *dcbE, struct nvkm_output **poutp)
+{
+        return nvkm_output_dp_new_(&gm107_sor_dp_func, disp, index, dcbE, poutp);
+}
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgm200.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgm200.c
index 2cfbef9c344f..c44fa7ea672a 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgm200.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/sorgm200.c
@@ -57,19 +57,6 @@ gm200_sor_dp_lane_map(struct nvkm_device *device, u8 lane)
 }
 
 static int
-gm200_sor_dp_pattern(struct nvkm_output_dp *outp, int pattern)
-{
-        struct nvkm_device *device = outp->base.disp->engine.subdev.device;
-        const u32 soff = gm200_sor_soff(outp);
-        const u32 data = 0x01010101 * pattern;
-        if (outp->base.info.sorconf.link & 1)
-                nvkm_mask(device, 0x61c110 + soff, 0x0f0f0f0f, data);
-        else
-                nvkm_mask(device, 0x61c12c + soff, 0x0f0f0f0f, data);
-        return 0;
-}
-
-static int
 gm200_sor_dp_lnk_pwr(struct nvkm_output_dp *outp, int nr)
 {
         struct nvkm_device *device = outp->base.disp->engine.subdev.device;
@@ -129,7 +116,7 @@ gm200_sor_dp_drv_ctl(struct nvkm_output_dp *outp,
 
 static const struct nvkm_output_dp_func
 gm200_sor_dp_func = {
-        .pattern = gm200_sor_dp_pattern,
+        .pattern = gm107_sor_dp_pattern,
         .lnk_pwr = gm200_sor_dp_lnk_pwr,
         .lnk_ctl = gf119_sor_dp_lnk_ctl,
         .drv_ctl = gm200_sor_dp_drv_ctl,
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c
index 9513badb8220..ae9ab5b1ab97 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c
@@ -949,22 +949,41 @@ gf100_gr_trap_gpc_rop(struct gf100_gr *gr, int gpc)
 }
 
 static const struct nvkm_enum gf100_mp_warp_error[] = {
-        { 0x00, "NO_ERROR" },
-        { 0x01, "STACK_MISMATCH" },
+        { 0x01, "STACK_ERROR" },
+        { 0x02, "API_STACK_ERROR" },
+        { 0x03, "RET_EMPTY_STACK_ERROR" },
+        { 0x04, "PC_WRAP" },
         { 0x05, "MISALIGNED_PC" },
-        { 0x08, "MISALIGNED_GPR" },
-        { 0x09, "INVALID_OPCODE" },
-        { 0x0d, "GPR_OUT_OF_BOUNDS" },
-        { 0x0e, "MEM_OUT_OF_BOUNDS" },
-        { 0x0f, "UNALIGNED_MEM_ACCESS" },
+        { 0x06, "PC_OVERFLOW" },
+        { 0x07, "MISALIGNED_IMMC_ADDR" },
+        { 0x08, "MISALIGNED_REG" },
+        { 0x09, "ILLEGAL_INSTR_ENCODING" },
+        { 0x0a, "ILLEGAL_SPH_INSTR_COMBO" },
+        { 0x0b, "ILLEGAL_INSTR_PARAM" },
+        { 0x0c, "INVALID_CONST_ADDR" },
+        { 0x0d, "OOR_REG" },
+        { 0x0e, "OOR_ADDR" },
+        { 0x0f, "MISALIGNED_ADDR" },
         { 0x10, "INVALID_ADDR_SPACE" },
-        { 0x11, "INVALID_PARAM" },
+        { 0x11, "ILLEGAL_INSTR_PARAM2" },
+        { 0x12, "INVALID_CONST_ADDR_LDC" },
+        { 0x13, "GEOMETRY_SM_ERROR" },
+        { 0x14, "DIVERGENT" },
+        { 0x15, "WARP_EXIT" },
         {}
 };
 
 static const struct nvkm_bitfield gf100_mp_global_error[] = {
+        { 0x00000001, "SM_TO_SM_FAULT" },
+        { 0x00000002, "L1_ERROR" },
         { 0x00000004, "MULTIPLE_WARP_ERRORS" },
-        { 0x00000008, "OUT_OF_STACK_SPACE" },
+        { 0x00000008, "PHYSICAL_STACK_OVERFLOW" },
+        { 0x00000010, "BPT_INT" },
+        { 0x00000020, "BPT_PAUSE" },
+        { 0x00000040, "SINGLE_STEP_COMPLETE" },
+        { 0x20000000, "ECC_SEC_ERROR" },
+        { 0x40000000, "ECC_DED_ERROR" },
+        { 0x80000000, "TIMEOUT" },
         {}
 };
 
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/disp.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/disp.c
index a5e92135cd77..9efb1b48cd54 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/disp.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/disp.c
@@ -141,7 +141,8 @@ nvbios_ocfg_parse(struct nvkm_bios *bios, u16 outp, u8 idx,
 {
         u16 data = nvbios_ocfg_entry(bios, outp, idx, ver, hdr, cnt, len);
         if (data) {
-                info->match     = nvbios_rd16(bios, data + 0x00);
+                info->proto     = nvbios_rd08(bios, data + 0x00);
+                info->flags     = nvbios_rd16(bios, data + 0x01);
                 info->clkcmp[0] = nvbios_rd16(bios, data + 0x02);
                 info->clkcmp[1] = nvbios_rd16(bios, data + 0x04);
         }
@@ -149,12 +150,13 @@ nvbios_ocfg_parse(struct nvkm_bios *bios, u16 outp, u8 idx,
 }
 
 u16
-nvbios_ocfg_match(struct nvkm_bios *bios, u16 outp, u16 type,
+nvbios_ocfg_match(struct nvkm_bios *bios, u16 outp, u8 proto, u8 flags,
                   u8 *ver, u8 *hdr, u8 *cnt, u8 *len, struct nvbios_ocfg *info)
 {
         u16 data, idx = 0;
         while ((data = nvbios_ocfg_parse(bios, outp, idx++, ver, hdr, cnt, len, info))) {
-                if (info->match == type)
+                if ((info->proto == proto || info->proto == 0xff) &&
+                    (info->flags == flags))
                         break;
         }
         return data;
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/iccsense/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/iccsense/base.c
index 323c79abe468..41bd5d0f7692 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/iccsense/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/iccsense/base.c
@@ -276,6 +276,8 @@ nvkm_iccsense_oneinit(struct nvkm_subdev *subdev)
                 struct pwr_rail_t *r = &stbl.rail[i];
                 struct nvkm_iccsense_rail *rail;
                 struct nvkm_iccsense_sensor *sensor;
+                int (*read)(struct nvkm_iccsense *,
+                            struct nvkm_iccsense_rail *);
 
                 if (!r->mode || r->resistor_mohm == 0)
                         continue;
@@ -284,31 +286,31 @@ nvkm_iccsense_oneinit(struct nvkm_subdev *subdev)
                 if (!sensor)
                         continue;
 
-                rail = kmalloc(sizeof(*rail), GFP_KERNEL);
-                if (!rail)
-                        return -ENOMEM;
-
                 switch (sensor->type) {
                 case NVBIOS_EXTDEV_INA209:
                         if (r->rail != 0)
                                 continue;
-                        rail->read = nvkm_iccsense_ina209_read;
+                        read = nvkm_iccsense_ina209_read;
                         break;
                 case NVBIOS_EXTDEV_INA219:
                         if (r->rail != 0)
                                 continue;
-                        rail->read = nvkm_iccsense_ina219_read;
+                        read = nvkm_iccsense_ina219_read;
                         break;
                 case NVBIOS_EXTDEV_INA3221:
                         if (r->rail >= 3)
                                 continue;
-                        rail->read = nvkm_iccsense_ina3221_read;
+                        read = nvkm_iccsense_ina3221_read;
                         break;
                 default:
                         continue;
                 }
 
+                rail = kmalloc(sizeof(*rail), GFP_KERNEL);
+                if (!rail)
+                        return -ENOMEM;
                 sensor->rail_mask |= 1 << r->rail;
+                rail->read = read;
                 rail->sensor = sensor;
                 rail->idx = r->rail;
                 rail->mohm = r->resistor_mohm;
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/ltc/gm107.c b/drivers/gpu/drm/nouveau/nvkm/subdev/ltc/gm107.c
index e292f5679418..389fb13a1998 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/ltc/gm107.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/ltc/gm107.c
@@ -69,11 +69,11 @@ gm107_ltc_zbc_clear_depth(struct nvkm_ltc *ltc, int i, const u32 depth)
 }
 
 static void
-gm107_ltc_lts_isr(struct nvkm_ltc *ltc, int c, int s)
+gm107_ltc_intr_lts(struct nvkm_ltc *ltc, int c, int s)
 {
         struct nvkm_subdev *subdev = &ltc->subdev;
         struct nvkm_device *device = subdev->device;
-        u32 base = 0x140000 + (c * 0x2000) + (s * 0x200);
+        u32 base = 0x140400 + (c * 0x2000) + (s * 0x200);
         u32 stat = nvkm_rd32(device, base + 0x00c);
 
         if (stat) {
@@ -92,7 +92,7 @@ gm107_ltc_intr(struct nvkm_ltc *ltc)
         while (mask) {
                 u32 s, c = __ffs(mask);
                 for (s = 0; s < ltc->lts_nr; s++)
-                        gm107_ltc_lts_isr(ltc, c, s);
+                        gm107_ltc_intr_lts(ltc, c, s);
                 mask &= ~(1 << c);
         }
 }
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/ltc/gm200.c b/drivers/gpu/drm/nouveau/nvkm/subdev/ltc/gm200.c
index 2a29bfd5125a..e18e0dc19ec8 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/ltc/gm200.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/ltc/gm200.c
@@ -46,7 +46,7 @@ static const struct nvkm_ltc_func
 gm200_ltc = {
         .oneinit = gm200_ltc_oneinit,
         .init = gm200_ltc_init,
-        .intr = gm107_ltc_intr, /*XXX: not validated */
+        .intr = gm107_ltc_intr,
         .cbc_clear = gm107_ltc_cbc_clear,
         .cbc_wait = gm107_ltc_cbc_wait,
         .zbc = 16,
diff --git a/drivers/gpu/drm/omapdrm/dss/dsi.c b/drivers/gpu/drm/omapdrm/dss/dsi.c
index 9ed8272e54ae..56c43f355ce3 100644
--- a/drivers/gpu/drm/omapdrm/dss/dsi.c
+++ b/drivers/gpu/drm/omapdrm/dss/dsi.c
@@ -1167,7 +1167,6 @@ static int dsi_regulator_init(struct platform_device *dsidev)
 {
         struct dsi_data *dsi = dsi_get_dsidrv_data(dsidev);
         struct regulator *vdds_dsi;
-        int r;
 
         if (dsi->vdds_dsi_reg != NULL)
                 return 0;
diff --git a/drivers/gpu/drm/omapdrm/dss/hdmi5.c b/drivers/gpu/drm/omapdrm/dss/hdmi5.c
index e129245eb8a9..9255c0e1e4a7 100644
--- a/drivers/gpu/drm/omapdrm/dss/hdmi5.c
+++ b/drivers/gpu/drm/omapdrm/dss/hdmi5.c
@@ -120,7 +120,6 @@ static irqreturn_t hdmi_irq_handler(int irq, void *data)
 
 static int hdmi_init_regulator(void)
 {
-        int r;
         struct regulator *reg;
 
         if (hdmi.vdda_reg != NULL)
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index 2e216e2ea78c..259cd6e6d71c 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -589,7 +589,8 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
                 if (ASIC_IS_DCE41(rdev) || ASIC_IS_DCE61(rdev) || ASIC_IS_DCE8(rdev))
                         radeon_crtc->pll_flags |= RADEON_PLL_USE_FRAC_FB_DIV;
                 /* use frac fb div on RS780/RS880 */
-                if ((rdev->family == CHIP_RS780) || (rdev->family == CHIP_RS880))
+                if (((rdev->family == CHIP_RS780) || (rdev->family == CHIP_RS880))
+                    && !radeon_crtc->ss_enabled)
                         radeon_crtc->pll_flags |= RADEON_PLL_USE_FRAC_FB_DIV;
                 if (ASIC_IS_DCE32(rdev) && mode->clock > 165000)
                         radeon_crtc->pll_flags |= RADEON_PLL_USE_FRAC_FB_DIV;
@@ -626,7 +627,7 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
                         if (radeon_crtc->ss.refdiv) {
                                 radeon_crtc->pll_flags |= RADEON_PLL_USE_REF_DIV;
                                 radeon_crtc->pll_reference_div = radeon_crtc->ss.refdiv;
-                                if (ASIC_IS_AVIVO(rdev))
+                                if (rdev->family >= CHIP_RV770)
                                         radeon_crtc->pll_flags |= RADEON_PLL_USE_FRAC_FB_DIV;
                         }
                 }
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index e721e6b2766e..21c44b2293bc 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -630,6 +630,23 @@ void radeon_gtt_location(struct radeon_device *rdev, struct radeon_mc *mc)
 /*
  * GPU helpers function.
  */
+
+/**
+ * radeon_device_is_virtual - check if we are running is a virtual environment
+ *
+ * Check if the asic has been passed through to a VM (all asics).
+ * Used at driver startup.
+ * Returns true if virtual or false if not.
+ */
+static bool radeon_device_is_virtual(void)
+{
+#ifdef CONFIG_X86
+        return boot_cpu_has(X86_FEATURE_HYPERVISOR);
+#else
+        return false;
+#endif
+}
+
 /**
  * radeon_card_posted - check if the hw has already been initialized
  *
@@ -643,6 +660,10 @@ bool radeon_card_posted(struct radeon_device *rdev)
 {
         uint32_t reg;
 
+        /* for pass through, always force asic_init */
+        if (radeon_device_is_virtual())
+                return false;
+
         /* required for EFI mode on macbook2,1 which uses an r5xx asic */
         if (efi_enabled(EFI_BOOT) &&
             (rdev->pdev->subsystem_vendor == PCI_VENDOR_ID_APPLE) &&
@@ -1631,7 +1652,7 @@ int radeon_suspend_kms(struct drm_device *dev, bool suspend,
         radeon_agp_suspend(rdev);
 
         pci_save_state(dev->pdev);
-        if (freeze && rdev->family >= CHIP_R600) {
+        if (freeze && rdev->family >= CHIP_CEDAR) {
                 rdev->asic->asic_reset(rdev, true);
                 pci_restore_state(dev->pdev);
         } else if (suspend) {
diff --git a/drivers/gpu/drm/sun4i/Kconfig b/drivers/gpu/drm/sun4i/Kconfig
index 99510e64e91a..a4b357db8856 100644
--- a/drivers/gpu/drm/sun4i/Kconfig
+++ b/drivers/gpu/drm/sun4i/Kconfig
@@ -1,6 +1,6 @@
 config DRM_SUN4I
         tristate "DRM Support for Allwinner A10 Display Engine"
-        depends on DRM && ARM
+        depends on DRM && ARM && COMMON_CLK
         depends on ARCH_SUNXI || COMPILE_TEST
         select DRM_GEM_CMA_HELPER
         select DRM_KMS_HELPER
diff --git a/drivers/gpu/drm/sun4i/sun4i_backend.c b/drivers/gpu/drm/sun4i/sun4i_backend.c
index f7a15c1a93bf..3ab560450a82 100644
--- a/drivers/gpu/drm/sun4i/sun4i_backend.c
+++ b/drivers/gpu/drm/sun4i/sun4i_backend.c
@@ -190,7 +190,7 @@ int sun4i_backend_update_layer_buffer(struct sun4i_backend *backend,
         /* Get the physical address of the buffer in memory */
         gem = drm_fb_cma_get_gem_obj(fb, 0);
 
-        DRM_DEBUG_DRIVER("Using GEM @ 0x%x\n", gem->paddr);
+        DRM_DEBUG_DRIVER("Using GEM @ %pad\n", &gem->paddr);
 
         /* Compute the start of the displayed memory */
         bpp = drm_format_plane_cpp(fb->pixel_format, 0);
@@ -198,7 +198,7 @@ int sun4i_backend_update_layer_buffer(struct sun4i_backend *backend,
         paddr += (state->src_x >> 16) * bpp;
         paddr += (state->src_y >> 16) * fb->pitches[0];
 
-        DRM_DEBUG_DRIVER("Setting buffer address to 0x%x\n", paddr);
+        DRM_DEBUG_DRIVER("Setting buffer address to %pad\n", &paddr);
 
         /* Write the 32 lower bits of the address (in bits) */
         lo_paddr = paddr << 3;
diff --git a/drivers/gpu/drm/sun4i/sun4i_dotclock.c b/drivers/gpu/drm/sun4i/sun4i_dotclock.c
index 3ff668cb463c..5b3463197c48 100644
--- a/drivers/gpu/drm/sun4i/sun4i_dotclock.c
+++ b/drivers/gpu/drm/sun4i/sun4i_dotclock.c
@@ -72,14 +72,40 @@ static unsigned long sun4i_dclk_recalc_rate(struct clk_hw *hw,
 static long sun4i_dclk_round_rate(struct clk_hw *hw, unsigned long rate,
                                   unsigned long *parent_rate)
 {
-        return *parent_rate / DIV_ROUND_CLOSEST(*parent_rate, rate);
+        unsigned long best_parent = 0;
+        u8 best_div = 1;
+        int i;
+
+        for (i = 6; i < 127; i++) {
+                unsigned long ideal = rate * i;
+                unsigned long rounded;
+
+                rounded = clk_hw_round_rate(clk_hw_get_parent(hw),
+                                            ideal);
+
+                if (rounded == ideal) {
+                        best_parent = rounded;
+                        best_div = i;
+                        goto out;
+                }
+
+                if ((rounded < ideal) && (rounded > best_parent)) {
+                        best_parent = rounded;
+                        best_div = i;
+                }
+        }
+
+out:
+        *parent_rate = best_parent;
+
+        return best_parent / best_div;
 }
 
 static int sun4i_dclk_set_rate(struct clk_hw *hw, unsigned long rate,
                                unsigned long parent_rate)
 {
         struct sun4i_dclk *dclk = hw_to_dclk(hw);
-        int div = DIV_ROUND_CLOSEST(parent_rate, rate);
+        u8 div = parent_rate / rate;
 
         return regmap_update_bits(dclk->regmap, SUN4I_TCON0_DCLK_REG,
                                   GENMASK(6, 0), div);
@@ -127,10 +153,14 @@ int sun4i_dclk_create(struct device *dev, struct sun4i_tcon *tcon)
         const char *clk_name, *parent_name;
         struct clk_init_data init;
         struct sun4i_dclk *dclk;
+        int ret;
 
         parent_name = __clk_get_name(tcon->sclk0);
-        of_property_read_string_index(dev->of_node, "clock-output-names", 0,
-                                      &clk_name);
+        ret = of_property_read_string_index(dev->of_node,
+                                            "clock-output-names", 0,
+                                            &clk_name);
+        if (ret)
+                return ret;
 
         dclk = devm_kzalloc(dev, sizeof(*dclk), GFP_KERNEL);
         if (!dclk)
@@ -140,6 +170,7 @@ int sun4i_dclk_create(struct device *dev, struct sun4i_tcon *tcon)
         init.ops = &sun4i_dclk_ops;
         init.parent_names = &parent_name;
         init.num_parents = 1;
+        init.flags = CLK_SET_RATE_PARENT;
 
         dclk->regmap = tcon->regs;
         dclk->hw.init = &init;
diff --git a/drivers/gpu/drm/sun4i/sun4i_drv.c b/drivers/gpu/drm/sun4i/sun4i_drv.c
index 76e922bb60e5..257d2b4f3645 100644
--- a/drivers/gpu/drm/sun4i/sun4i_drv.c
+++ b/drivers/gpu/drm/sun4i/sun4i_drv.c
@@ -24,34 +24,6 @@
 #include "sun4i_layer.h"
 #include "sun4i_tcon.h"
 
-static int sun4i_drv_connector_plug_all(struct drm_device *drm)
-{
-        struct drm_connector *connector, *failed;
-        int ret;
-
-        mutex_lock(&drm->mode_config.mutex);
-        list_for_each_entry(connector, &drm->mode_config.connector_list, head) {
-                ret = drm_connector_register(connector);
-                if (ret) {
-                        failed = connector;
-                        goto err;
-                }
-        }
-        mutex_unlock(&drm->mode_config.mutex);
-        return 0;
-
-err:
-        list_for_each_entry(connector, &drm->mode_config.connector_list, head) {
-                if (failed == connector)
-                        break;
-
-                drm_connector_unregister(connector);
-        }
-        mutex_unlock(&drm->mode_config.mutex);
-
-        return ret;
-}
-
 static int sun4i_drv_enable_vblank(struct drm_device *drm, unsigned int pipe)
 {
         struct sun4i_drv *drv = drm->dev_private;
@@ -125,6 +97,22 @@ static struct drm_driver sun4i_drv_driver = {
         .disable_vblank         = sun4i_drv_disable_vblank,
 };
 
+static void sun4i_remove_framebuffers(void)
+{
+        struct apertures_struct *ap;
+
+        ap = alloc_apertures(1);
+        if (!ap)
+                return;
+
+        /* The framebuffer can be located anywhere in RAM */
+        ap->ranges[0].base = 0;
+        ap->ranges[0].size = ~0;
+
+        remove_conflicting_framebuffers(ap, "sun4i-drm-fb", false);
+        kfree(ap);
+}
+
 static int sun4i_drv_bind(struct device *dev)
 {
         struct drm_device *drm;
@@ -172,6 +160,9 @@ static int sun4i_drv_bind(struct device *dev)
         }
         drm->irq_enabled = true;
 
+        /* Remove early framebuffers (ie. simplefb) */
+        sun4i_remove_framebuffers();
+
         /* Create our framebuffer */
         drv->fbdev = sun4i_framebuffer_init(drm);
         if (IS_ERR(drv->fbdev)) {
@@ -187,7 +178,7 @@ static int sun4i_drv_bind(struct device *dev)
         if (ret)
                 goto free_drm;
 
-        ret = sun4i_drv_connector_plug_all(drm);
+        ret = drm_connector_register_all(drm);
         if (ret)
                 goto unregister_drm;
 
@@ -204,6 +195,7 @@ static void sun4i_drv_unbind(struct device *dev)
 {
         struct drm_device *drm = dev_get_drvdata(dev);
 
+        drm_connector_unregister_all(drm);
         drm_dev_unregister(drm);
         drm_kms_helper_poll_fini(drm);
         sun4i_framebuffer_free(drm);
diff --git a/drivers/gpu/drm/sun4i/sun4i_rgb.c b/drivers/gpu/drm/sun4i/sun4i_rgb.c
index ab6494818050..aaffe9e64ffb 100644
--- a/drivers/gpu/drm/sun4i/sun4i_rgb.c
+++ b/drivers/gpu/drm/sun4i/sun4i_rgb.c
@@ -54,8 +54,13 @@ static int sun4i_rgb_get_modes(struct drm_connector *connector)
 static int sun4i_rgb_mode_valid(struct drm_connector *connector,
                                 struct drm_display_mode *mode)
 {
+        struct sun4i_rgb *rgb = drm_connector_to_sun4i_rgb(connector);
+        struct sun4i_drv *drv = rgb->drv;
+        struct sun4i_tcon *tcon = drv->tcon;
         u32 hsync = mode->hsync_end - mode->hsync_start;
         u32 vsync = mode->vsync_end - mode->vsync_start;
+        unsigned long rate = mode->clock * 1000;
+        long rounded_rate;
 
         DRM_DEBUG_DRIVER("Validating modes...\n");
 
@@ -87,6 +92,15 @@ static int sun4i_rgb_mode_valid(struct drm_connector *connector,
 
         DRM_DEBUG_DRIVER("Vertical parameters OK\n");
 
+        rounded_rate = clk_round_rate(tcon->dclk, rate);
+        if (rounded_rate < rate)
+                return MODE_CLOCK_LOW;
+
+        if (rounded_rate > rate)
+                return MODE_CLOCK_HIGH;
+
+        DRM_DEBUG_DRIVER("Clock rate OK\n");
+
         return MODE_OK;
 }
 
@@ -203,7 +217,7 @@ int sun4i_rgb_init(struct drm_device *drm)
         int ret;
 
         /* If we don't have a panel, there's no point in going on */
-        if (!tcon->panel)
+        if (IS_ERR(tcon->panel))
                 return -ENODEV;
 
         rgb = devm_kzalloc(drm->dev, sizeof(*rgb), GFP_KERNEL);
diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.c b/drivers/gpu/drm/sun4i/sun4i_tcon.c
index 9f19b0e08560..652385f09735 100644
--- a/drivers/gpu/drm/sun4i/sun4i_tcon.c
+++ b/drivers/gpu/drm/sun4i/sun4i_tcon.c
@@ -425,11 +425,11 @@ static struct drm_panel *sun4i_tcon_find_panel(struct device_node *node)
 
         remote = of_graph_get_remote_port_parent(end_node);
         if (!remote) {
-                DRM_DEBUG_DRIVER("Enable to parse remote node\n");
+                DRM_DEBUG_DRIVER("Unable to parse remote node\n");
                 return ERR_PTR(-EINVAL);
         }
 
-        return of_drm_find_panel(remote);
+        return of_drm_find_panel(remote) ?: ERR_PTR(-EPROBE_DEFER);
 }
 
 static int sun4i_tcon_bind(struct device *dev, struct device *master,
@@ -490,7 +490,11 @@ static int sun4i_tcon_bind(struct device *dev, struct device *master,
                 return 0;
         }
 
-        return sun4i_rgb_init(drm);
+        ret = sun4i_rgb_init(drm);
+        if (ret < 0)
+                goto err_free_clocks;
+
+        return 0;
 
 err_free_clocks:
         sun4i_tcon_free_clocks(tcon);
@@ -522,12 +526,13 @@ static int sun4i_tcon_probe(struct platform_device *pdev)
          * Defer the probe.
          */
         panel = sun4i_tcon_find_panel(node);
-        if (IS_ERR(panel)) {
-                /*
-                 * If we don't have a panel endpoint, just go on
-                 */
-                if (PTR_ERR(panel) != -ENODEV)
-                        return -EPROBE_DEFER;
+
+        /*
+         * If we don't have a panel endpoint, just go on
+         */
+        if (PTR_ERR(panel) == -EPROBE_DEFER) {
+                DRM_DEBUG_DRIVER("Still waiting for our panel. Deferring...\n");
+                return -EPROBE_DEFER;
         }
 
         return component_add(&pdev->dev, &sun4i_tcon_ops);
diff --git a/drivers/gpu/drm/vc4/vc4_crtc.c b/drivers/gpu/drm/vc4/vc4_crtc.c
index 904d0754ad78..0f18b76c7906 100644
--- a/drivers/gpu/drm/vc4/vc4_crtc.c
+++ b/drivers/gpu/drm/vc4/vc4_crtc.c
@@ -456,14 +456,6 @@ static void vc4_crtc_atomic_flush(struct drm_crtc *crtc,
 
         WARN_ON_ONCE(dlist_next - dlist_start != vc4_state->mm.size);
 
-        HVS_WRITE(SCALER_DISPLISTX(vc4_crtc->channel),
-                  vc4_state->mm.start);
-
-        if (debug_dump_regs) {
-                DRM_INFO("CRTC %d HVS after:\n", drm_crtc_index(crtc));
-                vc4_hvs_dump_state(dev);
-        }
-
         if (crtc->state->event) {
                 unsigned long flags;
 
@@ -473,8 +465,20 @@ static void vc4_crtc_atomic_flush(struct drm_crtc *crtc,
 
                 spin_lock_irqsave(&dev->event_lock, flags);
                 vc4_crtc->event = crtc->state->event;
-                spin_unlock_irqrestore(&dev->event_lock, flags);
                 crtc->state->event = NULL;
+
+                HVS_WRITE(SCALER_DISPLISTX(vc4_crtc->channel),
+                          vc4_state->mm.start);
+
+                spin_unlock_irqrestore(&dev->event_lock, flags);
+        } else {
+                HVS_WRITE(SCALER_DISPLISTX(vc4_crtc->channel),
+                          vc4_state->mm.start);
+        }
+
+        if (debug_dump_regs) {
+                DRM_INFO("CRTC %d HVS after:\n", drm_crtc_index(crtc));
+                vc4_hvs_dump_state(dev);
         }
 }
 
@@ -500,12 +504,17 @@ static void vc4_crtc_handle_page_flip(struct vc4_crtc *vc4_crtc)
 {
         struct drm_crtc *crtc = &vc4_crtc->base;
         struct drm_device *dev = crtc->dev;
+        struct vc4_dev *vc4 = to_vc4_dev(dev);
+        struct vc4_crtc_state *vc4_state = to_vc4_crtc_state(crtc->state);
+        u32 chan = vc4_crtc->channel;
         unsigned long flags;
 
         spin_lock_irqsave(&dev->event_lock, flags);
-        if (vc4_crtc->event) {
+        if (vc4_crtc->event &&
+            (vc4_state->mm.start == HVS_READ(SCALER_DISPLACTX(chan)))) {
                 drm_crtc_send_vblank_event(crtc, vc4_crtc->event);
                 vc4_crtc->event = NULL;
+                drm_crtc_vblank_put(crtc);
         }
         spin_unlock_irqrestore(&dev->event_lock, flags);
 }
@@ -556,6 +565,7 @@ vc4_async_page_flip_complete(struct vc4_seqno_cb *cb)
                 spin_unlock_irqrestore(&dev->event_lock, flags);
         }
 
+        drm_crtc_vblank_put(crtc);
         drm_framebuffer_unreference(flip_state->fb);
         kfree(flip_state);
 
@@ -598,6 +608,8 @@ static int vc4_async_page_flip(struct drm_crtc *crtc,
                 return ret;
         }
 
+        WARN_ON(drm_crtc_vblank_get(crtc) != 0);
+
         /* Immediately update the plane's legacy fb pointer, so that later
          * modeset prep sees the state that will be present when the semaphore
          * is released.
diff --git a/drivers/gpu/drm/vc4/vc4_drv.c b/drivers/gpu/drm/vc4/vc4_drv.c
index 3446ece21b4a..250ed7e3754c 100644
--- a/drivers/gpu/drm/vc4/vc4_drv.c
+++ b/drivers/gpu/drm/vc4/vc4_drv.c
@@ -66,12 +66,12 @@ static const struct file_operations vc4_drm_fops = {
 };
 
 static const struct drm_ioctl_desc vc4_drm_ioctls[] = {
-        DRM_IOCTL_DEF_DRV(VC4_SUBMIT_CL, vc4_submit_cl_ioctl, 0),
-        DRM_IOCTL_DEF_DRV(VC4_WAIT_SEQNO, vc4_wait_seqno_ioctl, 0),
-        DRM_IOCTL_DEF_DRV(VC4_WAIT_BO, vc4_wait_bo_ioctl, 0),
-        DRM_IOCTL_DEF_DRV(VC4_CREATE_BO, vc4_create_bo_ioctl, 0),
-        DRM_IOCTL_DEF_DRV(VC4_MMAP_BO, vc4_mmap_bo_ioctl, 0),
-        DRM_IOCTL_DEF_DRV(VC4_CREATE_SHADER_BO, vc4_create_shader_bo_ioctl, 0),
+        DRM_IOCTL_DEF_DRV(VC4_SUBMIT_CL, vc4_submit_cl_ioctl, DRM_RENDER_ALLOW),
+        DRM_IOCTL_DEF_DRV(VC4_WAIT_SEQNO, vc4_wait_seqno_ioctl, DRM_RENDER_ALLOW),
+        DRM_IOCTL_DEF_DRV(VC4_WAIT_BO, vc4_wait_bo_ioctl, DRM_RENDER_ALLOW),
+        DRM_IOCTL_DEF_DRV(VC4_CREATE_BO, vc4_create_bo_ioctl, DRM_RENDER_ALLOW),
+        DRM_IOCTL_DEF_DRV(VC4_MMAP_BO, vc4_mmap_bo_ioctl, DRM_RENDER_ALLOW),
+        DRM_IOCTL_DEF_DRV(VC4_CREATE_SHADER_BO, vc4_create_shader_bo_ioctl, DRM_RENDER_ALLOW),
         DRM_IOCTL_DEF_DRV(VC4_GET_HANG_STATE, vc4_get_hang_state_ioctl,
                           DRM_ROOT_ONLY),
 };
@@ -91,7 +91,7 @@ static struct drm_driver vc4_drm_driver = {
 
         .enable_vblank = vc4_enable_vblank,
         .disable_vblank = vc4_disable_vblank,
-        .get_vblank_counter = drm_vblank_count,
+        .get_vblank_counter = drm_vblank_no_hw_counter,
 
 #if defined(CONFIG_DEBUG_FS)
         .debugfs_init = vc4_debugfs_init,
diff --git a/drivers/gpu/drm/vc4/vc4_kms.c b/drivers/gpu/drm/vc4/vc4_kms.c
index cb37751bc99f..861a623bc185 100644
--- a/drivers/gpu/drm/vc4/vc4_kms.c
+++ b/drivers/gpu/drm/vc4/vc4_kms.c
@@ -117,10 +117,18 @@ static int vc4_atomic_commit(struct drm_device *dev,
                 return -ENOMEM;
 
         /* Make sure that any outstanding modesets have finished. */
-        ret = down_interruptible(&vc4->async_modeset);
-        if (ret) {
-                kfree(c);
-                return ret;
+        if (nonblock) {
+                ret = down_trylock(&vc4->async_modeset);
+                if (ret) {
+                        kfree(c);
+                        return -EBUSY;
+                }
+        } else {
+                ret = down_interruptible(&vc4->async_modeset);
+                if (ret) {
+                        kfree(c);
+                        return ret;
+                }
         }
 
         ret = drm_atomic_helper_prepare_planes(dev, state);
diff --git a/drivers/gpu/drm/vc4/vc4_regs.h b/drivers/gpu/drm/vc4/vc4_regs.h
index 6163b95c5411..f99eece4cc97 100644
--- a/drivers/gpu/drm/vc4/vc4_regs.h
+++ b/drivers/gpu/drm/vc4/vc4_regs.h
@@ -341,6 +341,10 @@
 #define SCALER_DISPLACT0                        0x00000030
 #define SCALER_DISPLACT1                        0x00000034
 #define SCALER_DISPLACT2                        0x00000038
+#define SCALER_DISPLACTX(x)                     (SCALER_DISPLACT0 +     \
+                                                 (x) * (SCALER_DISPLACT1 - \
+                                                        SCALER_DISPLACT0))
+
 #define SCALER_DISPCTRL0                        0x00000040
 # define SCALER_DISPCTRLX_ENABLE                BIT(31)
 # define SCALER_DISPCTRLX_RESET                 BIT(30)
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
index 6de283c8fa3e..f0374f9b56ca 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
@@ -28,6 +28,7 @@
 #include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
+#include <linux/frame.h>
 #include <asm/hypervisor.h>
 #include "drmP.h"
 #include "vmwgfx_msg.h"
@@ -194,7 +195,7 @@ static int vmw_send_msg(struct rpc_channel *channel, const char *msg)
 
         return -EINVAL;
 }
-
+STACK_FRAME_NON_STANDARD(vmw_send_msg);
 
 
 /**
@@ -304,6 +305,7 @@ static int vmw_recv_msg(struct rpc_channel *channel, void **msg,
 
         return 0;
 }
+STACK_FRAME_NON_STANDARD(vmw_recv_msg);
 
 
 /**
diff --git a/drivers/hid/hid-elo.c b/drivers/hid/hid-elo.c
index aad8c162a825..0cd4f7216239 100644
--- a/drivers/hid/hid-elo.c
+++ b/drivers/hid/hid-elo.c
@@ -261,7 +261,7 @@ static void elo_remove(struct hid_device *hdev)
         struct elo_priv *priv = hid_get_drvdata(hdev);
 
         hid_hw_stop(hdev);
-        flush_workqueue(wq);
+        cancel_delayed_work_sync(&priv->work);
         kfree(priv);
 }
 
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index c741f5e50a66..fb6f1f447279 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -61,6 +61,7 @@ MODULE_LICENSE("GPL");
 #define MT_QUIRK_ALWAYS_VALID           (1 << 4)
 #define MT_QUIRK_VALID_IS_INRANGE       (1 << 5)
 #define MT_QUIRK_VALID_IS_CONFIDENCE    (1 << 6)
+#define MT_QUIRK_CONFIDENCE             (1 << 7)
 #define MT_QUIRK_SLOT_IS_CONTACTID_MINUS_ONE    (1 << 8)
 #define MT_QUIRK_NO_AREA                (1 << 9)
 #define MT_QUIRK_IGNORE_DUPLICATES      (1 << 10)
@@ -78,6 +79,7 @@ struct mt_slot {
         __s32 contactid;        /* the device ContactID assigned to this slot */
         bool touch_state;       /* is the touch valid? */
         bool inrange_state;     /* is the finger in proximity of the sensor? */
+        bool confidence_state;  /* is the touch made by a finger? */
 };
 
 struct mt_class {
@@ -503,10 +505,8 @@ static int mt_touch_input_mapping(struct hid_device *hdev, struct hid_input *hi,
                         return 1;
                 case HID_DG_CONFIDENCE:
                         if (cls->name == MT_CLS_WIN_8 &&
-                                field->application == HID_DG_TOUCHPAD) {
-                                cls->quirks &= ~MT_QUIRK_ALWAYS_VALID;
-                                cls->quirks |= MT_QUIRK_VALID_IS_CONFIDENCE;
-                        }
+                                field->application == HID_DG_TOUCHPAD)
+                                cls->quirks |= MT_QUIRK_CONFIDENCE;
                         mt_store_field(usage, td, hi);
                         return 1;
                 case HID_DG_TIPSWITCH:
@@ -619,6 +619,7 @@ static void mt_complete_slot(struct mt_device *td, struct input_dev *input)
                 return;
 
         if (td->curvalid || (td->mtclass.quirks & MT_QUIRK_ALWAYS_VALID)) {
+                int active;
                 int slotnum = mt_compute_slot(td, input);
                 struct mt_slot *s = &td->curdata;
                 struct input_mt *mt = input->mt;
@@ -633,10 +634,14 @@ static void mt_complete_slot(struct mt_device *td, struct input_dev *input)
                                 return;
                 }
 
+                if (!(td->mtclass.quirks & MT_QUIRK_CONFIDENCE))
+                        s->confidence_state = 1;
+                active = (s->touch_state || s->inrange_state) &&
+                                                        s->confidence_state;
+
                 input_mt_slot(input, slotnum);
-                input_mt_report_slot_state(input, MT_TOOL_FINGER,
-                        s->touch_state || s->inrange_state);
-                if (s->touch_state || s->inrange_state) {
+                input_mt_report_slot_state(input, MT_TOOL_FINGER, active);
+                if (active) {
                         /* this finger is in proximity of the sensor */
                         int wide = (s->w > s->h);
                         /* divided by two to match visual scale of touch */
@@ -701,6 +706,8 @@ static void mt_process_mt_event(struct hid_device *hid, struct hid_field *field,
                         td->curdata.touch_state = value;
                         break;
                 case HID_DG_CONFIDENCE:
+                        if (quirks & MT_QUIRK_CONFIDENCE)
+                                td->curdata.confidence_state = value;
                         if (quirks & MT_QUIRK_VALID_IS_CONFIDENCE)
                                 td->curvalid = value;
                         break;
@@ -1401,6 +1408,11 @@ static const struct hid_device_id mt_devices[] = {
                 MT_USB_DEVICE(USB_VENDOR_ID_NOVATEK,
                         USB_DEVICE_ID_NOVATEK_PCT) },
 
+        /* Ntrig Panel */
+        { .driver_data = MT_CLS_NSMU,
+                HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8,
+                        USB_VENDOR_ID_NTRIG, 0x1b05) },
+
         /* PixArt optical touch screen */
         { .driver_data = MT_CLS_INRANGE_CONTACTNUMBER,
                 MT_USB_DEVICE(USB_VENDOR_ID_PIXART,
diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
index 2f1ddca6f2e0..700145b15088 100644
--- a/drivers/hid/usbhid/hiddev.c
+++ b/drivers/hid/usbhid/hiddev.c
@@ -516,13 +516,13 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd,
                                         goto inval;
                         } else if (uref->usage_index >= field->report_count)
                                 goto inval;
-
-                        else if ((cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) &&
-                                 (uref_multi->num_values > HID_MAX_MULTI_USAGES ||
-                                  uref->usage_index + uref_multi->num_values > field->report_count))
-                                goto inval;
                 }
 
+                if ((cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) &&
+                    (uref_multi->num_values > HID_MAX_MULTI_USAGES ||
+                     uref->usage_index + uref_multi->num_values > field->report_count))
+                        goto inval;
+
                 switch (cmd) {
                 case HIDIOCGUSAGE:
                         uref->value = field->value[uref->usage_index];
diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c
index c43318d3416e..2ac87d553e22 100644
--- a/drivers/hwmon/dell-smm-hwmon.c
+++ b/drivers/hwmon/dell-smm-hwmon.c
@@ -35,6 +35,7 @@
 #include <linux/uaccess.h>
 #include <linux/io.h>
 #include <linux/sched.h>
+#include <linux/ctype.h>
 
 #include <linux/i8k.h>
 
@@ -66,11 +67,13 @@
 
 static DEFINE_MUTEX(i8k_mutex);
 static char bios_version[4];
+static char bios_machineid[16];
 static struct device *i8k_hwmon_dev;
 static u32 i8k_hwmon_flags;
 static uint i8k_fan_mult = I8K_FAN_MULT;
 static uint i8k_pwm_mult;
 static uint i8k_fan_max = I8K_FAN_HIGH;
+static bool disallow_fan_type_call;
 
 #define I8K_HWMON_HAVE_TEMP1    (1 << 0)
 #define I8K_HWMON_HAVE_TEMP2    (1 << 1)
@@ -94,13 +97,13 @@ module_param(ignore_dmi, bool, 0);
 MODULE_PARM_DESC(ignore_dmi, "Continue probing hardware even if DMI data does not match");
 
 #if IS_ENABLED(CONFIG_I8K)
-static bool restricted;
+static bool restricted = true;
 module_param(restricted, bool, 0);
-MODULE_PARM_DESC(restricted, "Allow fan control if SYS_ADMIN capability set");
+MODULE_PARM_DESC(restricted, "Restrict fan control and serial number to CAP_SYS_ADMIN (default: 1)");
 
 static bool power_status;
 module_param(power_status, bool, 0600);
-MODULE_PARM_DESC(power_status, "Report power status in /proc/i8k");
+MODULE_PARM_DESC(power_status, "Report power status in /proc/i8k (default: 0)");
 #endif
 
 static uint fan_mult;
@@ -235,14 +238,28 @@ static int i8k_get_fan_speed(int fan)
 /*
  * Read the fan type.
  */
-static int i8k_get_fan_type(int fan)
+static int _i8k_get_fan_type(int fan)
 {
         struct smm_regs regs = { .eax = I8K_SMM_GET_FAN_TYPE, };
 
+        if (disallow_fan_type_call)
+                return -EINVAL;
+
         regs.ebx = fan & 0xff;
         return i8k_smm(&regs) ? : regs.eax & 0xff;
 }
 
+static int i8k_get_fan_type(int fan)
+{
+        /* I8K_SMM_GET_FAN_TYPE SMM call is expensive, so cache values */
+        static int types[2] = { INT_MIN, INT_MIN };
+
+        if (types[fan] == INT_MIN)
+                types[fan] = _i8k_get_fan_type(fan);
+
+        return types[fan];
+}
+
 /*
  * Read the fan nominal rpm for specific fan speed.
  */
@@ -387,14 +404,20 @@ i8k_ioctl_unlocked(struct file *fp, unsigned int cmd, unsigned long arg)
 
         switch (cmd) {
         case I8K_BIOS_VERSION:
+                if (!isdigit(bios_version[0]) || !isdigit(bios_version[1]) ||
+                    !isdigit(bios_version[2]))
+                        return -EINVAL;
+
                 val = (bios_version[0] << 16) |
                                 (bios_version[1] << 8) | bios_version[2];
                 break;
 
         case I8K_MACHINE_ID:
-                memset(buff, 0, 16);
-                strlcpy(buff, i8k_get_dmi_data(DMI_PRODUCT_SERIAL),
-                        sizeof(buff));
+                if (restricted && !capable(CAP_SYS_ADMIN))
+                        return -EPERM;
+
+                memset(buff, 0, sizeof(buff));
+                strlcpy(buff, bios_machineid, sizeof(buff));
                 break;
 
         case I8K_FN_STATUS:
@@ -511,7 +534,7 @@ static int i8k_proc_show(struct seq_file *seq, void *offset)
         seq_printf(seq, "%s %s %s %d %d %d %d %d %d %d\n",
                    I8K_PROC_FMT,
                    bios_version,
-                   i8k_get_dmi_data(DMI_PRODUCT_SERIAL),
+                   (restricted && !capable(CAP_SYS_ADMIN)) ? "-1" : bios_machineid,
                    cpu_temp,
                    left_fan, right_fan, left_speed, right_speed,
                    ac_power, fn_key);
@@ -718,6 +741,9 @@ static struct attribute *i8k_attrs[] = {
 static umode_t i8k_is_visible(struct kobject *kobj, struct attribute *attr,
                               int index)
 {
+        if (disallow_fan_type_call &&
+            (index == 9 || index == 12))
+                return 0;
         if (index >= 0 && index <= 1 &&
             !(i8k_hwmon_flags & I8K_HWMON_HAVE_TEMP1))
                 return 0;
@@ -767,13 +793,17 @@ static int __init i8k_init_hwmon(void)
         if (err >= 0)
                 i8k_hwmon_flags |= I8K_HWMON_HAVE_TEMP4;
 
-        /* First fan attributes, if fan type is OK */
-        err = i8k_get_fan_type(0);
+        /* First fan attributes, if fan status or type is OK */
+        err = i8k_get_fan_status(0);
+        if (err < 0)
+                err = i8k_get_fan_type(0);
         if (err >= 0)
                 i8k_hwmon_flags |= I8K_HWMON_HAVE_FAN1;
 
-        /* Second fan attributes, if fan type is OK */
-        err = i8k_get_fan_type(1);
+        /* Second fan attributes, if fan status or type is OK */
+        err = i8k_get_fan_status(1);
+        if (err < 0)
+                err = i8k_get_fan_type(1);
         if (err >= 0)
                 i8k_hwmon_flags |= I8K_HWMON_HAVE_FAN2;
 
@@ -929,12 +959,14 @@ static struct dmi_system_id i8k_dmi_table[] __initdata = {
 
 MODULE_DEVICE_TABLE(dmi, i8k_dmi_table);
 
-static struct dmi_system_id i8k_blacklist_dmi_table[] __initdata = {
+/*
+ * On some machines once I8K_SMM_GET_FAN_TYPE is issued then CPU fan speed
+ * randomly going up and down due to bug in Dell SMM or BIOS. Here is blacklist
+ * of affected Dell machines for which we disallow I8K_SMM_GET_FAN_TYPE call.
+ * See bug: https://bugzilla.kernel.org/show_bug.cgi?id=100121
+ */
+static struct dmi_system_id i8k_blacklist_fan_type_dmi_table[] __initdata = {
         {
-                /*
-                 * CPU fan speed going up and down on Dell Studio XPS 8000
-                 * for unknown reasons.
-                 */
                 .ident = "Dell Studio XPS 8000",
                 .matches = {
                         DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
@@ -942,16 +974,19 @@ static struct dmi_system_id i8k_blacklist_dmi_table[] __initdata = {
                 },
         },
         {
-                /*
-                 * CPU fan speed going up and down on Dell Studio XPS 8100
-                 * for unknown reasons.
-                 */
                 .ident = "Dell Studio XPS 8100",
                 .matches = {
                         DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
                         DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Studio XPS 8100"),
                 },
         },
+        {
+                .ident = "Dell Inspiron 580",
+                .matches = {
+                        DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                        DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Inspiron 580 "),
+                },
+        },
         { }
 };
 
@@ -966,8 +1001,7 @@ static int __init i8k_probe(void)
         /*
          * Get DMI information
          */
-        if (!dmi_check_system(i8k_dmi_table) ||
-            dmi_check_system(i8k_blacklist_dmi_table)) {
+        if (!dmi_check_system(i8k_dmi_table)) {
                 if (!ignore_dmi && !force)
                         return -ENODEV;
 
@@ -978,8 +1012,13 @@ static int __init i8k_probe(void)
                         i8k_get_dmi_data(DMI_BIOS_VERSION));
         }
 
+        if (dmi_check_system(i8k_blacklist_fan_type_dmi_table))
+                disallow_fan_type_call = true;
+
         strlcpy(bios_version, i8k_get_dmi_data(DMI_BIOS_VERSION),
                 sizeof(bios_version));
+        strlcpy(bios_machineid, i8k_get_dmi_data(DMI_PRODUCT_SERIAL),
+                sizeof(bios_machineid));
 
         /*
          * Get SMM Dell signature
diff --git a/drivers/hwmon/fam15h_power.c b/drivers/hwmon/fam15h_power.c
index eb97a9241d17..15aa49d082c4 100644
--- a/drivers/hwmon/fam15h_power.c
+++ b/drivers/hwmon/fam15h_power.c
@@ -172,9 +172,9 @@ static void do_read_registers_on_cu(void *_data)
  */
 static int read_registers(struct fam15h_power_data *data)
 {
-        int this_cpu, ret, cpu;
         int core, this_core;
         cpumask_var_t mask;
+        int ret, cpu;
 
         ret = zalloc_cpumask_var(&mask, GFP_KERNEL);
         if (!ret)
@@ -183,7 +183,6 @@ static int read_registers(struct fam15h_power_data *data)
         memset(data->cu_on, 0, sizeof(int) * MAX_CUS);
 
         get_online_cpus();
-        this_cpu = smp_processor_id();
 
         /*
          * Choose the first online core of each compute unit, and then
@@ -205,12 +204,9 @@ static int read_registers(struct fam15h_power_data *data)
                 cpumask_set_cpu(cpumask_any(topology_sibling_cpumask(cpu)), mask);
         }
 
-        if (cpumask_test_cpu(this_cpu, mask))
-                do_read_registers_on_cu(data);
+        on_each_cpu_mask(mask, do_read_registers_on_cu, data, true);
 
-        smp_call_function_many(mask, do_read_registers_on_cu, data, true);
         put_online_cpus();
-
         free_cpumask_var(mask);
 
         return 0;
diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c
index c9ff08dbe10c..e30a5939dc0d 100644
--- a/drivers/hwmon/lm90.c
+++ b/drivers/hwmon/lm90.c
@@ -375,7 +375,7 @@ struct lm90_data {
         int kind;
         u32 flags;
 
-        int update_interval;    /* in milliseconds */
+        unsigned int update_interval; /* in milliseconds */
 
         u8 config_orig;         /* Original configuration register value */
         u8 convrate_orig;       /* Original conversion rate register value */
diff --git a/drivers/hwtracing/coresight/coresight-tmc-etr.c b/drivers/hwtracing/coresight/coresight-tmc-etr.c
index 847d1b5f2c13..688be9e060fc 100644
--- a/drivers/hwtracing/coresight/coresight-tmc-etr.c
+++ b/drivers/hwtracing/coresight/coresight-tmc-etr.c
@@ -300,13 +300,10 @@ int tmc_read_unprepare_etr(struct tmc_drvdata *drvdata)
         if (local_read(&drvdata->mode) == CS_MODE_SYSFS) {
                 /*
                  * The trace run will continue with the same allocated trace
-                 * buffer. As such zero-out the buffer so that we don't end
-                 * up with stale data.
-                 *
-                 * Since the tracer is still enabled drvdata::buf
-                 * can't be NULL.
+                 * buffer. The trace buffer is cleared in tmc_etr_enable_hw(),
+                 * so we don't have to explicitly clear it. Also, since the
+                 * tracer is still enabled drvdata::buf can't be NULL.
                  */
-                memset(drvdata->buf, 0, drvdata->size);
                 tmc_etr_enable_hw(drvdata);
         } else {
                 /*
@@ -315,7 +312,7 @@ int tmc_read_unprepare_etr(struct tmc_drvdata *drvdata)
                  */
                 vaddr = drvdata->vaddr;
                 paddr = drvdata->paddr;
-                drvdata->buf = NULL;
+                drvdata->buf = drvdata->vaddr = NULL;
         }
 
         drvdata->reading = false;
diff --git a/drivers/hwtracing/coresight/coresight.c b/drivers/hwtracing/coresight/coresight.c
index 5443d03a1eec..d08d1ab9bba5 100644
--- a/drivers/hwtracing/coresight/coresight.c
+++ b/drivers/hwtracing/coresight/coresight.c
@@ -385,7 +385,6 @@ static int _coresight_build_path(struct coresight_device *csdev,
         int i;
         bool found = false;
         struct coresight_node *node;
-        struct coresight_connection *conn;
 
         /* An activated sink has been found.  Enqueue the element */
         if ((csdev->type == CORESIGHT_DEV_TYPE_SINK ||
@@ -394,8 +393,9 @@ static int _coresight_build_path(struct coresight_device *csdev,
 
         /* Not a sink - recursively explore each port found on this element */
         for (i = 0; i < csdev->nr_outport; i++) {
-                conn = &csdev->conns[i];
-                if (_coresight_build_path(conn->child_dev, path) == 0) {
+                struct coresight_device *child_dev = csdev->conns[i].child_dev;
+
+                if (child_dev && _coresight_build_path(child_dev, path) == 0) {
                         found = true;
                         break;
                 }
@@ -425,6 +425,7 @@ out:
 struct list_head *coresight_build_path(struct coresight_device *csdev)
 {
         struct list_head *path;
+        int rc;
 
         path = kzalloc(sizeof(struct list_head), GFP_KERNEL);
         if (!path)
@@ -432,9 +433,10 @@ struct list_head *coresight_build_path(struct coresight_device *csdev)
 
         INIT_LIST_HEAD(path);
 
-        if (_coresight_build_path(csdev, path)) {
+        rc = _coresight_build_path(csdev, path);
+        if (rc) {
                 kfree(path);
-                path = NULL;
+                return ERR_PTR(rc);
         }
 
         return path;
@@ -507,8 +509,9 @@ int coresight_enable(struct coresight_device *csdev)
                 goto out;
 
         path = coresight_build_path(csdev);
-        if (!path) {
+        if (IS_ERR(path)) {
                 pr_err("building path(s) failed\n");
+                ret = PTR_ERR(path);
                 goto out;
         }
 
diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index 64b1208bca5e..4a60ad214747 100644
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -245,6 +245,13 @@ struct i801_priv {
         struct platform_device *mux_pdev;
 #endif
         struct platform_device *tco_pdev;
+
+        /*
+         * If set to true the host controller registers are reserved for
+         * ACPI AML use. Protected by acpi_lock.
+         */
+        bool acpi_reserved;
+        struct mutex acpi_lock;
 };
 
 #define FEATURE_SMBUS_PEC       (1 << 0)
@@ -718,6 +725,12 @@ static s32 i801_access(struct i2c_adapter *adap, u16 addr,
         int ret = 0, xact = 0;
         struct i801_priv *priv = i2c_get_adapdata(adap);
 
+        mutex_lock(&priv->acpi_lock);
+        if (priv->acpi_reserved) {
+                mutex_unlock(&priv->acpi_lock);
+                return -EBUSY;
+        }
+
         pm_runtime_get_sync(&priv->pci_dev->dev);
 
         hwpec = (priv->features & FEATURE_SMBUS_PEC) && (flags & I2C_CLIENT_PEC)
@@ -820,6 +833,7 @@ static s32 i801_access(struct i2c_adapter *adap, u16 addr,
 out:
         pm_runtime_mark_last_busy(&priv->pci_dev->dev);
         pm_runtime_put_autosuspend(&priv->pci_dev->dev);
+        mutex_unlock(&priv->acpi_lock);
         return ret;
 }
 
@@ -1257,6 +1271,83 @@ static void i801_add_tco(struct i801_priv *priv)
         priv->tco_pdev = pdev;
 }
 
+#ifdef CONFIG_ACPI
+static acpi_status
+i801_acpi_io_handler(u32 function, acpi_physical_address address, u32 bits,
+                     u64 *value, void *handler_context, void *region_context)
+{
+        struct i801_priv *priv = handler_context;
+        struct pci_dev *pdev = priv->pci_dev;
+        acpi_status status;
+
+        /*
+         * Once BIOS AML code touches the OpRegion we warn and inhibit any
+         * further access from the driver itself. This device is now owned
+         * by the system firmware.
+         */
+        mutex_lock(&priv->acpi_lock);
+
+        if (!priv->acpi_reserved) {
+                priv->acpi_reserved = true;
+
+                dev_warn(&pdev->dev, "BIOS is accessing SMBus registers\n");
+                dev_warn(&pdev->dev, "Driver SMBus register access inhibited\n");
+
+                /*
+                 * BIOS is accessing the host controller so prevent it from
+                 * suspending automatically from now on.
+                 */
+                pm_runtime_get_sync(&pdev->dev);
+        }
+
+        if ((function & ACPI_IO_MASK) == ACPI_READ)
+                status = acpi_os_read_port(address, (u32 *)value, bits);
+        else
+                status = acpi_os_write_port(address, (u32)*value, bits);
+
+        mutex_unlock(&priv->acpi_lock);
+
+        return status;
+}
+
+static int i801_acpi_probe(struct i801_priv *priv)
+{
+        struct acpi_device *adev;
+        acpi_status status;
+
+        adev = ACPI_COMPANION(&priv->pci_dev->dev);
+        if (adev) {
+                status = acpi_install_address_space_handler(adev->handle,
+                                ACPI_ADR_SPACE_SYSTEM_IO, i801_acpi_io_handler,
+                                NULL, priv);
+                if (ACPI_SUCCESS(status))
+                        return 0;
+        }
+
+        return acpi_check_resource_conflict(&priv->pci_dev->resource[SMBBAR]);
+}
+
+static void i801_acpi_remove(struct i801_priv *priv)
+{
+        struct acpi_device *adev;
+
+        adev = ACPI_COMPANION(&priv->pci_dev->dev);
+        if (!adev)
+                return;
+
+        acpi_remove_address_space_handler(adev->handle,
+                ACPI_ADR_SPACE_SYSTEM_IO, i801_acpi_io_handler);
+
+        mutex_lock(&priv->acpi_lock);
+        if (priv->acpi_reserved)
+                pm_runtime_put(&priv->pci_dev->dev);
+        mutex_unlock(&priv->acpi_lock);
+}
+#else
+static inline int i801_acpi_probe(struct i801_priv *priv) { return 0; }
+static inline void i801_acpi_remove(struct i801_priv *priv) { }
+#endif
+
 static int i801_probe(struct pci_dev *dev, const struct pci_device_id *id)
 {
         unsigned char temp;
@@ -1274,6 +1365,7 @@ static int i801_probe(struct pci_dev *dev, const struct pci_device_id *id)
         priv->adapter.dev.parent = &dev->dev;
         ACPI_COMPANION_SET(&priv->adapter.dev, ACPI_COMPANION(&dev->dev));
         priv->adapter.retries = 3;
+        mutex_init(&priv->acpi_lock);
 
         priv->pci_dev = dev;
         switch (dev->device) {
@@ -1336,10 +1428,8 @@ static int i801_probe(struct pci_dev *dev, const struct pci_device_id *id)
                 return -ENODEV;
         }
 
-        err = acpi_check_resource_conflict(&dev->resource[SMBBAR]);
-        if (err) {
+        if (i801_acpi_probe(priv))
                 return -ENODEV;
-        }
 
         err = pcim_iomap_regions(dev, 1 << SMBBAR,
                                  dev_driver_string(&dev->dev));
@@ -1348,6 +1438,7 @@ static int i801_probe(struct pci_dev *dev, const struct pci_device_id *id)
                         "Failed to request SMBus region 0x%lx-0x%Lx\n",
                         priv->smba,
                         (unsigned long long)pci_resource_end(dev, SMBBAR));
+                i801_acpi_remove(priv);
                 return err;
         }
 
@@ -1412,6 +1503,7 @@ static int i801_probe(struct pci_dev *dev, const struct pci_device_id *id)
         err = i2c_add_adapter(&priv->adapter);
         if (err) {
                 dev_err(&dev->dev, "Failed to add SMBus adapter\n");
+                i801_acpi_remove(priv);
                 return err;
         }
 
@@ -1438,6 +1530,7 @@ static void i801_remove(struct pci_dev *dev)
 
         i801_del_mux(priv);
         i2c_del_adapter(&priv->adapter);
+        i801_acpi_remove(priv);
         pci_write_config_byte(dev, SMBHSTCFG, priv->original_hstcfg);
 
         platform_device_unregister(priv->tco_pdev);
diff --git a/drivers/i2c/busses/i2c-octeon.c b/drivers/i2c/busses/i2c-octeon.c
index aa5f01efd826..30ae35146723 100644
--- a/drivers/i2c/busses/i2c-octeon.c
+++ b/drivers/i2c/busses/i2c-octeon.c
@@ -934,8 +934,15 @@ static int octeon_i2c_read(struct octeon_i2c *i2c, int target,
                 return result;
 
         for (i = 0; i < length; i++) {
-                /* for the last byte TWSI_CTL_AAK must not be set */
-                if (i + 1 == length)
+                /*
+                 * For the last byte to receive TWSI_CTL_AAK must not be set.
+                 *
+                 * A special case is I2C_M_RECV_LEN where we don't know the
+                 * additional length yet. If recv_len is set we assume we're
+                 * not reading the final byte and therefore need to set
+                 * TWSI_CTL_AAK.
+                 */
+                if ((i + 1 == length) && !(recv_len && i == 0))
                         final_read = true;
 
                 /* clear iflg to allow next event */
@@ -950,12 +957,8 @@ static int octeon_i2c_read(struct octeon_i2c *i2c, int target,
 
                 data[i] = octeon_i2c_data_read(i2c);
                 if (recv_len && i == 0) {
-                        if (data[i] > I2C_SMBUS_BLOCK_MAX + 1) {
-                                dev_err(i2c->dev,
-                                        "%s: read len > I2C_SMBUS_BLOCK_MAX %d\n",
-                                        __func__, data[i]);
+                        if (data[i] > I2C_SMBUS_BLOCK_MAX + 1)
                                 return -EPROTO;
-                        }
                         length += data[i];
                 }
 
diff --git a/drivers/i2c/muxes/i2c-mux-reg.c b/drivers/i2c/muxes/i2c-mux-reg.c
index 6773cadf7c9f..26e7c5187a58 100644
--- a/drivers/i2c/muxes/i2c-mux-reg.c
+++ b/drivers/i2c/muxes/i2c-mux-reg.c
@@ -260,6 +260,7 @@ static struct platform_driver i2c_mux_reg_driver = {
         .remove = i2c_mux_reg_remove,
         .driver = {
                 .name   = "i2c-mux-reg",
+                .of_match_table = of_match_ptr(i2c_mux_reg_of_match),
         },
 };
 
diff --git a/drivers/iio/accel/kxsd9.c b/drivers/iio/accel/kxsd9.c
index 923f56598d4b..3a9f106787d2 100644
--- a/drivers/iio/accel/kxsd9.c
+++ b/drivers/iio/accel/kxsd9.c
@@ -81,7 +81,7 @@ static int kxsd9_write_scale(struct iio_dev *indio_dev, int micro)
 
         mutex_lock(&st->buf_lock);
         ret = spi_w8r8(st->us, KXSD9_READ(KXSD9_REG_CTRL_C));
-        if (ret)
+        if (ret < 0)
                 goto error_ret;
         st->tx[0] = KXSD9_WRITE(KXSD9_REG_CTRL_C);
         st->tx[1] = (ret & ~KXSD9_FS_MASK) | i;
@@ -163,7 +163,7 @@ static int kxsd9_read_raw(struct iio_dev *indio_dev,
                 break;
         case IIO_CHAN_INFO_SCALE:
                 ret = spi_w8r8(st->us, KXSD9_READ(KXSD9_REG_CTRL_C));
-                if (ret)
+                if (ret < 0)
                         goto error_ret;
                 *val2 = kxsd9_micro_scales[ret & KXSD9_FS_MASK];
                 ret = IIO_VAL_INT_PLUS_MICRO;
diff --git a/drivers/iio/accel/st_accel_buffer.c b/drivers/iio/accel/st_accel_buffer.c
index a1e642ee13d6..7fddc137e91e 100644
--- a/drivers/iio/accel/st_accel_buffer.c
+++ b/drivers/iio/accel/st_accel_buffer.c
@@ -91,7 +91,7 @@ static const struct iio_buffer_setup_ops st_accel_buffer_setup_ops = {
 
 int st_accel_allocate_ring(struct iio_dev *indio_dev)
 {
-        return iio_triggered_buffer_setup(indio_dev, &iio_pollfunc_store_time,
+        return iio_triggered_buffer_setup(indio_dev, NULL,
                 &st_sensors_trigger_handler, &st_accel_buffer_setup_ops);
 }
 
diff --git a/drivers/iio/accel/st_accel_core.c b/drivers/iio/accel/st_accel_core.c
index dc73f2d85e6d..4d95bfc4786c 100644
--- a/drivers/iio/accel/st_accel_core.c
+++ b/drivers/iio/accel/st_accel_core.c
@@ -741,6 +741,7 @@ static const struct iio_info accel_info = {
 static const struct iio_trigger_ops st_accel_trigger_ops = {
         .owner = THIS_MODULE,
         .set_trigger_state = ST_ACCEL_TRIGGER_SET_STATE,
+        .validate_device = st_sensors_validate_device,
 };
 #define ST_ACCEL_TRIGGER_OPS (&st_accel_trigger_ops)
 #else
diff --git a/drivers/iio/adc/ad7266.c b/drivers/iio/adc/ad7266.c
index 21e19b60e2b9..2123f0ac2e2a 100644
--- a/drivers/iio/adc/ad7266.c
+++ b/drivers/iio/adc/ad7266.c
@@ -396,8 +396,8 @@ static int ad7266_probe(struct spi_device *spi)
 
         st = iio_priv(indio_dev);
 
-        st->reg = devm_regulator_get(&spi->dev, "vref");
-        if (!IS_ERR_OR_NULL(st->reg)) {
+        st->reg = devm_regulator_get_optional(&spi->dev, "vref");
+        if (!IS_ERR(st->reg)) {
                 ret = regulator_enable(st->reg);
                 if (ret)
                         return ret;
@@ -408,6 +408,9 @@ static int ad7266_probe(struct spi_device *spi)
 
                 st->vref_mv = ret / 1000;
         } else {
+                /* Any other error indicates that the regulator does exist */
+                if (PTR_ERR(st->reg) != -ENODEV)
+                        return PTR_ERR(st->reg);
                 /* Use internal reference */
                 st->vref_mv = 2500;
         }
diff --git a/drivers/iio/common/st_sensors/st_sensors_buffer.c b/drivers/iio/common/st_sensors/st_sensors_buffer.c
index c55898543a47..f1693dbebb8a 100644
--- a/drivers/iio/common/st_sensors/st_sensors_buffer.c
+++ b/drivers/iio/common/st_sensors/st_sensors_buffer.c
@@ -57,31 +57,20 @@ irqreturn_t st_sensors_trigger_handler(int irq, void *p)
         struct iio_poll_func *pf = p;
         struct iio_dev *indio_dev = pf->indio_dev;
         struct st_sensor_data *sdata = iio_priv(indio_dev);
+        s64 timestamp;
 
-        /* If we have a status register, check if this IRQ came from us */
-        if (sdata->sensor_settings->drdy_irq.addr_stat_drdy) {
-                u8 status;
-
-                len = sdata->tf->read_byte(&sdata->tb, sdata->dev,
-                           sdata->sensor_settings->drdy_irq.addr_stat_drdy,
-                           &status);
-                if (len < 0)
-                        dev_err(sdata->dev, "could not read channel status\n");
-
-                /*
-                 * If this was not caused by any channels on this sensor,
-                 * return IRQ_NONE
-                 */
-                if (!(status & (u8)indio_dev->active_scan_mask[0]))
-                        return IRQ_NONE;
-        }
+        /* If we do timetamping here, do it before reading the values */
+        if (sdata->hw_irq_trigger)
+                timestamp = sdata->hw_timestamp;
+        else
+                timestamp = iio_get_time_ns();
 
         len = st_sensors_get_buffer_element(indio_dev, sdata->buffer_data);
         if (len < 0)
                 goto st_sensors_get_buffer_element_error;
 
         iio_push_to_buffers_with_timestamp(indio_dev, sdata->buffer_data,
-                pf->timestamp);
+                                           timestamp);
 
 st_sensors_get_buffer_element_error:
         iio_trigger_notify_done(indio_dev->trig);
diff --git a/drivers/iio/common/st_sensors/st_sensors_core.c b/drivers/iio/common/st_sensors/st_sensors_core.c
index dffe00692169..9e59c90f6a8d 100644
--- a/drivers/iio/common/st_sensors/st_sensors_core.c
+++ b/drivers/iio/common/st_sensors/st_sensors_core.c
@@ -363,6 +363,11 @@ int st_sensors_init_sensor(struct iio_dev *indio_dev,
         if (err < 0)
                 return err;
 
+        /* Disable DRDY, this might be still be enabled after reboot. */
+        err = st_sensors_set_dataready_irq(indio_dev, false);
+        if (err < 0)
+                return err;
+
         if (sdata->current_fullscale) {
                 err = st_sensors_set_fullscale(indio_dev,
                                                 sdata->current_fullscale->num);
@@ -424,6 +429,9 @@ int st_sensors_set_dataready_irq(struct iio_dev *indio_dev, bool enable)
         else
                 drdy_mask = sdata->sensor_settings->drdy_irq.mask_int2;
 
+        /* Flag to the poll function that the hardware trigger is in use */
+        sdata->hw_irq_trigger = enable;
+
         /* Enable/Disable the interrupt generator for data ready. */
         err = st_sensors_write_data_with_mask(indio_dev,
                                         sdata->sensor_settings->drdy_irq.addr,
diff --git a/drivers/iio/common/st_sensors/st_sensors_trigger.c b/drivers/iio/common/st_sensors/st_sensors_trigger.c
index da72279fcf99..296e4ff19ae8 100644
--- a/drivers/iio/common/st_sensors/st_sensors_trigger.c
+++ b/drivers/iio/common/st_sensors/st_sensors_trigger.c
@@ -17,6 +17,73 @@
 #include <linux/iio/common/st_sensors.h>
 #include "st_sensors_core.h"
 
+/**
+ * st_sensors_irq_handler() - top half of the IRQ-based triggers
+ * @irq: irq number
+ * @p: private handler data
+ */
+irqreturn_t st_sensors_irq_handler(int irq, void *p)
+{
+        struct iio_trigger *trig = p;
+        struct iio_dev *indio_dev = iio_trigger_get_drvdata(trig);
+        struct st_sensor_data *sdata = iio_priv(indio_dev);
+
+        /* Get the time stamp as close in time as possible */
+        sdata->hw_timestamp = iio_get_time_ns();
+        return IRQ_WAKE_THREAD;
+}
+
+/**
+ * st_sensors_irq_thread() - bottom half of the IRQ-based triggers
+ * @irq: irq number
+ * @p: private handler data
+ */
+irqreturn_t st_sensors_irq_thread(int irq, void *p)
+{
+        struct iio_trigger *trig = p;
+        struct iio_dev *indio_dev = iio_trigger_get_drvdata(trig);
+        struct st_sensor_data *sdata = iio_priv(indio_dev);
+        int ret;
+
+        /*
+         * If this trigger is backed by a hardware interrupt and we have a
+         * status register, check if this IRQ came from us
+         */
+        if (sdata->sensor_settings->drdy_irq.addr_stat_drdy) {
+                u8 status;
+
+                ret = sdata->tf->read_byte(&sdata->tb, sdata->dev,
+                           sdata->sensor_settings->drdy_irq.addr_stat_drdy,
+                           &status);
+                if (ret < 0) {
+                        dev_err(sdata->dev, "could not read channel status\n");
+                        goto out_poll;
+                }
+                /*
+                 * the lower bits of .active_scan_mask[0] is directly mapped
+                 * to the channels on the sensor: either bit 0 for
+                 * one-dimensional sensors, or e.g. x,y,z for accelerometers,
+                 * gyroscopes or magnetometers. No sensor use more than 3
+                 * channels, so cut the other status bits here.
+                 */
+                status &= 0x07;
+
+                /*
+                 * If this was not caused by any channels on this sensor,
+                 * return IRQ_NONE
+                 */
+                if (!indio_dev->active_scan_mask)
+                        return IRQ_NONE;
+                if (!(status & (u8)indio_dev->active_scan_mask[0]))
+                        return IRQ_NONE;
+        }
+
+out_poll:
+        /* It's our IRQ: proceed to handle the register polling */
+        iio_trigger_poll_chained(p);
+        return IRQ_HANDLED;
+}
+
 int st_sensors_allocate_trigger(struct iio_dev *indio_dev,
                                 const struct iio_trigger_ops *trigger_ops)
 {
@@ -30,6 +97,10 @@ int st_sensors_allocate_trigger(struct iio_dev *indio_dev,
                 return -ENOMEM;
         }
 
+        iio_trigger_set_drvdata(sdata->trig, indio_dev);
+        sdata->trig->ops = trigger_ops;
+        sdata->trig->dev.parent = sdata->dev;
+
         irq = sdata->get_irq_data_ready(indio_dev);
         irq_trig = irqd_get_trigger_type(irq_get_irq_data(irq));
         /*
@@ -77,9 +148,12 @@ int st_sensors_allocate_trigger(struct iio_dev *indio_dev,
             sdata->sensor_settings->drdy_irq.addr_stat_drdy)
                 irq_trig |= IRQF_SHARED;
 
-        err = request_threaded_irq(irq,
-                        iio_trigger_generic_data_rdy_poll,
-                        NULL,
+        /* Let's create an interrupt thread masking the hard IRQ here */
+        irq_trig |= IRQF_ONESHOT;
+
+        err = request_threaded_irq(sdata->get_irq_data_ready(indio_dev),
+                        st_sensors_irq_handler,
+                        st_sensors_irq_thread,
                         irq_trig,
                         sdata->trig->name,
                         sdata->trig);
@@ -88,10 +162,6 @@ int st_sensors_allocate_trigger(struct iio_dev *indio_dev,
                 goto iio_trigger_free;
         }
 
-        iio_trigger_set_drvdata(sdata->trig, indio_dev);
-        sdata->trig->ops = trigger_ops;
-        sdata->trig->dev.parent = sdata->dev;
-
         err = iio_trigger_register(sdata->trig);
         if (err < 0) {
                 dev_err(&indio_dev->dev, "failed to register iio trigger.\n");
@@ -119,6 +189,18 @@ void st_sensors_deallocate_trigger(struct iio_dev *indio_dev)
 }
 EXPORT_SYMBOL(st_sensors_deallocate_trigger);
 
+int st_sensors_validate_device(struct iio_trigger *trig,
+                               struct iio_dev *indio_dev)
+{
+        struct iio_dev *indio = iio_trigger_get_drvdata(trig);
+
+        if (indio != indio_dev)
+                return -EINVAL;
+
+        return 0;
+}
+EXPORT_SYMBOL(st_sensors_validate_device);
+
 MODULE_AUTHOR("Denis Ciocca <denis.ciocca@st.com>");
 MODULE_DESCRIPTION("STMicroelectronics ST-sensors trigger");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/iio/dac/Kconfig b/drivers/iio/dac/Kconfig
index e63b957c985f..f7c71da42f15 100644
--- a/drivers/iio/dac/Kconfig
+++ b/drivers/iio/dac/Kconfig
@@ -247,7 +247,7 @@ config MCP4922
 
 config STX104
         tristate "Apex Embedded Systems STX104 DAC driver"
-        depends on X86 && ISA
+        depends on X86 && ISA_BUS_API
         help
           Say yes here to build support for the 2-channel DAC on the Apex
           Embedded Systems STX104 integrated analog PC/104 card. The base port
diff --git a/drivers/iio/dac/ad5592r-base.c b/drivers/iio/dac/ad5592r-base.c
index 948f600e7059..69bde5909854 100644
--- a/drivers/iio/dac/ad5592r-base.c
+++ b/drivers/iio/dac/ad5592r-base.c
@@ -525,7 +525,7 @@ static int ad5592r_alloc_channels(struct ad5592r_state *st)
 
         device_for_each_child_node(st->dev, child) {
                 ret = fwnode_property_read_u32(child, "reg", &reg);
-                if (ret || reg > ARRAY_SIZE(st->channel_modes))
+                if (ret || reg >= ARRAY_SIZE(st->channel_modes))
                         continue;
 
                 ret = fwnode_property_read_u32(child, "adi,mode", &tmp);
diff --git a/drivers/iio/gyro/st_gyro_buffer.c b/drivers/iio/gyro/st_gyro_buffer.c
index d67b17b6a7aa..a5377044e42f 100644
--- a/drivers/iio/gyro/st_gyro_buffer.c
+++ b/drivers/iio/gyro/st_gyro_buffer.c
@@ -91,7 +91,7 @@ static const struct iio_buffer_setup_ops st_gyro_buffer_setup_ops = {
 
 int st_gyro_allocate_ring(struct iio_dev *indio_dev)
 {
-        return iio_triggered_buffer_setup(indio_dev, &iio_pollfunc_store_time,
+        return iio_triggered_buffer_setup(indio_dev, NULL,
                 &st_sensors_trigger_handler, &st_gyro_buffer_setup_ops);
 }
 
diff --git a/drivers/iio/gyro/st_gyro_core.c b/drivers/iio/gyro/st_gyro_core.c
index 52a3c87c375c..a8012955a1f6 100644
--- a/drivers/iio/gyro/st_gyro_core.c
+++ b/drivers/iio/gyro/st_gyro_core.c
@@ -409,6 +409,7 @@ static const struct iio_info gyro_info = {
 static const struct iio_trigger_ops st_gyro_trigger_ops = {
         .owner = THIS_MODULE,
         .set_trigger_state = ST_GYRO_TRIGGER_SET_STATE,
+        .validate_device = st_sensors_validate_device,
 };
 #define ST_GYRO_TRIGGER_OPS (&st_gyro_trigger_ops)
 #else
diff --git a/drivers/iio/humidity/am2315.c b/drivers/iio/humidity/am2315.c
index 3be6d209a159..11535911a5c6 100644
--- a/drivers/iio/humidity/am2315.c
+++ b/drivers/iio/humidity/am2315.c
@@ -165,10 +165,8 @@ static irqreturn_t am2315_trigger_handler(int irq, void *p)
         struct am2315_sensor_data sensor_data;
 
         ret = am2315_read_data(data, &sensor_data);
-        if (ret < 0) {
-                mutex_unlock(&data->lock);
+        if (ret < 0)
                 goto err;
-        }
 
         mutex_lock(&data->lock);
         if (*(indio_dev->active_scan_mask) == AM2315_ALL_CHANNEL_MASK) {
diff --git a/drivers/iio/humidity/hdc100x.c b/drivers/iio/humidity/hdc100x.c
index fa4767613173..a03832a5fc95 100644
--- a/drivers/iio/humidity/hdc100x.c
+++ b/drivers/iio/humidity/hdc100x.c
@@ -55,7 +55,7 @@ static const struct {
         },
         { /* IIO_HUMIDITYRELATIVE channel */
                 .shift = 8,
-                .mask = 2,
+                .mask = 3,
         },
 };
 
@@ -164,14 +164,14 @@ static int hdc100x_get_measurement(struct hdc100x_data *data,
                 dev_err(&client->dev, "cannot read high byte measurement");
                 return ret;
         }
-        val = ret << 6;
+        val = ret << 8;
 
         ret = i2c_smbus_read_byte(client);
         if (ret < 0) {
                 dev_err(&client->dev, "cannot read low byte measurement");
                 return ret;
         }
-        val |= ret >> 2;
+        val |= ret;
 
         return val;
 }
@@ -211,18 +211,18 @@ static int hdc100x_read_raw(struct iio_dev *indio_dev,
                 return IIO_VAL_INT_PLUS_MICRO;
         case IIO_CHAN_INFO_SCALE:
                 if (chan->type == IIO_TEMP) {
-                        *val = 165;
-                        *val2 = 65536 >> 2;
+                        *val = 165000;
+                        *val2 = 65536;
                         return IIO_VAL_FRACTIONAL;
                 } else {
-                        *val = 0;
-                        *val2 = 10000;
-                        return IIO_VAL_INT_PLUS_MICRO;
+                        *val = 100;
+                        *val2 = 65536;
+                        return IIO_VAL_FRACTIONAL;
                 }
                 break;
         case IIO_CHAN_INFO_OFFSET:
-                *val = -3971;
-                *val2 = 879096;
+                *val = -15887;
+                *val2 = 515151;
                 return IIO_VAL_INT_PLUS_MICRO;
         default:
                 return -EINVAL;
diff --git a/drivers/iio/imu/bmi160/bmi160_core.c b/drivers/iio/imu/bmi160/bmi160_core.c
index 0bf92b06d7d8..b8a290ec984e 100644
--- a/drivers/iio/imu/bmi160/bmi160_core.c
+++ b/drivers/iio/imu/bmi160/bmi160_core.c
@@ -209,11 +209,11 @@ static const struct  bmi160_scale_item bmi160_scale_table[] = {
 };
 
 static const struct bmi160_odr bmi160_accel_odr[] = {
-        {0x01, 0, 78125},
-        {0x02, 1, 5625},
-        {0x03, 3, 125},
-        {0x04, 6, 25},
-        {0x05, 12, 5},
+        {0x01, 0, 781250},
+        {0x02, 1, 562500},
+        {0x03, 3, 125000},
+        {0x04, 6, 250000},
+        {0x05, 12, 500000},
         {0x06, 25, 0},
         {0x07, 50, 0},
         {0x08, 100, 0},
@@ -229,7 +229,7 @@ static const struct bmi160_odr bmi160_gyro_odr[] = {
         {0x08, 100, 0},
         {0x09, 200, 0},
         {0x0A, 400, 0},
-        {0x0B, 8000, 0},
+        {0x0B, 800, 0},
         {0x0C, 1600, 0},
         {0x0D, 3200, 0},
 };
@@ -364,8 +364,8 @@ int bmi160_set_odr(struct bmi160_data *data, enum bmi160_sensor_type t,
 
         return regmap_update_bits(data->regmap,
                                   bmi160_regs[t].config,
-                                  bmi160_odr_table[t].tbl[i].bits,
-                                  bmi160_regs[t].config_odr_mask);
+                                  bmi160_regs[t].config_odr_mask,
+                                  bmi160_odr_table[t].tbl[i].bits);
 }
 
 static int bmi160_get_odr(struct bmi160_data *data, enum bmi160_sensor_type t,
diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_acpi.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_acpi.c
index f62b8bd9ad7e..dd6fc6d21f9d 100644
--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_acpi.c
+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_acpi.c
@@ -56,6 +56,7 @@ static int asus_acpi_get_sensor_info(struct acpi_device *adev,
         int i;
         acpi_status status;
         union acpi_object *cpm;
+        int ret;
 
         status = acpi_evaluate_object(adev->handle, "CNF0", NULL, &buffer);
         if (ACPI_FAILURE(status))
@@ -82,10 +83,10 @@ static int asus_acpi_get_sensor_info(struct acpi_device *adev,
                         }
                 }
         }
-
+        ret = cpm->package.count;
         kfree(buffer.pointer);
 
-        return cpm->package.count;
+        return ret;
 }
 
 static int acpi_i2c_check_resource(struct acpi_resource *ares, void *data)
diff --git a/drivers/iio/industrialio-trigger.c b/drivers/iio/industrialio-trigger.c
index ae2806aafb72..0c52dfe64977 100644
--- a/drivers/iio/industrialio-trigger.c
+++ b/drivers/iio/industrialio-trigger.c
@@ -210,22 +210,35 @@ static int iio_trigger_attach_poll_func(struct iio_trigger *trig,
 
         /* Prevent the module from being removed whilst attached to a trigger */
         __module_get(pf->indio_dev->info->driver_module);
+
+        /* Get irq number */
         pf->irq = iio_trigger_get_irq(trig);
+        if (pf->irq < 0)
+                goto out_put_module;
+
+        /* Request irq */
         ret = request_threaded_irq(pf->irq, pf->h, pf->thread,
                                    pf->type, pf->name,
                                    pf);
-        if (ret < 0) {
-                module_put(pf->indio_dev->info->driver_module);
-                return ret;
-        }
+        if (ret < 0)
+                goto out_put_irq;
 
+        /* Enable trigger in driver */
         if (trig->ops && trig->ops->set_trigger_state && notinuse) {
                 ret = trig->ops->set_trigger_state(trig, true);
                 if (ret < 0)
-                        module_put(pf->indio_dev->info->driver_module);
+                        goto out_free_irq;
         }
 
         return ret;
+
+out_free_irq:
+        free_irq(pf->irq, pf);
+out_put_irq:
+        iio_trigger_put_irq(trig, pf->irq);
+out_put_module:
+        module_put(pf->indio_dev->info->driver_module);
+        return ret;
 }
 
 static int iio_trigger_detach_poll_func(struct iio_trigger *trig,
diff --git a/drivers/iio/light/apds9960.c b/drivers/iio/light/apds9960.c
index b4dbb3912977..651d57b8abbf 100644
--- a/drivers/iio/light/apds9960.c
+++ b/drivers/iio/light/apds9960.c
@@ -1011,6 +1011,7 @@ static int apds9960_probe(struct i2c_client *client,
 
         iio_device_attach_buffer(indio_dev, buffer);
 
+        indio_dev->dev.parent = &client->dev;
         indio_dev->info = &apds9960_info;
         indio_dev->name = APDS9960_DRV_NAME;
         indio_dev->channels = apds9960_channels;
diff --git a/drivers/iio/light/bh1780.c b/drivers/iio/light/bh1780.c
index 72b364e4aa72..b54dcba05a82 100644
--- a/drivers/iio/light/bh1780.c
+++ b/drivers/iio/light/bh1780.c
@@ -84,7 +84,7 @@ static int bh1780_debugfs_reg_access(struct iio_dev *indio_dev,
         int ret;
 
         if (!readval)
-                bh1780_write(bh1780, (u8)reg, (u8)writeval);
+                return bh1780_write(bh1780, (u8)reg, (u8)writeval);
 
         ret = bh1780_read(bh1780, (u8)reg);
         if (ret < 0)
@@ -187,7 +187,7 @@ static int bh1780_probe(struct i2c_client *client,
 
         indio_dev->dev.parent = &client->dev;
         indio_dev->info = &bh1780_info;
-        indio_dev->name = id->name;
+        indio_dev->name = "bh1780";
         indio_dev->channels = bh1780_channels;
         indio_dev->num_channels = ARRAY_SIZE(bh1780_channels);
         indio_dev->modes = INDIO_DIRECT_MODE;
@@ -226,7 +226,8 @@ static int bh1780_remove(struct i2c_client *client)
 static int bh1780_runtime_suspend(struct device *dev)
 {
         struct i2c_client *client = to_i2c_client(dev);
-        struct bh1780_data *bh1780 = i2c_get_clientdata(client);
+        struct iio_dev *indio_dev = i2c_get_clientdata(client);
+        struct bh1780_data *bh1780 = iio_priv(indio_dev);
         int ret;
 
         ret = bh1780_write(bh1780, BH1780_REG_CONTROL, BH1780_POFF);
@@ -241,7 +242,8 @@ static int bh1780_runtime_suspend(struct device *dev)
 static int bh1780_runtime_resume(struct device *dev)
 {
         struct i2c_client *client = to_i2c_client(dev);
-        struct bh1780_data *bh1780 = i2c_get_clientdata(client);
+        struct iio_dev *indio_dev = i2c_get_clientdata(client);
+        struct bh1780_data *bh1780 = iio_priv(indio_dev);
         int ret;
 
         ret = bh1780_write(bh1780, BH1780_REG_CONTROL, BH1780_PON);
diff --git a/drivers/iio/light/max44000.c b/drivers/iio/light/max44000.c
index e01e58a9bd14..f17cb2ea18f5 100644
--- a/drivers/iio/light/max44000.c
+++ b/drivers/iio/light/max44000.c
@@ -147,7 +147,6 @@ static const struct iio_chan_spec max44000_channels[] = {
         {
                 .type = IIO_PROXIMITY,
                 .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
-                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
                 .scan_index = MAX44000_SCAN_INDEX_PRX,
                 .scan_type = {
                         .sign           = 'u',
diff --git a/drivers/iio/magnetometer/st_magn_buffer.c b/drivers/iio/magnetometer/st_magn_buffer.c
index ecd3bd0a9769..0a9e8fadfa9d 100644
--- a/drivers/iio/magnetometer/st_magn_buffer.c
+++ b/drivers/iio/magnetometer/st_magn_buffer.c
@@ -82,7 +82,7 @@ static const struct iio_buffer_setup_ops st_magn_buffer_setup_ops = {
 
 int st_magn_allocate_ring(struct iio_dev *indio_dev)
 {
-        return iio_triggered_buffer_setup(indio_dev, &iio_pollfunc_store_time,
+        return iio_triggered_buffer_setup(indio_dev, NULL,
                 &st_sensors_trigger_handler, &st_magn_buffer_setup_ops);
 }
 
diff --git a/drivers/iio/magnetometer/st_magn_core.c b/drivers/iio/magnetometer/st_magn_core.c
index 62036d2a9956..8250fc322c56 100644
--- a/drivers/iio/magnetometer/st_magn_core.c
+++ b/drivers/iio/magnetometer/st_magn_core.c
@@ -572,6 +572,7 @@ static const struct iio_info magn_info = {
 static const struct iio_trigger_ops st_magn_trigger_ops = {
         .owner = THIS_MODULE,
         .set_trigger_state = ST_MAGN_TRIGGER_SET_STATE,
+        .validate_device = st_sensors_validate_device,
 };
 #define ST_MAGN_TRIGGER_OPS (&st_magn_trigger_ops)
 #else
diff --git a/drivers/iio/pressure/bmp280.c b/drivers/iio/pressure/bmp280.c
index 2f1498e12bb2..724452d61846 100644
--- a/drivers/iio/pressure/bmp280.c
+++ b/drivers/iio/pressure/bmp280.c
@@ -879,8 +879,8 @@ static int bmp280_probe(struct i2c_client *client,
         if (ret < 0)
                 return ret;
         if (chip_id != id->driver_data) {
-                dev_err(&client->dev, "bad chip id.  expected %x got %x\n",
-                        BMP280_CHIP_ID, chip_id);
+                dev_err(&client->dev, "bad chip id.  expected %lx got %x\n",
+                        id->driver_data, chip_id);
                 return -EINVAL;
         }
 
diff --git a/drivers/iio/pressure/st_pressure_buffer.c b/drivers/iio/pressure/st_pressure_buffer.c
index 2ff53f222352..99468d0a64e7 100644
--- a/drivers/iio/pressure/st_pressure_buffer.c
+++ b/drivers/iio/pressure/st_pressure_buffer.c
@@ -82,7 +82,7 @@ static const struct iio_buffer_setup_ops st_press_buffer_setup_ops = {
 
 int st_press_allocate_ring(struct iio_dev *indio_dev)
 {
-        return iio_triggered_buffer_setup(indio_dev, &iio_pollfunc_store_time,
+        return iio_triggered_buffer_setup(indio_dev, NULL,
                 &st_sensors_trigger_handler, &st_press_buffer_setup_ops);
 }
 
diff --git a/drivers/iio/pressure/st_pressure_core.c b/drivers/iio/pressure/st_pressure_core.c
index 9e9b72a8f18f..92a118c3c4ac 100644
--- a/drivers/iio/pressure/st_pressure_core.c
+++ b/drivers/iio/pressure/st_pressure_core.c
@@ -28,15 +28,21 @@
 #include <linux/iio/common/st_sensors.h>
 #include "st_pressure.h"
 
+#define MCELSIUS_PER_CELSIUS                    1000
+
+/* Default pressure sensitivity */
 #define ST_PRESS_LSB_PER_MBAR                   4096UL
 #define ST_PRESS_KPASCAL_NANO_SCALE             (100000000UL / \
                                                  ST_PRESS_LSB_PER_MBAR)
+
+/* Default temperature sensitivity */
 #define ST_PRESS_LSB_PER_CELSIUS                480UL
-#define ST_PRESS_CELSIUS_NANO_SCALE             (1000000000UL / \
-                                                 ST_PRESS_LSB_PER_CELSIUS)
+#define ST_PRESS_MILLI_CELSIUS_OFFSET           42500UL
+
 #define ST_PRESS_NUMBER_DATA_CHANNELS           1
 
 /* FULLSCALE */
+#define ST_PRESS_FS_AVL_1100MB                  1100
 #define ST_PRESS_FS_AVL_1260MB                  1260
 
 #define ST_PRESS_1_OUT_XL_ADDR                  0x28
@@ -54,9 +60,6 @@
 #define ST_PRESS_LPS331AP_PW_MASK               0x80
 #define ST_PRESS_LPS331AP_FS_ADDR               0x23
 #define ST_PRESS_LPS331AP_FS_MASK               0x30
-#define ST_PRESS_LPS331AP_FS_AVL_1260_VAL       0x00
-#define ST_PRESS_LPS331AP_FS_AVL_1260_GAIN      ST_PRESS_KPASCAL_NANO_SCALE
-#define ST_PRESS_LPS331AP_FS_AVL_TEMP_GAIN      ST_PRESS_CELSIUS_NANO_SCALE
 #define ST_PRESS_LPS331AP_BDU_ADDR              0x20
 #define ST_PRESS_LPS331AP_BDU_MASK              0x04
 #define ST_PRESS_LPS331AP_DRDY_IRQ_ADDR         0x22
@@ -67,9 +70,14 @@
 #define ST_PRESS_LPS331AP_OD_IRQ_ADDR           0x22
 #define ST_PRESS_LPS331AP_OD_IRQ_MASK           0x40
 #define ST_PRESS_LPS331AP_MULTIREAD_BIT         true
-#define ST_PRESS_LPS331AP_TEMP_OFFSET           42500
 
 /* CUSTOM VALUES FOR LPS001WP SENSOR */
+
+/* LPS001WP pressure resolution */
+#define ST_PRESS_LPS001WP_LSB_PER_MBAR          16UL
+/* LPS001WP temperature resolution */
+#define ST_PRESS_LPS001WP_LSB_PER_CELSIUS       64UL
+
 #define ST_PRESS_LPS001WP_WAI_EXP               0xba
 #define ST_PRESS_LPS001WP_ODR_ADDR              0x20
 #define ST_PRESS_LPS001WP_ODR_MASK              0x30
@@ -78,6 +86,8 @@
 #define ST_PRESS_LPS001WP_ODR_AVL_13HZ_VAL      0x03
 #define ST_PRESS_LPS001WP_PW_ADDR               0x20
 #define ST_PRESS_LPS001WP_PW_MASK               0x40
+#define ST_PRESS_LPS001WP_FS_AVL_PRESS_GAIN \
+        (100000000UL / ST_PRESS_LPS001WP_LSB_PER_MBAR)
 #define ST_PRESS_LPS001WP_BDU_ADDR              0x20
 #define ST_PRESS_LPS001WP_BDU_MASK              0x04
 #define ST_PRESS_LPS001WP_MULTIREAD_BIT         true
@@ -94,11 +104,6 @@
 #define ST_PRESS_LPS25H_ODR_AVL_25HZ_VAL        0x04
 #define ST_PRESS_LPS25H_PW_ADDR                 0x20
 #define ST_PRESS_LPS25H_PW_MASK                 0x80
-#define ST_PRESS_LPS25H_FS_ADDR                 0x00
-#define ST_PRESS_LPS25H_FS_MASK                 0x00
-#define ST_PRESS_LPS25H_FS_AVL_1260_VAL         0x00
-#define ST_PRESS_LPS25H_FS_AVL_1260_GAIN        ST_PRESS_KPASCAL_NANO_SCALE
-#define ST_PRESS_LPS25H_FS_AVL_TEMP_GAIN        ST_PRESS_CELSIUS_NANO_SCALE
 #define ST_PRESS_LPS25H_BDU_ADDR                0x20
 #define ST_PRESS_LPS25H_BDU_MASK                0x04
 #define ST_PRESS_LPS25H_DRDY_IRQ_ADDR           0x23
@@ -109,7 +114,6 @@
 #define ST_PRESS_LPS25H_OD_IRQ_ADDR             0x22
 #define ST_PRESS_LPS25H_OD_IRQ_MASK             0x40
 #define ST_PRESS_LPS25H_MULTIREAD_BIT           true
-#define ST_PRESS_LPS25H_TEMP_OFFSET             42500
 #define ST_PRESS_LPS25H_OUT_XL_ADDR             0x28
 #define ST_TEMP_LPS25H_OUT_L_ADDR               0x2b
 
@@ -161,7 +165,9 @@ static const struct iio_chan_spec st_press_lps001wp_channels[] = {
                         .storagebits = 16,
                         .endianness = IIO_LE,
                 },
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
+                .info_mask_separate =
+                        BIT(IIO_CHAN_INFO_RAW) |
+                        BIT(IIO_CHAN_INFO_SCALE),
                 .modified = 0,
         },
         {
@@ -177,7 +183,7 @@ static const struct iio_chan_spec st_press_lps001wp_channels[] = {
                 },
                 .info_mask_separate =
                         BIT(IIO_CHAN_INFO_RAW) |
-                        BIT(IIO_CHAN_INFO_OFFSET),
+                        BIT(IIO_CHAN_INFO_SCALE),
                 .modified = 0,
         },
         IIO_CHAN_SOFT_TIMESTAMP(1)
@@ -212,11 +218,14 @@ static const struct st_sensor_settings st_press_sensors_settings[] = {
                         .addr = ST_PRESS_LPS331AP_FS_ADDR,
                         .mask = ST_PRESS_LPS331AP_FS_MASK,
                         .fs_avl = {
+                                /*
+                                 * Pressure and temperature sensitivity values
+                                 * as defined in table 3 of LPS331AP datasheet.
+                                 */
                                 [0] = {
                                         .num = ST_PRESS_FS_AVL_1260MB,
-                                        .value = ST_PRESS_LPS331AP_FS_AVL_1260_VAL,
-                                        .gain = ST_PRESS_LPS331AP_FS_AVL_1260_GAIN,
-                                        .gain2 = ST_PRESS_LPS331AP_FS_AVL_TEMP_GAIN,
+                                        .gain = ST_PRESS_KPASCAL_NANO_SCALE,
+                                        .gain2 = ST_PRESS_LSB_PER_CELSIUS,
                                 },
                         },
                 },
@@ -261,7 +270,17 @@ static const struct st_sensor_settings st_press_sensors_settings[] = {
                         .value_off = ST_SENSORS_DEFAULT_POWER_OFF_VALUE,
                 },
                 .fs = {
-                        .addr = 0,
+                        .fs_avl = {
+                                /*
+                                 * Pressure and temperature resolution values
+                                 * as defined in table 3 of LPS001WP datasheet.
+                                 */
+                                [0] = {
+                                        .num = ST_PRESS_FS_AVL_1100MB,
+                                        .gain = ST_PRESS_LPS001WP_FS_AVL_PRESS_GAIN,
+                                        .gain2 = ST_PRESS_LPS001WP_LSB_PER_CELSIUS,
+                                },
+                        },
                 },
                 .bdu = {
                         .addr = ST_PRESS_LPS001WP_BDU_ADDR,
@@ -298,14 +317,15 @@ static const struct st_sensor_settings st_press_sensors_settings[] = {
                         .value_off = ST_SENSORS_DEFAULT_POWER_OFF_VALUE,
                 },
                 .fs = {
-                        .addr = ST_PRESS_LPS25H_FS_ADDR,
-                        .mask = ST_PRESS_LPS25H_FS_MASK,
                         .fs_avl = {
+                                /*
+                                 * Pressure and temperature sensitivity values
+                                 * as defined in table 3 of LPS25H datasheet.
+                                 */
                                 [0] = {
                                         .num = ST_PRESS_FS_AVL_1260MB,
-                                        .value = ST_PRESS_LPS25H_FS_AVL_1260_VAL,
-                                        .gain = ST_PRESS_LPS25H_FS_AVL_1260_GAIN,
-                                        .gain2 = ST_PRESS_LPS25H_FS_AVL_TEMP_GAIN,
+                                        .gain = ST_PRESS_KPASCAL_NANO_SCALE,
+                                        .gain2 = ST_PRESS_LSB_PER_CELSIUS,
                                 },
                         },
                 },
@@ -364,26 +384,26 @@ static int st_press_read_raw(struct iio_dev *indio_dev,
 
                 return IIO_VAL_INT;
         case IIO_CHAN_INFO_SCALE:
-                *val = 0;
-
                 switch (ch->type) {
                 case IIO_PRESSURE:
+                        *val = 0;
                         *val2 = press_data->current_fullscale->gain;
-                        break;
+                        return IIO_VAL_INT_PLUS_NANO;
                 case IIO_TEMP:
+                        *val = MCELSIUS_PER_CELSIUS;
                         *val2 = press_data->current_fullscale->gain2;
-                        break;
+                        return IIO_VAL_FRACTIONAL;
                 default:
                         err = -EINVAL;
                         goto read_error;
                 }
 
-                return IIO_VAL_INT_PLUS_NANO;
         case IIO_CHAN_INFO_OFFSET:
                 switch (ch->type) {
                 case IIO_TEMP:
-                        *val = 425;
-                        *val2 = 10;
+                        *val = ST_PRESS_MILLI_CELSIUS_OFFSET *
+                               press_data->current_fullscale->gain2;
+                        *val2 = MCELSIUS_PER_CELSIUS;
                         break;
                 default:
                         err = -EINVAL;
@@ -425,6 +445,7 @@ static const struct iio_info press_info = {
 static const struct iio_trigger_ops st_press_trigger_ops = {
         .owner = THIS_MODULE,
         .set_trigger_state = ST_PRESS_TRIGGER_SET_STATE,
+        .validate_device = st_sensors_validate_device,
 };
 #define ST_PRESS_TRIGGER_OPS (&st_press_trigger_ops)
 #else
diff --git a/drivers/iio/proximity/as3935.c b/drivers/iio/proximity/as3935.c
index f4d29d5dbd5f..e2f926cdcad2 100644
--- a/drivers/iio/proximity/as3935.c
+++ b/drivers/iio/proximity/as3935.c
@@ -64,6 +64,7 @@ struct as3935_state {
         struct delayed_work work;
 
         u32 tune_cap;
+        u8 buffer[16]; /* 8-bit data + 56-bit padding + 64-bit timestamp */
         u8 buf[2] ____cacheline_aligned;
 };
 
@@ -72,7 +73,8 @@ static const struct iio_chan_spec as3935_channels[] = {
                 .type           = IIO_PROXIMITY,
                 .info_mask_separate =
                         BIT(IIO_CHAN_INFO_RAW) |
-                        BIT(IIO_CHAN_INFO_PROCESSED),
+                        BIT(IIO_CHAN_INFO_PROCESSED) |
+                        BIT(IIO_CHAN_INFO_SCALE),
                 .scan_index     = 0,
                 .scan_type = {
                         .sign           = 'u',
@@ -181,7 +183,12 @@ static int as3935_read_raw(struct iio_dev *indio_dev,
                 /* storm out of range */
                 if (*val == AS3935_DATA_MASK)
                         return -EINVAL;
-                *val *= 1000;
+
+                if (m == IIO_CHAN_INFO_PROCESSED)
+                        *val *= 1000;
+                break;
+        case IIO_CHAN_INFO_SCALE:
+                *val = 1000;
                 break;
         default:
                 return -EINVAL;
@@ -206,10 +213,10 @@ static irqreturn_t as3935_trigger_handler(int irq, void *private)
         ret = as3935_read(st, AS3935_DATA, &val);
         if (ret)
                 goto err_read;
-        val &= AS3935_DATA_MASK;
-        val *= 1000;
 
-        iio_push_to_buffers_with_timestamp(indio_dev, &val, pf->timestamp);
+        st->buffer[0] = val & AS3935_DATA_MASK;
+        iio_push_to_buffers_with_timestamp(indio_dev, &st->buffer,
+                                           pf->timestamp);
 err_read:
         iio_trigger_notify_done(indio_dev->trig);
 
diff --git a/drivers/infiniband/core/cache.c b/drivers/infiniband/core/cache.c
index c2e257d97eff..1a2984c28b95 100644
--- a/drivers/infiniband/core/cache.c
+++ b/drivers/infiniband/core/cache.c
@@ -178,6 +178,7 @@ static int write_gid(struct ib_device *ib_dev, u8 port,
 {
         int ret = 0;
         struct net_device *old_net_dev;
+        enum ib_gid_type old_gid_type;
 
         /* in rdma_cap_roce_gid_table, this funciton should be protected by a
          * sleep-able lock.
@@ -199,6 +200,7 @@ static int write_gid(struct ib_device *ib_dev, u8 port,
         }
 
         old_net_dev = table->data_vec[ix].attr.ndev;
+        old_gid_type = table->data_vec[ix].attr.gid_type;
         if (old_net_dev && old_net_dev != attr->ndev)
                 dev_put(old_net_dev);
         /* if modify_gid failed, just delete the old gid */
@@ -207,10 +209,14 @@ static int write_gid(struct ib_device *ib_dev, u8 port,
                 attr = &zattr;
                 table->data_vec[ix].context = NULL;
         }
-        if (default_gid)
-                table->data_vec[ix].props |= GID_TABLE_ENTRY_DEFAULT;
+
         memcpy(&table->data_vec[ix].gid, gid, sizeof(*gid));
         memcpy(&table->data_vec[ix].attr, attr, sizeof(*attr));
+        if (default_gid) {
+                table->data_vec[ix].props |= GID_TABLE_ENTRY_DEFAULT;
+                if (action == GID_TABLE_WRITE_ACTION_DEL)
+                        table->data_vec[ix].attr.gid_type = old_gid_type;
+        }
         if (table->data_vec[ix].attr.ndev &&
             table->data_vec[ix].attr.ndev != old_net_dev)
                 dev_hold(table->data_vec[ix].attr.ndev);
@@ -405,7 +411,9 @@ int ib_cache_gid_del_all_netdev_gids(struct ib_device *ib_dev, u8 port,
 
         for (ix = 0; ix < table->sz; ix++)
                 if (table->data_vec[ix].attr.ndev == ndev)
-                        if (!del_gid(ib_dev, port, table, ix, false))
+                        if (!del_gid(ib_dev, port, table, ix,
+                                     !!(table->data_vec[ix].props &
+                                        GID_TABLE_ENTRY_DEFAULT)))
                                 deleted = true;
 
         write_unlock_irq(&table->rwlock);
diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
index 1d92e091e22e..c99525512b34 100644
--- a/drivers/infiniband/core/cm.c
+++ b/drivers/infiniband/core/cm.c
@@ -3452,14 +3452,14 @@ static int cm_establish(struct ib_cm_id *cm_id)
         work->cm_event.event = IB_CM_USER_ESTABLISHED;
 
         /* Check if the device started its remove_one */
-        spin_lock_irq(&cm.lock);
+        spin_lock_irqsave(&cm.lock, flags);
         if (!cm_dev->going_down) {
                 queue_delayed_work(cm.wq, &work->work, 0);
         } else {
                 kfree(work);
                 ret = -ENODEV;
         }
-        spin_unlock_irq(&cm.lock);
+        spin_unlock_irqrestore(&cm.lock, flags);
 
 out:
         return ret;
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index f0c91ba3178a..ad1b1adcf6f0 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -708,17 +708,6 @@ static void cma_deref_id(struct rdma_id_private *id_priv)
                 complete(&id_priv->comp);
 }
 
-static int cma_disable_callback(struct rdma_id_private *id_priv,
-                                enum rdma_cm_state state)
-{
-        mutex_lock(&id_priv->handler_mutex);
-        if (id_priv->state != state) {
-                mutex_unlock(&id_priv->handler_mutex);
-                return -EINVAL;
-        }
-        return 0;
-}
-
 struct rdma_cm_id *rdma_create_id(struct net *net,
                                   rdma_cm_event_handler event_handler,
                                   void *context, enum rdma_port_space ps,
@@ -1671,11 +1660,12 @@ static int cma_ib_handler(struct ib_cm_id *cm_id, struct ib_cm_event *ib_event)
         struct rdma_cm_event event;
         int ret = 0;
 
+        mutex_lock(&id_priv->handler_mutex);
         if ((ib_event->event != IB_CM_TIMEWAIT_EXIT &&
-                cma_disable_callback(id_priv, RDMA_CM_CONNECT)) ||
+             id_priv->state != RDMA_CM_CONNECT) ||
             (ib_event->event == IB_CM_TIMEWAIT_EXIT &&
-                cma_disable_callback(id_priv, RDMA_CM_DISCONNECT)))
-                return 0;
+             id_priv->state != RDMA_CM_DISCONNECT))
+                goto out;
 
         memset(&event, 0, sizeof event);
         switch (ib_event->event) {
@@ -1870,7 +1860,7 @@ static int cma_check_req_qp_type(struct rdma_cm_id *id, struct ib_cm_event *ib_e
 
 static int cma_req_handler(struct ib_cm_id *cm_id, struct ib_cm_event *ib_event)
 {
-        struct rdma_id_private *listen_id, *conn_id;
+        struct rdma_id_private *listen_id, *conn_id = NULL;
         struct rdma_cm_event event;
         struct net_device *net_dev;
         int offset, ret;
@@ -1884,9 +1874,10 @@ static int cma_req_handler(struct ib_cm_id *cm_id, struct ib_cm_event *ib_event)
                 goto net_dev_put;
         }
 
-        if (cma_disable_callback(listen_id, RDMA_CM_LISTEN)) {
+        mutex_lock(&listen_id->handler_mutex);
+        if (listen_id->state != RDMA_CM_LISTEN) {
                 ret = -ECONNABORTED;
-                goto net_dev_put;
+                goto err1;
         }
 
         memset(&event, 0, sizeof event);
@@ -1976,8 +1967,9 @@ static int cma_iw_handler(struct iw_cm_id *iw_id, struct iw_cm_event *iw_event)
         struct sockaddr *laddr = (struct sockaddr *)&iw_event->local_addr;
         struct sockaddr *raddr = (struct sockaddr *)&iw_event->remote_addr;
 
-        if (cma_disable_callback(id_priv, RDMA_CM_CONNECT))
-                return 0;
+        mutex_lock(&id_priv->handler_mutex);
+        if (id_priv->state != RDMA_CM_CONNECT)
+                goto out;
 
         memset(&event, 0, sizeof event);
         switch (iw_event->event) {
@@ -2029,6 +2021,7 @@ static int cma_iw_handler(struct iw_cm_id *iw_id, struct iw_cm_event *iw_event)
                 return ret;
         }
 
+out:
         mutex_unlock(&id_priv->handler_mutex);
         return ret;
 }
@@ -2039,13 +2032,15 @@ static int iw_conn_req_handler(struct iw_cm_id *cm_id,
         struct rdma_cm_id *new_cm_id;
         struct rdma_id_private *listen_id, *conn_id;
         struct rdma_cm_event event;
-        int ret;
+        int ret = -ECONNABORTED;
         struct sockaddr *laddr = (struct sockaddr *)&iw_event->local_addr;
         struct sockaddr *raddr = (struct sockaddr *)&iw_event->remote_addr;
 
         listen_id = cm_id->context;
-        if (cma_disable_callback(listen_id, RDMA_CM_LISTEN))
-                return -ECONNABORTED;
+
+        mutex_lock(&listen_id->handler_mutex);
+        if (listen_id->state != RDMA_CM_LISTEN)
+                goto out;
 
         /* Create a new RDMA id for the new IW CM ID */
         new_cm_id = rdma_create_id(listen_id->id.route.addr.dev_addr.net,
@@ -3216,8 +3211,9 @@ static int cma_sidr_rep_handler(struct ib_cm_id *cm_id,
         struct ib_cm_sidr_rep_event_param *rep = &ib_event->param.sidr_rep_rcvd;
         int ret = 0;
 
-        if (cma_disable_callback(id_priv, RDMA_CM_CONNECT))
-                return 0;
+        mutex_lock(&id_priv->handler_mutex);
+        if (id_priv->state != RDMA_CM_CONNECT)
+                goto out;
 
         memset(&event, 0, sizeof event);
         switch (ib_event->event) {
@@ -3673,12 +3669,13 @@ static int cma_ib_mc_handler(int status, struct ib_sa_multicast *multicast)
         struct rdma_id_private *id_priv;
         struct cma_multicast *mc = multicast->context;
         struct rdma_cm_event event;
-        int ret;
+        int ret = 0;
 
         id_priv = mc->id_priv;
-        if (cma_disable_callback(id_priv, RDMA_CM_ADDR_BOUND) &&
-            cma_disable_callback(id_priv, RDMA_CM_ADDR_RESOLVED))
-                return 0;
+        mutex_lock(&id_priv->handler_mutex);
+        if (id_priv->state != RDMA_CM_ADDR_BOUND &&
+            id_priv->state != RDMA_CM_ADDR_RESOLVED)
+                goto out;
 
         if (!status)
                 status = cma_set_qkey(id_priv, be32_to_cpu(multicast->rec.qkey));
@@ -3720,6 +3717,7 @@ static int cma_ib_mc_handler(int status, struct ib_sa_multicast *multicast)
                 return 0;
         }
 
+out:
         mutex_unlock(&id_priv->handler_mutex);
         return 0;
 }
@@ -3878,12 +3876,12 @@ static int cma_iboe_join_multicast(struct rdma_id_private *id_priv,
         gid_type = id_priv->cma_dev->default_gid_type[id_priv->id.port_num -
                    rdma_start_port(id_priv->cma_dev->device)];
         if (addr->sa_family == AF_INET) {
-                if (gid_type == IB_GID_TYPE_ROCE_UDP_ENCAP)
+                if (gid_type == IB_GID_TYPE_ROCE_UDP_ENCAP) {
+                        mc->multicast.ib->rec.hop_limit = IPV6_DEFAULT_HOPLIMIT;
                         err = cma_igmp_send(ndev, &mc->multicast.ib->rec.mgid,
                                             true);
-                if (!err) {
-                        mc->igmp_joined = true;
-                        mc->multicast.ib->rec.hop_limit = IPV6_DEFAULT_HOPLIMIT;
+                        if (!err)
+                                mc->igmp_joined = true;
                 }
         } else {
                 if (gid_type == IB_GID_TYPE_ROCE_UDP_ENCAP)
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index 5516fb070344..5c155fa91eec 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -661,6 +661,9 @@ int ib_query_port(struct ib_device *device,
         if (err || port_attr->subnet_prefix)
                 return err;
 
+        if (rdma_port_get_link_layer(device, port_num) != IB_LINK_LAYER_INFINIBAND)
+                return 0;
+
         err = ib_query_gid(device, port_num, 0, &gid, NULL);
         if (err)
                 return err;
@@ -1024,7 +1027,8 @@ static int __init ib_core_init(void)
                 goto err_mad;
         }
 
-        if (ib_add_ibnl_clients()) {
+        ret = ib_add_ibnl_clients();
+        if (ret) {
                 pr_warn("Couldn't register ibnl clients\n");
                 goto err_sa;
         }
diff --git a/drivers/infiniband/core/iwpm_msg.c b/drivers/infiniband/core/iwpm_msg.c
index 43e3fa27102b..1c41b95cefec 100644
--- a/drivers/infiniband/core/iwpm_msg.c
+++ b/drivers/infiniband/core/iwpm_msg.c
@@ -506,7 +506,7 @@ int iwpm_add_and_query_mapping_cb(struct sk_buff *skb,
         if (!nlmsg_request) {
                 pr_info("%s: Could not find a matching request (seq = %u)\n",
                                  __func__, msg_seq);
-                        return -EINVAL;
+                return -EINVAL;
         }
         pm_msg = nlmsg_request->req_buffer;
         local_sockaddr = (struct sockaddr_storage *)
diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
index 82fb511112da..2d49228f28b2 100644
--- a/drivers/infiniband/core/mad.c
+++ b/drivers/infiniband/core/mad.c
@@ -1638,9 +1638,9 @@ static void remove_mad_reg_req(struct ib_mad_agent_private *agent_priv)
                 /* Now, check to see if there are any methods still in use */
                 if (!check_method_table(method)) {
                         /* If not, release management method table */
-                         kfree(method);
-                         class->method_table[mgmt_class] = NULL;
-                         /* Any management classes left ? */
+                        kfree(method);
+                        class->method_table[mgmt_class] = NULL;
+                        /* Any management classes left ? */
                         if (!check_class_table(class)) {
                                 /* If not, release management class table */
                                 kfree(class);
diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
index 5e573bb18660..a5793c8f1590 100644
--- a/drivers/infiniband/core/sysfs.c
+++ b/drivers/infiniband/core/sysfs.c
@@ -889,9 +889,9 @@ static struct attribute *alloc_hsa_lifespan(char *name, u8 port_num)
 static void setup_hw_stats(struct ib_device *device, struct ib_port *port,
                            u8 port_num)
 {
-        struct attribute_group *hsag = NULL;
+        struct attribute_group *hsag;
         struct rdma_hw_stats *stats;
-        int i = 0, ret;
+        int i, ret;
 
         stats = device->alloc_hw_stats(device, port_num);
 
@@ -899,19 +899,22 @@ static void setup_hw_stats(struct ib_device *device, struct ib_port *port,
                 return;
 
         if (!stats->names || stats->num_counters <= 0)
-                goto err;
+                goto err_free_stats;
 
+        /*
+         * Two extra attribue elements here, one for the lifespan entry and
+         * one to NULL terminate the list for the sysfs core code
+         */
         hsag = kzalloc(sizeof(*hsag) +
-                       // 1 extra for the lifespan config entry
-                       sizeof(void *) * (stats->num_counters + 1),
+                       sizeof(void *) * (stats->num_counters + 2),
                        GFP_KERNEL);
         if (!hsag)
-                return;
+                goto err_free_stats;
 
         ret = device->get_hw_stats(device, stats, port_num,
                                    stats->num_counters);
         if (ret != stats->num_counters)
-                goto err;
+                goto err_free_hsag;
 
         stats->timestamp = jiffies;
 
@@ -922,10 +925,13 @@ static void setup_hw_stats(struct ib_device *device, struct ib_port *port,
                 hsag->attrs[i] = alloc_hsa(i, port_num, stats->names[i]);
                 if (!hsag->attrs[i])
                         goto err;
+                sysfs_attr_init(hsag->attrs[i]);
         }
 
         /* treat an error here as non-fatal */
         hsag->attrs[i] = alloc_hsa_lifespan("lifespan", port_num);
+        if (hsag->attrs[i])
+                sysfs_attr_init(hsag->attrs[i]);
 
         if (port) {
                 struct kobject *kobj = &port->kobj;
@@ -946,10 +952,12 @@ static void setup_hw_stats(struct ib_device *device, struct ib_port *port,
         return;
 
 err:
-        kfree(stats);
         for (; i >= 0; i--)
                 kfree(hsag->attrs[i]);
+err_free_hsag:
         kfree(hsag);
+err_free_stats:
+        kfree(stats);
         return;
 }
 
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 1a8babb8ee3c..825021d1008b 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -1747,7 +1747,7 @@ static int create_qp(struct ib_uverbs_file *file,
         struct ib_srq                   *srq = NULL;
         struct ib_qp                    *qp;
         char                            *buf;
-        struct ib_qp_init_attr          attr;
+        struct ib_qp_init_attr          attr = {};
         struct ib_uverbs_ex_create_qp_resp resp;
         int                             ret;
 
diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
index 1d7d4cf442e3..6298f54b4137 100644
--- a/drivers/infiniband/core/verbs.c
+++ b/drivers/infiniband/core/verbs.c
@@ -511,12 +511,16 @@ int ib_init_ah_from_wc(struct ib_device *device, u8 port_num,
                 ah_attr->grh.dgid = sgid;
 
                 if (!rdma_cap_eth_ah(device, port_num)) {
-                        ret = ib_find_cached_gid_by_port(device, &dgid,
-                                                         IB_GID_TYPE_IB,
-                                                         port_num, NULL,
-                                                         &gid_index);
-                        if (ret)
-                                return ret;
+                        if (dgid.global.interface_id != cpu_to_be64(IB_SA_WELL_KNOWN_GUID)) {
+                                ret = ib_find_cached_gid_by_port(device, &dgid,
+                                                                 IB_GID_TYPE_IB,
+                                                                 port_num, NULL,
+                                                                 &gid_index);
+                                if (ret)
+                                        return ret;
+                        } else {
+                                gid_index = 0;
+                        }
                 }
 
                 ah_attr->grh.sgid_index = (u8) gid_index;
diff --git a/drivers/infiniband/hw/hfi1/affinity.c b/drivers/infiniband/hw/hfi1/affinity.c
index 6e7050ab9e16..14d7eeb09be6 100644
--- a/drivers/infiniband/hw/hfi1/affinity.c
+++ b/drivers/infiniband/hw/hfi1/affinity.c
@@ -300,16 +300,15 @@ int hfi1_get_proc_affinity(struct hfi1_devdata *dd, int node)
         const struct cpumask *node_mask,
                 *proc_mask = tsk_cpus_allowed(current);
         struct cpu_mask_set *set = &dd->affinity->proc;
-        char buf[1024];
 
         /*
          * check whether process/context affinity has already
          * been set
          */
         if (cpumask_weight(proc_mask) == 1) {
-                scnprintf(buf, 1024, "%*pbl", cpumask_pr_args(proc_mask));
-                hfi1_cdbg(PROC, "PID %u %s affinity set to CPU %s",
-                          current->pid, current->comm, buf);
+                hfi1_cdbg(PROC, "PID %u %s affinity set to CPU %*pbl",
+                          current->pid, current->comm,
+                          cpumask_pr_args(proc_mask));
                 /*
                  * Mark the pre-set CPU as used. This is atomic so we don't
                  * need the lock
@@ -318,9 +317,9 @@ int hfi1_get_proc_affinity(struct hfi1_devdata *dd, int node)
                 cpumask_set_cpu(cpu, &set->used);
                 goto done;
         } else if (cpumask_weight(proc_mask) < cpumask_weight(&set->mask)) {
-                scnprintf(buf, 1024, "%*pbl", cpumask_pr_args(proc_mask));
-                hfi1_cdbg(PROC, "PID %u %s affinity set to CPU set(s) %s",
-                          current->pid, current->comm, buf);
+                hfi1_cdbg(PROC, "PID %u %s affinity set to CPU set(s) %*pbl",
+                          current->pid, current->comm,
+                          cpumask_pr_args(proc_mask));
                 goto done;
         }
 
@@ -356,8 +355,8 @@ int hfi1_get_proc_affinity(struct hfi1_devdata *dd, int node)
         cpumask_or(intrs, intrs, (dd->affinity->rcv_intr.gen ?
                                   &dd->affinity->rcv_intr.mask :
                                   &dd->affinity->rcv_intr.used));
-        scnprintf(buf, 1024, "%*pbl", cpumask_pr_args(intrs));
-        hfi1_cdbg(PROC, "CPUs used by interrupts: %s", buf);
+        hfi1_cdbg(PROC, "CPUs used by interrupts: %*pbl",
+                  cpumask_pr_args(intrs));
 
         /*
          * If we don't have a NUMA node requested, preference is towards
@@ -366,18 +365,16 @@ int hfi1_get_proc_affinity(struct hfi1_devdata *dd, int node)
         if (node == -1)
                 node = dd->node;
         node_mask = cpumask_of_node(node);
-        scnprintf(buf, 1024, "%*pbl", cpumask_pr_args(node_mask));
-        hfi1_cdbg(PROC, "device on NUMA %u, CPUs %s", node, buf);
+        hfi1_cdbg(PROC, "device on NUMA %u, CPUs %*pbl", node,
+                  cpumask_pr_args(node_mask));
 
         /* diff will hold all unused cpus */
         cpumask_andnot(diff, &set->mask, &set->used);
-        scnprintf(buf, 1024, "%*pbl", cpumask_pr_args(diff));
-        hfi1_cdbg(PROC, "unused CPUs (all) %s", buf);
+        hfi1_cdbg(PROC, "unused CPUs (all) %*pbl", cpumask_pr_args(diff));
 
         /* get cpumask of available CPUs on preferred NUMA */
         cpumask_and(mask, diff, node_mask);
-        scnprintf(buf, 1024, "%*pbl", cpumask_pr_args(mask));
-        hfi1_cdbg(PROC, "available cpus on NUMA %s", buf);
+        hfi1_cdbg(PROC, "available cpus on NUMA %*pbl", cpumask_pr_args(mask));
 
         /*
          * At first, we don't want to place processes on the same
@@ -395,8 +392,8 @@ int hfi1_get_proc_affinity(struct hfi1_devdata *dd, int node)
                 cpumask_andnot(diff, &set->mask, &set->used);
                 cpumask_andnot(mask, diff, node_mask);
         }
-        scnprintf(buf, 1024, "%*pbl", cpumask_pr_args(mask));
-        hfi1_cdbg(PROC, "possible CPUs for process %s", buf);
+        hfi1_cdbg(PROC, "possible CPUs for process %*pbl",
+                  cpumask_pr_args(mask));
 
         cpu = cpumask_first(mask);
         if (cpu >= nr_cpu_ids) /* empty */
diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
index 3b876da745a1..f5de85178055 100644
--- a/drivers/infiniband/hw/hfi1/chip.c
+++ b/drivers/infiniband/hw/hfi1/chip.c
@@ -1037,7 +1037,7 @@ static void dc_shutdown(struct hfi1_devdata *);
 static void dc_start(struct hfi1_devdata *);
 static int qos_rmt_entries(struct hfi1_devdata *dd, unsigned int *mp,
                            unsigned int *np);
-static void remove_full_mgmt_pkey(struct hfi1_pportdata *ppd);
+static void clear_full_mgmt_pkey(struct hfi1_pportdata *ppd);
 
 /*
  * Error interrupt table entry.  This is used as input to the interrupt
@@ -6962,8 +6962,6 @@ void handle_link_down(struct work_struct *work)
         }
 
         reset_neighbor_info(ppd);
-        if (ppd->mgmt_allowed)
-                remove_full_mgmt_pkey(ppd);
 
         /* disable the port */
         clear_rcvctrl(ppd->dd, RCV_CTRL_RCV_PORT_ENABLE_SMASK);
@@ -7070,12 +7068,16 @@ static void add_full_mgmt_pkey(struct hfi1_pportdata *ppd)
                             __func__, ppd->pkeys[2], FULL_MGMT_P_KEY);
         ppd->pkeys[2] = FULL_MGMT_P_KEY;
         (void)hfi1_set_ib_cfg(ppd, HFI1_IB_CFG_PKEYS, 0);
+        hfi1_event_pkey_change(ppd->dd, ppd->port);
 }
 
-static void remove_full_mgmt_pkey(struct hfi1_pportdata *ppd)
+static void clear_full_mgmt_pkey(struct hfi1_pportdata *ppd)
 {
-        ppd->pkeys[2] = 0;
-        (void)hfi1_set_ib_cfg(ppd, HFI1_IB_CFG_PKEYS, 0);
+        if (ppd->pkeys[2] != 0) {
+                ppd->pkeys[2] = 0;
+                (void)hfi1_set_ib_cfg(ppd, HFI1_IB_CFG_PKEYS, 0);
+                hfi1_event_pkey_change(ppd->dd, ppd->port);
+        }
 }
 
 /*
@@ -7832,8 +7834,8 @@ static void handle_dcc_err(struct hfi1_devdata *dd, u32 unused, u64 reg)
                          * save first 2 flits in the packet that caused
                          * the error
                          */
-                         dd->err_info_rcvport.packet_flit1 = hdr0;
-                         dd->err_info_rcvport.packet_flit2 = hdr1;
+                        dd->err_info_rcvport.packet_flit1 = hdr0;
+                        dd->err_info_rcvport.packet_flit2 = hdr1;
                 }
                 switch (info) {
                 case 1:
@@ -9168,6 +9170,13 @@ int start_link(struct hfi1_pportdata *ppd)
                 return 0;
         }
 
+        /*
+         * FULL_MGMT_P_KEY is cleared from the pkey table, so that the
+         * pkey table can be configured properly if the HFI unit is connected
+         * to switch port with MgmtAllowed=NO
+         */
+        clear_full_mgmt_pkey(ppd);
+
         return set_link_state(ppd, HLS_DN_POLL);
 }
 
@@ -9777,7 +9786,7 @@ static void set_send_length(struct hfi1_pportdata *ppd)
         u64 len1 = 0, len2 = (((dd->vld[15].mtu + max_hb) >> 2)
                               & SEND_LEN_CHECK1_LEN_VL15_MASK) <<
                 SEND_LEN_CHECK1_LEN_VL15_SHIFT;
-        int i;
+        int i, j;
         u32 thres;
 
         for (i = 0; i < ppd->vls_supported; i++) {
@@ -9801,7 +9810,10 @@ static void set_send_length(struct hfi1_pportdata *ppd)
                             sc_mtu_to_threshold(dd->vld[i].sc,
                                                 dd->vld[i].mtu,
                                                 dd->rcd[0]->rcvhdrqentsize));
-                sc_set_cr_threshold(dd->vld[i].sc, thres);
+                for (j = 0; j < INIT_SC_PER_VL; j++)
+                        sc_set_cr_threshold(
+                                        pio_select_send_context_vl(dd, j, i),
+                                            thres);
         }
         thres = min(sc_percent_to_threshold(dd->vld[15].sc, 50),
                     sc_mtu_to_threshold(dd->vld[15].sc,
@@ -11906,7 +11918,7 @@ static void update_synth_timer(unsigned long opaque)
                 hfi1_cdbg(CNTR, "[%d] No update necessary", dd->unit);
         }
 
-mod_timer(&dd->synth_stats_timer, jiffies + HZ * SYNTH_CNT_TIME);
+        mod_timer(&dd->synth_stats_timer, jiffies + HZ * SYNTH_CNT_TIME);
 }
 
 #define C_MAX_NAME 13 /* 12 chars + one for /0 */
diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c
index 7a5b0e676cc7..c702a009608f 100644
--- a/drivers/infiniband/hw/hfi1/file_ops.c
+++ b/drivers/infiniband/hw/hfi1/file_ops.c
@@ -203,6 +203,9 @@ static long hfi1_file_ioctl(struct file *fp, unsigned int cmd,
 
         switch (cmd) {
         case HFI1_IOCTL_ASSIGN_CTXT:
+                if (uctxt)
+                        return -EINVAL;
+
                 if (copy_from_user(&uinfo,
                                    (struct hfi1_user_info __user *)arg,
                                    sizeof(uinfo)))
diff --git a/drivers/infiniband/hw/hfi1/init.c b/drivers/infiniband/hw/hfi1/init.c
index 5cc492e5776d..eed971ccd2a1 100644
--- a/drivers/infiniband/hw/hfi1/init.c
+++ b/drivers/infiniband/hw/hfi1/init.c
@@ -1337,7 +1337,7 @@ static void cleanup_device_data(struct hfi1_devdata *dd)
                 dma_free_coherent(&dd->pcidev->dev, sizeof(u64),
                                   (void *)dd->rcvhdrtail_dummy_kvaddr,
                                   dd->rcvhdrtail_dummy_physaddr);
-                                  dd->rcvhdrtail_dummy_kvaddr = NULL;
+                dd->rcvhdrtail_dummy_kvaddr = NULL;
         }
 
         for (ctxt = 0; tmp && ctxt < dd->num_rcv_contexts; ctxt++) {
@@ -1383,7 +1383,7 @@ static void postinit_cleanup(struct hfi1_devdata *dd)
 static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
         int ret = 0, j, pidx, initfail;
-        struct hfi1_devdata *dd = NULL;
+        struct hfi1_devdata *dd = ERR_PTR(-EINVAL);
         struct hfi1_pportdata *ppd;
 
         /* First, lock the non-writable module parameters */
diff --git a/drivers/infiniband/hw/hfi1/mad.c b/drivers/infiniband/hw/hfi1/mad.c
index 219029576ba0..fca07a1d6c28 100644
--- a/drivers/infiniband/hw/hfi1/mad.c
+++ b/drivers/infiniband/hw/hfi1/mad.c
@@ -78,6 +78,16 @@ static inline void clear_opa_smp_data(struct opa_smp *smp)
         memset(data, 0, size);
 }
 
+void hfi1_event_pkey_change(struct hfi1_devdata *dd, u8 port)
+{
+        struct ib_event event;
+
+        event.event = IB_EVENT_PKEY_CHANGE;
+        event.device = &dd->verbs_dev.rdi.ibdev;
+        event.element.port_num = port;
+        ib_dispatch_event(&event);
+}
+
 static void send_trap(struct hfi1_ibport *ibp, void *data, unsigned len)
 {
         struct ib_mad_send_buf *send_buf;
@@ -1418,15 +1428,10 @@ static int set_pkeys(struct hfi1_devdata *dd, u8 port, u16 *pkeys)
         }
 
         if (changed) {
-                struct ib_event event;
-
                 (void)hfi1_set_ib_cfg(ppd, HFI1_IB_CFG_PKEYS, 0);
-
-                event.event = IB_EVENT_PKEY_CHANGE;
-                event.device = &dd->verbs_dev.rdi.ibdev;
-                event.element.port_num = port;
-                ib_dispatch_event(&event);
+                hfi1_event_pkey_change(dd, port);
         }
+
         return 0;
 }
 
diff --git a/drivers/infiniband/hw/hfi1/mad.h b/drivers/infiniband/hw/hfi1/mad.h
index 55ee08675333..8b734aaae88a 100644
--- a/drivers/infiniband/hw/hfi1/mad.h
+++ b/drivers/infiniband/hw/hfi1/mad.h
@@ -434,4 +434,6 @@ struct sc2vlnt {
                     COUNTER_MASK(1, 3) | \
                     COUNTER_MASK(1, 4))
 
+void hfi1_event_pkey_change(struct hfi1_devdata *dd, u8 port);
+
 #endif                          /* _HFI1_MAD_H */
diff --git a/drivers/infiniband/hw/hfi1/pio.c b/drivers/infiniband/hw/hfi1/pio.c
index d5edb1afbb8f..d4022450b73f 100644
--- a/drivers/infiniband/hw/hfi1/pio.c
+++ b/drivers/infiniband/hw/hfi1/pio.c
@@ -995,7 +995,7 @@ static void sc_wait_for_packet_egress(struct send_context *sc, int pause)
                 /* counter is reset if occupancy count changes */
                 if (reg != reg_prev)
                         loop = 0;
-                if (loop > 500) {
+                if (loop > 50000) {
                         /* timed out - bounce the link */
                         dd_dev_err(dd,
                                    "%s: context %u(%u) timeout waiting for packets to egress, remaining count %u, bouncing link\n",
@@ -1798,6 +1798,21 @@ static void pio_map_rcu_callback(struct rcu_head *list)
 }
 
 /*
+ * Set credit return threshold for the kernel send context
+ */
+static void set_threshold(struct hfi1_devdata *dd, int scontext, int i)
+{
+        u32 thres;
+
+        thres = min(sc_percent_to_threshold(dd->kernel_send_context[scontext],
+                                            50),
+                    sc_mtu_to_threshold(dd->kernel_send_context[scontext],
+                                        dd->vld[i].mtu,
+                                        dd->rcd[0]->rcvhdrqentsize));
+        sc_set_cr_threshold(dd->kernel_send_context[scontext], thres);
+}
+
+/*
  * pio_map_init - called when #vls change
  * @dd: hfi1_devdata
  * @port: port number
@@ -1872,11 +1887,16 @@ int pio_map_init(struct hfi1_devdata *dd, u8 port, u8 num_vls, u8 *vl_scontexts)
                         if (!newmap->map[i])
                                 goto bail;
                         newmap->map[i]->mask = (1 << ilog2(sz)) - 1;
-                        /* assign send contexts */
+                        /*
+                         * assign send contexts and
+                         * adjust credit return threshold
+                         */
                         for (j = 0; j < sz; j++) {
-                                if (dd->kernel_send_context[scontext])
+                                if (dd->kernel_send_context[scontext]) {
                                         newmap->map[i]->ksc[j] =
                                         dd->kernel_send_context[scontext];
+                                        set_threshold(dd, scontext, i);
+                                }
                                 if (++scontext >= first_scontext +
                                                   vl_scontexts[i])
                                         /* wrap back to first send context */
diff --git a/drivers/infiniband/hw/hfi1/qsfp.c b/drivers/infiniband/hw/hfi1/qsfp.c
index 2441669f0817..9fb561682c66 100644
--- a/drivers/infiniband/hw/hfi1/qsfp.c
+++ b/drivers/infiniband/hw/hfi1/qsfp.c
@@ -579,7 +579,8 @@ int qsfp_dump(struct hfi1_pportdata *ppd, char *buf, int len)
 
         if (ppd->qsfp_info.cache_valid) {
                 if (QSFP_IS_CU(cache[QSFP_MOD_TECH_OFFS]))
-                        sprintf(lenstr, "%dM ", cache[QSFP_MOD_LEN_OFFS]);
+                        snprintf(lenstr, sizeof(lenstr), "%dM ",
+                                 cache[QSFP_MOD_LEN_OFFS]);
 
                 power_byte = cache[QSFP_MOD_PWR_OFFS];
                 sofar += scnprintf(buf + sofar, len - sofar, "PWR:%.3sW\n",
diff --git a/drivers/infiniband/hw/hfi1/trace.c b/drivers/infiniband/hw/hfi1/trace.c
index 79b2952c0dfb..4cfb13771897 100644
--- a/drivers/infiniband/hw/hfi1/trace.c
+++ b/drivers/infiniband/hw/hfi1/trace.c
@@ -214,19 +214,6 @@ const char *print_u32_array(
         return ret;
 }
 
-const char *print_u64_array(
-        struct trace_seq *p,
-        u64 *arr, int len)
-{
-        int i;
-        const char *ret = trace_seq_buffer_ptr(p);
-
-        for (i = 0; i < len; i++)
-                trace_seq_printf(p, "%s0x%016llx", i == 0 ? "" : " ", arr[i]);
-        trace_seq_putc(p, 0);
-        return ret;
-}
-
 __hfi1_trace_fn(PKT);
 __hfi1_trace_fn(PROC);
 __hfi1_trace_fn(SDMA);
diff --git a/drivers/infiniband/hw/hfi1/user_sdma.c b/drivers/infiniband/hw/hfi1/user_sdma.c
index 29f4795f866c..47ffd273ecbd 100644
--- a/drivers/infiniband/hw/hfi1/user_sdma.c
+++ b/drivers/infiniband/hw/hfi1/user_sdma.c
@@ -183,7 +183,7 @@ struct user_sdma_iovec {
         struct sdma_mmu_node *node;
 };
 
-#define SDMA_CACHE_NODE_EVICT BIT(0)
+#define SDMA_CACHE_NODE_EVICT 0
 
 struct sdma_mmu_node {
         struct mmu_rb_node rb;
@@ -1355,11 +1355,11 @@ static int set_txreq_header(struct user_sdma_request *req,
                  */
                 SDMA_DBG(req, "TID offset %ubytes %uunits om%u",
                          req->tidoffset, req->tidoffset / req->omfactor,
-                         !!(req->omfactor - KDETH_OM_SMALL));
+                         req->omfactor != KDETH_OM_SMALL);
                 KDETH_SET(hdr->kdeth.ver_tid_offset, OFFSET,
                           req->tidoffset / req->omfactor);
                 KDETH_SET(hdr->kdeth.ver_tid_offset, OM,
-                          !!(req->omfactor - KDETH_OM_SMALL));
+                          req->omfactor != KDETH_OM_SMALL);
         }
 done:
         trace_hfi1_sdma_user_header(pq->dd, pq->ctxt, pq->subctxt,
diff --git a/drivers/infiniband/hw/hfi1/verbs_txreq.c b/drivers/infiniband/hw/hfi1/verbs_txreq.c
index bc95c4112c61..d8fb056526f8 100644
--- a/drivers/infiniband/hw/hfi1/verbs_txreq.c
+++ b/drivers/infiniband/hw/hfi1/verbs_txreq.c
@@ -92,11 +92,10 @@ void hfi1_put_txreq(struct verbs_txreq *tx)
 
 struct verbs_txreq *__get_txreq(struct hfi1_ibdev *dev,
                                 struct rvt_qp *qp)
+        __must_hold(&qp->s_lock)
 {
         struct verbs_txreq *tx = ERR_PTR(-EBUSY);
-        unsigned long flags;
 
-        spin_lock_irqsave(&qp->s_lock, flags);
         write_seqlock(&dev->iowait_lock);
         if (ib_rvt_state_ops[qp->state] & RVT_PROCESS_RECV_OK) {
                 struct hfi1_qp_priv *priv;
@@ -116,7 +115,6 @@ struct verbs_txreq *__get_txreq(struct hfi1_ibdev *dev,
         }
 out:
         write_sequnlock(&dev->iowait_lock);
-        spin_unlock_irqrestore(&qp->s_lock, flags);
         return tx;
 }
 
diff --git a/drivers/infiniband/hw/hfi1/verbs_txreq.h b/drivers/infiniband/hw/hfi1/verbs_txreq.h
index 1cf69b2fe4a5..a1d6e0807f97 100644
--- a/drivers/infiniband/hw/hfi1/verbs_txreq.h
+++ b/drivers/infiniband/hw/hfi1/verbs_txreq.h
@@ -73,6 +73,7 @@ struct verbs_txreq *__get_txreq(struct hfi1_ibdev *dev,
 
 static inline struct verbs_txreq *get_txreq(struct hfi1_ibdev *dev,
                                             struct rvt_qp *qp)
+        __must_hold(&qp->slock)
 {
         struct verbs_txreq *tx;
         struct hfi1_qp_priv *priv = qp->priv;
diff --git a/drivers/infiniband/hw/i40iw/i40iw.h b/drivers/infiniband/hw/i40iw/i40iw.h
index 8b9532034558..b738acdb9b02 100644
--- a/drivers/infiniband/hw/i40iw/i40iw.h
+++ b/drivers/infiniband/hw/i40iw/i40iw.h
@@ -113,6 +113,8 @@
 
 #define IW_HMC_OBJ_TYPE_NUM ARRAY_SIZE(iw_hmc_obj_types)
 #define IW_CFG_FPM_QP_COUNT             32768
+#define I40IW_MAX_PAGES_PER_FMR         512
+#define I40IW_MIN_PAGES_PER_FMR         1
 
 #define I40IW_MTU_TO_MSS                40
 #define I40IW_DEFAULT_MSS               1460
diff --git a/drivers/infiniband/hw/i40iw/i40iw_verbs.c b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
index 02a735b64208..33959ed14563 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_verbs.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
@@ -79,6 +79,7 @@ static int i40iw_query_device(struct ib_device *ibdev,
         props->max_qp_init_rd_atom = props->max_qp_rd_atom;
         props->atomic_cap = IB_ATOMIC_NONE;
         props->max_map_per_fmr = 1;
+        props->max_fast_reg_page_list_len = I40IW_MAX_PAGES_PER_FMR;
         return 0;
 }
 
@@ -1527,7 +1528,7 @@ static struct ib_mr *i40iw_alloc_mr(struct ib_pd *pd,
         mutex_lock(&iwdev->pbl_mutex);
         status = i40iw_get_pble(&iwdev->sc_dev, iwdev->pble_rsrc, palloc, iwmr->page_cnt);
         mutex_unlock(&iwdev->pbl_mutex);
-        if (!status)
+        if (status)
                 goto err1;
 
         if (palloc->level != I40IW_LEVEL_1)
@@ -2149,6 +2150,7 @@ static int i40iw_post_send(struct ib_qp *ibqp,
                         struct i40iw_sc_dev *dev = &iwqp->iwdev->sc_dev;
                         struct i40iw_fast_reg_stag_info info;
 
+                        memset(&info, 0, sizeof(info));
                         info.access_rights = I40IW_ACCESS_FLAGS_LOCALREAD;
                         info.access_rights |= i40iw_get_user_access(flags);
                         info.stag_key = reg_wr(ib_wr)->key & 0xff;
@@ -2158,10 +2160,14 @@ static int i40iw_post_send(struct ib_qp *ibqp,
                         info.addr_type = I40IW_ADDR_TYPE_VA_BASED;
                         info.va = (void *)(uintptr_t)iwmr->ibmr.iova;
                         info.total_len = iwmr->ibmr.length;
+                        info.reg_addr_pa = *(u64 *)palloc->level1.addr;
                         info.first_pm_pbl_index = palloc->level1.idx;
                         info.local_fence = ib_wr->send_flags & IB_SEND_FENCE;
                         info.signaled = ib_wr->send_flags & IB_SEND_SIGNALED;
 
+                        if (iwmr->npages > I40IW_MIN_PAGES_PER_FMR)
+                                info.chunk_size = 1;
+
                         if (page_shift == 21)
                                 info.page_size = 1; /* 2M page */
 
@@ -2327,13 +2333,16 @@ static int i40iw_req_notify_cq(struct ib_cq *ibcq,
 {
         struct i40iw_cq *iwcq;
         struct i40iw_cq_uk *ukcq;
-        enum i40iw_completion_notify cq_notify = IW_CQ_COMPL_SOLICITED;
+        unsigned long flags;
+        enum i40iw_completion_notify cq_notify = IW_CQ_COMPL_EVENT;
 
         iwcq = (struct i40iw_cq *)ibcq;
         ukcq = &iwcq->sc_cq.cq_uk;
-        if (notify_flags == IB_CQ_NEXT_COMP)
-                cq_notify = IW_CQ_COMPL_EVENT;
+        if (notify_flags == IB_CQ_SOLICITED)
+                cq_notify = IW_CQ_COMPL_SOLICITED;
+        spin_lock_irqsave(&iwcq->lock, flags);
         ukcq->ops.iw_cq_request_notification(ukcq, cq_notify);
+        spin_unlock_irqrestore(&iwcq->lock, flags);
         return 0;
 }
 
diff --git a/drivers/infiniband/hw/mlx4/ah.c b/drivers/infiniband/hw/mlx4/ah.c
index 105246fba2e7..5fc623362731 100644
--- a/drivers/infiniband/hw/mlx4/ah.c
+++ b/drivers/infiniband/hw/mlx4/ah.c
@@ -47,6 +47,7 @@ static struct ib_ah *create_ib_ah(struct ib_pd *pd, struct ib_ah_attr *ah_attr,
 
         ah->av.ib.port_pd = cpu_to_be32(to_mpd(pd)->pdn | (ah_attr->port_num << 24));
         ah->av.ib.g_slid  = ah_attr->src_path_bits;
+        ah->av.ib.sl_tclass_flowlabel = cpu_to_be32(ah_attr->sl << 28);
         if (ah_attr->ah_flags & IB_AH_GRH) {
                 ah->av.ib.g_slid   |= 0x80;
                 ah->av.ib.gid_index = ah_attr->grh.sgid_index;
@@ -64,7 +65,6 @@ static struct ib_ah *create_ib_ah(struct ib_pd *pd, struct ib_ah_attr *ah_attr,
                        !(1 << ah->av.ib.stat_rate & dev->caps.stat_rate_support))
                         --ah->av.ib.stat_rate;
         }
-        ah->av.ib.sl_tclass_flowlabel = cpu_to_be32(ah_attr->sl << 28);
 
         return &ah->ibah;
 }
diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
index d68f506c1922..9c2e53d28f98 100644
--- a/drivers/infiniband/hw/mlx4/mad.c
+++ b/drivers/infiniband/hw/mlx4/mad.c
@@ -527,7 +527,7 @@ int mlx4_ib_send_to_slave(struct mlx4_ib_dev *dev, int slave, u8 port,
                 tun_tx_ix = (++tun_qp->tx_ix_head) & (MLX4_NUM_TUNNEL_BUFS - 1);
         spin_unlock(&tun_qp->tx_lock);
         if (ret)
-                goto out;
+                goto end;
 
         tun_mad = (struct mlx4_rcv_tunnel_mad *) (tun_qp->tx_ring[tun_tx_ix].buf.addr);
         if (tun_qp->tx_ring[tun_tx_ix].ah)
@@ -596,9 +596,15 @@ int mlx4_ib_send_to_slave(struct mlx4_ib_dev *dev, int slave, u8 port,
         wr.wr.send_flags = IB_SEND_SIGNALED;
 
         ret = ib_post_send(src_qp, &wr.wr, &bad_wr);
-out:
-        if (ret)
-                ib_destroy_ah(ah);
+        if (!ret)
+                return 0;
+ out:
+        spin_lock(&tun_qp->tx_lock);
+        tun_qp->tx_ix_tail++;
+        spin_unlock(&tun_qp->tx_lock);
+        tun_qp->tx_ring[tun_tx_ix].ah = NULL;
+end:
+        ib_destroy_ah(ah);
         return ret;
 }
 
@@ -1326,9 +1332,15 @@ int mlx4_ib_send_to_wire(struct mlx4_ib_dev *dev, int slave, u8 port,
 
 
         ret = ib_post_send(send_qp, &wr.wr, &bad_wr);
+        if (!ret)
+                return 0;
+
+        spin_lock(&sqp->tx_lock);
+        sqp->tx_ix_tail++;
+        spin_unlock(&sqp->tx_lock);
+        sqp->tx_ring[wire_tx_ix].ah = NULL;
 out:
-        if (ret)
-                ib_destroy_ah(ah);
+        ib_destroy_ah(ah);
         return ret;
 }
 
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index b01ef6eee6e8..42a46078d7d5 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -505,9 +505,9 @@ static int mlx4_ib_query_device(struct ib_device *ibdev,
                         props->device_cap_flags |= IB_DEVICE_MEM_WINDOW_TYPE_2B;
                 else
                         props->device_cap_flags |= IB_DEVICE_MEM_WINDOW_TYPE_2A;
-        if (dev->steering_support ==  MLX4_STEERING_MODE_DEVICE_MANAGED)
-                props->device_cap_flags |= IB_DEVICE_MANAGED_FLOW_STEERING;
         }
+        if (dev->steering_support == MLX4_STEERING_MODE_DEVICE_MANAGED)
+                props->device_cap_flags |= IB_DEVICE_MANAGED_FLOW_STEERING;
 
         props->device_cap_flags |= IB_DEVICE_RAW_IP_CSUM;
 
@@ -1704,6 +1704,9 @@ static struct ib_flow *mlx4_ib_create_flow(struct ib_qp *qp,
         struct mlx4_dev *dev = (to_mdev(qp->device))->dev;
         int is_bonded = mlx4_is_bonded(dev);
 
+        if (flow_attr->port < 1 || flow_attr->port > qp->device->phys_port_cnt)
+                return ERR_PTR(-EINVAL);
+
         if ((flow_attr->flags & IB_FLOW_ATTR_FLAGS_DONT_TRAP) &&
             (flow_attr->type != IB_FLOW_ATTR_NORMAL))
                 return ERR_PTR(-EOPNOTSUPP);
diff --git a/drivers/infiniband/hw/mlx4/mlx4_ib.h b/drivers/infiniband/hw/mlx4/mlx4_ib.h
index 6c5ac5d8f32f..29acda249612 100644
--- a/drivers/infiniband/hw/mlx4/mlx4_ib.h
+++ b/drivers/infiniband/hw/mlx4/mlx4_ib.h
@@ -139,7 +139,7 @@ struct mlx4_ib_mr {
         u32                     max_pages;
         struct mlx4_mr          mmr;
         struct ib_umem         *umem;
-        void                    *pages_alloc;
+        size_t                  page_map_size;
 };
 
 struct mlx4_ib_mw {
diff --git a/drivers/infiniband/hw/mlx4/mr.c b/drivers/infiniband/hw/mlx4/mr.c
index 631272172a0b..5d73989d9771 100644
--- a/drivers/infiniband/hw/mlx4/mr.c
+++ b/drivers/infiniband/hw/mlx4/mr.c
@@ -277,20 +277,23 @@ mlx4_alloc_priv_pages(struct ib_device *device,
                       struct mlx4_ib_mr *mr,
                       int max_pages)
 {
-        int size = max_pages * sizeof(u64);
-        int add_size;
         int ret;
 
-        add_size = max_t(int, MLX4_MR_PAGES_ALIGN - ARCH_KMALLOC_MINALIGN, 0);
+        /* Ensure that size is aligned to DMA cacheline
+         * requirements.
+         * max_pages is limited to MLX4_MAX_FAST_REG_PAGES
+         * so page_map_size will never cross PAGE_SIZE.
+         */
+        mr->page_map_size = roundup(max_pages * sizeof(u64),
+                                    MLX4_MR_PAGES_ALIGN);
 
-        mr->pages_alloc = kzalloc(size + add_size, GFP_KERNEL);
-        if (!mr->pages_alloc)
+        /* Prevent cross page boundary allocation. */
+        mr->pages = (__be64 *)get_zeroed_page(GFP_KERNEL);
+        if (!mr->pages)
                 return -ENOMEM;
 
-        mr->pages = PTR_ALIGN(mr->pages_alloc, MLX4_MR_PAGES_ALIGN);
-
         mr->page_map = dma_map_single(device->dma_device, mr->pages,
-                                      size, DMA_TO_DEVICE);
+                                      mr->page_map_size, DMA_TO_DEVICE);
 
         if (dma_mapping_error(device->dma_device, mr->page_map)) {
                 ret = -ENOMEM;
@@ -298,9 +301,9 @@ mlx4_alloc_priv_pages(struct ib_device *device,
         }
 
         return 0;
-err:
-        kfree(mr->pages_alloc);
 
+err:
+        free_page((unsigned long)mr->pages);
         return ret;
 }
 
@@ -309,11 +312,10 @@ mlx4_free_priv_pages(struct mlx4_ib_mr *mr)
 {
         if (mr->pages) {
                 struct ib_device *device = mr->ibmr.device;
-                int size = mr->max_pages * sizeof(u64);
 
                 dma_unmap_single(device->dma_device, mr->page_map,
-                                 size, DMA_TO_DEVICE);
-                kfree(mr->pages_alloc);
+                                 mr->page_map_size, DMA_TO_DEVICE);
+                free_page((unsigned long)mr->pages);
                 mr->pages = NULL;
         }
 }
@@ -537,14 +539,12 @@ int mlx4_ib_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg, int sg_nents,
         mr->npages = 0;
 
         ib_dma_sync_single_for_cpu(ibmr->device, mr->page_map,
-                                   sizeof(u64) * mr->max_pages,
-                                   DMA_TO_DEVICE);
+                                   mr->page_map_size, DMA_TO_DEVICE);
 
         rc = ib_sg_to_pages(ibmr, sg, sg_nents, sg_offset, mlx4_set_page);
 
         ib_dma_sync_single_for_device(ibmr->device, mr->page_map,
-                                      sizeof(u64) * mr->max_pages,
-                                      DMA_TO_DEVICE);
+                                      mr->page_map_size, DMA_TO_DEVICE);
 
         return rc;
 }
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index 81b0e1fbec1d..8db8405c1e99 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -362,7 +362,7 @@ static int send_wqe_overhead(enum mlx4_ib_qp_type type, u32 flags)
                         sizeof (struct mlx4_wqe_raddr_seg);
         case MLX4_IB_QPT_RC:
                 return sizeof (struct mlx4_wqe_ctrl_seg) +
-                        sizeof (struct mlx4_wqe_atomic_seg) +
+                        sizeof (struct mlx4_wqe_masked_atomic_seg) +
                         sizeof (struct mlx4_wqe_raddr_seg);
         case MLX4_IB_QPT_SMI:
         case MLX4_IB_QPT_GSI:
@@ -1191,8 +1191,10 @@ static struct ib_qp *_mlx4_ib_create_qp(struct ib_pd *pd,
         {
                 err = create_qp_common(to_mdev(pd->device), pd, init_attr,
                                        udata, 0, &qp, gfp);
-                if (err)
+                if (err) {
+                        kfree(qp);
                         return ERR_PTR(err);
+                }
 
                 qp->ibqp.qp_num = qp->mqp.qpn;
                 qp->xrcdn = xrcdn;
diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c
index dabcc65bd65e..9c0e67bd2ba7 100644
--- a/drivers/infiniband/hw/mlx5/cq.c
+++ b/drivers/infiniband/hw/mlx5/cq.c
@@ -822,7 +822,8 @@ struct ib_cq *mlx5_ib_create_cq(struct ib_device *ibdev,
         int eqn;
         int err;
 
-        if (entries < 0)
+        if (entries < 0 ||
+            (entries > (1 << MLX5_CAP_GEN(dev->mdev, log_max_cq_sz))))
                 return ERR_PTR(-EINVAL);
 
         if (check_cq_create_flags(attr->flags))
@@ -1168,11 +1169,16 @@ int mlx5_ib_resize_cq(struct ib_cq *ibcq, int entries, struct ib_udata *udata)
                 return -ENOSYS;
         }
 
-        if (entries < 1)
+        if (entries < 1 ||
+            entries > (1 << MLX5_CAP_GEN(dev->mdev, log_max_cq_sz))) {
+                mlx5_ib_warn(dev, "wrong entries number %d, max %d\n",
+                             entries,
+                             1 << MLX5_CAP_GEN(dev->mdev, log_max_cq_sz));
                 return -EINVAL;
+        }
 
         entries = roundup_pow_of_two(entries + 1);
-        if (entries >  (1 << MLX5_CAP_GEN(dev->mdev, log_max_cq_sz)) + 1)
+        if (entries > (1 << MLX5_CAP_GEN(dev->mdev, log_max_cq_sz)) + 1)
                 return -EINVAL;
 
         if (entries == ibcq->cqe + 1)
diff --git a/drivers/infiniband/hw/mlx5/mad.c b/drivers/infiniband/hw/mlx5/mad.c
index 1534af113058..364aab9f3c9e 100644
--- a/drivers/infiniband/hw/mlx5/mad.c
+++ b/drivers/infiniband/hw/mlx5/mad.c
@@ -121,7 +121,7 @@ static void pma_cnt_ext_assign(struct ib_pma_portcounters_ext *pma_cnt_ext,
         pma_cnt_ext->port_xmit_data =
                 cpu_to_be64(MLX5_SUM_CNT(out, transmitted_ib_unicast.octets,
                                          transmitted_ib_multicast.octets) >> 2);
-        pma_cnt_ext->port_xmit_data =
+        pma_cnt_ext->port_rcv_data =
                 cpu_to_be64(MLX5_SUM_CNT(out, received_ib_unicast.octets,
                                          received_ib_multicast.octets) >> 2);
         pma_cnt_ext->port_xmit_packets =
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index c72797cd9e4f..b48ad85315dc 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -524,6 +524,9 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
             MLX5_CAP_ETH(dev->mdev, scatter_fcs))
                 props->device_cap_flags |= IB_DEVICE_RAW_SCATTER_FCS;
 
+        if (mlx5_get_flow_namespace(dev->mdev, MLX5_FLOW_NAMESPACE_BYPASS))
+                props->device_cap_flags |= IB_DEVICE_MANAGED_FLOW_STEERING;
+
         props->vendor_part_id      = mdev->pdev->device;
         props->hw_ver              = mdev->pdev->revision;
 
@@ -915,7 +918,8 @@ static struct ib_ucontext *mlx5_ib_alloc_ucontext(struct ib_device *ibdev,
         num_uars = req.total_num_uuars / MLX5_NON_FP_BF_REGS_PER_PAGE;
         gross_uuars = num_uars * MLX5_BF_REGS_PER_PAGE;
         resp.qp_tab_size = 1 << MLX5_CAP_GEN(dev->mdev, log_max_qp);
-        resp.bf_reg_size = 1 << MLX5_CAP_GEN(dev->mdev, log_bf_reg_size);
+        if (mlx5_core_is_pf(dev->mdev) && MLX5_CAP_GEN(dev->mdev, bf))
+                resp.bf_reg_size = 1 << MLX5_CAP_GEN(dev->mdev, log_bf_reg_size);
         resp.cache_line_size = L1_CACHE_BYTES;
         resp.max_sq_desc_sz = MLX5_CAP_GEN(dev->mdev, max_wqe_sz_sq);
         resp.max_rq_desc_sz = MLX5_CAP_GEN(dev->mdev, max_wqe_sz_rq);
@@ -988,7 +992,14 @@ static struct ib_ucontext *mlx5_ib_alloc_ucontext(struct ib_device *ibdev,
         if (field_avail(typeof(resp), cqe_version, udata->outlen))
                 resp.response_length += sizeof(resp.cqe_version);
 
-        if (field_avail(typeof(resp), hca_core_clock_offset, udata->outlen)) {
+        /*
+         * We don't want to expose information from the PCI bar that is located
+         * after 4096 bytes, so if the arch only supports larger pages, let's
+         * pretend we don't support reading the HCA's core clock. This is also
+         * forced by mmap function.
+         */
+        if (PAGE_SIZE <= 4096 &&
+            field_avail(typeof(resp), hca_core_clock_offset, udata->outlen)) {
                 resp.comp_mask |=
                         MLX5_IB_ALLOC_UCONTEXT_RESP_MASK_CORE_CLOCK_OFFSET;
                 resp.hca_core_clock_offset =
@@ -1798,7 +1809,7 @@ static ssize_t show_fw_ver(struct device *device, struct device_attribute *attr,
 {
         struct mlx5_ib_dev *dev =
                 container_of(device, struct mlx5_ib_dev, ib_dev.dev);
-        return sprintf(buf, "%d.%d.%d\n", fw_rev_maj(dev->mdev),
+        return sprintf(buf, "%d.%d.%04d\n", fw_rev_maj(dev->mdev),
                        fw_rev_min(dev->mdev), fw_rev_sub(dev->mdev));
 }
 
@@ -1866,14 +1877,11 @@ static void mlx5_ib_event(struct mlx5_core_dev *dev, void *context,
                 break;
 
         case MLX5_DEV_EVENT_PORT_DOWN:
+        case MLX5_DEV_EVENT_PORT_INITIALIZED:
                 ibev.event = IB_EVENT_PORT_ERR;
                 port = (u8)param;
                 break;
 
-        case MLX5_DEV_EVENT_PORT_INITIALIZED:
-                /* not used by ULPs */
-                return;
-
         case MLX5_DEV_EVENT_LID_CHANGE:
                 ibev.event = IB_EVENT_LID_CHANGE;
                 port = (u8)param;
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 504117657d41..ce0a7ab35a22 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -235,6 +235,8 @@ static int set_rq_size(struct mlx5_ib_dev *dev, struct ib_qp_cap *cap,
                 qp->rq.max_gs = 0;
                 qp->rq.wqe_cnt = 0;
                 qp->rq.wqe_shift = 0;
+                cap->max_recv_wr = 0;
+                cap->max_recv_sge = 0;
         } else {
                 if (ucmd) {
                         qp->rq.wqe_cnt = ucmd->rq_wqe_count;
@@ -1851,13 +1853,15 @@ static int modify_raw_packet_eth_prio(struct mlx5_core_dev *dev,
 static int mlx5_set_path(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp,
                          const struct ib_ah_attr *ah,
                          struct mlx5_qp_path *path, u8 port, int attr_mask,
-                         u32 path_flags, const struct ib_qp_attr *attr)
+                         u32 path_flags, const struct ib_qp_attr *attr,
+                         bool alt)
 {
         enum rdma_link_layer ll = rdma_port_get_link_layer(&dev->ib_dev, port);
         int err;
 
         if (attr_mask & IB_QP_PKEY_INDEX)
-                path->pkey_index = attr->pkey_index;
+                path->pkey_index = cpu_to_be16(alt ? attr->alt_pkey_index :
+                                                     attr->pkey_index);
 
         if (ah->ah_flags & IB_AH_GRH) {
                 if (ah->grh.sgid_index >=
@@ -1877,9 +1881,9 @@ static int mlx5_set_path(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp,
                                                           ah->grh.sgid_index);
                 path->dci_cfi_prio_sl = (ah->sl & 0x7) << 4;
         } else {
-                path->fl = (path_flags & MLX5_PATH_FLAG_FL) ? 0x80 : 0;
-                path->free_ar = (path_flags & MLX5_PATH_FLAG_FREE_AR) ? 0x80 :
-                                                                        0;
+                path->fl_free_ar = (path_flags & MLX5_PATH_FLAG_FL) ? 0x80 : 0;
+                path->fl_free_ar |=
+                        (path_flags & MLX5_PATH_FLAG_FREE_AR) ? 0x40 : 0;
                 path->rlid = cpu_to_be16(ah->dlid);
                 path->grh_mlid = ah->src_path_bits & 0x7f;
                 if (ah->ah_flags & IB_AH_GRH)
@@ -1903,7 +1907,7 @@ static int mlx5_set_path(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp,
         path->port = port;
 
         if (attr_mask & IB_QP_TIMEOUT)
-                path->ackto_lt = attr->timeout << 3;
+                path->ackto_lt = (alt ? attr->alt_timeout : attr->timeout) << 3;
 
         if ((qp->ibqp.qp_type == IB_QPT_RAW_PACKET) && qp->sq.wqe_cnt)
                 return modify_raw_packet_eth_prio(dev->mdev,
@@ -2264,7 +2268,7 @@ static int __mlx5_ib_modify_qp(struct ib_qp *ibqp,
                 context->log_pg_sz_remote_qpn = cpu_to_be32(attr->dest_qp_num);
 
         if (attr_mask & IB_QP_PKEY_INDEX)
-                context->pri_path.pkey_index = attr->pkey_index;
+                context->pri_path.pkey_index = cpu_to_be16(attr->pkey_index);
 
         /* todo implement counter_index functionality */
 
@@ -2277,7 +2281,7 @@ static int __mlx5_ib_modify_qp(struct ib_qp *ibqp,
         if (attr_mask & IB_QP_AV) {
                 err = mlx5_set_path(dev, qp, &attr->ah_attr, &context->pri_path,
                                     attr_mask & IB_QP_PORT ? attr->port_num : qp->port,
-                                    attr_mask, 0, attr);
+                                    attr_mask, 0, attr, false);
                 if (err)
                         goto out;
         }
@@ -2288,7 +2292,9 @@ static int __mlx5_ib_modify_qp(struct ib_qp *ibqp,
         if (attr_mask & IB_QP_ALT_PATH) {
                 err = mlx5_set_path(dev, qp, &attr->alt_ah_attr,
                                     &context->alt_path,
-                                    attr->alt_port_num, attr_mask, 0, attr);
+                                    attr->alt_port_num,
+                                    attr_mask | IB_QP_PKEY_INDEX | IB_QP_TIMEOUT,
+                                    0, attr, true);
                 if (err)
                         goto out;
         }
@@ -3326,10 +3332,11 @@ static u8 get_fence(u8 fence, struct ib_send_wr *wr)
                         return MLX5_FENCE_MODE_SMALL_AND_FENCE;
                 else
                         return fence;
-
-        } else {
-                return 0;
+        } else if (unlikely(wr->send_flags & IB_SEND_FENCE)) {
+                return MLX5_FENCE_MODE_FENCE;
         }
+
+        return 0;
 }
 
 static int begin_wqe(struct mlx5_ib_qp *qp, void **seg,
@@ -4013,11 +4020,12 @@ static int query_qp_attr(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp,
         if (qp->ibqp.qp_type == IB_QPT_RC || qp->ibqp.qp_type == IB_QPT_UC) {
                 to_ib_ah_attr(dev, &qp_attr->ah_attr, &context->pri_path);
                 to_ib_ah_attr(dev, &qp_attr->alt_ah_attr, &context->alt_path);
-                qp_attr->alt_pkey_index = context->alt_path.pkey_index & 0x7f;
+                qp_attr->alt_pkey_index =
+                        be16_to_cpu(context->alt_path.pkey_index);
                 qp_attr->alt_port_num   = qp_attr->alt_ah_attr.port_num;
         }
 
-        qp_attr->pkey_index = context->pri_path.pkey_index & 0x7f;
+        qp_attr->pkey_index = be16_to_cpu(context->pri_path.pkey_index);
         qp_attr->port_num = context->pri_path.port;
 
         /* qp_attr->en_sqd_async_notify is only applicable in modify qp */
@@ -4079,17 +4087,19 @@ int mlx5_ib_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *qp_attr,
         qp_attr->cap.max_recv_sge    = qp->rq.max_gs;
 
         if (!ibqp->uobject) {
-                qp_attr->cap.max_send_wr  = qp->sq.wqe_cnt;
+                qp_attr->cap.max_send_wr  = qp->sq.max_post;
                 qp_attr->cap.max_send_sge = qp->sq.max_gs;
+                qp_init_attr->qp_context = ibqp->qp_context;
         } else {
                 qp_attr->cap.max_send_wr  = 0;
                 qp_attr->cap.max_send_sge = 0;
         }
 
-        /* We don't support inline sends for kernel QPs (yet), and we
-         * don't know what userspace's value should be.
-         */
-        qp_attr->cap.max_inline_data = 0;
+        qp_init_attr->qp_type = ibqp->qp_type;
+        qp_init_attr->recv_cq = ibqp->recv_cq;
+        qp_init_attr->send_cq = ibqp->send_cq;
+        qp_init_attr->srq = ibqp->srq;
+        qp_attr->cap.max_inline_data = qp->max_inline_data;
 
         qp_init_attr->cap            = qp_attr->cap;
 
diff --git a/drivers/infiniband/hw/qib/qib_file_ops.c b/drivers/infiniband/hw/qib/qib_file_ops.c
index ff946d5f59e4..382466a90da7 100644
--- a/drivers/infiniband/hw/qib/qib_file_ops.c
+++ b/drivers/infiniband/hw/qib/qib_file_ops.c
@@ -2178,6 +2178,11 @@ static ssize_t qib_write(struct file *fp, const char __user *data,
 
         switch (cmd.type) {
         case QIB_CMD_ASSIGN_CTXT:
+                if (rcd) {
+                        ret = -EINVAL;
+                        goto bail;
+                }
+
                 ret = qib_assign_ctxt(fp, &cmd.cmd.user_info);
                 if (ret)
                         goto bail;
diff --git a/drivers/infiniband/hw/usnic/usnic_uiom.c b/drivers/infiniband/hw/usnic/usnic_uiom.c
index 7209fbc03ccb..a0b6ebee4d8a 100644
--- a/drivers/infiniband/hw/usnic/usnic_uiom.c
+++ b/drivers/infiniband/hw/usnic/usnic_uiom.c
@@ -36,7 +36,6 @@
 #include <linux/dma-mapping.h>
 #include <linux/sched.h>
 #include <linux/hugetlb.h>
-#include <linux/dma-attrs.h>
 #include <linux/iommu.h>
 #include <linux/workqueue.h>
 #include <linux/list.h>
@@ -112,10 +111,6 @@ static int usnic_uiom_get_pages(unsigned long addr, size_t size, int writable,
         int i;
         int flags;
         dma_addr_t pa;
-        DEFINE_DMA_ATTRS(attrs);
-
-        if (dmasync)
-                dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs);
 
         if (!can_do_mlock())
                 return -EPERM;
diff --git a/drivers/infiniband/sw/rdmavt/qp.c b/drivers/infiniband/sw/rdmavt/qp.c
index 5fa4d4d81ee0..41ba7e9cadaa 100644
--- a/drivers/infiniband/sw/rdmavt/qp.c
+++ b/drivers/infiniband/sw/rdmavt/qp.c
@@ -369,8 +369,8 @@ static int alloc_qpn(struct rvt_dev_info *rdi, struct rvt_qpn_table *qpt,
                         /* wrap to first map page, invert bit 0 */
                         offset = qpt->incr | ((offset & 1) ^ 1);
                 }
-                /* there can be no bits at shift and below */
-                WARN_ON(offset & (rdi->dparms.qos_shift - 1));
+                /* there can be no set bits in low-order QoS bits */
+                WARN_ON(offset & (BIT(rdi->dparms.qos_shift) - 1));
                 qpn = mk_qpn(qpt, map, offset);
         }
 
@@ -502,6 +502,12 @@ static void rvt_remove_qp(struct rvt_dev_info *rdi, struct rvt_qp *qp)
  */
 static void rvt_reset_qp(struct rvt_dev_info *rdi, struct rvt_qp *qp,
                   enum ib_qp_type type)
+        __releases(&qp->s_lock)
+        __releases(&qp->s_hlock)
+        __releases(&qp->r_lock)
+        __acquires(&qp->r_lock)
+        __acquires(&qp->s_hlock)
+        __acquires(&qp->s_lock)
 {
         if (qp->state != IB_QPS_RESET) {
                 qp->state = IB_QPS_RESET;
@@ -570,12 +576,6 @@ static void rvt_reset_qp(struct rvt_dev_info *rdi, struct rvt_qp *qp,
         qp->s_ssn = 1;
         qp->s_lsn = 0;
         qp->s_mig_state = IB_MIG_MIGRATED;
-        if (qp->s_ack_queue)
-                memset(
-                        qp->s_ack_queue,
-                        0,
-                        rvt_max_atomic(rdi) *
-                                sizeof(*qp->s_ack_queue));
         qp->r_head_ack_queue = 0;
         qp->s_tail_ack_queue = 0;
         qp->s_num_rd_atomic = 0;
@@ -699,8 +699,10 @@ struct ib_qp *rvt_create_qp(struct ib_pd *ibpd,
                  * initialization that is needed.
                  */
                 priv = rdi->driver_f.qp_priv_alloc(rdi, qp, gfp);
-                if (!priv)
+                if (IS_ERR(priv)) {
+                        ret = priv;
                         goto bail_qp;
+                }
                 qp->priv = priv;
                 qp->timeout_jiffies =
                         usecs_to_jiffies((4096UL * (1UL << qp->timeout)) /
diff --git a/drivers/infiniband/sw/rdmavt/vt.c b/drivers/infiniband/sw/rdmavt/vt.c
index e1cc2cc42f25..30c4fda7a05a 100644
--- a/drivers/infiniband/sw/rdmavt/vt.c
+++ b/drivers/infiniband/sw/rdmavt/vt.c
@@ -501,9 +501,7 @@ static noinline int check_support(struct rvt_dev_info *rdi, int verb)
                             !rdi->driver_f.quiesce_qp ||
                             !rdi->driver_f.notify_error_qp ||
                             !rdi->driver_f.mtu_from_qp ||
-                            !rdi->driver_f.mtu_to_path_mtu ||
-                            !rdi->driver_f.shut_down_port ||
-                            !rdi->driver_f.cap_mask_chg)
+                            !rdi->driver_f.mtu_to_path_mtu)
                                 return -EINVAL;
                 break;
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
index bab7db6fa9ab..4f7d9b48df64 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib.h
+++ b/drivers/infiniband/ulp/ipoib/ipoib.h
@@ -94,6 +94,7 @@ enum {
         IPOIB_NEIGH_TBL_FLUSH     = 12,
         IPOIB_FLAG_DEV_ADDR_SET   = 13,
         IPOIB_FLAG_DEV_ADDR_CTRL  = 14,
+        IPOIB_FLAG_GOING_DOWN     = 15,
 
         IPOIB_MAX_BACKOFF_SECONDS = 16,
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index b2f42835d76d..951d9abcca8b 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -1486,6 +1486,10 @@ static ssize_t set_mode(struct device *d, struct device_attribute *attr,
 {
         struct net_device *dev = to_net_dev(d);
         int ret;
+        struct ipoib_dev_priv *priv = netdev_priv(dev);
+
+        if (test_bit(IPOIB_FLAG_GOING_DOWN, &priv->flags))
+                return -EPERM;
 
         if (!rtnl_trylock())
                 return restart_syscall();
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index 45c40a17d6a6..dc6d241b9406 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -1015,7 +1015,7 @@ static bool ipoib_dev_addr_changed_valid(struct ipoib_dev_priv *priv)
         if (ib_query_gid(priv->ca, priv->port, 0, &gid0, NULL))
                 return false;
 
-        netif_addr_lock(priv->dev);
+        netif_addr_lock_bh(priv->dev);
 
         /* The subnet prefix may have changed, update it now so we won't have
          * to do it later
@@ -1026,12 +1026,12 @@ static bool ipoib_dev_addr_changed_valid(struct ipoib_dev_priv *priv)
 
         search_gid.global.interface_id = priv->local_gid.global.interface_id;
 
-        netif_addr_unlock(priv->dev);
+        netif_addr_unlock_bh(priv->dev);
 
         err = ib_find_gid(priv->ca, &search_gid, IB_GID_TYPE_IB,
                           priv->dev, &port, &index);
 
-        netif_addr_lock(priv->dev);
+        netif_addr_lock_bh(priv->dev);
 
         if (search_gid.global.interface_id !=
             priv->local_gid.global.interface_id)
@@ -1092,7 +1092,7 @@ static bool ipoib_dev_addr_changed_valid(struct ipoib_dev_priv *priv)
         }
 
 out:
-        netif_addr_unlock(priv->dev);
+        netif_addr_unlock_bh(priv->dev);
 
         return ret;
 }
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 2d7c16346648..5f58c41ef787 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -1206,7 +1206,9 @@ struct ipoib_neigh *ipoib_neigh_get(struct net_device *dev, u8 *daddr)
                                 neigh = NULL;
                                 goto out_unlock;
                         }
-                        neigh->alive = jiffies;
+
+                        if (likely(skb_queue_len(&neigh->queue) < IPOIB_MAX_PATH_REC_QUEUE))
+                                neigh->alive = jiffies;
                         goto out_unlock;
                 }
         }
@@ -1851,7 +1853,7 @@ static void set_base_guid(struct ipoib_dev_priv *priv, union ib_gid *gid)
         struct ipoib_dev_priv *child_priv;
         struct net_device *netdev = priv->dev;
 
-        netif_addr_lock(netdev);
+        netif_addr_lock_bh(netdev);
 
         memcpy(&priv->local_gid.global.interface_id,
                &gid->global.interface_id,
@@ -1859,7 +1861,7 @@ static void set_base_guid(struct ipoib_dev_priv *priv, union ib_gid *gid)
         memcpy(netdev->dev_addr + 4, &priv->local_gid, sizeof(priv->local_gid));
         clear_bit(IPOIB_FLAG_DEV_ADDR_SET, &priv->flags);
 
-        netif_addr_unlock(netdev);
+        netif_addr_unlock_bh(netdev);
 
         if (!test_bit(IPOIB_FLAG_SUBINTERFACE, &priv->flags)) {
                 down_read(&priv->vlan_rwsem);
@@ -1875,7 +1877,7 @@ static int ipoib_check_lladdr(struct net_device *dev,
         union ib_gid *gid = (union ib_gid *)(ss->__data + 4);
         int ret = 0;
 
-        netif_addr_lock(dev);
+        netif_addr_lock_bh(dev);
 
         /* Make sure the QPN, reserved and subnet prefix match the current
          * lladdr, it also makes sure the lladdr is unicast.
@@ -1885,7 +1887,7 @@ static int ipoib_check_lladdr(struct net_device *dev,
             gid->global.interface_id == 0)
                 ret = -EINVAL;
 
-        netif_addr_unlock(dev);
+        netif_addr_unlock_bh(dev);
 
         return ret;
 }
@@ -2141,6 +2143,9 @@ static void ipoib_remove_one(struct ib_device *device, void *client_data)
                 ib_unregister_event_handler(&priv->event_handler);
                 flush_workqueue(ipoib_workqueue);
 
+                /* mark interface in the middle of destruction */
+                set_bit(IPOIB_FLAG_GOING_DOWN, &priv->flags);
+
                 rtnl_lock();
                 dev_change_flags(priv->dev, priv->dev->flags & ~IFF_UP);
                 rtnl_unlock();
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
index 82fbc9442608..d3394b6add24 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
@@ -582,13 +582,13 @@ void ipoib_mcast_join_task(struct work_struct *work)
                 return;
         }
         priv->local_lid = port_attr.lid;
-        netif_addr_lock(dev);
+        netif_addr_lock_bh(dev);
 
         if (!test_bit(IPOIB_FLAG_DEV_ADDR_SET, &priv->flags)) {
-                netif_addr_unlock(dev);
+                netif_addr_unlock_bh(dev);
                 return;
         }
-        netif_addr_unlock(dev);
+        netif_addr_unlock_bh(dev);
 
         spin_lock_irq(&priv->lock);
         if (!test_bit(IPOIB_FLAG_OPER_UP, &priv->flags))
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
index 64a35595eab8..a2f9f29c6ab5 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
@@ -131,6 +131,9 @@ int ipoib_vlan_add(struct net_device *pdev, unsigned short pkey)
 
         ppriv = netdev_priv(pdev);
 
+        if (test_bit(IPOIB_FLAG_GOING_DOWN, &ppriv->flags))
+                return -EPERM;
+
         snprintf(intf_name, sizeof intf_name, "%s.%04x",
                  ppriv->dev->name, pkey);
         priv = ipoib_intf_alloc(intf_name);
@@ -183,6 +186,9 @@ int ipoib_vlan_delete(struct net_device *pdev, unsigned short pkey)
 
         ppriv = netdev_priv(pdev);
 
+        if (test_bit(IPOIB_FLAG_GOING_DOWN, &ppriv->flags))
+                return -EPERM;
+
         if (!rtnl_trylock())
                 return restart_syscall();
 
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index 646de170ec12..3322ed750172 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -1457,7 +1457,6 @@ static int srp_map_sg_fr(struct srp_map_state *state, struct srp_rdma_ch *ch,
 {
         unsigned int sg_offset = 0;
 
-        state->desc = req->indirect_desc;
         state->fr.next = req->fr_list;
         state->fr.end = req->fr_list + ch->target->mr_per_cmd;
         state->sg = scat;
@@ -1489,7 +1488,6 @@ static int srp_map_sg_dma(struct srp_map_state *state, struct srp_rdma_ch *ch,
         struct scatterlist *sg;
         int i;
 
-        state->desc = req->indirect_desc;
         for_each_sg(scat, sg, count, i) {
                 srp_map_desc(state, ib_sg_dma_address(dev->dev, sg),
                              ib_sg_dma_len(dev->dev, sg),
@@ -1655,6 +1653,7 @@ static int srp_map_data(struct scsi_cmnd *scmnd, struct srp_rdma_ch *ch,
                                    target->indirect_size, DMA_TO_DEVICE);
 
         memset(&state, 0, sizeof(state));
+        state.desc = req->indirect_desc;
         if (dev->use_fast_reg)
                 ret = srp_map_sg_fr(&state, ch, req, scat, count);
         else if (dev->use_fmr)
@@ -3526,7 +3525,7 @@ static void srp_add_one(struct ib_device *device)
         int mr_page_shift, p;
         u64 max_pages_per_mr;
 
-        srp_dev = kmalloc(sizeof *srp_dev, GFP_KERNEL);
+        srp_dev = kzalloc(sizeof(*srp_dev), GFP_KERNEL);
         if (!srp_dev)
                 return;
 
@@ -3586,8 +3585,6 @@ static void srp_add_one(struct ib_device *device)
                                                    IB_ACCESS_REMOTE_WRITE);
                 if (IS_ERR(srp_dev->global_mr))
                         goto err_pd;
-        } else {
-                srp_dev->global_mr = NULL;
         }
 
         for (p = rdma_start_port(device); p <= rdma_end_port(device); ++p) {
diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
index e68b20cba70b..4a4155640d51 100644
--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
+++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
@@ -1638,8 +1638,7 @@ retry:
          */
         qp_init->cap.max_send_wr = srp_sq_size / 2;
         qp_init->cap.max_rdma_ctxs = srp_sq_size / 2;
-        qp_init->cap.max_send_sge = max(sdev->device->attrs.max_sge_rd,
-                                        sdev->device->attrs.max_sge);
+        qp_init->cap.max_send_sge = SRPT_DEF_SG_PER_WQE;
         qp_init->port_num = ch->sport->port;
 
         ch->qp = ib_create_qp(sdev->pd, qp_init);
diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.h b/drivers/infiniband/ulp/srpt/ib_srpt.h
index fee6bfd7ca21..389030487da7 100644
--- a/drivers/infiniband/ulp/srpt/ib_srpt.h
+++ b/drivers/infiniband/ulp/srpt/ib_srpt.h
@@ -106,6 +106,7 @@ enum {
         SRP_LOGIN_RSP_MULTICHAN_MAINTAINED = 0x2,
 
         SRPT_DEF_SG_TABLESIZE = 128,
+        SRPT_DEF_SG_PER_WQE = 16,
 
         MIN_SRPT_SQ_SIZE = 16,
         DEF_SRPT_SQ_SIZE = 4096,
diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
index 804dbcc37d3f..3438e98c145a 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -1031,17 +1031,17 @@ static int xpad_play_effect(struct input_dev *dev, void *data, struct ff_effect
 
         case XTYPE_XBOXONE:
                 packet->data[0] = 0x09; /* activate rumble */
-                packet->data[1] = 0x08;
+                packet->data[1] = 0x00;
                 packet->data[2] = xpad->odata_serial++;
-                packet->data[3] = 0x08; /* continuous effect */
-                packet->data[4] = 0x00; /* simple rumble mode */
-                packet->data[5] = 0x03; /* L and R actuator only */
-                packet->data[6] = 0x00; /* TODO: LT actuator */
-                packet->data[7] = 0x00; /* TODO: RT actuator */
+                packet->data[3] = 0x09;
+                packet->data[4] = 0x00;
+                packet->data[5] = 0x0F;
+                packet->data[6] = 0x00;
+                packet->data[7] = 0x00;
                 packet->data[8] = strong / 512; /* left actuator */
                 packet->data[9] = weak / 512;   /* right actuator */
-                packet->data[10] = 0x80;        /* length of pulse */
-                packet->data[11] = 0x00;        /* stop period of pulse */
+                packet->data[10] = 0xFF;
+                packet->data[11] = 0x00;
                 packet->data[12] = 0x00;
                 packet->len = 13;
                 packet->pending = true;
@@ -1437,16 +1437,6 @@ static int xpad_probe(struct usb_interface *intf, const struct usb_device_id *id
                         break;
         }
 
-        if (xpad_device[i].xtype == XTYPE_XBOXONE &&
-            intf->cur_altsetting->desc.bInterfaceNumber != 0) {
-                /*
-                 * The Xbox One controller lists three interfaces all with the
-                 * same interface class, subclass and protocol. Differentiate by
-                 * interface number.
-                 */
-                return -ENODEV;
-        }
-
         xpad = kzalloc(sizeof(struct usb_xpad), GFP_KERNEL);
         if (!xpad)
                 return -ENOMEM;
@@ -1478,6 +1468,8 @@ static int xpad_probe(struct usb_interface *intf, const struct usb_device_id *id
                 if (intf->cur_altsetting->desc.bInterfaceClass == USB_CLASS_VENDOR_SPEC) {
                         if (intf->cur_altsetting->desc.bInterfaceProtocol == 129)
                                 xpad->xtype = XTYPE_XBOX360W;
+                        else if (intf->cur_altsetting->desc.bInterfaceProtocol == 208)
+                                xpad->xtype = XTYPE_XBOXONE;
                         else
                                 xpad->xtype = XTYPE_XBOX360;
                 } else {
@@ -1492,6 +1484,17 @@ static int xpad_probe(struct usb_interface *intf, const struct usb_device_id *id
                         xpad->mapping |= MAP_STICKS_TO_NULL;
         }
 
+        if (xpad->xtype == XTYPE_XBOXONE &&
+            intf->cur_altsetting->desc.bInterfaceNumber != 0) {
+                /*
+                 * The Xbox One controller lists three interfaces all with the
+                 * same interface class, subclass and protocol. Differentiate by
+                 * interface number.
+                 */
+                error = -ENODEV;
+                goto err_free_in_urb;
+        }
+
         error = xpad_init_output(intf, xpad);
         if (error)
                 goto err_free_in_urb;
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index 78f93cf68840..be5b399da5d3 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -1568,13 +1568,7 @@ static int elantech_set_properties(struct elantech_data *etd)
                 case 5:
                         etd->hw_version = 3;
                         break;
-                case 6:
-                case 7:
-                case 8:
-                case 9:
-                case 10:
-                case 13:
-                case 14:
+                case 6 ... 14:
                         etd->hw_version = 4;
                         break;
                 default:
diff --git a/drivers/input/mouse/vmmouse.c b/drivers/input/mouse/vmmouse.c
index a3f0f5a47490..0f586780ceb4 100644
--- a/drivers/input/mouse/vmmouse.c
+++ b/drivers/input/mouse/vmmouse.c
@@ -355,18 +355,11 @@ int vmmouse_detect(struct psmouse *psmouse, bool set_properties)
                 return -ENXIO;
         }
 
-        if (!request_region(VMMOUSE_PROTO_PORT, 4, "vmmouse")) {
-                psmouse_dbg(psmouse, "VMMouse port in use.\n");
-                return -EBUSY;
-        }
-
         /* Check if the device is present */
         response = ~VMMOUSE_PROTO_MAGIC;
         VMMOUSE_CMD(GETVERSION, 0, version, response, dummy1, dummy2);
-        if (response != VMMOUSE_PROTO_MAGIC || version == 0xffffffffU) {
-                release_region(VMMOUSE_PROTO_PORT, 4);
+        if (response != VMMOUSE_PROTO_MAGIC || version == 0xffffffffU)
                 return -ENXIO;
-        }
 
         if (set_properties) {
                 psmouse->vendor = VMMOUSE_VENDOR;
@@ -374,8 +367,6 @@ int vmmouse_detect(struct psmouse *psmouse, bool set_properties)
                 psmouse->model = version;
         }
 
-        release_region(VMMOUSE_PROTO_PORT, 4);
-
         return 0;
 }
 
@@ -394,7 +385,6 @@ static void vmmouse_disconnect(struct psmouse *psmouse)
         psmouse_reset(psmouse);
         input_unregister_device(priv->abs_dev);
         kfree(priv);
-        release_region(VMMOUSE_PROTO_PORT, 4);
 }
 
 /**
@@ -438,15 +428,10 @@ int vmmouse_init(struct psmouse *psmouse)
         struct input_dev *rel_dev = psmouse->dev, *abs_dev;
         int error;
 
-        if (!request_region(VMMOUSE_PROTO_PORT, 4, "vmmouse")) {
-                psmouse_dbg(psmouse, "VMMouse port in use.\n");
-                return -EBUSY;
-        }
-
         psmouse_reset(psmouse);
         error = vmmouse_enable(psmouse);
         if (error)
-                goto release_region;
+                return error;
 
         priv = kzalloc(sizeof(*priv), GFP_KERNEL);
         abs_dev = input_allocate_device();
@@ -502,8 +487,5 @@ init_fail:
         kfree(priv);
         psmouse->private = NULL;
 
-release_region:
-        release_region(VMMOUSE_PROTO_PORT, 4);
-
         return error;
 }
diff --git a/drivers/input/touchscreen/wacom_w8001.c b/drivers/input/touchscreen/wacom_w8001.c
index bab3c6acf6a2..0c9191cf324d 100644
--- a/drivers/input/touchscreen/wacom_w8001.c
+++ b/drivers/input/touchscreen/wacom_w8001.c
@@ -27,7 +27,7 @@ MODULE_AUTHOR("Jaya Kumar <jayakumar.lkml@gmail.com>");
 MODULE_DESCRIPTION(DRIVER_DESC);
 MODULE_LICENSE("GPL");
 
-#define W8001_MAX_LENGTH        11
+#define W8001_MAX_LENGTH        13
 #define W8001_LEAD_MASK         0x80
 #define W8001_LEAD_BYTE         0x80
 #define W8001_TAB_MASK          0x40
@@ -339,6 +339,15 @@ static irqreturn_t w8001_interrupt(struct serio *serio,
                 w8001->idx = 0;
                 parse_multi_touch(w8001);
                 break;
+
+        default:
+                /*
+                 * ThinkPad X60 Tablet PC (pen only device) sometimes
+                 * sends invalid data packets that are larger than
+                 * W8001_PKTLEN_TPCPEN. Let's start over again.
+                 */
+                if (!w8001->touch_dev && w8001->idx > W8001_PKTLEN_TPCPEN - 1)
+                        w8001->idx = 0;
         }
 
         return IRQ_HANDLED;
diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
index 9e0034196e10..d091defc3426 100644
--- a/drivers/iommu/amd_iommu_init.c
+++ b/drivers/iommu/amd_iommu_init.c
@@ -1107,13 +1107,13 @@ static int __init init_iommu_from_acpi(struct amd_iommu *iommu,
                                 break;
                         }
 
+                        devid = e->devid;
                         DUMP_printk("  DEV_ACPI_HID(%s[%s])\t\tdevid: %02x:%02x.%x\n",
                                     hid, uid,
                                     PCI_BUS_NUM(devid),
                                     PCI_SLOT(devid),
                                     PCI_FUNC(devid));
 
-                        devid  = e->devid;
                         flags = e->flags;
 
                         ret = add_acpi_hid_device(hid, uid, &devid, false);
diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c
index 94b68213c50d..5f6b3bcab078 100644
--- a/drivers/iommu/arm-smmu-v3.c
+++ b/drivers/iommu/arm-smmu-v3.c
@@ -1941,6 +1941,7 @@ static struct iommu_ops arm_smmu_ops = {
         .attach_dev             = arm_smmu_attach_dev,
         .map                    = arm_smmu_map,
         .unmap                  = arm_smmu_unmap,
+        .map_sg                 = default_iommu_map_sg,
         .iova_to_phys           = arm_smmu_iova_to_phys,
         .add_device             = arm_smmu_add_device,
         .remove_device          = arm_smmu_remove_device,
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index a644d0cec2d8..cfe410eedaf0 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -3222,11 +3222,6 @@ static int __init init_dmars(void)
                         }
                 }
 
-                iommu_flush_write_buffer(iommu);
-                iommu_set_root_entry(iommu);
-                iommu->flush.flush_context(iommu, 0, 0, 0, DMA_CCMD_GLOBAL_INVL);
-                iommu->flush.flush_iotlb(iommu, 0, 0, 0, DMA_TLB_GLOBAL_FLUSH);
-
                 if (!ecap_pass_through(iommu->ecap))
                         hw_pass_through = 0;
 #ifdef CONFIG_INTEL_IOMMU_SVM
@@ -3235,6 +3230,18 @@ static int __init init_dmars(void)
 #endif
         }
 
+        /*
+         * Now that qi is enabled on all iommus, set the root entry and flush
+         * caches. This is required on some Intel X58 chipsets, otherwise the
+         * flush_context function will loop forever and the boot hangs.
+         */
+        for_each_active_iommu(iommu, drhd) {
+                iommu_flush_write_buffer(iommu);
+                iommu_set_root_entry(iommu);
+                iommu->flush.flush_context(iommu, 0, 0, 0, DMA_CCMD_GLOBAL_INVL);
+                iommu->flush.flush_iotlb(iommu, 0, 0, 0, DMA_TLB_GLOBAL_FLUSH);
+        }
+
         if (iommu_pass_through)
                 iommu_identity_mapping |= IDENTMAP_ALL;
 
@@ -4600,7 +4607,7 @@ static void free_all_cpu_cached_iovas(unsigned int cpu)
                 if (!iommu)
                         continue;
 
-                for (did = 0; did < 0xffff; did++) {
+                for (did = 0; did < cap_ndoms(iommu->cap); did++) {
                         domain = get_iommu_domain(iommu, did);
 
                         if (!domain)
diff --git a/drivers/iommu/iova.c b/drivers/iommu/iova.c
index ba764a0835d3..e23001bfcfee 100644
--- a/drivers/iommu/iova.c
+++ b/drivers/iommu/iova.c
@@ -420,8 +420,10 @@ retry:
 
                 /* Try replenishing IOVAs by flushing rcache. */
                 flushed_rcache = true;
+                preempt_disable();
                 for_each_online_cpu(cpu)
                         free_cpu_cached_iovas(cpu, iovad);
+                preempt_enable();
                 goto retry;
         }
 
@@ -749,7 +751,7 @@ static bool __iova_rcache_insert(struct iova_domain *iovad,
         bool can_insert = false;
         unsigned long flags;
 
-        cpu_rcache = this_cpu_ptr(rcache->cpu_rcaches);
+        cpu_rcache = get_cpu_ptr(rcache->cpu_rcaches);
         spin_lock_irqsave(&cpu_rcache->lock, flags);
 
         if (!iova_magazine_full(cpu_rcache->loaded)) {
@@ -779,6 +781,7 @@ static bool __iova_rcache_insert(struct iova_domain *iovad,
                 iova_magazine_push(cpu_rcache->loaded, iova_pfn);
 
         spin_unlock_irqrestore(&cpu_rcache->lock, flags);
+        put_cpu_ptr(rcache->cpu_rcaches);
 
         if (mag_to_free) {
                 iova_magazine_free_pfns(mag_to_free, iovad);
@@ -812,7 +815,7 @@ static unsigned long __iova_rcache_get(struct iova_rcache *rcache,
         bool has_pfn = false;
         unsigned long flags;
 
-        cpu_rcache = this_cpu_ptr(rcache->cpu_rcaches);
+        cpu_rcache = get_cpu_ptr(rcache->cpu_rcaches);
         spin_lock_irqsave(&cpu_rcache->lock, flags);
 
         if (!iova_magazine_empty(cpu_rcache->loaded)) {
@@ -834,6 +837,7 @@ static unsigned long __iova_rcache_get(struct iova_rcache *rcache,
                 iova_pfn = iova_magazine_pop(cpu_rcache->loaded, limit_pfn);
 
         spin_unlock_irqrestore(&cpu_rcache->lock, flags);
+        put_cpu_ptr(rcache->cpu_rcaches);
 
         return iova_pfn;
 }
diff --git a/drivers/iommu/rockchip-iommu.c b/drivers/iommu/rockchip-iommu.c
index c7d6156ff536..25b4627cb57f 100644
--- a/drivers/iommu/rockchip-iommu.c
+++ b/drivers/iommu/rockchip-iommu.c
@@ -815,7 +815,7 @@ static int rk_iommu_attach_device(struct iommu_domain *domain,
         dte_addr = virt_to_phys(rk_domain->dt);
         for (i = 0; i < iommu->num_mmu; i++) {
                 rk_iommu_write(iommu->bases[i], RK_MMU_DTE_ADDR, dte_addr);
-                rk_iommu_command(iommu->bases[i], RK_MMU_CMD_ZAP_CACHE);
+                rk_iommu_base_command(iommu->bases[i], RK_MMU_CMD_ZAP_CACHE);
                 rk_iommu_write(iommu->bases[i], RK_MMU_INT_MASK, RK_MMU_IRQ_MASK);
         }
 
diff --git a/drivers/irqchip/irq-mips-gic.c b/drivers/irqchip/irq-mips-gic.c
index 3b5e10aa48ab..8a4adbeb2b8c 100644
--- a/drivers/irqchip/irq-mips-gic.c
+++ b/drivers/irqchip/irq-mips-gic.c
@@ -746,6 +746,12 @@ static int gic_irq_domain_alloc(struct irq_domain *d, unsigned int virq,
                 /* verify that it doesn't conflict with an IPI irq */
                 if (test_bit(spec->hwirq, ipi_resrv))
                         return -EBUSY;
+
+                hwirq = GIC_SHARED_TO_HWIRQ(spec->hwirq);
+
+                return irq_domain_set_hwirq_and_chip(d, virq, hwirq,
+                                                     &gic_level_irq_controller,
+                                                     NULL);
         } else {
                 base_hwirq = find_first_bit(ipi_resrv, gic_shared_intrs);
                 if (base_hwirq == gic_shared_intrs) {
@@ -867,10 +873,14 @@ static int gic_dev_domain_alloc(struct irq_domain *d, unsigned int virq,
                                                     &gic_level_irq_controller,
                                                     NULL);
                 if (ret)
-                        return ret;
+                        goto error;
         }
 
         return 0;
+
+error:
+        irq_domain_free_irqs_parent(d, virq, nr_irqs);
+        return ret;
 }
 
 void gic_dev_domain_free(struct irq_domain *d, unsigned int virq,
diff --git a/drivers/leds/led-core.c b/drivers/leds/led-core.c
index 3495d5d6547f..3bce44893021 100644
--- a/drivers/leds/led-core.c
+++ b/drivers/leds/led-core.c
@@ -53,11 +53,12 @@ static void led_timer_function(unsigned long data)
 
         if (!led_cdev->blink_delay_on || !led_cdev->blink_delay_off) {
                 led_set_brightness_nosleep(led_cdev, LED_OFF);
+                led_cdev->flags &= ~LED_BLINK_SW;
                 return;
         }
 
         if (led_cdev->flags & LED_BLINK_ONESHOT_STOP) {
-                led_cdev->flags &= ~LED_BLINK_ONESHOT_STOP;
+                led_cdev->flags &=  ~(LED_BLINK_ONESHOT_STOP | LED_BLINK_SW);
                 return;
         }
 
@@ -151,6 +152,7 @@ static void led_set_software_blink(struct led_classdev *led_cdev,
                 return;
         }
 
+        led_cdev->flags |= LED_BLINK_SW;
         mod_timer(&led_cdev->blink_timer, jiffies + 1);
 }
 
@@ -219,6 +221,7 @@ void led_stop_software_blink(struct led_classdev *led_cdev)
         del_timer_sync(&led_cdev->blink_timer);
         led_cdev->blink_delay_on = 0;
         led_cdev->blink_delay_off = 0;
+        led_cdev->flags &= ~LED_BLINK_SW;
 }
 EXPORT_SYMBOL_GPL(led_stop_software_blink);
 
@@ -226,10 +229,10 @@ void led_set_brightness(struct led_classdev *led_cdev,
                         enum led_brightness brightness)
 {
         /*
-         * In case blinking is on delay brightness setting
+         * If software blink is active, delay brightness setting
          * until the next timer tick.
          */
-        if (led_cdev->blink_delay_on || led_cdev->blink_delay_off) {
+        if (led_cdev->flags & LED_BLINK_SW) {
                 /*
                  * If we need to disable soft blinking delegate this to the
                  * work queue task to avoid problems in case we are called
diff --git a/drivers/leds/trigger/ledtrig-heartbeat.c b/drivers/leds/trigger/ledtrig-heartbeat.c
index 410c39c62dc7..c9f386213e9e 100644
--- a/drivers/leds/trigger/ledtrig-heartbeat.c
+++ b/drivers/leds/trigger/ledtrig-heartbeat.c
@@ -19,6 +19,7 @@
 #include <linux/sched.h>
 #include <linux/leds.h>
 #include <linux/reboot.h>
+#include <linux/suspend.h>
 #include "../leds.h"
 
 static int panic_heartbeats;
@@ -154,6 +155,30 @@ static struct led_trigger heartbeat_led_trigger = {
         .deactivate = heartbeat_trig_deactivate,
 };
 
+static int heartbeat_pm_notifier(struct notifier_block *nb,
+                                 unsigned long pm_event, void *unused)
+{
+        int rc;
+
+        switch (pm_event) {
+        case PM_SUSPEND_PREPARE:
+        case PM_HIBERNATION_PREPARE:
+        case PM_RESTORE_PREPARE:
+                led_trigger_unregister(&heartbeat_led_trigger);
+                break;
+        case PM_POST_SUSPEND:
+        case PM_POST_HIBERNATION:
+        case PM_POST_RESTORE:
+                rc = led_trigger_register(&heartbeat_led_trigger);
+                if (rc)
+                        pr_err("could not re-register heartbeat trigger\n");
+                break;
+        default:
+                break;
+        }
+        return NOTIFY_DONE;
+}
+
 static int heartbeat_reboot_notifier(struct notifier_block *nb,
                                      unsigned long code, void *unused)
 {
@@ -168,6 +193,10 @@ static int heartbeat_panic_notifier(struct notifier_block *nb,
         return NOTIFY_DONE;
 }
 
+static struct notifier_block heartbeat_pm_nb = {
+        .notifier_call = heartbeat_pm_notifier,
+};
+
 static struct notifier_block heartbeat_reboot_nb = {
         .notifier_call = heartbeat_reboot_notifier,
 };
@@ -184,12 +213,14 @@ static int __init heartbeat_trig_init(void)
                 atomic_notifier_chain_register(&panic_notifier_list,
                                                &heartbeat_panic_nb);
                 register_reboot_notifier(&heartbeat_reboot_nb);
+                register_pm_notifier(&heartbeat_pm_nb);
         }
         return rc;
 }
 
 static void __exit heartbeat_trig_exit(void)
 {
+        unregister_pm_notifier(&heartbeat_pm_nb);
         unregister_reboot_notifier(&heartbeat_reboot_nb);
         atomic_notifier_chain_unregister(&panic_notifier_list,
                                          &heartbeat_panic_nb);
diff --git a/drivers/mcb/mcb-core.c b/drivers/mcb/mcb-core.c
index b73c6e7d28e4..6f2c8522e14a 100644
--- a/drivers/mcb/mcb-core.c
+++ b/drivers/mcb/mcb-core.c
@@ -61,21 +61,36 @@ static int mcb_probe(struct device *dev)
         struct mcb_driver *mdrv = to_mcb_driver(dev->driver);
         struct mcb_device *mdev = to_mcb_device(dev);
         const struct mcb_device_id *found_id;
+        struct module *carrier_mod;
+        int ret;
 
         found_id = mcb_match_id(mdrv->id_table, mdev);
         if (!found_id)
                 return -ENODEV;
 
-        return mdrv->probe(mdev, found_id);
+        carrier_mod = mdev->dev.parent->driver->owner;
+        if (!try_module_get(carrier_mod))
+                return -EINVAL;
+
+        get_device(dev);
+        ret = mdrv->probe(mdev, found_id);
+        if (ret)
+                module_put(carrier_mod);
+
+        return ret;
 }
 
 static int mcb_remove(struct device *dev)
 {
         struct mcb_driver *mdrv = to_mcb_driver(dev->driver);
         struct mcb_device *mdev = to_mcb_device(dev);
+        struct module *carrier_mod;
 
         mdrv->remove(mdev);
 
+        carrier_mod = mdev->dev.parent->driver->owner;
+        module_put(carrier_mod);
+
         put_device(&mdev->dev);
 
         return 0;
diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c
index d7723ce772b3..c04bc6afb965 100644
--- a/drivers/media/usb/uvc/uvc_v4l2.c
+++ b/drivers/media/usb/uvc/uvc_v4l2.c
@@ -1274,8 +1274,6 @@ struct uvc_xu_control_mapping32 {
 static int uvc_v4l2_get_xu_mapping(struct uvc_xu_control_mapping *kp,
                         const struct uvc_xu_control_mapping32 __user *up)
 {
-        struct uvc_menu_info __user *umenus;
-        struct uvc_menu_info __user *kmenus;
         compat_caddr_t p;
 
         if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||
@@ -1292,17 +1290,7 @@ static int uvc_v4l2_get_xu_mapping(struct uvc_xu_control_mapping *kp,
 
         if (__get_user(p, &up->menu_info))
                 return -EFAULT;
-        umenus = compat_ptr(p);
-        if (!access_ok(VERIFY_READ, umenus, kp->menu_count * sizeof(*umenus)))
-                return -EFAULT;
-
-        kmenus = compat_alloc_user_space(kp->menu_count * sizeof(*kmenus));
-        if (kmenus == NULL)
-                return -EFAULT;
-        kp->menu_info = kmenus;
-
-        if (copy_in_user(kmenus, umenus, kp->menu_count * sizeof(*umenus)))
-                return -EFAULT;
+        kp->menu_info = compat_ptr(p);
 
         return 0;
 }
@@ -1310,10 +1298,6 @@ static int uvc_v4l2_get_xu_mapping(struct uvc_xu_control_mapping *kp,
 static int uvc_v4l2_put_xu_mapping(const struct uvc_xu_control_mapping *kp,
                         struct uvc_xu_control_mapping32 __user *up)
 {
-        struct uvc_menu_info __user *umenus;
-        struct uvc_menu_info __user *kmenus = kp->menu_info;
-        compat_caddr_t p;
-
         if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) ||
             __copy_to_user(up, kp, offsetof(typeof(*up), menu_info)) ||
             __put_user(kp->menu_count, &up->menu_count))
@@ -1322,16 +1306,6 @@ static int uvc_v4l2_put_xu_mapping(const struct uvc_xu_control_mapping *kp,
         if (__clear_user(up->reserved, sizeof(up->reserved)))
                 return -EFAULT;
 
-        if (kp->menu_count == 0)
-                return 0;
-
-        if (get_user(p, &up->menu_info))
-                return -EFAULT;
-        umenus = compat_ptr(p);
-
-        if (copy_in_user(umenus, kmenus, kp->menu_count * sizeof(*umenus)))
-                return -EFAULT;
-
         return 0;
 }
 
@@ -1346,8 +1320,6 @@ struct uvc_xu_control_query32 {
 static int uvc_v4l2_get_xu_query(struct uvc_xu_control_query *kp,
                         const struct uvc_xu_control_query32 __user *up)
 {
-        u8 __user *udata;
-        u8 __user *kdata;
         compat_caddr_t p;
 
         if (!access_ok(VERIFY_READ, up, sizeof(*up)) ||
@@ -1361,17 +1333,7 @@ static int uvc_v4l2_get_xu_query(struct uvc_xu_control_query *kp,
 
         if (__get_user(p, &up->data))
                 return -EFAULT;
-        udata = compat_ptr(p);
-        if (!access_ok(VERIFY_READ, udata, kp->size))
-                return -EFAULT;
-
-        kdata = compat_alloc_user_space(kp->size);
-        if (kdata == NULL)
-                return -EFAULT;
-        kp->data = kdata;
-
-        if (copy_in_user(kdata, udata, kp->size))
-                return -EFAULT;
+        kp->data = compat_ptr(p);
 
         return 0;
 }
@@ -1379,26 +1341,10 @@ static int uvc_v4l2_get_xu_query(struct uvc_xu_control_query *kp,
 static int uvc_v4l2_put_xu_query(const struct uvc_xu_control_query *kp,
                         struct uvc_xu_control_query32 __user *up)
 {
-        u8 __user *udata;
-        u8 __user *kdata = kp->data;
-        compat_caddr_t p;
-
         if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) ||
             __copy_to_user(up, kp, offsetof(typeof(*up), data)))
                 return -EFAULT;
 
-        if (kp->size == 0)
-                return 0;
-
-        if (get_user(p, &up->data))
-                return -EFAULT;
-        udata = compat_ptr(p);
-        if (!access_ok(VERIFY_READ, udata, kp->size))
-                return -EFAULT;
-
-        if (copy_in_user(udata, kdata, kp->size))
-                return -EFAULT;
-
         return 0;
 }
 
@@ -1408,47 +1354,44 @@ static int uvc_v4l2_put_xu_query(const struct uvc_xu_control_query *kp,
 static long uvc_v4l2_compat_ioctl32(struct file *file,
                      unsigned int cmd, unsigned long arg)
 {
+        struct uvc_fh *handle = file->private_data;
         union {
                 struct uvc_xu_control_mapping xmap;
                 struct uvc_xu_control_query xqry;
         } karg;
         void __user *up = compat_ptr(arg);
-        mm_segment_t old_fs;
         long ret;
 
         switch (cmd) {
         case UVCIOC_CTRL_MAP32:
-                cmd = UVCIOC_CTRL_MAP;
                 ret = uvc_v4l2_get_xu_mapping(&karg.xmap, up);
+                if (ret)
+                        return ret;
+                ret = uvc_ioctl_ctrl_map(handle->chain, &karg.xmap);
+                if (ret)
+                        return ret;
+                ret = uvc_v4l2_put_xu_mapping(&karg.xmap, up);
+                if (ret)
+                        return ret;
+
                 break;
 
         case UVCIOC_CTRL_QUERY32:
-                cmd = UVCIOC_CTRL_QUERY;
                 ret = uvc_v4l2_get_xu_query(&karg.xqry, up);
+                if (ret)
+                        return ret;
+                ret = uvc_xu_ctrl_query(handle->chain, &karg.xqry);
+                if (ret)
+                        return ret;
+                ret = uvc_v4l2_put_xu_query(&karg.xqry, up);
+                if (ret)
+                        return ret;
                 break;
 
         default:
                 return -ENOIOCTLCMD;
         }
 
-        old_fs = get_fs();
-        set_fs(KERNEL_DS);
-        ret = video_ioctl2(file, cmd, (unsigned long)&karg);
-        set_fs(old_fs);
-
-        if (ret < 0)
-                return ret;
-
-        switch (cmd) {
-        case UVCIOC_CTRL_MAP:
-                ret = uvc_v4l2_put_xu_mapping(&karg.xmap, up);
-                break;
-
-        case UVCIOC_CTRL_QUERY:
-                ret = uvc_v4l2_put_xu_query(&karg.xqry, up);
-                break;
-        }
-
         return ret;
 }
 #endif
diff --git a/drivers/media/v4l2-core/v4l2-mc.c b/drivers/media/v4l2-core/v4l2-mc.c
index ca94bded3386..8bef4331bd51 100644
--- a/drivers/media/v4l2-core/v4l2-mc.c
+++ b/drivers/media/v4l2-core/v4l2-mc.c
@@ -1,7 +1,7 @@
 /*
  * Media Controller ancillary functions
  *
- * Copyright (c) 2016 Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+ * Copyright (c) 2016 Mauro Carvalho Chehab <mchehab@kernel.org>
  * Copyright (C) 2016 Shuah Khan <shuahkh@osg.samsung.com>
  * Copyright (C) 2006-2010 Nokia Corporation
  * Copyright (c) 2016 Intel Corporation.
diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c
index af4884ba6b7c..15508df24e5d 100644
--- a/drivers/memory/omap-gpmc.c
+++ b/drivers/memory/omap-gpmc.c
@@ -398,7 +398,7 @@ static void gpmc_cs_bool_timings(int cs, const struct gpmc_bool_timings *p)
         gpmc_cs_modify_reg(cs, GPMC_CS_CONFIG4,
                            GPMC_CONFIG4_OEEXTRADELAY, p->oe_extra_delay);
         gpmc_cs_modify_reg(cs, GPMC_CS_CONFIG4,
-                           GPMC_CONFIG4_OEEXTRADELAY, p->we_extra_delay);
+                           GPMC_CONFIG4_WEEXTRADELAY, p->we_extra_delay);
         gpmc_cs_modify_reg(cs, GPMC_CS_CONFIG6,
                            GPMC_CONFIG6_CYCLE2CYCLESAMECSEN,
                            p->cycle2cyclesamecsen);
diff --git a/drivers/mfd/max77620.c b/drivers/mfd/max77620.c
index 199d261990be..f32fbb8e8129 100644
--- a/drivers/mfd/max77620.c
+++ b/drivers/mfd/max77620.c
@@ -203,6 +203,7 @@ static int max77620_get_fps_period_reg_value(struct max77620_chip *chip,
                 break;
         case MAX77620:
                 fps_min_period = MAX77620_FPS_PERIOD_MIN_US;
+                break;
         default:
                 return -EINVAL;
         }
@@ -236,6 +237,7 @@ static int max77620_config_fps(struct max77620_chip *chip,
                 break;
         case MAX77620:
                 fps_max_period = MAX77620_FPS_PERIOD_MAX_US;
+                break;
         default:
                 return -EINVAL;
         }
diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c
index eed254da63a8..641c1a566687 100644
--- a/drivers/misc/mei/client.c
+++ b/drivers/misc/mei/client.c
@@ -730,7 +730,7 @@ static void mei_cl_wake_all(struct mei_cl *cl)
         /* synchronized under device mutex */
         if (waitqueue_active(&cl->wait)) {
                 cl_dbg(dev, cl, "Waking up ctrl write clients!\n");
-                wake_up_interruptible(&cl->wait);
+                wake_up(&cl->wait);
         }
 }
 
diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
index 16baeb51b2bd..ef3618299494 100644
--- a/drivers/mtd/ubi/build.c
+++ b/drivers/mtd/ubi/build.c
@@ -1147,11 +1147,17 @@ int ubi_detach_mtd_dev(int ubi_num, int anyway)
  */
 static struct mtd_info * __init open_mtd_by_chdev(const char *mtd_dev)
 {
-        struct kstat stat;
         int err, minor;
+        struct path path;
+        struct kstat stat;
 
         /* Probably this is an MTD character device node path */
-        err = vfs_stat(mtd_dev, &stat);
+        err = kern_path(mtd_dev, LOOKUP_FOLLOW, &path);
+        if (err)
+                return ERR_PTR(err);
+
+        err = vfs_getattr(&path, &stat);
+        path_put(&path);
         if (err)
                 return ERR_PTR(err);
 
@@ -1160,6 +1166,7 @@ static struct mtd_info * __init open_mtd_by_chdev(const char *mtd_dev)
                 return ERR_PTR(-EINVAL);
 
         minor = MINOR(stat.rdev);
+
         if (minor & 1)
                 /*
                  * Just do not think the "/dev/mtdrX" devices support is need,
diff --git a/drivers/mtd/ubi/eba.c b/drivers/mtd/ubi/eba.c
index 5780dd1ba79d..ebf517271d29 100644
--- a/drivers/mtd/ubi/eba.c
+++ b/drivers/mtd/ubi/eba.c
@@ -575,6 +575,7 @@ static int recover_peb(struct ubi_device *ubi, int pnum, int vol_id, int lnum,
         int err, idx = vol_id2idx(ubi, vol_id), new_pnum, data_size, tries = 0;
         struct ubi_volume *vol = ubi->volumes[idx];
         struct ubi_vid_hdr *vid_hdr;
+        uint32_t crc;
 
         vid_hdr = ubi_zalloc_vid_hdr(ubi, GFP_NOFS);
         if (!vid_hdr)
@@ -599,14 +600,8 @@ retry:
                 goto out_put;
         }
 
-        vid_hdr->sqnum = cpu_to_be64(ubi_next_sqnum(ubi));
-        err = ubi_io_write_vid_hdr(ubi, new_pnum, vid_hdr);
-        if (err) {
-                up_read(&ubi->fm_eba_sem);
-                goto write_error;
-        }
+        ubi_assert(vid_hdr->vol_type == UBI_VID_DYNAMIC);
 
-        data_size = offset + len;
         mutex_lock(&ubi->buf_mutex);
         memset(ubi->peb_buf + offset, 0xFF, len);
 
@@ -621,6 +616,19 @@ retry:
 
         memcpy(ubi->peb_buf + offset, buf, len);
 
+        data_size = offset + len;
+        crc = crc32(UBI_CRC32_INIT, ubi->peb_buf, data_size);
+        vid_hdr->sqnum = cpu_to_be64(ubi_next_sqnum(ubi));
+        vid_hdr->copy_flag = 1;
+        vid_hdr->data_size = cpu_to_be32(data_size);
+        vid_hdr->data_crc = cpu_to_be32(crc);
+        err = ubi_io_write_vid_hdr(ubi, new_pnum, vid_hdr);
+        if (err) {
+                mutex_unlock(&ubi->buf_mutex);
+                up_read(&ubi->fm_eba_sem);
+                goto write_error;
+        }
+
         err = ubi_io_write_data(ubi, ubi->peb_buf, new_pnum, 0, data_size);
         if (err) {
                 mutex_unlock(&ubi->buf_mutex);
diff --git a/drivers/mtd/ubi/kapi.c b/drivers/mtd/ubi/kapi.c
index 348dbbcbedc8..a9e2cef7c95c 100644
--- a/drivers/mtd/ubi/kapi.c
+++ b/drivers/mtd/ubi/kapi.c
@@ -302,6 +302,7 @@ EXPORT_SYMBOL_GPL(ubi_open_volume_nm);
 struct ubi_volume_desc *ubi_open_volume_path(const char *pathname, int mode)
 {
         int error, ubi_num, vol_id;
+        struct path path;
         struct kstat stat;
 
         dbg_gen("open volume %s, mode %d", pathname, mode);
@@ -309,7 +310,12 @@ struct ubi_volume_desc *ubi_open_volume_path(const char *pathname, int mode)
         if (!pathname || !*pathname)
                 return ERR_PTR(-EINVAL);
 
-        error = vfs_stat(pathname, &stat);
+        error = kern_path(pathname, LOOKUP_FOLLOW, &path);
+        if (error)
+                return ERR_PTR(error);
+
+        error = vfs_getattr(&path, &stat);
+        path_put(&path);
         if (error)
                 return ERR_PTR(error);
 
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index b9304a295f86..ca81f46ea1aa 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -657,6 +657,20 @@ static void __set_agg_ports_ready(struct aggregator *aggregator, int val)
         }
 }
 
+static int __agg_active_ports(struct aggregator *agg)
+{
+        struct port *port;
+        int active = 0;
+
+        for (port = agg->lag_ports; port;
+             port = port->next_port_in_aggregator) {
+                if (port->is_enabled)
+                        active++;
+        }
+
+        return active;
+}
+
 /**
  * __get_agg_bandwidth - get the total bandwidth of an aggregator
  * @aggregator: the aggregator we're looking at
@@ -664,39 +678,40 @@ static void __set_agg_ports_ready(struct aggregator *aggregator, int val)
  */
 static u32 __get_agg_bandwidth(struct aggregator *aggregator)
 {
+        int nports = __agg_active_ports(aggregator);
         u32 bandwidth = 0;
 
-        if (aggregator->num_of_ports) {
+        if (nports) {
                 switch (__get_link_speed(aggregator->lag_ports)) {
                 case AD_LINK_SPEED_1MBPS:
-                        bandwidth = aggregator->num_of_ports;
+                        bandwidth = nports;
                         break;
                 case AD_LINK_SPEED_10MBPS:
-                        bandwidth = aggregator->num_of_ports * 10;
+                        bandwidth = nports * 10;
                         break;
                 case AD_LINK_SPEED_100MBPS:
-                        bandwidth = aggregator->num_of_ports * 100;
+                        bandwidth = nports * 100;
                         break;
                 case AD_LINK_SPEED_1000MBPS:
-                        bandwidth = aggregator->num_of_ports * 1000;
+                        bandwidth = nports * 1000;
                         break;
                 case AD_LINK_SPEED_2500MBPS:
-                        bandwidth = aggregator->num_of_ports * 2500;
+                        bandwidth = nports * 2500;
                         break;
                 case AD_LINK_SPEED_10000MBPS:
-                        bandwidth = aggregator->num_of_ports * 10000;
+                        bandwidth = nports * 10000;
                         break;
                 case AD_LINK_SPEED_20000MBPS:
-                        bandwidth = aggregator->num_of_ports * 20000;
+                        bandwidth = nports * 20000;
                         break;
                 case AD_LINK_SPEED_40000MBPS:
-                        bandwidth = aggregator->num_of_ports * 40000;
+                        bandwidth = nports * 40000;
                         break;
                 case AD_LINK_SPEED_56000MBPS:
-                        bandwidth = aggregator->num_of_ports * 56000;
+                        bandwidth = nports * 56000;
                         break;
                 case AD_LINK_SPEED_100000MBPS:
-                        bandwidth = aggregator->num_of_ports * 100000;
+                        bandwidth = nports * 100000;
                         break;
                 default:
                         bandwidth = 0; /* to silence the compiler */
@@ -1530,10 +1545,10 @@ static struct aggregator *ad_agg_selection_test(struct aggregator *best,
 
         switch (__get_agg_selection_mode(curr->lag_ports)) {
         case BOND_AD_COUNT:
-                if (curr->num_of_ports > best->num_of_ports)
+                if (__agg_active_ports(curr) > __agg_active_ports(best))
                         return curr;
 
-                if (curr->num_of_ports < best->num_of_ports)
+                if (__agg_active_ports(curr) < __agg_active_ports(best))
                         return best;
 
                 /*FALLTHROUGH*/
@@ -1561,8 +1576,14 @@ static int agg_device_up(const struct aggregator *agg)
         if (!port)
                 return 0;
 
-        return netif_running(port->slave->dev) &&
-               netif_carrier_ok(port->slave->dev);
+        for (port = agg->lag_ports; port;
+             port = port->next_port_in_aggregator) {
+                if (netif_running(port->slave->dev) &&
+                    netif_carrier_ok(port->slave->dev))
+                        return 1;
+        }
+
+        return 0;
 }
 
 /**
@@ -1610,7 +1631,7 @@ static void ad_agg_selection_logic(struct aggregator *agg,
 
                 agg->is_active = 0;
 
-                if (agg->num_of_ports && agg_device_up(agg))
+                if (__agg_active_ports(agg) && agg_device_up(agg))
                         best = ad_agg_selection_test(best, agg);
         }
 
@@ -1622,7 +1643,7 @@ static void ad_agg_selection_logic(struct aggregator *agg,
                  * answering partner.
                  */
                 if (active && active->lag_ports &&
-                    active->lag_ports->is_enabled &&
+                    __agg_active_ports(active) &&
                     (__agg_has_partner(active) ||
                      (!__agg_has_partner(active) &&
                      !__agg_has_partner(best)))) {
@@ -2133,7 +2154,7 @@ void bond_3ad_unbind_slave(struct slave *slave)
                                 else
                                         temp_aggregator->lag_ports = temp_port->next_port_in_aggregator;
                                 temp_aggregator->num_of_ports--;
-                                if (temp_aggregator->num_of_ports == 0) {
+                                if (__agg_active_ports(temp_aggregator) == 0) {
                                         select_new_active_agg = temp_aggregator->is_active;
                                         ad_clear_agg(temp_aggregator);
                                         if (select_new_active_agg) {
@@ -2432,7 +2453,9 @@ void bond_3ad_adapter_speed_duplex_changed(struct slave *slave)
  */
 void bond_3ad_handle_link_change(struct slave *slave, char link)
 {
+        struct aggregator *agg;
         struct port *port;
+        bool dummy;
 
         port = &(SLAVE_AD_INFO(slave)->port);
 
@@ -2459,6 +2482,9 @@ void bond_3ad_handle_link_change(struct slave *slave, char link)
                 port->is_enabled = false;
                 ad_update_actor_keys(port, true);
         }
+        agg = __get_first_agg(port);
+        ad_agg_selection_logic(agg, &dummy);
+
         netdev_dbg(slave->bond->dev, "Port %d changed link status to %s\n",
                    port->actor_port_number,
                    link == BOND_LINK_UP ? "UP" : "DOWN");
@@ -2499,7 +2525,7 @@ int bond_3ad_set_carrier(struct bonding *bond)
         active = __get_active_agg(&(SLAVE_AD_INFO(first_slave)->aggregator));
         if (active) {
                 /* are enough slaves available to consider link up? */
-                if (active->num_of_ports < bond->params.min_links) {
+                if (__agg_active_ports(active) < bond->params.min_links) {
                         if (netif_carrier_ok(bond->dev)) {
                                 netif_carrier_off(bond->dev);
                                 goto out;
diff --git a/drivers/net/can/at91_can.c b/drivers/net/can/at91_can.c
index 8b3275d7792a..8f5e93cb7975 100644
--- a/drivers/net/can/at91_can.c
+++ b/drivers/net/can/at91_can.c
@@ -712,9 +712,10 @@ static int at91_poll_rx(struct net_device *dev, int quota)
 
         /* upper group completed, look again in lower */
         if (priv->rx_next > get_mb_rx_low_last(priv) &&
-            quota > 0 && mb > get_mb_rx_last(priv)) {
+            mb > get_mb_rx_last(priv)) {
                 priv->rx_next = get_mb_rx_first(priv);
-                goto again;
+                if (quota > 0)
+                        goto again;
         }
 
         return received;
diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
index f91b094288da..e3dccd3200d5 100644
--- a/drivers/net/can/c_can/c_can.c
+++ b/drivers/net/can/c_can/c_can.c
@@ -332,9 +332,23 @@ static void c_can_setup_tx_object(struct net_device *dev, int iface,
 
         priv->write_reg(priv, C_CAN_IFACE(MSGCTRL_REG, iface), ctrl);
 
-        for (i = 0; i < frame->can_dlc; i += 2) {
-                priv->write_reg(priv, C_CAN_IFACE(DATA1_REG, iface) + i / 2,
-                                frame->data[i] | (frame->data[i + 1] << 8));
+        if (priv->type == BOSCH_D_CAN) {
+                u32 data = 0, dreg = C_CAN_IFACE(DATA1_REG, iface);
+
+                for (i = 0; i < frame->can_dlc; i += 4, dreg += 2) {
+                        data = (u32)frame->data[i];
+                        data |= (u32)frame->data[i + 1] << 8;
+                        data |= (u32)frame->data[i + 2] << 16;
+                        data |= (u32)frame->data[i + 3] << 24;
+                        priv->write_reg32(priv, dreg, data);
+                }
+        } else {
+                for (i = 0; i < frame->can_dlc; i += 2) {
+                        priv->write_reg(priv,
+                                        C_CAN_IFACE(DATA1_REG, iface) + i / 2,
+                                        frame->data[i] |
+                                        (frame->data[i + 1] << 8));
+                }
         }
 }
 
@@ -402,10 +416,20 @@ static int c_can_read_msg_object(struct net_device *dev, int iface, u32 ctrl)
         } else {
                 int i, dreg = C_CAN_IFACE(DATA1_REG, iface);
 
-                for (i = 0; i < frame->can_dlc; i += 2, dreg ++) {
-                        data = priv->read_reg(priv, dreg);
-                        frame->data[i] = data;
-                        frame->data[i + 1] = data >> 8;
+                if (priv->type == BOSCH_D_CAN) {
+                        for (i = 0; i < frame->can_dlc; i += 4, dreg += 2) {
+                                data = priv->read_reg32(priv, dreg);
+                                frame->data[i] = data;
+                                frame->data[i + 1] = data >> 8;
+                                frame->data[i + 2] = data >> 16;
+                                frame->data[i + 3] = data >> 24;
+                        }
+                } else {
+                        for (i = 0; i < frame->can_dlc; i += 2, dreg++) {
+                                data = priv->read_reg(priv, dreg);
+                                frame->data[i] = data;
+                                frame->data[i + 1] = data >> 8;
+                        }
                 }
         }
 
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index 910c12e2638e..ad535a854e5c 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -798,6 +798,9 @@ static int can_validate(struct nlattr *tb[], struct nlattr *data[])
          * - control mode with CAN_CTRLMODE_FD set
          */
 
+        if (!data)
+                return 0;
+
         if (data[IFLA_CAN_CTRLMODE]) {
                 struct can_ctrlmode *cm = nla_data(data[IFLA_CAN_CTRLMODE]);
 
@@ -1008,6 +1011,11 @@ static int can_newlink(struct net *src_net, struct net_device *dev,
         return -EOPNOTSUPP;
 }
 
+static void can_dellink(struct net_device *dev, struct list_head *head)
+{
+        return;
+}
+
 static struct rtnl_link_ops can_link_ops __read_mostly = {
         .kind           = "can",
         .maxtype        = IFLA_CAN_MAX,
@@ -1016,6 +1024,7 @@ static struct rtnl_link_ops can_link_ops __read_mostly = {
         .validate       = can_validate,
         .newlink        = can_newlink,
         .changelink     = can_changelink,
+        .dellink        = can_dellink,
         .get_size       = can_get_size,
         .fill_info      = can_fill_info,
         .get_xstats_size = can_get_xstats_size,
diff --git a/drivers/net/can/usb/Kconfig b/drivers/net/can/usb/Kconfig
index bcb272f6c68a..8483a40e7e9e 100644
--- a/drivers/net/can/usb/Kconfig
+++ b/drivers/net/can/usb/Kconfig
@@ -16,7 +16,8 @@ config CAN_ESD_USB2
 config CAN_GS_USB
         tristate "Geschwister Schneider UG interfaces"
         ---help---
-          This driver supports the Geschwister Schneider USB/CAN devices.
+          This driver supports the Geschwister Schneider and bytewerk.org
+          candleLight USB CAN interfaces USB/CAN devices
           If unsure choose N,
           choose Y for built in support,
           M to compile as module (module will be named: gs_usb).
@@ -46,6 +47,8 @@ config CAN_KVASER_USB
             - Kvaser USBcan R
             - Kvaser Leaf Light v2
             - Kvaser Mini PCI Express HS
+            - Kvaser Mini PCI Express 2xHS
+            - Kvaser USBcan Light 2xHS
             - Kvaser USBcan II HS/HS
             - Kvaser USBcan II HS/LS
             - Kvaser USBcan Rugged ("USBcan Rev B")
diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
index 1556d4286235..acb0c8490673 100644
--- a/drivers/net/can/usb/gs_usb.c
+++ b/drivers/net/can/usb/gs_usb.c
@@ -1,7 +1,9 @@
-/* CAN driver for Geschwister Schneider USB/CAN devices.
+/* CAN driver for Geschwister Schneider USB/CAN devices
+ * and bytewerk.org candleLight USB CAN interfaces.
  *
- * Copyright (C) 2013 Geschwister Schneider Technologie-,
+ * Copyright (C) 2013-2016 Geschwister Schneider Technologie-,
  * Entwicklungs- und Vertriebs UG (Haftungsbeschränkt).
+ * Copyright (C) 2016 Hubert Denkmair
  *
  * Many thanks to all socketcan devs!
  *
@@ -29,6 +31,9 @@
 #define USB_GSUSB_1_VENDOR_ID      0x1d50
 #define USB_GSUSB_1_PRODUCT_ID     0x606f
 
+#define USB_CANDLELIGHT_VENDOR_ID  0x1209
+#define USB_CANDLELIGHT_PRODUCT_ID 0x2323
+
 #define GSUSB_ENDPOINT_IN          1
 #define GSUSB_ENDPOINT_OUT         2
 
@@ -952,6 +957,8 @@ static void gs_usb_disconnect(struct usb_interface *intf)
 static const struct usb_device_id gs_usb_table[] = {
         { USB_DEVICE_INTERFACE_NUMBER(USB_GSUSB_1_VENDOR_ID,
                                       USB_GSUSB_1_PRODUCT_ID, 0) },
+        { USB_DEVICE_INTERFACE_NUMBER(USB_CANDLELIGHT_VENDOR_ID,
+                                      USB_CANDLELIGHT_PRODUCT_ID, 0) },
         {} /* Terminating entry */
 };
 
@@ -969,5 +976,6 @@ module_usb_driver(gs_usb_driver);
 MODULE_AUTHOR("Maximilian Schneider <mws@schneidersoft.net>");
 MODULE_DESCRIPTION(
 "Socket CAN device driver for Geschwister Schneider Technologie-, "
-"Entwicklungs- und Vertriebs UG. USB2.0 to CAN interfaces.");
+"Entwicklungs- und Vertriebs UG. USB2.0 to CAN interfaces\n"
+"and bytewerk.org candleLight USB CAN interfaces.");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c
index 022bfa13ebfa..6f1f3b675ff5 100644
--- a/drivers/net/can/usb/kvaser_usb.c
+++ b/drivers/net/can/usb/kvaser_usb.c
@@ -59,11 +59,14 @@
 #define USB_CAN_R_PRODUCT_ID            39
 #define USB_LEAF_LITE_V2_PRODUCT_ID     288
 #define USB_MINI_PCIE_HS_PRODUCT_ID     289
+#define USB_LEAF_LIGHT_HS_V2_OEM_PRODUCT_ID 290
+#define USB_USBCAN_LIGHT_2HS_PRODUCT_ID 291
+#define USB_MINI_PCIE_2HS_PRODUCT_ID    292
 
 static inline bool kvaser_is_leaf(const struct usb_device_id *id)
 {
         return id->idProduct >= USB_LEAF_DEVEL_PRODUCT_ID &&
-               id->idProduct <= USB_MINI_PCIE_HS_PRODUCT_ID;
+               id->idProduct <= USB_MINI_PCIE_2HS_PRODUCT_ID;
 }
 
 /* Kvaser USBCan-II devices */
@@ -537,6 +540,9 @@ static const struct usb_device_id kvaser_usb_table[] = {
                 .driver_info = KVASER_HAS_TXRX_ERRORS },
         { USB_DEVICE(KVASER_VENDOR_ID, USB_LEAF_LITE_V2_PRODUCT_ID) },
         { USB_DEVICE(KVASER_VENDOR_ID, USB_MINI_PCIE_HS_PRODUCT_ID) },
+        { USB_DEVICE(KVASER_VENDOR_ID, USB_LEAF_LIGHT_HS_V2_OEM_PRODUCT_ID) },
+        { USB_DEVICE(KVASER_VENDOR_ID, USB_USBCAN_LIGHT_2HS_PRODUCT_ID) },
+        { USB_DEVICE(KVASER_VENDOR_ID, USB_MINI_PCIE_2HS_PRODUCT_ID) },
 
         /* USBCANII family IDs */
         { USB_DEVICE(KVASER_VENDOR_ID, USB_USBCAN2_PRODUCT_ID),
diff --git a/drivers/net/ethernet/amd/au1000_eth.c b/drivers/net/ethernet/amd/au1000_eth.c
index e0fb0f1122db..20760e10211a 100644
--- a/drivers/net/ethernet/amd/au1000_eth.c
+++ b/drivers/net/ethernet/amd/au1000_eth.c
@@ -509,8 +509,8 @@ static int au1000_mii_probe(struct net_device *dev)
          * on the current MAC's MII bus
          */
         for (phy_addr = 0; phy_addr < PHY_MAX_ADDR; phy_addr++)
-                if (mdiobus_get_phy(aup->mii_bus, aup->phy_addr)) {
-                        phydev = mdiobus_get_phy(aup->mii_bus, aup->phy_addr);
+                if (mdiobus_get_phy(aup->mii_bus, phy_addr)) {
+                        phydev = mdiobus_get_phy(aup->mii_bus, phy_addr);
                         if (!aup->phy_search_highest_addr)
                                 /* break out with first one found */
                                 break;
diff --git a/drivers/net/ethernet/atheros/alx/alx.h b/drivers/net/ethernet/atheros/alx/alx.h
index d02c4240b7df..8fc93c5f6abc 100644
--- a/drivers/net/ethernet/atheros/alx/alx.h
+++ b/drivers/net/ethernet/atheros/alx/alx.h
@@ -96,10 +96,6 @@ struct alx_priv {
         unsigned int rx_ringsz;
         unsigned int rxbuf_size;
 
-        struct page  *rx_page;
-        unsigned int rx_page_offset;
-        unsigned int rx_frag_size;
-
         struct napi_struct napi;
         struct alx_tx_queue txq;
         struct alx_rx_queue rxq;
diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c
index ec157a0c5d2a..6453148d066a 100644
--- a/drivers/net/ethernet/atheros/alx/main.c
+++ b/drivers/net/ethernet/atheros/alx/main.c
@@ -70,35 +70,6 @@ static void alx_free_txbuf(struct alx_priv *alx, int entry)
         }
 }
 
-static struct sk_buff *alx_alloc_skb(struct alx_priv *alx, gfp_t gfp)
-{
-        struct sk_buff *skb;
-        struct page *page;
-
-        if (alx->rx_frag_size > PAGE_SIZE)
-                return __netdev_alloc_skb(alx->dev, alx->rxbuf_size, gfp);
-
-        page = alx->rx_page;
-        if (!page) {
-                alx->rx_page = page = alloc_page(gfp);
-                if (unlikely(!page))
-                        return NULL;
-                alx->rx_page_offset = 0;
-        }
-
-        skb = build_skb(page_address(page) + alx->rx_page_offset,
-                        alx->rx_frag_size);
-        if (likely(skb)) {
-                alx->rx_page_offset += alx->rx_frag_size;
-                if (alx->rx_page_offset >= PAGE_SIZE)
-                        alx->rx_page = NULL;
-                else
-                        get_page(page);
-        }
-        return skb;
-}
-
-
 static int alx_refill_rx_ring(struct alx_priv *alx, gfp_t gfp)
 {
         struct alx_rx_queue *rxq = &alx->rxq;
@@ -115,9 +86,22 @@ static int alx_refill_rx_ring(struct alx_priv *alx, gfp_t gfp)
         while (!cur_buf->skb && next != rxq->read_idx) {
                 struct alx_rfd *rfd = &rxq->rfd[cur];
 
-                skb = alx_alloc_skb(alx, gfp);
+                /*
+                 * When DMA RX address is set to something like
+                 * 0x....fc0, it will be very likely to cause DMA
+                 * RFD overflow issue.
+                 *
+                 * To work around it, we apply rx skb with 64 bytes
+                 * longer space, and offset the address whenever
+                 * 0x....fc0 is detected.
+                 */
+                skb = __netdev_alloc_skb(alx->dev, alx->rxbuf_size + 64, gfp);
                 if (!skb)
                         break;
+
+                if (((unsigned long)skb->data & 0xfff) == 0xfc0)
+                        skb_reserve(skb, 64);
+
                 dma = dma_map_single(&alx->hw.pdev->dev,
                                      skb->data, alx->rxbuf_size,
                                      DMA_FROM_DEVICE);
@@ -153,7 +137,6 @@ static int alx_refill_rx_ring(struct alx_priv *alx, gfp_t gfp)
                 alx_write_mem16(&alx->hw, ALX_RFD_PIDX, cur);
         }
 
-
         return count;
 }
 
@@ -622,11 +605,6 @@ static void alx_free_rings(struct alx_priv *alx)
         kfree(alx->txq.bufs);
         kfree(alx->rxq.bufs);
 
-        if (alx->rx_page) {
-                put_page(alx->rx_page);
-                alx->rx_page = NULL;
-        }
-
         dma_free_coherent(&alx->hw.pdev->dev,
                           alx->descmem.size,
                           alx->descmem.virt,
@@ -681,7 +659,6 @@ static int alx_request_irq(struct alx_priv *alx)
                                   alx->dev->name, alx);
                 if (!err)
                         goto out;
-
                 /* fall back to legacy interrupt */
                 pci_disable_msi(alx->hw.pdev);
         }
@@ -725,7 +702,6 @@ static int alx_init_sw(struct alx_priv *alx)
         struct pci_dev *pdev = alx->hw.pdev;
         struct alx_hw *hw = &alx->hw;
         int err;
-        unsigned int head_size;
 
         err = alx_identify_hw(alx);
         if (err) {
@@ -741,12 +717,7 @@ static int alx_init_sw(struct alx_priv *alx)
 
         hw->smb_timer = 400;
         hw->mtu = alx->dev->mtu;
-
         alx->rxbuf_size = ALX_MAX_FRAME_LEN(hw->mtu);
-        head_size = SKB_DATA_ALIGN(alx->rxbuf_size + NET_SKB_PAD) +
-                    SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
-        alx->rx_frag_size = roundup_pow_of_two(head_size);
-
         alx->tx_ringsz = 256;
         alx->rx_ringsz = 512;
         hw->imt = 200;
@@ -848,7 +819,6 @@ static int alx_change_mtu(struct net_device *netdev, int mtu)
 {
         struct alx_priv *alx = netdev_priv(netdev);
         int max_frame = ALX_MAX_FRAME_LEN(mtu);
-        unsigned int head_size;
 
         if ((max_frame < ALX_MIN_FRAME_SIZE) ||
             (max_frame > ALX_MAX_FRAME_SIZE))
@@ -860,9 +830,6 @@ static int alx_change_mtu(struct net_device *netdev, int mtu)
         netdev->mtu = mtu;
         alx->hw.mtu = mtu;
         alx->rxbuf_size = max(max_frame, ALX_DEF_RXBUF_SIZE);
-        head_size = SKB_DATA_ALIGN(alx->rxbuf_size + NET_SKB_PAD) +
-                    SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
-        alx->rx_frag_size = roundup_pow_of_two(head_size);
         netdev_update_features(netdev);
         if (netif_running(netdev))
                 alx_reinit(alx);
diff --git a/drivers/net/ethernet/broadcom/bgmac.c b/drivers/net/ethernet/broadcom/bgmac.c
index ee5f431ab32a..a6333d38ecc0 100644
--- a/drivers/net/ethernet/broadcom/bgmac.c
+++ b/drivers/net/ethernet/broadcom/bgmac.c
@@ -267,15 +267,16 @@ static void bgmac_dma_tx_free(struct bgmac *bgmac, struct bgmac_dma_ring *ring)
         while (ring->start != ring->end) {
                 int slot_idx = ring->start % BGMAC_TX_RING_SLOTS;
                 struct bgmac_slot_info *slot = &ring->slots[slot_idx];
-                u32 ctl1;
+                u32 ctl0, ctl1;
                 int len;
 
                 if (slot_idx == empty_slot)
                         break;
 
+                ctl0 = le32_to_cpu(ring->cpu_base[slot_idx].ctl0);
                 ctl1 = le32_to_cpu(ring->cpu_base[slot_idx].ctl1);
                 len = ctl1 & BGMAC_DESC_CTL1_LEN;
-                if (ctl1 & BGMAC_DESC_CTL0_SOF)
+                if (ctl0 & BGMAC_DESC_CTL0_SOF)
                         /* Unmap no longer used buffer */
                         dma_unmap_single(dma_dev, slot->dma_addr, len,
                                          DMA_TO_DEVICE);
@@ -1312,7 +1313,8 @@ static int bgmac_open(struct net_device *net_dev)
 
         phy_start(bgmac->phy_dev);
 
-        netif_carrier_on(net_dev);
+        netif_start_queue(net_dev);
+
         return 0;
 }
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index c5fe915870ad..a59d55e25d5f 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -12895,52 +12895,71 @@ static int __bnx2x_vlan_configure_vid(struct bnx2x *bp, u16 vid, bool add)
         return rc;
 }
 
-int bnx2x_vlan_reconfigure_vid(struct bnx2x *bp)
+static int bnx2x_vlan_configure_vid_list(struct bnx2x *bp)
 {
         struct bnx2x_vlan_entry *vlan;
         int rc = 0;
 
-        if (!bp->vlan_cnt) {
-                DP(NETIF_MSG_IFUP, "No need to re-configure vlan filters\n");
-                return 0;
-        }
-
+        /* Configure all non-configured entries */
         list_for_each_entry(vlan, &bp->vlan_reg, link) {
-                /* Prepare for cleanup in case of errors */
-                if (rc) {
-                        vlan->hw = false;
-                        continue;
-                }
-
-                if (!vlan->hw)
+                if (vlan->hw)
                         continue;
 
-                DP(NETIF_MSG_IFUP, "Re-configuring vlan 0x%04x\n", vlan->vid);
+                if (bp->vlan_cnt >= bp->vlan_credit)
+                        return -ENOBUFS;
 
                 rc = __bnx2x_vlan_configure_vid(bp, vlan->vid, true);
                 if (rc) {
-                        BNX2X_ERR("Unable to configure VLAN %d\n", vlan->vid);
-                        vlan->hw = false;
-                        rc = -EINVAL;
-                        continue;
+                        BNX2X_ERR("Unable to config VLAN %d\n", vlan->vid);
+                        return rc;
                 }
+
+                DP(NETIF_MSG_IFUP, "HW configured for VLAN %d\n", vlan->vid);
+                vlan->hw = true;
+                bp->vlan_cnt++;
         }
 
-        return rc;
+        return 0;
+}
+
+static void bnx2x_vlan_configure(struct bnx2x *bp, bool set_rx_mode)
+{
+        bool need_accept_any_vlan;
+
+        need_accept_any_vlan = !!bnx2x_vlan_configure_vid_list(bp);
+
+        if (bp->accept_any_vlan != need_accept_any_vlan) {
+                bp->accept_any_vlan = need_accept_any_vlan;
+                DP(NETIF_MSG_IFUP, "Accept all VLAN %s\n",
+                   bp->accept_any_vlan ? "raised" : "cleared");
+                if (set_rx_mode) {
+                        if (IS_PF(bp))
+                                bnx2x_set_rx_mode_inner(bp);
+                        else
+                                bnx2x_vfpf_storm_rx_mode(bp);
+                }
+        }
+}
+
+int bnx2x_vlan_reconfigure_vid(struct bnx2x *bp)
+{
+        struct bnx2x_vlan_entry *vlan;
+
+        /* The hw forgot all entries after reload */
+        list_for_each_entry(vlan, &bp->vlan_reg, link)
+                vlan->hw = false;
+        bp->vlan_cnt = 0;
+
+        /* Don't set rx mode here. Our caller will do it. */
+        bnx2x_vlan_configure(bp, false);
+
+        return 0;
 }
 
 static int bnx2x_vlan_rx_add_vid(struct net_device *dev, __be16 proto, u16 vid)
 {
         struct bnx2x *bp = netdev_priv(dev);
         struct bnx2x_vlan_entry *vlan;
-        bool hw = false;
-        int rc = 0;
-
-        if (!netif_running(bp->dev)) {
-                DP(NETIF_MSG_IFUP,
-                   "Ignoring VLAN configuration the interface is down\n");
-                return -EFAULT;
-        }
 
         DP(NETIF_MSG_IFUP, "Adding VLAN %d\n", vid);
 
@@ -12948,93 +12967,47 @@ static int bnx2x_vlan_rx_add_vid(struct net_device *dev, __be16 proto, u16 vid)
         if (!vlan)
                 return -ENOMEM;
 
-        bp->vlan_cnt++;
-        if (bp->vlan_cnt > bp->vlan_credit && !bp->accept_any_vlan) {
-                DP(NETIF_MSG_IFUP, "Accept all VLAN raised\n");
-                bp->accept_any_vlan = true;
-                if (IS_PF(bp))
-                        bnx2x_set_rx_mode_inner(bp);
-                else
-                        bnx2x_vfpf_storm_rx_mode(bp);
-        } else if (bp->vlan_cnt <= bp->vlan_credit) {
-                rc = __bnx2x_vlan_configure_vid(bp, vid, true);
-                hw = true;
-        }
-
         vlan->vid = vid;
-        vlan->hw = hw;
+        vlan->hw = false;
+        list_add_tail(&vlan->link, &bp->vlan_reg);
 
-        if (!rc) {
-                list_add(&vlan->link, &bp->vlan_reg);
-        } else {
-                bp->vlan_cnt--;
-                kfree(vlan);
-        }
-
-        DP(NETIF_MSG_IFUP, "Adding VLAN result %d\n", rc);
+        if (netif_running(dev))
+                bnx2x_vlan_configure(bp, true);
 
-        return rc;
+        return 0;
 }
 
 static int bnx2x_vlan_rx_kill_vid(struct net_device *dev, __be16 proto, u16 vid)
 {
         struct bnx2x *bp = netdev_priv(dev);
         struct bnx2x_vlan_entry *vlan;
+        bool found = false;
         int rc = 0;
 
-        if (!netif_running(bp->dev)) {
-                DP(NETIF_MSG_IFUP,
-                   "Ignoring VLAN configuration the interface is down\n");
-                return -EFAULT;
-        }
-
         DP(NETIF_MSG_IFUP, "Removing VLAN %d\n", vid);
 
-        if (!bp->vlan_cnt) {
-                BNX2X_ERR("Unable to kill VLAN %d\n", vid);
-                return -EINVAL;
-        }
-
         list_for_each_entry(vlan, &bp->vlan_reg, link)
-                if (vlan->vid == vid)
+                if (vlan->vid == vid) {
+                        found = true;
                         break;
+                }
 
-        if (vlan->vid != vid) {
+        if (!found) {
                 BNX2X_ERR("Unable to kill VLAN %d - not found\n", vid);
                 return -EINVAL;
         }
 
-        if (vlan->hw)
+        if (netif_running(dev) && vlan->hw) {
                 rc = __bnx2x_vlan_configure_vid(bp, vid, false);
+                DP(NETIF_MSG_IFUP, "HW deconfigured for VLAN %d\n", vid);
+                bp->vlan_cnt--;
+        }
 
         list_del(&vlan->link);
         kfree(vlan);
 
-        bp->vlan_cnt--;
-
-        if (bp->vlan_cnt <= bp->vlan_credit && bp->accept_any_vlan) {
-                /* Configure all non-configured entries */
-                list_for_each_entry(vlan, &bp->vlan_reg, link) {
-                        if (vlan->hw)
-                                continue;
-
-                        rc = __bnx2x_vlan_configure_vid(bp, vlan->vid, true);
-                        if (rc) {
-                                BNX2X_ERR("Unable to config VLAN %d\n",
-                                          vlan->vid);
-                                continue;
-                        }
-                        DP(NETIF_MSG_IFUP, "HW configured for VLAN %d\n",
-                           vlan->vid);
-                        vlan->hw = true;
-                }
-                DP(NETIF_MSG_IFUP, "Accept all VLAN Removed\n");
-                bp->accept_any_vlan = false;
-                if (IS_PF(bp))
-                        bnx2x_set_rx_mode_inner(bp);
-                else
-                        bnx2x_vfpf_storm_rx_mode(bp);
-        }
+        if (netif_running(dev))
+                bnx2x_vlan_configure(bp, true);
 
         DP(NETIF_MSG_IFUP, "Removing VLAN result %d\n", rc);
 
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 72a2efff8e49..c777cde85ce4 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -286,7 +286,9 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev)
                         cpu_to_le32(DB_KEY_TX_PUSH | DB_LONG_TX_PUSH | prod);
                 txr->tx_prod = prod;
 
+                tx_buf->is_push = 1;
                 netdev_tx_sent_queue(txq, skb->len);
+                wmb();  /* Sync is_push and byte queue before pushing data */
 
                 push_len = (length + sizeof(*tx_push) + 7) / 8;
                 if (push_len > 16) {
@@ -298,7 +300,6 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev)
                                          push_len);
                 }
 
-                tx_buf->is_push = 1;
                 goto tx_done;
         }
 
@@ -1112,19 +1113,13 @@ static inline struct sk_buff *bnxt_tpa_end(struct bnxt *bp,
         if (tpa_info->hash_type != PKT_HASH_TYPE_NONE)
                 skb_set_hash(skb, tpa_info->rss_hash, tpa_info->hash_type);
 
-        if (tpa_info->flags2 & RX_CMP_FLAGS2_META_FORMAT_VLAN) {
-                netdev_features_t features = skb->dev->features;
+        if ((tpa_info->flags2 & RX_CMP_FLAGS2_META_FORMAT_VLAN) &&
+            (skb->dev->features & NETIF_F_HW_VLAN_CTAG_RX)) {
                 u16 vlan_proto = tpa_info->metadata >>
                         RX_CMP_FLAGS2_METADATA_TPID_SFT;
+                u16 vtag = tpa_info->metadata & RX_CMP_FLAGS2_METADATA_VID_MASK;
 
-                if (((features & NETIF_F_HW_VLAN_CTAG_RX) &&
-                     vlan_proto == ETH_P_8021Q) ||
-                    ((features & NETIF_F_HW_VLAN_STAG_RX) &&
-                     vlan_proto == ETH_P_8021AD)) {
-                        __vlan_hwaccel_put_tag(skb, htons(vlan_proto),
-                                               tpa_info->metadata &
-                                               RX_CMP_FLAGS2_METADATA_VID_MASK);
-                }
+                __vlan_hwaccel_put_tag(skb, htons(vlan_proto), vtag);
         }
 
         skb_checksum_none_assert(skb);
@@ -1277,19 +1272,14 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_napi *bnapi, u32 *raw_cons,
 
         skb->protocol = eth_type_trans(skb, dev);
 
-        if (rxcmp1->rx_cmp_flags2 &
-            cpu_to_le32(RX_CMP_FLAGS2_META_FORMAT_VLAN)) {
-                netdev_features_t features = skb->dev->features;
+        if ((rxcmp1->rx_cmp_flags2 &
+             cpu_to_le32(RX_CMP_FLAGS2_META_FORMAT_VLAN)) &&
+            (skb->dev->features & NETIF_F_HW_VLAN_CTAG_RX)) {
                 u32 meta_data = le32_to_cpu(rxcmp1->rx_cmp_meta_data);
+                u16 vtag = meta_data & RX_CMP_FLAGS2_METADATA_VID_MASK;
                 u16 vlan_proto = meta_data >> RX_CMP_FLAGS2_METADATA_TPID_SFT;
 
-                if (((features & NETIF_F_HW_VLAN_CTAG_RX) &&
-                     vlan_proto == ETH_P_8021Q) ||
-                    ((features & NETIF_F_HW_VLAN_STAG_RX) &&
-                     vlan_proto == ETH_P_8021AD))
-                        __vlan_hwaccel_put_tag(skb, htons(vlan_proto),
-                                               meta_data &
-                                               RX_CMP_FLAGS2_METADATA_VID_MASK);
+                __vlan_hwaccel_put_tag(skb, htons(vlan_proto), vtag);
         }
 
         skb_checksum_none_assert(skb);
@@ -5466,6 +5456,20 @@ static netdev_features_t bnxt_fix_features(struct net_device *dev,
 
         if (!bnxt_rfs_capable(bp))
                 features &= ~NETIF_F_NTUPLE;
+
+        /* Both CTAG and STAG VLAN accelaration on the RX side have to be
+         * turned on or off together.
+         */
+        if ((features & (NETIF_F_HW_VLAN_CTAG_RX | NETIF_F_HW_VLAN_STAG_RX)) !=
+            (NETIF_F_HW_VLAN_CTAG_RX | NETIF_F_HW_VLAN_STAG_RX)) {
+                if (dev->features & NETIF_F_HW_VLAN_CTAG_RX)
+                        features &= ~(NETIF_F_HW_VLAN_CTAG_RX |
+                                      NETIF_F_HW_VLAN_STAG_RX);
+                else
+                        features |= NETIF_F_HW_VLAN_CTAG_RX |
+                                    NETIF_F_HW_VLAN_STAG_RX;
+        }
+
         return features;
 }
 
diff --git a/drivers/net/ethernet/cavium/thunder/nic_main.c b/drivers/net/ethernet/cavium/thunder/nic_main.c
index 95f17f8cadac..16ed20357c5c 100644
--- a/drivers/net/ethernet/cavium/thunder/nic_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nic_main.c
@@ -499,6 +499,7 @@ static void nic_tx_channel_cfg(struct nicpf *nic, u8 vnic,
         u32 rr_quantum;
         u8 sq_idx = sq->sq_num;
         u8 pqs_vnic;
+        int svf;
 
         if (sq->sqs_mode)
                 pqs_vnic = nic->pqs_vf[vnic];
@@ -511,10 +512,19 @@ static void nic_tx_channel_cfg(struct nicpf *nic, u8 vnic,
         /* 24 bytes for FCS, IPG and preamble */
         rr_quantum = ((NIC_HW_MAX_FRS + 24) / 4);
 
-        tl4 = (lmac * NIC_TL4_PER_LMAC) + (bgx * NIC_TL4_PER_BGX);
+        if (!sq->sqs_mode) {
+                tl4 = (lmac * NIC_TL4_PER_LMAC) + (bgx * NIC_TL4_PER_BGX);
+        } else {
+                for (svf = 0; svf < MAX_SQS_PER_VF; svf++) {
+                        if (nic->vf_sqs[pqs_vnic][svf] == vnic)
+                                break;
+                }
+                tl4 = (MAX_LMAC_PER_BGX * NIC_TL4_PER_LMAC);
+                tl4 += (lmac * NIC_TL4_PER_LMAC * MAX_SQS_PER_VF);
+                tl4 += (svf * NIC_TL4_PER_LMAC);
+                tl4 += (bgx * NIC_TL4_PER_BGX);
+        }
         tl4 += sq_idx;
-        if (sq->sqs_mode)
-                tl4 += vnic * 8;
 
         tl3 = tl4 / (NIC_MAX_TL4 / NIC_MAX_TL3);
         nic_reg_write(nic, NIC_PF_QSET_0_127_SQ_0_7_CFG2 |
diff --git a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
index 3ed21988626b..63a39ac97d53 100644
--- a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
+++ b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
@@ -551,7 +551,9 @@ static int bgx_xaui_check_link(struct lmac *lmac)
         }
 
         /* Clear rcvflt bit (latching high) and read it back */
-        bgx_reg_modify(bgx, lmacid, BGX_SPUX_STATUS2, SPU_STATUS2_RCVFLT);
+        if (bgx_reg_read(bgx, lmacid, BGX_SPUX_STATUS2) & SPU_STATUS2_RCVFLT)
+                bgx_reg_modify(bgx, lmacid,
+                               BGX_SPUX_STATUS2, SPU_STATUS2_RCVFLT);
         if (bgx_reg_read(bgx, lmacid, BGX_SPUX_STATUS2) & SPU_STATUS2_RCVFLT) {
                 dev_err(&bgx->pdev->dev, "Receive fault, retry training\n");
                 if (bgx->use_training) {
@@ -570,13 +572,6 @@ static int bgx_xaui_check_link(struct lmac *lmac)
                 return -1;
         }
 
-        /* Wait for MAC RX to be ready */
-        if (bgx_poll_reg(bgx, lmacid, BGX_SMUX_RX_CTL,
-                         SMU_RX_CTL_STATUS, true)) {
-                dev_err(&bgx->pdev->dev, "SMU RX link not okay\n");
-                return -1;
-        }
-
         /* Wait for BGX RX to be idle */
         if (bgx_poll_reg(bgx, lmacid, BGX_SMUX_CTL, SMU_CTL_RX_IDLE, false)) {
                 dev_err(&bgx->pdev->dev, "SMU RX not idle\n");
@@ -589,29 +584,30 @@ static int bgx_xaui_check_link(struct lmac *lmac)
                 return -1;
         }
 
-        if (bgx_reg_read(bgx, lmacid, BGX_SPUX_STATUS2) & SPU_STATUS2_RCVFLT) {
-                dev_err(&bgx->pdev->dev, "Receive fault\n");
-                return -1;
-        }
-
-        /* Receive link is latching low. Force it high and verify it */
-        bgx_reg_modify(bgx, lmacid, BGX_SPUX_STATUS1, SPU_STATUS1_RCV_LNK);
-        if (bgx_poll_reg(bgx, lmacid, BGX_SPUX_STATUS1,
-                         SPU_STATUS1_RCV_LNK, false)) {
-                dev_err(&bgx->pdev->dev, "SPU receive link down\n");
-                return -1;
-        }
-
+        /* Clear receive packet disable */
         cfg = bgx_reg_read(bgx, lmacid, BGX_SPUX_MISC_CONTROL);
         cfg &= ~SPU_MISC_CTL_RX_DIS;
         bgx_reg_write(bgx, lmacid, BGX_SPUX_MISC_CONTROL, cfg);
-        return 0;
+
+        /* Check for MAC RX faults */
+        cfg = bgx_reg_read(bgx, lmacid, BGX_SMUX_RX_CTL);
+        /* 0 - Link is okay, 1 - Local fault, 2 - Remote fault */
+        cfg &= SMU_RX_CTL_STATUS;
+        if (!cfg)
+                return 0;
+
+        /* Rx local/remote fault seen.
+         * Do lmac reinit to see if condition recovers
+         */
+        bgx_lmac_xaui_init(bgx, lmacid, bgx->lmac_type);
+
+        return -1;
 }
 
 static void bgx_poll_for_link(struct work_struct *work)
 {
         struct lmac *lmac;
-        u64 link;
+        u64 spu_link, smu_link;
 
         lmac = container_of(work, struct lmac, dwork.work);
 
@@ -621,8 +617,11 @@ static void bgx_poll_for_link(struct work_struct *work)
         bgx_poll_reg(lmac->bgx, lmac->lmacid, BGX_SPUX_STATUS1,
                      SPU_STATUS1_RCV_LNK, false);
 
-        link = bgx_reg_read(lmac->bgx, lmac->lmacid, BGX_SPUX_STATUS1);
-        if (link & SPU_STATUS1_RCV_LNK) {
+        spu_link = bgx_reg_read(lmac->bgx, lmac->lmacid, BGX_SPUX_STATUS1);
+        smu_link = bgx_reg_read(lmac->bgx, lmac->lmacid, BGX_SMUX_RX_CTL);
+
+        if ((spu_link & SPU_STATUS1_RCV_LNK) &&
+            !(smu_link & SMU_RX_CTL_STATUS)) {
                 lmac->link_up = 1;
                 if (lmac->bgx->lmac_type == BGX_MODE_XLAUI)
                         lmac->last_speed = 40000;
@@ -636,9 +635,15 @@ static void bgx_poll_for_link(struct work_struct *work)
         }
 
         if (lmac->last_link != lmac->link_up) {
+                if (lmac->link_up) {
+                        if (bgx_xaui_check_link(lmac)) {
+                                /* Errors, clear link_up state */
+                                lmac->link_up = 0;
+                                lmac->last_speed = SPEED_UNKNOWN;
+                                lmac->last_duplex = DUPLEX_UNKNOWN;
+                        }
+                }
                 lmac->last_link = lmac->link_up;
-                if (lmac->link_up)
-                        bgx_xaui_check_link(lmac);
         }
 
         queue_delayed_work(lmac->check_link, &lmac->dwork, HZ * 2);
@@ -710,7 +715,7 @@ static int bgx_lmac_enable(struct bgx *bgx, u8 lmacid)
 static void bgx_lmac_disable(struct bgx *bgx, u8 lmacid)
 {
         struct lmac *lmac;
-        u64 cmrx_cfg;
+        u64 cfg;
 
         lmac = &bgx->lmac[lmacid];
         if (lmac->check_link) {
@@ -719,9 +724,33 @@ static void bgx_lmac_disable(struct bgx *bgx, u8 lmacid)
                 destroy_workqueue(lmac->check_link);
         }
 
-        cmrx_cfg = bgx_reg_read(bgx, lmacid, BGX_CMRX_CFG);
-        cmrx_cfg &= ~(1 << 15);
-        bgx_reg_write(bgx, lmacid, BGX_CMRX_CFG, cmrx_cfg);
+        /* Disable packet reception */
+        cfg = bgx_reg_read(bgx, lmacid, BGX_CMRX_CFG);
+        cfg &= ~CMR_PKT_RX_EN;
+        bgx_reg_write(bgx, lmacid, BGX_CMRX_CFG, cfg);
+
+        /* Give chance for Rx/Tx FIFO to get drained */
+        bgx_poll_reg(bgx, lmacid, BGX_CMRX_RX_FIFO_LEN, (u64)0x1FFF, true);
+        bgx_poll_reg(bgx, lmacid, BGX_CMRX_TX_FIFO_LEN, (u64)0x3FFF, true);
+
+        /* Disable packet transmission */
+        cfg = bgx_reg_read(bgx, lmacid, BGX_CMRX_CFG);
+        cfg &= ~CMR_PKT_TX_EN;
+        bgx_reg_write(bgx, lmacid, BGX_CMRX_CFG, cfg);
+
+        /* Disable serdes lanes */
+        if (!lmac->is_sgmii)
+                bgx_reg_modify(bgx, lmacid,
+                               BGX_SPUX_CONTROL1, SPU_CTL_LOW_POWER);
+        else
+                bgx_reg_modify(bgx, lmacid,
+                               BGX_GMP_PCS_MRX_CTL, PCS_MRX_CTL_PWR_DN);
+
+        /* Disable LMAC */
+        cfg = bgx_reg_read(bgx, lmacid, BGX_CMRX_CFG);
+        cfg &= ~CMR_EN;
+        bgx_reg_write(bgx, lmacid, BGX_CMRX_CFG, cfg);
+
         bgx_flush_dmac_addrs(bgx, lmacid);
 
         if ((bgx->lmac_type != BGX_MODE_XFI) &&
diff --git a/drivers/net/ethernet/cavium/thunder/thunder_bgx.h b/drivers/net/ethernet/cavium/thunder/thunder_bgx.h
index 149e179363a1..42010d2e5ddf 100644
--- a/drivers/net/ethernet/cavium/thunder/thunder_bgx.h
+++ b/drivers/net/ethernet/cavium/thunder/thunder_bgx.h
@@ -41,6 +41,7 @@
 #define BGX_CMRX_RX_STAT10              0xC0
 #define BGX_CMRX_RX_BP_DROP             0xC8
 #define BGX_CMRX_RX_DMAC_CTL            0x0E8
+#define BGX_CMRX_RX_FIFO_LEN            0x108
 #define BGX_CMR_RX_DMACX_CAM            0x200
 #define  RX_DMACX_CAM_EN                        BIT_ULL(48)
 #define  RX_DMACX_CAM_LMACID(x)                 (x << 49)
@@ -50,6 +51,7 @@
 #define BGX_CMR_CHAN_MSK_AND            0x450
 #define BGX_CMR_BIST_STATUS             0x460
 #define BGX_CMR_RX_LMACS                0x468
+#define BGX_CMRX_TX_FIFO_LEN            0x518
 #define BGX_CMRX_TX_STAT0               0x600
 #define BGX_CMRX_TX_STAT1               0x608
 #define BGX_CMRX_TX_STAT2               0x610
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_pci_id_tbl.h b/drivers/net/ethernet/chelsio/cxgb4/t4_pci_id_tbl.h
index a2cdfc1261dc..50812a1d67bd 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_pci_id_tbl.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_pci_id_tbl.h
@@ -144,6 +144,7 @@ CH_PCI_DEVICE_ID_TABLE_DEFINE_BEGIN
         CH_PCI_ID_TABLE_FENTRY(0x5015), /* T502-bt */
         CH_PCI_ID_TABLE_FENTRY(0x5016), /* T580-OCP-SO */
         CH_PCI_ID_TABLE_FENTRY(0x5017), /* T520-OCP-SO */
+        CH_PCI_ID_TABLE_FENTRY(0x5018), /* T540-BT */
         CH_PCI_ID_TABLE_FENTRY(0x5080), /* Custom T540-cr */
         CH_PCI_ID_TABLE_FENTRY(0x5081), /* Custom T540-LL-cr */
         CH_PCI_ID_TABLE_FENTRY(0x5082), /* Custom T504-cr */
diff --git a/drivers/net/ethernet/ethoc.c b/drivers/net/ethernet/ethoc.c
index 41b010645100..4edb98c3c6c7 100644
--- a/drivers/net/ethernet/ethoc.c
+++ b/drivers/net/ethernet/ethoc.c
@@ -1195,7 +1195,7 @@ static int ethoc_probe(struct platform_device *pdev)
         priv->mdio = mdiobus_alloc();
         if (!priv->mdio) {
                 ret = -ENOMEM;
-                goto free;
+                goto free2;
         }
 
         priv->mdio->name = "ethoc-mdio";
@@ -1208,7 +1208,7 @@ static int ethoc_probe(struct platform_device *pdev)
         ret = mdiobus_register(priv->mdio);
         if (ret) {
                 dev_err(&netdev->dev, "failed to register MDIO bus\n");
-                goto free;
+                goto free2;
         }
 
         ret = ethoc_mdio_probe(netdev);
@@ -1241,9 +1241,10 @@ error2:
 error:
         mdiobus_unregister(priv->mdio);
         mdiobus_free(priv->mdio);
-free:
+free2:
         if (priv->clk)
                 clk_disable_unprepare(priv->clk);
+free:
         free_netdev(netdev);
 out:
         return ret;
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 3c0255e98535..fea0f330ddbd 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -2416,24 +2416,24 @@ fec_enet_set_coalesce(struct net_device *ndev, struct ethtool_coalesce *ec)
                 return -EOPNOTSUPP;
 
         if (ec->rx_max_coalesced_frames > 255) {
-                pr_err("Rx coalesced frames exceed hardware limiation");
+                pr_err("Rx coalesced frames exceed hardware limitation\n");
                 return -EINVAL;
         }
 
         if (ec->tx_max_coalesced_frames > 255) {
-                pr_err("Tx coalesced frame exceed hardware limiation");
+                pr_err("Tx coalesced frame exceed hardware limitation\n");
                 return -EINVAL;
         }
 
         cycle = fec_enet_us_to_itr_clock(ndev, fep->rx_time_itr);
         if (cycle > 0xFFFF) {
-                pr_err("Rx coalesed usec exceeed hardware limiation");
+                pr_err("Rx coalesced usec exceed hardware limitation\n");
                 return -EINVAL;
         }
 
         cycle = fec_enet_us_to_itr_clock(ndev, fep->tx_time_itr);
         if (cycle > 0xFFFF) {
-                pr_err("Rx coalesed usec exceeed hardware limiation");
+                pr_err("Rx coalesced usec exceed hardware limitation\n");
                 return -EINVAL;
         }
 
diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index 7615e0668acb..2e6785b6e8be 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -2440,7 +2440,8 @@ static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev)
                                                  tx_queue->tx_ring_size);
 
         if (likely(!nr_frags)) {
-                lstatus |= BD_LFLAG(TXBD_LAST | TXBD_INTERRUPT);
+                if (likely(!do_tstamp))
+                        lstatus |= BD_LFLAG(TXBD_LAST | TXBD_INTERRUPT);
         } else {
                 u32 lstatus_start = lstatus;
 
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index 864cb21351a4..ecdb6854a898 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -2121,7 +2121,7 @@ static void handle_error_info_rsp(union ibmvnic_crq *crq,
                                   struct ibmvnic_adapter *adapter)
 {
         struct device *dev = &adapter->vdev->dev;
-        struct ibmvnic_error_buff *error_buff;
+        struct ibmvnic_error_buff *error_buff, *tmp;
         unsigned long flags;
         bool found = false;
         int i;
@@ -2133,7 +2133,7 @@ static void handle_error_info_rsp(union ibmvnic_crq *crq,
         }
 
         spin_lock_irqsave(&adapter->error_list_lock, flags);
-        list_for_each_entry(error_buff, &adapter->errors, list)
+        list_for_each_entry_safe(error_buff, tmp, &adapter->errors, list)
                 if (error_buff->error_id == crq->request_error_rsp.error_id) {
                         found = true;
                         list_del(&error_buff->list);
@@ -3141,14 +3141,14 @@ static void handle_request_ras_comp_num_rsp(union ibmvnic_crq *crq,
 
 static void ibmvnic_free_inflight(struct ibmvnic_adapter *adapter)
 {
-        struct ibmvnic_inflight_cmd *inflight_cmd;
+        struct ibmvnic_inflight_cmd *inflight_cmd, *tmp1;
         struct device *dev = &adapter->vdev->dev;
-        struct ibmvnic_error_buff *error_buff;
+        struct ibmvnic_error_buff *error_buff, *tmp2;
         unsigned long flags;
         unsigned long flags2;
 
         spin_lock_irqsave(&adapter->inflight_lock, flags);
-        list_for_each_entry(inflight_cmd, &adapter->inflight, list) {
+        list_for_each_entry_safe(inflight_cmd, tmp1, &adapter->inflight, list) {
                 switch (inflight_cmd->crq.generic.cmd) {
                 case LOGIN:
                         dma_unmap_single(dev, adapter->login_buf_token,
@@ -3165,8 +3165,8 @@ static void ibmvnic_free_inflight(struct ibmvnic_adapter *adapter)
                         break;
                 case REQUEST_ERROR_INFO:
                         spin_lock_irqsave(&adapter->error_list_lock, flags2);
-                        list_for_each_entry(error_buff, &adapter->errors,
-                                            list) {
+                        list_for_each_entry_safe(error_buff, tmp2,
+                                                 &adapter->errors, list) {
                                 dma_unmap_single(dev, error_buff->dma,
                                                  error_buff->len,
                                                  DMA_FROM_DEVICE);
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index a2dfa2fbedd8..67e4e7b185e5 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -154,6 +154,16 @@ void __ew32(struct e1000_hw *hw, unsigned long reg, u32 val)
         writel(val, hw->hw_addr + reg);
 }
 
+static bool e1000e_vlan_used(struct e1000_adapter *adapter)
+{
+        u16 vid;
+
+        for_each_set_bit(vid, adapter->active_vlans, VLAN_N_VID)
+                return true;
+
+        return false;
+}
+
 /**
  * e1000_regdump - register printout routine
  * @hw: pointer to the HW structure
@@ -2789,7 +2799,7 @@ static void e1000e_vlan_filter_enable(struct e1000_adapter *adapter)
 }
 
 /**
- * e1000e_vlan_strip_enable - helper to disable HW VLAN stripping
+ * e1000e_vlan_strip_disable - helper to disable HW VLAN stripping
  * @adapter: board private structure to initialize
  **/
 static void e1000e_vlan_strip_disable(struct e1000_adapter *adapter)
@@ -3443,7 +3453,8 @@ static void e1000e_set_rx_mode(struct net_device *netdev)
 
         ew32(RCTL, rctl);
 
-        if (netdev->features & NETIF_F_HW_VLAN_CTAG_RX)
+        if (netdev->features & NETIF_F_HW_VLAN_CTAG_RX ||
+            e1000e_vlan_used(adapter))
                 e1000e_vlan_strip_enable(adapter);
         else
                 e1000e_vlan_strip_disable(adapter);
diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
index c984462fad2a..d1cdc2d76151 100644
--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
@@ -133,6 +133,8 @@ static int mtk_mdio_read(struct mii_bus *bus, int phy_addr, int phy_reg)
 static void mtk_phy_link_adjust(struct net_device *dev)
 {
         struct mtk_mac *mac = netdev_priv(dev);
+        u16 lcl_adv = 0, rmt_adv = 0;
+        u8 flowctrl;
         u32 mcr = MAC_MCR_MAX_RX_1536 | MAC_MCR_IPG_CFG |
                   MAC_MCR_FORCE_MODE | MAC_MCR_TX_EN |
                   MAC_MCR_RX_EN | MAC_MCR_BACKOFF_EN |
@@ -150,11 +152,30 @@ static void mtk_phy_link_adjust(struct net_device *dev)
         if (mac->phy_dev->link)
                 mcr |= MAC_MCR_FORCE_LINK;
 
-        if (mac->phy_dev->duplex)
+        if (mac->phy_dev->duplex) {
                 mcr |= MAC_MCR_FORCE_DPX;
 
-        if (mac->phy_dev->pause)
-                mcr |= MAC_MCR_FORCE_RX_FC | MAC_MCR_FORCE_TX_FC;
+                if (mac->phy_dev->pause)
+                        rmt_adv = LPA_PAUSE_CAP;
+                if (mac->phy_dev->asym_pause)
+                        rmt_adv |= LPA_PAUSE_ASYM;
+
+                if (mac->phy_dev->advertising & ADVERTISED_Pause)
+                        lcl_adv |= ADVERTISE_PAUSE_CAP;
+                if (mac->phy_dev->advertising & ADVERTISED_Asym_Pause)
+                        lcl_adv |= ADVERTISE_PAUSE_ASYM;
+
+                flowctrl = mii_resolve_flowctrl_fdx(lcl_adv, rmt_adv);
+
+                if (flowctrl & FLOW_CTRL_TX)
+                        mcr |= MAC_MCR_FORCE_TX_FC;
+                if (flowctrl & FLOW_CTRL_RX)
+                        mcr |= MAC_MCR_FORCE_RX_FC;
+
+                netif_dbg(mac->hw, link, dev, "rx pause %s, tx pause %s\n",
+                          flowctrl & FLOW_CTRL_RX ? "enabled" : "disabled",
+                          flowctrl & FLOW_CTRL_TX ? "enabled" : "disabled");
+        }
 
         mtk_w32(mac->hw, mcr, MTK_MAC_MCR(mac->id));
 
@@ -208,10 +229,16 @@ static int mtk_phy_connect(struct mtk_mac *mac)
         u32 val, ge_mode;
 
         np = of_parse_phandle(mac->of_node, "phy-handle", 0);
+        if (!np && of_phy_is_fixed_link(mac->of_node))
+                if (!of_phy_register_fixed_link(mac->of_node))
+                        np = of_node_get(mac->of_node);
         if (!np)
                 return -ENODEV;
 
         switch (of_get_phy_mode(np)) {
+        case PHY_INTERFACE_MODE_RGMII_TXID:
+        case PHY_INTERFACE_MODE_RGMII_RXID:
+        case PHY_INTERFACE_MODE_RGMII_ID:
         case PHY_INTERFACE_MODE_RGMII:
                 ge_mode = 0;
                 break;
@@ -236,7 +263,8 @@ static int mtk_phy_connect(struct mtk_mac *mac)
         mac->phy_dev->autoneg = AUTONEG_ENABLE;
         mac->phy_dev->speed = 0;
         mac->phy_dev->duplex = 0;
-        mac->phy_dev->supported &= PHY_BASIC_FEATURES;
+        mac->phy_dev->supported &= PHY_GBIT_FEATURES | SUPPORTED_Pause |
+                                   SUPPORTED_Asym_Pause;
         mac->phy_dev->advertising = mac->phy_dev->supported |
                                     ADVERTISED_Autoneg;
         phy_start_aneg(mac->phy_dev);
@@ -280,7 +308,7 @@ static int mtk_mdio_init(struct mtk_eth *eth)
         return 0;
 
 err_free_bus:
-        kfree(eth->mii_bus);
+        mdiobus_free(eth->mii_bus);
 
 err_put_node:
         of_node_put(mii_np);
@@ -295,7 +323,7 @@ static void mtk_mdio_cleanup(struct mtk_eth *eth)
 
         mdiobus_unregister(eth->mii_bus);
         of_node_put(eth->mii_bus->dev.of_node);
-        kfree(eth->mii_bus);
+        mdiobus_free(eth->mii_bus);
 }
 
 static inline void mtk_irq_disable(struct mtk_eth *eth, u32 mask)
@@ -453,20 +481,23 @@ static inline void mtk_rx_get_desc(struct mtk_rx_dma *rxd,
 /* the qdma core needs scratch memory to be setup */
 static int mtk_init_fq_dma(struct mtk_eth *eth)
 {
-        dma_addr_t phy_ring_head, phy_ring_tail;
+        dma_addr_t phy_ring_tail;
         int cnt = MTK_DMA_SIZE;
         dma_addr_t dma_addr;
         int i;
 
         eth->scratch_ring = dma_alloc_coherent(eth->dev,
                                                cnt * sizeof(struct mtk_tx_dma),
-                                               &phy_ring_head,
+                                               &eth->phy_scratch_ring,
                                                GFP_ATOMIC | __GFP_ZERO);
         if (unlikely(!eth->scratch_ring))
                 return -ENOMEM;
 
         eth->scratch_head = kcalloc(cnt, MTK_QDMA_PAGE_SIZE,
                                     GFP_KERNEL);
+        if (unlikely(!eth->scratch_head))
+                return -ENOMEM;
+
         dma_addr = dma_map_single(eth->dev,
                                   eth->scratch_head, cnt * MTK_QDMA_PAGE_SIZE,
                                   DMA_FROM_DEVICE);
@@ -474,19 +505,19 @@ static int mtk_init_fq_dma(struct mtk_eth *eth)
                 return -ENOMEM;
 
         memset(eth->scratch_ring, 0x0, sizeof(struct mtk_tx_dma) * cnt);
-        phy_ring_tail = phy_ring_head +
+        phy_ring_tail = eth->phy_scratch_ring +
                         (sizeof(struct mtk_tx_dma) * (cnt - 1));
 
         for (i = 0; i < cnt; i++) {
                 eth->scratch_ring[i].txd1 =
                                         (dma_addr + (i * MTK_QDMA_PAGE_SIZE));
                 if (i < cnt - 1)
-                        eth->scratch_ring[i].txd2 = (phy_ring_head +
+                        eth->scratch_ring[i].txd2 = (eth->phy_scratch_ring +
                                 ((i + 1) * sizeof(struct mtk_tx_dma)));
                 eth->scratch_ring[i].txd3 = TX_DMA_SDL(MTK_QDMA_PAGE_SIZE);
         }
 
-        mtk_w32(eth, phy_ring_head, MTK_QDMA_FQ_HEAD);
+        mtk_w32(eth, eth->phy_scratch_ring, MTK_QDMA_FQ_HEAD);
         mtk_w32(eth, phy_ring_tail, MTK_QDMA_FQ_TAIL);
         mtk_w32(eth, (cnt << 16) | cnt, MTK_QDMA_FQ_CNT);
         mtk_w32(eth, MTK_QDMA_PAGE_SIZE << 16, MTK_QDMA_FQ_BLEN);
@@ -643,7 +674,7 @@ static int mtk_tx_map(struct sk_buff *skb, struct net_device *dev,
 
 err_dma:
         do {
-                tx_buf = mtk_desc_to_tx_buf(ring, txd);
+                tx_buf = mtk_desc_to_tx_buf(ring, itxd);
 
                 /* unmap dma */
                 mtk_tx_unmap(&dev->dev, tx_buf);
@@ -673,6 +704,20 @@ static inline int mtk_cal_txd_req(struct sk_buff *skb)
         return nfrags;
 }
 
+static int mtk_queue_stopped(struct mtk_eth *eth)
+{
+        int i;
+
+        for (i = 0; i < MTK_MAC_COUNT; i++) {
+                if (!eth->netdev[i])
+                        continue;
+                if (netif_queue_stopped(eth->netdev[i]))
+                        return 1;
+        }
+
+        return 0;
+}
+
 static void mtk_wake_queue(struct mtk_eth *eth)
 {
         int i;
@@ -738,12 +783,9 @@ static int mtk_start_xmit(struct sk_buff *skb, struct net_device *dev)
         if (mtk_tx_map(skb, dev, tx_num, ring, gso) < 0)
                 goto drop;
 
-        if (unlikely(atomic_read(&ring->free_count) <= ring->thresh)) {
+        if (unlikely(atomic_read(&ring->free_count) <= ring->thresh))
                 mtk_stop_queue(eth);
-                if (unlikely(atomic_read(&ring->free_count) >
-                             ring->thresh))
-                        mtk_wake_queue(eth);
-        }
+
         spin_unlock_irqrestore(&eth->page_lock, flags);
 
         return NETDEV_TX_OK;
@@ -798,6 +840,7 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget,
                                           DMA_FROM_DEVICE);
                 if (unlikely(dma_mapping_error(&netdev->dev, dma_addr))) {
                         skb_free_frag(new_data);
+                        netdev->stats.rx_dropped++;
                         goto release_desc;
                 }
 
@@ -805,6 +848,7 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget,
                 skb = build_skb(data, ring->frag_size);
                 if (unlikely(!skb)) {
                         put_page(virt_to_head_page(new_data));
+                        netdev->stats.rx_dropped++;
                         goto release_desc;
                 }
                 skb_reserve(skb, NET_SKB_PAD + NET_IP_ALIGN);
@@ -893,7 +937,6 @@ static int mtk_poll_tx(struct mtk_eth *eth, int budget, bool *tx_again)
                 }
                 mtk_tx_unmap(eth->dev, tx_buf);
 
-                ring->last_free->txd2 = next_cpu;
                 ring->last_free = desc;
                 atomic_inc(&ring->free_count);
 
@@ -918,7 +961,8 @@ static int mtk_poll_tx(struct mtk_eth *eth, int budget, bool *tx_again)
         if (!total)
                 return 0;
 
-        if (atomic_read(&ring->free_count) > ring->thresh)
+        if (mtk_queue_stopped(eth) &&
+            (atomic_read(&ring->free_count) > ring->thresh))
                 mtk_wake_queue(eth);
 
         return total;
@@ -999,9 +1043,8 @@ static int mtk_tx_alloc(struct mtk_eth *eth)
 
         atomic_set(&ring->free_count, MTK_DMA_SIZE - 2);
         ring->next_free = &ring->dma[0];
-        ring->last_free = &ring->dma[MTK_DMA_SIZE - 2];
-        ring->thresh = max((unsigned long)MTK_DMA_SIZE >> 2,
-                              MAX_SKB_FRAGS);
+        ring->last_free = &ring->dma[MTK_DMA_SIZE - 1];
+        ring->thresh = MAX_SKB_FRAGS;
 
         /* make sure that all changes to the dma ring are flushed before we
          * continue
@@ -1179,6 +1222,14 @@ static void mtk_dma_free(struct mtk_eth *eth)
         for (i = 0; i < MTK_MAC_COUNT; i++)
                 if (eth->netdev[i])
                         netdev_reset_queue(eth->netdev[i]);
+        if (eth->scratch_ring) {
+                dma_free_coherent(eth->dev,
+                                  MTK_DMA_SIZE * sizeof(struct mtk_tx_dma),
+                                  eth->scratch_ring,
+                                  eth->phy_scratch_ring);
+                eth->scratch_ring = NULL;
+                eth->phy_scratch_ring = 0;
+        }
         mtk_tx_clean(eth);
         mtk_rx_clean(eth);
         kfree(eth->scratch_head);
@@ -1241,7 +1292,7 @@ static int mtk_start_dma(struct mtk_eth *eth)
         mtk_w32(eth,
                 MTK_TX_WB_DDONE | MTK_RX_DMA_EN | MTK_TX_DMA_EN |
                 MTK_RX_2B_OFFSET | MTK_DMA_SIZE_16DWORDS |
-                MTK_RX_BT_32DWORDS,
+                MTK_RX_BT_32DWORDS | MTK_NDP_CO_PRO,
                 MTK_QDMA_GLO_CFG);
 
         return 0;
@@ -1355,7 +1406,7 @@ static int __init mtk_hw_init(struct mtk_eth *eth)
 
         /* disable delay and normal interrupt */
         mtk_w32(eth, 0, MTK_QDMA_DELAY_INT);
-        mtk_irq_disable(eth, MTK_TX_DONE_INT | MTK_RX_DONE_INT);
+        mtk_irq_disable(eth, ~0);
         mtk_w32(eth, RST_GL_PSE, MTK_RST_GL);
         mtk_w32(eth, 0, MTK_RST_GL);
 
@@ -1669,7 +1720,7 @@ static int mtk_add_mac(struct mtk_eth *eth, struct device_node *np)
         mac->hw_stats->reg_offset = id * MTK_STAT_OFFSET;
 
         SET_NETDEV_DEV(eth->netdev[id], eth->dev);
-        eth->netdev[id]->watchdog_timeo = HZ;
+        eth->netdev[id]->watchdog_timeo = 5 * HZ;
         eth->netdev[id]->netdev_ops = &mtk_netdev_ops;
         eth->netdev[id]->base_addr = (unsigned long)eth->base;
         eth->netdev[id]->vlan_features = MTK_HW_FEATURES &
diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.h b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
index eed626d56ea4..a5eb7c62306b 100644
--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
@@ -91,6 +91,7 @@
 #define MTK_QDMA_GLO_CFG        0x1A04
 #define MTK_RX_2B_OFFSET        BIT(31)
 #define MTK_RX_BT_32DWORDS      (3 << 11)
+#define MTK_NDP_CO_PRO          BIT(10)
 #define MTK_TX_WB_DDONE         BIT(6)
 #define MTK_DMA_SIZE_16DWORDS   (2 << 4)
 #define MTK_RX_DMA_BUSY         BIT(3)
@@ -357,6 +358,7 @@ struct mtk_rx_ring {
  * @rx_ring:            Pointer to the memore holding info about the RX ring
  * @rx_napi:            The NAPI struct
  * @scratch_ring:       Newer SoCs need memory for a second HW managed TX ring
+ * @phy_scratch_ring:   physical address of scratch_ring
  * @scratch_head:       The scratch memory that scratch_ring points to.
  * @clk_ethif:          The ethif clock
  * @clk_esw:            The switch clock
@@ -384,6 +386,7 @@ struct mtk_eth {
         struct mtk_rx_ring              rx_ring;
         struct napi_struct              rx_napi;
         struct mtk_tx_dma               *scratch_ring;
+        dma_addr_t                      phy_scratch_ring;
         void                            *scratch_head;
         struct clk                      *clk_ethif;
         struct clk                      *clk_esw;
diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c b/drivers/net/ethernet/mellanox/mlx4/cmd.c
index e94ca1c3fc7c..f04a423ff79d 100644
--- a/drivers/net/ethernet/mellanox/mlx4/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c
@@ -2597,7 +2597,6 @@ int mlx4_cmd_use_events(struct mlx4_dev *dev)
         priv->cmd.free_head = 0;
 
         sema_init(&priv->cmd.event_sem, priv->cmd.max_cmds);
-        spin_lock_init(&priv->cmd.context_lock);
 
         for (priv->cmd.token_mask = 1;
              priv->cmd.token_mask < priv->cmd.max_cmds;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 19ceced6736c..0c0dfd6cdca6 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -406,14 +406,18 @@ static int mlx4_en_vlan_rx_add_vid(struct net_device *dev,
         mutex_lock(&mdev->state_lock);
         if (mdev->device_up && priv->port_up) {
                 err = mlx4_SET_VLAN_FLTR(mdev->dev, priv);
-                if (err)
+                if (err) {
                         en_err(priv, "Failed configuring VLAN filter\n");
+                        goto out;
+                }
         }
-        if (mlx4_register_vlan(mdev->dev, priv->port, vid, &idx))
-                en_dbg(HW, priv, "failed adding vlan %d\n", vid);
-        mutex_unlock(&mdev->state_lock);
+        err = mlx4_register_vlan(mdev->dev, priv->port, vid, &idx);
+        if (err)
+                en_dbg(HW, priv, "Failed adding vlan %d\n", vid);
 
-        return 0;
+out:
+        mutex_unlock(&mdev->state_lock);
+        return err;
 }
 
 static int mlx4_en_vlan_rx_kill_vid(struct net_device *dev,
@@ -421,7 +425,7 @@ static int mlx4_en_vlan_rx_kill_vid(struct net_device *dev,
 {
         struct mlx4_en_priv *priv = netdev_priv(dev);
         struct mlx4_en_dev *mdev = priv->mdev;
-        int err;
+        int err = 0;
 
         en_dbg(HW, priv, "Killing VID:%d\n", vid);
 
@@ -438,7 +442,7 @@ static int mlx4_en_vlan_rx_kill_vid(struct net_device *dev,
         }
         mutex_unlock(&mdev->state_lock);
 
-        return 0;
+        return err;
 }
 
 static void mlx4_en_u64_to_mac(unsigned char dst_mac[ETH_ALEN + 2], u64 src_mac)
@@ -2032,11 +2036,20 @@ err:
         return -ENOMEM;
 }
 
+static void mlx4_en_shutdown(struct net_device *dev)
+{
+        rtnl_lock();
+        netif_device_detach(dev);
+        mlx4_en_close(dev);
+        rtnl_unlock();
+}
 
 void mlx4_en_destroy_netdev(struct net_device *dev)
 {
         struct mlx4_en_priv *priv = netdev_priv(dev);
         struct mlx4_en_dev *mdev = priv->mdev;
+        bool shutdown = mdev->dev->persist->interface_state &
+                                            MLX4_INTERFACE_STATE_SHUTDOWN;
 
         en_dbg(DRV, priv, "Destroying netdev on port:%d\n", priv->port);
 
@@ -2044,7 +2057,10 @@ void mlx4_en_destroy_netdev(struct net_device *dev)
         if (priv->registered) {
                 devlink_port_type_clear(mlx4_get_devlink_port(mdev->dev,
                                                               priv->port));
-                unregister_netdev(dev);
+                if (shutdown)
+                        mlx4_en_shutdown(dev);
+                else
+                        unregister_netdev(dev);
         }
 
         if (priv->allocated)
@@ -2069,7 +2085,8 @@ void mlx4_en_destroy_netdev(struct net_device *dev)
         kfree(priv->tx_ring);
         kfree(priv->tx_cq);
 
-        free_netdev(dev);
+        if (!shutdown)
+                free_netdev(dev);
 }
 
 static int mlx4_en_change_mtu(struct net_device *dev, int new_mtu)
@@ -2447,9 +2464,14 @@ static netdev_features_t mlx4_en_features_check(struct sk_buff *skb,
          * strip that feature if this is an IPv6 encapsulated frame.
          */
         if (skb->encapsulation &&
-            (skb->ip_summed == CHECKSUM_PARTIAL) &&
-            (ip_hdr(skb)->version != 4))
-                features &= ~(NETIF_F_CSUM_MASK | NETIF_F_GSO_MASK);
+            (skb->ip_summed == CHECKSUM_PARTIAL)) {
+                struct mlx4_en_priv *priv = netdev_priv(dev);
+
+                if (!priv->vxlan_port ||
+                    (ip_hdr(skb)->version != 4) ||
+                    (udp_hdr(skb)->dest != priv->vxlan_port))
+                        features &= ~(NETIF_F_CSUM_MASK | NETIF_F_GSO_MASK);
+        }
 
         return features;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 12c77a70abdb..546fab0ecc3b 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -3222,6 +3222,7 @@ static int mlx4_load_one(struct pci_dev *pdev, int pci_dev_data,
 
         INIT_LIST_HEAD(&priv->pgdir_list);
         mutex_init(&priv->pgdir_mutex);
+        spin_lock_init(&priv->cmd.context_lock);
 
         INIT_LIST_HEAD(&priv->bf_list);
         mutex_init(&priv->bf_mutex);
@@ -4134,8 +4135,11 @@ static void mlx4_shutdown(struct pci_dev *pdev)
 
         mlx4_info(persist->dev, "mlx4_shutdown was called\n");
         mutex_lock(&persist->interface_state_mutex);
-        if (persist->interface_state & MLX4_INTERFACE_STATE_UP)
+        if (persist->interface_state & MLX4_INTERFACE_STATE_UP) {
+                /* Notify mlx4 clients that the kernel is being shut down */
+                persist->interface_state |= MLX4_INTERFACE_STATE_SHUTDOWN;
                 mlx4_unload_one(pdev);
+        }
         mutex_unlock(&persist->interface_state_mutex);
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index dcd2df6518de..0b4986268cc9 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -545,6 +545,7 @@ const char *mlx5_command_str(int command)
         MLX5_COMMAND_STR_CASE(ALLOC_FLOW_COUNTER);
         MLX5_COMMAND_STR_CASE(DEALLOC_FLOW_COUNTER);
         MLX5_COMMAND_STR_CASE(QUERY_FLOW_COUNTER);
+        MLX5_COMMAND_STR_CASE(MODIFY_FLOW_TABLE);
         default: return "unknown command opcode";
         }
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
index e8a6c3325b39..baa991a23475 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
@@ -401,7 +401,7 @@ enum mlx5e_traffic_types {
 };
 
 enum {
-        MLX5E_STATE_ASYNC_EVENTS_ENABLE,
+        MLX5E_STATE_ASYNC_EVENTS_ENABLED,
         MLX5E_STATE_OPENED,
         MLX5E_STATE_DESTROYING,
 };
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
index fc7dcc03b1de..e667a870e0c2 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
@@ -184,7 +184,9 @@ static unsigned long mlx5e_query_pfc_combined(struct mlx5e_priv *priv)
 #define MLX5E_NUM_SQ_STATS(priv) \
         (NUM_SQ_STATS * priv->params.num_channels * priv->params.num_tc * \
          test_bit(MLX5E_STATE_OPENED, &priv->state))
-#define MLX5E_NUM_PFC_COUNTERS(priv) hweight8(mlx5e_query_pfc_combined(priv))
+#define MLX5E_NUM_PFC_COUNTERS(priv) \
+        (hweight8(mlx5e_query_pfc_combined(priv)) * \
+         NUM_PPORT_PER_PRIO_PFC_COUNTERS)
 
 static int mlx5e_get_sset_count(struct net_device *dev, int sset)
 {
@@ -211,42 +213,41 @@ static void mlx5e_fill_stats_strings(struct mlx5e_priv *priv, uint8_t *data)
 
         /* SW counters */
         for (i = 0; i < NUM_SW_COUNTERS; i++)
-                strcpy(data + (idx++) * ETH_GSTRING_LEN, sw_stats_desc[i].name);
+                strcpy(data + (idx++) * ETH_GSTRING_LEN, sw_stats_desc[i].format);
 
         /* Q counters */
         for (i = 0; i < MLX5E_NUM_Q_CNTRS(priv); i++)
-                strcpy(data + (idx++) * ETH_GSTRING_LEN, q_stats_desc[i].name);
+                strcpy(data + (idx++) * ETH_GSTRING_LEN, q_stats_desc[i].format);
 
         /* VPORT counters */
         for (i = 0; i < NUM_VPORT_COUNTERS; i++)
                 strcpy(data + (idx++) * ETH_GSTRING_LEN,
-                       vport_stats_desc[i].name);
+                       vport_stats_desc[i].format);
 
         /* PPORT counters */
         for (i = 0; i < NUM_PPORT_802_3_COUNTERS; i++)
                 strcpy(data + (idx++) * ETH_GSTRING_LEN,
-                       pport_802_3_stats_desc[i].name);
+                       pport_802_3_stats_desc[i].format);
 
         for (i = 0; i < NUM_PPORT_2863_COUNTERS; i++)
                 strcpy(data + (idx++) * ETH_GSTRING_LEN,
-                       pport_2863_stats_desc[i].name);
+                       pport_2863_stats_desc[i].format);
 
         for (i = 0; i < NUM_PPORT_2819_COUNTERS; i++)
                 strcpy(data + (idx++) * ETH_GSTRING_LEN,
-                       pport_2819_stats_desc[i].name);
+                       pport_2819_stats_desc[i].format);
 
         for (prio = 0; prio < NUM_PPORT_PRIO; prio++) {
                 for (i = 0; i < NUM_PPORT_PER_PRIO_TRAFFIC_COUNTERS; i++)
-                        sprintf(data + (idx++) * ETH_GSTRING_LEN, "prio%d_%s",
-                                prio,
-                                pport_per_prio_traffic_stats_desc[i].name);
+                        sprintf(data + (idx++) * ETH_GSTRING_LEN,
+                                pport_per_prio_traffic_stats_desc[i].format, prio);
         }
 
         pfc_combined = mlx5e_query_pfc_combined(priv);
         for_each_set_bit(prio, &pfc_combined, NUM_PPORT_PRIO) {
                 for (i = 0; i < NUM_PPORT_PER_PRIO_PFC_COUNTERS; i++) {
-                        sprintf(data + (idx++) * ETH_GSTRING_LEN, "prio%d_%s",
-                                prio, pport_per_prio_pfc_stats_desc[i].name);
+                        sprintf(data + (idx++) * ETH_GSTRING_LEN,
+                                pport_per_prio_pfc_stats_desc[i].format, prio);
                 }
         }
 
@@ -256,16 +257,15 @@ static void mlx5e_fill_stats_strings(struct mlx5e_priv *priv, uint8_t *data)
         /* per channel counters */
         for (i = 0; i < priv->params.num_channels; i++)
                 for (j = 0; j < NUM_RQ_STATS; j++)
-                        sprintf(data + (idx++) * ETH_GSTRING_LEN, "rx%d_%s", i,
-                                rq_stats_desc[j].name);
+                        sprintf(data + (idx++) * ETH_GSTRING_LEN,
+                                rq_stats_desc[j].format, i);
 
         for (tc = 0; tc < priv->params.num_tc; tc++)
                 for (i = 0; i < priv->params.num_channels; i++)
                         for (j = 0; j < NUM_SQ_STATS; j++)
                                 sprintf(data + (idx++) * ETH_GSTRING_LEN,
-                                        "tx%d_%s",
-                                        priv->channeltc_to_txq_map[i][tc],
-                                        sq_stats_desc[j].name);
+                                        sq_stats_desc[j].format,
+                                        priv->channeltc_to_txq_map[i][tc]);
 }
 
 static void mlx5e_get_strings(struct net_device *dev,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index fd4392999eee..cb6defd71fc1 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -105,11 +105,11 @@ static void mlx5e_update_sw_counters(struct mlx5e_priv *priv)
 
                 s->rx_packets   += rq_stats->packets;
                 s->rx_bytes     += rq_stats->bytes;
-                s->lro_packets  += rq_stats->lro_packets;
-                s->lro_bytes    += rq_stats->lro_bytes;
+                s->rx_lro_packets += rq_stats->lro_packets;
+                s->rx_lro_bytes += rq_stats->lro_bytes;
                 s->rx_csum_none += rq_stats->csum_none;
-                s->rx_csum_sw   += rq_stats->csum_sw;
-                s->rx_csum_inner += rq_stats->csum_inner;
+                s->rx_csum_complete += rq_stats->csum_complete;
+                s->rx_csum_unnecessary_inner += rq_stats->csum_unnecessary_inner;
                 s->rx_wqe_err   += rq_stats->wqe_err;
                 s->rx_mpwqe_filler += rq_stats->mpwqe_filler;
                 s->rx_mpwqe_frag   += rq_stats->mpwqe_frag;
@@ -122,24 +122,23 @@ static void mlx5e_update_sw_counters(struct mlx5e_priv *priv)
 
                         s->tx_packets           += sq_stats->packets;
                         s->tx_bytes             += sq_stats->bytes;
-                        s->tso_packets          += sq_stats->tso_packets;
-                        s->tso_bytes            += sq_stats->tso_bytes;
-                        s->tso_inner_packets    += sq_stats->tso_inner_packets;
-                        s->tso_inner_bytes      += sq_stats->tso_inner_bytes;
+                        s->tx_tso_packets       += sq_stats->tso_packets;
+                        s->tx_tso_bytes         += sq_stats->tso_bytes;
+                        s->tx_tso_inner_packets += sq_stats->tso_inner_packets;
+                        s->tx_tso_inner_bytes   += sq_stats->tso_inner_bytes;
                         s->tx_queue_stopped     += sq_stats->stopped;
                         s->tx_queue_wake        += sq_stats->wake;
                         s->tx_queue_dropped     += sq_stats->dropped;
-                        s->tx_csum_inner        += sq_stats->csum_offload_inner;
-                        tx_offload_none         += sq_stats->csum_offload_none;
+                        s->tx_csum_partial_inner += sq_stats->csum_partial_inner;
+                        tx_offload_none         += sq_stats->csum_none;
                 }
         }
 
         /* Update calculated offload counters */
-        s->tx_csum_offload = s->tx_packets - tx_offload_none - s->tx_csum_inner;
-        s->rx_csum_good    = s->rx_packets - s->rx_csum_none -
-                             s->rx_csum_sw;
+        s->tx_csum_partial = s->tx_packets - tx_offload_none - s->tx_csum_partial_inner;
+        s->rx_csum_unnecessary = s->rx_packets - s->rx_csum_none - s->rx_csum_complete;
 
-        s->link_down_events = MLX5_GET(ppcnt_reg,
+        s->link_down_events_phy = MLX5_GET(ppcnt_reg,
                                 priv->stats.pport.phy_counters,
                                 counter_set.phys_layer_cntrs.link_down_events);
 }
@@ -244,7 +243,7 @@ static void mlx5e_async_event(struct mlx5_core_dev *mdev, void *vpriv,
 {
         struct mlx5e_priv *priv = vpriv;
 
-        if (!test_bit(MLX5E_STATE_ASYNC_EVENTS_ENABLE, &priv->state))
+        if (!test_bit(MLX5E_STATE_ASYNC_EVENTS_ENABLED, &priv->state))
                 return;
 
         switch (event) {
@@ -260,12 +259,12 @@ static void mlx5e_async_event(struct mlx5_core_dev *mdev, void *vpriv,
 
 static void mlx5e_enable_async_events(struct mlx5e_priv *priv)
 {
-        set_bit(MLX5E_STATE_ASYNC_EVENTS_ENABLE, &priv->state);
+        set_bit(MLX5E_STATE_ASYNC_EVENTS_ENABLED, &priv->state);
 }
 
 static void mlx5e_disable_async_events(struct mlx5e_priv *priv)
 {
-        clear_bit(MLX5E_STATE_ASYNC_EVENTS_ENABLE, &priv->state);
+        clear_bit(MLX5E_STATE_ASYNC_EVENTS_ENABLED, &priv->state);
         synchronize_irq(mlx5_get_msix_vec(priv->mdev, MLX5_EQ_VEC_ASYNC));
 }
 
@@ -580,7 +579,7 @@ static int mlx5e_create_sq(struct mlx5e_channel *c,
         void *sqc_wq = MLX5_ADDR_OF(sqc, sqc, wq);
         int err;
 
-        err = mlx5_alloc_map_uar(mdev, &sq->uar, true);
+        err = mlx5_alloc_map_uar(mdev, &sq->uar, !!MLX5_CAP_GEN(mdev, bf));
         if (err)
                 return err;
 
@@ -3192,10 +3191,7 @@ static void mlx5e_destroy_netdev(struct mlx5_core_dev *mdev, void *vpriv)
         flush_workqueue(priv->wq);
         if (test_bit(MLX5_INTERFACE_STATE_SHUTDOWN, &mdev->intf_state)) {
                 netif_device_detach(netdev);
-                mutex_lock(&priv->state_lock);
-                if (test_bit(MLX5E_STATE_OPENED, &priv->state))
-                        mlx5e_close_locked(netdev);
-                mutex_unlock(&priv->state_lock);
+                mlx5e_close(netdev);
         } else {
                 unregister_netdev(netdev);
         }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
index bd947704b59c..022acc2e8922 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -689,7 +689,7 @@ static inline void mlx5e_handle_csum(struct net_device *netdev,
         if (is_first_ethertype_ip(skb)) {
                 skb->ip_summed = CHECKSUM_COMPLETE;
                 skb->csum = csum_unfold((__force __sum16)cqe->check_sum);
-                rq->stats.csum_sw++;
+                rq->stats.csum_complete++;
                 return;
         }
 
@@ -699,7 +699,7 @@ static inline void mlx5e_handle_csum(struct net_device *netdev,
                 if (cqe_is_tunneled(cqe)) {
                         skb->csum_level = 1;
                         skb->encapsulation = 1;
-                        rq->stats.csum_inner++;
+                        rq->stats.csum_unnecessary_inner++;
                 }
                 return;
         }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
index 83bc32b25849..fcd490cc5610 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
@@ -42,9 +42,11 @@
         be64_to_cpu(*(__be32 *)((char *)ptr + dsc[i].offset))
 
 #define MLX5E_DECLARE_STAT(type, fld) #fld, offsetof(type, fld)
+#define MLX5E_DECLARE_RX_STAT(type, fld) "rx%d_"#fld, offsetof(type, fld)
+#define MLX5E_DECLARE_TX_STAT(type, fld) "tx%d_"#fld, offsetof(type, fld)
 
 struct counter_desc {
-        char            name[ETH_GSTRING_LEN];
+        char            format[ETH_GSTRING_LEN];
         int             offset; /* Byte offset */
 };
 
@@ -53,18 +55,18 @@ struct mlx5e_sw_stats {
         u64 rx_bytes;
         u64 tx_packets;
         u64 tx_bytes;
-        u64 tso_packets;
-        u64 tso_bytes;
-        u64 tso_inner_packets;
-        u64 tso_inner_bytes;
-        u64 lro_packets;
-        u64 lro_bytes;
-        u64 rx_csum_good;
+        u64 tx_tso_packets;
+        u64 tx_tso_bytes;
+        u64 tx_tso_inner_packets;
+        u64 tx_tso_inner_bytes;
+        u64 rx_lro_packets;
+        u64 rx_lro_bytes;
+        u64 rx_csum_unnecessary;
         u64 rx_csum_none;
-        u64 rx_csum_sw;
-        u64 rx_csum_inner;
-        u64 tx_csum_offload;
-        u64 tx_csum_inner;
+        u64 rx_csum_complete;
+        u64 rx_csum_unnecessary_inner;
+        u64 tx_csum_partial;
+        u64 tx_csum_partial_inner;
         u64 tx_queue_stopped;
         u64 tx_queue_wake;
         u64 tx_queue_dropped;
@@ -76,7 +78,7 @@ struct mlx5e_sw_stats {
         u64 rx_cqe_compress_pkts;
 
         /* Special handling counters */
-        u64 link_down_events;
+        u64 link_down_events_phy;
 };
 
 static const struct counter_desc sw_stats_desc[] = {
@@ -84,18 +86,18 @@ static const struct counter_desc sw_stats_desc[] = {
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_bytes) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_packets) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_bytes) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tso_packets) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tso_bytes) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tso_inner_packets) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tso_inner_bytes) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, lro_packets) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, lro_bytes) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_csum_good) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_tso_packets) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_tso_bytes) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_tso_inner_packets) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_tso_inner_bytes) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_lro_packets) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_lro_bytes) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_csum_unnecessary) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_csum_none) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_csum_sw) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_csum_inner) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_csum_offload) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_csum_inner) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_csum_complete) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_csum_unnecessary_inner) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_csum_partial) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_csum_partial_inner) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_queue_stopped) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_queue_wake) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_queue_dropped) },
@@ -105,7 +107,7 @@ static const struct counter_desc sw_stats_desc[] = {
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_buff_alloc_err) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_cqe_compress_blks) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_cqe_compress_pkts) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, link_down_events) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, link_down_events_phy) },
 };
 
 struct mlx5e_qcounter_stats {
@@ -125,12 +127,6 @@ struct mlx5e_vport_stats {
 };
 
 static const struct counter_desc vport_stats_desc[] = {
-        { "rx_vport_error_packets",
-                VPORT_COUNTER_OFF(received_errors.packets) },
-        { "rx_vport_error_bytes", VPORT_COUNTER_OFF(received_errors.octets) },
-        { "tx_vport_error_packets",
-                VPORT_COUNTER_OFF(transmit_errors.packets) },
-        { "tx_vport_error_bytes", VPORT_COUNTER_OFF(transmit_errors.octets) },
         { "rx_vport_unicast_packets",
                 VPORT_COUNTER_OFF(received_eth_unicast.packets) },
         { "rx_vport_unicast_bytes",
@@ -192,94 +188,68 @@ struct mlx5e_pport_stats {
 };
 
 static const struct counter_desc pport_802_3_stats_desc[] = {
-        { "frames_tx", PPORT_802_3_OFF(a_frames_transmitted_ok) },
-        { "frames_rx", PPORT_802_3_OFF(a_frames_received_ok) },
-        { "check_seq_err", PPORT_802_3_OFF(a_frame_check_sequence_errors) },
-        { "alignment_err", PPORT_802_3_OFF(a_alignment_errors) },
-        { "octets_tx", PPORT_802_3_OFF(a_octets_transmitted_ok) },
-        { "octets_received", PPORT_802_3_OFF(a_octets_received_ok) },
-        { "multicast_xmitted", PPORT_802_3_OFF(a_multicast_frames_xmitted_ok) },
-        { "broadcast_xmitted", PPORT_802_3_OFF(a_broadcast_frames_xmitted_ok) },
-        { "multicast_rx", PPORT_802_3_OFF(a_multicast_frames_received_ok) },
-        { "broadcast_rx", PPORT_802_3_OFF(a_broadcast_frames_received_ok) },
-        { "in_range_len_errors", PPORT_802_3_OFF(a_in_range_length_errors) },
-        { "out_of_range_len", PPORT_802_3_OFF(a_out_of_range_length_field) },
-        { "too_long_errors", PPORT_802_3_OFF(a_frame_too_long_errors) },
-        { "symbol_err", PPORT_802_3_OFF(a_symbol_error_during_carrier) },
-        { "mac_control_tx", PPORT_802_3_OFF(a_mac_control_frames_transmitted) },
-        { "mac_control_rx", PPORT_802_3_OFF(a_mac_control_frames_received) },
-        { "unsupported_op_rx",
-                PPORT_802_3_OFF(a_unsupported_opcodes_received) },
-        { "pause_ctrl_rx", PPORT_802_3_OFF(a_pause_mac_ctrl_frames_received) },
-        { "pause_ctrl_tx",
-                PPORT_802_3_OFF(a_pause_mac_ctrl_frames_transmitted) },
+        { "tx_packets_phy", PPORT_802_3_OFF(a_frames_transmitted_ok) },
+        { "rx_packets_phy", PPORT_802_3_OFF(a_frames_received_ok) },
+        { "rx_crc_errors_phy", PPORT_802_3_OFF(a_frame_check_sequence_errors) },
+        { "tx_bytes_phy", PPORT_802_3_OFF(a_octets_transmitted_ok) },
+        { "rx_bytes_phy", PPORT_802_3_OFF(a_octets_received_ok) },
+        { "tx_multicast_phy", PPORT_802_3_OFF(a_multicast_frames_xmitted_ok) },
+        { "tx_broadcast_phy", PPORT_802_3_OFF(a_broadcast_frames_xmitted_ok) },
+        { "rx_multicast_phy", PPORT_802_3_OFF(a_multicast_frames_received_ok) },
+        { "rx_broadcast_phy", PPORT_802_3_OFF(a_broadcast_frames_received_ok) },
+        { "rx_in_range_len_errors_phy", PPORT_802_3_OFF(a_in_range_length_errors) },
+        { "rx_out_of_range_len_phy", PPORT_802_3_OFF(a_out_of_range_length_field) },
+        { "rx_oversize_pkts_phy", PPORT_802_3_OFF(a_frame_too_long_errors) },
+        { "rx_symbol_err_phy", PPORT_802_3_OFF(a_symbol_error_during_carrier) },
+        { "tx_mac_control_phy", PPORT_802_3_OFF(a_mac_control_frames_transmitted) },
+        { "rx_mac_control_phy", PPORT_802_3_OFF(a_mac_control_frames_received) },
+        { "rx_unsupported_op_phy", PPORT_802_3_OFF(a_unsupported_opcodes_received) },
+        { "rx_pause_ctrl_phy", PPORT_802_3_OFF(a_pause_mac_ctrl_frames_received) },
+        { "tx_pause_ctrl_phy", PPORT_802_3_OFF(a_pause_mac_ctrl_frames_transmitted) },
 };
 
 static const struct counter_desc pport_2863_stats_desc[] = {
-        { "in_octets", PPORT_2863_OFF(if_in_octets) },
-        { "in_ucast_pkts", PPORT_2863_OFF(if_in_ucast_pkts) },
-        { "in_discards", PPORT_2863_OFF(if_in_discards) },
-        { "in_errors", PPORT_2863_OFF(if_in_errors) },
-        { "in_unknown_protos", PPORT_2863_OFF(if_in_unknown_protos) },
-        { "out_octets", PPORT_2863_OFF(if_out_octets) },
-        { "out_ucast_pkts", PPORT_2863_OFF(if_out_ucast_pkts) },
-        { "out_discards", PPORT_2863_OFF(if_out_discards) },
-        { "out_errors", PPORT_2863_OFF(if_out_errors) },
-        { "in_multicast_pkts", PPORT_2863_OFF(if_in_multicast_pkts) },
-        { "in_broadcast_pkts", PPORT_2863_OFF(if_in_broadcast_pkts) },
-        { "out_multicast_pkts", PPORT_2863_OFF(if_out_multicast_pkts) },
-        { "out_broadcast_pkts", PPORT_2863_OFF(if_out_broadcast_pkts) },
+        { "rx_discards_phy", PPORT_2863_OFF(if_in_discards) },
+        { "tx_discards_phy", PPORT_2863_OFF(if_out_discards) },
+        { "tx_errors_phy", PPORT_2863_OFF(if_out_errors) },
 };
 
 static const struct counter_desc pport_2819_stats_desc[] = {
-        { "drop_events", PPORT_2819_OFF(ether_stats_drop_events) },
-        { "octets", PPORT_2819_OFF(ether_stats_octets) },
-        { "pkts", PPORT_2819_OFF(ether_stats_pkts) },
-        { "broadcast_pkts", PPORT_2819_OFF(ether_stats_broadcast_pkts) },
-        { "multicast_pkts", PPORT_2819_OFF(ether_stats_multicast_pkts) },
-        { "crc_align_errors", PPORT_2819_OFF(ether_stats_crc_align_errors) },
-        { "undersize_pkts", PPORT_2819_OFF(ether_stats_undersize_pkts) },
-        { "oversize_pkts", PPORT_2819_OFF(ether_stats_oversize_pkts) },
-        { "fragments", PPORT_2819_OFF(ether_stats_fragments) },
-        { "jabbers", PPORT_2819_OFF(ether_stats_jabbers) },
-        { "collisions", PPORT_2819_OFF(ether_stats_collisions) },
-        { "p64octets", PPORT_2819_OFF(ether_stats_pkts64octets) },
-        { "p65to127octets", PPORT_2819_OFF(ether_stats_pkts65to127octets) },
-        { "p128to255octets", PPORT_2819_OFF(ether_stats_pkts128to255octets) },
-        { "p256to511octets", PPORT_2819_OFF(ether_stats_pkts256to511octets) },
-        { "p512to1023octets", PPORT_2819_OFF(ether_stats_pkts512to1023octets) },
-        { "p1024to1518octets",
-                PPORT_2819_OFF(ether_stats_pkts1024to1518octets) },
-        { "p1519to2047octets",
-                PPORT_2819_OFF(ether_stats_pkts1519to2047octets) },
-        { "p2048to4095octets",
-                PPORT_2819_OFF(ether_stats_pkts2048to4095octets) },
-        { "p4096to8191octets",
-                PPORT_2819_OFF(ether_stats_pkts4096to8191octets) },
-        { "p8192to10239octets",
-                PPORT_2819_OFF(ether_stats_pkts8192to10239octets) },
+        { "rx_undersize_pkts_phy", PPORT_2819_OFF(ether_stats_undersize_pkts) },
+        { "rx_fragments_phy", PPORT_2819_OFF(ether_stats_fragments) },
+        { "rx_jabbers_phy", PPORT_2819_OFF(ether_stats_jabbers) },
+        { "rx_64_bytes_phy", PPORT_2819_OFF(ether_stats_pkts64octets) },
+        { "rx_65_to_127_bytes_phy", PPORT_2819_OFF(ether_stats_pkts65to127octets) },
+        { "rx_128_to_255_bytes_phy", PPORT_2819_OFF(ether_stats_pkts128to255octets) },
+        { "rx_256_to_511_bytes_phy", PPORT_2819_OFF(ether_stats_pkts256to511octets) },
+        { "rx_512_to_1023_bytes_phy", PPORT_2819_OFF(ether_stats_pkts512to1023octets) },
+        { "rx_1024_to_1518_bytes_phy", PPORT_2819_OFF(ether_stats_pkts1024to1518octets) },
+        { "rx_1519_to_2047_bytes_phy", PPORT_2819_OFF(ether_stats_pkts1519to2047octets) },
+        { "rx_2048_to_4095_bytes_phy", PPORT_2819_OFF(ether_stats_pkts2048to4095octets) },
+        { "rx_4096_to_8191_bytes_phy", PPORT_2819_OFF(ether_stats_pkts4096to8191octets) },
+        { "rx_8192_to_10239_bytes_phy", PPORT_2819_OFF(ether_stats_pkts8192to10239octets) },
 };
 
 static const struct counter_desc pport_per_prio_traffic_stats_desc[] = {
-        { "rx_octets", PPORT_PER_PRIO_OFF(rx_octets) },
-        { "rx_frames", PPORT_PER_PRIO_OFF(rx_frames) },
-        { "tx_octets", PPORT_PER_PRIO_OFF(tx_octets) },
-        { "tx_frames", PPORT_PER_PRIO_OFF(tx_frames) },
+        { "rx_prio%d_bytes", PPORT_PER_PRIO_OFF(rx_octets) },
+        { "rx_prio%d_packets", PPORT_PER_PRIO_OFF(rx_frames) },
+        { "tx_prio%d_bytes", PPORT_PER_PRIO_OFF(tx_octets) },
+        { "tx_prio%d_packets", PPORT_PER_PRIO_OFF(tx_frames) },
 };
 
 static const struct counter_desc pport_per_prio_pfc_stats_desc[] = {
-        { "rx_pause", PPORT_PER_PRIO_OFF(rx_pause) },
-        { "rx_pause_duration", PPORT_PER_PRIO_OFF(rx_pause_duration) },
-        { "tx_pause", PPORT_PER_PRIO_OFF(tx_pause) },
-        { "tx_pause_duration", PPORT_PER_PRIO_OFF(tx_pause_duration) },
-        { "rx_pause_transition", PPORT_PER_PRIO_OFF(rx_pause_transition) },
+        { "rx_prio%d_pause", PPORT_PER_PRIO_OFF(rx_pause) },
+        { "rx_prio%d_pause_duration", PPORT_PER_PRIO_OFF(rx_pause_duration) },
+        { "tx_prio%d_pause", PPORT_PER_PRIO_OFF(tx_pause) },
+        { "tx_prio%d_pause_duration", PPORT_PER_PRIO_OFF(tx_pause_duration) },
+        { "rx_prio%d_pause_transition", PPORT_PER_PRIO_OFF(rx_pause_transition) },
 };
 
 struct mlx5e_rq_stats {
         u64 packets;
         u64 bytes;
-        u64 csum_sw;
-        u64 csum_inner;
+        u64 csum_complete;
+        u64 csum_unnecessary_inner;
         u64 csum_none;
         u64 lro_packets;
         u64 lro_bytes;
@@ -292,19 +262,19 @@ struct mlx5e_rq_stats {
 };
 
 static const struct counter_desc rq_stats_desc[] = {
-        { MLX5E_DECLARE_STAT(struct mlx5e_rq_stats, packets) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_rq_stats, bytes) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_rq_stats, csum_sw) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_rq_stats, csum_inner) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_rq_stats, csum_none) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_rq_stats, lro_packets) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_rq_stats, lro_bytes) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_rq_stats, wqe_err) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_rq_stats, mpwqe_filler) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_rq_stats, mpwqe_frag) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_rq_stats, buff_alloc_err) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_rq_stats, cqe_compress_blks) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_rq_stats, cqe_compress_pkts) },
+        { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, packets) },
+        { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, bytes) },
+        { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, csum_complete) },
+        { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, csum_unnecessary_inner) },
+        { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, csum_none) },
+        { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, lro_packets) },
+        { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, lro_bytes) },
+        { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, wqe_err) },
+        { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, mpwqe_filler) },
+        { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, mpwqe_frag) },
+        { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, buff_alloc_err) },
+        { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, cqe_compress_blks) },
+        { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, cqe_compress_pkts) },
 };
 
 struct mlx5e_sq_stats {
@@ -315,28 +285,28 @@ struct mlx5e_sq_stats {
         u64 tso_bytes;
         u64 tso_inner_packets;
         u64 tso_inner_bytes;
-        u64 csum_offload_inner;
+        u64 csum_partial_inner;
         u64 nop;
         /* less likely accessed in data path */
-        u64 csum_offload_none;
+        u64 csum_none;
         u64 stopped;
         u64 wake;
         u64 dropped;
 };
 
 static const struct counter_desc sq_stats_desc[] = {
-        { MLX5E_DECLARE_STAT(struct mlx5e_sq_stats, packets) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sq_stats, bytes) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sq_stats, tso_packets) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sq_stats, tso_bytes) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sq_stats, tso_inner_packets) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sq_stats, tso_inner_bytes) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sq_stats, csum_offload_inner) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sq_stats, nop) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sq_stats, csum_offload_none) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sq_stats, stopped) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sq_stats, wake) },
-        { MLX5E_DECLARE_STAT(struct mlx5e_sq_stats, dropped) },
+        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, packets) },
+        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, bytes) },
+        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, tso_packets) },
+        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, tso_bytes) },
+        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, tso_inner_packets) },
+        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, tso_inner_bytes) },
+        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, csum_partial_inner) },
+        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, nop) },
+        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, csum_none) },
+        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, stopped) },
+        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, wake) },
+        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, dropped) },
 };
 
 #define NUM_SW_COUNTERS                 ARRAY_SIZE(sw_stats_desc)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
index 229ab16fb8d3..5a750b9cd006 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
@@ -192,12 +192,12 @@ static netdev_tx_t mlx5e_sq_xmit(struct mlx5e_sq *sq, struct sk_buff *skb)
                 if (skb->encapsulation) {
                         eseg->cs_flags |= MLX5_ETH_WQE_L3_INNER_CSUM |
                                           MLX5_ETH_WQE_L4_INNER_CSUM;
-                        sq->stats.csum_offload_inner++;
+                        sq->stats.csum_partial_inner++;
                 } else {
                         eseg->cs_flags |= MLX5_ETH_WQE_L4_CSUM;
                 }
         } else
-                sq->stats.csum_offload_none++;
+                sq->stats.csum_none++;
 
         if (sq->cc != sq->prev_cc) {
                 sq->prev_cc = sq->cc;
@@ -317,7 +317,8 @@ static netdev_tx_t mlx5e_sq_xmit(struct mlx5e_sq *sq, struct sk_buff *skb)
         while ((sq->pc & wq->sz_m1) > sq->edge)
                 mlx5e_send_nop(sq, false);
 
-        sq->bf_budget = bf ? sq->bf_budget - 1 : 0;
+        if (bf)
+                sq->bf_budget--;
 
         sq->stats.packets++;
         sq->stats.bytes += num_bytes;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
index b84a6918a700..aebbd6ccb9fe 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
@@ -383,7 +383,7 @@ __esw_fdb_set_vport_rule(struct mlx5_eswitch *esw, u32 vport, bool rx_rule,
                                    match_v,
                                    MLX5_FLOW_CONTEXT_ACTION_FWD_DEST,
                                    0, &dest);
-        if (IS_ERR_OR_NULL(flow_rule)) {
+        if (IS_ERR(flow_rule)) {
                 pr_warn(
                         "FDB: Failed to add flow rule: dmac_v(%pM) dmac_c(%pM) -> vport(%d), err(%ld)\n",
                          dmac_v, dmac_c, vport, PTR_ERR(flow_rule));
@@ -457,7 +457,7 @@ static int esw_create_fdb_table(struct mlx5_eswitch *esw, int nvports)
 
         table_size = BIT(MLX5_CAP_ESW_FLOWTABLE_FDB(dev, log_max_ft_size));
         fdb = mlx5_create_flow_table(root_ns, 0, table_size, 0);
-        if (IS_ERR_OR_NULL(fdb)) {
+        if (IS_ERR(fdb)) {
                 err = PTR_ERR(fdb);
                 esw_warn(dev, "Failed to create FDB Table err %d\n", err);
                 goto out;
@@ -474,7 +474,7 @@ static int esw_create_fdb_table(struct mlx5_eswitch *esw, int nvports)
         MLX5_SET(create_flow_group_in, flow_group_in, end_flow_index, table_size - 3);
         eth_broadcast_addr(dmac);
         g = mlx5_create_flow_group(fdb, flow_group_in);
-        if (IS_ERR_OR_NULL(g)) {
+        if (IS_ERR(g)) {
                 err = PTR_ERR(g);
                 esw_warn(dev, "Failed to create flow group err(%d)\n", err);
                 goto out;
@@ -489,7 +489,7 @@ static int esw_create_fdb_table(struct mlx5_eswitch *esw, int nvports)
         eth_zero_addr(dmac);
         dmac[0] = 0x01;
         g = mlx5_create_flow_group(fdb, flow_group_in);
-        if (IS_ERR_OR_NULL(g)) {
+        if (IS_ERR(g)) {
                 err = PTR_ERR(g);
                 esw_warn(dev, "Failed to create allmulti flow group err(%d)\n", err);
                 goto out;
@@ -506,7 +506,7 @@ static int esw_create_fdb_table(struct mlx5_eswitch *esw, int nvports)
         MLX5_SET(create_flow_group_in, flow_group_in, start_flow_index, table_size - 1);
         MLX5_SET(create_flow_group_in, flow_group_in, end_flow_index, table_size - 1);
         g = mlx5_create_flow_group(fdb, flow_group_in);
-        if (IS_ERR_OR_NULL(g)) {
+        if (IS_ERR(g)) {
                 err = PTR_ERR(g);
                 esw_warn(dev, "Failed to create promisc flow group err(%d)\n", err);
                 goto out;
@@ -529,7 +529,7 @@ out:
                 }
         }
 
-        kfree(flow_group_in);
+        kvfree(flow_group_in);
         return err;
 }
 
@@ -651,6 +651,7 @@ static void update_allmulti_vports(struct mlx5_eswitch *esw,
                                         esw_fdb_set_vport_rule(esw,
                                                                mac,
                                                                vport_idx);
+                        iter_vaddr->mc_promisc = true;
                         break;
                 case MLX5_ACTION_DEL:
                         if (!iter_vaddr)
@@ -1060,7 +1061,7 @@ static void esw_vport_enable_egress_acl(struct mlx5_eswitch *esw,
                 return;
 
         acl = mlx5_create_vport_flow_table(root_ns, 0, table_size, 0, vport->vport);
-        if (IS_ERR_OR_NULL(acl)) {
+        if (IS_ERR(acl)) {
                 err = PTR_ERR(acl);
                 esw_warn(dev, "Failed to create E-Switch vport[%d] egress flow Table, err(%d)\n",
                          vport->vport, err);
@@ -1075,7 +1076,7 @@ static void esw_vport_enable_egress_acl(struct mlx5_eswitch *esw,
         MLX5_SET(create_flow_group_in, flow_group_in, end_flow_index, 0);
 
         vlan_grp = mlx5_create_flow_group(acl, flow_group_in);
-        if (IS_ERR_OR_NULL(vlan_grp)) {
+        if (IS_ERR(vlan_grp)) {
                 err = PTR_ERR(vlan_grp);
                 esw_warn(dev, "Failed to create E-Switch vport[%d] egress allowed vlans flow group, err(%d)\n",
                          vport->vport, err);
@@ -1086,7 +1087,7 @@ static void esw_vport_enable_egress_acl(struct mlx5_eswitch *esw,
         MLX5_SET(create_flow_group_in, flow_group_in, start_flow_index, 1);
         MLX5_SET(create_flow_group_in, flow_group_in, end_flow_index, 1);
         drop_grp = mlx5_create_flow_group(acl, flow_group_in);
-        if (IS_ERR_OR_NULL(drop_grp)) {
+        if (IS_ERR(drop_grp)) {
                 err = PTR_ERR(drop_grp);
                 esw_warn(dev, "Failed to create E-Switch vport[%d] egress drop flow group, err(%d)\n",
                          vport->vport, err);
@@ -1097,7 +1098,7 @@ static void esw_vport_enable_egress_acl(struct mlx5_eswitch *esw,
         vport->egress.drop_grp = drop_grp;
         vport->egress.allowed_vlans_grp = vlan_grp;
 out:
-        kfree(flow_group_in);
+        kvfree(flow_group_in);
         if (err && !IS_ERR_OR_NULL(vlan_grp))
                 mlx5_destroy_flow_group(vlan_grp);
         if (err && !IS_ERR_OR_NULL(acl))
@@ -1174,7 +1175,7 @@ static void esw_vport_enable_ingress_acl(struct mlx5_eswitch *esw,
                 return;
 
         acl = mlx5_create_vport_flow_table(root_ns, 0, table_size, 0, vport->vport);
-        if (IS_ERR_OR_NULL(acl)) {
+        if (IS_ERR(acl)) {
                 err = PTR_ERR(acl);
                 esw_warn(dev, "Failed to create E-Switch vport[%d] ingress flow Table, err(%d)\n",
                          vport->vport, err);
@@ -1192,7 +1193,7 @@ static void esw_vport_enable_ingress_acl(struct mlx5_eswitch *esw,
         MLX5_SET(create_flow_group_in, flow_group_in, end_flow_index, 0);
 
         g = mlx5_create_flow_group(acl, flow_group_in);
-        if (IS_ERR_OR_NULL(g)) {
+        if (IS_ERR(g)) {
                 err = PTR_ERR(g);
                 esw_warn(dev, "Failed to create E-Switch vport[%d] ingress untagged spoofchk flow group, err(%d)\n",
                          vport->vport, err);
@@ -1207,7 +1208,7 @@ static void esw_vport_enable_ingress_acl(struct mlx5_eswitch *esw,
         MLX5_SET(create_flow_group_in, flow_group_in, end_flow_index, 1);
 
         g = mlx5_create_flow_group(acl, flow_group_in);
-        if (IS_ERR_OR_NULL(g)) {
+        if (IS_ERR(g)) {
                 err = PTR_ERR(g);
                 esw_warn(dev, "Failed to create E-Switch vport[%d] ingress untagged flow group, err(%d)\n",
                          vport->vport, err);
@@ -1223,7 +1224,7 @@ static void esw_vport_enable_ingress_acl(struct mlx5_eswitch *esw,
         MLX5_SET(create_flow_group_in, flow_group_in, end_flow_index, 2);
 
         g = mlx5_create_flow_group(acl, flow_group_in);
-        if (IS_ERR_OR_NULL(g)) {
+        if (IS_ERR(g)) {
                 err = PTR_ERR(g);
                 esw_warn(dev, "Failed to create E-Switch vport[%d] ingress spoofchk flow group, err(%d)\n",
                          vport->vport, err);
@@ -1236,7 +1237,7 @@ static void esw_vport_enable_ingress_acl(struct mlx5_eswitch *esw,
         MLX5_SET(create_flow_group_in, flow_group_in, end_flow_index, 3);
 
         g = mlx5_create_flow_group(acl, flow_group_in);
-        if (IS_ERR_OR_NULL(g)) {
+        if (IS_ERR(g)) {
                 err = PTR_ERR(g);
                 esw_warn(dev, "Failed to create E-Switch vport[%d] ingress drop flow group, err(%d)\n",
                          vport->vport, err);
@@ -1259,7 +1260,7 @@ out:
                         mlx5_destroy_flow_table(vport->ingress.acl);
         }
 
-        kfree(flow_group_in);
+        kvfree(flow_group_in);
 }
 
 static void esw_vport_cleanup_ingress_rules(struct mlx5_eswitch *esw,
@@ -1363,7 +1364,7 @@ static int esw_vport_ingress_config(struct mlx5_eswitch *esw,
                                    match_v,
                                    MLX5_FLOW_CONTEXT_ACTION_ALLOW,
                                    0, NULL);
-        if (IS_ERR_OR_NULL(vport->ingress.allow_rule)) {
+        if (IS_ERR(vport->ingress.allow_rule)) {
                 err = PTR_ERR(vport->ingress.allow_rule);
                 pr_warn("vport[%d] configure ingress allow rule, err(%d)\n",
                         vport->vport, err);
@@ -1380,7 +1381,7 @@ static int esw_vport_ingress_config(struct mlx5_eswitch *esw,
                                    match_v,
                                    MLX5_FLOW_CONTEXT_ACTION_DROP,
                                    0, NULL);
-        if (IS_ERR_OR_NULL(vport->ingress.drop_rule)) {
+        if (IS_ERR(vport->ingress.drop_rule)) {
                 err = PTR_ERR(vport->ingress.drop_rule);
                 pr_warn("vport[%d] configure ingress drop rule, err(%d)\n",
                         vport->vport, err);
@@ -1439,7 +1440,7 @@ static int esw_vport_egress_config(struct mlx5_eswitch *esw,
                                    match_v,
                                    MLX5_FLOW_CONTEXT_ACTION_ALLOW,
                                    0, NULL);
-        if (IS_ERR_OR_NULL(vport->egress.allowed_vlan)) {
+        if (IS_ERR(vport->egress.allowed_vlan)) {
                 err = PTR_ERR(vport->egress.allowed_vlan);
                 pr_warn("vport[%d] configure egress allowed vlan rule failed, err(%d)\n",
                         vport->vport, err);
@@ -1457,7 +1458,7 @@ static int esw_vport_egress_config(struct mlx5_eswitch *esw,
                                    match_v,
                                    MLX5_FLOW_CONTEXT_ACTION_DROP,
                                    0, NULL);
-        if (IS_ERR_OR_NULL(vport->egress.drop_rule)) {
+        if (IS_ERR(vport->egress.drop_rule)) {
                 err = PTR_ERR(vport->egress.drop_rule);
                 pr_warn("vport[%d] configure egress drop rule failed, err(%d)\n",
                         vport->vport, err);
@@ -1491,14 +1492,11 @@ static void esw_enable_vport(struct mlx5_eswitch *esw, int vport_num,
 
         /* Sync with current vport context */
         vport->enabled_events = enable_events;
-        esw_vport_change_handle_locked(vport);
-
         vport->enabled = true;
 
         /* only PF is trusted by default */
         vport->trusted = (vport_num) ? false : true;
-
-        arm_vport_context_events_cmd(esw->dev, vport_num, enable_events);
+        esw_vport_change_handle_locked(vport);
 
         esw->enabled_vports++;
         esw_debug(esw->dev, "Enabled VPORT(%d)\n", vport_num);
@@ -1728,11 +1726,24 @@ void mlx5_eswitch_vport_event(struct mlx5_eswitch *esw, struct mlx5_eqe *eqe)
         (esw && MLX5_CAP_GEN(esw->dev, vport_group_manager) && mlx5_core_is_pf(esw->dev))
 #define LEGAL_VPORT(esw, vport) (vport >= 0 && vport < esw->total_vports)
 
+static void node_guid_gen_from_mac(u64 *node_guid, u8 mac[ETH_ALEN])
+{
+        ((u8 *)node_guid)[7] = mac[0];
+        ((u8 *)node_guid)[6] = mac[1];
+        ((u8 *)node_guid)[5] = mac[2];
+        ((u8 *)node_guid)[4] = 0xff;
+        ((u8 *)node_guid)[3] = 0xfe;
+        ((u8 *)node_guid)[2] = mac[3];
+        ((u8 *)node_guid)[1] = mac[4];
+        ((u8 *)node_guid)[0] = mac[5];
+}
+
 int mlx5_eswitch_set_vport_mac(struct mlx5_eswitch *esw,
                                int vport, u8 mac[ETH_ALEN])
 {
-        int err = 0;
         struct mlx5_vport *evport;
+        u64 node_guid;
+        int err = 0;
 
         if (!ESW_ALLOWED(esw))
                 return -EPERM;
@@ -1756,11 +1767,17 @@ int mlx5_eswitch_set_vport_mac(struct mlx5_eswitch *esw,
                 return err;
         }
 
+        node_guid_gen_from_mac(&node_guid, mac);
+        err = mlx5_modify_nic_vport_node_guid(esw->dev, vport, node_guid);
+        if (err)
+                mlx5_core_warn(esw->dev,
+                               "Failed to set vport %d node guid, err = %d. RDMA_CM will not function properly for this VF.\n",
+                               vport, err);
+
         mutex_lock(&esw->state_lock);
         if (evport->enabled)
                 err = esw_vport_ingress_config(esw, evport);
         mutex_unlock(&esw->state_lock);
-
         return err;
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
index 8b5f0b2c0d5c..e912a3d2505e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
@@ -1292,8 +1292,8 @@ static int update_root_ft_destroy(struct mlx5_flow_table *ft)
                                        ft->id);
                         return err;
                 }
-                root->root_ft = new_root_ft;
         }
+        root->root_ft = new_root_ft;
         return 0;
 }
 
@@ -1767,6 +1767,9 @@ static void cleanup_root_ns(struct mlx5_core_dev *dev)
 
 void mlx5_cleanup_fs(struct mlx5_core_dev *dev)
 {
+        if (MLX5_CAP_GEN(dev, port_type) != MLX5_CAP_PORT_TYPE_ETH)
+                return;
+
         cleanup_root_ns(dev);
         cleanup_single_prio_root_ns(dev, dev->priv.fdb_root_ns);
         cleanup_single_prio_root_ns(dev, dev->priv.esw_egress_root_ns);
@@ -1828,29 +1831,36 @@ int mlx5_init_fs(struct mlx5_core_dev *dev)
 {
         int err = 0;
 
+        if (MLX5_CAP_GEN(dev, port_type) != MLX5_CAP_PORT_TYPE_ETH)
+                return 0;
+
         err = mlx5_init_fc_stats(dev);
         if (err)
                 return err;
 
-        if (MLX5_CAP_GEN(dev, nic_flow_table)) {
+        if (MLX5_CAP_GEN(dev, nic_flow_table) &&
+            MLX5_CAP_FLOWTABLE_NIC_RX(dev, ft_support)) {
                 err = init_root_ns(dev);
                 if (err)
                         goto err;
         }
+
         if (MLX5_CAP_GEN(dev, eswitch_flow_table)) {
-                err = init_fdb_root_ns(dev);
-                if (err)
-                        goto err;
-        }
-        if (MLX5_CAP_ESW_EGRESS_ACL(dev, ft_support)) {
-                err = init_egress_acl_root_ns(dev);
-                if (err)
-                        goto err;
-        }
-        if (MLX5_CAP_ESW_INGRESS_ACL(dev, ft_support)) {
-                err = init_ingress_acl_root_ns(dev);
-                if (err)
-                        goto err;
+                if (MLX5_CAP_ESW_FLOWTABLE_FDB(dev, ft_support)) {
+                        err = init_fdb_root_ns(dev);
+                        if (err)
+                                goto err;
+                }
+                if (MLX5_CAP_ESW_EGRESS_ACL(dev, ft_support)) {
+                        err = init_egress_acl_root_ns(dev);
+                        if (err)
+                                goto err;
+                }
+                if (MLX5_CAP_ESW_INGRESS_ACL(dev, ft_support)) {
+                        err = init_ingress_acl_root_ns(dev);
+                        if (err)
+                                goto err;
+                }
         }
 
         return 0;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index a19b59348dd6..c65f4a13e17e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -1508,8 +1508,9 @@ static const struct pci_device_id mlx5_core_pci_table[] = {
         { PCI_VDEVICE(MELLANOX, 0x1014), MLX5_PCI_DEV_IS_VF},   /* ConnectX-4 VF */
         { PCI_VDEVICE(MELLANOX, 0x1015) },                      /* ConnectX-4LX */
         { PCI_VDEVICE(MELLANOX, 0x1016), MLX5_PCI_DEV_IS_VF},   /* ConnectX-4LX VF */
-        { PCI_VDEVICE(MELLANOX, 0x1017) },                      /* ConnectX-5 */
+        { PCI_VDEVICE(MELLANOX, 0x1017) },                      /* ConnectX-5, PCIe 3.0 */
         { PCI_VDEVICE(MELLANOX, 0x1018), MLX5_PCI_DEV_IS_VF},   /* ConnectX-5 VF */
+        { PCI_VDEVICE(MELLANOX, 0x1019) },                      /* ConnectX-5, PCIe 4.0 */
         { 0, }
 };
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/qp.c b/drivers/net/ethernet/mellanox/mlx5/core/qp.c
index b720a274220d..b82d65802d96 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/qp.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/qp.c
@@ -418,7 +418,7 @@ int mlx5_core_xrcd_alloc(struct mlx5_core_dev *dev, u32 *xrcdn)
         if (out.hdr.status)
                 err = mlx5_cmd_status_to_err(&out.hdr);
         else
-                *xrcdn = be32_to_cpu(out.xrcdn);
+                *xrcdn = be32_to_cpu(out.xrcdn) & 0xffffff;
 
         return err;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/vport.c b/drivers/net/ethernet/mellanox/mlx5/core/vport.c
index b69dadcfb897..daf44cd4c566 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/vport.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/vport.c
@@ -508,6 +508,44 @@ int mlx5_query_nic_vport_node_guid(struct mlx5_core_dev *mdev, u64 *node_guid)
 }
 EXPORT_SYMBOL_GPL(mlx5_query_nic_vport_node_guid);
 
+int mlx5_modify_nic_vport_node_guid(struct mlx5_core_dev *mdev,
+                                    u32 vport, u64 node_guid)
+{
+        int inlen = MLX5_ST_SZ_BYTES(modify_nic_vport_context_in);
+        void *nic_vport_context;
+        u8 *guid;
+        void *in;
+        int err;
+
+        if (!vport)
+                return -EINVAL;
+        if (!MLX5_CAP_GEN(mdev, vport_group_manager))
+                return -EACCES;
+        if (!MLX5_CAP_ESW(mdev, nic_vport_node_guid_modify))
+                return -ENOTSUPP;
+
+        in = mlx5_vzalloc(inlen);
+        if (!in)
+                return -ENOMEM;
+
+        MLX5_SET(modify_nic_vport_context_in, in,
+                 field_select.node_guid, 1);
+        MLX5_SET(modify_nic_vport_context_in, in, vport_number, vport);
+        MLX5_SET(modify_nic_vport_context_in, in, other_vport, !!vport);
+
+        nic_vport_context = MLX5_ADDR_OF(modify_nic_vport_context_in,
+                                         in, nic_vport_context);
+        guid = MLX5_ADDR_OF(nic_vport_context, nic_vport_context,
+                            node_guid);
+        MLX5_SET64(nic_vport_context, nic_vport_context, node_guid, node_guid);
+
+        err = mlx5_modify_nic_vport_context(mdev, in, inlen);
+
+        kvfree(in);
+
+        return err;
+}
+
 int mlx5_query_nic_vport_qkey_viol_cntr(struct mlx5_core_dev *mdev,
                                         u16 *qkey_viol_cntr)
 {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/vxlan.c b/drivers/net/ethernet/mellanox/mlx5/core/vxlan.c
index f2fd1ef16da7..05de77267d58 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/vxlan.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/vxlan.c
@@ -105,6 +105,9 @@ static void mlx5e_vxlan_add_port(struct work_struct *work)
         struct mlx5e_vxlan *vxlan;
         int err;
 
+        if (mlx5e_vxlan_lookup_port(priv, port))
+                goto free_work;
+
         if (mlx5e_vxlan_core_add_port_cmd(priv->mdev, port))
                 goto free_work;
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/wq.c b/drivers/net/ethernet/mellanox/mlx5/core/wq.c
index ce21ee5b2357..821a087c7ae2 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/wq.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/wq.c
@@ -75,14 +75,14 @@ int mlx5_wq_cyc_create(struct mlx5_core_dev *mdev, struct mlx5_wq_param *param,
 
         err = mlx5_db_alloc_node(mdev, &wq_ctrl->db, param->db_numa_node);
         if (err) {
-                mlx5_core_warn(mdev, "mlx5_db_alloc() failed, %d\n", err);
+                mlx5_core_warn(mdev, "mlx5_db_alloc_node() failed, %d\n", err);
                 return err;
         }
 
         err = mlx5_buf_alloc_node(mdev, mlx5_wq_cyc_get_byte_size(wq),
                                   &wq_ctrl->buf, param->buf_numa_node);
         if (err) {
-                mlx5_core_warn(mdev, "mlx5_buf_alloc() failed, %d\n", err);
+                mlx5_core_warn(mdev, "mlx5_buf_alloc_node() failed, %d\n", err);
                 goto err_db_free;
         }
 
@@ -111,14 +111,14 @@ int mlx5_cqwq_create(struct mlx5_core_dev *mdev, struct mlx5_wq_param *param,
 
         err = mlx5_db_alloc_node(mdev, &wq_ctrl->db, param->db_numa_node);
         if (err) {
-                mlx5_core_warn(mdev, "mlx5_db_alloc() failed, %d\n", err);
+                mlx5_core_warn(mdev, "mlx5_db_alloc_node() failed, %d\n", err);
                 return err;
         }
 
         err = mlx5_buf_alloc_node(mdev, mlx5_cqwq_get_byte_size(wq),
                                   &wq_ctrl->buf, param->buf_numa_node);
         if (err) {
-                mlx5_core_warn(mdev, "mlx5_buf_alloc() failed, %d\n", err);
+                mlx5_core_warn(mdev, "mlx5_buf_alloc_node() failed, %d\n", err);
                 goto err_db_free;
         }
 
@@ -148,13 +148,14 @@ int mlx5_wq_ll_create(struct mlx5_core_dev *mdev, struct mlx5_wq_param *param,
 
         err = mlx5_db_alloc_node(mdev, &wq_ctrl->db, param->db_numa_node);
         if (err) {
-                mlx5_core_warn(mdev, "mlx5_db_alloc() failed, %d\n", err);
+                mlx5_core_warn(mdev, "mlx5_db_alloc_node() failed, %d\n", err);
                 return err;
         }
 
-        err = mlx5_buf_alloc(mdev, mlx5_wq_ll_get_byte_size(wq), &wq_ctrl->buf);
+        err = mlx5_buf_alloc_node(mdev, mlx5_wq_ll_get_byte_size(wq),
+                                  &wq_ctrl->buf, param->buf_numa_node);
         if (err) {
-                mlx5_core_warn(mdev, "mlx5_buf_alloc() failed, %d\n", err);
+                mlx5_core_warn(mdev, "mlx5_buf_alloc_node() failed, %d\n", err);
                 goto err_db_free;
         }
 
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
index 4a7273771028..660429ebfbe1 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -247,15 +247,23 @@ static int mlxsw_sp_port_mtu_set(struct mlxsw_sp_port *mlxsw_sp_port, u16 mtu)
         return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(pmtu), pmtu_pl);
 }
 
-static int mlxsw_sp_port_swid_set(struct mlxsw_sp_port *mlxsw_sp_port, u8 swid)
+static int __mlxsw_sp_port_swid_set(struct mlxsw_sp *mlxsw_sp, u8 local_port,
+                                    u8 swid)
 {
-        struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
         char pspa_pl[MLXSW_REG_PSPA_LEN];
 
-        mlxsw_reg_pspa_pack(pspa_pl, swid, mlxsw_sp_port->local_port);
+        mlxsw_reg_pspa_pack(pspa_pl, swid, local_port);
         return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(pspa), pspa_pl);
 }
 
+static int mlxsw_sp_port_swid_set(struct mlxsw_sp_port *mlxsw_sp_port, u8 swid)
+{
+        struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
+
+        return __mlxsw_sp_port_swid_set(mlxsw_sp, mlxsw_sp_port->local_port,
+                                        swid);
+}
+
 static int mlxsw_sp_port_vp_mode_set(struct mlxsw_sp_port *mlxsw_sp_port,
                                      bool enable)
 {
@@ -305,9 +313,9 @@ mlxsw_sp_port_system_port_mapping_set(struct mlxsw_sp_port *mlxsw_sp_port)
         return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sspr), sspr_pl);
 }
 
-static int __mlxsw_sp_port_module_info_get(struct mlxsw_sp *mlxsw_sp,
-                                           u8 local_port, u8 *p_module,
-                                           u8 *p_width, u8 *p_lane)
+static int mlxsw_sp_port_module_info_get(struct mlxsw_sp *mlxsw_sp,
+                                         u8 local_port, u8 *p_module,
+                                         u8 *p_width, u8 *p_lane)
 {
         char pmlp_pl[MLXSW_REG_PMLP_LEN];
         int err;
@@ -322,16 +330,6 @@ static int __mlxsw_sp_port_module_info_get(struct mlxsw_sp *mlxsw_sp,
         return 0;
 }
 
-static int mlxsw_sp_port_module_info_get(struct mlxsw_sp *mlxsw_sp,
-                                         u8 local_port, u8 *p_module,
-                                         u8 *p_width)
-{
-        u8 lane;
-
-        return __mlxsw_sp_port_module_info_get(mlxsw_sp, local_port, p_module,
-                                               p_width, &lane);
-}
-
 static int mlxsw_sp_port_module_map(struct mlxsw_sp *mlxsw_sp, u8 local_port,
                                     u8 module, u8 width, u8 lane)
 {
@@ -410,7 +408,11 @@ static netdev_tx_t mlxsw_sp_port_xmit(struct sk_buff *skb,
         }
 
         mlxsw_sp_txhdr_construct(skb, &tx_info);
-        len = skb->len;
+        /* TX header is consumed by HW on the way so we shouldn't count its
+         * bytes as being sent.
+         */
+        len = skb->len - MLXSW_TXHDR_LEN;
+
         /* Due to a race we might fail here because of a full queue. In that
          * unlikely case we simply drop the packet.
          */
@@ -949,17 +951,11 @@ static int mlxsw_sp_port_get_phys_port_name(struct net_device *dev, char *name,
                                             size_t len)
 {
         struct mlxsw_sp_port *mlxsw_sp_port = netdev_priv(dev);
-        u8 module, width, lane;
+        u8 module = mlxsw_sp_port->mapping.module;
+        u8 width = mlxsw_sp_port->mapping.width;
+        u8 lane = mlxsw_sp_port->mapping.lane;
         int err;
 
-        err = __mlxsw_sp_port_module_info_get(mlxsw_sp_port->mlxsw_sp,
-                                              mlxsw_sp_port->local_port,
-                                              &module, &width, &lane);
-        if (err) {
-                netdev_err(dev, "Failed to retrieve module information\n");
-                return err;
-        }
-
         if (!mlxsw_sp_port->split)
                 err = snprintf(name, len, "p%d", module + 1);
         else
@@ -1681,8 +1677,8 @@ static int mlxsw_sp_port_ets_init(struct mlxsw_sp_port *mlxsw_sp_port)
         return 0;
 }
 
-static int __mlxsw_sp_port_create(struct mlxsw_sp *mlxsw_sp, u8 local_port,
-                                  bool split, u8 module, u8 width)
+static int mlxsw_sp_port_create(struct mlxsw_sp *mlxsw_sp, u8 local_port,
+                                bool split, u8 module, u8 width, u8 lane)
 {
         struct mlxsw_sp_port *mlxsw_sp_port;
         struct net_device *dev;
@@ -1697,6 +1693,9 @@ static int __mlxsw_sp_port_create(struct mlxsw_sp *mlxsw_sp, u8 local_port,
         mlxsw_sp_port->mlxsw_sp = mlxsw_sp;
         mlxsw_sp_port->local_port = local_port;
         mlxsw_sp_port->split = split;
+        mlxsw_sp_port->mapping.module = module;
+        mlxsw_sp_port->mapping.width = width;
+        mlxsw_sp_port->mapping.lane = lane;
         bytes = DIV_ROUND_UP(VLAN_N_VID, BITS_PER_BYTE);
         mlxsw_sp_port->active_vlans = kzalloc(bytes, GFP_KERNEL);
         if (!mlxsw_sp_port->active_vlans) {
@@ -1839,28 +1838,6 @@ err_port_active_vlans_alloc:
         return err;
 }
 
-static int mlxsw_sp_port_create(struct mlxsw_sp *mlxsw_sp, u8 local_port,
-                                bool split, u8 module, u8 width, u8 lane)
-{
-        int err;
-
-        err = mlxsw_sp_port_module_map(mlxsw_sp, local_port, module, width,
-                                       lane);
-        if (err)
-                return err;
-
-        err = __mlxsw_sp_port_create(mlxsw_sp, local_port, split, module,
-                                     width);
-        if (err)
-                goto err_port_create;
-
-        return 0;
-
-err_port_create:
-        mlxsw_sp_port_module_unmap(mlxsw_sp, local_port);
-        return err;
-}
-
 static void mlxsw_sp_port_vports_fini(struct mlxsw_sp_port *mlxsw_sp_port)
 {
         struct net_device *dev = mlxsw_sp_port->dev;
@@ -1909,8 +1886,8 @@ static void mlxsw_sp_ports_remove(struct mlxsw_sp *mlxsw_sp)
 
 static int mlxsw_sp_ports_create(struct mlxsw_sp *mlxsw_sp)
 {
+        u8 module, width, lane;
         size_t alloc_size;
-        u8 module, width;
         int i;
         int err;
 
@@ -1921,13 +1898,14 @@ static int mlxsw_sp_ports_create(struct mlxsw_sp *mlxsw_sp)
 
         for (i = 1; i < MLXSW_PORT_MAX_PORTS; i++) {
                 err = mlxsw_sp_port_module_info_get(mlxsw_sp, i, &module,
-                                                    &width);
+                                                    &width, &lane);
                 if (err)
                         goto err_port_module_info_get;
                 if (!width)
                         continue;
                 mlxsw_sp->port_to_module[i] = module;
-                err = __mlxsw_sp_port_create(mlxsw_sp, i, false, module, width);
+                err = mlxsw_sp_port_create(mlxsw_sp, i, false, module, width,
+                                           lane);
                 if (err)
                         goto err_port_create;
         }
@@ -1948,12 +1926,85 @@ static u8 mlxsw_sp_cluster_base_port_get(u8 local_port)
         return local_port - offset;
 }
 
+static int mlxsw_sp_port_split_create(struct mlxsw_sp *mlxsw_sp, u8 base_port,
+                                      u8 module, unsigned int count)
+{
+        u8 width = MLXSW_PORT_MODULE_MAX_WIDTH / count;
+        int err, i;
+
+        for (i = 0; i < count; i++) {
+                err = mlxsw_sp_port_module_map(mlxsw_sp, base_port + i, module,
+                                               width, i * width);
+                if (err)
+                        goto err_port_module_map;
+        }
+
+        for (i = 0; i < count; i++) {
+                err = __mlxsw_sp_port_swid_set(mlxsw_sp, base_port + i, 0);
+                if (err)
+                        goto err_port_swid_set;
+        }
+
+        for (i = 0; i < count; i++) {
+                err = mlxsw_sp_port_create(mlxsw_sp, base_port + i, true,
+                                           module, width, i * width);
+                if (err)
+                        goto err_port_create;
+        }
+
+        return 0;
+
+err_port_create:
+        for (i--; i >= 0; i--)
+                mlxsw_sp_port_remove(mlxsw_sp, base_port + i);
+        i = count;
+err_port_swid_set:
+        for (i--; i >= 0; i--)
+                __mlxsw_sp_port_swid_set(mlxsw_sp, base_port + i,
+                                         MLXSW_PORT_SWID_DISABLED_PORT);
+        i = count;
+err_port_module_map:
+        for (i--; i >= 0; i--)
+                mlxsw_sp_port_module_unmap(mlxsw_sp, base_port + i);
+        return err;
+}
+
+static void mlxsw_sp_port_unsplit_create(struct mlxsw_sp *mlxsw_sp,
+                                         u8 base_port, unsigned int count)
+{
+        u8 local_port, module, width = MLXSW_PORT_MODULE_MAX_WIDTH;
+        int i;
+
+        /* Split by four means we need to re-create two ports, otherwise
+         * only one.
+         */
+        count = count / 2;
+
+        for (i = 0; i < count; i++) {
+                local_port = base_port + i * 2;
+                module = mlxsw_sp->port_to_module[local_port];
+
+                mlxsw_sp_port_module_map(mlxsw_sp, local_port, module, width,
+                                         0);
+        }
+
+        for (i = 0; i < count; i++)
+                __mlxsw_sp_port_swid_set(mlxsw_sp, base_port + i * 2, 0);
+
+        for (i = 0; i < count; i++) {
+                local_port = base_port + i * 2;
+                module = mlxsw_sp->port_to_module[local_port];
+
+                mlxsw_sp_port_create(mlxsw_sp, local_port, false, module,
+                                     width, 0);
+        }
+}
+
 static int mlxsw_sp_port_split(struct mlxsw_core *mlxsw_core, u8 local_port,
                                unsigned int count)
 {
         struct mlxsw_sp *mlxsw_sp = mlxsw_core_driver_priv(mlxsw_core);
         struct mlxsw_sp_port *mlxsw_sp_port;
-        u8 width = MLXSW_PORT_MODULE_MAX_WIDTH / count;
         u8 module, cur_width, base_port;
         int i;
         int err;
@@ -1965,18 +2016,14 @@ static int mlxsw_sp_port_split(struct mlxsw_core *mlxsw_core, u8 local_port,
                 return -EINVAL;
         }
 
+        module = mlxsw_sp_port->mapping.module;
+        cur_width = mlxsw_sp_port->mapping.width;
+
         if (count != 2 && count != 4) {
                 netdev_err(mlxsw_sp_port->dev, "Port can only be split into 2 or 4 ports\n");
                 return -EINVAL;
         }
 
-        err = mlxsw_sp_port_module_info_get(mlxsw_sp, local_port, &module,
-                                            &cur_width);
-        if (err) {
-                netdev_err(mlxsw_sp_port->dev, "Failed to get port's width\n");
-                return err;
-        }
-
         if (cur_width != MLXSW_PORT_MODULE_MAX_WIDTH) {
                 netdev_err(mlxsw_sp_port->dev, "Port cannot be split further\n");
                 return -EINVAL;
@@ -2001,25 +2048,16 @@ static int mlxsw_sp_port_split(struct mlxsw_core *mlxsw_core, u8 local_port,
         for (i = 0; i < count; i++)
                 mlxsw_sp_port_remove(mlxsw_sp, base_port + i);
 
-        for (i = 0; i < count; i++) {
-                err = mlxsw_sp_port_create(mlxsw_sp, base_port + i, true,
-                                           module, width, i * width);
-                if (err) {
-                        dev_err(mlxsw_sp->bus_info->dev, "Failed to create split port\n");
-                        goto err_port_create;
-                }
+        err = mlxsw_sp_port_split_create(mlxsw_sp, base_port, module, count);
+        if (err) {
+                dev_err(mlxsw_sp->bus_info->dev, "Failed to create split ports\n");
+                goto err_port_split_create;
         }
 
         return 0;
 
-err_port_create:
-        for (i--; i >= 0; i--)
-                mlxsw_sp_port_remove(mlxsw_sp, base_port + i);
-        for (i = 0; i < count / 2; i++) {
-                module = mlxsw_sp->port_to_module[base_port + i * 2];
-                mlxsw_sp_port_create(mlxsw_sp, base_port + i * 2, false,
-                                     module, MLXSW_PORT_MODULE_MAX_WIDTH, 0);
-        }
+err_port_split_create:
+        mlxsw_sp_port_unsplit_create(mlxsw_sp, base_port, count);
         return err;
 }
 
@@ -2027,10 +2065,9 @@ static int mlxsw_sp_port_unsplit(struct mlxsw_core *mlxsw_core, u8 local_port)
 {
         struct mlxsw_sp *mlxsw_sp = mlxsw_core_driver_priv(mlxsw_core);
         struct mlxsw_sp_port *mlxsw_sp_port;
-        u8 module, cur_width, base_port;
+        u8 cur_width, base_port;
         unsigned int count;
         int i;
-        int err;
 
         mlxsw_sp_port = mlxsw_sp->ports[local_port];
         if (!mlxsw_sp_port) {
@@ -2044,12 +2081,7 @@ static int mlxsw_sp_port_unsplit(struct mlxsw_core *mlxsw_core, u8 local_port)
                 return -EINVAL;
         }
 
-        err = mlxsw_sp_port_module_info_get(mlxsw_sp, local_port, &module,
-                                            &cur_width);
-        if (err) {
-                netdev_err(mlxsw_sp_port->dev, "Failed to get port's width\n");
-                return err;
-        }
+        cur_width = mlxsw_sp_port->mapping.width;
         count = cur_width == 1 ? 4 : 2;
 
         base_port = mlxsw_sp_cluster_base_port_get(local_port);
@@ -2061,14 +2093,7 @@ static int mlxsw_sp_port_unsplit(struct mlxsw_core *mlxsw_core, u8 local_port)
         for (i = 0; i < count; i++)
                 mlxsw_sp_port_remove(mlxsw_sp, base_port + i);
 
-        for (i = 0; i < count / 2; i++) {
-                module = mlxsw_sp->port_to_module[base_port + i * 2];
-                err = mlxsw_sp_port_create(mlxsw_sp, base_port + i * 2, false,
-                                           module, MLXSW_PORT_MODULE_MAX_WIDTH,
-                                           0);
-                if (err)
-                        dev_err(mlxsw_sp->bus_info->dev, "Failed to reinstantiate port\n");
-        }
+        mlxsw_sp_port_unsplit_create(mlxsw_sp, base_port, count);
 
         return 0;
 }
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
index e2c022d3e2f3..13b30eaa13d4 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
@@ -229,6 +229,11 @@ struct mlxsw_sp_port {
                 struct ieee_maxrate *maxrate;
                 struct ieee_pfc *pfc;
         } dcb;
+        struct {
+                u8 module;
+                u8 width;
+                u8 lane;
+        } mapping;
         /* 802.1Q bridge VLANs */
         unsigned long *active_vlans;
         unsigned long *untagged_vlans;
diff --git a/drivers/net/ethernet/mellanox/mlxsw/switchx2.c b/drivers/net/ethernet/mellanox/mlxsw/switchx2.c
index 3842eab9449a..25f658b3849a 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/switchx2.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/switchx2.c
@@ -316,7 +316,10 @@ static netdev_tx_t mlxsw_sx_port_xmit(struct sk_buff *skb,
                 }
         }
         mlxsw_sx_txhdr_construct(skb, &tx_info);
-        len = skb->len;
+        /* TX header is consumed by HW on the way so we shouldn't count its
+         * bytes as being sent.
+         */
+        len = skb->len - MLXSW_TXHDR_LEN;
         /* Due to a race we might fail here because of a full queue. In that
          * unlikely case we simply drop the packet.
          */
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
index fa47c14c743a..ba26bb356b8d 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
@@ -2015,7 +2015,7 @@ static void nfp_net_open_stack(struct nfp_net *nn)
 
         netif_tx_wake_all_queues(nn->netdev);
 
-        enable_irq(nn->irq_entries[NFP_NET_CFG_LSC].vector);
+        enable_irq(nn->irq_entries[NFP_NET_IRQ_LSC_IDX].vector);
         nfp_net_read_link_status(nn);
 }
 
@@ -2044,7 +2044,7 @@ static int nfp_net_netdev_open(struct net_device *netdev)
                                       NFP_NET_IRQ_LSC_IDX, nn->lsc_handler);
         if (err)
                 goto err_free_exn;
-        disable_irq(nn->irq_entries[NFP_NET_CFG_LSC].vector);
+        disable_irq(nn->irq_entries[NFP_NET_IRQ_LSC_IDX].vector);
 
         nn->rx_rings = kcalloc(nn->num_rx_rings, sizeof(*nn->rx_rings),
                                GFP_KERNEL);
@@ -2133,7 +2133,7 @@ static void nfp_net_close_stack(struct nfp_net *nn)
 {
         unsigned int r;
 
-        disable_irq(nn->irq_entries[NFP_NET_CFG_LSC].vector);
+        disable_irq(nn->irq_entries[NFP_NET_IRQ_LSC_IDX].vector);
         netif_carrier_off(nn->netdev);
         nn->link_up = false;
 
diff --git a/drivers/net/ethernet/qlogic/qed/qed_hsi.h b/drivers/net/ethernet/qlogic/qed/qed_hsi.h
index 9afc15fdbb02..e29ed5a69566 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_hsi.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_hsi.h
@@ -3700,6 +3700,7 @@ struct public_port {
 #define MEDIA_DA_TWINAX         0x3
 #define MEDIA_BASE_T            0x4
 #define MEDIA_SFP_1G_FIBER      0x5
+#define MEDIA_MODULE_FIBER      0x6
 #define MEDIA_KR                0xf0
 #define MEDIA_NOT_PRESENT       0xff
 
diff --git a/drivers/net/ethernet/qlogic/qed/qed_l2.c b/drivers/net/ethernet/qlogic/qed/qed_l2.c
index 8fba87dd48af..aada4c7e095f 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_l2.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_l2.c
@@ -72,6 +72,7 @@ int qed_sp_eth_vport_start(struct qed_hwfn *p_hwfn,
         p_ramrod->mtu                   = cpu_to_le16(p_params->mtu);
         p_ramrod->inner_vlan_removal_en = p_params->remove_inner_vlan;
         p_ramrod->drop_ttl0_en          = p_params->drop_ttl0;
+        p_ramrod->untagged              = p_params->only_untagged;
 
         SET_FIELD(rx_mode, ETH_VPORT_RX_MODE_UCAST_DROP_ALL, 1);
         SET_FIELD(rx_mode, ETH_VPORT_RX_MODE_MCAST_DROP_ALL, 1);
@@ -247,10 +248,6 @@ qed_sp_update_accept_mode(struct qed_hwfn *p_hwfn,
                 SET_FIELD(state, ETH_VPORT_TX_MODE_UCAST_DROP_ALL,
                           !!(accept_filter & QED_ACCEPT_NONE));
 
-                SET_FIELD(state, ETH_VPORT_TX_MODE_UCAST_ACCEPT_ALL,
-                          (!!(accept_filter & QED_ACCEPT_UCAST_MATCHED) &&
-                           !!(accept_filter & QED_ACCEPT_UCAST_UNMATCHED)));
-
                 SET_FIELD(state, ETH_VPORT_TX_MODE_MCAST_DROP_ALL,
                           !!(accept_filter & QED_ACCEPT_NONE));
 
@@ -1748,7 +1745,8 @@ static int qed_start_vport(struct qed_dev *cdev,
                            start.vport_id, start.mtu);
         }
 
-        qed_reset_vport_stats(cdev);
+        if (params->clear_stats)
+                qed_reset_vport_stats(cdev);
 
         return 0;
 }
diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c
index 753064679bde..c7e01b303540 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
@@ -1085,6 +1085,7 @@ static int qed_get_port_type(u32 media_type)
         case MEDIA_SFPP_10G_FIBER:
         case MEDIA_SFP_1G_FIBER:
         case MEDIA_XFP_FIBER:
+        case MEDIA_MODULE_FIBER:
         case MEDIA_KR:
                 port_type = PORT_FIBRE;
                 break;
@@ -1105,6 +1106,39 @@ static int qed_get_port_type(u32 media_type)
         return port_type;
 }
 
+static int qed_get_link_data(struct qed_hwfn *hwfn,
+                             struct qed_mcp_link_params *params,
+                             struct qed_mcp_link_state *link,
+                             struct qed_mcp_link_capabilities *link_caps)
+{
+        void *p;
+
+        if (!IS_PF(hwfn->cdev)) {
+                qed_vf_get_link_params(hwfn, params);
+                qed_vf_get_link_state(hwfn, link);
+                qed_vf_get_link_caps(hwfn, link_caps);
+
+                return 0;
+        }
+
+        p = qed_mcp_get_link_params(hwfn);
+        if (!p)
+                return -ENXIO;
+        memcpy(params, p, sizeof(*params));
+
+        p = qed_mcp_get_link_state(hwfn);
+        if (!p)
+                return -ENXIO;
+        memcpy(link, p, sizeof(*link));
+
+        p = qed_mcp_get_link_capabilities(hwfn);
+        if (!p)
+                return -ENXIO;
+        memcpy(link_caps, p, sizeof(*link_caps));
+
+        return 0;
+}
+
 static void qed_fill_link(struct qed_hwfn *hwfn,
                           struct qed_link_output *if_link)
 {
@@ -1116,15 +1150,9 @@ static void qed_fill_link(struct qed_hwfn *hwfn,
         memset(if_link, 0, sizeof(*if_link));
 
         /* Prepare source inputs */
-        if (IS_PF(hwfn->cdev)) {
-                memcpy(&params, qed_mcp_get_link_params(hwfn), sizeof(params));
-                memcpy(&link, qed_mcp_get_link_state(hwfn), sizeof(link));
-                memcpy(&link_caps, qed_mcp_get_link_capabilities(hwfn),
-                       sizeof(link_caps));
-        } else {
-                qed_vf_get_link_params(hwfn, &params);
-                qed_vf_get_link_state(hwfn, &link);
-                qed_vf_get_link_caps(hwfn, &link_caps);
+        if (qed_get_link_data(hwfn, &params, &link, &link_caps)) {
+                dev_warn(&hwfn->cdev->pdev->dev, "no link data available\n");
+                return;
         }
 
         /* Set the link parameters to pass to protocol driver */
diff --git a/drivers/net/ethernet/qlogic/qed/qed_spq.c b/drivers/net/ethernet/qlogic/qed/qed_spq.c
index acac6626a1b2..b122f6013b6c 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_spq.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_spq.c
@@ -213,19 +213,15 @@ static int qed_spq_hw_post(struct qed_hwfn *p_hwfn,
         SET_FIELD(db.params, CORE_DB_DATA_AGG_VAL_SEL,
                   DQ_XCM_CORE_SPQ_PROD_CMD);
         db.agg_flags = DQ_XCM_CORE_DQ_CF_CMD;
-
-        /* validate producer is up to-date */
-        rmb();
-
         db.spq_prod = cpu_to_le16(qed_chain_get_prod_idx(p_chain));
 
-        /* do not reorder */
-        barrier();
+        /* make sure the SPQE is updated before the doorbell */
+        wmb();
 
         DOORBELL(p_hwfn, qed_db_addr(p_spq->cid, DQ_DEMS_LEGACY), *(u32 *)&db);
 
         /* make sure doorbell is rang */
-        mmiowb();
+        wmb();
 
         DP_VERBOSE(p_hwfn, QED_MSG_SPQ,
                    "Doorbelled [0x%08x, CID 0x%08x] with Flags: %02x agg_params: %02x, prod: %04x\n",
@@ -614,7 +610,9 @@ qed_spq_add_entry(struct qed_hwfn *p_hwfn,
 
                         *p_en2 = *p_ent;
 
-                        kfree(p_ent);
+                        /* EBLOCK responsible to free the allocated p_ent */
+                        if (p_ent->comp_mode != QED_SPQ_MODE_EBLOCK)
+                                kfree(p_ent);
 
                         p_ent = p_en2;
                 }
@@ -749,6 +747,15 @@ int qed_spq_post(struct qed_hwfn *p_hwfn,
                  * Thus, after gaining the answer perform the cleanup here.
                  */
                 rc = qed_spq_block(p_hwfn, p_ent, fw_return_code);
+
+                if (p_ent->queue == &p_spq->unlimited_pending) {
+                        /* This is an allocated p_ent which does not need to
+                         * return to pool.
+                         */
+                        kfree(p_ent);
+                        return rc;
+                }
+
                 if (rc)
                         goto spq_post_fail2;
 
@@ -844,8 +851,12 @@ int qed_spq_completion(struct qed_hwfn *p_hwfn,
                 found->comp_cb.function(p_hwfn, found->comp_cb.cookie, p_data,
                                         fw_return_code);
 
-        if (found->comp_mode != QED_SPQ_MODE_EBLOCK)
-                /* EBLOCK is responsible for freeing its own entry */
+        if ((found->comp_mode != QED_SPQ_MODE_EBLOCK) ||
+            (found->queue == &p_spq->unlimited_pending))
+                /* EBLOCK  is responsible for returning its own entry into the
+                 * free list, unless it originally added the entry into the
+                 * unlimited pending list.
+                 */
                 qed_spq_return_entry(p_hwfn, found);
 
         /* Attempt to post pending requests */
diff --git a/drivers/net/ethernet/qlogic/qed/qed_sriov.h b/drivers/net/ethernet/qlogic/qed/qed_sriov.h
index c8667c65e685..c90b2b6ad969 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_sriov.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.h
@@ -12,11 +12,13 @@
 #include "qed_vf.h"
 #define QED_VF_ARRAY_LENGTH (3)
 
+#ifdef CONFIG_QED_SRIOV
 #define IS_VF(cdev)             ((cdev)->b_is_vf)
 #define IS_PF(cdev)             (!((cdev)->b_is_vf))
-#ifdef CONFIG_QED_SRIOV
 #define IS_PF_SRIOV(p_hwfn)     (!!((p_hwfn)->cdev->p_iov_info))
 #else
+#define IS_VF(cdev)             (0)
+#define IS_PF(cdev)             (1)
 #define IS_PF_SRIOV(p_hwfn)     (0)
 #endif
 #define IS_PF_SRIOV_ALLOC(p_hwfn)       (!!((p_hwfn)->pf_iov_info))
diff --git a/drivers/net/ethernet/qlogic/qede/qede_main.c b/drivers/net/ethernet/qlogic/qede/qede_main.c
index 5d00d1404bfc..f8e11f953acb 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_main.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_main.c
@@ -87,7 +87,9 @@ static const struct pci_device_id qede_pci_tbl[] = {
         {PCI_VDEVICE(QLOGIC, PCI_DEVICE_ID_57980S_100), QEDE_PRIVATE_PF},
         {PCI_VDEVICE(QLOGIC, PCI_DEVICE_ID_57980S_50), QEDE_PRIVATE_PF},
         {PCI_VDEVICE(QLOGIC, PCI_DEVICE_ID_57980S_25), QEDE_PRIVATE_PF},
+#ifdef CONFIG_QED_SRIOV
         {PCI_VDEVICE(QLOGIC, PCI_DEVICE_ID_57980S_IOV), QEDE_PRIVATE_VF},
+#endif
         { 0 }
 };
 
@@ -3229,7 +3231,7 @@ static int qede_stop_queues(struct qede_dev *edev)
         return rc;
 }
 
-static int qede_start_queues(struct qede_dev *edev)
+static int qede_start_queues(struct qede_dev *edev, bool clear_stats)
 {
         int rc, tc, i;
         int vlan_removal_en = 1;
@@ -3460,6 +3462,7 @@ out:
 
 enum qede_load_mode {
         QEDE_LOAD_NORMAL,
+        QEDE_LOAD_RELOAD,
 };
 
 static int qede_load(struct qede_dev *edev, enum qede_load_mode mode)
@@ -3498,7 +3501,7 @@ static int qede_load(struct qede_dev *edev, enum qede_load_mode mode)
                 goto err3;
         DP_INFO(edev, "Setup IRQs succeeded\n");
 
-        rc = qede_start_queues(edev);
+        rc = qede_start_queues(edev, mode != QEDE_LOAD_RELOAD);
         if (rc)
                 goto err4;
         DP_INFO(edev, "Start VPORT, RXQ and TXQ succeeded\n");
@@ -3553,7 +3556,7 @@ void qede_reload(struct qede_dev *edev,
         if (func)
                 func(edev, args);
 
-        qede_load(edev, QEDE_LOAD_NORMAL);
+        qede_load(edev, QEDE_LOAD_RELOAD);
 
         mutex_lock(&edev->qede_lock);
         qede_config_rx_mode(edev->ndev);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
index 7bd6f25b4625..607bb7d4514d 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
@@ -2220,7 +2220,7 @@ void qlcnic_83xx_process_rcv_ring_diag(struct qlcnic_host_sds_ring *sds_ring)
         if (!opcode)
                 return;
 
-        ring = QLCNIC_FETCH_RING_ID(qlcnic_83xx_hndl(sts_data[0]));
+        ring = QLCNIC_FETCH_RING_ID(sts_data[0]);
         qlcnic_83xx_process_rcv_diag(adapter, ring, sts_data);
         desc = &sds_ring->desc_head[consumer];
         desc->status_desc_data[0] = cpu_to_le64(STATUS_OWNER_PHANTOM);
diff --git a/drivers/net/ethernet/sfc/farch.c b/drivers/net/ethernet/sfc/farch.c
index 133e9e35be9e..4c83739d158f 100644
--- a/drivers/net/ethernet/sfc/farch.c
+++ b/drivers/net/ethernet/sfc/farch.c
@@ -104,7 +104,8 @@ int efx_farch_test_registers(struct efx_nic *efx,
                              const struct efx_farch_register_test *regs,
                              size_t n_regs)
 {
-        unsigned address = 0, i, j;
+        unsigned address = 0;
+        int i, j;
         efx_oword_t mask, imask, original, reg, buf;
 
         for (i = 0; i < n_regs; ++i) {
diff --git a/drivers/net/ethernet/sfc/mcdi_port.c b/drivers/net/ethernet/sfc/mcdi_port.c
index 7f295c4d7b80..2a9228a6e4a0 100644
--- a/drivers/net/ethernet/sfc/mcdi_port.c
+++ b/drivers/net/ethernet/sfc/mcdi_port.c
@@ -189,11 +189,12 @@ static u32 mcdi_to_ethtool_cap(u32 media, u32 cap)
 
         case MC_CMD_MEDIA_XFP:
         case MC_CMD_MEDIA_SFP_PLUS:
-                result |= SUPPORTED_FIBRE;
-                break;
-
         case MC_CMD_MEDIA_QSFP_PLUS:
                 result |= SUPPORTED_FIBRE;
+                if (cap & (1 << MC_CMD_PHY_CAP_1000FDX_LBN))
+                        result |= SUPPORTED_1000baseT_Full;
+                if (cap & (1 << MC_CMD_PHY_CAP_10000FDX_LBN))
+                        result |= SUPPORTED_10000baseT_Full;
                 if (cap & (1 << MC_CMD_PHY_CAP_40000FDX_LBN))
                         result |= SUPPORTED_40000baseCR4_Full;
                 break;
diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c
index 8af25563f627..b5ab5e120bca 100644
--- a/drivers/net/ethernet/smsc/smsc911x.c
+++ b/drivers/net/ethernet/smsc/smsc911x.c
@@ -116,7 +116,6 @@ struct smsc911x_data {
 
         struct phy_device *phy_dev;
         struct mii_bus *mii_bus;
-        int phy_irq[PHY_MAX_ADDR];
         unsigned int using_extphy;
         int last_duplex;
         int last_carrier;
@@ -1073,7 +1072,6 @@ static int smsc911x_mii_init(struct platform_device *pdev,
         pdata->mii_bus->priv = pdata;
         pdata->mii_bus->read = smsc911x_mii_read;
         pdata->mii_bus->write = smsc911x_mii_write;
-        memcpy(pdata->mii_bus->irq, pdata->phy_irq, sizeof(pdata->mii_bus));
 
         pdata->mii_bus->parent = &pdev->dev;
 
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
index 4f7283d05588..44da877d2483 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
@@ -156,7 +156,7 @@ static void dwmac4_set_filter(struct mac_device_info *hw,
                 struct netdev_hw_addr *ha;
 
                 netdev_for_each_uc_addr(ha, dev) {
-                        dwmac4_set_umac_addr(ioaddr, ha->addr, reg);
+                        dwmac4_set_umac_addr(hw, ha->addr, reg);
                         reg++;
                 }
         }
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index eac45d0c75e2..a473c182c91d 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -3450,8 +3450,6 @@ int stmmac_resume(struct device *dev)
         if (!netif_running(ndev))
                 return 0;
 
-        spin_lock_irqsave(&priv->lock, flags);
-
         /* Power Down bit, into the PM register, is cleared
          * automatically as soon as a magic packet or a Wake-up frame
          * is received. Anyway, it's better to manually clear
@@ -3459,7 +3457,9 @@ int stmmac_resume(struct device *dev)
          * from another devices (e.g. serial console).
          */
         if (device_may_wakeup(priv->device)) {
+                spin_lock_irqsave(&priv->lock, flags);
                 priv->hw->mac->pmt(priv->hw, 0);
+                spin_unlock_irqrestore(&priv->lock, flags);
                 priv->irq_wake = 0;
         } else {
                 pinctrl_pm_select_default_state(priv->device);
@@ -3473,6 +3473,8 @@ int stmmac_resume(struct device *dev)
 
         netif_device_attach(ndev);
 
+        spin_lock_irqsave(&priv->lock, flags);
+
         priv->cur_rx = 0;
         priv->dirty_rx = 0;
         priv->dirty_tx = 0;
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 4b08a2f52b3e..53190894f17a 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -1339,7 +1339,7 @@ static int cpsw_ndo_open(struct net_device *ndev)
         if (priv->coal_intvl != 0) {
                 struct ethtool_coalesce coal;
 
-                coal.rx_coalesce_usecs = (priv->coal_intvl << 4);
+                coal.rx_coalesce_usecs = priv->coal_intvl;
                 cpsw_set_coalesce(ndev, &coal);
         }
 
@@ -2505,8 +2505,6 @@ static int cpsw_probe(struct platform_device *pdev)
 clean_ale_ret:
         cpsw_ale_destroy(priv->ale);
 clean_dma_ret:
-        cpdma_chan_destroy(priv->txch);
-        cpdma_chan_destroy(priv->rxch);
         cpdma_ctlr_destroy(priv->dma);
 clean_runtime_disable_ret:
         pm_runtime_disable(&pdev->dev);
@@ -2534,8 +2532,6 @@ static int cpsw_remove(struct platform_device *pdev)
         unregister_netdev(ndev);
 
         cpsw_ale_destroy(priv->ale);
-        cpdma_chan_destroy(priv->txch);
-        cpdma_chan_destroy(priv->rxch);
         cpdma_ctlr_destroy(priv->dma);
         pm_runtime_disable(&pdev->dev);
         device_for_each_child(&pdev->dev, NULL, cpsw_remove_child_device);
diff --git a/drivers/net/ethernet/tile/tilegx.c b/drivers/net/ethernet/tile/tilegx.c
index 0a15acc075b3..11213a38c795 100644
--- a/drivers/net/ethernet/tile/tilegx.c
+++ b/drivers/net/ethernet/tile/tilegx.c
@@ -462,7 +462,7 @@ static void tile_tx_timestamp(struct sk_buff *skb, int instance)
         if (unlikely((shtx->tx_flags & SKBTX_HW_TSTAMP) != 0)) {
                 struct mpipe_data *md = &mpipe_data[instance];
                 struct skb_shared_hwtstamps shhwtstamps;
-                struct timespec ts;
+                struct timespec64 ts;
 
                 shtx->tx_flags |= SKBTX_IN_PROGRESS;
                 gxio_mpipe_get_timestamp(&md->context, &ts);
@@ -886,9 +886,9 @@ static struct ptp_clock_info ptp_mpipe_caps = {
 /* Sync mPIPE's timestamp up with Linux system time and register PTP clock. */
 static void register_ptp_clock(struct net_device *dev, struct mpipe_data *md)
 {
-        struct timespec ts;
+        struct timespec64 ts;
 
-        getnstimeofday(&ts);
+        ktime_get_ts64(&ts);
         gxio_mpipe_set_timestamp(&md->context, &ts);
 
         mutex_init(&md->ptp_lock);
diff --git a/drivers/net/fddi/skfp/Makefile b/drivers/net/fddi/skfp/Makefile
index b0be0234abf6..a957a1c7e5ba 100644
--- a/drivers/net/fddi/skfp/Makefile
+++ b/drivers/net/fddi/skfp/Makefile
@@ -17,4 +17,4 @@ skfp-objs :=  skfddi.o    hwmtm.o    fplustm.o  smt.o      cfm.o     \
 #   projects. To keep the source common for all those drivers (and
 #   thus simplify fixes to it), please do not clean it up!
 
-ccflags-y := -Idrivers/net/skfp -DPCI -DMEM_MAPPED_IO -Wno-strict-prototypes
+ccflags-y := -DPCI -DMEM_MAPPED_IO -Wno-strict-prototypes
diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
index cadefe4fdaa2..cc39cefeae45 100644
--- a/drivers/net/geneve.c
+++ b/drivers/net/geneve.c
@@ -958,8 +958,8 @@ tx_error:
                 dev->stats.collisions++;
         else if (err == -ENETUNREACH)
                 dev->stats.tx_carrier_errors++;
-        else
-                dev->stats.tx_errors++;
+
+        dev->stats.tx_errors++;
         return NETDEV_TX_OK;
 }
 
@@ -1048,8 +1048,8 @@ tx_error:
                 dev->stats.collisions++;
         else if (err == -ENETUNREACH)
                 dev->stats.tx_carrier_errors++;
-        else
-                dev->stats.tx_errors++;
+
+        dev->stats.tx_errors++;
         return NETDEV_TX_OK;
 }
 #endif
@@ -1508,6 +1508,7 @@ struct net_device *geneve_dev_create_fb(struct net *net, const char *name,
 {
         struct nlattr *tb[IFLA_MAX + 1];
         struct net_device *dev;
+        LIST_HEAD(list_kill);
         int err;
 
         memset(tb, 0, sizeof(tb));
@@ -1519,8 +1520,10 @@ struct net_device *geneve_dev_create_fb(struct net *net, const char *name,
         err = geneve_configure(net, dev, &geneve_remote_unspec,
                                0, 0, 0, 0, htons(dst_port), true,
                                GENEVE_F_UDP_ZERO_CSUM6_RX);
-        if (err)
-                goto err;
+        if (err) {
+                free_netdev(dev);
+                return ERR_PTR(err);
+        }
 
         /* openvswitch users expect packet sizes to be unrestricted,
          * so set the largest MTU we can.
@@ -1529,10 +1532,15 @@ struct net_device *geneve_dev_create_fb(struct net *net, const char *name,
         if (err)
                 goto err;
 
+        err = rtnl_configure_link(dev, NULL);
+        if (err < 0)
+                goto err;
+
         return dev;
 
  err:
-        free_netdev(dev);
+        geneve_dellink(dev, &list_kill);
+        unregister_netdevice_many(&list_kill);
         return ERR_PTR(err);
 }
 EXPORT_SYMBOL_GPL(geneve_dev_create_fb);
diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
index 47ee2c840b55..0e7eff7f1cd2 100644
--- a/drivers/net/macsec.c
+++ b/drivers/net/macsec.c
@@ -605,12 +605,41 @@ static void macsec_encrypt_done(struct crypto_async_request *base, int err)
         dev_put(dev);
 }
 
+static struct aead_request *macsec_alloc_req(struct crypto_aead *tfm,
+                                             unsigned char **iv,
+                                             struct scatterlist **sg)
+{
+        size_t size, iv_offset, sg_offset;
+        struct aead_request *req;
+        void *tmp;
+
+        size = sizeof(struct aead_request) + crypto_aead_reqsize(tfm);
+        iv_offset = size;
+        size += GCM_AES_IV_LEN;
+
+        size = ALIGN(size, __alignof__(struct scatterlist));
+        sg_offset = size;
+        size += sizeof(struct scatterlist) * (MAX_SKB_FRAGS + 1);
+
+        tmp = kmalloc(size, GFP_ATOMIC);
+        if (!tmp)
+                return NULL;
+
+        *iv = (unsigned char *)(tmp + iv_offset);
+        *sg = (struct scatterlist *)(tmp + sg_offset);
+        req = tmp;
+
+        aead_request_set_tfm(req, tfm);
+
+        return req;
+}
+
 static struct sk_buff *macsec_encrypt(struct sk_buff *skb,
                                       struct net_device *dev)
 {
         int ret;
-        struct scatterlist sg[MAX_SKB_FRAGS + 1];
-        unsigned char iv[GCM_AES_IV_LEN];
+        struct scatterlist *sg;
+        unsigned char *iv;
         struct ethhdr *eth;
         struct macsec_eth_header *hh;
         size_t unprotected_len;
@@ -668,8 +697,6 @@ static struct sk_buff *macsec_encrypt(struct sk_buff *skb,
         macsec_fill_sectag(hh, secy, pn);
         macsec_set_shortlen(hh, unprotected_len - 2 * ETH_ALEN);
 
-        macsec_fill_iv(iv, secy->sci, pn);
-
         skb_put(skb, secy->icv_len);
 
         if (skb->len - ETH_HLEN > macsec_priv(dev)->real_dev->mtu) {
@@ -684,13 +711,15 @@ static struct sk_buff *macsec_encrypt(struct sk_buff *skb,
                 return ERR_PTR(-EINVAL);
         }
 
-        req = aead_request_alloc(tx_sa->key.tfm, GFP_ATOMIC);
+        req = macsec_alloc_req(tx_sa->key.tfm, &iv, &sg);
         if (!req) {
                 macsec_txsa_put(tx_sa);
                 kfree_skb(skb);
                 return ERR_PTR(-ENOMEM);
         }
 
+        macsec_fill_iv(iv, secy->sci, pn);
+
         sg_init_table(sg, MAX_SKB_FRAGS + 1);
         skb_to_sgvec(skb, sg, 0, skb->len);
 
@@ -861,7 +890,6 @@ static void macsec_decrypt_done(struct crypto_async_request *base, int err)
 out:
         macsec_rxsa_put(rx_sa);
         dev_put(dev);
-        return;
 }
 
 static struct sk_buff *macsec_decrypt(struct sk_buff *skb,
@@ -871,8 +899,8 @@ static struct sk_buff *macsec_decrypt(struct sk_buff *skb,
                                       struct macsec_secy *secy)
 {
         int ret;
-        struct scatterlist sg[MAX_SKB_FRAGS + 1];
-        unsigned char iv[GCM_AES_IV_LEN];
+        struct scatterlist *sg;
+        unsigned char *iv;
         struct aead_request *req;
         struct macsec_eth_header *hdr;
         u16 icv_len = secy->icv_len;
@@ -882,7 +910,7 @@ static struct sk_buff *macsec_decrypt(struct sk_buff *skb,
         if (!skb)
                 return ERR_PTR(-ENOMEM);
 
-        req = aead_request_alloc(rx_sa->key.tfm, GFP_ATOMIC);
+        req = macsec_alloc_req(rx_sa->key.tfm, &iv, &sg);
         if (!req) {
                 kfree_skb(skb);
                 return ERR_PTR(-ENOMEM);
@@ -1234,7 +1262,7 @@ static struct crypto_aead *macsec_alloc_tfm(char *key, int key_len, int icv_len)
         struct crypto_aead *tfm;
         int ret;
 
-        tfm = crypto_alloc_aead("gcm(aes)", 0, CRYPTO_ALG_ASYNC);
+        tfm = crypto_alloc_aead("gcm(aes)", 0, 0);
         if (!tfm || IS_ERR(tfm))
                 return NULL;
 
@@ -3361,6 +3389,7 @@ static void __exit macsec_exit(void)
         genl_unregister_family(&macsec_fam);
         rtnl_link_unregister(&macsec_link_ops);
         unregister_netdevice_notifier(&macsec_notifier);
+        rcu_barrier();
 }
 
 module_init(macsec_init);
diff --git a/drivers/net/phy/fixed_phy.c b/drivers/net/phy/fixed_phy.c
index 2d2e4339f0df..9ec7f7353434 100644
--- a/drivers/net/phy/fixed_phy.c
+++ b/drivers/net/phy/fixed_phy.c
@@ -23,6 +23,7 @@
 #include <linux/slab.h>
 #include <linux/of.h>
 #include <linux/gpio.h>
+#include <linux/idr.h>
 
 #define MII_REGS_NUM 29
 
@@ -286,6 +287,8 @@ err_regs:
 }
 EXPORT_SYMBOL_GPL(fixed_phy_add);
 
+static DEFINE_IDA(phy_fixed_ida);
+
 static void fixed_phy_del(int phy_addr)
 {
         struct fixed_mdio_bus *fmb = &platform_fmb;
@@ -297,14 +300,12 @@ static void fixed_phy_del(int phy_addr)
                         if (gpio_is_valid(fp->link_gpio))
                                 gpio_free(fp->link_gpio);
                         kfree(fp);
+                        ida_simple_remove(&phy_fixed_ida, phy_addr);
                         return;
                 }
         }
 }
 
-static int phy_fixed_addr;
-static DEFINE_SPINLOCK(phy_fixed_addr_lock);
-
 struct phy_device *fixed_phy_register(unsigned int irq,
                                       struct fixed_phy_status *status,
                                       int link_gpio,
@@ -319,17 +320,15 @@ struct phy_device *fixed_phy_register(unsigned int irq,
                 return ERR_PTR(-EPROBE_DEFER);
 
         /* Get the next available PHY address, up to PHY_MAX_ADDR */
-        spin_lock(&phy_fixed_addr_lock);
-        if (phy_fixed_addr == PHY_MAX_ADDR) {
-                spin_unlock(&phy_fixed_addr_lock);
-                return ERR_PTR(-ENOSPC);
-        }
-        phy_addr = phy_fixed_addr++;
-        spin_unlock(&phy_fixed_addr_lock);
+        phy_addr = ida_simple_get(&phy_fixed_ida, 0, PHY_MAX_ADDR, GFP_KERNEL);
+        if (phy_addr < 0)
+                return ERR_PTR(phy_addr);
 
         ret = fixed_phy_add(irq, phy_addr, status, link_gpio);
-        if (ret < 0)
+        if (ret < 0) {
+                ida_simple_remove(&phy_fixed_ida, phy_addr);
                 return ERR_PTR(ret);
+        }
 
         phy = get_phy_device(fmb->mii_bus, phy_addr, false);
         if (IS_ERR(phy)) {
@@ -434,6 +433,7 @@ static void __exit fixed_mdio_bus_exit(void)
                 list_del(&fp->node);
                 kfree(fp);
         }
+        ida_destroy(&phy_fixed_ida);
 }
 module_exit(fixed_mdio_bus_exit);
 
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index 280e8795b463..ec2c1eee6405 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -285,6 +285,48 @@ static int marvell_config_aneg(struct phy_device *phydev)
         return 0;
 }
 
+static int m88e1111_config_aneg(struct phy_device *phydev)
+{
+        int err;
+
+        /* The Marvell PHY has an errata which requires
+         * that certain registers get written in order
+         * to restart autonegotiation
+         */
+        err = phy_write(phydev, MII_BMCR, BMCR_RESET);
+
+        err = marvell_set_polarity(phydev, phydev->mdix);
+        if (err < 0)
+                return err;
+
+        err = phy_write(phydev, MII_M1111_PHY_LED_CONTROL,
+                        MII_M1111_PHY_LED_DIRECT);
+        if (err < 0)
+                return err;
+
+        err = genphy_config_aneg(phydev);
+        if (err < 0)
+                return err;
+
+        if (phydev->autoneg != AUTONEG_ENABLE) {
+                int bmcr;
+
+                /* A write to speed/duplex bits (that is performed by
+                 * genphy_config_aneg() call above) must be followed by
+                 * a software reset. Otherwise, the write has no effect.
+                 */
+                bmcr = phy_read(phydev, MII_BMCR);
+                if (bmcr < 0)
+                        return bmcr;
+
+                err = phy_write(phydev, MII_BMCR, bmcr | BMCR_RESET);
+                if (err < 0)
+                        return err;
+        }
+
+        return 0;
+}
+
 #ifdef CONFIG_OF_MDIO
 /*
  * Set and/or override some configuration registers based on the
@@ -407,15 +449,7 @@ static int m88e1121_config_aneg(struct phy_device *phydev)
         if (err < 0)
                 return err;
 
-        oldpage = phy_read(phydev, MII_MARVELL_PHY_PAGE);
-
-        phy_write(phydev, MII_MARVELL_PHY_PAGE, MII_88E1121_PHY_LED_PAGE);
-        phy_write(phydev, MII_88E1121_PHY_LED_CTRL, MII_88E1121_PHY_LED_DEF);
-        phy_write(phydev, MII_MARVELL_PHY_PAGE, oldpage);
-
-        err = genphy_config_aneg(phydev);
-
-        return err;
+        return genphy_config_aneg(phydev);
 }
 
 static int m88e1318_config_aneg(struct phy_device *phydev)
@@ -636,6 +670,28 @@ static int m88e1111_config_init(struct phy_device *phydev)
         return phy_write(phydev, MII_BMCR, BMCR_RESET);
 }
 
+static int m88e1121_config_init(struct phy_device *phydev)
+{
+        int err, oldpage;
+
+        oldpage = phy_read(phydev, MII_MARVELL_PHY_PAGE);
+
+        err = phy_write(phydev, MII_MARVELL_PHY_PAGE, MII_88E1121_PHY_LED_PAGE);
+        if (err < 0)
+                return err;
+
+        /* Default PHY LED config: LED[0] .. Link, LED[1] .. Activity */
+        err = phy_write(phydev, MII_88E1121_PHY_LED_CTRL,
+                        MII_88E1121_PHY_LED_DEF);
+        if (err < 0)
+                return err;
+
+        phy_write(phydev, MII_MARVELL_PHY_PAGE, oldpage);
+
+        /* Set marvell,reg-init configuration from device tree */
+        return marvell_config_init(phydev);
+}
+
 static int m88e1510_config_init(struct phy_device *phydev)
 {
         int err;
@@ -668,7 +724,7 @@ static int m88e1510_config_init(struct phy_device *phydev)
                         return err;
         }
 
-        return marvell_config_init(phydev);
+        return m88e1121_config_init(phydev);
 }
 
 static int m88e1118_config_aneg(struct phy_device *phydev)
@@ -1161,7 +1217,7 @@ static struct phy_driver marvell_drivers[] = {
                 .flags = PHY_HAS_INTERRUPT,
                 .probe = marvell_probe,
                 .config_init = &m88e1111_config_init,
-                .config_aneg = &marvell_config_aneg,
+                .config_aneg = &m88e1111_config_aneg,
                 .read_status = &marvell_read_status,
                 .ack_interrupt = &marvell_ack_interrupt,
                 .config_intr = &marvell_config_intr,
@@ -1196,7 +1252,7 @@ static struct phy_driver marvell_drivers[] = {
                 .features = PHY_GBIT_FEATURES,
                 .flags = PHY_HAS_INTERRUPT,
                 .probe = marvell_probe,
-                .config_init = &marvell_config_init,
+                .config_init = &m88e1121_config_init,
                 .config_aneg = &m88e1121_config_aneg,
                 .read_status = &marvell_read_status,
                 .ack_interrupt = &marvell_ack_interrupt,
@@ -1215,7 +1271,7 @@ static struct phy_driver marvell_drivers[] = {
                 .features = PHY_GBIT_FEATURES,
                 .flags = PHY_HAS_INTERRUPT,
                 .probe = marvell_probe,
-                .config_init = &marvell_config_init,
+                .config_init = &m88e1121_config_init,
                 .config_aneg = &m88e1318_config_aneg,
                 .read_status = &marvell_read_status,
                 .ack_interrupt = &marvell_ack_interrupt,
diff --git a/drivers/net/phy/smsc.c b/drivers/net/phy/smsc.c
index 2e21e9366f76..b62c4aaee40b 100644
--- a/drivers/net/phy/smsc.c
+++ b/drivers/net/phy/smsc.c
@@ -75,22 +75,13 @@ static int smsc_phy_reset(struct phy_device *phydev)
          * in all capable mode before using it.
          */
         if ((rc & MII_LAN83C185_MODE_MASK) == MII_LAN83C185_MODE_POWERDOWN) {
-                int timeout = 50000;
-
-                /* set "all capable" mode and reset the phy */
+                /* set "all capable" mode */
                 rc |= MII_LAN83C185_MODE_ALL;
                 phy_write(phydev, MII_LAN83C185_SPECIAL_MODES, rc);
-                phy_write(phydev, MII_BMCR, BMCR_RESET);
-
-                /* wait end of reset (max 500 ms) */
-                do {
-                        udelay(10);
-                        if (timeout-- == 0)
-                                return -1;
-                        rc = phy_read(phydev, MII_BMCR);
-                } while (rc & BMCR_RESET);
         }
-        return 0;
+
+        /* reset the phy */
+        return genphy_soft_reset(phydev);
 }
 
 static int lan911x_config_init(struct phy_device *phydev)
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 2ace126533cd..fdee77207323 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -1203,8 +1203,10 @@ static int team_port_add(struct team *team, struct net_device *port_dev)
                 goto err_dev_open;
         }
 
+        netif_addr_lock_bh(dev);
         dev_uc_sync_multiple(port_dev, dev);
         dev_mc_sync_multiple(port_dev, dev);
+        netif_addr_unlock_bh(dev);
 
         err = vlan_vids_add_by_dev(port_dev, dev);
         if (err) {
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index 3f9f6ed3eec4..4e257b8d8f3e 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -31,7 +31,7 @@
 #define NETNEXT_VERSION         "08"
 
 /* Information for net */
-#define NET_VERSION             "3"
+#define NET_VERSION             "4"
 
 #define DRIVER_VERSION          "v1." NETNEXT_VERSION "." NET_VERSION
 #define DRIVER_AUTHOR "Realtek linux nic maintainers <nic_swsd@realtek.com>"
@@ -116,6 +116,7 @@
 #define USB_TX_DMA              0xd434
 #define USB_TOLERANCE           0xd490
 #define USB_LPM_CTRL            0xd41a
+#define USB_BMU_RESET           0xd4b0
 #define USB_UPS_CTRL            0xd800
 #define USB_MISC_0              0xd81a
 #define USB_POWER_CUT           0xd80a
@@ -338,6 +339,10 @@
 #define TEST_MODE_DISABLE       0x00000001
 #define TX_SIZE_ADJUST1         0x00000100
 
+/* USB_BMU_RESET */
+#define BMU_RESET_EP_IN         0x01
+#define BMU_RESET_EP_OUT        0x02
+
 /* USB_UPS_CTRL */
 #define POWER_CUT               0x0100
 
@@ -2169,7 +2174,7 @@ static void r8153_set_rx_early_timeout(struct r8152 *tp)
 static void r8153_set_rx_early_size(struct r8152 *tp)
 {
         u32 mtu = tp->netdev->mtu;
-        u32 ocp_data = (agg_buf_sz - mtu - VLAN_ETH_HLEN - VLAN_HLEN) / 4;
+        u32 ocp_data = (agg_buf_sz - mtu - VLAN_ETH_HLEN - VLAN_HLEN) / 8;
 
         ocp_write_word(tp, MCU_TYPE_USB, USB_RX_EARLY_SIZE, ocp_data);
 }
@@ -2456,6 +2461,17 @@ static void r8153_teredo_off(struct r8152 *tp)
         ocp_write_dword(tp, MCU_TYPE_PLA, PLA_TEREDO_TIMER, 0);
 }
 
+static void rtl_reset_bmu(struct r8152 *tp)
+{
+        u32 ocp_data;
+
+        ocp_data = ocp_read_byte(tp, MCU_TYPE_USB, USB_BMU_RESET);
+        ocp_data &= ~(BMU_RESET_EP_IN | BMU_RESET_EP_OUT);
+        ocp_write_byte(tp, MCU_TYPE_USB, USB_BMU_RESET, ocp_data);
+        ocp_data |= BMU_RESET_EP_IN | BMU_RESET_EP_OUT;
+        ocp_write_byte(tp, MCU_TYPE_USB, USB_BMU_RESET, ocp_data);
+}
+
 static void r8152_aldps_en(struct r8152 *tp, bool enable)
 {
         if (enable) {
@@ -2681,6 +2697,7 @@ static void r8153_first_init(struct r8152 *tp)
         r8153_hw_phy_cfg(tp);
 
         rtl8152_nic_reset(tp);
+        rtl_reset_bmu(tp);
 
         ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA, PLA_OOB_CTRL);
         ocp_data &= ~NOW_IS_OOB;
@@ -2742,6 +2759,7 @@ static void r8153_enter_oob(struct r8152 *tp)
         ocp_write_byte(tp, MCU_TYPE_PLA, PLA_OOB_CTRL, ocp_data);
 
         rtl_disable(tp);
+        rtl_reset_bmu(tp);
 
         for (i = 0; i < 1000; i++) {
                 ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA, PLA_OOB_CTRL);
@@ -2803,6 +2821,7 @@ static void rtl8153_disable(struct r8152 *tp)
 {
         r8153_aldps_en(tp, false);
         rtl_disable(tp);
+        rtl_reset_bmu(tp);
         r8153_aldps_en(tp, true);
         usb_enable_lpm(tp->udev);
 }
@@ -3382,15 +3401,11 @@ static void r8153_init(struct r8152 *tp)
         r8153_power_cut_en(tp, false);
         r8153_u1u2en(tp, true);
 
-        ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL, ALDPS_SPDWN_RATIO);
-        ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL2, EEE_SPDWN_RATIO);
-        ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL3,
-                       PKT_AVAIL_SPDWN_EN | SUSPEND_SPDWN_EN |
-                       U1U2_SPDWN_EN | L1_SPDWN_EN);
-        ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL4,
-                       PWRSAVE_SPDWN_EN | RXDV_SPDWN_EN | TX10MIDLE_EN |
-                       TP100_SPDWN_EN | TP500_SPDWN_EN | TP1000_SPDWN_EN |
-                       EEE_SPDWN_EN);
+        /* MAC clock speed down */
+        ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL, 0);
+        ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL2, 0);
+        ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL3, 0);
+        ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL4, 0);
 
         r8153_enable_eee(tp);
         r8153_aldps_en(tp, true);
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index db8022ae415b..08885bc8d6db 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -1369,7 +1369,7 @@ vmxnet3_rq_rx_complete(struct vmxnet3_rx_queue *rq,
                                 rcdlro = (struct Vmxnet3_RxCompDescExt *)rcd;
 
                                 segCnt = rcdlro->segCnt;
-                                BUG_ON(segCnt <= 1);
+                                WARN_ON_ONCE(segCnt == 0);
                                 mss = rcdlro->mss;
                                 if (unlikely(segCnt <= 1))
                                         segCnt = 0;
diff --git a/drivers/net/vmxnet3/vmxnet3_int.h b/drivers/net/vmxnet3/vmxnet3_int.h
index c4825392d64b..3d2b64e63408 100644
--- a/drivers/net/vmxnet3/vmxnet3_int.h
+++ b/drivers/net/vmxnet3/vmxnet3_int.h
@@ -69,10 +69,10 @@
 /*
  * Version numbers
  */
-#define VMXNET3_DRIVER_VERSION_STRING   "1.4.7.0-k"
+#define VMXNET3_DRIVER_VERSION_STRING   "1.4.8.0-k"
 
 /* a 32-bit int, each byte encode a verion number in VMXNET3_DRIVER_VERSION */
-#define VMXNET3_DRIVER_VERSION_NUM      0x01040700
+#define VMXNET3_DRIVER_VERSION_NUM      0x01040800
 
 #if defined(CONFIG_PCI_MSI)
         /* RSS only makes sense if MSI-X is supported. */
diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
index dff08842f26d..8bd8c7e1ee87 100644
--- a/drivers/net/vrf.c
+++ b/drivers/net/vrf.c
@@ -304,7 +304,7 @@ static int vrf_rt6_create(struct net_device *dev)
         dst_hold(&rt6->dst);
 
         rt6->rt6i_table = rt6i_table;
-        rt6->dst.output = vrf_output6;
+        rt6->dst.output = vrf_output6;
         rcu_assign_pointer(vrf->rt6, rt6);
 
         rc = 0;
@@ -403,7 +403,7 @@ static int vrf_rtable_create(struct net_device *dev)
         if (!rth)
                 return -ENOMEM;
 
-        rth->dst.output = vrf_output;
+        rth->dst.output = vrf_output;
         rth->rt_table_id = vrf->tb_id;
 
         rcu_assign_pointer(vrf->rth, rth);
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index f999db2f97b4..b3b9db68f758 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -2952,30 +2952,6 @@ static int vxlan_dev_configure(struct net *src_net, struct net_device *dev,
         return 0;
 }
 
-struct net_device *vxlan_dev_create(struct net *net, const char *name,
-                                    u8 name_assign_type, struct vxlan_config *conf)
-{
-        struct nlattr *tb[IFLA_MAX+1];
-        struct net_device *dev;
-        int err;
-
-        memset(&tb, 0, sizeof(tb));
-
-        dev = rtnl_create_link(net, name, name_assign_type,
-                               &vxlan_link_ops, tb);
-        if (IS_ERR(dev))
-                return dev;
-
-        err = vxlan_dev_configure(net, dev, conf);
-        if (err < 0) {
-                free_netdev(dev);
-                return ERR_PTR(err);
-        }
-
-        return dev;
-}
-EXPORT_SYMBOL_GPL(vxlan_dev_create);
-
 static int vxlan_newlink(struct net *src_net, struct net_device *dev,
                          struct nlattr *tb[], struct nlattr *data[])
 {
@@ -3268,6 +3244,40 @@ static struct rtnl_link_ops vxlan_link_ops __read_mostly = {
         .get_link_net   = vxlan_get_link_net,
 };
 
+struct net_device *vxlan_dev_create(struct net *net, const char *name,
+                                    u8 name_assign_type,
+                                    struct vxlan_config *conf)
+{
+        struct nlattr *tb[IFLA_MAX + 1];
+        struct net_device *dev;
+        int err;
+
+        memset(&tb, 0, sizeof(tb));
+
+        dev = rtnl_create_link(net, name, name_assign_type,
+                               &vxlan_link_ops, tb);
+        if (IS_ERR(dev))
+                return dev;
+
+        err = vxlan_dev_configure(net, dev, conf);
+        if (err < 0) {
+                free_netdev(dev);
+                return ERR_PTR(err);
+        }
+
+        err = rtnl_configure_link(dev, NULL);
+        if (err < 0) {
+                LIST_HEAD(list_kill);
+
+                vxlan_dellink(dev, &list_kill);
+                unregister_netdevice_many(&list_kill);
+                return ERR_PTR(err);
+        }
+
+        return dev;
+}
+EXPORT_SYMBOL_GPL(vxlan_dev_create);
+
 static void vxlan_handle_lowerdev_unregister(struct vxlan_net *vn,
                                              struct net_device *dev)
 {
diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c
index 49af62428c88..a92a0ba829f5 100644
--- a/drivers/net/wireless/ath/ath10k/core.c
+++ b/drivers/net/wireless/ath/ath10k/core.c
@@ -1083,7 +1083,7 @@ int ath10k_core_fetch_firmware_api_n(struct ath10k *ar, const char *name,
                         }
 
                         ath10k_dbg_dump(ar, ATH10K_DBG_BOOT, "features", "",
-                                        ar->running_fw->fw_file.fw_features,
+                                        fw_file->fw_features,
                                         sizeof(fw_file->fw_features));
                         break;
                 case ATH10K_FW_IE_FW_IMAGE:
diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
index cc979a4faeb0..813cdd2621a1 100644
--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
@@ -1904,7 +1904,6 @@ static void ath10k_htt_rx_in_ord_ind(struct ath10k *ar, struct sk_buff *skb)
                         return;
                 }
         }
-        ath10k_htt_rx_msdu_buff_replenish(htt);
 }
 
 static void ath10k_htt_rx_tx_fetch_resp_id_confirm(struct ath10k *ar,
diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index 6dd1d26b357f..4040f9413e86 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -679,10 +679,10 @@ static int ath10k_peer_create(struct ath10k *ar,
 
         peer = ath10k_peer_find(ar, vdev_id, addr);
         if (!peer) {
+                spin_unlock_bh(&ar->data_lock);
                 ath10k_warn(ar, "failed to find peer %pM on vdev %i after creation\n",
                             addr, vdev_id);
                 ath10k_wmi_peer_delete(ar, vdev_id, addr);
-                spin_unlock_bh(&ar->data_lock);
                 return -ENOENT;
         }
 
diff --git a/drivers/net/wireless/ath/ath9k/reg.h b/drivers/net/wireless/ath/ath9k/reg.h
index 9272ca90632b..80ff69f99229 100644
--- a/drivers/net/wireless/ath/ath9k/reg.h
+++ b/drivers/net/wireless/ath/ath9k/reg.h
@@ -1122,12 +1122,12 @@ enum {
 #define AR9300_NUM_GPIO                          16
 #define AR9330_NUM_GPIO                          16
 #define AR9340_NUM_GPIO                          23
-#define AR9462_NUM_GPIO                          10
+#define AR9462_NUM_GPIO                          14
 #define AR9485_NUM_GPIO                          12
 #define AR9531_NUM_GPIO                          18
 #define AR9550_NUM_GPIO                          24
 #define AR9561_NUM_GPIO                          23
-#define AR9565_NUM_GPIO                          12
+#define AR9565_NUM_GPIO                          14
 #define AR9580_NUM_GPIO                          16
 #define AR7010_NUM_GPIO                          16
 
@@ -1139,12 +1139,12 @@ enum {
 #define AR9300_GPIO_MASK                         0x0000F4FF
 #define AR9330_GPIO_MASK                         0x0000F4FF
 #define AR9340_GPIO_MASK                         0x0000000F
-#define AR9462_GPIO_MASK                         0x000003FF
+#define AR9462_GPIO_MASK                         0x00003FFF
 #define AR9485_GPIO_MASK                         0x00000FFF
 #define AR9531_GPIO_MASK                         0x0000000F
 #define AR9550_GPIO_MASK                         0x0000000F
 #define AR9561_GPIO_MASK                         0x0000000F
-#define AR9565_GPIO_MASK                         0x00000FFF
+#define AR9565_GPIO_MASK                         0x00003FFF
 #define AR9580_GPIO_MASK                         0x0000F4FF
 #define AR7010_GPIO_MASK                         0x0000FFFF
 
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index d0631b6cfd53..62f475e31077 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -2540,12 +2540,14 @@ brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
                            const u8 *mac, struct station_info *sinfo)
 {
         struct brcmf_if *ifp = netdev_priv(ndev);
+        struct brcmf_scb_val_le scb_val;
         s32 err = 0;
         struct brcmf_sta_info_le sta_info_le;
         u32 sta_flags;
         u32 is_tdls_peer;
         s32 total_rssi;
         s32 count_rssi;
+        int rssi;
         u32 i;
 
         brcmf_dbg(TRACE, "Enter, MAC %pM\n", mac);
@@ -2629,6 +2631,20 @@ brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
                         sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
                         total_rssi /= count_rssi;
                         sinfo->signal = total_rssi;
+                } else if (test_bit(BRCMF_VIF_STATUS_CONNECTED,
+                        &ifp->vif->sme_state)) {
+                        memset(&scb_val, 0, sizeof(scb_val));
+                        err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_RSSI,
+                                                     &scb_val, sizeof(scb_val));
+                        if (err) {
+                                brcmf_err("Could not get rssi (%d)\n", err);
+                                goto done;
+                        } else {
+                                rssi = le32_to_cpu(scb_val.val);
+                                sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
+                                sinfo->signal = rssi;
+                                brcmf_dbg(CONN, "RSSI %d dBm\n", rssi);
+                        }
                 }
         }
 done:
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
index 68f1ce02f4bf..2b9a2bc429d6 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
@@ -1157,6 +1157,8 @@ brcmf_msgbuf_process_rx_complete(struct brcmf_msgbuf *msgbuf, void *buf)
                 brcmu_pkt_buf_free_skb(skb);
                 return;
         }
+
+        skb->protocol = eth_type_trans(skb, ifp->ndev);
         brcmf_netif_rx(ifp, skb);
 }
 
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index e5f267b21316..18a8474b5760 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -3851,8 +3851,8 @@ static int iwl_mvm_mac_get_survey(struct ieee80211_hw *hw, int idx,
         if (idx != 0)
                 return -ENOENT;
 
-        if (fw_has_capa(&mvm->fw->ucode_capa,
-                        IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS))
+        if (!fw_has_capa(&mvm->fw->ucode_capa,
+                         IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS))
                 return -ENOENT;
 
         mutex_lock(&mvm->mutex);
@@ -3898,8 +3898,8 @@ static void iwl_mvm_mac_sta_statistics(struct ieee80211_hw *hw,
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
 
-        if (fw_has_capa(&mvm->fw->ucode_capa,
-                        IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS))
+        if (!fw_has_capa(&mvm->fw->ucode_capa,
+                         IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS))
                 return;
 
         /* if beacon filtering isn't on mac80211 does it anyway */
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
index ac2c5718e454..2c61516d06ff 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
@@ -581,7 +581,7 @@ static bool iwl_mvm_reorder(struct iwl_mvm *mvm,
                             struct iwl_rx_mpdu_desc *desc)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
-        struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
+        struct iwl_mvm_sta *mvm_sta;
         struct iwl_mvm_baid_data *baid_data;
         struct iwl_mvm_reorder_buffer *buffer;
         struct sk_buff *tail;
@@ -604,6 +604,8 @@ static bool iwl_mvm_reorder(struct iwl_mvm *mvm,
         if (WARN_ON(IS_ERR_OR_NULL(sta)))
                 return false;
 
+        mvm_sta = iwl_mvm_sta_from_mac80211(sta);
+
         /* not a data packet */
         if (!ieee80211_is_data_qos(hdr->frame_control) ||
             is_multicast_ether_addr(hdr->addr1))
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
index 6f609dd5c222..e78fc567ff7d 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
@@ -1222,7 +1222,7 @@ static int iwl_mvm_check_running_scans(struct iwl_mvm *mvm, int type)
         return -EIO;
 }
 
-#define SCAN_TIMEOUT (16 * HZ)
+#define SCAN_TIMEOUT (20 * HZ)
 
 void iwl_mvm_scan_timeout(unsigned long data)
 {
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
index fea4d3437e2f..b23ab4a4504f 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
@@ -1852,12 +1852,18 @@ static struct iwl_mvm_sta *iwl_mvm_get_key_sta(struct iwl_mvm *mvm,
             mvmvif->ap_sta_id != IWL_MVM_STATION_COUNT) {
                 u8 sta_id = mvmvif->ap_sta_id;
 
+                sta = rcu_dereference_check(mvm->fw_id_to_mac_id[sta_id],
+                                            lockdep_is_held(&mvm->mutex));
+
                 /*
                  * It is possible that the 'sta' parameter is NULL,
                  * for example when a GTK is removed - the sta_id will then
                  * be the AP ID, and no station was passed by mac80211.
                  */
-                return iwl_mvm_sta_from_staid_protected(mvm, sta_id);
+                if (IS_ERR_OR_NULL(sta))
+                        return NULL;
+
+                return iwl_mvm_sta_from_mac80211(sta);
         }
 
         return NULL;
@@ -1955,6 +1961,14 @@ static int iwl_mvm_send_sta_igtk(struct iwl_mvm *mvm,
                 struct ieee80211_key_seq seq;
                 const u8 *pn;
 
+                switch (keyconf->cipher) {
+                case WLAN_CIPHER_SUITE_AES_CMAC:
+                        igtk_cmd.ctrl_flags |= cpu_to_le32(STA_KEY_FLG_CCM);
+                        break;
+                default:
+                        return -EINVAL;
+                }
+
                 memcpy(igtk_cmd.IGTK, keyconf->key, keyconf->keylen);
                 ieee80211_get_key_rx_seq(keyconf, 0, &seq);
                 pn = seq.aes_cmac.pn;
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 9ed0ed1bf514..4dd5adcdd29b 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -2776,6 +2776,7 @@ static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2,
         if (!info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER] ||
             !info->attrs[HWSIM_ATTR_FLAGS] ||
             !info->attrs[HWSIM_ATTR_COOKIE] ||
+            !info->attrs[HWSIM_ATTR_SIGNAL] ||
             !info->attrs[HWSIM_ATTR_TX_INFO])
                 goto out;
 
diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c
index fe19ace0d6a0..b04cf30f3959 100644
--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c
+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c
@@ -1149,7 +1149,7 @@ static void rtl8192eu_phy_iqcalibrate(struct rtl8xxxu_priv *priv,
 
                 for (i = 0; i < retry; i++) {
                         path_b_ok = rtl8192eu_rx_iqk_path_b(priv);
-                        if (path_a_ok == 0x03) {
+                        if (path_b_ok == 0x03) {
                                 val32 = rtl8xxxu_read32(priv,
                                                         REG_RX_POWER_BEFORE_IQK_B_2);
                                 result[t][6] = (val32 >> 16) & 0x3ff;
diff --git a/drivers/net/wireless/realtek/rtlwifi/core.c b/drivers/net/wireless/realtek/rtlwifi/core.c
index 0f48048b8654..3a0faa8fe9d4 100644
--- a/drivers/net/wireless/realtek/rtlwifi/core.c
+++ b/drivers/net/wireless/realtek/rtlwifi/core.c
@@ -54,7 +54,7 @@ EXPORT_SYMBOL(channel5g_80m);
 void rtl_addr_delay(u32 addr)
 {
         if (addr == 0xfe)
-                msleep(50);
+                mdelay(50);
         else if (addr == 0xfd)
                 msleep(5);
         else if (addr == 0xfc)
@@ -75,7 +75,7 @@ void rtl_rfreg_delay(struct ieee80211_hw *hw, enum radio_path rfpath, u32 addr,
                 rtl_addr_delay(addr);
         } else {
                 rtl_set_rfreg(hw, rfpath, addr, mask, data);
-                usleep_range(1, 2);
+                udelay(1);
         }
 }
 EXPORT_SYMBOL(rtl_rfreg_delay);
@@ -86,7 +86,7 @@ void rtl_bb_delay(struct ieee80211_hw *hw, u32 addr, u32 data)
                 rtl_addr_delay(addr);
         } else {
                 rtl_set_bbreg(hw, addr, MASKDWORD, data);
-                usleep_range(1, 2);
+                udelay(1);
         }
 }
 EXPORT_SYMBOL(rtl_bb_delay);
diff --git a/drivers/nvdimm/pfn_devs.c b/drivers/nvdimm/pfn_devs.c
index f7718ec685fa..cea8350fbc7e 100644
--- a/drivers/nvdimm/pfn_devs.c
+++ b/drivers/nvdimm/pfn_devs.c
@@ -344,6 +344,8 @@ struct device *nd_pfn_create(struct nd_region *nd_region)
 int nd_pfn_validate(struct nd_pfn *nd_pfn, const char *sig)
 {
         u64 checksum, offset;
+        unsigned long align;
+        enum nd_pfn_mode mode;
         struct nd_namespace_io *nsio;
         struct nd_pfn_sb *pfn_sb = nd_pfn->pfn_sb;
         struct nd_namespace_common *ndns = nd_pfn->ndns;
@@ -386,22 +388,50 @@ int nd_pfn_validate(struct nd_pfn *nd_pfn, const char *sig)
                 return -ENXIO;
         }
 
+        align = le32_to_cpu(pfn_sb->align);
+        offset = le64_to_cpu(pfn_sb->dataoff);
+        if (align == 0)
+                align = 1UL << ilog2(offset);
+        mode = le32_to_cpu(pfn_sb->mode);
+
         if (!nd_pfn->uuid) {
-                /* from probe we allocate */
+                /*
+                 * When probing a namepace via nd_pfn_probe() the uuid
+                 * is NULL (see: nd_pfn_devinit()) we init settings from
+                 * pfn_sb
+                 */
                 nd_pfn->uuid = kmemdup(pfn_sb->uuid, 16, GFP_KERNEL);
                 if (!nd_pfn->uuid)
                         return -ENOMEM;
+                nd_pfn->align = align;
+                nd_pfn->mode = mode;
         } else {
-                /* from init we validate */
+                /*
+                 * When probing a pfn / dax instance we validate the
+                 * live settings against the pfn_sb
+                 */
                 if (memcmp(nd_pfn->uuid, pfn_sb->uuid, 16) != 0)
                         return -ENODEV;
+
+                /*
+                 * If the uuid validates, but other settings mismatch
+                 * return EINVAL because userspace has managed to change
+                 * the configuration without specifying new
+                 * identification.
+                 */
+                if (nd_pfn->align != align || nd_pfn->mode != mode) {
+                        dev_err(&nd_pfn->dev,
+                                        "init failed, settings mismatch\n");
+                        dev_dbg(&nd_pfn->dev, "align: %lx:%lx mode: %d:%d\n",
+                                        nd_pfn->align, align, nd_pfn->mode,
+                                        mode);
+                        return -EINVAL;
+                }
         }
 
-        if (nd_pfn->align == 0)
-                nd_pfn->align = le32_to_cpu(pfn_sb->align);
-        if (nd_pfn->align > nvdimm_namespace_capacity(ndns)) {
+        if (align > nvdimm_namespace_capacity(ndns)) {
                 dev_err(&nd_pfn->dev, "alignment: %lx exceeds capacity %llx\n",
-                                nd_pfn->align, nvdimm_namespace_capacity(ndns));
+                                align, nvdimm_namespace_capacity(ndns));
                 return -EINVAL;
         }
 
@@ -411,7 +441,6 @@ int nd_pfn_validate(struct nd_pfn *nd_pfn, const char *sig)
          * namespace has changed since the pfn superblock was
          * established.
          */
-        offset = le64_to_cpu(pfn_sb->dataoff);
         nsio = to_nd_namespace_io(&ndns->dev);
         if (offset >= resource_size(&nsio->res)) {
                 dev_err(&nd_pfn->dev, "pfn array size exceeds capacity of %s\n",
@@ -419,10 +448,11 @@ int nd_pfn_validate(struct nd_pfn *nd_pfn, const char *sig)
                 return -EBUSY;
         }
 
-        if ((nd_pfn->align && !IS_ALIGNED(offset, nd_pfn->align))
+        if ((align && !IS_ALIGNED(offset, align))
                         || !IS_ALIGNED(offset, PAGE_SIZE)) {
-                dev_err(&nd_pfn->dev, "bad offset: %#llx dax disabled\n",
-                                offset);
+                dev_err(&nd_pfn->dev,
+                                "bad offset: %#llx dax disabled align: %#lx\n",
+                                offset, align);
                 return -ENXIO;
         }
 
@@ -502,7 +532,6 @@ static struct vmem_altmap *__nvdimm_setup_pfn(struct nd_pfn *nd_pfn,
         res->start += start_pad;
         res->end -= end_trunc;
 
-        nd_pfn->mode = le32_to_cpu(nd_pfn->pfn_sb->mode);
         if (nd_pfn->mode == PFN_MODE_RAM) {
                 if (offset < SZ_8K)
                         return ERR_PTR(-EINVAL);
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index 14f2f8c7c260..33daffc4392c 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -395,7 +395,7 @@ static int unflatten_dt_nodes(const void *blob,
                               struct device_node **nodepp)
 {
         struct device_node *root;
-        int offset = 0, depth = 0;
+        int offset = 0, depth = 0, initial_depth = 0;
 #define FDT_MAX_DEPTH   64
         unsigned int fpsizes[FDT_MAX_DEPTH];
         struct device_node *nps[FDT_MAX_DEPTH];
@@ -405,11 +405,22 @@ static int unflatten_dt_nodes(const void *blob,
         if (nodepp)
                 *nodepp = NULL;
 
+        /*
+         * We're unflattening device sub-tree if @dad is valid. There are
+         * possibly multiple nodes in the first level of depth. We need
+         * set @depth to 1 to make fdt_next_node() happy as it bails
+         * immediately when negative @depth is found. Otherwise, the device
+         * nodes except the first one won't be unflattened successfully.
+         */
+        if (dad)
+                depth = initial_depth = 1;
+
         root = dad;
         fpsizes[depth] = dad ? strlen(of_node_full_name(dad)) : 0;
         nps[depth] = dad;
+
         for (offset = 0;
-             offset >= 0 && depth >= 0;
+             offset >= 0 && depth >= initial_depth;
              offset = fdt_next_node(blob, offset, &depth)) {
                 if (WARN_ON_ONCE(depth >= FDT_MAX_DEPTH))
                         continue;
diff --git a/drivers/of/irq.c b/drivers/of/irq.c
index e7bfc175b8e1..6ec743faabe8 100644
--- a/drivers/of/irq.c
+++ b/drivers/of/irq.c
@@ -386,13 +386,13 @@ int of_irq_to_resource(struct device_node *dev, int index, struct resource *r)
 EXPORT_SYMBOL_GPL(of_irq_to_resource);
 
 /**
- * of_irq_get - Decode a node's IRQ and return it as a Linux irq number
+ * of_irq_get - Decode a node's IRQ and return it as a Linux IRQ number
  * @dev: pointer to device tree node
- * @index: zero-based index of the irq
- *
- * Returns Linux irq number on success, or -EPROBE_DEFER if the irq domain
- * is not yet created.
+ * @index: zero-based index of the IRQ
  *
+ * Returns Linux IRQ number on success, or 0 on the IRQ mapping failure, or
+ * -EPROBE_DEFER if the IRQ domain is not yet created, or error code in case
+ * of any other failure.
  */
 int of_irq_get(struct device_node *dev, int index)
 {
@@ -413,12 +413,13 @@ int of_irq_get(struct device_node *dev, int index)
 EXPORT_SYMBOL_GPL(of_irq_get);
 
 /**
- * of_irq_get_byname - Decode a node's IRQ and return it as a Linux irq number
+ * of_irq_get_byname - Decode a node's IRQ and return it as a Linux IRQ number
  * @dev: pointer to device tree node
- * @name: irq name
+ * @name: IRQ name
  *
- * Returns Linux irq number on success, or -EPROBE_DEFER if the irq domain
- * is not yet created, or error code in case of any other failure.
+ * Returns Linux IRQ number on success, or 0 on the IRQ mapping failure, or
+ * -EPROBE_DEFER if the IRQ domain is not yet created, or error code in case
+ * of any other failure.
  */
 int of_irq_get_byname(struct device_node *dev, const char *name)
 {
diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c
index ed01c0172e4a..216648233874 100644
--- a/drivers/of/of_reserved_mem.c
+++ b/drivers/of/of_reserved_mem.c
@@ -127,8 +127,15 @@ static int __init __reserved_mem_alloc_size(unsigned long node,
         }
 
         /* Need adjust the alignment to satisfy the CMA requirement */
-        if (IS_ENABLED(CONFIG_CMA) && of_flat_dt_is_compatible(node, "shared-dma-pool"))
-                align = max(align, (phys_addr_t)PAGE_SIZE << max(MAX_ORDER - 1, pageblock_order));
+        if (IS_ENABLED(CONFIG_CMA)
+            && of_flat_dt_is_compatible(node, "shared-dma-pool")
+            && of_get_flat_dt_prop(node, "reusable", NULL)
+            && !of_get_flat_dt_prop(node, "no-map", NULL)) {
+                unsigned long order =
+                        max_t(unsigned long, MAX_ORDER - 1, pageblock_order);
+
+                align = max(align, (phys_addr_t)PAGE_SIZE << order);
+        }
 
         prop = of_get_flat_dt_prop(node, "alloc-ranges", &len);
         if (prop) {
diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index a080f4496fe2..a02981efdad5 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -4,6 +4,7 @@
  *
  * Copyright (C) 2003-2004 Intel
  * Copyright (C) Tom Long Nguyen (tom.l.nguyen@intel.com)
+ * Copyright (C) 2016 Christoph Hellwig.
  */
 
 #include <linux/err.h>
@@ -207,6 +208,12 @@ static void msi_mask_irq(struct msi_desc *desc, u32 mask, u32 flag)
         desc->masked = __pci_msi_desc_mask_irq(desc, mask, flag);
 }
 
+static void __iomem *pci_msix_desc_addr(struct msi_desc *desc)
+{
+        return desc->mask_base +
+                desc->msi_attrib.entry_nr * PCI_MSIX_ENTRY_SIZE;
+}
+
 /*
  * This internal function does not flush PCI writes to the device.
  * All users must ensure that they read from the device before either
@@ -217,8 +224,6 @@ static void msi_mask_irq(struct msi_desc *desc, u32 mask, u32 flag)
 u32 __pci_msix_desc_mask_irq(struct msi_desc *desc, u32 flag)
 {
         u32 mask_bits = desc->masked;
-        unsigned offset = desc->msi_attrib.entry_nr * PCI_MSIX_ENTRY_SIZE +
-                                                PCI_MSIX_ENTRY_VECTOR_CTRL;
 
         if (pci_msi_ignore_mask)
                 return 0;
@@ -226,7 +231,7 @@ u32 __pci_msix_desc_mask_irq(struct msi_desc *desc, u32 flag)
         mask_bits &= ~PCI_MSIX_ENTRY_CTRL_MASKBIT;
         if (flag)
                 mask_bits |= PCI_MSIX_ENTRY_CTRL_MASKBIT;
-        writel(mask_bits, desc->mask_base + offset);
+        writel(mask_bits, pci_msix_desc_addr(desc) + PCI_MSIX_ENTRY_VECTOR_CTRL);
 
         return mask_bits;
 }
@@ -284,8 +289,7 @@ void __pci_read_msi_msg(struct msi_desc *entry, struct msi_msg *msg)
         BUG_ON(dev->current_state != PCI_D0);
 
         if (entry->msi_attrib.is_msix) {
-                void __iomem *base = entry->mask_base +
-                        entry->msi_attrib.entry_nr * PCI_MSIX_ENTRY_SIZE;
+                void __iomem *base = pci_msix_desc_addr(entry);
 
                 msg->address_lo = readl(base + PCI_MSIX_ENTRY_LOWER_ADDR);
                 msg->address_hi = readl(base + PCI_MSIX_ENTRY_UPPER_ADDR);
@@ -315,9 +319,7 @@ void __pci_write_msi_msg(struct msi_desc *entry, struct msi_msg *msg)
         if (dev->current_state != PCI_D0) {
                 /* Don't touch the hardware now */
         } else if (entry->msi_attrib.is_msix) {
-                void __iomem *base;
-                base = entry->mask_base +
-                        entry->msi_attrib.entry_nr * PCI_MSIX_ENTRY_SIZE;
+                void __iomem *base = pci_msix_desc_addr(entry);
 
                 writel(msg->address_lo, base + PCI_MSIX_ENTRY_LOWER_ADDR);
                 writel(msg->address_hi, base + PCI_MSIX_ENTRY_UPPER_ADDR);
@@ -567,6 +569,7 @@ static struct msi_desc *msi_setup_entry(struct pci_dev *dev, int nvec)
         entry->msi_attrib.multi_cap     = (control & PCI_MSI_FLAGS_QMASK) >> 1;
         entry->msi_attrib.multiple      = ilog2(__roundup_pow_of_two(nvec));
         entry->nvec_used                = nvec;
+        entry->affinity                 = dev->irq_affinity;
 
         if (control & PCI_MSI_FLAGS_64BIT)
                 entry->mask_pos = dev->msi_cap + PCI_MSI_MASK_64;
@@ -678,10 +681,18 @@ static void __iomem *msix_map_region(struct pci_dev *dev, unsigned nr_entries)
 static int msix_setup_entries(struct pci_dev *dev, void __iomem *base,
                               struct msix_entry *entries, int nvec)
 {
+        const struct cpumask *mask = NULL;
         struct msi_desc *entry;
-        int i;
+        int cpu = -1, i;
 
         for (i = 0; i < nvec; i++) {
+                if (dev->irq_affinity) {
+                        cpu = cpumask_next(cpu, dev->irq_affinity);
+                        if (cpu >= nr_cpu_ids)
+                                cpu = cpumask_first(dev->irq_affinity);
+                        mask = cpumask_of(cpu);
+                }
+
                 entry = alloc_msi_entry(&dev->dev);
                 if (!entry) {
                         if (!i)
@@ -694,10 +705,14 @@ static int msix_setup_entries(struct pci_dev *dev, void __iomem *base,
 
                 entry->msi_attrib.is_msix       = 1;
                 entry->msi_attrib.is_64         = 1;
-                entry->msi_attrib.entry_nr      = entries[i].entry;
+                if (entries)
+                        entry->msi_attrib.entry_nr = entries[i].entry;
+                else
+                        entry->msi_attrib.entry_nr = i;
                 entry->msi_attrib.default_irq   = dev->irq;
                 entry->mask_base                = base;
                 entry->nvec_used                = 1;
+                entry->affinity                 = mask;
 
                 list_add_tail(&entry->list, dev_to_msi_list(&dev->dev));
         }
@@ -712,13 +727,11 @@ static void msix_program_entries(struct pci_dev *dev,
         int i = 0;
 
         for_each_pci_msi_entry(entry, dev) {
-                int offset = entries[i].entry * PCI_MSIX_ENTRY_SIZE +
-                                                PCI_MSIX_ENTRY_VECTOR_CTRL;
-
-                entries[i].vector = entry->irq;
-                entry->masked = readl(entry->mask_base + offset);
+                if (entries)
+                        entries[i++].vector = entry->irq;
+                entry->masked = readl(pci_msix_desc_addr(entry) +
+                                PCI_MSIX_ENTRY_VECTOR_CTRL);
                 msix_mask_irq(entry, 1);
-                i++;
         }
 }
 
@@ -931,7 +944,7 @@ EXPORT_SYMBOL(pci_msix_vec_count);
 /**
  * pci_enable_msix - configure device's MSI-X capability structure
  * @dev: pointer to the pci_dev data structure of MSI-X device function
- * @entries: pointer to an array of MSI-X entries
+ * @entries: pointer to an array of MSI-X entries (optional)
  * @nvec: number of MSI-X irqs requested for allocation by device driver
  *
  * Setup the MSI-X capability structure of device function with the number
@@ -951,22 +964,21 @@ int pci_enable_msix(struct pci_dev *dev, struct msix_entry *entries, int nvec)
         if (!pci_msi_supported(dev, nvec))
                 return -EINVAL;
 
-        if (!entries)
-                return -EINVAL;
-
         nr_entries = pci_msix_vec_count(dev);
         if (nr_entries < 0)
                 return nr_entries;
         if (nvec > nr_entries)
                 return nr_entries;
 
-        /* Check for any invalid entries */
-        for (i = 0; i < nvec; i++) {
-                if (entries[i].entry >= nr_entries)
-                        return -EINVAL;         /* invalid entry */
-                for (j = i + 1; j < nvec; j++) {
-                        if (entries[i].entry == entries[j].entry)
-                                return -EINVAL; /* duplicate entry */
+        if (entries) {
+                /* Check for any invalid entries */
+                for (i = 0; i < nvec; i++) {
+                        if (entries[i].entry >= nr_entries)
+                                return -EINVAL;         /* invalid entry */
+                        for (j = i + 1; j < nvec; j++) {
+                                if (entries[i].entry == entries[j].entry)
+                                        return -EINVAL; /* duplicate entry */
+                        }
                 }
         }
         WARN_ON(!!dev->msix_enabled);
@@ -1026,19 +1038,8 @@ int pci_msi_enabled(void)
 }
 EXPORT_SYMBOL(pci_msi_enabled);
 
-/**
- * pci_enable_msi_range - configure device's MSI capability structure
- * @dev: device to configure
- * @minvec: minimal number of interrupts to configure
- * @maxvec: maximum number of interrupts to configure
- *
- * This function tries to allocate a maximum possible number of interrupts in a
- * range between @minvec and @maxvec. It returns a negative errno if an error
- * occurs. If it succeeds, it returns the actual number of interrupts allocated
- * and updates the @dev's irq member to the lowest new interrupt number;
- * the other interrupt numbers allocated to this device are consecutive.
- **/
-int pci_enable_msi_range(struct pci_dev *dev, int minvec, int maxvec)
+static int __pci_enable_msi_range(struct pci_dev *dev, int minvec, int maxvec,
+                unsigned int flags)
 {
         int nvec;
         int rc;
@@ -1061,25 +1062,85 @@ int pci_enable_msi_range(struct pci_dev *dev, int minvec, int maxvec)
         nvec = pci_msi_vec_count(dev);
         if (nvec < 0)
                 return nvec;
-        else if (nvec < minvec)
+        if (nvec < minvec)
                 return -EINVAL;
-        else if (nvec > maxvec)
+
+        if (nvec > maxvec)
                 nvec = maxvec;
 
-        do {
+        for (;;) {
+                if (!(flags & PCI_IRQ_NOAFFINITY)) {
+                        dev->irq_affinity = irq_create_affinity_mask(&nvec);
+                        if (nvec < minvec)
+                                return -ENOSPC;
+                }
+
                 rc = msi_capability_init(dev, nvec);
-                if (rc < 0) {
+                if (rc == 0)
+                        return nvec;
+
+                kfree(dev->irq_affinity);
+                dev->irq_affinity = NULL;
+
+                if (rc < 0)
                         return rc;
-                } else if (rc > 0) {
-                        if (rc < minvec)
+                if (rc < minvec)
+                        return -ENOSPC;
+
+                nvec = rc;
+        }
+}
+
+/**
+ * pci_enable_msi_range - configure device's MSI capability structure
+ * @dev: device to configure
+ * @minvec: minimal number of interrupts to configure
+ * @maxvec: maximum number of interrupts to configure
+ *
+ * This function tries to allocate a maximum possible number of interrupts in a
+ * range between @minvec and @maxvec. It returns a negative errno if an error
+ * occurs. If it succeeds, it returns the actual number of interrupts allocated
+ * and updates the @dev's irq member to the lowest new interrupt number;
+ * the other interrupt numbers allocated to this device are consecutive.
+ **/
+int pci_enable_msi_range(struct pci_dev *dev, int minvec, int maxvec)
+{
+        return __pci_enable_msi_range(dev, minvec, maxvec, PCI_IRQ_NOAFFINITY);
+}
+EXPORT_SYMBOL(pci_enable_msi_range);
+
+static int __pci_enable_msix_range(struct pci_dev *dev,
+                struct msix_entry *entries, int minvec, int maxvec,
+                unsigned int flags)
+{
+        int nvec = maxvec;
+        int rc;
+
+        if (maxvec < minvec)
+                return -ERANGE;
+
+        for (;;) {
+                if (!(flags & PCI_IRQ_NOAFFINITY)) {
+                        dev->irq_affinity = irq_create_affinity_mask(&nvec);
+                        if (nvec < minvec)
                                 return -ENOSPC;
-                        nvec = rc;
                 }
-        } while (rc);
 
-        return nvec;
+                rc = pci_enable_msix(dev, entries, nvec);
+                if (rc == 0)
+                        return nvec;
+
+                kfree(dev->irq_affinity);
+                dev->irq_affinity = NULL;
+
+                if (rc < 0)
+                        return rc;
+                if (rc < minvec)
+                        return -ENOSPC;
+
+                nvec = rc;
+        }
 }
-EXPORT_SYMBOL(pci_enable_msi_range);
 
 /**
  * pci_enable_msix_range - configure device's MSI-X capability structure
@@ -1097,28 +1158,101 @@ EXPORT_SYMBOL(pci_enable_msi_range);
  * with new allocated MSI-X interrupts.
  **/
 int pci_enable_msix_range(struct pci_dev *dev, struct msix_entry *entries,
-                               int minvec, int maxvec)
+                int minvec, int maxvec)
 {
-        int nvec = maxvec;
-        int rc;
+        return __pci_enable_msix_range(dev, entries, minvec, maxvec,
+                        PCI_IRQ_NOAFFINITY);
+}
+EXPORT_SYMBOL(pci_enable_msix_range);
 
-        if (maxvec < minvec)
-                return -ERANGE;
+/**
+ * pci_alloc_irq_vectors - allocate multiple IRQs for a device
+ * @dev:                PCI device to operate on
+ * @min_vecs:           minimum number of vectors required (must be >= 1)
+ * @max_vecs:           maximum (desired) number of vectors
+ * @flags:              flags or quirks for the allocation
+ *
+ * Allocate up to @max_vecs interrupt vectors for @dev, using MSI-X or MSI
+ * vectors if available, and fall back to a single legacy vector
+ * if neither is available.  Return the number of vectors allocated,
+ * (which might be smaller than @max_vecs) if successful, or a negative
+ * error code on error. If less than @min_vecs interrupt vectors are
+ * available for @dev the function will fail with -ENOSPC.
+ *
+ * To get the Linux IRQ number used for a vector that can be passed to
+ * request_irq() use the pci_irq_vector() helper.
+ */
+int pci_alloc_irq_vectors(struct pci_dev *dev, unsigned int min_vecs,
+                unsigned int max_vecs, unsigned int flags)
+{
+        int vecs = -ENOSPC;
 
-        do {
-                rc = pci_enable_msix(dev, entries, nvec);
-                if (rc < 0) {
-                        return rc;
-                } else if (rc > 0) {
-                        if (rc < minvec)
-                                return -ENOSPC;
-                        nvec = rc;
+        if (!(flags & PCI_IRQ_NOMSIX)) {
+                vecs = __pci_enable_msix_range(dev, NULL, min_vecs, max_vecs,
+                                flags);
+                if (vecs > 0)
+                        return vecs;
+        }
+
+        if (!(flags & PCI_IRQ_NOMSI)) {
+                vecs = __pci_enable_msi_range(dev, min_vecs, max_vecs, flags);
+                if (vecs > 0)
+                        return vecs;
+        }
+
+        /* use legacy irq if allowed */
+        if (!(flags & PCI_IRQ_NOLEGACY) && min_vecs == 1)
+                return 1;
+        return vecs;
+}
+EXPORT_SYMBOL(pci_alloc_irq_vectors);
+
+/**
+ * pci_free_irq_vectors - free previously allocated IRQs for a device
+ * @dev:                PCI device to operate on
+ *
+ * Undoes the allocations and enabling in pci_alloc_irq_vectors().
+ */
+void pci_free_irq_vectors(struct pci_dev *dev)
+{
+        pci_disable_msix(dev);
+        pci_disable_msi(dev);
+}
+EXPORT_SYMBOL(pci_free_irq_vectors);
+
+/**
+ * pci_irq_vector - return Linux IRQ number of a device vector
+ * @dev: PCI device to operate on
+ * @nr: device-relative interrupt vector index (0-based).
+ */
+int pci_irq_vector(struct pci_dev *dev, unsigned int nr)
+{
+        if (dev->msix_enabled) {
+                struct msi_desc *entry;
+                int i = 0;
+
+                for_each_pci_msi_entry(entry, dev) {
+                        if (i == nr)
+                                return entry->irq;
+                        i++;
                 }
-        } while (rc);
+                WARN_ON_ONCE(1);
+                return -EINVAL;
+        }
 
-        return nvec;
+        if (dev->msi_enabled) {
+                struct msi_desc *entry = first_pci_msi_entry(dev);
+
+                if (WARN_ON_ONCE(nr >= entry->nvec_used))
+                        return -EINVAL;
+        } else {
+                if (WARN_ON_ONCE(nr > 0))
+                        return -EINVAL;
+        }
+
+        return dev->irq + nr;
 }
-EXPORT_SYMBOL(pci_enable_msix_range);
+EXPORT_SYMBOL(pci_irq_vector);
 
 struct pci_dev *msi_desc_to_pci_dev(struct msi_desc *desc)
 {
diff --git a/drivers/pci/vc.c b/drivers/pci/vc.c
index dfbab61a1b47..1fa3a3219c45 100644
--- a/drivers/pci/vc.c
+++ b/drivers/pci/vc.c
@@ -221,9 +221,9 @@ static int pci_vc_do_save_buffer(struct pci_dev *dev, int pos,
                 else
                         pci_write_config_word(dev, pos + PCI_VC_PORT_CTRL,
                                               *(u16 *)buf);
-                buf += 2;
+                buf += 4;
         }
-        len += 2;
+        len += 4;
 
         /*
          * If we have any Low Priority VCs and a VC Arbitration Table Offset
diff --git a/drivers/perf/arm_pmu.c b/drivers/perf/arm_pmu.c
index 1b8304e1efaa..140436a046c0 100644
--- a/drivers/perf/arm_pmu.c
+++ b/drivers/perf/arm_pmu.c
@@ -1010,8 +1010,8 @@ int arm_pmu_device_probe(struct platform_device *pdev,
                 if (!ret)
                         ret = init_fn(pmu);
         } else {
-                ret = probe_current_pmu(pmu, probe_table);
                 cpumask_setall(&pmu->supported_cpus);
+                ret = probe_current_pmu(pmu, probe_table);
         }
 
         if (ret) {
diff --git a/drivers/phy/phy-bcm-ns-usb2.c b/drivers/phy/phy-bcm-ns-usb2.c
index 95ab6b2a0de5..58dff80e9386 100644
--- a/drivers/phy/phy-bcm-ns-usb2.c
+++ b/drivers/phy/phy-bcm-ns-usb2.c
@@ -109,8 +109,8 @@ static int bcm_ns_usb2_probe(struct platform_device *pdev)
         }
 
         usb2->phy = devm_phy_create(dev, NULL, &ops);
-        if (IS_ERR(dev))
-                return PTR_ERR(dev);
+        if (IS_ERR(usb2->phy))
+                return PTR_ERR(usb2->phy);
 
         phy_set_drvdata(usb2->phy, usb2);
         platform_set_drvdata(pdev, usb2);
diff --git a/drivers/phy/phy-exynos-mipi-video.c b/drivers/phy/phy-exynos-mipi-video.c
index cc093ebfda94..8b851f718123 100644
--- a/drivers/phy/phy-exynos-mipi-video.c
+++ b/drivers/phy/phy-exynos-mipi-video.c
@@ -233,8 +233,12 @@ static inline int __is_running(const struct exynos_mipi_phy_desc *data,
                         struct exynos_mipi_video_phy *state)
 {
         u32 val;
+        int ret;
+
+        ret = regmap_read(state->regmaps[data->resetn_map], data->resetn_reg, &val);
+        if (ret)
+                return 0;
 
-        regmap_read(state->regmaps[data->resetn_map], data->resetn_reg, &val);
         return val & data->resetn_val;
 }
 
diff --git a/drivers/phy/phy-miphy28lp.c b/drivers/phy/phy-miphy28lp.c
index 3acd2a1808df..213e2e15339c 100644
--- a/drivers/phy/phy-miphy28lp.c
+++ b/drivers/phy/phy-miphy28lp.c
@@ -1143,7 +1143,8 @@ static int miphy28lp_probe_resets(struct device_node *node,
         struct miphy28lp_dev *miphy_dev = miphy_phy->phydev;
         int err;
 
-        miphy_phy->miphy_rst = of_reset_control_get(node, "miphy-sw-rst");
+        miphy_phy->miphy_rst =
+                of_reset_control_get_shared(node, "miphy-sw-rst");
 
         if (IS_ERR(miphy_phy->miphy_rst)) {
                 dev_err(miphy_dev->dev,
diff --git a/drivers/phy/phy-rcar-gen3-usb2.c b/drivers/phy/phy-rcar-gen3-usb2.c
index 76bb88f0700a..4be3f5dbbc9f 100644
--- a/drivers/phy/phy-rcar-gen3-usb2.c
+++ b/drivers/phy/phy-rcar-gen3-usb2.c
@@ -144,12 +144,6 @@ static void rcar_gen3_init_for_peri(struct rcar_gen3_chan *ch)
         extcon_set_cable_state_(ch->extcon, EXTCON_USB, true);
 }
 
-static bool rcar_gen3_check_vbus(struct rcar_gen3_chan *ch)
-{
-        return !!(readl(ch->base + USB2_ADPCTRL) &
-                  USB2_ADPCTRL_OTGSESSVLD);
-}
-
 static bool rcar_gen3_check_id(struct rcar_gen3_chan *ch)
 {
         return !!(readl(ch->base + USB2_ADPCTRL) & USB2_ADPCTRL_IDDIG);
@@ -157,13 +151,7 @@ static bool rcar_gen3_check_id(struct rcar_gen3_chan *ch)
 
 static void rcar_gen3_device_recognition(struct rcar_gen3_chan *ch)
 {
-        bool is_host = true;
-
-        /* B-device? */
-        if (rcar_gen3_check_id(ch) && rcar_gen3_check_vbus(ch))
-                is_host = false;
-
-        if (is_host)
+        if (!rcar_gen3_check_id(ch))
                 rcar_gen3_init_for_host(ch);
         else
                 rcar_gen3_init_for_peri(ch);
diff --git a/drivers/phy/phy-rockchip-dp.c b/drivers/phy/phy-rockchip-dp.c
index 793ecb6d87bc..8b267a746576 100644
--- a/drivers/phy/phy-rockchip-dp.c
+++ b/drivers/phy/phy-rockchip-dp.c
@@ -90,7 +90,7 @@ static int rockchip_dp_phy_probe(struct platform_device *pdev)
                 return -ENODEV;
 
         dp = devm_kzalloc(dev, sizeof(*dp), GFP_KERNEL);
-        if (IS_ERR(dp))
+        if (!dp)
                 return -ENOMEM;
 
         dp->dev = dev;
diff --git a/drivers/phy/phy-stih407-usb.c b/drivers/phy/phy-stih407-usb.c
index 1d5ae5f8ef69..b1f44ab669fb 100644
--- a/drivers/phy/phy-stih407-usb.c
+++ b/drivers/phy/phy-stih407-usb.c
@@ -105,13 +105,13 @@ static int stih407_usb2_picophy_probe(struct platform_device *pdev)
         phy_dev->dev = dev;
         dev_set_drvdata(dev, phy_dev);
 
-        phy_dev->rstc = devm_reset_control_get(dev, "global");
+        phy_dev->rstc = devm_reset_control_get_shared(dev, "global");
         if (IS_ERR(phy_dev->rstc)) {
                 dev_err(dev, "failed to ctrl picoPHY reset\n");
                 return PTR_ERR(phy_dev->rstc);
         }
 
-        phy_dev->rstport = devm_reset_control_get(dev, "port");
+        phy_dev->rstport = devm_reset_control_get_exclusive(dev, "port");
         if (IS_ERR(phy_dev->rstport)) {
                 dev_err(dev, "failed to ctrl picoPHY reset\n");
                 return PTR_ERR(phy_dev->rstport);
diff --git a/drivers/phy/phy-sun4i-usb.c b/drivers/phy/phy-sun4i-usb.c
index bae54f7a1f48..de3101fbbf40 100644
--- a/drivers/phy/phy-sun4i-usb.c
+++ b/drivers/phy/phy-sun4i-usb.c
@@ -175,7 +175,7 @@ static void sun4i_usb_phy_write(struct sun4i_usb_phy *phy, u32 addr, u32 data,
 {
         struct sun4i_usb_phy_data *phy_data = to_sun4i_usb_phy_data(phy);
         u32 temp, usbc_bit = BIT(phy->index * 2);
-        void *phyctl = phy_data->base + phy_data->cfg->phyctl_offset;
+        void __iomem *phyctl = phy_data->base + phy_data->cfg->phyctl_offset;
         int i;
 
         mutex_lock(&phy_data->mutex);
@@ -514,9 +514,9 @@ static int sun4i_usb_phy_remove(struct platform_device *pdev)
 
         if (data->vbus_power_nb_registered)
                 power_supply_unreg_notifier(&data->vbus_power_nb);
-        if (data->id_det_irq >= 0)
+        if (data->id_det_irq > 0)
                 devm_free_irq(dev, data->id_det_irq, data);
-        if (data->vbus_det_irq >= 0)
+        if (data->vbus_det_irq > 0)
                 devm_free_irq(dev, data->vbus_det_irq, data);
 
         cancel_delayed_work_sync(&data->detect);
@@ -645,11 +645,11 @@ static int sun4i_usb_phy_probe(struct platform_device *pdev)
 
         data->id_det_irq = gpiod_to_irq(data->id_det_gpio);
         data->vbus_det_irq = gpiod_to_irq(data->vbus_det_gpio);
-        if ((data->id_det_gpio && data->id_det_irq < 0) ||
-            (data->vbus_det_gpio && data->vbus_det_irq < 0))
+        if ((data->id_det_gpio && data->id_det_irq <= 0) ||
+            (data->vbus_det_gpio && data->vbus_det_irq <= 0))
                 data->phy0_poll = true;
 
-        if (data->id_det_irq >= 0) {
+        if (data->id_det_irq > 0) {
                 ret = devm_request_irq(dev, data->id_det_irq,
                                 sun4i_usb_phy0_id_vbus_det_irq,
                                 IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING,
@@ -660,7 +660,7 @@ static int sun4i_usb_phy_probe(struct platform_device *pdev)
                 }
         }
 
-        if (data->vbus_det_irq >= 0) {
+        if (data->vbus_det_irq > 0) {
                 ret = devm_request_irq(dev, data->vbus_det_irq,
                                 sun4i_usb_phy0_id_vbus_det_irq,
                                 IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING,
diff --git a/drivers/phy/phy-ti-pipe3.c b/drivers/phy/phy-ti-pipe3.c
index 0a477d24cf76..bf46844dc387 100644
--- a/drivers/phy/phy-ti-pipe3.c
+++ b/drivers/phy/phy-ti-pipe3.c
@@ -293,11 +293,18 @@ static int ti_pipe3_init(struct phy *x)
                 ret = ti_pipe3_dpll_wait_lock(phy);
         }
 
-        /* Program the DPLL only if not locked */
+        /* SATA has issues if re-programmed when locked */
         val = ti_pipe3_readl(phy->pll_ctrl_base, PLL_STATUS);
-        if (!(val & PLL_LOCK))
-                if (ti_pipe3_dpll_program(phy))
-                        return -EINVAL;
+        if ((val & PLL_LOCK) && of_device_is_compatible(phy->dev->of_node,
+                                                        "ti,phy-pipe3-sata"))
+                return ret;
+
+        /* Program the DPLL */
+        ret = ti_pipe3_dpll_program(phy);
+        if (ret) {
+                ti_pipe3_disable_clocks(phy);
+                return -EINVAL;
+        }
 
         return ret;
 }
diff --git a/drivers/phy/phy-twl4030-usb.c b/drivers/phy/phy-twl4030-usb.c
index 6b6af6cba454..d9b10a39a2cf 100644
--- a/drivers/phy/phy-twl4030-usb.c
+++ b/drivers/phy/phy-twl4030-usb.c
@@ -463,7 +463,8 @@ static int twl4030_phy_power_on(struct phy *phy)
         twl4030_usb_set_mode(twl, twl->usb_mode);
         if (twl->usb_mode == T2_USB_MODE_ULPI)
                 twl4030_i2c_access(twl, 0);
-        schedule_delayed_work(&twl->id_workaround_work, 0);
+        twl->linkstat = MUSB_UNKNOWN;
+        schedule_delayed_work(&twl->id_workaround_work, HZ);
 
         return 0;
 }
@@ -537,6 +538,7 @@ static irqreturn_t twl4030_usb_irq(int irq, void *_twl)
         struct twl4030_usb *twl = _twl;
         enum musb_vbus_id_status status;
         bool status_changed = false;
+        int err;
 
         status = twl4030_usb_linkstat(twl);
 
@@ -567,7 +569,9 @@ static irqreturn_t twl4030_usb_irq(int irq, void *_twl)
                         pm_runtime_mark_last_busy(twl->dev);
                         pm_runtime_put_autosuspend(twl->dev);
                 }
-                musb_mailbox(status);
+                err = musb_mailbox(status);
+                if (err)
+                        twl->linkstat = MUSB_UNKNOWN;
         }
 
         /* don't schedule during sleep - irq works right then */
@@ -595,7 +599,8 @@ static int twl4030_phy_init(struct phy *phy)
         struct twl4030_usb *twl = phy_get_drvdata(phy);
 
         pm_runtime_get_sync(twl->dev);
-        schedule_delayed_work(&twl->id_workaround_work, 0);
+        twl->linkstat = MUSB_UNKNOWN;
+        schedule_delayed_work(&twl->id_workaround_work, HZ);
         pm_runtime_mark_last_busy(twl->dev);
         pm_runtime_put_autosuspend(twl->dev);
 
@@ -763,7 +768,8 @@ static int twl4030_usb_remove(struct platform_device *pdev)
         if (cable_present(twl->linkstat))
                 pm_runtime_put_noidle(twl->dev);
         pm_runtime_mark_last_busy(twl->dev);
-        pm_runtime_put_sync_suspend(twl->dev);
+        pm_runtime_dont_use_autosuspend(&pdev->dev);
+        pm_runtime_put_sync(twl->dev);
         pm_runtime_disable(twl->dev);
 
         /* autogate 60MHz ULPI clock,
diff --git a/drivers/pinctrl/Makefile b/drivers/pinctrl/Makefile
index e4bc1151e04f..42a5c1dddfef 100644
--- a/drivers/pinctrl/Makefile
+++ b/drivers/pinctrl/Makefile
@@ -23,7 +23,7 @@ obj-$(CONFIG_PINCTRL_PISTACHIO)	+= pinctrl-pistachio.o
 obj-$(CONFIG_PINCTRL_ROCKCHIP)  += pinctrl-rockchip.o
 obj-$(CONFIG_PINCTRL_SINGLE)    += pinctrl-single.o
 obj-$(CONFIG_PINCTRL_SIRF)      += sirf/
-obj-$(CONFIG_PINCTRL_TEGRA)     += tegra/
+obj-$(CONFIG_ARCH_TEGRA)        += tegra/
 obj-$(CONFIG_PINCTRL_TZ1090)    += pinctrl-tz1090.o
 obj-$(CONFIG_PINCTRL_TZ1090_PDC)        += pinctrl-tz1090-pdc.o
 obj-$(CONFIG_PINCTRL_U300)      += pinctrl-u300.o
diff --git a/drivers/pinctrl/freescale/pinctrl-imx.c b/drivers/pinctrl/freescale/pinctrl-imx.c
index 47ccfcc8a647..eccb47480e1d 100644
--- a/drivers/pinctrl/freescale/pinctrl-imx.c
+++ b/drivers/pinctrl/freescale/pinctrl-imx.c
@@ -209,9 +209,9 @@ static int imx_pmx_set(struct pinctrl_dev *pctldev, unsigned selector,
                 pin_reg = &info->pin_regs[pin_id];
 
                 if (pin_reg->mux_reg == -1) {
-                        dev_err(ipctl->dev, "Pin(%s) does not support mux function\n",
+                        dev_dbg(ipctl->dev, "Pin(%s) does not support mux function\n",
                                 info->pins[pin_id].name);
-                        return -EINVAL;
+                        continue;
                 }
 
                 if (info->flags & SHARE_MUX_CONF_REG) {
diff --git a/drivers/pinctrl/intel/pinctrl-baytrail.c b/drivers/pinctrl/intel/pinctrl-baytrail.c
index 677a811b3a6f..7abfd42e8ffd 100644
--- a/drivers/pinctrl/intel/pinctrl-baytrail.c
+++ b/drivers/pinctrl/intel/pinctrl-baytrail.c
@@ -401,9 +401,9 @@ static const struct byt_simple_func_mux byt_score_sata_mux[] = {
 static const unsigned int byt_score_plt_clk0_pins[] = { 96 };
 static const unsigned int byt_score_plt_clk1_pins[] = { 97 };
 static const unsigned int byt_score_plt_clk2_pins[] = { 98 };
-static const unsigned int byt_score_plt_clk4_pins[] = { 99 };
-static const unsigned int byt_score_plt_clk5_pins[] = { 100 };
-static const unsigned int byt_score_plt_clk3_pins[] = { 101 };
+static const unsigned int byt_score_plt_clk3_pins[] = { 99 };
+static const unsigned int byt_score_plt_clk4_pins[] = { 100 };
+static const unsigned int byt_score_plt_clk5_pins[] = { 101 };
 static const struct byt_simple_func_mux byt_score_plt_clk_mux[] = {
         SIMPLE_FUNC("plt_clk", 1),
 };
diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
index cf9bafa10acf..bfdf720db270 100644
--- a/drivers/pinctrl/pinctrl-single.c
+++ b/drivers/pinctrl/pinctrl-single.c
@@ -1580,6 +1580,9 @@ static inline void pcs_irq_set(struct pcs_soc_data *pcs_soc,
                 else
                         mask &= ~soc_mask;
                 pcs->write(mask, pcswi->reg);
+
+                /* flush posted write */
+                mask = pcs->read(pcswi->reg);
                 raw_spin_unlock(&pcs->lock);
         }
 
diff --git a/drivers/pinctrl/tegra/Makefile b/drivers/pinctrl/tegra/Makefile
index a927379b6794..d9ea2be69cc4 100644
--- a/drivers/pinctrl/tegra/Makefile
+++ b/drivers/pinctrl/tegra/Makefile
@@ -1,4 +1,4 @@
-obj-y                                   += pinctrl-tegra.o
+obj-$(CONFIG_PINCTRL_TEGRA)             += pinctrl-tegra.o
 obj-$(CONFIG_PINCTRL_TEGRA20)           += pinctrl-tegra20.o
 obj-$(CONFIG_PINCTRL_TEGRA30)           += pinctrl-tegra30.o
 obj-$(CONFIG_PINCTRL_TEGRA114)          += pinctrl-tegra114.o
diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index c06bb85c2839..3ec0025d19e7 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -103,7 +103,6 @@ config DELL_SMBIOS
 
 config DELL_LAPTOP
         tristate "Dell Laptop Extras"
-        depends on X86
         depends on DELL_SMBIOS
         depends on DMI
         depends on BACKLIGHT_CLASS_DEVICE
@@ -505,7 +504,7 @@ config THINKPAD_ACPI_HOTKEY_POLL
 
 config SENSORS_HDAPS
         tristate "Thinkpad Hard Drive Active Protection System (hdaps)"
-        depends on INPUT && X86
+        depends on INPUT
         select INPUT_POLLDEV
         default n
         help
@@ -749,7 +748,7 @@ config TOSHIBA_WMI
 
 config ACPI_CMPC
         tristate "CMPC Laptop Extras"
-        depends on X86 && ACPI
+        depends on ACPI
         depends on RFKILL || RFKILL=n
         select INPUT
         select BACKLIGHT_CLASS_DEVICE
@@ -848,7 +847,7 @@ config INTEL_IMR
 
 config INTEL_PMC_CORE
         bool "Intel PMC Core driver"
-        depends on X86 && PCI
+        depends on PCI
         ---help---
           The Intel Platform Controller Hub for Intel Core SoCs provides access
           to Power Management Controller registers via a PCI interface. This
@@ -860,7 +859,7 @@ config INTEL_PMC_CORE
 
 config IBM_RTL
         tristate "Device driver to enable PRTL support"
-        depends on X86 && PCI
+        depends on PCI
         ---help---
          Enable support for IBM Premium Real Time Mode (PRTM).
          This module will allow you the enter and exit PRTM in the BIOS via
@@ -894,7 +893,6 @@ config XO15_EBOOK
 
 config SAMSUNG_LAPTOP
         tristate "Samsung Laptop driver"
-        depends on X86
         depends on RFKILL || RFKILL = n
         depends on ACPI_VIDEO || ACPI_VIDEO = n
         depends on BACKLIGHT_CLASS_DEVICE
diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c
index 4a23fbc66b71..d1a091b93192 100644
--- a/drivers/platform/x86/ideapad-laptop.c
+++ b/drivers/platform/x86/ideapad-laptop.c
@@ -567,6 +567,7 @@ static void ideapad_sysfs_exit(struct ideapad_private *priv)
 static const struct key_entry ideapad_keymap[] = {
         { KE_KEY, 6,  { KEY_SWITCHVIDEOMODE } },
         { KE_KEY, 7,  { KEY_CAMERA } },
+        { KE_KEY, 8,  { KEY_MICMUTE } },
         { KE_KEY, 11, { KEY_F16 } },
         { KE_KEY, 13, { KEY_WLAN } },
         { KE_KEY, 16, { KEY_PROG1 } },
@@ -809,6 +810,7 @@ static void ideapad_acpi_notify(acpi_handle handle, u32 event, void *data)
                                 break;
                         case 13:
                         case 11:
+                        case 8:
                         case 7:
                         case 6:
                                 ideapad_input_report(priv, vpc_bit);
diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
index c3bfa1fe95bf..b65ce7519411 100644
--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -2043,6 +2043,7 @@ static int hotkey_autosleep_ack;
 
 static u32 hotkey_orig_mask;            /* events the BIOS had enabled */
 static u32 hotkey_all_mask;             /* all events supported in fw */
+static u32 hotkey_adaptive_all_mask;    /* all adaptive events supported in fw */
 static u32 hotkey_reserved_mask;        /* events better left disabled */
 static u32 hotkey_driver_mask;          /* events needed by the driver */
 static u32 hotkey_user_mask;            /* events visible to userspace */
@@ -2742,6 +2743,17 @@ static ssize_t hotkey_all_mask_show(struct device *dev,
 
 static DEVICE_ATTR_RO(hotkey_all_mask);
 
+/* sysfs hotkey all_mask ----------------------------------------------- */
+static ssize_t hotkey_adaptive_all_mask_show(struct device *dev,
+                           struct device_attribute *attr,
+                           char *buf)
+{
+        return snprintf(buf, PAGE_SIZE, "0x%08x\n",
+                        hotkey_adaptive_all_mask | hotkey_source_mask);
+}
+
+static DEVICE_ATTR_RO(hotkey_adaptive_all_mask);
+
 /* sysfs hotkey recommended_mask --------------------------------------- */
 static ssize_t hotkey_recommended_mask_show(struct device *dev,
                                             struct device_attribute *attr,
@@ -2985,6 +2997,7 @@ static struct attribute *hotkey_attributes[] __initdata = {
         &dev_attr_wakeup_hotunplug_complete.attr,
         &dev_attr_hotkey_mask.attr,
         &dev_attr_hotkey_all_mask.attr,
+        &dev_attr_hotkey_adaptive_all_mask.attr,
         &dev_attr_hotkey_recommended_mask.attr,
 #ifdef CONFIG_THINKPAD_ACPI_HOTKEY_POLL
         &dev_attr_hotkey_source_mask.attr,
@@ -3321,20 +3334,6 @@ static int __init hotkey_init(struct ibm_init_struct *iibm)
         if (!tp_features.hotkey)
                 return 1;
 
-        /*
-         * Check if we have an adaptive keyboard, like on the
-         * Lenovo Carbon X1 2014 (2nd Gen).
-         */
-        if (acpi_evalf(hkey_handle, &hkeyv, "MHKV", "qd")) {
-                if ((hkeyv >> 8) == 2) {
-                        tp_features.has_adaptive_kbd = true;
-                        res = sysfs_create_group(&tpacpi_pdev->dev.kobj,
-                                        &adaptive_kbd_attr_group);
-                        if (res)
-                                goto err_exit;
-                }
-        }
-
         quirks = tpacpi_check_quirks(tpacpi_hotkey_qtable,
                                      ARRAY_SIZE(tpacpi_hotkey_qtable));
 
@@ -3357,30 +3356,70 @@ static int __init hotkey_init(struct ibm_init_struct *iibm)
            A30, R30, R31, T20-22, X20-21, X22-24.  Detected by checking
            for HKEY interface version 0x100 */
         if (acpi_evalf(hkey_handle, &hkeyv, "MHKV", "qd")) {
-                if ((hkeyv >> 8) != 1) {
-                        pr_err("unknown version of the HKEY interface: 0x%x\n",
-                               hkeyv);
-                        pr_err("please report this to %s\n", TPACPI_MAIL);
-                } else {
+                vdbg_printk(TPACPI_DBG_INIT | TPACPI_DBG_HKEY,
+                            "firmware HKEY interface version: 0x%x\n",
+                            hkeyv);
+
+                switch (hkeyv >> 8) {
+                case 1:
                         /*
                          * MHKV 0x100 in A31, R40, R40e,
                          * T4x, X31, and later
                          */
-                        vdbg_printk(TPACPI_DBG_INIT | TPACPI_DBG_HKEY,
-                                "firmware HKEY interface version: 0x%x\n",
-                                hkeyv);
 
                         /* Paranoia check AND init hotkey_all_mask */
                         if (!acpi_evalf(hkey_handle, &hotkey_all_mask,
                                         "MHKA", "qd")) {
-                                pr_err("missing MHKA handler, "
-                                       "please report this to %s\n",
+                                pr_err("missing MHKA handler, please report this to %s\n",
                                        TPACPI_MAIL);
                                 /* Fallback: pre-init for FN+F3,F4,F12 */
                                 hotkey_all_mask = 0x080cU;
                         } else {
                                 tp_features.hotkey_mask = 1;
                         }
+                        break;
+
+                case 2:
+                        /*
+                         * MHKV 0x200 in X1, T460s, X260, T560, X1 Tablet (2016)
+                         */
+
+                        /* Paranoia check AND init hotkey_all_mask */
+                        if (!acpi_evalf(hkey_handle, &hotkey_all_mask,
+                                        "MHKA", "dd", 1)) {
+                                pr_err("missing MHKA handler, please report this to %s\n",
+                                       TPACPI_MAIL);
+                                /* Fallback: pre-init for FN+F3,F4,F12 */
+                                hotkey_all_mask = 0x080cU;
+                        } else {
+                                tp_features.hotkey_mask = 1;
+                        }
+
+                        /*
+                         * Check if we have an adaptive keyboard, like on the
+                         * Lenovo Carbon X1 2014 (2nd Gen).
+                         */
+                        if (acpi_evalf(hkey_handle, &hotkey_adaptive_all_mask,
+                                       "MHKA", "dd", 2)) {
+                                if (hotkey_adaptive_all_mask != 0) {
+                                        tp_features.has_adaptive_kbd = true;
+                                        res = sysfs_create_group(
+                                                &tpacpi_pdev->dev.kobj,
+                                                &adaptive_kbd_attr_group);
+                                        if (res)
+                                                goto err_exit;
+                                }
+                        } else {
+                                tp_features.has_adaptive_kbd = false;
+                                hotkey_adaptive_all_mask = 0x0U;
+                        }
+                        break;
+
+                default:
+                        pr_err("unknown version of the HKEY interface: 0x%x\n",
+                               hkeyv);
+                        pr_err("please report this to %s\n", TPACPI_MAIL);
+                        break;
                 }
         }
 
diff --git a/drivers/power/power_supply_core.c b/drivers/power/power_supply_core.c
index 456987c88baa..b13cd074c52a 100644
--- a/drivers/power/power_supply_core.c
+++ b/drivers/power/power_supply_core.c
@@ -565,11 +565,12 @@ static int power_supply_read_temp(struct thermal_zone_device *tzd,
 
         WARN_ON(tzd == NULL);
         psy = tzd->devdata;
-        ret = psy->desc->get_property(psy, POWER_SUPPLY_PROP_TEMP, &val);
+        ret = power_supply_get_property(psy, POWER_SUPPLY_PROP_TEMP, &val);
+        if (ret)
+                return ret;
 
         /* Convert tenths of degree Celsius to milli degree Celsius. */
-        if (!ret)
-                *temp = val.intval * 100;
+        *temp = val.intval * 100;
 
         return ret;
 }
@@ -612,10 +613,12 @@ static int ps_get_max_charge_cntl_limit(struct thermal_cooling_device *tcd,
         int ret;
 
         psy = tcd->devdata;
-        ret = psy->desc->get_property(psy,
-                POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT_MAX, &val);
-        if (!ret)
-                *state = val.intval;
+        ret = power_supply_get_property(psy,
+                        POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT_MAX, &val);
+        if (ret)
+                return ret;
+
+        *state = val.intval;
 
         return ret;
 }
@@ -628,10 +631,12 @@ static int ps_get_cur_chrage_cntl_limit(struct thermal_cooling_device *tcd,
         int ret;
 
         psy = tcd->devdata;
-        ret = psy->desc->get_property(psy,
-                POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT, &val);
-        if (!ret)
-                *state = val.intval;
+        ret = power_supply_get_property(psy,
+                        POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT, &val);
+        if (ret)
+                return ret;
+
+        *state = val.intval;
 
         return ret;
 }
diff --git a/drivers/power/tps65217_charger.c b/drivers/power/tps65217_charger.c
index d9f56730c735..73dfae41def8 100644
--- a/drivers/power/tps65217_charger.c
+++ b/drivers/power/tps65217_charger.c
@@ -197,6 +197,7 @@ static int tps65217_charger_probe(struct platform_device *pdev)
 {
         struct tps65217 *tps = dev_get_drvdata(pdev->dev.parent);
         struct tps65217_charger *charger;
+        struct power_supply_config cfg = {};
         int ret;
 
         dev_dbg(&pdev->dev, "%s\n", __func__);
@@ -208,9 +209,12 @@ static int tps65217_charger_probe(struct platform_device *pdev)
         charger->tps = tps;
         charger->dev = &pdev->dev;
 
+        cfg.of_node = pdev->dev.of_node;
+        cfg.drv_data = charger;
+
         charger->ac = devm_power_supply_register(&pdev->dev,
                                                  &tps65217_charger_desc,
-                                                 NULL);
+                                                 &cfg);
         if (IS_ERR(charger->ac)) {
                 dev_err(&pdev->dev, "failed: power supply register\n");
                 return PTR_ERR(charger->ac);
diff --git a/drivers/pwm/core.c b/drivers/pwm/core.c
index dba3843c53b8..ed337a8c34ab 100644
--- a/drivers/pwm/core.c
+++ b/drivers/pwm/core.c
@@ -457,7 +457,8 @@ int pwm_apply_state(struct pwm_device *pwm, struct pwm_state *state)
 {
         int err;
 
-        if (!pwm)
+        if (!pwm || !state || !state->period ||
+            state->duty_cycle > state->period)
                 return -EINVAL;
 
         if (!memcmp(state, &pwm->state, sizeof(*state)))
diff --git a/drivers/pwm/pwm-atmel-hlcdc.c b/drivers/pwm/pwm-atmel-hlcdc.c
index f994c7eaf41c..14fc011faa32 100644
--- a/drivers/pwm/pwm-atmel-hlcdc.c
+++ b/drivers/pwm/pwm-atmel-hlcdc.c
@@ -272,7 +272,7 @@ static int atmel_hlcdc_pwm_probe(struct platform_device *pdev)
         chip->chip.of_pwm_n_cells = 3;
         chip->chip.can_sleep = 1;
 
-        ret = pwmchip_add(&chip->chip);
+        ret = pwmchip_add_with_polarity(&chip->chip, PWM_POLARITY_INVERSED);
         if (ret) {
                 clk_disable_unprepare(hlcdc->periph_clk);
                 return ret;
diff --git a/drivers/pwm/sysfs.c b/drivers/pwm/sysfs.c
index d98599249a05..01695d48dd54 100644
--- a/drivers/pwm/sysfs.c
+++ b/drivers/pwm/sysfs.c
@@ -152,7 +152,7 @@ static ssize_t enable_store(struct device *child,
                 goto unlock;
         }
 
-        pwm_apply_state(pwm, &state);
+        ret = pwm_apply_state(pwm, &state);
 
 unlock:
         mutex_unlock(&export->lock);
diff --git a/drivers/regulator/anatop-regulator.c b/drivers/regulator/anatop-regulator.c
index 63cd5e68c864..3a6d0290c54c 100644
--- a/drivers/regulator/anatop-regulator.c
+++ b/drivers/regulator/anatop-regulator.c
@@ -296,7 +296,7 @@ static int anatop_regulator_probe(struct platform_device *pdev)
                 if (!sreg->sel && !strcmp(sreg->name, "vddpu"))
                         sreg->sel = 22;
 
-                if (!sreg->sel) {
+                if (!sreg->bypass && !sreg->sel) {
                         dev_err(&pdev->dev, "Failed to read a valid default voltage selector.\n");
                         return -EINVAL;
                 }
diff --git a/drivers/regulator/max77620-regulator.c b/drivers/regulator/max77620-regulator.c
index 321e804aeab0..a1b49a6d538f 100644
--- a/drivers/regulator/max77620-regulator.c
+++ b/drivers/regulator/max77620-regulator.c
@@ -123,6 +123,9 @@ static int max77620_regulator_set_fps_src(struct max77620_regulator *pmic,
         unsigned int val;
         int ret;
 
+        if (!rinfo)
+                return 0;
+
         switch (fps_src) {
         case MAX77620_FPS_SRC_0:
         case MAX77620_FPS_SRC_1:
@@ -171,6 +174,9 @@ static int max77620_regulator_set_fps_slots(struct max77620_regulator *pmic,
         int pd = rpdata->active_fps_pd_slot;
         int ret = 0;
 
+        if (!rinfo)
+                return 0;
+
         if (is_suspend) {
                 pu = rpdata->suspend_fps_pu_slot;
                 pd = rpdata->suspend_fps_pd_slot;
@@ -680,7 +686,6 @@ static struct max77620_regulator_info max77620_regs_info[MAX77620_NUM_REGS] = {
         RAIL_SD(SD1, sd1, "in-sd1", SD1, 600000, 1550000, 12500, 0x22, SD1),
         RAIL_SD(SD2, sd2, "in-sd2", SDX, 600000, 3787500, 12500, 0xFF, NONE),
         RAIL_SD(SD3, sd3, "in-sd3", SDX, 600000, 3787500, 12500, 0xFF, NONE),
-        RAIL_SD(SD4, sd4, "in-sd4", SDX, 600000, 3787500, 12500, 0xFF, NONE),
 
         RAIL_LDO(LDO0, ldo0, "in-ldo0-1", N, 800000, 2375000, 25000),
         RAIL_LDO(LDO1, ldo1, "in-ldo0-1", N, 800000, 2375000, 25000),
diff --git a/drivers/regulator/qcom_smd-regulator.c b/drivers/regulator/qcom_smd-regulator.c
index 56a17ec5b5ef..526bf23dcb49 100644
--- a/drivers/regulator/qcom_smd-regulator.c
+++ b/drivers/regulator/qcom_smd-regulator.c
@@ -140,6 +140,19 @@ static const struct regulator_ops rpm_smps_ldo_ops = {
         .enable = rpm_reg_enable,
         .disable = rpm_reg_disable,
         .is_enabled = rpm_reg_is_enabled,
+        .list_voltage = regulator_list_voltage_linear_range,
+
+        .get_voltage = rpm_reg_get_voltage,
+        .set_voltage = rpm_reg_set_voltage,
+
+        .set_load = rpm_reg_set_load,
+};
+
+static const struct regulator_ops rpm_smps_ldo_ops_fixed = {
+        .enable = rpm_reg_enable,
+        .disable = rpm_reg_disable,
+        .is_enabled = rpm_reg_is_enabled,
+        .list_voltage = regulator_list_voltage_linear_range,
 
         .get_voltage = rpm_reg_get_voltage,
         .set_voltage = rpm_reg_set_voltage,
@@ -247,7 +260,7 @@ static const struct regulator_desc pm8941_nldo = {
 static const struct regulator_desc pm8941_lnldo = {
         .fixed_uV = 1740000,
         .n_voltages = 1,
-        .ops = &rpm_smps_ldo_ops,
+        .ops = &rpm_smps_ldo_ops_fixed,
 };
 
 static const struct regulator_desc pm8941_switch = {
diff --git a/drivers/regulator/tps51632-regulator.c b/drivers/regulator/tps51632-regulator.c
index 572816e30095..c139890c1514 100644
--- a/drivers/regulator/tps51632-regulator.c
+++ b/drivers/regulator/tps51632-regulator.c
@@ -94,11 +94,14 @@ static int tps51632_dcdc_set_ramp_delay(struct regulator_dev *rdev,
                 int ramp_delay)
 {
         struct tps51632_chip *tps = rdev_get_drvdata(rdev);
-        int bit = ramp_delay/6000;
+        int bit;
         int ret;
 
-        if (bit)
-                bit--;
+        if (ramp_delay == 0)
+                bit = 0;
+        else
+                bit = DIV_ROUND_UP(ramp_delay, 6000) - 1;
+
         ret = regmap_write(tps->regmap, TPS51632_SLEW_REGS, BIT(bit));
         if (ret < 0)
                 dev_err(tps->dev, "SLEW reg write failed, err %d\n", ret);
diff --git a/drivers/scsi/53c700.c b/drivers/scsi/53c700.c
index d4c285688ce9..3ddc85e6efd6 100644
--- a/drivers/scsi/53c700.c
+++ b/drivers/scsi/53c700.c
@@ -1122,7 +1122,7 @@ process_script_interrupt(__u32 dsps, __u32 dsp, struct scsi_cmnd *SCp,
                 } else {
                         struct scsi_cmnd *SCp;
 
-                        SCp = scsi_host_find_tag(SDp->host, SCSI_NO_TAG);
+                        SCp = SDp->current_cmnd;
                         if(unlikely(SCp == NULL)) {
                                 sdev_printk(KERN_ERR, SDp,
                                         "no saved request for untagged cmd\n");
@@ -1826,7 +1826,7 @@ NCR_700_queuecommand_lck(struct scsi_cmnd *SCp, void (*done)(struct scsi_cmnd *)
                        slot->tag, slot);
         } else {
                 slot->tag = SCSI_NO_TAG;
-                /* must populate current_cmnd for scsi_host_find_tag to work */
+                /* save current command for reselection */
                 SCp->device->current_cmnd = SCp;
         }
         /* sanity check: some of the commands generated by the mid-layer
diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
index 3408578b08d6..ff41c310c900 100644
--- a/drivers/scsi/scsi_devinfo.c
+++ b/drivers/scsi/scsi_devinfo.c
@@ -230,6 +230,7 @@ static struct {
         {"PIONEER", "CD-ROM DRM-624X", NULL, BLIST_FORCELUN | BLIST_SINGLELUN},
         {"Promise", "VTrak E610f", NULL, BLIST_SPARSELUN | BLIST_NO_RSOC},
         {"Promise", "", NULL, BLIST_SPARSELUN},
+        {"QEMU", "QEMU CD-ROM", NULL, BLIST_SKIP_VPD_PAGES},
         {"QNAP", "iSCSI Storage", NULL, BLIST_MAX_1024},
         {"SYNOLOGY", "iSCSI Storage", NULL, BLIST_MAX_1024},
         {"QUANTUM", "XP34301", "1071", BLIST_NOTQ},
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index a8b610eaa0ca..106a6adbd6f1 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -1128,7 +1128,6 @@ static int scsi_eh_action(struct scsi_cmnd *scmd, int rtn)
  */
 void scsi_eh_finish_cmd(struct scsi_cmnd *scmd, struct list_head *done_q)
 {
-        scmd->device->host->host_failed--;
         scmd->eh_eflags = 0;
         list_move_tail(&scmd->eh_entry, done_q);
 }
@@ -2227,6 +2226,9 @@ int scsi_error_handler(void *data)
                 else
                         scsi_unjam_host(shost);
 
+                /* All scmds have been handled */
+                shost->host_failed = 0;
+
                 /*
                  * Note - if the above fails completely, the action is to take
                  * individual devices offline and flush the queue of any
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index f459dff30512..60bff78e9ead 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -2867,10 +2867,10 @@ static int sd_revalidate_disk(struct gendisk *disk)
         if (sdkp->opt_xfer_blocks &&
             sdkp->opt_xfer_blocks <= dev_max &&
             sdkp->opt_xfer_blocks <= SD_DEF_XFER_BLOCKS &&
-            sdkp->opt_xfer_blocks * sdp->sector_size >= PAGE_SIZE)
-                rw_max = q->limits.io_opt =
-                        sdkp->opt_xfer_blocks * sdp->sector_size;
-        else
+            logical_to_bytes(sdp, sdkp->opt_xfer_blocks) >= PAGE_SIZE) {
+                q->limits.io_opt = logical_to_bytes(sdp, sdkp->opt_xfer_blocks);
+                rw_max = logical_to_sectors(sdp, sdkp->opt_xfer_blocks);
+        } else
                 rw_max = BLK_DEF_MAX_SECTORS;
 
         /* Combine with controller limits */
diff --git a/drivers/scsi/sd.h b/drivers/scsi/sd.h
index 654630bb7d0e..765a6f1ac1b7 100644
--- a/drivers/scsi/sd.h
+++ b/drivers/scsi/sd.h
@@ -151,6 +151,11 @@ static inline sector_t logical_to_sectors(struct scsi_device *sdev, sector_t blo
         return blocks << (ilog2(sdev->sector_size) - 9);
 }
 
+static inline unsigned int logical_to_bytes(struct scsi_device *sdev, sector_t blocks)
+{
+        return blocks * sdev->sector_size;
+}
+
 /*
  * A DIF-capable target device can be formatted with different
  * protection schemes.  Currently 0 through 3 are defined:
diff --git a/drivers/spi/spi-rockchip.c b/drivers/spi/spi-rockchip.c
index cd89682065b9..1026e180eed7 100644
--- a/drivers/spi/spi-rockchip.c
+++ b/drivers/spi/spi-rockchip.c
@@ -578,7 +578,7 @@ static int rockchip_spi_transfer_one(
                 struct spi_device *spi,
                 struct spi_transfer *xfer)
 {
-        int ret = 1;
+        int ret = 0;
         struct rockchip_spi *rs = spi_master_get_devdata(master);
 
         WARN_ON(readl_relaxed(rs->regs + ROCKCHIP_SPI_SSIENR) &&
@@ -627,6 +627,8 @@ static int rockchip_spi_transfer_one(
                         spi_enable_chip(rs, 1);
                         ret = rockchip_spi_prepare_dma(rs);
                 }
+                /* successful DMA prepare means the transfer is in progress */
+                ret = ret ? ret : 1;
         } else {
                 spi_enable_chip(rs, 1);
                 ret = rockchip_spi_pio_transfer(rs);
diff --git a/drivers/spi/spi-sun4i.c b/drivers/spi/spi-sun4i.c
index 1ddd9e2309b6..cf007f3b83ec 100644
--- a/drivers/spi/spi-sun4i.c
+++ b/drivers/spi/spi-sun4i.c
@@ -173,13 +173,17 @@ static int sun4i_spi_transfer_one(struct spi_master *master,
 {
         struct sun4i_spi *sspi = spi_master_get_devdata(master);
         unsigned int mclk_rate, div, timeout;
+        unsigned int start, end, tx_time;
         unsigned int tx_len = 0;
         int ret = 0;
         u32 reg;
 
         /* We don't support transfer larger than the FIFO */
         if (tfr->len > SUN4I_FIFO_DEPTH)
-                return -EINVAL;
+                return -EMSGSIZE;
+
+        if (tfr->tx_buf && tfr->len >= SUN4I_FIFO_DEPTH)
+                return -EMSGSIZE;
 
         reinit_completion(&sspi->done);
         sspi->tx_buf = tfr->tx_buf;
@@ -269,8 +273,12 @@ static int sun4i_spi_transfer_one(struct spi_master *master,
         sun4i_spi_write(sspi, SUN4I_BURST_CNT_REG, SUN4I_BURST_CNT(tfr->len));
         sun4i_spi_write(sspi, SUN4I_XMIT_CNT_REG, SUN4I_XMIT_CNT(tx_len));
 
-        /* Fill the TX FIFO */
-        sun4i_spi_fill_fifo(sspi, SUN4I_FIFO_DEPTH);
+        /*
+         * Fill the TX FIFO
+         * Filling the FIFO fully causes timeout for some reason
+         * at least on spi2 on A10s
+         */
+        sun4i_spi_fill_fifo(sspi, SUN4I_FIFO_DEPTH - 1);
 
         /* Enable the interrupts */
         sun4i_spi_write(sspi, SUN4I_INT_CTL_REG, SUN4I_INT_CTL_TC);
@@ -279,9 +287,16 @@ static int sun4i_spi_transfer_one(struct spi_master *master,
         reg = sun4i_spi_read(sspi, SUN4I_CTL_REG);
         sun4i_spi_write(sspi, SUN4I_CTL_REG, reg | SUN4I_CTL_XCH);
 
+        tx_time = max(tfr->len * 8 * 2 / (tfr->speed_hz / 1000), 100U);
+        start = jiffies;
         timeout = wait_for_completion_timeout(&sspi->done,
-                                              msecs_to_jiffies(1000));
+                                              msecs_to_jiffies(tx_time));
+        end = jiffies;
         if (!timeout) {
+                dev_warn(&master->dev,
+                         "%s: timeout transferring %u bytes@%iHz for %i(%i)ms",
+                         dev_name(&spi->dev), tfr->len, tfr->speed_hz,
+                         jiffies_to_msecs(end - start), tx_time);
                 ret = -ETIMEDOUT;
                 goto out;
         }
diff --git a/drivers/spi/spi-sun6i.c b/drivers/spi/spi-sun6i.c
index 42e2c4bd690a..7fce79a60608 100644
--- a/drivers/spi/spi-sun6i.c
+++ b/drivers/spi/spi-sun6i.c
@@ -160,6 +160,7 @@ static int sun6i_spi_transfer_one(struct spi_master *master,
 {
         struct sun6i_spi *sspi = spi_master_get_devdata(master);
         unsigned int mclk_rate, div, timeout;
+        unsigned int start, end, tx_time;
         unsigned int tx_len = 0;
         int ret = 0;
         u32 reg;
@@ -269,9 +270,16 @@ static int sun6i_spi_transfer_one(struct spi_master *master,
         reg = sun6i_spi_read(sspi, SUN6I_TFR_CTL_REG);
         sun6i_spi_write(sspi, SUN6I_TFR_CTL_REG, reg | SUN6I_TFR_CTL_XCH);
 
+        tx_time = max(tfr->len * 8 * 2 / (tfr->speed_hz / 1000), 100U);
+        start = jiffies;
         timeout = wait_for_completion_timeout(&sspi->done,
-                                              msecs_to_jiffies(1000));
+                                              msecs_to_jiffies(tx_time));
+        end = jiffies;
         if (!timeout) {
+                dev_warn(&master->dev,
+                         "%s: timeout transferring %u bytes@%iHz for %i(%i)ms",
+                         dev_name(&spi->dev), tfr->len, tfr->speed_hz,
+                         jiffies_to_msecs(end - start), tx_time);
                 ret = -ETIMEDOUT;
                 goto out;
         }
diff --git a/drivers/spi/spi-ti-qspi.c b/drivers/spi/spi-ti-qspi.c
index 443f664534e1..29ea8d2f9824 100644
--- a/drivers/spi/spi-ti-qspi.c
+++ b/drivers/spi/spi-ti-qspi.c
@@ -646,6 +646,13 @@ free_master:
 
 static int ti_qspi_remove(struct platform_device *pdev)
 {
+        struct ti_qspi *qspi = platform_get_drvdata(pdev);
+        int rc;
+
+        rc = spi_master_suspend(qspi->master);
+        if (rc)
+                return rc;
+
         pm_runtime_put_sync(&pdev->dev);
         pm_runtime_disable(&pdev->dev);
 
diff --git a/drivers/staging/iio/accel/sca3000_core.c b/drivers/staging/iio/accel/sca3000_core.c
index a8f533af9eca..ec12181822e6 100644
--- a/drivers/staging/iio/accel/sca3000_core.c
+++ b/drivers/staging/iio/accel/sca3000_core.c
@@ -594,7 +594,7 @@ static ssize_t sca3000_read_frequency(struct device *dev,
                 goto error_ret_mut;
         ret = sca3000_read_ctrl_reg(st, SCA3000_REG_CTRL_SEL_OUT_CTRL);
         mutex_unlock(&st->lock);
-        if (ret)
+        if (ret < 0)
                 goto error_ret;
         val = ret;
         if (base_freq > 0)
diff --git a/drivers/staging/iio/adc/ad7606_spi.c b/drivers/staging/iio/adc/ad7606_spi.c
index 825da0769936..9587fa86dc69 100644
--- a/drivers/staging/iio/adc/ad7606_spi.c
+++ b/drivers/staging/iio/adc/ad7606_spi.c
@@ -21,7 +21,7 @@ static int ad7606_spi_read_block(struct device *dev,
 {
         struct spi_device *spi = to_spi_device(dev);
         int i, ret;
-        unsigned short *data;
+        unsigned short *data = buf;
         __be16 *bdata = buf;
 
         ret = spi_read(spi, buf, count * 2);
diff --git a/drivers/staging/iio/impedance-analyzer/ad5933.c b/drivers/staging/iio/impedance-analyzer/ad5933.c
index 9f43976f4ef2..170ac980abcb 100644
--- a/drivers/staging/iio/impedance-analyzer/ad5933.c
+++ b/drivers/staging/iio/impedance-analyzer/ad5933.c
@@ -444,10 +444,10 @@ static ssize_t ad5933_store(struct device *dev,
                 st->settling_cycles = val;
 
                 /* 2x, 4x handling, see datasheet */
-                if (val > 511)
-                        val = (val >> 1) | (1 << 9);
-                else if (val > 1022)
+                if (val > 1022)
                         val = (val >> 2) | (3 << 9);
+                else if (val > 511)
+                        val = (val >> 1) | (1 << 9);
 
                 dat = cpu_to_be16(val);
                 ret = ad5933_i2c_write(st->client,
diff --git a/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c b/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c
index bbfee53cfcf5..845e49a52430 100644
--- a/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c
+++ b/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c
@@ -2521,12 +2521,13 @@ kiblnd_passive_connect(struct rdma_cm_id *cmid, void *priv, int priv_nob)
         return 0;
 
  failed:
-        if (ni)
+        if (ni) {
                 lnet_ni_decref(ni);
+                rej.ibr_cp.ibcp_queue_depth = kiblnd_msg_queue_size(version, ni);
+                rej.ibr_cp.ibcp_max_frags = kiblnd_rdma_frags(version, ni);
+        }
 
         rej.ibr_version             = version;
-        rej.ibr_cp.ibcp_queue_depth = kiblnd_msg_queue_size(version, ni);
-        rej.ibr_cp.ibcp_max_frags = kiblnd_rdma_frags(version, ni);
         kiblnd_reject(cmid, &rej);
 
         return -ECONNREFUSED;
diff --git a/drivers/staging/rtl8188eu/core/rtw_efuse.c b/drivers/staging/rtl8188eu/core/rtw_efuse.c
index c17870cddb5b..fbce1f7e68ca 100644
--- a/drivers/staging/rtl8188eu/core/rtw_efuse.c
+++ b/drivers/staging/rtl8188eu/core/rtw_efuse.c
@@ -102,7 +102,7 @@ efuse_phymap_to_logical(u8 *phymap, u16 _offset, u16 _size_byte, u8  *pbuf)
         if (!efuseTbl)
                 return;
 
-        eFuseWord = (u16 **)rtw_malloc2d(EFUSE_MAX_SECTION_88E, EFUSE_MAX_WORD_UNIT, sizeof(*eFuseWord));
+        eFuseWord = (u16 **)rtw_malloc2d(EFUSE_MAX_SECTION_88E, EFUSE_MAX_WORD_UNIT, sizeof(u16));
         if (!eFuseWord) {
                 DBG_88E("%s: alloc eFuseWord fail!\n", __func__);
                 goto eFuseWord_failed;
diff --git a/drivers/staging/rtl8188eu/hal/usb_halinit.c b/drivers/staging/rtl8188eu/hal/usb_halinit.c
index 87ea3b844951..363f3a34ddce 100644
--- a/drivers/staging/rtl8188eu/hal/usb_halinit.c
+++ b/drivers/staging/rtl8188eu/hal/usb_halinit.c
@@ -2072,7 +2072,8 @@ void rtl8188eu_set_hal_ops(struct adapter *adapt)
 {
         struct hal_ops  *halfunc = &adapt->HalFunc;
 
-        adapt->HalData = kzalloc(sizeof(*adapt->HalData), GFP_KERNEL);
+
+        adapt->HalData = kzalloc(sizeof(struct hal_data_8188e), GFP_KERNEL);
         if (!adapt->HalData)
                 DBG_88E("cant not alloc memory for HAL DATA\n");
 
diff --git a/drivers/thermal/cpu_cooling.c b/drivers/thermal/cpu_cooling.c
index 6ceac4f2d4b2..5b4b47ed948b 100644
--- a/drivers/thermal/cpu_cooling.c
+++ b/drivers/thermal/cpu_cooling.c
@@ -857,14 +857,6 @@ __cpufreq_cooling_register(struct device_node *np,
                 goto free_power_table;
         }
 
-        snprintf(dev_name, sizeof(dev_name), "thermal-cpufreq-%d",
-                 cpufreq_dev->id);
-
-        cool_dev = thermal_of_cooling_device_register(np, dev_name, cpufreq_dev,
-                                                      &cpufreq_cooling_ops);
-        if (IS_ERR(cool_dev))
-                goto remove_idr;
-
         /* Fill freq-table in descending order of frequencies */
         for (i = 0, freq = -1; i <= cpufreq_dev->max_level; i++) {
                 freq = find_next_max(table, freq);
@@ -877,6 +869,14 @@ __cpufreq_cooling_register(struct device_node *np,
                         pr_debug("%s: freq:%u KHz\n", __func__, freq);
         }
 
+        snprintf(dev_name, sizeof(dev_name), "thermal-cpufreq-%d",
+                 cpufreq_dev->id);
+
+        cool_dev = thermal_of_cooling_device_register(np, dev_name, cpufreq_dev,
+                                                      &cpufreq_cooling_ops);
+        if (IS_ERR(cool_dev))
+                goto remove_idr;
+
         cpufreq_dev->clipped_freq = cpufreq_dev->freq_table[0];
         cpufreq_dev->cool_dev = cool_dev;
 
diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
index f856c4544eea..51e0d32883ba 100644
--- a/drivers/tty/pty.c
+++ b/drivers/tty/pty.c
@@ -667,8 +667,11 @@ static void pty_unix98_remove(struct tty_driver *driver, struct tty_struct *tty)
                 fsi = tty->driver_data;
         else
                 fsi = tty->link->driver_data;
-        devpts_kill_index(fsi, tty->index);
-        devpts_release(fsi);
+
+        if (fsi) {
+                devpts_kill_index(fsi, tty->index);
+                devpts_release(fsi);
+        }
 }
 
 static const struct tty_operations ptm_unix98_ops = {
diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
index dc125322f48f..5b0fe97c46ca 100644
--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -750,6 +750,7 @@ static void visual_init(struct vc_data *vc, int num, int init)
         vc->vc_complement_mask = 0;
         vc->vc_can_do_color = 0;
         vc->vc_panic_force_write = false;
+        vc->vc_cur_blink_ms = DEFAULT_CURSOR_BLINK_MS;
         vc->vc_sw->con_init(vc, init);
         if (!vc->vc_complement_mask)
                 vc->vc_complement_mask = vc->vc_can_do_color ? 0x7700 : 0x0800;
diff --git a/drivers/usb/common/usb-otg-fsm.c b/drivers/usb/common/usb-otg-fsm.c
index 9059b7dc185e..2f537bbdda09 100644
--- a/drivers/usb/common/usb-otg-fsm.c
+++ b/drivers/usb/common/usb-otg-fsm.c
@@ -21,6 +21,7 @@
  * 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+#include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/types.h>
 #include <linux/mutex.h>
@@ -450,3 +451,4 @@ int otg_statemachine(struct otg_fsm *fsm)
         return fsm->state_changed;
 }
 EXPORT_SYMBOL_GPL(otg_statemachine);
+MODULE_LICENSE("GPL");
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 34b837ae1ed7..d2e3f655c26f 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -2598,26 +2598,23 @@ EXPORT_SYMBOL_GPL(usb_create_hcd);
  * Don't deallocate the bandwidth_mutex until the last shared usb_hcd is
  * deallocated.
  *
- * Make sure to only deallocate the bandwidth_mutex when the primary HCD is
- * freed.  When hcd_release() is called for either hcd in a peer set
- * invalidate the peer's ->shared_hcd and ->primary_hcd pointers to
- * block new peering attempts
+ * Make sure to deallocate the bandwidth_mutex only when the last HCD is
+ * freed.  When hcd_release() is called for either hcd in a peer set,
+ * invalidate the peer's ->shared_hcd and ->primary_hcd pointers.
  */
 static void hcd_release(struct kref *kref)
 {
         struct usb_hcd *hcd = container_of (kref, struct usb_hcd, kref);
 
         mutex_lock(&usb_port_peer_mutex);
-        if (usb_hcd_is_primary_hcd(hcd)) {
-                kfree(hcd->address0_mutex);
-                kfree(hcd->bandwidth_mutex);
-        }
         if (hcd->shared_hcd) {
                 struct usb_hcd *peer = hcd->shared_hcd;
 
                 peer->shared_hcd = NULL;
-                if (peer->primary_hcd == hcd)
-                        peer->primary_hcd = NULL;
+                peer->primary_hcd = NULL;
+        } else {
+                kfree(hcd->address0_mutex);
+                kfree(hcd->bandwidth_mutex);
         }
         mutex_unlock(&usb_port_peer_mutex);
         kfree(hcd);
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 6dc810bce295..944a6dca0fcb 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -44,6 +44,9 @@ static const struct usb_device_id usb_quirk_list[] = {
         /* Creative SB Audigy 2 NX */
         { USB_DEVICE(0x041e, 0x3020), .driver_info = USB_QUIRK_RESET_RESUME },
 
+        /* USB3503 */
+        { USB_DEVICE(0x0424, 0x3503), .driver_info = USB_QUIRK_RESET_RESUME },
+
         /* Microsoft Wireless Laser Mouse 6000 Receiver */
         { USB_DEVICE(0x045e, 0x00e1), .driver_info = USB_QUIRK_RESET_RESUME },
 
@@ -173,6 +176,10 @@ static const struct usb_device_id usb_quirk_list[] = {
         /* MAYA44USB sound device */
         { USB_DEVICE(0x0a92, 0x0091), .driver_info = USB_QUIRK_RESET_RESUME },
 
+        /* ASUS Base Station(T100) */
+        { USB_DEVICE(0x0b05, 0x17e0), .driver_info =
+                        USB_QUIRK_IGNORE_REMOTE_WAKEUP },
+
         /* Action Semiconductor flash disk */
         { USB_DEVICE(0x10d6, 0x2200), .driver_info =
                         USB_QUIRK_STRING_FETCH_255 },
@@ -188,26 +195,22 @@ static const struct usb_device_id usb_quirk_list[] = {
         { USB_DEVICE(0x1908, 0x1315), .driver_info =
                         USB_QUIRK_HONOR_BNUMINTERFACES },
 
-        /* INTEL VALUE SSD */
-        { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME },
-
-        /* USB3503 */
-        { USB_DEVICE(0x0424, 0x3503), .driver_info = USB_QUIRK_RESET_RESUME },
-
-        /* ASUS Base Station(T100) */
-        { USB_DEVICE(0x0b05, 0x17e0), .driver_info =
-                        USB_QUIRK_IGNORE_REMOTE_WAKEUP },
-
         /* Protocol and OTG Electrical Test Device */
         { USB_DEVICE(0x1a0a, 0x0200), .driver_info =
                         USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL },
 
+        /* Acer C120 LED Projector */
+        { USB_DEVICE(0x1de1, 0xc102), .driver_info = USB_QUIRK_NO_LPM },
+
         /* Blackmagic Design Intensity Shuttle */
         { USB_DEVICE(0x1edb, 0xbd3b), .driver_info = USB_QUIRK_NO_LPM },
 
         /* Blackmagic Design UltraStudio SDI */
         { USB_DEVICE(0x1edb, 0xbd4f), .driver_info = USB_QUIRK_NO_LPM },
 
+        /* INTEL VALUE SSD */
+        { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME },
+
         { }  /* terminating entry must be last */
 };
 
diff --git a/drivers/usb/dwc2/core.h b/drivers/usb/dwc2/core.h
index 3c58d633ce80..dec0b21fc626 100644
--- a/drivers/usb/dwc2/core.h
+++ b/drivers/usb/dwc2/core.h
@@ -64,6 +64,17 @@
         DWC2_TRACE_SCHEDULER_VB(pr_fmt("%s: SCH: " fmt),                \
                                 dev_name(hsotg->dev), ##__VA_ARGS__)
 
+#ifdef CONFIG_MIPS
+/*
+ * There are some MIPS machines that can run in either big-endian
+ * or little-endian mode and that use the dwc2 register without
+ * a byteswap in both ways.
+ * Unlike other architectures, MIPS apparently does not require a
+ * barrier before the __raw_writel() to synchronize with DMA but does
+ * require the barrier after the __raw_writel() to serialize a set of
+ * writes. This set of operations was added specifically for MIPS and
+ * should only be used there.
+ */
 static inline u32 dwc2_readl(const void __iomem *addr)
 {
         u32 value = __raw_readl(addr);
@@ -90,6 +101,22 @@ static inline void dwc2_writel(u32 value, void __iomem *addr)
         pr_info("INFO:: wrote %08x to %p\n", value, addr);
 #endif
 }
+#else
+/* Normal architectures just use readl/write */
+static inline u32 dwc2_readl(const void __iomem *addr)
+{
+        return readl(addr);
+}
+
+static inline void dwc2_writel(u32 value, void __iomem *addr)
+{
+        writel(value, addr);
+
+#ifdef DWC2_LOG_WRITES
+        pr_info("info:: wrote %08x to %p\n", value, addr);
+#endif
+}
+#endif
 
 /* Maximum number of Endpoints/HostChannels */
 #define MAX_EPS_CHANNELS        16
diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index 4c5e3005e1dc..26cf09d0fe3c 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -1018,7 +1018,7 @@ static int dwc2_hsotg_process_req_status(struct dwc2_hsotg *hsotg,
         return 1;
 }
 
-static int dwc2_hsotg_ep_sethalt(struct usb_ep *ep, int value);
+static int dwc2_hsotg_ep_sethalt(struct usb_ep *ep, int value, bool now);
 
 /**
  * get_ep_head - return the first request on the endpoint
@@ -1094,7 +1094,7 @@ static int dwc2_hsotg_process_req_feature(struct dwc2_hsotg *hsotg,
                 case USB_ENDPOINT_HALT:
                         halted = ep->halted;
 
-                        dwc2_hsotg_ep_sethalt(&ep->ep, set);
+                        dwc2_hsotg_ep_sethalt(&ep->ep, set, true);
 
                         ret = dwc2_hsotg_send_reply(hsotg, ep0, NULL, 0);
                         if (ret) {
@@ -2948,8 +2948,13 @@ static int dwc2_hsotg_ep_dequeue(struct usb_ep *ep, struct usb_request *req)
  * dwc2_hsotg_ep_sethalt - set halt on a given endpoint
  * @ep: The endpoint to set halt.
  * @value: Set or unset the halt.
+ * @now: If true, stall the endpoint now. Otherwise return -EAGAIN if
+ *       the endpoint is busy processing requests.
+ *
+ * We need to stall the endpoint immediately if request comes from set_feature
+ * protocol command handler.
  */
-static int dwc2_hsotg_ep_sethalt(struct usb_ep *ep, int value)
+static int dwc2_hsotg_ep_sethalt(struct usb_ep *ep, int value, bool now)
 {
         struct dwc2_hsotg_ep *hs_ep = our_ep(ep);
         struct dwc2_hsotg *hs = hs_ep->parent;
@@ -2969,6 +2974,17 @@ static int dwc2_hsotg_ep_sethalt(struct usb_ep *ep, int value)
                 return 0;
         }
 
+        if (hs_ep->isochronous) {
+                dev_err(hs->dev, "%s is Isochronous Endpoint\n", ep->name);
+                return -EINVAL;
+        }
+
+        if (!now && value && !list_empty(&hs_ep->queue)) {
+                dev_dbg(hs->dev, "%s request is pending, cannot halt\n",
+                        ep->name);
+                return -EAGAIN;
+        }
+
         if (hs_ep->dir_in) {
                 epreg = DIEPCTL(index);
                 epctl = dwc2_readl(hs->regs + epreg);
@@ -3020,7 +3036,7 @@ static int dwc2_hsotg_ep_sethalt_lock(struct usb_ep *ep, int value)
         int ret = 0;
 
         spin_lock_irqsave(&hs->lock, flags);
-        ret = dwc2_hsotg_ep_sethalt(ep, value);
+        ret = dwc2_hsotg_ep_sethalt(ep, value, false);
         spin_unlock_irqrestore(&hs->lock, flags);
 
         return ret;
diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h
index 7ddf9449a063..654050684f4f 100644
--- a/drivers/usb/dwc3/core.h
+++ b/drivers/usb/dwc3/core.h
@@ -402,6 +402,7 @@
 #define DWC3_DEPCMD_GET_RSC_IDX(x)      (((x) >> DWC3_DEPCMD_PARAM_SHIFT) & 0x7f)
 #define DWC3_DEPCMD_STATUS(x)           (((x) >> 12) & 0x0F)
 #define DWC3_DEPCMD_HIPRI_FORCERM       (1 << 11)
+#define DWC3_DEPCMD_CLEARPENDIN         (1 << 11)
 #define DWC3_DEPCMD_CMDACT              (1 << 10)
 #define DWC3_DEPCMD_CMDIOC              (1 << 8)
 
diff --git a/drivers/usb/dwc3/dwc3-exynos.c b/drivers/usb/dwc3/dwc3-exynos.c
index dd5cb5577dca..2f1fb7e7aa54 100644
--- a/drivers/usb/dwc3/dwc3-exynos.c
+++ b/drivers/usb/dwc3/dwc3-exynos.c
@@ -128,12 +128,6 @@ static int dwc3_exynos_probe(struct platform_device *pdev)
 
         platform_set_drvdata(pdev, exynos);
 
-        ret = dwc3_exynos_register_phys(exynos);
-        if (ret) {
-                dev_err(dev, "couldn't register PHYs\n");
-                return ret;
-        }
-
         exynos->dev     = dev;
 
         exynos->clk = devm_clk_get(dev, "usbdrd30");
@@ -183,20 +177,29 @@ static int dwc3_exynos_probe(struct platform_device *pdev)
                 goto err3;
         }
 
+        ret = dwc3_exynos_register_phys(exynos);
+        if (ret) {
+                dev_err(dev, "couldn't register PHYs\n");
+                goto err4;
+        }
+
         if (node) {
                 ret = of_platform_populate(node, NULL, NULL, dev);
                 if (ret) {
                         dev_err(dev, "failed to add dwc3 core\n");
-                        goto err4;
+                        goto err5;
                 }
         } else {
                 dev_err(dev, "no device node, failed to add dwc3 core\n");
                 ret = -ENODEV;
-                goto err4;
+                goto err5;
         }
 
         return 0;
 
+err5:
+        platform_device_unregister(exynos->usb2_phy);
+        platform_device_unregister(exynos->usb3_phy);
 err4:
         regulator_disable(exynos->vdd10);
 err3:
diff --git a/drivers/usb/dwc3/dwc3-st.c b/drivers/usb/dwc3/dwc3-st.c
index 5c0adb9c6fb2..89a2f712fdfe 100644
--- a/drivers/usb/dwc3/dwc3-st.c
+++ b/drivers/usb/dwc3/dwc3-st.c
@@ -129,12 +129,18 @@ static int st_dwc3_drd_init(struct st_dwc3 *dwc3_data)
         switch (dwc3_data->dr_mode) {
         case USB_DR_MODE_PERIPHERAL:
 
-                val &= ~(USB3_FORCE_VBUSVALID | USB3_DELAY_VBUSVALID
+                val &= ~(USB3_DELAY_VBUSVALID
                         | USB3_SEL_FORCE_OPMODE | USB3_FORCE_OPMODE(0x3)
                         | USB3_SEL_FORCE_DPPULLDOWN2 | USB3_FORCE_DPPULLDOWN2
                         | USB3_SEL_FORCE_DMPULLDOWN2 | USB3_FORCE_DMPULLDOWN2);
 
-                val |= USB3_DEVICE_NOT_HOST;
+                /*
+                 * USB3_PORT2_FORCE_VBUSVALID When '1' and when
+                 * USB3_PORT2_DEVICE_NOT_HOST = 1, forces VBUSVLDEXT2 input
+                 * of the pico PHY to 1.
+                 */
+
+                val |= USB3_DEVICE_NOT_HOST | USB3_FORCE_VBUSVALID;
                 break;
 
         case USB_DR_MODE_HOST:
@@ -227,7 +233,8 @@ static int st_dwc3_probe(struct platform_device *pdev)
         dev_vdbg(&pdev->dev, "glue-logic addr 0x%p, syscfg-reg offset 0x%x\n",
                  dwc3_data->glue_base, dwc3_data->syscfg_reg_off);
 
-        dwc3_data->rstc_pwrdn = devm_reset_control_get(dev, "powerdown");
+        dwc3_data->rstc_pwrdn =
+                devm_reset_control_get_exclusive(dev, "powerdown");
         if (IS_ERR(dwc3_data->rstc_pwrdn)) {
                 dev_err(&pdev->dev, "could not get power controller\n");
                 ret = PTR_ERR(dwc3_data->rstc_pwrdn);
@@ -237,7 +244,8 @@ static int st_dwc3_probe(struct platform_device *pdev)
         /* Manage PowerDown */
         reset_control_deassert(dwc3_data->rstc_pwrdn);
 
-        dwc3_data->rstc_rst = devm_reset_control_get(dev, "softreset");
+        dwc3_data->rstc_rst =
+                devm_reset_control_get_shared(dev, "softreset");
         if (IS_ERR(dwc3_data->rstc_rst)) {
                 dev_err(&pdev->dev, "could not get reset controller\n");
                 ret = PTR_ERR(dwc3_data->rstc_rst);
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 9a7d0bd15dc3..07248ff1be5c 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -347,6 +347,28 @@ int dwc3_send_gadget_ep_cmd(struct dwc3 *dwc, unsigned ep,
         return ret;
 }
 
+static int dwc3_send_clear_stall_ep_cmd(struct dwc3_ep *dep)
+{
+        struct dwc3 *dwc = dep->dwc;
+        struct dwc3_gadget_ep_cmd_params params;
+        u32 cmd = DWC3_DEPCMD_CLEARSTALL;
+
+        /*
+         * As of core revision 2.60a the recommended programming model
+         * is to set the ClearPendIN bit when issuing a Clear Stall EP
+         * command for IN endpoints. This is to prevent an issue where
+         * some (non-compliant) hosts may not send ACK TPs for pending
+         * IN transfers due to a mishandled error condition. Synopsys
+         * STAR 9000614252.
+         */
+        if (dep->direction && (dwc->revision >= DWC3_REVISION_260A))
+                cmd |= DWC3_DEPCMD_CLEARPENDIN;
+
+        memset(&params, 0, sizeof(params));
+
+        return dwc3_send_gadget_ep_cmd(dwc, dep->number, cmd, &params);
+}
+
 static dma_addr_t dwc3_trb_dma_offset(struct dwc3_ep *dep,
                 struct dwc3_trb *trb)
 {
@@ -1314,8 +1336,7 @@ int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value, int protocol)
                 else
                         dep->flags |= DWC3_EP_STALL;
         } else {
-                ret = dwc3_send_gadget_ep_cmd(dwc, dep->number,
-                        DWC3_DEPCMD_CLEARSTALL, &params);
+                ret = dwc3_send_clear_stall_ep_cmd(dep);
                 if (ret)
                         dev_err(dwc->dev, "failed to clear STALL on %s\n",
                                         dep->name);
@@ -2247,7 +2268,6 @@ static void dwc3_clear_stall_all_ep(struct dwc3 *dwc)
 
         for (epnum = 1; epnum < DWC3_ENDPOINTS_NUM; epnum++) {
                 struct dwc3_ep *dep;
-                struct dwc3_gadget_ep_cmd_params params;
                 int ret;
 
                 dep = dwc->eps[epnum];
@@ -2259,9 +2279,7 @@ static void dwc3_clear_stall_all_ep(struct dwc3 *dwc)
 
                 dep->flags &= ~DWC3_EP_STALL;
 
-                memset(&params, 0, sizeof(params));
-                ret = dwc3_send_gadget_ep_cmd(dwc, dep->number,
-                                DWC3_DEPCMD_CLEARSTALL, &params);
+                ret = dwc3_send_clear_stall_ep_cmd(dep);
                 WARN_ON_ONCE(ret);
         }
 }
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index d67de0d22a2b..eb648485a58c 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -1868,14 +1868,19 @@ unknown:
                                 }
                                 break;
                         }
-                        req->length = value;
-                        req->context = cdev;
-                        req->zero = value < w_length;
-                        value = composite_ep0_queue(cdev, req, GFP_ATOMIC);
-                        if (value < 0) {
-                                DBG(cdev, "ep_queue --> %d\n", value);
-                                req->status = 0;
-                                composite_setup_complete(gadget->ep0, req);
+
+                        if (value >= 0) {
+                                req->length = value;
+                                req->context = cdev;
+                                req->zero = value < w_length;
+                                value = composite_ep0_queue(cdev, req,
+                                                            GFP_ATOMIC);
+                                if (value < 0) {
+                                        DBG(cdev, "ep_queue --> %d\n", value);
+                                        req->status = 0;
+                                        composite_setup_complete(gadget->ep0,
+                                                                 req);
+                                }
                         }
                         return value;
                 }
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index b6f60ca8a035..70cf3477f951 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -1401,6 +1401,7 @@ static const struct usb_gadget_driver configfs_driver_template = {
                 .owner          = THIS_MODULE,
                 .name           = "configfs-gadget",
         },
+        .match_existing_only = 1,
 };
 
 static struct config_group *gadgets_make(
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 73515d54e1cc..cc33d2667408 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -2051,7 +2051,7 @@ static int __ffs_data_do_os_desc(enum ffs_os_desc_type type,
 
                 if (len < sizeof(*d) ||
                     d->bFirstInterfaceNumber >= ffs->interfaces_count ||
-                    d->Reserved1)
+                    !d->Reserved1)
                         return -EINVAL;
                 for (i = 0; i < ARRAY_SIZE(d->Reserved2); ++i)
                         if (d->Reserved2[i])
@@ -2729,6 +2729,7 @@ static int _ffs_func_bind(struct usb_configuration *c,
                 func->ffs->ss_descs_count;
 
         int fs_len, hs_len, ss_len, ret, i;
+        struct ffs_ep *eps_ptr;
 
         /* Make it a single chunk, less management later on */
         vla_group(d);
@@ -2777,12 +2778,9 @@ static int _ffs_func_bind(struct usb_configuration *c,
                ffs->raw_descs_length);
 
         memset(vla_ptr(vlabuf, d, inums), 0xff, d_inums__sz);
-        for (ret = ffs->eps_count; ret; --ret) {
-                struct ffs_ep *ptr;
-
-                ptr = vla_ptr(vlabuf, d, eps);
-                ptr[ret].num = -1;
-        }
+        eps_ptr = vla_ptr(vlabuf, d, eps);
+        for (i = 0; i < ffs->eps_count; i++)
+                eps_ptr[i].num = -1;
 
         /* Save pointers
          * d_eps == vlabuf, func->eps used to kfree vlabuf later
@@ -2851,7 +2849,7 @@ static int _ffs_func_bind(struct usb_configuration *c,
                 goto error;
 
         func->function.os_desc_table = vla_ptr(vlabuf, d, os_desc_table);
-        if (c->cdev->use_os_string)
+        if (c->cdev->use_os_string) {
                 for (i = 0; i < ffs->interfaces_count; ++i) {
                         struct usb_os_desc *desc;
 
@@ -2862,13 +2860,15 @@ static int _ffs_func_bind(struct usb_configuration *c,
                                 vla_ptr(vlabuf, d, ext_compat) + i * 16;
                         INIT_LIST_HEAD(&desc->ext_prop);
                 }
-        ret = ffs_do_os_descs(ffs->ms_os_descs_count,
-                              vla_ptr(vlabuf, d, raw_descs) +
-                              fs_len + hs_len + ss_len,
-                              d_raw_descs__sz - fs_len - hs_len - ss_len,
-                              __ffs_func_bind_do_os_desc, func);
-        if (unlikely(ret < 0))
-                goto error;
+                ret = ffs_do_os_descs(ffs->ms_os_descs_count,
+                                      vla_ptr(vlabuf, d, raw_descs) +
+                                      fs_len + hs_len + ss_len,
+                                      d_raw_descs__sz - fs_len - hs_len -
+                                      ss_len,
+                                      __ffs_func_bind_do_os_desc, func);
+                if (unlikely(ret < 0))
+                        goto error;
+        }
         func->function.os_desc_n =
                 c->cdev->use_os_string ? ffs->interfaces_count : 0;
 
diff --git a/drivers/usb/gadget/function/f_printer.c b/drivers/usb/gadget/function/f_printer.c
index c45104e3a64b..64706a789580 100644
--- a/drivers/usb/gadget/function/f_printer.c
+++ b/drivers/usb/gadget/function/f_printer.c
@@ -161,14 +161,6 @@ static struct usb_endpoint_descriptor hs_ep_out_desc = {
         .wMaxPacketSize =       cpu_to_le16(512)
 };
 
-static struct usb_qualifier_descriptor dev_qualifier = {
-        .bLength =              sizeof(dev_qualifier),
-        .bDescriptorType =      USB_DT_DEVICE_QUALIFIER,
-        .bcdUSB =               cpu_to_le16(0x0200),
-        .bDeviceClass =         USB_CLASS_PRINTER,
-        .bNumConfigurations =   1
-};
-
 static struct usb_descriptor_header *hs_printer_function[] = {
         (struct usb_descriptor_header *) &intf_desc,
         (struct usb_descriptor_header *) &hs_ep_in_desc,
diff --git a/drivers/usb/gadget/function/f_tcm.c b/drivers/usb/gadget/function/f_tcm.c
index 35fe3c80cfc0..197f73386fac 100644
--- a/drivers/usb/gadget/function/f_tcm.c
+++ b/drivers/usb/gadget/function/f_tcm.c
@@ -1445,16 +1445,18 @@ static void usbg_drop_tpg(struct se_portal_group *se_tpg)
         for (i = 0; i < TPG_INSTANCES; ++i)
                 if (tpg_instances[i].tpg == tpg)
                         break;
-        if (i < TPG_INSTANCES)
+        if (i < TPG_INSTANCES) {
                 tpg_instances[i].tpg = NULL;
-        opts = container_of(tpg_instances[i].func_inst,
-                struct f_tcm_opts, func_inst);
-        mutex_lock(&opts->dep_lock);
-        if (opts->has_dep)
-                module_put(opts->dependent);
-        else
-                configfs_undepend_item_unlocked(&opts->func_inst.group.cg_item);
-        mutex_unlock(&opts->dep_lock);
+                opts = container_of(tpg_instances[i].func_inst,
+                        struct f_tcm_opts, func_inst);
+                mutex_lock(&opts->dep_lock);
+                if (opts->has_dep)
+                        module_put(opts->dependent);
+                else
+                        configfs_undepend_item_unlocked(
+                                &opts->func_inst.group.cg_item);
+                mutex_unlock(&opts->dep_lock);
+        }
         mutex_unlock(&tpg_instances_lock);
 
         kfree(tpg);
diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c
index 186d4b162524..cd214ec8a601 100644
--- a/drivers/usb/gadget/function/f_uac2.c
+++ b/drivers/usb/gadget/function/f_uac2.c
@@ -598,18 +598,6 @@ static struct usb_gadget_strings *fn_strings[] = {
         NULL,
 };
 
-static struct usb_qualifier_descriptor devqual_desc = {
-        .bLength = sizeof devqual_desc,
-        .bDescriptorType = USB_DT_DEVICE_QUALIFIER,
-
-        .bcdUSB = cpu_to_le16(0x200),
-        .bDeviceClass = USB_CLASS_MISC,
-        .bDeviceSubClass = 0x02,
-        .bDeviceProtocol = 0x01,
-        .bNumConfigurations = 1,
-        .bRESERVED = 0,
-};
-
 static struct usb_interface_assoc_descriptor iad_desc = {
         .bLength = sizeof iad_desc,
         .bDescriptorType = USB_DT_INTERFACE_ASSOCIATION,
@@ -1292,6 +1280,7 @@ in_rq_cur(struct usb_function *fn, const struct usb_ctrlrequest *cr)
 
         if (control_selector == UAC2_CS_CONTROL_SAM_FREQ) {
                 struct cntrl_cur_lay3 c;
+                memset(&c, 0, sizeof(struct cntrl_cur_lay3));
 
                 if (entity_id == USB_IN_CLK_ID)
                         c.dCUR = p_srate;
diff --git a/drivers/usb/gadget/function/storage_common.c b/drivers/usb/gadget/function/storage_common.c
index d62683017cf3..990df221c629 100644
--- a/drivers/usb/gadget/function/storage_common.c
+++ b/drivers/usb/gadget/function/storage_common.c
@@ -83,9 +83,7 @@ EXPORT_SYMBOL_GPL(fsg_fs_function);
  * USB 2.0 devices need to expose both high speed and full speed
  * descriptors, unless they only run at full speed.
  *
- * That means alternate endpoint descriptors (bigger packets)
- * and a "device qualifier" ... plus more construction options
- * for the configuration descriptor.
+ * That means alternate endpoint descriptors (bigger packets).
  */
 struct usb_endpoint_descriptor fsg_hs_bulk_in_desc = {
         .bLength =              USB_DT_ENDPOINT_SIZE,
diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
index e64479f882a5..aa3707bdebb4 100644
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -938,8 +938,11 @@ ep0_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr)
                         struct usb_ep           *ep = dev->gadget->ep0;
                         struct usb_request      *req = dev->req;
 
-                        if ((retval = setup_req (ep, req, 0)) == 0)
-                                retval = usb_ep_queue (ep, req, GFP_ATOMIC);
+                        if ((retval = setup_req (ep, req, 0)) == 0) {
+                                spin_unlock_irq (&dev->lock);
+                                retval = usb_ep_queue (ep, req, GFP_KERNEL);
+                                spin_lock_irq (&dev->lock);
+                        }
                         dev->state = STATE_DEV_CONNECTED;
 
                         /* assume that was SET_CONFIGURATION */
@@ -1457,8 +1460,11 @@ delegate:
                                                         w_length);
                                 if (value < 0)
                                         break;
+
+                                spin_unlock (&dev->lock);
                                 value = usb_ep_queue (gadget->ep0, dev->req,
-                                                        GFP_ATOMIC);
+                                                        GFP_KERNEL);
+                                spin_lock (&dev->lock);
                                 if (value < 0) {
                                         clean_req (gadget->ep0, dev->req);
                                         break;
@@ -1481,11 +1487,14 @@ delegate:
         if (value >= 0 && dev->state != STATE_DEV_SETUP) {
                 req->length = value;
                 req->zero = value < w_length;
-                value = usb_ep_queue (gadget->ep0, req, GFP_ATOMIC);
+
+                spin_unlock (&dev->lock);
+                value = usb_ep_queue (gadget->ep0, req, GFP_KERNEL);
                 if (value < 0) {
                         DBG (dev, "ep_queue --> %d\n", value);
                         req->status = 0;
                 }
+                return value;
         }
 
         /* device stalls when value < 0 */
diff --git a/drivers/usb/gadget/udc/udc-core.c b/drivers/usb/gadget/udc/udc-core.c
index 6e8300d6a737..e1b2dcebdc2e 100644
--- a/drivers/usb/gadget/udc/udc-core.c
+++ b/drivers/usb/gadget/udc/udc-core.c
@@ -603,11 +603,15 @@ int usb_gadget_probe_driver(struct usb_gadget_driver *driver)
                 }
         }
 
-        list_add_tail(&driver->pending, &gadget_driver_pending_list);
-        pr_info("udc-core: couldn't find an available UDC - added [%s] to list of pending drivers\n",
-                driver->function);
+        if (!driver->match_existing_only) {
+                list_add_tail(&driver->pending, &gadget_driver_pending_list);
+                pr_info("udc-core: couldn't find an available UDC - added [%s] to list of pending drivers\n",
+                        driver->function);
+                ret = 0;
+        }
+
         mutex_unlock(&udc_lock);
-        return 0;
+        return ret;
 found:
         ret = udc_bind_to_driver(udc, driver);
         mutex_unlock(&udc_lock);
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index ae1b6e69eb96..a962b89b65a6 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -368,6 +368,15 @@ static void ehci_shutdown(struct usb_hcd *hcd)
 {
         struct ehci_hcd *ehci = hcd_to_ehci(hcd);
 
+        /**
+         * Protect the system from crashing at system shutdown in cases where
+         * usb host is not added yet from OTG controller driver.
+         * As ehci_setup() not done yet, so stop accessing registers or
+         * variables initialized in ehci_setup()
+         */
+        if (!ehci->sbrn)
+                return;
+
         spin_lock_irq(&ehci->lock);
         ehci->shutdown = true;
         ehci->rh_state = EHCI_RH_STOPPING;
diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
index ffc90295a95f..74f62d68f013 100644
--- a/drivers/usb/host/ehci-hub.c
+++ b/drivers/usb/host/ehci-hub.c
@@ -872,15 +872,23 @@ int ehci_hub_control(
 ) {
         struct ehci_hcd *ehci = hcd_to_ehci (hcd);
         int             ports = HCS_N_PORTS (ehci->hcs_params);
-        u32 __iomem     *status_reg = &ehci->regs->port_status[
-                                (wIndex & 0xff) - 1];
-        u32 __iomem     *hostpc_reg = &ehci->regs->hostpc[(wIndex & 0xff) - 1];
+        u32 __iomem     *status_reg, *hostpc_reg;
         u32             temp, temp1, status;
         unsigned long   flags;
         int             retval = 0;
         unsigned        selector;
 
         /*
+         * Avoid underflow while calculating (wIndex & 0xff) - 1.
+         * The compiler might deduce that wIndex can never be 0 and then
+         * optimize away the tests for !wIndex below.
+         */
+        temp = wIndex & 0xff;
+        temp -= (temp > 0);
+        status_reg = &ehci->regs->port_status[temp];
+        hostpc_reg = &ehci->regs->hostpc[temp];
+
+        /*
          * FIXME:  support SetPortFeatures USB_PORT_FEAT_INDICATOR.
          * HCS_INDICATOR may say we can change LEDs to off/amber/green.
          * (track current state ourselves) ... blink for diagnostics,
diff --git a/drivers/usb/host/ehci-msm.c b/drivers/usb/host/ehci-msm.c
index d3afc89d00f5..2f8d3af811ce 100644
--- a/drivers/usb/host/ehci-msm.c
+++ b/drivers/usb/host/ehci-msm.c
@@ -179,22 +179,32 @@ static int ehci_msm_remove(struct platform_device *pdev)
 static int ehci_msm_pm_suspend(struct device *dev)
 {
         struct usb_hcd *hcd = dev_get_drvdata(dev);
+        struct ehci_hcd *ehci = hcd_to_ehci(hcd);
         bool do_wakeup = device_may_wakeup(dev);
 
         dev_dbg(dev, "ehci-msm PM suspend\n");
 
-        return ehci_suspend(hcd, do_wakeup);
+        /* Only call ehci_suspend if ehci_setup has been done */
+        if (ehci->sbrn)
+                return ehci_suspend(hcd, do_wakeup);
+
+        return 0;
 }
 
 static int ehci_msm_pm_resume(struct device *dev)
 {
         struct usb_hcd *hcd = dev_get_drvdata(dev);
+        struct ehci_hcd *ehci = hcd_to_ehci(hcd);
 
         dev_dbg(dev, "ehci-msm PM resume\n");
-        ehci_resume(hcd, false);
+
+        /* Only call ehci_resume if ehci_setup has been done */
+        if (ehci->sbrn)
+                ehci_resume(hcd, false);
 
         return 0;
 }
+
 #else
 #define ehci_msm_pm_suspend     NULL
 #define ehci_msm_pm_resume      NULL
diff --git a/drivers/usb/host/ehci-st.c b/drivers/usb/host/ehci-st.c
index a94ed677d937..be4a2788fc58 100644
--- a/drivers/usb/host/ehci-st.c
+++ b/drivers/usb/host/ehci-st.c
@@ -206,7 +206,8 @@ static int st_ehci_platform_probe(struct platform_device *dev)
                 priv->clk48 = NULL;
         }
 
-        priv->pwr = devm_reset_control_get_optional(&dev->dev, "power");
+        priv->pwr =
+                devm_reset_control_get_optional_shared(&dev->dev, "power");
         if (IS_ERR(priv->pwr)) {
                 err = PTR_ERR(priv->pwr);
                 if (err == -EPROBE_DEFER)
@@ -214,7 +215,8 @@ static int st_ehci_platform_probe(struct platform_device *dev)
                 priv->pwr = NULL;
         }
 
-        priv->rst = devm_reset_control_get_optional(&dev->dev, "softreset");
+        priv->rst =
+                devm_reset_control_get_optional_shared(&dev->dev, "softreset");
         if (IS_ERR(priv->rst)) {
                 err = PTR_ERR(priv->rst);
                 if (err == -EPROBE_DEFER)
diff --git a/drivers/usb/host/ehci-tegra.c b/drivers/usb/host/ehci-tegra.c
index 4031b372008e..9a3d7db5be57 100644
--- a/drivers/usb/host/ehci-tegra.c
+++ b/drivers/usb/host/ehci-tegra.c
@@ -81,15 +81,23 @@ static int tegra_reset_usb_controller(struct platform_device *pdev)
         struct usb_hcd *hcd = platform_get_drvdata(pdev);
         struct tegra_ehci_hcd *tegra =
                 (struct tegra_ehci_hcd *)hcd_to_ehci(hcd)->priv;
+        bool has_utmi_pad_registers = false;
 
         phy_np = of_parse_phandle(pdev->dev.of_node, "nvidia,phy", 0);
         if (!phy_np)
                 return -ENOENT;
 
+        if (of_property_read_bool(phy_np, "nvidia,has-utmi-pad-registers"))
+                has_utmi_pad_registers = true;
+
         if (!usb1_reset_attempted) {
                 struct reset_control *usb1_reset;
 
-                usb1_reset = of_reset_control_get(phy_np, "usb");
+                if (!has_utmi_pad_registers)
+                        usb1_reset = of_reset_control_get(phy_np, "utmi-pads");
+                else
+                        usb1_reset = tegra->rst;
+
                 if (IS_ERR(usb1_reset)) {
                         dev_warn(&pdev->dev,
                                  "can't get utmi-pads reset from the PHY\n");
@@ -99,13 +107,15 @@ static int tegra_reset_usb_controller(struct platform_device *pdev)
                         reset_control_assert(usb1_reset);
                         udelay(1);
                         reset_control_deassert(usb1_reset);
+
+                        if (!has_utmi_pad_registers)
+                                reset_control_put(usb1_reset);
                 }
 
-                reset_control_put(usb1_reset);
                 usb1_reset_attempted = true;
         }
 
-        if (!of_property_read_bool(phy_np, "nvidia,has-utmi-pad-registers")) {
+        if (!has_utmi_pad_registers) {
                 reset_control_assert(tegra->rst);
                 udelay(1);
                 reset_control_deassert(tegra->rst);
diff --git a/drivers/usb/host/ohci-q.c b/drivers/usb/host/ohci-q.c
index d029bbe9eb36..641fed609911 100644
--- a/drivers/usb/host/ohci-q.c
+++ b/drivers/usb/host/ohci-q.c
@@ -183,7 +183,6 @@ static int ed_schedule (struct ohci_hcd *ohci, struct ed *ed)
 {
         int     branch;
 
-        ed->state = ED_OPER;
         ed->ed_prev = NULL;
         ed->ed_next = NULL;
         ed->hwNextED = 0;
@@ -259,6 +258,8 @@ static int ed_schedule (struct ohci_hcd *ohci, struct ed *ed)
         /* the HC may not see the schedule updates yet, but if it does
          * then they'll be properly ordered.
          */
+
+        ed->state = ED_OPER;
         return 0;
 }
 
diff --git a/drivers/usb/host/ohci-st.c b/drivers/usb/host/ohci-st.c
index acf2eb2a5676..02816a1515a1 100644
--- a/drivers/usb/host/ohci-st.c
+++ b/drivers/usb/host/ohci-st.c
@@ -188,13 +188,15 @@ static int st_ohci_platform_probe(struct platform_device *dev)
                 priv->clk48 = NULL;
         }
 
-        priv->pwr = devm_reset_control_get_optional(&dev->dev, "power");
+        priv->pwr =
+                devm_reset_control_get_optional_shared(&dev->dev, "power");
         if (IS_ERR(priv->pwr)) {
                 err = PTR_ERR(priv->pwr);
                 goto err_put_clks;
         }
 
-        priv->rst = devm_reset_control_get_optional(&dev->dev, "softreset");
+        priv->rst =
+                devm_reset_control_get_optional_shared(&dev->dev, "softreset");
         if (IS_ERR(priv->rst)) {
                 err = PTR_ERR(priv->rst);
                 goto err_put_clks;
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index ac352fe391f4..4fd041bec332 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -37,6 +37,7 @@
 /* Device for a quirk */
 #define PCI_VENDOR_ID_FRESCO_LOGIC      0x1b73
 #define PCI_DEVICE_ID_FRESCO_LOGIC_PDK  0x1000
+#define PCI_DEVICE_ID_FRESCO_LOGIC_FL1009       0x1009
 #define PCI_DEVICE_ID_FRESCO_LOGIC_FL1400       0x1400
 
 #define PCI_VENDOR_ID_ETRON             0x1b6f
@@ -114,6 +115,10 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
                 xhci->quirks |= XHCI_TRUST_TX_LENGTH;
         }
 
+        if (pdev->vendor == PCI_VENDOR_ID_FRESCO_LOGIC &&
+                        pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_FL1009)
+                xhci->quirks |= XHCI_BROKEN_STREAMS;
+
         if (pdev->vendor == PCI_VENDOR_ID_NEC)
                 xhci->quirks |= XHCI_NEC_HOST;
 
diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
index 676ea458148b..1f3f981fe7f8 100644
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -196,6 +196,9 @@ static int xhci_plat_probe(struct platform_device *pdev)
                 ret = clk_prepare_enable(clk);
                 if (ret)
                         goto put_hcd;
+        } else if (PTR_ERR(clk) == -EPROBE_DEFER) {
+                ret = -EPROBE_DEFER;
+                goto put_hcd;
         }
 
         xhci = hcd_to_xhci(hcd);
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 52deae4b7eac..d7d502578d79 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -290,6 +290,14 @@ static int xhci_abort_cmd_ring(struct xhci_hcd *xhci)
 
         temp_64 = xhci_read_64(xhci, &xhci->op_regs->cmd_ring);
         xhci->cmd_ring_state = CMD_RING_STATE_ABORTED;
+
+        /*
+         * Writing the CMD_RING_ABORT bit should cause a cmd completion event,
+         * however on some host hw the CMD_RING_RUNNING bit is correctly cleared
+         * but the completion event in never sent. Use the cmd timeout timer to
+         * handle those cases. Use twice the time to cover the bit polling retry
+         */
+        mod_timer(&xhci->cmd_timer, jiffies + (2 * XHCI_CMD_DEFAULT_TIMEOUT));
         xhci_write_64(xhci, temp_64 | CMD_RING_ABORT,
                         &xhci->op_regs->cmd_ring);
 
@@ -314,6 +322,7 @@ static int xhci_abort_cmd_ring(struct xhci_hcd *xhci)
 
                 xhci_err(xhci, "Stopped the command ring failed, "
                                 "maybe the host is dead\n");
+                del_timer(&xhci->cmd_timer);
                 xhci->xhc_state |= XHCI_STATE_DYING;
                 xhci_quiesce(xhci);
                 xhci_halt(xhci);
@@ -1246,22 +1255,21 @@ void xhci_handle_command_timeout(unsigned long data)
         int ret;
         unsigned long flags;
         u64 hw_ring_state;
-        struct xhci_command *cur_cmd = NULL;
+        bool second_timeout = false;
         xhci = (struct xhci_hcd *) data;
 
         /* mark this command to be cancelled */
         spin_lock_irqsave(&xhci->lock, flags);
         if (xhci->current_cmd) {
-                cur_cmd = xhci->current_cmd;
-                cur_cmd->status = COMP_CMD_ABORT;
+                if (xhci->current_cmd->status == COMP_CMD_ABORT)
+                        second_timeout = true;
+                xhci->current_cmd->status = COMP_CMD_ABORT;
         }
 
-
         /* Make sure command ring is running before aborting it */
         hw_ring_state = xhci_read_64(xhci, &xhci->op_regs->cmd_ring);
         if ((xhci->cmd_ring_state & CMD_RING_STATE_RUNNING) &&
             (hw_ring_state & CMD_RING_RUNNING))  {
-
                 spin_unlock_irqrestore(&xhci->lock, flags);
                 xhci_dbg(xhci, "Command timeout\n");
                 ret = xhci_abort_cmd_ring(xhci);
@@ -1273,6 +1281,15 @@ void xhci_handle_command_timeout(unsigned long data)
                 }
                 return;
         }
+
+        /* command ring failed to restart, or host removed. Bail out */
+        if (second_timeout || xhci->xhc_state & XHCI_STATE_REMOVING) {
+                spin_unlock_irqrestore(&xhci->lock, flags);
+                xhci_dbg(xhci, "command timed out twice, ring start fail?\n");
+                xhci_cleanup_command_queue(xhci);
+                return;
+        }
+
         /* command timeout on stopped ring, ring can't be aborted */
         xhci_dbg(xhci, "Command timeout on stopped ring\n");
         xhci_handle_stopped_cmd_ring(xhci, xhci->current_cmd);
@@ -2721,7 +2738,8 @@ hw_died:
                 writel(irq_pending, &xhci->ir_set->irq_pending);
         }
 
-        if (xhci->xhc_state & XHCI_STATE_DYING) {
+        if (xhci->xhc_state & XHCI_STATE_DYING ||
+            xhci->xhc_state & XHCI_STATE_HALTED) {
                 xhci_dbg(xhci, "xHCI dying, ignoring interrupt. "
                                 "Shouldn't IRQs be disabled?\n");
                 /* Clear the event handler busy flag (RW1C);
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index fa7e1ef36cd9..f2f9518c53ab 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -685,20 +685,23 @@ void xhci_stop(struct usb_hcd *hcd)
         u32 temp;
         struct xhci_hcd *xhci = hcd_to_xhci(hcd);
 
-        if (xhci->xhc_state & XHCI_STATE_HALTED)
-                return;
-
         mutex_lock(&xhci->mutex);
-        spin_lock_irq(&xhci->lock);
-        xhci->xhc_state |= XHCI_STATE_HALTED;
-        xhci->cmd_ring_state = CMD_RING_STATE_STOPPED;
 
-        /* Make sure the xHC is halted for a USB3 roothub
-         * (xhci_stop() could be called as part of failed init).
-         */
-        xhci_halt(xhci);
-        xhci_reset(xhci);
-        spin_unlock_irq(&xhci->lock);
+        if (!(xhci->xhc_state & XHCI_STATE_HALTED)) {
+                spin_lock_irq(&xhci->lock);
+
+                xhci->xhc_state |= XHCI_STATE_HALTED;
+                xhci->cmd_ring_state = CMD_RING_STATE_STOPPED;
+                xhci_halt(xhci);
+                xhci_reset(xhci);
+
+                spin_unlock_irq(&xhci->lock);
+        }
+
+        if (!usb_hcd_is_primary_hcd(hcd)) {
+                mutex_unlock(&xhci->mutex);
+                return;
+        }
 
         xhci_cleanup_msix(xhci);
 
@@ -4886,7 +4889,7 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
                 xhci->hcc_params2 = readl(&xhci->cap_regs->hcc_params2);
         xhci_print_registers(xhci);
 
-        xhci->quirks = quirks;
+        xhci->quirks |= quirks;
 
         get_quirks(dev, xhci);
 
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index 39fd95833eb8..f824336def5c 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -1090,29 +1090,6 @@ void musb_stop(struct musb *musb)
         musb_platform_try_idle(musb, 0);
 }
 
-static void musb_shutdown(struct platform_device *pdev)
-{
-        struct musb     *musb = dev_to_musb(&pdev->dev);
-        unsigned long   flags;
-
-        pm_runtime_get_sync(musb->controller);
-
-        musb_host_cleanup(musb);
-        musb_gadget_cleanup(musb);
-
-        spin_lock_irqsave(&musb->lock, flags);
-        musb_platform_disable(musb);
-        musb_generic_disable(musb);
-        spin_unlock_irqrestore(&musb->lock, flags);
-
-        musb_writeb(musb->mregs, MUSB_DEVCTL, 0);
-        musb_platform_exit(musb);
-
-        pm_runtime_put(musb->controller);
-        /* FIXME power down */
-}
-
-
 /*-------------------------------------------------------------------------*/
 
 /*
@@ -1702,7 +1679,7 @@ EXPORT_SYMBOL_GPL(musb_dma_completion);
 #define use_dma                 0
 #endif
 
-static void (*musb_phy_callback)(enum musb_vbus_id_status status);
+static int (*musb_phy_callback)(enum musb_vbus_id_status status);
 
 /*
  * musb_mailbox - optional phy notifier function
@@ -1711,11 +1688,12 @@ static void (*musb_phy_callback)(enum musb_vbus_id_status status);
  * Optionally gets called from the USB PHY. Note that the USB PHY must be
  * disabled at the point the phy_callback is registered or unregistered.
  */
-void musb_mailbox(enum musb_vbus_id_status status)
+int musb_mailbox(enum musb_vbus_id_status status)
 {
         if (musb_phy_callback)
-                musb_phy_callback(status);
+                return musb_phy_callback(status);
 
+        return -ENODEV;
 };
 EXPORT_SYMBOL_GPL(musb_mailbox);
 
@@ -2028,11 +2006,6 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl)
         musb_readl = musb_default_readl;
         musb_writel = musb_default_writel;
 
-        /* We need musb_read/write functions initialized for PM */
-        pm_runtime_use_autosuspend(musb->controller);
-        pm_runtime_set_autosuspend_delay(musb->controller, 200);
-        pm_runtime_enable(musb->controller);
-
         /* The musb_platform_init() call:
          *   - adjusts musb->mregs
          *   - sets the musb->isr
@@ -2134,6 +2107,16 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl)
         if (musb->ops->phy_callback)
                 musb_phy_callback = musb->ops->phy_callback;
 
+        /*
+         * We need musb_read/write functions initialized for PM.
+         * Note that at least 2430 glue needs autosuspend delay
+         * somewhere above 300 ms for the hardware to idle properly
+         * after disconnecting the cable in host mode. Let's use
+         * 500 ms for some margin.
+         */
+        pm_runtime_use_autosuspend(musb->controller);
+        pm_runtime_set_autosuspend_delay(musb->controller, 500);
+        pm_runtime_enable(musb->controller);
         pm_runtime_get_sync(musb->controller);
 
         status = usb_phy_init(musb->xceiv);
@@ -2237,13 +2220,8 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl)
         if (status)
                 goto fail5;
 
-        pm_runtime_put(musb->controller);
-
-        /*
-         * For why this is currently needed, see commit 3e43a0725637
-         * ("usb: musb: core: add pm_runtime_irq_safe()")
-         */
-        pm_runtime_irq_safe(musb->controller);
+        pm_runtime_mark_last_busy(musb->controller);
+        pm_runtime_put_autosuspend(musb->controller);
 
         return 0;
 
@@ -2265,7 +2243,9 @@ fail2_5:
         usb_phy_shutdown(musb->xceiv);
 
 err_usb_phy_init:
+        pm_runtime_dont_use_autosuspend(musb->controller);
         pm_runtime_put_sync(musb->controller);
+        pm_runtime_disable(musb->controller);
 
 fail2:
         if (musb->irq_wake)
@@ -2273,7 +2253,6 @@ fail2:
         musb_platform_exit(musb);
 
 fail1:
-        pm_runtime_disable(musb->controller);
         dev_err(musb->controller,
                 "musb_init_controller failed with status %d\n", status);
 
@@ -2312,6 +2291,7 @@ static int musb_remove(struct platform_device *pdev)
 {
         struct device   *dev = &pdev->dev;
         struct musb     *musb = dev_to_musb(dev);
+        unsigned long   flags;
 
         /* this gets called on rmmod.
          *  - Host mode: host may still be active
@@ -2319,17 +2299,26 @@ static int musb_remove(struct platform_device *pdev)
          *  - OTG mode: both roles are deactivated (or never-activated)
          */
         musb_exit_debugfs(musb);
-        musb_shutdown(pdev);
-        musb_phy_callback = NULL;
-
-        if (musb->dma_controller)
-                musb_dma_controller_destroy(musb->dma_controller);
-
-        usb_phy_shutdown(musb->xceiv);
 
         cancel_work_sync(&musb->irq_work);
         cancel_delayed_work_sync(&musb->finish_resume_work);
         cancel_delayed_work_sync(&musb->deassert_reset_work);
+        pm_runtime_get_sync(musb->controller);
+        musb_host_cleanup(musb);
+        musb_gadget_cleanup(musb);
+        spin_lock_irqsave(&musb->lock, flags);
+        musb_platform_disable(musb);
+        musb_generic_disable(musb);
+        spin_unlock_irqrestore(&musb->lock, flags);
+        musb_writeb(musb->mregs, MUSB_DEVCTL, 0);
+        pm_runtime_dont_use_autosuspend(musb->controller);
+        pm_runtime_put_sync(musb->controller);
+        pm_runtime_disable(musb->controller);
+        musb_platform_exit(musb);
+        musb_phy_callback = NULL;
+        if (musb->dma_controller)
+                musb_dma_controller_destroy(musb->dma_controller);
+        usb_phy_shutdown(musb->xceiv);
         musb_free(musb);
         device_init_wakeup(dev, 0);
         return 0;
@@ -2429,7 +2418,8 @@ static void musb_restore_context(struct musb *musb)
         musb_writew(musb_base, MUSB_INTRTXE, musb->intrtxe);
         musb_writew(musb_base, MUSB_INTRRXE, musb->intrrxe);
         musb_writeb(musb_base, MUSB_INTRUSBE, musb->context.intrusbe);
-        musb_writeb(musb_base, MUSB_DEVCTL, musb->context.devctl);
+        if (musb->context.devctl & MUSB_DEVCTL_SESSION)
+                musb_writeb(musb_base, MUSB_DEVCTL, musb->context.devctl);
 
         for (i = 0; i < musb->config->num_eps; ++i) {
                 struct musb_hw_ep       *hw_ep;
@@ -2612,7 +2602,6 @@ static struct platform_driver musb_driver = {
         },
         .probe          = musb_probe,
         .remove         = musb_remove,
-        .shutdown       = musb_shutdown,
 };
 
 module_platform_driver(musb_driver);
diff --git a/drivers/usb/musb/musb_core.h b/drivers/usb/musb/musb_core.h
index b6afe9e43305..b55a776b03eb 100644
--- a/drivers/usb/musb/musb_core.h
+++ b/drivers/usb/musb/musb_core.h
@@ -215,7 +215,7 @@ struct musb_platform_ops {
                                 dma_addr_t *dma_addr, u32 *len);
         void    (*pre_root_reset_end)(struct musb *musb);
         void    (*post_root_reset_end)(struct musb *musb);
-        void    (*phy_callback)(enum musb_vbus_id_status status);
+        int     (*phy_callback)(enum musb_vbus_id_status status);
 };
 
 /*
@@ -312,6 +312,7 @@ struct musb {
         struct work_struct      irq_work;
         struct delayed_work     deassert_reset_work;
         struct delayed_work     finish_resume_work;
+        struct delayed_work     gadget_work;
         u16                     hwvers;
 
         u16                     intrrxe;
diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index 152865b36522..af2a3a7addf9 100644
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -1656,6 +1656,20 @@ static int musb_gadget_vbus_draw(struct usb_gadget *gadget, unsigned mA)
         return usb_phy_set_power(musb->xceiv, mA);
 }
 
+static void musb_gadget_work(struct work_struct *work)
+{
+        struct musb *musb;
+        unsigned long flags;
+
+        musb = container_of(work, struct musb, gadget_work.work);
+        pm_runtime_get_sync(musb->controller);
+        spin_lock_irqsave(&musb->lock, flags);
+        musb_pullup(musb, musb->softconnect);
+        spin_unlock_irqrestore(&musb->lock, flags);
+        pm_runtime_mark_last_busy(musb->controller);
+        pm_runtime_put_autosuspend(musb->controller);
+}
+
 static int musb_gadget_pullup(struct usb_gadget *gadget, int is_on)
 {
         struct musb     *musb = gadget_to_musb(gadget);
@@ -1663,20 +1677,16 @@ static int musb_gadget_pullup(struct usb_gadget *gadget, int is_on)
 
         is_on = !!is_on;
 
-        pm_runtime_get_sync(musb->controller);
-
         /* NOTE: this assumes we are sensing vbus; we'd rather
          * not pullup unless the B-session is active.
          */
         spin_lock_irqsave(&musb->lock, flags);
         if (is_on != musb->softconnect) {
                 musb->softconnect = is_on;
-                musb_pullup(musb, is_on);
+                schedule_delayed_work(&musb->gadget_work, 0);
         }
         spin_unlock_irqrestore(&musb->lock, flags);
 
-        pm_runtime_put(musb->controller);
-
         return 0;
 }
 
@@ -1845,7 +1855,7 @@ int musb_gadget_setup(struct musb *musb)
 #elif IS_ENABLED(CONFIG_USB_MUSB_GADGET)
         musb->g.is_otg = 0;
 #endif
-
+        INIT_DELAYED_WORK(&musb->gadget_work, musb_gadget_work);
         musb_g_init_endpoints(musb);
 
         musb->is_active = 0;
@@ -1866,6 +1876,8 @@ void musb_gadget_cleanup(struct musb *musb)
 {
         if (musb->port_mode == MUSB_PORT_MODE_HOST)
                 return;
+
+        cancel_delayed_work_sync(&musb->gadget_work);
         usb_del_gadget_udc(&musb->g);
 }
 
@@ -1914,8 +1926,8 @@ static int musb_gadget_start(struct usb_gadget *g,
         if (musb->xceiv->last_event == USB_EVENT_ID)
                 musb_platform_set_vbus(musb, 1);
 
-        if (musb->xceiv->last_event == USB_EVENT_NONE)
-                pm_runtime_put(musb->controller);
+        pm_runtime_mark_last_busy(musb->controller);
+        pm_runtime_put_autosuspend(musb->controller);
 
         return 0;
 
@@ -1934,8 +1946,7 @@ static int musb_gadget_stop(struct usb_gadget *g)
         struct musb     *musb = gadget_to_musb(g);
         unsigned long   flags;
 
-        if (musb->xceiv->last_event == USB_EVENT_NONE)
-                pm_runtime_get_sync(musb->controller);
+        pm_runtime_get_sync(musb->controller);
 
         /*
          * REVISIT always use otg_set_peripheral() here too;
@@ -1963,7 +1974,8 @@ static int musb_gadget_stop(struct usb_gadget *g)
          * that currently misbehaves.
          */
 
-        pm_runtime_put(musb->controller);
+        pm_runtime_mark_last_busy(musb->controller);
+        pm_runtime_put_autosuspend(musb->controller);
 
         return 0;
 }
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index 2f8ad7f1f482..d227a71d85e1 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -434,7 +434,13 @@ static void musb_advance_schedule(struct musb *musb, struct urb *urb,
                 }
         }
 
-        if (qh != NULL && qh->is_ready) {
+        /*
+         * The pipe must be broken if current urb->status is set, so don't
+         * start next urb.
+         * TODO: to minimize the risk of regression, only check urb->status
+         * for RX, until we have a test case to understand the behavior of TX.
+         */
+        if ((!status || !is_in) && qh && qh->is_ready) {
                 dev_dbg(musb->controller, "... next ep%d %cX urb %p\n",
                     hw_ep->epnum, is_in ? 'R' : 'T', next_urb(qh));
                 musb_start_urb(musb, is_in, qh);
@@ -594,14 +600,13 @@ musb_rx_reinit(struct musb *musb, struct musb_qh *qh, u8 epnum)
                 musb_writew(ep->regs, MUSB_TXCSR, 0);
 
         /* scrub all previous state, clearing toggle */
-        } else {
-                csr = musb_readw(ep->regs, MUSB_RXCSR);
-                if (csr & MUSB_RXCSR_RXPKTRDY)
-                        WARNING("rx%d, packet/%d ready?\n", ep->epnum,
-                                musb_readw(ep->regs, MUSB_RXCOUNT));
-
-                musb_h_flush_rxfifo(ep, MUSB_RXCSR_CLRDATATOG);
         }
+        csr = musb_readw(ep->regs, MUSB_RXCSR);
+        if (csr & MUSB_RXCSR_RXPKTRDY)
+                WARNING("rx%d, packet/%d ready?\n", ep->epnum,
+                        musb_readw(ep->regs, MUSB_RXCOUNT));
+
+        musb_h_flush_rxfifo(ep, MUSB_RXCSR_CLRDATATOG);
 
         /* target addr and (for multipoint) hub addr/port */
         if (musb->is_multipoint) {
@@ -627,7 +632,7 @@ musb_rx_reinit(struct musb *musb, struct musb_qh *qh, u8 epnum)
         ep->rx_reinit = 0;
 }
 
-static int musb_tx_dma_set_mode_mentor(struct dma_controller *dma,
+static void musb_tx_dma_set_mode_mentor(struct dma_controller *dma,
                 struct musb_hw_ep *hw_ep, struct musb_qh *qh,
                 struct urb *urb, u32 offset,
                 u32 *length, u8 *mode)
@@ -664,23 +669,18 @@ static int musb_tx_dma_set_mode_mentor(struct dma_controller *dma,
         }
         channel->desired_mode = *mode;
         musb_writew(epio, MUSB_TXCSR, csr);
-
-        return 0;
 }
 
-static int musb_tx_dma_set_mode_cppi_tusb(struct dma_controller *dma,
-                                          struct musb_hw_ep *hw_ep,
-                                          struct musb_qh *qh,
-                                          struct urb *urb,
-                                          u32 offset,
-                                          u32 *length,
-                                          u8 *mode)
+static void musb_tx_dma_set_mode_cppi_tusb(struct dma_controller *dma,
+                                           struct musb_hw_ep *hw_ep,
+                                           struct musb_qh *qh,
+                                           struct urb *urb,
+                                           u32 offset,
+                                           u32 *length,
+                                           u8 *mode)
 {
         struct dma_channel *channel = hw_ep->tx_channel;
 
-        if (!is_cppi_enabled(hw_ep->musb) && !tusb_dma_omap(hw_ep->musb))
-                return -ENODEV;
-
         channel->actual_len = 0;
 
         /*
@@ -688,8 +688,6 @@ static int musb_tx_dma_set_mode_cppi_tusb(struct dma_controller *dma,
          * to identify the zero-length-final-packet case.
          */
         *mode = (urb->transfer_flags & URB_ZERO_PACKET) ? 1 : 0;
-
-        return 0;
 }
 
 static bool musb_tx_dma_program(struct dma_controller *dma,
@@ -699,15 +697,14 @@ static bool musb_tx_dma_program(struct dma_controller *dma,
         struct dma_channel      *channel = hw_ep->tx_channel;
         u16                     pkt_size = qh->maxpacket;
         u8                      mode;
-        int                     res;
 
         if (musb_dma_inventra(hw_ep->musb) || musb_dma_ux500(hw_ep->musb))
-                res = musb_tx_dma_set_mode_mentor(dma, hw_ep, qh, urb,
-                                                 offset, &length, &mode);
+                musb_tx_dma_set_mode_mentor(dma, hw_ep, qh, urb, offset,
+                                            &length, &mode);
+        else if (is_cppi_enabled(hw_ep->musb) || tusb_dma_omap(hw_ep->musb))
+                musb_tx_dma_set_mode_cppi_tusb(dma, hw_ep, qh, urb, offset,
+                                               &length, &mode);
         else
-                res = musb_tx_dma_set_mode_cppi_tusb(dma, hw_ep, qh, urb,
-                                                     offset, &length, &mode);
-        if (res)
                 return false;
 
         qh->segsize = length;
@@ -995,9 +992,15 @@ static void musb_bulk_nak_timeout(struct musb *musb, struct musb_hw_ep *ep,
         if (is_in) {
                 dma = is_dma_capable() ? ep->rx_channel : NULL;
 
-                /* clear nak timeout bit */
+                /*
+                 * Need to stop the transaction by clearing REQPKT first
+                 * then the NAK Timeout bit ref MUSBMHDRC USB 2.0 HIGH-SPEED
+                 * DUAL-ROLE CONTROLLER Programmer's Guide, section 9.2.2
+                 */
                 rx_csr = musb_readw(epio, MUSB_RXCSR);
                 rx_csr |= MUSB_RXCSR_H_WZC_BITS;
+                rx_csr &= ~MUSB_RXCSR_H_REQPKT;
+                musb_writew(epio, MUSB_RXCSR, rx_csr);
                 rx_csr &= ~MUSB_RXCSR_DATAERROR;
                 musb_writew(epio, MUSB_RXCSR, rx_csr);
 
@@ -1551,7 +1554,7 @@ static int musb_rx_dma_iso_cppi41(struct dma_controller *dma,
                                   struct urb *urb,
                                   size_t len)
 {
-        struct dma_channel *channel = hw_ep->tx_channel;
+        struct dma_channel *channel = hw_ep->rx_channel;
         void __iomem *epio = hw_ep->regs;
         dma_addr_t *buf;
         u32 length, res;
@@ -1870,6 +1873,9 @@ void musb_host_rx(struct musb *musb, u8 epnum)
                 status = -EPROTO;
                 musb_writeb(epio, MUSB_RXINTERVAL, 0);
 
+                rx_csr &= ~MUSB_RXCSR_H_ERROR;
+                musb_writew(epio, MUSB_RXCSR, rx_csr);
+
         } else if (rx_csr & MUSB_RXCSR_DATAERROR) {
 
                 if (USB_ENDPOINT_XFER_ISOC != qh->type) {
diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
index c84e0322c108..0b4cec940386 100644
--- a/drivers/usb/musb/omap2430.c
+++ b/drivers/usb/musb/omap2430.c
@@ -49,97 +49,14 @@ struct omap2430_glue {
         enum musb_vbus_id_status status;
         struct work_struct      omap_musb_mailbox_work;
         struct device           *control_otghs;
+        bool                    cable_connected;
+        bool                    enabled;
+        bool                    powered;
 };
 #define glue_to_musb(g)         platform_get_drvdata(g->musb)
 
 static struct omap2430_glue     *_glue;
 
-static struct timer_list musb_idle_timer;
-
-static void musb_do_idle(unsigned long _musb)
-{
-        struct musb     *musb = (void *)_musb;
-        unsigned long   flags;
-        u8      power;
-        u8      devctl;
-
-        spin_lock_irqsave(&musb->lock, flags);
-
-        switch (musb->xceiv->otg->state) {
-        case OTG_STATE_A_WAIT_BCON:
-
-                devctl = musb_readb(musb->mregs, MUSB_DEVCTL);
-                if (devctl & MUSB_DEVCTL_BDEVICE) {
-                        musb->xceiv->otg->state = OTG_STATE_B_IDLE;
-                        MUSB_DEV_MODE(musb);
-                } else {
-                        musb->xceiv->otg->state = OTG_STATE_A_IDLE;
-                        MUSB_HST_MODE(musb);
-                }
-                break;
-        case OTG_STATE_A_SUSPEND:
-                /* finish RESUME signaling? */
-                if (musb->port1_status & MUSB_PORT_STAT_RESUME) {
-                        power = musb_readb(musb->mregs, MUSB_POWER);
-                        power &= ~MUSB_POWER_RESUME;
-                        dev_dbg(musb->controller, "root port resume stopped, power %02x\n", power);
-                        musb_writeb(musb->mregs, MUSB_POWER, power);
-                        musb->is_active = 1;
-                        musb->port1_status &= ~(USB_PORT_STAT_SUSPEND
-                                                | MUSB_PORT_STAT_RESUME);
-                        musb->port1_status |= USB_PORT_STAT_C_SUSPEND << 16;
-                        usb_hcd_poll_rh_status(musb->hcd);
-                        /* NOTE: it might really be A_WAIT_BCON ... */
-                        musb->xceiv->otg->state = OTG_STATE_A_HOST;
-                }
-                break;
-        case OTG_STATE_A_HOST:
-                devctl = musb_readb(musb->mregs, MUSB_DEVCTL);
-                if (devctl &  MUSB_DEVCTL_BDEVICE)
-                        musb->xceiv->otg->state = OTG_STATE_B_IDLE;
-                else
-                        musb->xceiv->otg->state = OTG_STATE_A_WAIT_BCON;
-        default:
-                break;
-        }
-        spin_unlock_irqrestore(&musb->lock, flags);
-}
-
-
-static void omap2430_musb_try_idle(struct musb *musb, unsigned long timeout)
-{
-        unsigned long           default_timeout = jiffies + msecs_to_jiffies(3);
-        static unsigned long    last_timer;
-
-        if (timeout == 0)
-                timeout = default_timeout;
-
-        /* Never idle if active, or when VBUS timeout is not set as host */
-        if (musb->is_active || ((musb->a_wait_bcon == 0)
-                        && (musb->xceiv->otg->state == OTG_STATE_A_WAIT_BCON))) {
-                dev_dbg(musb->controller, "%s active, deleting timer\n",
-                        usb_otg_state_string(musb->xceiv->otg->state));
-                del_timer(&musb_idle_timer);
-                last_timer = jiffies;
-                return;
-        }
-
-        if (time_after(last_timer, timeout)) {
-                if (!timer_pending(&musb_idle_timer))
-                        last_timer = timeout;
-                else {
-                        dev_dbg(musb->controller, "Longer idle timer already pending, ignoring\n");
-                        return;
-                }
-        }
-        last_timer = timeout;
-
-        dev_dbg(musb->controller, "%s inactive, for idle timer for %lu ms\n",
-                usb_otg_state_string(musb->xceiv->otg->state),
-                (unsigned long)jiffies_to_msecs(timeout - jiffies));
-        mod_timer(&musb_idle_timer, timeout);
-}
-
 static void omap2430_musb_set_vbus(struct musb *musb, int is_on)
 {
         struct usb_otg  *otg = musb->xceiv->otg;
@@ -205,16 +122,6 @@ static void omap2430_musb_set_vbus(struct musb *musb, int is_on)
                 musb_readb(musb->mregs, MUSB_DEVCTL));
 }
 
-static int omap2430_musb_set_mode(struct musb *musb, u8 musb_mode)
-{
-        u8      devctl = musb_readb(musb->mregs, MUSB_DEVCTL);
-
-        devctl |= MUSB_DEVCTL_SESSION;
-        musb_writeb(musb->mregs, MUSB_DEVCTL, devctl);
-
-        return 0;
-}
-
 static inline void omap2430_low_level_exit(struct musb *musb)
 {
         u32 l;
@@ -234,22 +141,63 @@ static inline void omap2430_low_level_init(struct musb *musb)
         musb_writel(musb->mregs, OTG_FORCESTDBY, l);
 }
 
-static void omap2430_musb_mailbox(enum musb_vbus_id_status status)
+/*
+ * We can get multiple cable events so we need to keep track
+ * of the power state. Only keep power enabled if USB cable is
+ * connected and a gadget is started.
+ */
+static void omap2430_set_power(struct musb *musb, bool enabled, bool cable)
+{
+        struct device *dev = musb->controller;
+        struct omap2430_glue *glue = dev_get_drvdata(dev->parent);
+        bool power_up;
+        int res;
+
+        if (glue->enabled != enabled)
+                glue->enabled = enabled;
+
+        if (glue->cable_connected != cable)
+                glue->cable_connected = cable;
+
+        power_up = glue->enabled && glue->cable_connected;
+        if (power_up == glue->powered) {
+                dev_warn(musb->controller, "power state already %i\n",
+                         power_up);
+                return;
+        }
+
+        glue->powered = power_up;
+
+        if (power_up) {
+                res = pm_runtime_get_sync(musb->controller);
+                if (res < 0) {
+                        dev_err(musb->controller, "could not enable: %i", res);
+                        glue->powered = false;
+                }
+        } else {
+                pm_runtime_mark_last_busy(musb->controller);
+                pm_runtime_put_autosuspend(musb->controller);
+        }
+}
+
+static int omap2430_musb_mailbox(enum musb_vbus_id_status status)
 {
         struct omap2430_glue    *glue = _glue;
 
         if (!glue) {
                 pr_err("%s: musb core is not yet initialized\n", __func__);
-                return;
+                return -EPROBE_DEFER;
         }
         glue->status = status;
 
         if (!glue_to_musb(glue)) {
                 pr_err("%s: musb core is not yet ready\n", __func__);
-                return;
+                return -EPROBE_DEFER;
         }
 
         schedule_work(&glue->omap_musb_mailbox_work);
+
+        return 0;
 }
 
 static void omap_musb_set_mailbox(struct omap2430_glue *glue)
@@ -259,6 +207,13 @@ static void omap_musb_set_mailbox(struct omap2430_glue *glue)
         struct musb_hdrc_platform_data *pdata = dev_get_platdata(dev);
         struct omap_musb_board_data *data = pdata->board_data;
         struct usb_otg *otg = musb->xceiv->otg;
+        bool cable_connected;
+
+        cable_connected = ((glue->status == MUSB_ID_GROUND) ||
+                           (glue->status == MUSB_VBUS_VALID));
+
+        if (cable_connected)
+                omap2430_set_power(musb, glue->enabled, cable_connected);
 
         switch (glue->status) {
         case MUSB_ID_GROUND:
@@ -268,7 +223,6 @@ static void omap_musb_set_mailbox(struct omap2430_glue *glue)
                 musb->xceiv->otg->state = OTG_STATE_A_IDLE;
                 musb->xceiv->last_event = USB_EVENT_ID;
                 if (musb->gadget_driver) {
-                        pm_runtime_get_sync(dev);
                         omap_control_usb_set_mode(glue->control_otghs,
                                 USB_MODE_HOST);
                         omap2430_musb_set_vbus(musb, 1);
@@ -281,8 +235,6 @@ static void omap_musb_set_mailbox(struct omap2430_glue *glue)
                 otg->default_a = false;
                 musb->xceiv->otg->state = OTG_STATE_B_IDLE;
                 musb->xceiv->last_event = USB_EVENT_VBUS;
-                if (musb->gadget_driver)
-                        pm_runtime_get_sync(dev);
                 omap_control_usb_set_mode(glue->control_otghs, USB_MODE_DEVICE);
                 break;
 
@@ -291,11 +243,8 @@ static void omap_musb_set_mailbox(struct omap2430_glue *glue)
                 dev_dbg(dev, "VBUS Disconnect\n");
 
                 musb->xceiv->last_event = USB_EVENT_NONE;
-                if (musb->gadget_driver) {
+                if (musb->gadget_driver)
                         omap2430_musb_set_vbus(musb, 0);
-                        pm_runtime_mark_last_busy(dev);
-                        pm_runtime_put_autosuspend(dev);
-                }
 
                 if (data->interface_type == MUSB_INTERFACE_UTMI)
                         otg_set_vbus(musb->xceiv->otg, 0);
@@ -307,6 +256,9 @@ static void omap_musb_set_mailbox(struct omap2430_glue *glue)
                 dev_dbg(dev, "ID float\n");
         }
 
+        if (!cable_connected)
+                omap2430_set_power(musb, glue->enabled, cable_connected);
+
         atomic_notifier_call_chain(&musb->xceiv->notifier,
                         musb->xceiv->last_event, NULL);
 }
@@ -316,13 +268,8 @@ static void omap_musb_mailbox_work(struct work_struct *mailbox_work)
 {
         struct omap2430_glue *glue = container_of(mailbox_work,
                                 struct omap2430_glue, omap_musb_mailbox_work);
-        struct musb *musb = glue_to_musb(glue);
-        struct device *dev = musb->controller;
 
-        pm_runtime_get_sync(dev);
         omap_musb_set_mailbox(glue);
-        pm_runtime_mark_last_busy(dev);
-        pm_runtime_put_autosuspend(dev);
 }
 
 static irqreturn_t omap2430_musb_interrupt(int irq, void *__hci)
@@ -389,23 +336,7 @@ static int omap2430_musb_init(struct musb *musb)
                 return PTR_ERR(musb->phy);
         }
         musb->isr = omap2430_musb_interrupt;
-
-        /*
-         * Enable runtime PM for musb parent (this driver). We can't
-         * do it earlier as struct musb is not yet allocated and we
-         * need to touch the musb registers for runtime PM.
-         */
-        pm_runtime_enable(glue->dev);
-        status = pm_runtime_get_sync(glue->dev);
-        if (status < 0)
-                goto err1;
-
-        status = pm_runtime_get_sync(dev);
-        if (status < 0) {
-                dev_err(dev, "pm_runtime_get_sync FAILED %d\n", status);
-                pm_runtime_put_sync(glue->dev);
-                goto err1;
-        }
+        phy_init(musb->phy);
 
         l = musb_readl(musb->mregs, OTG_INTERFSEL);
 
@@ -427,20 +358,10 @@ static int omap2430_musb_init(struct musb *musb)
                         musb_readl(musb->mregs, OTG_INTERFSEL),
                         musb_readl(musb->mregs, OTG_SIMENABLE));
 
-        setup_timer(&musb_idle_timer, musb_do_idle, (unsigned long) musb);
-
         if (glue->status != MUSB_UNKNOWN)
                 omap_musb_set_mailbox(glue);
 
-        phy_init(musb->phy);
-        phy_power_on(musb->phy);
-
-        pm_runtime_put_noidle(musb->controller);
-        pm_runtime_put_noidle(glue->dev);
         return 0;
-
-err1:
-        return status;
 }
 
 static void omap2430_musb_enable(struct musb *musb)
@@ -452,6 +373,11 @@ static void omap2430_musb_enable(struct musb *musb)
         struct musb_hdrc_platform_data *pdata = dev_get_platdata(dev);
         struct omap_musb_board_data *data = pdata->board_data;
 
+        if (!WARN_ON(!musb->phy))
+                phy_power_on(musb->phy);
+
+        omap2430_set_power(musb, true, glue->cable_connected);
+
         switch (glue->status) {
 
         case MUSB_ID_GROUND:
@@ -487,18 +413,25 @@ static void omap2430_musb_disable(struct musb *musb)
         struct device *dev = musb->controller;
         struct omap2430_glue *glue = dev_get_drvdata(dev->parent);
 
+        if (!WARN_ON(!musb->phy))
+                phy_power_off(musb->phy);
+
         if (glue->status != MUSB_UNKNOWN)
                 omap_control_usb_set_mode(glue->control_otghs,
                         USB_MODE_DISCONNECT);
+
+        omap2430_set_power(musb, false, glue->cable_connected);
 }
 
 static int omap2430_musb_exit(struct musb *musb)
 {
-        del_timer_sync(&musb_idle_timer);
+        struct device *dev = musb->controller;
+        struct omap2430_glue *glue = dev_get_drvdata(dev->parent);
 
         omap2430_low_level_exit(musb);
-        phy_power_off(musb->phy);
         phy_exit(musb->phy);
+        musb->phy = NULL;
+        cancel_work_sync(&glue->omap_musb_mailbox_work);
 
         return 0;
 }
@@ -512,9 +445,6 @@ static const struct musb_platform_ops omap2430_ops = {
         .init           = omap2430_musb_init,
         .exit           = omap2430_musb_exit,
 
-        .set_mode       = omap2430_musb_set_mode,
-        .try_idle       = omap2430_musb_try_idle,
-
         .set_vbus       = omap2430_musb_set_vbus,
 
         .enable         = omap2430_musb_enable,
@@ -639,11 +569,9 @@ static int omap2430_probe(struct platform_device *pdev)
                 goto err2;
         }
 
-        /*
-         * Note that we cannot enable PM runtime yet for this
-         * driver as we need struct musb initialized first.
-         * See omap2430_musb_init above.
-         */
+        pm_runtime_enable(glue->dev);
+        pm_runtime_use_autosuspend(glue->dev);
+        pm_runtime_set_autosuspend_delay(glue->dev, 500);
 
         ret = platform_device_add(musb);
         if (ret) {
@@ -662,12 +590,14 @@ err0:
 
 static int omap2430_remove(struct platform_device *pdev)
 {
-        struct omap2430_glue            *glue = platform_get_drvdata(pdev);
+        struct omap2430_glue *glue = platform_get_drvdata(pdev);
+        struct musb *musb = glue_to_musb(glue);
 
         pm_runtime_get_sync(glue->dev);
-        cancel_work_sync(&glue->omap_musb_mailbox_work);
         platform_device_unregister(glue->musb);
+        omap2430_set_power(musb, false, false);
         pm_runtime_put_sync(glue->dev);
+        pm_runtime_dont_use_autosuspend(glue->dev);
         pm_runtime_disable(glue->dev);
 
         return 0;
@@ -680,12 +610,13 @@ static int omap2430_runtime_suspend(struct device *dev)
         struct omap2430_glue            *glue = dev_get_drvdata(dev);
         struct musb                     *musb = glue_to_musb(glue);
 
-        if (musb) {
-                musb->context.otg_interfsel = musb_readl(musb->mregs,
-                                OTG_INTERFSEL);
+        if (!musb)
+                return 0;
 
-                omap2430_low_level_exit(musb);
-        }
+        musb->context.otg_interfsel = musb_readl(musb->mregs,
+                                                 OTG_INTERFSEL);
+
+        omap2430_low_level_exit(musb);
 
         return 0;
 }
@@ -696,7 +627,7 @@ static int omap2430_runtime_resume(struct device *dev)
         struct musb                     *musb = glue_to_musb(glue);
 
         if (!musb)
-                return -EPROBE_DEFER;
+                return 0;
 
         omap2430_low_level_init(musb);
         musb_writel(musb->mregs, OTG_INTERFSEL,
@@ -738,18 +669,8 @@ static struct platform_driver omap2430_driver = {
         },
 };
 
+module_platform_driver(omap2430_driver);
+
 MODULE_DESCRIPTION("OMAP2PLUS MUSB Glue Layer");
 MODULE_AUTHOR("Felipe Balbi <balbi@ti.com>");
 MODULE_LICENSE("GPL v2");
-
-static int __init omap2430_init(void)
-{
-        return platform_driver_register(&omap2430_driver);
-}
-subsys_initcall(omap2430_init);
-
-static void __exit omap2430_exit(void)
-{
-        platform_driver_unregister(&omap2430_driver);
-}
-module_exit(omap2430_exit);
diff --git a/drivers/usb/musb/sunxi.c b/drivers/usb/musb/sunxi.c
index fdab4232cfbf..76500515dd8b 100644
--- a/drivers/usb/musb/sunxi.c
+++ b/drivers/usb/musb/sunxi.c
@@ -80,7 +80,8 @@ static struct musb *sunxi_musb;
 
 struct sunxi_glue {
         struct device           *dev;
-        struct platform_device  *musb;
+        struct musb             *musb;
+        struct platform_device  *musb_pdev;
         struct clk              *clk;
         struct reset_control    *rst;
         struct phy              *phy;
@@ -102,7 +103,7 @@ static void sunxi_musb_work(struct work_struct *work)
                 return;
 
         if (test_and_clear_bit(SUNXI_MUSB_FL_HOSTMODE_PEND, &glue->flags)) {
-                struct musb *musb = platform_get_drvdata(glue->musb);
+                struct musb *musb = glue->musb;
                 unsigned long flags;
                 u8 devctl;
 
@@ -112,7 +113,7 @@ static void sunxi_musb_work(struct work_struct *work)
                 if (test_bit(SUNXI_MUSB_FL_HOSTMODE, &glue->flags)) {
                         set_bit(SUNXI_MUSB_FL_VBUS_ON, &glue->flags);
                         musb->xceiv->otg->default_a = 1;
-                        musb->xceiv->otg->state = OTG_STATE_A_IDLE;
+                        musb->xceiv->otg->state = OTG_STATE_A_WAIT_VRISE;
                         MUSB_HST_MODE(musb);
                         devctl |= MUSB_DEVCTL_SESSION;
                 } else {
@@ -145,10 +146,12 @@ static void sunxi_musb_set_vbus(struct musb *musb, int is_on)
 {
         struct sunxi_glue *glue = dev_get_drvdata(musb->controller->parent);
 
-        if (is_on)
+        if (is_on) {
                 set_bit(SUNXI_MUSB_FL_VBUS_ON, &glue->flags);
-        else
+                musb->xceiv->otg->state = OTG_STATE_A_WAIT_VRISE;
+        } else {
                 clear_bit(SUNXI_MUSB_FL_VBUS_ON, &glue->flags);
+        }
 
         schedule_work(&glue->work);
 }
@@ -264,15 +267,6 @@ static int sunxi_musb_init(struct musb *musb)
         if (ret)
                 goto error_unregister_notifier;
 
-        if (musb->port_mode == MUSB_PORT_MODE_HOST) {
-                ret = phy_power_on(glue->phy);
-                if (ret)
-                        goto error_phy_exit;
-                set_bit(SUNXI_MUSB_FL_PHY_ON, &glue->flags);
-                /* Stop musb work from turning vbus off again */
-                set_bit(SUNXI_MUSB_FL_VBUS_ON, &glue->flags);
-        }
-
         musb->isr = sunxi_musb_interrupt;
 
         /* Stop the musb-core from doing runtime pm (not supported on sunxi) */
@@ -280,8 +274,6 @@ static int sunxi_musb_init(struct musb *musb)
 
         return 0;
 
-error_phy_exit:
-        phy_exit(glue->phy);
 error_unregister_notifier:
         if (musb->port_mode == MUSB_PORT_MODE_DUAL_ROLE)
                 extcon_unregister_notifier(glue->extcon, EXTCON_USB_HOST,
@@ -323,10 +315,31 @@ static int sunxi_musb_exit(struct musb *musb)
         return 0;
 }
 
+static int sunxi_set_mode(struct musb *musb, u8 mode)
+{
+        struct sunxi_glue *glue = dev_get_drvdata(musb->controller->parent);
+        int ret;
+
+        if (mode == MUSB_HOST) {
+                ret = phy_power_on(glue->phy);
+                if (ret)
+                        return ret;
+
+                set_bit(SUNXI_MUSB_FL_PHY_ON, &glue->flags);
+                /* Stop musb work from turning vbus off again */
+                set_bit(SUNXI_MUSB_FL_VBUS_ON, &glue->flags);
+                musb->xceiv->otg->state = OTG_STATE_A_WAIT_VRISE;
+        }
+
+        return 0;
+}
+
 static void sunxi_musb_enable(struct musb *musb)
 {
         struct sunxi_glue *glue = dev_get_drvdata(musb->controller->parent);
 
+        glue->musb = musb;
+
         /* musb_core does not call us in a balanced manner */
         if (test_and_set_bit(SUNXI_MUSB_FL_ENABLED, &glue->flags))
                 return;
@@ -569,6 +582,7 @@ static const struct musb_platform_ops sunxi_musb_ops = {
         .exit           = sunxi_musb_exit,
         .enable         = sunxi_musb_enable,
         .disable        = sunxi_musb_disable,
+        .set_mode       = sunxi_set_mode,
         .fifo_offset    = sunxi_musb_fifo_offset,
         .ep_offset      = sunxi_musb_ep_offset,
         .busctl_offset  = sunxi_musb_busctl_offset,
@@ -721,9 +735,9 @@ static int sunxi_musb_probe(struct platform_device *pdev)
         pinfo.data      = &pdata;
         pinfo.size_data = sizeof(pdata);
 
-        glue->musb = platform_device_register_full(&pinfo);
-        if (IS_ERR(glue->musb)) {
-                ret = PTR_ERR(glue->musb);
+        glue->musb_pdev = platform_device_register_full(&pinfo);
+        if (IS_ERR(glue->musb_pdev)) {
+                ret = PTR_ERR(glue->musb_pdev);
                 dev_err(&pdev->dev, "Error registering musb dev: %d\n", ret);
                 goto err_unregister_usb_phy;
         }
@@ -740,7 +754,7 @@ static int sunxi_musb_remove(struct platform_device *pdev)
         struct sunxi_glue *glue = platform_get_drvdata(pdev);
         struct platform_device *usb_phy = glue->usb_phy;
 
-        platform_device_unregister(glue->musb); /* Frees glue ! */
+        platform_device_unregister(glue->musb_pdev);
         usb_phy_generic_unregister(usb_phy);
 
         return 0;
diff --git a/drivers/usb/phy/phy-twl6030-usb.c b/drivers/usb/phy/phy-twl6030-usb.c
index 24e2b3cf1867..a72e8d670adc 100644
--- a/drivers/usb/phy/phy-twl6030-usb.c
+++ b/drivers/usb/phy/phy-twl6030-usb.c
@@ -97,6 +97,9 @@ struct twl6030_usb {
 
         struct regulator                *usb3v3;
 
+        /* used to check initial cable status after probe */
+        struct delayed_work     get_status_work;
+
         /* used to set vbus, in atomic path */
         struct work_struct      set_vbus_work;
 
@@ -227,12 +230,16 @@ static irqreturn_t twl6030_usb_irq(int irq, void *_twl)
                         twl->asleep = 1;
                         status = MUSB_VBUS_VALID;
                         twl->linkstat = status;
-                        musb_mailbox(status);
+                        ret = musb_mailbox(status);
+                        if (ret)
+                                twl->linkstat = MUSB_UNKNOWN;
                 } else {
                         if (twl->linkstat != MUSB_UNKNOWN) {
                                 status = MUSB_VBUS_OFF;
                                 twl->linkstat = status;
-                                musb_mailbox(status);
+                                ret = musb_mailbox(status);
+                                if (ret)
+                                        twl->linkstat = MUSB_UNKNOWN;
                                 if (twl->asleep) {
                                         regulator_disable(twl->usb3v3);
                                         twl->asleep = 0;
@@ -264,7 +271,9 @@ static irqreturn_t twl6030_usbotg_irq(int irq, void *_twl)
                 twl6030_writeb(twl, TWL_MODULE_USB, 0x10, USB_ID_INT_EN_HI_SET);
                 status = MUSB_ID_GROUND;
                 twl->linkstat = status;
-                musb_mailbox(status);
+                ret = musb_mailbox(status);
+                if (ret)
+                        twl->linkstat = MUSB_UNKNOWN;
         } else  {
                 twl6030_writeb(twl, TWL_MODULE_USB, 0x10, USB_ID_INT_EN_HI_CLR);
                 twl6030_writeb(twl, TWL_MODULE_USB, 0x1, USB_ID_INT_EN_HI_SET);
@@ -274,6 +283,15 @@ static irqreturn_t twl6030_usbotg_irq(int irq, void *_twl)
         return IRQ_HANDLED;
 }
 
+static void twl6030_status_work(struct work_struct *work)
+{
+        struct twl6030_usb *twl = container_of(work, struct twl6030_usb,
+                                               get_status_work.work);
+
+        twl6030_usb_irq(twl->irq2, twl);
+        twl6030_usbotg_irq(twl->irq1, twl);
+}
+
 static int twl6030_enable_irq(struct twl6030_usb *twl)
 {
         twl6030_writeb(twl, TWL_MODULE_USB, 0x1, USB_ID_INT_EN_HI_SET);
@@ -284,8 +302,6 @@ static int twl6030_enable_irq(struct twl6030_usb *twl)
                                 REG_INT_MSK_LINE_C);
         twl6030_interrupt_unmask(TWL6030_CHARGER_CTRL_INT_MASK,
                                 REG_INT_MSK_STS_C);
-        twl6030_usb_irq(twl->irq2, twl);
-        twl6030_usbotg_irq(twl->irq1, twl);
 
         return 0;
 }
@@ -371,6 +387,7 @@ static int twl6030_usb_probe(struct platform_device *pdev)
                 dev_warn(&pdev->dev, "could not create sysfs file\n");
 
         INIT_WORK(&twl->set_vbus_work, otg_set_vbus_work);
+        INIT_DELAYED_WORK(&twl->get_status_work, twl6030_status_work);
 
         status = request_threaded_irq(twl->irq1, NULL, twl6030_usbotg_irq,
                         IRQF_TRIGGER_FALLING | IRQF_TRIGGER_RISING | IRQF_ONESHOT,
@@ -395,6 +412,7 @@ static int twl6030_usb_probe(struct platform_device *pdev)
 
         twl->asleep = 0;
         twl6030_enable_irq(twl);
+        schedule_delayed_work(&twl->get_status_work, HZ);
         dev_info(&pdev->dev, "Initialized TWL6030 USB module\n");
 
         return 0;
@@ -404,6 +422,7 @@ static int twl6030_usb_remove(struct platform_device *pdev)
 {
         struct twl6030_usb *twl = platform_get_drvdata(pdev);
 
+        cancel_delayed_work(&twl->get_status_work);
         twl6030_interrupt_mask(TWL6030_USBOTG_INT_MASK,
                 REG_INT_MSK_LINE_C);
         twl6030_interrupt_mask(TWL6030_USBOTG_INT_MASK,
diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
index 2eddbe538cda..5608af4a369d 100644
--- a/drivers/usb/serial/mos7720.c
+++ b/drivers/usb/serial/mos7720.c
@@ -2007,6 +2007,7 @@ static void mos7720_release(struct usb_serial *serial)
                                     urblist_entry)
                         usb_unlink_urb(urbtrack->urb);
                 spin_unlock_irqrestore(&mos_parport->listlock, flags);
+                parport_del_port(mos_parport->pp);
 
                 kref_put(&mos_parport->ref_count, destroy_mos_parport);
         }
diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c
index 4d49fce406e1..5ef014ba6ae8 100644
--- a/drivers/usb/storage/uas.c
+++ b/drivers/usb/storage/uas.c
@@ -836,6 +836,7 @@ static int uas_slave_configure(struct scsi_device *sdev)
         if (devinfo->flags & US_FL_BROKEN_FUA)
                 sdev->broken_fua = 1;
 
+        scsi_change_queue_depth(sdev, devinfo->qdepth - 2);
         return 0;
 }
 
@@ -848,7 +849,6 @@ static struct scsi_host_template uas_host_template = {
         .slave_configure = uas_slave_configure,
         .eh_abort_handler = uas_eh_abort_handler,
         .eh_bus_reset_handler = uas_eh_bus_reset_handler,
-        .can_queue = MAX_CMNDS,
         .this_id = -1,
         .sg_tablesize = SG_NONE,
         .skip_settle_delay = 1,
diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
index fca51105974e..2e0450bec1b1 100644
--- a/drivers/usb/usbip/vhci_hcd.c
+++ b/drivers/usb/usbip/vhci_hcd.c
@@ -941,7 +941,7 @@ static void vhci_stop(struct usb_hcd *hcd)
 
 static int vhci_get_frame_number(struct usb_hcd *hcd)
 {
-        pr_err("Not yet implemented\n");
+        dev_err_ratelimited(&hcd->self.root_hub->dev, "Not yet implemented\n");
         return 0;
 }
 
diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index b54f26c55dfd..b4b3e256491b 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -746,7 +746,7 @@ config ALIM7101_WDT
 
 config EBC_C384_WDT
         tristate "WinSystems EBC-C384 Watchdog Timer"
-        depends on X86 && ISA
+        depends on X86 && ISA_BUS_API
         select WATCHDOG_CORE
         help
           Enables watchdog timer support for the watchdog timer on the
diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index d46839f51e73..e4db19e88ab1 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -151,8 +151,6 @@ static DECLARE_WAIT_QUEUE_HEAD(balloon_wq);
 static void balloon_process(struct work_struct *work);
 static DECLARE_DELAYED_WORK(balloon_worker, balloon_process);
 
-static void release_memory_resource(struct resource *resource);
-
 /* When ballooning out (allocating memory to return to Xen) we don't really
    want the kernel to try too hard since that can trigger the oom killer. */
 #define GFP_BALLOON \
@@ -248,6 +246,19 @@ static enum bp_state update_schedule(enum bp_state state)
 }
 
 #ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG
+static void release_memory_resource(struct resource *resource)
+{
+        if (!resource)
+                return;
+
+        /*
+         * No need to reset region to identity mapped since we now
+         * know that no I/O can be in this region
+         */
+        release_resource(resource);
+        kfree(resource);
+}
+
 static struct resource *additional_memory_resource(phys_addr_t size)
 {
         struct resource *res;
@@ -286,19 +297,6 @@ static struct resource *additional_memory_resource(phys_addr_t size)
         return res;
 }
 
-static void release_memory_resource(struct resource *resource)
-{
-        if (!resource)
-                return;
-
-        /*
-         * No need to reset region to identity mapped since we now
-         * know that no I/O can be in this region
-         */
-        release_resource(resource);
-        kfree(resource);
-}
-
 static enum bp_state reserve_additional_memory(void)
 {
         long credit;
diff --git a/drivers/xen/xen-pciback/conf_space.c b/drivers/xen/xen-pciback/conf_space.c
index 8e67336f8ddd..6a25533da237 100644
--- a/drivers/xen/xen-pciback/conf_space.c
+++ b/drivers/xen/xen-pciback/conf_space.c
@@ -183,8 +183,7 @@ int xen_pcibk_config_read(struct pci_dev *dev, int offset, int size,
                 field_start = OFFSET(cfg_entry);
                 field_end = OFFSET(cfg_entry) + field->size;
 
-                if ((req_start >= field_start && req_start < field_end)
-                    || (req_end > field_start && req_end <= field_end)) {
+                 if (req_end > field_start && field_end > req_start) {
                         err = conf_space_read(dev, cfg_entry, field_start,
                                               &tmp_val);
                         if (err)
@@ -230,8 +229,7 @@ int xen_pcibk_config_write(struct pci_dev *dev, int offset, int size, u32 value)
                 field_start = OFFSET(cfg_entry);
                 field_end = OFFSET(cfg_entry) + field->size;
 
-                if ((req_start >= field_start && req_start < field_end)
-                    || (req_end > field_start && req_end <= field_end)) {
+                 if (req_end > field_start && field_end > req_start) {
                         tmp_val = 0;
 
                         err = xen_pcibk_config_read(dev, field_start,
diff --git a/drivers/xen/xen-pciback/conf_space_header.c b/drivers/xen/xen-pciback/conf_space_header.c
index ad3d17d29c81..9ead1c2ff1dd 100644
--- a/drivers/xen/xen-pciback/conf_space_header.c
+++ b/drivers/xen/xen-pciback/conf_space_header.c
@@ -145,7 +145,7 @@ static int rom_write(struct pci_dev *dev, int offset, u32 value, void *data)
         /* A write to obtain the length must happen as a 32-bit write.
          * This does not (yet) support writing individual bytes
          */
-        if (value == ~PCI_ROM_ADDRESS_ENABLE)
+        if ((value | ~PCI_ROM_ADDRESS_MASK) == ~0U)
                 bar->which = 1;
         else {
                 u32 tmpval;
@@ -225,38 +225,42 @@ static inline void read_dev_bar(struct pci_dev *dev,
                            (PCI_BASE_ADDRESS_SPACE_MEMORY |
                                 PCI_BASE_ADDRESS_MEM_TYPE_64))) {
                         bar_info->val = res[pos - 1].start >> 32;
-                        bar_info->len_val = res[pos - 1].end >> 32;
+                        bar_info->len_val = -resource_size(&res[pos - 1]) >> 32;
                         return;
                 }
         }
 
+        if (!res[pos].flags ||
+            (res[pos].flags & (IORESOURCE_DISABLED | IORESOURCE_UNSET |
+                               IORESOURCE_BUSY)))
+                return;
+
         bar_info->val = res[pos].start |
                         (res[pos].flags & PCI_REGION_FLAG_MASK);
-        bar_info->len_val = resource_size(&res[pos]);
+        bar_info->len_val = -resource_size(&res[pos]) |
+                            (res[pos].flags & PCI_REGION_FLAG_MASK);
 }
 
 static void *bar_init(struct pci_dev *dev, int offset)
 {
-        struct pci_bar_info *bar = kmalloc(sizeof(*bar), GFP_KERNEL);
+        struct pci_bar_info *bar = kzalloc(sizeof(*bar), GFP_KERNEL);
 
         if (!bar)
                 return ERR_PTR(-ENOMEM);
 
         read_dev_bar(dev, bar, offset, ~0);
-        bar->which = 0;
 
         return bar;
 }
 
 static void *rom_init(struct pci_dev *dev, int offset)
 {
-        struct pci_bar_info *bar = kmalloc(sizeof(*bar), GFP_KERNEL);
+        struct pci_bar_info *bar = kzalloc(sizeof(*bar), GFP_KERNEL);
 
         if (!bar)
                 return ERR_PTR(-ENOMEM);
 
         read_dev_bar(dev, bar, offset, ~PCI_ROM_ADDRESS_ENABLE);
-        bar->which = 0;
 
         return bar;
 }
diff --git a/fs/9p/vfs_file.c b/fs/9p/vfs_file.c
index b84c291ba1eb..d7b78d531e63 100644
--- a/fs/9p/vfs_file.c
+++ b/fs/9p/vfs_file.c
@@ -74,7 +74,7 @@ int v9fs_file_open(struct inode *inode, struct file *file)
                                         v9fs_proto_dotu(v9ses));
         fid = file->private_data;
         if (!fid) {
-                fid = v9fs_fid_clone(file->f_path.dentry);
+                fid = v9fs_fid_clone(file_dentry(file));
                 if (IS_ERR(fid))
                         return PTR_ERR(fid);
 
@@ -100,7 +100,7 @@ int v9fs_file_open(struct inode *inode, struct file *file)
                  * because we want write after unlink usecase
                  * to work.
                  */
-                fid = v9fs_writeback_fid(file->f_path.dentry);
+                fid = v9fs_writeback_fid(file_dentry(file));
                 if (IS_ERR(fid)) {
                         err = PTR_ERR(fid);
                         mutex_unlock(&v9inode->v_mutex);
@@ -516,7 +516,7 @@ v9fs_mmap_file_mmap(struct file *filp, struct vm_area_struct *vma)
                  * because we want write after unlink usecase
                  * to work.
                  */
-                fid = v9fs_writeback_fid(filp->f_path.dentry);
+                fid = v9fs_writeback_fid(file_dentry(filp));
                 if (IS_ERR(fid)) {
                         retval = PTR_ERR(fid);
                         mutex_unlock(&v9inode->v_mutex);
diff --git a/fs/autofs4/autofs_i.h b/fs/autofs4/autofs_i.h
index f0d268b97d19..a439548de785 100644
--- a/fs/autofs4/autofs_i.h
+++ b/fs/autofs4/autofs_i.h
@@ -70,9 +70,13 @@ struct autofs_info {
 };
 
 #define AUTOFS_INF_EXPIRING     (1<<0) /* dentry in the process of expiring */
-#define AUTOFS_INF_NO_RCU       (1<<1) /* the dentry is being considered
+#define AUTOFS_INF_WANT_EXPIRE  (1<<1) /* the dentry is being considered
                                         * for expiry, so RCU_walk is
-                                        * not permitted
+                                        * not permitted.  If it progresses to
+                                        * actual expiry attempt, the flag is
+                                        * not cleared when EXPIRING is set -
+                                        * in that case it gets cleared only
+                                        * when it comes to clearing EXPIRING.
                                         */
 #define AUTOFS_INF_PENDING      (1<<2) /* dentry pending mount */
 
diff --git a/fs/autofs4/expire.c b/fs/autofs4/expire.c
index 9510d8d2e9cd..b493909e7492 100644
--- a/fs/autofs4/expire.c
+++ b/fs/autofs4/expire.c
@@ -316,19 +316,17 @@ struct dentry *autofs4_expire_direct(struct super_block *sb,
         if (ino->flags & AUTOFS_INF_PENDING)
                 goto out;
         if (!autofs4_direct_busy(mnt, root, timeout, do_now)) {
-                ino->flags |= AUTOFS_INF_NO_RCU;
+                ino->flags |= AUTOFS_INF_WANT_EXPIRE;
                 spin_unlock(&sbi->fs_lock);
                 synchronize_rcu();
                 spin_lock(&sbi->fs_lock);
                 if (!autofs4_direct_busy(mnt, root, timeout, do_now)) {
                         ino->flags |= AUTOFS_INF_EXPIRING;
-                        smp_mb();
-                        ino->flags &= ~AUTOFS_INF_NO_RCU;
                         init_completion(&ino->expire_complete);
                         spin_unlock(&sbi->fs_lock);
                         return root;
                 }
-                ino->flags &= ~AUTOFS_INF_NO_RCU;
+                ino->flags &= ~AUTOFS_INF_WANT_EXPIRE;
         }
 out:
         spin_unlock(&sbi->fs_lock);
@@ -446,7 +444,7 @@ struct dentry *autofs4_expire_indirect(struct super_block *sb,
         while ((dentry = get_next_positive_subdir(dentry, root))) {
                 spin_lock(&sbi->fs_lock);
                 ino = autofs4_dentry_ino(dentry);
-                if (ino->flags & AUTOFS_INF_NO_RCU)
+                if (ino->flags & AUTOFS_INF_WANT_EXPIRE)
                         expired = NULL;
                 else
                         expired = should_expire(dentry, mnt, timeout, how);
@@ -455,7 +453,7 @@ struct dentry *autofs4_expire_indirect(struct super_block *sb,
                         continue;
                 }
                 ino = autofs4_dentry_ino(expired);
-                ino->flags |= AUTOFS_INF_NO_RCU;
+                ino->flags |= AUTOFS_INF_WANT_EXPIRE;
                 spin_unlock(&sbi->fs_lock);
                 synchronize_rcu();
                 spin_lock(&sbi->fs_lock);
@@ -465,7 +463,7 @@ struct dentry *autofs4_expire_indirect(struct super_block *sb,
                         goto found;
                 }
 
-                ino->flags &= ~AUTOFS_INF_NO_RCU;
+                ino->flags &= ~AUTOFS_INF_WANT_EXPIRE;
                 if (expired != dentry)
                         dput(expired);
                 spin_unlock(&sbi->fs_lock);
@@ -475,17 +473,8 @@ struct dentry *autofs4_expire_indirect(struct super_block *sb,
 found:
         pr_debug("returning %p %pd\n", expired, expired);
         ino->flags |= AUTOFS_INF_EXPIRING;
-        smp_mb();
-        ino->flags &= ~AUTOFS_INF_NO_RCU;
         init_completion(&ino->expire_complete);
         spin_unlock(&sbi->fs_lock);
-        spin_lock(&sbi->lookup_lock);
-        spin_lock(&expired->d_parent->d_lock);
-        spin_lock_nested(&expired->d_lock, DENTRY_D_LOCK_NESTED);
-        list_move(&expired->d_parent->d_subdirs, &expired->d_child);
-        spin_unlock(&expired->d_lock);
-        spin_unlock(&expired->d_parent->d_lock);
-        spin_unlock(&sbi->lookup_lock);
         return expired;
 }
 
@@ -496,7 +485,7 @@ int autofs4_expire_wait(struct dentry *dentry, int rcu_walk)
         int status;
 
         /* Block on any pending expire */
-        if (!(ino->flags & (AUTOFS_INF_EXPIRING | AUTOFS_INF_NO_RCU)))
+        if (!(ino->flags & AUTOFS_INF_WANT_EXPIRE))
                 return 0;
         if (rcu_walk)
                 return -ECHILD;
@@ -554,7 +543,7 @@ int autofs4_expire_run(struct super_block *sb,
         ino = autofs4_dentry_ino(dentry);
         /* avoid rapid-fire expire attempts if expiry fails */
         ino->last_used = now;
-        ino->flags &= ~AUTOFS_INF_EXPIRING;
+        ino->flags &= ~(AUTOFS_INF_EXPIRING|AUTOFS_INF_WANT_EXPIRE);
         complete_all(&ino->expire_complete);
         spin_unlock(&sbi->fs_lock);
 
@@ -583,7 +572,7 @@ int autofs4_do_expire_multi(struct super_block *sb, struct vfsmount *mnt,
                 spin_lock(&sbi->fs_lock);
                 /* avoid rapid-fire expire attempts if expiry fails */
                 ino->last_used = now;
-                ino->flags &= ~AUTOFS_INF_EXPIRING;
+                ino->flags &= ~(AUTOFS_INF_EXPIRING|AUTOFS_INF_WANT_EXPIRE);
                 complete_all(&ino->expire_complete);
                 spin_unlock(&sbi->fs_lock);
                 dput(dentry);
diff --git a/fs/autofs4/root.c b/fs/autofs4/root.c
index 78bd80298528..3767f6641af1 100644
--- a/fs/autofs4/root.c
+++ b/fs/autofs4/root.c
@@ -458,7 +458,7 @@ static int autofs4_d_manage(struct dentry *dentry, bool rcu_walk)
                  */
                 struct inode *inode;
 
-                if (ino->flags & (AUTOFS_INF_EXPIRING | AUTOFS_INF_NO_RCU))
+                if (ino->flags & AUTOFS_INF_WANT_EXPIRE)
                         return 0;
                 if (d_mountpoint(dentry))
                         return 0;
diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c
index 0146d911f468..631f1554c87b 100644
--- a/fs/autofs4/waitq.c
+++ b/fs/autofs4/waitq.c
@@ -66,11 +66,12 @@ static int autofs4_write(struct autofs_sb_info *sbi,
         set_fs(KERNEL_DS);
 
         mutex_lock(&sbi->pipe_mutex);
-        wr = __vfs_write(file, data, bytes, &file->f_pos);
-        while (bytes && wr) {
+        while (bytes) {
+                wr = __vfs_write(file, data, bytes, &file->f_pos);
+                if (wr <= 0)
+                        break;
                 data += wr;
                 bytes -= wr;
-                wr = __vfs_write(file, data, bytes, &file->f_pos);
         }
         mutex_unlock(&sbi->pipe_mutex);
 
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index e158b22ef32f..a7a28110dc80 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -2275,7 +2275,7 @@ static int elf_core_dump(struct coredump_params *cprm)
                 goto end_coredump;
 
         /* Align to page */
-        if (!dump_skip(cprm, dataoff - cprm->file->f_pos))
+        if (!dump_skip(cprm, dataoff - cprm->pos))
                 goto end_coredump;
 
         for (i = 0, vma = first_vma(current, gate_vma); vma != NULL;
diff --git a/fs/binfmt_elf_fdpic.c b/fs/binfmt_elf_fdpic.c
index 71ade0e556b7..203589311bf8 100644
--- a/fs/binfmt_elf_fdpic.c
+++ b/fs/binfmt_elf_fdpic.c
@@ -1787,7 +1787,7 @@ static int elf_fdpic_core_dump(struct coredump_params *cprm)
                                 goto end_coredump;
         }
 
-        if (!dump_skip(cprm, dataoff - cprm->file->f_pos))
+        if (!dump_skip(cprm, dataoff - cprm->pos))
                 goto end_coredump;
 
         if (!elf_fdpic_dump_segments(cprm))
diff --git a/fs/btrfs/check-integrity.c b/fs/btrfs/check-integrity.c
index b677a6ea6001..7706c8dc5fa6 100644
--- a/fs/btrfs/check-integrity.c
+++ b/fs/btrfs/check-integrity.c
@@ -2645,7 +2645,7 @@ static void btrfsic_dump_tree_sub(const struct btrfsic_state *state,
          * This algorithm is recursive because the amount of used stack space
          * is very small and the max recursion depth is limited.
          */
-        indent_add = sprintf(buf, "%c-%llu(%s/%llu/%d)",
+        indent_add = sprintf(buf, "%c-%llu(%s/%llu/%u)",
                              btrfsic_get_block_type(state, block),
                              block->logical_bytenr, block->dev_state->name,
                              block->dev_bytenr, block->mirror_num);
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index 427c36b430a6..a85cf7d23309 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -1373,7 +1373,8 @@ tree_mod_log_rewind(struct btrfs_fs_info *fs_info, struct btrfs_path *path,
 
         if (tm->op == MOD_LOG_KEY_REMOVE_WHILE_FREEING) {
                 BUG_ON(tm->slot != 0);
-                eb_rewin = alloc_dummy_extent_buffer(fs_info, eb->start);
+                eb_rewin = alloc_dummy_extent_buffer(fs_info, eb->start,
+                                                eb->len);
                 if (!eb_rewin) {
                         btrfs_tree_read_unlock_blocking(eb);
                         free_extent_buffer(eb);
@@ -1454,7 +1455,8 @@ get_old_root(struct btrfs_root *root, u64 time_seq)
         } else if (old_root) {
                 btrfs_tree_read_unlock(eb_root);
                 free_extent_buffer(eb_root);
-                eb = alloc_dummy_extent_buffer(root->fs_info, logical);
+                eb = alloc_dummy_extent_buffer(root->fs_info, logical,
+                                        root->nodesize);
         } else {
                 btrfs_set_lock_blocking_rw(eb_root, BTRFS_READ_LOCK);
                 eb = btrfs_clone_extent_buffer(eb_root);
@@ -1552,6 +1554,7 @@ noinline int btrfs_cow_block(struct btrfs_trans_handle *trans,
                        trans->transid, root->fs_info->generation);
 
         if (!should_cow_block(trans, root, buf)) {
+                trans->dirty = true;
                 *cow_ret = buf;
                 return 0;
         }
@@ -1783,10 +1786,12 @@ static noinline int generic_bin_search(struct extent_buffer *eb,
                         if (!err) {
                                 tmp = (struct btrfs_disk_key *)(kaddr + offset -
                                                         map_start);
-                        } else {
+                        } else if (err == 1) {
                                 read_extent_buffer(eb, &unaligned,
                                                    offset, sizeof(unaligned));
                                 tmp = &unaligned;
+                        } else {
+                                return err;
                         }
 
                 } else {
@@ -2510,6 +2515,8 @@ read_block_for_search(struct btrfs_trans_handle *trans,
                 if (!btrfs_buffer_uptodate(tmp, 0, 0))
                         ret = -EIO;
                 free_extent_buffer(tmp);
+        } else {
+                ret = PTR_ERR(tmp);
         }
         return ret;
 }
@@ -2773,8 +2780,10 @@ again:
                          * then we don't want to set the path blocking,
                          * so we test it here
                          */
-                        if (!should_cow_block(trans, root, b))
+                        if (!should_cow_block(trans, root, b)) {
+                                trans->dirty = true;
                                 goto cow_done;
+                        }
 
                         /*
                          * must have write locks on this node and the
@@ -2823,6 +2832,8 @@ cow_done:
                 }
 
                 ret = key_search(b, key, level, &prev_cmp, &slot);
+                if (ret < 0)
+                        goto done;
 
                 if (level != 0) {
                         int dec = 0;
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 101c3cfd3f7c..4274a7bfdaed 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -2518,7 +2518,7 @@ void btrfs_put_block_group(struct btrfs_block_group_cache *cache);
 int btrfs_run_delayed_refs(struct btrfs_trans_handle *trans,
                            struct btrfs_root *root, unsigned long count);
 int btrfs_async_run_delayed_refs(struct btrfs_root *root,
-                                 unsigned long count, int wait);
+                                 unsigned long count, u64 transid, int wait);
 int btrfs_lookup_data_extent(struct btrfs_root *root, u64 start, u64 len);
 int btrfs_lookup_extent_info(struct btrfs_trans_handle *trans,
                              struct btrfs_root *root, u64 bytenr,
diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c
index 61561c2a3f96..d3aaabbfada0 100644
--- a/fs/btrfs/delayed-inode.c
+++ b/fs/btrfs/delayed-inode.c
@@ -1606,15 +1606,23 @@ int btrfs_inode_delayed_dir_index_count(struct inode *inode)
         return 0;
 }
 
-void btrfs_get_delayed_items(struct inode *inode, struct list_head *ins_list,
-                             struct list_head *del_list)
+bool btrfs_readdir_get_delayed_items(struct inode *inode,
+                                     struct list_head *ins_list,
+                                     struct list_head *del_list)
 {
         struct btrfs_delayed_node *delayed_node;
         struct btrfs_delayed_item *item;
 
         delayed_node = btrfs_get_delayed_node(inode);
         if (!delayed_node)
-                return;
+                return false;
+
+        /*
+         * We can only do one readdir with delayed items at a time because of
+         * item->readdir_list.
+         */
+        inode_unlock_shared(inode);
+        inode_lock(inode);
 
         mutex_lock(&delayed_node->mutex);
         item = __btrfs_first_delayed_insertion_item(delayed_node);
@@ -1641,10 +1649,13 @@ void btrfs_get_delayed_items(struct inode *inode, struct list_head *ins_list,
          * requeue or dequeue this delayed node.
          */
         atomic_dec(&delayed_node->refs);
+
+        return true;
 }
 
-void btrfs_put_delayed_items(struct list_head *ins_list,
-                             struct list_head *del_list)
+void btrfs_readdir_put_delayed_items(struct inode *inode,
+                                     struct list_head *ins_list,
+                                     struct list_head *del_list)
 {
         struct btrfs_delayed_item *curr, *next;
 
@@ -1659,6 +1670,12 @@ void btrfs_put_delayed_items(struct list_head *ins_list,
                 if (atomic_dec_and_test(&curr->refs))
                         kfree(curr);
         }
+
+        /*
+         * The VFS is going to do up_read(), so we need to downgrade back to a
+         * read lock.
+         */
+        downgrade_write(&inode->i_rwsem);
 }
 
 int btrfs_should_delete_dir_index(struct list_head *del_list,
diff --git a/fs/btrfs/delayed-inode.h b/fs/btrfs/delayed-inode.h
index 0167853c84ae..2495b3d4075f 100644
--- a/fs/btrfs/delayed-inode.h
+++ b/fs/btrfs/delayed-inode.h
@@ -137,10 +137,12 @@ void btrfs_kill_all_delayed_nodes(struct btrfs_root *root);
 void btrfs_destroy_delayed_inodes(struct btrfs_root *root);
 
 /* Used for readdir() */
-void btrfs_get_delayed_items(struct inode *inode, struct list_head *ins_list,
-                             struct list_head *del_list);
-void btrfs_put_delayed_items(struct list_head *ins_list,
-                             struct list_head *del_list);
+bool btrfs_readdir_get_delayed_items(struct inode *inode,
+                                     struct list_head *ins_list,
+                                     struct list_head *del_list);
+void btrfs_readdir_put_delayed_items(struct inode *inode,
+                                     struct list_head *ins_list,
+                                     struct list_head *del_list);
 int btrfs_should_delete_dir_index(struct list_head *del_list,
                                   u64 index);
 int btrfs_readdir_delayed_dir_index(struct dir_context *ctx,
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 6628fca9f4ed..60ce1190307b 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -1098,7 +1098,7 @@ void readahead_tree_block(struct btrfs_root *root, u64 bytenr)
         struct inode *btree_inode = root->fs_info->btree_inode;
 
         buf = btrfs_find_create_tree_block(root, bytenr);
-        if (!buf)
+        if (IS_ERR(buf))
                 return;
         read_extent_buffer_pages(&BTRFS_I(btree_inode)->io_tree,
                                  buf, 0, WAIT_NONE, btree_get_extent, 0);
@@ -1114,7 +1114,7 @@ int reada_tree_block_flagged(struct btrfs_root *root, u64 bytenr,
         int ret;
 
         buf = btrfs_find_create_tree_block(root, bytenr);
-        if (!buf)
+        if (IS_ERR(buf))
                 return 0;
 
         set_bit(EXTENT_BUFFER_READAHEAD, &buf->bflags);
@@ -1147,7 +1147,8 @@ struct extent_buffer *btrfs_find_create_tree_block(struct btrfs_root *root,
                                                  u64 bytenr)
 {
         if (btrfs_test_is_dummy_root(root))
-                return alloc_test_extent_buffer(root->fs_info, bytenr);
+                return alloc_test_extent_buffer(root->fs_info, bytenr,
+                                root->nodesize);
         return alloc_extent_buffer(root->fs_info, bytenr);
 }
 
@@ -1171,8 +1172,8 @@ struct extent_buffer *read_tree_block(struct btrfs_root *root, u64 bytenr,
         int ret;
 
         buf = btrfs_find_create_tree_block(root, bytenr);
-        if (!buf)
-                return ERR_PTR(-ENOMEM);
+        if (IS_ERR(buf))
+                return buf;
 
         ret = btree_read_extent_buffer_pages(root, buf, 0, parent_transid);
         if (ret) {
@@ -1314,14 +1315,16 @@ static struct btrfs_root *btrfs_alloc_root(struct btrfs_fs_info *fs_info,
 
 #ifdef CONFIG_BTRFS_FS_RUN_SANITY_TESTS
 /* Should only be used by the testing infrastructure */
-struct btrfs_root *btrfs_alloc_dummy_root(void)
+struct btrfs_root *btrfs_alloc_dummy_root(u32 sectorsize, u32 nodesize)
 {
         struct btrfs_root *root;
 
         root = btrfs_alloc_root(NULL, GFP_KERNEL);
         if (!root)
                 return ERR_PTR(-ENOMEM);
-        __setup_root(4096, 4096, 4096, root, NULL, 1);
+        /* We don't use the stripesize in selftest, set it as sectorsize */
+        __setup_root(nodesize, sectorsize, sectorsize, root, NULL,
+                        BTRFS_ROOT_TREE_OBJECTID);
         set_bit(BTRFS_ROOT_DUMMY_ROOT, &root->state);
         root->alloc_bytenr = 0;
 
@@ -1803,6 +1806,13 @@ static int cleaner_kthread(void *arg)
                 if (btrfs_need_cleaner_sleep(root))
                         goto sleep;
 
+                /*
+                 * Do not do anything if we might cause open_ctree() to block
+                 * before we have finished mounting the filesystem.
+                 */
+                if (!root->fs_info->open)
+                        goto sleep;
+
                 if (!mutex_trylock(&root->fs_info->cleaner_mutex))
                         goto sleep;
 
@@ -2517,7 +2527,6 @@ int open_ctree(struct super_block *sb,
         int num_backups_tried = 0;
         int backup_index = 0;
         int max_active;
-        bool cleaner_mutex_locked = false;
 
         tree_root = fs_info->tree_root = btrfs_alloc_root(fs_info, GFP_KERNEL);
         chunk_root = fs_info->chunk_root = btrfs_alloc_root(fs_info, GFP_KERNEL);
@@ -2797,7 +2806,7 @@ int open_ctree(struct super_block *sb,
 
         nodesize = btrfs_super_nodesize(disk_super);
         sectorsize = btrfs_super_sectorsize(disk_super);
-        stripesize = btrfs_super_stripesize(disk_super);
+        stripesize = sectorsize;
         fs_info->dirty_metadata_batch = nodesize * (1 + ilog2(nr_cpu_ids));
         fs_info->delalloc_batch = sectorsize * 512 * (1 + ilog2(nr_cpu_ids));
 
@@ -2996,13 +3005,6 @@ retry_root_backup:
                 goto fail_sysfs;
         }
 
-        /*
-         * Hold the cleaner_mutex thread here so that we don't block
-         * for a long time on btrfs_recover_relocation.  cleaner_kthread
-         * will wait for us to finish mounting the filesystem.
-         */
-        mutex_lock(&fs_info->cleaner_mutex);
-        cleaner_mutex_locked = true;
         fs_info->cleaner_kthread = kthread_run(cleaner_kthread, tree_root,
                                                "btrfs-cleaner");
         if (IS_ERR(fs_info->cleaner_kthread))
@@ -3062,8 +3064,10 @@ retry_root_backup:
                 ret = btrfs_cleanup_fs_roots(fs_info);
                 if (ret)
                         goto fail_qgroup;
-                /* We locked cleaner_mutex before creating cleaner_kthread. */
+
+                mutex_lock(&fs_info->cleaner_mutex);
                 ret = btrfs_recover_relocation(tree_root);
+                mutex_unlock(&fs_info->cleaner_mutex);
                 if (ret < 0) {
                         btrfs_warn(fs_info, "failed to recover relocation: %d",
                                         ret);
@@ -3071,8 +3075,6 @@ retry_root_backup:
                         goto fail_qgroup;
                 }
         }
-        mutex_unlock(&fs_info->cleaner_mutex);
-        cleaner_mutex_locked = false;
 
         location.objectid = BTRFS_FS_TREE_OBJECTID;
         location.type = BTRFS_ROOT_ITEM_KEY;
@@ -3186,10 +3188,6 @@ fail_cleaner:
         filemap_write_and_wait(fs_info->btree_inode->i_mapping);
 
 fail_sysfs:
-        if (cleaner_mutex_locked) {
-                mutex_unlock(&fs_info->cleaner_mutex);
-                cleaner_mutex_locked = false;
-        }
         btrfs_sysfs_remove_mounted(fs_info);
 
 fail_fsdev_sysfs:
@@ -4130,6 +4128,16 @@ static int btrfs_check_super_valid(struct btrfs_fs_info *fs_info,
          * Hint to catch really bogus numbers, bitflips or so, more exact checks are
          * done later
          */
+        if (btrfs_super_bytes_used(sb) < 6 * btrfs_super_nodesize(sb)) {
+                btrfs_err(fs_info, "bytes_used is too small %llu",
+                       btrfs_super_bytes_used(sb));
+                ret = -EINVAL;
+        }
+        if (!is_power_of_2(btrfs_super_stripesize(sb))) {
+                btrfs_err(fs_info, "invalid stripesize %u",
+                       btrfs_super_stripesize(sb));
+                ret = -EINVAL;
+        }
         if (btrfs_super_num_devices(sb) > (1UL << 31))
                 printk(KERN_WARNING "BTRFS: suspicious number of devices: %llu\n",
                                 btrfs_super_num_devices(sb));
diff --git a/fs/btrfs/disk-io.h b/fs/btrfs/disk-io.h
index 8e79d0070bcf..acba821499a9 100644
--- a/fs/btrfs/disk-io.h
+++ b/fs/btrfs/disk-io.h
@@ -90,7 +90,7 @@ void btrfs_drop_and_free_fs_root(struct btrfs_fs_info *fs_info,
 void btrfs_free_fs_root(struct btrfs_root *root);
 
 #ifdef CONFIG_BTRFS_FS_RUN_SANITY_TESTS
-struct btrfs_root *btrfs_alloc_dummy_root(void);
+struct btrfs_root *btrfs_alloc_dummy_root(u32 sectorsize, u32 nodesize);
 #endif
 
 /*
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 689d25ac6a68..82b912a293ab 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -2835,6 +2835,7 @@ int btrfs_should_throttle_delayed_refs(struct btrfs_trans_handle *trans,
 
 struct async_delayed_refs {
         struct btrfs_root *root;
+        u64 transid;
         int count;
         int error;
         int sync;
@@ -2850,6 +2851,10 @@ static void delayed_ref_async_start(struct btrfs_work *work)
 
         async = container_of(work, struct async_delayed_refs, work);
 
+        /* if the commit is already started, we don't need to wait here */
+        if (btrfs_transaction_blocked(async->root->fs_info))
+                goto done;
+
         trans = btrfs_join_transaction(async->root);
         if (IS_ERR(trans)) {
                 async->error = PTR_ERR(trans);
@@ -2861,10 +2866,15 @@ static void delayed_ref_async_start(struct btrfs_work *work)
          * wait on delayed refs
          */
         trans->sync = true;
+
+        /* Don't bother flushing if we got into a different transaction */
+        if (trans->transid > async->transid)
+                goto end;
+
         ret = btrfs_run_delayed_refs(trans, async->root, async->count);
         if (ret)
                 async->error = ret;
-
+end:
         ret = btrfs_end_transaction(trans, async->root);
         if (ret && !async->error)
                 async->error = ret;
@@ -2876,7 +2886,7 @@ done:
 }
 
 int btrfs_async_run_delayed_refs(struct btrfs_root *root,
-                                 unsigned long count, int wait)
+                                 unsigned long count, u64 transid, int wait)
 {
         struct async_delayed_refs *async;
         int ret;
@@ -2888,6 +2898,7 @@ int btrfs_async_run_delayed_refs(struct btrfs_root *root,
         async->root = root->fs_info->tree_root;
         async->count = count;
         async->error = 0;
+        async->transid = transid;
         if (wait)
                 async->sync = 1;
         else
@@ -8016,8 +8027,9 @@ btrfs_init_new_buffer(struct btrfs_trans_handle *trans, struct btrfs_root *root,
         struct extent_buffer *buf;
 
         buf = btrfs_find_create_tree_block(root, bytenr);
-        if (!buf)
-                return ERR_PTR(-ENOMEM);
+        if (IS_ERR(buf))
+                return buf;
+
         btrfs_set_header_generation(buf, trans->transid);
         btrfs_set_buffer_lockdep_class(root->root_key.objectid, buf, level);
         btrfs_tree_lock(buf);
@@ -8044,7 +8056,7 @@ btrfs_init_new_buffer(struct btrfs_trans_handle *trans, struct btrfs_root *root,
                 set_extent_dirty(&trans->transaction->dirty_pages, buf->start,
                          buf->start + buf->len - 1, GFP_NOFS);
         }
-        trans->blocks_used++;
+        trans->dirty = true;
         /* this returns a buffer locked for blocking */
         return buf;
 }
@@ -8659,8 +8671,9 @@ static noinline int do_walk_down(struct btrfs_trans_handle *trans,
         next = btrfs_find_tree_block(root->fs_info, bytenr);
         if (!next) {
                 next = btrfs_find_create_tree_block(root, bytenr);
-                if (!next)
-                        return -ENOMEM;
+                if (IS_ERR(next))
+                        return PTR_ERR(next);
+
                 btrfs_set_buffer_lockdep_class(root->root_key.objectid, next,
                                                level - 1);
                 reada = 1;
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 6e953de83f08..75533adef998 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -4728,16 +4728,16 @@ err:
 }
 
 struct extent_buffer *alloc_dummy_extent_buffer(struct btrfs_fs_info *fs_info,
-                                                u64 start)
+                                                u64 start, u32 nodesize)
 {
         unsigned long len;
 
         if (!fs_info) {
                 /*
                  * Called only from tests that don't always have a fs_info
-                 * available, but we know that nodesize is 4096
+                 * available
                  */
-                len = 4096;
+                len = nodesize;
         } else {
                 len = fs_info->tree_root->nodesize;
         }
@@ -4833,7 +4833,7 @@ struct extent_buffer *find_extent_buffer(struct btrfs_fs_info *fs_info,
 
 #ifdef CONFIG_BTRFS_FS_RUN_SANITY_TESTS
 struct extent_buffer *alloc_test_extent_buffer(struct btrfs_fs_info *fs_info,
-                                               u64 start)
+                                        u64 start, u32 nodesize)
 {
         struct extent_buffer *eb, *exists = NULL;
         int ret;
@@ -4841,7 +4841,7 @@ struct extent_buffer *alloc_test_extent_buffer(struct btrfs_fs_info *fs_info,
         eb = find_extent_buffer(fs_info, start);
         if (eb)
                 return eb;
-        eb = alloc_dummy_extent_buffer(fs_info, start);
+        eb = alloc_dummy_extent_buffer(fs_info, start, nodesize);
         if (!eb)
                 return NULL;
         eb->fs_info = fs_info;
@@ -4892,18 +4892,25 @@ struct extent_buffer *alloc_extent_buffer(struct btrfs_fs_info *fs_info,
         int uptodate = 1;
         int ret;
 
+        if (!IS_ALIGNED(start, fs_info->tree_root->sectorsize)) {
+                btrfs_err(fs_info, "bad tree block start %llu", start);
+                return ERR_PTR(-EINVAL);
+        }
+
         eb = find_extent_buffer(fs_info, start);
         if (eb)
                 return eb;
 
         eb = __alloc_extent_buffer(fs_info, start, len);
         if (!eb)
-                return NULL;
+                return ERR_PTR(-ENOMEM);
 
         for (i = 0; i < num_pages; i++, index++) {
                 p = find_or_create_page(mapping, index, GFP_NOFS|__GFP_NOFAIL);
-                if (!p)
+                if (!p) {
+                        exists = ERR_PTR(-ENOMEM);
                         goto free_eb;
+                }
 
                 spin_lock(&mapping->private_lock);
                 if (PagePrivate(p)) {
@@ -4948,8 +4955,10 @@ struct extent_buffer *alloc_extent_buffer(struct btrfs_fs_info *fs_info,
                 set_bit(EXTENT_BUFFER_UPTODATE, &eb->bflags);
 again:
         ret = radix_tree_preload(GFP_NOFS);
-        if (ret)
+        if (ret) {
+                exists = ERR_PTR(ret);
                 goto free_eb;
+        }
 
         spin_lock(&fs_info->buffer_lock);
         ret = radix_tree_insert(&fs_info->buffer_radix,
@@ -5333,6 +5342,11 @@ int read_extent_buffer_to_user(struct extent_buffer *eb, void __user *dstv,
         return ret;
 }
 
+/*
+ * return 0 if the item is found within a page.
+ * return 1 if the item spans two pages.
+ * return -EINVAL otherwise.
+ */
 int map_private_extent_buffer(struct extent_buffer *eb, unsigned long start,
                                unsigned long min_len, char **map,
                                unsigned long *map_start,
@@ -5347,7 +5361,7 @@ int map_private_extent_buffer(struct extent_buffer *eb, unsigned long start,
                 PAGE_SHIFT;
 
         if (i != end_i)
-                return -EINVAL;
+                return 1;
 
         if (i == 0) {
                 offset = start_offset;
diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h
index 1baf19c9b79d..c0c1c4fef6ce 100644
--- a/fs/btrfs/extent_io.h
+++ b/fs/btrfs/extent_io.h
@@ -348,7 +348,7 @@ struct extent_buffer *alloc_extent_buffer(struct btrfs_fs_info *fs_info,
 struct extent_buffer *__alloc_dummy_extent_buffer(struct btrfs_fs_info *fs_info,
                                                   u64 start, unsigned long len);
 struct extent_buffer *alloc_dummy_extent_buffer(struct btrfs_fs_info *fs_info,
-                                                u64 start);
+                                                u64 start, u32 nodesize);
 struct extent_buffer *btrfs_clone_extent_buffer(struct extent_buffer *src);
 struct extent_buffer *find_extent_buffer(struct btrfs_fs_info *fs_info,
                                          u64 start);
@@ -468,5 +468,5 @@ noinline u64 find_lock_delalloc_range(struct inode *inode,
                                       u64 *end, u64 max_bytes);
 #endif
 struct extent_buffer *alloc_test_extent_buffer(struct btrfs_fs_info *fs_info,
-                                               u64 start);
+                                               u64 start, u32 nodesize);
 #endif
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index e0c9bd3fb02d..2234e88cf674 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -1534,30 +1534,30 @@ static noinline ssize_t __btrfs_buffered_write(struct file *file,
                 reserve_bytes = round_up(write_bytes + sector_offset,
                                 root->sectorsize);
 
-                if ((BTRFS_I(inode)->flags & (BTRFS_INODE_NODATACOW |
-                                              BTRFS_INODE_PREALLOC)) &&
-                    check_can_nocow(inode, pos, &write_bytes) > 0) {
-                        /*
-                         * For nodata cow case, no need to reserve
-                         * data space.
-                         */
-                        only_release_metadata = true;
-                        /*
-                         * our prealloc extent may be smaller than
-                         * write_bytes, so scale down.
-                         */
-                        num_pages = DIV_ROUND_UP(write_bytes + offset,
-                                                 PAGE_SIZE);
-                        reserve_bytes = round_up(write_bytes + sector_offset,
-                                        root->sectorsize);
-                        goto reserve_metadata;
-                }
-
                 ret = btrfs_check_data_free_space(inode, pos, write_bytes);
-                if (ret < 0)
-                        break;
+                if (ret < 0) {
+                        if ((BTRFS_I(inode)->flags & (BTRFS_INODE_NODATACOW |
+                                                      BTRFS_INODE_PREALLOC)) &&
+                            check_can_nocow(inode, pos, &write_bytes) > 0) {
+                                /*
+                                 * For nodata cow case, no need to reserve
+                                 * data space.
+                                 */
+                                only_release_metadata = true;
+                                /*
+                                 * our prealloc extent may be smaller than
+                                 * write_bytes, so scale down.
+                                 */
+                                num_pages = DIV_ROUND_UP(write_bytes + offset,
+                                                         PAGE_SIZE);
+                                reserve_bytes = round_up(write_bytes +
+                                                         sector_offset,
+                                                         root->sectorsize);
+                        } else {
+                                break;
+                        }
+                }
 
-reserve_metadata:
                 ret = btrfs_delalloc_reserve_metadata(inode, reserve_bytes);
                 if (ret) {
                         if (!only_release_metadata)
diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
index c6dc1183f542..69d270f6602c 100644
--- a/fs/btrfs/free-space-cache.c
+++ b/fs/btrfs/free-space-cache.c
@@ -29,7 +29,7 @@
 #include "inode-map.h"
 #include "volumes.h"
 
-#define BITS_PER_BITMAP         (PAGE_SIZE * 8)
+#define BITS_PER_BITMAP         (PAGE_SIZE * 8UL)
 #define MAX_CACHE_BYTES_PER_GIG SZ_32K
 
 struct btrfs_trim_range {
@@ -1415,11 +1415,11 @@ static inline u64 offset_to_bitmap(struct btrfs_free_space_ctl *ctl,
                                    u64 offset)
 {
         u64 bitmap_start;
-        u32 bytes_per_bitmap;
+        u64 bytes_per_bitmap;
 
         bytes_per_bitmap = BITS_PER_BITMAP * ctl->unit;
         bitmap_start = offset - ctl->start;
-        bitmap_start = div_u64(bitmap_start, bytes_per_bitmap);
+        bitmap_start = div64_u64(bitmap_start, bytes_per_bitmap);
         bitmap_start *= bytes_per_bitmap;
         bitmap_start += ctl->start;
 
@@ -1638,10 +1638,10 @@ static void recalculate_thresholds(struct btrfs_free_space_ctl *ctl)
         u64 bitmap_bytes;
         u64 extent_bytes;
         u64 size = block_group->key.offset;
-        u32 bytes_per_bg = BITS_PER_BITMAP * ctl->unit;
-        u32 max_bitmaps = div_u64(size + bytes_per_bg - 1, bytes_per_bg);
+        u64 bytes_per_bg = BITS_PER_BITMAP * ctl->unit;
+        u64 max_bitmaps = div64_u64(size + bytes_per_bg - 1, bytes_per_bg);
 
-        max_bitmaps = max_t(u32, max_bitmaps, 1);
+        max_bitmaps = max_t(u64, max_bitmaps, 1);
 
         ASSERT(ctl->total_bitmaps <= max_bitmaps);
 
@@ -1660,7 +1660,7 @@ static void recalculate_thresholds(struct btrfs_free_space_ctl *ctl)
          * sure we don't go over our overall goal of MAX_CACHE_BYTES_PER_GIG as
          * we add more bitmaps.
          */
-        bitmap_bytes = (ctl->total_bitmaps + 1) * PAGE_SIZE;
+        bitmap_bytes = (ctl->total_bitmaps + 1) * ctl->unit;
 
         if (bitmap_bytes >= max_bytes) {
                 ctl->extents_thresh = 0;
@@ -3662,7 +3662,7 @@ have_info:
                         if (tmp->offset + tmp->bytes < offset)
                                 break;
                         if (offset + bytes < tmp->offset) {
-                                n = rb_prev(&info->offset_index);
+                                n = rb_prev(&tmp->offset_index);
                                 continue;
                         }
                         info = tmp;
@@ -3676,7 +3676,7 @@ have_info:
                         if (offset + bytes < tmp->offset)
                                 break;
                         if (tmp->offset + tmp->bytes < offset) {
-                                n = rb_next(&info->offset_index);
+                                n = rb_next(&tmp->offset_index);
                                 continue;
                         }
                         info = tmp;
diff --git a/fs/btrfs/hash.c b/fs/btrfs/hash.c
index aae520b2aee5..a97fdc156a03 100644
--- a/fs/btrfs/hash.c
+++ b/fs/btrfs/hash.c
@@ -24,6 +24,11 @@ int __init btrfs_hash_init(void)
         return PTR_ERR_OR_ZERO(tfm);
 }
 
+const char* btrfs_crc32c_impl(void)
+{
+        return crypto_tfm_alg_driver_name(crypto_shash_tfm(tfm));
+}
+
 void btrfs_hash_exit(void)
 {
         crypto_free_shash(tfm);
diff --git a/fs/btrfs/hash.h b/fs/btrfs/hash.h
index 118a2316e5d3..c3a2ec554361 100644
--- a/fs/btrfs/hash.h
+++ b/fs/btrfs/hash.h
@@ -22,6 +22,7 @@
 int __init btrfs_hash_init(void);
 
 void btrfs_hash_exit(void);
+const char* btrfs_crc32c_impl(void);
 
 u32 btrfs_crc32c(u32 crc, const void *address, unsigned int length);
 
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 8b1212e8f7a8..4421954720b8 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -3271,7 +3271,16 @@ int btrfs_orphan_add(struct btrfs_trans_handle *trans, struct inode *inode)
         /* grab metadata reservation from transaction handle */
         if (reserve) {
                 ret = btrfs_orphan_reserve_metadata(trans, inode);
-                BUG_ON(ret); /* -ENOSPC in reservation; Logic error? JDM */
+                ASSERT(!ret);
+                if (ret) {
+                        atomic_dec(&root->orphan_inodes);
+                        clear_bit(BTRFS_INODE_ORPHAN_META_RESERVED,
+                                  &BTRFS_I(inode)->runtime_flags);
+                        if (insert)
+                                clear_bit(BTRFS_INODE_HAS_ORPHAN_ITEM,
+                                          &BTRFS_I(inode)->runtime_flags);
+                        return ret;
+                }
         }
 
         /* insert an orphan item to track this unlinked/truncated file */
@@ -4549,6 +4558,7 @@ delete:
                         BUG_ON(ret);
                         if (btrfs_should_throttle_delayed_refs(trans, root))
                                 btrfs_async_run_delayed_refs(root,
+                                                             trans->transid,
                                         trans->delayed_ref_updates * 2, 0);
                         if (be_nice) {
                                 if (truncate_space_check(trans, root,
@@ -5748,6 +5758,7 @@ static int btrfs_real_readdir(struct file *file, struct dir_context *ctx)
         int name_len;
         int is_curr = 0;        /* ctx->pos points to the current index? */
         bool emitted;
+        bool put = false;
 
         /* FIXME, use a real flag for deciding about the key type */
         if (root->fs_info->tree_root == root)
@@ -5765,7 +5776,8 @@ static int btrfs_real_readdir(struct file *file, struct dir_context *ctx)
         if (key_type == BTRFS_DIR_INDEX_KEY) {
                 INIT_LIST_HEAD(&ins_list);
                 INIT_LIST_HEAD(&del_list);
-                btrfs_get_delayed_items(inode, &ins_list, &del_list);
+                put = btrfs_readdir_get_delayed_items(inode, &ins_list,
+                                                      &del_list);
         }
 
         key.type = key_type;
@@ -5912,8 +5924,8 @@ next:
 nopos:
         ret = 0;
 err:
-        if (key_type == BTRFS_DIR_INDEX_KEY)
-                btrfs_put_delayed_items(&ins_list, &del_list);
+        if (put)
+                btrfs_readdir_put_delayed_items(inode, &ins_list, &del_list);
         btrfs_free_path(path);
         return ret;
 }
@@ -10525,7 +10537,7 @@ static const struct inode_operations btrfs_dir_ro_inode_operations = {
 static const struct file_operations btrfs_dir_file_operations = {
         .llseek         = generic_file_llseek,
         .read           = generic_read_dir,
-        .iterate        = btrfs_real_readdir,
+        .iterate_shared = btrfs_real_readdir,
         .unlocked_ioctl = btrfs_ioctl,
 #ifdef CONFIG_COMPAT
         .compat_ioctl   = btrfs_compat_ioctl,
diff --git a/fs/btrfs/ordered-data.c b/fs/btrfs/ordered-data.c
index e96634a725c3..aca8264f4a49 100644
--- a/fs/btrfs/ordered-data.c
+++ b/fs/btrfs/ordered-data.c
@@ -968,6 +968,7 @@ int btrfs_ordered_update_i_size(struct inode *inode, u64 offset,
         struct rb_node *prev = NULL;
         struct btrfs_ordered_extent *test;
         int ret = 1;
+        u64 orig_offset = offset;
 
         spin_lock_irq(&tree->lock);
         if (ordered) {
@@ -983,7 +984,7 @@ int btrfs_ordered_update_i_size(struct inode *inode, u64 offset,
 
         /* truncate file */
         if (disk_i_size > i_size) {
-                BTRFS_I(inode)->disk_i_size = i_size;
+                BTRFS_I(inode)->disk_i_size = orig_offset;
                 ret = 0;
                 goto out;
         }
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 4e59a91a11e0..60e7179ed4b7 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -235,7 +235,7 @@ void __btrfs_abort_transaction(struct btrfs_trans_handle *trans,
         trans->aborted = errno;
         /* Nothing used. The other threads that have joined this
          * transaction may be able to continue. */
-        if (!trans->blocks_used && list_empty(&trans->new_bgs)) {
+        if (!trans->dirty && list_empty(&trans->new_bgs)) {
                 const char *errstr;
 
                 errstr = btrfs_decode_error(errno);
@@ -1807,6 +1807,8 @@ static int btrfs_remount(struct super_block *sb, int *flags, char *data)
                         }
                 }
                 sb->s_flags &= ~MS_RDONLY;
+
+                fs_info->open = 1;
         }
 out:
         wake_up_process(fs_info->transaction_kthread);
@@ -2303,7 +2305,7 @@ static void btrfs_interface_exit(void)
 
 static void btrfs_print_mod_info(void)
 {
-        printk(KERN_INFO "Btrfs loaded"
+        printk(KERN_INFO "Btrfs loaded, crc32c=%s"
 #ifdef CONFIG_BTRFS_DEBUG
                         ", debug=on"
 #endif
@@ -2313,33 +2315,48 @@ static void btrfs_print_mod_info(void)
 #ifdef CONFIG_BTRFS_FS_CHECK_INTEGRITY
                         ", integrity-checker=on"
 #endif
-                        "\n");
+                        "\n",
+                        btrfs_crc32c_impl());
 }
 
 static int btrfs_run_sanity_tests(void)
 {
-        int ret;
-
+        int ret, i;
+        u32 sectorsize, nodesize;
+        u32 test_sectorsize[] = {
+                PAGE_SIZE,
+        };
         ret = btrfs_init_test_fs();
         if (ret)
                 return ret;
-
-        ret = btrfs_test_free_space_cache();
-        if (ret)
-                goto out;
-        ret = btrfs_test_extent_buffer_operations();
-        if (ret)
-                goto out;
-        ret = btrfs_test_extent_io();
-        if (ret)
-                goto out;
-        ret = btrfs_test_inodes();
-        if (ret)
-                goto out;
-        ret = btrfs_test_qgroups();
-        if (ret)
-                goto out;
-        ret = btrfs_test_free_space_tree();
+        for (i = 0; i < ARRAY_SIZE(test_sectorsize); i++) {
+                sectorsize = test_sectorsize[i];
+                for (nodesize = sectorsize;
+                     nodesize <= BTRFS_MAX_METADATA_BLOCKSIZE;
+                     nodesize <<= 1) {
+                        pr_info("BTRFS: selftest: sectorsize: %u  nodesize: %u\n",
+                                sectorsize, nodesize);
+                        ret = btrfs_test_free_space_cache(sectorsize, nodesize);
+                        if (ret)
+                                goto out;
+                        ret = btrfs_test_extent_buffer_operations(sectorsize,
+                                nodesize);
+                        if (ret)
+                                goto out;
+                        ret = btrfs_test_extent_io(sectorsize, nodesize);
+                        if (ret)
+                                goto out;
+                        ret = btrfs_test_inodes(sectorsize, nodesize);
+                        if (ret)
+                                goto out;
+                        ret = btrfs_test_qgroups(sectorsize, nodesize);
+                        if (ret)
+                                goto out;
+                        ret = btrfs_test_free_space_tree(sectorsize, nodesize);
+                        if (ret)
+                                goto out;
+                }
+        }
 out:
         btrfs_destroy_test_fs();
         return ret;
diff --git a/fs/btrfs/tests/btrfs-tests.c b/fs/btrfs/tests/btrfs-tests.c
index f54bf450bad3..02223f3f78f4 100644
--- a/fs/btrfs/tests/btrfs-tests.c
+++ b/fs/btrfs/tests/btrfs-tests.c
@@ -68,7 +68,7 @@ int btrfs_init_test_fs(void)
         if (IS_ERR(test_mnt)) {
                 printk(KERN_ERR "btrfs: cannot mount test file system\n");
                 unregister_filesystem(&test_type);
-                return ret;
+                return PTR_ERR(test_mnt);
         }
         return 0;
 }
@@ -175,7 +175,7 @@ void btrfs_free_dummy_root(struct btrfs_root *root)
 }
 
 struct btrfs_block_group_cache *
-btrfs_alloc_dummy_block_group(unsigned long length)
+btrfs_alloc_dummy_block_group(unsigned long length, u32 sectorsize)
 {
         struct btrfs_block_group_cache *cache;
 
@@ -192,8 +192,8 @@ btrfs_alloc_dummy_block_group(unsigned long length)
         cache->key.objectid = 0;
         cache->key.offset = length;
         cache->key.type = BTRFS_BLOCK_GROUP_ITEM_KEY;
-        cache->sectorsize = 4096;
-        cache->full_stripe_len = 4096;
+        cache->sectorsize = sectorsize;
+        cache->full_stripe_len = sectorsize;
 
         INIT_LIST_HEAD(&cache->list);
         INIT_LIST_HEAD(&cache->cluster_list);
diff --git a/fs/btrfs/tests/btrfs-tests.h b/fs/btrfs/tests/btrfs-tests.h
index 054b8c73c951..66fb6b701eb7 100644
--- a/fs/btrfs/tests/btrfs-tests.h
+++ b/fs/btrfs/tests/btrfs-tests.h
@@ -26,27 +26,28 @@
 struct btrfs_root;
 struct btrfs_trans_handle;
 
-int btrfs_test_free_space_cache(void);
-int btrfs_test_extent_buffer_operations(void);
-int btrfs_test_extent_io(void);
-int btrfs_test_inodes(void);
-int btrfs_test_qgroups(void);
-int btrfs_test_free_space_tree(void);
+int btrfs_test_free_space_cache(u32 sectorsize, u32 nodesize);
+int btrfs_test_extent_buffer_operations(u32 sectorsize, u32 nodesize);
+int btrfs_test_extent_io(u32 sectorsize, u32 nodesize);
+int btrfs_test_inodes(u32 sectorsize, u32 nodesize);
+int btrfs_test_qgroups(u32 sectorsize, u32 nodesize);
+int btrfs_test_free_space_tree(u32 sectorsize, u32 nodesize);
 int btrfs_init_test_fs(void);
 void btrfs_destroy_test_fs(void);
 struct inode *btrfs_new_test_inode(void);
 struct btrfs_fs_info *btrfs_alloc_dummy_fs_info(void);
 void btrfs_free_dummy_root(struct btrfs_root *root);
 struct btrfs_block_group_cache *
-btrfs_alloc_dummy_block_group(unsigned long length);
+btrfs_alloc_dummy_block_group(unsigned long length, u32 sectorsize);
 void btrfs_free_dummy_block_group(struct btrfs_block_group_cache *cache);
 void btrfs_init_dummy_trans(struct btrfs_trans_handle *trans);
 #else
-static inline int btrfs_test_free_space_cache(void)
+static inline int btrfs_test_free_space_cache(u32 sectorsize, u32 nodesize)
 {
         return 0;
 }
-static inline int btrfs_test_extent_buffer_operations(void)
+static inline int btrfs_test_extent_buffer_operations(u32 sectorsize,
+        u32 nodesize)
 {
         return 0;
 }
@@ -57,19 +58,19 @@ static inline int btrfs_init_test_fs(void)
 static inline void btrfs_destroy_test_fs(void)
 {
 }
-static inline int btrfs_test_extent_io(void)
+static inline int btrfs_test_extent_io(u32 sectorsize, u32 nodesize)
 {
         return 0;
 }
-static inline int btrfs_test_inodes(void)
+static inline int btrfs_test_inodes(u32 sectorsize, u32 nodesize)
 {
         return 0;
 }
-static inline int btrfs_test_qgroups(void)
+static inline int btrfs_test_qgroups(u32 sectorsize, u32 nodesize)
 {
         return 0;
 }
-static inline int btrfs_test_free_space_tree(void)
+static inline int btrfs_test_free_space_tree(u32 sectorsize, u32 nodesize)
 {
         return 0;
 }
diff --git a/fs/btrfs/tests/extent-buffer-tests.c b/fs/btrfs/tests/extent-buffer-tests.c
index f51963a8f929..4f8cbd1ec5ee 100644
--- a/fs/btrfs/tests/extent-buffer-tests.c
+++ b/fs/btrfs/tests/extent-buffer-tests.c
@@ -22,7 +22,7 @@
 #include "../extent_io.h"
 #include "../disk-io.h"
 
-static int test_btrfs_split_item(void)
+static int test_btrfs_split_item(u32 sectorsize, u32 nodesize)
 {
         struct btrfs_path *path;
         struct btrfs_root *root;
@@ -40,7 +40,7 @@ static int test_btrfs_split_item(void)
 
         test_msg("Running btrfs_split_item tests\n");
 
-        root = btrfs_alloc_dummy_root();
+        root = btrfs_alloc_dummy_root(sectorsize, nodesize);
         if (IS_ERR(root)) {
                 test_msg("Could not allocate root\n");
                 return PTR_ERR(root);
@@ -53,7 +53,8 @@ static int test_btrfs_split_item(void)
                 return -ENOMEM;
         }
 
-        path->nodes[0] = eb = alloc_dummy_extent_buffer(NULL, 4096);
+        path->nodes[0] = eb = alloc_dummy_extent_buffer(NULL, nodesize,
+                                                        nodesize);
         if (!eb) {
                 test_msg("Could not allocate dummy buffer\n");
                 ret = -ENOMEM;
@@ -222,8 +223,8 @@ out:
         return ret;
 }
 
-int btrfs_test_extent_buffer_operations(void)
+int btrfs_test_extent_buffer_operations(u32 sectorsize, u32 nodesize)
 {
-        test_msg("Running extent buffer operation tests");
-        return test_btrfs_split_item();
+        test_msg("Running extent buffer operation tests\n");
+        return test_btrfs_split_item(sectorsize, nodesize);
 }
diff --git a/fs/btrfs/tests/extent-io-tests.c b/fs/btrfs/tests/extent-io-tests.c
index 55724607f79b..d19ab0317283 100644
--- a/fs/btrfs/tests/extent-io-tests.c
+++ b/fs/btrfs/tests/extent-io-tests.c
@@ -21,6 +21,7 @@
 #include <linux/slab.h>
 #include <linux/sizes.h>
 #include "btrfs-tests.h"
+#include "../ctree.h"
 #include "../extent_io.h"
 
 #define PROCESS_UNLOCK          (1 << 0)
@@ -65,7 +66,7 @@ static noinline int process_page_range(struct inode *inode, u64 start, u64 end,
         return count;
 }
 
-static int test_find_delalloc(void)
+static int test_find_delalloc(u32 sectorsize)
 {
         struct inode *inode;
         struct extent_io_tree tmp;
@@ -113,7 +114,7 @@ static int test_find_delalloc(void)
          * |--- delalloc ---|
          * |---  search  ---|
          */
-        set_extent_delalloc(&tmp, 0, 4095, NULL);
+        set_extent_delalloc(&tmp, 0, sectorsize - 1, NULL);
         start = 0;
         end = 0;
         found = find_lock_delalloc_range(inode, &tmp, locked_page, &start,
@@ -122,9 +123,9 @@ static int test_find_delalloc(void)
                 test_msg("Should have found at least one delalloc\n");
                 goto out_bits;
         }
-        if (start != 0 || end != 4095) {
-                test_msg("Expected start 0 end 4095, got start %Lu end %Lu\n",
-                         start, end);
+        if (start != 0 || end != (sectorsize - 1)) {
+                test_msg("Expected start 0 end %u, got start %llu end %llu\n",
+                        sectorsize - 1, start, end);
                 goto out_bits;
         }
         unlock_extent(&tmp, start, end);
@@ -144,7 +145,7 @@ static int test_find_delalloc(void)
                 test_msg("Couldn't find the locked page\n");
                 goto out_bits;
         }
-        set_extent_delalloc(&tmp, 4096, max_bytes - 1, NULL);
+        set_extent_delalloc(&tmp, sectorsize, max_bytes - 1, NULL);
         start = test_start;
         end = 0;
         found = find_lock_delalloc_range(inode, &tmp, locked_page, &start,
@@ -172,7 +173,7 @@ static int test_find_delalloc(void)
          * |--- delalloc ---|
          *                    |--- search ---|
          */
-        test_start = max_bytes + 4096;
+        test_start = max_bytes + sectorsize;
         locked_page = find_lock_page(inode->i_mapping, test_start >>
                                      PAGE_SHIFT);
         if (!locked_page) {
@@ -272,6 +273,16 @@ out:
         return ret;
 }
 
+/**
+ * test_bit_in_byte - Determine whether a bit is set in a byte
+ * @nr: bit number to test
+ * @addr: Address to start counting from
+ */
+static inline int test_bit_in_byte(int nr, const u8 *addr)
+{
+        return 1UL & (addr[nr / BITS_PER_BYTE] >> (nr & (BITS_PER_BYTE - 1)));
+}
+
 static int __test_eb_bitmaps(unsigned long *bitmap, struct extent_buffer *eb,
                              unsigned long len)
 {
@@ -298,25 +309,29 @@ static int __test_eb_bitmaps(unsigned long *bitmap, struct extent_buffer *eb,
                 return -EINVAL;
         }
 
-        bitmap_set(bitmap, (PAGE_SIZE - sizeof(long) / 2) * BITS_PER_BYTE,
-                   sizeof(long) * BITS_PER_BYTE);
-        extent_buffer_bitmap_set(eb, PAGE_SIZE - sizeof(long) / 2, 0,
-                                 sizeof(long) * BITS_PER_BYTE);
-        if (memcmp_extent_buffer(eb, bitmap, 0, len) != 0) {
-                test_msg("Setting straddling pages failed\n");
-                return -EINVAL;
-        }
+        /* Straddling pages test */
+        if (len > PAGE_SIZE) {
+                bitmap_set(bitmap,
+                        (PAGE_SIZE - sizeof(long) / 2) * BITS_PER_BYTE,
+                        sizeof(long) * BITS_PER_BYTE);
+                extent_buffer_bitmap_set(eb, PAGE_SIZE - sizeof(long) / 2, 0,
+                                        sizeof(long) * BITS_PER_BYTE);
+                if (memcmp_extent_buffer(eb, bitmap, 0, len) != 0) {
+                        test_msg("Setting straddling pages failed\n");
+                        return -EINVAL;
+                }
 
-        bitmap_set(bitmap, 0, len * BITS_PER_BYTE);
-        bitmap_clear(bitmap,
-                     (PAGE_SIZE - sizeof(long) / 2) * BITS_PER_BYTE,
-                     sizeof(long) * BITS_PER_BYTE);
-        extent_buffer_bitmap_set(eb, 0, 0, len * BITS_PER_BYTE);
-        extent_buffer_bitmap_clear(eb, PAGE_SIZE - sizeof(long) / 2, 0,
-                                   sizeof(long) * BITS_PER_BYTE);
-        if (memcmp_extent_buffer(eb, bitmap, 0, len) != 0) {
-                test_msg("Clearing straddling pages failed\n");
-                return -EINVAL;
+                bitmap_set(bitmap, 0, len * BITS_PER_BYTE);
+                bitmap_clear(bitmap,
+                        (PAGE_SIZE - sizeof(long) / 2) * BITS_PER_BYTE,
+                        sizeof(long) * BITS_PER_BYTE);
+                extent_buffer_bitmap_set(eb, 0, 0, len * BITS_PER_BYTE);
+                extent_buffer_bitmap_clear(eb, PAGE_SIZE - sizeof(long) / 2, 0,
+                                        sizeof(long) * BITS_PER_BYTE);
+                if (memcmp_extent_buffer(eb, bitmap, 0, len) != 0) {
+                        test_msg("Clearing straddling pages failed\n");
+                        return -EINVAL;
+                }
         }
 
         /*
@@ -333,7 +348,7 @@ static int __test_eb_bitmaps(unsigned long *bitmap, struct extent_buffer *eb,
         for (i = 0; i < len * BITS_PER_BYTE; i++) {
                 int bit, bit1;
 
-                bit = !!test_bit(i, bitmap);
+                bit = !!test_bit_in_byte(i, (u8 *)bitmap);
                 bit1 = !!extent_buffer_test_bit(eb, 0, i);
                 if (bit1 != bit) {
                         test_msg("Testing bit pattern failed\n");
@@ -351,15 +366,22 @@ static int __test_eb_bitmaps(unsigned long *bitmap, struct extent_buffer *eb,
         return 0;
 }
 
-static int test_eb_bitmaps(void)
+static int test_eb_bitmaps(u32 sectorsize, u32 nodesize)
 {
-        unsigned long len = PAGE_SIZE * 4;
+        unsigned long len;
         unsigned long *bitmap;
         struct extent_buffer *eb;
         int ret;
 
         test_msg("Running extent buffer bitmap tests\n");
 
+        /*
+         * In ppc64, sectorsize can be 64K, thus 4 * 64K will be larger than
+         * BTRFS_MAX_METADATA_BLOCKSIZE.
+         */
+        len = (sectorsize < BTRFS_MAX_METADATA_BLOCKSIZE)
+                ? sectorsize * 4 : sectorsize;
+
         bitmap = kmalloc(len, GFP_KERNEL);
         if (!bitmap) {
                 test_msg("Couldn't allocate test bitmap\n");
@@ -379,7 +401,7 @@ static int test_eb_bitmaps(void)
 
         /* Do it over again with an extent buffer which isn't page-aligned. */
         free_extent_buffer(eb);
-        eb = __alloc_dummy_extent_buffer(NULL, PAGE_SIZE / 2, len);
+        eb = __alloc_dummy_extent_buffer(NULL, nodesize / 2, len);
         if (!eb) {
                 test_msg("Couldn't allocate test extent buffer\n");
                 kfree(bitmap);
@@ -393,17 +415,17 @@ out:
         return ret;
 }
 
-int btrfs_test_extent_io(void)
+int btrfs_test_extent_io(u32 sectorsize, u32 nodesize)
 {
         int ret;
 
         test_msg("Running extent I/O tests\n");
 
-        ret = test_find_delalloc();
+        ret = test_find_delalloc(sectorsize);
         if (ret)
                 goto out;
 
-        ret = test_eb_bitmaps();
+        ret = test_eb_bitmaps(sectorsize, nodesize);
 out:
         test_msg("Extent I/O tests finished\n");
         return ret;
diff --git a/fs/btrfs/tests/free-space-tests.c b/fs/btrfs/tests/free-space-tests.c
index 0eeb8f3d6b67..3956bb2ff84c 100644
--- a/fs/btrfs/tests/free-space-tests.c
+++ b/fs/btrfs/tests/free-space-tests.c
@@ -22,7 +22,7 @@
 #include "../disk-io.h"
 #include "../free-space-cache.h"
 
-#define BITS_PER_BITMAP         (PAGE_SIZE * 8)
+#define BITS_PER_BITMAP         (PAGE_SIZE * 8UL)
 
 /*
  * This test just does basic sanity checking, making sure we can add an extent
@@ -99,7 +99,8 @@ static int test_extents(struct btrfs_block_group_cache *cache)
         return 0;
 }
 
-static int test_bitmaps(struct btrfs_block_group_cache *cache)
+static int test_bitmaps(struct btrfs_block_group_cache *cache,
+                        u32 sectorsize)
 {
         u64 next_bitmap_offset;
         int ret;
@@ -139,7 +140,7 @@ static int test_bitmaps(struct btrfs_block_group_cache *cache)
          * The first bitmap we have starts at offset 0 so the next one is just
          * at the end of the first bitmap.
          */
-        next_bitmap_offset = (u64)(BITS_PER_BITMAP * 4096);
+        next_bitmap_offset = (u64)(BITS_PER_BITMAP * sectorsize);
 
         /* Test a bit straddling two bitmaps */
         ret = test_add_free_space_entry(cache, next_bitmap_offset - SZ_2M,
@@ -167,9 +168,10 @@ static int test_bitmaps(struct btrfs_block_group_cache *cache)
 }
 
 /* This is the high grade jackassery */
-static int test_bitmaps_and_extents(struct btrfs_block_group_cache *cache)
+static int test_bitmaps_and_extents(struct btrfs_block_group_cache *cache,
+                                    u32 sectorsize)
 {
-        u64 bitmap_offset = (u64)(BITS_PER_BITMAP * 4096);
+        u64 bitmap_offset = (u64)(BITS_PER_BITMAP * sectorsize);
         int ret;
 
         test_msg("Running bitmap and extent tests\n");
@@ -401,7 +403,8 @@ static int check_cache_empty(struct btrfs_block_group_cache *cache)
  * requests.
  */
 static int
-test_steal_space_from_bitmap_to_extent(struct btrfs_block_group_cache *cache)
+test_steal_space_from_bitmap_to_extent(struct btrfs_block_group_cache *cache,
+                                       u32 sectorsize)
 {
         int ret;
         u64 offset;
@@ -539,7 +542,7 @@ test_steal_space_from_bitmap_to_extent(struct btrfs_block_group_cache *cache)
          * The goal is to test that the bitmap entry space stealing doesn't
          * steal this space region.
          */
-        ret = btrfs_add_free_space(cache, SZ_128M + SZ_16M, 4096);
+        ret = btrfs_add_free_space(cache, SZ_128M + SZ_16M, sectorsize);
         if (ret) {
                 test_msg("Error adding free space: %d\n", ret);
                 return ret;
@@ -597,8 +600,8 @@ test_steal_space_from_bitmap_to_extent(struct btrfs_block_group_cache *cache)
                 return -ENOENT;
         }
 
-        if (cache->free_space_ctl->free_space != (SZ_1M + 4096)) {
-                test_msg("Cache free space is not 1Mb + 4Kb\n");
+        if (cache->free_space_ctl->free_space != (SZ_1M + sectorsize)) {
+                test_msg("Cache free space is not 1Mb + %u\n", sectorsize);
                 return -EINVAL;
         }
 
@@ -611,22 +614,25 @@ test_steal_space_from_bitmap_to_extent(struct btrfs_block_group_cache *cache)
                 return -EINVAL;
         }
 
-        /* All that remains is a 4Kb free space region in a bitmap. Confirm. */
+        /*
+         * All that remains is a sectorsize free space region in a bitmap.
+         * Confirm.
+         */
         ret = check_num_extents_and_bitmaps(cache, 1, 1);
         if (ret)
                 return ret;
 
-        if (cache->free_space_ctl->free_space != 4096) {
-                test_msg("Cache free space is not 4Kb\n");
+        if (cache->free_space_ctl->free_space != sectorsize) {
+                test_msg("Cache free space is not %u\n", sectorsize);
                 return -EINVAL;
         }
 
         offset = btrfs_find_space_for_alloc(cache,
-                                            0, 4096, 0,
+                                            0, sectorsize, 0,
                                             &max_extent_size);
         if (offset != (SZ_128M + SZ_16M)) {
-                test_msg("Failed to allocate 4Kb from space cache, returned offset is: %llu\n",
-                         offset);
+                test_msg("Failed to allocate %u, returned offset : %llu\n",
+                         sectorsize, offset);
                 return -EINVAL;
         }
 
@@ -733,7 +739,7 @@ test_steal_space_from_bitmap_to_extent(struct btrfs_block_group_cache *cache)
          * The goal is to test that the bitmap entry space stealing doesn't
          * steal this space region.
          */
-        ret = btrfs_add_free_space(cache, SZ_32M, 8192);
+        ret = btrfs_add_free_space(cache, SZ_32M, 2 * sectorsize);
         if (ret) {
                 test_msg("Error adding free space: %d\n", ret);
                 return ret;
@@ -757,7 +763,7 @@ test_steal_space_from_bitmap_to_extent(struct btrfs_block_group_cache *cache)
 
         /*
          * Confirm that our extent entry didn't stole all free space from the
-         * bitmap, because of the small 8Kb free space region.
+         * bitmap, because of the small 2 * sectorsize free space region.
          */
         ret = check_num_extents_and_bitmaps(cache, 2, 1);
         if (ret)
@@ -783,8 +789,8 @@ test_steal_space_from_bitmap_to_extent(struct btrfs_block_group_cache *cache)
                 return -ENOENT;
         }
 
-        if (cache->free_space_ctl->free_space != (SZ_1M + 8192)) {
-                test_msg("Cache free space is not 1Mb + 8Kb\n");
+        if (cache->free_space_ctl->free_space != (SZ_1M + 2 * sectorsize)) {
+                test_msg("Cache free space is not 1Mb + %u\n", 2 * sectorsize);
                 return -EINVAL;
         }
 
@@ -796,21 +802,25 @@ test_steal_space_from_bitmap_to_extent(struct btrfs_block_group_cache *cache)
                 return -EINVAL;
         }
 
-        /* All that remains is a 8Kb free space region in a bitmap. Confirm. */
+        /*
+         * All that remains is 2 * sectorsize free space region
+         * in a bitmap. Confirm.
+         */
         ret = check_num_extents_and_bitmaps(cache, 1, 1);
         if (ret)
                 return ret;
 
-        if (cache->free_space_ctl->free_space != 8192) {
-                test_msg("Cache free space is not 8Kb\n");
+        if (cache->free_space_ctl->free_space != 2 * sectorsize) {
+                test_msg("Cache free space is not %u\n", 2 * sectorsize);
                 return -EINVAL;
         }
 
         offset = btrfs_find_space_for_alloc(cache,
-                                            0, 8192, 0,
+                                            0, 2 * sectorsize, 0,
                                             &max_extent_size);
         if (offset != SZ_32M) {
-                test_msg("Failed to allocate 8Kb from space cache, returned offset is: %llu\n",
+                test_msg("Failed to allocate %u, offset: %llu\n",
+                         2 * sectorsize,
                          offset);
                 return -EINVAL;
         }
@@ -825,7 +835,7 @@ test_steal_space_from_bitmap_to_extent(struct btrfs_block_group_cache *cache)
         return 0;
 }
 
-int btrfs_test_free_space_cache(void)
+int btrfs_test_free_space_cache(u32 sectorsize, u32 nodesize)
 {
         struct btrfs_block_group_cache *cache;
         struct btrfs_root *root = NULL;
@@ -833,13 +843,19 @@ int btrfs_test_free_space_cache(void)
 
         test_msg("Running btrfs free space cache tests\n");
 
-        cache = btrfs_alloc_dummy_block_group(1024 * 1024 * 1024);
+        /*
+         * For ppc64 (with 64k page size), bytes per bitmap might be
+         * larger than 1G.  To make bitmap test available in ppc64,
+         * alloc dummy block group whose size cross bitmaps.
+         */
+        cache = btrfs_alloc_dummy_block_group(BITS_PER_BITMAP * sectorsize
+                                        + PAGE_SIZE, sectorsize);
         if (!cache) {
                 test_msg("Couldn't run the tests\n");
                 return 0;
         }
 
-        root = btrfs_alloc_dummy_root();
+        root = btrfs_alloc_dummy_root(sectorsize, nodesize);
         if (IS_ERR(root)) {
                 ret = PTR_ERR(root);
                 goto out;
@@ -855,14 +871,14 @@ int btrfs_test_free_space_cache(void)
         ret = test_extents(cache);
         if (ret)
                 goto out;
-        ret = test_bitmaps(cache);
+        ret = test_bitmaps(cache, sectorsize);
         if (ret)
                 goto out;
-        ret = test_bitmaps_and_extents(cache);
+        ret = test_bitmaps_and_extents(cache, sectorsize);
         if (ret)
                 goto out;
 
-        ret = test_steal_space_from_bitmap_to_extent(cache);
+        ret = test_steal_space_from_bitmap_to_extent(cache, sectorsize);
 out:
         btrfs_free_dummy_block_group(cache);
         btrfs_free_dummy_root(root);
diff --git a/fs/btrfs/tests/free-space-tree-tests.c b/fs/btrfs/tests/free-space-tree-tests.c
index 7cea4462acd5..aac507085ab0 100644
--- a/fs/btrfs/tests/free-space-tree-tests.c
+++ b/fs/btrfs/tests/free-space-tree-tests.c
@@ -16,6 +16,7 @@
  * Boston, MA 021110-1307, USA.
  */
 
+#include <linux/types.h>
 #include "btrfs-tests.h"
 #include "../ctree.h"
 #include "../disk-io.h"
@@ -30,7 +31,7 @@ struct free_space_extent {
  * The test cases align their operations to this in order to hit some of the
  * edge cases in the bitmap code.
  */
-#define BITMAP_RANGE (BTRFS_FREE_SPACE_BITMAP_BITS * 4096)
+#define BITMAP_RANGE (BTRFS_FREE_SPACE_BITMAP_BITS * PAGE_SIZE)
 
 static int __check_free_space_extents(struct btrfs_trans_handle *trans,
                                       struct btrfs_fs_info *fs_info,
@@ -439,7 +440,8 @@ typedef int (*test_func_t)(struct btrfs_trans_handle *,
                            struct btrfs_block_group_cache *,
                            struct btrfs_path *);
 
-static int run_test(test_func_t test_func, int bitmaps)
+static int run_test(test_func_t test_func, int bitmaps,
+                u32 sectorsize, u32 nodesize)
 {
         struct btrfs_root *root = NULL;
         struct btrfs_block_group_cache *cache = NULL;
@@ -447,7 +449,7 @@ static int run_test(test_func_t test_func, int bitmaps)
         struct btrfs_path *path = NULL;
         int ret;
 
-        root = btrfs_alloc_dummy_root();
+        root = btrfs_alloc_dummy_root(sectorsize, nodesize);
         if (IS_ERR(root)) {
                 test_msg("Couldn't allocate dummy root\n");
                 ret = PTR_ERR(root);
@@ -466,7 +468,8 @@ static int run_test(test_func_t test_func, int bitmaps)
         root->fs_info->free_space_root = root;
         root->fs_info->tree_root = root;
 
-        root->node = alloc_test_extent_buffer(root->fs_info, 4096);
+        root->node = alloc_test_extent_buffer(root->fs_info,
+                nodesize, nodesize);
         if (!root->node) {
                 test_msg("Couldn't allocate dummy buffer\n");
                 ret = -ENOMEM;
@@ -474,9 +477,9 @@ static int run_test(test_func_t test_func, int bitmaps)
         }
         btrfs_set_header_level(root->node, 0);
         btrfs_set_header_nritems(root->node, 0);
-        root->alloc_bytenr += 8192;
+        root->alloc_bytenr += 2 * nodesize;
 
-        cache = btrfs_alloc_dummy_block_group(8 * BITMAP_RANGE);
+        cache = btrfs_alloc_dummy_block_group(8 * BITMAP_RANGE, sectorsize);
         if (!cache) {
                 test_msg("Couldn't allocate dummy block group cache\n");
                 ret = -ENOMEM;
@@ -534,17 +537,18 @@ out:
         return ret;
 }
 
-static int run_test_both_formats(test_func_t test_func)
+static int run_test_both_formats(test_func_t test_func,
+        u32 sectorsize, u32 nodesize)
 {
         int ret;
 
-        ret = run_test(test_func, 0);
+        ret = run_test(test_func, 0, sectorsize, nodesize);
         if (ret)
                 return ret;
-        return run_test(test_func, 1);
+        return run_test(test_func, 1, sectorsize, nodesize);
 }
 
-int btrfs_test_free_space_tree(void)
+int btrfs_test_free_space_tree(u32 sectorsize, u32 nodesize)
 {
         test_func_t tests[] = {
                 test_empty_block_group,
@@ -561,9 +565,11 @@ int btrfs_test_free_space_tree(void)
 
         test_msg("Running free space tree tests\n");
         for (i = 0; i < ARRAY_SIZE(tests); i++) {
-                int ret = run_test_both_formats(tests[i]);
+                int ret = run_test_both_formats(tests[i], sectorsize,
+                        nodesize);
                 if (ret) {
-                        test_msg("%pf failed\n", tests[i]);
+                        test_msg("%pf : sectorsize %u failed\n",
+                                tests[i], sectorsize);
                         return ret;
                 }
         }
diff --git a/fs/btrfs/tests/inode-tests.c b/fs/btrfs/tests/inode-tests.c
index 8a25fe8b7c45..29648c0a39f1 100644
--- a/fs/btrfs/tests/inode-tests.c
+++ b/fs/btrfs/tests/inode-tests.c
@@ -16,6 +16,7 @@
  * Boston, MA 021110-1307, USA.
  */
 
+#include <linux/types.h>
 #include "btrfs-tests.h"
 #include "../ctree.h"
 #include "../btrfs_inode.h"
@@ -86,19 +87,19 @@ static void insert_inode_item_key(struct btrfs_root *root)
  * diagram of how the extents will look though this may not be possible we still
  * want to make sure everything acts normally (the last number is not inclusive)
  *
- * [0 - 5][5 -  6][6 - 10][10 - 4096][  4096 - 8192 ][8192 - 12288]
- * [hole ][inline][ hole ][ regular ][regular1 split][    hole    ]
+ * [0 - 5][5 -  6][     6 - 4096     ][ 4096 - 4100][4100 - 8195][8195 - 12291]
+ * [hole ][inline][hole but no extent][  hole   ][   regular ][regular1 split]
  *
- * [ 12288 - 20480][20480 - 24576][  24576 - 28672  ][28672 - 36864][36864 - 45056]
- * [regular1 split][   prealloc1 ][prealloc1 written][   prealloc1 ][ compressed  ]
+ * [12291 - 16387][16387 - 24579][24579 - 28675][ 28675 - 32771][32771 - 36867 ]
+ * [    hole    ][regular1 split][   prealloc ][   prealloc1  ][prealloc1 written]
  *
- * [45056 - 49152][49152-53248][53248-61440][61440-65536][     65536+81920   ]
- * [ compressed1 ][  regular  ][compressed1][  regular  ][ hole but no extent]
+ * [36867 - 45059][45059 - 53251][53251 - 57347][57347 - 61443][61443- 69635]
+ * [  prealloc1  ][ compressed  ][ compressed1 ][    regular  ][ compressed1]
  *
- * [81920-86016]
- * [  regular  ]
+ * [69635-73731][   73731 - 86019   ][86019-90115]
+ * [  regular  ][ hole but no extent][  regular  ]
  */
-static void setup_file_extents(struct btrfs_root *root)
+static void setup_file_extents(struct btrfs_root *root, u32 sectorsize)
 {
         int slot = 0;
         u64 disk_bytenr = SZ_1M;
@@ -119,7 +120,7 @@ static void setup_file_extents(struct btrfs_root *root)
         insert_extent(root, offset, 1, 1, 0, 0, 0, BTRFS_FILE_EXTENT_INLINE, 0,
                       slot);
         slot++;
-        offset = 4096;
+        offset = sectorsize;
 
         /* Now another hole */
         insert_extent(root, offset, 4, 4, 0, 0, 0, BTRFS_FILE_EXTENT_REG, 0,
@@ -128,99 +129,106 @@ static void setup_file_extents(struct btrfs_root *root)
         offset += 4;
 
         /* Now for a regular extent */
-        insert_extent(root, offset, 4095, 4095, 0, disk_bytenr, 4096,
-                      BTRFS_FILE_EXTENT_REG, 0, slot);
+        insert_extent(root, offset, sectorsize - 1, sectorsize - 1, 0,
+                      disk_bytenr, sectorsize, BTRFS_FILE_EXTENT_REG, 0, slot);
         slot++;
-        disk_bytenr += 4096;
-        offset += 4095;
+        disk_bytenr += sectorsize;
+        offset += sectorsize - 1;
 
         /*
          * Now for 3 extents that were split from a hole punch so we test
          * offsets properly.
          */
-        insert_extent(root, offset, 4096, 16384, 0, disk_bytenr, 16384,
-                      BTRFS_FILE_EXTENT_REG, 0, slot);
+        insert_extent(root, offset, sectorsize, 4 * sectorsize, 0, disk_bytenr,
+                      4 * sectorsize, BTRFS_FILE_EXTENT_REG, 0, slot);
         slot++;
-        offset += 4096;
-        insert_extent(root, offset, 4096, 4096, 0, 0, 0, BTRFS_FILE_EXTENT_REG,
-                      0, slot);
+        offset += sectorsize;
+        insert_extent(root, offset, sectorsize, sectorsize, 0, 0, 0,
+                      BTRFS_FILE_EXTENT_REG, 0, slot);
         slot++;
-        offset += 4096;
-        insert_extent(root, offset, 8192, 16384, 8192, disk_bytenr, 16384,
+        offset += sectorsize;
+        insert_extent(root, offset, 2 * sectorsize, 4 * sectorsize,
+                      2 * sectorsize, disk_bytenr, 4 * sectorsize,
                       BTRFS_FILE_EXTENT_REG, 0, slot);
         slot++;
-        offset += 8192;
-        disk_bytenr += 16384;
+        offset += 2 * sectorsize;
+        disk_bytenr += 4 * sectorsize;
 
         /* Now for a unwritten prealloc extent */
-        insert_extent(root, offset, 4096, 4096, 0, disk_bytenr, 4096,
-                      BTRFS_FILE_EXTENT_PREALLOC, 0, slot);
+        insert_extent(root, offset, sectorsize, sectorsize, 0, disk_bytenr,
+                sectorsize, BTRFS_FILE_EXTENT_PREALLOC, 0, slot);
         slot++;
-        offset += 4096;
+        offset += sectorsize;
 
         /*
          * We want to jack up disk_bytenr a little more so the em stuff doesn't
          * merge our records.
          */
-        disk_bytenr += 8192;
+        disk_bytenr += 2 * sectorsize;
 
         /*
          * Now for a partially written prealloc extent, basically the same as
          * the hole punch example above.  Ram_bytes never changes when you mark
          * extents written btw.
          */
-        insert_extent(root, offset, 4096, 16384, 0, disk_bytenr, 16384,
-                      BTRFS_FILE_EXTENT_PREALLOC, 0, slot);
+        insert_extent(root, offset, sectorsize, 4 * sectorsize, 0, disk_bytenr,
+                      4 * sectorsize, BTRFS_FILE_EXTENT_PREALLOC, 0, slot);
         slot++;
-        offset += 4096;
-        insert_extent(root, offset, 4096, 16384, 4096, disk_bytenr, 16384,
-                      BTRFS_FILE_EXTENT_REG, 0, slot);
+        offset += sectorsize;
+        insert_extent(root, offset, sectorsize, 4 * sectorsize, sectorsize,
+                      disk_bytenr, 4 * sectorsize, BTRFS_FILE_EXTENT_REG, 0,
+                      slot);
         slot++;
-        offset += 4096;
-        insert_extent(root, offset, 8192, 16384, 8192, disk_bytenr, 16384,
+        offset += sectorsize;
+        insert_extent(root, offset, 2 * sectorsize, 4 * sectorsize,
+                      2 * sectorsize, disk_bytenr, 4 * sectorsize,
                       BTRFS_FILE_EXTENT_PREALLOC, 0, slot);
         slot++;
-        offset += 8192;
-        disk_bytenr += 16384;
+        offset += 2 * sectorsize;
+        disk_bytenr += 4 * sectorsize;
 
         /* Now a normal compressed extent */
-        insert_extent(root, offset, 8192, 8192, 0, disk_bytenr, 4096,
-                      BTRFS_FILE_EXTENT_REG, BTRFS_COMPRESS_ZLIB, slot);
+        insert_extent(root, offset, 2 * sectorsize, 2 * sectorsize, 0,
+                      disk_bytenr, sectorsize, BTRFS_FILE_EXTENT_REG,
+                      BTRFS_COMPRESS_ZLIB, slot);
         slot++;
-        offset += 8192;
+        offset += 2 * sectorsize;
         /* No merges */
-        disk_bytenr += 8192;
+        disk_bytenr += 2 * sectorsize;
 
         /* Now a split compressed extent */
-        insert_extent(root, offset, 4096, 16384, 0, disk_bytenr, 4096,
-                      BTRFS_FILE_EXTENT_REG, BTRFS_COMPRESS_ZLIB, slot);
+        insert_extent(root, offset, sectorsize, 4 * sectorsize, 0, disk_bytenr,
+                      sectorsize, BTRFS_FILE_EXTENT_REG,
+                      BTRFS_COMPRESS_ZLIB, slot);
         slot++;
-        offset += 4096;
-        insert_extent(root, offset, 4096, 4096, 0, disk_bytenr + 4096, 4096,
+        offset += sectorsize;
+        insert_extent(root, offset, sectorsize, sectorsize, 0,
+                      disk_bytenr + sectorsize, sectorsize,
                       BTRFS_FILE_EXTENT_REG, 0, slot);
         slot++;
-        offset += 4096;
-        insert_extent(root, offset, 8192, 16384, 8192, disk_bytenr, 4096,
+        offset += sectorsize;
+        insert_extent(root, offset, 2 * sectorsize, 4 * sectorsize,
+                      2 * sectorsize, disk_bytenr, sectorsize,
                       BTRFS_FILE_EXTENT_REG, BTRFS_COMPRESS_ZLIB, slot);
         slot++;
-        offset += 8192;
-        disk_bytenr += 8192;
+        offset += 2 * sectorsize;
+        disk_bytenr += 2 * sectorsize;
 
         /* Now extents that have a hole but no hole extent */
-        insert_extent(root, offset, 4096, 4096, 0, disk_bytenr, 4096,
-                      BTRFS_FILE_EXTENT_REG, 0, slot);
+        insert_extent(root, offset, sectorsize, sectorsize, 0, disk_bytenr,
+                      sectorsize, BTRFS_FILE_EXTENT_REG, 0, slot);
         slot++;
-        offset += 16384;
-        disk_bytenr += 4096;
-        insert_extent(root, offset, 4096, 4096, 0, disk_bytenr, 4096,
-                      BTRFS_FILE_EXTENT_REG, 0, slot);
+        offset += 4 * sectorsize;
+        disk_bytenr += sectorsize;
+        insert_extent(root, offset, sectorsize, sectorsize, 0, disk_bytenr,
+                      sectorsize, BTRFS_FILE_EXTENT_REG, 0, slot);
 }
 
 static unsigned long prealloc_only = 0;
 static unsigned long compressed_only = 0;
 static unsigned long vacancy_only = 0;
 
-static noinline int test_btrfs_get_extent(void)
+static noinline int test_btrfs_get_extent(u32 sectorsize, u32 nodesize)
 {
         struct inode *inode = NULL;
         struct btrfs_root *root = NULL;
@@ -240,7 +248,7 @@ static noinline int test_btrfs_get_extent(void)
         BTRFS_I(inode)->location.objectid = BTRFS_FIRST_FREE_OBJECTID;
         BTRFS_I(inode)->location.offset = 0;
 
-        root = btrfs_alloc_dummy_root();
+        root = btrfs_alloc_dummy_root(sectorsize, nodesize);
         if (IS_ERR(root)) {
                 test_msg("Couldn't allocate root\n");
                 goto out;
@@ -256,7 +264,7 @@ static noinline int test_btrfs_get_extent(void)
                 goto out;
         }
 
-        root->node = alloc_dummy_extent_buffer(NULL, 4096);
+        root->node = alloc_dummy_extent_buffer(NULL, nodesize, nodesize);
         if (!root->node) {
                 test_msg("Couldn't allocate dummy buffer\n");
                 goto out;
@@ -273,7 +281,7 @@ static noinline int test_btrfs_get_extent(void)
 
         /* First with no extents */
         BTRFS_I(inode)->root = root;
-        em = btrfs_get_extent(inode, NULL, 0, 0, 4096, 0);
+        em = btrfs_get_extent(inode, NULL, 0, 0, sectorsize, 0);
         if (IS_ERR(em)) {
                 em = NULL;
                 test_msg("Got an error when we shouldn't have\n");
@@ -295,7 +303,7 @@ static noinline int test_btrfs_get_extent(void)
          * setup_file_extents, so if you change anything there you need to
          * update the comment and update the expected values below.
          */
-        setup_file_extents(root);
+        setup_file_extents(root, sectorsize);
 
         em = btrfs_get_extent(inode, NULL, 0, 0, (u64)-1, 0);
         if (IS_ERR(em)) {
@@ -318,7 +326,7 @@ static noinline int test_btrfs_get_extent(void)
         offset = em->start + em->len;
         free_extent_map(em);
 
-        em = btrfs_get_extent(inode, NULL, 0, offset, 4096, 0);
+        em = btrfs_get_extent(inode, NULL, 0, offset, sectorsize, 0);
         if (IS_ERR(em)) {
                 test_msg("Got an error when we shouldn't have\n");
                 goto out;
@@ -327,7 +335,8 @@ static noinline int test_btrfs_get_extent(void)
                 test_msg("Expected an inline, got %llu\n", em->block_start);
                 goto out;
         }
-        if (em->start != offset || em->len != 4091) {
+
+        if (em->start != offset || em->len != (sectorsize - 5)) {
                 test_msg("Unexpected extent wanted start %llu len 1, got start "
                          "%llu len %llu\n", offset, em->start, em->len);
                 goto out;
@@ -344,7 +353,7 @@ static noinline int test_btrfs_get_extent(void)
         offset = em->start + em->len;
         free_extent_map(em);
 
-        em = btrfs_get_extent(inode, NULL, 0, offset, 4096, 0);
+        em = btrfs_get_extent(inode, NULL, 0, offset, sectorsize, 0);
         if (IS_ERR(em)) {
                 test_msg("Got an error when we shouldn't have\n");
                 goto out;
@@ -366,7 +375,7 @@ static noinline int test_btrfs_get_extent(void)
         free_extent_map(em);
 
         /* Regular extent */
-        em = btrfs_get_extent(inode, NULL, 0, offset, 4096, 0);
+        em = btrfs_get_extent(inode, NULL, 0, offset, sectorsize, 0);
         if (IS_ERR(em)) {
                 test_msg("Got an error when we shouldn't have\n");
                 goto out;
@@ -375,7 +384,7 @@ static noinline int test_btrfs_get_extent(void)
                 test_msg("Expected a real extent, got %llu\n", em->block_start);
                 goto out;
         }
-        if (em->start != offset || em->len != 4095) {
+        if (em->start != offset || em->len != sectorsize - 1) {
                 test_msg("Unexpected extent wanted start %llu len 4095, got "
                          "start %llu len %llu\n", offset, em->start, em->len);
                 goto out;
@@ -393,7 +402,7 @@ static noinline int test_btrfs_get_extent(void)
         free_extent_map(em);
 
         /* The next 3 are split extents */
-        em = btrfs_get_extent(inode, NULL, 0, offset, 4096, 0);
+        em = btrfs_get_extent(inode, NULL, 0, offset, sectorsize, 0);
         if (IS_ERR(em)) {
                 test_msg("Got an error when we shouldn't have\n");
                 goto out;
@@ -402,9 +411,10 @@ static noinline int test_btrfs_get_extent(void)
                 test_msg("Expected a real extent, got %llu\n", em->block_start);
                 goto out;
         }
-        if (em->start != offset || em->len != 4096) {
-                test_msg("Unexpected extent wanted start %llu len 4096, got "
-                         "start %llu len %llu\n", offset, em->start, em->len);
+        if (em->start != offset || em->len != sectorsize) {
+                test_msg("Unexpected extent start %llu len %u, "
+                        "got start %llu len %llu\n",
+                        offset, sectorsize, em->start, em->len);
                 goto out;
         }
         if (em->flags != 0) {
@@ -421,7 +431,7 @@ static noinline int test_btrfs_get_extent(void)
         offset = em->start + em->len;
         free_extent_map(em);
 
-        em = btrfs_get_extent(inode, NULL, 0, offset, 4096, 0);
+        em = btrfs_get_extent(inode, NULL, 0, offset, sectorsize, 0);
         if (IS_ERR(em)) {
                 test_msg("Got an error when we shouldn't have\n");
                 goto out;
@@ -430,9 +440,10 @@ static noinline int test_btrfs_get_extent(void)
                 test_msg("Expected a hole, got %llu\n", em->block_start);
                 goto out;
         }
-        if (em->start != offset || em->len != 4096) {
-                test_msg("Unexpected extent wanted start %llu len 4096, got "
-                         "start %llu len %llu\n", offset, em->start, em->len);
+        if (em->start != offset || em->len != sectorsize) {
+                test_msg("Unexpected extent wanted start %llu len %u, "
+                        "got start %llu len %llu\n",
+                        offset, sectorsize, em->start, em->len);
                 goto out;
         }
         if (em->flags != 0) {
@@ -442,7 +453,7 @@ static noinline int test_btrfs_get_extent(void)
         offset = em->start + em->len;
         free_extent_map(em);
 
-        em = btrfs_get_extent(inode, NULL, 0, offset, 4096, 0);
+        em = btrfs_get_extent(inode, NULL, 0, offset, sectorsize, 0);
         if (IS_ERR(em)) {
                 test_msg("Got an error when we shouldn't have\n");
                 goto out;
@@ -451,9 +462,10 @@ static noinline int test_btrfs_get_extent(void)
                 test_msg("Expected a real extent, got %llu\n", em->block_start);
                 goto out;
         }
-        if (em->start != offset || em->len != 8192) {
-                test_msg("Unexpected extent wanted start %llu len 8192, got "
-                         "start %llu len %llu\n", offset, em->start, em->len);
+        if (em->start != offset || em->len != 2 * sectorsize) {
+                test_msg("Unexpected extent wanted start %llu len %u, "
+                        "got start %llu len %llu\n",
+                        offset, 2 * sectorsize, em->start, em->len);
                 goto out;
         }
         if (em->flags != 0) {
@@ -475,7 +487,7 @@ static noinline int test_btrfs_get_extent(void)
         free_extent_map(em);
 
         /* Prealloc extent */
-        em = btrfs_get_extent(inode, NULL, 0, offset, 4096, 0);
+        em = btrfs_get_extent(inode, NULL, 0, offset, sectorsize, 0);
         if (IS_ERR(em)) {
                 test_msg("Got an error when we shouldn't have\n");
                 goto out;
@@ -484,9 +496,10 @@ static noinline int test_btrfs_get_extent(void)
                 test_msg("Expected a real extent, got %llu\n", em->block_start);
                 goto out;
         }
-        if (em->start != offset || em->len != 4096) {
-                test_msg("Unexpected extent wanted start %llu len 4096, got "
-                         "start %llu len %llu\n", offset, em->start, em->len);
+        if (em->start != offset || em->len != sectorsize) {
+                test_msg("Unexpected extent wanted start %llu len %u, "
+                        "got start %llu len %llu\n",
+                        offset, sectorsize, em->start, em->len);
                 goto out;
         }
         if (em->flags != prealloc_only) {
@@ -503,7 +516,7 @@ static noinline int test_btrfs_get_extent(void)
         free_extent_map(em);
 
         /* The next 3 are a half written prealloc extent */
-        em = btrfs_get_extent(inode, NULL, 0, offset, 4096, 0);
+        em = btrfs_get_extent(inode, NULL, 0, offset, sectorsize, 0);
         if (IS_ERR(em)) {
                 test_msg("Got an error when we shouldn't have\n");
                 goto out;
@@ -512,9 +525,10 @@ static noinline int test_btrfs_get_extent(void)
                 test_msg("Expected a real extent, got %llu\n", em->block_start);
                 goto out;
         }
-        if (em->start != offset || em->len != 4096) {
-                test_msg("Unexpected extent wanted start %llu len 4096, got "
-                         "start %llu len %llu\n", offset, em->start, em->len);
+        if (em->start != offset || em->len != sectorsize) {
+                test_msg("Unexpected extent wanted start %llu len %u, "
+                        "got start %llu len %llu\n",
+                        offset, sectorsize, em->start, em->len);
                 goto out;
         }
         if (em->flags != prealloc_only) {
@@ -532,7 +546,7 @@ static noinline int test_btrfs_get_extent(void)
         offset = em->start + em->len;
         free_extent_map(em);
 
-        em = btrfs_get_extent(inode, NULL, 0, offset, 4096, 0);
+        em = btrfs_get_extent(inode, NULL, 0, offset, sectorsize, 0);
         if (IS_ERR(em)) {
                 test_msg("Got an error when we shouldn't have\n");
                 goto out;
@@ -541,9 +555,10 @@ static noinline int test_btrfs_get_extent(void)
                 test_msg("Expected a real extent, got %llu\n", em->block_start);
                 goto out;
         }
-        if (em->start != offset || em->len != 4096) {
-                test_msg("Unexpected extent wanted start %llu len 4096, got "
-                         "start %llu len %llu\n", offset, em->start, em->len);
+        if (em->start != offset || em->len != sectorsize) {
+                test_msg("Unexpected extent wanted start %llu len %u, "
+                        "got start %llu len %llu\n",
+                        offset, sectorsize, em->start, em->len);
                 goto out;
         }
         if (em->flags != 0) {
@@ -564,7 +579,7 @@ static noinline int test_btrfs_get_extent(void)
         offset = em->start + em->len;
         free_extent_map(em);
 
-        em = btrfs_get_extent(inode, NULL, 0, offset, 4096, 0);
+        em = btrfs_get_extent(inode, NULL, 0, offset, sectorsize, 0);
         if (IS_ERR(em)) {
                 test_msg("Got an error when we shouldn't have\n");
                 goto out;
@@ -573,9 +588,10 @@ static noinline int test_btrfs_get_extent(void)
                 test_msg("Expected a real extent, got %llu\n", em->block_start);
                 goto out;
         }
-        if (em->start != offset || em->len != 8192) {
-                test_msg("Unexpected extent wanted start %llu len 8192, got "
-                         "start %llu len %llu\n", offset, em->start, em->len);
+        if (em->start != offset || em->len != 2 * sectorsize) {
+                test_msg("Unexpected extent wanted start %llu len %u, "
+                        "got start %llu len %llu\n",
+                        offset, 2 * sectorsize, em->start, em->len);
                 goto out;
         }
         if (em->flags != prealloc_only) {
@@ -598,7 +614,7 @@ static noinline int test_btrfs_get_extent(void)
         free_extent_map(em);
 
         /* Now for the compressed extent */
-        em = btrfs_get_extent(inode, NULL, 0, offset, 4096, 0);
+        em = btrfs_get_extent(inode, NULL, 0, offset, sectorsize, 0);
         if (IS_ERR(em)) {
                 test_msg("Got an error when we shouldn't have\n");
                 goto out;
@@ -607,9 +623,10 @@ static noinline int test_btrfs_get_extent(void)
                 test_msg("Expected a real extent, got %llu\n", em->block_start);
                 goto out;
         }
-        if (em->start != offset || em->len != 8192) {
-                test_msg("Unexpected extent wanted start %llu len 8192, got "
-                         "start %llu len %llu\n", offset, em->start, em->len);
+        if (em->start != offset || em->len != 2 * sectorsize) {
+                test_msg("Unexpected extent wanted start %llu len %u,"
+                        "got start %llu len %llu\n",
+                        offset, 2 * sectorsize, em->start, em->len);
                 goto out;
         }
         if (em->flags != compressed_only) {
@@ -631,7 +648,7 @@ static noinline int test_btrfs_get_extent(void)
         free_extent_map(em);
 
         /* Split compressed extent */
-        em = btrfs_get_extent(inode, NULL, 0, offset, 4096, 0);
+        em = btrfs_get_extent(inode, NULL, 0, offset, sectorsize, 0);
         if (IS_ERR(em)) {
                 test_msg("Got an error when we shouldn't have\n");
                 goto out;
@@ -640,9 +657,10 @@ static noinline int test_btrfs_get_extent(void)
                 test_msg("Expected a real extent, got %llu\n", em->block_start);
                 goto out;
         }
-        if (em->start != offset || em->len != 4096) {
-                test_msg("Unexpected extent wanted start %llu len 4096, got "
-                         "start %llu len %llu\n", offset, em->start, em->len);
+        if (em->start != offset || em->len != sectorsize) {
+                test_msg("Unexpected extent wanted start %llu len %u,"
+                        "got start %llu len %llu\n",
+                        offset, sectorsize, em->start, em->len);
                 goto out;
         }
         if (em->flags != compressed_only) {
@@ -665,7 +683,7 @@ static noinline int test_btrfs_get_extent(void)
         offset = em->start + em->len;
         free_extent_map(em);
 
-        em = btrfs_get_extent(inode, NULL, 0, offset, 4096, 0);
+        em = btrfs_get_extent(inode, NULL, 0, offset, sectorsize, 0);
         if (IS_ERR(em)) {
                 test_msg("Got an error when we shouldn't have\n");
                 goto out;
@@ -674,9 +692,10 @@ static noinline int test_btrfs_get_extent(void)
                 test_msg("Expected a real extent, got %llu\n", em->block_start);
                 goto out;
         }
-        if (em->start != offset || em->len != 4096) {
-                test_msg("Unexpected extent wanted start %llu len 4096, got "
-                         "start %llu len %llu\n", offset, em->start, em->len);
+        if (em->start != offset || em->len != sectorsize) {
+                test_msg("Unexpected extent wanted start %llu len %u, "
+                        "got start %llu len %llu\n",
+                        offset, sectorsize, em->start, em->len);
                 goto out;
         }
         if (em->flags != 0) {
@@ -691,7 +710,7 @@ static noinline int test_btrfs_get_extent(void)
         offset = em->start + em->len;
         free_extent_map(em);
 
-        em = btrfs_get_extent(inode, NULL, 0, offset, 4096, 0);
+        em = btrfs_get_extent(inode, NULL, 0, offset, sectorsize, 0);
         if (IS_ERR(em)) {
                 test_msg("Got an error when we shouldn't have\n");
                 goto out;
@@ -701,9 +720,10 @@ static noinline int test_btrfs_get_extent(void)
                          disk_bytenr, em->block_start);
                 goto out;
         }
-        if (em->start != offset || em->len != 8192) {
-                test_msg("Unexpected extent wanted start %llu len 8192, got "
-                         "start %llu len %llu\n", offset, em->start, em->len);
+        if (em->start != offset || em->len != 2 * sectorsize) {
+                test_msg("Unexpected extent wanted start %llu len %u, "
+                        "got start %llu len %llu\n",
+                        offset, 2 * sectorsize, em->start, em->len);
                 goto out;
         }
         if (em->flags != compressed_only) {
@@ -725,7 +745,7 @@ static noinline int test_btrfs_get_extent(void)
         free_extent_map(em);
 
         /* A hole between regular extents but no hole extent */
-        em = btrfs_get_extent(inode, NULL, 0, offset + 6, 4096, 0);
+        em = btrfs_get_extent(inode, NULL, 0, offset + 6, sectorsize, 0);
         if (IS_ERR(em)) {
                 test_msg("Got an error when we shouldn't have\n");
                 goto out;
@@ -734,9 +754,10 @@ static noinline int test_btrfs_get_extent(void)
                 test_msg("Expected a real extent, got %llu\n", em->block_start);
                 goto out;
         }
-        if (em->start != offset || em->len != 4096) {
-                test_msg("Unexpected extent wanted start %llu len 4096, got "
-                         "start %llu len %llu\n", offset, em->start, em->len);
+        if (em->start != offset || em->len != sectorsize) {
+                test_msg("Unexpected extent wanted start %llu len %u, "
+                        "got start %llu len %llu\n",
+                        offset, sectorsize, em->start, em->len);
                 goto out;
         }
         if (em->flags != 0) {
@@ -765,9 +786,10 @@ static noinline int test_btrfs_get_extent(void)
          * length of the actual hole, if this changes we'll have to change this
          * test.
          */
-        if (em->start != offset || em->len != 12288) {
-                test_msg("Unexpected extent wanted start %llu len 12288, got "
-                         "start %llu len %llu\n", offset, em->start, em->len);
+        if (em->start != offset || em->len != 3 * sectorsize) {
+                test_msg("Unexpected extent wanted start %llu len %u, "
+                        "got start %llu len %llu\n",
+                        offset, 3 * sectorsize, em->start, em->len);
                 goto out;
         }
         if (em->flags != vacancy_only) {
@@ -783,7 +805,7 @@ static noinline int test_btrfs_get_extent(void)
         offset = em->start + em->len;
         free_extent_map(em);
 
-        em = btrfs_get_extent(inode, NULL, 0, offset, 4096, 0);
+        em = btrfs_get_extent(inode, NULL, 0, offset, sectorsize, 0);
         if (IS_ERR(em)) {
                 test_msg("Got an error when we shouldn't have\n");
                 goto out;
@@ -792,9 +814,10 @@ static noinline int test_btrfs_get_extent(void)
                 test_msg("Expected a real extent, got %llu\n", em->block_start);
                 goto out;
         }
-        if (em->start != offset || em->len != 4096) {
-                test_msg("Unexpected extent wanted start %llu len 4096, got "
-                         "start %llu len %llu\n", offset, em->start, em->len);
+        if (em->start != offset || em->len != sectorsize) {
+                test_msg("Unexpected extent wanted start %llu len %u,"
+                        "got start %llu len %llu\n",
+                        offset, sectorsize, em->start, em->len);
                 goto out;
         }
         if (em->flags != 0) {
@@ -815,7 +838,7 @@ out:
         return ret;
 }
 
-static int test_hole_first(void)
+static int test_hole_first(u32 sectorsize, u32 nodesize)
 {
         struct inode *inode = NULL;
         struct btrfs_root *root = NULL;
@@ -832,7 +855,7 @@ static int test_hole_first(void)
         BTRFS_I(inode)->location.objectid = BTRFS_FIRST_FREE_OBJECTID;
         BTRFS_I(inode)->location.offset = 0;
 
-        root = btrfs_alloc_dummy_root();
+        root = btrfs_alloc_dummy_root(sectorsize, nodesize);
         if (IS_ERR(root)) {
                 test_msg("Couldn't allocate root\n");
                 goto out;
@@ -844,7 +867,7 @@ static int test_hole_first(void)
                 goto out;
         }
 
-        root->node = alloc_dummy_extent_buffer(NULL, 4096);
+        root->node = alloc_dummy_extent_buffer(NULL, nodesize, nodesize);
         if (!root->node) {
                 test_msg("Couldn't allocate dummy buffer\n");
                 goto out;
@@ -861,9 +884,9 @@ static int test_hole_first(void)
          * btrfs_get_extent.
          */
         insert_inode_item_key(root);
-        insert_extent(root, 4096, 4096, 4096, 0, 4096, 4096,
-                      BTRFS_FILE_EXTENT_REG, 0, 1);
-        em = btrfs_get_extent(inode, NULL, 0, 0, 8192, 0);
+        insert_extent(root, sectorsize, sectorsize, sectorsize, 0, sectorsize,
+                      sectorsize, BTRFS_FILE_EXTENT_REG, 0, 1);
+        em = btrfs_get_extent(inode, NULL, 0, 0, 2 * sectorsize, 0);
         if (IS_ERR(em)) {
                 test_msg("Got an error when we shouldn't have\n");
                 goto out;
@@ -872,9 +895,10 @@ static int test_hole_first(void)
                 test_msg("Expected a hole, got %llu\n", em->block_start);
                 goto out;
         }
-        if (em->start != 0 || em->len != 4096) {
-                test_msg("Unexpected extent wanted start 0 len 4096, got start "
-                         "%llu len %llu\n", em->start, em->len);
+        if (em->start != 0 || em->len != sectorsize) {
+                test_msg("Unexpected extent wanted start 0 len %u, "
+                        "got start %llu len %llu\n",
+                        sectorsize, em->start, em->len);
                 goto out;
         }
         if (em->flags != vacancy_only) {
@@ -884,18 +908,19 @@ static int test_hole_first(void)
         }
         free_extent_map(em);
 
-        em = btrfs_get_extent(inode, NULL, 0, 4096, 8192, 0);
+        em = btrfs_get_extent(inode, NULL, 0, sectorsize, 2 * sectorsize, 0);
         if (IS_ERR(em)) {
                 test_msg("Got an error when we shouldn't have\n");
                 goto out;
         }
-        if (em->block_start != 4096) {
+        if (em->block_start != sectorsize) {
                 test_msg("Expected a real extent, got %llu\n", em->block_start);
                 goto out;
         }
-        if (em->start != 4096 || em->len != 4096) {
-                test_msg("Unexpected extent wanted start 4096 len 4096, got "
-                         "start %llu len %llu\n", em->start, em->len);
+        if (em->start != sectorsize || em->len != sectorsize) {
+                test_msg("Unexpected extent wanted start %u len %u, "
+                        "got start %llu len %llu\n",
+                        sectorsize, sectorsize, em->start, em->len);
                 goto out;
         }
         if (em->flags != 0) {
@@ -912,7 +937,7 @@ out:
         return ret;
 }
 
-static int test_extent_accounting(void)
+static int test_extent_accounting(u32 sectorsize, u32 nodesize)
 {
         struct inode *inode = NULL;
         struct btrfs_root *root = NULL;
@@ -924,7 +949,7 @@ static int test_extent_accounting(void)
                 return ret;
         }
 
-        root = btrfs_alloc_dummy_root();
+        root = btrfs_alloc_dummy_root(sectorsize, nodesize);
         if (IS_ERR(root)) {
                 test_msg("Couldn't allocate root\n");
                 goto out;
@@ -954,10 +979,11 @@ static int test_extent_accounting(void)
                 goto out;
         }
 
-        /* [BTRFS_MAX_EXTENT_SIZE][4k] */
+        /* [BTRFS_MAX_EXTENT_SIZE][sectorsize] */
         BTRFS_I(inode)->outstanding_extents++;
         ret = btrfs_set_extent_delalloc(inode, BTRFS_MAX_EXTENT_SIZE,
-                                        BTRFS_MAX_EXTENT_SIZE + 4095, NULL);
+                                        BTRFS_MAX_EXTENT_SIZE + sectorsize - 1,
+                                        NULL);
         if (ret) {
                 test_msg("btrfs_set_extent_delalloc returned %d\n", ret);
                 goto out;
@@ -969,10 +995,10 @@ static int test_extent_accounting(void)
                 goto out;
         }
 
-        /* [BTRFS_MAX_EXTENT_SIZE/2][4K HOLE][the rest] */
+        /* [BTRFS_MAX_EXTENT_SIZE/2][sectorsize HOLE][the rest] */
         ret = clear_extent_bit(&BTRFS_I(inode)->io_tree,
                                BTRFS_MAX_EXTENT_SIZE >> 1,
-                               (BTRFS_MAX_EXTENT_SIZE >> 1) + 4095,
+                               (BTRFS_MAX_EXTENT_SIZE >> 1) + sectorsize - 1,
                                EXTENT_DELALLOC | EXTENT_DIRTY |
                                EXTENT_UPTODATE | EXTENT_DO_ACCOUNTING, 0, 0,
                                NULL, GFP_KERNEL);
@@ -987,10 +1013,11 @@ static int test_extent_accounting(void)
                 goto out;
         }
 
-        /* [BTRFS_MAX_EXTENT_SIZE][4K] */
+        /* [BTRFS_MAX_EXTENT_SIZE][sectorsize] */
         BTRFS_I(inode)->outstanding_extents++;
         ret = btrfs_set_extent_delalloc(inode, BTRFS_MAX_EXTENT_SIZE >> 1,
-                                        (BTRFS_MAX_EXTENT_SIZE >> 1) + 4095,
+                                        (BTRFS_MAX_EXTENT_SIZE >> 1)
+                                        + sectorsize - 1,
                                         NULL);
         if (ret) {
                 test_msg("btrfs_set_extent_delalloc returned %d\n", ret);
@@ -1004,16 +1031,17 @@ static int test_extent_accounting(void)
         }
 
         /*
-         * [BTRFS_MAX_EXTENT_SIZE+4K][4K HOLE][BTRFS_MAX_EXTENT_SIZE+4K]
+         * [BTRFS_MAX_EXTENT_SIZE+sectorsize][sectorsize HOLE][BTRFS_MAX_EXTENT_SIZE+sectorsize]
          *
          * I'm artificially adding 2 to outstanding_extents because in the
          * buffered IO case we'd add things up as we go, but I don't feel like
          * doing that here, this isn't the interesting case we want to test.
          */
         BTRFS_I(inode)->outstanding_extents += 2;
-        ret = btrfs_set_extent_delalloc(inode, BTRFS_MAX_EXTENT_SIZE + 8192,
-                                        (BTRFS_MAX_EXTENT_SIZE << 1) + 12287,
-                                        NULL);
+        ret = btrfs_set_extent_delalloc(inode,
+                        BTRFS_MAX_EXTENT_SIZE + 2 * sectorsize,
+                        (BTRFS_MAX_EXTENT_SIZE << 1) + 3 * sectorsize - 1,
+                        NULL);
         if (ret) {
                 test_msg("btrfs_set_extent_delalloc returned %d\n", ret);
                 goto out;
@@ -1025,10 +1053,13 @@ static int test_extent_accounting(void)
                 goto out;
         }
 
-        /* [BTRFS_MAX_EXTENT_SIZE+4k][4k][BTRFS_MAX_EXTENT_SIZE+4k] */
+        /*
+        * [BTRFS_MAX_EXTENT_SIZE+sectorsize][sectorsize][BTRFS_MAX_EXTENT_SIZE+sectorsize]
+        */
         BTRFS_I(inode)->outstanding_extents++;
-        ret = btrfs_set_extent_delalloc(inode, BTRFS_MAX_EXTENT_SIZE+4096,
-                                        BTRFS_MAX_EXTENT_SIZE+8191, NULL);
+        ret = btrfs_set_extent_delalloc(inode,
+                        BTRFS_MAX_EXTENT_SIZE + sectorsize,
+                        BTRFS_MAX_EXTENT_SIZE + 2 * sectorsize - 1, NULL);
         if (ret) {
                 test_msg("btrfs_set_extent_delalloc returned %d\n", ret);
                 goto out;
@@ -1042,8 +1073,8 @@ static int test_extent_accounting(void)
 
         /* [BTRFS_MAX_EXTENT_SIZE+4k][4K HOLE][BTRFS_MAX_EXTENT_SIZE+4k] */
         ret = clear_extent_bit(&BTRFS_I(inode)->io_tree,
-                               BTRFS_MAX_EXTENT_SIZE+4096,
-                               BTRFS_MAX_EXTENT_SIZE+8191,
+                               BTRFS_MAX_EXTENT_SIZE + sectorsize,
+                               BTRFS_MAX_EXTENT_SIZE + 2 * sectorsize - 1,
                                EXTENT_DIRTY | EXTENT_DELALLOC |
                                EXTENT_DO_ACCOUNTING | EXTENT_UPTODATE, 0, 0,
                                NULL, GFP_KERNEL);
@@ -1063,8 +1094,9 @@ static int test_extent_accounting(void)
          * might fail and I'd rather satisfy my paranoia at this point.
          */
         BTRFS_I(inode)->outstanding_extents++;
-        ret = btrfs_set_extent_delalloc(inode, BTRFS_MAX_EXTENT_SIZE+4096,
-                                        BTRFS_MAX_EXTENT_SIZE+8191, NULL);
+        ret = btrfs_set_extent_delalloc(inode,
+                        BTRFS_MAX_EXTENT_SIZE + sectorsize,
+                        BTRFS_MAX_EXTENT_SIZE + 2 * sectorsize - 1, NULL);
         if (ret) {
                 test_msg("btrfs_set_extent_delalloc returned %d\n", ret);
                 goto out;
@@ -1103,7 +1135,7 @@ out:
         return ret;
 }
 
-int btrfs_test_inodes(void)
+int btrfs_test_inodes(u32 sectorsize, u32 nodesize)
 {
         int ret;
 
@@ -1112,13 +1144,13 @@ int btrfs_test_inodes(void)
         set_bit(EXTENT_FLAG_PREALLOC, &prealloc_only);
 
         test_msg("Running btrfs_get_extent tests\n");
-        ret = test_btrfs_get_extent();
+        ret = test_btrfs_get_extent(sectorsize, nodesize);
         if (ret)
                 return ret;
         test_msg("Running hole first btrfs_get_extent test\n");
-        ret = test_hole_first();
+        ret = test_hole_first(sectorsize, nodesize);
         if (ret)
                 return ret;
         test_msg("Running outstanding_extents tests\n");
-        return test_extent_accounting();
+        return test_extent_accounting(sectorsize, nodesize);
 }
diff --git a/fs/btrfs/tests/qgroup-tests.c b/fs/btrfs/tests/qgroup-tests.c
index 8aa4ded31326..57a12c0d680b 100644
--- a/fs/btrfs/tests/qgroup-tests.c
+++ b/fs/btrfs/tests/qgroup-tests.c
@@ -16,6 +16,7 @@
  * Boston, MA 021110-1307, USA.
  */
 
+#include <linux/types.h>
 #include "btrfs-tests.h"
 #include "../ctree.h"
 #include "../transaction.h"
@@ -216,7 +217,8 @@ static int remove_extent_ref(struct btrfs_root *root, u64 bytenr,
         return ret;
 }
 
-static int test_no_shared_qgroup(struct btrfs_root *root)
+static int test_no_shared_qgroup(struct btrfs_root *root,
+                u32 sectorsize, u32 nodesize)
 {
         struct btrfs_trans_handle trans;
         struct btrfs_fs_info *fs_info = root->fs_info;
@@ -227,7 +229,7 @@ static int test_no_shared_qgroup(struct btrfs_root *root)
         btrfs_init_dummy_trans(&trans);
 
         test_msg("Qgroup basic add\n");
-        ret = btrfs_create_qgroup(NULL, fs_info, 5);
+        ret = btrfs_create_qgroup(NULL, fs_info, BTRFS_FS_TREE_OBJECTID);
         if (ret) {
                 test_msg("Couldn't create a qgroup %d\n", ret);
                 return ret;
@@ -238,18 +240,19 @@ static int test_no_shared_qgroup(struct btrfs_root *root)
          * we can only call btrfs_qgroup_account_extent() directly to test
          * quota.
          */
-        ret = btrfs_find_all_roots(&trans, fs_info, 4096, 0, &old_roots);
+        ret = btrfs_find_all_roots(&trans, fs_info, nodesize, 0, &old_roots);
         if (ret) {
                 ulist_free(old_roots);
                 test_msg("Couldn't find old roots: %d\n", ret);
                 return ret;
         }
 
-        ret = insert_normal_tree_ref(root, 4096, 4096, 0, 5);
+        ret = insert_normal_tree_ref(root, nodesize, nodesize, 0,
+                                BTRFS_FS_TREE_OBJECTID);
         if (ret)
                 return ret;
 
-        ret = btrfs_find_all_roots(&trans, fs_info, 4096, 0, &new_roots);
+        ret = btrfs_find_all_roots(&trans, fs_info, nodesize, 0, &new_roots);
         if (ret) {
                 ulist_free(old_roots);
                 ulist_free(new_roots);
@@ -257,32 +260,33 @@ static int test_no_shared_qgroup(struct btrfs_root *root)
                 return ret;
         }
 
-        ret = btrfs_qgroup_account_extent(&trans, fs_info, 4096, 4096,
-                                          old_roots, new_roots);
+        ret = btrfs_qgroup_account_extent(&trans, fs_info, nodesize,
+                                          nodesize, old_roots, new_roots);
         if (ret) {
                 test_msg("Couldn't account space for a qgroup %d\n", ret);
                 return ret;
         }
 
-        if (btrfs_verify_qgroup_counts(fs_info, 5, 4096, 4096)) {
+        if (btrfs_verify_qgroup_counts(fs_info, BTRFS_FS_TREE_OBJECTID,
+                                nodesize, nodesize)) {
                 test_msg("Qgroup counts didn't match expected values\n");
                 return -EINVAL;
         }
         old_roots = NULL;
         new_roots = NULL;
 
-        ret = btrfs_find_all_roots(&trans, fs_info, 4096, 0, &old_roots);
+        ret = btrfs_find_all_roots(&trans, fs_info, nodesize, 0, &old_roots);
         if (ret) {
                 ulist_free(old_roots);
                 test_msg("Couldn't find old roots: %d\n", ret);
                 return ret;
         }
 
-        ret = remove_extent_item(root, 4096, 4096);
+        ret = remove_extent_item(root, nodesize, nodesize);
         if (ret)
                 return -EINVAL;
 
-        ret = btrfs_find_all_roots(&trans, fs_info, 4096, 0, &new_roots);
+        ret = btrfs_find_all_roots(&trans, fs_info, nodesize, 0, &new_roots);
         if (ret) {
                 ulist_free(old_roots);
                 ulist_free(new_roots);
@@ -290,14 +294,14 @@ static int test_no_shared_qgroup(struct btrfs_root *root)
                 return ret;
         }
 
-        ret = btrfs_qgroup_account_extent(&trans, fs_info, 4096, 4096,
-                                          old_roots, new_roots);
+        ret = btrfs_qgroup_account_extent(&trans, fs_info, nodesize,
+                                          nodesize, old_roots, new_roots);
         if (ret) {
                 test_msg("Couldn't account space for a qgroup %d\n", ret);
                 return -EINVAL;
         }
 
-        if (btrfs_verify_qgroup_counts(fs_info, 5, 0, 0)) {
+        if (btrfs_verify_qgroup_counts(fs_info, BTRFS_FS_TREE_OBJECTID, 0, 0)) {
                 test_msg("Qgroup counts didn't match expected values\n");
                 return -EINVAL;
         }
@@ -310,7 +314,8 @@ static int test_no_shared_qgroup(struct btrfs_root *root)
  * right, also remove one of the roots and make sure the exclusive count is
  * adjusted properly.
  */
-static int test_multiple_refs(struct btrfs_root *root)
+static int test_multiple_refs(struct btrfs_root *root,
+                u32 sectorsize, u32 nodesize)
 {
         struct btrfs_trans_handle trans;
         struct btrfs_fs_info *fs_info = root->fs_info;
@@ -322,25 +327,29 @@ static int test_multiple_refs(struct btrfs_root *root)
 
         test_msg("Qgroup multiple refs test\n");
 
-        /* We have 5 created already from the previous test */
-        ret = btrfs_create_qgroup(NULL, fs_info, 256);
+        /*
+         * We have BTRFS_FS_TREE_OBJECTID created already from the
+         * previous test.
+         */
+        ret = btrfs_create_qgroup(NULL, fs_info, BTRFS_FIRST_FREE_OBJECTID);
         if (ret) {
                 test_msg("Couldn't create a qgroup %d\n", ret);
                 return ret;
         }
 
-        ret = btrfs_find_all_roots(&trans, fs_info, 4096, 0, &old_roots);
+        ret = btrfs_find_all_roots(&trans, fs_info, nodesize, 0, &old_roots);
         if (ret) {
                 ulist_free(old_roots);
                 test_msg("Couldn't find old roots: %d\n", ret);
                 return ret;
         }
 
-        ret = insert_normal_tree_ref(root, 4096, 4096, 0, 5);
+        ret = insert_normal_tree_ref(root, nodesize, nodesize, 0,
+                                BTRFS_FS_TREE_OBJECTID);
         if (ret)
                 return ret;
 
-        ret = btrfs_find_all_roots(&trans, fs_info, 4096, 0, &new_roots);
+        ret = btrfs_find_all_roots(&trans, fs_info, nodesize, 0, &new_roots);
         if (ret) {
                 ulist_free(old_roots);
                 ulist_free(new_roots);
@@ -348,30 +357,32 @@ static int test_multiple_refs(struct btrfs_root *root)
                 return ret;
         }
 
-        ret = btrfs_qgroup_account_extent(&trans, fs_info, 4096, 4096,
-                                          old_roots, new_roots);
+        ret = btrfs_qgroup_account_extent(&trans, fs_info, nodesize,
+                                          nodesize, old_roots, new_roots);
         if (ret) {
                 test_msg("Couldn't account space for a qgroup %d\n", ret);
                 return ret;
         }
 
-        if (btrfs_verify_qgroup_counts(fs_info, 5, 4096, 4096)) {
+        if (btrfs_verify_qgroup_counts(fs_info, BTRFS_FS_TREE_OBJECTID,
+                                       nodesize, nodesize)) {
                 test_msg("Qgroup counts didn't match expected values\n");
                 return -EINVAL;
         }
 
-        ret = btrfs_find_all_roots(&trans, fs_info, 4096, 0, &old_roots);
+        ret = btrfs_find_all_roots(&trans, fs_info, nodesize, 0, &old_roots);
         if (ret) {
                 ulist_free(old_roots);
                 test_msg("Couldn't find old roots: %d\n", ret);
                 return ret;
         }
 
-        ret = add_tree_ref(root, 4096, 4096, 0, 256);
+        ret = add_tree_ref(root, nodesize, nodesize, 0,
+                        BTRFS_FIRST_FREE_OBJECTID);
         if (ret)
                 return ret;
 
-        ret = btrfs_find_all_roots(&trans, fs_info, 4096, 0, &new_roots);
+        ret = btrfs_find_all_roots(&trans, fs_info, nodesize, 0, &new_roots);
         if (ret) {
                 ulist_free(old_roots);
                 ulist_free(new_roots);
@@ -379,35 +390,38 @@ static int test_multiple_refs(struct btrfs_root *root)
                 return ret;
         }
 
-        ret = btrfs_qgroup_account_extent(&trans, fs_info, 4096, 4096,
-                                          old_roots, new_roots);
+        ret = btrfs_qgroup_account_extent(&trans, fs_info, nodesize,
+                                          nodesize, old_roots, new_roots);
         if (ret) {
                 test_msg("Couldn't account space for a qgroup %d\n", ret);
                 return ret;
         }
 
-        if (btrfs_verify_qgroup_counts(fs_info, 5, 4096, 0)) {
+        if (btrfs_verify_qgroup_counts(fs_info, BTRFS_FS_TREE_OBJECTID,
+                                        nodesize, 0)) {
                 test_msg("Qgroup counts didn't match expected values\n");
                 return -EINVAL;
         }
 
-        if (btrfs_verify_qgroup_counts(fs_info, 256, 4096, 0)) {
+        if (btrfs_verify_qgroup_counts(fs_info, BTRFS_FIRST_FREE_OBJECTID,
+                                        nodesize, 0)) {
                 test_msg("Qgroup counts didn't match expected values\n");
                 return -EINVAL;
         }
 
-        ret = btrfs_find_all_roots(&trans, fs_info, 4096, 0, &old_roots);
+        ret = btrfs_find_all_roots(&trans, fs_info, nodesize, 0, &old_roots);
         if (ret) {
                 ulist_free(old_roots);
                 test_msg("Couldn't find old roots: %d\n", ret);
                 return ret;
         }
 
-        ret = remove_extent_ref(root, 4096, 4096, 0, 256);
+        ret = remove_extent_ref(root, nodesize, nodesize, 0,
+                                BTRFS_FIRST_FREE_OBJECTID);
         if (ret)
                 return ret;
 
-        ret = btrfs_find_all_roots(&trans, fs_info, 4096, 0, &new_roots);
+        ret = btrfs_find_all_roots(&trans, fs_info, nodesize, 0, &new_roots);
         if (ret) {
                 ulist_free(old_roots);
                 ulist_free(new_roots);
@@ -415,19 +429,21 @@ static int test_multiple_refs(struct btrfs_root *root)
                 return ret;
         }
 
-        ret = btrfs_qgroup_account_extent(&trans, fs_info, 4096, 4096,
-                                          old_roots, new_roots);
+        ret = btrfs_qgroup_account_extent(&trans, fs_info, nodesize,
+                                          nodesize, old_roots, new_roots);
         if (ret) {
                 test_msg("Couldn't account space for a qgroup %d\n", ret);
                 return ret;
         }
 
-        if (btrfs_verify_qgroup_counts(fs_info, 256, 0, 0)) {
+        if (btrfs_verify_qgroup_counts(fs_info, BTRFS_FIRST_FREE_OBJECTID,
+                                        0, 0)) {
                 test_msg("Qgroup counts didn't match expected values\n");
                 return -EINVAL;
         }
 
-        if (btrfs_verify_qgroup_counts(fs_info, 5, 4096, 4096)) {
+        if (btrfs_verify_qgroup_counts(fs_info, BTRFS_FS_TREE_OBJECTID,
+                                        nodesize, nodesize)) {
                 test_msg("Qgroup counts didn't match expected values\n");
                 return -EINVAL;
         }
@@ -435,13 +451,13 @@ static int test_multiple_refs(struct btrfs_root *root)
         return 0;
 }
 
-int btrfs_test_qgroups(void)
+int btrfs_test_qgroups(u32 sectorsize, u32 nodesize)
 {
         struct btrfs_root *root;
         struct btrfs_root *tmp_root;
         int ret = 0;
 
-        root = btrfs_alloc_dummy_root();
+        root = btrfs_alloc_dummy_root(sectorsize, nodesize);
         if (IS_ERR(root)) {
                 test_msg("Couldn't allocate root\n");
                 return PTR_ERR(root);
@@ -468,7 +484,8 @@ int btrfs_test_qgroups(void)
          * Can't use bytenr 0, some things freak out
          * *cough*backref walking code*cough*
          */
-        root->node = alloc_test_extent_buffer(root->fs_info, 4096);
+        root->node = alloc_test_extent_buffer(root->fs_info, nodesize,
+                                        nodesize);
         if (!root->node) {
                 test_msg("Couldn't allocate dummy buffer\n");
                 ret = -ENOMEM;
@@ -476,16 +493,16 @@ int btrfs_test_qgroups(void)
         }
         btrfs_set_header_level(root->node, 0);
         btrfs_set_header_nritems(root->node, 0);
-        root->alloc_bytenr += 8192;
+        root->alloc_bytenr += 2 * nodesize;
 
-        tmp_root = btrfs_alloc_dummy_root();
+        tmp_root = btrfs_alloc_dummy_root(sectorsize, nodesize);
         if (IS_ERR(tmp_root)) {
                 test_msg("Couldn't allocate a fs root\n");
                 ret = PTR_ERR(tmp_root);
                 goto out;
         }
 
-        tmp_root->root_key.objectid = 5;
+        tmp_root->root_key.objectid = BTRFS_FS_TREE_OBJECTID;
         root->fs_info->fs_root = tmp_root;
         ret = btrfs_insert_fs_root(root->fs_info, tmp_root);
         if (ret) {
@@ -493,14 +510,14 @@ int btrfs_test_qgroups(void)
                 goto out;
         }
 
-        tmp_root = btrfs_alloc_dummy_root();
+        tmp_root = btrfs_alloc_dummy_root(sectorsize, nodesize);
         if (IS_ERR(tmp_root)) {
                 test_msg("Couldn't allocate a fs root\n");
                 ret = PTR_ERR(tmp_root);
                 goto out;
         }
 
-        tmp_root->root_key.objectid = 256;
+        tmp_root->root_key.objectid = BTRFS_FIRST_FREE_OBJECTID;
         ret = btrfs_insert_fs_root(root->fs_info, tmp_root);
         if (ret) {
                 test_msg("Couldn't insert fs root %d\n", ret);
@@ -508,10 +525,10 @@ int btrfs_test_qgroups(void)
         }
 
         test_msg("Running qgroup tests\n");
-        ret = test_no_shared_qgroup(root);
+        ret = test_no_shared_qgroup(root, sectorsize, nodesize);
         if (ret)
                 goto out;
-        ret = test_multiple_refs(root);
+        ret = test_multiple_refs(root, sectorsize, nodesize);
 out:
         btrfs_free_dummy_root(root);
         return ret;
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index f6e24cb423ae..948aa186b353 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -818,6 +818,7 @@ static int __btrfs_end_transaction(struct btrfs_trans_handle *trans,
 {
         struct btrfs_transaction *cur_trans = trans->transaction;
         struct btrfs_fs_info *info = root->fs_info;
+        u64 transid = trans->transid;
         unsigned long cur = trans->delayed_ref_updates;
         int lock = (trans->type != TRANS_JOIN_NOLOCK);
         int err = 0;
@@ -905,7 +906,7 @@ static int __btrfs_end_transaction(struct btrfs_trans_handle *trans,
 
         kmem_cache_free(btrfs_trans_handle_cachep, trans);
         if (must_run_delayed_refs) {
-                btrfs_async_run_delayed_refs(root, cur,
+                btrfs_async_run_delayed_refs(root, cur, transid,
                                              must_run_delayed_refs == 1);
         }
         return err;
@@ -1311,11 +1312,6 @@ int btrfs_defrag_root(struct btrfs_root *root)
         return ret;
 }
 
-/* Bisesctability fixup, remove in 4.8 */
-#ifndef btrfs_std_error
-#define btrfs_std_error btrfs_handle_fs_error
-#endif
-
 /*
  * Do all special snapshot related qgroup dirty hack.
  *
@@ -1385,7 +1381,7 @@ static int qgroup_account_snapshot(struct btrfs_trans_handle *trans,
         switch_commit_roots(trans->transaction, fs_info);
         ret = btrfs_write_and_wait_transaction(trans, src);
         if (ret)
-                btrfs_std_error(fs_info, ret,
+                btrfs_handle_fs_error(fs_info, ret,
                         "Error while writing out transaction for qgroup");
 
 out:
diff --git a/fs/btrfs/transaction.h b/fs/btrfs/transaction.h
index 9fe0ec2bf0fe..c5abee4f01ad 100644
--- a/fs/btrfs/transaction.h
+++ b/fs/btrfs/transaction.h
@@ -110,7 +110,6 @@ struct btrfs_trans_handle {
         u64 chunk_bytes_reserved;
         unsigned long use_count;
         unsigned long blocks_reserved;
-        unsigned long blocks_used;
         unsigned long delayed_ref_updates;
         struct btrfs_transaction *transaction;
         struct btrfs_block_rsv *block_rsv;
@@ -121,6 +120,7 @@ struct btrfs_trans_handle {
         bool can_flush_pending_bgs;
         bool reloc_reserved;
         bool sync;
+        bool dirty;
         unsigned int type;
         /*
          * this root is only needed to validate that the root passed to
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index b7665af471d8..c05f69a8ec42 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -2422,8 +2422,8 @@ static noinline int walk_down_log_tree(struct btrfs_trans_handle *trans,
                 root_owner = btrfs_header_owner(parent);
 
                 next = btrfs_find_create_tree_block(root, bytenr);
-                if (!next)
-                        return -ENOMEM;
+                if (IS_ERR(next))
+                        return PTR_ERR(next);
 
                 if (*level == 1) {
                         ret = wc->process_func(root, next, wc, ptr_gen);
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index da9e0036a864..589f128173b1 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -4241,6 +4241,7 @@ int btrfs_create_uuid_tree(struct btrfs_fs_info *fs_info)
         if (IS_ERR(uuid_root)) {
                 ret = PTR_ERR(uuid_root);
                 btrfs_abort_transaction(trans, tree_root, ret);
+                btrfs_end_transaction(trans, tree_root);
                 return ret;
         }
 
@@ -4693,12 +4694,12 @@ static int __btrfs_alloc_chunk(struct btrfs_trans_handle *trans,
 
         if (type & BTRFS_BLOCK_GROUP_RAID5) {
                 raid_stripe_len = find_raid56_stripe_len(ndevs - 1,
-                                 btrfs_super_stripesize(info->super_copy));
+                                                extent_root->stripesize);
                 data_stripes = num_stripes - 1;
         }
         if (type & BTRFS_BLOCK_GROUP_RAID6) {
                 raid_stripe_len = find_raid56_stripe_len(ndevs - 2,
-                                 btrfs_super_stripesize(info->super_copy));
+                                                extent_root->stripesize);
                 data_stripes = num_stripes - 2;
         }
 
@@ -6258,27 +6259,23 @@ struct btrfs_device *btrfs_alloc_device(struct btrfs_fs_info *fs_info,
         return dev;
 }
 
-static int read_one_chunk(struct btrfs_root *root, struct btrfs_key *key,
-                          struct extent_buffer *leaf,
-                          struct btrfs_chunk *chunk)
+/* Return -EIO if any error, otherwise return 0. */
+static int btrfs_check_chunk_valid(struct btrfs_root *root,
+                                   struct extent_buffer *leaf,
+                                   struct btrfs_chunk *chunk, u64 logical)
 {
-        struct btrfs_mapping_tree *map_tree = &root->fs_info->mapping_tree;
-        struct map_lookup *map;
-        struct extent_map *em;
-        u64 logical;
         u64 length;
         u64 stripe_len;
-        u64 devid;
-        u8 uuid[BTRFS_UUID_SIZE];
-        int num_stripes;
-        int ret;
-        int i;
+        u16 num_stripes;
+        u16 sub_stripes;
+        u64 type;
 
-        logical = key->offset;
         length = btrfs_chunk_length(leaf, chunk);
         stripe_len = btrfs_chunk_stripe_len(leaf, chunk);
         num_stripes = btrfs_chunk_num_stripes(leaf, chunk);
-        /* Validation check */
+        sub_stripes = btrfs_chunk_sub_stripes(leaf, chunk);
+        type = btrfs_chunk_type(leaf, chunk);
+
         if (!num_stripes) {
                 btrfs_err(root->fs_info, "invalid chunk num_stripes: %u",
                           num_stripes);
@@ -6289,6 +6286,11 @@ static int read_one_chunk(struct btrfs_root *root, struct btrfs_key *key,
                           "invalid chunk logical %llu", logical);
                 return -EIO;
         }
+        if (btrfs_chunk_sector_size(leaf, chunk) != root->sectorsize) {
+                btrfs_err(root->fs_info, "invalid chunk sectorsize %u",
+                          btrfs_chunk_sector_size(leaf, chunk));
+                return -EIO;
+        }
         if (!length || !IS_ALIGNED(length, root->sectorsize)) {
                 btrfs_err(root->fs_info,
                         "invalid chunk length %llu", length);
@@ -6300,13 +6302,54 @@ static int read_one_chunk(struct btrfs_root *root, struct btrfs_key *key,
                 return -EIO;
         }
         if (~(BTRFS_BLOCK_GROUP_TYPE_MASK | BTRFS_BLOCK_GROUP_PROFILE_MASK) &
-            btrfs_chunk_type(leaf, chunk)) {
+            type) {
                 btrfs_err(root->fs_info, "unrecognized chunk type: %llu",
                           ~(BTRFS_BLOCK_GROUP_TYPE_MASK |
                             BTRFS_BLOCK_GROUP_PROFILE_MASK) &
                           btrfs_chunk_type(leaf, chunk));
                 return -EIO;
         }
+        if ((type & BTRFS_BLOCK_GROUP_RAID10 && sub_stripes != 2) ||
+            (type & BTRFS_BLOCK_GROUP_RAID1 && num_stripes < 1) ||
+            (type & BTRFS_BLOCK_GROUP_RAID5 && num_stripes < 2) ||
+            (type & BTRFS_BLOCK_GROUP_RAID6 && num_stripes < 3) ||
+            (type & BTRFS_BLOCK_GROUP_DUP && num_stripes > 2) ||
+            ((type & BTRFS_BLOCK_GROUP_PROFILE_MASK) == 0 &&
+             num_stripes != 1)) {
+                btrfs_err(root->fs_info,
+                        "invalid num_stripes:sub_stripes %u:%u for profile %llu",
+                        num_stripes, sub_stripes,
+                        type & BTRFS_BLOCK_GROUP_PROFILE_MASK);
+                return -EIO;
+        }
+
+        return 0;
+}
+
+static int read_one_chunk(struct btrfs_root *root, struct btrfs_key *key,
+                          struct extent_buffer *leaf,
+                          struct btrfs_chunk *chunk)
+{
+        struct btrfs_mapping_tree *map_tree = &root->fs_info->mapping_tree;
+        struct map_lookup *map;
+        struct extent_map *em;
+        u64 logical;
+        u64 length;
+        u64 stripe_len;
+        u64 devid;
+        u8 uuid[BTRFS_UUID_SIZE];
+        int num_stripes;
+        int ret;
+        int i;
+
+        logical = key->offset;
+        length = btrfs_chunk_length(leaf, chunk);
+        stripe_len = btrfs_chunk_stripe_len(leaf, chunk);
+        num_stripes = btrfs_chunk_num_stripes(leaf, chunk);
+
+        ret = btrfs_check_chunk_valid(root, leaf, chunk, logical);
+        if (ret)
+                return ret;
 
         read_lock(&map_tree->map_tree.lock);
         em = lookup_extent_mapping(&map_tree->map_tree, logical, 1);
@@ -6554,6 +6597,7 @@ int btrfs_read_sys_array(struct btrfs_root *root)
         u32 array_size;
         u32 len = 0;
         u32 cur_offset;
+        u64 type;
         struct btrfs_key key;
 
         ASSERT(BTRFS_SUPER_INFO_SIZE <= root->nodesize);
@@ -6563,8 +6607,8 @@ int btrfs_read_sys_array(struct btrfs_root *root)
          * overallocate but we can keep it as-is, only the first page is used.
          */
         sb = btrfs_find_create_tree_block(root, BTRFS_SUPER_INFO_OFFSET);
-        if (!sb)
-                return -ENOMEM;
+        if (IS_ERR(sb))
+                return PTR_ERR(sb);
         set_extent_buffer_uptodate(sb);
         btrfs_set_buffer_lockdep_class(root->root_key.objectid, sb, 0);
         /*
@@ -6620,6 +6664,15 @@ int btrfs_read_sys_array(struct btrfs_root *root)
                                 break;
                         }
 
+                        type = btrfs_chunk_type(sb, chunk);
+                        if ((type & BTRFS_BLOCK_GROUP_SYSTEM) == 0) {
+                                btrfs_err(root->fs_info,
+                            "invalid chunk type %llu in sys_array at offset %u",
+                                        type, cur_offset);
+                                ret = -EIO;
+                                break;
+                        }
+
                         len = btrfs_chunk_item_size(num_stripes);
                         if (cur_offset + len > array_size)
                                 goto out_short_read;
@@ -6638,12 +6691,14 @@ int btrfs_read_sys_array(struct btrfs_root *root)
                 sb_array_offset += len;
                 cur_offset += len;
         }
+        clear_extent_buffer_uptodate(sb);
         free_extent_buffer_stale(sb);
         return ret;
 
 out_short_read:
         printk(KERN_ERR "BTRFS: sys_array too short to read %u bytes at offset %u\n",
                         len, cur_offset);
+        clear_extent_buffer_uptodate(sb);
         free_extent_buffer_stale(sb);
         return -EIO;
 }
@@ -6656,6 +6711,7 @@ int btrfs_read_chunk_tree(struct btrfs_root *root)
         struct btrfs_key found_key;
         int ret;
         int slot;
+        u64 total_dev = 0;
 
         root = root->fs_info->chunk_root;
 
@@ -6697,6 +6753,7 @@ int btrfs_read_chunk_tree(struct btrfs_root *root)
                         ret = read_one_dev(root, leaf, dev_item);
                         if (ret)
                                 goto error;
+                        total_dev++;
                 } else if (found_key.type == BTRFS_CHUNK_ITEM_KEY) {
                         struct btrfs_chunk *chunk;
                         chunk = btrfs_item_ptr(leaf, slot, struct btrfs_chunk);
@@ -6706,6 +6763,28 @@ int btrfs_read_chunk_tree(struct btrfs_root *root)
                 }
                 path->slots[0]++;
         }
+
+        /*
+         * After loading chunk tree, we've got all device information,
+         * do another round of validation checks.
+         */
+        if (total_dev != root->fs_info->fs_devices->total_devices) {
+                btrfs_err(root->fs_info,
+           "super_num_devices %llu mismatch with num_devices %llu found here",
+                          btrfs_super_num_devices(root->fs_info->super_copy),
+                          total_dev);
+                ret = -EINVAL;
+                goto error;
+        }
+        if (btrfs_super_total_bytes(root->fs_info->super_copy) <
+            root->fs_info->fs_devices->total_rw_bytes) {
+                btrfs_err(root->fs_info,
+        "super_total_bytes %llu mismatch with fs_devices total_rw_bytes %llu",
+                          btrfs_super_total_bytes(root->fs_info->super_copy),
+                          root->fs_info->fs_devices->total_rw_bytes);
+                ret = -EINVAL;
+                goto error;
+        }
         ret = 0;
 error:
         unlock_chunks(root);
diff --git a/fs/ceph/export.c b/fs/ceph/export.c
index 6e72c98162d5..1780218a48f0 100644
--- a/fs/ceph/export.c
+++ b/fs/ceph/export.c
@@ -95,10 +95,8 @@ static struct dentry *__fh_to_dentry(struct super_block *sb, u64 ino)
         }
 
         dentry = d_obtain_alias(inode);
-        if (IS_ERR(dentry)) {
-                iput(inode);
+        if (IS_ERR(dentry))
                 return dentry;
-        }
         err = ceph_init_dentry(dentry);
         if (err < 0) {
                 dput(dentry);
@@ -167,10 +165,8 @@ static struct dentry *__get_parent(struct super_block *sb,
                 return ERR_PTR(-ENOENT);
 
         dentry = d_obtain_alias(inode);
-        if (IS_ERR(dentry)) {
-                iput(inode);
+        if (IS_ERR(dentry))
                 return dentry;
-        }
         err = ceph_init_dentry(dentry);
         if (err < 0) {
                 dput(dentry);
@@ -210,7 +206,7 @@ static struct dentry *ceph_fh_to_parent(struct super_block *sb,
 
         dout("fh_to_parent %llx\n", cfh->parent_ino);
         dentry = __get_parent(sb, NULL, cfh->ino);
-        if (IS_ERR(dentry) && PTR_ERR(dentry) == -ENOENT)
+        if (unlikely(dentry == ERR_PTR(-ENOENT)))
                 dentry = __fh_to_dentry(sb, cfh->parent_ino);
         return dentry;
 }
diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c
index 5a53ac6b1e02..02b071bf3732 100644
--- a/fs/cifs/cifs_unicode.c
+++ b/fs/cifs/cifs_unicode.c
@@ -101,6 +101,12 @@ convert_sfm_char(const __u16 src_char, char *target)
         case SFM_SLASH:
                 *target = '\\';
                 break;
+        case SFM_SPACE:
+                *target = ' ';
+                break;
+        case SFM_PERIOD:
+                *target = '.';
+                break;
         default:
                 return false;
         }
@@ -404,7 +410,7 @@ static __le16 convert_to_sfu_char(char src_char)
         return dest_char;
 }
 
-static __le16 convert_to_sfm_char(char src_char)
+static __le16 convert_to_sfm_char(char src_char, bool end_of_string)
 {
         __le16 dest_char;
 
@@ -427,6 +433,18 @@ static __le16 convert_to_sfm_char(char src_char)
         case '|':
                 dest_char = cpu_to_le16(SFM_PIPE);
                 break;
+        case '.':
+                if (end_of_string)
+                        dest_char = cpu_to_le16(SFM_PERIOD);
+                else
+                        dest_char = 0;
+                break;
+        case ' ':
+                if (end_of_string)
+                        dest_char = cpu_to_le16(SFM_SPACE);
+                else
+                        dest_char = 0;
+                break;
         default:
                 dest_char = 0;
         }
@@ -469,9 +487,16 @@ cifsConvertToUTF16(__le16 *target, const char *source, int srclen,
                 /* see if we must remap this char */
                 if (map_chars == SFU_MAP_UNI_RSVD)
                         dst_char = convert_to_sfu_char(src_char);
-                else if (map_chars == SFM_MAP_UNI_RSVD)
-                        dst_char = convert_to_sfm_char(src_char);
-                else
+                else if (map_chars == SFM_MAP_UNI_RSVD) {
+                        bool end_of_string;
+
+                        if (i == srclen - 1)
+                                end_of_string = true;
+                        else
+                                end_of_string = false;
+
+                        dst_char = convert_to_sfm_char(src_char, end_of_string);
+                } else
                         dst_char = 0;
                 /*
                  * FIXME: We can not handle remapping backslash (UNI_SLASH)
diff --git a/fs/cifs/cifs_unicode.h b/fs/cifs/cifs_unicode.h
index bdc52cb9a676..479bc0a941f3 100644
--- a/fs/cifs/cifs_unicode.h
+++ b/fs/cifs/cifs_unicode.h
@@ -64,6 +64,8 @@
 #define SFM_LESSTHAN    ((__u16) 0xF023)
 #define SFM_PIPE        ((__u16) 0xF027)
 #define SFM_SLASH       ((__u16) 0xF026)
+#define SFM_PERIOD      ((__u16) 0xF028)
+#define SFM_SPACE       ((__u16) 0xF029)
 
 /*
  * Mapping mechanism to use when one of the seven reserved characters is
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 5d8b7edf8a8f..5d841f39c4b7 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -87,6 +87,7 @@ extern mempool_t *cifs_req_poolp;
 extern mempool_t *cifs_mid_poolp;
 
 struct workqueue_struct *cifsiod_wq;
+__u32 cifs_lock_secret;
 
 /*
  * Bumps refcount for cifs super block.
@@ -1266,6 +1267,8 @@ init_cifs(void)
         spin_lock_init(&cifs_file_list_lock);
         spin_lock_init(&GlobalMid_Lock);
 
+        get_random_bytes(&cifs_lock_secret, sizeof(cifs_lock_secret));
+
         if (cifs_max_pending < 2) {
                 cifs_max_pending = 2;
                 cifs_dbg(FYI, "cifs_max_pending set to min of 2\n");
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index bba106cdc43c..8f1d8c1e72be 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -1619,6 +1619,7 @@ void cifs_oplock_break(struct work_struct *work);
 
 extern const struct slow_work_ops cifs_oplock_break_ops;
 extern struct workqueue_struct *cifsiod_wq;
+extern __u32 cifs_lock_secret;
 
 extern mempool_t *cifs_mid_poolp;
 
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 66736f57b5ab..7d2b15c06090 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -428,7 +428,9 @@ cifs_echo_request(struct work_struct *work)
          * server->ops->need_neg() == true. Also, no need to ping if
          * we got a response recently.
          */
-        if (!server->ops->need_neg || server->ops->need_neg(server) ||
+
+        if (server->tcpStatus == CifsNeedReconnect ||
+            server->tcpStatus == CifsExiting || server->tcpStatus == CifsNew ||
             (server->ops->can_echo && !server->ops->can_echo(server)) ||
             time_before(jiffies, server->lstrp + echo_interval - HZ))
                 goto requeue_echo;
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 9793ae0bcaa2..d4890b6dc22d 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -1112,6 +1112,12 @@ cifs_push_mandatory_locks(struct cifsFileInfo *cfile)
         return rc;
 }
 
+static __u32
+hash_lockowner(fl_owner_t owner)
+{
+        return cifs_lock_secret ^ hash32_ptr((const void *)owner);
+}
+
 struct lock_to_push {
         struct list_head llist;
         __u64 offset;
@@ -1178,7 +1184,7 @@ cifs_push_posix_locks(struct cifsFileInfo *cfile)
                 else
                         type = CIFS_WRLCK;
                 lck = list_entry(el, struct lock_to_push, llist);
-                lck->pid = flock->fl_pid;
+                lck->pid = hash_lockowner(flock->fl_owner);
                 lck->netfid = cfile->fid.netfid;
                 lck->length = length;
                 lck->type = type;
@@ -1305,7 +1311,8 @@ cifs_getlk(struct file *file, struct file_lock *flock, __u32 type,
                         posix_lock_type = CIFS_RDLCK;
                 else
                         posix_lock_type = CIFS_WRLCK;
-                rc = CIFSSMBPosixLock(xid, tcon, netfid, current->tgid,
+                rc = CIFSSMBPosixLock(xid, tcon, netfid,
+                                      hash_lockowner(flock->fl_owner),
                                       flock->fl_start, length, flock,
                                       posix_lock_type, wait_flag);
                 return rc;
@@ -1505,7 +1512,8 @@ cifs_setlk(struct file *file, struct file_lock *flock, __u32 type,
                         posix_lock_type = CIFS_UNLCK;
 
                 rc = CIFSSMBPosixLock(xid, tcon, cfile->fid.netfid,
-                                      current->tgid, flock->fl_start, length,
+                                      hash_lockowner(flock->fl_owner),
+                                      flock->fl_start, length,
                                       NULL, posix_lock_type, wait_flag);
                 goto out;
         }
diff --git a/fs/cifs/ntlmssp.h b/fs/cifs/ntlmssp.h
index 848249fa120f..3079b38f0afb 100644
--- a/fs/cifs/ntlmssp.h
+++ b/fs/cifs/ntlmssp.h
@@ -133,6 +133,6 @@ typedef struct _AUTHENTICATE_MESSAGE {
 
 int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len, struct cifs_ses *ses);
 void build_ntlmssp_negotiate_blob(unsigned char *pbuffer, struct cifs_ses *ses);
-int build_ntlmssp_auth_blob(unsigned char *pbuffer, u16 *buflen,
+int build_ntlmssp_auth_blob(unsigned char **pbuffer, u16 *buflen,
                         struct cifs_ses *ses,
                         const struct nls_table *nls_cp);
diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index af0ec2d5ad0e..538d9b55699a 100644
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -364,19 +364,43 @@ void build_ntlmssp_negotiate_blob(unsigned char *pbuffer,
         sec_blob->DomainName.MaximumLength = 0;
 }
 
-/* We do not malloc the blob, it is passed in pbuffer, because its
-   maximum possible size is fixed and small, making this approach cleaner.
-   This function returns the length of the data in the blob */
-int build_ntlmssp_auth_blob(unsigned char *pbuffer,
+static int size_of_ntlmssp_blob(struct cifs_ses *ses)
+{
+        int sz = sizeof(AUTHENTICATE_MESSAGE) + ses->auth_key.len
+                - CIFS_SESS_KEY_SIZE + CIFS_CPHTXT_SIZE + 2;
+
+        if (ses->domainName)
+                sz += 2 * strnlen(ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
+        else
+                sz += 2;
+
+        if (ses->user_name)
+                sz += 2 * strnlen(ses->user_name, CIFS_MAX_USERNAME_LEN);
+        else
+                sz += 2;
+
+        return sz;
+}
+
+int build_ntlmssp_auth_blob(unsigned char **pbuffer,
                                         u16 *buflen,
                                    struct cifs_ses *ses,
                                    const struct nls_table *nls_cp)
 {
         int rc;
-        AUTHENTICATE_MESSAGE *sec_blob = (AUTHENTICATE_MESSAGE *)pbuffer;
+        AUTHENTICATE_MESSAGE *sec_blob;
         __u32 flags;
         unsigned char *tmp;
 
+        rc = setup_ntlmv2_rsp(ses, nls_cp);
+        if (rc) {
+                cifs_dbg(VFS, "Error %d during NTLMSSP authentication\n", rc);
+                *buflen = 0;
+                goto setup_ntlmv2_ret;
+        }
+        *pbuffer = kmalloc(size_of_ntlmssp_blob(ses), GFP_KERNEL);
+        sec_blob = (AUTHENTICATE_MESSAGE *)*pbuffer;
+
         memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
         sec_blob->MessageType = NtLmAuthenticate;
 
@@ -391,7 +415,7 @@ int build_ntlmssp_auth_blob(unsigned char *pbuffer,
                         flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
         }
 
-        tmp = pbuffer + sizeof(AUTHENTICATE_MESSAGE);
+        tmp = *pbuffer + sizeof(AUTHENTICATE_MESSAGE);
         sec_blob->NegotiateFlags = cpu_to_le32(flags);
 
         sec_blob->LmChallengeResponse.BufferOffset =
@@ -399,13 +423,9 @@ int build_ntlmssp_auth_blob(unsigned char *pbuffer,
         sec_blob->LmChallengeResponse.Length = 0;
         sec_blob->LmChallengeResponse.MaximumLength = 0;
 
-        sec_blob->NtChallengeResponse.BufferOffset = cpu_to_le32(tmp - pbuffer);
+        sec_blob->NtChallengeResponse.BufferOffset =
+                                cpu_to_le32(tmp - *pbuffer);
         if (ses->user_name != NULL) {
-                rc = setup_ntlmv2_rsp(ses, nls_cp);
-                if (rc) {
-                        cifs_dbg(VFS, "Error %d during NTLMSSP authentication\n", rc);
-                        goto setup_ntlmv2_ret;
-                }
                 memcpy(tmp, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
                                 ses->auth_key.len - CIFS_SESS_KEY_SIZE);
                 tmp += ses->auth_key.len - CIFS_SESS_KEY_SIZE;
@@ -423,23 +443,23 @@ int build_ntlmssp_auth_blob(unsigned char *pbuffer,
         }
 
         if (ses->domainName == NULL) {
-                sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - pbuffer);
+                sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
                 sec_blob->DomainName.Length = 0;
                 sec_blob->DomainName.MaximumLength = 0;
                 tmp += 2;
         } else {
                 int len;
                 len = cifs_strtoUTF16((__le16 *)tmp, ses->domainName,
-                                      CIFS_MAX_USERNAME_LEN, nls_cp);
+                                      CIFS_MAX_DOMAINNAME_LEN, nls_cp);
                 len *= 2; /* unicode is 2 bytes each */
-                sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - pbuffer);
+                sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
                 sec_blob->DomainName.Length = cpu_to_le16(len);
                 sec_blob->DomainName.MaximumLength = cpu_to_le16(len);
                 tmp += len;
         }
 
         if (ses->user_name == NULL) {
-                sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - pbuffer);
+                sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
                 sec_blob->UserName.Length = 0;
                 sec_blob->UserName.MaximumLength = 0;
                 tmp += 2;
@@ -448,13 +468,13 @@ int build_ntlmssp_auth_blob(unsigned char *pbuffer,
                 len = cifs_strtoUTF16((__le16 *)tmp, ses->user_name,
                                       CIFS_MAX_USERNAME_LEN, nls_cp);
                 len *= 2; /* unicode is 2 bytes each */
-                sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - pbuffer);
+                sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
                 sec_blob->UserName.Length = cpu_to_le16(len);
                 sec_blob->UserName.MaximumLength = cpu_to_le16(len);
                 tmp += len;
         }
 
-        sec_blob->WorkstationName.BufferOffset = cpu_to_le32(tmp - pbuffer);
+        sec_blob->WorkstationName.BufferOffset = cpu_to_le32(tmp - *pbuffer);
         sec_blob->WorkstationName.Length = 0;
         sec_blob->WorkstationName.MaximumLength = 0;
         tmp += 2;
@@ -463,19 +483,19 @@ int build_ntlmssp_auth_blob(unsigned char *pbuffer,
                 (ses->ntlmssp->server_flags & NTLMSSP_NEGOTIATE_EXTENDED_SEC))
                         && !calc_seckey(ses)) {
                 memcpy(tmp, ses->ntlmssp->ciphertext, CIFS_CPHTXT_SIZE);
-                sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - pbuffer);
+                sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer);
                 sec_blob->SessionKey.Length = cpu_to_le16(CIFS_CPHTXT_SIZE);
                 sec_blob->SessionKey.MaximumLength =
                                 cpu_to_le16(CIFS_CPHTXT_SIZE);
                 tmp += CIFS_CPHTXT_SIZE;
         } else {
-                sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - pbuffer);
+                sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer);
                 sec_blob->SessionKey.Length = 0;
                 sec_blob->SessionKey.MaximumLength = 0;
         }
 
+        *buflen = tmp - *pbuffer;
 setup_ntlmv2_ret:
-        *buflen = tmp - pbuffer;
         return rc;
 }
 
@@ -690,6 +710,8 @@ sess_auth_lanman(struct sess_data *sess_data)
                 rc = calc_lanman_hash(ses->password, ses->server->cryptkey,
                                       ses->server->sec_mode & SECMODE_PW_ENCRYPT ?
                                       true : false, lnm_session_key);
+                if (rc)
+                        goto out;
 
                 memcpy(bcc_ptr, (char *)lnm_session_key, CIFS_AUTH_RESP_SIZE);
                 bcc_ptr += CIFS_AUTH_RESP_SIZE;
@@ -1266,7 +1288,7 @@ sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data)
         struct cifs_ses *ses = sess_data->ses;
         __u16 bytes_remaining;
         char *bcc_ptr;
-        char *ntlmsspblob = NULL;
+        unsigned char *ntlmsspblob = NULL;
         u16 blob_len;
 
         cifs_dbg(FYI, "rawntlmssp session setup authenticate phase\n");
@@ -1279,19 +1301,7 @@ sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data)
         /* Build security blob before we assemble the request */
         pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
         smb_buf = (struct smb_hdr *)pSMB;
-        /*
-         * 5 is an empirical value, large enough to hold
-         * authenticate message plus max 10 of av paris,
-         * domain, user, workstation names, flags, etc.
-         */
-        ntlmsspblob = kzalloc(5*sizeof(struct _AUTHENTICATE_MESSAGE),
-                                GFP_KERNEL);
-        if (!ntlmsspblob) {
-                rc = -ENOMEM;
-                goto out;
-        }
-
-        rc = build_ntlmssp_auth_blob(ntlmsspblob,
+        rc = build_ntlmssp_auth_blob(&ntlmsspblob,
                                         &blob_len, ses, sess_data->nls_cp);
         if (rc)
                 goto out_free_ntlmsspblob;
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 8f38e33d365b..29e06db5f187 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -588,7 +588,7 @@ SMB2_sess_setup(const unsigned int xid, struct cifs_ses *ses,
         u16 blob_length = 0;
         struct key *spnego_key = NULL;
         char *security_blob = NULL;
-        char *ntlmssp_blob = NULL;
+        unsigned char *ntlmssp_blob = NULL;
         bool use_spnego = false; /* else use raw ntlmssp */
 
         cifs_dbg(FYI, "Session Setup\n");
@@ -713,13 +713,7 @@ ssetup_ntlmssp_authenticate:
                 iov[1].iov_len = blob_length;
         } else if (phase == NtLmAuthenticate) {
                 req->hdr.SessionId = ses->Suid;
-                ntlmssp_blob = kzalloc(sizeof(struct _NEGOTIATE_MESSAGE) + 500,
-                                       GFP_KERNEL);
-                if (ntlmssp_blob == NULL) {
-                        rc = -ENOMEM;
-                        goto ssetup_exit;
-                }
-                rc = build_ntlmssp_auth_blob(ntlmssp_blob, &blob_length, ses,
+                rc = build_ntlmssp_auth_blob(&ntlmssp_blob, &blob_length, ses,
                                              nls_cp);
                 if (rc) {
                         cifs_dbg(FYI, "build_ntlmssp_auth_blob failed %d\n",
@@ -1818,6 +1812,33 @@ SMB2_echo(struct TCP_Server_Info *server)
 
         cifs_dbg(FYI, "In echo request\n");
 
+        if (server->tcpStatus == CifsNeedNegotiate) {
+                struct list_head *tmp, *tmp2;
+                struct cifs_ses *ses;
+                struct cifs_tcon *tcon;
+
+                cifs_dbg(FYI, "Need negotiate, reconnecting tcons\n");
+                spin_lock(&cifs_tcp_ses_lock);
+                list_for_each(tmp, &server->smb_ses_list) {
+                        ses = list_entry(tmp, struct cifs_ses, smb_ses_list);
+                        list_for_each(tmp2, &ses->tcon_list) {
+                                tcon = list_entry(tmp2, struct cifs_tcon,
+                                                  tcon_list);
+                                /* add check for persistent handle reconnect */
+                                if (tcon && tcon->need_reconnect) {
+                                        spin_unlock(&cifs_tcp_ses_lock);
+                                        rc = smb2_reconnect(SMB2_ECHO, tcon);
+                                        spin_lock(&cifs_tcp_ses_lock);
+                                }
+                        }
+                }
+                spin_unlock(&cifs_tcp_ses_lock);
+        }
+
+        /* if no session, renegotiate failed above */
+        if (server->tcpStatus == CifsNeedNegotiate)
+                return -EIO;
+
         rc = small_smb2_init(SMB2_ECHO, NULL, (void **)&req);
         if (rc)
                 return rc;
diff --git a/fs/coredump.c b/fs/coredump.c
index 38a7ab87e10a..281b768000e6 100644
--- a/fs/coredump.c
+++ b/fs/coredump.c
@@ -794,6 +794,7 @@ int dump_emit(struct coredump_params *cprm, const void *addr, int nr)
                         return 0;
                 file->f_pos = pos;
                 cprm->written += n;
+                cprm->pos += n;
                 nr -= n;
         }
         return 1;
@@ -808,6 +809,7 @@ int dump_skip(struct coredump_params *cprm, size_t nr)
                 if (dump_interrupted() ||
                     file->f_op->llseek(file, nr, SEEK_CUR) < 0)
                         return 0;
+                cprm->pos += nr;
                 return 1;
         } else {
                 while (nr > PAGE_SIZE) {
@@ -822,7 +824,7 @@ EXPORT_SYMBOL(dump_skip);
 
 int dump_align(struct coredump_params *cprm, int align)
 {
-        unsigned mod = cprm->file->f_pos & (align - 1);
+        unsigned mod = cprm->pos & (align - 1);
         if (align & (align - 1))
                 return 0;
         return mod ? dump_skip(cprm, align - mod) : 1;
diff --git a/fs/dax.c b/fs/dax.c
index 761495bf5eb9..e207f8f9b700 100644
--- a/fs/dax.c
+++ b/fs/dax.c
@@ -208,7 +208,12 @@ static ssize_t dax_io(struct inode *inode, struct iov_iter *iter,
                                 dax.addr += first;
                                 size = map_len - first;
                         }
-                        max = min(pos + size, end);
+                        /*
+                         * pos + size is one past the last offset for IO,
+                         * so pos + size can overflow loff_t at extreme offsets.
+                         * Cast to u64 to catch this and get the true minimum.
+                         */
+                        max = min_t(u64, pos + size, end);
                 }
 
                 if (iov_iter_rw(iter) == WRITE) {
diff --git a/fs/dcache.c b/fs/dcache.c
index ad4a542e9bab..d6847d7b123d 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -507,6 +507,44 @@ void d_drop(struct dentry *dentry)
 }
 EXPORT_SYMBOL(d_drop);
 
+static inline void dentry_unlist(struct dentry *dentry, struct dentry *parent)
+{
+        struct dentry *next;
+        /*
+         * Inform d_walk() and shrink_dentry_list() that we are no longer
+         * attached to the dentry tree
+         */
+        dentry->d_flags |= DCACHE_DENTRY_KILLED;
+        if (unlikely(list_empty(&dentry->d_child)))
+                return;
+        __list_del_entry(&dentry->d_child);
+        /*
+         * Cursors can move around the list of children.  While we'd been
+         * a normal list member, it didn't matter - ->d_child.next would've
+         * been updated.  However, from now on it won't be and for the
+         * things like d_walk() it might end up with a nasty surprise.
+         * Normally d_walk() doesn't care about cursors moving around -
+         * ->d_lock on parent prevents that and since a cursor has no children
+         * of its own, we get through it without ever unlocking the parent.
+         * There is one exception, though - if we ascend from a child that
+         * gets killed as soon as we unlock it, the next sibling is found
+         * using the value left in its ->d_child.next.  And if _that_
+         * pointed to a cursor, and cursor got moved (e.g. by lseek())
+         * before d_walk() regains parent->d_lock, we'll end up skipping
+         * everything the cursor had been moved past.
+         *
+         * Solution: make sure that the pointer left behind in ->d_child.next
+         * points to something that won't be moving around.  I.e. skip the
+         * cursors.
+         */
+        while (dentry->d_child.next != &parent->d_subdirs) {
+                next = list_entry(dentry->d_child.next, struct dentry, d_child);
+                if (likely(!(next->d_flags & DCACHE_DENTRY_CURSOR)))
+                        break;
+                dentry->d_child.next = next->d_child.next;
+        }
+}
+
 static void __dentry_kill(struct dentry *dentry)
 {
         struct dentry *parent = NULL;
@@ -532,12 +570,7 @@ static void __dentry_kill(struct dentry *dentry)
         }
         /* if it was on the hash then remove it */
         __d_drop(dentry);
-        __list_del_entry(&dentry->d_child);
-        /*
-         * Inform d_walk() that we are no longer attached to the
-         * dentry tree
-         */
-        dentry->d_flags |= DCACHE_DENTRY_KILLED;
+        dentry_unlist(dentry, parent);
         if (parent)
                 spin_unlock(&parent->d_lock);
         dentry_iput(dentry);
@@ -1203,6 +1236,9 @@ resume:
                 struct dentry *dentry = list_entry(tmp, struct dentry, d_child);
                 next = tmp->next;
 
+                if (unlikely(dentry->d_flags & DCACHE_DENTRY_CURSOR))
+                        continue;
+
                 spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
 
                 ret = enter(data, dentry);
@@ -1636,7 +1672,7 @@ struct dentry *d_alloc(struct dentry * parent, const struct qstr *name)
         struct dentry *dentry = __d_alloc(parent->d_sb, name);
         if (!dentry)
                 return NULL;
-
+        dentry->d_flags |= DCACHE_RCUACCESS;
         spin_lock(&parent->d_lock);
         /*
          * don't need child lock because it is not subject
@@ -1651,6 +1687,16 @@ struct dentry *d_alloc(struct dentry * parent, const struct qstr *name)
 }
 EXPORT_SYMBOL(d_alloc);
 
+struct dentry *d_alloc_cursor(struct dentry * parent)
+{
+        struct dentry *dentry = __d_alloc(parent->d_sb, NULL);
+        if (dentry) {
+                dentry->d_flags |= DCACHE_RCUACCESS | DCACHE_DENTRY_CURSOR;
+                dentry->d_parent = dget(parent);
+        }
+        return dentry;
+}
+
 /**
  * d_alloc_pseudo - allocate a dentry (for lookup-less filesystems)
  * @sb: the superblock
@@ -2358,7 +2404,6 @@ static void __d_rehash(struct dentry * entry, struct hlist_bl_head *b)
 {
         BUG_ON(!d_unhashed(entry));
         hlist_bl_lock(b);
-        entry->d_flags |= DCACHE_RCUACCESS;
         hlist_bl_add_head_rcu(&entry->d_hash, b);
         hlist_bl_unlock(b);
 }
@@ -2458,7 +2503,6 @@ retry:
                 rcu_read_unlock();
                 goto retry;
         }
-        rcu_read_unlock();
         /*
          * No changes for the parent since the beginning of d_lookup().
          * Since all removals from the chain happen with hlist_bl_lock(),
@@ -2471,8 +2515,6 @@ retry:
                         continue;
                 if (dentry->d_parent != parent)
                         continue;
-                if (d_unhashed(dentry))
-                        continue;
                 if (parent->d_flags & DCACHE_OP_COMPARE) {
                         int tlen = dentry->d_name.len;
                         const char *tname = dentry->d_name.name;
@@ -2484,9 +2526,18 @@ retry:
                         if (dentry_cmp(dentry, str, len))
                                 continue;
                 }
-                dget(dentry);
                 hlist_bl_unlock(b);
-                /* somebody is doing lookup for it right now; wait for it */
+                /* now we can try to grab a reference */
+                if (!lockref_get_not_dead(&dentry->d_lockref)) {
+                        rcu_read_unlock();
+                        goto retry;
+                }
+
+                rcu_read_unlock();
+                /*
+                 * somebody is likely to be still doing lookup for it;
+                 * wait for them to finish
+                 */
                 spin_lock(&dentry->d_lock);
                 d_wait_lookup(dentry);
                 /*
@@ -2517,6 +2568,7 @@ retry:
                 dput(new);
                 return dentry;
         }
+        rcu_read_unlock();
         /* we can't take ->d_lock here; it's OK, though. */
         new->d_flags |= DCACHE_PAR_LOOKUP;
         new->d_wait = wq;
@@ -2843,6 +2895,7 @@ static void __d_move(struct dentry *dentry, struct dentry *target,
         /* ... and switch them in the tree */
         if (IS_ROOT(dentry)) {
                 /* splicing a tree */
+                dentry->d_flags |= DCACHE_RCUACCESS;
                 dentry->d_parent = target->d_parent;
                 target->d_parent = target;
                 list_del_init(&target->d_child);
diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c
index 9c1c9a01b7e5..592059f88e04 100644
--- a/fs/debugfs/file.c
+++ b/fs/debugfs/file.c
@@ -127,7 +127,6 @@ static int open_proxy_open(struct inode *inode, struct file *filp)
                 r = real_fops->open(inode, filp);
 
 out:
-        fops_put(real_fops);
         debugfs_use_file_finish(srcu_idx);
         return r;
 }
@@ -262,8 +261,10 @@ static int full_proxy_open(struct inode *inode, struct file *filp)
 
         if (real_fops->open) {
                 r = real_fops->open(inode, filp);
-
-                if (filp->f_op != proxy_fops) {
+                if (r) {
+                        replace_fops(filp, d_inode(dentry)->i_fop);
+                        goto free_proxy;
+                } else if (filp->f_op != proxy_fops) {
                         /* No protection against file removal anymore. */
                         WARN(1, "debugfs file owner replaced proxy fops: %pd",
                                 dentry);
diff --git a/fs/ecryptfs/kthread.c b/fs/ecryptfs/kthread.c
index 866bb18efefe..e818f5ac7a26 100644
--- a/fs/ecryptfs/kthread.c
+++ b/fs/ecryptfs/kthread.c
@@ -25,6 +25,7 @@
 #include <linux/slab.h>
 #include <linux/wait.h>
 #include <linux/mount.h>
+#include <linux/file.h>
 #include "ecryptfs_kernel.h"
 
 struct ecryptfs_open_req {
@@ -147,7 +148,7 @@ int ecryptfs_privileged_open(struct file **lower_file,
         flags |= IS_RDONLY(d_inode(lower_dentry)) ? O_RDONLY : O_RDWR;
         (*lower_file) = dentry_open(&req.path, flags, cred);
         if (!IS_ERR(*lower_file))
-                goto out;
+                goto have_file;
         if ((flags & O_ACCMODE) == O_RDONLY) {
                 rc = PTR_ERR((*lower_file));
                 goto out;
@@ -165,8 +166,16 @@ int ecryptfs_privileged_open(struct file **lower_file,
         mutex_unlock(&ecryptfs_kthread_ctl.mux);
         wake_up(&ecryptfs_kthread_ctl.wait);
         wait_for_completion(&req.done);
-        if (IS_ERR(*lower_file))
+        if (IS_ERR(*lower_file)) {
                 rc = PTR_ERR(*lower_file);
+                goto out;
+        }
+have_file:
+        if ((*lower_file)->f_op->mmap == NULL) {
+                fput(*lower_file);
+                *lower_file = NULL;
+                rc = -EMEDIUMTYPE;
+        }
 out:
         return rc;
 }
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index ccd4971cc6c1..264f07c7754e 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -341,8 +341,10 @@ static struct dentry *fuse_lookup(struct inode *dir, struct dentry *entry,
         struct dentry *newent;
         bool outarg_valid = true;
 
+        fuse_lock_inode(dir);
         err = fuse_lookup_name(dir->i_sb, get_node_id(dir), &entry->d_name,
                                &outarg, &inode);
+        fuse_unlock_inode(dir);
         if (err == -ENOENT) {
                 outarg_valid = false;
                 err = 0;
@@ -1341,7 +1343,9 @@ static int fuse_readdir(struct file *file, struct dir_context *ctx)
                 fuse_read_fill(req, file, ctx->pos, PAGE_SIZE,
                                FUSE_READDIR);
         }
+        fuse_lock_inode(inode);
         fuse_request_send(fc, req);
+        fuse_unlock_inode(inode);
         nbytes = req->out.args[0].size;
         err = req->out.h.error;
         fuse_put_request(fc, req);
diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
index eddbe02c4028..929c383432b0 100644
--- a/fs/fuse/fuse_i.h
+++ b/fs/fuse/fuse_i.h
@@ -110,6 +110,9 @@ struct fuse_inode {
 
         /** Miscellaneous bits describing inode state */
         unsigned long state;
+
+        /** Lock for serializing lookup and readdir for back compatibility*/
+        struct mutex mutex;
 };
 
 /** FUSE inode state bits */
@@ -540,6 +543,9 @@ struct fuse_conn {
         /** write-back cache policy (default is write-through) */
         unsigned writeback_cache:1;
 
+        /** allow parallel lookups and readdir (default is serialized) */
+        unsigned parallel_dirops:1;
+
         /*
          * The following bitfields are only for optimization purposes
          * and hence races in setting them will not cause malfunction
@@ -956,4 +962,7 @@ int fuse_do_setattr(struct inode *inode, struct iattr *attr,
 
 void fuse_set_initialized(struct fuse_conn *fc);
 
+void fuse_unlock_inode(struct inode *inode);
+void fuse_lock_inode(struct inode *inode);
+
 #endif /* _FS_FUSE_I_H */
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index 1ce67668a8e1..9961d8432ce3 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -97,6 +97,7 @@ static struct inode *fuse_alloc_inode(struct super_block *sb)
         INIT_LIST_HEAD(&fi->queued_writes);
         INIT_LIST_HEAD(&fi->writepages);
         init_waitqueue_head(&fi->page_waitq);
+        mutex_init(&fi->mutex);
         fi->forget = fuse_alloc_forget();
         if (!fi->forget) {
                 kmem_cache_free(fuse_inode_cachep, inode);
@@ -117,6 +118,7 @@ static void fuse_destroy_inode(struct inode *inode)
         struct fuse_inode *fi = get_fuse_inode(inode);
         BUG_ON(!list_empty(&fi->write_files));
         BUG_ON(!list_empty(&fi->queued_writes));
+        mutex_destroy(&fi->mutex);
         kfree(fi->forget);
         call_rcu(&inode->i_rcu, fuse_i_callback);
 }
@@ -351,6 +353,18 @@ int fuse_reverse_inval_inode(struct super_block *sb, u64 nodeid,
         return 0;
 }
 
+void fuse_lock_inode(struct inode *inode)
+{
+        if (!get_fuse_conn(inode)->parallel_dirops)
+                mutex_lock(&get_fuse_inode(inode)->mutex);
+}
+
+void fuse_unlock_inode(struct inode *inode)
+{
+        if (!get_fuse_conn(inode)->parallel_dirops)
+                mutex_unlock(&get_fuse_inode(inode)->mutex);
+}
+
 static void fuse_umount_begin(struct super_block *sb)
 {
         fuse_abort_conn(get_fuse_conn_super(sb));
@@ -898,6 +912,8 @@ static void process_init_reply(struct fuse_conn *fc, struct fuse_req *req)
                                 fc->async_dio = 1;
                         if (arg->flags & FUSE_WRITEBACK_CACHE)
                                 fc->writeback_cache = 1;
+                        if (arg->flags & FUSE_PARALLEL_DIROPS)
+                                fc->parallel_dirops = 1;
                         if (arg->time_gran && arg->time_gran <= 1000000000)
                                 fc->sb->s_time_gran = arg->time_gran;
                 } else {
@@ -928,7 +944,8 @@ static void fuse_send_init(struct fuse_conn *fc, struct fuse_req *req)
                 FUSE_SPLICE_WRITE | FUSE_SPLICE_MOVE | FUSE_SPLICE_READ |
                 FUSE_FLOCK_LOCKS | FUSE_IOCTL_DIR | FUSE_AUTO_INVAL_DATA |
                 FUSE_DO_READDIRPLUS | FUSE_READDIRPLUS_AUTO | FUSE_ASYNC_DIO |
-                FUSE_WRITEBACK_CACHE | FUSE_NO_OPEN_SUPPORT;
+                FUSE_WRITEBACK_CACHE | FUSE_NO_OPEN_SUPPORT |
+                FUSE_PARALLEL_DIROPS;
         req->in.h.opcode = FUSE_INIT;
         req->in.numargs = 1;
         req->in.args[0].size = sizeof(*arg);
diff --git a/fs/internal.h b/fs/internal.h
index b71deeecea17..f57ced528cde 100644
--- a/fs/internal.h
+++ b/fs/internal.h
@@ -130,6 +130,7 @@ extern int invalidate_inodes(struct super_block *, bool);
 extern struct dentry *__d_alloc(struct super_block *, const struct qstr *);
 extern int d_set_mounted(struct dentry *dentry);
 extern long prune_dcache_sb(struct super_block *sb, struct shrink_control *sc);
+extern struct dentry *d_alloc_cursor(struct dentry *);
 
 /*
  * read_write.c
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index b31852f76f46..e3ca4b4cac84 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -2329,18 +2329,10 @@ void *jbd2_alloc(size_t size, gfp_t flags)
 
         BUG_ON(size & (size-1)); /* Must be a power of 2 */
 
-        flags |= __GFP_REPEAT;
-        if (size == PAGE_SIZE)
-                ptr = (void *)__get_free_pages(flags, 0);
-        else if (size > PAGE_SIZE) {
-                int order = get_order(size);
-
-                if (order < 3)
-                        ptr = (void *)__get_free_pages(flags, order);
-                else
-                        ptr = vmalloc(size);
-        } else
+        if (size < PAGE_SIZE)
                 ptr = kmem_cache_alloc(get_slab(size), flags);
+        else
+                ptr = (void *)__get_free_pages(flags, get_order(size));
 
         /* Check alignment; SLUB has gotten this wrong in the past,
          * and this can lead to user data corruption! */
@@ -2351,20 +2343,10 @@ void *jbd2_alloc(size_t size, gfp_t flags)
 
 void jbd2_free(void *ptr, size_t size)
 {
-        if (size == PAGE_SIZE) {
-                free_pages((unsigned long)ptr, 0);
-                return;
-        }
-        if (size > PAGE_SIZE) {
-                int order = get_order(size);
-
-                if (order < 3)
-                        free_pages((unsigned long)ptr, order);
-                else
-                        vfree(ptr);
-                return;
-        }
-        kmem_cache_free(get_slab(size), ptr);
+        if (size < PAGE_SIZE)
+                kmem_cache_free(get_slab(size), ptr);
+        else
+                free_pages((unsigned long)ptr, get_order(size));
 };
 
 /*
diff --git a/fs/libfs.c b/fs/libfs.c
index 3db2721144c2..74dc8b9e7f53 100644
--- a/fs/libfs.c
+++ b/fs/libfs.c
@@ -71,9 +71,7 @@ EXPORT_SYMBOL(simple_lookup);
 
 int dcache_dir_open(struct inode *inode, struct file *file)
 {
-        static struct qstr cursor_name = QSTR_INIT(".", 1);
-
-        file->private_data = d_alloc(file->f_path.dentry, &cursor_name);
+        file->private_data = d_alloc_cursor(file->f_path.dentry);
 
         return file->private_data ? 0 : -ENOMEM;
 }
@@ -86,6 +84,61 @@ int dcache_dir_close(struct inode *inode, struct file *file)
 }
 EXPORT_SYMBOL(dcache_dir_close);
 
+/* parent is locked at least shared */
+static struct dentry *next_positive(struct dentry *parent,
+                                    struct list_head *from,
+                                    int count)
+{
+        unsigned *seq = &parent->d_inode->i_dir_seq, n;
+        struct dentry *res;
+        struct list_head *p;
+        bool skipped;
+        int i;
+
+retry:
+        i = count;
+        skipped = false;
+        n = smp_load_acquire(seq) & ~1;
+        res = NULL;
+        rcu_read_lock();
+        for (p = from->next; p != &parent->d_subdirs; p = p->next) {
+                struct dentry *d = list_entry(p, struct dentry, d_child);
+                if (!simple_positive(d)) {
+                        skipped = true;
+                } else if (!--i) {
+                        res = d;
+                        break;
+                }
+        }
+        rcu_read_unlock();
+        if (skipped) {
+                smp_rmb();
+                if (unlikely(*seq != n))
+                        goto retry;
+        }
+        return res;
+}
+
+static void move_cursor(struct dentry *cursor, struct list_head *after)
+{
+        struct dentry *parent = cursor->d_parent;
+        unsigned n, *seq = &parent->d_inode->i_dir_seq;
+        spin_lock(&parent->d_lock);
+        for (;;) {
+                n = *seq;
+                if (!(n & 1) && cmpxchg(seq, n, n + 1) == n)
+                        break;
+                cpu_relax();
+        }
+        __list_del(cursor->d_child.prev, cursor->d_child.next);
+        if (after)
+                list_add(&cursor->d_child, after);
+        else
+                list_add_tail(&cursor->d_child, &parent->d_subdirs);
+        smp_store_release(seq, n + 2);
+        spin_unlock(&parent->d_lock);
+}
+
 loff_t dcache_dir_lseek(struct file *file, loff_t offset, int whence)
 {
         struct dentry *dentry = file->f_path.dentry;
@@ -101,25 +154,14 @@ loff_t dcache_dir_lseek(struct file *file, loff_t offset, int whence)
         if (offset != file->f_pos) {
                 file->f_pos = offset;
                 if (file->f_pos >= 2) {
-                        struct list_head *p;
                         struct dentry *cursor = file->private_data;
+                        struct dentry *to;
                         loff_t n = file->f_pos - 2;
 
-                        spin_lock(&dentry->d_lock);
-                        /* d_lock not required for cursor */
-                        list_del(&cursor->d_child);
-                        p = dentry->d_subdirs.next;
-                        while (n && p != &dentry->d_subdirs) {
-                                struct dentry *next;
-                                next = list_entry(p, struct dentry, d_child);
-                                spin_lock_nested(&next->d_lock, DENTRY_D_LOCK_NESTED);
-                                if (simple_positive(next))
-                                        n--;
-                                spin_unlock(&next->d_lock);
-                                p = p->next;
-                        }
-                        list_add_tail(&cursor->d_child, p);
-                        spin_unlock(&dentry->d_lock);
+                        inode_lock_shared(dentry->d_inode);
+                        to = next_positive(dentry, &dentry->d_subdirs, n);
+                        move_cursor(cursor, to ? &to->d_child : NULL);
+                        inode_unlock_shared(dentry->d_inode);
                 }
         }
         return offset;
@@ -142,36 +184,25 @@ int dcache_readdir(struct file *file, struct dir_context *ctx)
 {
         struct dentry *dentry = file->f_path.dentry;
         struct dentry *cursor = file->private_data;
-        struct list_head *p, *q = &cursor->d_child;
+        struct list_head *p = &cursor->d_child;
+        struct dentry *next;
+        bool moved = false;
 
         if (!dir_emit_dots(file, ctx))
                 return 0;
-        spin_lock(&dentry->d_lock);
-        if (ctx->pos == 2)
-                list_move(q, &dentry->d_subdirs);
 
-        for (p = q->next; p != &dentry->d_subdirs; p = p->next) {
-                struct dentry *next = list_entry(p, struct dentry, d_child);
-                spin_lock_nested(&next->d_lock, DENTRY_D_LOCK_NESTED);
-                if (!simple_positive(next)) {
-                        spin_unlock(&next->d_lock);
-                        continue;
-                }
-
-                spin_unlock(&next->d_lock);
-                spin_unlock(&dentry->d_lock);
+        if (ctx->pos == 2)
+                p = &dentry->d_subdirs;
+        while ((next = next_positive(dentry, p, 1)) != NULL) {
                 if (!dir_emit(ctx, next->d_name.name, next->d_name.len,
                               d_inode(next)->i_ino, dt_type(d_inode(next))))
-                        return 0;
-                spin_lock(&dentry->d_lock);
-                spin_lock_nested(&next->d_lock, DENTRY_D_LOCK_NESTED);
-                /* next is still alive */
-                list_move(q, p);
-                spin_unlock(&next->d_lock);
-                p = q;
+                        break;
+                moved = true;
+                p = &next->d_child;
                 ctx->pos++;
         }
-        spin_unlock(&dentry->d_lock);
+        if (moved)
+                move_cursor(cursor, p);
         return 0;
 }
 EXPORT_SYMBOL(dcache_readdir);
diff --git a/fs/lockd/svc.c b/fs/lockd/svc.c
index 154a107cd376..fc4084ef4736 100644
--- a/fs/lockd/svc.c
+++ b/fs/lockd/svc.c
@@ -335,12 +335,17 @@ static struct notifier_block lockd_inet6addr_notifier = {
 };
 #endif
 
-static void lockd_svc_exit_thread(void)
+static void lockd_unregister_notifiers(void)
 {
         unregister_inetaddr_notifier(&lockd_inetaddr_notifier);
 #if IS_ENABLED(CONFIG_IPV6)
         unregister_inet6addr_notifier(&lockd_inet6addr_notifier);
 #endif
+}
+
+static void lockd_svc_exit_thread(void)
+{
+        lockd_unregister_notifiers();
         svc_exit_thread(nlmsvc_rqst);
 }
 
@@ -462,7 +467,7 @@ int lockd_up(struct net *net)
          * Note: svc_serv structures have an initial use count of 1,
          * so we exit through here on both success and failure.
          */
-err_net:
+err_put:
         svc_destroy(serv);
 err_create:
         mutex_unlock(&nlmsvc_mutex);
@@ -470,7 +475,9 @@ err_create:
 
 err_start:
         lockd_down_net(serv, net);
-        goto err_net;
+err_net:
+        lockd_unregister_notifiers();
+        goto err_put;
 }
 EXPORT_SYMBOL_GPL(lockd_up);
 
diff --git a/fs/locks.c b/fs/locks.c
index 7c5f91be9b65..ee1b15f6fc13 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -1628,7 +1628,7 @@ generic_add_lease(struct file *filp, long arg, struct file_lock **flp, void **pr
 {
         struct file_lock *fl, *my_fl = NULL, *lease;
         struct dentry *dentry = filp->f_path.dentry;
-        struct inode *inode = dentry->d_inode;
+        struct inode *inode = file_inode(filp);
         struct file_lock_context *ctx;
         bool is_deleg = (*flp)->fl_flags & FL_DELEG;
         int error;
diff --git a/fs/namei.c b/fs/namei.c
index 6a82fb7e2127..70580ab1445c 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -3030,9 +3030,13 @@ static int atomic_open(struct nameidata *nd, struct dentry *dentry,
                         }
                         if (*opened & FILE_CREATED)
                                 fsnotify_create(dir, dentry);
-                        path->dentry = dentry;
-                        path->mnt = nd->path.mnt;
-                        return 1;
+                        if (unlikely(d_is_negative(dentry))) {
+                                error = -ENOENT;
+                        } else {
+                                path->dentry = dentry;
+                                path->mnt = nd->path.mnt;
+                                return 1;
+                        }
                 }
         }
         dput(dentry);
@@ -3201,9 +3205,7 @@ static int do_last(struct nameidata *nd,
         int acc_mode = op->acc_mode;
         unsigned seq;
         struct inode *inode;
-        struct path save_parent = { .dentry = NULL, .mnt = NULL };
         struct path path;
-        bool retried = false;
         int error;
 
         nd->flags &= ~LOOKUP_PARENT;
@@ -3246,7 +3248,6 @@ static int do_last(struct nameidata *nd,
                         return -EISDIR;
         }
 
-retry_lookup:
         if (open_flag & (O_CREAT | O_TRUNC | O_WRONLY | O_RDWR)) {
                 error = mnt_want_write(nd->path.mnt);
                 if (!error)
@@ -3298,6 +3299,10 @@ retry_lookup:
                 got_write = false;
         }
 
+        error = follow_managed(&path, nd);
+        if (unlikely(error < 0))
+                return error;
+
         if (unlikely(d_is_negative(path.dentry))) {
                 path_to_nameidata(&path, nd);
                 return -ENOENT;
@@ -3313,10 +3318,6 @@ retry_lookup:
                 return -EEXIST;
         }
 
-        error = follow_managed(&path, nd);
-        if (unlikely(error < 0))
-                return error;
-
         seq = 0;        /* out of RCU mode, so the value doesn't matter */
         inode = d_backing_inode(path.dentry);
 finish_lookup:
@@ -3327,23 +3328,14 @@ finish_lookup:
         if (unlikely(error))
                 return error;
 
-        if ((nd->flags & LOOKUP_RCU) || nd->path.mnt != path.mnt) {
-                path_to_nameidata(&path, nd);
-        } else {
-                save_parent.dentry = nd->path.dentry;
-                save_parent.mnt = mntget(path.mnt);
-                nd->path.dentry = path.dentry;
-
-        }
+        path_to_nameidata(&path, nd);
         nd->inode = inode;
         nd->seq = seq;
         /* Why this, you ask?  _Now_ we might have grown LOOKUP_JUMPED... */
 finish_open:
         error = complete_walk(nd);
-        if (error) {
-                path_put(&save_parent);
+        if (error)
                 return error;
-        }
         audit_inode(nd->name, nd->path.dentry, 0);
         error = -EISDIR;
         if ((open_flag & O_CREAT) && d_is_dir(nd->path.dentry))
@@ -3366,13 +3358,9 @@ finish_open_created:
                 goto out;
         BUG_ON(*opened & FILE_OPENED); /* once it's opened, it's opened */
         error = vfs_open(&nd->path, file, current_cred());
-        if (!error) {
-                *opened |= FILE_OPENED;
-        } else {
-                if (error == -EOPENSTALE)
-                        goto stale_open;
+        if (error)
                 goto out;
-        }
+        *opened |= FILE_OPENED;
 opened:
         error = open_check_o_direct(file);
         if (!error)
@@ -3388,26 +3376,7 @@ out:
         }
         if (got_write)
                 mnt_drop_write(nd->path.mnt);
-        path_put(&save_parent);
         return error;
-
-stale_open:
-        /* If no saved parent or already retried then can't retry */
-        if (!save_parent.dentry || retried)
-                goto out;
-
-        BUG_ON(save_parent.dentry != dir);
-        path_put(&nd->path);
-        nd->path = save_parent;
-        nd->inode = dir->d_inode;
-        save_parent.mnt = NULL;
-        save_parent.dentry = NULL;
-        if (got_write) {
-                mnt_drop_write(nd->path.mnt);
-                got_write = false;
-        }
-        retried = true;
-        goto retry_lookup;
 }
 
 static int do_tmpfile(struct nameidata *nd, unsigned flags,
diff --git a/fs/namespace.c b/fs/namespace.c
index 4fb1691b4355..419f746d851d 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1562,6 +1562,7 @@ void __detach_mounts(struct dentry *dentry)
                 goto out_unlock;
 
         lock_mount_hash();
+        event++;
         while (!hlist_empty(&mp->m_list)) {
                 mnt = hlist_entry(mp->m_list.first, struct mount, mnt_mp_list);
                 if (mnt->mnt.mnt_flags & MNT_UMOUNT) {
@@ -2409,8 +2410,10 @@ static int do_new_mount(struct path *path, const char *fstype, int flags,
                         mnt_flags |= MNT_NODEV | MNT_LOCK_NODEV;
                 }
                 if (type->fs_flags & FS_USERNS_VISIBLE) {
-                        if (!fs_fully_visible(type, &mnt_flags))
+                        if (!fs_fully_visible(type, &mnt_flags)) {
+                                put_filesystem(type);
                                 return -EPERM;
+                        }
                 }
         }
 
@@ -3245,6 +3248,10 @@ static bool fs_fully_visible(struct file_system_type *type, int *new_mnt_flags)
                 if (mnt->mnt.mnt_sb->s_iflags & SB_I_NOEXEC)
                         mnt_flags &= ~(MNT_LOCK_NOSUID | MNT_LOCK_NOEXEC);
 
+                /* Don't miss readonly hidden in the superblock flags */
+                if (mnt->mnt.mnt_sb->s_flags & MS_RDONLY)
+                        mnt_flags |= MNT_LOCK_READONLY;
+
                 /* Verify the mount flags are equal to or more permissive
                  * than the proposed new mount.
                  */
@@ -3271,7 +3278,7 @@ static bool fs_fully_visible(struct file_system_type *type, int *new_mnt_flags)
                 list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) {
                         struct inode *inode = child->mnt_mountpoint->d_inode;
                         /* Only worry about locked mounts */
-                        if (!(mnt_flags & MNT_LOCKED))
+                        if (!(child->mnt.mnt_flags & MNT_LOCKED))
                                 continue;
                         /* Is the directory permanetly empty? */
                         if (!is_empty_dir_inode(inode))
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index aaf7bd0cbae2..d8015a03db4c 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -424,12 +424,17 @@ static int xdr_decode(nfs_readdir_descriptor_t *desc,
 static
 int nfs_same_file(struct dentry *dentry, struct nfs_entry *entry)
 {
+        struct inode *inode;
         struct nfs_inode *nfsi;
 
         if (d_really_is_negative(dentry))
                 return 0;
 
-        nfsi = NFS_I(d_inode(dentry));
+        inode = d_inode(dentry);
+        if (is_bad_inode(inode) || NFS_STALE(inode))
+                return 0;
+
+        nfsi = NFS_I(inode);
         if (entry->fattr->fileid == nfsi->fileid)
                 return 1;
         if (nfs_compare_fh(entry->fh, &nfsi->fh) == 0)
@@ -1363,7 +1368,6 @@ EXPORT_SYMBOL_GPL(nfs_dentry_operations);
 struct dentry *nfs_lookup(struct inode *dir, struct dentry * dentry, unsigned int flags)
 {
         struct dentry *res;
-        struct dentry *parent;
         struct inode *inode = NULL;
         struct nfs_fh *fhandle = NULL;
         struct nfs_fattr *fattr = NULL;
@@ -1393,7 +1397,6 @@ struct dentry *nfs_lookup(struct inode *dir, struct dentry * dentry, unsigned in
         if (IS_ERR(label))
                 goto out;
 
-        parent = dentry->d_parent;
         /* Protect against concurrent sillydeletes */
         trace_nfs_lookup_enter(dir, dentry, flags);
         error = NFS_PROTO(dir)->lookup(dir, &dentry->d_name, fhandle, fattr, label);
@@ -1536,9 +1539,9 @@ int nfs_atomic_open(struct inode *dir, struct dentry *dentry,
                 err = PTR_ERR(inode);
                 trace_nfs_atomic_open_exit(dir, ctx, open_flags, err);
                 put_nfs_open_context(ctx);
+                d_drop(dentry);
                 switch (err) {
                 case -ENOENT:
-                        d_drop(dentry);
                         d_add(dentry, NULL);
                         nfs_set_verifier(dentry, nfs_save_change_attribute(dir));
                         break;
diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index 979b3c4dee6a..c7326c2af2c3 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -353,10 +353,12 @@ static ssize_t nfs_direct_wait(struct nfs_direct_req *dreq)
 
         result = wait_for_completion_killable(&dreq->completion);
 
+        if (!result) {
+                result = dreq->count;
+                WARN_ON_ONCE(dreq->count < 0);
+        }
         if (!result)
                 result = dreq->error;
-        if (!result)
-                result = dreq->count;
 
 out:
         return (ssize_t) result;
@@ -386,8 +388,10 @@ static void nfs_direct_complete(struct nfs_direct_req *dreq, bool write)
 
         if (dreq->iocb) {
                 long res = (long) dreq->error;
-                if (!res)
+                if (dreq->count != 0) {
                         res = (long) dreq->count;
+                        WARN_ON_ONCE(dreq->count < 0);
+                }
                 dreq->iocb->ki_complete(dreq->iocb, res, 0);
         }
 
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index 52e7d6869e3b..dda689d7a8a7 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -282,6 +282,7 @@ nfs_init_locked(struct inode *inode, void *opaque)
         struct nfs_fattr        *fattr = desc->fattr;
 
         set_nfs_fileid(inode, fattr->fileid);
+        inode->i_mode = fattr->mode;
         nfs_copy_fh(NFS_FH(inode), desc->fh);
         return 0;
 }
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index de97567795a5..ff416d0e24bc 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -2882,12 +2882,11 @@ static void nfs4_close_prepare(struct rpc_task *task, void *data)
                         call_close |= is_wronly;
                 else if (is_wronly)
                         calldata->arg.fmode |= FMODE_WRITE;
+                if (calldata->arg.fmode != (FMODE_READ|FMODE_WRITE))
+                        call_close |= is_rdwr;
         } else if (is_rdwr)
                 calldata->arg.fmode |= FMODE_READ|FMODE_WRITE;
 
-        if (calldata->arg.fmode == 0)
-                call_close |= is_rdwr;
-
         if (!nfs4_valid_open_stateid(state))
                 call_close = 0;
         spin_unlock(&state->owner->so_lock);
@@ -7924,8 +7923,8 @@ nfs4_layoutget_handle_exception(struct rpc_task *task,
                         break;
                 }
                 lo = NFS_I(inode)->layout;
-                if (lo && nfs4_stateid_match(&lgp->args.stateid,
-                                        &lo->plh_stateid)) {
+                if (lo && !test_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags) &&
+                    nfs4_stateid_match_other(&lgp->args.stateid, &lo->plh_stateid)) {
                         LIST_HEAD(head);
 
                         /*
@@ -7936,10 +7935,10 @@ nfs4_layoutget_handle_exception(struct rpc_task *task,
                         pnfs_mark_matching_lsegs_invalid(lo, &head, NULL, 0);
                         spin_unlock(&inode->i_lock);
                         pnfs_free_lseg_list(&head);
+                        status = -EAGAIN;
+                        goto out;
                 } else
                         spin_unlock(&inode->i_lock);
-                status = -EAGAIN;
-                goto out;
         }
 
         status = nfs4_handle_exception(server, status, exception);
@@ -8036,7 +8035,10 @@ nfs4_proc_layoutget(struct nfs4_layoutget *lgp, long *timeout, gfp_t gfp_flags)
                 .flags = RPC_TASK_ASYNC,
         };
         struct pnfs_layout_segment *lseg = NULL;
-        struct nfs4_exception exception = { .timeout = *timeout };
+        struct nfs4_exception exception = {
+                .inode = inode,
+                .timeout = *timeout,
+        };
         int status = 0;
 
         dprintk("--> %s\n", __func__);
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 9679f4749364..834b875900d6 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -1488,9 +1488,9 @@ restart:
                                         }
                                         spin_unlock(&state->state_lock);
                                 }
-                                nfs4_put_open_state(state);
                                 clear_bit(NFS_STATE_RECLAIM_NOGRACE,
                                         &state->flags);
+                                nfs4_put_open_state(state);
                                 spin_lock(&sp->so_lock);
                                 goto restart;
                         }
diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index 0c7e0d45a4de..0fbe734cc38c 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -361,8 +361,10 @@ pnfs_layout_remove_lseg(struct pnfs_layout_hdr *lo,
         list_del_init(&lseg->pls_list);
         /* Matched by pnfs_get_layout_hdr in pnfs_layout_insert_lseg */
         atomic_dec(&lo->plh_refcount);
-        if (list_empty(&lo->plh_segs))
+        if (list_empty(&lo->plh_segs)) {
+                set_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags);
                 clear_bit(NFS_LAYOUT_BULK_RECALL, &lo->plh_flags);
+        }
         rpc_wake_up(&NFS_SERVER(inode)->roc_rpcwaitq);
 }
 
@@ -1290,6 +1292,7 @@ alloc_init_layout_hdr(struct inode *ino,
         INIT_LIST_HEAD(&lo->plh_bulk_destroy);
         lo->plh_inode = ino;
         lo->plh_lc_cred = get_rpccred(ctx->cred);
+        lo->plh_flags |= 1 << NFS_LAYOUT_INVALID_STID;
         return lo;
 }
 
@@ -1297,6 +1300,8 @@ static struct pnfs_layout_hdr *
 pnfs_find_alloc_layout(struct inode *ino,
                        struct nfs_open_context *ctx,
                        gfp_t gfp_flags)
+        __releases(&ino->i_lock)
+        __acquires(&ino->i_lock)
 {
         struct nfs_inode *nfsi = NFS_I(ino);
         struct pnfs_layout_hdr *new = NULL;
@@ -1565,8 +1570,7 @@ lookup_again:
          * stateid, or it has been invalidated, then we must use the open
          * stateid.
          */
-        if (lo->plh_stateid.seqid == 0 ||
-            test_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags)) {
+        if (test_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags)) {
 
                 /*
                  * The first layoutget for the file. Need to serialize per
diff --git a/fs/nfs/pnfs_nfs.c b/fs/nfs/pnfs_nfs.c
index 0dfc476da3e1..b38e3c0dc790 100644
--- a/fs/nfs/pnfs_nfs.c
+++ b/fs/nfs/pnfs_nfs.c
@@ -247,7 +247,11 @@ void pnfs_fetch_commit_bucket_list(struct list_head *pages,
 }
 
 /* Helper function for pnfs_generic_commit_pagelist to catch an empty
- * page list. This can happen when two commits race. */
+ * page list. This can happen when two commits race.
+ *
+ * This must be called instead of nfs_init_commit - call one or the other, but
+ * not both!
+ */
 static bool
 pnfs_generic_commit_cancel_empty_pagelist(struct list_head *pages,
                                           struct nfs_commit_data *data,
@@ -256,7 +260,11 @@ pnfs_generic_commit_cancel_empty_pagelist(struct list_head *pages,
         if (list_empty(pages)) {
                 if (atomic_dec_and_test(&cinfo->mds->rpcs_out))
                         wake_up_atomic_t(&cinfo->mds->rpcs_out);
-                nfs_commitdata_release(data);
+                /* don't call nfs_commitdata_release - it tries to put
+                 * the open_context which is not acquired until nfs_init_commit
+                 * which has not been called on @data */
+                WARN_ON_ONCE(data->context);
+                nfs_commit_free(data);
                 return true;
         }
 
diff --git a/fs/nfs/read.c b/fs/nfs/read.c
index 6776d7a7839e..572e5b3b06f1 100644
--- a/fs/nfs/read.c
+++ b/fs/nfs/read.c
@@ -367,13 +367,13 @@ readpage_async_filler(void *data, struct page *page)
                 nfs_list_remove_request(new);
                 nfs_readpage_release(new);
                 error = desc->pgio->pg_error;
-                goto out_unlock;
+                goto out;
         }
         return 0;
 out_error:
         error = PTR_ERR(new);
-out_unlock:
         unlock_page(page);
+out:
         return error;
 }
 
diff --git a/fs/nfsd/blocklayout.c b/fs/nfsd/blocklayout.c
index e55b5242614d..31f3df193bdb 100644
--- a/fs/nfsd/blocklayout.c
+++ b/fs/nfsd/blocklayout.c
@@ -290,7 +290,7 @@ out_free_buf:
         return error;
 }
 
-#define NFSD_MDS_PR_KEY         0x0100000000000000
+#define NFSD_MDS_PR_KEY         0x0100000000000000ULL
 
 /*
  * We use the client ID as a unique key for the reservations.
diff --git a/fs/nfsd/nfs2acl.c b/fs/nfsd/nfs2acl.c
index 1580ea6fd64d..d08cd88155c7 100644
--- a/fs/nfsd/nfs2acl.c
+++ b/fs/nfsd/nfs2acl.c
@@ -104,22 +104,21 @@ static __be32 nfsacld_proc_setacl(struct svc_rqst * rqstp,
                 goto out;
 
         inode = d_inode(fh->fh_dentry);
-        if (!IS_POSIXACL(inode) || !inode->i_op->set_acl) {
-                error = -EOPNOTSUPP;
-                goto out_errno;
-        }
 
         error = fh_want_write(fh);
         if (error)
                 goto out_errno;
 
-        error = inode->i_op->set_acl(inode, argp->acl_access, ACL_TYPE_ACCESS);
+        fh_lock(fh);
+
+        error = set_posix_acl(inode, ACL_TYPE_ACCESS, argp->acl_access);
         if (error)
-                goto out_drop_write;
-        error = inode->i_op->set_acl(inode, argp->acl_default,
-                                     ACL_TYPE_DEFAULT);
+                goto out_drop_lock;
+        error = set_posix_acl(inode, ACL_TYPE_DEFAULT, argp->acl_default);
         if (error)
-                goto out_drop_write;
+                goto out_drop_lock;
+
+        fh_unlock(fh);
 
         fh_drop_write(fh);
 
@@ -131,7 +130,8 @@ out:
         posix_acl_release(argp->acl_access);
         posix_acl_release(argp->acl_default);
         return nfserr;
-out_drop_write:
+out_drop_lock:
+        fh_unlock(fh);
         fh_drop_write(fh);
 out_errno:
         nfserr = nfserrno(error);
diff --git a/fs/nfsd/nfs3acl.c b/fs/nfsd/nfs3acl.c
index 01df4cd7c753..0c890347cde3 100644
--- a/fs/nfsd/nfs3acl.c
+++ b/fs/nfsd/nfs3acl.c
@@ -95,22 +95,20 @@ static __be32 nfsd3_proc_setacl(struct svc_rqst * rqstp,
                 goto out;
 
         inode = d_inode(fh->fh_dentry);
-        if (!IS_POSIXACL(inode) || !inode->i_op->set_acl) {
-                error = -EOPNOTSUPP;
-                goto out_errno;
-        }
 
         error = fh_want_write(fh);
         if (error)
                 goto out_errno;
 
-        error = inode->i_op->set_acl(inode, argp->acl_access, ACL_TYPE_ACCESS);
+        fh_lock(fh);
+
+        error = set_posix_acl(inode, ACL_TYPE_ACCESS, argp->acl_access);
         if (error)
-                goto out_drop_write;
-        error = inode->i_op->set_acl(inode, argp->acl_default,
-                                     ACL_TYPE_DEFAULT);
+                goto out_drop_lock;
+        error = set_posix_acl(inode, ACL_TYPE_DEFAULT, argp->acl_default);
 
-out_drop_write:
+out_drop_lock:
+        fh_unlock(fh);
         fh_drop_write(fh);
 out_errno:
         nfserr = nfserrno(error);
diff --git a/fs/nfsd/nfs4acl.c b/fs/nfsd/nfs4acl.c
index 6adabd6049b7..71292a0d6f09 100644
--- a/fs/nfsd/nfs4acl.c
+++ b/fs/nfsd/nfs4acl.c
@@ -770,9 +770,6 @@ nfsd4_set_nfs4_acl(struct svc_rqst *rqstp, struct svc_fh *fhp,
         dentry = fhp->fh_dentry;
         inode = d_inode(dentry);
 
-        if (!inode->i_op->set_acl || !IS_POSIXACL(inode))
-                return nfserr_attrnotsupp;
-
         if (S_ISDIR(inode->i_mode))
                 flags = NFS4_ACL_DIR;
 
@@ -782,16 +779,19 @@ nfsd4_set_nfs4_acl(struct svc_rqst *rqstp, struct svc_fh *fhp,
         if (host_error < 0)
                 goto out_nfserr;
 
-        host_error = inode->i_op->set_acl(inode, pacl, ACL_TYPE_ACCESS);
+        fh_lock(fhp);
+
+        host_error = set_posix_acl(inode, ACL_TYPE_ACCESS, pacl);
         if (host_error < 0)
-                goto out_release;
+                goto out_drop_lock;
 
         if (S_ISDIR(inode->i_mode)) {
-                host_error = inode->i_op->set_acl(inode, dpacl,
-                                                  ACL_TYPE_DEFAULT);
+                host_error = set_posix_acl(inode, ACL_TYPE_DEFAULT, dpacl);
         }
 
-out_release:
+out_drop_lock:
+        fh_unlock(fhp);
+
         posix_acl_release(pacl);
         posix_acl_release(dpacl);
 out_nfserr:
diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c
index 7389cb1d7409..04c68d900324 100644
--- a/fs/nfsd/nfs4callback.c
+++ b/fs/nfsd/nfs4callback.c
@@ -710,22 +710,6 @@ static struct rpc_cred *get_backchannel_cred(struct nfs4_client *clp, struct rpc
         }
 }
 
-static struct rpc_clnt *create_backchannel_client(struct rpc_create_args *args)
-{
-        struct rpc_xprt *xprt;
-
-        if (args->protocol != XPRT_TRANSPORT_BC_TCP)
-                return rpc_create(args);
-
-        xprt = args->bc_xprt->xpt_bc_xprt;
-        if (xprt) {
-                xprt_get(xprt);
-                return rpc_create_xprt(args, xprt);
-        }
-
-        return rpc_create(args);
-}
-
 static int setup_callback_client(struct nfs4_client *clp, struct nfs4_cb_conn *conn, struct nfsd4_session *ses)
 {
         int maxtime = max_cb_time(clp->net);
@@ -768,7 +752,7 @@ static int setup_callback_client(struct nfs4_client *clp, struct nfs4_cb_conn *c
                 args.authflavor = ses->se_cb_sec.flavor;
         }
         /* Create RPC client */
-        client = create_backchannel_client(&args);
+        client = rpc_create(&args);
         if (IS_ERR(client)) {
                 dprintk("NFSD: couldn't create callback client: %ld\n",
                         PTR_ERR(client));
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index f5f82e145018..70d0b9b33031 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -3480,12 +3480,17 @@ alloc_init_open_stateowner(unsigned int strhashval, struct nfsd4_open *open,
 }
 
 static struct nfs4_ol_stateid *
-init_open_stateid(struct nfs4_ol_stateid *stp, struct nfs4_file *fp,
-                struct nfsd4_open *open)
+init_open_stateid(struct nfs4_file *fp, struct nfsd4_open *open)
 {
 
         struct nfs4_openowner *oo = open->op_openowner;
         struct nfs4_ol_stateid *retstp = NULL;
+        struct nfs4_ol_stateid *stp;
+
+        stp = open->op_stp;
+        /* We are moving these outside of the spinlocks to avoid the warnings */
+        mutex_init(&stp->st_mutex);
+        mutex_lock(&stp->st_mutex);
 
         spin_lock(&oo->oo_owner.so_client->cl_lock);
         spin_lock(&fp->fi_lock);
@@ -3493,6 +3498,8 @@ init_open_stateid(struct nfs4_ol_stateid *stp, struct nfs4_file *fp,
         retstp = nfsd4_find_existing_open(fp, open);
         if (retstp)
                 goto out_unlock;
+
+        open->op_stp = NULL;
         atomic_inc(&stp->st_stid.sc_count);
         stp->st_stid.sc_type = NFS4_OPEN_STID;
         INIT_LIST_HEAD(&stp->st_locks);
@@ -3502,14 +3509,19 @@ init_open_stateid(struct nfs4_ol_stateid *stp, struct nfs4_file *fp,
         stp->st_access_bmap = 0;
         stp->st_deny_bmap = 0;
         stp->st_openstp = NULL;
-        init_rwsem(&stp->st_rwsem);
         list_add(&stp->st_perstateowner, &oo->oo_owner.so_stateids);
         list_add(&stp->st_perfile, &fp->fi_stateids);
 
 out_unlock:
         spin_unlock(&fp->fi_lock);
         spin_unlock(&oo->oo_owner.so_client->cl_lock);
-        return retstp;
+        if (retstp) {
+                mutex_lock(&retstp->st_mutex);
+                /* To keep mutex tracking happy */
+                mutex_unlock(&stp->st_mutex);
+                stp = retstp;
+        }
+        return stp;
 }
 
 /*
@@ -4305,7 +4317,6 @@ nfsd4_process_open2(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nf
         struct nfs4_client *cl = open->op_openowner->oo_owner.so_client;
         struct nfs4_file *fp = NULL;
         struct nfs4_ol_stateid *stp = NULL;
-        struct nfs4_ol_stateid *swapstp = NULL;
         struct nfs4_delegation *dp = NULL;
         __be32 status;
 
@@ -4335,32 +4346,28 @@ nfsd4_process_open2(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nf
          */
         if (stp) {
                 /* Stateid was found, this is an OPEN upgrade */
-                down_read(&stp->st_rwsem);
+                mutex_lock(&stp->st_mutex);
                 status = nfs4_upgrade_open(rqstp, fp, current_fh, stp, open);
                 if (status) {
-                        up_read(&stp->st_rwsem);
+                        mutex_unlock(&stp->st_mutex);
                         goto out;
                 }
         } else {
-                stp = open->op_stp;
-                open->op_stp = NULL;
-                swapstp = init_open_stateid(stp, fp, open);
-                if (swapstp) {
-                        nfs4_put_stid(&stp->st_stid);
-                        stp = swapstp;
-                        down_read(&stp->st_rwsem);
+                /* stp is returned locked. */
+                stp = init_open_stateid(fp, open);
+                /* See if we lost the race to some other thread */
+                if (stp->st_access_bmap != 0) {
                         status = nfs4_upgrade_open(rqstp, fp, current_fh,
                                                 stp, open);
                         if (status) {
-                                up_read(&stp->st_rwsem);
+                                mutex_unlock(&stp->st_mutex);
                                 goto out;
                         }
                         goto upgrade_out;
                 }
-                down_read(&stp->st_rwsem);
                 status = nfs4_get_vfs_file(rqstp, fp, current_fh, stp, open);
                 if (status) {
-                        up_read(&stp->st_rwsem);
+                        mutex_unlock(&stp->st_mutex);
                         release_open_stateid(stp);
                         goto out;
                 }
@@ -4372,7 +4379,7 @@ nfsd4_process_open2(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nf
         }
 upgrade_out:
         nfs4_inc_and_copy_stateid(&open->op_stateid, &stp->st_stid);
-        up_read(&stp->st_rwsem);
+        mutex_unlock(&stp->st_mutex);
 
         if (nfsd4_has_session(&resp->cstate)) {
                 if (open->op_deleg_want & NFS4_SHARE_WANT_NO_DELEG) {
@@ -4977,12 +4984,12 @@ static __be32 nfs4_seqid_op_checks(struct nfsd4_compound_state *cstate, stateid_
                  * revoked delegations are kept only for free_stateid.
                  */
                 return nfserr_bad_stateid;
-        down_write(&stp->st_rwsem);
+        mutex_lock(&stp->st_mutex);
         status = check_stateid_generation(stateid, &stp->st_stid.sc_stateid, nfsd4_has_session(cstate));
         if (status == nfs_ok)
                 status = nfs4_check_fh(current_fh, &stp->st_stid);
         if (status != nfs_ok)
-                up_write(&stp->st_rwsem);
+                mutex_unlock(&stp->st_mutex);
         return status;
 }
 
@@ -5030,7 +5037,7 @@ static __be32 nfs4_preprocess_confirmed_seqid_op(struct nfsd4_compound_state *cs
                 return status;
         oo = openowner(stp->st_stateowner);
         if (!(oo->oo_flags & NFS4_OO_CONFIRMED)) {
-                up_write(&stp->st_rwsem);
+                mutex_unlock(&stp->st_mutex);
                 nfs4_put_stid(&stp->st_stid);
                 return nfserr_bad_stateid;
         }
@@ -5062,12 +5069,12 @@ nfsd4_open_confirm(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
         oo = openowner(stp->st_stateowner);
         status = nfserr_bad_stateid;
         if (oo->oo_flags & NFS4_OO_CONFIRMED) {
-                up_write(&stp->st_rwsem);
+                mutex_unlock(&stp->st_mutex);
                 goto put_stateid;
         }
         oo->oo_flags |= NFS4_OO_CONFIRMED;
         nfs4_inc_and_copy_stateid(&oc->oc_resp_stateid, &stp->st_stid);
-        up_write(&stp->st_rwsem);
+        mutex_unlock(&stp->st_mutex);
         dprintk("NFSD: %s: success, seqid=%d stateid=" STATEID_FMT "\n",
                 __func__, oc->oc_seqid, STATEID_VAL(&stp->st_stid.sc_stateid));
 
@@ -5143,7 +5150,7 @@ nfsd4_open_downgrade(struct svc_rqst *rqstp,
         nfs4_inc_and_copy_stateid(&od->od_stateid, &stp->st_stid);
         status = nfs_ok;
 put_stateid:
-        up_write(&stp->st_rwsem);
+        mutex_unlock(&stp->st_mutex);
         nfs4_put_stid(&stp->st_stid);
 out:
         nfsd4_bump_seqid(cstate, status);
@@ -5196,7 +5203,7 @@ nfsd4_close(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
         if (status)
                 goto out; 
         nfs4_inc_and_copy_stateid(&close->cl_stateid, &stp->st_stid);
-        up_write(&stp->st_rwsem);
+        mutex_unlock(&stp->st_mutex);
 
         nfsd4_close_open_stateid(stp);
 
@@ -5422,7 +5429,7 @@ init_lock_stateid(struct nfs4_ol_stateid *stp, struct nfs4_lockowner *lo,
         stp->st_access_bmap = 0;
         stp->st_deny_bmap = open_stp->st_deny_bmap;
         stp->st_openstp = open_stp;
-        init_rwsem(&stp->st_rwsem);
+        mutex_init(&stp->st_mutex);
         list_add(&stp->st_locks, &open_stp->st_locks);
         list_add(&stp->st_perstateowner, &lo->lo_owner.so_stateids);
         spin_lock(&fp->fi_lock);
@@ -5591,7 +5598,7 @@ nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
                                         &open_stp, nn);
                 if (status)
                         goto out;
-                up_write(&open_stp->st_rwsem);
+                mutex_unlock(&open_stp->st_mutex);
                 open_sop = openowner(open_stp->st_stateowner);
                 status = nfserr_bad_stateid;
                 if (!same_clid(&open_sop->oo_owner.so_client->cl_clientid,
@@ -5600,7 +5607,7 @@ nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
                 status = lookup_or_create_lock_state(cstate, open_stp, lock,
                                                         &lock_stp, &new);
                 if (status == nfs_ok)
-                        down_write(&lock_stp->st_rwsem);
+                        mutex_lock(&lock_stp->st_mutex);
         } else {
                 status = nfs4_preprocess_seqid_op(cstate,
                                        lock->lk_old_lock_seqid,
@@ -5704,7 +5711,7 @@ out:
                     seqid_mutating_err(ntohl(status)))
                         lock_sop->lo_owner.so_seqid++;
 
-                up_write(&lock_stp->st_rwsem);
+                mutex_unlock(&lock_stp->st_mutex);
 
                 /*
                  * If this is a new, never-before-used stateid, and we are
@@ -5874,7 +5881,7 @@ nfsd4_locku(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
 fput:
         fput(filp);
 put_stateid:
-        up_write(&stp->st_rwsem);
+        mutex_unlock(&stp->st_mutex);
         nfs4_put_stid(&stp->st_stid);
 out:
         nfsd4_bump_seqid(cstate, status);
diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h
index 986e51e5ceac..64053eadeb81 100644
--- a/fs/nfsd/state.h
+++ b/fs/nfsd/state.h
@@ -535,7 +535,7 @@ struct nfs4_ol_stateid {
         unsigned char                   st_access_bmap;
         unsigned char                   st_deny_bmap;
         struct nfs4_ol_stateid          *st_openstp;
-        struct rw_semaphore             st_rwsem;
+        struct mutex                    st_mutex;
 };
 
 static inline struct nfs4_ol_stateid *openlockstateid(struct nfs4_stid *s)
diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c
index 809bd2de7ad0..e9fd241b9a0a 100644
--- a/fs/nilfs2/the_nilfs.c
+++ b/fs/nilfs2/the_nilfs.c
@@ -439,7 +439,7 @@ static int nilfs_valid_sb(struct nilfs_super_block *sbp)
         if (!sbp || le16_to_cpu(sbp->s_magic) != NILFS_SUPER_MAGIC)
                 return 0;
         bytes = le16_to_cpu(sbp->s_bytes);
-        if (bytes > BLOCK_SIZE)
+        if (bytes < sumoff + 4 || bytes > BLOCK_SIZE)
                 return 0;
         crc = crc32_le(le32_to_cpu(sbp->s_crc_seed), (unsigned char *)sbp,
                        sumoff);
diff --git a/fs/ocfs2/Makefile b/fs/ocfs2/Makefile
index e27e6527912b..4342c7ee7d20 100644
--- a/fs/ocfs2/Makefile
+++ b/fs/ocfs2/Makefile
@@ -1,7 +1,5 @@
 ccflags-y := -Ifs/ocfs2
 
-ccflags-y += -DCATCH_BH_JBD_RACES
-
 obj-$(CONFIG_OCFS2_FS) +=       \
         ocfs2.o                 \
         ocfs2_stackglue.o
diff --git a/fs/ocfs2/buffer_head_io.c b/fs/ocfs2/buffer_head_io.c
index fe50ded1b4ce..498641eed2db 100644
--- a/fs/ocfs2/buffer_head_io.c
+++ b/fs/ocfs2/buffer_head_io.c
@@ -139,11 +139,16 @@ int ocfs2_read_blocks_sync(struct ocfs2_super *osb, u64 block,
 
                 lock_buffer(bh);
                 if (buffer_jbd(bh)) {
+#ifdef CATCH_BH_JBD_RACES
                         mlog(ML_ERROR,
                              "block %llu had the JBD bit set "
                              "while I was in lock_buffer!",
                              (unsigned long long)bh->b_blocknr);
                         BUG();
+#else
+                        unlock_buffer(bh);
+                        continue;
+#endif
                 }
 
                 clear_buffer_uptodate(bh);
diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
index 22f0253a3567..c2a6b0894022 100644
--- a/fs/overlayfs/dir.c
+++ b/fs/overlayfs/dir.c
@@ -405,12 +405,21 @@ static int ovl_create_or_link(struct dentry *dentry, int mode, dev_t rdev,
                 err = ovl_create_upper(dentry, inode, &stat, link, hardlink);
         } else {
                 const struct cred *old_cred;
+                struct cred *override_cred;
 
                 old_cred = ovl_override_creds(dentry->d_sb);
 
-                err = ovl_create_over_whiteout(dentry, inode, &stat, link,
-                                               hardlink);
+                err = -ENOMEM;
+                override_cred = prepare_creds();
+                if (override_cred) {
+                        override_cred->fsuid = old_cred->fsuid;
+                        override_cred->fsgid = old_cred->fsgid;
+                        put_cred(override_creds(override_cred));
+                        put_cred(override_cred);
 
+                        err = ovl_create_over_whiteout(dentry, inode, &stat,
+                                                       link, hardlink);
+                }
                 revert_creds(old_cred);
         }
 
diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
index 0ed7c4012437..c831c2e5f803 100644
--- a/fs/overlayfs/inode.c
+++ b/fs/overlayfs/inode.c
@@ -59,16 +59,37 @@ int ovl_setattr(struct dentry *dentry, struct iattr *attr)
         if (err)
                 goto out;
 
+        if (attr->ia_valid & ATTR_SIZE) {
+                struct inode *realinode = d_inode(ovl_dentry_real(dentry));
+
+                err = -ETXTBSY;
+                if (atomic_read(&realinode->i_writecount) < 0)
+                        goto out_drop_write;
+        }
+
         err = ovl_copy_up(dentry);
         if (!err) {
+                struct inode *winode = NULL;
+
                 upperdentry = ovl_dentry_upper(dentry);
 
+                if (attr->ia_valid & ATTR_SIZE) {
+                        winode = d_inode(upperdentry);
+                        err = get_write_access(winode);
+                        if (err)
+                                goto out_drop_write;
+                }
+
                 inode_lock(upperdentry->d_inode);
                 err = notify_change(upperdentry, attr, NULL);
                 if (!err)
                         ovl_copyattr(upperdentry->d_inode, dentry->d_inode);
                 inode_unlock(upperdentry->d_inode);
+
+                if (winode)
+                        put_write_access(winode);
         }
+out_drop_write:
         ovl_drop_write(dentry);
 out:
         return err;
@@ -121,16 +142,18 @@ int ovl_permission(struct inode *inode, int mask)
 
                 err = vfs_getattr(&realpath, &stat);
                 if (err)
-                        return err;
+                        goto out_dput;
 
+                err = -ESTALE;
                 if ((stat.mode ^ inode->i_mode) & S_IFMT)
-                        return -ESTALE;
+                        goto out_dput;
 
                 inode->i_mode = stat.mode;
                 inode->i_uid = stat.uid;
                 inode->i_gid = stat.gid;
 
-                return generic_permission(inode, mask);
+                err = generic_permission(inode, mask);
+                goto out_dput;
         }
 
         /* Careful in RCU walk mode */
@@ -238,41 +261,27 @@ out:
         return err;
 }
 
-static bool ovl_need_xattr_filter(struct dentry *dentry,
-                                  enum ovl_path_type type)
-{
-        if ((type & (__OVL_PATH_PURE | __OVL_PATH_UPPER)) == __OVL_PATH_UPPER)
-                return S_ISDIR(dentry->d_inode->i_mode);
-        else
-                return false;
-}
-
 ssize_t ovl_getxattr(struct dentry *dentry, struct inode *inode,
                      const char *name, void *value, size_t size)
 {
-        struct path realpath;
-        enum ovl_path_type type = ovl_path_real(dentry, &realpath);
+        struct dentry *realdentry = ovl_dentry_real(dentry);
 
-        if (ovl_need_xattr_filter(dentry, type) && ovl_is_private_xattr(name))
+        if (ovl_is_private_xattr(name))
                 return -ENODATA;
 
-        return vfs_getxattr(realpath.dentry, name, value, size);
+        return vfs_getxattr(realdentry, name, value, size);
 }
 
 ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size)
 {
-        struct path realpath;
-        enum ovl_path_type type = ovl_path_real(dentry, &realpath);
+        struct dentry *realdentry = ovl_dentry_real(dentry);
         ssize_t res;
         int off;
 
-        res = vfs_listxattr(realpath.dentry, list, size);
+        res = vfs_listxattr(realdentry, list, size);
         if (res <= 0 || size == 0)
                 return res;
 
-        if (!ovl_need_xattr_filter(dentry, type))
-                return res;
-
         /* filter out private xattrs */
         for (off = 0; off < res;) {
                 char *s = list + off;
@@ -302,7 +311,7 @@ int ovl_removexattr(struct dentry *dentry, const char *name)
                 goto out;
 
         err = -ENODATA;
-        if (ovl_need_xattr_filter(dentry, type) && ovl_is_private_xattr(name))
+        if (ovl_is_private_xattr(name))
                 goto out_drop_write;
 
         if (!OVL_TYPE_UPPER(type)) {
diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
index ce02f46029da..9a7693d5f8ff 100644
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -1082,11 +1082,13 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
                         if (err < 0)
                                 goto out_put_workdir;
 
-                        if (!err) {
-                                pr_err("overlayfs: upper fs needs to support d_type.\n");
-                                err = -EINVAL;
-                                goto out_put_workdir;
-                        }
+                        /*
+                         * We allowed this configuration and don't want to
+                         * break users over kernel upgrade. So warn instead
+                         * of erroring out.
+                         */
+                        if (!err)
+                                pr_warn("overlayfs: upper fs needs to support d_type.\n");
                 }
         }
 
diff --git a/fs/posix_acl.c b/fs/posix_acl.c
index 8a4a266beff3..edc452c2a563 100644
--- a/fs/posix_acl.c
+++ b/fs/posix_acl.c
@@ -820,39 +820,43 @@ posix_acl_xattr_get(const struct xattr_handler *handler,
         return error;
 }
 
-static int
-posix_acl_xattr_set(const struct xattr_handler *handler,
-                    struct dentry *unused, struct inode *inode,
-                    const char *name, const void *value,
-                    size_t size, int flags)
+int
+set_posix_acl(struct inode *inode, int type, struct posix_acl *acl)
 {
-        struct posix_acl *acl = NULL;
-        int ret;
-
         if (!IS_POSIXACL(inode))
                 return -EOPNOTSUPP;
         if (!inode->i_op->set_acl)
                 return -EOPNOTSUPP;
 
-        if (handler->flags == ACL_TYPE_DEFAULT && !S_ISDIR(inode->i_mode))
-                return value ? -EACCES : 0;
+        if (type == ACL_TYPE_DEFAULT && !S_ISDIR(inode->i_mode))
+                return acl ? -EACCES : 0;
         if (!inode_owner_or_capable(inode))
                 return -EPERM;
 
+        if (acl) {
+                int ret = posix_acl_valid(acl);
+                if (ret)
+                        return ret;
+        }
+        return inode->i_op->set_acl(inode, acl, type);
+}
+EXPORT_SYMBOL(set_posix_acl);
+
+static int
+posix_acl_xattr_set(const struct xattr_handler *handler,
+                    struct dentry *unused, struct inode *inode,
+                    const char *name, const void *value,
+                    size_t size, int flags)
+{
+        struct posix_acl *acl = NULL;
+        int ret;
+
         if (value) {
                 acl = posix_acl_from_xattr(&init_user_ns, value, size);
                 if (IS_ERR(acl))
                         return PTR_ERR(acl);
-
-                if (acl) {
-                        ret = posix_acl_valid(acl);
-                        if (ret)
-                                goto out;
-                }
         }
-
-        ret = inode->i_op->set_acl(inode, acl, handler->flags);
-out:
+        ret = set_posix_acl(inode, handler->flags, acl);
         posix_acl_release(acl);
         return ret;
 }
diff --git a/fs/proc/root.c b/fs/proc/root.c
index 55bc7d6c8aac..06702783bf40 100644
--- a/fs/proc/root.c
+++ b/fs/proc/root.c
@@ -121,6 +121,13 @@ static struct dentry *proc_mount(struct file_system_type *fs_type,
         if (IS_ERR(sb))
                 return ERR_CAST(sb);
 
+        /*
+         * procfs isn't actually a stacking filesystem; however, there is
+         * too much magic going on inside it to permit stacking things on
+         * top of it
+         */
+        sb->s_stack_depth = FILESYSTEM_MAX_STACK_DEPTH;
+
         if (!proc_parse_options(options, ns)) {
                 deactivate_locked_super(sb);
                 return ERR_PTR(-EINVAL);
diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
index b8f2d1e8c645..c72c16c5a60f 100644
--- a/fs/reiserfs/super.c
+++ b/fs/reiserfs/super.c
@@ -1393,7 +1393,7 @@ static int reiserfs_remount(struct super_block *s, int *mount_flags, char *arg)
         unsigned long safe_mask = 0;
         unsigned int commit_max_age = (unsigned int)-1;
         struct reiserfs_journal *journal = SB_JOURNAL(s);
-        char *new_opts = kstrdup(arg, GFP_KERNEL);
+        char *new_opts;
         int err;
         char *qf_names[REISERFS_MAXQUOTAS];
         unsigned int qfmt = 0;
@@ -1401,6 +1401,10 @@ static int reiserfs_remount(struct super_block *s, int *mount_flags, char *arg)
         int i;
 #endif
 
+        new_opts = kstrdup(arg, GFP_KERNEL);
+        if (arg && !new_opts)
+                return -ENOMEM;
+
         sync_filesystem(s);
         reiserfs_write_lock(s);
 
@@ -1546,7 +1550,8 @@ static int reiserfs_remount(struct super_block *s, int *mount_flags, char *arg)
         }
 
 out_ok_unlocked:
-        replace_mount_options(s, new_opts);
+        if (new_opts)
+                replace_mount_options(s, new_opts);
         return 0;
 
 out_err_unlock:
diff --git a/fs/ubifs/file.c b/fs/ubifs/file.c
index 08316972ff93..7bbf420d1289 100644
--- a/fs/ubifs/file.c
+++ b/fs/ubifs/file.c
@@ -52,6 +52,7 @@
 #include "ubifs.h"
 #include <linux/mount.h>
 #include <linux/slab.h>
+#include <linux/migrate.h>
 
 static int read_block(struct inode *inode, void *addr, unsigned int block,
                       struct ubifs_data_node *dn)
@@ -1452,6 +1453,26 @@ static int ubifs_set_page_dirty(struct page *page)
         return ret;
 }
 
+#ifdef CONFIG_MIGRATION
+static int ubifs_migrate_page(struct address_space *mapping,
+                struct page *newpage, struct page *page, enum migrate_mode mode)
+{
+        int rc;
+
+        rc = migrate_page_move_mapping(mapping, newpage, page, NULL, mode, 0);
+        if (rc != MIGRATEPAGE_SUCCESS)
+                return rc;
+
+        if (PagePrivate(page)) {
+                ClearPagePrivate(page);
+                SetPagePrivate(newpage);
+        }
+
+        migrate_page_copy(newpage, page);
+        return MIGRATEPAGE_SUCCESS;
+}
+#endif
+
 static int ubifs_releasepage(struct page *page, gfp_t unused_gfp_flags)
 {
         /*
@@ -1591,6 +1612,9 @@ const struct address_space_operations ubifs_file_address_operations = {
         .write_end      = ubifs_write_end,
         .invalidatepage = ubifs_invalidatepage,
         .set_page_dirty = ubifs_set_page_dirty,
+#ifdef CONFIG_MIGRATION
+        .migratepage    = ubifs_migrate_page,
+#endif
         .releasepage    = ubifs_releasepage,
 };
 
diff --git a/fs/udf/partition.c b/fs/udf/partition.c
index 5f861ed287c3..888c364b2fe9 100644
--- a/fs/udf/partition.c
+++ b/fs/udf/partition.c
@@ -295,7 +295,8 @@ static uint32_t udf_try_read_meta(struct inode *inode, uint32_t block,
                 map = &UDF_SB(sb)->s_partmaps[partition];
                 /* map to sparable/physical partition desc */
                 phyblock = udf_get_pblock(sb, eloc.logicalBlockNum,
-                        map->s_partition_num, ext_offset + offset);
+                        map->s_type_specific.s_metadata.s_phys_partition_ref,
+                        ext_offset + offset);
         }
 
         brelse(epos.bh);
@@ -317,14 +318,18 @@ uint32_t udf_get_pblock_meta25(struct super_block *sb, uint32_t block,
         mdata = &map->s_type_specific.s_metadata;
         inode = mdata->s_metadata_fe ? : mdata->s_mirror_fe;
 
-        /* We shouldn't mount such media... */
-        BUG_ON(!inode);
+        if (!inode)
+                return 0xFFFFFFFF;
+
         retblk = udf_try_read_meta(inode, block, partition, offset);
         if (retblk == 0xFFFFFFFF && mdata->s_metadata_fe) {
                 udf_warn(sb, "error reading from METADATA, trying to read from MIRROR\n");
                 if (!(mdata->s_flags & MF_MIRROR_FE_LOADED)) {
                         mdata->s_mirror_fe = udf_find_metadata_inode_efe(sb,
-                                mdata->s_mirror_file_loc, map->s_partition_num);
+                                mdata->s_mirror_file_loc,
+                                mdata->s_phys_partition_ref);
+                        if (IS_ERR(mdata->s_mirror_fe))
+                                mdata->s_mirror_fe = NULL;
                         mdata->s_flags |= MF_MIRROR_FE_LOADED;
                 }
 
diff --git a/fs/udf/super.c b/fs/udf/super.c
index 5e2c8c814e1b..4942549e7dc8 100644
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -951,13 +951,13 @@ out2:
 }
 
 struct inode *udf_find_metadata_inode_efe(struct super_block *sb,
-                                        u32 meta_file_loc, u32 partition_num)
+                                        u32 meta_file_loc, u32 partition_ref)
 {
         struct kernel_lb_addr addr;
         struct inode *metadata_fe;
 
         addr.logicalBlockNum = meta_file_loc;
-        addr.partitionReferenceNum = partition_num;
+        addr.partitionReferenceNum = partition_ref;
 
         metadata_fe = udf_iget_special(sb, &addr);
 
@@ -974,7 +974,8 @@ struct inode *udf_find_metadata_inode_efe(struct super_block *sb,
         return metadata_fe;
 }
 
-static int udf_load_metadata_files(struct super_block *sb, int partition)
+static int udf_load_metadata_files(struct super_block *sb, int partition,
+                                   int type1_index)
 {
         struct udf_sb_info *sbi = UDF_SB(sb);
         struct udf_part_map *map;
@@ -984,20 +985,21 @@ static int udf_load_metadata_files(struct super_block *sb, int partition)
 
         map = &sbi->s_partmaps[partition];
         mdata = &map->s_type_specific.s_metadata;
+        mdata->s_phys_partition_ref = type1_index;
 
         /* metadata address */
         udf_debug("Metadata file location: block = %d part = %d\n",
-                  mdata->s_meta_file_loc, map->s_partition_num);
+                  mdata->s_meta_file_loc, mdata->s_phys_partition_ref);
 
         fe = udf_find_metadata_inode_efe(sb, mdata->s_meta_file_loc,
-                                         map->s_partition_num);
+                                         mdata->s_phys_partition_ref);
         if (IS_ERR(fe)) {
                 /* mirror file entry */
                 udf_debug("Mirror metadata file location: block = %d part = %d\n",
-                          mdata->s_mirror_file_loc, map->s_partition_num);
+                          mdata->s_mirror_file_loc, mdata->s_phys_partition_ref);
 
                 fe = udf_find_metadata_inode_efe(sb, mdata->s_mirror_file_loc,
-                                                 map->s_partition_num);
+                                                 mdata->s_phys_partition_ref);
 
                 if (IS_ERR(fe)) {
                         udf_err(sb, "Both metadata and mirror metadata inode efe can not found\n");
@@ -1015,7 +1017,7 @@ static int udf_load_metadata_files(struct super_block *sb, int partition)
         */
         if (mdata->s_bitmap_file_loc != 0xFFFFFFFF) {
                 addr.logicalBlockNum = mdata->s_bitmap_file_loc;
-                addr.partitionReferenceNum = map->s_partition_num;
+                addr.partitionReferenceNum = mdata->s_phys_partition_ref;
 
                 udf_debug("Bitmap file location: block = %d part = %d\n",
                           addr.logicalBlockNum, addr.partitionReferenceNum);
@@ -1283,7 +1285,7 @@ static int udf_load_partdesc(struct super_block *sb, sector_t block)
         p = (struct partitionDesc *)bh->b_data;
         partitionNumber = le16_to_cpu(p->partitionNumber);
 
-        /* First scan for TYPE1, SPARABLE and METADATA partitions */
+        /* First scan for TYPE1 and SPARABLE partitions */
         for (i = 0; i < sbi->s_partitions; i++) {
                 map = &sbi->s_partmaps[i];
                 udf_debug("Searching map: (%d == %d)\n",
@@ -1333,7 +1335,7 @@ static int udf_load_partdesc(struct super_block *sb, sector_t block)
                 goto out_bh;
 
         if (map->s_partition_type == UDF_METADATA_MAP25) {
-                ret = udf_load_metadata_files(sb, i);
+                ret = udf_load_metadata_files(sb, i, type1_idx);
                 if (ret < 0) {
                         udf_err(sb, "error loading MetaData partition map %d\n",
                                 i);
diff --git a/fs/udf/udf_sb.h b/fs/udf/udf_sb.h
index 27b5335730c9..c13875d669c0 100644
--- a/fs/udf/udf_sb.h
+++ b/fs/udf/udf_sb.h
@@ -61,6 +61,11 @@ struct udf_meta_data {
         __u32   s_bitmap_file_loc;
         __u32   s_alloc_unit_size;
         __u16   s_align_unit_size;
+        /*
+         * Partition Reference Number of the associated physical / sparable
+         * partition
+         */
+        __u16   s_phys_partition_ref;
         int     s_flags;
         struct inode *s_metadata_fe;
         struct inode *s_mirror_fe;
diff --git a/include/asm-generic/qspinlock.h b/include/asm-generic/qspinlock.h
index 6bd05700d8c9..05f05f17a7c2 100644
--- a/include/asm-generic/qspinlock.h
+++ b/include/asm-generic/qspinlock.h
@@ -22,37 +22,33 @@
 #include <asm-generic/qspinlock_types.h>
 
 /**
+ * queued_spin_unlock_wait - wait until the _current_ lock holder releases the lock
+ * @lock : Pointer to queued spinlock structure
+ *
+ * There is a very slight possibility of live-lock if the lockers keep coming
+ * and the waiter is just unfortunate enough to not see any unlock state.
+ */
+#ifndef queued_spin_unlock_wait
+extern void queued_spin_unlock_wait(struct qspinlock *lock);
+#endif
+
+/**
  * queued_spin_is_locked - is the spinlock locked?
  * @lock: Pointer to queued spinlock structure
  * Return: 1 if it is locked, 0 otherwise
  */
+#ifndef queued_spin_is_locked
 static __always_inline int queued_spin_is_locked(struct qspinlock *lock)
 {
         /*
-         * queued_spin_lock_slowpath() can ACQUIRE the lock before
-         * issuing the unordered store that sets _Q_LOCKED_VAL.
-         *
-         * See both smp_cond_acquire() sites for more detail.
-         *
-         * This however means that in code like:
-         *
-         *   spin_lock(A)               spin_lock(B)
-         *   spin_unlock_wait(B)        spin_is_locked(A)
-         *   do_something()             do_something()
-         *
-         * Both CPUs can end up running do_something() because the store
-         * setting _Q_LOCKED_VAL will pass through the loads in
-         * spin_unlock_wait() and/or spin_is_locked().
+         * See queued_spin_unlock_wait().
          *
-         * Avoid this by issuing a full memory barrier between the spin_lock()
-         * and the loads in spin_unlock_wait() and spin_is_locked().
-         *
-         * Note that regular mutual exclusion doesn't care about this
-         * delayed store.
+         * Any !0 state indicates it is locked, even if _Q_LOCKED_VAL
+         * isn't immediately observable.
          */
-        smp_mb();
-        return atomic_read(&lock->val) & _Q_LOCKED_MASK;
+        return atomic_read(&lock->val);
 }
+#endif
 
 /**
  * queued_spin_value_unlocked - is the spinlock structure unlocked?
@@ -122,21 +118,6 @@ static __always_inline void queued_spin_unlock(struct qspinlock *lock)
 }
 #endif
 
-/**
- * queued_spin_unlock_wait - wait until current lock holder releases the lock
- * @lock : Pointer to queued spinlock structure
- *
- * There is a very slight possibility of live-lock if the lockers keep coming
- * and the waiter is just unfortunate enough to not see any unlock state.
- */
-static inline void queued_spin_unlock_wait(struct qspinlock *lock)
-{
-        /* See queued_spin_is_locked() */
-        smp_mb();
-        while (atomic_read(&lock->val) & _Q_LOCKED_MASK)
-                cpu_relax();
-}
-
 #ifndef virt_spin_lock
 static __always_inline bool virt_spin_lock(struct qspinlock *lock)
 {
diff --git a/include/drm/i915_pciids.h b/include/drm/i915_pciids.h
index 9094599a1150..33466bfc6440 100644
--- a/include/drm/i915_pciids.h
+++ b/include/drm/i915_pciids.h
@@ -309,6 +309,7 @@
         INTEL_VGA_DEVICE(0x5906, info), /* ULT GT1 */ \
         INTEL_VGA_DEVICE(0x590E, info), /* ULX GT1 */ \
         INTEL_VGA_DEVICE(0x5902, info), /* DT  GT1 */ \
+        INTEL_VGA_DEVICE(0x5908, info), /* Halo GT1 */ \
         INTEL_VGA_DEVICE(0x590B, info), /* Halo GT1 */ \
         INTEL_VGA_DEVICE(0x590A, info) /* SRV GT1 */
 
@@ -322,15 +323,12 @@
         INTEL_VGA_DEVICE(0x591D, info) /* WKS GT2 */
 
 #define INTEL_KBL_GT3_IDS(info) \
+        INTEL_VGA_DEVICE(0x5923, info), /* ULT GT3 */ \
         INTEL_VGA_DEVICE(0x5926, info), /* ULT GT3 */ \
-        INTEL_VGA_DEVICE(0x592B, info), /* Halo GT3 */ \
-        INTEL_VGA_DEVICE(0x592A, info) /* SRV GT3 */
+        INTEL_VGA_DEVICE(0x5927, info) /* ULT GT3 */
 
 #define INTEL_KBL_GT4_IDS(info) \
-        INTEL_VGA_DEVICE(0x5932, info), /* DT  GT4 */ \
-        INTEL_VGA_DEVICE(0x593B, info), /* Halo GT4 */ \
-        INTEL_VGA_DEVICE(0x593A, info), /* SRV GT4 */ \
-        INTEL_VGA_DEVICE(0x593D, info)  /* WKS GT4 */
+        INTEL_VGA_DEVICE(0x593B, info) /* Halo GT4 */
 
 #define INTEL_KBL_IDS(info) \
         INTEL_KBL_GT1_IDS(info), \
diff --git a/include/kvm/arm_pmu.h b/include/kvm/arm_pmu.h
index fe389ac31489..92e7e97ca8ff 100644
--- a/include/kvm/arm_pmu.h
+++ b/include/kvm/arm_pmu.h
@@ -18,13 +18,13 @@
 #ifndef __ASM_ARM_KVM_PMU_H
 #define __ASM_ARM_KVM_PMU_H
 
-#ifdef CONFIG_KVM_ARM_PMU
-
 #include <linux/perf_event.h>
 #include <asm/perf_event.h>
 
 #define ARMV8_PMU_CYCLE_IDX             (ARMV8_PMU_MAX_COUNTERS - 1)
 
+#ifdef CONFIG_KVM_ARM_PMU
+
 struct kvm_pmc {
         u8 idx; /* index into the pmu->pmc array */
         struct perf_event *perf_event;
diff --git a/include/linux/audit.h b/include/linux/audit.h
index 961a417d641e..e38e3fc13ea8 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -26,7 +26,6 @@
 #include <linux/sched.h>
 #include <linux/ptrace.h>
 #include <uapi/linux/audit.h>
-#include <linux/tty.h>
 
 #define AUDIT_INO_UNSET ((unsigned long)-1)
 #define AUDIT_DEV_UNSET ((dev_t)-1)
@@ -348,23 +347,6 @@ static inline unsigned int audit_get_sessionid(struct task_struct *tsk)
         return tsk->sessionid;
 }
 
-static inline struct tty_struct *audit_get_tty(struct task_struct *tsk)
-{
-        struct tty_struct *tty = NULL;
-        unsigned long flags;
-
-        spin_lock_irqsave(&tsk->sighand->siglock, flags);
-        if (tsk->signal)
-                tty = tty_kref_get(tsk->signal->tty);
-        spin_unlock_irqrestore(&tsk->sighand->siglock, flags);
-        return tty;
-}
-
-static inline void audit_put_tty(struct tty_struct *tty)
-{
-        tty_kref_put(tty);
-}
-
 extern void __audit_ipc_obj(struct kern_ipc_perm *ipcp);
 extern void __audit_ipc_set_perm(unsigned long qbytes, uid_t uid, gid_t gid, umode_t mode);
 extern void __audit_bprm(struct linux_binprm *bprm);
@@ -522,12 +504,6 @@ static inline unsigned int audit_get_sessionid(struct task_struct *tsk)
 {
         return -1;
 }
-static inline struct tty_struct *audit_get_tty(struct task_struct *tsk)
-{
-        return NULL;
-}
-static inline void audit_put_tty(struct tty_struct *tty)
-{ }
 static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp)
 { }
 static inline void audit_ipc_set_perm(unsigned long qbytes, uid_t uid,
diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
index 576e4639ca60..314b3caa701c 100644
--- a/include/linux/binfmts.h
+++ b/include/linux/binfmts.h
@@ -65,6 +65,7 @@ struct coredump_params {
         unsigned long limit;
         unsigned long mm_flags;
         loff_t written;
+        loff_t pos;
 };
 
 /*
diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 8ee27b8afe81..0de4de6dd43e 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -111,6 +111,31 @@ enum bpf_access_type {
         BPF_WRITE = 2
 };
 
+/* types of values stored in eBPF registers */
+enum bpf_reg_type {
+        NOT_INIT = 0,            /* nothing was written into register */
+        UNKNOWN_VALUE,           /* reg doesn't contain a valid pointer */
+        PTR_TO_CTX,              /* reg points to bpf_context */
+        CONST_PTR_TO_MAP,        /* reg points to struct bpf_map */
+        PTR_TO_MAP_VALUE,        /* reg points to map element value */
+        PTR_TO_MAP_VALUE_OR_NULL,/* points to map elem value or NULL */
+        FRAME_PTR,               /* reg == frame_pointer */
+        PTR_TO_STACK,            /* reg == frame_pointer + imm */
+        CONST_IMM,               /* constant integer value */
+
+        /* PTR_TO_PACKET represents:
+         * skb->data
+         * skb->data + imm
+         * skb->data + (u16) var
+         * skb->data + (u16) var + imm
+         * if (range > 0) then [ptr, ptr + range - off) is safe to access
+         * if (id > 0) means that some 'var' was added
+         * if (off > 0) menas that 'imm' was added
+         */
+        PTR_TO_PACKET,
+        PTR_TO_PACKET_END,       /* skb->data + headlen */
+};
+
 struct bpf_prog;
 
 struct bpf_verifier_ops {
@@ -120,7 +145,8 @@ struct bpf_verifier_ops {
         /* return true if 'size' wide access at offset 'off' within bpf_context
          * with 'type' (read or write) is allowed
          */
-        bool (*is_valid_access)(int off, int size, enum bpf_access_type type);
+        bool (*is_valid_access)(int off, int size, enum bpf_access_type type,
+                                enum bpf_reg_type *reg_type);
 
         u32 (*convert_ctx_access)(enum bpf_access_type type, int dst_reg,
                                   int src_reg, int ctx_off,
@@ -238,6 +264,10 @@ static inline struct bpf_prog *bpf_prog_get(u32 ufd)
 static inline void bpf_prog_put(struct bpf_prog *prog)
 {
 }
+
+static inline void bpf_prog_put_rcu(struct bpf_prog *prog)
+{
+}
 #endif /* CONFIG_BPF_SYSCALL */
 
 /* verifier prototypes for helper functions called from eBPF programs */
diff --git a/include/linux/clk-provider.h b/include/linux/clk-provider.h
index 0c72204c75fc..fb39d5add173 100644
--- a/include/linux/clk-provider.h
+++ b/include/linux/clk-provider.h
@@ -25,7 +25,7 @@
 #define CLK_SET_PARENT_GATE     BIT(1) /* must be gated across re-parent */
 #define CLK_SET_RATE_PARENT     BIT(2) /* propagate rate change up one level */
 #define CLK_IGNORE_UNUSED       BIT(3) /* do not gate even if unused */
-#define CLK_IS_ROOT             BIT(4) /* Deprecated: Don't use */
+                                /* unused */
 #define CLK_IS_BASIC            BIT(5) /* Basic clk, can't do a to_clk_foo() */
 #define CLK_GET_RATE_NOCACHE    BIT(6) /* do not use the cached clk rate */
 #define CLK_SET_RATE_NO_REPARENT BIT(7) /* don't re-parent on rate change */
diff --git a/include/linux/cpuidle.h b/include/linux/cpuidle.h
index 786ad32631a6..07b83d32f66c 100644
--- a/include/linux/cpuidle.h
+++ b/include/linux/cpuidle.h
@@ -152,6 +152,8 @@ extern void cpuidle_disable_device(struct cpuidle_device *dev);
 extern int cpuidle_play_dead(void);
 
 extern struct cpuidle_driver *cpuidle_get_cpu_driver(struct cpuidle_device *dev);
+static inline struct cpuidle_device *cpuidle_get_device(void)
+{return __this_cpu_read(cpuidle_devices); }
 #else
 static inline void disable_cpuidle(void) { }
 static inline bool cpuidle_not_available(struct cpuidle_driver *drv,
@@ -187,6 +189,7 @@ static inline void cpuidle_disable_device(struct cpuidle_device *dev) { }
 static inline int cpuidle_play_dead(void) {return -ENODEV; }
 static inline struct cpuidle_driver *cpuidle_get_cpu_driver(
         struct cpuidle_device *dev) {return NULL; }
+static inline struct cpuidle_device *cpuidle_get_device(void) {return NULL; }
 #endif
 
 #if defined(CONFIG_CPU_IDLE) && defined(CONFIG_SUSPEND)
diff --git a/include/linux/dcache.h b/include/linux/dcache.h
index 484c8792da82..f53fa055021a 100644
--- a/include/linux/dcache.h
+++ b/include/linux/dcache.h
@@ -212,6 +212,7 @@ struct dentry_operations {
 #define DCACHE_OP_REAL                  0x08000000
 
 #define DCACHE_PAR_LOOKUP               0x10000000 /* being looked up (with parent locked shared) */
+#define DCACHE_DENTRY_CURSOR            0x20000000
 
 extern seqlock_t rename_lock;
 
@@ -575,5 +576,17 @@ static inline struct inode *vfs_select_inode(struct dentry *dentry,
         return inode;
 }
 
+/**
+ * d_real_inode - Return the real inode
+ * @dentry: The dentry to query
+ *
+ * If dentry is on an union/overlay, then return the underlying, real inode.
+ * Otherwise return d_inode().
+ */
+static inline struct inode *d_real_inode(struct dentry *dentry)
+{
+        return d_backing_inode(d_real(dentry));
+}
+
 
 #endif  /* __LINUX_DCACHE_H */
diff --git a/include/linux/efi.h b/include/linux/efi.h
index c2db3ca22217..f196dd0b0f2f 100644
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
@@ -1005,7 +1005,7 @@ extern int efi_memattr_apply_permissions(struct mm_struct *mm,
 /* Iterate through an efi_memory_map */
 #define for_each_efi_memory_desc_in_map(m, md)                             \
         for ((md) = (m)->map;                                              \
-             (md) <= (efi_memory_desc_t *)((m)->map_end - (m)->desc_size); \
+             ((void *)(md) + (m)->desc_size) <= (m)->map_end;              \
              (md) = (void *)(md) + (m)->desc_size)
 
 /**
diff --git a/include/linux/iio/common/st_sensors.h b/include/linux/iio/common/st_sensors.h
index d029ffac0d69..99403b19092f 100644
--- a/include/linux/iio/common/st_sensors.h
+++ b/include/linux/iio/common/st_sensors.h
@@ -223,6 +223,8 @@ struct st_sensor_settings {
  * @get_irq_data_ready: Function to get the IRQ used for data ready signal.
  * @tf: Transfer function structure used by I/O operations.
  * @tb: Transfer buffers and mutex used by I/O operations.
+ * @hw_irq_trigger: if we're using the hardware interrupt on the sensor.
+ * @hw_timestamp: Latest timestamp from the interrupt handler, when in use.
  */
 struct st_sensor_data {
         struct device *dev;
@@ -247,6 +249,9 @@ struct st_sensor_data {
 
         const struct st_sensor_transfer_function *tf;
         struct st_sensor_transfer_buffer tb;
+
+        bool hw_irq_trigger;
+        s64 hw_timestamp;
 };
 
 #ifdef CONFIG_IIO_BUFFER
@@ -260,7 +265,8 @@ int st_sensors_allocate_trigger(struct iio_dev *indio_dev,
                                 const struct iio_trigger_ops *trigger_ops);
 
 void st_sensors_deallocate_trigger(struct iio_dev *indio_dev);
-
+int st_sensors_validate_device(struct iio_trigger *trig,
+                               struct iio_dev *indio_dev);
 #else
 static inline int st_sensors_allocate_trigger(struct iio_dev *indio_dev,
                                 const struct iio_trigger_ops *trigger_ops)
@@ -271,6 +277,7 @@ static inline void st_sensors_deallocate_trigger(struct iio_dev *indio_dev)
 {
         return;
 }
+#define st_sensors_validate_device NULL
 #endif
 
 int st_sensors_init_sensor(struct iio_dev *indio_dev,
diff --git a/include/linux/inet_diag.h b/include/linux/inet_diag.h
index 7c27fa1030e8..feb04ea20f11 100644
--- a/include/linux/inet_diag.h
+++ b/include/linux/inet_diag.h
@@ -52,6 +52,12 @@ struct sock *inet_diag_find_one_icsk(struct net *net,
 
 int inet_diag_bc_sk(const struct nlattr *_bc, struct sock *sk);
 
+void inet_diag_msg_common_fill(struct inet_diag_msg *r, struct sock *sk);
+
+int inet_diag_msg_attrs_fill(struct sock *sk, struct sk_buff *skb,
+                             struct inet_diag_msg *r, int ext,
+                             struct user_namespace *user_ns);
+
 extern int  inet_diag_register(const struct inet_diag_handler *handler);
 extern void inet_diag_unregister(const struct inet_diag_handler *handler);
 #endif /* _INET_DIAG_H_ */
diff --git a/include/linux/init_task.h b/include/linux/init_task.h
index f2cb8d45513d..f8834f820ec2 100644
--- a/include/linux/init_task.h
+++ b/include/linux/init_task.h
@@ -190,7 +190,7 @@ extern struct task_group root_task_group;
 #define INIT_TASK(tsk)  \
 {                                                                       \
         .state          = 0,                                            \
-        .stack          = &init_thread_info,                            \
+        .stack          = init_stack,                                   \
         .usage          = ATOMIC_INIT(2),                               \
         .flags          = PF_KTHREAD,                                   \
         .prio           = MAX_PRIO-20,                                  \
diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h
index 9fcabeb07787..b6683f0ffc9f 100644
--- a/include/linux/interrupt.h
+++ b/include/linux/interrupt.h
@@ -278,6 +278,8 @@ extern int irq_set_affinity_hint(unsigned int irq, const struct cpumask *m);
 extern int
 irq_set_affinity_notifier(unsigned int irq, struct irq_affinity_notify *notify);
 
+struct cpumask *irq_create_affinity_mask(unsigned int *nr_vecs);
+
 #else /* CONFIG_SMP */
 
 static inline int irq_set_affinity(unsigned int irq, const struct cpumask *m)
@@ -308,6 +310,12 @@ irq_set_affinity_notifier(unsigned int irq, struct irq_affinity_notify *notify)
 {
         return 0;
 }
+
+static inline struct cpumask *irq_create_affinity_mask(unsigned int *nr_vecs)
+{
+        *nr_vecs = 1;
+        return NULL;
+}
 #endif /* CONFIG_SMP */
 
 /*
diff --git a/include/linux/irq.h b/include/linux/irq.h
index 4d758a7c604a..39ce46ac5c18 100644
--- a/include/linux/irq.h
+++ b/include/linux/irq.h
@@ -197,6 +197,7 @@ struct irq_data {
  * IRQD_IRQ_INPROGRESS          - In progress state of the interrupt
  * IRQD_WAKEUP_ARMED            - Wakeup mode armed
  * IRQD_FORWARDED_TO_VCPU       - The interrupt is forwarded to a VCPU
+ * IRQD_AFFINITY_MANAGED        - Affinity is auto-managed by the kernel
  */
 enum {
         IRQD_TRIGGER_MASK               = 0xf,
@@ -212,6 +213,7 @@ enum {
         IRQD_IRQ_INPROGRESS             = (1 << 18),
         IRQD_WAKEUP_ARMED               = (1 << 19),
         IRQD_FORWARDED_TO_VCPU          = (1 << 20),
+        IRQD_AFFINITY_MANAGED           = (1 << 21),
 };
 
 #define __irqd_to_state(d) ACCESS_PRIVATE((d)->common, state_use_accessors)
@@ -305,6 +307,11 @@ static inline void irqd_clr_forwarded_to_vcpu(struct irq_data *d)
         __irqd_to_state(d) &= ~IRQD_FORWARDED_TO_VCPU;
 }
 
+static inline bool irqd_affinity_is_managed(struct irq_data *d)
+{
+        return __irqd_to_state(d) & IRQD_AFFINITY_MANAGED;
+}
+
 #undef __irqd_to_state
 
 static inline irq_hw_number_t irqd_to_hwirq(struct irq_data *d)
@@ -701,11 +708,11 @@ static inline struct cpumask *irq_data_get_affinity_mask(struct irq_data *d)
 unsigned int arch_dynirq_lower_bound(unsigned int from);
 
 int __irq_alloc_descs(int irq, unsigned int from, unsigned int cnt, int node,
-                struct module *owner);
+                      struct module *owner, const struct cpumask *affinity);
 
 /* use macros to avoid needing export.h for THIS_MODULE */
 #define irq_alloc_descs(irq, from, cnt, node)   \
-        __irq_alloc_descs(irq, from, cnt, node, THIS_MODULE)
+        __irq_alloc_descs(irq, from, cnt, node, THIS_MODULE, NULL)
 
 #define irq_alloc_desc(node)                    \
         irq_alloc_descs(-1, 0, 1, node)
diff --git a/include/linux/irqdomain.h b/include/linux/irqdomain.h
index f1f36e04d885..1aee0fbe900e 100644
--- a/include/linux/irqdomain.h
+++ b/include/linux/irqdomain.h
@@ -39,6 +39,7 @@ struct irq_domain;
 struct of_device_id;
 struct irq_chip;
 struct irq_data;
+struct cpumask;
 
 /* Number of irqs reserved for a legacy isa controller */
 #define NUM_ISA_INTERRUPTS      16
@@ -217,7 +218,8 @@ extern struct irq_domain *irq_find_matching_fwspec(struct irq_fwspec *fwspec,
                                                    enum irq_domain_bus_token bus_token);
 extern void irq_set_default_host(struct irq_domain *host);
 extern int irq_domain_alloc_descs(int virq, unsigned int nr_irqs,
-                                  irq_hw_number_t hwirq, int node);
+                                  irq_hw_number_t hwirq, int node,
+                                  const struct cpumask *affinity);
 
 static inline struct fwnode_handle *of_node_to_fwnode(struct device_node *node)
 {
@@ -389,7 +391,7 @@ static inline struct irq_domain *irq_domain_add_hierarchy(struct irq_domain *par
 
 extern int __irq_domain_alloc_irqs(struct irq_domain *domain, int irq_base,
                                    unsigned int nr_irqs, int node, void *arg,
-                                   bool realloc);
+                                   bool realloc, const struct cpumask *affinity);
 extern void irq_domain_free_irqs(unsigned int virq, unsigned int nr_irqs);
 extern void irq_domain_activate_irq(struct irq_data *irq_data);
 extern void irq_domain_deactivate_irq(struct irq_data *irq_data);
@@ -397,7 +399,8 @@ extern void irq_domain_deactivate_irq(struct irq_data *irq_data);
 static inline int irq_domain_alloc_irqs(struct irq_domain *domain,
                         unsigned int nr_irqs, int node, void *arg)
 {
-        return __irq_domain_alloc_irqs(domain, -1, nr_irqs, node, arg, false);
+        return __irq_domain_alloc_irqs(domain, -1, nr_irqs, node, arg, false,
+                                       NULL);
 }
 
 extern int irq_domain_alloc_irqs_recursive(struct irq_domain *domain,
diff --git a/include/linux/isa.h b/include/linux/isa.h
index 5ab85281230b..f2d0258414cf 100644
--- a/include/linux/isa.h
+++ b/include/linux/isa.h
@@ -6,6 +6,7 @@
 #define __LINUX_ISA_H
 
 #include <linux/device.h>
+#include <linux/errno.h>
 #include <linux/kernel.h>
 
 struct isa_driver {
@@ -22,13 +23,13 @@ struct isa_driver {
 
 #define to_isa_driver(x) container_of((x), struct isa_driver, driver)
 
-#ifdef CONFIG_ISA
+#ifdef CONFIG_ISA_BUS_API
 int isa_register_driver(struct isa_driver *, unsigned int);
 void isa_unregister_driver(struct isa_driver *);
 #else
 static inline int isa_register_driver(struct isa_driver *d, unsigned int i)
 {
-        return 0;
+        return -ENODEV;
 }
 
 static inline void isa_unregister_driver(struct isa_driver *d)
diff --git a/include/linux/jump_label.h b/include/linux/jump_label.h
index 0536524bb9eb..68904469fba1 100644
--- a/include/linux/jump_label.h
+++ b/include/linux/jump_label.h
@@ -117,13 +117,18 @@ struct module;
 
 #include <linux/atomic.h>
 
+#ifdef HAVE_JUMP_LABEL
+
 static inline int static_key_count(struct static_key *key)
 {
-        return atomic_read(&key->enabled);
+        /*
+         * -1 means the first static_key_slow_inc() is in progress.
+         *  static_key_enabled() must return true, so return 1 here.
+         */
+        int n = atomic_read(&key->enabled);
+        return n >= 0 ? n : 1;
 }
 
-#ifdef HAVE_JUMP_LABEL
-
 #define JUMP_TYPE_FALSE 0UL
 #define JUMP_TYPE_TRUE  1UL
 #define JUMP_TYPE_MASK  1UL
@@ -162,6 +167,11 @@ extern void jump_label_apply_nops(struct module *mod);
 
 #else  /* !HAVE_JUMP_LABEL */
 
+static inline int static_key_count(struct static_key *key)
+{
+        return atomic_read(&key->enabled);
+}
+
 static __always_inline void jump_label_init(void)
 {
         static_key_initialized = true;
diff --git a/include/linux/kasan.h b/include/linux/kasan.h
index 611927f5870d..ac4b3c46a84d 100644
--- a/include/linux/kasan.h
+++ b/include/linux/kasan.h
@@ -59,14 +59,13 @@ void kasan_poison_object_data(struct kmem_cache *cache, void *object);
 
 void kasan_kmalloc_large(const void *ptr, size_t size, gfp_t flags);
 void kasan_kfree_large(const void *ptr);
-void kasan_kfree(void *ptr);
+void kasan_poison_kfree(void *ptr);
 void kasan_kmalloc(struct kmem_cache *s, const void *object, size_t size,
                   gfp_t flags);
 void kasan_krealloc(const void *object, size_t new_size, gfp_t flags);
 
 void kasan_slab_alloc(struct kmem_cache *s, void *object, gfp_t flags);
 bool kasan_slab_free(struct kmem_cache *s, void *object);
-void kasan_poison_slab_free(struct kmem_cache *s, void *object);
 
 struct kasan_cache {
         int alloc_meta_offset;
@@ -76,6 +75,9 @@ struct kasan_cache {
 int kasan_module_alloc(void *addr, size_t size);
 void kasan_free_shadow(const struct vm_struct *vm);
 
+size_t ksize(const void *);
+static inline void kasan_unpoison_slab(const void *ptr) { ksize(ptr); }
+
 #else /* CONFIG_KASAN */
 
 static inline void kasan_unpoison_shadow(const void *address, size_t size) {}
@@ -102,7 +104,7 @@ static inline void kasan_poison_object_data(struct kmem_cache *cache,
 
 static inline void kasan_kmalloc_large(void *ptr, size_t size, gfp_t flags) {}
 static inline void kasan_kfree_large(const void *ptr) {}
-static inline void kasan_kfree(void *ptr) {}
+static inline void kasan_poison_kfree(void *ptr) {}
 static inline void kasan_kmalloc(struct kmem_cache *s, const void *object,
                                 size_t size, gfp_t flags) {}
 static inline void kasan_krealloc(const void *object, size_t new_size,
@@ -114,11 +116,12 @@ static inline bool kasan_slab_free(struct kmem_cache *s, void *object)
 {
         return false;
 }
-static inline void kasan_poison_slab_free(struct kmem_cache *s, void *object) {}
 
 static inline int kasan_module_alloc(void *addr, size_t size) { return 0; }
 static inline void kasan_free_shadow(const struct vm_struct *vm) {}
 
+static inline void kasan_unpoison_slab(const void *ptr) { }
+
 #endif /* CONFIG_KASAN */
 
 #endif /* LINUX_KASAN_H */
diff --git a/include/linux/leds.h b/include/linux/leds.h
index d2b13066e781..e5e7f2e80a54 100644
--- a/include/linux/leds.h
+++ b/include/linux/leds.h
@@ -42,15 +42,16 @@ struct led_classdev {
 #define LED_UNREGISTERING       (1 << 1)
         /* Upper 16 bits reflect control information */
 #define LED_CORE_SUSPENDRESUME  (1 << 16)
-#define LED_BLINK_ONESHOT       (1 << 17)
-#define LED_BLINK_ONESHOT_STOP  (1 << 18)
-#define LED_BLINK_INVERT        (1 << 19)
-#define LED_BLINK_BRIGHTNESS_CHANGE (1 << 20)
-#define LED_BLINK_DISABLE       (1 << 21)
-#define LED_SYSFS_DISABLE       (1 << 22)
-#define LED_DEV_CAP_FLASH       (1 << 23)
-#define LED_HW_PLUGGABLE        (1 << 24)
-#define LED_PANIC_INDICATOR     (1 << 25)
+#define LED_BLINK_SW            (1 << 17)
+#define LED_BLINK_ONESHOT       (1 << 18)
+#define LED_BLINK_ONESHOT_STOP  (1 << 19)
+#define LED_BLINK_INVERT        (1 << 20)
+#define LED_BLINK_BRIGHTNESS_CHANGE (1 << 21)
+#define LED_BLINK_DISABLE       (1 << 22)
+#define LED_SYSFS_DISABLE       (1 << 23)
+#define LED_DEV_CAP_FLASH       (1 << 24)
+#define LED_HW_PLUGGABLE        (1 << 25)
+#define LED_PANIC_INDICATOR     (1 << 26)
 
         /* Set LED brightness level
          * Must not sleep. Use brightness_set_blocking for drivers
@@ -72,8 +73,8 @@ struct led_classdev {
          * and if both are zero then a sensible default should be chosen.
          * The call should adjust the timings in that case and if it can't
          * match the values specified exactly.
-         * Deactivate blinking again when the brightness is set to a fixed
-         * value via the brightness_set() callback.
+         * Deactivate blinking again when the brightness is set to LED_OFF
+         * via the brightness_set() callback.
          */
         int             (*blink_set)(struct led_classdev *led_cdev,
                                      unsigned long *delay_on,
diff --git a/include/linux/mfd/da9052/da9052.h b/include/linux/mfd/da9052/da9052.h
index c18a4c19d6fc..ce9230af09c2 100644
--- a/include/linux/mfd/da9052/da9052.h
+++ b/include/linux/mfd/da9052/da9052.h
@@ -171,7 +171,7 @@ static inline int da9052_group_read(struct da9052 *da9052, unsigned char reg,
 static inline int da9052_group_write(struct da9052 *da9052, unsigned char reg,
                                       unsigned reg_cnt, unsigned char *val)
 {
-        int ret;
+        int ret = 0;
         int i;
 
         for (i = 0; i < reg_cnt; i++) {
diff --git a/include/linux/mlx4/device.h b/include/linux/mlx4/device.h
index 80dec87a94f8..d46a0e7f144d 100644
--- a/include/linux/mlx4/device.h
+++ b/include/linux/mlx4/device.h
@@ -466,6 +466,7 @@ enum {
 enum {
         MLX4_INTERFACE_STATE_UP         = 1 << 0,
         MLX4_INTERFACE_STATE_DELETION   = 1 << 1,
+        MLX4_INTERFACE_STATE_SHUTDOWN   = 1 << 2,
 };
 
 #define MSTR_SM_CHANGE_MASK (MLX4_EQ_PORT_INFO_MSTR_SM_SL_CHANGE_MASK | \
diff --git a/include/linux/mlx5/device.h b/include/linux/mlx5/device.h
index 035abdf62cfe..73a48479892d 100644
--- a/include/linux/mlx5/device.h
+++ b/include/linux/mlx5/device.h
@@ -1240,8 +1240,6 @@ struct mlx5_destroy_psv_out {
         u8                      rsvd[8];
 };
 
-#define MLX5_CMD_OP_MAX 0x920
-
 enum {
         VPORT_STATE_DOWN                = 0x0,
         VPORT_STATE_UP                  = 0x1,
@@ -1369,6 +1367,12 @@ enum mlx5_cap_type {
 #define MLX5_CAP_FLOWTABLE_MAX(mdev, cap) \
         MLX5_GET(flow_table_nic_cap, mdev->hca_caps_max[MLX5_CAP_FLOW_TABLE], cap)
 
+#define MLX5_CAP_FLOWTABLE_NIC_RX(mdev, cap) \
+        MLX5_CAP_FLOWTABLE(mdev, flow_table_properties_nic_receive.cap)
+
+#define MLX5_CAP_FLOWTABLE_NIC_RX_MAX(mdev, cap) \
+        MLX5_CAP_FLOWTABLE_MAX(mdev, flow_table_properties_nic_receive.cap)
+
 #define MLX5_CAP_ESW_FLOWTABLE(mdev, cap) \
         MLX5_GET(flow_table_eswitch_cap, \
                  mdev->hca_caps_cur[MLX5_CAP_ESWITCH_FLOW_TABLE], cap)
diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
index 9a05cd7e5890..e955a2859009 100644
--- a/include/linux/mlx5/mlx5_ifc.h
+++ b/include/linux/mlx5/mlx5_ifc.h
@@ -205,7 +205,8 @@ enum {
         MLX5_CMD_OP_ALLOC_FLOW_COUNTER            = 0x939,
         MLX5_CMD_OP_DEALLOC_FLOW_COUNTER          = 0x93a,
         MLX5_CMD_OP_QUERY_FLOW_COUNTER            = 0x93b,
-        MLX5_CMD_OP_MODIFY_FLOW_TABLE             = 0x93c
+        MLX5_CMD_OP_MODIFY_FLOW_TABLE             = 0x93c,
+        MLX5_CMD_OP_MAX
 };
 
 struct mlx5_ifc_flow_table_fields_supported_bits {
@@ -500,7 +501,9 @@ struct mlx5_ifc_e_switch_cap_bits {
         u8         vport_svlan_insert[0x1];
         u8         vport_cvlan_insert_if_not_exist[0x1];
         u8         vport_cvlan_insert_overwrite[0x1];
-        u8         reserved_at_5[0x1b];
+        u8         reserved_at_5[0x19];
+        u8         nic_vport_node_guid_modify[0x1];
+        u8         nic_vport_port_guid_modify[0x1];
 
         u8         reserved_at_20[0x7e0];
 };
@@ -4583,7 +4586,10 @@ struct mlx5_ifc_modify_nic_vport_context_out_bits {
 };
 
 struct mlx5_ifc_modify_nic_vport_field_select_bits {
-        u8         reserved_at_0[0x19];
+        u8         reserved_at_0[0x16];
+        u8         node_guid[0x1];
+        u8         port_guid[0x1];
+        u8         reserved_at_18[0x1];
         u8         mtu[0x1];
         u8         change_event[0x1];
         u8         promisc[0x1];
diff --git a/include/linux/mlx5/qp.h b/include/linux/mlx5/qp.h
index 64221027bf1f..ab310819ac36 100644
--- a/include/linux/mlx5/qp.h
+++ b/include/linux/mlx5/qp.h
@@ -172,6 +172,7 @@ enum {
 enum {
         MLX5_FENCE_MODE_NONE                    = 0 << 5,
         MLX5_FENCE_MODE_INITIATOR_SMALL         = 1 << 5,
+        MLX5_FENCE_MODE_FENCE                   = 2 << 5,
         MLX5_FENCE_MODE_STRONG_ORDERING         = 3 << 5,
         MLX5_FENCE_MODE_SMALL_AND_FENCE         = 4 << 5,
 };
@@ -460,10 +461,9 @@ struct mlx5_core_qp {
 };
 
 struct mlx5_qp_path {
-        u8                      fl;
+        u8                      fl_free_ar;
         u8                      rsvd3;
-        u8                      free_ar;
-        u8                      pkey_index;
+        __be16                  pkey_index;
         u8                      rsvd0;
         u8                      grh_mlid;
         __be16                  rlid;
@@ -560,6 +560,7 @@ struct mlx5_modify_qp_mbox_in {
         __be32                  optparam;
         u8                      rsvd0[4];
         struct mlx5_qp_context  ctx;
+        u8                      rsvd2[16];
 };
 
 struct mlx5_modify_qp_mbox_out {
diff --git a/include/linux/mlx5/vport.h b/include/linux/mlx5/vport.h
index 301da4a5e6bf..6c16c198f680 100644
--- a/include/linux/mlx5/vport.h
+++ b/include/linux/mlx5/vport.h
@@ -50,6 +50,8 @@ int mlx5_modify_nic_vport_mtu(struct mlx5_core_dev *mdev, u16 mtu);
 int mlx5_query_nic_vport_system_image_guid(struct mlx5_core_dev *mdev,
                                            u64 *system_image_guid);
 int mlx5_query_nic_vport_node_guid(struct mlx5_core_dev *mdev, u64 *node_guid);
+int mlx5_modify_nic_vport_node_guid(struct mlx5_core_dev *mdev,
+                                    u32 vport, u64 node_guid);
 int mlx5_query_nic_vport_qkey_viol_cntr(struct mlx5_core_dev *mdev,
                                         u16 *qkey_viol_cntr);
 int mlx5_query_hca_vport_gid(struct mlx5_core_dev *dev, u8 other_vport,
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 5df5feb49575..ece042dfe23c 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -602,7 +602,7 @@ static inline pte_t maybe_mkwrite(pte_t pte, struct vm_area_struct *vma)
 }
 
 void do_set_pte(struct vm_area_struct *vma, unsigned long address,
-                struct page *page, pte_t *pte, bool write, bool anon, bool old);
+                struct page *page, pte_t *pte, bool write, bool anon);
 #endif
 
 /*
diff --git a/include/linux/msi.h b/include/linux/msi.h
index 8b425c66305a..4f0bfe5912b2 100644
--- a/include/linux/msi.h
+++ b/include/linux/msi.h
@@ -47,6 +47,7 @@ struct fsl_mc_msi_desc {
  * @nvec_used:  The number of vectors used
  * @dev:        Pointer to the device which uses this descriptor
  * @msg:        The last set MSI message cached for reuse
+ * @affinity:   Optional pointer to a cpu affinity mask for this descriptor
  *
  * @masked:     [PCI MSI/X] Mask bits
  * @is_msix:    [PCI MSI/X] True if MSI-X
@@ -67,6 +68,7 @@ struct msi_desc {
         unsigned int                    nvec_used;
         struct device                   *dev;
         struct msi_msg                  msg;
+        const struct cpumask            *affinity;
 
         union {
                 /* PCI MSI/X specific data */
@@ -264,12 +266,10 @@ enum {
          * callbacks.
          */
         MSI_FLAG_USE_DEF_CHIP_OPS       = (1 << 1),
-        /* Build identity map between hwirq and irq */
-        MSI_FLAG_IDENTITY_MAP           = (1 << 2),
         /* Support multiple PCI MSI interrupts */
-        MSI_FLAG_MULTI_PCI_MSI          = (1 << 3),
+        MSI_FLAG_MULTI_PCI_MSI          = (1 << 2),
         /* Support PCI MSIX interrupts */
-        MSI_FLAG_PCI_MSIX               = (1 << 4),
+        MSI_FLAG_PCI_MSIX               = (1 << 3),
 };
 
 int msi_domain_set_affinity(struct irq_data *data, const struct cpumask *mask,
diff --git a/include/linux/net.h b/include/linux/net.h
index 9aa49a05fe38..25aa03b51c4e 100644
--- a/include/linux/net.h
+++ b/include/linux/net.h
@@ -251,7 +251,8 @@ do {									\
         DEFINE_DYNAMIC_DEBUG_METADATA(descriptor, fmt);                 \
         if (unlikely(descriptor.flags & _DPRINTK_FLAGS_PRINT) &&        \
             net_ratelimit())                                            \
-                __dynamic_pr_debug(&descriptor, fmt, ##__VA_ARGS__);    \
+                __dynamic_pr_debug(&descriptor, pr_fmt(fmt),            \
+                                   ##__VA_ARGS__);                      \
 } while (0)
 #elif defined(DEBUG)
 #define net_dbg_ratelimited(fmt, ...)                           \
diff --git a/include/linux/of.h b/include/linux/of.h
index c7292e8ea080..74eb28cadbef 100644
--- a/include/linux/of.h
+++ b/include/linux/of.h
@@ -614,7 +614,7 @@ static inline struct device_node *of_parse_phandle(const struct device_node *np,
         return NULL;
 }
 
-static inline int of_parse_phandle_with_args(struct device_node *np,
+static inline int of_parse_phandle_with_args(const struct device_node *np,
                                              const char *list_name,
                                              const char *cells_name,
                                              int index,
diff --git a/include/linux/of_pci.h b/include/linux/of_pci.h
index f6e9e85164e8..b969e9443962 100644
--- a/include/linux/of_pci.h
+++ b/include/linux/of_pci.h
@@ -8,7 +8,7 @@ struct pci_dev;
 struct of_phandle_args;
 struct device_node;
 
-#ifdef CONFIG_OF
+#ifdef CONFIG_OF_PCI
 int of_irq_parse_pci(const struct pci_dev *pdev, struct of_phandle_args *out_irq);
 struct device_node *of_pci_find_child_device(struct device_node *parent,
                                              unsigned int devfn);
diff --git a/include/linux/of_reserved_mem.h b/include/linux/of_reserved_mem.h
index ad2f67054372..c201060e0c6d 100644
--- a/include/linux/of_reserved_mem.h
+++ b/include/linux/of_reserved_mem.h
@@ -31,6 +31,13 @@ typedef int (*reservedmem_of_init_fn)(struct reserved_mem *rmem);
 int of_reserved_mem_device_init(struct device *dev);
 void of_reserved_mem_device_release(struct device *dev);
 
+int early_init_dt_alloc_reserved_memory_arch(phys_addr_t size,
+                                             phys_addr_t align,
+                                             phys_addr_t start,
+                                             phys_addr_t end,
+                                             bool nomap,
+                                             phys_addr_t *res_base);
+
 void fdt_init_reserved_mem(void);
 void fdt_reserved_mem_save_node(unsigned long node, const char *uname,
                                phys_addr_t base, phys_addr_t size);
diff --git a/include/linux/pci.h b/include/linux/pci.h
index 1fed5927b08a..98909063a70c 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -325,6 +325,7 @@ struct pci_dev {
          * directly, use the values stored here. They might be different!
          */
         unsigned int    irq;
+        struct cpumask  *irq_affinity;
         struct resource resource[DEVICE_COUNT_RESOURCE]; /* I/O and memory regions + expansion ROMs */
 
         bool match_driver;              /* Skip attaching driver */
@@ -1249,6 +1250,11 @@ resource_size_t pcibios_iov_resource_alignment(struct pci_dev *dev, int resno);
 int pci_set_vga_state(struct pci_dev *pdev, bool decode,
                       unsigned int command_bits, u32 flags);
 
+#define PCI_IRQ_NOLEGACY        (1 << 0) /* don't use legacy interrupts */
+#define PCI_IRQ_NOMSI           (1 << 1) /* don't use MSI interrupts */
+#define PCI_IRQ_NOMSIX          (1 << 2) /* don't use MSI-X interrupts */
+#define PCI_IRQ_NOAFFINITY      (1 << 3) /* don't auto-assign affinity */
+
 /* kmem_cache style wrapper around pci_alloc_consistent() */
 
 #include <linux/pci-dma.h>
@@ -1296,6 +1302,11 @@ static inline int pci_enable_msix_exact(struct pci_dev *dev,
                 return rc;
         return 0;
 }
+int pci_alloc_irq_vectors(struct pci_dev *dev, unsigned int min_vecs,
+                unsigned int max_vecs, unsigned int flags);
+void pci_free_irq_vectors(struct pci_dev *dev);
+int pci_irq_vector(struct pci_dev *dev, unsigned int nr);
+
 #else
 static inline int pci_msi_vec_count(struct pci_dev *dev) { return -ENOSYS; }
 static inline void pci_msi_shutdown(struct pci_dev *dev) { }
@@ -1319,6 +1330,24 @@ static inline int pci_enable_msix_range(struct pci_dev *dev,
 static inline int pci_enable_msix_exact(struct pci_dev *dev,
                       struct msix_entry *entries, int nvec)
 { return -ENOSYS; }
+static inline int pci_alloc_irq_vectors(struct pci_dev *dev,
+                unsigned int min_vecs, unsigned int max_vecs,
+                unsigned int flags)
+{
+        if (min_vecs > 1)
+                return -EINVAL;
+        return 1;
+}
+static inline void pci_free_irq_vectors(struct pci_dev *dev)
+{
+}
+
+static inline int pci_irq_vector(struct pci_dev *dev, unsigned int nr)
+{
+        if (WARN_ON_ONCE(nr > 0))
+                return -EINVAL;
+        return dev->irq;
+}
 #endif
 
 #ifdef CONFIG_PCIEPORTBUS
diff --git a/include/linux/pwm.h b/include/linux/pwm.h
index 17018f3c066e..c038ae36b10e 100644
--- a/include/linux/pwm.h
+++ b/include/linux/pwm.h
@@ -235,6 +235,9 @@ static inline int pwm_config(struct pwm_device *pwm, int duty_ns,
         if (!pwm)
                 return -EINVAL;
 
+        if (duty_ns < 0 || period_ns < 0)
+                return -EINVAL;
+
         pwm_get_state(pwm, &state);
         if (state.duty_cycle == duty_ns && state.period == period_ns)
                 return 0;
@@ -461,6 +464,8 @@ static inline bool pwm_can_sleep(struct pwm_device *pwm)
 
 static inline void pwm_apply_args(struct pwm_device *pwm)
 {
+        struct pwm_state state = { };
+
         /*
          * PWM users calling pwm_apply_args() expect to have a fresh config
          * where the polarity and period are set according to pwm_args info.
@@ -473,18 +478,20 @@ static inline void pwm_apply_args(struct pwm_device *pwm)
          * at startup (even if they are actually enabled), thus authorizing
          * polarity setting.
          *
-         * Instead of setting ->enabled to false, we call pwm_disable()
-         * before pwm_set_polarity() to ensure that everything is configured
-         * as expected, and the PWM is really disabled when the user request
-         * it.
+         * To fulfill this requirement, we apply a new state which disables
+         * the PWM device and set the reference period and polarity config.
          *
          * Note that PWM users requiring a smooth handover between the
          * bootloader and the kernel (like critical regulators controlled by
          * PWM devices) will have to switch to the atomic API and avoid calling
          * pwm_apply_args().
          */
-        pwm_disable(pwm);
-        pwm_set_polarity(pwm, pwm->args.polarity);
+
+        state.enabled = false;
+        state.polarity = pwm->args.polarity;
+        state.period = pwm->args.period;
+
+        pwm_apply_state(pwm, &state);
 }
 
 struct pwm_lookup {
diff --git a/include/linux/qed/qed_eth_if.h b/include/linux/qed/qed_eth_if.h
index 6ae8cb4a61d3..6c876a63558d 100644
--- a/include/linux/qed/qed_eth_if.h
+++ b/include/linux/qed/qed_eth_if.h
@@ -49,6 +49,7 @@ struct qed_start_vport_params {
         bool drop_ttl0;
         u8 vport_id;
         u16 mtu;
+        bool clear_stats;
 };
 
 struct qed_stop_rxq_params {
diff --git a/include/linux/reset.h b/include/linux/reset.h
index ec0306ce7b92..45a4abeb6acb 100644
--- a/include/linux/reset.h
+++ b/include/linux/reset.h
@@ -84,8 +84,8 @@ static inline struct reset_control *__devm_reset_control_get(
 #endif /* CONFIG_RESET_CONTROLLER */
 
 /**
- * reset_control_get - Lookup and obtain an exclusive reference to a
- *                     reset controller.
+ * reset_control_get_exclusive - Lookup and obtain an exclusive reference
+ *                               to a reset controller.
  * @dev: device to be reset by the controller
  * @id: reset line name
  *
@@ -98,8 +98,8 @@ static inline struct reset_control *__devm_reset_control_get(
  *
  * Use of id names is optional.
  */
-static inline struct reset_control *__must_check reset_control_get(
-                                        struct device *dev, const char *id)
+static inline struct reset_control *
+__must_check reset_control_get_exclusive(struct device *dev, const char *id)
 {
 #ifndef CONFIG_RESET_CONTROLLER
         WARN_ON(1);
@@ -107,12 +107,6 @@ static inline struct reset_control *__must_check reset_control_get(
         return __of_reset_control_get(dev ? dev->of_node : NULL, id, 0, 0);
 }
 
-static inline struct reset_control *reset_control_get_optional(
-                                        struct device *dev, const char *id)
-{
-        return __of_reset_control_get(dev ? dev->of_node : NULL, id, 0, 0);
-}
-
 /**
  * reset_control_get_shared - Lookup and obtain a shared reference to a
  *                            reset controller.
@@ -141,9 +135,21 @@ static inline struct reset_control *reset_control_get_shared(
         return __of_reset_control_get(dev ? dev->of_node : NULL, id, 0, 1);
 }
 
+static inline struct reset_control *reset_control_get_optional_exclusive(
+                                        struct device *dev, const char *id)
+{
+        return __of_reset_control_get(dev ? dev->of_node : NULL, id, 0, 0);
+}
+
+static inline struct reset_control *reset_control_get_optional_shared(
+                                        struct device *dev, const char *id)
+{
+        return __of_reset_control_get(dev ? dev->of_node : NULL, id, 0, 1);
+}
+
 /**
- * of_reset_control_get - Lookup and obtain an exclusive reference to a
- *                        reset controller.
+ * of_reset_control_get_exclusive - Lookup and obtain an exclusive reference
+ *                                  to a reset controller.
  * @node: device to be reset by the controller
  * @id: reset line name
  *
@@ -151,15 +157,41 @@ static inline struct reset_control *reset_control_get_shared(
  *
  * Use of id names is optional.
  */
-static inline struct reset_control *of_reset_control_get(
+static inline struct reset_control *of_reset_control_get_exclusive(
                                 struct device_node *node, const char *id)
 {
         return __of_reset_control_get(node, id, 0, 0);
 }
 
 /**
- * of_reset_control_get_by_index - Lookup and obtain an exclusive reference to
- *                                 a reset controller by index.
+ * of_reset_control_get_shared - Lookup and obtain an shared reference
+ *                               to a reset controller.
+ * @node: device to be reset by the controller
+ * @id: reset line name
+ *
+ * When a reset-control is shared, the behavior of reset_control_assert /
+ * deassert is changed, the reset-core will keep track of a deassert_count
+ * and only (re-)assert the reset after reset_control_assert has been called
+ * as many times as reset_control_deassert was called. Also see the remark
+ * about shared reset-controls in the reset_control_assert docs.
+ *
+ * Calling reset_control_assert without first calling reset_control_deassert
+ * is not allowed on a shared reset control. Calling reset_control_reset is
+ * also not allowed on a shared reset control.
+ * Returns a struct reset_control or IS_ERR() condition containing errno.
+ *
+ * Use of id names is optional.
+ */
+static inline struct reset_control *of_reset_control_get_shared(
+                                struct device_node *node, const char *id)
+{
+        return __of_reset_control_get(node, id, 0, 1);
+}
+
+/**
+ * of_reset_control_get_exclusive_by_index - Lookup and obtain an exclusive
+ *                                           reference to a reset controller
+ *                                           by index.
  * @node: device to be reset by the controller
  * @index: index of the reset controller
  *
@@ -167,49 +199,60 @@ static inline struct reset_control *of_reset_control_get(
  * in whatever order. Returns a struct reset_control or IS_ERR() condition
  * containing errno.
  */
-static inline struct reset_control *of_reset_control_get_by_index(
+static inline struct reset_control *of_reset_control_get_exclusive_by_index(
                                         struct device_node *node, int index)
 {
         return __of_reset_control_get(node, NULL, index, 0);
 }
 
 /**
- * devm_reset_control_get - resource managed reset_control_get()
- * @dev: device to be reset by the controller
- * @id: reset line name
+ * of_reset_control_get_shared_by_index - Lookup and obtain an shared
+ *                                        reference to a reset controller
+ *                                        by index.
+ * @node: device to be reset by the controller
+ * @index: index of the reset controller
+ *
+ * When a reset-control is shared, the behavior of reset_control_assert /
+ * deassert is changed, the reset-core will keep track of a deassert_count
+ * and only (re-)assert the reset after reset_control_assert has been called
+ * as many times as reset_control_deassert was called. Also see the remark
+ * about shared reset-controls in the reset_control_assert docs.
+ *
+ * Calling reset_control_assert without first calling reset_control_deassert
+ * is not allowed on a shared reset control. Calling reset_control_reset is
+ * also not allowed on a shared reset control.
+ * Returns a struct reset_control or IS_ERR() condition containing errno.
  *
- * Managed reset_control_get(). For reset controllers returned from this
- * function, reset_control_put() is called automatically on driver detach.
- * See reset_control_get() for more information.
+ * This is to be used to perform a list of resets for a device or power domain
+ * in whatever order. Returns a struct reset_control or IS_ERR() condition
+ * containing errno.
  */
-static inline struct reset_control *__must_check devm_reset_control_get(
-                                        struct device *dev, const char *id)
-{
-#ifndef CONFIG_RESET_CONTROLLER
-        WARN_ON(1);
-#endif
-        return __devm_reset_control_get(dev, id, 0, 0);
-}
-
-static inline struct reset_control *devm_reset_control_get_optional(
-                                        struct device *dev, const char *id)
+static inline struct reset_control *of_reset_control_get_shared_by_index(
+                                        struct device_node *node, int index)
 {
-        return __devm_reset_control_get(dev, id, 0, 0);
+        return __of_reset_control_get(node, NULL, index, 1);
 }
 
 /**
- * devm_reset_control_get_by_index - resource managed reset_control_get
+ * devm_reset_control_get_exclusive - resource managed
+ *                                    reset_control_get_exclusive()
  * @dev: device to be reset by the controller
- * @index: index of the reset controller
+ * @id: reset line name
  *
- * Managed reset_control_get(). For reset controllers returned from this
- * function, reset_control_put() is called automatically on driver detach.
- * See reset_control_get() for more information.
+ * Managed reset_control_get_exclusive(). For reset controllers returned
+ * from this function, reset_control_put() is called automatically on driver
+ * detach.
+ *
+ * See reset_control_get_exclusive() for more information.
  */
-static inline struct reset_control *devm_reset_control_get_by_index(
-                                        struct device *dev, int index)
+static inline struct reset_control *
+__must_check devm_reset_control_get_exclusive(struct device *dev,
+                                              const char *id)
 {
-        return __devm_reset_control_get(dev, NULL, index, 0);
+#ifndef CONFIG_RESET_CONTROLLER
+        WARN_ON(1);
+#endif
+        return __devm_reset_control_get(dev, id, 0, 0);
 }
 
 /**
@@ -227,6 +270,36 @@ static inline struct reset_control *devm_reset_control_get_shared(
         return __devm_reset_control_get(dev, id, 0, 1);
 }
 
+static inline struct reset_control *devm_reset_control_get_optional_exclusive(
+                                        struct device *dev, const char *id)
+{
+        return __devm_reset_control_get(dev, id, 0, 0);
+}
+
+static inline struct reset_control *devm_reset_control_get_optional_shared(
+                                        struct device *dev, const char *id)
+{
+        return __devm_reset_control_get(dev, id, 0, 1);
+}
+
+/**
+ * devm_reset_control_get_exclusive_by_index - resource managed
+ *                                             reset_control_get_exclusive()
+ * @dev: device to be reset by the controller
+ * @index: index of the reset controller
+ *
+ * Managed reset_control_get_exclusive(). For reset controllers returned from
+ * this function, reset_control_put() is called automatically on driver
+ * detach.
+ *
+ * See reset_control_get_exclusive() for more information.
+ */
+static inline struct reset_control *
+devm_reset_control_get_exclusive_by_index(struct device *dev, int index)
+{
+        return __devm_reset_control_get(dev, NULL, index, 0);
+}
+
 /**
  * devm_reset_control_get_shared_by_index - resource managed
  * reset_control_get_shared
@@ -237,10 +310,60 @@ static inline struct reset_control *devm_reset_control_get_shared(
  * this function, reset_control_put() is called automatically on driver detach.
  * See reset_control_get_shared() for more information.
  */
-static inline struct reset_control *devm_reset_control_get_shared_by_index(
-                                        struct device *dev, int index)
+static inline struct reset_control *
+devm_reset_control_get_shared_by_index(struct device *dev, int index)
 {
         return __devm_reset_control_get(dev, NULL, index, 1);
 }
 
+/*
+ * TEMPORARY calls to use during transition:
+ *
+ *   of_reset_control_get() => of_reset_control_get_exclusive()
+ *
+ * These inline function calls will be removed once all consumers
+ * have been moved over to the new explicit API.
+ */
+static inline struct reset_control *reset_control_get(
+                                struct device *dev, const char *id)
+{
+        return reset_control_get_exclusive(dev, id);
+}
+
+static inline struct reset_control *reset_control_get_optional(
+                                        struct device *dev, const char *id)
+{
+        return reset_control_get_optional_exclusive(dev, id);
+}
+
+static inline struct reset_control *of_reset_control_get(
+                                struct device_node *node, const char *id)
+{
+        return of_reset_control_get_exclusive(node, id);
+}
+
+static inline struct reset_control *of_reset_control_get_by_index(
+                                struct device_node *node, int index)
+{
+        return of_reset_control_get_exclusive_by_index(node, index);
+}
+
+static inline struct reset_control *devm_reset_control_get(
+                                struct device *dev, const char *id)
+{
+        return devm_reset_control_get_exclusive(dev, id);
+}
+
+static inline struct reset_control *devm_reset_control_get_optional(
+                                struct device *dev, const char *id)
+{
+        return devm_reset_control_get_optional_exclusive(dev, id);
+
+}
+
+static inline struct reset_control *devm_reset_control_get_by_index(
+                                struct device *dev, int index)
+{
+        return devm_reset_control_get_exclusive_by_index(dev, index);
+}
 #endif
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 6e42ada26345..253538f29ade 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -3007,7 +3007,7 @@ static inline int object_is_on_stack(void *obj)
         return (obj >= stack) && (obj < (stack + THREAD_SIZE));
 }
 
-extern void thread_info_cache_init(void);
+extern void thread_stack_cache_init(void);
 
 #ifdef CONFIG_DEBUG_STACK_USAGE
 static inline unsigned long stack_not_used(struct task_struct *p)
diff --git a/include/linux/seqlock.h b/include/linux/seqlock.h
index 7973a821ac58..ead97654c4e9 100644
--- a/include/linux/seqlock.h
+++ b/include/linux/seqlock.h
@@ -277,7 +277,10 @@ static inline void raw_write_seqcount_barrier(seqcount_t *s)
 
 static inline int raw_read_seqcount_latch(seqcount_t *s)
 {
-        return lockless_dereference(s)->sequence;
+        int seq = READ_ONCE(s->sequence);
+        /* Pairs with the first smp_wmb() in raw_write_seqcount_latch() */
+        smp_read_barrier_depends();
+        return seq;
 }
 
 /**
@@ -331,7 +334,7 @@ static inline int raw_read_seqcount_latch(seqcount_t *s)
  *      unsigned seq, idx;
  *
  *      do {
- *              seq = lockless_dereference(latch)->seq;
+ *              seq = raw_read_seqcount_latch(&latch->seq);
  *
  *              idx = seq & 0x01;
  *              entry = data_query(latch->data[idx], ...);
diff --git a/include/linux/sock_diag.h b/include/linux/sock_diag.h
index 4018b48f2b3b..a0596ca0e80a 100644
--- a/include/linux/sock_diag.h
+++ b/include/linux/sock_diag.h
@@ -36,6 +36,9 @@ enum sknetlink_groups sock_diag_destroy_group(const struct sock *sk)
 {
         switch (sk->sk_family) {
         case AF_INET:
+                if (sk->sk_type == SOCK_RAW)
+                        return SKNLGRP_NONE;
+
                 switch (sk->sk_protocol) {
                 case IPPROTO_TCP:
                         return SKNLGRP_INET_TCP_DESTROY;
@@ -45,6 +48,9 @@ enum sknetlink_groups sock_diag_destroy_group(const struct sock *sk)
                         return SKNLGRP_NONE;
                 }
         case AF_INET6:
+                if (sk->sk_type == SOCK_RAW)
+                        return SKNLGRP_NONE;
+
                 switch (sk->sk_protocol) {
                 case IPPROTO_TCP:
                         return SKNLGRP_INET6_TCP_DESTROY;
diff --git a/include/linux/sunrpc/clnt.h b/include/linux/sunrpc/clnt.h
index 19c659d1c0f8..b6810c92b8bb 100644
--- a/include/linux/sunrpc/clnt.h
+++ b/include/linux/sunrpc/clnt.h
@@ -137,8 +137,6 @@ struct rpc_create_args {
 #define RPC_CLNT_CREATE_NO_RETRANS_TIMEOUT      (1UL << 9)
 
 struct rpc_clnt *rpc_create(struct rpc_create_args *args);
-struct rpc_clnt *rpc_create_xprt(struct rpc_create_args *args,
-                                        struct rpc_xprt *xprt);
 struct rpc_clnt *rpc_bind_new_program(struct rpc_clnt *,
                                 const struct rpc_program *, u32);
 struct rpc_clnt *rpc_clone_client(struct rpc_clnt *);
diff --git a/include/linux/sunrpc/svc_xprt.h b/include/linux/sunrpc/svc_xprt.h
index b7dabc4baafd..79ba50856707 100644
--- a/include/linux/sunrpc/svc_xprt.h
+++ b/include/linux/sunrpc/svc_xprt.h
@@ -84,6 +84,7 @@ struct svc_xprt {
 
         struct net              *xpt_net;
         struct rpc_xprt         *xpt_bc_xprt;   /* NFSv4.1 backchannel */
+        struct rpc_xprt_switch  *xpt_bc_xps;    /* NFSv4.1 backchannel */
 };
 
 static inline void unregister_xpt_user(struct svc_xprt *xpt, struct svc_xpt_user *u)
diff --git a/include/linux/sunrpc/xprt.h b/include/linux/sunrpc/xprt.h
index 5aa3834619a8..5e3e1b63dbb3 100644
--- a/include/linux/sunrpc/xprt.h
+++ b/include/linux/sunrpc/xprt.h
@@ -297,6 +297,7 @@ struct xprt_create {
         size_t                  addrlen;
         const char              *servername;
         struct svc_xprt         *bc_xprt;       /* NFSv4.1 backchannel */
+        struct rpc_xprt_switch  *bc_xps;
         unsigned int            flags;
 };
 
diff --git a/include/linux/thermal.h b/include/linux/thermal.h
index e45abe7db9a6..ee517bef0db0 100644
--- a/include/linux/thermal.h
+++ b/include/linux/thermal.h
@@ -335,6 +335,8 @@ struct thermal_genl_event {
  * @get_trend: a pointer to a function that reads the sensor temperature trend.
  * @set_emul_temp: a pointer to a function that sets sensor emulated
  *                 temperature.
+ * @set_trip_temp: a pointer to a function that sets the trip temperature on
+ *                 hardware.
  */
 struct thermal_zone_of_device_ops {
         int (*get_temp)(void *, int *);
diff --git a/include/linux/usb/ehci_def.h b/include/linux/usb/ehci_def.h
index 966889a20ea3..e479033bd782 100644
--- a/include/linux/usb/ehci_def.h
+++ b/include/linux/usb/ehci_def.h
@@ -180,11 +180,11 @@ struct ehci_regs {
  * PORTSCx
  */
         /* HOSTPC: offset 0x84 */
-        u32             hostpc[1];      /* HOSTPC extension */
+        u32             hostpc[0];      /* HOSTPC extension */
 #define HOSTPC_PHCD     (1<<22)         /* Phy clock disable */
 #define HOSTPC_PSPD     (3<<25)         /* Port speed detection */
 
-        u32             reserved5[16];
+        u32             reserved5[17];
 
         /* USBMODE_EX: offset 0xc8 */
         u32             usbmode_ex;     /* USB Device mode extension */
diff --git a/include/linux/usb/gadget.h b/include/linux/usb/gadget.h
index 457651bf45b0..fefe8b06a63d 100644
--- a/include/linux/usb/gadget.h
+++ b/include/linux/usb/gadget.h
@@ -1034,6 +1034,8 @@ static inline int usb_gadget_activate(struct usb_gadget *gadget)
  * @udc_name: A name of UDC this driver should be bound to. If udc_name is NULL,
  *      this driver will be bound to any available UDC.
  * @pending: UDC core private data used for deferred probe of this driver.
+ * @match_existing_only: If udc is not found, return an error and don't add this
+ *      gadget driver to list of pending driver
  *
  * Devices are disabled till a gadget driver successfully bind()s, which
  * means the driver will handle setup() requests needed to enumerate (and
@@ -1097,6 +1099,7 @@ struct usb_gadget_driver {
 
         char                    *udc_name;
         struct list_head        pending;
+        unsigned                match_existing_only:1;
 };
 
 
diff --git a/include/linux/usb/musb.h b/include/linux/usb/musb.h
index 0b3da40a525e..d315c8907869 100644
--- a/include/linux/usb/musb.h
+++ b/include/linux/usb/musb.h
@@ -142,10 +142,11 @@ enum musb_vbus_id_status {
 };
 
 #if IS_ENABLED(CONFIG_USB_MUSB_HDRC)
-void musb_mailbox(enum musb_vbus_id_status status);
+int musb_mailbox(enum musb_vbus_id_status status);
 #else
-static inline void musb_mailbox(enum musb_vbus_id_status status)
+static inline int musb_mailbox(enum musb_vbus_id_status status)
 {
+        return 0;
 }
 #endif
 
diff --git a/include/media/v4l2-mc.h b/include/media/v4l2-mc.h
index 98a938aabdfb..7a8d6037a4bb 100644
--- a/include/media/v4l2-mc.h
+++ b/include/media/v4l2-mc.h
@@ -1,7 +1,7 @@
 /*
  * v4l2-mc.h - Media Controller V4L2 types and prototypes
  *
- * Copyright (C) 2016 Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+ * Copyright (C) 2016 Mauro Carvalho Chehab <mchehab@kernel.org>
  * Copyright (C) 2006-2010 Nokia Corporation
  * Copyright (c) 2016 Intel Corporation.
  *
diff --git a/include/net/compat.h b/include/net/compat.h
index 48103cf94e97..13de0ccaa059 100644
--- a/include/net/compat.h
+++ b/include/net/compat.h
@@ -42,6 +42,7 @@ int compat_sock_get_timestampns(struct sock *, struct timespec __user *);
 
 int get_compat_msghdr(struct msghdr *, struct compat_msghdr __user *,
                       struct sockaddr __user **, struct iovec **);
+struct sock_fprog __user *get_compat_bpf_fprog(char __user *optval);
 asmlinkage long compat_sys_sendmsg(int, struct compat_msghdr __user *,
                                    unsigned int);
 asmlinkage long compat_sys_sendmmsg(int, struct compat_mmsghdr __user *,
diff --git a/include/net/gre.h b/include/net/gre.h
index 5dce30a6abe3..7a54a31d1d4c 100644
--- a/include/net/gre.h
+++ b/include/net/gre.h
@@ -26,7 +26,7 @@ int gre_del_protocol(const struct gre_protocol *proto, u8 version);
 struct net_device *gretap_fb_dev_create(struct net *net, const char *name,
                                        u8 name_assign_type);
 int gre_parse_header(struct sk_buff *skb, struct tnl_ptk_info *tpi,
-                     bool *csum_err, __be16 proto);
+                     bool *csum_err, __be16 proto, int nhs);
 
 static inline int gre_calc_hlen(__be16 o_flags)
 {
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index af4c10ebb241..cd6018a9ee24 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -1232,7 +1232,7 @@ void ip_vs_conn_expire_now(struct ip_vs_conn *cp);
 const char *ip_vs_state_name(__u16 proto, int state);
 
 void ip_vs_tcp_conn_listen(struct ip_vs_conn *cp);
-int ip_vs_check_template(struct ip_vs_conn *ct);
+int ip_vs_check_template(struct ip_vs_conn *ct, struct ip_vs_dest *cdest);
 void ip_vs_random_dropentry(struct netns_ipvs *ipvs);
 int ip_vs_conn_init(void);
 void ip_vs_conn_cleanup(void);
diff --git a/include/net/netfilter/nf_queue.h b/include/net/netfilter/nf_queue.h
index 9c5638ad872e..0dbce55437f2 100644
--- a/include/net/netfilter/nf_queue.h
+++ b/include/net/netfilter/nf_queue.h
@@ -28,8 +28,8 @@ struct nf_queue_handler {
                                                 struct nf_hook_ops *ops);
 };
 
-void nf_register_queue_handler(const struct nf_queue_handler *qh);
-void nf_unregister_queue_handler(void);
+void nf_register_queue_handler(struct net *net, const struct nf_queue_handler *qh);
+void nf_unregister_queue_handler(struct net *net);
 void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict);
 
 void nf_queue_entry_get_refs(struct nf_queue_entry *entry);
diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 092235458691..f7c291ff4074 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -167,6 +167,7 @@ struct nft_set_elem {
 
 struct nft_set;
 struct nft_set_iter {
+        u8              genmask;
         unsigned int    count;
         unsigned int    skip;
         int             err;
diff --git a/include/net/netns/netfilter.h b/include/net/netns/netfilter.h
index 38aa4983e2a9..36d723579af2 100644
--- a/include/net/netns/netfilter.h
+++ b/include/net/netns/netfilter.h
@@ -5,11 +5,13 @@
 
 struct proc_dir_entry;
 struct nf_logger;
+struct nf_queue_handler;
 
 struct netns_nf {
 #if defined CONFIG_PROC_FS
         struct proc_dir_entry *proc_netfilter;
 #endif
+        const struct nf_queue_handler __rcu *queue_handler;
         const struct nf_logger __rcu *nf_loggers[NFPROTO_NUMPROTO];
 #ifdef CONFIG_SYSCTL
         struct ctl_table_header *nf_log_dir_header;
diff --git a/include/net/pkt_cls.h b/include/net/pkt_cls.h
index 0f7efa88f210..3722dda0199d 100644
--- a/include/net/pkt_cls.h
+++ b/include/net/pkt_cls.h
@@ -392,16 +392,20 @@ struct tc_cls_u32_offload {
         };
 };
 
-static inline bool tc_should_offload(struct net_device *dev, u32 flags)
+static inline bool tc_should_offload(const struct net_device *dev,
+                                     const struct tcf_proto *tp, u32 flags)
 {
+        const struct Qdisc *sch = tp->q;
+        const struct Qdisc_class_ops *cops = sch->ops->cl_ops;
+
         if (!(dev->features & NETIF_F_HW_TC))
                 return false;
-
         if (flags & TCA_CLS_FLAGS_SKIP_HW)
                 return false;
-
         if (!dev->netdev_ops->ndo_setup_tc)
                 return false;
+        if (cops && cops->tcf_cl_offload)
+                return cops->tcf_cl_offload(tp->classid);
 
         return true;
 }
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index a1fd76c22a59..62d553184e91 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -168,6 +168,7 @@ struct Qdisc_class_ops {
 
         /* Filter manipulation */
         struct tcf_proto __rcu ** (*tcf_chain)(struct Qdisc *, unsigned long);
+        bool                    (*tcf_cl_offload)(u32 classid);
         unsigned long           (*bind_tcf)(struct Qdisc *, unsigned long,
                                         u32 classid);
         void                    (*unbind_tcf)(struct Qdisc *, unsigned long);
@@ -691,9 +692,11 @@ static inline struct sk_buff *qdisc_peek_dequeued(struct Qdisc *sch)
         /* we can reuse ->gso_skb because peek isn't called for root qdiscs */
         if (!sch->gso_skb) {
                 sch->gso_skb = sch->dequeue(sch);
-                if (sch->gso_skb)
+                if (sch->gso_skb) {
                         /* it's still part of the queue */
+                        qdisc_qstats_backlog_inc(sch, sch->gso_skb);
                         sch->q.qlen++;
+                }
         }
 
         return sch->gso_skb;
@@ -706,6 +709,7 @@ static inline struct sk_buff *qdisc_dequeue_peeked(struct Qdisc *sch)
 
         if (skb) {
                 sch->gso_skb = NULL;
+                qdisc_qstats_backlog_dec(sch, skb);
                 sch->q.qlen--;
         } else {
                 skb = sch->dequeue(sch);
diff --git a/include/net/tc_act/tc_ife.h b/include/net/tc_act/tc_ife.h
index dc9a09aefb33..c55facd17b7e 100644
--- a/include/net/tc_act/tc_ife.h
+++ b/include/net/tc_act/tc_ife.h
@@ -36,7 +36,7 @@ struct tcf_meta_ops {
         int     (*encode)(struct sk_buff *, void *, struct tcf_meta_info *);
         int     (*decode)(struct sk_buff *, void *, u16 len);
         int     (*get)(struct sk_buff *skb, struct tcf_meta_info *mi);
-        int     (*alloc)(struct tcf_meta_info *, void *);
+        int     (*alloc)(struct tcf_meta_info *, void *, gfp_t);
         void    (*release)(struct tcf_meta_info *);
         int     (*validate)(void *val, int len);
         struct module   *owner;
@@ -48,8 +48,8 @@ int ife_get_meta_u32(struct sk_buff *skb, struct tcf_meta_info *mi);
 int ife_get_meta_u16(struct sk_buff *skb, struct tcf_meta_info *mi);
 int ife_tlv_meta_encode(void *skbdata, u16 attrtype, u16 dlen,
                         const void *dval);
-int ife_alloc_meta_u32(struct tcf_meta_info *mi, void *metaval);
-int ife_alloc_meta_u16(struct tcf_meta_info *mi, void *metaval);
+int ife_alloc_meta_u32(struct tcf_meta_info *mi, void *metaval, gfp_t gfp);
+int ife_alloc_meta_u16(struct tcf_meta_info *mi, void *metaval, gfp_t gfp);
 int ife_check_meta_u32(u32 metaval, struct tcf_meta_info *mi);
 int ife_encode_meta_u32(u32 metaval, void *skbdata, struct tcf_meta_info *mi);
 int ife_validate_meta_u32(void *val, int len);
diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index 432bed510369..7e440d41487a 100644
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -217,10 +217,10 @@ enum ib_device_cap_flags {
         IB_DEVICE_CROSS_CHANNEL         = (1 << 27),
         IB_DEVICE_MANAGED_FLOW_STEERING         = (1 << 29),
         IB_DEVICE_SIGNATURE_HANDOVER            = (1 << 30),
-        IB_DEVICE_ON_DEMAND_PAGING              = (1 << 31),
+        IB_DEVICE_ON_DEMAND_PAGING              = (1ULL << 31),
         IB_DEVICE_SG_GAPS_REG                   = (1ULL << 32),
-        IB_DEVICE_VIRTUAL_FUNCTION              = ((u64)1 << 33),
-        IB_DEVICE_RAW_SCATTER_FCS               = ((u64)1 << 34),
+        IB_DEVICE_VIRTUAL_FUNCTION              = (1ULL << 33),
+        IB_DEVICE_RAW_SCATTER_FCS               = (1ULL << 34),
 };
 
 enum ib_signature_prot_cap {
diff --git a/include/rdma/rdma_vt.h b/include/rdma/rdma_vt.h
index 16274e2133cd..9c9a27d42aaa 100644
--- a/include/rdma/rdma_vt.h
+++ b/include/rdma/rdma_vt.h
@@ -203,7 +203,9 @@ struct rvt_driver_provided {
 
         /*
          * Allocate a private queue pair data structure for driver specific
-         * information which is opaque to rdmavt.
+         * information which is opaque to rdmavt.  Errors are returned via
+         * ERR_PTR(err).  The driver is free to return NULL or a valid
+         * pointer.
          */
         void * (*qp_priv_alloc)(struct rvt_dev_info *rdi, struct rvt_qp *qp,
                                 gfp_t gfp);
diff --git a/include/uapi/linux/btrfs.h b/include/uapi/linux/btrfs.h
index 23c6960e94a4..2bdd1e3e7007 100644
--- a/include/uapi/linux/btrfs.h
+++ b/include/uapi/linux/btrfs.h
@@ -118,7 +118,7 @@ struct btrfs_ioctl_vol_args_v2 {
         };
         union {
                 char name[BTRFS_SUBVOL_NAME_MAX + 1];
-                u64 devid;
+                __u64 devid;
         };
 };
 
diff --git a/include/uapi/linux/fuse.h b/include/uapi/linux/fuse.h
index 5974fae54e12..27e17363263a 100644
--- a/include/uapi/linux/fuse.h
+++ b/include/uapi/linux/fuse.h
@@ -105,6 +105,9 @@
  *
  *  7.24
  *  - add FUSE_LSEEK for SEEK_HOLE and SEEK_DATA support
+ *
+ *  7.25
+ *  - add FUSE_PARALLEL_DIROPS
  */
 
 #ifndef _LINUX_FUSE_H
@@ -140,7 +143,7 @@
 #define FUSE_KERNEL_VERSION 7
 
 /** Minor version number of this interface */
-#define FUSE_KERNEL_MINOR_VERSION 24
+#define FUSE_KERNEL_MINOR_VERSION 25
 
 /** The node ID of the root inode */
 #define FUSE_ROOT_ID 1
@@ -234,6 +237,7 @@ struct fuse_file_lock {
  * FUSE_ASYNC_DIO: asynchronous direct I/O submission
  * FUSE_WRITEBACK_CACHE: use writeback cache for buffered writes
  * FUSE_NO_OPEN_SUPPORT: kernel supports zero-message opens
+ * FUSE_PARALLEL_DIROPS: allow parallel lookups and readdir
  */
 #define FUSE_ASYNC_READ         (1 << 0)
 #define FUSE_POSIX_LOCKS        (1 << 1)
@@ -253,6 +257,7 @@ struct fuse_file_lock {
 #define FUSE_ASYNC_DIO          (1 << 15)
 #define FUSE_WRITEBACK_CACHE    (1 << 16)
 #define FUSE_NO_OPEN_SUPPORT    (1 << 17)
+#define FUSE_PARALLEL_DIROPS    (1 << 18)
 
 /**
  * CUSE INIT request/reply flags
diff --git a/include/uapi/linux/gtp.h b/include/uapi/linux/gtp.h
index ca1054dd8249..72a04a0e8cce 100644
--- a/include/uapi/linux/gtp.h
+++ b/include/uapi/linux/gtp.h
@@ -1,5 +1,5 @@
 #ifndef _UAPI_LINUX_GTP_H_
-#define _UAPI_LINUX_GTP_H__
+#define _UAPI_LINUX_GTP_H_
 
 enum gtp_genl_cmds {
         GTP_CMD_NEWPDP,
diff --git a/include/uapi/linux/input-event-codes.h b/include/uapi/linux/input-event-codes.h
index 87cf351bab03..737fa32faad4 100644
--- a/include/uapi/linux/input-event-codes.h
+++ b/include/uapi/linux/input-event-codes.h
@@ -611,6 +611,37 @@
 #define KEY_KBDINPUTASSIST_ACCEPT               0x264
 #define KEY_KBDINPUTASSIST_CANCEL               0x265
 
+/* Diagonal movement keys */
+#define KEY_RIGHT_UP                    0x266
+#define KEY_RIGHT_DOWN                  0x267
+#define KEY_LEFT_UP                     0x268
+#define KEY_LEFT_DOWN                   0x269
+
+#define KEY_ROOT_MENU                   0x26a /* Show Device's Root Menu */
+/* Show Top Menu of the Media (e.g. DVD) */
+#define KEY_MEDIA_TOP_MENU              0x26b
+#define KEY_NUMERIC_11                  0x26c
+#define KEY_NUMERIC_12                  0x26d
+/*
+ * Toggle Audio Description: refers to an audio service that helps blind and
+ * visually impaired consumers understand the action in a program. Note: in
+ * some countries this is referred to as "Video Description".
+ */
+#define KEY_AUDIO_DESC                  0x26e
+#define KEY_3D_MODE                     0x26f
+#define KEY_NEXT_FAVORITE               0x270
+#define KEY_STOP_RECORD                 0x271
+#define KEY_PAUSE_RECORD                0x272
+#define KEY_VOD                         0x273 /* Video on Demand */
+#define KEY_UNMUTE                      0x274
+#define KEY_FASTREVERSE                 0x275
+#define KEY_SLOWREVERSE                 0x276
+/*
+ * Control a data application associated with the currently viewed channel,
+ * e.g. teletext or data broadcast application (MHEG, MHP, HbbTV, etc.)
+ */
+#define KEY_DATA                        0x275
+
 #define BTN_TRIGGER_HAPPY               0x2c0
 #define BTN_TRIGGER_HAPPY1              0x2c0
 #define BTN_TRIGGER_HAPPY2              0x2c1
diff --git a/include/uapi/linux/input.h b/include/uapi/linux/input.h
index 01113841190d..c51494119817 100644
--- a/include/uapi/linux/input.h
+++ b/include/uapi/linux/input.h
@@ -247,6 +247,7 @@ struct input_mask {
 #define BUS_ATARI               0x1B
 #define BUS_SPI                 0x1C
 #define BUS_RMI                 0x1D
+#define BUS_CEC                 0x1E
 
 /*
  * MT_TOOL types
diff --git a/include/uapi/linux/netfilter/Kbuild b/include/uapi/linux/netfilter/Kbuild
index 1d973d2ba417..cd26d7a0fd07 100644
--- a/include/uapi/linux/netfilter/Kbuild
+++ b/include/uapi/linux/netfilter/Kbuild
@@ -33,6 +33,7 @@ header-y += xt_NFLOG.h
 header-y += xt_NFQUEUE.h
 header-y += xt_RATEEST.h
 header-y += xt_SECMARK.h
+header-y += xt_SYNPROXY.h
 header-y += xt_TCPMSS.h
 header-y += xt_TCPOPTSTRIP.h
 header-y += xt_TEE.h
diff --git a/include/uapi/linux/netfilter/xt_SYNPROXY.h b/include/uapi/linux/netfilter/xt_SYNPROXY.h
index 2d59fbaa93c6..ca67e61d2a61 100644
--- a/include/uapi/linux/netfilter/xt_SYNPROXY.h
+++ b/include/uapi/linux/netfilter/xt_SYNPROXY.h
@@ -1,6 +1,8 @@
 #ifndef _XT_SYNPROXY_H
 #define _XT_SYNPROXY_H
 
+#include <linux/types.h>
+
 #define XT_SYNPROXY_OPT_MSS             0x01
 #define XT_SYNPROXY_OPT_WSCALE          0x02
 #define XT_SYNPROXY_OPT_SACK_PERM       0x04
diff --git a/include/uapi/sound/Kbuild b/include/uapi/sound/Kbuild
index a7f27704f980..691984cb0b91 100644
--- a/include/uapi/sound/Kbuild
+++ b/include/uapi/sound/Kbuild
@@ -1,5 +1,6 @@
 # UAPI Header export list
 header-y += asequencer.h
+header-y += asoc.h
 header-y += asound.h
 header-y += asound_fm.h
 header-y += compress_offload.h
@@ -10,3 +11,5 @@ header-y += hdsp.h
 header-y += hdspm.h
 header-y += sb16_csp.h
 header-y += sfnt_info.h
+header-y += tlv.h
+header-y += usb_stream.h
diff --git a/init/main.c b/init/main.c
index 4c17fda5c2ff..eae02aa03c9e 100644
--- a/init/main.c
+++ b/init/main.c
@@ -453,7 +453,7 @@ void __init __weak smp_setup_processor_id(void)
 }
 
 # if THREAD_SIZE >= PAGE_SIZE
-void __init __weak thread_info_cache_init(void)
+void __init __weak thread_stack_cache_init(void)
 {
 }
 #endif
@@ -627,7 +627,7 @@ asmlinkage __visible void __init start_kernel(void)
         /* Should be run before the first non-init thread is created */
         init_espfix_bsp();
 #endif
-        thread_info_cache_init();
+        thread_stack_cache_init();
         cred_init();
         fork_init();
         proc_caches_init();
@@ -708,11 +708,13 @@ static bool __init_or_module initcall_blacklisted(initcall_t fn)
 {
         struct blacklist_entry *entry;
         char fn_name[KSYM_SYMBOL_LEN];
+        unsigned long addr;
 
         if (list_empty(&blacklisted_initcalls))
                 return false;
 
-        sprint_symbol_no_offset(fn_name, (unsigned long)fn);
+        addr = (unsigned long) dereference_function_descriptor(fn);
+        sprint_symbol_no_offset(fn_name, addr);
 
         list_for_each_entry(entry, &blacklisted_initcalls, next) {
                 if (!strcmp(fn_name, entry->buf)) {
diff --git a/kernel/audit.c b/kernel/audit.c
index 22bb4f24f071..8d528f9930da 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -1883,6 +1883,23 @@ out_null:
         audit_log_format(ab, " exe=(null)");
 }
 
+struct tty_struct *audit_get_tty(struct task_struct *tsk)
+{
+        struct tty_struct *tty = NULL;
+        unsigned long flags;
+
+        spin_lock_irqsave(&tsk->sighand->siglock, flags);
+        if (tsk->signal)
+                tty = tty_kref_get(tsk->signal->tty);
+        spin_unlock_irqrestore(&tsk->sighand->siglock, flags);
+        return tty;
+}
+
+void audit_put_tty(struct tty_struct *tty)
+{
+        tty_kref_put(tty);
+}
+
 void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk)
 {
         const struct cred *cred;
diff --git a/kernel/audit.h b/kernel/audit.h
index cbbe6bb6496e..a492f4c4e710 100644
--- a/kernel/audit.h
+++ b/kernel/audit.h
@@ -23,6 +23,7 @@
 #include <linux/audit.h>
 #include <linux/skbuff.h>
 #include <uapi/linux/mqueue.h>
+#include <linux/tty.h>
 
 /* AUDIT_NAMES is the number of slots we reserve in the audit_context
  * for saving names from getname().  If we get more names we will allocate
@@ -262,6 +263,9 @@ extern struct audit_entry *audit_dupe_rule(struct audit_krule *old);
 extern void audit_log_d_path_exe(struct audit_buffer *ab,
                                  struct mm_struct *mm);
 
+extern struct tty_struct *audit_get_tty(struct task_struct *tsk);
+extern void audit_put_tty(struct tty_struct *tty);
+
 /* audit watch functions */
 #ifdef CONFIG_AUDIT_WATCH
 extern void audit_put_watch(struct audit_watch *watch);
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 62ab53d7619c..2672d105cffc 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -63,7 +63,6 @@
 #include <asm/unistd.h>
 #include <linux/security.h>
 #include <linux/list.h>
-#include <linux/tty.h>
 #include <linux/binfmts.h>
 #include <linux/highmem.h>
 #include <linux/syscalls.h>
@@ -1985,14 +1984,15 @@ static void audit_log_set_loginuid(kuid_t koldloginuid, kuid_t kloginuid,
         if (!audit_enabled)
                 return;
 
+        ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_LOGIN);
+        if (!ab)
+                return;
+
         uid = from_kuid(&init_user_ns, task_uid(current));
         oldloginuid = from_kuid(&init_user_ns, koldloginuid);
         loginuid = from_kuid(&init_user_ns, kloginuid),
         tty = audit_get_tty(current);
 
-        ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_LOGIN);
-        if (!ab)
-                return;
         audit_log_format(ab, "pid=%d uid=%u", task_pid_nr(current), uid);
         audit_log_task_context(ab);
         audit_log_format(ab, " old-auid=%u auid=%u tty=%s old-ses=%u ses=%u res=%d",
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 668e07903c8f..eec9f90ba030 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -126,31 +126,6 @@
  * are set to NOT_INIT to indicate that they are no longer readable.
  */
 
-/* types of values stored in eBPF registers */
-enum bpf_reg_type {
-        NOT_INIT = 0,            /* nothing was written into register */
-        UNKNOWN_VALUE,           /* reg doesn't contain a valid pointer */
-        PTR_TO_CTX,              /* reg points to bpf_context */
-        CONST_PTR_TO_MAP,        /* reg points to struct bpf_map */
-        PTR_TO_MAP_VALUE,        /* reg points to map element value */
-        PTR_TO_MAP_VALUE_OR_NULL,/* points to map elem value or NULL */
-        FRAME_PTR,               /* reg == frame_pointer */
-        PTR_TO_STACK,            /* reg == frame_pointer + imm */
-        CONST_IMM,               /* constant integer value */
-
-        /* PTR_TO_PACKET represents:
-         * skb->data
-         * skb->data + imm
-         * skb->data + (u16) var
-         * skb->data + (u16) var + imm
-         * if (range > 0) then [ptr, ptr + range - off) is safe to access
-         * if (id > 0) means that some 'var' was added
-         * if (off > 0) menas that 'imm' was added
-         */
-        PTR_TO_PACKET,
-        PTR_TO_PACKET_END,       /* skb->data + headlen */
-};
-
 struct reg_state {
         enum bpf_reg_type type;
         union {
@@ -695,10 +670,10 @@ static int check_packet_access(struct verifier_env *env, u32 regno, int off,
 
 /* check access to 'struct bpf_context' fields */
 static int check_ctx_access(struct verifier_env *env, int off, int size,
-                            enum bpf_access_type t)
+                            enum bpf_access_type t, enum bpf_reg_type *reg_type)
 {
         if (env->prog->aux->ops->is_valid_access &&
-            env->prog->aux->ops->is_valid_access(off, size, t)) {
+            env->prog->aux->ops->is_valid_access(off, size, t, reg_type)) {
                 /* remember the offset of last byte accessed in ctx */
                 if (env->prog->aux->max_ctx_offset < off + size)
                         env->prog->aux->max_ctx_offset = off + size;
@@ -798,21 +773,19 @@ static int check_mem_access(struct verifier_env *env, u32 regno, int off,
                         mark_reg_unknown_value(state->regs, value_regno);
 
         } else if (reg->type == PTR_TO_CTX) {
+                enum bpf_reg_type reg_type = UNKNOWN_VALUE;
+
                 if (t == BPF_WRITE && value_regno >= 0 &&
                     is_pointer_value(env, value_regno)) {
                         verbose("R%d leaks addr into ctx\n", value_regno);
                         return -EACCES;
                 }
-                err = check_ctx_access(env, off, size, t);
+                err = check_ctx_access(env, off, size, t, &reg_type);
                 if (!err && t == BPF_READ && value_regno >= 0) {
                         mark_reg_unknown_value(state->regs, value_regno);
-                        if (off == offsetof(struct __sk_buff, data) &&
-                            env->allow_ptr_leaks)
+                        if (env->allow_ptr_leaks)
                                 /* note that reg.[id|off|range] == 0 */
-                                state->regs[value_regno].type = PTR_TO_PACKET;
-                        else if (off == offsetof(struct __sk_buff, data_end) &&
-                                 env->allow_ptr_leaks)
-                                state->regs[value_regno].type = PTR_TO_PACKET_END;
+                                state->regs[value_regno].type = reg_type;
                 }
 
         } else if (reg->type == FRAME_PTR || reg->type == PTR_TO_STACK) {
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 86cb5c6e8932..75c0ff00aca6 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -837,6 +837,8 @@ static void put_css_set_locked(struct css_set *cset)
 
 static void put_css_set(struct css_set *cset)
 {
+        unsigned long flags;
+
         /*
          * Ensure that the refcount doesn't hit zero while any readers
          * can see it. Similar to atomic_dec_and_lock(), but for an
@@ -845,9 +847,9 @@ static void put_css_set(struct css_set *cset)
         if (atomic_add_unless(&cset->refcount, -1, 1))
                 return;
 
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irqsave(&css_set_lock, flags);
         put_css_set_locked(cset);
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irqrestore(&css_set_lock, flags);
 }
 
 /*
@@ -1070,11 +1072,11 @@ static struct css_set *find_css_set(struct css_set *old_cset,
 
         /* First see if we already have a cgroup group that matches
          * the desired set */
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
         cset = find_existing_css_set(old_cset, cgrp, template);
         if (cset)
                 get_css_set(cset);
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
 
         if (cset)
                 return cset;
@@ -1102,7 +1104,7 @@ static struct css_set *find_css_set(struct css_set *old_cset,
          * find_existing_css_set() */
         memcpy(cset->subsys, template, sizeof(cset->subsys));
 
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
         /* Add reference counts and links from the new css_set. */
         list_for_each_entry(link, &old_cset->cgrp_links, cgrp_link) {
                 struct cgroup *c = link->cgrp;
@@ -1128,7 +1130,7 @@ static struct css_set *find_css_set(struct css_set *old_cset,
                 css_get(css);
         }
 
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
 
         return cset;
 }
@@ -1192,7 +1194,7 @@ static void cgroup_destroy_root(struct cgroup_root *root)
          * Release all the links from cset_links to this hierarchy's
          * root cgroup
          */
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
 
         list_for_each_entry_safe(link, tmp_link, &cgrp->cset_links, cset_link) {
                 list_del(&link->cset_link);
@@ -1200,7 +1202,7 @@ static void cgroup_destroy_root(struct cgroup_root *root)
                 kfree(link);
         }
 
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
 
         if (!list_empty(&root->root_list)) {
                 list_del(&root->root_list);
@@ -1600,11 +1602,11 @@ static int rebind_subsystems(struct cgroup_root *dst_root, u16 ss_mask)
                 ss->root = dst_root;
                 css->cgroup = dcgrp;
 
-                spin_lock_bh(&css_set_lock);
+                spin_lock_irq(&css_set_lock);
                 hash_for_each(css_set_table, i, cset, hlist)
                         list_move_tail(&cset->e_cset_node[ss->id],
                                        &dcgrp->e_csets[ss->id]);
-                spin_unlock_bh(&css_set_lock);
+                spin_unlock_irq(&css_set_lock);
 
                 /* default hierarchy doesn't enable controllers by default */
                 dst_root->subsys_mask |= 1 << ssid;
@@ -1640,10 +1642,10 @@ static int cgroup_show_path(struct seq_file *sf, struct kernfs_node *kf_node,
         if (!buf)
                 return -ENOMEM;
 
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
         ns_cgroup = current_cgns_cgroup_from_root(kf_cgroot);
         len = kernfs_path_from_node(kf_node, ns_cgroup->kn, buf, PATH_MAX);
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
 
         if (len >= PATH_MAX)
                 len = -ERANGE;
@@ -1897,7 +1899,7 @@ static void cgroup_enable_task_cg_lists(void)
 {
         struct task_struct *p, *g;
 
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
 
         if (use_task_css_set_links)
                 goto out_unlock;
@@ -1922,8 +1924,12 @@ static void cgroup_enable_task_cg_lists(void)
                  * entry won't be deleted though the process has exited.
                  * Do it while holding siglock so that we don't end up
                  * racing against cgroup_exit().
+                 *
+                 * Interrupts were already disabled while acquiring
+                 * the css_set_lock, so we do not need to disable it
+                 * again when acquiring the sighand->siglock here.
                  */
-                spin_lock_irq(&p->sighand->siglock);
+                spin_lock(&p->sighand->siglock);
                 if (!(p->flags & PF_EXITING)) {
                         struct css_set *cset = task_css_set(p);
 
@@ -1932,11 +1938,11 @@ static void cgroup_enable_task_cg_lists(void)
                         list_add_tail(&p->cg_list, &cset->tasks);
                         get_css_set(cset);
                 }
-                spin_unlock_irq(&p->sighand->siglock);
+                spin_unlock(&p->sighand->siglock);
         } while_each_thread(g, p);
         read_unlock(&tasklist_lock);
 out_unlock:
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
 }
 
 static void init_cgroup_housekeeping(struct cgroup *cgrp)
@@ -2043,13 +2049,13 @@ static int cgroup_setup_root(struct cgroup_root *root, u16 ss_mask)
          * Link the root cgroup in this hierarchy into all the css_set
          * objects.
          */
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
         hash_for_each(css_set_table, i, cset, hlist) {
                 link_css_set(&tmp_links, cset, root_cgrp);
                 if (css_set_populated(cset))
                         cgroup_update_populated(root_cgrp, true);
         }
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
 
         BUG_ON(!list_empty(&root_cgrp->self.children));
         BUG_ON(atomic_read(&root->nr_cgrps) != 1);
@@ -2256,11 +2262,11 @@ out_mount:
                 struct cgroup *cgrp;
 
                 mutex_lock(&cgroup_mutex);
-                spin_lock_bh(&css_set_lock);
+                spin_lock_irq(&css_set_lock);
 
                 cgrp = cset_cgroup_from_root(ns->root_cset, root);
 
-                spin_unlock_bh(&css_set_lock);
+                spin_unlock_irq(&css_set_lock);
                 mutex_unlock(&cgroup_mutex);
 
                 nsdentry = kernfs_node_dentry(cgrp->kn, dentry->d_sb);
@@ -2337,11 +2343,11 @@ char *cgroup_path_ns(struct cgroup *cgrp, char *buf, size_t buflen,
         char *ret;
 
         mutex_lock(&cgroup_mutex);
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
 
         ret = cgroup_path_ns_locked(cgrp, buf, buflen, ns);
 
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
         mutex_unlock(&cgroup_mutex);
 
         return ret;
@@ -2369,7 +2375,7 @@ char *task_cgroup_path(struct task_struct *task, char *buf, size_t buflen)
         char *path = NULL;
 
         mutex_lock(&cgroup_mutex);
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
 
         root = idr_get_next(&cgroup_hierarchy_idr, &hierarchy_id);
 
@@ -2382,7 +2388,7 @@ char *task_cgroup_path(struct task_struct *task, char *buf, size_t buflen)
                         path = buf;
         }
 
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
         mutex_unlock(&cgroup_mutex);
         return path;
 }
@@ -2557,7 +2563,7 @@ static int cgroup_taskset_migrate(struct cgroup_taskset *tset,
          * the new cgroup.  There are no failure cases after here, so this
          * is the commit point.
          */
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
         list_for_each_entry(cset, &tset->src_csets, mg_node) {
                 list_for_each_entry_safe(task, tmp_task, &cset->mg_tasks, cg_list) {
                         struct css_set *from_cset = task_css_set(task);
@@ -2568,7 +2574,7 @@ static int cgroup_taskset_migrate(struct cgroup_taskset *tset,
                         put_css_set_locked(from_cset);
                 }
         }
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
 
         /*
          * Migration is committed, all target tasks are now on dst_csets.
@@ -2597,13 +2603,13 @@ out_cancel_attach:
                 }
         } while_each_subsys_mask();
 out_release_tset:
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
         list_splice_init(&tset->dst_csets, &tset->src_csets);
         list_for_each_entry_safe(cset, tmp_cset, &tset->src_csets, mg_node) {
                 list_splice_tail_init(&cset->mg_tasks, &cset->tasks);
                 list_del_init(&cset->mg_node);
         }
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
         return ret;
 }
 
@@ -2634,7 +2640,7 @@ static void cgroup_migrate_finish(struct list_head *preloaded_csets)
 
         lockdep_assert_held(&cgroup_mutex);
 
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
         list_for_each_entry_safe(cset, tmp_cset, preloaded_csets, mg_preload_node) {
                 cset->mg_src_cgrp = NULL;
                 cset->mg_dst_cgrp = NULL;
@@ -2642,7 +2648,7 @@ static void cgroup_migrate_finish(struct list_head *preloaded_csets)
                 list_del_init(&cset->mg_preload_node);
                 put_css_set_locked(cset);
         }
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
 }
 
 /**
@@ -2783,7 +2789,7 @@ static int cgroup_migrate(struct task_struct *leader, bool threadgroup,
          * already PF_EXITING could be freed from underneath us unless we
          * take an rcu_read_lock.
          */
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
         rcu_read_lock();
         task = leader;
         do {
@@ -2792,7 +2798,7 @@ static int cgroup_migrate(struct task_struct *leader, bool threadgroup,
                         break;
         } while_each_thread(leader, task);
         rcu_read_unlock();
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
 
         return cgroup_taskset_migrate(&tset, root);
 }
@@ -2816,7 +2822,7 @@ static int cgroup_attach_task(struct cgroup *dst_cgrp,
                 return -EBUSY;
 
         /* look up all src csets */
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
         rcu_read_lock();
         task = leader;
         do {
@@ -2826,7 +2832,7 @@ static int cgroup_attach_task(struct cgroup *dst_cgrp,
                         break;
         } while_each_thread(leader, task);
         rcu_read_unlock();
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
 
         /* prepare dst csets and commit */
         ret = cgroup_migrate_prepare_dst(&preloaded_csets);
@@ -2859,9 +2865,9 @@ static int cgroup_procs_write_permission(struct task_struct *task,
                 struct cgroup *cgrp;
                 struct inode *inode;
 
-                spin_lock_bh(&css_set_lock);
+                spin_lock_irq(&css_set_lock);
                 cgrp = task_cgroup_from_root(task, &cgrp_dfl_root);
-                spin_unlock_bh(&css_set_lock);
+                spin_unlock_irq(&css_set_lock);
 
                 while (!cgroup_is_descendant(dst_cgrp, cgrp))
                         cgrp = cgroup_parent(cgrp);
@@ -2962,9 +2968,9 @@ int cgroup_attach_task_all(struct task_struct *from, struct task_struct *tsk)
                 if (root == &cgrp_dfl_root)
                         continue;
 
-                spin_lock_bh(&css_set_lock);
+                spin_lock_irq(&css_set_lock);
                 from_cgrp = task_cgroup_from_root(from, root);
-                spin_unlock_bh(&css_set_lock);
+                spin_unlock_irq(&css_set_lock);
 
                 retval = cgroup_attach_task(from_cgrp, tsk, false);
                 if (retval)
@@ -3080,7 +3086,7 @@ static int cgroup_update_dfl_csses(struct cgroup *cgrp)
         percpu_down_write(&cgroup_threadgroup_rwsem);
 
         /* look up all csses currently attached to @cgrp's subtree */
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
         cgroup_for_each_live_descendant_pre(dsct, d_css, cgrp) {
                 struct cgrp_cset_link *link;
 
@@ -3088,14 +3094,14 @@ static int cgroup_update_dfl_csses(struct cgroup *cgrp)
                         cgroup_migrate_add_src(link->cset, dsct,
                                                &preloaded_csets);
         }
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
 
         /* NULL dst indicates self on default hierarchy */
         ret = cgroup_migrate_prepare_dst(&preloaded_csets);
         if (ret)
                 goto out_finish;
 
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
         list_for_each_entry(src_cset, &preloaded_csets, mg_preload_node) {
                 struct task_struct *task, *ntask;
 
@@ -3107,7 +3113,7 @@ static int cgroup_update_dfl_csses(struct cgroup *cgrp)
                 list_for_each_entry_safe(task, ntask, &src_cset->tasks, cg_list)
                         cgroup_taskset_add(task, &tset);
         }
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
 
         ret = cgroup_taskset_migrate(&tset, cgrp->root);
 out_finish:
@@ -3908,10 +3914,10 @@ static int cgroup_task_count(const struct cgroup *cgrp)
         int count = 0;
         struct cgrp_cset_link *link;
 
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
         list_for_each_entry(link, &cgrp->cset_links, cset_link)
                 count += atomic_read(&link->cset->refcount);
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
         return count;
 }
 
@@ -4249,7 +4255,7 @@ void css_task_iter_start(struct cgroup_subsys_state *css,
 
         memset(it, 0, sizeof(*it));
 
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
 
         it->ss = css->ss;
 
@@ -4262,7 +4268,7 @@ void css_task_iter_start(struct cgroup_subsys_state *css,
 
         css_task_iter_advance_css_set(it);
 
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
 }
 
 /**
@@ -4280,7 +4286,7 @@ struct task_struct *css_task_iter_next(struct css_task_iter *it)
                 it->cur_task = NULL;
         }
 
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
 
         if (it->task_pos) {
                 it->cur_task = list_entry(it->task_pos, struct task_struct,
@@ -4289,7 +4295,7 @@ struct task_struct *css_task_iter_next(struct css_task_iter *it)
                 css_task_iter_advance(it);
         }
 
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
 
         return it->cur_task;
 }
@@ -4303,10 +4309,10 @@ struct task_struct *css_task_iter_next(struct css_task_iter *it)
 void css_task_iter_end(struct css_task_iter *it)
 {
         if (it->cur_cset) {
-                spin_lock_bh(&css_set_lock);
+                spin_lock_irq(&css_set_lock);
                 list_del(&it->iters_node);
                 put_css_set_locked(it->cur_cset);
-                spin_unlock_bh(&css_set_lock);
+                spin_unlock_irq(&css_set_lock);
         }
 
         if (it->cur_task)
@@ -4338,10 +4344,10 @@ int cgroup_transfer_tasks(struct cgroup *to, struct cgroup *from)
         mutex_lock(&cgroup_mutex);
 
         /* all tasks in @from are being moved, all csets are source */
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
         list_for_each_entry(link, &from->cset_links, cset_link)
                 cgroup_migrate_add_src(link->cset, to, &preloaded_csets);
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
 
         ret = cgroup_migrate_prepare_dst(&preloaded_csets);
         if (ret)
@@ -5063,6 +5069,7 @@ static void init_and_link_css(struct cgroup_subsys_state *css,
         memset(css, 0, sizeof(*css));
         css->cgroup = cgrp;
         css->ss = ss;
+        css->id = -1;
         INIT_LIST_HEAD(&css->sibling);
         INIT_LIST_HEAD(&css->children);
         css->serial_nr = css_serial_nr_next++;
@@ -5150,7 +5157,7 @@ static struct cgroup_subsys_state *css_create(struct cgroup *cgrp,
 
         err = cgroup_idr_alloc(&ss->css_idr, NULL, 2, 0, GFP_KERNEL);
         if (err < 0)
-                goto err_free_percpu_ref;
+                goto err_free_css;
         css->id = err;
 
         /* @css is ready to be brought online now, make it visible */
@@ -5174,9 +5181,6 @@ static struct cgroup_subsys_state *css_create(struct cgroup *cgrp,
 
 err_list_del:
         list_del_rcu(&css->sibling);
-        cgroup_idr_remove(&ss->css_idr, css->id);
-err_free_percpu_ref:
-        percpu_ref_exit(&css->refcnt);
 err_free_css:
         call_rcu(&css->rcu_head, css_free_rcu_fn);
         return ERR_PTR(err);
@@ -5451,10 +5455,10 @@ static int cgroup_destroy_locked(struct cgroup *cgrp)
          */
         cgrp->self.flags &= ~CSS_ONLINE;
 
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
         list_for_each_entry(link, &cgrp->cset_links, cset_link)
                 link->cset->dead = true;
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
 
         /* initiate massacre of all css's */
         for_each_css(css, ssid, cgrp)
@@ -5725,7 +5729,7 @@ int proc_cgroup_show(struct seq_file *m, struct pid_namespace *ns,
                 goto out;
 
         mutex_lock(&cgroup_mutex);
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
 
         for_each_root(root) {
                 struct cgroup_subsys *ss;
@@ -5778,7 +5782,7 @@ int proc_cgroup_show(struct seq_file *m, struct pid_namespace *ns,
 
         retval = 0;
 out_unlock:
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
         mutex_unlock(&cgroup_mutex);
         kfree(buf);
 out:
@@ -5923,13 +5927,13 @@ void cgroup_post_fork(struct task_struct *child)
         if (use_task_css_set_links) {
                 struct css_set *cset;
 
-                spin_lock_bh(&css_set_lock);
+                spin_lock_irq(&css_set_lock);
                 cset = task_css_set(current);
                 if (list_empty(&child->cg_list)) {
                         get_css_set(cset);
                         css_set_move_task(child, NULL, cset, false);
                 }
-                spin_unlock_bh(&css_set_lock);
+                spin_unlock_irq(&css_set_lock);
         }
 
         /*
@@ -5974,9 +5978,9 @@ void cgroup_exit(struct task_struct *tsk)
         cset = task_css_set(tsk);
 
         if (!list_empty(&tsk->cg_list)) {
-                spin_lock_bh(&css_set_lock);
+                spin_lock_irq(&css_set_lock);
                 css_set_move_task(tsk, cset, NULL, false);
-                spin_unlock_bh(&css_set_lock);
+                spin_unlock_irq(&css_set_lock);
         } else {
                 get_css_set(cset);
         }
@@ -6044,9 +6048,9 @@ static void cgroup_release_agent(struct work_struct *work)
         if (!pathbuf || !agentbuf)
                 goto out;
 
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
         path = cgroup_path_ns_locked(cgrp, pathbuf, PATH_MAX, &init_cgroup_ns);
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
         if (!path)
                 goto out;
 
@@ -6306,12 +6310,12 @@ struct cgroup_namespace *copy_cgroup_ns(unsigned long flags,
                 return ERR_PTR(-EPERM);
 
         mutex_lock(&cgroup_mutex);
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
 
         cset = task_css_set(current);
         get_css_set(cset);
 
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
         mutex_unlock(&cgroup_mutex);
 
         new_ns = alloc_cgroup_ns();
@@ -6435,7 +6439,7 @@ static int current_css_set_cg_links_read(struct seq_file *seq, void *v)
         if (!name_buf)
                 return -ENOMEM;
 
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
         rcu_read_lock();
         cset = rcu_dereference(current->cgroups);
         list_for_each_entry(link, &cset->cgrp_links, cgrp_link) {
@@ -6446,7 +6450,7 @@ static int current_css_set_cg_links_read(struct seq_file *seq, void *v)
                            c->root->hierarchy_id, name_buf);
         }
         rcu_read_unlock();
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
         kfree(name_buf);
         return 0;
 }
@@ -6457,7 +6461,7 @@ static int cgroup_css_links_read(struct seq_file *seq, void *v)
         struct cgroup_subsys_state *css = seq_css(seq);
         struct cgrp_cset_link *link;
 
-        spin_lock_bh(&css_set_lock);
+        spin_lock_irq(&css_set_lock);
         list_for_each_entry(link, &css->cgroup->cset_links, cset_link) {
                 struct css_set *cset = link->cset;
                 struct task_struct *task;
@@ -6480,7 +6484,7 @@ static int cgroup_css_links_read(struct seq_file *seq, void *v)
         overflow:
                 seq_puts(seq, "  ...\n");
         }
-        spin_unlock_bh(&css_set_lock);
+        spin_unlock_irq(&css_set_lock);
         return 0;
 }
 
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 274450efea90..85cd41878a74 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -3862,10 +3862,8 @@ static void _free_event(struct perf_event *event)
         if (event->ctx)
                 put_ctx(event->ctx);
 
-        if (event->pmu) {
-                exclusive_event_destroy(event);
-                module_put(event->pmu->module);
-        }
+        exclusive_event_destroy(event);
+        module_put(event->pmu->module);
 
         call_rcu(&event->rcu_head, free_event_rcu);
 }
@@ -7531,7 +7529,7 @@ static void perf_event_free_bpf_prog(struct perf_event *event)
         prog = event->tp_event->prog;
         if (prog) {
                 event->tp_event->prog = NULL;
-                bpf_prog_put(prog);
+                bpf_prog_put_rcu(prog);
         }
 }
 
diff --git a/kernel/fork.c b/kernel/fork.c
index 5c2c355aa97f..4a7ec0c6c88c 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -148,18 +148,18 @@ static inline void free_task_struct(struct task_struct *tsk)
 }
 #endif
 
-void __weak arch_release_thread_info(struct thread_info *ti)
+void __weak arch_release_thread_stack(unsigned long *stack)
 {
 }
 
-#ifndef CONFIG_ARCH_THREAD_INFO_ALLOCATOR
+#ifndef CONFIG_ARCH_THREAD_STACK_ALLOCATOR
 
 /*
  * Allocate pages if THREAD_SIZE is >= PAGE_SIZE, otherwise use a
  * kmemcache based allocator.
  */
 # if THREAD_SIZE >= PAGE_SIZE
-static struct thread_info *alloc_thread_info_node(struct task_struct *tsk,
+static unsigned long *alloc_thread_stack_node(struct task_struct *tsk,
                                                   int node)
 {
         struct page *page = alloc_kmem_pages_node(node, THREADINFO_GFP,
@@ -172,33 +172,33 @@ static struct thread_info *alloc_thread_info_node(struct task_struct *tsk,
         return page ? page_address(page) : NULL;
 }
 
-static inline void free_thread_info(struct thread_info *ti)
+static inline void free_thread_stack(unsigned long *stack)
 {
-        struct page *page = virt_to_page(ti);
+        struct page *page = virt_to_page(stack);
 
         memcg_kmem_update_page_stat(page, MEMCG_KERNEL_STACK,
                                     -(1 << THREAD_SIZE_ORDER));
         __free_kmem_pages(page, THREAD_SIZE_ORDER);
 }
 # else
-static struct kmem_cache *thread_info_cache;
+static struct kmem_cache *thread_stack_cache;
 
-static struct thread_info *alloc_thread_info_node(struct task_struct *tsk,
+static unsigned long *alloc_thread_stack_node(struct task_struct *tsk,
                                                   int node)
 {
-        return kmem_cache_alloc_node(thread_info_cache, THREADINFO_GFP, node);
+        return kmem_cache_alloc_node(thread_stack_cache, THREADINFO_GFP, node);
 }
 
-static void free_thread_info(struct thread_info *ti)
+static void free_thread_stack(unsigned long *stack)
 {
-        kmem_cache_free(thread_info_cache, ti);
+        kmem_cache_free(thread_stack_cache, stack);
 }
 
-void thread_info_cache_init(void)
+void thread_stack_cache_init(void)
 {
-        thread_info_cache = kmem_cache_create("thread_info", THREAD_SIZE,
+        thread_stack_cache = kmem_cache_create("thread_stack", THREAD_SIZE,
                                               THREAD_SIZE, 0, NULL);
-        BUG_ON(thread_info_cache == NULL);
+        BUG_ON(thread_stack_cache == NULL);
 }
 # endif
 #endif
@@ -221,9 +221,9 @@ struct kmem_cache *vm_area_cachep;
 /* SLAB cache for mm_struct structures (tsk->mm) */
 static struct kmem_cache *mm_cachep;
 
-static void account_kernel_stack(struct thread_info *ti, int account)
+static void account_kernel_stack(unsigned long *stack, int account)
 {
-        struct zone *zone = page_zone(virt_to_page(ti));
+        struct zone *zone = page_zone(virt_to_page(stack));
 
         mod_zone_page_state(zone, NR_KERNEL_STACK, account);
 }
@@ -231,8 +231,8 @@ static void account_kernel_stack(struct thread_info *ti, int account)
 void free_task(struct task_struct *tsk)
 {
         account_kernel_stack(tsk->stack, -1);
-        arch_release_thread_info(tsk->stack);
-        free_thread_info(tsk->stack);
+        arch_release_thread_stack(tsk->stack);
+        free_thread_stack(tsk->stack);
         rt_mutex_debug_task_free(tsk);
         ftrace_graph_exit_task(tsk);
         put_seccomp_filter(tsk);
@@ -343,7 +343,7 @@ void set_task_stack_end_magic(struct task_struct *tsk)
 static struct task_struct *dup_task_struct(struct task_struct *orig, int node)
 {
         struct task_struct *tsk;
-        struct thread_info *ti;
+        unsigned long *stack;
         int err;
 
         if (node == NUMA_NO_NODE)
@@ -352,15 +352,15 @@ static struct task_struct *dup_task_struct(struct task_struct *orig, int node)
         if (!tsk)
                 return NULL;
 
-        ti = alloc_thread_info_node(tsk, node);
-        if (!ti)
+        stack = alloc_thread_stack_node(tsk, node);
+        if (!stack)
                 goto free_tsk;
 
         err = arch_dup_task_struct(tsk, orig);
         if (err)
-                goto free_ti;
+                goto free_stack;
 
-        tsk->stack = ti;
+        tsk->stack = stack;
 #ifdef CONFIG_SECCOMP
         /*
          * We must handle setting up seccomp filters once we're under
@@ -392,14 +392,14 @@ static struct task_struct *dup_task_struct(struct task_struct *orig, int node)
         tsk->task_frag.page = NULL;
         tsk->wake_q.next = NULL;
 
-        account_kernel_stack(ti, 1);
+        account_kernel_stack(stack, 1);
 
         kcov_task_init(tsk);
 
         return tsk;
 
-free_ti:
-        free_thread_info(ti);
+free_stack:
+        free_thread_stack(stack);
 free_tsk:
         free_task_struct(tsk);
         return NULL;
diff --git a/kernel/futex.c b/kernel/futex.c
index ee25f5ba4aca..33664f70e2d2 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -469,7 +469,7 @@ get_futex_key(u32 __user *uaddr, int fshared, union futex_key *key, int rw)
 {
         unsigned long address = (unsigned long)uaddr;
         struct mm_struct *mm = current->mm;
-        struct page *page;
+        struct page *page, *tail;
         struct address_space *mapping;
         int err, ro = 0;
 
@@ -530,7 +530,15 @@ again:
          * considered here and page lock forces unnecessarily serialization
          * From this point on, mapping will be re-verified if necessary and
          * page lock will be acquired only if it is unavoidable
-         */
+         *
+         * Mapping checks require the head page for any compound page so the
+         * head page and mapping is looked up now. For anonymous pages, it
+         * does not matter if the page splits in the future as the key is
+         * based on the address. For filesystem-backed pages, the tail is
+         * required as the index of the page determines the key. For
+         * base pages, there is no tail page and tail == page.
+         */
+        tail = page;
         page = compound_head(page);
         mapping = READ_ONCE(page->mapping);
 
@@ -654,7 +662,7 @@ again:
 
                 key->both.offset |= FUT_OFF_INODE; /* inode-based key */
                 key->shared.inode = inode;
-                key->shared.pgoff = basepage_index(page);
+                key->shared.pgoff = basepage_index(tail);
                 rcu_read_unlock();
         }
 
diff --git a/kernel/irq/Makefile b/kernel/irq/Makefile
index 2ee42e95a3ce..1d3ee3169202 100644
--- a/kernel/irq/Makefile
+++ b/kernel/irq/Makefile
@@ -9,3 +9,4 @@ obj-$(CONFIG_GENERIC_IRQ_MIGRATION) += cpuhotplug.o
 obj-$(CONFIG_PM_SLEEP) += pm.o
 obj-$(CONFIG_GENERIC_MSI_IRQ) += msi.o
 obj-$(CONFIG_GENERIC_IRQ_IPI) += ipi.o
+obj-$(CONFIG_SMP) += affinity.o
diff --git a/kernel/irq/affinity.c b/kernel/irq/affinity.c
new file mode 100644
index 000000000000..f68959341c0f
--- /dev/null
+++ b/kernel/irq/affinity.c
@@ -0,0 +1,61 @@
+
+#include <linux/interrupt.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/cpu.h>
+
+static int get_first_sibling(unsigned int cpu)
+{
+        unsigned int ret;
+
+        ret = cpumask_first(topology_sibling_cpumask(cpu));
+        if (ret < nr_cpu_ids)
+                return ret;
+        return cpu;
+}
+
+/*
+ * Take a map of online CPUs and the number of available interrupt vectors
+ * and generate an output cpumask suitable for spreading MSI/MSI-X vectors
+ * so that they are distributed as good as possible around the CPUs.  If
+ * more vectors than CPUs are available we'll map one to each CPU,
+ * otherwise we map one to the first sibling of each socket.
+ *
+ * If there are more vectors than CPUs we will still only have one bit
+ * set per CPU, but interrupt code will keep on assigning the vectors from
+ * the start of the bitmap until we run out of vectors.
+ */
+struct cpumask *irq_create_affinity_mask(unsigned int *nr_vecs)
+{
+        struct cpumask *affinity_mask;
+        unsigned int max_vecs = *nr_vecs;
+
+        if (max_vecs == 1)
+                return NULL;
+
+        affinity_mask = kzalloc(cpumask_size(), GFP_KERNEL);
+        if (!affinity_mask) {
+                *nr_vecs = 1;
+                return NULL;
+        }
+
+        if (max_vecs >= num_online_cpus()) {
+                cpumask_copy(affinity_mask, cpu_online_mask);
+                *nr_vecs = num_online_cpus();
+        } else {
+                unsigned int vecs = 0, cpu;
+
+                for_each_online_cpu(cpu) {
+                        if (cpu == get_first_sibling(cpu)) {
+                                cpumask_set_cpu(cpu, affinity_mask);
+                                vecs++;
+                        }
+
+                        if (--max_vecs == 0)
+                                break;
+                }
+                *nr_vecs = vecs;
+        }
+
+        return affinity_mask;
+}
diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h
index 09be2c903c6d..b15aa3b617a2 100644
--- a/kernel/irq/internals.h
+++ b/kernel/irq/internals.h
@@ -105,6 +105,8 @@ static inline void unregister_handler_proc(unsigned int irq,
                                            struct irqaction *action) { }
 #endif
 
+extern bool irq_can_set_affinity_usr(unsigned int irq);
+
 extern int irq_select_affinity_usr(unsigned int irq, struct cpumask *mask);
 
 extern void irq_set_thread_affinity(struct irq_desc *desc);
diff --git a/kernel/irq/ipi.c b/kernel/irq/ipi.c
index 89b49f6773f0..4fd23510d5f2 100644
--- a/kernel/irq/ipi.c
+++ b/kernel/irq/ipi.c
@@ -76,7 +76,7 @@ int irq_reserve_ipi(struct irq_domain *domain,
                 }
         }
 
-        virq = irq_domain_alloc_descs(-1, nr_irqs, 0, NUMA_NO_NODE);
+        virq = irq_domain_alloc_descs(-1, nr_irqs, 0, NUMA_NO_NODE, NULL);
         if (virq <= 0) {
                 pr_warn("Can't reserve IPI, failed to alloc descs\n");
                 return -ENOMEM;
diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c
index 8731e1c5d1e7..a623b44f2d4b 100644
--- a/kernel/irq/irqdesc.c
+++ b/kernel/irq/irqdesc.c
@@ -68,9 +68,13 @@ static int alloc_masks(struct irq_desc *desc, gfp_t gfp, int node)
         return 0;
 }
 
-static void desc_smp_init(struct irq_desc *desc, int node)
+static void desc_smp_init(struct irq_desc *desc, int node,
+                          const struct cpumask *affinity)
 {
-        cpumask_copy(desc->irq_common_data.affinity, irq_default_affinity);
+        if (!affinity)
+                affinity = irq_default_affinity;
+        cpumask_copy(desc->irq_common_data.affinity, affinity);
+
 #ifdef CONFIG_GENERIC_PENDING_IRQ
         cpumask_clear(desc->pending_mask);
 #endif
@@ -82,11 +86,12 @@ static void desc_smp_init(struct irq_desc *desc, int node)
 #else
 static inline int
 alloc_masks(struct irq_desc *desc, gfp_t gfp, int node) { return 0; }
-static inline void desc_smp_init(struct irq_desc *desc, int node) { }
+static inline void
+desc_smp_init(struct irq_desc *desc, int node, const struct cpumask *affinity) { }
 #endif
 
 static void desc_set_defaults(unsigned int irq, struct irq_desc *desc, int node,
-                struct module *owner)
+                              const struct cpumask *affinity, struct module *owner)
 {
         int cpu;
 
@@ -107,7 +112,7 @@ static void desc_set_defaults(unsigned int irq, struct irq_desc *desc, int node,
         desc->owner = owner;
         for_each_possible_cpu(cpu)
                 *per_cpu_ptr(desc->kstat_irqs, cpu) = 0;
-        desc_smp_init(desc, node);
+        desc_smp_init(desc, node, affinity);
 }
 
 int nr_irqs = NR_IRQS;
@@ -158,7 +163,9 @@ void irq_unlock_sparse(void)
         mutex_unlock(&sparse_irq_lock);
 }
 
-static struct irq_desc *alloc_desc(int irq, int node, struct module *owner)
+static struct irq_desc *alloc_desc(int irq, int node, unsigned int flags,
+                                   const struct cpumask *affinity,
+                                   struct module *owner)
 {
         struct irq_desc *desc;
         gfp_t gfp = GFP_KERNEL;
@@ -178,7 +185,8 @@ static struct irq_desc *alloc_desc(int irq, int node, struct module *owner)
         lockdep_set_class(&desc->lock, &irq_desc_lock_class);
         init_rcu_head(&desc->rcu);
 
-        desc_set_defaults(irq, desc, node, owner);
+        desc_set_defaults(irq, desc, node, affinity, owner);
+        irqd_set(&desc->irq_data, flags);
 
         return desc;
 
@@ -223,13 +231,32 @@ static void free_desc(unsigned int irq)
 }
 
 static int alloc_descs(unsigned int start, unsigned int cnt, int node,
-                       struct module *owner)
+                       const struct cpumask *affinity, struct module *owner)
 {
+        const struct cpumask *mask = NULL;
         struct irq_desc *desc;
-        int i;
+        unsigned int flags;
+        int i, cpu = -1;
+
+        if (affinity && cpumask_empty(affinity))
+                return -EINVAL;
+
+        flags = affinity ? IRQD_AFFINITY_MANAGED : 0;
 
         for (i = 0; i < cnt; i++) {
-                desc = alloc_desc(start + i, node, owner);
+                if (affinity) {
+                        cpu = cpumask_next(cpu, affinity);
+                        if (cpu >= nr_cpu_ids)
+                                cpu = cpumask_first(affinity);
+                        node = cpu_to_node(cpu);
+
+                        /*
+                         * For single allocations we use the caller provided
+                         * mask otherwise we use the mask of the target cpu
+                         */
+                        mask = cnt == 1 ? affinity : cpumask_of(cpu);
+                }
+                desc = alloc_desc(start + i, node, flags, mask, owner);
                 if (!desc)
                         goto err;
                 mutex_lock(&sparse_irq_lock);
@@ -277,7 +304,7 @@ int __init early_irq_init(void)
                 nr_irqs = initcnt;
 
         for (i = 0; i < initcnt; i++) {
-                desc = alloc_desc(i, node, NULL);
+                desc = alloc_desc(i, node, 0, NULL, NULL);
                 set_bit(i, allocated_irqs);
                 irq_insert_desc(i, desc);
         }
@@ -311,7 +338,7 @@ int __init early_irq_init(void)
                 alloc_masks(&desc[i], GFP_KERNEL, node);
                 raw_spin_lock_init(&desc[i].lock);
                 lockdep_set_class(&desc[i].lock, &irq_desc_lock_class);
-                desc_set_defaults(i, &desc[i], node, NULL);
+                desc_set_defaults(i, &desc[i], node, NULL, NULL);
         }
         return arch_early_irq_init();
 }
@@ -328,11 +355,12 @@ static void free_desc(unsigned int irq)
         unsigned long flags;
 
         raw_spin_lock_irqsave(&desc->lock, flags);
-        desc_set_defaults(irq, desc, irq_desc_get_node(desc), NULL);
+        desc_set_defaults(irq, desc, irq_desc_get_node(desc), NULL, NULL);
         raw_spin_unlock_irqrestore(&desc->lock, flags);
 }
 
 static inline int alloc_descs(unsigned int start, unsigned int cnt, int node,
+                              const struct cpumask *affinity,
                               struct module *owner)
 {
         u32 i;
@@ -453,12 +481,15 @@ EXPORT_SYMBOL_GPL(irq_free_descs);
  * @cnt:        Number of consecutive irqs to allocate.
  * @node:       Preferred node on which the irq descriptor should be allocated
  * @owner:      Owning module (can be NULL)
+ * @affinity:   Optional pointer to an affinity mask which hints where the
+ *              irq descriptors should be allocated and which default
+ *              affinities to use
  *
  * Returns the first irq number or error code
  */
 int __ref
 __irq_alloc_descs(int irq, unsigned int from, unsigned int cnt, int node,
-                  struct module *owner)
+                  struct module *owner, const struct cpumask *affinity)
 {
         int start, ret;
 
@@ -494,7 +525,7 @@ __irq_alloc_descs(int irq, unsigned int from, unsigned int cnt, int node,
 
         bitmap_set(allocated_irqs, start, cnt);
         mutex_unlock(&sparse_irq_lock);
-        return alloc_descs(start, cnt, node, owner);
+        return alloc_descs(start, cnt, node, affinity, owner);
 
 err:
         mutex_unlock(&sparse_irq_lock);
@@ -512,7 +543,7 @@ EXPORT_SYMBOL_GPL(__irq_alloc_descs);
  */
 unsigned int irq_alloc_hwirqs(int cnt, int node)
 {
-        int i, irq = __irq_alloc_descs(-1, 0, cnt, node, NULL);
+        int i, irq = __irq_alloc_descs(-1, 0, cnt, node, NULL, NULL);
 
         if (irq < 0)
                 return 0;
diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
index 8798b6c9e945..79459b732dc9 100644
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -481,7 +481,7 @@ unsigned int irq_create_mapping(struct irq_domain *domain,
         }
 
         /* Allocate a virtual interrupt number */
-        virq = irq_domain_alloc_descs(-1, 1, hwirq, of_node_to_nid(of_node));
+        virq = irq_domain_alloc_descs(-1, 1, hwirq, of_node_to_nid(of_node), NULL);
         if (virq <= 0) {
                 pr_debug("-> virq allocation failed\n");
                 return 0;
@@ -835,19 +835,23 @@ const struct irq_domain_ops irq_domain_simple_ops = {
 EXPORT_SYMBOL_GPL(irq_domain_simple_ops);
 
 int irq_domain_alloc_descs(int virq, unsigned int cnt, irq_hw_number_t hwirq,
-                           int node)
+                           int node, const struct cpumask *affinity)
 {
         unsigned int hint;
 
         if (virq >= 0) {
-                virq = irq_alloc_descs(virq, virq, cnt, node);
+                virq = __irq_alloc_descs(virq, virq, cnt, node, THIS_MODULE,
+                                         affinity);
         } else {
                 hint = hwirq % nr_irqs;
                 if (hint == 0)
                         hint++;
-                virq = irq_alloc_descs_from(hint, cnt, node);
-                if (virq <= 0 && hint > 1)
-                        virq = irq_alloc_descs_from(1, cnt, node);
+                virq = __irq_alloc_descs(-1, hint, cnt, node, THIS_MODULE,
+                                         affinity);
+                if (virq <= 0 && hint > 1) {
+                        virq = __irq_alloc_descs(-1, 1, cnt, node, THIS_MODULE,
+                                                 affinity);
+                }
         }
 
         return virq;
@@ -1160,6 +1164,7 @@ int irq_domain_alloc_irqs_recursive(struct irq_domain *domain,
  * @node:       NUMA node id for memory allocation
  * @arg:        domain specific argument
  * @realloc:    IRQ descriptors have already been allocated if true
+ * @affinity:   Optional irq affinity mask for multiqueue devices
  *
  * Allocate IRQ numbers and initialized all data structures to support
  * hierarchy IRQ domains.
@@ -1175,7 +1180,7 @@ int irq_domain_alloc_irqs_recursive(struct irq_domain *domain,
  */
 int __irq_domain_alloc_irqs(struct irq_domain *domain, int irq_base,
                             unsigned int nr_irqs, int node, void *arg,
-                            bool realloc)
+                            bool realloc, const struct cpumask *affinity)
 {
         int i, ret, virq;
 
@@ -1193,7 +1198,8 @@ int __irq_domain_alloc_irqs(struct irq_domain *domain, int irq_base,
         if (realloc && irq_base >= 0) {
                 virq = irq_base;
         } else {
-                virq = irq_domain_alloc_descs(irq_base, nr_irqs, 0, node);
+                virq = irq_domain_alloc_descs(irq_base, nr_irqs, 0, node,
+                                              affinity);
                 if (virq < 0) {
                         pr_debug("cannot allocate IRQ(base %d, count %d)\n",
                                  irq_base, nr_irqs);
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index ef0bc02c3a70..ad0aac6d1248 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -115,12 +115,12 @@ EXPORT_SYMBOL(synchronize_irq);
 #ifdef CONFIG_SMP
 cpumask_var_t irq_default_affinity;
 
-static int __irq_can_set_affinity(struct irq_desc *desc)
+static bool __irq_can_set_affinity(struct irq_desc *desc)
 {
         if (!desc || !irqd_can_balance(&desc->irq_data) ||
             !desc->irq_data.chip || !desc->irq_data.chip->irq_set_affinity)
-                return 0;
-        return 1;
+                return false;
+        return true;
 }
 
 /**
@@ -134,6 +134,21 @@ int irq_can_set_affinity(unsigned int irq)
 }
 
 /**
+ * irq_can_set_affinity_usr - Check if affinity of a irq can be set from user space
+ * @irq:        Interrupt to check
+ *
+ * Like irq_can_set_affinity() above, but additionally checks for the
+ * AFFINITY_MANAGED flag.
+ */
+bool irq_can_set_affinity_usr(unsigned int irq)
+{
+        struct irq_desc *desc = irq_to_desc(irq);
+
+        return __irq_can_set_affinity(desc) &&
+                !irqd_affinity_is_managed(&desc->irq_data);
+}
+
+/**
  *      irq_set_thread_affinity - Notify irq threads to adjust affinity
  *      @desc:          irq descriptor which has affitnity changed
  *
@@ -338,10 +353,11 @@ static int setup_affinity(struct irq_desc *desc, struct cpumask *mask)
                 return 0;
 
         /*
-         * Preserve an userspace affinity setup, but make sure that
-         * one of the targets is online.
+         * Preserve the managed affinity setting and an userspace affinity
+         * setup, but make sure that one of the targets is online.
          */
-        if (irqd_has_set(&desc->irq_data, IRQD_AFFINITY_SET)) {
+        if (irqd_affinity_is_managed(&desc->irq_data) ||
+            irqd_has_set(&desc->irq_data, IRQD_AFFINITY_SET)) {
                 if (cpumask_intersects(desc->irq_common_data.affinity,
                                        cpu_online_mask))
                         set = desc->irq_common_data.affinity;
diff --git a/kernel/irq/msi.c b/kernel/irq/msi.c
index 38e89ce7b071..0e2a736b14a7 100644
--- a/kernel/irq/msi.c
+++ b/kernel/irq/msi.c
@@ -324,7 +324,7 @@ int msi_domain_alloc_irqs(struct irq_domain *domain, struct device *dev,
         struct msi_domain_ops *ops = info->ops;
         msi_alloc_info_t arg;
         struct msi_desc *desc;
-        int i, ret, virq = -1;
+        int i, ret, virq;
 
         ret = msi_domain_prepare_irqs(domain, dev, nvec, &arg);
         if (ret)
@@ -332,13 +332,10 @@ int msi_domain_alloc_irqs(struct irq_domain *domain, struct device *dev,
 
         for_each_msi_entry(desc, dev) {
                 ops->set_desc(&arg, desc);
-                if (info->flags & MSI_FLAG_IDENTITY_MAP)
-                        virq = (int)ops->get_hwirq(info, &arg);
-                else
-                        virq = -1;
 
-                virq = __irq_domain_alloc_irqs(domain, virq, desc->nvec_used,
-                                               dev_to_node(dev), &arg, false);
+                virq = __irq_domain_alloc_irqs(domain, -1, desc->nvec_used,
+                                               dev_to_node(dev), &arg, false,
+                                               desc->affinity);
                 if (virq < 0) {
                         ret = -ENOSPC;
                         if (ops->handle_error)
diff --git a/kernel/irq/proc.c b/kernel/irq/proc.c
index 4e1b94726818..40bdcdc1f700 100644
--- a/kernel/irq/proc.c
+++ b/kernel/irq/proc.c
@@ -96,7 +96,7 @@ static ssize_t write_irq_affinity(int type, struct file *file,
         cpumask_var_t new_value;
         int err;
 
-        if (!irq_can_set_affinity(irq) || no_irq_affinity)
+        if (!irq_can_set_affinity_usr(irq) || no_irq_affinity)
                 return -EIO;
 
         if (!alloc_cpumask_var(&new_value, GFP_KERNEL))
diff --git a/kernel/jump_label.c b/kernel/jump_label.c
index 05254eeb4b4e..4b353e0be121 100644
--- a/kernel/jump_label.c
+++ b/kernel/jump_label.c
@@ -58,13 +58,36 @@ static void jump_label_update(struct static_key *key);
 
 void static_key_slow_inc(struct static_key *key)
 {
+        int v, v1;
+
         STATIC_KEY_CHECK_USE();
-        if (atomic_inc_not_zero(&key->enabled))
-                return;
+
+        /*
+         * Careful if we get concurrent static_key_slow_inc() calls;
+         * later calls must wait for the first one to _finish_ the
+         * jump_label_update() process.  At the same time, however,
+         * the jump_label_update() call below wants to see
+         * static_key_enabled(&key) for jumps to be updated properly.
+         *
+         * So give a special meaning to negative key->enabled: it sends
+         * static_key_slow_inc() down the slow path, and it is non-zero
+         * so it counts as "enabled" in jump_label_update().  Note that
+         * atomic_inc_unless_negative() checks >= 0, so roll our own.
+         */
+        for (v = atomic_read(&key->enabled); v > 0; v = v1) {
+                v1 = atomic_cmpxchg(&key->enabled, v, v + 1);
+                if (likely(v1 == v))
+                        return;
+        }
 
         jump_label_lock();
-        if (atomic_inc_return(&key->enabled) == 1)
+        if (atomic_read(&key->enabled) == 0) {
+                atomic_set(&key->enabled, -1);
                 jump_label_update(key);
+                atomic_set(&key->enabled, 1);
+        } else {
+                atomic_inc(&key->enabled);
+        }
         jump_label_unlock();
 }
 EXPORT_SYMBOL_GPL(static_key_slow_inc);
@@ -72,6 +95,13 @@ EXPORT_SYMBOL_GPL(static_key_slow_inc);
 static void __static_key_slow_dec(struct static_key *key,
                 unsigned long rate_limit, struct delayed_work *work)
 {
+        /*
+         * The negative count check is valid even when a negative
+         * key->enabled is in use by static_key_slow_inc(); a
+         * __static_key_slow_dec() before the first static_key_slow_inc()
+         * returns is unbalanced, because all other static_key_slow_inc()
+         * instances block while the update is in progress.
+         */
         if (!atomic_dec_and_mutex_lock(&key->enabled, &jump_label_mutex)) {
                 WARN(atomic_read(&key->enabled) < 0,
                      "jump label: negative count!\n");
diff --git a/kernel/kcov.c b/kernel/kcov.c
index a02f2dddd1d7..8d44b3fea9d0 100644
--- a/kernel/kcov.c
+++ b/kernel/kcov.c
@@ -264,7 +264,12 @@ static const struct file_operations kcov_fops = {
 
 static int __init kcov_init(void)
 {
-        if (!debugfs_create_file("kcov", 0600, NULL, NULL, &kcov_fops)) {
+        /*
+         * The kcov debugfs file won't ever get removed and thus,
+         * there is no need to protect it against removal races. The
+         * use of debugfs_create_file_unsafe() is actually safe here.
+         */
+        if (!debugfs_create_file_unsafe("kcov", 0600, NULL, NULL, &kcov_fops)) {
                 pr_err("failed to create kcov in debugfs\n");
                 return -ENOMEM;
         }
diff --git a/kernel/locking/mutex-debug.c b/kernel/locking/mutex-debug.c
index 3ef3736002d8..9c951fade415 100644
--- a/kernel/locking/mutex-debug.c
+++ b/kernel/locking/mutex-debug.c
@@ -49,21 +49,21 @@ void debug_mutex_free_waiter(struct mutex_waiter *waiter)
 }
 
 void debug_mutex_add_waiter(struct mutex *lock, struct mutex_waiter *waiter,
-                            struct thread_info *ti)
+                            struct task_struct *task)
 {
         SMP_DEBUG_LOCKS_WARN_ON(!spin_is_locked(&lock->wait_lock));
 
         /* Mark the current thread as blocked on the lock: */
-        ti->task->blocked_on = waiter;
+        task->blocked_on = waiter;
 }
 
 void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
-                         struct thread_info *ti)
+                         struct task_struct *task)
 {
         DEBUG_LOCKS_WARN_ON(list_empty(&waiter->list));
-        DEBUG_LOCKS_WARN_ON(waiter->task != ti->task);
-        DEBUG_LOCKS_WARN_ON(ti->task->blocked_on != waiter);
-        ti->task->blocked_on = NULL;
+        DEBUG_LOCKS_WARN_ON(waiter->task != task);
+        DEBUG_LOCKS_WARN_ON(task->blocked_on != waiter);
+        task->blocked_on = NULL;
 
         list_del_init(&waiter->list);
         waiter->task = NULL;
diff --git a/kernel/locking/mutex-debug.h b/kernel/locking/mutex-debug.h
index 0799fd3e4cfa..d06ae3bb46c5 100644
--- a/kernel/locking/mutex-debug.h
+++ b/kernel/locking/mutex-debug.h
@@ -20,9 +20,9 @@ extern void debug_mutex_wake_waiter(struct mutex *lock,
 extern void debug_mutex_free_waiter(struct mutex_waiter *waiter);
 extern void debug_mutex_add_waiter(struct mutex *lock,
                                    struct mutex_waiter *waiter,
-                                   struct thread_info *ti);
+                                   struct task_struct *task);
 extern void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
-                                struct thread_info *ti);
+                                struct task_struct *task);
 extern void debug_mutex_unlock(struct mutex *lock);
 extern void debug_mutex_init(struct mutex *lock, const char *name,
                              struct lock_class_key *key);
diff --git a/kernel/locking/mutex.c b/kernel/locking/mutex.c
index e364b424b019..a70b90db3909 100644
--- a/kernel/locking/mutex.c
+++ b/kernel/locking/mutex.c
@@ -486,9 +486,6 @@ __ww_mutex_lock_check_stamp(struct mutex *lock, struct ww_acquire_ctx *ctx)
         if (!hold_ctx)
                 return 0;
 
-        if (unlikely(ctx == hold_ctx))
-                return -EALREADY;
-
         if (ctx->stamp - hold_ctx->stamp <= LONG_MAX &&
             (ctx->stamp != hold_ctx->stamp || ctx > hold_ctx)) {
 #ifdef CONFIG_DEBUG_MUTEXES
@@ -514,6 +511,12 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
         unsigned long flags;
         int ret;
 
+        if (use_ww_ctx) {
+                struct ww_mutex *ww = container_of(lock, struct ww_mutex, base);
+                if (unlikely(ww_ctx == READ_ONCE(ww->ctx)))
+                        return -EALREADY;
+        }
+
         preempt_disable();
         mutex_acquire_nest(&lock->dep_map, subclass, 0, nest_lock, ip);
 
@@ -534,7 +537,7 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
                 goto skip_wait;
 
         debug_mutex_lock_common(lock, &waiter);
-        debug_mutex_add_waiter(lock, &waiter, task_thread_info(task));
+        debug_mutex_add_waiter(lock, &waiter, task);
 
         /* add waiting tasks to the end of the waitqueue (FIFO): */
         list_add_tail(&waiter.list, &lock->wait_list);
@@ -581,7 +584,7 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
         }
         __set_task_state(task, TASK_RUNNING);
 
-        mutex_remove_waiter(lock, &waiter, current_thread_info());
+        mutex_remove_waiter(lock, &waiter, task);
         /* set it to 0 if there are no waiters left: */
         if (likely(list_empty(&lock->wait_list)))
                 atomic_set(&lock->count, 0);
@@ -602,7 +605,7 @@ skip_wait:
         return 0;
 
 err:
-        mutex_remove_waiter(lock, &waiter, task_thread_info(task));
+        mutex_remove_waiter(lock, &waiter, task);
         spin_unlock_mutex(&lock->wait_lock, flags);
         debug_mutex_free_waiter(&waiter);
         mutex_release(&lock->dep_map, 1, ip);
diff --git a/kernel/locking/mutex.h b/kernel/locking/mutex.h
index 5cda397607f2..a68bae5e852a 100644
--- a/kernel/locking/mutex.h
+++ b/kernel/locking/mutex.h
@@ -13,7 +13,7 @@
                 do { spin_lock(lock); (void)(flags); } while (0)
 #define spin_unlock_mutex(lock, flags) \
                 do { spin_unlock(lock); (void)(flags); } while (0)
-#define mutex_remove_waiter(lock, waiter, ti) \
+#define mutex_remove_waiter(lock, waiter, task) \
                 __list_del((waiter)->list.prev, (waiter)->list.next)
 
 #ifdef CONFIG_MUTEX_SPIN_ON_OWNER
diff --git a/kernel/locking/qspinlock.c b/kernel/locking/qspinlock.c
index ce2f75e32ae1..5fc8c311b8fe 100644
--- a/kernel/locking/qspinlock.c
+++ b/kernel/locking/qspinlock.c
@@ -267,6 +267,66 @@ static __always_inline u32  __pv_wait_head_or_lock(struct qspinlock *lock,
 #define queued_spin_lock_slowpath       native_queued_spin_lock_slowpath
 #endif
 
+/*
+ * queued_spin_lock_slowpath() can (load-)ACQUIRE the lock before
+ * issuing an _unordered_ store to set _Q_LOCKED_VAL.
+ *
+ * This means that the store can be delayed, but no later than the
+ * store-release from the unlock. This means that simply observing
+ * _Q_LOCKED_VAL is not sufficient to determine if the lock is acquired.
+ *
+ * There are two paths that can issue the unordered store:
+ *
+ *  (1) clear_pending_set_locked():     *,1,0 -> *,0,1
+ *
+ *  (2) set_locked():                   t,0,0 -> t,0,1 ; t != 0
+ *      atomic_cmpxchg_relaxed():       t,0,0 -> 0,0,1
+ *
+ * However, in both cases we have other !0 state we've set before to queue
+ * ourseves:
+ *
+ * For (1) we have the atomic_cmpxchg_acquire() that set _Q_PENDING_VAL, our
+ * load is constrained by that ACQUIRE to not pass before that, and thus must
+ * observe the store.
+ *
+ * For (2) we have a more intersting scenario. We enqueue ourselves using
+ * xchg_tail(), which ends up being a RELEASE. This in itself is not
+ * sufficient, however that is followed by an smp_cond_acquire() on the same
+ * word, giving a RELEASE->ACQUIRE ordering. This again constrains our load and
+ * guarantees we must observe that store.
+ *
+ * Therefore both cases have other !0 state that is observable before the
+ * unordered locked byte store comes through. This means we can use that to
+ * wait for the lock store, and then wait for an unlock.
+ */
+#ifndef queued_spin_unlock_wait
+void queued_spin_unlock_wait(struct qspinlock *lock)
+{
+        u32 val;
+
+        for (;;) {
+                val = atomic_read(&lock->val);
+
+                if (!val) /* not locked, we're done */
+                        goto done;
+
+                if (val & _Q_LOCKED_MASK) /* locked, go wait for unlock */
+                        break;
+
+                /* not locked, but pending, wait until we observe the lock */
+                cpu_relax();
+        }
+
+        /* any unlock is good */
+        while (atomic_read(&lock->val) & _Q_LOCKED_MASK)
+                cpu_relax();
+
+done:
+        smp_rmb(); /* CTRL + RMB -> ACQUIRE */
+}
+EXPORT_SYMBOL(queued_spin_unlock_wait);
+#endif
+
 #endif /* _GEN_PV_LOCK_SLOWPATH */
 
 /**
diff --git a/kernel/power/process.c b/kernel/power/process.c
index df058bed53ce..0c2ee9761d57 100644
--- a/kernel/power/process.c
+++ b/kernel/power/process.c
@@ -146,6 +146,18 @@ int freeze_processes(void)
         if (!error && !oom_killer_disable())
                 error = -EBUSY;
 
+        /*
+         * There is a hard to fix race between oom_reaper kernel thread
+         * and oom_killer_disable. oom_reaper calls exit_oom_victim
+         * before the victim reaches exit_mm so try to freeze all the tasks
+         * again and catch such a left over task.
+         */
+        if (!error) {
+                pr_info("Double checking all user space processes after OOM killer disable... ");
+                error = try_to_freeze_tasks(true);
+                pr_cont("\n");
+        }
+
         if (error)
                 thaw_processes();
         return error;
diff --git a/kernel/relay.c b/kernel/relay.c
index 074994bcfa9b..04d7cf3ef8cf 100644
--- a/kernel/relay.c
+++ b/kernel/relay.c
@@ -614,6 +614,7 @@ free_bufs:
 
         kref_put(&chan->kref, relay_destroy_channel);
         mutex_unlock(&relay_channels_mutex);
+        kfree(chan);
         return NULL;
 }
 EXPORT_SYMBOL_GPL(relay_open);
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 7f2cae4620c7..51d7105f529a 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -1536,7 +1536,9 @@ static int select_fallback_rq(int cpu, struct task_struct *p)
         for (;;) {
                 /* Any allowed, online CPU? */
                 for_each_cpu(dest_cpu, tsk_cpus_allowed(p)) {
-                        if (!cpu_active(dest_cpu))
+                        if (!(p->flags & PF_KTHREAD) && !cpu_active(dest_cpu))
+                                continue;
+                        if (!cpu_online(dest_cpu))
                                 continue;
                         goto out;
                 }
@@ -2253,9 +2255,11 @@ int sysctl_numa_balancing(struct ctl_table *table, int write,
 #endif
 #endif
 
+#ifdef CONFIG_SCHEDSTATS
+
 DEFINE_STATIC_KEY_FALSE(sched_schedstats);
+static bool __initdata __sched_schedstats = false;
 
-#ifdef CONFIG_SCHEDSTATS
 static void set_schedstats(bool enabled)
 {
         if (enabled)
@@ -2278,11 +2282,16 @@ static int __init setup_schedstats(char *str)
         if (!str)
                 goto out;
 
+        /*
+         * This code is called before jump labels have been set up, so we can't
+         * change the static branch directly just yet.  Instead set a temporary
+         * variable so init_schedstats() can do it later.
+         */
         if (!strcmp(str, "enable")) {
-                set_schedstats(true);
+                __sched_schedstats = true;
                 ret = 1;
         } else if (!strcmp(str, "disable")) {
-                set_schedstats(false);
+                __sched_schedstats = false;
                 ret = 1;
         }
 out:
@@ -2293,6 +2302,11 @@ out:
 }
 __setup("schedstats=", setup_schedstats);
 
+static void __init init_schedstats(void)
+{
+        set_schedstats(__sched_schedstats);
+}
+
 #ifdef CONFIG_PROC_SYSCTL
 int sysctl_schedstats(struct ctl_table *table, int write,
                          void __user *buffer, size_t *lenp, loff_t *ppos)
@@ -2313,8 +2327,10 @@ int sysctl_schedstats(struct ctl_table *table, int write,
                 set_schedstats(state);
         return err;
 }
-#endif
-#endif
+#endif /* CONFIG_PROC_SYSCTL */
+#else  /* !CONFIG_SCHEDSTATS */
+static inline void init_schedstats(void) {}
+#endif /* CONFIG_SCHEDSTATS */
 
 /*
  * fork()/clone()-time setup:
@@ -2521,10 +2537,9 @@ void wake_up_new_task(struct task_struct *p)
          */
         set_task_cpu(p, select_task_rq(p, task_cpu(p), SD_BALANCE_FORK, 0));
 #endif
-        /* Post initialize new task's util average when its cfs_rq is set */
+        rq = __task_rq_lock(p, &rf);
         post_init_entity_util_avg(&p->se);
 
-        rq = __task_rq_lock(p, &rf);
         activate_task(rq, p, 0);
         p->on_rq = TASK_ON_RQ_QUEUED;
         trace_sched_wakeup_new(p);
@@ -3156,7 +3171,8 @@ static noinline void __schedule_bug(struct task_struct *prev)
 static inline void schedule_debug(struct task_struct *prev)
 {
 #ifdef CONFIG_SCHED_STACK_END_CHECK
-        BUG_ON(task_stack_end_corrupted(prev));
+        if (task_stack_end_corrupted(prev))
+                panic("corrupted stack end detected inside scheduler\n");
 #endif
 
         if (unlikely(in_atomic_preempt_off())) {
@@ -5133,14 +5149,16 @@ void show_state_filter(unsigned long state_filter)
                 /*
                  * reset the NMI-timeout, listing all files on a slow
                  * console might take a lot of time:
+                 * Also, reset softlockup watchdogs on all CPUs, because
+                 * another CPU might be blocked waiting for us to process
+                 * an IPI.
                  */
                 touch_nmi_watchdog();
+                touch_all_softlockup_watchdogs();
                 if (!state_filter || (p->state & state_filter))
                         sched_show_task(p);
         }
 
-        touch_all_softlockup_watchdogs();
-
 #ifdef CONFIG_SCHED_DEBUG
         if (!state_filter)
                 sysrq_sched_debug_show();
@@ -7487,6 +7505,8 @@ void __init sched_init(void)
 #endif
         init_sched_fair_class();
 
+        init_schedstats();
+
         scheduler_running = 1;
 }
 
diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c
index cf905f655ba1..0368c393a336 100644
--- a/kernel/sched/debug.c
+++ b/kernel/sched/debug.c
@@ -427,19 +427,12 @@ print_task(struct seq_file *m, struct rq *rq, struct task_struct *p)
                 SPLIT_NS(p->se.vruntime),
                 (long long)(p->nvcsw + p->nivcsw),
                 p->prio);
-#ifdef CONFIG_SCHEDSTATS
-        if (schedstat_enabled()) {
-                SEQ_printf(m, "%9Ld.%06ld %9Ld.%06ld %9Ld.%06ld",
-                        SPLIT_NS(p->se.statistics.wait_sum),
-                        SPLIT_NS(p->se.sum_exec_runtime),
-                        SPLIT_NS(p->se.statistics.sum_sleep_runtime));
-        }
-#else
+
         SEQ_printf(m, "%9Ld.%06ld %9Ld.%06ld %9Ld.%06ld",
-                0LL, 0L,
+                SPLIT_NS(schedstat_val(p, se.statistics.wait_sum)),
                 SPLIT_NS(p->se.sum_exec_runtime),
-                0LL, 0L);
-#endif
+                SPLIT_NS(schedstat_val(p, se.statistics.sum_sleep_runtime)));
+
 #ifdef CONFIG_NUMA_BALANCING
         SEQ_printf(m, " %d %d", task_node(p), task_numa_group_id(p));
 #endif
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 218f8e83db73..bdcbeea90c95 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -2904,6 +2904,23 @@ static inline void cfs_rq_util_change(struct cfs_rq *cfs_rq)
         }
 }
 
+/*
+ * Unsigned subtract and clamp on underflow.
+ *
+ * Explicitly do a load-store to ensure the intermediate value never hits
+ * memory. This allows lockless observations without ever seeing the negative
+ * values.
+ */
+#define sub_positive(_ptr, _val) do {                           \
+        typeof(_ptr) ptr = (_ptr);                              \
+        typeof(*ptr) val = (_val);                              \
+        typeof(*ptr) res, var = READ_ONCE(*ptr);                \
+        res = var - val;                                        \
+        if (res > var)                                          \
+                res = 0;                                        \
+        WRITE_ONCE(*ptr, res);                                  \
+} while (0)
+
 /* Group cfs_rq's load_avg is used for task_h_load and update_cfs_share */
 static inline int
 update_cfs_rq_load_avg(u64 now, struct cfs_rq *cfs_rq, bool update_freq)
@@ -2913,15 +2930,15 @@ update_cfs_rq_load_avg(u64 now, struct cfs_rq *cfs_rq, bool update_freq)
 
         if (atomic_long_read(&cfs_rq->removed_load_avg)) {
                 s64 r = atomic_long_xchg(&cfs_rq->removed_load_avg, 0);
-                sa->load_avg = max_t(long, sa->load_avg - r, 0);
-                sa->load_sum = max_t(s64, sa->load_sum - r * LOAD_AVG_MAX, 0);
+                sub_positive(&sa->load_avg, r);
+                sub_positive(&sa->load_sum, r * LOAD_AVG_MAX);
                 removed_load = 1;
         }
 
         if (atomic_long_read(&cfs_rq->removed_util_avg)) {
                 long r = atomic_long_xchg(&cfs_rq->removed_util_avg, 0);
-                sa->util_avg = max_t(long, sa->util_avg - r, 0);
-                sa->util_sum = max_t(s32, sa->util_sum - r * LOAD_AVG_MAX, 0);
+                sub_positive(&sa->util_avg, r);
+                sub_positive(&sa->util_sum, r * LOAD_AVG_MAX);
                 removed_util = 1;
         }
 
@@ -2994,10 +3011,10 @@ static void detach_entity_load_avg(struct cfs_rq *cfs_rq, struct sched_entity *s
                           &se->avg, se->on_rq * scale_load_down(se->load.weight),
                           cfs_rq->curr == se, NULL);
 
-        cfs_rq->avg.load_avg = max_t(long, cfs_rq->avg.load_avg - se->avg.load_avg, 0);
-        cfs_rq->avg.load_sum = max_t(s64,  cfs_rq->avg.load_sum - se->avg.load_sum, 0);
-        cfs_rq->avg.util_avg = max_t(long, cfs_rq->avg.util_avg - se->avg.util_avg, 0);
-        cfs_rq->avg.util_sum = max_t(s32,  cfs_rq->avg.util_sum - se->avg.util_sum, 0);
+        sub_positive(&cfs_rq->avg.load_avg, se->avg.load_avg);
+        sub_positive(&cfs_rq->avg.load_sum, se->avg.load_sum);
+        sub_positive(&cfs_rq->avg.util_avg, se->avg.util_avg);
+        sub_positive(&cfs_rq->avg.util_sum, se->avg.util_sum);
 
         cfs_rq_util_change(cfs_rq);
 }
@@ -3246,7 +3263,7 @@ static inline void check_schedstat_required(void)
                         trace_sched_stat_iowait_enabled()  ||
                         trace_sched_stat_blocked_enabled() ||
                         trace_sched_stat_runtime_enabled())  {
-                pr_warn_once("Scheduler tracepoints stat_sleep, stat_iowait, "
+                printk_deferred_once("Scheduler tracepoints stat_sleep, stat_iowait, "
                              "stat_blocked and stat_runtime require the "
                              "kernel parameter schedstats=enabled or "
                              "kernel.sched_schedstats=1\n");
@@ -4185,6 +4202,26 @@ static void check_enqueue_throttle(struct cfs_rq *cfs_rq)
         if (!cfs_bandwidth_used())
                 return;
 
+        /* Synchronize hierarchical throttle counter: */
+        if (unlikely(!cfs_rq->throttle_uptodate)) {
+                struct rq *rq = rq_of(cfs_rq);
+                struct cfs_rq *pcfs_rq;
+                struct task_group *tg;
+
+                cfs_rq->throttle_uptodate = 1;
+
+                /* Get closest up-to-date node, because leaves go first: */
+                for (tg = cfs_rq->tg->parent; tg; tg = tg->parent) {
+                        pcfs_rq = tg->cfs_rq[cpu_of(rq)];
+                        if (pcfs_rq->throttle_uptodate)
+                                break;
+                }
+                if (tg) {
+                        cfs_rq->throttle_count = pcfs_rq->throttle_count;
+                        cfs_rq->throttled_clock_task = rq_clock_task(rq);
+                }
+        }
+
         /* an active group must be handled by the update_curr()->put() path */
         if (!cfs_rq->runtime_enabled || cfs_rq->curr)
                 return;
@@ -4500,15 +4537,14 @@ static void dequeue_task_fair(struct rq *rq, struct task_struct *p, int flags)
 
                 /* Don't dequeue parent if it has other entities besides us */
                 if (cfs_rq->load.weight) {
+                        /* Avoid re-evaluating load for this entity: */
+                        se = parent_entity(se);
                         /*
                          * Bias pick_next to pick a task from this cfs_rq, as
                          * p is sleeping when it is within its sched_slice.
                          */
-                        if (task_sleep && parent_entity(se))
-                                set_next_buddy(parent_entity(se));
-
-                        /* avoid re-evaluating load for this entity */
-                        se = parent_entity(se);
+                        if (task_sleep && se && !throttled_hierarchy(cfs_rq))
+                                set_next_buddy(se);
                         break;
                 }
                 flags |= DEQUEUE_SLEEP;
@@ -8496,8 +8532,9 @@ void free_fair_sched_group(struct task_group *tg)
 
 int alloc_fair_sched_group(struct task_group *tg, struct task_group *parent)
 {
-        struct cfs_rq *cfs_rq;
         struct sched_entity *se;
+        struct cfs_rq *cfs_rq;
+        struct rq *rq;
         int i;
 
         tg->cfs_rq = kzalloc(sizeof(cfs_rq) * nr_cpu_ids, GFP_KERNEL);
@@ -8512,6 +8549,8 @@ int alloc_fair_sched_group(struct task_group *tg, struct task_group *parent)
         init_cfs_bandwidth(tg_cfs_bandwidth(tg));
 
         for_each_possible_cpu(i) {
+                rq = cpu_rq(i);
+
                 cfs_rq = kzalloc_node(sizeof(struct cfs_rq),
                                       GFP_KERNEL, cpu_to_node(i));
                 if (!cfs_rq)
@@ -8525,7 +8564,10 @@ int alloc_fair_sched_group(struct task_group *tg, struct task_group *parent)
                 init_cfs_rq(cfs_rq);
                 init_tg_cfs_entry(tg, cfs_rq, se, i, parent->se[i]);
                 init_entity_runnable_average(se);
+
+                raw_spin_lock_irq(&rq->lock);
                 post_init_entity_util_avg(se);
+                raw_spin_unlock_irq(&rq->lock);
         }
 
         return 1;
diff --git a/kernel/sched/idle.c b/kernel/sched/idle.c
index bd12c6c714ec..c5aeedf4e93a 100644
--- a/kernel/sched/idle.c
+++ b/kernel/sched/idle.c
@@ -127,7 +127,7 @@ static int call_cpuidle(struct cpuidle_driver *drv, struct cpuidle_device *dev,
  */
 static void cpuidle_idle_call(void)
 {
-        struct cpuidle_device *dev = __this_cpu_read(cpuidle_devices);
+        struct cpuidle_device *dev = cpuidle_get_device();
         struct cpuidle_driver *drv = cpuidle_get_cpu_driver(dev);
         int next_state, entered_state;
 
diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
index 72f1f3087b04..7cbeb92a1cb9 100644
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -437,7 +437,7 @@ struct cfs_rq {
 
         u64 throttled_clock, throttled_clock_task;
         u64 throttled_clock_task_time;
-        int throttled, throttle_count;
+        int throttled, throttle_count, throttle_uptodate;
         struct list_head throttled_list;
 #endif /* CONFIG_CFS_BANDWIDTH */
 #endif /* CONFIG_FAIR_GROUP_SCHED */
diff --git a/kernel/sched/stats.h b/kernel/sched/stats.h
index 70b3b6a20fb0..78955cbea31c 100644
--- a/kernel/sched/stats.h
+++ b/kernel/sched/stats.h
@@ -33,6 +33,8 @@ rq_sched_info_dequeued(struct rq *rq, unsigned long long delta)
 # define schedstat_inc(rq, field)       do { if (schedstat_enabled()) { (rq)->field++; } } while (0)
 # define schedstat_add(rq, field, amt)  do { if (schedstat_enabled()) { (rq)->field += (amt); } } while (0)
 # define schedstat_set(var, val)        do { if (schedstat_enabled()) { var = (val); } } while (0)
+# define schedstat_val(rq, field)       ((schedstat_enabled()) ? (rq)->field : 0)
+
 #else /* !CONFIG_SCHEDSTATS */
 static inline void
 rq_sched_info_arrive(struct rq *rq, unsigned long long delta)
@@ -47,6 +49,7 @@ rq_sched_info_depart(struct rq *rq, unsigned long long delta)
 # define schedstat_inc(rq, field)       do { } while (0)
 # define schedstat_add(rq, field, amt)  do { } while (0)
 # define schedstat_set(var, val)        do { } while (0)
+# define schedstat_val(rq, field)       0
 #endif
 
 #ifdef CONFIG_SCHED_INFO
diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 780bcbe1d4de..26f603da7e26 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -198,7 +198,7 @@ static u64 bpf_perf_event_read(u64 r1, u64 index, u64 r3, u64 r4, u64 r5)
         if (unlikely(index >= array->map.max_entries))
                 return -E2BIG;
 
-        file = (struct file *)array->ptrs[index];
+        file = READ_ONCE(array->ptrs[index]);
         if (unlikely(!file))
                 return -ENOENT;
 
@@ -209,6 +209,10 @@ static u64 bpf_perf_event_read(u64 r1, u64 index, u64 r3, u64 r4, u64 r5)
             event->pmu->count)
                 return -EINVAL;
 
+        if (unlikely(event->attr.type != PERF_TYPE_HARDWARE &&
+                     event->attr.type != PERF_TYPE_RAW))
+                return -EINVAL;
+
         /*
          * we don't know if the function is run successfully by the
          * return value. It can be judged in other places, such as
@@ -247,7 +251,7 @@ static u64 bpf_perf_event_output(u64 r1, u64 r2, u64 flags, u64 r4, u64 size)
         if (unlikely(index >= array->map.max_entries))
                 return -E2BIG;
 
-        file = (struct file *)array->ptrs[index];
+        file = READ_ONCE(array->ptrs[index]);
         if (unlikely(!file))
                 return -ENOENT;
 
@@ -349,7 +353,8 @@ static const struct bpf_func_proto *kprobe_prog_func_proto(enum bpf_func_id func
 }
 
 /* bpf+kprobe programs can access fields of 'struct pt_regs' */
-static bool kprobe_prog_is_valid_access(int off, int size, enum bpf_access_type type)
+static bool kprobe_prog_is_valid_access(int off, int size, enum bpf_access_type type,
+                                        enum bpf_reg_type *reg_type)
 {
         /* check bounds */
         if (off < 0 || off >= sizeof(struct pt_regs))
@@ -427,7 +432,8 @@ static const struct bpf_func_proto *tp_prog_func_proto(enum bpf_func_id func_id)
         }
 }
 
-static bool tp_prog_is_valid_access(int off, int size, enum bpf_access_type type)
+static bool tp_prog_is_valid_access(int off, int size, enum bpf_access_type type,
+                                    enum bpf_reg_type *reg_type)
 {
         if (off < sizeof(void *) || off >= PERF_MAX_TRACE_SIZE)
                 return false;
diff --git a/kernel/trace/trace_printk.c b/kernel/trace/trace_printk.c
index f96f0383f6c6..ad1d6164e946 100644
--- a/kernel/trace/trace_printk.c
+++ b/kernel/trace/trace_printk.c
@@ -36,6 +36,10 @@ struct trace_bprintk_fmt {
 static inline struct trace_bprintk_fmt *lookup_format(const char *fmt)
 {
         struct trace_bprintk_fmt *pos;
+
+        if (!fmt)
+                return ERR_PTR(-EINVAL);
+
         list_for_each_entry(pos, &trace_bprintk_fmt_list, list) {
                 if (!strcmp(pos->fmt, fmt))
                         return pos;
@@ -57,7 +61,8 @@ void hold_module_trace_bprintk_format(const char **start, const char **end)
         for (iter = start; iter < end; iter++) {
                 struct trace_bprintk_fmt *tb_fmt = lookup_format(*iter);
                 if (tb_fmt) {
-                        *iter = tb_fmt->fmt;
+                        if (!IS_ERR(tb_fmt))
+                                *iter = tb_fmt->fmt;
                         continue;
                 }
 
diff --git a/mm/compaction.c b/mm/compaction.c
index 1427366ad673..79bfe0e06907 100644
--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -441,25 +441,23 @@ static unsigned long isolate_freepages_block(struct compact_control *cc,
 
                 /* Found a free page, break it into order-0 pages */
                 isolated = split_free_page(page);
+                if (!isolated)
+                        break;
+
                 total_isolated += isolated;
+                cc->nr_freepages += isolated;
                 for (i = 0; i < isolated; i++) {
                         list_add(&page->lru, freelist);
                         page++;
                 }
-
-                /* If a page was split, advance to the end of it */
-                if (isolated) {
-                        cc->nr_freepages += isolated;
-                        if (!strict &&
-                                cc->nr_migratepages <= cc->nr_freepages) {
-                                blockpfn += isolated;
-                                break;
-                        }
-
-                        blockpfn += isolated - 1;
-                        cursor += isolated - 1;
-                        continue;
+                if (!strict && cc->nr_migratepages <= cc->nr_freepages) {
+                        blockpfn += isolated;
+                        break;
                 }
+                /* Advance to the end of split page */
+                blockpfn += isolated - 1;
+                cursor += isolated - 1;
+                continue;
 
 isolate_fail:
                 if (strict)
@@ -469,6 +467,9 @@ isolate_fail:
 
         }
 
+        if (locked)
+                spin_unlock_irqrestore(&cc->zone->lock, flags);
+
         /*
          * There is a tiny chance that we have read bogus compound_order(),
          * so be careful to not go outside of the pageblock.
@@ -490,9 +491,6 @@ isolate_fail:
         if (strict && blockpfn < end_pfn)
                 total_isolated = 0;
 
-        if (locked)
-                spin_unlock_irqrestore(&cc->zone->lock, flags);
-
         /* Update the pageblock-skip if the whole pageblock was scanned */
         if (blockpfn == end_pfn)
                 update_pageblock_skip(cc, valid_page, total_isolated, false);
@@ -1011,6 +1009,7 @@ static void isolate_freepages(struct compact_control *cc)
                                 block_end_pfn = block_start_pfn,
                                 block_start_pfn -= pageblock_nr_pages,
                                 isolate_start_pfn = block_start_pfn) {
+                unsigned long isolated;
 
                 /*
                  * This can iterate a massively long zone without finding any
@@ -1035,8 +1034,12 @@ static void isolate_freepages(struct compact_control *cc)
                         continue;
 
                 /* Found a block suitable for isolating free pages from. */
-                isolate_freepages_block(cc, &isolate_start_pfn,
-                                        block_end_pfn, freelist, false);
+                isolated = isolate_freepages_block(cc, &isolate_start_pfn,
+                                                block_end_pfn, freelist, false);
+                /* If isolation failed early, do not continue needlessly */
+                if (!isolated && isolate_start_pfn < block_end_pfn &&
+                    cc->nr_migratepages > cc->nr_freepages)
+                        break;
 
                 /*
                  * If we isolated enough freepages, or aborted due to async
diff --git a/mm/fadvise.c b/mm/fadvise.c
index b8024fa7101d..6c707bfe02fd 100644
--- a/mm/fadvise.c
+++ b/mm/fadvise.c
@@ -126,6 +126,17 @@ SYSCALL_DEFINE4(fadvise64_64, int, fd, loff_t, offset, loff_t, len, int, advice)
                  */
                 start_index = (offset+(PAGE_SIZE-1)) >> PAGE_SHIFT;
                 end_index = (endbyte >> PAGE_SHIFT);
+                if ((endbyte & ~PAGE_MASK) != ~PAGE_MASK) {
+                        /* First page is tricky as 0 - 1 = -1, but pgoff_t
+                         * is unsigned, so the end_index >= start_index
+                         * check below would be true and we'll discard the whole
+                         * file cache which is not what was asked.
+                         */
+                        if (end_index == 0)
+                                break;
+
+                        end_index--;
+                }
 
                 if (end_index >= start_index) {
                         unsigned long count = invalidate_mapping_pages(mapping,
diff --git a/mm/filemap.c b/mm/filemap.c
index 00ae878b2a38..20f3b1f33f0e 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -2186,7 +2186,7 @@ repeat:
                 if (file->f_ra.mmap_miss > 0)
                         file->f_ra.mmap_miss--;
                 addr = address + (page->index - vmf->pgoff) * PAGE_SIZE;
-                do_set_pte(vma, addr, page, pte, false, false, true);
+                do_set_pte(vma, addr, page, pte, false, false);
                 unlock_page(page);
                 goto next;
 unlock:
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index d26162e81fea..c1f3c0be150a 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -832,8 +832,27 @@ static bool vma_has_reserves(struct vm_area_struct *vma, long chg)
          * Only the process that called mmap() has reserves for
          * private mappings.
          */
-        if (is_vma_resv_set(vma, HPAGE_RESV_OWNER))
-                return true;
+        if (is_vma_resv_set(vma, HPAGE_RESV_OWNER)) {
+                /*
+                 * Like the shared case above, a hole punch or truncate
+                 * could have been performed on the private mapping.
+                 * Examine the value of chg to determine if reserves
+                 * actually exist or were previously consumed.
+                 * Very Subtle - The value of chg comes from a previous
+                 * call to vma_needs_reserves().  The reserve map for
+                 * private mappings has different (opposite) semantics
+                 * than that of shared mappings.  vma_needs_reserves()
+                 * has already taken this difference in semantics into
+                 * account.  Therefore, the meaning of chg is the same
+                 * as in the shared case above.  Code could easily be
+                 * combined, but keeping it separate draws attention to
+                 * subtle differences.
+                 */
+                if (chg)
+                        return false;
+                else
+                        return true;
+        }
 
         return false;
 }
@@ -1011,6 +1030,7 @@ static void destroy_compound_gigantic_page(struct page *page,
         int nr_pages = 1 << order;
         struct page *p = page + 1;
 
+        atomic_set(compound_mapcount_ptr(page), 0);
         for (i = 1; i < nr_pages; i++, p = mem_map_next(p, page, i)) {
                 clear_compound_head(p);
                 set_page_refcounted(p);
@@ -1816,6 +1836,25 @@ static long __vma_reservation_common(struct hstate *h,
 
         if (vma->vm_flags & VM_MAYSHARE)
                 return ret;
+        else if (is_vma_resv_set(vma, HPAGE_RESV_OWNER) && ret >= 0) {
+                /*
+                 * In most cases, reserves always exist for private mappings.
+                 * However, a file associated with mapping could have been
+                 * hole punched or truncated after reserves were consumed.
+                 * As subsequent fault on such a range will not use reserves.
+                 * Subtle - The reserve map for private mappings has the
+                 * opposite meaning than that of shared mappings.  If NO
+                 * entry is in the reserve map, it means a reservation exists.
+                 * If an entry exists in the reserve map, it means the
+                 * reservation has already been consumed.  As a result, the
+                 * return value of this routine is the opposite of the
+                 * value returned from reserve map manipulation routines above.
+                 */
+                if (ret)
+                        return 0;
+                else
+                        return 1;
+        }
         else
                 return ret < 0 ? ret : 0;
 }
@@ -4190,7 +4229,6 @@ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud)
                 if (saddr) {
                         spte = huge_pte_offset(svma->vm_mm, saddr);
                         if (spte) {
-                                mm_inc_nr_pmds(mm);
                                 get_page(virt_to_page(spte));
                                 break;
                         }
@@ -4205,9 +4243,9 @@ pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud)
         if (pud_none(*pud)) {
                 pud_populate(mm, pud,
                                 (pmd_t *)((unsigned long)spte & PAGE_MASK));
+                mm_inc_nr_pmds(mm);
         } else {
                 put_page(virt_to_page(spte));
-                mm_inc_nr_pmds(mm);
         }
         spin_unlock(ptl);
 out:
diff --git a/mm/internal.h b/mm/internal.h
index a37e5b6f9d25..2524ec880e24 100644
--- a/mm/internal.h
+++ b/mm/internal.h
@@ -24,7 +24,8 @@
  */
 #define GFP_RECLAIM_MASK (__GFP_RECLAIM|__GFP_HIGH|__GFP_IO|__GFP_FS|\
                         __GFP_NOWARN|__GFP_REPEAT|__GFP_NOFAIL|\
-                        __GFP_NORETRY|__GFP_MEMALLOC|__GFP_NOMEMALLOC)
+                        __GFP_NORETRY|__GFP_MEMALLOC|__GFP_NOMEMALLOC|\
+                        __GFP_ATOMIC)
 
 /* The GFP flags allowed during early boot */
 #define GFP_BOOT_MASK (__GFP_BITS_MASK & ~(__GFP_RECLAIM|__GFP_IO|__GFP_FS))
diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c
index 18b6a2b8d183..6845f9294696 100644
--- a/mm/kasan/kasan.c
+++ b/mm/kasan/kasan.c
@@ -508,7 +508,7 @@ void kasan_slab_alloc(struct kmem_cache *cache, void *object, gfp_t flags)
         kasan_kmalloc(cache, object, cache->object_size, flags);
 }
 
-void kasan_poison_slab_free(struct kmem_cache *cache, void *object)
+static void kasan_poison_slab_free(struct kmem_cache *cache, void *object)
 {
         unsigned long size = cache->object_size;
         unsigned long rounded_up_size = round_up(size, KASAN_SHADOW_SCALE_SIZE);
@@ -626,7 +626,7 @@ void kasan_krealloc(const void *object, size_t size, gfp_t flags)
                 kasan_kmalloc(page->slab_cache, object, size, flags);
 }
 
-void kasan_kfree(void *ptr)
+void kasan_poison_kfree(void *ptr)
 {
         struct page *page;
 
@@ -636,7 +636,7 @@ void kasan_kfree(void *ptr)
                 kasan_poison_shadow(ptr, PAGE_SIZE << compound_order(page),
                                 KASAN_FREE_PAGE);
         else
-                kasan_slab_free(page->slab_cache, ptr);
+                kasan_poison_slab_free(page->slab_cache, ptr);
 }
 
 void kasan_kfree_large(const void *ptr)
@@ -763,8 +763,8 @@ static int kasan_mem_notifier(struct notifier_block *nb,
 
 static int __init kasan_memhotplug_init(void)
 {
-        pr_err("WARNING: KASAN doesn't support memory hot-add\n");
-        pr_err("Memory hot-add will be disabled\n");
+        pr_info("WARNING: KASAN doesn't support memory hot-add\n");
+        pr_info("Memory hot-add will be disabled\n");
 
         hotplug_memory_notifier(kasan_mem_notifier, 0);
 
diff --git a/mm/kmemleak.c b/mm/kmemleak.c
index e6429926e957..04320d3adbef 100644
--- a/mm/kmemleak.c
+++ b/mm/kmemleak.c
@@ -307,8 +307,10 @@ static void hex_dump_object(struct seq_file *seq,
         len = min_t(size_t, object->size, HEX_MAX_LINES * HEX_ROW_SIZE);
 
         seq_printf(seq, "  hex dump (first %zu bytes):\n", len);
+        kasan_disable_current();
         seq_hex_dump(seq, "    ", DUMP_PREFIX_NONE, HEX_ROW_SIZE,
                      HEX_GROUP_SIZE, ptr, len, HEX_ASCII);
+        kasan_enable_current();
 }
 
 /*
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 58c69c94402a..ac8664db3823 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -1608,7 +1608,7 @@ static void memcg_oom_recover(struct mem_cgroup *memcg)
 
 static void mem_cgroup_oom(struct mem_cgroup *memcg, gfp_t mask, int order)
 {
-        if (!current->memcg_may_oom || current->memcg_in_oom)
+        if (!current->memcg_may_oom)
                 return;
         /*
          * We are in the middle of the charge context here, so we
@@ -4203,7 +4203,7 @@ mem_cgroup_css_alloc(struct cgroup_subsys_state *parent_css)
         return &memcg->css;
 fail:
         mem_cgroup_free(memcg);
-        return NULL;
+        return ERR_PTR(-ENOMEM);
 }
 
 static int
@@ -5544,6 +5544,7 @@ void mem_cgroup_migrate(struct page *oldpage, struct page *newpage)
         struct mem_cgroup *memcg;
         unsigned int nr_pages;
         bool compound;
+        unsigned long flags;
 
         VM_BUG_ON_PAGE(!PageLocked(oldpage), oldpage);
         VM_BUG_ON_PAGE(!PageLocked(newpage), newpage);
@@ -5574,10 +5575,10 @@ void mem_cgroup_migrate(struct page *oldpage, struct page *newpage)
 
         commit_charge(newpage, memcg, false);
 
-        local_irq_disable();
+        local_irq_save(flags);
         mem_cgroup_charge_statistics(memcg, newpage, compound, nr_pages);
         memcg_check_events(memcg, newpage);
-        local_irq_enable();
+        local_irq_restore(flags);
 }
 
 DEFINE_STATIC_KEY_FALSE(memcg_sockets_enabled_key);
diff --git a/mm/memory.c b/mm/memory.c
index 15322b73636b..cd1f29e4897e 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -2877,7 +2877,7 @@ static int __do_fault(struct vm_area_struct *vma, unsigned long address,
  * vm_ops->map_pages.
  */
 void do_set_pte(struct vm_area_struct *vma, unsigned long address,
-                struct page *page, pte_t *pte, bool write, bool anon, bool old)
+                struct page *page, pte_t *pte, bool write, bool anon)
 {
         pte_t entry;
 
@@ -2885,8 +2885,6 @@ void do_set_pte(struct vm_area_struct *vma, unsigned long address,
         entry = mk_pte(page, vma->vm_page_prot);
         if (write)
                 entry = maybe_mkwrite(pte_mkdirty(entry), vma);
-        if (old)
-                entry = pte_mkold(entry);
         if (anon) {
                 inc_mm_counter_fast(vma->vm_mm, MM_ANONPAGES);
                 page_add_new_anon_rmap(page, vma, address, false);
@@ -2900,16 +2898,8 @@ void do_set_pte(struct vm_area_struct *vma, unsigned long address,
         update_mmu_cache(vma, address, pte);
 }
 
-/*
- * If architecture emulates "accessed" or "young" bit without HW support,
- * there is no much gain with fault_around.
- */
 static unsigned long fault_around_bytes __read_mostly =
-#ifndef __HAVE_ARCH_PTEP_SET_ACCESS_FLAGS
-        PAGE_SIZE;
-#else
         rounddown_pow_of_two(65536);
-#endif
 
 #ifdef CONFIG_DEBUG_FS
 static int fault_around_bytes_get(void *data, u64 *val)
@@ -3032,20 +3022,9 @@ static int do_read_fault(struct mm_struct *mm, struct vm_area_struct *vma,
          */
         if (vma->vm_ops->map_pages && fault_around_bytes >> PAGE_SHIFT > 1) {
                 pte = pte_offset_map_lock(mm, pmd, address, &ptl);
-                if (!pte_same(*pte, orig_pte))
-                        goto unlock_out;
                 do_fault_around(vma, address, pte, pgoff, flags);
-                /* Check if the fault is handled by faultaround */
-                if (!pte_same(*pte, orig_pte)) {
-                        /*
-                         * Faultaround produce old pte, but the pte we've
-                         * handler fault for should be young.
-                         */
-                        pte_t entry = pte_mkyoung(*pte);
-                        if (ptep_set_access_flags(vma, address, pte, entry, 0))
-                                update_mmu_cache(vma, address, pte);
+                if (!pte_same(*pte, orig_pte))
                         goto unlock_out;
-                }
                 pte_unmap_unlock(pte, ptl);
         }
 
@@ -3060,7 +3039,7 @@ static int do_read_fault(struct mm_struct *mm, struct vm_area_struct *vma,
                 put_page(fault_page);
                 return ret;
         }
-        do_set_pte(vma, address, fault_page, pte, false, false, false);
+        do_set_pte(vma, address, fault_page, pte, false, false);
         unlock_page(fault_page);
 unlock_out:
         pte_unmap_unlock(pte, ptl);
@@ -3111,7 +3090,7 @@ static int do_cow_fault(struct mm_struct *mm, struct vm_area_struct *vma,
                 }
                 goto uncharge_out;
         }
-        do_set_pte(vma, address, new_page, pte, true, true, false);
+        do_set_pte(vma, address, new_page, pte, true, true);
         mem_cgroup_commit_charge(new_page, memcg, false, false);
         lru_cache_add_active_or_unevictable(new_page, vma);
         pte_unmap_unlock(pte, ptl);
@@ -3164,7 +3143,7 @@ static int do_shared_fault(struct mm_struct *mm, struct vm_area_struct *vma,
                 put_page(fault_page);
                 return ret;
         }
-        do_set_pte(vma, address, fault_page, pte, true, false, false);
+        do_set_pte(vma, address, fault_page, pte, true, false);
         pte_unmap_unlock(pte, ptl);
 
         if (set_page_dirty(fault_page))
diff --git a/mm/mempool.c b/mm/mempool.c
index 9e075f829d0d..8f65464da5de 100644
--- a/mm/mempool.c
+++ b/mm/mempool.c
@@ -104,20 +104,16 @@ static inline void poison_element(mempool_t *pool, void *element)
 
 static void kasan_poison_element(mempool_t *pool, void *element)
 {
-        if (pool->alloc == mempool_alloc_slab)
-                kasan_poison_slab_free(pool->pool_data, element);
-        if (pool->alloc == mempool_kmalloc)
-                kasan_kfree(element);
+        if (pool->alloc == mempool_alloc_slab || pool->alloc == mempool_kmalloc)
+                kasan_poison_kfree(element);
         if (pool->alloc == mempool_alloc_pages)
                 kasan_free_pages(element, (unsigned long)pool->pool_data);
 }
 
 static void kasan_unpoison_element(mempool_t *pool, void *element, gfp_t flags)
 {
-        if (pool->alloc == mempool_alloc_slab)
-                kasan_slab_alloc(pool->pool_data, element, flags);
-        if (pool->alloc == mempool_kmalloc)
-                kasan_krealloc(element, (size_t)pool->pool_data, flags);
+        if (pool->alloc == mempool_alloc_slab || pool->alloc == mempool_kmalloc)
+                kasan_unpoison_slab(element);
         if (pool->alloc == mempool_alloc_pages)
                 kasan_alloc_pages(element, (unsigned long)pool->pool_data);
 }
diff --git a/mm/migrate.c b/mm/migrate.c
index 9baf41c877ff..bd3fdc202e8b 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -431,6 +431,7 @@ int migrate_page_move_mapping(struct address_space *mapping,
 
         return MIGRATEPAGE_SUCCESS;
 }
+EXPORT_SYMBOL(migrate_page_move_mapping);
 
 /*
  * The expected number of remaining references is the same as that
@@ -586,6 +587,7 @@ void migrate_page_copy(struct page *newpage, struct page *page)
 
         mem_cgroup_migrate(page, newpage);
 }
+EXPORT_SYMBOL(migrate_page_copy);
 
 /************************************************************
  *                    Migration functions
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index acbc432d1a52..ddf74487f848 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -474,13 +474,8 @@ static bool __oom_reap_task(struct task_struct *tsk)
         p = find_lock_task_mm(tsk);
         if (!p)
                 goto unlock_oom;
-
         mm = p->mm;
-        if (!atomic_inc_not_zero(&mm->mm_users)) {
-                task_unlock(p);
-                goto unlock_oom;
-        }
-
+        atomic_inc(&mm->mm_users);
         task_unlock(p);
 
         if (!down_read_trylock(&mm->mmap_sem)) {
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index b9956fdee8f5..e2481949494c 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -373,8 +373,9 @@ static void domain_dirty_limits(struct dirty_throttle_control *dtc)
         struct dirty_throttle_control *gdtc = mdtc_gdtc(dtc);
         unsigned long bytes = vm_dirty_bytes;
         unsigned long bg_bytes = dirty_background_bytes;
-        unsigned long ratio = vm_dirty_ratio;
-        unsigned long bg_ratio = dirty_background_ratio;
+        /* convert ratios to per-PAGE_SIZE for higher precision */
+        unsigned long ratio = (vm_dirty_ratio * PAGE_SIZE) / 100;
+        unsigned long bg_ratio = (dirty_background_ratio * PAGE_SIZE) / 100;
         unsigned long thresh;
         unsigned long bg_thresh;
         struct task_struct *tsk;
@@ -386,26 +387,28 @@ static void domain_dirty_limits(struct dirty_throttle_control *dtc)
                 /*
                  * The byte settings can't be applied directly to memcg
                  * domains.  Convert them to ratios by scaling against
-                 * globally available memory.
+                 * globally available memory.  As the ratios are in
+                 * per-PAGE_SIZE, they can be obtained by dividing bytes by
+                 * number of pages.
                  */
                 if (bytes)
-                        ratio = min(DIV_ROUND_UP(bytes, PAGE_SIZE) * 100 /
-                                    global_avail, 100UL);
+                        ratio = min(DIV_ROUND_UP(bytes, global_avail),
+                                    PAGE_SIZE);
                 if (bg_bytes)
-                        bg_ratio = min(DIV_ROUND_UP(bg_bytes, PAGE_SIZE) * 100 /
-                                       global_avail, 100UL);
+                        bg_ratio = min(DIV_ROUND_UP(bg_bytes, global_avail),
+                                       PAGE_SIZE);
                 bytes = bg_bytes = 0;
         }
 
         if (bytes)
                 thresh = DIV_ROUND_UP(bytes, PAGE_SIZE);
         else
-                thresh = (ratio * available_memory) / 100;
+                thresh = (ratio * available_memory) / PAGE_SIZE;
 
         if (bg_bytes)
                 bg_thresh = DIV_ROUND_UP(bg_bytes, PAGE_SIZE);
         else
-                bg_thresh = (bg_ratio * available_memory) / 100;
+                bg_thresh = (bg_ratio * available_memory) / PAGE_SIZE;
 
         if (bg_thresh >= thresh)
                 bg_thresh = thresh / 2;
diff --git a/mm/page_owner.c b/mm/page_owner.c
index c6cda3e36212..fedeba88c9cb 100644
--- a/mm/page_owner.c
+++ b/mm/page_owner.c
@@ -207,13 +207,15 @@ void __dump_page_owner(struct page *page)
                 .nr_entries = page_ext->nr_entries,
                 .entries = &page_ext->trace_entries[0],
         };
-        gfp_t gfp_mask = page_ext->gfp_mask;
-        int mt = gfpflags_to_migratetype(gfp_mask);
+        gfp_t gfp_mask;
+        int mt;
 
         if (unlikely(!page_ext)) {
                 pr_alert("There is not page extension available.\n");
                 return;
         }
+        gfp_mask = page_ext->gfp_mask;
+        mt = gfpflags_to_migratetype(gfp_mask);
 
         if (!test_bit(PAGE_EXT_OWNER, &page_ext->flags)) {
                 pr_alert("page_owner info is not active (free page?)\n");
diff --git a/mm/percpu.c b/mm/percpu.c
index 0c59684f1ff2..9903830aaebb 100644
--- a/mm/percpu.c
+++ b/mm/percpu.c
@@ -112,7 +112,7 @@ struct pcpu_chunk {
         int                     map_used;       /* # of map entries used before the sentry */
         int                     map_alloc;      /* # of map entries allocated */
         int                     *map;           /* allocation map */
-        struct work_struct      map_extend_work;/* async ->map[] extension */
+        struct list_head        map_extend_list;/* on pcpu_map_extend_chunks */
 
         void                    *data;          /* chunk data */
         int                     first_free;     /* no free below this */
@@ -162,10 +162,13 @@ static struct pcpu_chunk *pcpu_reserved_chunk;
 static int pcpu_reserved_chunk_limit;
 
 static DEFINE_SPINLOCK(pcpu_lock);      /* all internal data structures */
-static DEFINE_MUTEX(pcpu_alloc_mutex);  /* chunk create/destroy, [de]pop */
+static DEFINE_MUTEX(pcpu_alloc_mutex);  /* chunk create/destroy, [de]pop, map ext */
 
 static struct list_head *pcpu_slot __read_mostly; /* chunk list slots */
 
+/* chunks which need their map areas extended, protected by pcpu_lock */
+static LIST_HEAD(pcpu_map_extend_chunks);
+
 /*
  * The number of empty populated pages, protected by pcpu_lock.  The
  * reserved chunk doesn't contribute to the count.
@@ -395,13 +398,19 @@ static int pcpu_need_to_extend(struct pcpu_chunk *chunk, bool is_atomic)
 {
         int margin, new_alloc;
 
+        lockdep_assert_held(&pcpu_lock);
+
         if (is_atomic) {
                 margin = 3;
 
                 if (chunk->map_alloc <
-                    chunk->map_used + PCPU_ATOMIC_MAP_MARGIN_LOW &&
-                    pcpu_async_enabled)
-                        schedule_work(&chunk->map_extend_work);
+                    chunk->map_used + PCPU_ATOMIC_MAP_MARGIN_LOW) {
+                        if (list_empty(&chunk->map_extend_list)) {
+                                list_add_tail(&chunk->map_extend_list,
+                                              &pcpu_map_extend_chunks);
+                                pcpu_schedule_balance_work();
+                        }
+                }
         } else {
                 margin = PCPU_ATOMIC_MAP_MARGIN_HIGH;
         }
@@ -435,6 +444,8 @@ static int pcpu_extend_area_map(struct pcpu_chunk *chunk, int new_alloc)
         size_t old_size = 0, new_size = new_alloc * sizeof(new[0]);
         unsigned long flags;
 
+        lockdep_assert_held(&pcpu_alloc_mutex);
+
         new = pcpu_mem_zalloc(new_size);
         if (!new)
                 return -ENOMEM;
@@ -467,20 +478,6 @@ out_unlock:
         return 0;
 }
 
-static void pcpu_map_extend_workfn(struct work_struct *work)
-{
-        struct pcpu_chunk *chunk = container_of(work, struct pcpu_chunk,
-                                                map_extend_work);
-        int new_alloc;
-
-        spin_lock_irq(&pcpu_lock);
-        new_alloc = pcpu_need_to_extend(chunk, false);
-        spin_unlock_irq(&pcpu_lock);
-
-        if (new_alloc)
-                pcpu_extend_area_map(chunk, new_alloc);
-}
-
 /**
  * pcpu_fit_in_area - try to fit the requested allocation in a candidate area
  * @chunk: chunk the candidate area belongs to
@@ -740,7 +737,7 @@ static struct pcpu_chunk *pcpu_alloc_chunk(void)
         chunk->map_used = 1;
 
         INIT_LIST_HEAD(&chunk->list);
-        INIT_WORK(&chunk->map_extend_work, pcpu_map_extend_workfn);
+        INIT_LIST_HEAD(&chunk->map_extend_list);
         chunk->free_size = pcpu_unit_size;
         chunk->contig_hint = pcpu_unit_size;
 
@@ -895,6 +892,9 @@ static void __percpu *pcpu_alloc(size_t size, size_t align, bool reserved,
                 return NULL;
         }
 
+        if (!is_atomic)
+                mutex_lock(&pcpu_alloc_mutex);
+
         spin_lock_irqsave(&pcpu_lock, flags);
 
         /* serve reserved allocations from the reserved chunk if available */
@@ -967,12 +967,9 @@ restart:
         if (is_atomic)
                 goto fail;
 
-        mutex_lock(&pcpu_alloc_mutex);
-
         if (list_empty(&pcpu_slot[pcpu_nr_slots - 1])) {
                 chunk = pcpu_create_chunk();
                 if (!chunk) {
-                        mutex_unlock(&pcpu_alloc_mutex);
                         err = "failed to allocate new chunk";
                         goto fail;
                 }
@@ -983,7 +980,6 @@ restart:
                 spin_lock_irqsave(&pcpu_lock, flags);
         }
 
-        mutex_unlock(&pcpu_alloc_mutex);
         goto restart;
 
 area_found:
@@ -993,8 +989,6 @@ area_found:
         if (!is_atomic) {
                 int page_start, page_end, rs, re;
 
-                mutex_lock(&pcpu_alloc_mutex);
-
                 page_start = PFN_DOWN(off);
                 page_end = PFN_UP(off + size);
 
@@ -1005,7 +999,6 @@ area_found:
 
                         spin_lock_irqsave(&pcpu_lock, flags);
                         if (ret) {
-                                mutex_unlock(&pcpu_alloc_mutex);
                                 pcpu_free_area(chunk, off, &occ_pages);
                                 err = "failed to populate";
                                 goto fail_unlock;
@@ -1045,6 +1038,8 @@ fail:
                 /* see the flag handling in pcpu_blance_workfn() */
                 pcpu_atomic_alloc_failed = true;
                 pcpu_schedule_balance_work();
+        } else {
+                mutex_unlock(&pcpu_alloc_mutex);
         }
         return NULL;
 }
@@ -1129,6 +1124,7 @@ static void pcpu_balance_workfn(struct work_struct *work)
                 if (chunk == list_first_entry(free_head, struct pcpu_chunk, list))
                         continue;
 
+                list_del_init(&chunk->map_extend_list);
                 list_move(&chunk->list, &to_free);
         }
 
@@ -1146,6 +1142,25 @@ static void pcpu_balance_workfn(struct work_struct *work)
                 pcpu_destroy_chunk(chunk);
         }
 
+        /* service chunks which requested async area map extension */
+        do {
+                int new_alloc = 0;
+
+                spin_lock_irq(&pcpu_lock);
+
+                chunk = list_first_entry_or_null(&pcpu_map_extend_chunks,
+                                        struct pcpu_chunk, map_extend_list);
+                if (chunk) {
+                        list_del_init(&chunk->map_extend_list);
+                        new_alloc = pcpu_need_to_extend(chunk, false);
+                }
+
+                spin_unlock_irq(&pcpu_lock);
+
+                if (new_alloc)
+                        pcpu_extend_area_map(chunk, new_alloc);
+        } while (chunk);
+
         /*
          * Ensure there are certain number of free populated pages for
          * atomic allocs.  Fill up from the most packed so that atomic
@@ -1644,7 +1659,7 @@ int __init pcpu_setup_first_chunk(const struct pcpu_alloc_info *ai,
          */
         schunk = memblock_virt_alloc(pcpu_chunk_struct_size, 0);
         INIT_LIST_HEAD(&schunk->list);
-        INIT_WORK(&schunk->map_extend_work, pcpu_map_extend_workfn);
+        INIT_LIST_HEAD(&schunk->map_extend_list);
         schunk->base_addr = base_addr;
         schunk->map = smap;
         schunk->map_alloc = ARRAY_SIZE(smap);
@@ -1673,7 +1688,7 @@ int __init pcpu_setup_first_chunk(const struct pcpu_alloc_info *ai,
         if (dyn_size) {
                 dchunk = memblock_virt_alloc(pcpu_chunk_struct_size, 0);
                 INIT_LIST_HEAD(&dchunk->list);
-                INIT_WORK(&dchunk->map_extend_work, pcpu_map_extend_workfn);
+                INIT_LIST_HEAD(&dchunk->map_extend_list);
                 dchunk->base_addr = base_addr;
                 dchunk->map = dmap;
                 dchunk->map_alloc = ARRAY_SIZE(dmap);
diff --git a/mm/shmem.c b/mm/shmem.c
index a36144909b28..24463b67b6ef 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -2227,7 +2227,7 @@ static long shmem_fallocate(struct file *file, int mode, loff_t offset,
                         /* Remove the !PageUptodate pages we added */
                         shmem_undo_range(inode,
                                 (loff_t)start << PAGE_SHIFT,
-                                (loff_t)index << PAGE_SHIFT, true);
+                                ((loff_t)index << PAGE_SHIFT) - 1, true);
                         goto undone;
                 }
 
diff --git a/mm/swap.c b/mm/swap.c
index 95916142fc46..90530ff8ed16 100644
--- a/mm/swap.c
+++ b/mm/swap.c
@@ -242,7 +242,7 @@ void rotate_reclaimable_page(struct page *page)
                 get_page(page);
                 local_irq_save(flags);
                 pvec = this_cpu_ptr(&lru_rotate_pvecs);
-                if (!pagevec_add(pvec, page))
+                if (!pagevec_add(pvec, page) || PageCompound(page))
                         pagevec_move_tail(pvec);
                 local_irq_restore(flags);
         }
@@ -296,7 +296,7 @@ void activate_page(struct page *page)
                 struct pagevec *pvec = &get_cpu_var(activate_page_pvecs);
 
                 get_page(page);
-                if (!pagevec_add(pvec, page))
+                if (!pagevec_add(pvec, page) || PageCompound(page))
                         pagevec_lru_move_fn(pvec, __activate_page, NULL);
                 put_cpu_var(activate_page_pvecs);
         }
@@ -391,9 +391,8 @@ static void __lru_cache_add(struct page *page)
         struct pagevec *pvec = &get_cpu_var(lru_add_pvec);
 
         get_page(page);
-        if (!pagevec_space(pvec))
+        if (!pagevec_add(pvec, page) || PageCompound(page))
                 __pagevec_lru_add(pvec);
-        pagevec_add(pvec, page);
         put_cpu_var(lru_add_pvec);
 }
 
@@ -628,7 +627,7 @@ void deactivate_file_page(struct page *page)
         if (likely(get_page_unless_zero(page))) {
                 struct pagevec *pvec = &get_cpu_var(lru_deactivate_file_pvecs);
 
-                if (!pagevec_add(pvec, page))
+                if (!pagevec_add(pvec, page) || PageCompound(page))
                         pagevec_lru_move_fn(pvec, lru_deactivate_file_fn, NULL);
                 put_cpu_var(lru_deactivate_file_pvecs);
         }
@@ -648,7 +647,7 @@ void deactivate_page(struct page *page)
                 struct pagevec *pvec = &get_cpu_var(lru_deactivate_pvecs);
 
                 get_page(page);
-                if (!pagevec_add(pvec, page))
+                if (!pagevec_add(pvec, page) || PageCompound(page))
                         pagevec_lru_move_fn(pvec, lru_deactivate_fn, NULL);
                 put_cpu_var(lru_deactivate_pvecs);
         }
@@ -667,6 +666,24 @@ static void lru_add_drain_per_cpu(struct work_struct *dummy)
 
 static DEFINE_PER_CPU(struct work_struct, lru_add_drain_work);
 
+/*
+ * lru_add_drain_wq is used to do lru_add_drain_all() from a WQ_MEM_RECLAIM
+ * workqueue, aiding in getting memory freed.
+ */
+static struct workqueue_struct *lru_add_drain_wq;
+
+static int __init lru_init(void)
+{
+        lru_add_drain_wq = alloc_workqueue("lru-add-drain", WQ_MEM_RECLAIM, 0);
+
+        if (WARN(!lru_add_drain_wq,
+                "Failed to create workqueue lru_add_drain_wq"))
+                return -ENOMEM;
+
+        return 0;
+}
+early_initcall(lru_init);
+
 void lru_add_drain_all(void)
 {
         static DEFINE_MUTEX(lock);
@@ -686,7 +703,7 @@ void lru_add_drain_all(void)
                     pagevec_count(&per_cpu(lru_deactivate_pvecs, cpu)) ||
                     need_activate_page_drain(cpu)) {
                         INIT_WORK(work, lru_add_drain_per_cpu);
-                        schedule_work_on(cpu, work);
+                        queue_work_on(cpu, lru_add_drain_wq, work);
                         cpumask_set_cpu(cpu, &has_work);
                 }
         }
diff --git a/mm/swap_state.c b/mm/swap_state.c
index 0d457e7db8d6..c99463ac02fb 100644
--- a/mm/swap_state.c
+++ b/mm/swap_state.c
@@ -252,7 +252,10 @@ static inline void free_swap_cache(struct page *page)
 void free_page_and_swap_cache(struct page *page)
 {
         free_swap_cache(page);
-        put_page(page);
+        if (is_huge_zero_page(page))
+                put_huge_zero_page();
+        else
+                put_page(page);
 }
 
 /*
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index fbd0acf80b13..2fdebabbfacd 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -976,7 +976,8 @@ static int ax25_release(struct socket *sock)
                         release_sock(sk);
                         ax25_disconnect(ax25, 0);
                         lock_sock(sk);
-                        ax25_destroy_socket(ax25);
+                        if (!sock_flag(ax25->sk, SOCK_DESTROY))
+                                ax25_destroy_socket(ax25);
                         break;
 
                 case AX25_STATE_3:
diff --git a/net/ax25/ax25_ds_timer.c b/net/ax25/ax25_ds_timer.c
index 951cd57bb07d..5237dff6941d 100644
--- a/net/ax25/ax25_ds_timer.c
+++ b/net/ax25/ax25_ds_timer.c
@@ -102,6 +102,7 @@ void ax25_ds_heartbeat_expiry(ax25_cb *ax25)
         switch (ax25->state) {
 
         case AX25_STATE_0:
+        case AX25_STATE_2:
                 /* Magic here: If we listen() and a new link dies before it
                    is accepted() it isn't 'dead' so doesn't get removed. */
                 if (!sk || sock_flag(sk, SOCK_DESTROY) ||
@@ -111,6 +112,7 @@ void ax25_ds_heartbeat_expiry(ax25_cb *ax25)
                                 sock_hold(sk);
                                 ax25_destroy_socket(ax25);
                                 bh_unlock_sock(sk);
+                                /* Ungrab socket and destroy it */
                                 sock_put(sk);
                         } else
                                 ax25_destroy_socket(ax25);
@@ -213,7 +215,8 @@ void ax25_ds_t1_timeout(ax25_cb *ax25)
         case AX25_STATE_2:
                 if (ax25->n2count == ax25->n2) {
                         ax25_send_control(ax25, AX25_DISC, AX25_POLLON, AX25_COMMAND);
-                        ax25_disconnect(ax25, ETIMEDOUT);
+                        if (!sock_flag(ax25->sk, SOCK_DESTROY))
+                                ax25_disconnect(ax25, ETIMEDOUT);
                         return;
                 } else {
                         ax25->n2count++;
diff --git a/net/ax25/ax25_std_timer.c b/net/ax25/ax25_std_timer.c
index 004467c9e6e1..2c0d6ef66f9d 100644
--- a/net/ax25/ax25_std_timer.c
+++ b/net/ax25/ax25_std_timer.c
@@ -38,6 +38,7 @@ void ax25_std_heartbeat_expiry(ax25_cb *ax25)
 
         switch (ax25->state) {
         case AX25_STATE_0:
+        case AX25_STATE_2:
                 /* Magic here: If we listen() and a new link dies before it
                    is accepted() it isn't 'dead' so doesn't get removed. */
                 if (!sk || sock_flag(sk, SOCK_DESTROY) ||
@@ -47,6 +48,7 @@ void ax25_std_heartbeat_expiry(ax25_cb *ax25)
                                 sock_hold(sk);
                                 ax25_destroy_socket(ax25);
                                 bh_unlock_sock(sk);
+                                /* Ungrab socket and destroy it */
                                 sock_put(sk);
                         } else
                                 ax25_destroy_socket(ax25);
@@ -144,7 +146,8 @@ void ax25_std_t1timer_expiry(ax25_cb *ax25)
         case AX25_STATE_2:
                 if (ax25->n2count == ax25->n2) {
                         ax25_send_control(ax25, AX25_DISC, AX25_POLLON, AX25_COMMAND);
-                        ax25_disconnect(ax25, ETIMEDOUT);
+                        if (!sock_flag(ax25->sk, SOCK_DESTROY))
+                                ax25_disconnect(ax25, ETIMEDOUT);
                         return;
                 } else {
                         ax25->n2count++;
diff --git a/net/ax25/ax25_subr.c b/net/ax25/ax25_subr.c
index 3b78e8473a01..655a7d4c96e1 100644
--- a/net/ax25/ax25_subr.c
+++ b/net/ax25/ax25_subr.c
@@ -264,7 +264,8 @@ void ax25_disconnect(ax25_cb *ax25, int reason)
 {
         ax25_clear_queues(ax25);
 
-        ax25_stop_heartbeat(ax25);
+        if (!sock_flag(ax25->sk, SOCK_DESTROY))
+                ax25_stop_heartbeat(ax25);
         ax25_stop_t1timer(ax25);
         ax25_stop_t2timer(ax25);
         ax25_stop_t3timer(ax25);
diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index e3857ed4057f..6c2901a86230 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -374,6 +374,7 @@ int batadv_recv_icmp_packet(struct sk_buff *skb,
                 if (skb_cow(skb, ETH_HLEN) < 0)
                         goto out;
 
+                ethhdr = eth_hdr(skb);
                 icmph = (struct batadv_icmp_header *)skb->data;
                 icmp_packet_rr = (struct batadv_icmp_packet_rr *)icmph;
                 if (icmp_packet_rr->rr_cur >= BATADV_RR_LEN)
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index 343d2c904399..287a3879ed7e 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -1033,7 +1033,9 @@ void batadv_softif_destroy_sysfs(struct net_device *soft_iface)
 static void batadv_softif_destroy_netlink(struct net_device *soft_iface,
                                           struct list_head *head)
 {
+        struct batadv_priv *bat_priv = netdev_priv(soft_iface);
         struct batadv_hard_iface *hard_iface;
+        struct batadv_softif_vlan *vlan;
 
         list_for_each_entry(hard_iface, &batadv_hardif_list, list) {
                 if (hard_iface->soft_iface == soft_iface)
@@ -1041,6 +1043,13 @@ static void batadv_softif_destroy_netlink(struct net_device *soft_iface,
                                                         BATADV_IF_CLEANUP_KEEP);
         }
 
+        /* destroy the "untagged" VLAN */
+        vlan = batadv_softif_vlan_get(bat_priv, BATADV_NO_FLAGS);
+        if (vlan) {
+                batadv_softif_destroy_vlan(bat_priv, vlan);
+                batadv_softif_vlan_put(vlan);
+        }
+
         batadv_sysfs_del_meshif(soft_iface);
         unregister_netdevice_queue(soft_iface, head);
 }
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index feaf492b01ca..57ec87f37050 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -650,8 +650,10 @@ bool batadv_tt_local_add(struct net_device *soft_iface, const u8 *addr,
 
         /* increase the refcounter of the related vlan */
         vlan = batadv_softif_vlan_get(bat_priv, vid);
-        if (WARN(!vlan, "adding TT local entry %pM to non-existent VLAN %d",
-                 addr, BATADV_PRINT_VID(vid))) {
+        if (!vlan) {
+                net_ratelimited_function(batadv_info, soft_iface,
+                                         "adding TT local entry %pM to non-existent VLAN %d\n",
+                                         addr, BATADV_PRINT_VID(vid));
                 kfree(tt_local);
                 tt_local = NULL;
                 goto out;
@@ -691,7 +693,6 @@ bool batadv_tt_local_add(struct net_device *soft_iface, const u8 *addr,
         if (unlikely(hash_added != 0)) {
                 /* remove the reference for the hash */
                 batadv_tt_local_entry_put(tt_local);
-                batadv_softif_vlan_put(vlan);
                 goto out;
         }
 
@@ -2269,6 +2270,29 @@ static u32 batadv_tt_local_crc(struct batadv_priv *bat_priv,
         return crc;
 }
 
+/**
+ * batadv_tt_req_node_release - free tt_req node entry
+ * @ref: kref pointer of the tt req_node entry
+ */
+static void batadv_tt_req_node_release(struct kref *ref)
+{
+        struct batadv_tt_req_node *tt_req_node;
+
+        tt_req_node = container_of(ref, struct batadv_tt_req_node, refcount);
+
+        kfree(tt_req_node);
+}
+
+/**
+ * batadv_tt_req_node_put - decrement the tt_req_node refcounter and
+ *  possibly release it
+ * @tt_req_node: tt_req_node to be free'd
+ */
+static void batadv_tt_req_node_put(struct batadv_tt_req_node *tt_req_node)
+{
+        kref_put(&tt_req_node->refcount, batadv_tt_req_node_release);
+}
+
 static void batadv_tt_req_list_free(struct batadv_priv *bat_priv)
 {
         struct batadv_tt_req_node *node;
@@ -2278,7 +2302,7 @@ static void batadv_tt_req_list_free(struct batadv_priv *bat_priv)
 
         hlist_for_each_entry_safe(node, safe, &bat_priv->tt.req_list, list) {
                 hlist_del_init(&node->list);
-                kfree(node);
+                batadv_tt_req_node_put(node);
         }
 
         spin_unlock_bh(&bat_priv->tt.req_list_lock);
@@ -2315,7 +2339,7 @@ static void batadv_tt_req_purge(struct batadv_priv *bat_priv)
                 if (batadv_has_timed_out(node->issued_at,
                                          BATADV_TT_REQUEST_TIMEOUT)) {
                         hlist_del_init(&node->list);
-                        kfree(node);
+                        batadv_tt_req_node_put(node);
                 }
         }
         spin_unlock_bh(&bat_priv->tt.req_list_lock);
@@ -2347,9 +2371,11 @@ batadv_tt_req_node_new(struct batadv_priv *bat_priv,
         if (!tt_req_node)
                 goto unlock;
 
+        kref_init(&tt_req_node->refcount);
         ether_addr_copy(tt_req_node->addr, orig_node->orig);
         tt_req_node->issued_at = jiffies;
 
+        kref_get(&tt_req_node->refcount);
         hlist_add_head(&tt_req_node->list, &bat_priv->tt.req_list);
 unlock:
         spin_unlock_bh(&bat_priv->tt.req_list_lock);
@@ -2613,13 +2639,19 @@ static bool batadv_send_tt_request(struct batadv_priv *bat_priv,
 out:
         if (primary_if)
                 batadv_hardif_put(primary_if);
+
         if (ret && tt_req_node) {
                 spin_lock_bh(&bat_priv->tt.req_list_lock);
-                /* hlist_del_init() verifies tt_req_node still is in the list */
-                hlist_del_init(&tt_req_node->list);
+                if (!hlist_unhashed(&tt_req_node->list)) {
+                        hlist_del_init(&tt_req_node->list);
+                        batadv_tt_req_node_put(tt_req_node);
+                }
                 spin_unlock_bh(&bat_priv->tt.req_list_lock);
-                kfree(tt_req_node);
         }
+
+        if (tt_req_node)
+                batadv_tt_req_node_put(tt_req_node);
+
         kfree(tvlv_tt_data);
         return ret;
 }
@@ -3055,7 +3087,7 @@ static void batadv_handle_tt_response(struct batadv_priv *bat_priv,
                 if (!batadv_compare_eth(node->addr, resp_src))
                         continue;
                 hlist_del_init(&node->list);
-                kfree(node);
+                batadv_tt_req_node_put(node);
         }
 
         spin_unlock_bh(&bat_priv->tt.req_list_lock);
diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
index 6a577f4f8ba7..ba846b078af8 100644
--- a/net/batman-adv/types.h
+++ b/net/batman-adv/types.h
@@ -1137,11 +1137,13 @@ struct batadv_tt_change_node {
  * struct batadv_tt_req_node - data to keep track of the tt requests in flight
  * @addr: mac address address of the originator this request was sent to
  * @issued_at: timestamp used for purging stale tt requests
+ * @refcount: number of contexts the object is used by
  * @list: list node for batadv_priv_tt::req_list
  */
 struct batadv_tt_req_node {
         u8 addr[ETH_ALEN];
         unsigned long issued_at;
+        struct kref refcount;
         struct hlist_node list;
 };
 
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index dcea4f4c62b3..c18080ad4085 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -279,6 +279,8 @@ void br_fdb_change_mac_address(struct net_bridge *br, const u8 *newaddr)
          * change from under us.
          */
         list_for_each_entry(v, &vg->vlan_list, vlist) {
+                if (!br_vlan_should_use(v))
+                        continue;
                 f = __br_fdb_get(br, br->dev->dev_addr, v->vid);
                 if (f && f->is_local && !f->dst)
                         fdb_delete_local(br, NULL, f);
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index 160797722228..43d2cd862bc2 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -213,8 +213,7 @@ drop:
 }
 EXPORT_SYMBOL_GPL(br_handle_frame_finish);
 
-/* note: already called with rcu_read_lock */
-static int br_handle_local_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
+static void __br_handle_local_finish(struct sk_buff *skb)
 {
         struct net_bridge_port *p = br_port_get_rcu(skb->dev);
         u16 vid = 0;
@@ -222,6 +221,14 @@ static int br_handle_local_finish(struct net *net, struct sock *sk, struct sk_bu
         /* check if vlan is allowed, to avoid spoofing */
         if (p->flags & BR_LEARNING && br_should_learn(p, skb, &vid))
                 br_fdb_update(p->br, p, eth_hdr(skb)->h_source, vid, false);
+}
+
+/* note: already called with rcu_read_lock */
+static int br_handle_local_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
+{
+        struct net_bridge_port *p = br_port_get_rcu(skb->dev);
+
+        __br_handle_local_finish(skb);
 
         BR_INPUT_SKB_CB(skb)->brdev = p->br->dev;
         br_pass_frame_up(skb);
@@ -274,7 +281,9 @@ rx_handler_result_t br_handle_frame(struct sk_buff **pskb)
                         if (p->br->stp_enabled == BR_NO_STP ||
                             fwd_mask & (1u << dest[5]))
                                 goto forward;
-                        break;
+                        *pskb = skb;
+                        __br_handle_local_finish(skb);
+                        return RX_HANDLER_PASS;
 
                 case 0x01:      /* IEEE MAC (Pause) */
                         goto drop;
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 6852f3c7009c..43844144c9c4 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -464,8 +464,11 @@ static struct sk_buff *br_ip6_multicast_alloc_query(struct net_bridge *br,
         if (ipv6_dev_get_saddr(dev_net(br->dev), br->dev, &ip6h->daddr, 0,
                                &ip6h->saddr)) {
                 kfree_skb(skb);
+                br->has_ipv6_addr = 0;
                 return NULL;
         }
+
+        br->has_ipv6_addr = 1;
         ipv6_eth_mc_map(&ip6h->daddr, eth->h_dest);
 
         hopopt = (u8 *)(ip6h + 1);
@@ -1745,6 +1748,7 @@ void br_multicast_init(struct net_bridge *br)
         br->ip6_other_query.delay_time = 0;
         br->ip6_querier.port = NULL;
 #endif
+        br->has_ipv6_addr = 1;
 
         spin_lock_init(&br->multicast_lock);
         setup_timer(&br->multicast_router_timer,
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index a5343c7232bf..85e89f693589 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -1273,7 +1273,7 @@ static int br_fill_linkxstats(struct sk_buff *skb, const struct net_device *dev,
                 struct bridge_vlan_xstats vxi;
                 struct br_vlan_stats stats;
 
-                if (vl_idx++ < *prividx)
+                if (++vl_idx < *prividx)
                         continue;
                 memset(&vxi, 0, sizeof(vxi));
                 vxi.vid = v->vid;
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index c7fb5d7a7218..52edecf3c294 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -314,6 +314,7 @@ struct net_bridge
         u8                              multicast_disabled:1;
         u8                              multicast_querier:1;
         u8                              multicast_query_use_ifaddr:1;
+        u8                              has_ipv6_addr:1;
 
         u32                             hash_elasticity;
         u32                             hash_max;
@@ -588,10 +589,22 @@ static inline bool br_multicast_is_router(struct net_bridge *br)
 
 static inline bool
 __br_multicast_querier_exists(struct net_bridge *br,
-                              struct bridge_mcast_other_query *querier)
+                                struct bridge_mcast_other_query *querier,
+                                const bool is_ipv6)
 {
+        bool own_querier_enabled;
+
+        if (br->multicast_querier) {
+                if (is_ipv6 && !br->has_ipv6_addr)
+                        own_querier_enabled = false;
+                else
+                        own_querier_enabled = true;
+        } else {
+                own_querier_enabled = false;
+        }
+
         return time_is_before_jiffies(querier->delay_time) &&
-               (br->multicast_querier || timer_pending(&querier->timer));
+               (own_querier_enabled || timer_pending(&querier->timer));
 }
 
 static inline bool br_multicast_querier_exists(struct net_bridge *br,
@@ -599,10 +612,12 @@ static inline bool br_multicast_querier_exists(struct net_bridge *br,
 {
         switch (eth->h_proto) {
         case (htons(ETH_P_IP)):
-                return __br_multicast_querier_exists(br, &br->ip4_other_query);
+                return __br_multicast_querier_exists(br,
+                        &br->ip4_other_query, false);
 #if IS_ENABLED(CONFIG_IPV6)
         case (htons(ETH_P_IPV6)):
-                return __br_multicast_querier_exists(br, &br->ip6_other_query);
+                return __br_multicast_querier_exists(br,
+                        &br->ip6_other_query, true);
 #endif
         default:
                 return false;
diff --git a/net/compat.c b/net/compat.c
index 5cfd26a0006f..1cd2ec046164 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -309,8 +309,8 @@ void scm_detach_fds_compat(struct msghdr *kmsg, struct scm_cookie *scm)
         __scm_destroy(scm);
 }
 
-static int do_set_attach_filter(struct socket *sock, int level, int optname,
-                                char __user *optval, unsigned int optlen)
+/* allocate a 64-bit sock_fprog on the user stack for duration of syscall. */
+struct sock_fprog __user *get_compat_bpf_fprog(char __user *optval)
 {
         struct compat_sock_fprog __user *fprog32 = (struct compat_sock_fprog __user *)optval;
         struct sock_fprog __user *kfprog = compat_alloc_user_space(sizeof(struct sock_fprog));
@@ -323,6 +323,19 @@ static int do_set_attach_filter(struct socket *sock, int level, int optname,
             __get_user(ptr, &fprog32->filter) ||
             __put_user(len, &kfprog->len) ||
             __put_user(compat_ptr(ptr), &kfprog->filter))
+                return NULL;
+
+        return kfprog;
+}
+EXPORT_SYMBOL_GPL(get_compat_bpf_fprog);
+
+static int do_set_attach_filter(struct socket *sock, int level, int optname,
+                                char __user *optval, unsigned int optlen)
+{
+        struct sock_fprog __user *kfprog;
+
+        kfprog = get_compat_bpf_fprog(optval);
+        if (!kfprog)
                 return -EFAULT;
 
         return sock_setsockopt(sock, level, optname, (char __user *)kfprog,
@@ -354,7 +367,8 @@ static int do_set_sock_timeout(struct socket *sock, int level,
 static int compat_sock_setsockopt(struct socket *sock, int level, int optname,
                                 char __user *optval, unsigned int optlen)
 {
-        if (optname == SO_ATTACH_FILTER)
+        if (optname == SO_ATTACH_FILTER ||
+            optname == SO_ATTACH_REUSEPORT_CBPF)
                 return do_set_attach_filter(sock, level, optname,
                                             optval, optlen);
         if (optname == SO_RCVTIMEO || optname == SO_SNDTIMEO)
diff --git a/net/core/filter.c b/net/core/filter.c
index 68adb5f52110..c4b330c85c02 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2085,7 +2085,8 @@ static bool __is_valid_access(int off, int size, enum bpf_access_type type)
 }
 
 static bool sk_filter_is_valid_access(int off, int size,
-                                      enum bpf_access_type type)
+                                      enum bpf_access_type type,
+                                      enum bpf_reg_type *reg_type)
 {
         switch (off) {
         case offsetof(struct __sk_buff, tc_classid):
@@ -2108,7 +2109,8 @@ static bool sk_filter_is_valid_access(int off, int size,
 }
 
 static bool tc_cls_act_is_valid_access(int off, int size,
-                                       enum bpf_access_type type)
+                                       enum bpf_access_type type,
+                                       enum bpf_reg_type *reg_type)
 {
         if (type == BPF_WRITE) {
                 switch (off) {
@@ -2123,6 +2125,16 @@ static bool tc_cls_act_is_valid_access(int off, int size,
                         return false;
                 }
         }
+
+        switch (off) {
+        case offsetof(struct __sk_buff, data):
+                *reg_type = PTR_TO_PACKET;
+                break;
+        case offsetof(struct __sk_buff, data_end):
+                *reg_type = PTR_TO_PACKET_END;
+                break;
+        }
+
         return __is_valid_access(off, size, type);
 }
 
diff --git a/net/core/gen_stats.c b/net/core/gen_stats.c
index f96ee8b9478d..be873e4e3125 100644
--- a/net/core/gen_stats.c
+++ b/net/core/gen_stats.c
@@ -47,6 +47,7 @@ nla_put_failure:
  * @xstats_type: TLV type for backward compatibility xstats TLV
  * @lock: statistics lock
  * @d: dumping handle
+ * @padattr: padding attribute
  *
  * Initializes the dumping handle, grabs the statistic lock and appends
  * an empty TLV header to the socket buffer for use a container for all
@@ -87,6 +88,7 @@ EXPORT_SYMBOL(gnet_stats_start_copy_compat);
  * @type: TLV type for top level statistic TLV
  * @lock: statistics lock
  * @d: dumping handle
+ * @padattr: padding attribute
  *
  * Initializes the dumping handle, grabs the statistic lock and appends
  * an empty TLV header to the socket buffer for use a container for all
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 29dd8cc22bbf..510cd62fcb99 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -2469,13 +2469,17 @@ int neigh_xmit(int index, struct net_device *dev,
                 tbl = neigh_tables[index];
                 if (!tbl)
                         goto out;
+                rcu_read_lock_bh();
                 neigh = __neigh_lookup_noref(tbl, addr, dev);
                 if (!neigh)
                         neigh = __neigh_create(tbl, addr, dev, false);
                 err = PTR_ERR(neigh);
-                if (IS_ERR(neigh))
+                if (IS_ERR(neigh)) {
+                        rcu_read_unlock_bh();
                         goto out_kfree_skb;
+                }
                 err = neigh->output(neigh, skb);
+                rcu_read_unlock_bh();
         }
         else if (index == NEIGH_LINK_TABLE) {
                 err = dev_hard_header(skb, dev, ntohs(skb->protocol),
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index 2b3f76fe65f4..7a0b616557ab 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -24,6 +24,7 @@
 #include <linux/jiffies.h>
 #include <linux/pm_runtime.h>
 #include <linux/of.h>
+#include <linux/of_net.h>
 
 #include "net-sysfs.h"
 
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 477937465a20..d95631d09248 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -23,6 +23,11 @@ struct esp_skb_cb {
         void *tmp;
 };
 
+struct esp_output_extra {
+        __be32 seqhi;
+        u32 esphoff;
+};
+
 #define ESP_SKB_CB(__skb) ((struct esp_skb_cb *)&((__skb)->cb[0]))
 
 static u32 esp4_get_mtu(struct xfrm_state *x, int mtu);
@@ -35,11 +40,11 @@ static u32 esp4_get_mtu(struct xfrm_state *x, int mtu);
  *
  * TODO: Use spare space in skb for this where possible.
  */
-static void *esp_alloc_tmp(struct crypto_aead *aead, int nfrags, int seqhilen)
+static void *esp_alloc_tmp(struct crypto_aead *aead, int nfrags, int extralen)
 {
         unsigned int len;
 
-        len = seqhilen;
+        len = extralen;
 
         len += crypto_aead_ivsize(aead);
 
@@ -57,15 +62,16 @@ static void *esp_alloc_tmp(struct crypto_aead *aead, int nfrags, int seqhilen)
         return kmalloc(len, GFP_ATOMIC);
 }
 
-static inline __be32 *esp_tmp_seqhi(void *tmp)
+static inline void *esp_tmp_extra(void *tmp)
 {
-        return PTR_ALIGN((__be32 *)tmp, __alignof__(__be32));
+        return PTR_ALIGN(tmp, __alignof__(struct esp_output_extra));
 }
-static inline u8 *esp_tmp_iv(struct crypto_aead *aead, void *tmp, int seqhilen)
+
+static inline u8 *esp_tmp_iv(struct crypto_aead *aead, void *tmp, int extralen)
 {
         return crypto_aead_ivsize(aead) ?
-               PTR_ALIGN((u8 *)tmp + seqhilen,
-                         crypto_aead_alignmask(aead) + 1) : tmp + seqhilen;
+               PTR_ALIGN((u8 *)tmp + extralen,
+                         crypto_aead_alignmask(aead) + 1) : tmp + extralen;
 }
 
 static inline struct aead_request *esp_tmp_req(struct crypto_aead *aead, u8 *iv)
@@ -99,7 +105,7 @@ static void esp_restore_header(struct sk_buff *skb, unsigned int offset)
 {
         struct ip_esp_hdr *esph = (void *)(skb->data + offset);
         void *tmp = ESP_SKB_CB(skb)->tmp;
-        __be32 *seqhi = esp_tmp_seqhi(tmp);
+        __be32 *seqhi = esp_tmp_extra(tmp);
 
         esph->seq_no = esph->spi;
         esph->spi = *seqhi;
@@ -107,7 +113,11 @@ static void esp_restore_header(struct sk_buff *skb, unsigned int offset)
 
 static void esp_output_restore_header(struct sk_buff *skb)
 {
-        esp_restore_header(skb, skb_transport_offset(skb) - sizeof(__be32));
+        void *tmp = ESP_SKB_CB(skb)->tmp;
+        struct esp_output_extra *extra = esp_tmp_extra(tmp);
+
+        esp_restore_header(skb, skb_transport_offset(skb) + extra->esphoff -
+                                sizeof(__be32));
 }
 
 static void esp_output_done_esn(struct crypto_async_request *base, int err)
@@ -121,6 +131,7 @@ static void esp_output_done_esn(struct crypto_async_request *base, int err)
 static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
 {
         int err;
+        struct esp_output_extra *extra;
         struct ip_esp_hdr *esph;
         struct crypto_aead *aead;
         struct aead_request *req;
@@ -137,8 +148,7 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
         int tfclen;
         int nfrags;
         int assoclen;
-        int seqhilen;
-        __be32 *seqhi;
+        int extralen;
         __be64 seqno;
 
         /* skb is pure payload to encrypt */
@@ -166,21 +176,21 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
         nfrags = err;
 
         assoclen = sizeof(*esph);
-        seqhilen = 0;
+        extralen = 0;
 
         if (x->props.flags & XFRM_STATE_ESN) {
-                seqhilen += sizeof(__be32);
-                assoclen += seqhilen;
+                extralen += sizeof(*extra);
+                assoclen += sizeof(__be32);
         }
 
-        tmp = esp_alloc_tmp(aead, nfrags, seqhilen);
+        tmp = esp_alloc_tmp(aead, nfrags, extralen);
         if (!tmp) {
                 err = -ENOMEM;
                 goto error;
         }
 
-        seqhi = esp_tmp_seqhi(tmp);
-        iv = esp_tmp_iv(aead, tmp, seqhilen);
+        extra = esp_tmp_extra(tmp);
+        iv = esp_tmp_iv(aead, tmp, extralen);
         req = esp_tmp_req(aead, iv);
         sg = esp_req_sg(aead, req);
 
@@ -247,8 +257,10 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
          * encryption.
          */
         if ((x->props.flags & XFRM_STATE_ESN)) {
-                esph = (void *)(skb_transport_header(skb) - sizeof(__be32));
-                *seqhi = esph->spi;
+                extra->esphoff = (unsigned char *)esph -
+                                 skb_transport_header(skb);
+                esph = (struct ip_esp_hdr *)((unsigned char *)esph - 4);
+                extra->seqhi = esph->spi;
                 esph->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output.hi);
                 aead_request_set_callback(req, 0, esp_output_done_esn, skb);
         }
@@ -445,7 +457,7 @@ static int esp_input(struct xfrm_state *x, struct sk_buff *skb)
                 goto out;
 
         ESP_SKB_CB(skb)->tmp = tmp;
-        seqhi = esp_tmp_seqhi(tmp);
+        seqhi = esp_tmp_extra(tmp);
         iv = esp_tmp_iv(aead, tmp, seqhilen);
         req = esp_tmp_req(aead, iv);
         sg = esp_req_sg(aead, req);
diff --git a/net/ipv4/gre_demux.c b/net/ipv4/gre_demux.c
index 4c39f4fd332a..de1d119a4497 100644
--- a/net/ipv4/gre_demux.c
+++ b/net/ipv4/gre_demux.c
@@ -62,26 +62,26 @@ EXPORT_SYMBOL_GPL(gre_del_protocol);
 
 /* Fills in tpi and returns header length to be pulled. */
 int gre_parse_header(struct sk_buff *skb, struct tnl_ptk_info *tpi,
-                     bool *csum_err, __be16 proto)
+                     bool *csum_err, __be16 proto, int nhs)
 {
         const struct gre_base_hdr *greh;
         __be32 *options;
         int hdr_len;
 
-        if (unlikely(!pskb_may_pull(skb, sizeof(struct gre_base_hdr))))
+        if (unlikely(!pskb_may_pull(skb, nhs + sizeof(struct gre_base_hdr))))
                 return -EINVAL;
 
-        greh = (struct gre_base_hdr *)skb_transport_header(skb);
+        greh = (struct gre_base_hdr *)(skb->data + nhs);
         if (unlikely(greh->flags & (GRE_VERSION | GRE_ROUTING)))
                 return -EINVAL;
 
         tpi->flags = gre_flags_to_tnl_flags(greh->flags);
         hdr_len = gre_calc_hlen(tpi->flags);
 
-        if (!pskb_may_pull(skb, hdr_len))
+        if (!pskb_may_pull(skb, nhs + hdr_len))
                 return -EINVAL;
 
-        greh = (struct gre_base_hdr *)skb_transport_header(skb);
+        greh = (struct gre_base_hdr *)(skb->data + nhs);
         tpi->proto = greh->protocol;
 
         options = (__be32 *)(greh + 1);
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 4d2025f7ec57..1d000af7f561 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -49,12 +49,6 @@
 #include <net/gre.h>
 #include <net/dst_metadata.h>
 
-#if IS_ENABLED(CONFIG_IPV6)
-#include <net/ipv6.h>
-#include <net/ip6_fib.h>
-#include <net/ip6_route.h>
-#endif
-
 /*
    Problems & solutions
    --------------------
@@ -217,12 +211,14 @@ static void gre_err(struct sk_buff *skb, u32 info)
          * by themselves???
          */
 
+        const struct iphdr *iph = (struct iphdr *)skb->data;
         const int type = icmp_hdr(skb)->type;
         const int code = icmp_hdr(skb)->code;
         struct tnl_ptk_info tpi;
         bool csum_err = false;
 
-        if (gre_parse_header(skb, &tpi, &csum_err, htons(ETH_P_IP)) < 0) {
+        if (gre_parse_header(skb, &tpi, &csum_err, htons(ETH_P_IP),
+                             iph->ihl * 4) < 0) {
                 if (!csum_err)          /* ignore csum errors. */
                         return;
         }
@@ -338,7 +334,7 @@ static int gre_rcv(struct sk_buff *skb)
         }
 #endif
 
-        hdr_len = gre_parse_header(skb, &tpi, &csum_err, htons(ETH_P_IP));
+        hdr_len = gre_parse_header(skb, &tpi, &csum_err, htons(ETH_P_IP), 0);
         if (hdr_len < 0)
                 goto drop;
 
@@ -1121,6 +1117,7 @@ struct net_device *gretap_fb_dev_create(struct net *net, const char *name,
 {
         struct nlattr *tb[IFLA_MAX + 1];
         struct net_device *dev;
+        LIST_HEAD(list_kill);
         struct ip_tunnel *t;
         int err;
 
@@ -1136,8 +1133,10 @@ struct net_device *gretap_fb_dev_create(struct net *net, const char *name,
         t->collect_md = true;
 
         err = ipgre_newlink(net, dev, tb, NULL);
-        if (err < 0)
-                goto out;
+        if (err < 0) {
+                free_netdev(dev);
+                return ERR_PTR(err);
+        }
 
         /* openvswitch users expect packet sizes to be unrestricted,
          * so set the largest MTU we can.
@@ -1146,9 +1145,14 @@ struct net_device *gretap_fb_dev_create(struct net *net, const char *name,
         if (err)
                 goto out;
 
+        err = rtnl_configure_link(dev, NULL);
+        if (err < 0)
+                goto out;
+
         return dev;
 out:
-        free_netdev(dev);
+        ip_tunnel_dellink(dev, &list_kill);
+        unregister_netdevice_many(&list_kill);
         return ERR_PTR(err);
 }
 EXPORT_SYMBOL_GPL(gretap_fb_dev_create);
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index 2ed9dd2b5f2f..1d71c40eaaf3 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -127,7 +127,9 @@ __be32 ic_myaddr = NONE;		/* My IP address */
 static __be32 ic_netmask = NONE;        /* Netmask for local subnet */
 __be32 ic_gateway = NONE;       /* Gateway IP address */
 
-__be32 ic_addrservaddr = NONE;  /* IP Address of the IP addresses'server */
+#ifdef IPCONFIG_DYNAMIC
+static __be32 ic_addrservaddr = NONE;   /* IP Address of the IP addresses'server */
+#endif
 
 __be32 ic_servaddr = NONE;      /* Boot server IP address */
 
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 21a38e296fe2..5ad48ec77710 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -891,8 +891,10 @@ static struct mfc_cache *ipmr_cache_alloc(void)
 {
         struct mfc_cache *c = kmem_cache_zalloc(mrt_cachep, GFP_KERNEL);
 
-        if (c)
+        if (c) {
+                c->mfc_un.res.last_assert = jiffies - MFC_ASSERT_THRESH - 1;
                 c->mfc_un.res.minvif = MAXVIFS;
+        }
         return c;
 }
 
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 8bd9911fdd16..e00e972c4e6a 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2751,7 +2751,7 @@ void tcp_xmit_retransmit_queue(struct sock *sk)
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *skb;
         struct sk_buff *hole = NULL;
-        u32 last_lost;
+        u32 max_segs, last_lost;
         int mib_idx;
         int fwd_rexmitting = 0;
 
@@ -2771,6 +2771,7 @@ void tcp_xmit_retransmit_queue(struct sock *sk)
                 last_lost = tp->snd_una;
         }
 
+        max_segs = tcp_tso_autosize(sk, tcp_current_mss(sk));
         tcp_for_write_queue_from(skb, sk) {
                 __u8 sacked = TCP_SKB_CB(skb)->sacked;
                 int segs;
@@ -2784,6 +2785,10 @@ void tcp_xmit_retransmit_queue(struct sock *sk)
                 segs = tp->snd_cwnd - tcp_packets_in_flight(tp);
                 if (segs <= 0)
                         return;
+                /* In case tcp_shift_skb_data() have aggregated large skbs,
+                 * we need to make sure not sending too bigs TSO packets
+                 */
+                segs = min_t(int, segs, max_segs);
 
                 if (fwd_rexmitting) {
 begin_fwd:
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index d56c0559b477..ca5e8ea29538 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -391,9 +391,9 @@ int udp_v4_get_port(struct sock *sk, unsigned short snum)
         return udp_lib_get_port(sk, snum, ipv4_rcv_saddr_equal, hash2_nulladdr);
 }
 
-static inline int compute_score(struct sock *sk, struct net *net,
-                                __be32 saddr, unsigned short hnum, __be16 sport,
-                                __be32 daddr, __be16 dport, int dif)
+static int compute_score(struct sock *sk, struct net *net,
+                         __be32 saddr, __be16 sport,
+                         __be32 daddr, unsigned short hnum, int dif)
 {
         int score;
         struct inet_sock *inet;
@@ -434,52 +434,6 @@ static inline int compute_score(struct sock *sk, struct net *net,
         return score;
 }
 
-/*
- * In this second variant, we check (daddr, dport) matches (inet_rcv_sadd, inet_num)
- */
-static inline int compute_score2(struct sock *sk, struct net *net,
-                                 __be32 saddr, __be16 sport,
-                                 __be32 daddr, unsigned int hnum, int dif)
-{
-        int score;
-        struct inet_sock *inet;
-
-        if (!net_eq(sock_net(sk), net) ||
-            ipv6_only_sock(sk))
-                return -1;
-
-        inet = inet_sk(sk);
-
-        if (inet->inet_rcv_saddr != daddr ||
-            inet->inet_num != hnum)
-                return -1;
-
-        score = (sk->sk_family == PF_INET) ? 2 : 1;
-
-        if (inet->inet_daddr) {
-                if (inet->inet_daddr != saddr)
-                        return -1;
-                score += 4;
-        }
-
-        if (inet->inet_dport) {
-                if (inet->inet_dport != sport)
-                        return -1;
-                score += 4;
-        }
-
-        if (sk->sk_bound_dev_if) {
-                if (sk->sk_bound_dev_if != dif)
-                        return -1;
-                score += 4;
-        }
-
-        if (sk->sk_incoming_cpu == raw_smp_processor_id())
-                score++;
-
-        return score;
-}
-
 static u32 udp_ehashfn(const struct net *net, const __be32 laddr,
                        const __u16 lport, const __be32 faddr,
                        const __be16 fport)
@@ -492,11 +446,11 @@ static u32 udp_ehashfn(const struct net *net, const __be32 laddr,
                               udp_ehash_secret + net_hash_mix(net));
 }
 
-/* called with read_rcu_lock() */
+/* called with rcu_read_lock() */
 static struct sock *udp4_lib_lookup2(struct net *net,
                 __be32 saddr, __be16 sport,
                 __be32 daddr, unsigned int hnum, int dif,
-                struct udp_hslot *hslot2, unsigned int slot2,
+                struct udp_hslot *hslot2,
                 struct sk_buff *skb)
 {
         struct sock *sk, *result;
@@ -506,7 +460,7 @@ static struct sock *udp4_lib_lookup2(struct net *net,
         result = NULL;
         badness = 0;
         udp_portaddr_for_each_entry_rcu(sk, &hslot2->head) {
-                score = compute_score2(sk, net, saddr, sport,
+                score = compute_score(sk, net, saddr, sport,
                                       daddr, hnum, dif);
                 if (score > badness) {
                         reuseport = sk->sk_reuseport;
@@ -554,17 +508,22 @@ struct sock *__udp4_lib_lookup(struct net *net, __be32 saddr,
 
                 result = udp4_lib_lookup2(net, saddr, sport,
                                           daddr, hnum, dif,
-                                          hslot2, slot2, skb);
+                                          hslot2, skb);
                 if (!result) {
+                        unsigned int old_slot2 = slot2;
                         hash2 = udp4_portaddr_hash(net, htonl(INADDR_ANY), hnum);
                         slot2 = hash2 & udptable->mask;
+                        /* avoid searching the same slot again. */
+                        if (unlikely(slot2 == old_slot2))
+                                return result;
+
                         hslot2 = &udptable->hash2[slot2];
                         if (hslot->count < hslot2->count)
                                 goto begin;
 
                         result = udp4_lib_lookup2(net, saddr, sport,
-                                                  htonl(INADDR_ANY), hnum, dif,
-                                                  hslot2, slot2, skb);
+                                                  daddr, hnum, dif,
+                                                  hslot2, skb);
                 }
                 return result;
         }
@@ -572,8 +531,8 @@ begin:
         result = NULL;
         badness = 0;
         sk_for_each_rcu(sk, &hslot->head) {
-                score = compute_score(sk, net, saddr, hnum, sport,
-                                      daddr, dport, dif);
+                score = compute_score(sk, net, saddr, sport,
+                                      daddr, hnum, dif);
                 if (score > badness) {
                         reuseport = sk->sk_reuseport;
                         if (reuseport) {
@@ -1618,12 +1577,12 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
                 }
         }
 
-        if (rcu_access_pointer(sk->sk_filter)) {
-                if (udp_lib_checksum_complete(skb))
+        if (rcu_access_pointer(sk->sk_filter) &&
+            udp_lib_checksum_complete(skb))
                         goto csum_error;
-                if (sk_filter(sk, skb))
-                        goto drop;
-        }
+
+        if (sk_filter(sk, skb))
+                goto drop;
 
         udp_csum_pull_header(skb);
         if (sk_rcvqueues_full(sk, sk->sk_rcvbuf)) {
@@ -1755,8 +1714,11 @@ static inline int udp4_csum_init(struct sk_buff *skb, struct udphdr *uh,
                         return err;
         }
 
-        return skb_checksum_init_zero_check(skb, proto, uh->check,
-                                            inet_compute_pseudo);
+        /* Note, we are only interested in != 0 or == 0, thus the
+         * force to int.
+         */
+        return (__force int)skb_checksum_init_zero_check(skb, proto, uh->check,
+                                                         inet_compute_pseudo);
 }
 
 /*
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 4527285fcaa2..a4fa84076969 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -98,7 +98,7 @@ static void icmpv6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 
         if (!(type & ICMPV6_INFOMSG_MASK))
                 if (icmp6->icmp6_type == ICMPV6_ECHO_REQUEST)
-                        ping_err(skb, offset, info);
+                        ping_err(skb, offset, ntohl(info));
 }
 
 static int icmpv6_rcv(struct sk_buff *skb);
diff --git a/net/ipv6/ip6_checksum.c b/net/ipv6/ip6_checksum.c
index b2025bf3da4a..c0cbcb259f5a 100644
--- a/net/ipv6/ip6_checksum.c
+++ b/net/ipv6/ip6_checksum.c
@@ -78,9 +78,12 @@ int udp6_csum_init(struct sk_buff *skb, struct udphdr *uh, int proto)
          * we accept a checksum of zero here. When we find the socket
          * for the UDP packet we'll check if that socket allows zero checksum
          * for IPv6 (set by socket option).
+         *
+         * Note, we are only interested in != 0 or == 0, thus the
+         * force to int.
          */
-        return skb_checksum_init_zero_check(skb, proto, uh->check,
-                                           ip6_compute_pseudo);
+        return (__force int)skb_checksum_init_zero_check(skb, proto, uh->check,
+                                                         ip6_compute_pseudo);
 }
 EXPORT_SYMBOL(udp6_csum_init);
 
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index f4ac2842d4d9..776d145113e1 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -468,7 +468,7 @@ static int gre_rcv(struct sk_buff *skb)
         bool csum_err = false;
         int hdr_len;
 
-        hdr_len = gre_parse_header(skb, &tpi, &csum_err, htons(ETH_P_IPV6));
+        hdr_len = gre_parse_header(skb, &tpi, &csum_err, htons(ETH_P_IPV6), 0);
         if (hdr_len < 0)
                 goto drop;
 
@@ -1256,6 +1256,8 @@ static int ip6gre_tap_init(struct net_device *dev)
         if (ret)
                 return ret;
 
+        dev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
+
         tunnel = netdev_priv(dev);
 
         ip6gre_tnl_link_config(tunnel, 1);
@@ -1289,6 +1291,7 @@ static void ip6gre_tap_setup(struct net_device *dev)
 
         dev->features |= NETIF_F_NETNS_LOCAL;
         dev->priv_flags &= ~IFF_TX_SKB_SHARING;
+        dev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
 }
 
 static bool ip6gre_netlink_encap_parms(struct nlattr *data[],
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index cbf127ae7c67..635b8d340cdb 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1071,17 +1071,12 @@ struct dst_entry *ip6_sk_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
                                          const struct in6_addr *final_dst)
 {
         struct dst_entry *dst = sk_dst_check(sk, inet6_sk(sk)->dst_cookie);
-        int err;
 
         dst = ip6_sk_dst_check(sk, dst, fl6);
+        if (!dst)
+                dst = ip6_dst_lookup_flow(sk, fl6, final_dst);
 
-        err = ip6_dst_lookup_tail(sock_net(sk), sk, &dst, fl6);
-        if (err)
-                return ERR_PTR(err);
-        if (final_dst)
-                fl6->daddr = *final_dst;
-
-        return xfrm_lookup_route(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);
+        return dst;
 }
 EXPORT_SYMBOL_GPL(ip6_sk_dst_lookup_flow);
 
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index f2e2013f8346..487ef3bc7bbc 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -1074,6 +1074,7 @@ static struct mfc6_cache *ip6mr_cache_alloc(void)
         struct mfc6_cache *c = kmem_cache_zalloc(mrt_cachep, GFP_KERNEL);
         if (!c)
                 return NULL;
+        c->mfc_un.res.last_assert = jiffies - MFC_ASSERT_THRESH - 1;
         c->mfc_un.res.minvif = MAXMIFS;
         return c;
 }
diff --git a/net/ipv6/netfilter/nf_dup_ipv6.c b/net/ipv6/netfilter/nf_dup_ipv6.c
index 6989c70ae29f..4a84b5ad9ecb 100644
--- a/net/ipv6/netfilter/nf_dup_ipv6.c
+++ b/net/ipv6/netfilter/nf_dup_ipv6.c
@@ -33,6 +33,7 @@ static bool nf_dup_ipv6_route(struct net *net, struct sk_buff *skb,
         fl6.daddr = *gw;
         fl6.flowlabel = (__force __be32)(((iph->flow_lbl[0] & 0xF) << 16) |
                         (iph->flow_lbl[1] << 8) | iph->flow_lbl[2]);
+        fl6.flowi6_flags = FLOWI_FLAG_KNOWN_NH;
         dst = ip6_route_output(net, NULL, &fl6);
         if (dst->error) {
                 dst_release(dst);
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 969913da494f..520b7884d0c2 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1782,7 +1782,7 @@ static struct rt6_info *ip6_nh_lookup_table(struct net *net,
         };
         struct fib6_table *table;
         struct rt6_info *rt;
-        int flags = 0;
+        int flags = RT6_LOOKUP_F_IFACE;
 
         table = fib6_get_table(net, cfg->fc_table);
         if (!table)
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 0a5a255277e5..0619ac70836d 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -560,13 +560,13 @@ static int ipip6_err(struct sk_buff *skb, u32 info)
 
         if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) {
                 ipv4_update_pmtu(skb, dev_net(skb->dev), info,
-                                 t->parms.link, 0, IPPROTO_IPV6, 0);
+                                 t->parms.link, 0, iph->protocol, 0);
                 err = 0;
                 goto out;
         }
         if (type == ICMP_REDIRECT) {
                 ipv4_redirect(skb, dev_net(skb->dev), t->parms.link, 0,
-                              IPPROTO_IPV6, 0);
+                              iph->protocol, 0);
                 err = 0;
                 goto out;
         }
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 79e33e02f11a..2255d2bf5f6b 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -738,7 +738,7 @@ static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
 static void tcp_v6_send_response(const struct sock *sk, struct sk_buff *skb, u32 seq,
                                  u32 ack, u32 win, u32 tsval, u32 tsecr,
                                  int oif, struct tcp_md5sig_key *key, int rst,
-                                 u8 tclass, u32 label)
+                                 u8 tclass, __be32 label)
 {
         const struct tcphdr *th = tcp_hdr(skb);
         struct tcphdr *t1;
@@ -911,7 +911,7 @@ out:
 static void tcp_v6_send_ack(const struct sock *sk, struct sk_buff *skb, u32 seq,
                             u32 ack, u32 win, u32 tsval, u32 tsecr, int oif,
                             struct tcp_md5sig_key *key, u8 tclass,
-                            u32 label)
+                            __be32 label)
 {
         tcp_v6_send_response(sk, skb, seq, ack, win, tsval, tsecr, oif, key, 0,
                              tclass, label);
@@ -1721,7 +1721,9 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
         destp = ntohs(inet->inet_dport);
         srcp  = ntohs(inet->inet_sport);
 
-        if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
+        if (icsk->icsk_pending == ICSK_TIME_RETRANS ||
+            icsk->icsk_pending == ICSK_TIME_EARLY_RETRANS ||
+            icsk->icsk_pending == ICSK_TIME_LOSS_PROBE) {
                 timer_active    = 1;
                 timer_expires   = icsk->icsk_timeout;
         } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 2da1896af934..005dc82c2138 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -115,11 +115,10 @@ static void udp_v6_rehash(struct sock *sk)
         udp_lib_rehash(sk, new_hash);
 }
 
-static inline int compute_score(struct sock *sk, struct net *net,
-                                unsigned short hnum,
-                                const struct in6_addr *saddr, __be16 sport,
-                                const struct in6_addr *daddr, __be16 dport,
-                                int dif)
+static int compute_score(struct sock *sk, struct net *net,
+                         const struct in6_addr *saddr, __be16 sport,
+                         const struct in6_addr *daddr, unsigned short hnum,
+                         int dif)
 {
         int score;
         struct inet_sock *inet;
@@ -162,54 +161,11 @@ static inline int compute_score(struct sock *sk, struct net *net,
         return score;
 }
 
-static inline int compute_score2(struct sock *sk, struct net *net,
-                                 const struct in6_addr *saddr, __be16 sport,
-                                 const struct in6_addr *daddr,
-                                 unsigned short hnum, int dif)
-{
-        int score;
-        struct inet_sock *inet;
-
-        if (!net_eq(sock_net(sk), net) ||
-            udp_sk(sk)->udp_port_hash != hnum ||
-            sk->sk_family != PF_INET6)
-                return -1;
-
-        if (!ipv6_addr_equal(&sk->sk_v6_rcv_saddr, daddr))
-                return -1;
-
-        score = 0;
-        inet = inet_sk(sk);
-
-        if (inet->inet_dport) {
-                if (inet->inet_dport != sport)
-                        return -1;
-                score++;
-        }
-
-        if (!ipv6_addr_any(&sk->sk_v6_daddr)) {
-                if (!ipv6_addr_equal(&sk->sk_v6_daddr, saddr))
-                        return -1;
-                score++;
-        }
-
-        if (sk->sk_bound_dev_if) {
-                if (sk->sk_bound_dev_if != dif)
-                        return -1;
-                score++;
-        }
-
-        if (sk->sk_incoming_cpu == raw_smp_processor_id())
-                score++;
-
-        return score;
-}
-
-/* called with read_rcu_lock() */
+/* called with rcu_read_lock() */
 static struct sock *udp6_lib_lookup2(struct net *net,
                 const struct in6_addr *saddr, __be16 sport,
                 const struct in6_addr *daddr, unsigned int hnum, int dif,
-                struct udp_hslot *hslot2, unsigned int slot2,
+                struct udp_hslot *hslot2,
                 struct sk_buff *skb)
 {
         struct sock *sk, *result;
@@ -219,7 +175,7 @@ static struct sock *udp6_lib_lookup2(struct net *net,
         result = NULL;
         badness = -1;
         udp_portaddr_for_each_entry_rcu(sk, &hslot2->head) {
-                score = compute_score2(sk, net, saddr, sport,
+                score = compute_score(sk, net, saddr, sport,
                                       daddr, hnum, dif);
                 if (score > badness) {
                         reuseport = sk->sk_reuseport;
@@ -268,17 +224,22 @@ struct sock *__udp6_lib_lookup(struct net *net,
 
                 result = udp6_lib_lookup2(net, saddr, sport,
                                           daddr, hnum, dif,
-                                          hslot2, slot2, skb);
+                                          hslot2, skb);
                 if (!result) {
+                        unsigned int old_slot2 = slot2;
                         hash2 = udp6_portaddr_hash(net, &in6addr_any, hnum);
                         slot2 = hash2 & udptable->mask;
+                        /* avoid searching the same slot again. */
+                        if (unlikely(slot2 == old_slot2))
+                                return result;
+
                         hslot2 = &udptable->hash2[slot2];
                         if (hslot->count < hslot2->count)
                                 goto begin;
 
                         result = udp6_lib_lookup2(net, saddr, sport,
-                                                  &in6addr_any, hnum, dif,
-                                                  hslot2, slot2, skb);
+                                                  daddr, hnum, dif,
+                                                  hslot2, skb);
                 }
                 return result;
         }
@@ -286,7 +247,7 @@ begin:
         result = NULL;
         badness = -1;
         sk_for_each_rcu(sk, &hslot->head) {
-                score = compute_score(sk, net, hnum, saddr, sport, daddr, dport, dif);
+                score = compute_score(sk, net, saddr, sport, daddr, hnum, dif);
                 if (score > badness) {
                         reuseport = sk->sk_reuseport;
                         if (reuseport) {
@@ -653,12 +614,12 @@ int udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
                 }
         }
 
-        if (rcu_access_pointer(sk->sk_filter)) {
-                if (udp_lib_checksum_complete(skb))
-                        goto csum_error;
-                if (sk_filter(sk, skb))
-                        goto drop;
-        }
+        if (rcu_access_pointer(sk->sk_filter) &&
+            udp_lib_checksum_complete(skb))
+                goto csum_error;
+
+        if (sk_filter(sk, skb))
+                goto drop;
 
         udp_csum_pull_header(skb);
         if (sk_rcvqueues_full(sk, sk->sk_rcvbuf)) {
diff --git a/net/kcm/kcmproc.c b/net/kcm/kcmproc.c
index 738008726cc6..fda7f4715c58 100644
--- a/net/kcm/kcmproc.c
+++ b/net/kcm/kcmproc.c
@@ -241,6 +241,7 @@ static const struct file_operations kcm_seq_fops = {
         .open           = kcm_seq_open,
         .read           = seq_read,
         .llseek         = seq_lseek,
+        .release        = seq_release_net,
 };
 
 static struct kcm_seq_muxinfo kcm_seq_muxinfo = {
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 6edfa9980314..1e40dacaa137 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1581,7 +1581,7 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
         /* Mark socket as an encapsulation socket. See net/ipv4/udp.c */
         tunnel->encap = encap;
         if (encap == L2TP_ENCAPTYPE_UDP) {
-                struct udp_tunnel_sock_cfg udp_cfg;
+                struct udp_tunnel_sock_cfg udp_cfg = { };
 
                 udp_cfg.sk_user_data = tunnel;
                 udp_cfg.encap_type = UDP_ENCAP_L2TPINUDP;
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 4c6404e1ad6e..6a1603bcdced 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -148,19 +148,26 @@ u32 mesh_accept_plinks_update(struct ieee80211_sub_if_data *sdata)
 void mesh_sta_cleanup(struct sta_info *sta)
 {
         struct ieee80211_sub_if_data *sdata = sta->sdata;
-        u32 changed;
+        u32 changed = 0;
 
         /*
          * maybe userspace handles peer allocation and peering, but in either
          * case the beacon is still generated by the kernel and we might need
          * an update.
          */
-        changed = mesh_accept_plinks_update(sdata);
+        if (sdata->u.mesh.user_mpm &&
+            sta->mesh->plink_state == NL80211_PLINK_ESTAB)
+                changed |= mesh_plink_dec_estab_count(sdata);
+        changed |= mesh_accept_plinks_update(sdata);
         if (!sdata->u.mesh.user_mpm) {
                 changed |= mesh_plink_deactivate(sta);
                 del_timer_sync(&sta->mesh->plink_timer);
         }
 
+        /* make sure no readers can access nexthop sta from here on */
+        mesh_path_flush_by_nexthop(sta);
+        synchronize_net();
+
         if (changed)
                 ieee80211_mbss_info_change_notify(sdata, changed);
 }
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index c8b8ccc370eb..78b0ef32dddd 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -280,7 +280,7 @@ struct ieee80211_fast_tx {
         u8 sa_offs, da_offs, pn_offs;
         u8 band;
         u8 hdr[30 + 2 + IEEE80211_FAST_XMIT_MAX_IV +
-               sizeof(rfc1042_header)];
+               sizeof(rfc1042_header)] __aligned(2);
 
         struct rcu_head rcu_head;
 };
diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
index 2cb3c626cd43..096a45103f14 100644
--- a/net/netfilter/ipvs/ip_vs_conn.c
+++ b/net/netfilter/ipvs/ip_vs_conn.c
@@ -762,7 +762,7 @@ static int expire_quiescent_template(struct netns_ipvs *ipvs,
  *      If available, return 1, otherwise invalidate this connection
  *      template and return 0.
  */
-int ip_vs_check_template(struct ip_vs_conn *ct)
+int ip_vs_check_template(struct ip_vs_conn *ct, struct ip_vs_dest *cdest)
 {
         struct ip_vs_dest *dest = ct->dest;
         struct netns_ipvs *ipvs = ct->ipvs;
@@ -772,7 +772,8 @@ int ip_vs_check_template(struct ip_vs_conn *ct)
          */
         if ((dest == NULL) ||
             !(dest->flags & IP_VS_DEST_F_AVAILABLE) ||
-            expire_quiescent_template(ipvs, dest)) {
+            expire_quiescent_template(ipvs, dest) ||
+            (cdest && (dest != cdest))) {
                 IP_VS_DBG_BUF(9, "check_template: dest not available for "
                               "protocol %s s:%s:%d v:%s:%d "
                               "-> d:%s:%d\n",
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index 1207f20d24e4..2c1b498a7a27 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -321,7 +321,7 @@ ip_vs_sched_persist(struct ip_vs_service *svc,
 
         /* Check if a template already exists */
         ct = ip_vs_ct_in_get(&param);
-        if (!ct || !ip_vs_check_template(ct)) {
+        if (!ct || !ip_vs_check_template(ct, NULL)) {
                 struct ip_vs_scheduler *sched;
 
                 /*
@@ -1154,7 +1154,8 @@ struct ip_vs_conn *ip_vs_new_conn_out(struct ip_vs_service *svc,
                                                   vport, &param) < 0)
                         return NULL;
                 ct = ip_vs_ct_in_get(&param);
-                if (!ct) {
+                /* check if template exists and points to the same dest */
+                if (!ct || !ip_vs_check_template(ct, dest)) {
                         ct = ip_vs_conn_new(&param, dest->af, daddr, dport,
                                             IP_VS_CONN_F_TEMPLATE, dest, 0);
                         if (!ct) {
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index db2312eeb2a4..f204274a9b6b 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -1544,6 +1544,8 @@ void nf_conntrack_cleanup_end(void)
         nf_conntrack_tstamp_fini();
         nf_conntrack_acct_fini();
         nf_conntrack_expect_fini();
+
+        kmem_cache_destroy(nf_conntrack_cachep);
 }
 
 /*
diff --git a/net/netfilter/nf_conntrack_ftp.c b/net/netfilter/nf_conntrack_ftp.c
index 883c691ec8d0..19efeba02abb 100644
--- a/net/netfilter/nf_conntrack_ftp.c
+++ b/net/netfilter/nf_conntrack_ftp.c
@@ -632,6 +632,7 @@ static int __init nf_conntrack_ftp_init(void)
                         if (ret) {
                                 pr_err("failed to register helper for pf: %d port: %d\n",
                                        ftp[i][j].tuple.src.l3num, ports[i]);
+                                ports_c = i;
                                 nf_conntrack_ftp_fini();
                                 return ret;
                         }
diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index f703adb7e5f7..196cb39649e1 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -361,9 +361,10 @@ EXPORT_SYMBOL_GPL(nf_ct_helper_log);
 
 int nf_conntrack_helper_register(struct nf_conntrack_helper *me)
 {
-        int ret = 0;
-        struct nf_conntrack_helper *cur;
+        struct nf_conntrack_tuple_mask mask = { .src.u.all = htons(0xFFFF) };
         unsigned int h = helper_hash(&me->tuple);
+        struct nf_conntrack_helper *cur;
+        int ret = 0;
 
         BUG_ON(me->expect_policy == NULL);
         BUG_ON(me->expect_class_max >= NF_CT_MAX_EXPECT_CLASSES);
@@ -371,9 +372,7 @@ int nf_conntrack_helper_register(struct nf_conntrack_helper *me)
 
         mutex_lock(&nf_ct_helper_mutex);
         hlist_for_each_entry(cur, &nf_ct_helper_hash[h], hnode) {
-                if (strncmp(cur->name, me->name, NF_CT_HELPER_NAME_LEN) == 0 &&
-                    cur->tuple.src.l3num == me->tuple.src.l3num &&
-                    cur->tuple.dst.protonum == me->tuple.dst.protonum) {
+                if (nf_ct_tuple_src_mask_cmp(&cur->tuple, &me->tuple, &mask)) {
                         ret = -EEXIST;
                         goto out;
                 }
diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_irc.c
index 8b6da2719600..f97ac61d2536 100644
--- a/net/netfilter/nf_conntrack_irc.c
+++ b/net/netfilter/nf_conntrack_irc.c
@@ -271,6 +271,7 @@ static int __init nf_conntrack_irc_init(void)
                 if (ret) {
                         pr_err("failed to register helper for pf: %u port: %u\n",
                                irc[i].tuple.src.l3num, ports[i]);
+                        ports_c = i;
                         nf_conntrack_irc_fini();
                         return ret;
                 }
diff --git a/net/netfilter/nf_conntrack_sane.c b/net/netfilter/nf_conntrack_sane.c
index 7523a575f6d1..3fcbaab83b3d 100644
--- a/net/netfilter/nf_conntrack_sane.c
+++ b/net/netfilter/nf_conntrack_sane.c
@@ -223,6 +223,7 @@ static int __init nf_conntrack_sane_init(void)
                         if (ret) {
                                 pr_err("failed to register helper for pf: %d port: %d\n",
                                        sane[i][j].tuple.src.l3num, ports[i]);
+                                ports_c = i;
                                 nf_conntrack_sane_fini();
                                 return ret;
                         }
diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 3e06402739e0..f72ba5587588 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -1669,6 +1669,7 @@ static int __init nf_conntrack_sip_init(void)
                         if (ret) {
                                 pr_err("failed to register helper for pf: %u port: %u\n",
                                        sip[i][j].tuple.src.l3num, ports[i]);
+                                ports_c = i;
                                 nf_conntrack_sip_fini();
                                 return ret;
                         }
diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index f87e84ebcec3..c026c472ea80 100644
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -487,8 +487,6 @@ static struct ctl_table nf_ct_sysctl_table[] = {
         { }
 };
 
-#define NET_NF_CONNTRACK_MAX 2089
-
 static struct ctl_table nf_ct_netfilter_table[] = {
         {
                 .procname       = "nf_conntrack_max",
diff --git a/net/netfilter/nf_conntrack_tftp.c b/net/netfilter/nf_conntrack_tftp.c
index 36f964066461..2e65b5430fba 100644
--- a/net/netfilter/nf_conntrack_tftp.c
+++ b/net/netfilter/nf_conntrack_tftp.c
@@ -142,6 +142,7 @@ static int __init nf_conntrack_tftp_init(void)
                         if (ret) {
                                 pr_err("failed to register helper for pf: %u port: %u\n",
                                        tftp[i][j].tuple.src.l3num, ports[i]);
+                                ports_c = i;
                                 nf_conntrack_tftp_fini();
                                 return ret;
                         }
diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
index 5baa8e24e6ac..b19ad20a705c 100644
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -26,23 +26,21 @@
  * Once the queue is registered it must reinject all packets it
  * receives, no matter what.
  */
-static const struct nf_queue_handler __rcu *queue_handler __read_mostly;
 
 /* return EBUSY when somebody else is registered, return EEXIST if the
  * same handler is registered, return 0 in case of success. */
-void nf_register_queue_handler(const struct nf_queue_handler *qh)
+void nf_register_queue_handler(struct net *net, const struct nf_queue_handler *qh)
 {
         /* should never happen, we only have one queueing backend in kernel */
-        WARN_ON(rcu_access_pointer(queue_handler));
-        rcu_assign_pointer(queue_handler, qh);
+        WARN_ON(rcu_access_pointer(net->nf.queue_handler));
+        rcu_assign_pointer(net->nf.queue_handler, qh);
 }
 EXPORT_SYMBOL(nf_register_queue_handler);
 
 /* The caller must flush their queue before this */
-void nf_unregister_queue_handler(void)
+void nf_unregister_queue_handler(struct net *net)
 {
-        RCU_INIT_POINTER(queue_handler, NULL);
-        synchronize_rcu();
+        RCU_INIT_POINTER(net->nf.queue_handler, NULL);
 }
 EXPORT_SYMBOL(nf_unregister_queue_handler);
 
@@ -103,7 +101,7 @@ void nf_queue_nf_hook_drop(struct net *net, struct nf_hook_ops *ops)
         const struct nf_queue_handler *qh;
 
         rcu_read_lock();
-        qh = rcu_dereference(queue_handler);
+        qh = rcu_dereference(net->nf.queue_handler);
         if (qh)
                 qh->nf_hook_drop(net, ops);
         rcu_read_unlock();
@@ -122,9 +120,10 @@ int nf_queue(struct sk_buff *skb,
         struct nf_queue_entry *entry = NULL;
         const struct nf_afinfo *afinfo;
         const struct nf_queue_handler *qh;
+        struct net *net = state->net;
 
         /* QUEUE == DROP if no one is waiting, to be safe. */
-        qh = rcu_dereference(queue_handler);
+        qh = rcu_dereference(net->nf.queue_handler);
         if (!qh) {
                 status = -ESRCH;
                 goto err;
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 4d292b933b5c..2c881871db38 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -2647,6 +2647,8 @@ static int nf_tables_getset(struct net *net, struct sock *nlsk,
         /* Only accept unspec with dump */
         if (nfmsg->nfgen_family == NFPROTO_UNSPEC)
                 return -EAFNOSUPPORT;
+        if (!nla[NFTA_SET_TABLE])
+                return -EINVAL;
 
         set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_NAME]);
         if (IS_ERR(set))
@@ -2944,24 +2946,20 @@ int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
                  * jumps are already validated for that chain.
                  */
                 list_for_each_entry(i, &set->bindings, list) {
-                        if (binding->flags & NFT_SET_MAP &&
+                        if (i->flags & NFT_SET_MAP &&
                             i->chain == binding->chain)
                                 goto bind;
                 }
 
+                iter.genmask    = nft_genmask_next(ctx->net);
                 iter.skip       = 0;
                 iter.count      = 0;
                 iter.err        = 0;
                 iter.fn         = nf_tables_bind_check_setelem;
 
                 set->ops->walk(ctx, set, &iter);
-                if (iter.err < 0) {
-                        /* Destroy anonymous sets if binding fails */
-                        if (set->flags & NFT_SET_ANONYMOUS)
-                                nf_tables_set_destroy(ctx, set);
-
+                if (iter.err < 0)
                         return iter.err;
-                }
         }
 bind:
         binding->chain = ctx->chain;
@@ -3190,12 +3188,13 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
         if (nest == NULL)
                 goto nla_put_failure;
 
-        args.cb         = cb;
-        args.skb        = skb;
-        args.iter.skip  = cb->args[0];
-        args.iter.count = 0;
-        args.iter.err   = 0;
-        args.iter.fn    = nf_tables_dump_setelem;
+        args.cb                 = cb;
+        args.skb                = skb;
+        args.iter.genmask       = nft_genmask_cur(ctx.net);
+        args.iter.skip          = cb->args[0];
+        args.iter.count         = 0;
+        args.iter.err           = 0;
+        args.iter.fn            = nf_tables_dump_setelem;
         set->ops->walk(&ctx, set, &args.iter);
 
         nla_nest_end(skb, nest);
@@ -4282,6 +4281,7 @@ static int nf_tables_check_loops(const struct nft_ctx *ctx,
                             binding->chain != chain)
                                 continue;
 
+                        iter.genmask    = nft_genmask_next(ctx->net);
                         iter.skip       = 0;
                         iter.count      = 0;
                         iter.err        = 0;
diff --git a/net/netfilter/nf_tables_core.c b/net/netfilter/nf_tables_core.c
index e9f8dffcc244..fb8b5892b5ff 100644
--- a/net/netfilter/nf_tables_core.c
+++ b/net/netfilter/nf_tables_core.c
@@ -143,7 +143,7 @@ next_rule:
         list_for_each_entry_continue_rcu(rule, &chain->rules, list) {
 
                 /* This rule is not active, skip. */
-                if (unlikely(rule->genmask & (1 << gencursor)))
+                if (unlikely(rule->genmask & gencursor))
                         continue;
 
                 rulenum++;
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index aa93877ab6e2..5d36a0926b4a 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -557,7 +557,7 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
 
         if (entskb->tstamp.tv64) {
                 struct nfqnl_msg_packet_timestamp ts;
-                struct timespec64 kts = ktime_to_timespec64(skb->tstamp);
+                struct timespec64 kts = ktime_to_timespec64(entskb->tstamp);
 
                 ts.sec = cpu_to_be64(kts.tv_sec);
                 ts.usec = cpu_to_be64(kts.tv_nsec / NSEC_PER_USEC);
@@ -1482,21 +1482,29 @@ static int __net_init nfnl_queue_net_init(struct net *net)
                          net->nf.proc_netfilter, &nfqnl_file_ops))
                 return -ENOMEM;
 #endif
+        nf_register_queue_handler(net, &nfqh);
         return 0;
 }
 
 static void __net_exit nfnl_queue_net_exit(struct net *net)
 {
+        nf_unregister_queue_handler(net);
 #ifdef CONFIG_PROC_FS
         remove_proc_entry("nfnetlink_queue", net->nf.proc_netfilter);
 #endif
 }
 
+static void nfnl_queue_net_exit_batch(struct list_head *net_exit_list)
+{
+        synchronize_rcu();
+}
+
 static struct pernet_operations nfnl_queue_net_ops = {
-        .init   = nfnl_queue_net_init,
-        .exit   = nfnl_queue_net_exit,
-        .id     = &nfnl_queue_net_id,
-        .size   = sizeof(struct nfnl_queue_net),
+        .init           = nfnl_queue_net_init,
+        .exit           = nfnl_queue_net_exit,
+        .exit_batch     = nfnl_queue_net_exit_batch,
+        .id             = &nfnl_queue_net_id,
+        .size           = sizeof(struct nfnl_queue_net),
 };
 
 static int __init nfnetlink_queue_init(void)
@@ -1517,7 +1525,6 @@ static int __init nfnetlink_queue_init(void)
         }
 
         register_netdevice_notifier(&nfqnl_dev_notifier);
-        nf_register_queue_handler(&nfqh);
         return status;
 
 cleanup_netlink_notifier:
@@ -1529,7 +1536,6 @@ out:
 
 static void __exit nfnetlink_queue_fini(void)
 {
-        nf_unregister_queue_handler();
         unregister_netdevice_notifier(&nfqnl_dev_notifier);
         nfnetlink_subsys_unregister(&nfqnl_subsys);
         netlink_unregister_notifier(&nfqnl_rtnl_notifier);
diff --git a/net/netfilter/nft_hash.c b/net/netfilter/nft_hash.c
index 6fa016564f90..f39c53a159eb 100644
--- a/net/netfilter/nft_hash.c
+++ b/net/netfilter/nft_hash.c
@@ -189,7 +189,6 @@ static void nft_hash_walk(const struct nft_ctx *ctx, const struct nft_set *set,
         struct nft_hash_elem *he;
         struct rhashtable_iter hti;
         struct nft_set_elem elem;
-        u8 genmask = nft_genmask_cur(read_pnet(&set->pnet));
         int err;
 
         err = rhashtable_walk_init(&priv->ht, &hti, GFP_KERNEL);
@@ -218,7 +217,7 @@ static void nft_hash_walk(const struct nft_ctx *ctx, const struct nft_set *set,
                         goto cont;
                 if (nft_set_elem_expired(&he->ext))
                         goto cont;
-                if (!nft_set_elem_active(&he->ext, genmask))
+                if (!nft_set_elem_active(&he->ext, iter->genmask))
                         goto cont;
 
                 elem.priv = he;
diff --git a/net/netfilter/nft_rbtree.c b/net/netfilter/nft_rbtree.c
index f762094af7c1..7201d57b5a93 100644
--- a/net/netfilter/nft_rbtree.c
+++ b/net/netfilter/nft_rbtree.c
@@ -211,7 +211,6 @@ static void nft_rbtree_walk(const struct nft_ctx *ctx,
         struct nft_rbtree_elem *rbe;
         struct nft_set_elem elem;
         struct rb_node *node;
-        u8 genmask = nft_genmask_cur(read_pnet(&set->pnet));
 
         spin_lock_bh(&nft_rbtree_lock);
         for (node = rb_first(&priv->root); node != NULL; node = rb_next(node)) {
@@ -219,7 +218,7 @@ static void nft_rbtree_walk(const struct nft_ctx *ctx,
 
                 if (iter->count < iter->skip)
                         goto cont;
-                if (!nft_set_elem_active(&rbe->ext, genmask))
+                if (!nft_set_elem_active(&rbe->ext, iter->genmask))
                         goto cont;
 
                 elem.priv = rbe;
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index c69c892231d7..2675d580c490 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -612,7 +612,7 @@ int xt_compat_check_entry_offsets(const void *base, const char *elems,
                 return -EINVAL;
 
         if (strcmp(t->u.user.name, XT_STANDARD_TARGET) == 0 &&
-            target_offset + sizeof(struct compat_xt_standard_target) != next_offset)
+            COMPAT_XT_ALIGN(target_offset + sizeof(struct compat_xt_standard_target)) != next_offset)
                 return -EINVAL;
 
         /* compat_xt_entry match has less strict aligment requirements,
@@ -694,7 +694,7 @@ int xt_check_entry_offsets(const void *base,
                 return -EINVAL;
 
         if (strcmp(t->u.user.name, XT_STANDARD_TARGET) == 0 &&
-            target_offset + sizeof(struct xt_standard_target) != next_offset)
+            XT_ALIGN(target_offset + sizeof(struct xt_standard_target)) != next_offset)
                 return -EINVAL;
 
         return xt_check_entry_match(elems, base + target_offset,
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index 3d5feede962d..d84312584ee4 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -818,8 +818,18 @@ static int ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
                  */
                 state = OVS_CS_F_TRACKED | OVS_CS_F_NEW | OVS_CS_F_RELATED;
                 __ovs_ct_update_key(key, state, &info->zone, exp->master);
-        } else
-                return __ovs_ct_lookup(net, key, info, skb);
+        } else {
+                struct nf_conn *ct;
+                int err;
+
+                err = __ovs_ct_lookup(net, key, info, skb);
+                if (err)
+                        return err;
+
+                ct = (struct nf_conn *)skb->nfct;
+                if (ct)
+                        nf_ct_deliver_cached_events(ct);
+        }
 
         return 0;
 }
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 4040eb92d9c9..9bff6ef16fa7 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -93,6 +93,7 @@
 #include <net/inet_common.h>
 #endif
 #include <linux/bpf.h>
+#include <net/compat.h>
 
 #include "internal.h"
 
@@ -3940,6 +3941,27 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
 }
 
 
+#ifdef CONFIG_COMPAT
+static int compat_packet_setsockopt(struct socket *sock, int level, int optname,
+                                    char __user *optval, unsigned int optlen)
+{
+        struct packet_sock *po = pkt_sk(sock->sk);
+
+        if (level != SOL_PACKET)
+                return -ENOPROTOOPT;
+
+        if (optname == PACKET_FANOUT_DATA &&
+            po->fanout && po->fanout->type == PACKET_FANOUT_CBPF) {
+                optval = (char __user *)get_compat_bpf_fprog(optval);
+                if (!optval)
+                        return -EFAULT;
+                optlen = sizeof(struct sock_fprog);
+        }
+
+        return packet_setsockopt(sock, level, optname, optval, optlen);
+}
+#endif
+
 static int packet_notifier(struct notifier_block *this,
                            unsigned long msg, void *ptr)
 {
@@ -4416,6 +4438,9 @@ static const struct proto_ops packet_ops = {
         .shutdown =     sock_no_shutdown,
         .setsockopt =   packet_setsockopt,
         .getsockopt =   packet_getsockopt,
+#ifdef CONFIG_COMPAT
+        .compat_setsockopt = compat_packet_setsockopt,
+#endif
         .sendmsg =      packet_sendmsg,
         .recvmsg =      packet_recvmsg,
         .mmap =         packet_mmap,
diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c
index 310cabce2311..7c2a65a6af5c 100644
--- a/net/rds/ib_cm.c
+++ b/net/rds/ib_cm.c
@@ -111,7 +111,7 @@ void rds_ib_cm_connect_complete(struct rds_connection *conn, struct rdma_cm_even
                 }
         }
 
-        if (conn->c_version < RDS_PROTOCOL(3,1)) {
+        if (conn->c_version < RDS_PROTOCOL(3, 1)) {
                 printk(KERN_NOTICE "RDS/IB: Connection to %pI4 version %u.%u failed,"
                        " no longer supported\n",
                        &conn->c_faddr,
diff --git a/net/rds/loop.c b/net/rds/loop.c
index 6b12b68541ae..814173b466d9 100644
--- a/net/rds/loop.c
+++ b/net/rds/loop.c
@@ -95,8 +95,9 @@ out:
  */
 static void rds_loop_inc_free(struct rds_incoming *inc)
 {
-        struct rds_message *rm = container_of(inc, struct rds_message, m_inc);
-        rds_message_put(rm);
+        struct rds_message *rm = container_of(inc, struct rds_message, m_inc);
+
+        rds_message_put(rm);
 }
 
 /* we need to at least give the thread something to succeed */
diff --git a/net/rds/rds.h b/net/rds/rds.h
index 80256b08eac0..387df5f32e49 100644
--- a/net/rds/rds.h
+++ b/net/rds/rds.h
@@ -74,6 +74,7 @@ enum {
         RDS_CONN_CONNECTING,
         RDS_CONN_DISCONNECTING,
         RDS_CONN_UP,
+        RDS_CONN_RESETTING,
         RDS_CONN_ERROR,
 };
 
@@ -813,6 +814,7 @@ void rds_connect_worker(struct work_struct *);
 void rds_shutdown_worker(struct work_struct *);
 void rds_send_worker(struct work_struct *);
 void rds_recv_worker(struct work_struct *);
+void rds_connect_path_complete(struct rds_connection *conn, int curr);
 void rds_connect_complete(struct rds_connection *conn);
 
 /* transport.c */
diff --git a/net/rds/recv.c b/net/rds/recv.c
index c0be1ecd11c9..8413f6c99e13 100644
--- a/net/rds/recv.c
+++ b/net/rds/recv.c
@@ -561,5 +561,7 @@ void rds_inc_info_copy(struct rds_incoming *inc,
                 minfo.fport = inc->i_hdr.h_dport;
         }
 
+        minfo.flags = 0;
+
         rds_info_copy(iter, &minfo, sizeof(minfo));
 }
diff --git a/net/rds/send.c b/net/rds/send.c
index c9cdb358ea88..b1962f8e30f7 100644
--- a/net/rds/send.c
+++ b/net/rds/send.c
@@ -99,6 +99,7 @@ void rds_send_reset(struct rds_connection *conn)
         list_splice_init(&conn->c_retrans, &conn->c_send_queue);
         spin_unlock_irqrestore(&conn->c_lock, flags);
 }
+EXPORT_SYMBOL_GPL(rds_send_reset);
 
 static int acquire_in_xmit(struct rds_connection *conn)
 {
diff --git a/net/rds/sysctl.c b/net/rds/sysctl.c
index c173f69e1479..e381bbcd9cc1 100644
--- a/net/rds/sysctl.c
+++ b/net/rds/sysctl.c
@@ -102,7 +102,8 @@ int rds_sysctl_init(void)
         rds_sysctl_reconnect_min = msecs_to_jiffies(1);
         rds_sysctl_reconnect_min_jiffies = rds_sysctl_reconnect_min;
 
-        rds_sysctl_reg_table = register_net_sysctl(&init_net,"net/rds", rds_sysctl_rds_table);
+        rds_sysctl_reg_table =
+                register_net_sysctl(&init_net, "net/rds", rds_sysctl_rds_table);
         if (!rds_sysctl_reg_table)
                 return -ENOMEM;
         return 0;
diff --git a/net/rds/tcp.c b/net/rds/tcp.c
index 86187dad1440..74ee126a6fe6 100644
--- a/net/rds/tcp.c
+++ b/net/rds/tcp.c
@@ -126,9 +126,81 @@ void rds_tcp_restore_callbacks(struct socket *sock,
 }
 
 /*
- * This is the only path that sets tc->t_sock.  Send and receive trust that
- * it is set.  The RDS_CONN_UP bit protects those paths from being
- * called while it isn't set.
+ * rds_tcp_reset_callbacks() switches the to the new sock and
+ * returns the existing tc->t_sock.
+ *
+ * The only functions that set tc->t_sock are rds_tcp_set_callbacks
+ * and rds_tcp_reset_callbacks.  Send and receive trust that
+ * it is set.  The absence of RDS_CONN_UP bit protects those paths
+ * from being called while it isn't set.
+ */
+void rds_tcp_reset_callbacks(struct socket *sock,
+                             struct rds_connection *conn)
+{
+        struct rds_tcp_connection *tc = conn->c_transport_data;
+        struct socket *osock = tc->t_sock;
+
+        if (!osock)
+                goto newsock;
+
+        /* Need to resolve a duelling SYN between peers.
+         * We have an outstanding SYN to this peer, which may
+         * potentially have transitioned to the RDS_CONN_UP state,
+         * so we must quiesce any send threads before resetting
+         * c_transport_data. We quiesce these threads by setting
+         * c_state to something other than RDS_CONN_UP, and then
+         * waiting for any existing threads in rds_send_xmit to
+         * complete release_in_xmit(). (Subsequent threads entering
+         * rds_send_xmit() will bail on !rds_conn_up().
+         *
+         * However an incoming syn-ack at this point would end up
+         * marking the conn as RDS_CONN_UP, and would again permit
+         * rds_send_xmi() threads through, so ideally we would
+         * synchronize on RDS_CONN_UP after lock_sock(), but cannot
+         * do that: waiting on !RDS_IN_XMIT after lock_sock() may
+         * end up deadlocking with tcp_sendmsg(), and the RDS_IN_XMIT
+         * would not get set. As a result, we set c_state to
+         * RDS_CONN_RESETTTING, to ensure that rds_tcp_state_change
+         * cannot mark rds_conn_path_up() in the window before lock_sock()
+         */
+        atomic_set(&conn->c_state, RDS_CONN_RESETTING);
+        wait_event(conn->c_waitq, !test_bit(RDS_IN_XMIT, &conn->c_flags));
+        lock_sock(osock->sk);
+        /* reset receive side state for rds_tcp_data_recv() for osock  */
+        if (tc->t_tinc) {
+                rds_inc_put(&tc->t_tinc->ti_inc);
+                tc->t_tinc = NULL;
+        }
+        tc->t_tinc_hdr_rem = sizeof(struct rds_header);
+        tc->t_tinc_data_rem = 0;
+        tc->t_sock = NULL;
+
+        write_lock_bh(&osock->sk->sk_callback_lock);
+
+        osock->sk->sk_user_data = NULL;
+        osock->sk->sk_data_ready = tc->t_orig_data_ready;
+        osock->sk->sk_write_space = tc->t_orig_write_space;
+        osock->sk->sk_state_change = tc->t_orig_state_change;
+        write_unlock_bh(&osock->sk->sk_callback_lock);
+        release_sock(osock->sk);
+        sock_release(osock);
+newsock:
+        rds_send_reset(conn);
+        lock_sock(sock->sk);
+        write_lock_bh(&sock->sk->sk_callback_lock);
+        tc->t_sock = sock;
+        sock->sk->sk_user_data = conn;
+        sock->sk->sk_data_ready = rds_tcp_data_ready;
+        sock->sk->sk_write_space = rds_tcp_write_space;
+        sock->sk->sk_state_change = rds_tcp_state_change;
+
+        write_unlock_bh(&sock->sk->sk_callback_lock);
+        release_sock(sock->sk);
+}
+
+/* Add tc to rds_tcp_tc_list and set tc->t_sock. See comments
+ * above rds_tcp_reset_callbacks for notes about synchronization
+ * with data path
  */
 void rds_tcp_set_callbacks(struct socket *sock, struct rds_connection *conn)
 {
diff --git a/net/rds/tcp.h b/net/rds/tcp.h
index 41c228300525..7940babf6c71 100644
--- a/net/rds/tcp.h
+++ b/net/rds/tcp.h
@@ -50,6 +50,7 @@ struct rds_tcp_statistics {
 void rds_tcp_tune(struct socket *sock);
 void rds_tcp_nonagle(struct socket *sock);
 void rds_tcp_set_callbacks(struct socket *sock, struct rds_connection *conn);
+void rds_tcp_reset_callbacks(struct socket *sock, struct rds_connection *conn);
 void rds_tcp_restore_callbacks(struct socket *sock,
                                struct rds_tcp_connection *tc);
 u32 rds_tcp_snd_nxt(struct rds_tcp_connection *tc);
@@ -82,7 +83,7 @@ int rds_tcp_inc_copy_to_user(struct rds_incoming *inc, struct iov_iter *to);
 void rds_tcp_xmit_prepare(struct rds_connection *conn);
 void rds_tcp_xmit_complete(struct rds_connection *conn);
 int rds_tcp_xmit(struct rds_connection *conn, struct rds_message *rm,
-                 unsigned int hdr_off, unsigned int sg, unsigned int off);
+                 unsigned int hdr_off, unsigned int sg, unsigned int off);
 void rds_tcp_write_space(struct sock *sk);
 
 /* tcp_stats.c */
diff --git a/net/rds/tcp_connect.c b/net/rds/tcp_connect.c
index fb82e0a0bf89..f6e95d60db54 100644
--- a/net/rds/tcp_connect.c
+++ b/net/rds/tcp_connect.c
@@ -54,19 +54,19 @@ void rds_tcp_state_change(struct sock *sk)
 
         rdsdebug("sock %p state_change to %d\n", tc->t_sock, sk->sk_state);
 
-        switch(sk->sk_state) {
-                /* ignore connecting sockets as they make progress */
-                case TCP_SYN_SENT:
-                case TCP_SYN_RECV:
-                        break;
-                case TCP_ESTABLISHED:
-                        rds_connect_complete(conn);
-                        break;
-                case TCP_CLOSE_WAIT:
-                case TCP_CLOSE:
-                        rds_conn_drop(conn);
-                default:
-                        break;
+        switch (sk->sk_state) {
+        /* ignore connecting sockets as they make progress */
+        case TCP_SYN_SENT:
+        case TCP_SYN_RECV:
+                break;
+        case TCP_ESTABLISHED:
+                rds_connect_path_complete(conn, RDS_CONN_CONNECTING);
+                break;
+        case TCP_CLOSE_WAIT:
+        case TCP_CLOSE:
+                rds_conn_drop(conn);
+        default:
+                break;
         }
 out:
         read_unlock_bh(&sk->sk_callback_lock);
diff --git a/net/rds/tcp_listen.c b/net/rds/tcp_listen.c
index 4bf4befe5066..245542ca4718 100644
--- a/net/rds/tcp_listen.c
+++ b/net/rds/tcp_listen.c
@@ -78,7 +78,6 @@ int rds_tcp_accept_one(struct socket *sock)
         struct inet_sock *inet;
         struct rds_tcp_connection *rs_tcp = NULL;
         int conn_state;
-        struct sock *nsk;
 
         if (!sock) /* module unload or netns delete in progress */
                 return -ENETUNREACH;
@@ -136,26 +135,21 @@ int rds_tcp_accept_one(struct socket *sock)
                     !conn->c_outgoing) {
                         goto rst_nsk;
                 } else {
-                        atomic_set(&conn->c_state, RDS_CONN_CONNECTING);
-                        wait_event(conn->c_waitq,
-                                   !test_bit(RDS_IN_XMIT, &conn->c_flags));
-                        rds_tcp_restore_callbacks(rs_tcp->t_sock, rs_tcp);
+                        rds_tcp_reset_callbacks(new_sock, conn);
                         conn->c_outgoing = 0;
+                        /* rds_connect_path_complete() marks RDS_CONN_UP */
+                        rds_connect_path_complete(conn, RDS_CONN_RESETTING);
                 }
+        } else {
+                rds_tcp_set_callbacks(new_sock, conn);
+                rds_connect_path_complete(conn, RDS_CONN_CONNECTING);
         }
-        rds_tcp_set_callbacks(new_sock, conn);
-        rds_connect_complete(conn); /* marks RDS_CONN_UP */
         new_sock = NULL;
         ret = 0;
         goto out;
 rst_nsk:
         /* reset the newly returned accept sock and bail */
-        nsk = new_sock->sk;
-        rds_tcp_stats_inc(s_tcp_listen_closed_stale);
-        nsk->sk_user_data = NULL;
-        nsk->sk_prot->disconnect(nsk, 0);
-        tcp_done(nsk);
-        new_sock = NULL;
+        kernel_sock_shutdown(new_sock, SHUT_RDWR);
         ret = 0;
 out:
         if (rs_tcp)
diff --git a/net/rds/tcp_recv.c b/net/rds/tcp_recv.c
index c3196f9d070a..6e6a7111a034 100644
--- a/net/rds/tcp_recv.c
+++ b/net/rds/tcp_recv.c
@@ -171,7 +171,7 @@ static int rds_tcp_data_recv(read_descriptor_t *desc, struct sk_buff *skb,
         while (left) {
                 if (!tinc) {
                         tinc = kmem_cache_alloc(rds_tcp_incoming_slab,
-                                                arg->gfp);
+                                                arg->gfp);
                         if (!tinc) {
                                 desc->error = -ENOMEM;
                                 goto out;
diff --git a/net/rds/tcp_send.c b/net/rds/tcp_send.c
index 22d0f2020a79..618be69c9c3b 100644
--- a/net/rds/tcp_send.c
+++ b/net/rds/tcp_send.c
@@ -66,19 +66,19 @@ void rds_tcp_xmit_complete(struct rds_connection *conn)
 static int rds_tcp_sendmsg(struct socket *sock, void *data, unsigned int len)
 {
         struct kvec vec = {
-                .iov_base = data,
-                .iov_len = len,
+                .iov_base = data,
+                .iov_len = len,
+        };
+        struct msghdr msg = {
+                .msg_flags = MSG_DONTWAIT | MSG_NOSIGNAL,
         };
-        struct msghdr msg = {
-                .msg_flags = MSG_DONTWAIT | MSG_NOSIGNAL,
-        };
 
         return kernel_sendmsg(sock, &msg, &vec, 1, vec.iov_len);
 }
 
 /* the core send_sem serializes this with other xmit and shutdown */
 int rds_tcp_xmit(struct rds_connection *conn, struct rds_message *rm,
-                 unsigned int hdr_off, unsigned int sg, unsigned int off)
+                 unsigned int hdr_off, unsigned int sg, unsigned int off)
 {
         struct rds_tcp_connection *tc = conn->c_transport_data;
         int done = 0;
@@ -196,7 +196,7 @@ void rds_tcp_write_space(struct sock *sk)
         tc->t_last_seen_una = rds_tcp_snd_una(tc);
         rds_send_drop_acked(conn, rds_tcp_snd_una(tc), rds_tcp_is_acked);
 
-        if ((atomic_read(&sk->sk_wmem_alloc) << 1) <= sk->sk_sndbuf)
+        if ((atomic_read(&sk->sk_wmem_alloc) << 1) <= sk->sk_sndbuf)
                 queue_delayed_work(rds_wq, &conn->c_send_w, 0);
 
 out:
diff --git a/net/rds/threads.c b/net/rds/threads.c
index 454aa6d23327..4a323045719b 100644
--- a/net/rds/threads.c
+++ b/net/rds/threads.c
@@ -71,9 +71,9 @@
 struct workqueue_struct *rds_wq;
 EXPORT_SYMBOL_GPL(rds_wq);
 
-void rds_connect_complete(struct rds_connection *conn)
+void rds_connect_path_complete(struct rds_connection *conn, int curr)
 {
-        if (!rds_conn_transition(conn, RDS_CONN_CONNECTING, RDS_CONN_UP)) {
+        if (!rds_conn_transition(conn, curr, RDS_CONN_UP)) {
                 printk(KERN_WARNING "%s: Cannot transition to state UP, "
                                 "current state is %d\n",
                                 __func__,
@@ -90,6 +90,12 @@ void rds_connect_complete(struct rds_connection *conn)
         queue_delayed_work(rds_wq, &conn->c_send_w, 0);
         queue_delayed_work(rds_wq, &conn->c_recv_w, 0);
 }
+EXPORT_SYMBOL_GPL(rds_connect_path_complete);
+
+void rds_connect_complete(struct rds_connection *conn)
+{
+        rds_connect_path_complete(conn, RDS_CONN_CONNECTING);
+}
 EXPORT_SYMBOL_GPL(rds_connect_complete);
 
 /*
diff --git a/net/rds/transport.c b/net/rds/transport.c
index f3afd1d60d3c..2ffd3e30c643 100644
--- a/net/rds/transport.c
+++ b/net/rds/transport.c
@@ -140,8 +140,7 @@ unsigned int rds_trans_stats_info_copy(struct rds_info_iterator *iter,
         rds_info_iter_unmap(iter);
         down_read(&rds_trans_sem);
 
-        for (i = 0; i < RDS_TRANS_COUNT; i++)
-        {
+        for (i = 0; i < RDS_TRANS_COUNT; i++) {
                 trans = transports[i];
                 if (!trans || !trans->stats_info_copy)
                         continue;
diff --git a/net/rxrpc/rxkad.c b/net/rxrpc/rxkad.c
index 6b726a046a7d..bab56ed649ba 100644
--- a/net/rxrpc/rxkad.c
+++ b/net/rxrpc/rxkad.c
@@ -1162,9 +1162,7 @@ static int rxkad_init(void)
         /* pin the cipher we need so that the crypto layer doesn't invoke
          * keventd to go get it */
         rxkad_ci = crypto_alloc_skcipher("pcbc(fcrypt)", 0, CRYPTO_ALG_ASYNC);
-        if (IS_ERR(rxkad_ci))
-                return PTR_ERR(rxkad_ci);
-        return 0;
+        return PTR_ERR_OR_ZERO(rxkad_ci);
 }
 
 /*
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index 336774a535c3..c7a0b0d481c0 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -1118,7 +1118,7 @@ tc_dump_action(struct sk_buff *skb, struct netlink_callback *cb)
                 nla_nest_end(skb, nest);
                 ret = skb->len;
         } else
-                nla_nest_cancel(skb, nest);
+                nlmsg_trim(skb, b);
 
         nlh->nlmsg_len = skb_tail_pointer(skb) - b;
         if (NETLINK_CB(cb->skb).portid && ret)
diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c
index 658046dfe02d..ea4a2fef1b71 100644
--- a/net/sched/act_ife.c
+++ b/net/sched/act_ife.c
@@ -106,9 +106,9 @@ int ife_get_meta_u16(struct sk_buff *skb, struct tcf_meta_info *mi)
 }
 EXPORT_SYMBOL_GPL(ife_get_meta_u16);
 
-int ife_alloc_meta_u32(struct tcf_meta_info *mi, void *metaval)
+int ife_alloc_meta_u32(struct tcf_meta_info *mi, void *metaval, gfp_t gfp)
 {
-        mi->metaval = kmemdup(metaval, sizeof(u32), GFP_KERNEL);
+        mi->metaval = kmemdup(metaval, sizeof(u32), gfp);
         if (!mi->metaval)
                 return -ENOMEM;
 
@@ -116,9 +116,9 @@ int ife_alloc_meta_u32(struct tcf_meta_info *mi, void *metaval)
 }
 EXPORT_SYMBOL_GPL(ife_alloc_meta_u32);
 
-int ife_alloc_meta_u16(struct tcf_meta_info *mi, void *metaval)
+int ife_alloc_meta_u16(struct tcf_meta_info *mi, void *metaval, gfp_t gfp)
 {
-        mi->metaval = kmemdup(metaval, sizeof(u16), GFP_KERNEL);
+        mi->metaval = kmemdup(metaval, sizeof(u16), gfp);
         if (!mi->metaval)
                 return -ENOMEM;
 
@@ -240,10 +240,10 @@ static int ife_validate_metatype(struct tcf_meta_ops *ops, void *val, int len)
 }
 
 /* called when adding new meta information
- * under ife->tcf_lock
+ * under ife->tcf_lock for existing action
 */
 static int load_metaops_and_vet(struct tcf_ife_info *ife, u32 metaid,
-                                void *val, int len)
+                                void *val, int len, bool exists)
 {
         struct tcf_meta_ops *ops = find_ife_oplist(metaid);
         int ret = 0;
@@ -251,11 +251,13 @@ static int load_metaops_and_vet(struct tcf_ife_info *ife, u32 metaid,
         if (!ops) {
                 ret = -ENOENT;
 #ifdef CONFIG_MODULES
-                spin_unlock_bh(&ife->tcf_lock);
+                if (exists)
+                        spin_unlock_bh(&ife->tcf_lock);
                 rtnl_unlock();
                 request_module("ifemeta%u", metaid);
                 rtnl_lock();
-                spin_lock_bh(&ife->tcf_lock);
+                if (exists)
+                        spin_lock_bh(&ife->tcf_lock);
                 ops = find_ife_oplist(metaid);
 #endif
         }
@@ -272,10 +274,10 @@ static int load_metaops_and_vet(struct tcf_ife_info *ife, u32 metaid,
 }
 
 /* called when adding new meta information
- * under ife->tcf_lock
+ * under ife->tcf_lock for existing action
 */
 static int add_metainfo(struct tcf_ife_info *ife, u32 metaid, void *metaval,
-                        int len)
+                        int len, bool atomic)
 {
         struct tcf_meta_info *mi = NULL;
         struct tcf_meta_ops *ops = find_ife_oplist(metaid);
@@ -284,7 +286,7 @@ static int add_metainfo(struct tcf_ife_info *ife, u32 metaid, void *metaval,
         if (!ops)
                 return -ENOENT;
 
-        mi = kzalloc(sizeof(*mi), GFP_KERNEL);
+        mi = kzalloc(sizeof(*mi), atomic ? GFP_ATOMIC : GFP_KERNEL);
         if (!mi) {
                 /*put back what find_ife_oplist took */
                 module_put(ops->owner);
@@ -294,7 +296,7 @@ static int add_metainfo(struct tcf_ife_info *ife, u32 metaid, void *metaval,
         mi->metaid = metaid;
         mi->ops = ops;
         if (len > 0) {
-                ret = ops->alloc(mi, metaval);
+                ret = ops->alloc(mi, metaval, atomic ? GFP_ATOMIC : GFP_KERNEL);
                 if (ret != 0) {
                         kfree(mi);
                         module_put(ops->owner);
@@ -313,11 +315,13 @@ static int use_all_metadata(struct tcf_ife_info *ife)
         int rc = 0;
         int installed = 0;
 
+        read_lock(&ife_mod_lock);
         list_for_each_entry(o, &ifeoplist, list) {
-                rc = add_metainfo(ife, o->metaid, NULL, 0);
+                rc = add_metainfo(ife, o->metaid, NULL, 0, true);
                 if (rc == 0)
                         installed += 1;
         }
+        read_unlock(&ife_mod_lock);
 
         if (installed)
                 return 0;
@@ -385,8 +389,9 @@ static void tcf_ife_cleanup(struct tc_action *a, int bind)
         spin_unlock_bh(&ife->tcf_lock);
 }
 
-/* under ife->tcf_lock */
-static int populate_metalist(struct tcf_ife_info *ife, struct nlattr **tb)
+/* under ife->tcf_lock for existing action */
+static int populate_metalist(struct tcf_ife_info *ife, struct nlattr **tb,
+                             bool exists)
 {
         int len = 0;
         int rc = 0;
@@ -398,11 +403,11 @@ static int populate_metalist(struct tcf_ife_info *ife, struct nlattr **tb)
                         val = nla_data(tb[i]);
                         len = nla_len(tb[i]);
 
-                        rc = load_metaops_and_vet(ife, i, val, len);
+                        rc = load_metaops_and_vet(ife, i, val, len, exists);
                         if (rc != 0)
                                 return rc;
 
-                        rc = add_metainfo(ife, i, val, len);
+                        rc = add_metainfo(ife, i, val, len, exists);
                         if (rc)
                                 return rc;
                 }
@@ -474,7 +479,8 @@ static int tcf_ife_init(struct net *net, struct nlattr *nla,
                         saddr = nla_data(tb[TCA_IFE_SMAC]);
         }
 
-        spin_lock_bh(&ife->tcf_lock);
+        if (exists)
+                spin_lock_bh(&ife->tcf_lock);
         ife->tcf_action = parm->action;
 
         if (parm->flags & IFE_ENCODE) {
@@ -504,11 +510,12 @@ metadata_parse_err:
                         if (ret == ACT_P_CREATED)
                                 _tcf_ife_cleanup(a, bind);
 
-                        spin_unlock_bh(&ife->tcf_lock);
+                        if (exists)
+                                spin_unlock_bh(&ife->tcf_lock);
                         return err;
                 }
 
-                err = populate_metalist(ife, tb2);
+                err = populate_metalist(ife, tb2, exists);
                 if (err)
                         goto metadata_parse_err;
 
@@ -523,12 +530,14 @@ metadata_parse_err:
                         if (ret == ACT_P_CREATED)
                                 _tcf_ife_cleanup(a, bind);
 
-                        spin_unlock_bh(&ife->tcf_lock);
+                        if (exists)
+                                spin_unlock_bh(&ife->tcf_lock);
                         return err;
                 }
         }
 
-        spin_unlock_bh(&ife->tcf_lock);
+        if (exists)
+                spin_unlock_bh(&ife->tcf_lock);
 
         if (ret == ACT_P_CREATED)
                 tcf_hash_insert(tn, a);
diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
index 9f002ada7074..d4bd19ee5822 100644
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -121,10 +121,13 @@ static int __tcf_ipt_init(struct tc_action_net *tn, struct nlattr *nla,
         }
 
         td = (struct xt_entry_target *)nla_data(tb[TCA_IPT_TARG]);
-        if (nla_len(tb[TCA_IPT_TARG]) < td->u.target_size)
+        if (nla_len(tb[TCA_IPT_TARG]) < td->u.target_size) {
+                if (exists)
+                        tcf_hash_release(a, bind);
                 return -EINVAL;
+        }
 
-        if (!tcf_hash_check(tn, index, a, bind)) {
+        if (!exists) {
                 ret = tcf_hash_create(tn, index, est, a, sizeof(*ipt), bind,
                                       false);
                 if (ret)
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index b884dae692a1..c557789765dc 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -38,7 +38,7 @@ struct tcf_police {
         bool                    peak_present;
 };
 #define to_police(pc)   \
-        container_of(pc, struct tcf_police, common)
+        container_of(pc->priv, struct tcf_police, common)
 
 #define POL_TAB_MASK     15
 
@@ -119,14 +119,12 @@ static int tcf_act_police_locate(struct net *net, struct nlattr *nla,
                                  struct nlattr *est, struct tc_action *a,
                                  int ovr, int bind)
 {
-        unsigned int h;
         int ret = 0, err;
         struct nlattr *tb[TCA_POLICE_MAX + 1];
         struct tc_police *parm;
         struct tcf_police *police;
         struct qdisc_rate_table *R_tab = NULL, *P_tab = NULL;
         struct tc_action_net *tn = net_generic(net, police_net_id);
-        struct tcf_hashinfo *hinfo = tn->hinfo;
         int size;
 
         if (nla == NULL)
@@ -145,7 +143,7 @@ static int tcf_act_police_locate(struct net *net, struct nlattr *nla,
 
         if (parm->index) {
                 if (tcf_hash_search(tn, a, parm->index)) {
-                        police = to_police(a->priv);
+                        police = to_police(a);
                         if (bind) {
                                 police->tcf_bindcnt += 1;
                                 police->tcf_refcnt += 1;
@@ -156,16 +154,15 @@ static int tcf_act_police_locate(struct net *net, struct nlattr *nla,
                         /* not replacing */
                         return -EEXIST;
                 }
+        } else {
+                ret = tcf_hash_create(tn, parm->index, NULL, a,
+                                      sizeof(*police), bind, false);
+                if (ret)
+                        return ret;
+                ret = ACT_P_CREATED;
         }
 
-        police = kzalloc(sizeof(*police), GFP_KERNEL);
-        if (police == NULL)
-                return -ENOMEM;
-        ret = ACT_P_CREATED;
-        police->tcf_refcnt = 1;
-        spin_lock_init(&police->tcf_lock);
-        if (bind)
-                police->tcf_bindcnt = 1;
+        police = to_police(a);
 override:
         if (parm->rate.rate) {
                 err = -ENOMEM;
@@ -237,16 +234,8 @@ override:
                 return ret;
 
         police->tcfp_t_c = ktime_get_ns();
-        police->tcf_index = parm->index ? parm->index :
-                tcf_hash_new_index(tn);
-        police->tcf_tm.install = jiffies;
-        police->tcf_tm.lastuse = jiffies;
-        h = tcf_hash(police->tcf_index, POL_TAB_MASK);
-        spin_lock_bh(&hinfo->lock);
-        hlist_add_head(&police->tcf_head, &hinfo->htab[h]);
-        spin_unlock_bh(&hinfo->lock);
+        tcf_hash_insert(tn, a);
 
-        a->priv = police;
         return ret;
 
 failure_unlock:
@@ -255,7 +244,7 @@ failure:
         qdisc_put_rtab(P_tab);
         qdisc_put_rtab(R_tab);
         if (ret == ACT_P_CREATED)
-                kfree(police);
+                tcf_hash_cleanup(a, est);
         return err;
 }
 
diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
index 730aacafc22d..b3b7978f4182 100644
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -171,7 +171,7 @@ static void fl_hw_destroy_filter(struct tcf_proto *tp, unsigned long cookie)
         struct tc_cls_flower_offload offload = {0};
         struct tc_to_netdev tc;
 
-        if (!tc_should_offload(dev, 0))
+        if (!tc_should_offload(dev, tp, 0))
                 return;
 
         offload.command = TC_CLSFLOWER_DESTROY;
@@ -194,7 +194,7 @@ static void fl_hw_replace_filter(struct tcf_proto *tp,
         struct tc_cls_flower_offload offload = {0};
         struct tc_to_netdev tc;
 
-        if (!tc_should_offload(dev, flags))
+        if (!tc_should_offload(dev, tp, flags))
                 return;
 
         offload.command = TC_CLSFLOWER_REPLACE;
@@ -216,7 +216,7 @@ static void fl_hw_update_stats(struct tcf_proto *tp, struct cls_fl_filter *f)
         struct tc_cls_flower_offload offload = {0};
         struct tc_to_netdev tc;
 
-        if (!tc_should_offload(dev, 0))
+        if (!tc_should_offload(dev, tp, 0))
                 return;
 
         offload.command = TC_CLSFLOWER_STATS;
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index 079b43b3c5d2..ffe593efe930 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -440,7 +440,7 @@ static void u32_remove_hw_knode(struct tcf_proto *tp, u32 handle)
         offload.type = TC_SETUP_CLSU32;
         offload.cls_u32 = &u32_offload;
 
-        if (tc_should_offload(dev, 0)) {
+        if (tc_should_offload(dev, tp, 0)) {
                 offload.cls_u32->command = TC_CLSU32_DELETE_KNODE;
                 offload.cls_u32->knode.handle = handle;
                 dev->netdev_ops->ndo_setup_tc(dev, tp->q->handle,
@@ -457,20 +457,21 @@ static int u32_replace_hw_hnode(struct tcf_proto *tp,
         struct tc_to_netdev offload;
         int err;
 
+        if (!tc_should_offload(dev, tp, flags))
+                return tc_skip_sw(flags) ? -EINVAL : 0;
+
         offload.type = TC_SETUP_CLSU32;
         offload.cls_u32 = &u32_offload;
 
-        if (tc_should_offload(dev, flags)) {
-                offload.cls_u32->command = TC_CLSU32_NEW_HNODE;
-                offload.cls_u32->hnode.divisor = h->divisor;
-                offload.cls_u32->hnode.handle = h->handle;
-                offload.cls_u32->hnode.prio = h->prio;
+        offload.cls_u32->command = TC_CLSU32_NEW_HNODE;
+        offload.cls_u32->hnode.divisor = h->divisor;
+        offload.cls_u32->hnode.handle = h->handle;
+        offload.cls_u32->hnode.prio = h->prio;
 
-                err = dev->netdev_ops->ndo_setup_tc(dev, tp->q->handle,
-                                                    tp->protocol, &offload);
-                if (tc_skip_sw(flags))
-                        return err;
-        }
+        err = dev->netdev_ops->ndo_setup_tc(dev, tp->q->handle,
+                                            tp->protocol, &offload);
+        if (tc_skip_sw(flags))
+                return err;
 
         return 0;
 }
@@ -484,7 +485,7 @@ static void u32_clear_hw_hnode(struct tcf_proto *tp, struct tc_u_hnode *h)
         offload.type = TC_SETUP_CLSU32;
         offload.cls_u32 = &u32_offload;
 
-        if (tc_should_offload(dev, 0)) {
+        if (tc_should_offload(dev, tp, 0)) {
                 offload.cls_u32->command = TC_CLSU32_DELETE_HNODE;
                 offload.cls_u32->hnode.divisor = h->divisor;
                 offload.cls_u32->hnode.handle = h->handle;
@@ -507,27 +508,28 @@ static int u32_replace_hw_knode(struct tcf_proto *tp,
         offload.type = TC_SETUP_CLSU32;
         offload.cls_u32 = &u32_offload;
 
-        if (tc_should_offload(dev, flags)) {
-                offload.cls_u32->command = TC_CLSU32_REPLACE_KNODE;
-                offload.cls_u32->knode.handle = n->handle;
-                offload.cls_u32->knode.fshift = n->fshift;
+        if (!tc_should_offload(dev, tp, flags))
+                return tc_skip_sw(flags) ? -EINVAL : 0;
+
+        offload.cls_u32->command = TC_CLSU32_REPLACE_KNODE;
+        offload.cls_u32->knode.handle = n->handle;
+        offload.cls_u32->knode.fshift = n->fshift;
 #ifdef CONFIG_CLS_U32_MARK
-                offload.cls_u32->knode.val = n->val;
-                offload.cls_u32->knode.mask = n->mask;
+        offload.cls_u32->knode.val = n->val;
+        offload.cls_u32->knode.mask = n->mask;
 #else
-                offload.cls_u32->knode.val = 0;
-                offload.cls_u32->knode.mask = 0;
+        offload.cls_u32->knode.val = 0;
+        offload.cls_u32->knode.mask = 0;
 #endif
-                offload.cls_u32->knode.sel = &n->sel;
-                offload.cls_u32->knode.exts = &n->exts;
-                if (n->ht_down)
-                        offload.cls_u32->knode.link_handle = n->ht_down->handle;
-
-                err = dev->netdev_ops->ndo_setup_tc(dev, tp->q->handle,
-                                                    tp->protocol, &offload);
-                if (tc_skip_sw(flags))
-                        return err;
-        }
+        offload.cls_u32->knode.sel = &n->sel;
+        offload.cls_u32->knode.exts = &n->exts;
+        if (n->ht_down)
+                offload.cls_u32->knode.link_handle = n->ht_down->handle;
+
+        err = dev->netdev_ops->ndo_setup_tc(dev, tp->q->handle,
+                                            tp->protocol, &offload);
+        if (tc_skip_sw(flags))
+                return err;
 
         return 0;
 }
@@ -863,7 +865,7 @@ static int u32_change(struct net *net, struct sk_buff *in_skb,
         if (tb[TCA_U32_FLAGS]) {
                 flags = nla_get_u32(tb[TCA_U32_FLAGS]);
                 if (!tc_flags_valid(flags))
-                        return err;
+                        return -EINVAL;
         }
 
         n = (struct tc_u_knode *)*arg;
@@ -921,11 +923,17 @@ static int u32_change(struct net *net, struct sk_buff *in_skb,
                 ht->divisor = divisor;
                 ht->handle = handle;
                 ht->prio = tp->prio;
+
+                err = u32_replace_hw_hnode(tp, ht, flags);
+                if (err) {
+                        kfree(ht);
+                        return err;
+                }
+
                 RCU_INIT_POINTER(ht->next, tp_c->hlist);
                 rcu_assign_pointer(tp_c->hlist, ht);
                 *arg = (unsigned long)ht;
 
-                u32_replace_hw_hnode(tp, ht, flags);
                 return 0;
         }
 
diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
index a63e879e8975..bf8af2c43c2c 100644
--- a/net/sched/sch_drr.c
+++ b/net/sched/sch_drr.c
@@ -375,6 +375,7 @@ static int drr_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                 cl->deficit = cl->quantum;
         }
 
+        qdisc_qstats_backlog_inc(sch, skb);
         sch->q.qlen++;
         return err;
 }
@@ -407,6 +408,7 @@ static struct sk_buff *drr_dequeue(struct Qdisc *sch)
 
                         bstats_update(&cl->bstats, skb);
                         qdisc_bstats_update(sch, skb);
+                        qdisc_qstats_backlog_dec(sch, skb);
                         sch->q.qlen--;
                         return skb;
                 }
@@ -428,6 +430,7 @@ static unsigned int drr_drop(struct Qdisc *sch)
                 if (cl->qdisc->ops->drop) {
                         len = cl->qdisc->ops->drop(cl->qdisc);
                         if (len > 0) {
+                                sch->qstats.backlog -= len;
                                 sch->q.qlen--;
                                 if (cl->qdisc->q.qlen == 0)
                                         list_del(&cl->alist);
@@ -463,6 +466,7 @@ static void drr_reset_qdisc(struct Qdisc *sch)
                         qdisc_reset(cl->qdisc);
                 }
         }
+        sch->qstats.backlog = 0;
         sch->q.qlen = 0;
 }
 
diff --git a/net/sched/sch_fifo.c b/net/sched/sch_fifo.c
index 2177eac0a61e..2e4bd2c0a50c 100644
--- a/net/sched/sch_fifo.c
+++ b/net/sched/sch_fifo.c
@@ -37,14 +37,18 @@ static int pfifo_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 
 static int pfifo_tail_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 {
+        unsigned int prev_backlog;
+
         if (likely(skb_queue_len(&sch->q) < sch->limit))
                 return qdisc_enqueue_tail(skb, sch);
 
+        prev_backlog = sch->qstats.backlog;
         /* queue full, remove one skb to fulfill the limit */
         __qdisc_queue_drop_head(sch, &sch->q);
         qdisc_qstats_drop(sch);
         qdisc_enqueue_tail(skb, sch);
 
+        qdisc_tree_reduce_backlog(sch, 0, prev_backlog - sch->qstats.backlog);
         return NET_XMIT_CN;
 }
 
diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c
index 6883a8971562..da250b2e06ae 100644
--- a/net/sched/sch_fq_codel.c
+++ b/net/sched/sch_fq_codel.c
@@ -199,6 +199,7 @@ static int fq_codel_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         unsigned int idx, prev_backlog, prev_qlen;
         struct fq_codel_flow *flow;
         int uninitialized_var(ret);
+        unsigned int pkt_len;
         bool memory_limited;
 
         idx = fq_codel_classify(skb, sch, &ret);
@@ -230,6 +231,8 @@ static int fq_codel_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         prev_backlog = sch->qstats.backlog;
         prev_qlen = sch->q.qlen;
 
+        /* save this packet length as it might be dropped by fq_codel_drop() */
+        pkt_len = qdisc_pkt_len(skb);
         /* fq_codel_drop() is quite expensive, as it performs a linear search
          * in q->backlogs[] to find a fat flow.
          * So instead of dropping a single packet, drop half of its backlog
@@ -237,14 +240,23 @@ static int fq_codel_enqueue(struct sk_buff *skb, struct Qdisc *sch)
          */
         ret = fq_codel_drop(sch, q->drop_batch_size);
 
-        q->drop_overlimit += prev_qlen - sch->q.qlen;
+        prev_qlen -= sch->q.qlen;
+        prev_backlog -= sch->qstats.backlog;
+        q->drop_overlimit += prev_qlen;
         if (memory_limited)
-                q->drop_overmemory += prev_qlen - sch->q.qlen;
-        /* As we dropped packet(s), better let upper stack know this */
-        qdisc_tree_reduce_backlog(sch, prev_qlen - sch->q.qlen,
-                                  prev_backlog - sch->qstats.backlog);
+                q->drop_overmemory += prev_qlen;
 
-        return ret == idx ? NET_XMIT_CN : NET_XMIT_SUCCESS;
+        /* As we dropped packet(s), better let upper stack know this.
+         * If we dropped a packet for this flow, return NET_XMIT_CN,
+         * but in this case, our parents wont increase their backlogs.
+         */
+        if (ret == idx) {
+                qdisc_tree_reduce_backlog(sch, prev_qlen - 1,
+                                          prev_backlog - pkt_len);
+                return NET_XMIT_CN;
+        }
+        qdisc_tree_reduce_backlog(sch, prev_qlen, prev_backlog);
+        return NET_XMIT_SUCCESS;
 }
 
 /* This is the specific function called from codel_dequeue()
@@ -649,7 +661,7 @@ static int fq_codel_dump_class_stats(struct Qdisc *sch, unsigned long cl,
                 qs.backlog = q->backlogs[idx];
                 qs.drops = flow->dropped;
         }
-        if (gnet_stats_copy_queue(d, NULL, &qs, 0) < 0)
+        if (gnet_stats_copy_queue(d, NULL, &qs, qs.qlen) < 0)
                 return -1;
         if (idx < q->flows_cnt)
                 return gnet_stats_copy_app(d, &xstats, sizeof(xstats));
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 269dd71b3828..f9e0e9c03d0a 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -49,6 +49,7 @@ static inline int dev_requeue_skb(struct sk_buff *skb, struct Qdisc *q)
 {
         q->gso_skb = skb;
         q->qstats.requeues++;
+        qdisc_qstats_backlog_inc(q, skb);
         q->q.qlen++;    /* it's still part of the queue */
         __netif_schedule(q);
 
@@ -92,6 +93,7 @@ static struct sk_buff *dequeue_skb(struct Qdisc *q, bool *validate,
                 txq = skb_get_tx_queue(txq->dev, skb);
                 if (!netif_xmit_frozen_or_stopped(txq)) {
                         q->gso_skb = NULL;
+                        qdisc_qstats_backlog_dec(q, skb);
                         q->q.qlen--;
                 } else
                         skb = NULL;
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index d783d7cc3348..1ac9f9f03fe3 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -1529,6 +1529,7 @@ hfsc_reset_qdisc(struct Qdisc *sch)
         q->eligible = RB_ROOT;
         INIT_LIST_HEAD(&q->droplist);
         qdisc_watchdog_cancel(&q->watchdog);
+        sch->qstats.backlog = 0;
         sch->q.qlen = 0;
 }
 
@@ -1559,14 +1560,6 @@ hfsc_dump_qdisc(struct Qdisc *sch, struct sk_buff *skb)
         struct hfsc_sched *q = qdisc_priv(sch);
         unsigned char *b = skb_tail_pointer(skb);
         struct tc_hfsc_qopt qopt;
-        struct hfsc_class *cl;
-        unsigned int i;
-
-        sch->qstats.backlog = 0;
-        for (i = 0; i < q->clhash.hashsize; i++) {
-                hlist_for_each_entry(cl, &q->clhash.hash[i], cl_common.hnode)
-                        sch->qstats.backlog += cl->qdisc->qstats.backlog;
-        }
 
         qopt.defcls = q->defcls;
         if (nla_put(skb, TCA_OPTIONS, sizeof(qopt), &qopt))
@@ -1604,6 +1597,7 @@ hfsc_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         if (cl->qdisc->q.qlen == 1)
                 set_active(cl, qdisc_pkt_len(skb));
 
+        qdisc_qstats_backlog_inc(sch, skb);
         sch->q.qlen++;
 
         return NET_XMIT_SUCCESS;
@@ -1672,6 +1666,7 @@ hfsc_dequeue(struct Qdisc *sch)
 
         qdisc_unthrottled(sch);
         qdisc_bstats_update(sch, skb);
+        qdisc_qstats_backlog_dec(sch, skb);
         sch->q.qlen--;
 
         return skb;
@@ -1695,6 +1690,7 @@ hfsc_drop(struct Qdisc *sch)
                         }
                         cl->qstats.drops++;
                         qdisc_qstats_drop(sch);
+                        sch->qstats.backlog -= len;
                         sch->q.qlen--;
                         return len;
                 }
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index d4b4218af6b1..62f9d8100c6e 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -1007,7 +1007,9 @@ static void htb_work_func(struct work_struct *work)
         struct htb_sched *q = container_of(work, struct htb_sched, work);
         struct Qdisc *sch = q->watchdog.qdisc;
 
+        rcu_read_lock();
         __netif_schedule(qdisc_root(sch));
+        rcu_read_unlock();
 }
 
 static int htb_init(struct Qdisc *sch, struct nlattr *opt)
diff --git a/net/sched/sch_ingress.c b/net/sched/sch_ingress.c
index 10adbc617905..8fe6999b642a 100644
--- a/net/sched/sch_ingress.c
+++ b/net/sched/sch_ingress.c
@@ -27,6 +27,11 @@ static unsigned long ingress_get(struct Qdisc *sch, u32 classid)
         return TC_H_MIN(classid) + 1;
 }
 
+static bool ingress_cl_offload(u32 classid)
+{
+        return true;
+}
+
 static unsigned long ingress_bind_filter(struct Qdisc *sch,
                                          unsigned long parent, u32 classid)
 {
@@ -86,6 +91,7 @@ static const struct Qdisc_class_ops ingress_class_ops = {
         .put            =       ingress_put,
         .walk           =       ingress_walk,
         .tcf_chain      =       ingress_find_tcf,
+        .tcf_cl_offload =       ingress_cl_offload,
         .bind_tcf       =       ingress_bind_filter,
         .unbind_tcf     =       ingress_put,
 };
@@ -110,6 +116,11 @@ static unsigned long clsact_get(struct Qdisc *sch, u32 classid)
         }
 }
 
+static bool clsact_cl_offload(u32 classid)
+{
+        return TC_H_MIN(classid) == TC_H_MIN(TC_H_MIN_INGRESS);
+}
+
 static unsigned long clsact_bind_filter(struct Qdisc *sch,
                                         unsigned long parent, u32 classid)
 {
@@ -158,6 +169,7 @@ static const struct Qdisc_class_ops clsact_class_ops = {
         .put            =       ingress_put,
         .walk           =       ingress_walk,
         .tcf_chain      =       clsact_find_tcf,
+        .tcf_cl_offload =       clsact_cl_offload,
         .bind_tcf       =       clsact_bind_filter,
         .unbind_tcf     =       ingress_put,
 };
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 205bed00dd34..178f1630a036 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -650,14 +650,14 @@ deliver:
 #endif
 
                         if (q->qdisc) {
+                                unsigned int pkt_len = qdisc_pkt_len(skb);
                                 int err = qdisc_enqueue(skb, q->qdisc);
 
-                                if (unlikely(err != NET_XMIT_SUCCESS)) {
-                                        if (net_xmit_drop_count(err)) {
-                                                qdisc_qstats_drop(sch);
-                                                qdisc_tree_reduce_backlog(sch, 1,
-                                                                          qdisc_pkt_len(skb));
-                                        }
+                                if (err != NET_XMIT_SUCCESS &&
+                                    net_xmit_drop_count(err)) {
+                                        qdisc_qstats_drop(sch);
+                                        qdisc_tree_reduce_backlog(sch, 1,
+                                                                  pkt_len);
                                 }
                                 goto tfifo_dequeue;
                         }
diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
index fee1b15506b2..a356450b747b 100644
--- a/net/sched/sch_prio.c
+++ b/net/sched/sch_prio.c
@@ -85,6 +85,7 @@ prio_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 
         ret = qdisc_enqueue(skb, qdisc);
         if (ret == NET_XMIT_SUCCESS) {
+                qdisc_qstats_backlog_inc(sch, skb);
                 sch->q.qlen++;
                 return NET_XMIT_SUCCESS;
         }
@@ -117,6 +118,7 @@ static struct sk_buff *prio_dequeue(struct Qdisc *sch)
                 struct sk_buff *skb = qdisc_dequeue_peeked(qdisc);
                 if (skb) {
                         qdisc_bstats_update(sch, skb);
+                        qdisc_qstats_backlog_dec(sch, skb);
                         sch->q.qlen--;
                         return skb;
                 }
@@ -135,6 +137,7 @@ static unsigned int prio_drop(struct Qdisc *sch)
         for (prio = q->bands-1; prio >= 0; prio--) {
                 qdisc = q->queues[prio];
                 if (qdisc->ops->drop && (len = qdisc->ops->drop(qdisc)) != 0) {
+                        sch->qstats.backlog -= len;
                         sch->q.qlen--;
                         return len;
                 }
@@ -151,6 +154,7 @@ prio_reset(struct Qdisc *sch)
 
         for (prio = 0; prio < q->bands; prio++)
                 qdisc_reset(q->queues[prio]);
+        sch->qstats.backlog = 0;
         sch->q.qlen = 0;
 }
 
@@ -168,8 +172,9 @@ prio_destroy(struct Qdisc *sch)
 static int prio_tune(struct Qdisc *sch, struct nlattr *opt)
 {
         struct prio_sched_data *q = qdisc_priv(sch);
+        struct Qdisc *queues[TCQ_PRIO_BANDS];
+        int oldbands = q->bands, i;
         struct tc_prio_qopt *qopt;
-        int i;
 
         if (nla_len(opt) < sizeof(*qopt))
                 return -EINVAL;
@@ -183,62 +188,42 @@ static int prio_tune(struct Qdisc *sch, struct nlattr *opt)
                         return -EINVAL;
         }
 
+        /* Before commit, make sure we can allocate all new qdiscs */
+        for (i = oldbands; i < qopt->bands; i++) {
+                queues[i] = qdisc_create_dflt(sch->dev_queue, &pfifo_qdisc_ops,
+                                              TC_H_MAKE(sch->handle, i + 1));
+                if (!queues[i]) {
+                        while (i > oldbands)
+                                qdisc_destroy(queues[--i]);
+                        return -ENOMEM;
+                }
+        }
+
         sch_tree_lock(sch);
         q->bands = qopt->bands;
         memcpy(q->prio2band, qopt->priomap, TC_PRIO_MAX+1);
 
-        for (i = q->bands; i < TCQ_PRIO_BANDS; i++) {
+        for (i = q->bands; i < oldbands; i++) {
                 struct Qdisc *child = q->queues[i];
-                q->queues[i] = &noop_qdisc;
-                if (child != &noop_qdisc) {
-                        qdisc_tree_reduce_backlog(child, child->q.qlen, child->qstats.backlog);
-                        qdisc_destroy(child);
-                }
-        }
-        sch_tree_unlock(sch);
 
-        for (i = 0; i < q->bands; i++) {
-                if (q->queues[i] == &noop_qdisc) {
-                        struct Qdisc *child, *old;
-
-                        child = qdisc_create_dflt(sch->dev_queue,
-                                                  &pfifo_qdisc_ops,
-                                                  TC_H_MAKE(sch->handle, i + 1));
-                        if (child) {
-                                sch_tree_lock(sch);
-                                old = q->queues[i];
-                                q->queues[i] = child;
-
-                                if (old != &noop_qdisc) {
-                                        qdisc_tree_reduce_backlog(old,
-                                                                  old->q.qlen,
-                                                                  old->qstats.backlog);
-                                        qdisc_destroy(old);
-                                }
-                                sch_tree_unlock(sch);
-                        }
-                }
+                qdisc_tree_reduce_backlog(child, child->q.qlen,
+                                          child->qstats.backlog);
+                qdisc_destroy(child);
         }
+
+        for (i = oldbands; i < q->bands; i++)
+                q->queues[i] = queues[i];
+
+        sch_tree_unlock(sch);
         return 0;
 }
 
 static int prio_init(struct Qdisc *sch, struct nlattr *opt)
 {
-        struct prio_sched_data *q = qdisc_priv(sch);
-        int i;
-
-        for (i = 0; i < TCQ_PRIO_BANDS; i++)
-                q->queues[i] = &noop_qdisc;
-
-        if (opt == NULL) {
+        if (!opt)
                 return -EINVAL;
-        } else {
-                int err;
 
-                if ((err = prio_tune(sch, opt)) != 0)
-                        return err;
-        }
-        return 0;
+        return prio_tune(sch, opt);
 }
 
 static int prio_dump(struct Qdisc *sch, struct sk_buff *skb)
diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
index 8d2d8d953432..f18857febdad 100644
--- a/net/sched/sch_qfq.c
+++ b/net/sched/sch_qfq.c
@@ -1235,8 +1235,10 @@ static int qfq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                          cl->agg->lmax, qdisc_pkt_len(skb), cl->common.classid);
                 err = qfq_change_agg(sch, cl, cl->agg->class_weight,
                                      qdisc_pkt_len(skb));
-                if (err)
-                        return err;
+                if (err) {
+                        cl->qstats.drops++;
+                        return qdisc_drop(skb, sch);
+                }
         }
 
         err = qdisc_enqueue(skb, cl->qdisc);
diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c
index 8c0508c0e287..91578bdd378c 100644
--- a/net/sched/sch_red.c
+++ b/net/sched/sch_red.c
@@ -97,6 +97,7 @@ static int red_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 
         ret = qdisc_enqueue(skb, child);
         if (likely(ret == NET_XMIT_SUCCESS)) {
+                qdisc_qstats_backlog_inc(sch, skb);
                 sch->q.qlen++;
         } else if (net_xmit_drop_count(ret)) {
                 q->stats.pdrop++;
@@ -118,6 +119,7 @@ static struct sk_buff *red_dequeue(struct Qdisc *sch)
         skb = child->dequeue(child);
         if (skb) {
                 qdisc_bstats_update(sch, skb);
+                qdisc_qstats_backlog_dec(sch, skb);
                 sch->q.qlen--;
         } else {
                 if (!red_is_idling(&q->vars))
@@ -143,6 +145,7 @@ static unsigned int red_drop(struct Qdisc *sch)
         if (child->ops->drop && (len = child->ops->drop(child)) > 0) {
                 q->stats.other++;
                 qdisc_qstats_drop(sch);
+                sch->qstats.backlog -= len;
                 sch->q.qlen--;
                 return len;
         }
@@ -158,6 +161,7 @@ static void red_reset(struct Qdisc *sch)
         struct red_sched_data *q = qdisc_priv(sch);
 
         qdisc_reset(q->qdisc);
+        sch->qstats.backlog = 0;
         sch->q.qlen = 0;
         red_restart(&q->vars);
 }
diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
index 83b90b584fae..3161e491990b 100644
--- a/net/sched/sch_tbf.c
+++ b/net/sched/sch_tbf.c
@@ -207,6 +207,7 @@ static int tbf_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                 return ret;
         }
 
+        qdisc_qstats_backlog_inc(sch, skb);
         sch->q.qlen++;
         return NET_XMIT_SUCCESS;
 }
@@ -217,6 +218,7 @@ static unsigned int tbf_drop(struct Qdisc *sch)
         unsigned int len = 0;
 
         if (q->qdisc->ops->drop && (len = q->qdisc->ops->drop(q->qdisc)) != 0) {
+                sch->qstats.backlog -= len;
                 sch->q.qlen--;
                 qdisc_qstats_drop(sch);
         }
@@ -263,6 +265,7 @@ static struct sk_buff *tbf_dequeue(struct Qdisc *sch)
                         q->t_c = now;
                         q->tokens = toks;
                         q->ptokens = ptoks;
+                        qdisc_qstats_backlog_dec(sch, skb);
                         sch->q.qlen--;
                         qdisc_unthrottled(sch);
                         qdisc_bstats_update(sch, skb);
@@ -294,6 +297,7 @@ static void tbf_reset(struct Qdisc *sch)
         struct tbf_sched_data *q = qdisc_priv(sch);
 
         qdisc_reset(q->qdisc);
+        sch->qstats.backlog = 0;
         sch->q.qlen = 0;
         q->t_c = ktime_get_ns();
         q->tokens = q->buffer;
diff --git a/net/sctp/sctp_diag.c b/net/sctp/sctp_diag.c
index 1ce724b87618..f69edcf219e5 100644
--- a/net/sctp/sctp_diag.c
+++ b/net/sctp/sctp_diag.c
@@ -3,12 +3,6 @@
 #include <linux/sock_diag.h>
 #include <net/sctp/sctp.h>
 
-extern void inet_diag_msg_common_fill(struct inet_diag_msg *r,
-                                      struct sock *sk);
-extern int inet_diag_msg_attrs_fill(struct sock *sk, struct sk_buff *skb,
-                                    struct inet_diag_msg *r, int ext,
-                                    struct user_namespace *user_ns);
-
 static void sctp_diag_get_info(struct sock *sk, struct inet_diag_msg *r,
                                void *info);
 
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 06b4df9faaa1..2808d550d273 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -446,16 +446,27 @@ out_no_rpciod:
         return ERR_PTR(err);
 }
 
-struct rpc_clnt *rpc_create_xprt(struct rpc_create_args *args,
+static struct rpc_clnt *rpc_create_xprt(struct rpc_create_args *args,
                                         struct rpc_xprt *xprt)
 {
         struct rpc_clnt *clnt = NULL;
         struct rpc_xprt_switch *xps;
 
-        xps = xprt_switch_alloc(xprt, GFP_KERNEL);
-        if (xps == NULL)
-                return ERR_PTR(-ENOMEM);
-
+        if (args->bc_xprt && args->bc_xprt->xpt_bc_xps) {
+                WARN_ON(args->protocol != XPRT_TRANSPORT_BC_TCP);
+                xps = args->bc_xprt->xpt_bc_xps;
+                xprt_switch_get(xps);
+        } else {
+                xps = xprt_switch_alloc(xprt, GFP_KERNEL);
+                if (xps == NULL) {
+                        xprt_put(xprt);
+                        return ERR_PTR(-ENOMEM);
+                }
+                if (xprt->bc_xprt) {
+                        xprt_switch_get(xps);
+                        xprt->bc_xprt->xpt_bc_xps = xps;
+                }
+        }
         clnt = rpc_new_client(args, xps, xprt, NULL);
         if (IS_ERR(clnt))
                 return clnt;
@@ -483,7 +494,6 @@ struct rpc_clnt *rpc_create_xprt(struct rpc_create_args *args,
 
         return clnt;
 }
-EXPORT_SYMBOL_GPL(rpc_create_xprt);
 
 /**
  * rpc_create - create an RPC client and transport with one call
@@ -509,6 +519,15 @@ struct rpc_clnt *rpc_create(struct rpc_create_args *args)
         };
         char servername[48];
 
+        if (args->bc_xprt) {
+                WARN_ON(args->protocol != XPRT_TRANSPORT_BC_TCP);
+                xprt = args->bc_xprt->xpt_bc_xprt;
+                if (xprt) {
+                        xprt_get(xprt);
+                        return rpc_create_xprt(args, xprt);
+                }
+        }
+
         if (args->flags & RPC_CLNT_CREATE_INFINITE_SLOTS)
                 xprtargs.flags |= XPRT_CREATE_INFINITE_SLOTS;
         if (args->flags & RPC_CLNT_CREATE_NO_IDLE_TIMEOUT)
diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index f5572e31d518..4f01f63102ee 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -136,6 +136,8 @@ static void svc_xprt_free(struct kref *kref)
         /* See comment on corresponding get in xs_setup_bc_tcp(): */
         if (xprt->xpt_bc_xprt)
                 xprt_put(xprt->xpt_bc_xprt);
+        if (xprt->xpt_bc_xps)
+                xprt_switch_put(xprt->xpt_bc_xps);
         xprt->xpt_ops->xpo_free(xprt);
         module_put(owner);
 }
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 2d3e0c42361e..7e2b2fa189c3 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -3057,6 +3057,7 @@ static struct rpc_xprt *xs_setup_bc_tcp(struct xprt_create *args)
                 return xprt;
 
         args->bc_xprt->xpt_bc_xprt = NULL;
+        args->bc_xprt->xpt_bc_xps = NULL;
         xprt_put(xprt);
         ret = ERR_PTR(-EINVAL);
 out_err:
diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index 6f11c62bc8f9..bf8f05c3eb82 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c
@@ -405,7 +405,7 @@ int tipc_l2_send_msg(struct net *net, struct sk_buff *skb,
                 return 0;
 
         /* Send RESET message even if bearer is detached from device */
-        tipc_ptr = rtnl_dereference(dev->tipc_ptr);
+        tipc_ptr = rcu_dereference_rtnl(dev->tipc_ptr);
         if (unlikely(!tipc_ptr && !msg_is_reset(buf_msg(skb))))
                 goto drop;
 
diff --git a/net/tipc/link.c b/net/tipc/link.c
index 7059c94f33c5..67b6ab9f4c8d 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -704,7 +704,8 @@ static void link_profile_stats(struct tipc_link *l)
  */
 int tipc_link_timeout(struct tipc_link *l, struct sk_buff_head *xmitq)
 {
-        int mtyp, rc = 0;
+        int mtyp = 0;
+        int rc = 0;
         bool state = false;
         bool probe = false;
         bool setup = false;
diff --git a/net/tipc/msg.c b/net/tipc/msg.c
index 8740930f0787..17201aa8423d 100644
--- a/net/tipc/msg.c
+++ b/net/tipc/msg.c
@@ -41,6 +41,8 @@
 #include "name_table.h"
 
 #define MAX_FORWARD_SIZE 1024
+#define BUF_HEADROOM (LL_MAX_HEADER + 48)
+#define BUF_TAILROOM 16
 
 static unsigned int align(unsigned int i)
 {
@@ -505,6 +507,10 @@ bool tipc_msg_reverse(u32 own_node,  struct sk_buff **skb, int err)
                 msg_set_hdr_sz(hdr, BASIC_H_SIZE);
         }
 
+        if (skb_cloned(_skb) &&
+            pskb_expand_head(_skb, BUF_HEADROOM, BUF_TAILROOM, GFP_KERNEL))
+                goto exit;
+
         /* Now reverse the concerned fields */
         msg_set_errcode(hdr, err);
         msg_set_origport(hdr, msg_destport(&ohdr));
diff --git a/net/tipc/msg.h b/net/tipc/msg.h
index 024da8af91f0..7cf52fb39bee 100644
--- a/net/tipc/msg.h
+++ b/net/tipc/msg.h
@@ -94,17 +94,6 @@ struct plist;
 
 #define TIPC_MEDIA_INFO_OFFSET  5
 
-/**
- * TIPC message buffer code
- *
- * TIPC message buffer headroom reserves space for the worst-case
- * link-level device header (in case the message is sent off-node).
- *
- * Note: Headroom should be a multiple of 4 to ensure the TIPC header fields
- *       are word aligned for quicker access
- */
-#define BUF_HEADROOM (LL_MAX_HEADER + 48)
-
 struct tipc_skb_cb {
         void *handle;
         struct sk_buff *tail;
diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
index f795b1dd0ccd..3ad9fab1985f 100644
--- a/net/tipc/netlink_compat.c
+++ b/net/tipc/netlink_compat.c
@@ -604,7 +604,8 @@ static int tipc_nl_compat_link_dump(struct tipc_nl_compat_msg *msg,
 
         link_info.dest = nla_get_flag(link[TIPC_NLA_LINK_DEST]);
         link_info.up = htonl(nla_get_flag(link[TIPC_NLA_LINK_UP]));
-        strcpy(link_info.str, nla_data(link[TIPC_NLA_LINK_NAME]));
+        nla_strlcpy(link_info.str, nla_data(link[TIPC_NLA_LINK_NAME]),
+                    TIPC_MAX_LINK_NAME);
 
         return tipc_add_tlv(msg->rep, TIPC_TLV_LINK_INFO,
                             &link_info, sizeof(link_info));
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 88bfcd707064..c49b8df438cb 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -796,9 +796,11 @@ void tipc_sk_mcast_rcv(struct net *net, struct sk_buff_head *arrvq,
  * @tsk: receiving socket
  * @skb: pointer to message buffer.
  */
-static void tipc_sk_proto_rcv(struct tipc_sock *tsk, struct sk_buff *skb)
+static void tipc_sk_proto_rcv(struct tipc_sock *tsk, struct sk_buff *skb,
+                              struct sk_buff_head *xmitq)
 {
         struct sock *sk = &tsk->sk;
+        u32 onode = tsk_own_node(tsk);
         struct tipc_msg *hdr = buf_msg(skb);
         int mtyp = msg_type(hdr);
         bool conn_cong;
@@ -811,7 +813,8 @@ static void tipc_sk_proto_rcv(struct tipc_sock *tsk, struct sk_buff *skb)
 
         if (mtyp == CONN_PROBE) {
                 msg_set_type(hdr, CONN_PROBE_REPLY);
-                tipc_sk_respond(sk, skb, TIPC_OK);
+                if (tipc_msg_reverse(onode, &skb, TIPC_OK))
+                        __skb_queue_tail(xmitq, skb);
                 return;
         } else if (mtyp == CONN_ACK) {
                 conn_cong = tsk_conn_cong(tsk);
@@ -1686,7 +1689,8 @@ static unsigned int rcvbuf_limit(struct sock *sk, struct sk_buff *skb)
  *
  * Returns true if message was added to socket receive queue, otherwise false
  */
-static bool filter_rcv(struct sock *sk, struct sk_buff *skb)
+static bool filter_rcv(struct sock *sk, struct sk_buff *skb,
+                       struct sk_buff_head *xmitq)
 {
         struct socket *sock = sk->sk_socket;
         struct tipc_sock *tsk = tipc_sk(sk);
@@ -1696,7 +1700,7 @@ static bool filter_rcv(struct sock *sk, struct sk_buff *skb)
         int usr = msg_user(hdr);
 
         if (unlikely(msg_user(hdr) == CONN_MANAGER)) {
-                tipc_sk_proto_rcv(tsk, skb);
+                tipc_sk_proto_rcv(tsk, skb, xmitq);
                 return false;
         }
 
@@ -1739,7 +1743,8 @@ static bool filter_rcv(struct sock *sk, struct sk_buff *skb)
         return true;
 
 reject:
-        tipc_sk_respond(sk, skb, err);
+        if (tipc_msg_reverse(tsk_own_node(tsk), &skb, err))
+                __skb_queue_tail(xmitq, skb);
         return false;
 }
 
@@ -1755,9 +1760,24 @@ reject:
 static int tipc_backlog_rcv(struct sock *sk, struct sk_buff *skb)
 {
         unsigned int truesize = skb->truesize;
+        struct sk_buff_head xmitq;
+        u32 dnode, selector;
 
-        if (likely(filter_rcv(sk, skb)))
+        __skb_queue_head_init(&xmitq);
+
+        if (likely(filter_rcv(sk, skb, &xmitq))) {
                 atomic_add(truesize, &tipc_sk(sk)->dupl_rcvcnt);
+                return 0;
+        }
+
+        if (skb_queue_empty(&xmitq))
+                return 0;
+
+        /* Send response/rejected message */
+        skb = __skb_dequeue(&xmitq);
+        dnode = msg_destnode(buf_msg(skb));
+        selector = msg_origport(buf_msg(skb));
+        tipc_node_xmit_skb(sock_net(sk), skb, dnode, selector);
         return 0;
 }
 
@@ -1771,12 +1791,13 @@ static int tipc_backlog_rcv(struct sock *sk, struct sk_buff *skb)
  * Caller must hold socket lock
  */
 static void tipc_sk_enqueue(struct sk_buff_head *inputq, struct sock *sk,
-                            u32 dport)
+                            u32 dport, struct sk_buff_head *xmitq)
 {
+        unsigned long time_limit = jiffies + 2;
+        struct sk_buff *skb;
         unsigned int lim;
         atomic_t *dcnt;
-        struct sk_buff *skb;
-        unsigned long time_limit = jiffies + 2;
+        u32 onode;
 
         while (skb_queue_len(inputq)) {
                 if (unlikely(time_after_eq(jiffies, time_limit)))
@@ -1788,7 +1809,7 @@ static void tipc_sk_enqueue(struct sk_buff_head *inputq, struct sock *sk,
 
                 /* Add message directly to receive queue if possible */
                 if (!sock_owned_by_user(sk)) {
-                        filter_rcv(sk, skb);
+                        filter_rcv(sk, skb, xmitq);
                         continue;
                 }
 
@@ -1801,7 +1822,9 @@ static void tipc_sk_enqueue(struct sk_buff_head *inputq, struct sock *sk,
                         continue;
 
                 /* Overload => reject message back to sender */
-                tipc_sk_respond(sk, skb, TIPC_ERR_OVERLOAD);
+                onode = tipc_own_addr(sock_net(sk));
+                if (tipc_msg_reverse(onode, &skb, TIPC_ERR_OVERLOAD))
+                        __skb_queue_tail(xmitq, skb);
                 break;
         }
 }
@@ -1814,12 +1837,14 @@ static void tipc_sk_enqueue(struct sk_buff_head *inputq, struct sock *sk,
  */
 void tipc_sk_rcv(struct net *net, struct sk_buff_head *inputq)
 {
+        struct sk_buff_head xmitq;
         u32 dnode, dport = 0;
         int err;
         struct tipc_sock *tsk;
         struct sock *sk;
         struct sk_buff *skb;
 
+        __skb_queue_head_init(&xmitq);
         while (skb_queue_len(inputq)) {
                 dport = tipc_skb_peek_port(inputq, dport);
                 tsk = tipc_sk_lookup(net, dport);
@@ -1827,9 +1852,14 @@ void tipc_sk_rcv(struct net *net, struct sk_buff_head *inputq)
                 if (likely(tsk)) {
                         sk = &tsk->sk;
                         if (likely(spin_trylock_bh(&sk->sk_lock.slock))) {
-                                tipc_sk_enqueue(inputq, sk, dport);
+                                tipc_sk_enqueue(inputq, sk, dport, &xmitq);
                                 spin_unlock_bh(&sk->sk_lock.slock);
                         }
+                        /* Send pending response/rejected messages, if any */
+                        while ((skb = __skb_dequeue(&xmitq))) {
+                                dnode = msg_destnode(buf_msg(skb));
+                                tipc_node_xmit_skb(net, skb, dnode, dport);
+                        }
                         sock_put(sk);
                         continue;
                 }
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 80aa6a3e6817..735362c26c8e 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -315,7 +315,7 @@ static struct sock *unix_find_socket_byinode(struct inode *i)
                     &unix_socket_table[i->i_ino & (UNIX_HASH_SIZE - 1)]) {
                 struct dentry *dentry = unix_sk(s)->path.dentry;
 
-                if (dentry && d_backing_inode(dentry) == i) {
+                if (dentry && d_real_inode(dentry) == i) {
                         sock_hold(s);
                         goto found;
                 }
@@ -911,7 +911,7 @@ static struct sock *unix_find_other(struct net *net,
                 err = kern_path(sunname->sun_path, LOOKUP_FOLLOW, &path);
                 if (err)
                         goto fail;
-                inode = d_backing_inode(path.dentry);
+                inode = d_real_inode(path.dentry);
                 err = inode_permission(inode, MAY_WRITE);
                 if (err)
                         goto put_fail;
@@ -1048,7 +1048,7 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                         goto out_up;
                 }
                 addr->hash = UNIX_HASH_SIZE;
-                hash = d_backing_inode(dentry)->i_ino & (UNIX_HASH_SIZE - 1);
+                hash = d_real_inode(dentry)->i_ino & (UNIX_HASH_SIZE - 1);
                 spin_lock(&unix_table_lock);
                 u->path = u_path;
                 list = &unix_socket_table[hash];
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index b5f1221f48d4..b96ac918e0ba 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -61,6 +61,14 @@
  * function will also cleanup rejected sockets, those that reach the connected
  * state but leave it before they have been accepted.
  *
+ * - Lock ordering for pending or accept queue sockets is:
+ *
+ *     lock_sock(listener);
+ *     lock_sock_nested(pending, SINGLE_DEPTH_NESTING);
+ *
+ * Using explicit nested locking keeps lockdep happy since normally only one
+ * lock of a given class may be taken at a time.
+ *
  * - Sockets created by user action will be cleaned up when the user process
  * calls close(2), causing our release implementation to be called. Our release
  * implementation will perform some cleanup then drop the last reference so our
@@ -443,7 +451,7 @@ void vsock_pending_work(struct work_struct *work)
         cleanup = true;
 
         lock_sock(listener);
-        lock_sock(sk);
+        lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
 
         if (vsock_is_pending(sk)) {
                 vsock_remove_pending(listener, sk);
@@ -1292,7 +1300,7 @@ static int vsock_accept(struct socket *sock, struct socket *newsock, int flags)
         if (connected) {
                 listener->sk_ack_backlog--;
 
-                lock_sock(connected);
+                lock_sock_nested(connected, SINGLE_DEPTH_NESTING);
                 vconnected = vsock_sk(connected);
 
                 /* If the listener socket has received an error, then we should
diff --git a/net/wireless/core.c b/net/wireless/core.c
index d25c82bc1bbe..ecca3896b9f7 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -363,8 +363,6 @@ struct wiphy *wiphy_new_nm(const struct cfg80211_ops *ops, int sizeof_priv,
         WARN_ON(ops->remain_on_channel && !ops->cancel_remain_on_channel);
         WARN_ON(ops->tdls_channel_switch && !ops->tdls_cancel_channel_switch);
         WARN_ON(ops->add_tx_ts && !ops->del_tx_ts);
-        WARN_ON(ops->set_tx_power && !ops->get_tx_power);
-        WARN_ON(ops->set_antenna && !ops->get_antenna);
 
         alloc_size = sizeof(*rdev) + sizeof_priv;
 
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 4e809e978b7d..2443ee30ba5b 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -509,7 +509,7 @@ static int __ieee80211_data_to_8023(struct sk_buff *skb, struct ethhdr *ehdr,
                  * replace EtherType */
                 hdrlen += ETH_ALEN + 2;
         else
-                tmp.h_proto = htons(skb->len);
+                tmp.h_proto = htons(skb->len - hdrlen);
 
         pskb_pull(skb, hdrlen);
 
diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
index 6250b1cfcde5..dbb2738e356a 100644
--- a/net/wireless/wext-core.c
+++ b/net/wireless/wext-core.c
@@ -958,8 +958,29 @@ static int wireless_process_ioctl(struct net *net, struct ifreq *ifr,
                         return private(dev, iwr, cmd, info, handler);
         }
         /* Old driver API : call driver ioctl handler */
-        if (dev->netdev_ops->ndo_do_ioctl)
-                return dev->netdev_ops->ndo_do_ioctl(dev, ifr, cmd);
+        if (dev->netdev_ops->ndo_do_ioctl) {
+#ifdef CONFIG_COMPAT
+                if (info->flags & IW_REQUEST_FLAG_COMPAT) {
+                        int ret = 0;
+                        struct iwreq iwr_lcl;
+                        struct compat_iw_point *iwp_compat = (void *) &iwr->u.data;
+
+                        memcpy(&iwr_lcl, iwr, sizeof(struct iwreq));
+                        iwr_lcl.u.data.pointer = compat_ptr(iwp_compat->pointer);
+                        iwr_lcl.u.data.length = iwp_compat->length;
+                        iwr_lcl.u.data.flags = iwp_compat->flags;
+
+                        ret = dev->netdev_ops->ndo_do_ioctl(dev, (void *) &iwr_lcl, cmd);
+
+                        iwp_compat->pointer = ptr_to_compat(iwr_lcl.u.data.pointer);
+                        iwp_compat->length = iwr_lcl.u.data.length;
+                        iwp_compat->flags = iwr_lcl.u.data.flags;
+
+                        return ret;
+                } else
+#endif
+                        return dev->netdev_ops->ndo_do_ioctl(dev, ifr, cmd);
+        }
         return -EOPNOTSUPP;
 }
 
diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c
index a9155077feef..fec75786f75b 100644
--- a/scripts/mod/file2alias.c
+++ b/scripts/mod/file2alias.c
@@ -384,7 +384,7 @@ static void do_of_entry_multi(void *symval, struct module *mod)
         len = sprintf(alias, "of:N%sT%s", (*name)[0] ? *name : "*",
                       (*type)[0] ? *type : "*");
 
-        if (compatible[0])
+        if ((*compatible)[0])
                 sprintf(&alias[len], "%sC%s", (*type)[0] ? "*" : "",
                         *compatible);
 
diff --git a/security/keys/key.c b/security/keys/key.c
index bd5a272f28a6..346fbf201c22 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -597,7 +597,7 @@ int key_reject_and_link(struct key *key,
 
         mutex_unlock(&key_construction_mutex);
 
-        if (keyring)
+        if (keyring && link_ret == 0)
                 __key_link_end(keyring, &key->index_key, edit);
 
         /* wake up anyone waiting for a key to be constructed */
diff --git a/sound/drivers/dummy.c b/sound/drivers/dummy.c
index c0f8f613f1f1..172dacd925f5 100644
--- a/sound/drivers/dummy.c
+++ b/sound/drivers/dummy.c
@@ -420,6 +420,7 @@ static int dummy_hrtimer_stop(struct snd_pcm_substream *substream)
 
 static inline void dummy_hrtimer_sync(struct dummy_hrtimer_pcm *dpcm)
 {
+        hrtimer_cancel(&dpcm->timer);
         tasklet_kill(&dpcm->tasklet);
 }
 
diff --git a/sound/hda/hdac_regmap.c b/sound/hda/hdac_regmap.c
index 87041ddd29cb..47a358fab132 100644
--- a/sound/hda/hdac_regmap.c
+++ b/sound/hda/hdac_regmap.c
@@ -444,7 +444,7 @@ int snd_hdac_regmap_write_raw(struct hdac_device *codec, unsigned int reg,
         err = reg_raw_write(codec, reg, val);
         if (err == -EAGAIN) {
                 err = snd_hdac_power_up_pm(codec);
-                if (!err)
+                if (err >= 0)
                         err = reg_raw_write(codec, reg, val);
                 snd_hdac_power_down_pm(codec);
         }
@@ -470,7 +470,7 @@ static int __snd_hdac_regmap_read_raw(struct hdac_device *codec,
         err = reg_raw_read(codec, reg, val, uncached);
         if (err == -EAGAIN) {
                 err = snd_hdac_power_up_pm(codec);
-                if (!err)
+                if (err >= 0)
                         err = reg_raw_read(codec, reg, val, uncached);
                 snd_hdac_power_down_pm(codec);
         }
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 9a0d1445ca5c..94089fc71884 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -365,8 +365,11 @@ enum {
 
 #define IS_SKL(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0xa170)
 #define IS_SKL_LP(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x9d70)
+#define IS_KBL(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0xa171)
+#define IS_KBL_LP(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x9d71)
 #define IS_BXT(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x5a98)
-#define IS_SKL_PLUS(pci) (IS_SKL(pci) || IS_SKL_LP(pci) || IS_BXT(pci))
+#define IS_SKL_PLUS(pci) (IS_SKL(pci) || IS_SKL_LP(pci) || IS_BXT(pci)) || \
+                        IS_KBL(pci) || IS_KBL_LP(pci)
 
 static char *driver_short_names[] = {
         [AZX_DRIVER_ICH] = "HDA Intel",
@@ -2181,6 +2184,12 @@ static const struct pci_device_id azx_ids[] = {
         /* Sunrise Point-LP */
         { PCI_DEVICE(0x8086, 0x9d70),
           .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_SKYLAKE },
+        /* Kabylake */
+        { PCI_DEVICE(0x8086, 0xa171),
+          .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_SKYLAKE },
+        /* Kabylake-LP */
+        { PCI_DEVICE(0x8086, 0x9d71),
+          .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_SKYLAKE },
         /* Broxton-P(Apollolake) */
         { PCI_DEVICE(0x8086, 0x5a98),
           .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_BROXTON },
diff --git a/sound/pci/hda/hda_tegra.c b/sound/pci/hda/hda_tegra.c
index 17fd81736d3d..0621920f7617 100644
--- a/sound/pci/hda/hda_tegra.c
+++ b/sound/pci/hda/hda_tegra.c
@@ -115,20 +115,20 @@ static int substream_free_pages(struct azx *chip,
 /*
  * Register access ops. Tegra HDA register access is DWORD only.
  */
-static void hda_tegra_writel(u32 value, u32 *addr)
+static void hda_tegra_writel(u32 value, u32 __iomem *addr)
 {
         writel(value, addr);
 }
 
-static u32 hda_tegra_readl(u32 *addr)
+static u32 hda_tegra_readl(u32 __iomem *addr)
 {
         return readl(addr);
 }
 
-static void hda_tegra_writew(u16 value, u16 *addr)
+static void hda_tegra_writew(u16 value, u16 __iomem  *addr)
 {
         unsigned int shift = ((unsigned long)(addr) & 0x3) << 3;
-        void *dword_addr = (void *)((unsigned long)(addr) & ~0x3);
+        void __iomem *dword_addr = (void __iomem *)((unsigned long)(addr) & ~0x3);
         u32 v;
 
         v = readl(dword_addr);
@@ -137,20 +137,20 @@ static void hda_tegra_writew(u16 value, u16 *addr)
         writel(v, dword_addr);
 }
 
-static u16 hda_tegra_readw(u16 *addr)
+static u16 hda_tegra_readw(u16 __iomem *addr)
 {
         unsigned int shift = ((unsigned long)(addr) & 0x3) << 3;
-        void *dword_addr = (void *)((unsigned long)(addr) & ~0x3);
+        void __iomem *dword_addr = (void __iomem *)((unsigned long)(addr) & ~0x3);
         u32 v;
 
         v = readl(dword_addr);
         return (v >> shift) & 0xffff;
 }
 
-static void hda_tegra_writeb(u8 value, u8 *addr)
+static void hda_tegra_writeb(u8 value, u8 __iomem *addr)
 {
         unsigned int shift = ((unsigned long)(addr) & 0x3) << 3;
-        void *dword_addr = (void *)((unsigned long)(addr) & ~0x3);
+        void __iomem *dword_addr = (void __iomem *)((unsigned long)(addr) & ~0x3);
         u32 v;
 
         v = readl(dword_addr);
@@ -159,10 +159,10 @@ static void hda_tegra_writeb(u8 value, u8 *addr)
         writel(v, dword_addr);
 }
 
-static u8 hda_tegra_readb(u8 *addr)
+static u8 hda_tegra_readb(u8 __iomem *addr)
 {
         unsigned int shift = ((unsigned long)(addr) & 0x3) << 3;
-        void *dword_addr = (void *)((unsigned long)(addr) & ~0x3);
+        void __iomem *dword_addr = (void __iomem *)((unsigned long)(addr) & ~0x3);
         u32 v;
 
         v = readl(dword_addr);
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index d53c25e7a1c1..900bfbc3368c 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -346,6 +346,9 @@ static void alc_fill_eapd_coef(struct hda_codec *codec)
         case 0x10ec0234:
         case 0x10ec0274:
         case 0x10ec0294:
+        case 0x10ec0700:
+        case 0x10ec0701:
+        case 0x10ec0703:
                 alc_update_coef_idx(codec, 0x10, 1<<15, 0);
                 break;
         case 0x10ec0662:
@@ -2655,6 +2658,7 @@ enum {
         ALC269_TYPE_ALC256,
         ALC269_TYPE_ALC225,
         ALC269_TYPE_ALC294,
+        ALC269_TYPE_ALC700,
 };
 
 /*
@@ -2686,6 +2690,7 @@ static int alc269_parse_auto_config(struct hda_codec *codec)
         case ALC269_TYPE_ALC256:
         case ALC269_TYPE_ALC225:
         case ALC269_TYPE_ALC294:
+        case ALC269_TYPE_ALC700:
                 ssids = alc269_ssids;
                 break;
         default:
@@ -3618,13 +3623,20 @@ static void alc269_fixup_hp_line1_mic1_led(struct hda_codec *codec,
 static void alc_headset_mode_unplugged(struct hda_codec *codec)
 {
         static struct coef_fw coef0255[] = {
-                WRITE_COEF(0x1b, 0x0c0b), /* LDO and MISC control */
                 WRITE_COEF(0x45, 0xd089), /* UAJ function set to menual mode */
                 UPDATE_COEFEX(0x57, 0x05, 1<<14, 0), /* Direct Drive HP Amp control(Set to verb control)*/
                 WRITE_COEF(0x06, 0x6104), /* Set MIC2 Vref gate with HP */
                 WRITE_COEFEX(0x57, 0x03, 0x8aa6), /* Direct Drive HP Amp control */
                 {}
         };
+        static struct coef_fw coef0255_1[] = {
+                WRITE_COEF(0x1b, 0x0c0b), /* LDO and MISC control */
+                {}
+        };
+        static struct coef_fw coef0256[] = {
+                WRITE_COEF(0x1b, 0x0c4b), /* LDO and MISC control */
+                {}
+        };
         static struct coef_fw coef0233[] = {
                 WRITE_COEF(0x1b, 0x0c0b),
                 WRITE_COEF(0x45, 0xc429),
@@ -3677,7 +3689,11 @@ static void alc_headset_mode_unplugged(struct hda_codec *codec)
 
         switch (codec->core.vendor_id) {
         case 0x10ec0255:
+                alc_process_coef_fw(codec, coef0255_1);
+                alc_process_coef_fw(codec, coef0255);
+                break;
         case 0x10ec0256:
+                alc_process_coef_fw(codec, coef0256);
                 alc_process_coef_fw(codec, coef0255);
                 break;
         case 0x10ec0233:
@@ -3896,6 +3912,12 @@ static void alc_headset_mode_ctia(struct hda_codec *codec)
                 WRITE_COEFEX(0x57, 0x03, 0x8ea6),
                 {}
         };
+        static struct coef_fw coef0256[] = {
+                WRITE_COEF(0x45, 0xd489), /* Set to CTIA type */
+                WRITE_COEF(0x1b, 0x0c6b),
+                WRITE_COEFEX(0x57, 0x03, 0x8ea6),
+                {}
+        };
         static struct coef_fw coef0233[] = {
                 WRITE_COEF(0x45, 0xd429),
                 WRITE_COEF(0x1b, 0x0c2b),
@@ -3936,9 +3958,11 @@ static void alc_headset_mode_ctia(struct hda_codec *codec)
 
         switch (codec->core.vendor_id) {
         case 0x10ec0255:
-        case 0x10ec0256:
                 alc_process_coef_fw(codec, coef0255);
                 break;
+        case 0x10ec0256:
+                alc_process_coef_fw(codec, coef0256);
+                break;
         case 0x10ec0233:
         case 0x10ec0283:
                 alc_process_coef_fw(codec, coef0233);
@@ -3978,6 +4002,12 @@ static void alc_headset_mode_omtp(struct hda_codec *codec)
                 WRITE_COEFEX(0x57, 0x03, 0x8ea6),
                 {}
         };
+        static struct coef_fw coef0256[] = {
+                WRITE_COEF(0x45, 0xe489), /* Set to OMTP Type */
+                WRITE_COEF(0x1b, 0x0c6b),
+                WRITE_COEFEX(0x57, 0x03, 0x8ea6),
+                {}
+        };
         static struct coef_fw coef0233[] = {
                 WRITE_COEF(0x45, 0xe429),
                 WRITE_COEF(0x1b, 0x0c2b),
@@ -4018,9 +4048,11 @@ static void alc_headset_mode_omtp(struct hda_codec *codec)
 
         switch (codec->core.vendor_id) {
         case 0x10ec0255:
-        case 0x10ec0256:
                 alc_process_coef_fw(codec, coef0255);
                 break;
+        case 0x10ec0256:
+                alc_process_coef_fw(codec, coef0256);
+                break;
         case 0x10ec0233:
         case 0x10ec0283:
                 alc_process_coef_fw(codec, coef0233);
@@ -4266,7 +4298,7 @@ static void alc_fixup_headset_mode_no_hp_mic(struct hda_codec *codec,
 static void alc255_set_default_jack_type(struct hda_codec *codec)
 {
         /* Set to iphone type */
-        static struct coef_fw fw[] = {
+        static struct coef_fw alc255fw[] = {
                 WRITE_COEF(0x1b, 0x880b),
                 WRITE_COEF(0x45, 0xd089),
                 WRITE_COEF(0x1b, 0x080b),
@@ -4274,7 +4306,22 @@ static void alc255_set_default_jack_type(struct hda_codec *codec)
                 WRITE_COEF(0x1b, 0x0c0b),
                 {}
         };
-        alc_process_coef_fw(codec, fw);
+        static struct coef_fw alc256fw[] = {
+                WRITE_COEF(0x1b, 0x884b),
+                WRITE_COEF(0x45, 0xd089),
+                WRITE_COEF(0x1b, 0x084b),
+                WRITE_COEF(0x46, 0x0004),
+                WRITE_COEF(0x1b, 0x0c4b),
+                {}
+        };
+        switch (codec->core.vendor_id) {
+        case 0x10ec0255:
+                alc_process_coef_fw(codec, alc255fw);
+                break;
+        case 0x10ec0256:
+                alc_process_coef_fw(codec, alc256fw);
+                break;
+        }
         msleep(30);
 }
 
@@ -5587,6 +5634,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x17aa, 0x2218, "Thinkpad X1 Carbon 2nd", ALC292_FIXUP_TPT440_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x2223, "ThinkPad T550", ALC292_FIXUP_TPT440_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x2226, "ThinkPad X250", ALC292_FIXUP_TPT440_DOCK),
+        SND_PCI_QUIRK(0x17aa, 0x2231, "Thinkpad T560", ALC292_FIXUP_TPT460),
         SND_PCI_QUIRK(0x17aa, 0x2233, "Thinkpad", ALC292_FIXUP_TPT460),
         SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
         SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
@@ -5602,6 +5650,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x17aa, 0x503c, "Thinkpad L450", ALC292_FIXUP_TPT440_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x504a, "ThinkPad X260", ALC292_FIXUP_TPT440_DOCK),
         SND_PCI_QUIRK(0x17aa, 0x504b, "Thinkpad", ALC293_FIXUP_LENOVO_SPK_NOISE),
+        SND_PCI_QUIRK(0x17aa, 0x5050, "Thinkpad T560p", ALC292_FIXUP_TPT460),
+        SND_PCI_QUIRK(0x17aa, 0x5053, "Thinkpad T460", ALC292_FIXUP_TPT460),
         SND_PCI_QUIRK(0x17aa, 0x5109, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
         SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K),
         SND_PCI_QUIRK(0x17aa, 0x9e54, "LENOVO NB", ALC269_FIXUP_LENOVO_EAPD),
@@ -5775,11 +5825,19 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
                 {0x12, 0x90a60180},
                 {0x14, 0x90170130},
                 {0x21, 0x02211040}),
+        SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell Inspiron 5565", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+                {0x12, 0x90a60180},
+                {0x14, 0x90170120},
+                {0x21, 0x02211030}),
         SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
                 {0x12, 0x90a60160},
                 {0x14, 0x90170120},
                 {0x21, 0x02211030}),
         SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+                {0x12, 0x90a60170},
+                {0x14, 0x90170120},
+                {0x21, 0x02211030}),
+        SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
                 ALC256_STANDARD_PINS),
         SND_HDA_PIN_QUIRK(0x10ec0280, 0x103c, "HP", ALC280_FIXUP_HP_GPIO4,
                 {0x12, 0x90a60130},
@@ -6053,6 +6111,14 @@ static int patch_alc269(struct hda_codec *codec)
         case 0x10ec0294:
                 spec->codec_variant = ALC269_TYPE_ALC294;
                 break;
+        case 0x10ec0700:
+        case 0x10ec0701:
+        case 0x10ec0703:
+                spec->codec_variant = ALC269_TYPE_ALC700;
+                spec->gen.mixer_nid = 0; /* ALC700 does not have any loopback mixer path */
+                alc_update_coef_idx(codec, 0x4a, 0, 1 << 15); /* Combo jack auto trigger control */
+                break;
+
         }
 
         if (snd_hda_codec_read(codec, 0x51, 0, AC_VERB_PARAMETERS, 0) == 0x10ec5505) {
@@ -7008,6 +7074,9 @@ static const struct hda_device_id snd_hda_id_realtek[] = {
         HDA_CODEC_ENTRY(0x10ec0670, "ALC670", patch_alc662),
         HDA_CODEC_ENTRY(0x10ec0671, "ALC671", patch_alc662),
         HDA_CODEC_ENTRY(0x10ec0680, "ALC680", patch_alc680),
+        HDA_CODEC_ENTRY(0x10ec0700, "ALC700", patch_alc269),
+        HDA_CODEC_ENTRY(0x10ec0701, "ALC701", patch_alc269),
+        HDA_CODEC_ENTRY(0x10ec0703, "ALC703", patch_alc269),
         HDA_CODEC_ENTRY(0x10ec0867, "ALC891", patch_alc882),
         HDA_CODEC_ENTRY(0x10ec0880, "ALC880", patch_alc880),
         HDA_CODEC_ENTRY(0x10ec0882, "ALC882", patch_alc882),
diff --git a/tools/perf/util/data-convert-bt.c b/tools/perf/util/data-convert-bt.c
index bbf69d248ec5..9f53020c3269 100644
--- a/tools/perf/util/data-convert-bt.c
+++ b/tools/perf/util/data-convert-bt.c
@@ -204,6 +204,44 @@ static unsigned long long adjust_signedness(unsigned long long value_int, int si
         return (value_int & value_mask) | ~value_mask;
 }
 
+static int string_set_value(struct bt_ctf_field *field, const char *string)
+{
+        char *buffer = NULL;
+        size_t len = strlen(string), i, p;
+        int err;
+
+        for (i = p = 0; i < len; i++, p++) {
+                if (isprint(string[i])) {
+                        if (!buffer)
+                                continue;
+                        buffer[p] = string[i];
+                } else {
+                        char numstr[5];
+
+                        snprintf(numstr, sizeof(numstr), "\\x%02x",
+                                 (unsigned int)(string[i]) & 0xff);
+
+                        if (!buffer) {
+                                buffer = zalloc(i + (len - i) * 4 + 2);
+                                if (!buffer) {
+                                        pr_err("failed to set unprintable string '%s'\n", string);
+                                        return bt_ctf_field_string_set_value(field, "UNPRINTABLE-STRING");
+                                }
+                                if (i > 0)
+                                        strncpy(buffer, string, i);
+                        }
+                        strncat(buffer + p, numstr, 4);
+                        p += 3;
+                }
+        }
+
+        if (!buffer)
+                return bt_ctf_field_string_set_value(field, string);
+        err = bt_ctf_field_string_set_value(field, buffer);
+        free(buffer);
+        return err;
+}
+
 static int add_tracepoint_field_value(struct ctf_writer *cw,
                                       struct bt_ctf_event_class *event_class,
                                       struct bt_ctf_event *event,
@@ -270,8 +308,7 @@ static int add_tracepoint_field_value(struct ctf_writer *cw,
                 }
 
                 if (flags & FIELD_IS_STRING)
-                        ret = bt_ctf_field_string_set_value(field,
-                                        data + offset + i * len);
+                        ret = string_set_value(field, data + offset + i * len);
                 else {
                         unsigned long long value_int;
 
diff --git a/tools/perf/util/event.c b/tools/perf/util/event.c
index f6fcc6832949..9b141f12329e 100644
--- a/tools/perf/util/event.c
+++ b/tools/perf/util/event.c
@@ -673,6 +673,8 @@ int perf_event__synthesize_kernel_mmap(struct perf_tool *tool,
         int err;
         union perf_event *event;
 
+        if (symbol_conf.kptr_restrict)
+                return -1;
         if (map == NULL)
                 return -1;
 
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index 20f9cb32b703..54c4ff2b1cee 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -1933,17 +1933,17 @@ int setup_intlist(struct intlist **list, const char *list_str,
 static bool symbol__read_kptr_restrict(void)
 {
         bool value = false;
+        FILE *fp = fopen("/proc/sys/kernel/kptr_restrict", "r");
 
-        if (geteuid() != 0) {
-                FILE *fp = fopen("/proc/sys/kernel/kptr_restrict", "r");
-                if (fp != NULL) {
-                        char line[8];
+        if (fp != NULL) {
+                char line[8];
 
-                        if (fgets(line, sizeof(line), fp) != NULL)
-                                value = atoi(line) != 0;
+                if (fgets(line, sizeof(line), fp) != NULL)
+                        value = (geteuid() != 0) ?
+                                        (atoi(line) != 0) :
+                                        (atoi(line) == 2);
 
-                        fclose(fp);
-                }
+                fclose(fp);
         }
 
         return value;
diff --git a/tools/testing/selftests/ftrace/test.d/trigger/trigger-hist-mod.tc b/tools/testing/selftests/ftrace/test.d/trigger/trigger-hist-mod.tc
index c2b61c4fda11..0bf5085281f3 100644
--- a/tools/testing/selftests/ftrace/test.d/trigger/trigger-hist-mod.tc
+++ b/tools/testing/selftests/ftrace/test.d/trigger/trigger-hist-mod.tc
@@ -23,15 +23,14 @@ if [ ! -f events/sched/sched_process_fork/trigger ]; then
     exit_unsupported
 fi
 
-reset_tracer
-do_reset
-
-FEATURE=`grep hist events/sched/sched_process_fork/trigger`
-if [ -z "$FEATURE" ]; then
+if [ ! -f events/sched/sched_process_fork/hist ]; then
     echo "hist trigger is not supported"
     exit_unsupported
 fi
 
+reset_tracer
+do_reset
+
 echo "Test histogram with execname modifier"
 
 echo 'hist:keys=common_pid.execname' > events/sched/sched_process_fork/trigger
diff --git a/tools/testing/selftests/ftrace/test.d/trigger/trigger-hist.tc b/tools/testing/selftests/ftrace/test.d/trigger/trigger-hist.tc
index b2902d42a537..a00184cd9c95 100644
--- a/tools/testing/selftests/ftrace/test.d/trigger/trigger-hist.tc
+++ b/tools/testing/selftests/ftrace/test.d/trigger/trigger-hist.tc
@@ -23,15 +23,14 @@ if [ ! -f events/sched/sched_process_fork/trigger ]; then
     exit_unsupported
 fi
 
-reset_tracer
-do_reset
-
-FEATURE=`grep hist events/sched/sched_process_fork/trigger`
-if [ -z "$FEATURE" ]; then
+if [ ! -f events/sched/sched_process_fork/hist ]; then
     echo "hist trigger is not supported"
     exit_unsupported
 fi
 
+reset_tracer
+do_reset
+
 echo "Test histogram basic tigger"
 
 echo 'hist:keys=parent_pid:vals=child_pid' > events/sched/sched_process_fork/trigger
diff --git a/tools/testing/selftests/ftrace/test.d/trigger/trigger-multihist.tc b/tools/testing/selftests/ftrace/test.d/trigger/trigger-multihist.tc
index 03c4a46561fc..3478b00ead57 100644
--- a/tools/testing/selftests/ftrace/test.d/trigger/trigger-multihist.tc
+++ b/tools/testing/selftests/ftrace/test.d/trigger/trigger-multihist.tc
@@ -23,15 +23,14 @@ if [ ! -f events/sched/sched_process_fork/trigger ]; then
     exit_unsupported
 fi
 
-reset_tracer
-do_reset
-
-FEATURE=`grep hist events/sched/sched_process_fork/trigger`
-if [ -z "$FEATURE" ]; then
+if [ ! -f events/sched/sched_process_fork/hist ]; then
     echo "hist trigger is not supported"
     exit_unsupported
 fi
 
+reset_tracer
+do_reset
+
 reset_trigger
 
 echo "Test histogram multiple tiggers"
diff --git a/tools/testing/selftests/net/reuseport_bpf.c b/tools/testing/selftests/net/reuseport_bpf.c
index 96ba386b1b7b..4a8217448f20 100644
--- a/tools/testing/selftests/net/reuseport_bpf.c
+++ b/tools/testing/selftests/net/reuseport_bpf.c
@@ -111,9 +111,9 @@ static void attach_ebpf(int fd, uint16_t mod)
         memset(&attr, 0, sizeof(attr));
         attr.prog_type = BPF_PROG_TYPE_SOCKET_FILTER;
         attr.insn_cnt = ARRAY_SIZE(prog);
-        attr.insns = (uint64_t)prog;
-        attr.license = (uint64_t)bpf_license;
-        attr.log_buf = (uint64_t)bpf_log_buf;
+        attr.insns = (unsigned long) &prog;
+        attr.license = (unsigned long) &bpf_license;
+        attr.log_buf = (unsigned long) &bpf_log_buf;
         attr.log_size = sizeof(bpf_log_buf);
         attr.log_level = 1;
         attr.kern_version = 0;
@@ -351,8 +351,8 @@ static void test_filter_no_reuseport(const struct test_params p)
         memset(&eprog, 0, sizeof(eprog));
         eprog.prog_type = BPF_PROG_TYPE_SOCKET_FILTER;
         eprog.insn_cnt = ARRAY_SIZE(ecode);
-        eprog.insns = (uint64_t)ecode;
-        eprog.license = (uint64_t)bpf_license;
+        eprog.insns = (unsigned long) &ecode;
+        eprog.license = (unsigned long) &bpf_license;
         eprog.kern_version = 0;
 
         memset(&cprog, 0, sizeof(cprog));
diff --git a/tools/testing/selftests/vm/compaction_test.c b/tools/testing/selftests/vm/compaction_test.c
index 932ff577ffc0..00c4f65d12da 100644
--- a/tools/testing/selftests/vm/compaction_test.c
+++ b/tools/testing/selftests/vm/compaction_test.c
@@ -136,7 +136,7 @@ int check_compaction(unsigned long mem_free, unsigned int hugepage_size)
         printf("No of huge pages allocated = %d\n",
                (atoi(nr_hugepages)));
 
-        if (write(fd, initial_nr_hugepages, sizeof(initial_nr_hugepages))
+        if (write(fd, initial_nr_hugepages, strlen(initial_nr_hugepages))
             != strlen(initial_nr_hugepages)) {
                 perror("Failed to write to /proc/sys/vm/nr_hugepages\n");
                 goto close_fd;
diff --git a/tools/virtio/ringtest/Makefile b/tools/virtio/ringtest/Makefile
index 6ba745529833..6173adae9f08 100644
--- a/tools/virtio/ringtest/Makefile
+++ b/tools/virtio/ringtest/Makefile
@@ -1,6 +1,6 @@
 all:
 
-all: ring virtio_ring_0_9 virtio_ring_poll virtio_ring_inorder
+all: ring virtio_ring_0_9 virtio_ring_poll virtio_ring_inorder noring
 
 CFLAGS += -Wall
 CFLAGS += -pthread -O2 -ggdb
@@ -15,11 +15,13 @@ ring: ring.o main.o
 virtio_ring_0_9: virtio_ring_0_9.o main.o
 virtio_ring_poll: virtio_ring_poll.o main.o
 virtio_ring_inorder: virtio_ring_inorder.o main.o
+noring: noring.o main.o
 clean:
         -rm main.o
         -rm ring.o ring
         -rm virtio_ring_0_9.o virtio_ring_0_9
         -rm virtio_ring_poll.o virtio_ring_poll
         -rm virtio_ring_inorder.o virtio_ring_inorder
+        -rm noring.o noring
 
 .PHONY: all clean
diff --git a/tools/virtio/ringtest/README b/tools/virtio/ringtest/README
index 34e94c46104f..d83707a336c9 100644
--- a/tools/virtio/ringtest/README
+++ b/tools/virtio/ringtest/README
@@ -1,2 +1,6 @@
 Partial implementation of various ring layouts, useful to tune virtio design.
 Uses shared memory heavily.
+
+Typical use:
+
+# sh run-on-all.sh perf stat -r 10 --log-fd 1 -- ./ring
diff --git a/tools/virtio/ringtest/noring.c b/tools/virtio/ringtest/noring.c
new file mode 100644
index 000000000000..eda2f4824130
--- /dev/null
+++ b/tools/virtio/ringtest/noring.c
@@ -0,0 +1,69 @@
+#define _GNU_SOURCE
+#include "main.h"
+#include <assert.h>
+
+/* stub implementation: useful for measuring overhead */
+void alloc_ring(void)
+{
+}
+
+/* guest side */
+int add_inbuf(unsigned len, void *buf, void *datap)
+{
+        return 0;
+}
+
+/*
+ * skb_array API provides no way for producer to find out whether a given
+ * buffer was consumed.  Our tests merely require that a successful get_buf
+ * implies that add_inbuf succeed in the past, and that add_inbuf will succeed,
+ * fake it accordingly.
+ */
+void *get_buf(unsigned *lenp, void **bufp)
+{
+        return "Buffer";
+}
+
+void poll_used(void)
+{
+}
+
+void disable_call()
+{
+        assert(0);
+}
+
+bool enable_call()
+{
+        assert(0);
+}
+
+void kick_available(void)
+{
+        assert(0);
+}
+
+/* host side */
+void disable_kick()
+{
+        assert(0);
+}
+
+bool enable_kick()
+{
+        assert(0);
+}
+
+void poll_avail(void)
+{
+}
+
+bool use_buf(unsigned *lenp, void **bufp)
+{
+        return true;
+}
+
+void call_used(void)
+{
+        assert(0);
+}
diff --git a/tools/virtio/ringtest/run-on-all.sh b/tools/virtio/ringtest/run-on-all.sh
index 52b0f71ffa8d..2e69ca812b4c 100755
--- a/tools/virtio/ringtest/run-on-all.sh
+++ b/tools/virtio/ringtest/run-on-all.sh
@@ -3,10 +3,10 @@
 #use last CPU for host. Why not the first?
 #many devices tend to use cpu0 by default so
 #it tends to be busier
-HOST_AFFINITY=$(cd /dev/cpu; ls|grep -v '[a-z]'|sort -n|tail -1)
+HOST_AFFINITY=$(lscpu -p=cpu | tail -1)
 
 #run command on all cpus
-for cpu in $(cd /dev/cpu; ls|grep -v '[a-z]'|sort -n);
+for cpu in $(seq 0 $HOST_AFFINITY)
 do
         #Don't run guest and host on same CPU
         #It actually works ok if using signalling
diff --git a/tools/vm/slabinfo.c b/tools/vm/slabinfo.c
index 1889163f2f05..7cf6e1769903 100644
--- a/tools/vm/slabinfo.c
+++ b/tools/vm/slabinfo.c
@@ -492,7 +492,7 @@ static void slab_stats(struct slabinfo *s)
                         s->deactivate_to_head + s->deactivate_to_tail + s->deactivate_bypass;
 
         if (total) {
-                printf("\nSlab Deactivation             Ocurrences  %%\n");
+                printf("\nSlab Deactivation             Occurrences %%\n");
                 printf("-------------------------------------------------\n");
                 printf("Slab full                     %7lu  %3lu%%\n",
                         s->deactivate_full, (s->deactivate_full * 100) / total);
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 02e98f3131bd..48bd520fc702 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -2941,7 +2941,7 @@ static long kvm_vm_ioctl(struct file *filp,
                 if (copy_from_user(&routing, argp, sizeof(routing)))
                         goto out;
                 r = -EINVAL;
-                if (routing.nr >= KVM_MAX_IRQ_ROUTES)
+                if (routing.nr > KVM_MAX_IRQ_ROUTES)
                         goto out;
                 if (routing.flags)
                         goto out;