Merge branch 'x86/urgent' into x86/platform, to queue up dependent patch

Signed-off-by: Ingo Molnar <mingo@kernel.org>
author: Ingo Molnar <mingo@kernel.org> 2016-02-23 01:36:46 -0500
committer: Ingo Molnar <mingo@kernel.org> 2016-02-23 01:36:46 -0500
commit: fb86780bf7708cd6553f592a6318f10eda766127 (patch)
tree: b59737c56a407c9f82166576209ef8e8cd09ecc6
parent: 8f8e2aec9944dd12671182a1a26b8e1a35872a1d (diff)
parent: dd71a17b1193dd4a4c35ecd0ba227aac3d110836 (diff)
221 files changed, 2124 insertions, 919 deletions
diff --git a/Documentation/devicetree/bindings/clock/rockchip,rk3036-cru.txt b/Documentation/devicetree/bindings/clock/rockchip,rk3036-cru.txt
index ace05992a262..20df350b9ef3 100644
--- a/Documentation/devicetree/bindings/clock/rockchip,rk3036-cru.txt
+++ b/Documentation/devicetree/bindings/clock/rockchip,rk3036-cru.txt
@@ -30,7 +30,7 @@ that they are defined using standard clock bindings with following
 clock-output-names:
 - "xin24m" - crystal input - required,
 - "ext_i2s" - external I2S clock - optional,
- - "ext_gmac" - external GMAC clock - optional
+ - "rmii_clkin" - external EMAC clock - optional
 Example: Clock controller node:
diff --git a/Documentation/devicetree/bindings/interrupt-controller/arm,gic-v3.txt b/Documentation/devicetree/bindings/interrupt-controller/arm,gic-v3.txt
index 7803e77d85cb..007a5b46256a 100644
--- a/Documentation/devicetree/bindings/interrupt-controller/arm,gic-v3.txt
+++ b/Documentation/devicetree/bindings/interrupt-controller/arm,gic-v3.txt
@@ -24,9 +24,8 @@ Main node required properties:
                1 = edge triggered
                4 = level triggered
-  Cells 4 and beyond are reserved for future use. When the 1st cell
+  Cells 4 and beyond are reserved for future use and must have a value
-  has a value of 0 or 1, cells 4 and beyond act as padding, and may be
+  of 0 if present.
-  ignored. It is recommended that padding cells have a value of 0.
 - reg : Specifies base physical address(s) and size of the GIC
  registers, in the following order:
diff --git a/Documentation/devicetree/bindings/rtc/s3c-rtc.txt b/Documentation/devicetree/bindings/rtc/s3c-rtc.txt
index ac2fcd6ff4b8..1068ffce9f91 100644
--- a/Documentation/devicetree/bindings/rtc/s3c-rtc.txt
+++ b/Documentation/devicetree/bindings/rtc/s3c-rtc.txt
@@ -14,6 +14,10 @@ Required properties:
  interrupt number is the rtc alarm interrupt and second interrupt number
  is the rtc tick interrupt. The number of cells representing a interrupt
  depends on the parent interrupt controller.
+- clocks: Must contain a list of phandle and clock specifier for the rtc
+          and source clocks.
+- clock-names: Must contain "rtc" and "rtc_src" entries sorted in the
+               same order as the clocks property.
 Example:
@@ -21,4 +25,6 @@ Example:
                compatible = "samsung,s3c6410-rtc";
                reg = <0x10070000 0x100>;
                interrupts = <44 0 45 0>;
+                clocks = <&clock CLK_RTC>, <&s2mps11_osc S2MPS11_CLK_AP>;
+                clock-names = "rtc", "rtc_src";
        };
diff --git a/Documentation/devicetree/bindings/serial/fsl-imx-uart.txt b/Documentation/devicetree/bindings/serial/fsl-imx-uart.txt
index 35ae1fb3537f..ed94c217c98d 100644
--- a/Documentation/devicetree/bindings/serial/fsl-imx-uart.txt
+++ b/Documentation/devicetree/bindings/serial/fsl-imx-uart.txt
@@ -9,7 +9,7 @@ Optional properties:
 - fsl,uart-has-rtscts : Indicate the uart has rts and cts
 - fsl,irda-mode : Indicate the uart supports irda mode
 - fsl,dte-mode : Indicate the uart works in DTE mode. The uart works
-                  is DCE mode by default.
+                  in DCE mode by default.
 Note: Each uart controller should have an alias correctly numbered
 in "aliases" node.
diff --git a/Documentation/filesystems/efivarfs.txt b/Documentation/filesystems/efivarfs.txt
index c477af086e65..686a64bba775 100644
--- a/Documentation/filesystems/efivarfs.txt
+++ b/Documentation/filesystems/efivarfs.txt
@@ -14,3 +14,10 @@ filesystem.
 efivarfs is typically mounted like this,
        mount -t efivarfs none /sys/firmware/efi/efivars
+Due to the presence of numerous firmware bugs where removing non-standard
+UEFI variables causes the system firmware to fail to POST, efivarfs
+files that are not well-known standardized variables are created
+as immutable files.  This doesn't prevent removal - "chattr -i" will work -
+but it does prevent this kind of failure from being accomplished
+accidentally.
diff --git a/Documentation/timers/hpet.txt b/Documentation/timers/hpet.txt
index 767392ffd31e..a484d2c109d7 100644
--- a/Documentation/timers/hpet.txt
+++ b/Documentation/timers/hpet.txt
@@ -1,9 +1,7 @@
                High Precision Event Timer Driver for Linux
 The High Precision Event Timer (HPET) hardware follows a specification
-by Intel and Microsoft which can be found at
+by Intel and Microsoft, revision 1.
-        http://www.intel.com/hardwaredesign/hpetspec_1.pdf
 Each HPET has one fixed-rate counter (at 10+ MHz, hence "High Precision")
 and up to 32 comparators.  Normally three or more comparators are provided,
diff --git a/MAINTAINERS b/MAINTAINERS
index 28eb61bbecf4..4978dc19a4d2 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -6128,7 +6128,7 @@ F:	include/uapi/linux/sunrpc/
 KERNEL SELFTEST FRAMEWORK
 M:      Shuah Khan <shuahkh@osg.samsung.com>
-L:      linux-api@vger.kernel.org
+L:      linux-kselftest@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/shuah/linux-kselftest
 S:      Maintained
 F:      tools/testing/selftests
diff --git a/Makefile b/Makefile
index 701c36056ca8..fbe1b921798f 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 4
 PATCHLEVEL = 5
 SUBLEVEL = 0
-EXTRAVERSION = -rc4
+EXTRAVERSION = -rc5
 NAME = Blurry Fish Butt
 # *DOCUMENTATION*
diff --git a/arch/arm/crypto/aes-ce-glue.c b/arch/arm/crypto/aes-ce-glue.c
index b445a5d56f43..89a3a3e592d6 100644
--- a/arch/arm/crypto/aes-ce-glue.c
+++ b/arch/arm/crypto/aes-ce-glue.c
@@ -364,7 +364,7 @@ static struct crypto_alg aes_algs[] = { {
        .cra_blkcipher = {
                .min_keysize    = AES_MIN_KEY_SIZE,
                .max_keysize    = AES_MAX_KEY_SIZE,
-                .ivsize         = AES_BLOCK_SIZE,
+                .ivsize         = 0,
                .setkey         = ce_aes_setkey,
                .encrypt        = ecb_encrypt,
                .decrypt        = ecb_decrypt,
@@ -441,7 +441,7 @@ static struct crypto_alg aes_algs[] = { {
        .cra_ablkcipher = {
                .min_keysize    = AES_MIN_KEY_SIZE,
                .max_keysize    = AES_MAX_KEY_SIZE,
-                .ivsize         = AES_BLOCK_SIZE,
+                .ivsize         = 0,
                .setkey         = ablk_set_key,
                .encrypt        = ablk_encrypt,
                .decrypt        = ablk_decrypt,
diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile
index 307237cfe728..b5e3f6d42b88 100644
--- a/arch/arm64/Makefile
+++ b/arch/arm64/Makefile
@@ -88,7 +88,7 @@ Image: vmlinux
 Image.%: vmlinux
        $(Q)$(MAKE) $(build)=$(boot) $(boot)/$@
-zinstall install: vmlinux
+zinstall install:
        $(Q)$(MAKE) $(build)=$(boot) $@
 %.dtb: scripts
diff --git a/arch/arm64/boot/Makefile b/arch/arm64/boot/Makefile
index abcbba2f01ba..305c552b5ec1 100644
--- a/arch/arm64/boot/Makefile
+++ b/arch/arm64/boot/Makefile
@@ -34,10 +34,10 @@ $(obj)/Image.lzma: $(obj)/Image FORCE
 $(obj)/Image.lzo: $(obj)/Image FORCE
        $(call if_changed,lzo)
-install: $(obj)/Image
+install:
        $(CONFIG_SHELL) $(srctree)/$(src)/install.sh $(KERNELRELEASE) \
        $(obj)/Image System.map "$(INSTALL_PATH)"
-zinstall: $(obj)/Image.gz
+zinstall:
        $(CONFIG_SHELL) $(srctree)/$(src)/install.sh $(KERNELRELEASE) \
        $(obj)/Image.gz System.map "$(INSTALL_PATH)"
diff --git a/arch/arm64/boot/install.sh b/arch/arm64/boot/install.sh
index 12ed78aa6f0c..d91e1f022573 100644
--- a/arch/arm64/boot/install.sh
+++ b/arch/arm64/boot/install.sh
@@ -20,6 +20,20 @@
 #   $4 - default install path (blank if root directory)
 #
+verify () {
+        if [ ! -f "$1" ]; then
+                echo ""                                                   1>&2
+                echo " *** Missing file: $1"                              1>&2
+                echo ' *** You need to run "make" before "make install".' 1>&2
+                echo ""                                                   1>&2
+                exit 1
+        fi
+}
+# Make sure the files actually exist
+verify "$2"
+verify "$3"
 # User may have a custom install script
 if [ -x ~/bin/${INSTALLKERNEL} ]; then exec ~/bin/${INSTALLKERNEL} "$@"; fi
 if [ -x /sbin/${INSTALLKERNEL} ]; then exec /sbin/${INSTALLKERNEL} "$@"; fi
diff --git a/arch/arm64/crypto/aes-glue.c b/arch/arm64/crypto/aes-glue.c
index 05d9e16c0dfd..7a3d22a46faf 100644
--- a/arch/arm64/crypto/aes-glue.c
+++ b/arch/arm64/crypto/aes-glue.c
@@ -294,7 +294,7 @@ static struct crypto_alg aes_algs[] = { {
        .cra_blkcipher = {
                .min_keysize    = AES_MIN_KEY_SIZE,
                .max_keysize    = AES_MAX_KEY_SIZE,
-                .ivsize         = AES_BLOCK_SIZE,
+                .ivsize         = 0,
                .setkey         = aes_setkey,
                .encrypt        = ecb_encrypt,
                .decrypt        = ecb_decrypt,
@@ -371,7 +371,7 @@ static struct crypto_alg aes_algs[] = { {
        .cra_ablkcipher = {
                .min_keysize    = AES_MIN_KEY_SIZE,
                .max_keysize    = AES_MAX_KEY_SIZE,
-                .ivsize         = AES_BLOCK_SIZE,
+                .ivsize         = 0,
                .setkey         = ablk_set_key,
                .encrypt        = ablk_encrypt,
                .decrypt        = ablk_decrypt,
diff --git a/arch/arm64/include/asm/kvm_arm.h b/arch/arm64/include/asm/kvm_arm.h
index bef6e9243c63..d201d4b396d1 100644
--- a/arch/arm64/include/asm/kvm_arm.h
+++ b/arch/arm64/include/asm/kvm_arm.h
@@ -107,8 +107,6 @@
 #define TCR_EL2_MASK    (TCR_EL2_TG0 | TCR_EL2_SH0 | \
                         TCR_EL2_ORGN0 | TCR_EL2_IRGN0 | TCR_EL2_T0SZ)
-#define TCR_EL2_FLAGS   (TCR_EL2_RES1 | TCR_EL2_PS_40B)
 /* VTCR_EL2 Registers bits */
 #define VTCR_EL2_RES1           (1 << 31)
 #define VTCR_EL2_PS_MASK        (7 << 16)
diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c
index 8aee3aeec3e6..c536c9e307b9 100644
--- a/arch/arm64/kernel/debug-monitors.c
+++ b/arch/arm64/kernel/debug-monitors.c
@@ -226,11 +226,28 @@ static int call_step_hook(struct pt_regs *regs, unsigned int esr)
        return retval;
 }
+static void send_user_sigtrap(int si_code)
+{
+        struct pt_regs *regs = current_pt_regs();
+        siginfo_t info = {
+                .si_signo       = SIGTRAP,
+                .si_errno       = 0,
+                .si_code        = si_code,
+                .si_addr        = (void __user *)instruction_pointer(regs),
+        };
+        if (WARN_ON(!user_mode(regs)))
+                return;
+        if (interrupts_enabled(regs))
+                local_irq_enable();
+        force_sig_info(SIGTRAP, &info, current);
+}
 static int single_step_handler(unsigned long addr, unsigned int esr,
                               struct pt_regs *regs)
 {
-        siginfo_t info;
        /*
         * If we are stepping a pending breakpoint, call the hw_breakpoint
         * handler first.
@@ -239,11 +256,7 @@ static int single_step_handler(unsigned long addr, unsigned int esr,
                return 0;
        if (user_mode(regs)) {
-                info.si_signo = SIGTRAP;
+                send_user_sigtrap(TRAP_HWBKPT);
-                info.si_errno = 0;
-                info.si_code  = TRAP_HWBKPT;
-                info.si_addr  = (void __user *)instruction_pointer(regs);
-                force_sig_info(SIGTRAP, &info, current);
                /*
                 * ptrace will disable single step unless explicitly
@@ -307,17 +320,8 @@ static int call_break_hook(struct pt_regs *regs, unsigned int esr)
 static int brk_handler(unsigned long addr, unsigned int esr,
                       struct pt_regs *regs)
 {
-        siginfo_t info;
        if (user_mode(regs)) {
-                info = (siginfo_t) {
+                send_user_sigtrap(TRAP_BRKPT);
-                        .si_signo = SIGTRAP,
-                        .si_errno = 0,
-                        .si_code  = TRAP_BRKPT,
-                        .si_addr  = (void __user *)instruction_pointer(regs),
-                };
-                force_sig_info(SIGTRAP, &info, current);
        } else if (call_break_hook(regs, esr) != DBG_HOOK_HANDLED) {
                pr_warning("Unexpected kernel BRK exception at EL1\n");
                return -EFAULT;
@@ -328,7 +332,6 @@ static int brk_handler(unsigned long addr, unsigned int esr,
 int aarch32_break_handler(struct pt_regs *regs)
 {
-        siginfo_t info;
        u32 arm_instr;
        u16 thumb_instr;
        bool bp = false;
@@ -359,14 +362,7 @@ int aarch32_break_handler(struct pt_regs *regs)
        if (!bp)
                return -EFAULT;
-        info = (siginfo_t) {
+        send_user_sigtrap(TRAP_BRKPT);
-                .si_signo = SIGTRAP,
-                .si_errno = 0,
-                .si_code  = TRAP_BRKPT,
-                .si_addr  = pc,
-        };
-        force_sig_info(SIGTRAP, &info, current);
        return 0;
 }
diff --git a/arch/arm64/kernel/image.h b/arch/arm64/kernel/image.h
index 999633bd7294..352f7abd91c9 100644
--- a/arch/arm64/kernel/image.h
+++ b/arch/arm64/kernel/image.h
@@ -89,6 +89,7 @@ __efistub_memcpy		= KALLSYMS_HIDE(__pi_memcpy);
 __efistub_memmove               = KALLSYMS_HIDE(__pi_memmove);
 __efistub_memset                = KALLSYMS_HIDE(__pi_memset);
 __efistub_strlen                = KALLSYMS_HIDE(__pi_strlen);
+__efistub_strnlen               = KALLSYMS_HIDE(__pi_strnlen);
 __efistub_strcmp                = KALLSYMS_HIDE(__pi_strcmp);
 __efistub_strncmp               = KALLSYMS_HIDE(__pi_strncmp);
 __efistub___flush_dcache_area   = KALLSYMS_HIDE(__pi___flush_dcache_area);
diff --git a/arch/arm64/kernel/stacktrace.c b/arch/arm64/kernel/stacktrace.c
index 4fad9787ab46..d9751a4769e7 100644
--- a/arch/arm64/kernel/stacktrace.c
+++ b/arch/arm64/kernel/stacktrace.c
@@ -44,14 +44,13 @@ int notrace unwind_frame(struct task_struct *tsk, struct stackframe *frame)
        unsigned long irq_stack_ptr;
        /*
-         * Use raw_smp_processor_id() to avoid false-positives from
+         * Switching between stacks is valid when tracing current and in
-         * CONFIG_DEBUG_PREEMPT. get_wchan() calls unwind_frame() on sleeping
+         * non-preemptible context.
-         * task stacks, we can be pre-empted in this case, so
-         * {raw_,}smp_processor_id() may give us the wrong value. Sleeping
-         * tasks can't ever be on an interrupt stack, so regardless of cpu,
-         * the checks will always fail.
         */
-        irq_stack_ptr = IRQ_STACK_PTR(raw_smp_processor_id());
+        if (tsk == current && !preemptible())
+                irq_stack_ptr = IRQ_STACK_PTR(smp_processor_id());
+        else
+                irq_stack_ptr = 0;
        low  = frame->sp;
        /* irq stacks are not THREAD_SIZE aligned */
@@ -64,8 +63,8 @@ int notrace unwind_frame(struct task_struct *tsk, struct stackframe *frame)
                return -EINVAL;
        frame->sp = fp + 0x10;
-        frame->fp = *(unsigned long *)(fp);
+        frame->fp = READ_ONCE_NOCHECK(*(unsigned long *)(fp));
-        frame->pc = *(unsigned long *)(fp + 8);
+        frame->pc = READ_ONCE_NOCHECK(*(unsigned long *)(fp + 8));
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
        if (tsk && tsk->ret_stack &&
diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
index cbedd724f48e..c5392081b49b 100644
--- a/arch/arm64/kernel/traps.c
+++ b/arch/arm64/kernel/traps.c
@@ -146,9 +146,18 @@ static void dump_instr(const char *lvl, struct pt_regs *regs)
 static void dump_backtrace(struct pt_regs *regs, struct task_struct *tsk)
 {
        struct stackframe frame;
-        unsigned long irq_stack_ptr = IRQ_STACK_PTR(smp_processor_id());
+        unsigned long irq_stack_ptr;
        int skip;
+        /*
+         * Switching between stacks is valid when tracing current and in
+         * non-preemptible context.
+         */
+        if (tsk == current && !preemptible())
+                irq_stack_ptr = IRQ_STACK_PTR(smp_processor_id());
+        else
+                irq_stack_ptr = 0;
        pr_debug("%s(regs = %p tsk = %p)\n", __func__, regs, tsk);
        if (!tsk)
diff --git a/arch/arm64/kvm/hyp-init.S b/arch/arm64/kvm/hyp-init.S
index 3e568dcd907b..d073b5a216f7 100644
--- a/arch/arm64/kvm/hyp-init.S
+++ b/arch/arm64/kvm/hyp-init.S
@@ -64,7 +64,7 @@ __do_hyp_init:
        mrs     x4, tcr_el1
        ldr     x5, =TCR_EL2_MASK
        and     x4, x4, x5
-        ldr     x5, =TCR_EL2_FLAGS
+        mov     x5, #TCR_EL2_RES1
        orr     x4, x4, x5
 #ifndef CONFIG_ARM64_VA_BITS_48
@@ -85,15 +85,17 @@ __do_hyp_init:
        ldr_l   x5, idmap_t0sz
        bfi     x4, x5, TCR_T0SZ_OFFSET, TCR_TxSZ_WIDTH
 #endif
-        msr     tcr_el2, x4
-        ldr     x4, =VTCR_EL2_FLAGS
        /*
         * Read the PARange bits from ID_AA64MMFR0_EL1 and set the PS bits in
-         * VTCR_EL2.
+         * TCR_EL2 and VTCR_EL2.
         */
        mrs     x5, ID_AA64MMFR0_EL1
        bfi     x4, x5, #16, #3
+        msr     tcr_el2, x4
+        ldr     x4, =VTCR_EL2_FLAGS
+        bfi     x4, x5, #16, #3
        /*
         * Read the VMIDBits bits from ID_AA64MMFR1_EL1 and set the VS bit in
         * VTCR_EL2.
diff --git a/arch/arm64/lib/strnlen.S b/arch/arm64/lib/strnlen.S
index 2ca665711bf2..eae38da6e0bb 100644
--- a/arch/arm64/lib/strnlen.S
+++ b/arch/arm64/lib/strnlen.S
@@ -168,4 +168,4 @@ CPU_LE( lsr	tmp2, tmp2, tmp4 )	/* Shift (tmp1 & 63).  */
 .Lhit_limit:
        mov     len, limit
        ret
-ENDPROC(strnlen)
+ENDPIPROC(strnlen)
diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c
index 331c4ca6205c..a6e757cbab77 100644
--- a/arch/arm64/mm/dma-mapping.c
+++ b/arch/arm64/mm/dma-mapping.c
@@ -933,6 +933,10 @@ static int __init __iommu_dma_init(void)
                ret = register_iommu_dma_ops_notifier(&platform_bus_type);
        if (!ret)
                ret = register_iommu_dma_ops_notifier(&amba_bustype);
+        /* handle devices queued before this arch_initcall */
+        if (!ret)
+                __iommu_attach_notifier(NULL, BUS_NOTIFY_ADD_DEVICE, NULL);
        return ret;
 }
 arch_initcall(__iommu_dma_init);
diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
index 92ddac1e8ca2..abe2a9542b3a 100644
--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -371,6 +371,13 @@ static int __kprobes do_translation_fault(unsigned long addr,
        return 0;
 }
+static int do_alignment_fault(unsigned long addr, unsigned int esr,
+                              struct pt_regs *regs)
+{
+        do_bad_area(addr, esr, regs);
+        return 0;
+}
 /*
 * This abort handler always returns "fault".
 */
@@ -418,7 +425,7 @@ static struct fault_info {
        { do_bad,               SIGBUS,  0,             "synchronous parity error (translation table walk)" },
        { do_bad,               SIGBUS,  0,             "synchronous parity error (translation table walk)" },
        { do_bad,               SIGBUS,  0,             "unknown 32"                    },
-        { do_bad,               SIGBUS,  BUS_ADRALN,    "alignment fault"               },
+        { do_alignment_fault,   SIGBUS,  BUS_ADRALN,    "alignment fault"               },
        { do_bad,               SIGBUS,  0,             "unknown 34"                    },
        { do_bad,               SIGBUS,  0,             "unknown 35"                    },
        { do_bad,               SIGBUS,  0,             "unknown 36"                    },
diff --git a/arch/m68k/configs/amiga_defconfig b/arch/m68k/configs/amiga_defconfig
index fc96e814188e..d1fc4796025e 100644
--- a/arch/m68k/configs/amiga_defconfig
+++ b/arch/m68k/configs/amiga_defconfig
@@ -108,6 +108,8 @@ CONFIG_NFT_NAT=m
 CONFIG_NFT_QUEUE=m
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
+CONFIG_NFT_DUP_NETDEV=m
+CONFIG_NFT_FWD_NETDEV=m
 CONFIG_NETFILTER_XT_SET=m
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
@@ -266,6 +268,12 @@ CONFIG_L2TP=m
 CONFIG_BRIDGE=m
 CONFIG_ATALK=m
 CONFIG_6LOWPAN=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_HOP=m
+CONFIG_6LOWPAN_GHC_UDP=m
+CONFIG_6LOWPAN_GHC_ICMPV6=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_DEST=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_FRAG=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_ROUTE=m
 CONFIG_DNS_RESOLVER=y
 CONFIG_BATMAN_ADV=m
 CONFIG_BATMAN_ADV_DAT=y
@@ -366,6 +374,7 @@ CONFIG_ARIADNE=y
 # CONFIG_NET_VENDOR_INTEL is not set
 # CONFIG_NET_VENDOR_MARVELL is not set
 # CONFIG_NET_VENDOR_MICREL is not set
+# CONFIG_NET_VENDOR_NETRONOME is not set
 CONFIG_HYDRA=y
 CONFIG_APNE=y
 CONFIG_ZORRO8390=y
diff --git a/arch/m68k/configs/apollo_defconfig b/arch/m68k/configs/apollo_defconfig
index 05c904f08d9d..9bfe8be3658c 100644
--- a/arch/m68k/configs/apollo_defconfig
+++ b/arch/m68k/configs/apollo_defconfig
@@ -106,6 +106,8 @@ CONFIG_NFT_NAT=m
 CONFIG_NFT_QUEUE=m
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
+CONFIG_NFT_DUP_NETDEV=m
+CONFIG_NFT_FWD_NETDEV=m
 CONFIG_NETFILTER_XT_SET=m
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
@@ -264,6 +266,12 @@ CONFIG_L2TP=m
 CONFIG_BRIDGE=m
 CONFIG_ATALK=m
 CONFIG_6LOWPAN=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_HOP=m
+CONFIG_6LOWPAN_GHC_UDP=m
+CONFIG_6LOWPAN_GHC_ICMPV6=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_DEST=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_FRAG=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_ROUTE=m
 CONFIG_DNS_RESOLVER=y
 CONFIG_BATMAN_ADV=m
 CONFIG_BATMAN_ADV_DAT=y
@@ -344,6 +352,7 @@ CONFIG_VETH=m
 # CONFIG_NET_VENDOR_MARVELL is not set
 # CONFIG_NET_VENDOR_MICREL is not set
 # CONFIG_NET_VENDOR_NATSEMI is not set
+# CONFIG_NET_VENDOR_NETRONOME is not set
 # CONFIG_NET_VENDOR_QUALCOMM is not set
 # CONFIG_NET_VENDOR_RENESAS is not set
 # CONFIG_NET_VENDOR_ROCKER is not set
diff --git a/arch/m68k/configs/atari_defconfig b/arch/m68k/configs/atari_defconfig
index d572b731c510..ebdcfae55580 100644
--- a/arch/m68k/configs/atari_defconfig
+++ b/arch/m68k/configs/atari_defconfig
@@ -106,6 +106,8 @@ CONFIG_NFT_NAT=m
 CONFIG_NFT_QUEUE=m
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
+CONFIG_NFT_DUP_NETDEV=m
+CONFIG_NFT_FWD_NETDEV=m
 CONFIG_NETFILTER_XT_SET=m
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
@@ -264,6 +266,12 @@ CONFIG_L2TP=m
 CONFIG_BRIDGE=m
 CONFIG_ATALK=m
 CONFIG_6LOWPAN=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_HOP=m
+CONFIG_6LOWPAN_GHC_UDP=m
+CONFIG_6LOWPAN_GHC_ICMPV6=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_DEST=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_FRAG=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_ROUTE=m
 CONFIG_DNS_RESOLVER=y
 CONFIG_BATMAN_ADV=m
 CONFIG_BATMAN_ADV_DAT=y
@@ -353,6 +361,7 @@ CONFIG_ATARILANCE=y
 # CONFIG_NET_VENDOR_INTEL is not set
 # CONFIG_NET_VENDOR_MARVELL is not set
 # CONFIG_NET_VENDOR_MICREL is not set
+# CONFIG_NET_VENDOR_NETRONOME is not set
 CONFIG_NE2000=y
 # CONFIG_NET_VENDOR_QUALCOMM is not set
 # CONFIG_NET_VENDOR_RENESAS is not set
diff --git a/arch/m68k/configs/bvme6000_defconfig b/arch/m68k/configs/bvme6000_defconfig
index 11a30c65ad44..8acc65e54995 100644
--- a/arch/m68k/configs/bvme6000_defconfig
+++ b/arch/m68k/configs/bvme6000_defconfig
@@ -104,6 +104,8 @@ CONFIG_NFT_NAT=m
 CONFIG_NFT_QUEUE=m
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
+CONFIG_NFT_DUP_NETDEV=m
+CONFIG_NFT_FWD_NETDEV=m
 CONFIG_NETFILTER_XT_SET=m
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
@@ -262,6 +264,12 @@ CONFIG_L2TP=m
 CONFIG_BRIDGE=m
 CONFIG_ATALK=m
 CONFIG_6LOWPAN=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_HOP=m
+CONFIG_6LOWPAN_GHC_UDP=m
+CONFIG_6LOWPAN_GHC_ICMPV6=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_DEST=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_FRAG=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_ROUTE=m
 CONFIG_DNS_RESOLVER=y
 CONFIG_BATMAN_ADV=m
 CONFIG_BATMAN_ADV_DAT=y
@@ -343,6 +351,7 @@ CONFIG_BVME6000_NET=y
 # CONFIG_NET_VENDOR_MARVELL is not set
 # CONFIG_NET_VENDOR_MICREL is not set
 # CONFIG_NET_VENDOR_NATSEMI is not set
+# CONFIG_NET_VENDOR_NETRONOME is not set
 # CONFIG_NET_VENDOR_QUALCOMM is not set
 # CONFIG_NET_VENDOR_RENESAS is not set
 # CONFIG_NET_VENDOR_ROCKER is not set
diff --git a/arch/m68k/configs/hp300_defconfig b/arch/m68k/configs/hp300_defconfig
index 6630a5154b9d..0c6a3d52b26e 100644
--- a/arch/m68k/configs/hp300_defconfig
+++ b/arch/m68k/configs/hp300_defconfig
@@ -106,6 +106,8 @@ CONFIG_NFT_NAT=m
 CONFIG_NFT_QUEUE=m
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
+CONFIG_NFT_DUP_NETDEV=m
+CONFIG_NFT_FWD_NETDEV=m
 CONFIG_NETFILTER_XT_SET=m
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
@@ -264,6 +266,12 @@ CONFIG_L2TP=m
 CONFIG_BRIDGE=m
 CONFIG_ATALK=m
 CONFIG_6LOWPAN=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_HOP=m
+CONFIG_6LOWPAN_GHC_UDP=m
+CONFIG_6LOWPAN_GHC_ICMPV6=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_DEST=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_FRAG=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_ROUTE=m
 CONFIG_DNS_RESOLVER=y
 CONFIG_BATMAN_ADV=m
 CONFIG_BATMAN_ADV_DAT=y
@@ -345,6 +353,7 @@ CONFIG_HPLANCE=y
 # CONFIG_NET_VENDOR_MARVELL is not set
 # CONFIG_NET_VENDOR_MICREL is not set
 # CONFIG_NET_VENDOR_NATSEMI is not set
+# CONFIG_NET_VENDOR_NETRONOME is not set
 # CONFIG_NET_VENDOR_QUALCOMM is not set
 # CONFIG_NET_VENDOR_RENESAS is not set
 # CONFIG_NET_VENDOR_ROCKER is not set
diff --git a/arch/m68k/configs/mac_defconfig b/arch/m68k/configs/mac_defconfig
index 1d90b71d0903..12a8a6cb32f4 100644
--- a/arch/m68k/configs/mac_defconfig
+++ b/arch/m68k/configs/mac_defconfig
@@ -105,6 +105,8 @@ CONFIG_NFT_NAT=m
 CONFIG_NFT_QUEUE=m
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
+CONFIG_NFT_DUP_NETDEV=m
+CONFIG_NFT_FWD_NETDEV=m
 CONFIG_NETFILTER_XT_SET=m
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
@@ -266,6 +268,12 @@ CONFIG_DEV_APPLETALK=m
 CONFIG_IPDDP=m
 CONFIG_IPDDP_ENCAP=y
 CONFIG_6LOWPAN=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_HOP=m
+CONFIG_6LOWPAN_GHC_UDP=m
+CONFIG_6LOWPAN_GHC_ICMPV6=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_DEST=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_FRAG=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_ROUTE=m
 CONFIG_DNS_RESOLVER=y
 CONFIG_BATMAN_ADV=m
 CONFIG_BATMAN_ADV_DAT=y
@@ -362,6 +370,7 @@ CONFIG_MAC89x0=y
 # CONFIG_NET_VENDOR_MARVELL is not set
 # CONFIG_NET_VENDOR_MICREL is not set
 CONFIG_MACSONIC=y
+# CONFIG_NET_VENDOR_NETRONOME is not set
 CONFIG_MAC8390=y
 # CONFIG_NET_VENDOR_QUALCOMM is not set
 # CONFIG_NET_VENDOR_RENESAS is not set
diff --git a/arch/m68k/configs/multi_defconfig b/arch/m68k/configs/multi_defconfig
index 1fd21c1ca87f..64ff2dcb34c8 100644
--- a/arch/m68k/configs/multi_defconfig
+++ b/arch/m68k/configs/multi_defconfig
@@ -115,6 +115,8 @@ CONFIG_NFT_NAT=m
 CONFIG_NFT_QUEUE=m
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
+CONFIG_NFT_DUP_NETDEV=m
+CONFIG_NFT_FWD_NETDEV=m
 CONFIG_NETFILTER_XT_SET=m
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
@@ -276,6 +278,12 @@ CONFIG_DEV_APPLETALK=m
 CONFIG_IPDDP=m
 CONFIG_IPDDP_ENCAP=y
 CONFIG_6LOWPAN=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_HOP=m
+CONFIG_6LOWPAN_GHC_UDP=m
+CONFIG_6LOWPAN_GHC_ICMPV6=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_DEST=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_FRAG=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_ROUTE=m
 CONFIG_DNS_RESOLVER=y
 CONFIG_BATMAN_ADV=m
 CONFIG_BATMAN_ADV_DAT=y
@@ -404,6 +412,7 @@ CONFIG_MVME16x_NET=y
 # CONFIG_NET_VENDOR_MARVELL is not set
 # CONFIG_NET_VENDOR_MICREL is not set
 CONFIG_MACSONIC=y
+# CONFIG_NET_VENDOR_NETRONOME is not set
 CONFIG_HYDRA=y
 CONFIG_MAC8390=y
 CONFIG_NE2000=y
diff --git a/arch/m68k/configs/mvme147_defconfig b/arch/m68k/configs/mvme147_defconfig
index 74e10f79d7b1..07fc6abcfe0c 100644
--- a/arch/m68k/configs/mvme147_defconfig
+++ b/arch/m68k/configs/mvme147_defconfig
@@ -103,6 +103,8 @@ CONFIG_NFT_NAT=m
 CONFIG_NFT_QUEUE=m
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
+CONFIG_NFT_DUP_NETDEV=m
+CONFIG_NFT_FWD_NETDEV=m
 CONFIG_NETFILTER_XT_SET=m
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
@@ -261,6 +263,12 @@ CONFIG_L2TP=m
 CONFIG_BRIDGE=m
 CONFIG_ATALK=m
 CONFIG_6LOWPAN=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_HOP=m
+CONFIG_6LOWPAN_GHC_UDP=m
+CONFIG_6LOWPAN_GHC_ICMPV6=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_DEST=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_FRAG=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_ROUTE=m
 CONFIG_DNS_RESOLVER=y
 CONFIG_BATMAN_ADV=m
 CONFIG_BATMAN_ADV_DAT=y
@@ -343,6 +351,7 @@ CONFIG_MVME147_NET=y
 # CONFIG_NET_VENDOR_MARVELL is not set
 # CONFIG_NET_VENDOR_MICREL is not set
 # CONFIG_NET_VENDOR_NATSEMI is not set
+# CONFIG_NET_VENDOR_NETRONOME is not set
 # CONFIG_NET_VENDOR_QUALCOMM is not set
 # CONFIG_NET_VENDOR_RENESAS is not set
 # CONFIG_NET_VENDOR_ROCKER is not set
diff --git a/arch/m68k/configs/mvme16x_defconfig b/arch/m68k/configs/mvme16x_defconfig
index 7034e716f166..69903ded88f7 100644
--- a/arch/m68k/configs/mvme16x_defconfig
+++ b/arch/m68k/configs/mvme16x_defconfig
@@ -104,6 +104,8 @@ CONFIG_NFT_NAT=m
 CONFIG_NFT_QUEUE=m
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
+CONFIG_NFT_DUP_NETDEV=m
+CONFIG_NFT_FWD_NETDEV=m
 CONFIG_NETFILTER_XT_SET=m
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
@@ -262,6 +264,12 @@ CONFIG_L2TP=m
 CONFIG_BRIDGE=m
 CONFIG_ATALK=m
 CONFIG_6LOWPAN=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_HOP=m
+CONFIG_6LOWPAN_GHC_UDP=m
+CONFIG_6LOWPAN_GHC_ICMPV6=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_DEST=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_FRAG=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_ROUTE=m
 CONFIG_DNS_RESOLVER=y
 CONFIG_BATMAN_ADV=m
 CONFIG_BATMAN_ADV_DAT=y
@@ -343,6 +351,7 @@ CONFIG_MVME16x_NET=y
 # CONFIG_NET_VENDOR_MARVELL is not set
 # CONFIG_NET_VENDOR_MICREL is not set
 # CONFIG_NET_VENDOR_NATSEMI is not set
+# CONFIG_NET_VENDOR_NETRONOME is not set
 # CONFIG_NET_VENDOR_QUALCOMM is not set
 # CONFIG_NET_VENDOR_RENESAS is not set
 # CONFIG_NET_VENDOR_ROCKER is not set
diff --git a/arch/m68k/configs/q40_defconfig b/arch/m68k/configs/q40_defconfig
index f7deb5f702a6..bd8401686dde 100644
--- a/arch/m68k/configs/q40_defconfig
+++ b/arch/m68k/configs/q40_defconfig
@@ -104,6 +104,8 @@ CONFIG_NFT_NAT=m
 CONFIG_NFT_QUEUE=m
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
+CONFIG_NFT_DUP_NETDEV=m
+CONFIG_NFT_FWD_NETDEV=m
 CONFIG_NETFILTER_XT_SET=m
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
@@ -262,6 +264,12 @@ CONFIG_L2TP=m
 CONFIG_BRIDGE=m
 CONFIG_ATALK=m
 CONFIG_6LOWPAN=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_HOP=m
+CONFIG_6LOWPAN_GHC_UDP=m
+CONFIG_6LOWPAN_GHC_ICMPV6=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_DEST=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_FRAG=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_ROUTE=m
 CONFIG_DNS_RESOLVER=y
 CONFIG_BATMAN_ADV=m
 CONFIG_BATMAN_ADV_DAT=y
@@ -352,6 +360,7 @@ CONFIG_VETH=m
 # CONFIG_NET_VENDOR_INTEL is not set
 # CONFIG_NET_VENDOR_MARVELL is not set
 # CONFIG_NET_VENDOR_MICREL is not set
+# CONFIG_NET_VENDOR_NETRONOME is not set
 CONFIG_NE2000=y
 # CONFIG_NET_VENDOR_QUALCOMM is not set
 # CONFIG_NET_VENDOR_RENESAS is not set
diff --git a/arch/m68k/configs/sun3_defconfig b/arch/m68k/configs/sun3_defconfig
index 0ce79eb0d805..5f9fb3ab9636 100644
--- a/arch/m68k/configs/sun3_defconfig
+++ b/arch/m68k/configs/sun3_defconfig
@@ -101,6 +101,8 @@ CONFIG_NFT_NAT=m
 CONFIG_NFT_QUEUE=m
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
+CONFIG_NFT_DUP_NETDEV=m
+CONFIG_NFT_FWD_NETDEV=m
 CONFIG_NETFILTER_XT_SET=m
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
@@ -259,6 +261,12 @@ CONFIG_L2TP=m
 CONFIG_BRIDGE=m
 CONFIG_ATALK=m
 CONFIG_6LOWPAN=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_HOP=m
+CONFIG_6LOWPAN_GHC_UDP=m
+CONFIG_6LOWPAN_GHC_ICMPV6=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_DEST=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_FRAG=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_ROUTE=m
 CONFIG_DNS_RESOLVER=y
 CONFIG_BATMAN_ADV=m
 CONFIG_BATMAN_ADV_DAT=y
@@ -340,6 +348,7 @@ CONFIG_SUN3_82586=y
 # CONFIG_NET_VENDOR_MARVELL is not set
 # CONFIG_NET_VENDOR_MICREL is not set
 # CONFIG_NET_VENDOR_NATSEMI is not set
+# CONFIG_NET_VENDOR_NETRONOME is not set
 # CONFIG_NET_VENDOR_QUALCOMM is not set
 # CONFIG_NET_VENDOR_RENESAS is not set
 # CONFIG_NET_VENDOR_ROCKER is not set
diff --git a/arch/m68k/configs/sun3x_defconfig b/arch/m68k/configs/sun3x_defconfig
index 4cb787e4991f..5d1c674530e2 100644
--- a/arch/m68k/configs/sun3x_defconfig
+++ b/arch/m68k/configs/sun3x_defconfig
@@ -101,6 +101,8 @@ CONFIG_NFT_NAT=m
 CONFIG_NFT_QUEUE=m
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_COMPAT=m
+CONFIG_NFT_DUP_NETDEV=m
+CONFIG_NFT_FWD_NETDEV=m
 CONFIG_NETFILTER_XT_SET=m
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
@@ -259,6 +261,12 @@ CONFIG_L2TP=m
 CONFIG_BRIDGE=m
 CONFIG_ATALK=m
 CONFIG_6LOWPAN=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_HOP=m
+CONFIG_6LOWPAN_GHC_UDP=m
+CONFIG_6LOWPAN_GHC_ICMPV6=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_DEST=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_FRAG=m
+CONFIG_6LOWPAN_GHC_EXT_HDR_ROUTE=m
 CONFIG_DNS_RESOLVER=y
 CONFIG_BATMAN_ADV=m
 CONFIG_BATMAN_ADV_DAT=y
@@ -341,6 +349,7 @@ CONFIG_SUN3LANCE=y
 # CONFIG_NET_VENDOR_MARVELL is not set
 # CONFIG_NET_VENDOR_MICREL is not set
 # CONFIG_NET_VENDOR_NATSEMI is not set
+# CONFIG_NET_VENDOR_NETRONOME is not set
 # CONFIG_NET_VENDOR_QUALCOMM is not set
 # CONFIG_NET_VENDOR_RENESAS is not set
 # CONFIG_NET_VENDOR_ROCKER is not set
diff --git a/arch/m68k/include/asm/unistd.h b/arch/m68k/include/asm/unistd.h
index f9d96bf86910..bafaff6dcd7b 100644
--- a/arch/m68k/include/asm/unistd.h
+++ b/arch/m68k/include/asm/unistd.h
@@ -4,7 +4,7 @@
 #include <uapi/asm/unistd.h>
-#define NR_syscalls             376
+#define NR_syscalls             377
 #define __ARCH_WANT_OLD_READDIR
 #define __ARCH_WANT_OLD_STAT
diff --git a/arch/m68k/include/uapi/asm/unistd.h b/arch/m68k/include/uapi/asm/unistd.h
index 36cf129de663..0ca729665f29 100644
--- a/arch/m68k/include/uapi/asm/unistd.h
+++ b/arch/m68k/include/uapi/asm/unistd.h
@@ -381,5 +381,6 @@
 #define __NR_userfaultfd        373
 #define __NR_membarrier         374
 #define __NR_mlock2             375
+#define __NR_copy_file_range    376
 #endif /* _UAPI_ASM_M68K_UNISTD_H_ */
diff --git a/arch/m68k/kernel/syscalltable.S b/arch/m68k/kernel/syscalltable.S
index 282cd903f4c4..8bb94261ff97 100644
--- a/arch/m68k/kernel/syscalltable.S
+++ b/arch/m68k/kernel/syscalltable.S
@@ -396,3 +396,4 @@ ENTRY(sys_call_table)
        .long sys_userfaultfd
        .long sys_membarrier
        .long sys_mlock2                /* 375 */
+        .long sys_copy_file_range
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index e4824fd04bb7..9faa18c4f3f7 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -557,7 +557,7 @@ choice
 config PPC_4K_PAGES
        bool "4k page size"
-        select HAVE_ARCH_SOFT_DIRTY if CHECKPOINT_RESTORE && PPC_BOOK3S
+        select HAVE_ARCH_SOFT_DIRTY if PPC_BOOK3S_64
 config PPC_16K_PAGES
        bool "16k page size"
@@ -566,7 +566,7 @@ config PPC_16K_PAGES
 config PPC_64K_PAGES
        bool "64k page size"
        depends on !PPC_FSL_BOOK3E && (44x || PPC_STD_MMU_64 || PPC_BOOK3E_64)
-        select HAVE_ARCH_SOFT_DIRTY if CHECKPOINT_RESTORE && PPC_BOOK3S
+        select HAVE_ARCH_SOFT_DIRTY if PPC_BOOK3S_64
 config PPC_256K_PAGES
        bool "256k page size"
diff --git a/arch/powerpc/include/asm/book3s/64/pgtable.h b/arch/powerpc/include/asm/book3s/64/pgtable.h
index 8d1c41d28318..ac07a30a7934 100644
--- a/arch/powerpc/include/asm/book3s/64/pgtable.h
+++ b/arch/powerpc/include/asm/book3s/64/pgtable.h
@@ -281,6 +281,10 @@ extern pgtable_t pgtable_trans_huge_withdraw(struct mm_struct *mm, pmd_t *pmdp);
 extern void pmdp_invalidate(struct vm_area_struct *vma, unsigned long address,
                            pmd_t *pmdp);
+#define __HAVE_ARCH_PMDP_HUGE_SPLIT_PREPARE
+extern void pmdp_huge_split_prepare(struct vm_area_struct *vma,
+                                    unsigned long address, pmd_t *pmdp);
 #define pmd_move_must_withdraw pmd_move_must_withdraw
 struct spinlock;
 static inline int pmd_move_must_withdraw(struct spinlock *new_pmd_ptl,
diff --git a/arch/powerpc/include/asm/eeh.h b/arch/powerpc/include/asm/eeh.h
index c5eb86f3d452..867c39b45df6 100644
--- a/arch/powerpc/include/asm/eeh.h
+++ b/arch/powerpc/include/asm/eeh.h
@@ -81,6 +81,7 @@ struct pci_dn;
 #define EEH_PE_KEEP             (1 << 8)        /* Keep PE on hotplug   */
 #define EEH_PE_CFG_RESTRICTED   (1 << 9)        /* Block config on error */
 #define EEH_PE_REMOVED          (1 << 10)       /* Removed permanently  */
+#define EEH_PE_PRI_BUS          (1 << 11)       /* Cached primary bus   */
 struct eeh_pe {
        int type;                       /* PE type: PHB/Bus/Device      */
diff --git a/arch/powerpc/include/asm/trace.h b/arch/powerpc/include/asm/trace.h
index 8e86b48d0369..32e36b16773f 100644
--- a/arch/powerpc/include/asm/trace.h
+++ b/arch/powerpc/include/asm/trace.h
@@ -57,12 +57,14 @@ DEFINE_EVENT(ppc64_interrupt_class, timer_interrupt_exit,
 extern void hcall_tracepoint_regfunc(void);
 extern void hcall_tracepoint_unregfunc(void);
-TRACE_EVENT_FN(hcall_entry,
+TRACE_EVENT_FN_COND(hcall_entry,
        TP_PROTO(unsigned long opcode, unsigned long *args),
        TP_ARGS(opcode, args),
+        TP_CONDITION(cpu_online(raw_smp_processor_id())),
        TP_STRUCT__entry(
                __field(unsigned long, opcode)
        ),
@@ -76,13 +78,15 @@ TRACE_EVENT_FN(hcall_entry,
        hcall_tracepoint_regfunc, hcall_tracepoint_unregfunc
 );
-TRACE_EVENT_FN(hcall_exit,
+TRACE_EVENT_FN_COND(hcall_exit,
        TP_PROTO(unsigned long opcode, unsigned long retval,
                unsigned long *retbuf),
        TP_ARGS(opcode, retval, retbuf),
+        TP_CONDITION(cpu_online(raw_smp_processor_id())),
        TP_STRUCT__entry(
                __field(unsigned long, opcode)
                __field(unsigned long, retval)
diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c
index 938742135ee0..301be3126ae3 100644
--- a/arch/powerpc/kernel/eeh_driver.c
+++ b/arch/powerpc/kernel/eeh_driver.c
@@ -564,6 +564,7 @@ static int eeh_reset_device(struct eeh_pe *pe, struct pci_bus *bus)
         */
        eeh_pe_state_mark(pe, EEH_PE_KEEP);
        if (bus) {
+                eeh_pe_state_clear(pe, EEH_PE_PRI_BUS);
                pci_lock_rescan_remove();
                pcibios_remove_pci_devices(bus);
                pci_unlock_rescan_remove();
@@ -803,6 +804,7 @@ perm_error:
         * the their PCI config any more.
         */
        if (frozen_bus) {
+                eeh_pe_state_clear(pe, EEH_PE_PRI_BUS);
                eeh_pe_dev_mode_mark(pe, EEH_DEV_REMOVED);
                pci_lock_rescan_remove();
@@ -886,6 +888,7 @@ static void eeh_handle_special_event(void)
                                        continue;
                                /* Notify all devices to be down */
+                                eeh_pe_state_clear(pe, EEH_PE_PRI_BUS);
                                bus = eeh_pe_bus_get(phb_pe);
                                eeh_pe_dev_traverse(pe,
                                        eeh_report_failure, NULL);
diff --git a/arch/powerpc/kernel/eeh_pe.c b/arch/powerpc/kernel/eeh_pe.c
index ca9e5371930e..98f81800e00c 100644
--- a/arch/powerpc/kernel/eeh_pe.c
+++ b/arch/powerpc/kernel/eeh_pe.c
@@ -928,7 +928,7 @@ struct pci_bus *eeh_pe_bus_get(struct eeh_pe *pe)
                bus = pe->phb->bus;
        } else if (pe->type & EEH_PE_BUS ||
                   pe->type & EEH_PE_DEVICE) {
-                if (pe->bus) {
+                if (pe->state & EEH_PE_PRI_BUS) {
                        bus = pe->bus;
                        goto out;
                }
diff --git a/arch/powerpc/kernel/module_64.c b/arch/powerpc/kernel/module_64.c
index ac64ffdb52c8..08b7a40de5f8 100644
--- a/arch/powerpc/kernel/module_64.c
+++ b/arch/powerpc/kernel/module_64.c
@@ -340,7 +340,7 @@ static void dedotify(Elf64_Sym *syms, unsigned int numsyms, char *strtab)
                        if (name[0] == '.') {
                                if (strcmp(name+1, "TOC.") == 0)
                                        syms[i].st_shndx = SHN_ABS;
-                                memmove(name, name+1, strlen(name));
+                                syms[i].st_name++;
                        }
                }
        }
diff --git a/arch/powerpc/mm/pgtable_64.c b/arch/powerpc/mm/pgtable_64.c
index 3124a20d0fab..cdf2123d46db 100644
--- a/arch/powerpc/mm/pgtable_64.c
+++ b/arch/powerpc/mm/pgtable_64.c
@@ -646,6 +646,28 @@ pgtable_t pgtable_trans_huge_withdraw(struct mm_struct *mm, pmd_t *pmdp)
        return pgtable;
 }
+void pmdp_huge_split_prepare(struct vm_area_struct *vma,
+                             unsigned long address, pmd_t *pmdp)
+{
+        VM_BUG_ON(address & ~HPAGE_PMD_MASK);
+        VM_BUG_ON(REGION_ID(address) != USER_REGION_ID);
+        /*
+         * We can't mark the pmd none here, because that will cause a race
+         * against exit_mmap. We need to continue mark pmd TRANS HUGE, while
+         * we spilt, but at the same time we wan't rest of the ppc64 code
+         * not to insert hash pte on this, because we will be modifying
+         * the deposited pgtable in the caller of this function. Hence
+         * clear the _PAGE_USER so that we move the fault handling to
+         * higher level function and that will serialize against ptl.
+         * We need to flush existing hash pte entries here even though,
+         * the translation is still valid, because we will withdraw
+         * pgtable_t after this.
+         */
+        pmd_hugepage_update(vma->vm_mm, address, pmdp, _PAGE_USER, 0);
+}
 /*
 * set a new huge pmd. We should not be called for updating
 * an existing pmd entry. That should go via pmd_hugepage_update.
@@ -663,10 +685,20 @@ void set_pmd_at(struct mm_struct *mm, unsigned long addr,
        return set_pte_at(mm, addr, pmdp_ptep(pmdp), pmd_pte(pmd));
 }
+/*
+ * We use this to invalidate a pmdp entry before switching from a
+ * hugepte to regular pmd entry.
+ */
 void pmdp_invalidate(struct vm_area_struct *vma, unsigned long address,
                     pmd_t *pmdp)
 {
        pmd_hugepage_update(vma->vm_mm, address, pmdp, _PAGE_PRESENT, 0);
+        /*
+         * This ensures that generic code that rely on IRQ disabling
+         * to prevent a parallel THP split work as expected.
+         */
+        kick_all_cpus_sync();
 }
 /*
diff --git a/arch/powerpc/platforms/powernv/eeh-powernv.c b/arch/powerpc/platforms/powernv/eeh-powernv.c
index 5f152b95ca0c..87f47e55aab6 100644
--- a/arch/powerpc/platforms/powernv/eeh-powernv.c
+++ b/arch/powerpc/platforms/powernv/eeh-powernv.c
@@ -444,9 +444,12 @@ static void *pnv_eeh_probe(struct pci_dn *pdn, void *data)
         * PCI devices of the PE are expected to be removed prior
         * to PE reset.
         */
-        if (!edev->pe->bus)
+        if (!(edev->pe->state & EEH_PE_PRI_BUS)) {
                edev->pe->bus = pci_find_bus(hose->global_number,
                                             pdn->busno);
+                if (edev->pe->bus)
+                        edev->pe->state |= EEH_PE_PRI_BUS;
+        }
        /*
         * Enable EEH explicitly so that we will do EEH check
diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
index 573ae1994097..f90dc04395bf 100644
--- a/arch/powerpc/platforms/powernv/pci-ioda.c
+++ b/arch/powerpc/platforms/powernv/pci-ioda.c
@@ -3180,6 +3180,7 @@ static void pnv_pci_ioda_shutdown(struct pci_controller *hose)
 static const struct pci_controller_ops pnv_pci_ioda_controller_ops = {
       .dma_dev_setup = pnv_pci_dma_dev_setup,
+       .dma_bus_setup = pnv_pci_dma_bus_setup,
 #ifdef CONFIG_PCI_MSI
       .setup_msi_irqs = pnv_setup_msi_irqs,
       .teardown_msi_irqs = pnv_teardown_msi_irqs,
diff --git a/arch/powerpc/platforms/powernv/pci.c b/arch/powerpc/platforms/powernv/pci.c
index 2f55c86df703..b1ef84a6c9d1 100644
--- a/arch/powerpc/platforms/powernv/pci.c
+++ b/arch/powerpc/platforms/powernv/pci.c
@@ -599,6 +599,9 @@ int pnv_tce_build(struct iommu_table *tbl, long index, long npages,
        u64 rpn = __pa(uaddr) >> tbl->it_page_shift;
        long i;
+        if (proto_tce & TCE_PCI_WRITE)
+                proto_tce |= TCE_PCI_READ;
        for (i = 0; i < npages; i++) {
                unsigned long newtce = proto_tce |
                        ((rpn + i) << tbl->it_page_shift);
@@ -620,6 +623,9 @@ int pnv_tce_xchg(struct iommu_table *tbl, long index,
        BUG_ON(*hpa & ~IOMMU_PAGE_MASK(tbl));
+        if (newtce & TCE_PCI_WRITE)
+                newtce |= TCE_PCI_READ;
        oldtce = xchg(pnv_tce(tbl, idx), cpu_to_be64(newtce));
        *hpa = be64_to_cpu(oldtce) & ~(TCE_PCI_READ | TCE_PCI_WRITE);
        *direction = iommu_tce_direction(oldtce);
@@ -760,6 +766,26 @@ void pnv_pci_dma_dev_setup(struct pci_dev *pdev)
                phb->dma_dev_setup(phb, pdev);
 }
+void pnv_pci_dma_bus_setup(struct pci_bus *bus)
+{
+        struct pci_controller *hose = bus->sysdata;
+        struct pnv_phb *phb = hose->private_data;
+        struct pnv_ioda_pe *pe;
+        list_for_each_entry(pe, &phb->ioda.pe_list, list) {
+                if (!(pe->flags & (PNV_IODA_PE_BUS | PNV_IODA_PE_BUS_ALL)))
+                        continue;
+                if (!pe->pbus)
+                        continue;
+                if (bus->number == ((pe->rid >> 8) & 0xFF)) {
+                        pe->pbus = bus;
+                        break;
+                }
+        }
+}
 void pnv_pci_shutdown(void)
 {
        struct pci_controller *hose;
diff --git a/arch/powerpc/platforms/powernv/pci.h b/arch/powerpc/platforms/powernv/pci.h
index 7f56313e8d72..00691a9b99af 100644
--- a/arch/powerpc/platforms/powernv/pci.h
+++ b/arch/powerpc/platforms/powernv/pci.h
@@ -242,6 +242,7 @@ extern void pnv_pci_reset_secondary_bus(struct pci_dev *dev);
 extern int pnv_eeh_phb_reset(struct pci_controller *hose, int option);
 extern void pnv_pci_dma_dev_setup(struct pci_dev *pdev);
+extern void pnv_pci_dma_bus_setup(struct pci_bus *bus);
 extern int pnv_setup_msi_irqs(struct pci_dev *pdev, int nvec, int type);
 extern void pnv_teardown_msi_irqs(struct pci_dev *pdev);
diff --git a/arch/s390/include/asm/livepatch.h b/arch/s390/include/asm/livepatch.h
index 7aa799134a11..a52b6cca873d 100644
--- a/arch/s390/include/asm/livepatch.h
+++ b/arch/s390/include/asm/livepatch.h
@@ -37,7 +37,7 @@ static inline void klp_arch_set_pc(struct pt_regs *regs, unsigned long ip)
        regs->psw.addr = ip;
 }
 #else
-#error Live patching support is disabled; check CONFIG_LIVEPATCH
+#error Include linux/livepatch.h, not asm/livepatch.h
 #endif
 #endif
diff --git a/arch/s390/kernel/perf_event.c b/arch/s390/kernel/perf_event.c
index cfcba2dd9bb5..0943b11a2f6e 100644
--- a/arch/s390/kernel/perf_event.c
+++ b/arch/s390/kernel/perf_event.c
@@ -260,12 +260,13 @@ static unsigned long __store_trace(struct perf_callchain_entry *entry,
 void perf_callchain_kernel(struct perf_callchain_entry *entry,
                           struct pt_regs *regs)
 {
-        unsigned long head;
+        unsigned long head, frame_size;
        struct stack_frame *head_sf;
        if (user_mode(regs))
                return;
+        frame_size = STACK_FRAME_OVERHEAD + sizeof(struct pt_regs);
        head = regs->gprs[15];
        head_sf = (struct stack_frame *) head;
@@ -273,8 +274,9 @@ void perf_callchain_kernel(struct perf_callchain_entry *entry,
                return;
        head = head_sf->back_chain;
-        head = __store_trace(entry, head, S390_lowcore.async_stack - ASYNC_SIZE,
+        head = __store_trace(entry, head,
-                             S390_lowcore.async_stack);
+                             S390_lowcore.async_stack + frame_size - ASYNC_SIZE,
+                             S390_lowcore.async_stack + frame_size);
        __store_trace(entry, head, S390_lowcore.thread_info,
                      S390_lowcore.thread_info + THREAD_SIZE);
diff --git a/arch/s390/kernel/stacktrace.c b/arch/s390/kernel/stacktrace.c
index 5acba3cb7220..8f64ebd63767 100644
--- a/arch/s390/kernel/stacktrace.c
+++ b/arch/s390/kernel/stacktrace.c
@@ -59,26 +59,32 @@ static unsigned long save_context_stack(struct stack_trace *trace,
        }
 }
-void save_stack_trace(struct stack_trace *trace)
+static void __save_stack_trace(struct stack_trace *trace, unsigned long sp)
 {
-        register unsigned long sp asm ("15");
+        unsigned long new_sp, frame_size;
-        unsigned long orig_sp, new_sp;
-        orig_sp = sp;
+        frame_size = STACK_FRAME_OVERHEAD + sizeof(struct pt_regs);
-        new_sp = save_context_stack(trace, orig_sp,
+        new_sp = save_context_stack(trace, sp,
-                                    S390_lowcore.panic_stack - PAGE_SIZE,
+                        S390_lowcore.panic_stack + frame_size - PAGE_SIZE,
-                                    S390_lowcore.panic_stack, 1);
+                        S390_lowcore.panic_stack + frame_size, 1);
-        if (new_sp != orig_sp)
-                return;
        new_sp = save_context_stack(trace, new_sp,
-                                    S390_lowcore.async_stack - ASYNC_SIZE,
+                        S390_lowcore.async_stack + frame_size - ASYNC_SIZE,
-                                    S390_lowcore.async_stack, 1);
+                        S390_lowcore.async_stack + frame_size, 1);
-        if (new_sp != orig_sp)
-                return;
        save_context_stack(trace, new_sp,
                           S390_lowcore.thread_info,
                           S390_lowcore.thread_info + THREAD_SIZE, 1);
 }
+void save_stack_trace(struct stack_trace *trace)
+{
+        register unsigned long r15 asm ("15");
+        unsigned long sp;
+        sp = r15;
+        __save_stack_trace(trace, sp);
+        if (trace->nr_entries < trace->max_entries)
+                trace->entries[trace->nr_entries++] = ULONG_MAX;
+}
 EXPORT_SYMBOL_GPL(save_stack_trace);
 void save_stack_trace_tsk(struct task_struct *tsk, struct stack_trace *trace)
@@ -86,6 +92,10 @@ void save_stack_trace_tsk(struct task_struct *tsk, struct stack_trace *trace)
        unsigned long sp, low, high;
        sp = tsk->thread.ksp;
+        if (tsk == current) {
+                /* Get current stack pointer. */
+                asm volatile("la %0,0(15)" : "=a" (sp));
+        }
        low = (unsigned long) task_stack_page(tsk);
        high = (unsigned long) task_pt_regs(tsk);
        save_context_stack(trace, sp, low, high, 0);
@@ -93,3 +103,14 @@ void save_stack_trace_tsk(struct task_struct *tsk, struct stack_trace *trace)
                trace->entries[trace->nr_entries++] = ULONG_MAX;
 }
 EXPORT_SYMBOL_GPL(save_stack_trace_tsk);
+void save_stack_trace_regs(struct pt_regs *regs, struct stack_trace *trace)
+{
+        unsigned long sp;
+        sp = kernel_stack_pointer(regs);
+        __save_stack_trace(trace, sp);
+        if (trace->nr_entries < trace->max_entries)
+                trace->entries[trace->nr_entries++] = ULONG_MAX;
+}
+EXPORT_SYMBOL_GPL(save_stack_trace_regs);
diff --git a/arch/s390/kernel/trace.c b/arch/s390/kernel/trace.c
index 21a5df99552b..dde7654f5c68 100644
--- a/arch/s390/kernel/trace.c
+++ b/arch/s390/kernel/trace.c
@@ -18,6 +18,9 @@ void trace_s390_diagnose_norecursion(int diag_nr)
        unsigned long flags;
        unsigned int *depth;
+        /* Avoid lockdep recursion. */
+        if (IS_ENABLED(CONFIG_LOCKDEP))
+                return;
        local_irq_save(flags);
        depth = this_cpu_ptr(&diagnose_trace_depth);
        if (*depth == 0) {
diff --git a/arch/s390/mm/maccess.c b/arch/s390/mm/maccess.c
index fec59c067d0d..792f9c63fbca 100644
--- a/arch/s390/mm/maccess.c
+++ b/arch/s390/mm/maccess.c
@@ -93,15 +93,19 @@ static int __memcpy_real(void *dest, void *src, size_t count)
 */
 int memcpy_real(void *dest, void *src, size_t count)
 {
+        int irqs_disabled, rc;
        unsigned long flags;
-        int rc;
        if (!count)
                return 0;
-        local_irq_save(flags);
+        flags = __arch_local_irq_stnsm(0xf8UL);
-        __arch_local_irq_stnsm(0xfbUL);
+        irqs_disabled = arch_irqs_disabled_flags(flags);
+        if (!irqs_disabled)
+                trace_hardirqs_off();
        rc = __memcpy_real(dest, src, count);
-        local_irq_restore(flags);
+        if (!irqs_disabled)
+                trace_hardirqs_on();
+        __arch_local_irq_ssm(flags);
        return rc;
 }
diff --git a/arch/s390/oprofile/backtrace.c b/arch/s390/oprofile/backtrace.c
index fe0bfe370c45..1884e1759529 100644
--- a/arch/s390/oprofile/backtrace.c
+++ b/arch/s390/oprofile/backtrace.c
@@ -54,12 +54,13 @@ __show_trace(unsigned int *depth, unsigned long sp,
 void s390_backtrace(struct pt_regs * const regs, unsigned int depth)
 {
-        unsigned long head;
+        unsigned long head, frame_size;
        struct stack_frame* head_sf;
        if (user_mode(regs))
                return;
+        frame_size = STACK_FRAME_OVERHEAD + sizeof(struct pt_regs);
        head = regs->gprs[15];
        head_sf = (struct stack_frame*)head;
@@ -68,8 +69,9 @@ void s390_backtrace(struct pt_regs * const regs, unsigned int depth)
        head = head_sf->back_chain;
-        head = __show_trace(&depth, head, S390_lowcore.async_stack - ASYNC_SIZE,
+        head = __show_trace(&depth, head,
-                            S390_lowcore.async_stack);
+                            S390_lowcore.async_stack + frame_size - ASYNC_SIZE,
+                            S390_lowcore.async_stack + frame_size);
        __show_trace(&depth, head, S390_lowcore.thread_info,
                     S390_lowcore.thread_info + THREAD_SIZE);
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index ab2ed5328f0a..c46662f64c39 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -778,8 +778,8 @@ config HPET_TIMER
          HPET is the next generation timer replacing legacy 8254s.
          The HPET provides a stable time base on SMP
          systems, unlike the TSC, but it is more expensive to access,
-          as it is off-chip.  You can find the HPET spec at
+          as it is off-chip.  The interface used is documented
-          <http://www.intel.com/hardwaredesign/hpetspec_1.pdf>.
+          in the HPET spec, revision 1.
          You can safely choose Y here.  However, HPET will only be
          activated if the platform and the BIOS support this feature.
diff --git a/arch/x86/include/asm/livepatch.h b/arch/x86/include/asm/livepatch.h
index 19c099afa861..e795f5274217 100644
--- a/arch/x86/include/asm/livepatch.h
+++ b/arch/x86/include/asm/livepatch.h
@@ -41,7 +41,7 @@ static inline void klp_arch_set_pc(struct pt_regs *regs, unsigned long ip)
        regs->ip = ip;
 }
 #else
-#error Live patching support is disabled; check CONFIG_LIVEPATCH
+#error Include linux/livepatch.h, not asm/livepatch.h
 #endif
 #endif /* _ASM_X86_LIVEPATCH_H */
diff --git a/arch/x86/kernel/cpu/perf_event_amd_uncore.c b/arch/x86/kernel/cpu/perf_event_amd_uncore.c
index 49742746a6c9..8836fc9fa84b 100644
--- a/arch/x86/kernel/cpu/perf_event_amd_uncore.c
+++ b/arch/x86/kernel/cpu/perf_event_amd_uncore.c
@@ -323,6 +323,8 @@ static int amd_uncore_cpu_up_prepare(unsigned int cpu)
        return 0;
 fail:
+        if (amd_uncore_nb)
+                *per_cpu_ptr(amd_uncore_nb, cpu) = NULL;
        kfree(uncore_nb);
        return -ENOMEM;
 }
diff --git a/arch/x86/lib/copy_user_64.S b/arch/x86/lib/copy_user_64.S
index 982ce34f4a9b..27f89c79a44b 100644
--- a/arch/x86/lib/copy_user_64.S
+++ b/arch/x86/lib/copy_user_64.S
@@ -232,17 +232,31 @@ ENDPROC(copy_user_enhanced_fast_string)
 /*
 * copy_user_nocache - Uncached memory copy with exception handling
- * This will force destination/source out of cache for more performance.
+ * This will force destination out of cache for more performance.
+ *
+ * Note: Cached memory copy is used when destination or size is not
+ * naturally aligned. That is:
+ *  - Require 8-byte alignment when size is 8 bytes or larger.
+ *  - Require 4-byte alignment when size is 4 bytes.
 */
 ENTRY(__copy_user_nocache)
        ASM_STAC
+        /* If size is less than 8 bytes, go to 4-byte copy */
        cmpl $8,%edx
-        jb 20f          /* less then 8 bytes, go to byte copy loop */
+        jb .L_4b_nocache_copy_entry
+        /* If destination is not 8-byte aligned, "cache" copy to align it */
        ALIGN_DESTINATION
+        /* Set 4x8-byte copy count and remainder */
        movl %edx,%ecx
        andl $63,%edx
        shrl $6,%ecx
-        jz 17f
+        jz .L_8b_nocache_copy_entry     /* jump if count is 0 */
+        /* Perform 4x8-byte nocache loop-copy */
+.L_4x8b_nocache_copy_loop:
 1:      movq (%rsi),%r8
 2:      movq 1*8(%rsi),%r9
 3:      movq 2*8(%rsi),%r10
@@ -262,60 +276,106 @@ ENTRY(__copy_user_nocache)
        leaq 64(%rsi),%rsi
        leaq 64(%rdi),%rdi
        decl %ecx
-        jnz 1b
+        jnz .L_4x8b_nocache_copy_loop
-17:     movl %edx,%ecx
+        /* Set 8-byte copy count and remainder */
+.L_8b_nocache_copy_entry:
+        movl %edx,%ecx
        andl $7,%edx
        shrl $3,%ecx
-        jz 20f
+        jz .L_4b_nocache_copy_entry     /* jump if count is 0 */
-18:     movq (%rsi),%r8
-19:     movnti %r8,(%rdi)
+        /* Perform 8-byte nocache loop-copy */
+.L_8b_nocache_copy_loop:
+20:     movq (%rsi),%r8
+21:     movnti %r8,(%rdi)
        leaq 8(%rsi),%rsi
        leaq 8(%rdi),%rdi
        decl %ecx
-        jnz 18b
+        jnz .L_8b_nocache_copy_loop
-20:     andl %edx,%edx
-        jz 23f
+        /* If no byte left, we're done */
+.L_4b_nocache_copy_entry:
+        andl %edx,%edx
+        jz .L_finish_copy
+        /* If destination is not 4-byte aligned, go to byte copy: */
+        movl %edi,%ecx
+        andl $3,%ecx
+        jnz .L_1b_cache_copy_entry
+        /* Set 4-byte copy count (1 or 0) and remainder */
        movl %edx,%ecx
-21:     movb (%rsi),%al
+        andl $3,%edx
-22:     movb %al,(%rdi)
+        shrl $2,%ecx
+        jz .L_1b_cache_copy_entry       /* jump if count is 0 */
+        /* Perform 4-byte nocache copy: */
+30:     movl (%rsi),%r8d
+31:     movnti %r8d,(%rdi)
+        leaq 4(%rsi),%rsi
+        leaq 4(%rdi),%rdi
+        /* If no bytes left, we're done: */
+        andl %edx,%edx
+        jz .L_finish_copy
+        /* Perform byte "cache" loop-copy for the remainder */
+.L_1b_cache_copy_entry:
+        movl %edx,%ecx
+.L_1b_cache_copy_loop:
+40:     movb (%rsi),%al
+41:     movb %al,(%rdi)
        incq %rsi
        incq %rdi
        decl %ecx
-        jnz 21b
+        jnz .L_1b_cache_copy_loop
-23:     xorl %eax,%eax
+        /* Finished copying; fence the prior stores */
+.L_finish_copy:
+        xorl %eax,%eax
        ASM_CLAC
        sfence
        ret
        .section .fixup,"ax"
-30:     shll $6,%ecx
+.L_fixup_4x8b_copy:
+        shll $6,%ecx
        addl %ecx,%edx
-        jmp 60f
+        jmp .L_fixup_handle_tail
-40:     lea (%rdx,%rcx,8),%rdx
+.L_fixup_8b_copy:
-        jmp 60f
+        lea (%rdx,%rcx,8),%rdx
-50:     movl %ecx,%edx
+        jmp .L_fixup_handle_tail
-60:     sfence
+.L_fixup_4b_copy:
+        lea (%rdx,%rcx,4),%rdx
+        jmp .L_fixup_handle_tail
+.L_fixup_1b_copy:
+        movl %ecx,%edx
+.L_fixup_handle_tail:
+        sfence
        jmp copy_user_handle_tail
        .previous
-        _ASM_EXTABLE(1b,30b)
+        _ASM_EXTABLE(1b,.L_fixup_4x8b_copy)
-        _ASM_EXTABLE(2b,30b)
+        _ASM_EXTABLE(2b,.L_fixup_4x8b_copy)
-        _ASM_EXTABLE(3b,30b)
+        _ASM_EXTABLE(3b,.L_fixup_4x8b_copy)
-        _ASM_EXTABLE(4b,30b)
+        _ASM_EXTABLE(4b,.L_fixup_4x8b_copy)
-        _ASM_EXTABLE(5b,30b)
+        _ASM_EXTABLE(5b,.L_fixup_4x8b_copy)
-        _ASM_EXTABLE(6b,30b)
+        _ASM_EXTABLE(6b,.L_fixup_4x8b_copy)
-        _ASM_EXTABLE(7b,30b)
+        _ASM_EXTABLE(7b,.L_fixup_4x8b_copy)
-        _ASM_EXTABLE(8b,30b)
+        _ASM_EXTABLE(8b,.L_fixup_4x8b_copy)
-        _ASM_EXTABLE(9b,30b)
+        _ASM_EXTABLE(9b,.L_fixup_4x8b_copy)
-        _ASM_EXTABLE(10b,30b)
+        _ASM_EXTABLE(10b,.L_fixup_4x8b_copy)
-        _ASM_EXTABLE(11b,30b)
+        _ASM_EXTABLE(11b,.L_fixup_4x8b_copy)
-        _ASM_EXTABLE(12b,30b)
+        _ASM_EXTABLE(12b,.L_fixup_4x8b_copy)
-        _ASM_EXTABLE(13b,30b)
+        _ASM_EXTABLE(13b,.L_fixup_4x8b_copy)
-        _ASM_EXTABLE(14b,30b)
+        _ASM_EXTABLE(14b,.L_fixup_4x8b_copy)
-        _ASM_EXTABLE(15b,30b)
+        _ASM_EXTABLE(15b,.L_fixup_4x8b_copy)
-        _ASM_EXTABLE(16b,30b)
+        _ASM_EXTABLE(16b,.L_fixup_4x8b_copy)
-        _ASM_EXTABLE(18b,40b)
+        _ASM_EXTABLE(20b,.L_fixup_8b_copy)
-        _ASM_EXTABLE(19b,40b)
+        _ASM_EXTABLE(21b,.L_fixup_8b_copy)
-        _ASM_EXTABLE(21b,50b)
+        _ASM_EXTABLE(30b,.L_fixup_4b_copy)
-        _ASM_EXTABLE(22b,50b)
+        _ASM_EXTABLE(31b,.L_fixup_4b_copy)
+        _ASM_EXTABLE(40b,.L_fixup_1b_copy)
+        _ASM_EXTABLE(41b,.L_fixup_1b_copy)
 ENDPROC(__copy_user_nocache)
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index eef44d9a3f77..e830c71a1323 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -287,6 +287,9 @@ static noinline int vmalloc_fault(unsigned long address)
        if (!pmd_k)
                return -1;
+        if (pmd_huge(*pmd_k))
+                return 0;
        pte_k = pte_offset_kernel(pmd_k, address);
        if (!pte_present(*pte_k))
                return -1;
@@ -360,8 +363,6 @@ void vmalloc_sync_all(void)
 * 64-bit:
 *
 *   Handle a fault on the vmalloc area
- *
- * This assumes no large pages in there.
 */
 static noinline int vmalloc_fault(unsigned long address)
 {
@@ -403,17 +404,23 @@ static noinline int vmalloc_fault(unsigned long address)
        if (pud_none(*pud_ref))
                return -1;
-        if (pud_none(*pud) || pud_page_vaddr(*pud) != pud_page_vaddr(*pud_ref))
+        if (pud_none(*pud) || pud_pfn(*pud) != pud_pfn(*pud_ref))
                BUG();
+        if (pud_huge(*pud))
+                return 0;
        pmd = pmd_offset(pud, address);
        pmd_ref = pmd_offset(pud_ref, address);
        if (pmd_none(*pmd_ref))
                return -1;
-        if (pmd_none(*pmd) || pmd_page(*pmd) != pmd_page(*pmd_ref))
+        if (pmd_none(*pmd) || pmd_pfn(*pmd) != pmd_pfn(*pmd_ref))
                BUG();
+        if (pmd_huge(*pmd))
+                return 0;
        pte_ref = pte_offset_kernel(pmd_ref, address);
        if (!pte_present(*pte_ref))
                return -1;
diff --git a/arch/x86/mm/gup.c b/arch/x86/mm/gup.c
index 6d5eb5900372..d8a798d8bf50 100644
--- a/arch/x86/mm/gup.c
+++ b/arch/x86/mm/gup.c
@@ -102,7 +102,6 @@ static noinline int gup_pte_range(pmd_t pmd, unsigned long addr,
                        return 0;
                }
-                page = pte_page(pte);
                if (pte_devmap(pte)) {
                        pgmap = get_dev_pagemap(pte_pfn(pte), pgmap);
                        if (unlikely(!pgmap)) {
@@ -115,6 +114,7 @@ static noinline int gup_pte_range(pmd_t pmd, unsigned long addr,
                        return 0;
                }
                VM_BUG_ON(!pfn_valid(pte_pfn(pte)));
+                page = pte_page(pte);
                get_page(page);
                put_dev_pagemap(pgmap);
                SetPageReferenced(page);
diff --git a/arch/x86/platform/intel-quark/imr.c b/arch/x86/platform/intel-quark/imr.c
index 0a3736f03edc..740445a53363 100644
--- a/arch/x86/platform/intel-quark/imr.c
+++ b/arch/x86/platform/intel-quark/imr.c
@@ -580,14 +580,14 @@ static void __init imr_fixup_memmap(struct imr_device *idev)
        end = (unsigned long)__end_rodata - 1;
        /*
-         * Setup a locked IMR around the physical extent of the kernel
+         * Setup an unlocked IMR around the physical extent of the kernel
         * from the beginning of the .text secton to the end of the
         * .rodata section as one physically contiguous block.
         *
         * We don't round up @size since it is already PAGE_SIZE aligned.
         * See vmlinux.lds.S for details.
         */
-        ret = imr_add_range(base, size, IMR_CPU, IMR_CPU, true);
+        ret = imr_add_range(base, size, IMR_CPU, IMR_CPU, false);
        if (ret < 0) {
                pr_err("unable to setup IMR for kernel: %zu KiB (%lx - %lx)\n",
                        size / 1024, start, end);
diff --git a/block/bio.c b/block/bio.c
index dbabd48b1934..cf7591551b17 100644
--- a/block/bio.c
+++ b/block/bio.c
@@ -874,7 +874,7 @@ int submit_bio_wait(int rw, struct bio *bio)
        bio->bi_private = &ret;
        bio->bi_end_io = submit_bio_wait_endio;
        submit_bio(rw, bio);
-        wait_for_completion(&ret.event);
+        wait_for_completion_io(&ret.event);
        return ret.error;
 }
@@ -1090,9 +1090,12 @@ int bio_uncopy_user(struct bio *bio)
        if (!bio_flagged(bio, BIO_NULL_MAPPED)) {
                /*
                 * if we're in a workqueue, the request is orphaned, so
-                 * don't copy into a random user address space, just free.
+                 * don't copy into a random user address space, just free
+                 * and return -EINTR so user space doesn't expect any data.
                 */
-                if (current->mm && bio_data_dir(bio) == READ)
+                if (!current->mm)
+                        ret = -EINTR;
+                else if (bio_data_dir(bio) == READ)
                        ret = bio_copy_to_iter(bio, bmd->iter);
                if (bmd->is_our_pages)
                        bio_free_pages(bio);
diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
index 5a37188b559f..66e6f1aae02e 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -788,6 +788,7 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
 {
        struct gendisk *disk;
        struct blkcg_gq *blkg;
+        struct module *owner;
        unsigned int major, minor;
        int key_len, part, ret;
        char *body;
@@ -804,7 +805,9 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
        if (!disk)
                return -ENODEV;
        if (part) {
+                owner = disk->fops->owner;
                put_disk(disk);
+                module_put(owner);
                return -ENODEV;
        }
@@ -820,7 +823,9 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
                ret = PTR_ERR(blkg);
                rcu_read_unlock();
                spin_unlock_irq(disk->queue->queue_lock);
+                owner = disk->fops->owner;
                put_disk(disk);
+                module_put(owner);
                /*
                 * If queue was bypassing, we should retry.  Do so after a
                 * short msleep().  It isn't strictly necessary but queue
@@ -851,9 +856,13 @@ EXPORT_SYMBOL_GPL(blkg_conf_prep);
 void blkg_conf_finish(struct blkg_conf_ctx *ctx)
        __releases(ctx->disk->queue->queue_lock) __releases(rcu)
 {
+        struct module *owner;
        spin_unlock_irq(ctx->disk->queue->queue_lock);
        rcu_read_unlock();
+        owner = ctx->disk->fops->owner;
        put_disk(ctx->disk);
+        module_put(owner);
 }
 EXPORT_SYMBOL_GPL(blkg_conf_finish);
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 4c0622fae413..56c0a726b619 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -599,8 +599,10 @@ static void blk_mq_check_expired(struct blk_mq_hw_ctx *hctx,
                 * If a request wasn't started before the queue was
                 * marked dying, kill it here or it'll go unnoticed.
                 */
-                if (unlikely(blk_queue_dying(rq->q)))
+                if (unlikely(blk_queue_dying(rq->q))) {
-                        blk_mq_complete_request(rq, -EIO);
+                        rq->errors = -EIO;
+                        blk_mq_end_request(rq, rq->errors);
+                }
                return;
        }
diff --git a/block/blk-settings.c b/block/blk-settings.c
index dd4973583978..c7bb666aafd1 100644
--- a/block/blk-settings.c
+++ b/block/blk-settings.c
@@ -91,8 +91,8 @@ void blk_set_default_limits(struct queue_limits *lim)
        lim->seg_boundary_mask = BLK_SEG_BOUNDARY_MASK;
        lim->virt_boundary_mask = 0;
        lim->max_segment_size = BLK_MAX_SEGMENT_SIZE;
-        lim->max_sectors = lim->max_dev_sectors = lim->max_hw_sectors =
+        lim->max_sectors = lim->max_hw_sectors = BLK_SAFE_MAX_SECTORS;
-                BLK_SAFE_MAX_SECTORS;
+        lim->max_dev_sectors = 0;
        lim->chunk_sectors = 0;
        lim->max_write_same_sectors = 0;
        lim->max_discard_sectors = 0;
diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
index e140cc487ce1..dd93763057ce 100644
--- a/block/blk-sysfs.c
+++ b/block/blk-sysfs.c
@@ -147,10 +147,9 @@ static ssize_t queue_discard_granularity_show(struct request_queue *q, char *pag
 static ssize_t queue_discard_max_hw_show(struct request_queue *q, char *page)
 {
-        unsigned long long val;
-        val = q->limits.max_hw_discard_sectors << 9;
+        return sprintf(page, "%llu\n",
-        return sprintf(page, "%llu\n", val);
+                (unsigned long long)q->limits.max_hw_discard_sectors << 9);
 }
 static ssize_t queue_discard_max_show(struct request_queue *q, char *page)
diff --git a/block/deadline-iosched.c b/block/deadline-iosched.c
index a753df2b3fc2..d0dd7882d8c7 100644
--- a/block/deadline-iosched.c
+++ b/block/deadline-iosched.c
@@ -39,7 +39,6 @@ struct deadline_data {
         */
        struct request *next_rq[2];
        unsigned int batching;          /* number of sequential requests made */
-        sector_t last_sector;           /* head position */
        unsigned int starved;           /* times reads have starved writes */
        /*
@@ -210,8 +209,6 @@ deadline_move_request(struct deadline_data *dd, struct request *rq)
        dd->next_rq[WRITE] = NULL;
        dd->next_rq[data_dir] = deadline_latter_request(rq);
-        dd->last_sector = rq_end_sector(rq);
        /*
         * take it off the sort and fifo list, move
         * to dispatch queue
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index 9e251201dd48..84708a5f8c52 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -866,7 +866,7 @@ static void set_fdc(int drive)
 }
 /* locks the driver */
-static int lock_fdc(int drive, bool interruptible)
+static int lock_fdc(int drive)
 {
        if (WARN(atomic_read(&usage_count) == 0,
                 "Trying to lock fdc while usage count=0\n"))
@@ -2173,7 +2173,7 @@ static int do_format(int drive, struct format_descr *tmp_format_req)
 {
        int ret;
-        if (lock_fdc(drive, true))
+        if (lock_fdc(drive))
                return -EINTR;
        set_floppy(drive);
@@ -2960,7 +2960,7 @@ static int user_reset_fdc(int drive, int arg, bool interruptible)
 {
        int ret;
-        if (lock_fdc(drive, interruptible))
+        if (lock_fdc(drive))
                return -EINTR;
        if (arg == FD_RESET_ALWAYS)
@@ -3243,7 +3243,7 @@ static int set_geometry(unsigned int cmd, struct floppy_struct *g,
                if (!capable(CAP_SYS_ADMIN))
                        return -EPERM;
                mutex_lock(&open_lock);
-                if (lock_fdc(drive, true)) {
+                if (lock_fdc(drive)) {
                        mutex_unlock(&open_lock);
                        return -EINTR;
                }
@@ -3263,7 +3263,7 @@ static int set_geometry(unsigned int cmd, struct floppy_struct *g,
        } else {
                int oldStretch;
-                if (lock_fdc(drive, true))
+                if (lock_fdc(drive))
                        return -EINTR;
                if (cmd != FDDEFPRM) {
                        /* notice a disk change immediately, else
@@ -3349,7 +3349,7 @@ static int get_floppy_geometry(int drive, int type, struct floppy_struct **g)
        if (type)
                *g = &floppy_type[type];
        else {
-                if (lock_fdc(drive, false))
+                if (lock_fdc(drive))
                        return -EINTR;
                if (poll_drive(false, 0) == -EINTR)
                        return -EINTR;
@@ -3433,7 +3433,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
                if (UDRS->fd_ref != 1)
                        /* somebody else has this drive open */
                        return -EBUSY;
-                if (lock_fdc(drive, true))
+                if (lock_fdc(drive))
                        return -EINTR;
                /* do the actual eject. Fails on
@@ -3445,7 +3445,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
                process_fd_request();
                return ret;
        case FDCLRPRM:
-                if (lock_fdc(drive, true))
+                if (lock_fdc(drive))
                        return -EINTR;
                current_type[drive] = NULL;
                floppy_sizes[drive] = MAX_DISK_SIZE << 1;
@@ -3467,7 +3467,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
                UDP->flags &= ~FTD_MSG;
                return 0;
        case FDFMTBEG:
-                if (lock_fdc(drive, true))
+                if (lock_fdc(drive))
                        return -EINTR;
                if (poll_drive(true, FD_RAW_NEED_DISK) == -EINTR)
                        return -EINTR;
@@ -3484,7 +3484,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
                return do_format(drive, &inparam.f);
        case FDFMTEND:
        case FDFLUSH:
-                if (lock_fdc(drive, true))
+                if (lock_fdc(drive))
                        return -EINTR;
                return invalidate_drive(bdev);
        case FDSETEMSGTRESH:
@@ -3507,7 +3507,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
                outparam = UDP;
                break;
        case FDPOLLDRVSTAT:
-                if (lock_fdc(drive, true))
+                if (lock_fdc(drive))
                        return -EINTR;
                if (poll_drive(true, FD_RAW_NEED_DISK) == -EINTR)
                        return -EINTR;
@@ -3530,7 +3530,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
        case FDRAWCMD:
                if (type)
                        return -EINVAL;
-                if (lock_fdc(drive, true))
+                if (lock_fdc(drive))
                        return -EINTR;
                set_floppy(drive);
                i = raw_cmd_ioctl(cmd, (void __user *)param);
@@ -3539,7 +3539,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
                process_fd_request();
                return i;
        case FDTWADDLE:
-                if (lock_fdc(drive, true))
+                if (lock_fdc(drive))
                        return -EINTR;
                twaddle();
                process_fd_request();
@@ -3663,6 +3663,11 @@ static int floppy_open(struct block_device *bdev, fmode_t mode)
        opened_bdev[drive] = bdev;
+        if (!(mode & (FMODE_READ|FMODE_WRITE))) {
+                res = -EINVAL;
+                goto out;
+        }
        res = -ENXIO;
        if (!floppy_track_buffer) {
@@ -3706,21 +3711,20 @@ static int floppy_open(struct block_device *bdev, fmode_t mode)
        if (UFDCS->rawcmd == 1)
                UFDCS->rawcmd = 2;
-        if (!(mode & FMODE_NDELAY)) {
+        UDRS->last_checked = 0;
-                if (mode & (FMODE_READ|FMODE_WRITE)) {
+        clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags);
-                        UDRS->last_checked = 0;
+        check_disk_change(bdev);
-                        clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags);
+        if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags))
-                        check_disk_change(bdev);
+                goto out;
-                        if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags))
+        if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags))
-                                goto out;
+                goto out;
-                        if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags))
-                                goto out;
+        res = -EROFS;
-                }
-                res = -EROFS;
+        if ((mode & FMODE_WRITE) &&
-                if ((mode & FMODE_WRITE) &&
+                        !test_bit(FD_DISK_WRITABLE_BIT, &UDRS->flags))
-                    !test_bit(FD_DISK_WRITABLE_BIT, &UDRS->flags))
+                goto out;
-                        goto out;
-        }
        mutex_unlock(&open_lock);
        mutex_unlock(&floppy_mutex);
        return 0;
@@ -3748,7 +3752,8 @@ static unsigned int floppy_check_events(struct gendisk *disk,
                return DISK_EVENT_MEDIA_CHANGE;
        if (time_after(jiffies, UDRS->last_checked + UDP->checkfreq)) {
-                lock_fdc(drive, false);
+                if (lock_fdc(drive))
+                        return -EINTR;
                poll_drive(false, 0);
                process_fd_request();
        }
@@ -3847,7 +3852,9 @@ static int floppy_revalidate(struct gendisk *disk)
                         "VFS: revalidate called on non-open device.\n"))
                        return -EFAULT;
-                lock_fdc(drive, false);
+                res = lock_fdc(drive);
+                if (res)
+                        return res;
                cf = (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags) ||
                      test_bit(FD_VERIFY_BIT, &UDRS->flags));
                if (!(cf || test_bit(drive, &fake_change) || drive_no_geom(drive))) {
diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c
index 8ba1e97d573c..64a7b5971b57 100644
--- a/drivers/block/null_blk.c
+++ b/drivers/block/null_blk.c
@@ -478,7 +478,7 @@ static int null_lnvm_id(struct nvm_dev *dev, struct nvm_id *id)
        id->ver_id = 0x1;
        id->vmnt = 0;
        id->cgrps = 1;
-        id->cap = 0x3;
+        id->cap = 0x2;
        id->dom = 0x1;
        id->ppaf.blk_offset = 0;
@@ -707,9 +707,7 @@ static int null_add_dev(void)
        queue_flag_set_unlocked(QUEUE_FLAG_NONROT, nullb->q);
        queue_flag_clear_unlocked(QUEUE_FLAG_ADD_RANDOM, nullb->q);
        mutex_lock(&lock);
-        list_add_tail(&nullb->list, &nullb_list);
        nullb->index = nullb_indexes++;
        mutex_unlock(&lock);
@@ -743,6 +741,10 @@ static int null_add_dev(void)
        strncpy(disk->disk_name, nullb->disk_name, DISK_NAME_LEN);
        add_disk(disk);
+        mutex_lock(&lock);
+        list_add_tail(&nullb->list, &nullb_list);
+        mutex_unlock(&lock);
 done:
        return 0;
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 8a8dc91c39f7..83eb9e6bf8b0 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -1873,6 +1873,43 @@ again:
        return err;
 }
+static int negotiate_mq(struct blkfront_info *info)
+{
+        unsigned int backend_max_queues = 0;
+        int err;
+        unsigned int i;
+        BUG_ON(info->nr_rings);
+        /* Check if backend supports multiple queues. */
+        err = xenbus_scanf(XBT_NIL, info->xbdev->otherend,
+                           "multi-queue-max-queues", "%u", &backend_max_queues);
+        if (err < 0)
+                backend_max_queues = 1;
+        info->nr_rings = min(backend_max_queues, xen_blkif_max_queues);
+        /* We need at least one ring. */
+        if (!info->nr_rings)
+                info->nr_rings = 1;
+        info->rinfo = kzalloc(sizeof(struct blkfront_ring_info) * info->nr_rings, GFP_KERNEL);
+        if (!info->rinfo) {
+                xenbus_dev_fatal(info->xbdev, -ENOMEM, "allocating ring_info structure");
+                return -ENOMEM;
+        }
+        for (i = 0; i < info->nr_rings; i++) {
+                struct blkfront_ring_info *rinfo;
+                rinfo = &info->rinfo[i];
+                INIT_LIST_HEAD(&rinfo->indirect_pages);
+                INIT_LIST_HEAD(&rinfo->grants);
+                rinfo->dev_info = info;
+                INIT_WORK(&rinfo->work, blkif_restart_queue);
+                spin_lock_init(&rinfo->ring_lock);
+        }
+        return 0;
+}
 /**
 * Entry point to this code when a new device is created.  Allocate the basic
 * structures and the ring buffer for communication with the backend, and
@@ -1883,9 +1920,7 @@ static int blkfront_probe(struct xenbus_device *dev,
                          const struct xenbus_device_id *id)
 {
        int err, vdevice;
-        unsigned int r_index;
        struct blkfront_info *info;
-        unsigned int backend_max_queues = 0;
        /* FIXME: Use dynamic device id if this is not set. */
        err = xenbus_scanf(XBT_NIL, dev->nodename,
@@ -1936,33 +1971,10 @@ static int blkfront_probe(struct xenbus_device *dev,
        }
        info->xbdev = dev;
-        /* Check if backend supports multiple queues. */
+        err = negotiate_mq(info);
-        err = xenbus_scanf(XBT_NIL, info->xbdev->otherend,
+        if (err) {
-                           "multi-queue-max-queues", "%u", &backend_max_queues);
-        if (err < 0)
-                backend_max_queues = 1;
-        info->nr_rings = min(backend_max_queues, xen_blkif_max_queues);
-        /* We need at least one ring. */
-        if (!info->nr_rings)
-                info->nr_rings = 1;
-        info->rinfo = kzalloc(sizeof(struct blkfront_ring_info) * info->nr_rings, GFP_KERNEL);
-        if (!info->rinfo) {
-                xenbus_dev_fatal(dev, -ENOMEM, "allocating ring_info structure");
                kfree(info);
-                return -ENOMEM;
+                return err;
-        }
-        for (r_index = 0; r_index < info->nr_rings; r_index++) {
-                struct blkfront_ring_info *rinfo;
-                rinfo = &info->rinfo[r_index];
-                INIT_LIST_HEAD(&rinfo->indirect_pages);
-                INIT_LIST_HEAD(&rinfo->grants);
-                rinfo->dev_info = info;
-                INIT_WORK(&rinfo->work, blkif_restart_queue);
-                spin_lock_init(&rinfo->ring_lock);
        }
        mutex_init(&info->mutex);
@@ -2123,12 +2135,16 @@ static int blkif_recover(struct blkfront_info *info)
 static int blkfront_resume(struct xenbus_device *dev)
 {
        struct blkfront_info *info = dev_get_drvdata(&dev->dev);
-        int err;
+        int err = 0;
        dev_dbg(&dev->dev, "blkfront_resume: %s\n", dev->nodename);
        blkif_free(info, info->connected == BLKIF_STATE_CONNECTED);
+        err = negotiate_mq(info);
+        if (err)
+                return err;
        err = talk_to_blkback(dev, info);
        /*
diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
index 240b6cf1d97c..be54e5331a45 100644
--- a/drivers/char/hpet.c
+++ b/drivers/char/hpet.c
@@ -42,7 +42,7 @@
 /*
 * The High Precision Event Timer driver.
 * This driver is closely modelled after the rtc.c driver.
- * http://www.intel.com/hardwaredesign/hpetspec_1.pdf
+ * See HPET spec revision 1.
 */
 #define HPET_USER_FREQ  (64)
 #define HPET_DRIFT      (500)
diff --git a/drivers/clk/Makefile b/drivers/clk/Makefile
index b038e3666058..bae4be6501df 100644
--- a/drivers/clk/Makefile
+++ b/drivers/clk/Makefile
@@ -43,7 +43,7 @@ obj-$(CONFIG_COMMON_CLK_SI514)		+= clk-si514.o
 obj-$(CONFIG_COMMON_CLK_SI570)          += clk-si570.o
 obj-$(CONFIG_COMMON_CLK_CDCE925)        += clk-cdce925.o
 obj-$(CONFIG_ARCH_STM32)                += clk-stm32f4.o
-obj-$(CONFIG_ARCH_TANGOX)               += clk-tango4.o
+obj-$(CONFIG_ARCH_TANGO)                += clk-tango4.o
 obj-$(CONFIG_CLK_TWL6040)               += clk-twl6040.o
 obj-$(CONFIG_ARCH_U300)                 += clk-u300.o
 obj-$(CONFIG_ARCH_VT8500)               += clk-vt8500.o
diff --git a/drivers/clk/clk-gpio.c b/drivers/clk/clk-gpio.c
index 19fed65587e8..7b09a265d79f 100644
--- a/drivers/clk/clk-gpio.c
+++ b/drivers/clk/clk-gpio.c
@@ -289,7 +289,7 @@ static void __init of_gpio_clk_setup(struct device_node *node,
        num_parents = of_clk_get_parent_count(node);
        if (num_parents < 0)
-                return;
+                num_parents = 0;
        data = kzalloc(sizeof(*data), GFP_KERNEL);
        if (!data)
diff --git a/drivers/clk/clk-scpi.c b/drivers/clk/clk-scpi.c
index cd0f2726f5e0..89e9ca78bb94 100644
--- a/drivers/clk/clk-scpi.c
+++ b/drivers/clk/clk-scpi.c
@@ -299,7 +299,7 @@ static int scpi_clocks_probe(struct platform_device *pdev)
        /* Add the virtual cpufreq device */
        cpufreq_dev = platform_device_register_simple("scpi-cpufreq",
                                                      -1, NULL, 0);
-        if (!cpufreq_dev)
+        if (IS_ERR(cpufreq_dev))
                pr_warn("unable to register cpufreq device");
        return 0;
diff --git a/drivers/clk/mvebu/dove-divider.c b/drivers/clk/mvebu/dove-divider.c
index d5c5bfa35a5a..3e0b52daa35f 100644
--- a/drivers/clk/mvebu/dove-divider.c
+++ b/drivers/clk/mvebu/dove-divider.c
@@ -247,7 +247,7 @@ static struct clk_onecell_data dove_divider_data = {
 void __init dove_divider_clk_init(struct device_node *np)
 {
-        void *base;
+        void __iomem *base;
        base = of_iomap(np, 0);
        if (WARN_ON(!base))
diff --git a/drivers/clk/qcom/gcc-apq8084.c b/drivers/clk/qcom/gcc-apq8084.c
index cf73e539e9f6..070037a29ea5 100644
--- a/drivers/clk/qcom/gcc-apq8084.c
+++ b/drivers/clk/qcom/gcc-apq8084.c
@@ -3587,7 +3587,6 @@ static const struct regmap_config gcc_apq8084_regmap_config = {
        .val_bits       = 32,
        .max_register   = 0x1fc0,
        .fast_io        = true,
-        .val_format_endian = REGMAP_ENDIAN_LITTLE,
 };
 static const struct qcom_cc_desc gcc_apq8084_desc = {
diff --git a/drivers/clk/qcom/gcc-ipq806x.c b/drivers/clk/qcom/gcc-ipq806x.c
index b692ae881d6a..dd5402bac620 100644
--- a/drivers/clk/qcom/gcc-ipq806x.c
+++ b/drivers/clk/qcom/gcc-ipq806x.c
@@ -3005,7 +3005,6 @@ static const struct regmap_config gcc_ipq806x_regmap_config = {
        .val_bits       = 32,
        .max_register   = 0x3e40,
        .fast_io        = true,
-        .val_format_endian = REGMAP_ENDIAN_LITTLE,
 };
 static const struct qcom_cc_desc gcc_ipq806x_desc = {
diff --git a/drivers/clk/qcom/gcc-msm8660.c b/drivers/clk/qcom/gcc-msm8660.c
index f6a2b14dfec4..ad413036f7c7 100644
--- a/drivers/clk/qcom/gcc-msm8660.c
+++ b/drivers/clk/qcom/gcc-msm8660.c
@@ -2702,7 +2702,6 @@ static const struct regmap_config gcc_msm8660_regmap_config = {
        .val_bits       = 32,
        .max_register   = 0x363c,
        .fast_io        = true,
-        .val_format_endian = REGMAP_ENDIAN_LITTLE,
 };
 static const struct qcom_cc_desc gcc_msm8660_desc = {
diff --git a/drivers/clk/qcom/gcc-msm8916.c b/drivers/clk/qcom/gcc-msm8916.c
index e3bf09d7d0ef..8cc9b2868b41 100644
--- a/drivers/clk/qcom/gcc-msm8916.c
+++ b/drivers/clk/qcom/gcc-msm8916.c
@@ -3336,7 +3336,6 @@ static const struct regmap_config gcc_msm8916_regmap_config = {
        .val_bits       = 32,
        .max_register   = 0x80000,
        .fast_io        = true,
-        .val_format_endian = REGMAP_ENDIAN_LITTLE,
 };
 static const struct qcom_cc_desc gcc_msm8916_desc = {
diff --git a/drivers/clk/qcom/gcc-msm8960.c b/drivers/clk/qcom/gcc-msm8960.c
index f31111e32d44..983dd7dc89a7 100644
--- a/drivers/clk/qcom/gcc-msm8960.c
+++ b/drivers/clk/qcom/gcc-msm8960.c
@@ -3468,7 +3468,6 @@ static const struct regmap_config gcc_msm8960_regmap_config = {
        .val_bits       = 32,
        .max_register   = 0x3660,
        .fast_io        = true,
-        .val_format_endian = REGMAP_ENDIAN_LITTLE,
 };
 static const struct regmap_config gcc_apq8064_regmap_config = {
@@ -3477,7 +3476,6 @@ static const struct regmap_config gcc_apq8064_regmap_config = {
        .val_bits       = 32,
        .max_register   = 0x3880,
        .fast_io        = true,
-        .val_format_endian = REGMAP_ENDIAN_LITTLE,
 };
 static const struct qcom_cc_desc gcc_msm8960_desc = {
diff --git a/drivers/clk/qcom/gcc-msm8974.c b/drivers/clk/qcom/gcc-msm8974.c
index df164d618e34..335952db309b 100644
--- a/drivers/clk/qcom/gcc-msm8974.c
+++ b/drivers/clk/qcom/gcc-msm8974.c
@@ -2680,7 +2680,6 @@ static const struct regmap_config gcc_msm8974_regmap_config = {
        .val_bits       = 32,
        .max_register   = 0x1fc0,
        .fast_io        = true,
-        .val_format_endian = REGMAP_ENDIAN_LITTLE,
 };
 static const struct qcom_cc_desc gcc_msm8974_desc = {
diff --git a/drivers/clk/qcom/lcc-ipq806x.c b/drivers/clk/qcom/lcc-ipq806x.c
index 62e79fadd5f7..db3998e5e2d8 100644
--- a/drivers/clk/qcom/lcc-ipq806x.c
+++ b/drivers/clk/qcom/lcc-ipq806x.c
@@ -419,7 +419,6 @@ static const struct regmap_config lcc_ipq806x_regmap_config = {
        .val_bits       = 32,
        .max_register   = 0xfc,
        .fast_io        = true,
-        .val_format_endian = REGMAP_ENDIAN_LITTLE,
 };
 static const struct qcom_cc_desc lcc_ipq806x_desc = {
diff --git a/drivers/clk/qcom/lcc-msm8960.c b/drivers/clk/qcom/lcc-msm8960.c
index bf95bb0ea1b8..4fcf9d1d233c 100644
--- a/drivers/clk/qcom/lcc-msm8960.c
+++ b/drivers/clk/qcom/lcc-msm8960.c
@@ -524,7 +524,6 @@ static const struct regmap_config lcc_msm8960_regmap_config = {
        .val_bits       = 32,
        .max_register   = 0xfc,
        .fast_io        = true,
-        .val_format_endian = REGMAP_ENDIAN_LITTLE,
 };
 static const struct qcom_cc_desc lcc_msm8960_desc = {
diff --git a/drivers/clk/qcom/mmcc-apq8084.c b/drivers/clk/qcom/mmcc-apq8084.c
index 1e703fda8a0f..30777f9f1a43 100644
--- a/drivers/clk/qcom/mmcc-apq8084.c
+++ b/drivers/clk/qcom/mmcc-apq8084.c
@@ -3368,7 +3368,6 @@ static const struct regmap_config mmcc_apq8084_regmap_config = {
        .val_bits       = 32,
        .max_register   = 0x5104,
        .fast_io        = true,
-        .val_format_endian = REGMAP_ENDIAN_LITTLE,
 };
 static const struct qcom_cc_desc mmcc_apq8084_desc = {
diff --git a/drivers/clk/qcom/mmcc-msm8960.c b/drivers/clk/qcom/mmcc-msm8960.c
index d73a048d3b9d..00e36192a1de 100644
--- a/drivers/clk/qcom/mmcc-msm8960.c
+++ b/drivers/clk/qcom/mmcc-msm8960.c
@@ -3029,7 +3029,6 @@ static const struct regmap_config mmcc_msm8960_regmap_config = {
        .val_bits       = 32,
        .max_register   = 0x334,
        .fast_io        = true,
-        .val_format_endian = REGMAP_ENDIAN_LITTLE,
 };
 static const struct regmap_config mmcc_apq8064_regmap_config = {
@@ -3038,7 +3037,6 @@ static const struct regmap_config mmcc_apq8064_regmap_config = {
        .val_bits       = 32,
        .max_register   = 0x350,
        .fast_io        = true,
-        .val_format_endian = REGMAP_ENDIAN_LITTLE,
 };
 static const struct qcom_cc_desc mmcc_msm8960_desc = {
diff --git a/drivers/clk/qcom/mmcc-msm8974.c b/drivers/clk/qcom/mmcc-msm8974.c
index bbe28ed93669..9d790bcadf25 100644
--- a/drivers/clk/qcom/mmcc-msm8974.c
+++ b/drivers/clk/qcom/mmcc-msm8974.c
@@ -2594,7 +2594,6 @@ static const struct regmap_config mmcc_msm8974_regmap_config = {
        .val_bits       = 32,
        .max_register   = 0x5104,
        .fast_io        = true,
-        .val_format_endian = REGMAP_ENDIAN_LITTLE,
 };
 static const struct qcom_cc_desc mmcc_msm8974_desc = {
diff --git a/drivers/clk/rockchip/clk-rk3036.c b/drivers/clk/rockchip/clk-rk3036.c
index ebce98033fbb..bc7fbac83ab7 100644
--- a/drivers/clk/rockchip/clk-rk3036.c
+++ b/drivers/clk/rockchip/clk-rk3036.c
@@ -133,7 +133,7 @@ PNAME(mux_spdif_p)	= { "spdif_src", "spdif_frac", "xin12m" };
 PNAME(mux_uart0_p)      = { "uart0_src", "uart0_frac", "xin24m" };
 PNAME(mux_uart1_p)      = { "uart1_src", "uart1_frac", "xin24m" };
 PNAME(mux_uart2_p)      = { "uart2_src", "uart2_frac", "xin24m" };
-PNAME(mux_mac_p)        = { "mac_pll_src", "ext_gmac" };
+PNAME(mux_mac_p)        = { "mac_pll_src", "rmii_clkin" };
 PNAME(mux_dclk_p)       = { "dclk_lcdc", "dclk_cru" };
 static struct rockchip_pll_clock rk3036_pll_clks[] __initdata = {
@@ -224,16 +224,16 @@ static struct rockchip_clk_branch rk3036_clk_branches[] __initdata = {
                        RK2928_CLKGATE_CON(2), 2, GFLAGS),
        COMPOSITE_NODIV(SCLK_TIMER0, "sclk_timer0", mux_timer_p, CLK_IGNORE_UNUSED,
-                        RK2928_CLKSEL_CON(2), 4, 1, DFLAGS,
+                        RK2928_CLKSEL_CON(2), 4, 1, MFLAGS,
                        RK2928_CLKGATE_CON(1), 0, GFLAGS),
        COMPOSITE_NODIV(SCLK_TIMER1, "sclk_timer1", mux_timer_p, CLK_IGNORE_UNUSED,
-                        RK2928_CLKSEL_CON(2), 5, 1, DFLAGS,
+                        RK2928_CLKSEL_CON(2), 5, 1, MFLAGS,
                        RK2928_CLKGATE_CON(1), 1, GFLAGS),
        COMPOSITE_NODIV(SCLK_TIMER2, "sclk_timer2", mux_timer_p, CLK_IGNORE_UNUSED,
-                        RK2928_CLKSEL_CON(2), 6, 1, DFLAGS,
+                        RK2928_CLKSEL_CON(2), 6, 1, MFLAGS,
                        RK2928_CLKGATE_CON(2), 4, GFLAGS),
        COMPOSITE_NODIV(SCLK_TIMER3, "sclk_timer3", mux_timer_p, CLK_IGNORE_UNUSED,
-                        RK2928_CLKSEL_CON(2), 7, 1, DFLAGS,
+                        RK2928_CLKSEL_CON(2), 7, 1, MFLAGS,
                        RK2928_CLKGATE_CON(2), 5, GFLAGS),
        MUX(0, "uart_pll_clk", mux_pll_src_apll_dpll_gpll_usb480m_p, 0,
@@ -242,11 +242,11 @@ static struct rockchip_clk_branch rk3036_clk_branches[] __initdata = {
                        RK2928_CLKSEL_CON(13), 0, 7, DFLAGS,
                        RK2928_CLKGATE_CON(1), 8, GFLAGS),
        COMPOSITE_NOMUX(0, "uart1_src", "uart_pll_clk", 0,
-                        RK2928_CLKSEL_CON(13), 0, 7, DFLAGS,
+                        RK2928_CLKSEL_CON(14), 0, 7, DFLAGS,
-                        RK2928_CLKGATE_CON(1), 8, GFLAGS),
+                        RK2928_CLKGATE_CON(1), 10, GFLAGS),
        COMPOSITE_NOMUX(0, "uart2_src", "uart_pll_clk", 0,
-                        RK2928_CLKSEL_CON(13), 0, 7, DFLAGS,
+                        RK2928_CLKSEL_CON(15), 0, 7, DFLAGS,
-                        RK2928_CLKGATE_CON(1), 8, GFLAGS),
+                        RK2928_CLKGATE_CON(1), 12, GFLAGS),
        COMPOSITE_FRACMUX(0, "uart0_frac", "uart0_src", CLK_SET_RATE_PARENT,
                        RK2928_CLKSEL_CON(17), 0,
                        RK2928_CLKGATE_CON(1), 9, GFLAGS,
@@ -279,13 +279,13 @@ static struct rockchip_clk_branch rk3036_clk_branches[] __initdata = {
                        RK2928_CLKGATE_CON(3), 2, GFLAGS),
        COMPOSITE_NODIV(0, "sclk_sdmmc_src", mux_mmc_src_p, 0,
-                        RK2928_CLKSEL_CON(12), 8, 2, DFLAGS,
+                        RK2928_CLKSEL_CON(12), 8, 2, MFLAGS,
                        RK2928_CLKGATE_CON(2), 11, GFLAGS),
        DIV(SCLK_SDMMC, "sclk_sdmmc", "sclk_sdmmc_src", 0,
                        RK2928_CLKSEL_CON(11), 0, 7, DFLAGS),
        COMPOSITE_NODIV(0, "sclk_sdio_src", mux_mmc_src_p, 0,
-                        RK2928_CLKSEL_CON(12), 10, 2, DFLAGS,
+                        RK2928_CLKSEL_CON(12), 10, 2, MFLAGS,
                        RK2928_CLKGATE_CON(2), 13, GFLAGS),
        DIV(SCLK_SDIO, "sclk_sdio", "sclk_sdio_src", 0,
                        RK2928_CLKSEL_CON(11), 8, 7, DFLAGS),
@@ -344,12 +344,12 @@ static struct rockchip_clk_branch rk3036_clk_branches[] __initdata = {
                        RK2928_CLKGATE_CON(10), 5, GFLAGS),
        COMPOSITE_NOGATE(0, "mac_pll_src", mux_pll_src_3plls_p, 0,
-                        RK2928_CLKSEL_CON(21), 0, 2, MFLAGS, 4, 5, DFLAGS),
+                        RK2928_CLKSEL_CON(21), 0, 2, MFLAGS, 9, 5, DFLAGS),
        MUX(SCLK_MACREF, "mac_clk_ref", mux_mac_p, CLK_SET_RATE_PARENT,
                        RK2928_CLKSEL_CON(21), 3, 1, MFLAGS),
        COMPOSITE_NOMUX(SCLK_MAC, "mac_clk", "mac_clk_ref", 0,
-                        RK2928_CLKSEL_CON(21), 9, 5, DFLAGS,
+                        RK2928_CLKSEL_CON(21), 4, 5, DFLAGS,
                        RK2928_CLKGATE_CON(2), 6, GFLAGS),
        MUX(SCLK_HDMI, "dclk_hdmi", mux_dclk_p, 0,
diff --git a/drivers/clk/rockchip/clk-rk3368.c b/drivers/clk/rockchip/clk-rk3368.c
index be0ede522269..21f3ea909fab 100644
--- a/drivers/clk/rockchip/clk-rk3368.c
+++ b/drivers/clk/rockchip/clk-rk3368.c
@@ -780,13 +780,13 @@ static struct rockchip_clk_branch rk3368_clk_branches[] __initdata = {
        GATE(PCLK_TSADC, "pclk_tsadc", "pclk_peri", 0, RK3368_CLKGATE_CON(20), 0, GFLAGS),
        /* pclk_pd_alive gates */
-        GATE(PCLK_TIMER1, "pclk_timer1", "pclk_pd_alive", 0, RK3368_CLKGATE_CON(14), 8, GFLAGS),
+        GATE(PCLK_TIMER1, "pclk_timer1", "pclk_pd_alive", 0, RK3368_CLKGATE_CON(22), 13, GFLAGS),
-        GATE(PCLK_TIMER0, "pclk_timer0", "pclk_pd_alive", 0, RK3368_CLKGATE_CON(14), 7, GFLAGS),
+        GATE(PCLK_TIMER0, "pclk_timer0", "pclk_pd_alive", 0, RK3368_CLKGATE_CON(22), 12, GFLAGS),
-        GATE(0, "pclk_alive_niu", "pclk_pd_alive", CLK_IGNORE_UNUSED, RK3368_CLKGATE_CON(14), 12, GFLAGS),
+        GATE(0, "pclk_alive_niu", "pclk_pd_alive", CLK_IGNORE_UNUSED, RK3368_CLKGATE_CON(22), 9, GFLAGS),
-        GATE(PCLK_GRF, "pclk_grf", "pclk_pd_alive", CLK_IGNORE_UNUSED, RK3368_CLKGATE_CON(14), 11, GFLAGS),
+        GATE(PCLK_GRF, "pclk_grf", "pclk_pd_alive", CLK_IGNORE_UNUSED, RK3368_CLKGATE_CON(22), 8, GFLAGS),
-        GATE(PCLK_GPIO3, "pclk_gpio3", "pclk_pd_alive", 0, RK3368_CLKGATE_CON(14), 3, GFLAGS),
+        GATE(PCLK_GPIO3, "pclk_gpio3", "pclk_pd_alive", 0, RK3368_CLKGATE_CON(22), 3, GFLAGS),
-        GATE(PCLK_GPIO2, "pclk_gpio2", "pclk_pd_alive", 0, RK3368_CLKGATE_CON(14), 2, GFLAGS),
+        GATE(PCLK_GPIO2, "pclk_gpio2", "pclk_pd_alive", 0, RK3368_CLKGATE_CON(22), 2, GFLAGS),
-        GATE(PCLK_GPIO1, "pclk_gpio1", "pclk_pd_alive", 0, RK3368_CLKGATE_CON(14), 1, GFLAGS),
+        GATE(PCLK_GPIO1, "pclk_gpio1", "pclk_pd_alive", 0, RK3368_CLKGATE_CON(22), 1, GFLAGS),
        /*
         * pclk_vio gates
@@ -796,12 +796,12 @@ static struct rockchip_clk_branch rk3368_clk_branches[] __initdata = {
        GATE(0, "pclk_dphytx", "hclk_vio", CLK_IGNORE_UNUSED, RK3368_CLKGATE_CON(14), 8, GFLAGS),
        /* pclk_pd_pmu gates */
-        GATE(PCLK_PMUGRF, "pclk_pmugrf", "pclk_pd_pmu", CLK_IGNORE_UNUSED, RK3368_CLKGATE_CON(17), 0, GFLAGS),
+        GATE(PCLK_PMUGRF, "pclk_pmugrf", "pclk_pd_pmu", CLK_IGNORE_UNUSED, RK3368_CLKGATE_CON(23), 5, GFLAGS),
-        GATE(PCLK_GPIO0, "pclk_gpio0", "pclk_pd_pmu", 0, RK3368_CLKGATE_CON(17), 4, GFLAGS),
+        GATE(PCLK_GPIO0, "pclk_gpio0", "pclk_pd_pmu", 0, RK3368_CLKGATE_CON(23), 4, GFLAGS),
-        GATE(PCLK_SGRF, "pclk_sgrf", "pclk_pd_pmu", CLK_IGNORE_UNUSED, RK3368_CLKGATE_CON(17), 3, GFLAGS),
+        GATE(PCLK_SGRF, "pclk_sgrf", "pclk_pd_pmu", CLK_IGNORE_UNUSED, RK3368_CLKGATE_CON(23), 3, GFLAGS),
-        GATE(0, "pclk_pmu_noc", "pclk_pd_pmu", CLK_IGNORE_UNUSED, RK3368_CLKGATE_CON(17), 2, GFLAGS),
+        GATE(0, "pclk_pmu_noc", "pclk_pd_pmu", CLK_IGNORE_UNUSED, RK3368_CLKGATE_CON(23), 2, GFLAGS),
-        GATE(0, "pclk_intmem1", "pclk_pd_pmu", CLK_IGNORE_UNUSED, RK3368_CLKGATE_CON(17), 1, GFLAGS),
+        GATE(0, "pclk_intmem1", "pclk_pd_pmu", CLK_IGNORE_UNUSED, RK3368_CLKGATE_CON(23), 1, GFLAGS),
-        GATE(PCLK_PMU, "pclk_pmu", "pclk_pd_pmu", CLK_IGNORE_UNUSED, RK3368_CLKGATE_CON(17), 2, GFLAGS),
+        GATE(PCLK_PMU, "pclk_pmu", "pclk_pd_pmu", CLK_IGNORE_UNUSED, RK3368_CLKGATE_CON(23), 0, GFLAGS),
        /* timer gates */
        GATE(0, "sclk_timer15", "xin24m", CLK_IGNORE_UNUSED, RK3368_CLKGATE_CON(24), 11, GFLAGS),
diff --git a/drivers/clk/tegra/clk-emc.c b/drivers/clk/tegra/clk-emc.c
index e1fe8f35d45c..74e7544f861b 100644
--- a/drivers/clk/tegra/clk-emc.c
+++ b/drivers/clk/tegra/clk-emc.c
@@ -450,8 +450,10 @@ static int load_timings_from_dt(struct tegra_clk_emc *tegra,
                struct emc_timing *timing = tegra->timings + (i++);
                err = load_one_timing_from_dt(tegra, timing, child);
-                if (err)
+                if (err) {
+                        of_node_put(child);
                        return err;
+                }
                timing->ram_code = ram_code;
        }
@@ -499,9 +501,9 @@ struct clk *tegra_clk_register_emc(void __iomem *base, struct device_node *np,
                 * fuses until the apbmisc driver is loaded.
                 */
                err = load_timings_from_dt(tegra, node, node_ram_code);
+                of_node_put(node);
                if (err)
                        return ERR_PTR(err);
-                of_node_put(node);
                break;
        }
diff --git a/drivers/clk/tegra/clk-id.h b/drivers/clk/tegra/clk-id.h
index 19ce0738ee76..62ea38187b71 100644
--- a/drivers/clk/tegra/clk-id.h
+++ b/drivers/clk/tegra/clk-id.h
@@ -11,6 +11,7 @@ enum clk_id {
        tegra_clk_afi,
        tegra_clk_amx,
        tegra_clk_amx1,
+        tegra_clk_apb2ape,
        tegra_clk_apbdma,
        tegra_clk_apbif,
        tegra_clk_ape,
diff --git a/drivers/clk/tegra/clk-pll.c b/drivers/clk/tegra/clk-pll.c
index a534bfab30b3..6ac3f843e7ca 100644
--- a/drivers/clk/tegra/clk-pll.c
+++ b/drivers/clk/tegra/clk-pll.c
@@ -86,15 +86,21 @@
 #define PLLE_SS_DISABLE (PLLE_SS_CNTL_BYPASS_SS | PLLE_SS_CNTL_INTERP_RESET |\
                                PLLE_SS_CNTL_SSC_BYP)
 #define PLLE_SS_MAX_MASK 0x1ff
-#define PLLE_SS_MAX_VAL 0x25
+#define PLLE_SS_MAX_VAL_TEGRA114 0x25
+#define PLLE_SS_MAX_VAL_TEGRA210 0x21
 #define PLLE_SS_INC_MASK (0xff << 16)
 #define PLLE_SS_INC_VAL (0x1 << 16)
 #define PLLE_SS_INCINTRV_MASK (0x3f << 24)
-#define PLLE_SS_INCINTRV_VAL (0x20 << 24)
+#define PLLE_SS_INCINTRV_VAL_TEGRA114 (0x20 << 24)
+#define PLLE_SS_INCINTRV_VAL_TEGRA210 (0x23 << 24)
 #define PLLE_SS_COEFFICIENTS_MASK \
        (PLLE_SS_MAX_MASK | PLLE_SS_INC_MASK | PLLE_SS_INCINTRV_MASK)
-#define PLLE_SS_COEFFICIENTS_VAL \
+#define PLLE_SS_COEFFICIENTS_VAL_TEGRA114 \
-        (PLLE_SS_MAX_VAL | PLLE_SS_INC_VAL | PLLE_SS_INCINTRV_VAL)
+        (PLLE_SS_MAX_VAL_TEGRA114 | PLLE_SS_INC_VAL |\
+         PLLE_SS_INCINTRV_VAL_TEGRA114)
+#define PLLE_SS_COEFFICIENTS_VAL_TEGRA210 \
+        (PLLE_SS_MAX_VAL_TEGRA210 | PLLE_SS_INC_VAL |\
+         PLLE_SS_INCINTRV_VAL_TEGRA210)
 #define PLLE_AUX_PLLP_SEL       BIT(2)
 #define PLLE_AUX_USE_LOCKDET    BIT(3)
@@ -880,7 +886,7 @@ static int clk_plle_training(struct tegra_clk_pll *pll)
 static int clk_plle_enable(struct clk_hw *hw)
 {
        struct tegra_clk_pll *pll = to_clk_pll(hw);
-        unsigned long input_rate = clk_get_rate(clk_get_parent(hw->clk));
+        unsigned long input_rate = clk_hw_get_rate(clk_hw_get_parent(hw));
        struct tegra_clk_pll_freq_table sel;
        u32 val;
        int err;
@@ -1378,7 +1384,7 @@ static int clk_plle_tegra114_enable(struct clk_hw *hw)
        u32 val;
        int ret;
        unsigned long flags = 0;
-        unsigned long input_rate = clk_get_rate(clk_get_parent(hw->clk));
+        unsigned long input_rate = clk_hw_get_rate(clk_hw_get_parent(hw));
        if (_get_table_rate(hw, &sel, pll->params->fixed_rate, input_rate))
                return -EINVAL;
@@ -1401,7 +1407,7 @@ static int clk_plle_tegra114_enable(struct clk_hw *hw)
        val |= PLLE_MISC_IDDQ_SW_CTRL;
        val &= ~PLLE_MISC_IDDQ_SW_VALUE;
        val |= PLLE_MISC_PLLE_PTS;
-        val |= PLLE_MISC_VREG_BG_CTRL_MASK | PLLE_MISC_VREG_CTRL_MASK;
+        val &= ~(PLLE_MISC_VREG_BG_CTRL_MASK | PLLE_MISC_VREG_CTRL_MASK);
        pll_writel_misc(val, pll);
        udelay(5);
@@ -1428,7 +1434,7 @@ static int clk_plle_tegra114_enable(struct clk_hw *hw)
        val = pll_readl(PLLE_SS_CTRL, pll);
        val &= ~(PLLE_SS_CNTL_CENTER | PLLE_SS_CNTL_INVERT);
        val &= ~PLLE_SS_COEFFICIENTS_MASK;
-        val |= PLLE_SS_COEFFICIENTS_VAL;
+        val |= PLLE_SS_COEFFICIENTS_VAL_TEGRA114;
        pll_writel(val, PLLE_SS_CTRL, pll);
        val &= ~(PLLE_SS_CNTL_SSC_BYP | PLLE_SS_CNTL_BYPASS_SS);
        pll_writel(val, PLLE_SS_CTRL, pll);
@@ -2012,9 +2018,9 @@ static int clk_plle_tegra210_enable(struct clk_hw *hw)
        struct tegra_clk_pll *pll = to_clk_pll(hw);
        struct tegra_clk_pll_freq_table sel;
        u32 val;
-        int ret;
+        int ret = 0;
        unsigned long flags = 0;
-        unsigned long input_rate = clk_get_rate(clk_get_parent(hw->clk));
+        unsigned long input_rate = clk_hw_get_rate(clk_hw_get_parent(hw));
        if (_get_table_rate(hw, &sel, pll->params->fixed_rate, input_rate))
                return -EINVAL;
@@ -2022,22 +2028,20 @@ static int clk_plle_tegra210_enable(struct clk_hw *hw)
        if (pll->lock)
                spin_lock_irqsave(pll->lock, flags);
+        val = pll_readl(pll->params->aux_reg, pll);
+        if (val & PLLE_AUX_SEQ_ENABLE)
+                goto out;
        val = pll_readl_base(pll);
        val &= ~BIT(30); /* Disable lock override */
        pll_writel_base(val, pll);
-        val = pll_readl(pll->params->aux_reg, pll);
-        val |= PLLE_AUX_ENABLE_SWCTL;
-        val &= ~PLLE_AUX_SEQ_ENABLE;
-        pll_writel(val, pll->params->aux_reg, pll);
-        udelay(1);
        val = pll_readl_misc(pll);
        val |= PLLE_MISC_LOCK_ENABLE;
        val |= PLLE_MISC_IDDQ_SW_CTRL;
        val &= ~PLLE_MISC_IDDQ_SW_VALUE;
        val |= PLLE_MISC_PLLE_PTS;
-        val |= PLLE_MISC_VREG_BG_CTRL_MASK | PLLE_MISC_VREG_CTRL_MASK;
+        val &= ~(PLLE_MISC_VREG_BG_CTRL_MASK | PLLE_MISC_VREG_CTRL_MASK);
        pll_writel_misc(val, pll);
        udelay(5);
@@ -2067,7 +2071,7 @@ static int clk_plle_tegra210_enable(struct clk_hw *hw)
        val = pll_readl(PLLE_SS_CTRL, pll);
        val &= ~(PLLE_SS_CNTL_CENTER | PLLE_SS_CNTL_INVERT);
        val &= ~PLLE_SS_COEFFICIENTS_MASK;
-        val |= PLLE_SS_COEFFICIENTS_VAL;
+        val |= PLLE_SS_COEFFICIENTS_VAL_TEGRA210;
        pll_writel(val, PLLE_SS_CTRL, pll);
        val &= ~(PLLE_SS_CNTL_SSC_BYP | PLLE_SS_CNTL_BYPASS_SS);
        pll_writel(val, PLLE_SS_CTRL, pll);
@@ -2104,15 +2108,25 @@ static void clk_plle_tegra210_disable(struct clk_hw *hw)
        if (pll->lock)
                spin_lock_irqsave(pll->lock, flags);
+        /* If PLLE HW sequencer is enabled, SW should not disable PLLE */
+        val = pll_readl(pll->params->aux_reg, pll);
+        if (val & PLLE_AUX_SEQ_ENABLE)
+                goto out;
        val = pll_readl_base(pll);
        val &= ~PLLE_BASE_ENABLE;
        pll_writel_base(val, pll);
+        val = pll_readl(pll->params->aux_reg, pll);
+        val |= PLLE_AUX_ENABLE_SWCTL | PLLE_AUX_SS_SWCTL;
+        pll_writel(val, pll->params->aux_reg, pll);
        val = pll_readl_misc(pll);
        val |= PLLE_MISC_IDDQ_SW_CTRL | PLLE_MISC_IDDQ_SW_VALUE;
        pll_writel_misc(val, pll);
        udelay(1);
+out:
        if (pll->lock)
                spin_unlock_irqrestore(pll->lock, flags);
 }
diff --git a/drivers/clk/tegra/clk-tegra-periph.c b/drivers/clk/tegra/clk-tegra-periph.c
index 6ad381a888a6..ea2b9cbf9e70 100644
--- a/drivers/clk/tegra/clk-tegra-periph.c
+++ b/drivers/clk/tegra/clk-tegra-periph.c
@@ -773,7 +773,7 @@ static struct tegra_periph_init_data periph_clks[] = {
        XUSB("xusb_dev_src", mux_clkm_pllp_pllc_pllre, CLK_SOURCE_XUSB_DEV_SRC, 95, TEGRA_PERIPH_ON_APB | TEGRA_PERIPH_NO_RESET, tegra_clk_xusb_dev_src),
        XUSB("xusb_dev_src", mux_clkm_pllp_pllre, CLK_SOURCE_XUSB_DEV_SRC, 95, TEGRA_PERIPH_ON_APB | TEGRA_PERIPH_NO_RESET, tegra_clk_xusb_dev_src_8),
        MUX8("dbgapb", mux_pllp_clkm_2, CLK_SOURCE_DBGAPB, 185, TEGRA_PERIPH_NO_RESET, tegra_clk_dbgapb),
-        MUX8("msenc", mux_pllc2_c_c3_pllp_plla1_clkm, CLK_SOURCE_NVENC, 219, 0, tegra_clk_nvenc),
+        MUX8("nvenc", mux_pllc2_c_c3_pllp_plla1_clkm, CLK_SOURCE_NVENC, 219, 0, tegra_clk_nvenc),
        MUX8("nvdec", mux_pllc2_c_c3_pllp_plla1_clkm, CLK_SOURCE_NVDEC, 194, 0, tegra_clk_nvdec),
        MUX8("nvjpg", mux_pllc2_c_c3_pllp_plla1_clkm, CLK_SOURCE_NVJPG, 195, 0, tegra_clk_nvjpg),
        MUX8("ape", mux_plla_pllc4_out0_pllc_pllc4_out1_pllp_pllc4_out2_clkm, CLK_SOURCE_APE, 198, TEGRA_PERIPH_ON_APB, tegra_clk_ape),
@@ -782,7 +782,7 @@ static struct tegra_periph_init_data periph_clks[] = {
        NODIV("sor1", mux_clkm_sor1_brick_sor1_src, CLK_SOURCE_SOR1, 15, MASK(1), 183, 0, tegra_clk_sor1, &sor1_lock),
        MUX8("sdmmc_legacy", mux_pllp_out3_clkm_pllp_pllc4, CLK_SOURCE_SDMMC_LEGACY, 193, TEGRA_PERIPH_ON_APB | TEGRA_PERIPH_NO_RESET, tegra_clk_sdmmc_legacy),
        MUX8("qspi", mux_pllp_pllc_pllc_out1_pllc4_out2_pllc4_out1_clkm_pllc4_out0, CLK_SOURCE_QSPI, 211, TEGRA_PERIPH_ON_APB, tegra_clk_qspi),
-        MUX("vii2c", mux_pllp_pllc_clkm, CLK_SOURCE_VI_I2C, 208, TEGRA_PERIPH_ON_APB, tegra_clk_vi_i2c),
+        I2C("vii2c", mux_pllp_pllc_clkm, CLK_SOURCE_VI_I2C, 208, tegra_clk_vi_i2c),
        MUX("mipibif", mux_pllp_clkm, CLK_SOURCE_MIPIBIF, 173, TEGRA_PERIPH_ON_APB, tegra_clk_mipibif),
        MUX("uartape", mux_pllp_pllc_clkm, CLK_SOURCE_UARTAPE, 212, TEGRA_PERIPH_ON_APB | TEGRA_PERIPH_NO_RESET, tegra_clk_uartape),
        MUX8("tsecb", mux_pllp_pllc2_c_c3_clkm, CLK_SOURCE_TSECB, 206, 0, tegra_clk_tsecb),
@@ -829,6 +829,7 @@ static struct tegra_periph_init_data gate_clks[] = {
        GATE("xusb_gate", "osc", 143, 0, tegra_clk_xusb_gate, 0),
        GATE("pll_p_out_cpu", "pll_p", 223, 0, tegra_clk_pll_p_out_cpu, 0),
        GATE("pll_p_out_adsp", "pll_p", 187, 0, tegra_clk_pll_p_out_adsp, 0),
+        GATE("apb2ape", "clk_m", 107, 0, tegra_clk_apb2ape, 0),
 };
 static struct tegra_periph_init_data div_clks[] = {
diff --git a/drivers/clk/tegra/clk-tegra-super-gen4.c b/drivers/clk/tegra/clk-tegra-super-gen4.c
index 4559a20e3af6..474de0f0c26d 100644
--- a/drivers/clk/tegra/clk-tegra-super-gen4.c
+++ b/drivers/clk/tegra/clk-tegra-super-gen4.c
@@ -67,7 +67,7 @@ static const char *cclk_lp_parents[] = { "clk_m", "pll_c", "clk_32k", "pll_m",
                                         "pll_p", "pll_p_out4", "unused",
                                         "unused", "pll_x", "pll_x_out0" };
-const struct tegra_super_gen_info tegra_super_gen_info_gen4 = {
+static const struct tegra_super_gen_info tegra_super_gen_info_gen4 = {
        .gen = gen4,
        .sclk_parents = sclk_parents,
        .cclk_g_parents = cclk_g_parents,
@@ -93,7 +93,7 @@ static const char *cclk_lp_parents_gen5[] = { "clk_m", "unused", "clk_32k", "unu
                                        "unused", "unused", "unused", "unused",
                                        "dfllCPU_out" };
-const struct tegra_super_gen_info tegra_super_gen_info_gen5 = {
+static const struct tegra_super_gen_info tegra_super_gen_info_gen5 = {
        .gen = gen5,
        .sclk_parents = sclk_parents_gen5,
        .cclk_g_parents = cclk_g_parents_gen5,
@@ -171,7 +171,7 @@ static void __init tegra_sclk_init(void __iomem *clk_base,
        *dt_clk = clk;
 }
-void __init tegra_super_clk_init(void __iomem *clk_base,
+static void __init tegra_super_clk_init(void __iomem *clk_base,
                                void __iomem *pmc_base,
                                struct tegra_clk *tegra_clks,
                                struct tegra_clk_pll_params *params,
diff --git a/drivers/clk/tegra/clk-tegra210.c b/drivers/clk/tegra/clk-tegra210.c
index 58514c44ea83..637041fd53ad 100644
--- a/drivers/clk/tegra/clk-tegra210.c
+++ b/drivers/clk/tegra/clk-tegra210.c
@@ -59,8 +59,8 @@
 #define PLLC3_MISC3 0x50c
 #define PLLM_BASE 0x90
-#define PLLM_MISC0 0x9c
 #define PLLM_MISC1 0x98
+#define PLLM_MISC2 0x9c
 #define PLLP_BASE 0xa0
 #define PLLP_MISC0 0xac
 #define PLLP_MISC1 0x680
@@ -99,7 +99,7 @@
 #define PLLC4_MISC0 0x5a8
 #define PLLC4_OUT 0x5e4
 #define PLLMB_BASE 0x5e8
-#define PLLMB_MISC0 0x5ec
+#define PLLMB_MISC1 0x5ec
 #define PLLA1_BASE 0x6a4
 #define PLLA1_MISC0 0x6a8
 #define PLLA1_MISC1 0x6ac
@@ -243,7 +243,8 @@ static unsigned long tegra210_input_freq[] = {
 };
 static const char *mux_pllmcp_clkm[] = {
-        "pll_m", "pll_c", "pll_p", "clk_m", "pll_m_ud", "pll_c2", "pll_c3",
+        "pll_m", "pll_c", "pll_p", "clk_m", "pll_m_ud", "pll_mb", "pll_mb",
+        "pll_p",
 };
 #define mux_pllmcp_clkm_idx NULL
@@ -367,12 +368,12 @@ static const char *mux_pllmcp_clkm[] = {
 /* PLLMB */
 #define PLLMB_BASE_LOCK                 (1 << 27)
-#define PLLMB_MISC0_LOCK_OVERRIDE       (1 << 18)
+#define PLLMB_MISC1_LOCK_OVERRIDE       (1 << 18)
-#define PLLMB_MISC0_IDDQ                (1 << 17)
+#define PLLMB_MISC1_IDDQ                (1 << 17)
-#define PLLMB_MISC0_LOCK_ENABLE         (1 << 16)
+#define PLLMB_MISC1_LOCK_ENABLE         (1 << 16)
-#define PLLMB_MISC0_DEFAULT_VALUE       0x00030000
+#define PLLMB_MISC1_DEFAULT_VALUE       0x00030000
-#define PLLMB_MISC0_WRITE_MASK          0x0007ffff
+#define PLLMB_MISC1_WRITE_MASK          0x0007ffff
 /* PLLP */
 #define PLLP_BASE_OVERRIDE              (1 << 28)
@@ -457,7 +458,8 @@ static void pllcx_check_defaults(struct tegra_clk_pll_params *params)
                        PLLCX_MISC3_WRITE_MASK);
 }
-void tegra210_pllcx_set_defaults(const char *name, struct tegra_clk_pll *pllcx)
+static void tegra210_pllcx_set_defaults(const char *name,
+                                        struct tegra_clk_pll *pllcx)
 {
        pllcx->params->defaults_set = true;
@@ -482,22 +484,22 @@ void tegra210_pllcx_set_defaults(const char *name, struct tegra_clk_pll *pllcx)
        udelay(1);
 }
-void _pllc_set_defaults(struct tegra_clk_pll *pllcx)
+static void _pllc_set_defaults(struct tegra_clk_pll *pllcx)
 {
        tegra210_pllcx_set_defaults("PLL_C", pllcx);
 }
-void _pllc2_set_defaults(struct tegra_clk_pll *pllcx)
+static void _pllc2_set_defaults(struct tegra_clk_pll *pllcx)
 {
        tegra210_pllcx_set_defaults("PLL_C2", pllcx);
 }
-void _pllc3_set_defaults(struct tegra_clk_pll *pllcx)
+static void _pllc3_set_defaults(struct tegra_clk_pll *pllcx)
 {
        tegra210_pllcx_set_defaults("PLL_C3", pllcx);
 }
-void _plla1_set_defaults(struct tegra_clk_pll *pllcx)
+static void _plla1_set_defaults(struct tegra_clk_pll *pllcx)
 {
        tegra210_pllcx_set_defaults("PLL_A1", pllcx);
 }
@@ -507,7 +509,7 @@ void _plla1_set_defaults(struct tegra_clk_pll *pllcx)
 * PLL with dynamic ramp and fractional SDM. Dynamic ramp is not used.
 * Fractional SDM is allowed to provide exact audio rates.
 */
-void tegra210_plla_set_defaults(struct tegra_clk_pll *plla)
+static void tegra210_plla_set_defaults(struct tegra_clk_pll *plla)
 {
        u32 mask;
        u32 val = readl_relaxed(clk_base + plla->params->base_reg);
@@ -559,7 +561,7 @@ void tegra210_plla_set_defaults(struct tegra_clk_pll *plla)
 * PLLD
 * PLL with fractional SDM.
 */
-void tegra210_plld_set_defaults(struct tegra_clk_pll *plld)
+static void tegra210_plld_set_defaults(struct tegra_clk_pll *plld)
 {
        u32 val;
        u32 mask = 0xffff;
@@ -698,7 +700,7 @@ static void plldss_defaults(const char *pll_name, struct tegra_clk_pll *plldss,
        udelay(1);
 }
-void tegra210_plld2_set_defaults(struct tegra_clk_pll *plld2)
+static void tegra210_plld2_set_defaults(struct tegra_clk_pll *plld2)
 {
        plldss_defaults("PLL_D2", plld2, PLLD2_MISC0_DEFAULT_VALUE,
                        PLLD2_MISC1_CFG_DEFAULT_VALUE,
@@ -706,7 +708,7 @@ void tegra210_plld2_set_defaults(struct tegra_clk_pll *plld2)
                        PLLD2_MISC3_CTRL2_DEFAULT_VALUE);
 }
-void tegra210_plldp_set_defaults(struct tegra_clk_pll *plldp)
+static void tegra210_plldp_set_defaults(struct tegra_clk_pll *plldp)
 {
        plldss_defaults("PLL_DP", plldp, PLLDP_MISC0_DEFAULT_VALUE,
                        PLLDP_MISC1_CFG_DEFAULT_VALUE,
@@ -719,7 +721,7 @@ void tegra210_plldp_set_defaults(struct tegra_clk_pll *plldp)
 * Base and misc0 layout is the same as PLLD2/PLLDP, but no SDM/SSC support.
 * VCO is exposed to the clock tree via fixed 1/3 and 1/5 dividers.
 */
-void tegra210_pllc4_set_defaults(struct tegra_clk_pll *pllc4)
+static void tegra210_pllc4_set_defaults(struct tegra_clk_pll *pllc4)
 {
        plldss_defaults("PLL_C4", pllc4, PLLC4_MISC0_DEFAULT_VALUE, 0, 0, 0);
 }
@@ -728,7 +730,7 @@ void tegra210_pllc4_set_defaults(struct tegra_clk_pll *pllc4)
 * PLLRE
 * VCO is exposed to the clock tree directly along with post-divider output
 */
-void tegra210_pllre_set_defaults(struct tegra_clk_pll *pllre)
+static void tegra210_pllre_set_defaults(struct tegra_clk_pll *pllre)
 {
        u32 mask;
        u32 val = readl_relaxed(clk_base + pllre->params->base_reg);
@@ -780,13 +782,13 @@ static void pllx_get_dyn_steps(struct clk_hw *hw, u32 *step_a, u32 *step_b)
 {
        unsigned long input_rate;
-        if (!IS_ERR_OR_NULL(hw->clk)) {
+        /* cf rate */
+        if (!IS_ERR_OR_NULL(hw->clk))
                input_rate = clk_hw_get_rate(clk_hw_get_parent(hw));
-                /* cf rate */
+        else
-                input_rate /= tegra_pll_get_fixed_mdiv(hw, input_rate);
-        } else {
                input_rate = 38400000;
-        }
+        input_rate /= tegra_pll_get_fixed_mdiv(hw, input_rate);
        switch (input_rate) {
        case 12000000:
@@ -841,7 +843,7 @@ static void pllx_check_defaults(struct tegra_clk_pll *pll)
                        PLLX_MISC5_WRITE_MASK);
 }
-void tegra210_pllx_set_defaults(struct tegra_clk_pll *pllx)
+static void tegra210_pllx_set_defaults(struct tegra_clk_pll *pllx)
 {
        u32 val;
        u32 step_a, step_b;
@@ -901,7 +903,7 @@ void tegra210_pllx_set_defaults(struct tegra_clk_pll *pllx)
 }
 /* PLLMB */
-void tegra210_pllmb_set_defaults(struct tegra_clk_pll *pllmb)
+static void tegra210_pllmb_set_defaults(struct tegra_clk_pll *pllmb)
 {
        u32 mask, val = readl_relaxed(clk_base + pllmb->params->base_reg);
@@ -914,15 +916,15 @@ void tegra210_pllmb_set_defaults(struct tegra_clk_pll *pllmb)
                 * PLL is ON: check if defaults already set, then set those
                 * that can be updated in flight.
                 */
-                val = PLLMB_MISC0_DEFAULT_VALUE & (~PLLMB_MISC0_IDDQ);
+                val = PLLMB_MISC1_DEFAULT_VALUE & (~PLLMB_MISC1_IDDQ);
-                mask = PLLMB_MISC0_LOCK_ENABLE | PLLMB_MISC0_LOCK_OVERRIDE;
+                mask = PLLMB_MISC1_LOCK_ENABLE | PLLMB_MISC1_LOCK_OVERRIDE;
                _pll_misc_chk_default(clk_base, pllmb->params, 0, val,
-                                ~mask & PLLMB_MISC0_WRITE_MASK);
+                                ~mask & PLLMB_MISC1_WRITE_MASK);
                /* Enable lock detect */
                val = readl_relaxed(clk_base + pllmb->params->ext_misc_reg[0]);
                val &= ~mask;
-                val |= PLLMB_MISC0_DEFAULT_VALUE & mask;
+                val |= PLLMB_MISC1_DEFAULT_VALUE & mask;
                writel_relaxed(val, clk_base + pllmb->params->ext_misc_reg[0]);
                udelay(1);
@@ -930,7 +932,7 @@ void tegra210_pllmb_set_defaults(struct tegra_clk_pll *pllmb)
        }
        /* set IDDQ, enable lock detect */
-        writel_relaxed(PLLMB_MISC0_DEFAULT_VALUE,
+        writel_relaxed(PLLMB_MISC1_DEFAULT_VALUE,
                        clk_base + pllmb->params->ext_misc_reg[0]);
        udelay(1);
 }
@@ -960,7 +962,7 @@ static void pllp_check_defaults(struct tegra_clk_pll *pll, bool enabled)
                        ~mask & PLLP_MISC1_WRITE_MASK);
 }
-void tegra210_pllp_set_defaults(struct tegra_clk_pll *pllp)
+static void tegra210_pllp_set_defaults(struct tegra_clk_pll *pllp)
 {
        u32 mask;
        u32 val = readl_relaxed(clk_base + pllp->params->base_reg);
@@ -1022,7 +1024,7 @@ static void pllu_check_defaults(struct tegra_clk_pll *pll, bool hw_control)
                        ~mask & PLLU_MISC1_WRITE_MASK);
 }
-void tegra210_pllu_set_defaults(struct tegra_clk_pll *pllu)
+static void tegra210_pllu_set_defaults(struct tegra_clk_pll *pllu)
 {
        u32 val = readl_relaxed(clk_base + pllu->params->base_reg);
@@ -1212,8 +1214,9 @@ static void tegra210_clk_pll_set_gain(struct tegra_clk_pll_freq_table *cfg)
        cfg->m *= PLL_SDM_COEFF;
 }
-unsigned long tegra210_clk_adjust_vco_min(struct tegra_clk_pll_params *params,
+static unsigned long
-                                          unsigned long parent_rate)
+tegra210_clk_adjust_vco_min(struct tegra_clk_pll_params *params,
+                            unsigned long parent_rate)
 {
        unsigned long vco_min = params->vco_min;
@@ -1386,7 +1389,7 @@ static struct tegra_clk_pll_params pll_c_params = {
        .mdiv_default = 3,
        .div_nmp = &pllc_nmp,
        .freq_table = pll_cx_freq_table,
-        .flags = TEGRA_PLL_USE_LOCK | TEGRA_PLL_HAS_LOCK_ENABLE,
+        .flags = TEGRA_PLL_USE_LOCK,
        .set_defaults = _pllc_set_defaults,
        .calc_rate = tegra210_pll_fixed_mdiv_cfg,
 };
@@ -1425,7 +1428,7 @@ static struct tegra_clk_pll_params pll_c2_params = {
        .ext_misc_reg[2] = PLLC2_MISC2,
        .ext_misc_reg[3] = PLLC2_MISC3,
        .freq_table = pll_cx_freq_table,
-        .flags = TEGRA_PLL_USE_LOCK | TEGRA_PLL_HAS_LOCK_ENABLE,
+        .flags = TEGRA_PLL_USE_LOCK,
        .set_defaults = _pllc2_set_defaults,
        .calc_rate = tegra210_pll_fixed_mdiv_cfg,
 };
@@ -1455,7 +1458,7 @@ static struct tegra_clk_pll_params pll_c3_params = {
        .ext_misc_reg[2] = PLLC3_MISC2,
        .ext_misc_reg[3] = PLLC3_MISC3,
        .freq_table = pll_cx_freq_table,
-        .flags = TEGRA_PLL_USE_LOCK | TEGRA_PLL_HAS_LOCK_ENABLE,
+        .flags = TEGRA_PLL_USE_LOCK,
        .set_defaults = _pllc3_set_defaults,
        .calc_rate = tegra210_pll_fixed_mdiv_cfg,
 };
@@ -1505,7 +1508,6 @@ static struct tegra_clk_pll_params pll_c4_vco_params = {
        .base_reg = PLLC4_BASE,
        .misc_reg = PLLC4_MISC0,
        .lock_mask = PLL_BASE_LOCK,
-        .lock_enable_bit_idx = PLLSS_MISC_LOCK_ENABLE,
        .lock_delay = 300,
        .max_p = PLL_QLIN_PDIV_MAX,
        .ext_misc_reg[0] = PLLC4_MISC0,
@@ -1517,8 +1519,7 @@ static struct tegra_clk_pll_params pll_c4_vco_params = {
        .div_nmp = &pllss_nmp,
        .freq_table = pll_c4_vco_freq_table,
        .set_defaults = tegra210_pllc4_set_defaults,
-        .flags = TEGRA_PLL_USE_LOCK | TEGRA_PLL_HAS_LOCK_ENABLE |
+        .flags = TEGRA_PLL_USE_LOCK | TEGRA_PLL_VCO_OUT,
-                 TEGRA_PLL_VCO_OUT,
        .calc_rate = tegra210_pll_fixed_mdiv_cfg,
 };
@@ -1559,15 +1560,15 @@ static struct tegra_clk_pll_params pll_m_params = {
        .vco_min = 800000000,
        .vco_max = 1866000000,
        .base_reg = PLLM_BASE,
-        .misc_reg = PLLM_MISC1,
+        .misc_reg = PLLM_MISC2,
        .lock_mask = PLL_BASE_LOCK,
        .lock_enable_bit_idx = PLLM_MISC_LOCK_ENABLE,
        .lock_delay = 300,
-        .iddq_reg = PLLM_MISC0,
+        .iddq_reg = PLLM_MISC2,
        .iddq_bit_idx = PLLM_IDDQ_BIT,
        .max_p = PLL_QLIN_PDIV_MAX,
-        .ext_misc_reg[0] = PLLM_MISC0,
+        .ext_misc_reg[0] = PLLM_MISC2,
-        .ext_misc_reg[0] = PLLM_MISC1,
+        .ext_misc_reg[1] = PLLM_MISC1,
        .round_p_to_pdiv = pll_qlin_p_to_pdiv,
        .pdiv_tohw = pll_qlin_pdiv_to_hw,
        .div_nmp = &pllm_nmp,
@@ -1586,19 +1587,18 @@ static struct tegra_clk_pll_params pll_mb_params = {
        .vco_min = 800000000,
        .vco_max = 1866000000,
        .base_reg = PLLMB_BASE,
-        .misc_reg = PLLMB_MISC0,
+        .misc_reg = PLLMB_MISC1,
        .lock_mask = PLL_BASE_LOCK,
-        .lock_enable_bit_idx = PLLMB_MISC_LOCK_ENABLE,
        .lock_delay = 300,
-        .iddq_reg = PLLMB_MISC0,
+        .iddq_reg = PLLMB_MISC1,
        .iddq_bit_idx = PLLMB_IDDQ_BIT,
        .max_p = PLL_QLIN_PDIV_MAX,
-        .ext_misc_reg[0] = PLLMB_MISC0,
+        .ext_misc_reg[0] = PLLMB_MISC1,
        .round_p_to_pdiv = pll_qlin_p_to_pdiv,
        .pdiv_tohw = pll_qlin_pdiv_to_hw,
        .div_nmp = &pllm_nmp,
        .freq_table = pll_m_freq_table,
-        .flags = TEGRA_PLL_USE_LOCK | TEGRA_PLL_HAS_LOCK_ENABLE,
+        .flags = TEGRA_PLL_USE_LOCK,
        .set_defaults = tegra210_pllmb_set_defaults,
        .calc_rate = tegra210_pll_fixed_mdiv_cfg,
 };
@@ -1671,7 +1671,6 @@ static struct tegra_clk_pll_params pll_re_vco_params = {
        .base_reg = PLLRE_BASE,
        .misc_reg = PLLRE_MISC0,
        .lock_mask = PLLRE_MISC_LOCK,
-        .lock_enable_bit_idx = PLLRE_MISC_LOCK_ENABLE,
        .lock_delay = 300,
        .max_p = PLL_QLIN_PDIV_MAX,
        .ext_misc_reg[0] = PLLRE_MISC0,
@@ -1681,8 +1680,7 @@ static struct tegra_clk_pll_params pll_re_vco_params = {
        .pdiv_tohw = pll_qlin_pdiv_to_hw,
        .div_nmp = &pllre_nmp,
        .freq_table = pll_re_vco_freq_table,
-        .flags = TEGRA_PLL_USE_LOCK | TEGRA_PLL_LOCK_MISC |
+        .flags = TEGRA_PLL_USE_LOCK | TEGRA_PLL_LOCK_MISC | TEGRA_PLL_VCO_OUT,
-                 TEGRA_PLL_HAS_LOCK_ENABLE | TEGRA_PLL_VCO_OUT,
        .set_defaults = tegra210_pllre_set_defaults,
        .calc_rate = tegra210_pll_fixed_mdiv_cfg,
 };
@@ -1712,7 +1710,6 @@ static struct tegra_clk_pll_params pll_p_params = {
        .base_reg = PLLP_BASE,
        .misc_reg = PLLP_MISC0,
        .lock_mask = PLL_BASE_LOCK,
-        .lock_enable_bit_idx = PLLP_MISC_LOCK_ENABLE,
        .lock_delay = 300,
        .iddq_reg = PLLP_MISC0,
        .iddq_bit_idx = PLLXP_IDDQ_BIT,
@@ -1721,8 +1718,7 @@ static struct tegra_clk_pll_params pll_p_params = {
        .div_nmp = &pllp_nmp,
        .freq_table = pll_p_freq_table,
        .fixed_rate = 408000000,
-        .flags = TEGRA_PLL_FIXED | TEGRA_PLL_USE_LOCK |
+        .flags = TEGRA_PLL_FIXED | TEGRA_PLL_USE_LOCK | TEGRA_PLL_VCO_OUT,
-                 TEGRA_PLL_HAS_LOCK_ENABLE | TEGRA_PLL_VCO_OUT,
        .set_defaults = tegra210_pllp_set_defaults,
        .calc_rate = tegra210_pll_fixed_mdiv_cfg,
 };
@@ -1750,7 +1746,7 @@ static struct tegra_clk_pll_params pll_a1_params = {
        .ext_misc_reg[2] = PLLA1_MISC2,
        .ext_misc_reg[3] = PLLA1_MISC3,
        .freq_table = pll_cx_freq_table,
-        .flags = TEGRA_PLL_USE_LOCK | TEGRA_PLL_HAS_LOCK_ENABLE,
+        .flags = TEGRA_PLL_USE_LOCK,
        .set_defaults = _plla1_set_defaults,
        .calc_rate = tegra210_pll_fixed_mdiv_cfg,
 };
@@ -1787,7 +1783,6 @@ static struct tegra_clk_pll_params pll_a_params = {
        .base_reg = PLLA_BASE,
        .misc_reg = PLLA_MISC0,
        .lock_mask = PLL_BASE_LOCK,
-        .lock_enable_bit_idx = PLLA_MISC_LOCK_ENABLE,
        .lock_delay = 300,
        .round_p_to_pdiv = pll_qlin_p_to_pdiv,
        .pdiv_tohw = pll_qlin_pdiv_to_hw,
@@ -1802,8 +1797,7 @@ static struct tegra_clk_pll_params pll_a_params = {
        .ext_misc_reg[1] = PLLA_MISC1,
        .ext_misc_reg[2] = PLLA_MISC2,
        .freq_table = pll_a_freq_table,
-        .flags = TEGRA_PLL_USE_LOCK | TEGRA_MDIV_NEW |
+        .flags = TEGRA_PLL_USE_LOCK | TEGRA_MDIV_NEW,
-                 TEGRA_PLL_HAS_LOCK_ENABLE,
        .set_defaults = tegra210_plla_set_defaults,
        .calc_rate = tegra210_pll_fixed_mdiv_cfg,
        .set_gain = tegra210_clk_pll_set_gain,
@@ -1836,7 +1830,6 @@ static struct tegra_clk_pll_params pll_d_params = {
        .base_reg = PLLD_BASE,
        .misc_reg = PLLD_MISC0,
        .lock_mask = PLL_BASE_LOCK,
-        .lock_enable_bit_idx = PLLD_MISC_LOCK_ENABLE,
        .lock_delay = 1000,
        .iddq_reg = PLLD_MISC0,
        .iddq_bit_idx = PLLD_IDDQ_BIT,
@@ -1850,7 +1843,7 @@ static struct tegra_clk_pll_params pll_d_params = {
        .ext_misc_reg[0] = PLLD_MISC0,
        .ext_misc_reg[1] = PLLD_MISC1,
        .freq_table = pll_d_freq_table,
-        .flags = TEGRA_PLL_USE_LOCK | TEGRA_PLL_HAS_LOCK_ENABLE,
+        .flags = TEGRA_PLL_USE_LOCK,
        .mdiv_default = 1,
        .set_defaults = tegra210_plld_set_defaults,
        .calc_rate = tegra210_pll_fixed_mdiv_cfg,
@@ -1876,7 +1869,6 @@ static struct tegra_clk_pll_params pll_d2_params = {
        .base_reg = PLLD2_BASE,
        .misc_reg = PLLD2_MISC0,
        .lock_mask = PLL_BASE_LOCK,
-        .lock_enable_bit_idx = PLLSS_MISC_LOCK_ENABLE,
        .lock_delay = 300,
        .iddq_reg = PLLD2_BASE,
        .iddq_bit_idx = PLLSS_IDDQ_BIT,
@@ -1897,7 +1889,7 @@ static struct tegra_clk_pll_params pll_d2_params = {
        .mdiv_default = 1,
        .freq_table = tegra210_pll_d2_freq_table,
        .set_defaults = tegra210_plld2_set_defaults,
-        .flags = TEGRA_PLL_USE_LOCK | TEGRA_PLL_HAS_LOCK_ENABLE,
+        .flags = TEGRA_PLL_USE_LOCK,
        .calc_rate = tegra210_pll_fixed_mdiv_cfg,
        .set_gain = tegra210_clk_pll_set_gain,
        .adjust_vco = tegra210_clk_adjust_vco_min,
@@ -1920,7 +1912,6 @@ static struct tegra_clk_pll_params pll_dp_params = {
        .base_reg = PLLDP_BASE,
        .misc_reg = PLLDP_MISC,
        .lock_mask = PLL_BASE_LOCK,
-        .lock_enable_bit_idx = PLLSS_MISC_LOCK_ENABLE,
        .lock_delay = 300,
        .iddq_reg = PLLDP_BASE,
        .iddq_bit_idx = PLLSS_IDDQ_BIT,
@@ -1941,7 +1932,7 @@ static struct tegra_clk_pll_params pll_dp_params = {
        .mdiv_default = 1,
        .freq_table = pll_dp_freq_table,
        .set_defaults = tegra210_plldp_set_defaults,
-        .flags = TEGRA_PLL_USE_LOCK | TEGRA_PLL_HAS_LOCK_ENABLE,
+        .flags = TEGRA_PLL_USE_LOCK,
        .calc_rate = tegra210_pll_fixed_mdiv_cfg,
        .set_gain = tegra210_clk_pll_set_gain,
        .adjust_vco = tegra210_clk_adjust_vco_min,
@@ -1973,7 +1964,6 @@ static struct tegra_clk_pll_params pll_u_vco_params = {
        .base_reg = PLLU_BASE,
        .misc_reg = PLLU_MISC0,
        .lock_mask = PLL_BASE_LOCK,
-        .lock_enable_bit_idx = PLLU_MISC_LOCK_ENABLE,
        .lock_delay = 1000,
        .iddq_reg = PLLU_MISC0,
        .iddq_bit_idx = PLLU_IDDQ_BIT,
@@ -1983,8 +1973,7 @@ static struct tegra_clk_pll_params pll_u_vco_params = {
        .pdiv_tohw = pll_qlin_pdiv_to_hw,
        .div_nmp = &pllu_nmp,
        .freq_table = pll_u_freq_table,
-        .flags = TEGRA_PLLU | TEGRA_PLL_USE_LOCK | TEGRA_PLL_HAS_LOCK_ENABLE |
+        .flags = TEGRA_PLLU | TEGRA_PLL_USE_LOCK | TEGRA_PLL_VCO_OUT,
-                 TEGRA_PLL_VCO_OUT,
        .set_defaults = tegra210_pllu_set_defaults,
        .calc_rate = tegra210_pll_fixed_mdiv_cfg,
 };
@@ -2218,6 +2207,7 @@ static struct tegra_clk tegra210_clks[tegra_clk_max] __initdata = {
        [tegra_clk_pll_c4_out1] = { .dt_id = TEGRA210_CLK_PLL_C4_OUT1, .present = true },
        [tegra_clk_pll_c4_out2] = { .dt_id = TEGRA210_CLK_PLL_C4_OUT2, .present = true },
        [tegra_clk_pll_c4_out3] = { .dt_id = TEGRA210_CLK_PLL_C4_OUT3, .present = true },
+        [tegra_clk_apb2ape] = { .dt_id = TEGRA210_CLK_APB2APE, .present = true },
 };
 static struct tegra_devclk devclks[] __initdata = {
@@ -2519,7 +2509,7 @@ static void __init tegra210_pll_init(void __iomem *clk_base,
        /* PLLU_VCO */
        val = readl(clk_base + pll_u_vco_params.base_reg);
-        val &= ~BIT(24); /* disable PLLU_OVERRIDE */
+        val &= ~PLLU_BASE_OVERRIDE; /* disable PLLU_OVERRIDE */
        writel(val, clk_base + pll_u_vco_params.base_reg);
        clk = tegra_clk_register_pllre("pll_u_vco", "pll_ref", clk_base, pmc,
@@ -2738,8 +2728,6 @@ static struct tegra_clk_init_table init_table[] __initdata = {
        { TEGRA210_CLK_DFLL_REF, TEGRA210_CLK_PLL_P, 51000000, 1 },
        { TEGRA210_CLK_SBC4, TEGRA210_CLK_PLL_P, 12000000, 1 },
        { TEGRA210_CLK_PLL_RE_VCO, TEGRA210_CLK_CLK_MAX, 672000000, 1 },
-        { TEGRA210_CLK_PLL_U_OUT1, TEGRA210_CLK_CLK_MAX, 48000000, 1 },
-        { TEGRA210_CLK_PLL_U_OUT2, TEGRA210_CLK_CLK_MAX, 60000000, 1 },
        { TEGRA210_CLK_XUSB_GATE, TEGRA210_CLK_CLK_MAX, 0, 1 },
        { TEGRA210_CLK_XUSB_SS_SRC, TEGRA210_CLK_PLL_U_480M, 120000000, 0 },
        { TEGRA210_CLK_XUSB_FS_SRC, TEGRA210_CLK_PLL_U_48M, 48000000, 0 },
diff --git a/drivers/clk/versatile/clk-icst.c b/drivers/clk/versatile/clk-icst.c
index e62f8cb2c9b5..3bca438ecd19 100644
--- a/drivers/clk/versatile/clk-icst.c
+++ b/drivers/clk/versatile/clk-icst.c
@@ -78,6 +78,9 @@ static int vco_set(struct clk_icst *icst, struct icst_vco vco)
        ret = regmap_read(icst->map, icst->vcoreg_off, &val);
        if (ret)
                return ret;
+        /* Mask the 18 bits used by the VCO */
+        val &= ~0x7ffff;
        val |= vco.v | (vco.r << 9) | (vco.s << 16);
        /* This magic unlocks the VCO so it can be controlled */
diff --git a/drivers/dma/dw/core.c b/drivers/dma/dw/core.c
index e893318560db..5ad0ec1f0e29 100644
--- a/drivers/dma/dw/core.c
+++ b/drivers/dma/dw/core.c
@@ -156,7 +156,6 @@ static void dwc_initialize(struct dw_dma_chan *dwc)
        /* Enable interrupts */
        channel_set_bit(dw, MASK.XFER, dwc->mask);
-        channel_set_bit(dw, MASK.BLOCK, dwc->mask);
        channel_set_bit(dw, MASK.ERROR, dwc->mask);
        dwc->initialized = true;
@@ -588,6 +587,9 @@ static void dwc_handle_cyclic(struct dw_dma *dw, struct dw_dma_chan *dwc,
                spin_unlock_irqrestore(&dwc->lock, flags);
        }
+        /* Re-enable interrupts */
+        channel_set_bit(dw, MASK.BLOCK, dwc->mask);
 }
 /* ------------------------------------------------------------------------- */
@@ -618,11 +620,8 @@ static void dw_dma_tasklet(unsigned long data)
                        dwc_scan_descriptors(dw, dwc);
        }
-        /*
+        /* Re-enable interrupts */
-         * Re-enable interrupts.
-         */
        channel_set_bit(dw, MASK.XFER, dw->all_chan_mask);
-        channel_set_bit(dw, MASK.BLOCK, dw->all_chan_mask);
        channel_set_bit(dw, MASK.ERROR, dw->all_chan_mask);
 }
@@ -1261,6 +1260,7 @@ static void dwc_free_chan_resources(struct dma_chan *chan)
 int dw_dma_cyclic_start(struct dma_chan *chan)
 {
        struct dw_dma_chan      *dwc = to_dw_dma_chan(chan);
+        struct dw_dma           *dw = to_dw_dma(chan->device);
        unsigned long           flags;
        if (!test_bit(DW_DMA_IS_CYCLIC, &dwc->flags)) {
@@ -1269,7 +1269,12 @@ int dw_dma_cyclic_start(struct dma_chan *chan)
        }
        spin_lock_irqsave(&dwc->lock, flags);
+        /* Enable interrupts to perform cyclic transfer */
+        channel_set_bit(dw, MASK.BLOCK, dwc->mask);
        dwc_dostart(dwc, dwc->cdesc->desc[0]);
        spin_unlock_irqrestore(&dwc->lock, flags);
        return 0;
diff --git a/drivers/dma/dw/pci.c b/drivers/dma/dw/pci.c
index 4c30fdd092b3..358f9689a3f5 100644
--- a/drivers/dma/dw/pci.c
+++ b/drivers/dma/dw/pci.c
@@ -108,6 +108,10 @@ static const struct pci_device_id dw_pci_id_table[] = {
        /* Haswell */
        { PCI_VDEVICE(INTEL, 0x9c60) },
+        /* Broadwell */
+        { PCI_VDEVICE(INTEL, 0x9ce0) },
        { }
 };
 MODULE_DEVICE_TABLE(pci, dw_pci_id_table);
diff --git a/drivers/dma/edma.c b/drivers/dma/edma.c
index d92d65549406..e3d7fcb69b4c 100644
--- a/drivers/dma/edma.c
+++ b/drivers/dma/edma.c
@@ -113,6 +113,9 @@
 #define GET_NUM_REGN(x)         ((x & 0x300000) >> 20) /* bits 20-21 */
 #define CHMAP_EXIST             BIT(24)
+/* CCSTAT register */
+#define EDMA_CCSTAT_ACTV        BIT(4)
 /*
 * Max of 20 segments per channel to conserve PaRAM slots
 * Also note that MAX_NR_SG should be atleast the no.of periods
@@ -1680,9 +1683,20 @@ static void edma_issue_pending(struct dma_chan *chan)
        spin_unlock_irqrestore(&echan->vchan.lock, flags);
 }
+/*
+ * This limit exists to avoid a possible infinite loop when waiting for proof
+ * that a particular transfer is completed. This limit can be hit if there
+ * are large bursts to/from slow devices or the CPU is never able to catch
+ * the DMA hardware idle. On an AM335x transfering 48 bytes from the UART
+ * RX-FIFO, as many as 55 loops have been seen.
+ */
+#define EDMA_MAX_TR_WAIT_LOOPS 1000
 static u32 edma_residue(struct edma_desc *edesc)
 {
        bool dst = edesc->direction == DMA_DEV_TO_MEM;
+        int loop_count = EDMA_MAX_TR_WAIT_LOOPS;
+        struct edma_chan *echan = edesc->echan;
        struct edma_pset *pset = edesc->pset;
        dma_addr_t done, pos;
        int i;
@@ -1691,7 +1705,32 @@ static u32 edma_residue(struct edma_desc *edesc)
         * We always read the dst/src position from the first RamPar
         * pset. That's the one which is active now.
         */
-        pos = edma_get_position(edesc->echan->ecc, edesc->echan->slot[0], dst);
+        pos = edma_get_position(echan->ecc, echan->slot[0], dst);
+        /*
+         * "pos" may represent a transfer request that is still being
+         * processed by the EDMACC or EDMATC. We will busy wait until
+         * any one of the situations occurs:
+         *   1. the DMA hardware is idle
+         *   2. a new transfer request is setup
+         *   3. we hit the loop limit
+         */
+        while (edma_read(echan->ecc, EDMA_CCSTAT) & EDMA_CCSTAT_ACTV) {
+                /* check if a new transfer request is setup */
+                if (edma_get_position(echan->ecc,
+                                      echan->slot[0], dst) != pos) {
+                        break;
+                }
+                if (!--loop_count) {
+                        dev_dbg_ratelimited(echan->vchan.chan.device->dev,
+                                "%s: timeout waiting for PaRAM update\n",
+                                __func__);
+                        break;
+                }
+                cpu_relax();
+        }
        /*
         * Cyclic is simple. Just subtract pset[0].addr from pos.
diff --git a/drivers/dma/ioat/dma.c b/drivers/dma/ioat/dma.c
index 1d5df2ef148b..21539d5c54c3 100644
--- a/drivers/dma/ioat/dma.c
+++ b/drivers/dma/ioat/dma.c
@@ -861,32 +861,42 @@ void ioat_timer_event(unsigned long data)
                        return;
        }
+        spin_lock_bh(&ioat_chan->cleanup_lock);
+        /* handle the no-actives case */
+        if (!ioat_ring_active(ioat_chan)) {
+                spin_lock_bh(&ioat_chan->prep_lock);
+                check_active(ioat_chan);
+                spin_unlock_bh(&ioat_chan->prep_lock);
+                spin_unlock_bh(&ioat_chan->cleanup_lock);
+                return;
+        }
        /* if we haven't made progress and we have already
         * acknowledged a pending completion once, then be more
         * forceful with a restart
         */
-        spin_lock_bh(&ioat_chan->cleanup_lock);
        if (ioat_cleanup_preamble(ioat_chan, &phys_complete))
                __cleanup(ioat_chan, phys_complete);
        else if (test_bit(IOAT_COMPLETION_ACK, &ioat_chan->state)) {
+                u32 chanerr;
+                chanerr = readl(ioat_chan->reg_base + IOAT_CHANERR_OFFSET);
+                dev_warn(to_dev(ioat_chan), "Restarting channel...\n");
+                dev_warn(to_dev(ioat_chan), "CHANSTS: %#Lx CHANERR: %#x\n",
+                         status, chanerr);
+                dev_warn(to_dev(ioat_chan), "Active descriptors: %d\n",
+                         ioat_ring_active(ioat_chan));
                spin_lock_bh(&ioat_chan->prep_lock);
                ioat_restart_channel(ioat_chan);
                spin_unlock_bh(&ioat_chan->prep_lock);
                spin_unlock_bh(&ioat_chan->cleanup_lock);
                return;
-        } else {
+        } else
                set_bit(IOAT_COMPLETION_ACK, &ioat_chan->state);
-                mod_timer(&ioat_chan->timer, jiffies + COMPLETION_TIMEOUT);
-        }
-        if (ioat_ring_active(ioat_chan))
+        mod_timer(&ioat_chan->timer, jiffies + COMPLETION_TIMEOUT);
-                mod_timer(&ioat_chan->timer, jiffies + COMPLETION_TIMEOUT);
-        else {
-                spin_lock_bh(&ioat_chan->prep_lock);
-                check_active(ioat_chan);
-                spin_unlock_bh(&ioat_chan->prep_lock);
-        }
        spin_unlock_bh(&ioat_chan->cleanup_lock);
 }
diff --git a/drivers/firmware/efi/efivars.c b/drivers/firmware/efi/efivars.c
index 756eca8c4cf8..10e6774ab2a2 100644
--- a/drivers/firmware/efi/efivars.c
+++ b/drivers/firmware/efi/efivars.c
@@ -221,7 +221,7 @@ sanity_check(struct efi_variable *var, efi_char16_t *name, efi_guid_t vendor,
        }
        if ((attributes & ~EFI_VARIABLE_MASK) != 0 ||
-            efivar_validate(name, data, size) == false) {
+            efivar_validate(vendor, name, data, size) == false) {
                printk(KERN_ERR "efivars: Malformed variable content\n");
                return -EINVAL;
        }
@@ -447,7 +447,8 @@ static ssize_t efivar_create(struct file *filp, struct kobject *kobj,
        }
        if ((attributes & ~EFI_VARIABLE_MASK) != 0 ||
-            efivar_validate(name, data, size) == false) {
+            efivar_validate(new_var->VendorGuid, name, data,
+                            size) == false) {
                printk(KERN_ERR "efivars: Malformed variable content\n");
                return -EINVAL;
        }
@@ -540,38 +541,30 @@ static ssize_t efivar_delete(struct file *filp, struct kobject *kobj,
 static int
 efivar_create_sysfs_entry(struct efivar_entry *new_var)
 {
-        int i, short_name_size;
+        int short_name_size;
        char *short_name;
-        unsigned long variable_name_size;
+        unsigned long utf8_name_size;
-        efi_char16_t *variable_name;
+        efi_char16_t *variable_name = new_var->var.VariableName;
        int ret;
-        variable_name = new_var->var.VariableName;
-        variable_name_size = ucs2_strlen(variable_name) * sizeof(efi_char16_t);
        /*
-         * Length of the variable bytes in ASCII, plus the '-' separator,
+         * Length of the variable bytes in UTF8, plus the '-' separator,
         * plus the GUID, plus trailing NUL
         */
-        short_name_size = variable_name_size / sizeof(efi_char16_t)
+        utf8_name_size = ucs2_utf8size(variable_name);
-                                + 1 + EFI_VARIABLE_GUID_LEN + 1;
+        short_name_size = utf8_name_size + 1 + EFI_VARIABLE_GUID_LEN + 1;
-        short_name = kzalloc(short_name_size, GFP_KERNEL);
+        short_name = kmalloc(short_name_size, GFP_KERNEL);
        if (!short_name)
                return -ENOMEM;
-        /* Convert Unicode to normal chars (assume top bits are 0),
+        ucs2_as_utf8(short_name, variable_name, short_name_size);
-           ala UTF-8 */
-        for (i=0; i < (int)(variable_name_size / sizeof(efi_char16_t)); i++) {
-                short_name[i] = variable_name[i] & 0xFF;
-        }
        /* This is ugly, but necessary to separate one vendor's
           private variables from another's.         */
+        short_name[utf8_name_size] = '-';
-        *(short_name + strlen(short_name)) = '-';
        efi_guid_to_str(&new_var->var.VendorGuid,
-                         short_name + strlen(short_name));
+                         short_name + utf8_name_size + 1);
        new_var->kobj.kset = efivars_kset;
diff --git a/drivers/firmware/efi/vars.c b/drivers/firmware/efi/vars.c
index 70a0fb10517f..7f2ea21c730d 100644
--- a/drivers/firmware/efi/vars.c
+++ b/drivers/firmware/efi/vars.c
@@ -165,67 +165,133 @@ validate_ascii_string(efi_char16_t *var_name, int match, u8 *buffer,
 }
 struct variable_validate {
+        efi_guid_t vendor;
        char *name;
        bool (*validate)(efi_char16_t *var_name, int match, u8 *data,
                         unsigned long len);
 };
+/*
+ * This is the list of variables we need to validate, as well as the
+ * whitelist for what we think is safe not to default to immutable.
+ *
+ * If it has a validate() method that's not NULL, it'll go into the
+ * validation routine.  If not, it is assumed valid, but still used for
+ * whitelisting.
+ *
+ * Note that it's sorted by {vendor,name}, but globbed names must come after
+ * any other name with the same prefix.
+ */
 static const struct variable_validate variable_validate[] = {
-        { "BootNext", validate_uint16 },
+        { EFI_GLOBAL_VARIABLE_GUID, "BootNext", validate_uint16 },
-        { "BootOrder", validate_boot_order },
+        { EFI_GLOBAL_VARIABLE_GUID, "BootOrder", validate_boot_order },
-        { "DriverOrder", validate_boot_order },
+        { EFI_GLOBAL_VARIABLE_GUID, "Boot*", validate_load_option },
-        { "Boot*", validate_load_option },
+        { EFI_GLOBAL_VARIABLE_GUID, "DriverOrder", validate_boot_order },
-        { "Driver*", validate_load_option },
+        { EFI_GLOBAL_VARIABLE_GUID, "Driver*", validate_load_option },
-        { "ConIn", validate_device_path },
+        { EFI_GLOBAL_VARIABLE_GUID, "ConIn", validate_device_path },
-        { "ConInDev", validate_device_path },
+        { EFI_GLOBAL_VARIABLE_GUID, "ConInDev", validate_device_path },
-        { "ConOut", validate_device_path },
+        { EFI_GLOBAL_VARIABLE_GUID, "ConOut", validate_device_path },
-        { "ConOutDev", validate_device_path },
+        { EFI_GLOBAL_VARIABLE_GUID, "ConOutDev", validate_device_path },
-        { "ErrOut", validate_device_path },
+        { EFI_GLOBAL_VARIABLE_GUID, "ErrOut", validate_device_path },
-        { "ErrOutDev", validate_device_path },
+        { EFI_GLOBAL_VARIABLE_GUID, "ErrOutDev", validate_device_path },
-        { "Timeout", validate_uint16 },
+        { EFI_GLOBAL_VARIABLE_GUID, "Lang", validate_ascii_string },
-        { "Lang", validate_ascii_string },
+        { EFI_GLOBAL_VARIABLE_GUID, "OsIndications", NULL },
-        { "PlatformLang", validate_ascii_string },
+        { EFI_GLOBAL_VARIABLE_GUID, "PlatformLang", validate_ascii_string },
-        { "", NULL },
+        { EFI_GLOBAL_VARIABLE_GUID, "Timeout", validate_uint16 },
+        { LINUX_EFI_CRASH_GUID, "*", NULL },
+        { NULL_GUID, "", NULL },
 };
+static bool
+variable_matches(const char *var_name, size_t len, const char *match_name,
+                 int *match)
+{
+        for (*match = 0; ; (*match)++) {
+                char c = match_name[*match];
+                char u = var_name[*match];
+                /* Wildcard in the matching name means we've matched */
+                if (c == '*')
+                        return true;
+                /* Case sensitive match */
+                if (!c && *match == len)
+                        return true;
+                if (c != u)
+                        return false;
+                if (!c)
+                        return true;
+        }
+        return true;
+}
 bool
-efivar_validate(efi_char16_t *var_name, u8 *data, unsigned long len)
+efivar_validate(efi_guid_t vendor, efi_char16_t *var_name, u8 *data,
+                unsigned long data_size)
 {
        int i;
-        u16 *unicode_name = var_name;
+        unsigned long utf8_size;
+        u8 *utf8_name;
-        for (i = 0; variable_validate[i].validate != NULL; i++) {
+        utf8_size = ucs2_utf8size(var_name);
-                const char *name = variable_validate[i].name;
+        utf8_name = kmalloc(utf8_size + 1, GFP_KERNEL);
-                int match;
+        if (!utf8_name)
+                return false;
-                for (match = 0; ; match++) {
+        ucs2_as_utf8(utf8_name, var_name, utf8_size);
-                        char c = name[match];
+        utf8_name[utf8_size] = '\0';
-                        u16 u = unicode_name[match];
-                        /* All special variables are plain ascii */
+        for (i = 0; variable_validate[i].name[0] != '\0'; i++) {
-                        if (u > 127)
+                const char *name = variable_validate[i].name;
-                                return true;
+                int match = 0;
-                        /* Wildcard in the matching name means we've matched */
+                if (efi_guidcmp(vendor, variable_validate[i].vendor))
-                        if (c == '*')
+                        continue;
-                                return variable_validate[i].validate(var_name,
-                                                             match, data, len);
-                        /* Case sensitive match */
+                if (variable_matches(utf8_name, utf8_size+1, name, &match)) {
-                        if (c != u)
+                        if (variable_validate[i].validate == NULL)
                                break;
+                        kfree(utf8_name);
-                        /* Reached the end of the string while matching */
+                        return variable_validate[i].validate(var_name, match,
-                        if (!c)
+                                                             data, data_size);
-                                return variable_validate[i].validate(var_name,
-                                                             match, data, len);
                }
        }
+        kfree(utf8_name);
        return true;
 }
 EXPORT_SYMBOL_GPL(efivar_validate);
+bool
+efivar_variable_is_removable(efi_guid_t vendor, const char *var_name,
+                             size_t len)
+{
+        int i;
+        bool found = false;
+        int match = 0;
+        /*
+         * Check if our variable is in the validated variables list
+         */
+        for (i = 0; variable_validate[i].name[0] != '\0'; i++) {
+                if (efi_guidcmp(variable_validate[i].vendor, vendor))
+                        continue;
+                if (variable_matches(var_name, len,
+                                     variable_validate[i].name, &match)) {
+                        found = true;
+                        break;
+                }
+        }
+        /*
+         * If it's in our list, it is removable.
+         */
+        return found;
+}
+EXPORT_SYMBOL_GPL(efivar_variable_is_removable);
 static efi_status_t
 check_var_size(u32 attributes, unsigned long size)
 {
@@ -852,7 +918,7 @@ int efivar_entry_set_get_size(struct efivar_entry *entry, u32 attributes,
        *set = false;
-        if (efivar_validate(name, data, *size) == false)
+        if (efivar_validate(*vendor, name, data, *size) == false)
                return -EINVAL;
        /*
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
index 6442a06d6fdc..1cbb16e15307 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
@@ -712,7 +712,7 @@ static int amdgpu_ttm_tt_populate(struct ttm_tt *ttm)
                                                       0, PAGE_SIZE,
                                                       PCI_DMA_BIDIRECTIONAL);
                if (pci_dma_mapping_error(adev->pdev, gtt->ttm.dma_address[i])) {
-                        while (--i) {
+                        while (i--) {
                                pci_unmap_page(adev->pdev, gtt->ttm.dma_address[i],
                                               PAGE_SIZE, PCI_DMA_BIDIRECTIONAL);
                                gtt->ttm.dma_address[i] = 0;
diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c
index 3f74193885f1..9a7b44616b55 100644
--- a/drivers/gpu/drm/drm_atomic.c
+++ b/drivers/gpu/drm/drm_atomic.c
@@ -65,8 +65,6 @@ drm_atomic_state_init(struct drm_device *dev, struct drm_atomic_state *state)
         */
        state->allow_modeset = true;
-        state->num_connector = ACCESS_ONCE(dev->mode_config.num_connector);
        state->crtcs = kcalloc(dev->mode_config.num_crtc,
                               sizeof(*state->crtcs), GFP_KERNEL);
        if (!state->crtcs)
@@ -83,16 +81,6 @@ drm_atomic_state_init(struct drm_device *dev, struct drm_atomic_state *state)
                                      sizeof(*state->plane_states), GFP_KERNEL);
        if (!state->plane_states)
                goto fail;
-        state->connectors = kcalloc(state->num_connector,
-                                    sizeof(*state->connectors),
-                                    GFP_KERNEL);
-        if (!state->connectors)
-                goto fail;
-        state->connector_states = kcalloc(state->num_connector,
-                                          sizeof(*state->connector_states),
-                                          GFP_KERNEL);
-        if (!state->connector_states)
-                goto fail;
        state->dev = dev;
@@ -823,19 +811,27 @@ drm_atomic_get_connector_state(struct drm_atomic_state *state,
        index = drm_connector_index(connector);
-        /*
-         * Construction of atomic state updates can race with a connector
-         * hot-add which might overflow. In this case flip the table and just
-         * restart the entire ioctl - no one is fast enough to livelock a cpu
-         * with physical hotplug events anyway.
-         *
-         * Note that we only grab the indexes once we have the right lock to
-         * prevent hotplug/unplugging of connectors. So removal is no problem,
-         * at most the array is a bit too large.
-         */
        if (index >= state->num_connector) {
-                DRM_DEBUG_ATOMIC("Hot-added connector would overflow state array, restarting\n");
+                struct drm_connector **c;
-                return ERR_PTR(-EAGAIN);
+                struct drm_connector_state **cs;
+                int alloc = max(index + 1, config->num_connector);
+                c = krealloc(state->connectors, alloc * sizeof(*state->connectors), GFP_KERNEL);
+                if (!c)
+                        return ERR_PTR(-ENOMEM);
+                state->connectors = c;
+                memset(&state->connectors[state->num_connector], 0,
+                       sizeof(*state->connectors) * (alloc - state->num_connector));
+                cs = krealloc(state->connector_states, alloc * sizeof(*state->connector_states), GFP_KERNEL);
+                if (!cs)
+                        return ERR_PTR(-ENOMEM);
+                state->connector_states = cs;
+                memset(&state->connector_states[state->num_connector], 0,
+                       sizeof(*state->connector_states) * (alloc - state->num_connector));
+                state->num_connector = alloc;
        }
        if (state->connector_states[index])
diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
index 7c523060a076..4f2d3e161593 100644
--- a/drivers/gpu/drm/drm_atomic_helper.c
+++ b/drivers/gpu/drm/drm_atomic_helper.c
@@ -1493,7 +1493,7 @@ void drm_atomic_helper_swap_state(struct drm_device *dev,
 {
        int i;
-        for (i = 0; i < dev->mode_config.num_connector; i++) {
+        for (i = 0; i < state->num_connector; i++) {
                struct drm_connector *connector = state->connectors[i];
                if (!connector)
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index d40bab29747e..f6191215b2cb 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -918,12 +918,19 @@ int drm_connector_init(struct drm_device *dev,
        connector->base.properties = &connector->properties;
        connector->dev = dev;
        connector->funcs = funcs;
+        connector->connector_id = ida_simple_get(&config->connector_ida, 0, 0, GFP_KERNEL);
+        if (connector->connector_id < 0) {
+                ret = connector->connector_id;
+                goto out_put;
+        }
        connector->connector_type = connector_type;
        connector->connector_type_id =
                ida_simple_get(connector_ida, 1, 0, GFP_KERNEL);
        if (connector->connector_type_id < 0) {
                ret = connector->connector_type_id;
-                goto out_put;
+                goto out_put_id;
        }
        connector->name =
                kasprintf(GFP_KERNEL, "%s-%d",
@@ -931,7 +938,7 @@ int drm_connector_init(struct drm_device *dev,
                          connector->connector_type_id);
        if (!connector->name) {
                ret = -ENOMEM;
-                goto out_put;
+                goto out_put_type_id;
        }
        INIT_LIST_HEAD(&connector->probed_modes);
@@ -959,7 +966,12 @@ int drm_connector_init(struct drm_device *dev,
        }
        connector->debugfs_entry = NULL;
+out_put_type_id:
+        if (ret)
+                ida_remove(connector_ida, connector->connector_type_id);
+out_put_id:
+        if (ret)
+                ida_remove(&config->connector_ida, connector->connector_id);
 out_put:
        if (ret)
                drm_mode_object_put(dev, &connector->base);
@@ -996,6 +1008,9 @@ void drm_connector_cleanup(struct drm_connector *connector)
        ida_remove(&drm_connector_enum_list[connector->connector_type].ida,
                   connector->connector_type_id);
+        ida_remove(&dev->mode_config.connector_ida,
+                   connector->connector_id);
        kfree(connector->display_info.bus_formats);
        drm_mode_object_put(dev, &connector->base);
        kfree(connector->name);
@@ -1013,32 +1028,6 @@ void drm_connector_cleanup(struct drm_connector *connector)
 EXPORT_SYMBOL(drm_connector_cleanup);
 /**
- * drm_connector_index - find the index of a registered connector
- * @connector: connector to find index for
- *
- * Given a registered connector, return the index of that connector within a DRM
- * device's list of connectors.
- */
-unsigned int drm_connector_index(struct drm_connector *connector)
-{
-        unsigned int index = 0;
-        struct drm_connector *tmp;
-        struct drm_mode_config *config = &connector->dev->mode_config;
-        WARN_ON(!drm_modeset_is_locked(&config->connection_mutex));
-        drm_for_each_connector(tmp, connector->dev) {
-                if (tmp == connector)
-                        return index;
-                index++;
-        }
-        BUG();
-}
-EXPORT_SYMBOL(drm_connector_index);
-/**
 * drm_connector_register - register a connector
 * @connector: the connector to register
 *
@@ -5789,6 +5778,7 @@ void drm_mode_config_init(struct drm_device *dev)
        INIT_LIST_HEAD(&dev->mode_config.plane_list);
        idr_init(&dev->mode_config.crtc_idr);
        idr_init(&dev->mode_config.tile_idr);
+        ida_init(&dev->mode_config.connector_ida);
        drm_modeset_lock_all(dev);
        drm_mode_create_standard_properties(dev);
@@ -5869,6 +5859,7 @@ void drm_mode_config_cleanup(struct drm_device *dev)
                crtc->funcs->destroy(crtc);
        }
+        ida_destroy(&dev->mode_config.connector_ida);
        idr_destroy(&dev->mode_config.tile_idr);
        idr_destroy(&dev->mode_config.crtc_idr);
        drm_modeset_lock_fini(&dev->mode_config.connection_mutex);
diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
index 8ae13de272c4..27fbd79d0daf 100644
--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -1159,11 +1159,13 @@ static void drm_dp_add_port(struct drm_dp_mst_branch *mstb,
                        drm_dp_put_port(port);
                        goto out;
                }
+                if (port->port_num >= DP_MST_LOGICAL_PORT_0) {
-                drm_mode_connector_set_tile_property(port->connector);
+                        port->cached_edid = drm_get_edid(port->connector, &port->aux.ddc);
+                        drm_mode_connector_set_tile_property(port->connector);
+                }
                (*mstb->mgr->cbs->register_connector)(port->connector);
        }
 out:
        /* put reference to this port */
        drm_dp_put_port(port);
@@ -1188,8 +1190,8 @@ static void drm_dp_update_port(struct drm_dp_mst_branch *mstb,
        port->ddps = conn_stat->displayport_device_plug_status;
        if (old_ddps != port->ddps) {
-                dowork = true;
                if (port->ddps) {
+                        dowork = true;
                } else {
                        port->available_pbn = 0;
                }
@@ -1294,13 +1296,8 @@ static void drm_dp_check_and_send_link_address(struct drm_dp_mst_topology_mgr *m
                if (port->input)
                        continue;
-                if (!port->ddps) {
+                if (!port->ddps)
-                        if (port->cached_edid) {
-                                kfree(port->cached_edid);
-                                port->cached_edid = NULL;
-                        }
                        continue;
-                }
                if (!port->available_pbn)
                        drm_dp_send_enum_path_resources(mgr, mstb, port);
@@ -1311,12 +1308,6 @@ static void drm_dp_check_and_send_link_address(struct drm_dp_mst_topology_mgr *m
                                drm_dp_check_and_send_link_address(mgr, mstb_child);
                                drm_dp_put_mst_branch_device(mstb_child);
                        }
-                } else if (port->pdt == DP_PEER_DEVICE_SST_SINK ||
-                        port->pdt == DP_PEER_DEVICE_DP_LEGACY_CONV) {
-                        if (!port->cached_edid) {
-                                port->cached_edid =
-                                        drm_get_edid(port->connector, &port->aux.ddc);
-                        }
                }
        }
 }
@@ -1336,8 +1327,6 @@ static void drm_dp_mst_link_probe_work(struct work_struct *work)
                drm_dp_check_and_send_link_address(mgr, mstb);
                drm_dp_put_mst_branch_device(mstb);
        }
-        (*mgr->cbs->hotplug)(mgr);
 }
 static bool drm_dp_validate_guid(struct drm_dp_mst_topology_mgr *mgr,
@@ -1597,6 +1586,7 @@ static void drm_dp_send_link_address(struct drm_dp_mst_topology_mgr *mgr,
                        for (i = 0; i < txmsg->reply.u.link_addr.nports; i++) {
                                drm_dp_add_port(mstb, mgr->dev, &txmsg->reply.u.link_addr.ports[i]);
                        }
+                        (*mgr->cbs->hotplug)(mgr);
                }
        } else {
                mstb->link_address_sent = false;
@@ -2293,6 +2283,8 @@ static int drm_dp_mst_handle_up_req(struct drm_dp_mst_topology_mgr *mgr)
                        drm_dp_update_port(mstb, &msg.u.conn_stat);
                        DRM_DEBUG_KMS("Got CSN: pn: %d ldps:%d ddps: %d mcs: %d ip: %d pdt: %d\n", msg.u.conn_stat.port_number, msg.u.conn_stat.legacy_device_plug_status, msg.u.conn_stat.displayport_device_plug_status, msg.u.conn_stat.message_capability_status, msg.u.conn_stat.input_port, msg.u.conn_stat.peer_device_type);
+                        (*mgr->cbs->hotplug)(mgr);
                } else if (msg.req_type == DP_RESOURCE_STATUS_NOTIFY) {
                        drm_dp_send_up_ack_reply(mgr, mgr->mst_primary, msg.req_type, seqno, false);
                        if (!mstb)
@@ -2379,6 +2371,10 @@ enum drm_connector_status drm_dp_mst_detect_port(struct drm_connector *connector
        case DP_PEER_DEVICE_SST_SINK:
                status = connector_status_connected;
+                /* for logical ports - cache the EDID */
+                if (port->port_num >= 8 && !port->cached_edid) {
+                        port->cached_edid = drm_get_edid(connector, &port->aux.ddc);
+                }
                break;
        case DP_PEER_DEVICE_DP_LEGACY_CONV:
                if (port->ldps)
@@ -2433,7 +2429,10 @@ struct edid *drm_dp_mst_get_edid(struct drm_connector *connector, struct drm_dp_
        if (port->cached_edid)
                edid = drm_edid_duplicate(port->cached_edid);
+        else {
+                edid = drm_get_edid(connector, &port->aux.ddc);
+                drm_mode_connector_set_tile_property(connector);
+        }
        port->has_audio = drm_detect_monitor_audio(edid);
        drm_dp_put_port(port);
        return edid;
diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c
index d12a4efa651b..1fe14579e8c9 100644
--- a/drivers/gpu/drm/drm_irq.c
+++ b/drivers/gpu/drm/drm_irq.c
@@ -224,6 +224,64 @@ static void drm_update_vblank_count(struct drm_device *dev, unsigned int pipe,
                diff = (flags & DRM_CALLED_FROM_VBLIRQ) != 0;
        }
+        /*
+         * Within a drm_vblank_pre_modeset - drm_vblank_post_modeset
+         * interval? If so then vblank irqs keep running and it will likely
+         * happen that the hardware vblank counter is not trustworthy as it
+         * might reset at some point in that interval and vblank timestamps
+         * are not trustworthy either in that interval. Iow. this can result
+         * in a bogus diff >> 1 which must be avoided as it would cause
+         * random large forward jumps of the software vblank counter.
+         */
+        if (diff > 1 && (vblank->inmodeset & 0x2)) {
+                DRM_DEBUG_VBL("clamping vblank bump to 1 on crtc %u: diffr=%u"
+                              " due to pre-modeset.\n", pipe, diff);
+                diff = 1;
+        }
+        /*
+         * FIMXE: Need to replace this hack with proper seqlocks.
+         *
+         * Restrict the bump of the software vblank counter to a safe maximum
+         * value of +1 whenever there is the possibility that concurrent readers
+         * of vblank timestamps could be active at the moment, as the current
+         * implementation of the timestamp caching and updating is not safe
+         * against concurrent readers for calls to store_vblank() with a bump
+         * of anything but +1. A bump != 1 would very likely return corrupted
+         * timestamps to userspace, because the same slot in the cache could
+         * be concurrently written by store_vblank() and read by one of those
+         * readers without the read-retry logic detecting the collision.
+         *
+         * Concurrent readers can exist when we are called from the
+         * drm_vblank_off() or drm_vblank_on() functions and other non-vblank-
+         * irq callers. However, all those calls to us are happening with the
+         * vbl_lock locked to prevent drm_vblank_get(), so the vblank refcount
+         * can't increase while we are executing. Therefore a zero refcount at
+         * this point is safe for arbitrary counter bumps if we are called
+         * outside vblank irq, a non-zero count is not 100% safe. Unfortunately
+         * we must also accept a refcount of 1, as whenever we are called from
+         * drm_vblank_get() -> drm_vblank_enable() the refcount will be 1 and
+         * we must let that one pass through in order to not lose vblank counts
+         * during vblank irq off - which would completely defeat the whole
+         * point of this routine.
+         *
+         * Whenever we are called from vblank irq, we have to assume concurrent
+         * readers exist or can show up any time during our execution, even if
+         * the refcount is currently zero, as vblank irqs are usually only
+         * enabled due to the presence of readers, and because when we are called
+         * from vblank irq we can't hold the vbl_lock to protect us from sudden
+         * bumps in vblank refcount. Therefore also restrict bumps to +1 when
+         * called from vblank irq.
+         */
+        if ((diff > 1) && (atomic_read(&vblank->refcount) > 1 ||
+            (flags & DRM_CALLED_FROM_VBLIRQ))) {
+                DRM_DEBUG_VBL("clamping vblank bump to 1 on crtc %u: diffr=%u "
+                              "refcount %u, vblirq %u\n", pipe, diff,
+                              atomic_read(&vblank->refcount),
+                              (flags & DRM_CALLED_FROM_VBLIRQ) != 0);
+                diff = 1;
+        }
        DRM_DEBUG_VBL("updating vblank count on crtc %u:"
                      " current=%u, diff=%u, hw=%u hw_last=%u\n",
                      pipe, vblank->count, diff, cur_vblank, vblank->last);
@@ -1316,7 +1374,13 @@ void drm_vblank_off(struct drm_device *dev, unsigned int pipe)
        spin_lock_irqsave(&dev->event_lock, irqflags);
        spin_lock(&dev->vbl_lock);
-        vblank_disable_and_save(dev, pipe);
+        DRM_DEBUG_VBL("crtc %d, vblank enabled %d, inmodeset %d\n",
+                      pipe, vblank->enabled, vblank->inmodeset);
+        /* Avoid redundant vblank disables without previous drm_vblank_on(). */
+        if (drm_core_check_feature(dev, DRIVER_ATOMIC) || !vblank->inmodeset)
+                vblank_disable_and_save(dev, pipe);
        wake_up(&vblank->queue);
        /*
@@ -1418,6 +1482,9 @@ void drm_vblank_on(struct drm_device *dev, unsigned int pipe)
                return;
        spin_lock_irqsave(&dev->vbl_lock, irqflags);
+        DRM_DEBUG_VBL("crtc %d, vblank enabled %d, inmodeset %d\n",
+                      pipe, vblank->enabled, vblank->inmodeset);
        /* Drop our private "prevent drm_vblank_get" refcount */
        if (vblank->inmodeset) {
                atomic_dec(&vblank->refcount);
@@ -1430,8 +1497,7 @@ void drm_vblank_on(struct drm_device *dev, unsigned int pipe)
         * re-enable interrupts if there are users left, or the
         * user wishes vblank interrupts to be enabled all the time.
         */
-        if (atomic_read(&vblank->refcount) != 0 ||
+        if (atomic_read(&vblank->refcount) != 0 || drm_vblank_offdelay == 0)
-            (!dev->vblank_disable_immediate && drm_vblank_offdelay == 0))
                WARN_ON(drm_vblank_enable(dev, pipe));
        spin_unlock_irqrestore(&dev->vbl_lock, irqflags);
 }
@@ -1526,6 +1592,7 @@ void drm_vblank_post_modeset(struct drm_device *dev, unsigned int pipe)
        if (vblank->inmodeset) {
                spin_lock_irqsave(&dev->vbl_lock, irqflags);
                dev->vblank_disable_allowed = true;
+                drm_reset_vblank_timestamp(dev, pipe);
                spin_unlock_irqrestore(&dev->vbl_lock, irqflags);
                if (vblank->inmodeset & 0x2)
diff --git a/drivers/gpu/drm/exynos/Kconfig b/drivers/gpu/drm/exynos/Kconfig
index 83efca941388..f17d39279596 100644
--- a/drivers/gpu/drm/exynos/Kconfig
+++ b/drivers/gpu/drm/exynos/Kconfig
@@ -1,6 +1,6 @@
 config DRM_EXYNOS
        tristate "DRM Support for Samsung SoC EXYNOS Series"
-        depends on OF && DRM && (PLAT_SAMSUNG || ARCH_MULTIPLATFORM)
+        depends on OF && DRM && (ARCH_S3C64XX || ARCH_EXYNOS || ARCH_MULTIPLATFORM)
        select DRM_KMS_HELPER
        select DRM_KMS_FB_HELPER
        select FB_CFB_FILLRECT
diff --git a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
index 1bf6a21130c7..162ab93e99cb 100644
--- a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
+++ b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
@@ -93,7 +93,7 @@ static int decon_enable_vblank(struct exynos_drm_crtc *crtc)
        if (test_bit(BIT_SUSPENDED, &ctx->flags))
                return -EPERM;
-        if (test_and_set_bit(BIT_IRQS_ENABLED, &ctx->flags)) {
+        if (!test_and_set_bit(BIT_IRQS_ENABLED, &ctx->flags)) {
                val = VIDINTCON0_INTEN;
                if (ctx->out_type == IFTYPE_I80)
                        val |= VIDINTCON0_FRAMEDONE;
@@ -402,8 +402,6 @@ static void decon_enable(struct exynos_drm_crtc *crtc)
                decon_enable_vblank(ctx->crtc);
        decon_commit(ctx->crtc);
-        set_bit(BIT_SUSPENDED, &ctx->flags);
 }
 static void decon_disable(struct exynos_drm_crtc *crtc)
@@ -582,9 +580,9 @@ out:
 static int exynos5433_decon_suspend(struct device *dev)
 {
        struct decon_context *ctx = dev_get_drvdata(dev);
-        int i;
+        int i = ARRAY_SIZE(decon_clks_name);
-        for (i = 0; i < ARRAY_SIZE(decon_clks_name); i++)
+        while (--i >= 0)
                clk_disable_unprepare(ctx->clks[i]);
        return 0;
diff --git a/drivers/gpu/drm/exynos/exynos_drm_dsi.c b/drivers/gpu/drm/exynos/exynos_drm_dsi.c
index e977a81af2e6..26e81d191f56 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_dsi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_dsi.c
@@ -1782,6 +1782,7 @@ static int exynos_dsi_bind(struct device *dev, struct device *master,
        bridge = of_drm_find_bridge(dsi->bridge_node);
        if (bridge) {
+                encoder->bridge = bridge;
                drm_bridge_attach(drm_dev, bridge);
        }
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fbdev.c b/drivers/gpu/drm/exynos/exynos_drm_fbdev.c
index f6118baa8e3e..8baabd813ff5 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fbdev.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fbdev.c
@@ -50,7 +50,7 @@ static int exynos_drm_fb_mmap(struct fb_info *info,
        if (vm_size > exynos_gem->size)
                return -EINVAL;
-        ret = dma_mmap_attrs(helper->dev->dev, vma, exynos_gem->pages,
+        ret = dma_mmap_attrs(helper->dev->dev, vma, exynos_gem->cookie,
                             exynos_gem->dma_addr, exynos_gem->size,
                             &exynos_gem->dma_attrs);
        if (ret < 0) {
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimc.c b/drivers/gpu/drm/exynos/exynos_drm_fimc.c
index c747824f3c98..8a4f4a0211d0 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fimc.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fimc.c
@@ -1723,7 +1723,7 @@ static int fimc_probe(struct platform_device *pdev)
                goto err_put_clk;
        }
-        DRM_DEBUG_KMS("id[%d]ippdrv[0x%x]\n", ctx->id, (int)ippdrv);
+        DRM_DEBUG_KMS("id[%d]ippdrv[%p]\n", ctx->id, ippdrv);
        spin_lock_init(&ctx->lock);
        platform_set_drvdata(pdev, ctx);
diff --git a/drivers/gpu/drm/exynos/exynos_drm_g2d.c b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
index c17efdb238a6..8dfe6e113a88 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_g2d.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
@@ -1166,7 +1166,7 @@ int exynos_g2d_set_cmdlist_ioctl(struct drm_device *drm_dev, void *data,
                goto err_free_event;
        }
-        cmd = (struct drm_exynos_g2d_cmd *)(uint32_t)req->cmd;
+        cmd = (struct drm_exynos_g2d_cmd *)(unsigned long)req->cmd;
        if (copy_from_user(cmdlist->data + cmdlist->last,
                                (void __user *)cmd,
@@ -1184,7 +1184,8 @@ int exynos_g2d_set_cmdlist_ioctl(struct drm_device *drm_dev, void *data,
        if (req->cmd_buf_nr) {
                struct drm_exynos_g2d_cmd *cmd_buf;
-                cmd_buf = (struct drm_exynos_g2d_cmd *)(uint32_t)req->cmd_buf;
+                cmd_buf = (struct drm_exynos_g2d_cmd *)
+                                (unsigned long)req->cmd_buf;
                if (copy_from_user(cmdlist->data + cmdlist->last,
                                        (void __user *)cmd_buf,
diff --git a/drivers/gpu/drm/exynos/exynos_drm_gem.c b/drivers/gpu/drm/exynos/exynos_drm_gem.c
index 32358c5e3db4..26b5e4bd55b6 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_gem.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_gem.c
@@ -218,7 +218,7 @@ static struct exynos_drm_gem *exynos_drm_gem_init(struct drm_device *dev,
                return ERR_PTR(ret);
        }
-        DRM_DEBUG_KMS("created file object = 0x%x\n", (unsigned int)obj->filp);
+        DRM_DEBUG_KMS("created file object = %p\n", obj->filp);
        return exynos_gem;
 }
@@ -335,7 +335,7 @@ static int exynos_drm_gem_mmap_buffer(struct exynos_drm_gem *exynos_gem,
        if (vm_size > exynos_gem->size)
                return -EINVAL;
-        ret = dma_mmap_attrs(drm_dev->dev, vma, exynos_gem->pages,
+        ret = dma_mmap_attrs(drm_dev->dev, vma, exynos_gem->cookie,
                             exynos_gem->dma_addr, exynos_gem->size,
                             &exynos_gem->dma_attrs);
        if (ret < 0) {
diff --git a/drivers/gpu/drm/exynos/exynos_drm_gsc.c b/drivers/gpu/drm/exynos/exynos_drm_gsc.c
index 7aecd23cfa11..5d20da8f957e 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_gsc.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_gsc.c
@@ -1723,7 +1723,7 @@ static int gsc_probe(struct platform_device *pdev)
                return ret;
        }
-        DRM_DEBUG_KMS("id[%d]ippdrv[0x%x]\n", ctx->id, (int)ippdrv);
+        DRM_DEBUG_KMS("id[%d]ippdrv[%p]\n", ctx->id, ippdrv);
        mutex_init(&ctx->lock);
        platform_set_drvdata(pdev, ctx);
diff --git a/drivers/gpu/drm/exynos/exynos_drm_ipp.c b/drivers/gpu/drm/exynos/exynos_drm_ipp.c
index 67d24236e745..95eeb9116f10 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_ipp.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_ipp.c
@@ -208,7 +208,7 @@ static struct exynos_drm_ippdrv *ipp_find_drv_by_handle(u32 prop_id)
         * e.g PAUSE state, queue buf, command control.
         */
        list_for_each_entry(ippdrv, &exynos_drm_ippdrv_list, drv_list) {
-                DRM_DEBUG_KMS("count[%d]ippdrv[0x%x]\n", count++, (int)ippdrv);
+                DRM_DEBUG_KMS("count[%d]ippdrv[%p]\n", count++, ippdrv);
                mutex_lock(&ippdrv->cmd_lock);
                list_for_each_entry(c_node, &ippdrv->cmd_list, list) {
@@ -388,8 +388,8 @@ int exynos_drm_ipp_set_property(struct drm_device *drm_dev, void *data,
        }
        property->prop_id = ret;
-        DRM_DEBUG_KMS("created prop_id[%d]cmd[%d]ippdrv[0x%x]\n",
+        DRM_DEBUG_KMS("created prop_id[%d]cmd[%d]ippdrv[%p]\n",
-                property->prop_id, property->cmd, (int)ippdrv);
+                property->prop_id, property->cmd, ippdrv);
        /* stored property information and ippdrv in private data */
        c_node->property = *property;
@@ -518,7 +518,7 @@ static int ipp_put_mem_node(struct drm_device *drm_dev,
 {
        int i;
-        DRM_DEBUG_KMS("node[0x%x]\n", (int)m_node);
+        DRM_DEBUG_KMS("node[%p]\n", m_node);
        if (!m_node) {
                DRM_ERROR("invalid dequeue node.\n");
@@ -562,7 +562,7 @@ static struct drm_exynos_ipp_mem_node
        m_node->buf_id = qbuf->buf_id;
        INIT_LIST_HEAD(&m_node->list);
-        DRM_DEBUG_KMS("m_node[0x%x]ops_id[%d]\n", (int)m_node, qbuf->ops_id);
+        DRM_DEBUG_KMS("m_node[%p]ops_id[%d]\n", m_node, qbuf->ops_id);
        DRM_DEBUG_KMS("prop_id[%d]buf_id[%d]\n", qbuf->prop_id, m_node->buf_id);
        for_each_ipp_planar(i) {
@@ -582,8 +582,8 @@ static struct drm_exynos_ipp_mem_node
                        buf_info->handles[i] = qbuf->handle[i];
                        buf_info->base[i] = *addr;
-                        DRM_DEBUG_KMS("i[%d]base[0x%x]hd[0x%lx]\n", i,
+                        DRM_DEBUG_KMS("i[%d]base[%pad]hd[0x%lx]\n", i,
-                                      buf_info->base[i], buf_info->handles[i]);
+                                      &buf_info->base[i], buf_info->handles[i]);
                }
        }
@@ -664,7 +664,7 @@ static void ipp_put_event(struct drm_exynos_ipp_cmd_node *c_node,
        mutex_lock(&c_node->event_lock);
        list_for_each_entry_safe(e, te, &c_node->event_list, base.link) {
-                DRM_DEBUG_KMS("count[%d]e[0x%x]\n", count++, (int)e);
+                DRM_DEBUG_KMS("count[%d]e[%p]\n", count++, e);
                /*
                 * qbuf == NULL condition means all event deletion.
@@ -755,7 +755,7 @@ static struct drm_exynos_ipp_mem_node
        /* find memory node from memory list */
        list_for_each_entry(m_node, head, list) {
-                DRM_DEBUG_KMS("count[%d]m_node[0x%x]\n", count++, (int)m_node);
+                DRM_DEBUG_KMS("count[%d]m_node[%p]\n", count++, m_node);
                /* compare buffer id */
                if (m_node->buf_id == qbuf->buf_id)
@@ -772,7 +772,7 @@ static int ipp_set_mem_node(struct exynos_drm_ippdrv *ippdrv,
        struct exynos_drm_ipp_ops *ops = NULL;
        int ret = 0;
-        DRM_DEBUG_KMS("node[0x%x]\n", (int)m_node);
+        DRM_DEBUG_KMS("node[%p]\n", m_node);
        if (!m_node) {
                DRM_ERROR("invalid queue node.\n");
@@ -1237,7 +1237,7 @@ static int ipp_start_property(struct exynos_drm_ippdrv *ippdrv,
                        m_node = list_first_entry(head,
                                struct drm_exynos_ipp_mem_node, list);
-                        DRM_DEBUG_KMS("m_node[0x%x]\n", (int)m_node);
+                        DRM_DEBUG_KMS("m_node[%p]\n", m_node);
                        ret = ipp_set_mem_node(ippdrv, c_node, m_node);
                        if (ret) {
@@ -1610,8 +1610,8 @@ static int ipp_subdrv_probe(struct drm_device *drm_dev, struct device *dev)
                }
                ippdrv->prop_list.ipp_id = ret;
-                DRM_DEBUG_KMS("count[%d]ippdrv[0x%x]ipp_id[%d]\n",
+                DRM_DEBUG_KMS("count[%d]ippdrv[%p]ipp_id[%d]\n",
-                        count++, (int)ippdrv, ret);
+                        count++, ippdrv, ret);
                /* store parent device for node */
                ippdrv->parent_dev = dev;
@@ -1668,7 +1668,7 @@ static int ipp_subdrv_open(struct drm_device *drm_dev, struct device *dev,
        file_priv->ipp_dev = dev;
-        DRM_DEBUG_KMS("done priv[0x%x]\n", (int)dev);
+        DRM_DEBUG_KMS("done priv[%p]\n", dev);
        return 0;
 }
@@ -1685,8 +1685,8 @@ static void ipp_subdrv_close(struct drm_device *drm_dev, struct device *dev,
                mutex_lock(&ippdrv->cmd_lock);
                list_for_each_entry_safe(c_node, tc_node,
                        &ippdrv->cmd_list, list) {
-                        DRM_DEBUG_KMS("count[%d]ippdrv[0x%x]\n",
+                        DRM_DEBUG_KMS("count[%d]ippdrv[%p]\n",
-                                count++, (int)ippdrv);
+                                count++, ippdrv);
                        if (c_node->filp == file) {
                                /*
diff --git a/drivers/gpu/drm/exynos/exynos_drm_mic.c b/drivers/gpu/drm/exynos/exynos_drm_mic.c
index 4eaef36aec5a..9869d70e9e54 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_mic.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_mic.c
@@ -18,6 +18,7 @@
 #include <linux/of.h>
 #include <linux/of_graph.h>
 #include <linux/clk.h>
+#include <linux/component.h>
 #include <drm/drmP.h>
 #include <linux/mfd/syscon.h>
 #include <linux/regmap.h>
@@ -306,9 +307,9 @@ exit:
        return ret;
 }
-void mic_disable(struct drm_bridge *bridge) { }
+static void mic_disable(struct drm_bridge *bridge) { }
-void mic_post_disable(struct drm_bridge *bridge)
+static void mic_post_disable(struct drm_bridge *bridge)
 {
        struct exynos_mic *mic = bridge->driver_private;
        int i;
@@ -328,7 +329,7 @@ already_disabled:
        mutex_unlock(&mic_mutex);
 }
-void mic_pre_enable(struct drm_bridge *bridge)
+static void mic_pre_enable(struct drm_bridge *bridge)
 {
        struct exynos_mic *mic = bridge->driver_private;
        int ret, i;
@@ -371,11 +372,35 @@ already_enabled:
        mutex_unlock(&mic_mutex);
 }
-void mic_enable(struct drm_bridge *bridge) { }
+static void mic_enable(struct drm_bridge *bridge) { }
-void mic_destroy(struct drm_bridge *bridge)
+static const struct drm_bridge_funcs mic_bridge_funcs = {
+        .disable = mic_disable,
+        .post_disable = mic_post_disable,
+        .pre_enable = mic_pre_enable,
+        .enable = mic_enable,
+};
+static int exynos_mic_bind(struct device *dev, struct device *master,
+                           void *data)
 {
-        struct exynos_mic *mic = bridge->driver_private;
+        struct exynos_mic *mic = dev_get_drvdata(dev);
+        int ret;
+        mic->bridge.funcs = &mic_bridge_funcs;
+        mic->bridge.of_node = dev->of_node;
+        mic->bridge.driver_private = mic;
+        ret = drm_bridge_add(&mic->bridge);
+        if (ret)
+                DRM_ERROR("mic: Failed to add MIC to the global bridge list\n");
+        return ret;
+}
+static void exynos_mic_unbind(struct device *dev, struct device *master,
+                              void *data)
+{
+        struct exynos_mic *mic = dev_get_drvdata(dev);
        int i;
        mutex_lock(&mic_mutex);
@@ -387,16 +412,16 @@ void mic_destroy(struct drm_bridge *bridge)
 already_disabled:
        mutex_unlock(&mic_mutex);
+        drm_bridge_remove(&mic->bridge);
 }
-static const struct drm_bridge_funcs mic_bridge_funcs = {
+static const struct component_ops exynos_mic_component_ops = {
-        .disable = mic_disable,
+        .bind   = exynos_mic_bind,
-        .post_disable = mic_post_disable,
+        .unbind = exynos_mic_unbind,
-        .pre_enable = mic_pre_enable,
-        .enable = mic_enable,
 };
-int exynos_mic_probe(struct platform_device *pdev)
+static int exynos_mic_probe(struct platform_device *pdev)
 {
        struct device *dev = &pdev->dev;
        struct exynos_mic *mic;
@@ -435,17 +460,8 @@ int exynos_mic_probe(struct platform_device *pdev)
                goto err;
        }
-        mic->bridge.funcs = &mic_bridge_funcs;
-        mic->bridge.of_node = dev->of_node;
-        mic->bridge.driver_private = mic;
-        ret = drm_bridge_add(&mic->bridge);
-        if (ret) {
-                DRM_ERROR("mic: Failed to add MIC to the global bridge list\n");
-                goto err;
-        }
        for (i = 0; i < NUM_CLKS; i++) {
-                mic->clks[i] = of_clk_get_by_name(dev->of_node, clk_names[i]);
+                mic->clks[i] = devm_clk_get(dev, clk_names[i]);
                if (IS_ERR(mic->clks[i])) {
                        DRM_ERROR("mic: Failed to get clock (%s)\n",
                                                                clk_names[i]);
@@ -454,7 +470,10 @@ int exynos_mic_probe(struct platform_device *pdev)
                }
        }
+        platform_set_drvdata(pdev, mic);
        DRM_DEBUG_KMS("MIC has been probed\n");
+        return component_add(dev, &exynos_mic_component_ops);
 err:
        return ret;
@@ -462,14 +481,7 @@ err:
 static int exynos_mic_remove(struct platform_device *pdev)
 {
-        struct exynos_mic *mic = platform_get_drvdata(pdev);
+        component_del(&pdev->dev, &exynos_mic_component_ops);
-        int i;
-        drm_bridge_remove(&mic->bridge);
-        for (i = NUM_CLKS - 1; i > -1; i--)
-                clk_put(mic->clks[i]);
        return 0;
 }
diff --git a/drivers/gpu/drm/exynos/exynos_drm_rotator.c b/drivers/gpu/drm/exynos/exynos_drm_rotator.c
index bea0f7826d30..ce59f4443394 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_rotator.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_rotator.c
@@ -754,7 +754,7 @@ static int rotator_probe(struct platform_device *pdev)
                goto err_ippdrv_register;
        }
-        DRM_DEBUG_KMS("ippdrv[0x%x]\n", (int)ippdrv);
+        DRM_DEBUG_KMS("ippdrv[%p]\n", ippdrv);
        platform_set_drvdata(pdev, rot);
diff --git a/drivers/gpu/drm/exynos/exynos_drm_vidi.c b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
index 62ac4e5fa51d..b605bd7395ec 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_vidi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
@@ -223,7 +223,7 @@ static void vidi_fake_vblank_handler(struct work_struct *work)
        }
 }
-static int vidi_show_connection(struct device *dev,
+static ssize_t vidi_show_connection(struct device *dev,
                                struct device_attribute *attr, char *buf)
 {
        struct vidi_context *ctx = dev_get_drvdata(dev);
@@ -238,7 +238,7 @@ static int vidi_show_connection(struct device *dev,
        return rc;
 }
-static int vidi_store_connection(struct device *dev,
+static ssize_t vidi_store_connection(struct device *dev,
                                struct device_attribute *attr,
                                const char *buf, size_t len)
 {
@@ -294,7 +294,9 @@ int vidi_connection_ioctl(struct drm_device *drm_dev, void *data,
        }
        if (vidi->connection) {
-                struct edid *raw_edid  = (struct edid *)(uint32_t)vidi->edid;
+                struct edid *raw_edid;
+                raw_edid = (struct edid *)(unsigned long)vidi->edid;
                if (!drm_edid_is_valid(raw_edid)) {
                        DRM_DEBUG_KMS("edid data is invalid.\n");
                        return -EINVAL;
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index b9a564b76528..4897728713f6 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -3287,19 +3287,20 @@ enum skl_disp_power_wells {
 #define PORT_HOTPLUG_STAT       _MMIO(dev_priv->info.display_mmio_offset + 0x61114)
 /*
- * HDMI/DP bits are gen4+
+ * HDMI/DP bits are g4x+
 *
 * WARNING: Bspec for hpd status bits on gen4 seems to be completely confused.
 * Please check the detailed lore in the commit message for for experimental
 * evidence.
 */
-#define   PORTD_HOTPLUG_LIVE_STATUS_G4X         (1 << 29)
+/* Bspec says GM45 should match G4X/VLV/CHV, but reality disagrees */
+#define   PORTD_HOTPLUG_LIVE_STATUS_GM45        (1 << 29)
+#define   PORTC_HOTPLUG_LIVE_STATUS_GM45        (1 << 28)
+#define   PORTB_HOTPLUG_LIVE_STATUS_GM45        (1 << 27)
+/* G4X/VLV/CHV DP/HDMI bits again match Bspec */
+#define   PORTD_HOTPLUG_LIVE_STATUS_G4X         (1 << 27)
 #define   PORTC_HOTPLUG_LIVE_STATUS_G4X         (1 << 28)
-#define   PORTB_HOTPLUG_LIVE_STATUS_G4X         (1 << 27)
+#define   PORTB_HOTPLUG_LIVE_STATUS_G4X         (1 << 29)
-/* VLV DP/HDMI bits again match Bspec */
-#define   PORTD_HOTPLUG_LIVE_STATUS_VLV         (1 << 27)
-#define   PORTC_HOTPLUG_LIVE_STATUS_VLV         (1 << 28)
-#define   PORTB_HOTPLUG_LIVE_STATUS_VLV         (1 << 29)
 #define   PORTD_HOTPLUG_INT_STATUS              (3 << 21)
 #define   PORTD_HOTPLUG_INT_LONG_PULSE          (2 << 21)
 #define   PORTD_HOTPLUG_INT_SHORT_PULSE         (1 << 21)
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 796e3d313cb9..1bbd67b046da 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -4493,20 +4493,20 @@ static bool g4x_digital_port_connected(struct drm_i915_private *dev_priv,
        return I915_READ(PORT_HOTPLUG_STAT) & bit;
 }
-static bool vlv_digital_port_connected(struct drm_i915_private *dev_priv,
+static bool gm45_digital_port_connected(struct drm_i915_private *dev_priv,
-                                       struct intel_digital_port *port)
+                                        struct intel_digital_port *port)
 {
        u32 bit;
        switch (port->port) {
        case PORT_B:
-                bit = PORTB_HOTPLUG_LIVE_STATUS_VLV;
+                bit = PORTB_HOTPLUG_LIVE_STATUS_GM45;
                break;
        case PORT_C:
-                bit = PORTC_HOTPLUG_LIVE_STATUS_VLV;
+                bit = PORTC_HOTPLUG_LIVE_STATUS_GM45;
                break;
        case PORT_D:
-                bit = PORTD_HOTPLUG_LIVE_STATUS_VLV;
+                bit = PORTD_HOTPLUG_LIVE_STATUS_GM45;
                break;
        default:
                MISSING_CASE(port->port);
@@ -4558,8 +4558,8 @@ bool intel_digital_port_connected(struct drm_i915_private *dev_priv,
                return cpt_digital_port_connected(dev_priv, port);
        else if (IS_BROXTON(dev_priv))
                return bxt_digital_port_connected(dev_priv, port);
-        else if (IS_VALLEYVIEW(dev_priv) || IS_CHERRYVIEW(dev_priv))
+        else if (IS_GM45(dev_priv))
-                return vlv_digital_port_connected(dev_priv, port);
+                return gm45_digital_port_connected(dev_priv, port);
        else
                return g4x_digital_port_connected(dev_priv, port);
 }
diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c
index 78f520d05de9..e3acc35e3805 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
@@ -1520,7 +1520,7 @@ nouveau_ttm_tt_populate(struct ttm_tt *ttm)
                                    DMA_BIDIRECTIONAL);
                if (dma_mapping_error(pdev, addr)) {
-                        while (--i) {
+                        while (i--) {
                                dma_unmap_page(pdev, ttm_dma->dma_address[i],
                                               PAGE_SIZE, DMA_BIDIRECTIONAL);
                                ttm_dma->dma_address[i] = 0;
diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
index 24be27d3cd18..20935eb2a09e 100644
--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -635,10 +635,6 @@ nouveau_display_resume(struct drm_device *dev, bool runtime)
                nv_crtc->lut.depth = 0;
        }
-        /* Make sure that drm and hw vblank irqs get resumed if needed. */
-        for (head = 0; head < dev->mode_config.num_crtc; head++)
-                drm_vblank_on(dev, head);
        /* This should ensure we don't hit a locking problem when someone
         * wakes us up via a connector.  We should never go into suspend
         * while the display is on anyways.
@@ -648,6 +644,10 @@ nouveau_display_resume(struct drm_device *dev, bool runtime)
        drm_helper_resume_force_mode(dev);
+        /* Make sure that drm and hw vblank irqs get resumed if needed. */
+        for (head = 0; head < dev->mode_config.num_crtc; head++)
+                drm_vblank_on(dev, head);
        list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
                struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c
index 2ae8577497ca..7c2e78201ead 100644
--- a/drivers/gpu/drm/qxl/qxl_ioctl.c
+++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
@@ -168,7 +168,8 @@ static int qxl_process_single_command(struct qxl_device *qdev,
                       cmd->command_size))
                return -EFAULT;
-        reloc_info = kmalloc(sizeof(struct qxl_reloc_info) * cmd->relocs_num, GFP_KERNEL);
+        reloc_info = kmalloc_array(cmd->relocs_num,
+                                   sizeof(struct qxl_reloc_info), GFP_KERNEL);
        if (!reloc_info)
                return -ENOMEM;
diff --git a/drivers/gpu/drm/qxl/qxl_prime.c b/drivers/gpu/drm/qxl/qxl_prime.c
index 3d031b50a8fd..9f029dda1f07 100644
--- a/drivers/gpu/drm/qxl/qxl_prime.c
+++ b/drivers/gpu/drm/qxl/qxl_prime.c
@@ -68,5 +68,5 @@ int qxl_gem_prime_mmap(struct drm_gem_object *obj,
                       struct vm_area_struct *area)
 {
        WARN_ONCE(1, "not implemented");
-        return ENOSYS;
+        return -ENOSYS;
 }
diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
index 460c8f2989da..248c5a9fb0b6 100644
--- a/drivers/gpu/drm/radeon/radeon_pm.c
+++ b/drivers/gpu/drm/radeon/radeon_pm.c
@@ -276,8 +276,12 @@ static void radeon_pm_set_clocks(struct radeon_device *rdev)
        if (rdev->irq.installed) {
                for (i = 0; i < rdev->num_crtc; i++) {
                        if (rdev->pm.active_crtcs & (1 << i)) {
-                                rdev->pm.req_vblank |= (1 << i);
+                                /* This can fail if a modeset is in progress */
-                                drm_vblank_get(rdev->ddev, i);
+                                if (drm_vblank_get(rdev->ddev, i) == 0)
+                                        rdev->pm.req_vblank |= (1 << i);
+                                else
+                                        DRM_DEBUG_DRIVER("crtc %d no vblank, can glitch\n",
+                                                         i);
                        }
                }
        }
diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
index e34307459e50..e06ac546a90f 100644
--- a/drivers/gpu/drm/radeon/radeon_ttm.c
+++ b/drivers/gpu/drm/radeon/radeon_ttm.c
@@ -758,7 +758,7 @@ static int radeon_ttm_tt_populate(struct ttm_tt *ttm)
                                                       0, PAGE_SIZE,
                                                       PCI_DMA_BIDIRECTIONAL);
                if (pci_dma_mapping_error(rdev->pdev, gtt->ttm.dma_address[i])) {
-                        while (--i) {
+                        while (i--) {
                                pci_unmap_page(rdev->pdev, gtt->ttm.dma_address[i],
                                               PAGE_SIZE, PCI_DMA_BIDIRECTIONAL);
                                gtt->ttm.dma_address[i] = 0;
diff --git a/drivers/gpu/drm/vc4/vc4_bo.c b/drivers/gpu/drm/vc4/vc4_bo.c
index 18dfe3ec9a62..22278bcfc60e 100644
--- a/drivers/gpu/drm/vc4/vc4_bo.c
+++ b/drivers/gpu/drm/vc4/vc4_bo.c
@@ -215,7 +215,7 @@ struct vc4_bo *vc4_bo_create(struct drm_device *dev, size_t unaligned_size,
        struct drm_gem_cma_object *cma_obj;
        if (size == 0)
-                return NULL;
+                return ERR_PTR(-EINVAL);
        /* First, try to get a vc4_bo from the kernel BO cache. */
        if (from_cache) {
@@ -237,7 +237,7 @@ struct vc4_bo *vc4_bo_create(struct drm_device *dev, size_t unaligned_size,
                if (IS_ERR(cma_obj)) {
                        DRM_ERROR("Failed to allocate from CMA:\n");
                        vc4_bo_stats_dump(vc4);
-                        return NULL;
+                        return ERR_PTR(-ENOMEM);
                }
        }
@@ -259,8 +259,8 @@ int vc4_dumb_create(struct drm_file *file_priv,
                args->size = args->pitch * args->height;
        bo = vc4_bo_create(dev, args->size, false);
-        if (!bo)
+        if (IS_ERR(bo))
-                return -ENOMEM;
+                return PTR_ERR(bo);
        ret = drm_gem_handle_create(file_priv, &bo->base.base, &args->handle);
        drm_gem_object_unreference_unlocked(&bo->base.base);
@@ -443,8 +443,8 @@ int vc4_create_bo_ioctl(struct drm_device *dev, void *data,
         * get zeroed, and that might leak data between users.
         */
        bo = vc4_bo_create(dev, args->size, false);
-        if (!bo)
+        if (IS_ERR(bo))
-                return -ENOMEM;
+                return PTR_ERR(bo);
        ret = drm_gem_handle_create(file_priv, &bo->base.base, &args->handle);
        drm_gem_object_unreference_unlocked(&bo->base.base);
@@ -496,8 +496,8 @@ vc4_create_shader_bo_ioctl(struct drm_device *dev, void *data,
        }
        bo = vc4_bo_create(dev, args->size, true);
-        if (!bo)
+        if (IS_ERR(bo))
-                return -ENOMEM;
+                return PTR_ERR(bo);
        ret = copy_from_user(bo->base.vaddr,
                             (void __user *)(uintptr_t)args->data,
diff --git a/drivers/gpu/drm/vc4/vc4_drv.h b/drivers/gpu/drm/vc4/vc4_drv.h
index 080865ec2bae..51a63330d4f8 100644
--- a/drivers/gpu/drm/vc4/vc4_drv.h
+++ b/drivers/gpu/drm/vc4/vc4_drv.h
@@ -91,8 +91,12 @@ struct vc4_dev {
        struct vc4_bo *overflow_mem;
        struct work_struct overflow_mem_work;
+        int power_refcount;
+        /* Mutex controlling the power refcount. */
+        struct mutex power_lock;
        struct {
-                uint32_t last_ct0ca, last_ct1ca;
                struct timer_list timer;
                struct work_struct reset_work;
        } hangcheck;
@@ -142,6 +146,7 @@ struct vc4_seqno_cb {
 };
 struct vc4_v3d {
+        struct vc4_dev *vc4;
        struct platform_device *pdev;
        void __iomem *regs;
 };
@@ -192,6 +197,11 @@ struct vc4_exec_info {
        /* Sequence number for this bin/render job. */
        uint64_t seqno;
+        /* Last current addresses the hardware was processing when the
+         * hangcheck timer checked on us.
+         */
+        uint32_t last_ct0ca, last_ct1ca;
        /* Kernel-space copy of the ioctl arguments */
        struct drm_vc4_submit_cl *args;
@@ -434,7 +444,6 @@ void vc4_plane_async_set_fb(struct drm_plane *plane,
 extern struct platform_driver vc4_v3d_driver;
 int vc4_v3d_debugfs_ident(struct seq_file *m, void *unused);
 int vc4_v3d_debugfs_regs(struct seq_file *m, void *unused);
-int vc4_v3d_set_power(struct vc4_dev *vc4, bool on);
 /* vc4_validate.c */
 int
diff --git a/drivers/gpu/drm/vc4/vc4_gem.c b/drivers/gpu/drm/vc4/vc4_gem.c
index 48ce30a6f4b5..202aa1544acc 100644
--- a/drivers/gpu/drm/vc4/vc4_gem.c
+++ b/drivers/gpu/drm/vc4/vc4_gem.c
@@ -23,6 +23,7 @@
 #include <linux/module.h>
 #include <linux/platform_device.h>
+#include <linux/pm_runtime.h>
 #include <linux/device.h>
 #include <linux/io.h>
@@ -228,8 +229,16 @@ vc4_reset(struct drm_device *dev)
        struct vc4_dev *vc4 = to_vc4_dev(dev);
        DRM_INFO("Resetting GPU.\n");
-        vc4_v3d_set_power(vc4, false);
-        vc4_v3d_set_power(vc4, true);
+        mutex_lock(&vc4->power_lock);
+        if (vc4->power_refcount) {
+                /* Power the device off and back on the by dropping the
+                 * reference on runtime PM.
+                 */
+                pm_runtime_put_sync_suspend(&vc4->v3d->pdev->dev);
+                pm_runtime_get_sync(&vc4->v3d->pdev->dev);
+        }
+        mutex_unlock(&vc4->power_lock);
        vc4_irq_reset(dev);
@@ -257,10 +266,17 @@ vc4_hangcheck_elapsed(unsigned long data)
        struct drm_device *dev = (struct drm_device *)data;
        struct vc4_dev *vc4 = to_vc4_dev(dev);
        uint32_t ct0ca, ct1ca;
+        unsigned long irqflags;
+        struct vc4_exec_info *exec;
+        spin_lock_irqsave(&vc4->job_lock, irqflags);
+        exec = vc4_first_job(vc4);
        /* If idle, we can stop watching for hangs. */
-        if (list_empty(&vc4->job_list))
+        if (!exec) {
+                spin_unlock_irqrestore(&vc4->job_lock, irqflags);
                return;
+        }
        ct0ca = V3D_READ(V3D_CTNCA(0));
        ct1ca = V3D_READ(V3D_CTNCA(1));
@@ -268,14 +284,16 @@ vc4_hangcheck_elapsed(unsigned long data)
        /* If we've made any progress in execution, rearm the timer
         * and wait.
         */
-        if (ct0ca != vc4->hangcheck.last_ct0ca ||
+        if (ct0ca != exec->last_ct0ca || ct1ca != exec->last_ct1ca) {
-            ct1ca != vc4->hangcheck.last_ct1ca) {
+                exec->last_ct0ca = ct0ca;
-                vc4->hangcheck.last_ct0ca = ct0ca;
+                exec->last_ct1ca = ct1ca;
-                vc4->hangcheck.last_ct1ca = ct1ca;
+                spin_unlock_irqrestore(&vc4->job_lock, irqflags);
                vc4_queue_hangcheck(dev);
                return;
        }
+        spin_unlock_irqrestore(&vc4->job_lock, irqflags);
        /* We've gone too long with no progress, reset.  This has to
         * be done from a work struct, since resetting can sleep and
         * this timer hook isn't allowed to.
@@ -340,12 +358,7 @@ vc4_wait_for_seqno(struct drm_device *dev, uint64_t seqno, uint64_t timeout_ns,
        finish_wait(&vc4->job_wait_queue, &wait);
        trace_vc4_wait_for_seqno_end(dev, seqno);
-        if (ret && ret != -ERESTARTSYS) {
+        return ret;
-                DRM_ERROR("timeout waiting for render thread idle\n");
-                return ret;
-        }
-        return 0;
 }
 static void
@@ -578,9 +591,9 @@ vc4_get_bcl(struct drm_device *dev, struct vc4_exec_info *exec)
        }
        bo = vc4_bo_create(dev, exec_size, true);
-        if (!bo) {
+        if (IS_ERR(bo)) {
                DRM_ERROR("Couldn't allocate BO for binning\n");
-                ret = -ENOMEM;
+                ret = PTR_ERR(bo);
                goto fail;
        }
        exec->exec_bo = &bo->base;
@@ -617,6 +630,7 @@ fail:
 static void
 vc4_complete_exec(struct drm_device *dev, struct vc4_exec_info *exec)
 {
+        struct vc4_dev *vc4 = to_vc4_dev(dev);
        unsigned i;
        /* Need the struct lock for drm_gem_object_unreference(). */
@@ -635,6 +649,11 @@ vc4_complete_exec(struct drm_device *dev, struct vc4_exec_info *exec)
        }
        mutex_unlock(&dev->struct_mutex);
+        mutex_lock(&vc4->power_lock);
+        if (--vc4->power_refcount == 0)
+                pm_runtime_put(&vc4->v3d->pdev->dev);
+        mutex_unlock(&vc4->power_lock);
        kfree(exec);
 }
@@ -746,6 +765,9 @@ vc4_wait_bo_ioctl(struct drm_device *dev, void *data,
        struct drm_gem_object *gem_obj;
        struct vc4_bo *bo;
+        if (args->pad != 0)
+                return -EINVAL;
        gem_obj = drm_gem_object_lookup(dev, file_priv, args->handle);
        if (!gem_obj) {
                DRM_ERROR("Failed to look up GEM BO %d\n", args->handle);
@@ -772,7 +794,7 @@ vc4_submit_cl_ioctl(struct drm_device *dev, void *data,
        struct vc4_dev *vc4 = to_vc4_dev(dev);
        struct drm_vc4_submit_cl *args = data;
        struct vc4_exec_info *exec;
-        int ret;
+        int ret = 0;
        if ((args->flags & ~VC4_SUBMIT_CL_USE_CLEAR_COLOR) != 0) {
                DRM_ERROR("Unknown flags: 0x%02x\n", args->flags);
@@ -785,6 +807,15 @@ vc4_submit_cl_ioctl(struct drm_device *dev, void *data,
                return -ENOMEM;
        }
+        mutex_lock(&vc4->power_lock);
+        if (vc4->power_refcount++ == 0)
+                ret = pm_runtime_get_sync(&vc4->v3d->pdev->dev);
+        mutex_unlock(&vc4->power_lock);
+        if (ret < 0) {
+                kfree(exec);
+                return ret;
+        }
        exec->args = args;
        INIT_LIST_HEAD(&exec->unref_list);
@@ -839,6 +870,8 @@ vc4_gem_init(struct drm_device *dev)
                    (unsigned long)dev);
        INIT_WORK(&vc4->job_done_work, vc4_job_done_work);
+        mutex_init(&vc4->power_lock);
 }
 void
diff --git a/drivers/gpu/drm/vc4/vc4_irq.c b/drivers/gpu/drm/vc4/vc4_irq.c
index b68060e758db..78a21357fb2d 100644
--- a/drivers/gpu/drm/vc4/vc4_irq.c
+++ b/drivers/gpu/drm/vc4/vc4_irq.c
@@ -57,7 +57,7 @@ vc4_overflow_mem_work(struct work_struct *work)
        struct vc4_bo *bo;
        bo = vc4_bo_create(dev, 256 * 1024, true);
-        if (!bo) {
+        if (IS_ERR(bo)) {
                DRM_ERROR("Couldn't allocate binner overflow mem\n");
                return;
        }
diff --git a/drivers/gpu/drm/vc4/vc4_render_cl.c b/drivers/gpu/drm/vc4/vc4_render_cl.c
index 8a2a312e2c1b..0f12418725e5 100644
--- a/drivers/gpu/drm/vc4/vc4_render_cl.c
+++ b/drivers/gpu/drm/vc4/vc4_render_cl.c
@@ -316,20 +316,11 @@ static int vc4_create_rcl_bo(struct drm_device *dev, struct vc4_exec_info *exec,
        size += xtiles * ytiles * loop_body_size;
        setup->rcl = &vc4_bo_create(dev, size, true)->base;
-        if (!setup->rcl)
+        if (IS_ERR(setup->rcl))
-                return -ENOMEM;
+                return PTR_ERR(setup->rcl);
        list_add_tail(&to_vc4_bo(&setup->rcl->base)->unref_head,
                      &exec->unref_list);
-        rcl_u8(setup, VC4_PACKET_TILE_RENDERING_MODE_CONFIG);
-        rcl_u32(setup,
-                (setup->color_write ? (setup->color_write->paddr +
-                                       args->color_write.offset) :
-                 0));
-        rcl_u16(setup, args->width);
-        rcl_u16(setup, args->height);
-        rcl_u16(setup, args->color_write.bits);
        /* The tile buffer gets cleared when the previous tile is stored.  If
         * the clear values changed between frames, then the tile buffer has
         * stale clear values in it, so we have to do a store in None mode (no
@@ -349,6 +340,15 @@ static int vc4_create_rcl_bo(struct drm_device *dev, struct vc4_exec_info *exec,
                rcl_u32(setup, 0); /* no address, since we're in None mode */
        }
+        rcl_u8(setup, VC4_PACKET_TILE_RENDERING_MODE_CONFIG);
+        rcl_u32(setup,
+                (setup->color_write ? (setup->color_write->paddr +
+                                       args->color_write.offset) :
+                 0));
+        rcl_u16(setup, args->width);
+        rcl_u16(setup, args->height);
+        rcl_u16(setup, args->color_write.bits);
        for (y = min_y_tile; y <= max_y_tile; y++) {
                for (x = min_x_tile; x <= max_x_tile; x++) {
                        bool first = (x == min_x_tile && y == min_y_tile);
diff --git a/drivers/gpu/drm/vc4/vc4_v3d.c b/drivers/gpu/drm/vc4/vc4_v3d.c
index 314ff71db978..31de5d17bc85 100644
--- a/drivers/gpu/drm/vc4/vc4_v3d.c
+++ b/drivers/gpu/drm/vc4/vc4_v3d.c
@@ -17,6 +17,7 @@
 */
 #include "linux/component.h"
+#include "linux/pm_runtime.h"
 #include "vc4_drv.h"
 #include "vc4_regs.h"
@@ -144,18 +145,6 @@ int vc4_v3d_debugfs_ident(struct seq_file *m, void *unused)
 }
 #endif /* CONFIG_DEBUG_FS */
-int
-vc4_v3d_set_power(struct vc4_dev *vc4, bool on)
-{
-        /* XXX: This interface is needed for GPU reset, and the way to
-         * do it is to turn our power domain off and back on.  We
-         * can't just reset from within the driver, because the reset
-         * bits are in the power domain's register area, and get set
-         * during the poweron process.
-         */
-        return 0;
-}
 static void vc4_v3d_init_hw(struct drm_device *dev)
 {
        struct vc4_dev *vc4 = to_vc4_dev(dev);
@@ -167,6 +156,29 @@ static void vc4_v3d_init_hw(struct drm_device *dev)
        V3D_WRITE(V3D_VPMBASE, 0);
 }
+#ifdef CONFIG_PM
+static int vc4_v3d_runtime_suspend(struct device *dev)
+{
+        struct vc4_v3d *v3d = dev_get_drvdata(dev);
+        struct vc4_dev *vc4 = v3d->vc4;
+        vc4_irq_uninstall(vc4->dev);
+        return 0;
+}
+static int vc4_v3d_runtime_resume(struct device *dev)
+{
+        struct vc4_v3d *v3d = dev_get_drvdata(dev);
+        struct vc4_dev *vc4 = v3d->vc4;
+        vc4_v3d_init_hw(vc4->dev);
+        vc4_irq_postinstall(vc4->dev);
+        return 0;
+}
+#endif
 static int vc4_v3d_bind(struct device *dev, struct device *master, void *data)
 {
        struct platform_device *pdev = to_platform_device(dev);
@@ -179,6 +191,8 @@ static int vc4_v3d_bind(struct device *dev, struct device *master, void *data)
        if (!v3d)
                return -ENOMEM;
+        dev_set_drvdata(dev, v3d);
        v3d->pdev = pdev;
        v3d->regs = vc4_ioremap_regs(pdev, 0);
@@ -186,6 +200,7 @@ static int vc4_v3d_bind(struct device *dev, struct device *master, void *data)
                return PTR_ERR(v3d->regs);
        vc4->v3d = v3d;
+        v3d->vc4 = vc4;
        if (V3D_READ(V3D_IDENT0) != V3D_EXPECTED_IDENT0) {
                DRM_ERROR("V3D_IDENT0 read 0x%08x instead of 0x%08x\n",
@@ -207,6 +222,8 @@ static int vc4_v3d_bind(struct device *dev, struct device *master, void *data)
                return ret;
        }
+        pm_runtime_enable(dev);
        return 0;
 }
@@ -216,6 +233,8 @@ static void vc4_v3d_unbind(struct device *dev, struct device *master,
        struct drm_device *drm = dev_get_drvdata(master);
        struct vc4_dev *vc4 = to_vc4_dev(drm);
+        pm_runtime_disable(dev);
        drm_irq_uninstall(drm);
        /* Disable the binner's overflow memory address, so the next
@@ -228,6 +247,10 @@ static void vc4_v3d_unbind(struct device *dev, struct device *master,
        vc4->v3d = NULL;
 }
+static const struct dev_pm_ops vc4_v3d_pm_ops = {
+        SET_RUNTIME_PM_OPS(vc4_v3d_runtime_suspend, vc4_v3d_runtime_resume, NULL)
+};
 static const struct component_ops vc4_v3d_ops = {
        .bind   = vc4_v3d_bind,
        .unbind = vc4_v3d_unbind,
@@ -255,5 +278,6 @@ struct platform_driver vc4_v3d_driver = {
        .driver = {
                .name = "vc4_v3d",
                .of_match_table = vc4_v3d_dt_match,
+                .pm = &vc4_v3d_pm_ops,
        },
 };
diff --git a/drivers/gpu/drm/vc4/vc4_validate.c b/drivers/gpu/drm/vc4/vc4_validate.c
index e26d9f6face3..24c2c746e8f3 100644
--- a/drivers/gpu/drm/vc4/vc4_validate.c
+++ b/drivers/gpu/drm/vc4/vc4_validate.c
@@ -401,8 +401,8 @@ validate_tile_binning_config(VALIDATE_ARGS)
        tile_bo = vc4_bo_create(dev, exec->tile_alloc_offset + tile_alloc_size,
                                true);
        exec->tile_bo = &tile_bo->base;
-        if (!exec->tile_bo)
+        if (IS_ERR(exec->tile_bo))
-                return -ENOMEM;
+                return PTR_ERR(exec->tile_bo);
        list_add_tail(&tile_bo->unref_head, &exec->unref_list);
        /* tile alloc address. */
diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
index 62a400c5ba06..fb092f3f11cb 100644
--- a/drivers/iommu/dmar.c
+++ b/drivers/iommu/dmar.c
@@ -1353,7 +1353,7 @@ void dmar_disable_qi(struct intel_iommu *iommu)
        raw_spin_lock_irqsave(&iommu->register_lock, flags);
-        sts =  dmar_readq(iommu->reg + DMAR_GSTS_REG);
+        sts =  readl(iommu->reg + DMAR_GSTS_REG);
        if (!(sts & DMA_GSTS_QIES))
                goto end;
diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c
index 50464833d0b8..d9939fa9b588 100644
--- a/drivers/iommu/intel-svm.c
+++ b/drivers/iommu/intel-svm.c
@@ -249,12 +249,30 @@ static void intel_flush_pasid_dev(struct intel_svm *svm, struct intel_svm_dev *s
 static void intel_mm_release(struct mmu_notifier *mn, struct mm_struct *mm)
 {
        struct intel_svm *svm = container_of(mn, struct intel_svm, notifier);
+        struct intel_svm_dev *sdev;
+        /* This might end up being called from exit_mmap(), *before* the page
+         * tables are cleared. And __mmu_notifier_release() will delete us from
+         * the list of notifiers so that our invalidate_range() callback doesn't
+         * get called when the page tables are cleared. So we need to protect
+         * against hardware accessing those page tables.
+         *
+         * We do it by clearing the entry in the PASID table and then flushing
+         * the IOTLB and the PASID table caches. This might upset hardware;
+         * perhaps we'll want to point the PASID to a dummy PGD (like the zero
+         * page) so that we end up taking a fault that the hardware really
+         * *has* to handle gracefully without affecting other processes.
+         */
        svm->iommu->pasid_table[svm->pasid].val = 0;
+        wmb();
+        rcu_read_lock();
+        list_for_each_entry_rcu(sdev, &svm->devs, list) {
+                intel_flush_pasid_dev(svm, sdev, svm->pasid);
+                intel_flush_svm_range_dev(svm, sdev, 0, -1, 0, !svm->mm);
+        }
+        rcu_read_unlock();
-        /* There's no need to do any flush because we can't get here if there
-         * are any devices left anyway. */
-        WARN_ON(!list_empty(&svm->devs));
 }
 static const struct mmu_notifier_ops intel_mmuops = {
@@ -379,7 +397,6 @@ int intel_svm_bind_mm(struct device *dev, int *pasid, int flags, struct svm_dev_
                                goto out;
                        }
                        iommu->pasid_table[svm->pasid].val = (u64)__pa(mm->pgd) | 1;
-                        mm = NULL;
                } else
                        iommu->pasid_table[svm->pasid].val = (u64)__pa(init_mm.pgd) | 1 | (1ULL << 11);
                wmb();
@@ -442,11 +459,11 @@ int intel_svm_unbind_mm(struct device *dev, int pasid)
                                kfree_rcu(sdev, rcu);
                                if (list_empty(&svm->devs)) {
-                                        mmu_notifier_unregister(&svm->notifier, svm->mm);
                                        idr_remove(&svm->iommu->pasid_idr, svm->pasid);
                                        if (svm->mm)
-                                                mmput(svm->mm);
+                                                mmu_notifier_unregister(&svm->notifier, svm->mm);
                                        /* We mandate that no page faults may be outstanding
                                         * for the PASID when intel_svm_unbind_mm() is called.
                                         * If that is not obeyed, subtle errors will happen.
@@ -507,6 +524,10 @@ static irqreturn_t prq_event_thread(int irq, void *d)
        struct intel_svm *svm = NULL;
        int head, tail, handled = 0;
+        /* Clear PPR bit before reading head/tail registers, to
+         * ensure that we get a new interrupt if needed. */
+        writel(DMA_PRS_PPR, iommu->reg + DMAR_PRS_REG);
        tail = dmar_readq(iommu->reg + DMAR_PQT_REG) & PRQ_RING_MASK;
        head = dmar_readq(iommu->reg + DMAR_PQH_REG) & PRQ_RING_MASK;
        while (head != tail) {
@@ -551,6 +572,9 @@ static irqreturn_t prq_event_thread(int irq, void *d)
                 * any faults on kernel addresses. */
                if (!svm->mm)
                        goto bad_req;
+                /* If the mm is already defunct, don't handle faults. */
+                if (!atomic_inc_not_zero(&svm->mm->mm_users))
+                        goto bad_req;
                down_read(&svm->mm->mmap_sem);
                vma = find_extend_vma(svm->mm, address);
                if (!vma || address < vma->vm_start)
@@ -567,6 +591,7 @@ static irqreturn_t prq_event_thread(int irq, void *d)
                result = QI_RESP_SUCCESS;
        invalid:
                up_read(&svm->mm->mmap_sem);
+                mmput(svm->mm);
        bad_req:
                /* Accounting for major/minor faults? */
                rcu_read_lock();
diff --git a/drivers/iommu/intel_irq_remapping.c b/drivers/iommu/intel_irq_remapping.c
index c12ba4516df2..ac596928f6b4 100644
--- a/drivers/iommu/intel_irq_remapping.c
+++ b/drivers/iommu/intel_irq_remapping.c
@@ -629,7 +629,7 @@ static void iommu_disable_irq_remapping(struct intel_iommu *iommu)
        raw_spin_lock_irqsave(&iommu->register_lock, flags);
-        sts = dmar_readq(iommu->reg + DMAR_GSTS_REG);
+        sts = readl(iommu->reg + DMAR_GSTS_REG);
        if (!(sts & DMA_GSTS_IRES))
                goto end;
diff --git a/drivers/lightnvm/core.c b/drivers/lightnvm/core.c
index 33224cb91c5b..9f6acd5d1d2e 100644
--- a/drivers/lightnvm/core.c
+++ b/drivers/lightnvm/core.c
@@ -572,11 +572,13 @@ int nvm_register(struct request_queue *q, char *disk_name,
                }
        }
-        ret = nvm_get_sysblock(dev, &dev->sb);
+        if (dev->identity.cap & NVM_ID_DCAP_BBLKMGMT) {
-        if (!ret)
+                ret = nvm_get_sysblock(dev, &dev->sb);
-                pr_err("nvm: device not initialized.\n");
+                if (!ret)
-        else if (ret < 0)
+                        pr_err("nvm: device not initialized.\n");
-                pr_err("nvm: err (%d) on device initialization\n", ret);
+                else if (ret < 0)
+                        pr_err("nvm: err (%d) on device initialization\n", ret);
+        }
        /* register device with a supported media manager */
        down_write(&nvm_lock);
@@ -1055,9 +1057,11 @@ static long __nvm_ioctl_dev_init(struct nvm_ioctl_dev_init *init)
        strncpy(info.mmtype, init->mmtype, NVM_MMTYPE_LEN);
        info.fs_ppa.ppa = -1;
-        ret = nvm_init_sysblock(dev, &info);
+        if (dev->identity.cap & NVM_ID_DCAP_BBLKMGMT) {
-        if (ret)
+                ret = nvm_init_sysblock(dev, &info);
-                return ret;
+                if (ret)
+                        return ret;
+        }
        memcpy(&dev->sb, &info, sizeof(struct nvm_sb_info));
@@ -1117,7 +1121,10 @@ static long nvm_ioctl_dev_factory(struct file *file, void __user *arg)
                dev->mt = NULL;
        }
-        return nvm_dev_factory(dev, fact.flags);
+        if (dev->identity.cap & NVM_ID_DCAP_BBLKMGMT)
+                return nvm_dev_factory(dev, fact.flags);
+        return 0;
 }
 static long nvm_ctl_ioctl(struct file *file, uint cmd, unsigned long arg)
diff --git a/drivers/lightnvm/rrpc.c b/drivers/lightnvm/rrpc.c
index d8c75958ced3..307db1ea22de 100644
--- a/drivers/lightnvm/rrpc.c
+++ b/drivers/lightnvm/rrpc.c
@@ -300,8 +300,10 @@ static int rrpc_move_valid_pages(struct rrpc *rrpc, struct rrpc_block *rblk)
        }
        page = mempool_alloc(rrpc->page_pool, GFP_NOIO);
-        if (!page)
+        if (!page) {
+                bio_put(bio);
                return -ENOMEM;
+        }
        while ((slot = find_first_zero_bit(rblk->invalid_pages,
                                            nr_pgs_per_blk)) < nr_pgs_per_blk) {
diff --git a/drivers/lightnvm/rrpc.h b/drivers/lightnvm/rrpc.h
index ef13ac7700c8..f7b37336353f 100644
--- a/drivers/lightnvm/rrpc.h
+++ b/drivers/lightnvm/rrpc.h
@@ -174,8 +174,7 @@ static inline sector_t rrpc_get_sector(sector_t laddr)
 static inline int request_intersects(struct rrpc_inflight_rq *r,
                                sector_t laddr_start, sector_t laddr_end)
 {
-        return (laddr_end >= r->l_start && laddr_end <= r->l_end) &&
+        return (laddr_end >= r->l_start) && (laddr_start <= r->l_end);
-                (laddr_start >= r->l_start && laddr_start <= r->l_end);
 }
 static int __rrpc_lock_laddr(struct rrpc *rrpc, sector_t laddr,
@@ -184,6 +183,8 @@ static int __rrpc_lock_laddr(struct rrpc *rrpc, sector_t laddr,
        sector_t laddr_end = laddr + pages - 1;
        struct rrpc_inflight_rq *rtmp;
+        WARN_ON(irqs_disabled());
        spin_lock_irq(&rrpc->inflights.lock);
        list_for_each_entry(rtmp, &rrpc->inflights.reqs, list) {
                if (unlikely(request_intersects(rtmp, laddr, laddr_end))) {
diff --git a/drivers/nvme/host/Kconfig b/drivers/nvme/host/Kconfig
index 5d6237391dcd..b586d84f2518 100644
--- a/drivers/nvme/host/Kconfig
+++ b/drivers/nvme/host/Kconfig
@@ -17,5 +17,6 @@ config BLK_DEV_NVME_SCSI
          and block devices nodes, as well a a translation for a small
          number of selected SCSI commands to NVMe commands to the NVMe
          driver.  If you don't know what this means you probably want
-          to say N here, and if you know what it means you probably
+          to say N here, unless you run a distro that abuses the SCSI
-          want to say N as well.
+          emulation to provide stable device names for mount by id, like
+          some OpenSuSE and SLES versions.
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index c5bf001af559..3cd921e6121e 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -1121,7 +1121,6 @@ static void nvme_alloc_ns(struct nvme_ctrl *ctrl, unsigned nsid)
        ns->queue = blk_mq_init_queue(ctrl->tagset);
        if (IS_ERR(ns->queue))
                goto out_free_ns;
-        queue_flag_set_unlocked(QUEUE_FLAG_NOMERGES, ns->queue);
        queue_flag_set_unlocked(QUEUE_FLAG_NONROT, ns->queue);
        ns->queue->queuedata = ns;
        ns->ctrl = ctrl;
diff --git a/drivers/nvme/host/lightnvm.c b/drivers/nvme/host/lightnvm.c
index 5cd3725e2fa4..6bb15e4926dc 100644
--- a/drivers/nvme/host/lightnvm.c
+++ b/drivers/nvme/host/lightnvm.c
@@ -146,9 +146,10 @@ struct nvme_nvm_command {
        };
 };
+#define NVME_NVM_LP_MLC_PAIRS 886
 struct nvme_nvm_lp_mlc {
        __u16                   num_pairs;
-        __u8                    pairs[886];
+        __u8                    pairs[NVME_NVM_LP_MLC_PAIRS];
 };
 struct nvme_nvm_lp_tbl {
@@ -282,9 +283,14 @@ static int init_grps(struct nvm_id *nvm_id, struct nvme_nvm_id *nvme_nvm_id)
                        memcpy(dst->lptbl.id, src->lptbl.id, 8);
                        dst->lptbl.mlc.num_pairs =
                                        le16_to_cpu(src->lptbl.mlc.num_pairs);
-                        /* 4 bits per pair */
+                        if (dst->lptbl.mlc.num_pairs > NVME_NVM_LP_MLC_PAIRS) {
+                                pr_err("nvm: number of MLC pairs not supported\n");
+                                return -EINVAL;
+                        }
                        memcpy(dst->lptbl.mlc.pairs, src->lptbl.mlc.pairs,
-                                                dst->lptbl.mlc.num_pairs >> 1);
+                                                dst->lptbl.mlc.num_pairs);
                }
        }
diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
index 4fb5bb737868..9664d07d807d 100644
--- a/drivers/nvme/host/nvme.h
+++ b/drivers/nvme/host/nvme.h
@@ -139,9 +139,9 @@ static inline bool nvme_io_incapable(struct nvme_ctrl *ctrl)
        u32 val = 0;
        if (ctrl->ops->io_incapable(ctrl))
-                return false;
+                return true;
        if (ctrl->ops->reg_read32(ctrl, NVME_REG_CSTS, &val))
-                return false;
+                return true;
        return val & NVME_CSTS_CFS;
 }
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 72ef8322d32a..a128672472ec 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -678,6 +678,11 @@ static int nvme_queue_rq(struct blk_mq_hw_ctx *hctx,
        blk_mq_start_request(req);
        spin_lock_irq(&nvmeq->q_lock);
+        if (unlikely(nvmeq->cq_vector < 0)) {
+                ret = BLK_MQ_RQ_QUEUE_BUSY;
+                spin_unlock_irq(&nvmeq->q_lock);
+                goto out;
+        }
        __nvme_submit_cmd(nvmeq, &cmnd);
        nvme_process_cq(nvmeq);
        spin_unlock_irq(&nvmeq->q_lock);
@@ -999,7 +1004,7 @@ static void nvme_cancel_queue_ios(struct request *req, void *data, bool reserved
        if (!blk_mq_request_started(req))
                return;
-        dev_warn(nvmeq->q_dmadev,
+        dev_dbg_ratelimited(nvmeq->q_dmadev,
                 "Cancelling I/O %d QID %d\n", req->tag, nvmeq->qid);
        status = NVME_SC_ABORT_REQ;
@@ -2111,16 +2116,12 @@ static void nvme_remove(struct pci_dev *pdev)
 {
        struct nvme_dev *dev = pci_get_drvdata(pdev);
-        spin_lock(&dev_list_lock);
-        list_del_init(&dev->node);
-        spin_unlock(&dev_list_lock);
        pci_set_drvdata(pdev, NULL);
-        flush_work(&dev->reset_work);
        flush_work(&dev->scan_work);
        nvme_remove_namespaces(&dev->ctrl);
        nvme_uninit_ctrl(&dev->ctrl);
        nvme_dev_disable(dev, true);
+        flush_work(&dev->reset_work);
        nvme_dev_remove_admin(dev);
        nvme_free_queues(dev, 0);
        nvme_release_cmb(dev);
diff --git a/drivers/of/irq.c b/drivers/of/irq.c
index 7ee21ae305ae..e7bfc175b8e1 100644
--- a/drivers/of/irq.c
+++ b/drivers/of/irq.c
@@ -635,6 +635,13 @@ static u32 __of_msi_map_rid(struct device *dev, struct device_node **np,
                msi_base = be32_to_cpup(msi_map + 2);
                rid_len = be32_to_cpup(msi_map + 3);
+                if (rid_base & ~map_mask) {
+                        dev_err(parent_dev,
+                                "Invalid msi-map translation - msi-map-mask (0x%x) ignores rid-base (0x%x)\n",
+                                map_mask, rid_base);
+                        return rid_out;
+                }
                msi_controller_node = of_find_node_by_phandle(phandle);
                matched = (masked_rid >= rid_base &&
@@ -654,7 +661,7 @@ static u32 __of_msi_map_rid(struct device *dev, struct device_node **np,
        if (!matched)
                return rid_out;
-        rid_out = masked_rid + msi_base;
+        rid_out = masked_rid - rid_base + msi_base;
        dev_dbg(dev,
                "msi-map at: %s, using mask %08x, rid-base: %08x, msi-base: %08x, length: %08x, rid: %08x -> %08x\n",
                dev_name(parent_dev), map_mask, rid_base, msi_base,
diff --git a/drivers/pinctrl/mediatek/pinctrl-mtk-common.c b/drivers/pinctrl/mediatek/pinctrl-mtk-common.c
index 16d48a4ed225..e96e86d2e745 100644
--- a/drivers/pinctrl/mediatek/pinctrl-mtk-common.c
+++ b/drivers/pinctrl/mediatek/pinctrl-mtk-common.c
@@ -347,6 +347,7 @@ static int mtk_pconf_parse_conf(struct pinctrl_dev *pctldev,
                ret = mtk_pconf_set_pull_select(pctl, pin, true, false, arg);
                break;
        case PIN_CONFIG_INPUT_ENABLE:
+                mtk_pmx_gpio_set_direction(pctldev, NULL, pin, true);
                ret = mtk_pconf_set_ies_smt(pctl, pin, arg, param);
                break;
        case PIN_CONFIG_OUTPUT:
@@ -354,6 +355,7 @@ static int mtk_pconf_parse_conf(struct pinctrl_dev *pctldev,
                ret = mtk_pmx_gpio_set_direction(pctldev, NULL, pin, false);
                break;
        case PIN_CONFIG_INPUT_SCHMITT_ENABLE:
+                mtk_pmx_gpio_set_direction(pctldev, NULL, pin, true);
                ret = mtk_pconf_set_ies_smt(pctl, pin, arg, param);
                break;
        case PIN_CONFIG_DRIVE_STRENGTH:
diff --git a/drivers/pinctrl/mvebu/pinctrl-mvebu.c b/drivers/pinctrl/mvebu/pinctrl-mvebu.c
index e4d473811bb3..3ef798fac81b 100644
--- a/drivers/pinctrl/mvebu/pinctrl-mvebu.c
+++ b/drivers/pinctrl/mvebu/pinctrl-mvebu.c
@@ -666,16 +666,19 @@ int mvebu_pinctrl_probe(struct platform_device *pdev)
                struct mvebu_mpp_ctrl_setting *set = &mode->settings[0];
                struct mvebu_pinctrl_group *grp;
                unsigned num_settings;
+                unsigned supp_settings;
-                for (num_settings = 0; ; set++) {
+                for (num_settings = 0, supp_settings = 0; ; set++) {
                        if (!set->name)
                                break;
+                        num_settings++;
                        /* skip unsupported settings for this variant */
                        if (pctl->variant && !(pctl->variant & set->variant))
                                continue;
-                        num_settings++;
+                        supp_settings++;
                        /* find gpio/gpo/gpi settings */
                        if (strcmp(set->name, "gpio") == 0)
@@ -688,7 +691,7 @@ int mvebu_pinctrl_probe(struct platform_device *pdev)
                }
                /* skip modes with no settings for this variant */
-                if (!num_settings)
+                if (!supp_settings)
                        continue;
                grp = mvebu_pinctrl_find_group_by_pid(pctl, mode->pid);
diff --git a/drivers/pinctrl/nomadik/pinctrl-abx500.c b/drivers/pinctrl/nomadik/pinctrl-abx500.c
index 085e60106ec2..1f7469c9857d 100644
--- a/drivers/pinctrl/nomadik/pinctrl-abx500.c
+++ b/drivers/pinctrl/nomadik/pinctrl-abx500.c
@@ -191,6 +191,7 @@ static void abx500_gpio_set(struct gpio_chip *chip, unsigned offset, int val)
                dev_err(pct->dev, "%s write failed (%d)\n", __func__, ret);
 }
+#ifdef CONFIG_DEBUG_FS
 static int abx500_get_pull_updown(struct abx500_pinctrl *pct, int offset,
                                  enum abx500_gpio_pull_updown *pull_updown)
 {
@@ -226,6 +227,7 @@ out:
        return ret;
 }
+#endif
 static int abx500_set_pull_updown(struct abx500_pinctrl *pct,
                                  int offset, enum abx500_gpio_pull_updown val)
@@ -468,6 +470,7 @@ out:
        return ret;
 }
+#ifdef CONFIG_DEBUG_FS
 static int abx500_get_mode(struct pinctrl_dev *pctldev, struct gpio_chip *chip,
                          unsigned gpio)
 {
@@ -553,8 +556,6 @@ out:
        return ret;
 }
-#ifdef CONFIG_DEBUG_FS
 #include <linux/seq_file.h>
 static void abx500_gpio_dbg_show_one(struct seq_file *s,
diff --git a/drivers/pinctrl/pxa/pinctrl-pxa2xx.c b/drivers/pinctrl/pxa/pinctrl-pxa2xx.c
index d90e205cf809..216f227c6009 100644
--- a/drivers/pinctrl/pxa/pinctrl-pxa2xx.c
+++ b/drivers/pinctrl/pxa/pinctrl-pxa2xx.c
@@ -426,6 +426,7 @@ int pxa2xx_pinctrl_init(struct platform_device *pdev,
        return 0;
 }
+EXPORT_SYMBOL(pxa2xx_pinctrl_init);
 int pxa2xx_pinctrl_exit(struct platform_device *pdev)
 {
diff --git a/drivers/pinctrl/samsung/pinctrl-samsung.c b/drivers/pinctrl/samsung/pinctrl-samsung.c
index f67b1e958589..5cc97f85db02 100644
--- a/drivers/pinctrl/samsung/pinctrl-samsung.c
+++ b/drivers/pinctrl/samsung/pinctrl-samsung.c
@@ -514,25 +514,35 @@ static const struct pinconf_ops samsung_pinconf_ops = {
        .pin_config_group_set   = samsung_pinconf_group_set,
 };
-/* gpiolib gpio_set callback function */
+/*
-static void samsung_gpio_set(struct gpio_chip *gc, unsigned offset, int value)
+ * The samsung_gpio_set_vlaue() should be called with "bank->slock" held
+ * to avoid race condition.
+ */
+static void samsung_gpio_set_value(struct gpio_chip *gc,
+                                          unsigned offset, int value)
 {
        struct samsung_pin_bank *bank = gpiochip_get_data(gc);
        const struct samsung_pin_bank_type *type = bank->type;
-        unsigned long flags;
        void __iomem *reg;
        u32 data;
        reg = bank->drvdata->virt_base + bank->pctl_offset;
-        spin_lock_irqsave(&bank->slock, flags);
        data = readl(reg + type->reg_offset[PINCFG_TYPE_DAT]);
        data &= ~(1 << offset);
        if (value)
                data |= 1 << offset;
        writel(data, reg + type->reg_offset[PINCFG_TYPE_DAT]);
+}
+/* gpiolib gpio_set callback function */
+static void samsung_gpio_set(struct gpio_chip *gc, unsigned offset, int value)
+{
+        struct samsung_pin_bank *bank = gpiochip_get_data(gc);
+        unsigned long flags;
+        spin_lock_irqsave(&bank->slock, flags);
+        samsung_gpio_set_value(gc, offset, value);
        spin_unlock_irqrestore(&bank->slock, flags);
 }
@@ -553,6 +563,8 @@ static int samsung_gpio_get(struct gpio_chip *gc, unsigned offset)
 }
 /*
+ * The samsung_gpio_set_direction() should be called with "bank->slock" held
+ * to avoid race condition.
 * The calls to gpio_direction_output() and gpio_direction_input()
 * leads to this function call.
 */
@@ -564,7 +576,6 @@ static int samsung_gpio_set_direction(struct gpio_chip *gc,
        struct samsung_pinctrl_drv_data *drvdata;
        void __iomem *reg;
        u32 data, mask, shift;
-        unsigned long flags;
        bank = gpiochip_get_data(gc);
        type = bank->type;
@@ -581,31 +592,42 @@ static int samsung_gpio_set_direction(struct gpio_chip *gc,
                reg += 4;
        }
-        spin_lock_irqsave(&bank->slock, flags);
        data = readl(reg);
        data &= ~(mask << shift);
        if (!input)
                data |= FUNC_OUTPUT << shift;
        writel(data, reg);
-        spin_unlock_irqrestore(&bank->slock, flags);
        return 0;
 }
 /* gpiolib gpio_direction_input callback function. */
 static int samsung_gpio_direction_input(struct gpio_chip *gc, unsigned offset)
 {
-        return samsung_gpio_set_direction(gc, offset, true);
+        struct samsung_pin_bank *bank = gpiochip_get_data(gc);
+        unsigned long flags;
+        int ret;
+        spin_lock_irqsave(&bank->slock, flags);
+        ret = samsung_gpio_set_direction(gc, offset, true);
+        spin_unlock_irqrestore(&bank->slock, flags);
+        return ret;
 }
 /* gpiolib gpio_direction_output callback function. */
 static int samsung_gpio_direction_output(struct gpio_chip *gc, unsigned offset,
                                                        int value)
 {
-        samsung_gpio_set(gc, offset, value);
+        struct samsung_pin_bank *bank = gpiochip_get_data(gc);
-        return samsung_gpio_set_direction(gc, offset, false);
+        unsigned long flags;
+        int ret;
+        spin_lock_irqsave(&bank->slock, flags);
+        samsung_gpio_set_value(gc, offset, value);
+        ret = samsung_gpio_set_direction(gc, offset, false);
+        spin_unlock_irqrestore(&bank->slock, flags);
+        return ret;
 }
 /*
diff --git a/drivers/pinctrl/sunxi/pinctrl-sun8i-h3.c b/drivers/pinctrl/sunxi/pinctrl-sun8i-h3.c
index 77d4cf047cee..11760bbe9d51 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sun8i-h3.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sun8i-h3.c
@@ -492,6 +492,7 @@ static const struct sunxi_pinctrl_desc sun8i_h3_pinctrl_data = {
        .pins = sun8i_h3_pins,
        .npins = ARRAY_SIZE(sun8i_h3_pins),
        .irq_banks = 2,
+        .irq_read_needs_mux = true
 };
 static int sun8i_h3_pinctrl_probe(struct platform_device *pdev)
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index 41605dac8309..c78db05e75b1 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -3035,6 +3035,7 @@ static void dasd_setup_queue(struct dasd_block *block)
                max = block->base->discipline->max_blocks << block->s2b_shift;
        }
        queue_flag_set_unlocked(QUEUE_FLAG_NONROT, block->request_queue);
+        block->request_queue->limits.max_dev_sectors = max;
        blk_queue_logical_block_size(block->request_queue,
                                     block->bp_block);
        blk_queue_max_hw_sectors(block->request_queue, max);
diff --git a/drivers/s390/block/dasd_alias.c b/drivers/s390/block/dasd_alias.c
index 184b1dbeb554..286782c60da4 100644
--- a/drivers/s390/block/dasd_alias.c
+++ b/drivers/s390/block/dasd_alias.c
@@ -264,8 +264,10 @@ void dasd_alias_disconnect_device_from_lcu(struct dasd_device *device)
                spin_unlock_irqrestore(&lcu->lock, flags);
                cancel_work_sync(&lcu->suc_data.worker);
                spin_lock_irqsave(&lcu->lock, flags);
-                if (device == lcu->suc_data.device)
+                if (device == lcu->suc_data.device) {
+                        dasd_put_device(device);
                        lcu->suc_data.device = NULL;
+                }
        }
        was_pending = 0;
        if (device == lcu->ruac_data.device) {
@@ -273,8 +275,10 @@ void dasd_alias_disconnect_device_from_lcu(struct dasd_device *device)
                was_pending = 1;
                cancel_delayed_work_sync(&lcu->ruac_data.dwork);
                spin_lock_irqsave(&lcu->lock, flags);
-                if (device == lcu->ruac_data.device)
+                if (device == lcu->ruac_data.device) {
+                        dasd_put_device(device);
                        lcu->ruac_data.device = NULL;
+                }
        }
        private->lcu = NULL;
        spin_unlock_irqrestore(&lcu->lock, flags);
@@ -549,8 +553,10 @@ static void lcu_update_work(struct work_struct *work)
        if ((rc && (rc != -EOPNOTSUPP)) || (lcu->flags & NEED_UAC_UPDATE)) {
                DBF_DEV_EVENT(DBF_WARNING, device, "could not update"
                            " alias data in lcu (rc = %d), retry later", rc);
-                schedule_delayed_work(&lcu->ruac_data.dwork, 30*HZ);
+                if (!schedule_delayed_work(&lcu->ruac_data.dwork, 30*HZ))
+                        dasd_put_device(device);
        } else {
+                dasd_put_device(device);
                lcu->ruac_data.device = NULL;
                lcu->flags &= ~UPDATE_PENDING;
        }
@@ -593,8 +599,10 @@ static int _schedule_lcu_update(struct alias_lcu *lcu,
         */
        if (!usedev)
                return -EINVAL;
+        dasd_get_device(usedev);
        lcu->ruac_data.device = usedev;
-        schedule_delayed_work(&lcu->ruac_data.dwork, 0);
+        if (!schedule_delayed_work(&lcu->ruac_data.dwork, 0))
+                dasd_put_device(usedev);
        return 0;
 }
@@ -723,7 +731,7 @@ static int reset_summary_unit_check(struct alias_lcu *lcu,
        ASCEBC((char *) &cqr->magic, 4);
        ccw = cqr->cpaddr;
        ccw->cmd_code = DASD_ECKD_CCW_RSCK;
-        ccw->flags = 0 ;
+        ccw->flags = CCW_FLAG_SLI;
        ccw->count = 16;
        ccw->cda = (__u32)(addr_t) cqr->data;
        ((char *)cqr->data)[0] = reason;
@@ -930,6 +938,7 @@ static void summary_unit_check_handling_work(struct work_struct *work)
        /* 3. read new alias configuration */
        _schedule_lcu_update(lcu, device);
        lcu->suc_data.device = NULL;
+        dasd_put_device(device);
        spin_unlock_irqrestore(&lcu->lock, flags);
 }
@@ -989,6 +998,8 @@ void dasd_alias_handle_summary_unit_check(struct dasd_device *device,
        }
        lcu->suc_data.reason = reason;
        lcu->suc_data.device = device;
+        dasd_get_device(device);
        spin_unlock(&lcu->lock);
-        schedule_work(&lcu->suc_data.worker);
+        if (!schedule_work(&lcu->suc_data.worker))
+                dasd_put_device(device);
 };
diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
index da2e068ee47d..bbfbfd9e5aa3 100644
--- a/drivers/scsi/scsi_devinfo.c
+++ b/drivers/scsi/scsi_devinfo.c
@@ -206,6 +206,7 @@ static struct {
        {"iRiver", "iFP Mass Driver", NULL, BLIST_NOT_LOCKABLE | BLIST_INQUIRY_36},
        {"LASOUND", "CDX7405", "3.10", BLIST_MAX5LUN | BLIST_SINGLELUN},
        {"Marvell", "Console", NULL, BLIST_SKIP_VPD_PAGES},
+        {"Marvell", "91xx Config", "1.01", BLIST_SKIP_VPD_PAGES},
        {"MATSHITA", "PD-1", NULL, BLIST_FORCELUN | BLIST_SINGLELUN},
        {"MATSHITA", "DMC-LC5", NULL, BLIST_NOT_LOCKABLE | BLIST_INQUIRY_36},
        {"MATSHITA", "DMC-LC40", NULL, BLIST_NOT_LOCKABLE | BLIST_INQUIRY_36},
diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index 4f18a851e2c7..00bc7218a7f8 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -1272,16 +1272,18 @@ static void __scsi_remove_target(struct scsi_target *starget)
 void scsi_remove_target(struct device *dev)
 {
        struct Scsi_Host *shost = dev_to_shost(dev->parent);
-        struct scsi_target *starget;
+        struct scsi_target *starget, *last_target = NULL;
        unsigned long flags;
 restart:
        spin_lock_irqsave(shost->host_lock, flags);
        list_for_each_entry(starget, &shost->__targets, siblings) {
-                if (starget->state == STARGET_DEL)
+                if (starget->state == STARGET_DEL ||
+                    starget == last_target)
                        continue;
                if (starget->dev.parent == dev || &starget->dev == dev) {
                        kref_get(&starget->reap_ref);
+                        last_target = starget;
                        spin_unlock_irqrestore(shost->host_lock, flags);
                        __scsi_remove_target(starget);
                        scsi_target_reap(starget);
diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c
index aebad36391c9..8feac599e9ab 100644
--- a/drivers/spi/spi-atmel.c
+++ b/drivers/spi/spi-atmel.c
@@ -1571,6 +1571,7 @@ static int atmel_spi_probe(struct platform_device *pdev)
        as->use_cs_gpios = true;
        if (atmel_spi_is_v2(as) &&
+            pdev->dev.of_node &&
            !of_get_property(pdev->dev.of_node, "cs-gpios", NULL)) {
                as->use_cs_gpios = false;
                master->num_chipselect = 4;
diff --git a/drivers/spi/spi-bcm2835aux.c b/drivers/spi/spi-bcm2835aux.c
index 7de6f8472a81..ecc73c0a97cf 100644
--- a/drivers/spi/spi-bcm2835aux.c
+++ b/drivers/spi/spi-bcm2835aux.c
@@ -73,8 +73,8 @@
 /* Bitfields in CNTL1 */
 #define BCM2835_AUX_SPI_CNTL1_CSHIGH    0x00000700
-#define BCM2835_AUX_SPI_CNTL1_IDLE      0x00000080
+#define BCM2835_AUX_SPI_CNTL1_TXEMPTY   0x00000080
-#define BCM2835_AUX_SPI_CNTL1_TXEMPTY   0x00000040
+#define BCM2835_AUX_SPI_CNTL1_IDLE      0x00000040
 #define BCM2835_AUX_SPI_CNTL1_MSBF_IN   0x00000002
 #define BCM2835_AUX_SPI_CNTL1_KEEP_IN   0x00000001
diff --git a/drivers/spi/spi-fsl-espi.c b/drivers/spi/spi-fsl-espi.c
index 7fd6a4c009d2..7cb0c1921495 100644
--- a/drivers/spi/spi-fsl-espi.c
+++ b/drivers/spi/spi-fsl-espi.c
@@ -84,7 +84,7 @@ struct fsl_espi_transfer {
 /* SPCOM register values */
 #define SPCOM_CS(x)             ((x) << 30)
 #define SPCOM_TRANLEN(x)        ((x) << 0)
-#define SPCOM_TRANLEN_MAX       0xFFFF  /* Max transaction length */
+#define SPCOM_TRANLEN_MAX       0x10000 /* Max transaction length */
 #define AUTOSUSPEND_TIMEOUT 2000
@@ -233,7 +233,7 @@ static int fsl_espi_bufs(struct spi_device *spi, struct spi_transfer *t)
        reinit_completion(&mpc8xxx_spi->done);
        /* Set SPCOM[CS] and SPCOM[TRANLEN] field */
-        if ((t->len - 1) > SPCOM_TRANLEN_MAX) {
+        if (t->len > SPCOM_TRANLEN_MAX) {
                dev_err(mpc8xxx_spi->dev, "Transaction length (%d)"
                                " beyond the SPCOM[TRANLEN] field\n", t->len);
                return -EINVAL;
diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
index d98c33cb64f9..6a4ff27f4357 100644
--- a/drivers/spi/spi-imx.c
+++ b/drivers/spi/spi-imx.c
@@ -929,7 +929,7 @@ static int spi_imx_dma_transfer(struct spi_imx_data *spi_imx,
                                        tx->sgl, tx->nents, DMA_MEM_TO_DEV,
                                        DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
                if (!desc_tx)
-                        goto no_dma;
+                        goto tx_nodma;
                desc_tx->callback = spi_imx_dma_tx_callback;
                desc_tx->callback_param = (void *)spi_imx;
@@ -941,7 +941,7 @@ static int spi_imx_dma_transfer(struct spi_imx_data *spi_imx,
                                        rx->sgl, rx->nents, DMA_DEV_TO_MEM,
                                        DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
                if (!desc_rx)
-                        goto no_dma;
+                        goto rx_nodma;
                desc_rx->callback = spi_imx_dma_rx_callback;
                desc_rx->callback_param = (void *)spi_imx;
@@ -1008,7 +1008,9 @@ static int spi_imx_dma_transfer(struct spi_imx_data *spi_imx,
        return ret;
-no_dma:
+rx_nodma:
+        dmaengine_terminate_all(master->dma_tx);
+tx_nodma:
        pr_warn_once("%s %s: DMA not available, falling back to PIO\n",
                     dev_driver_string(&master->dev),
                     dev_name(&master->dev));
diff --git a/drivers/spi/spi-loopback-test.c b/drivers/spi/spi-loopback-test.c
index 894616f687b0..cf4bb36bee25 100644
--- a/drivers/spi/spi-loopback-test.c
+++ b/drivers/spi/spi-loopback-test.c
@@ -761,6 +761,7 @@ static int spi_test_run_iter(struct spi_device *spi,
                test.iterate_transfer_mask = 1;
        /* count number of transfers with tx/rx_buf != NULL */
+        rx_count = tx_count = 0;
        for (i = 0; i < test.transfer_count; i++) {
                if (test.transfers[i].tx_buf)
                        tx_count++;
diff --git a/drivers/spi/spi-omap2-mcspi.c b/drivers/spi/spi-omap2-mcspi.c
index 7273820275e9..0caa3c8bef46 100644
--- a/drivers/spi/spi-omap2-mcspi.c
+++ b/drivers/spi/spi-omap2-mcspi.c
@@ -1490,6 +1490,8 @@ static int omap2_mcspi_probe(struct platform_device *pdev)
        return status;
 disable_pm:
+        pm_runtime_dont_use_autosuspend(&pdev->dev);
+        pm_runtime_put_sync(&pdev->dev);
        pm_runtime_disable(&pdev->dev);
 free_master:
        spi_master_put(master);
@@ -1501,6 +1503,7 @@ static int omap2_mcspi_remove(struct platform_device *pdev)
        struct spi_master *master = platform_get_drvdata(pdev);
        struct omap2_mcspi *mcspi = spi_master_get_devdata(master);
+        pm_runtime_dont_use_autosuspend(mcspi->dev);
        pm_runtime_put_sync(mcspi->dev);
        pm_runtime_disable(&pdev->dev);
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 151b7c71b868..d96f5cf38a2d 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -7986,6 +7986,7 @@ static void btrfs_endio_direct_read(struct bio *bio)
        kfree(dip);
+        dio_bio->bi_error = bio->bi_error;
        dio_end_io(dio_bio, bio->bi_error);
        if (io_bio->end_io)
@@ -8040,6 +8041,7 @@ static void btrfs_endio_direct_write(struct bio *bio)
        kfree(dip);
+        dio_bio->bi_error = bio->bi_error;
        dio_end_io(dio_bio, bio->bi_error);
        bio_put(bio);
 }
diff --git a/fs/cifs/cifs_dfs_ref.c b/fs/cifs/cifs_dfs_ref.c
index 7dc886c9a78f..e956cba94338 100644
--- a/fs/cifs/cifs_dfs_ref.c
+++ b/fs/cifs/cifs_dfs_ref.c
@@ -175,7 +175,7 @@ char *cifs_compose_mount_options(const char *sb_mountdata,
         * string to the length of the original string to allow for worst case.
         */
        md_len = strlen(sb_mountdata) + INET6_ADDRSTRLEN;
-        mountdata = kzalloc(md_len + 1, GFP_KERNEL);
+        mountdata = kzalloc(md_len + sizeof("ip=") + 1, GFP_KERNEL);
        if (mountdata == NULL) {
                rc = -ENOMEM;
                goto compose_mount_options_err;
diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c
index afa09fce8151..e682b36a210f 100644
--- a/fs/cifs/cifsencrypt.c
+++ b/fs/cifs/cifsencrypt.c
@@ -714,7 +714,7 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, const struct nls_table *nls_cp)
        ses->auth_key.response = kmalloc(baselen + tilen, GFP_KERNEL);
        if (!ses->auth_key.response) {
-                rc = ENOMEM;
+                rc = -ENOMEM;
                ses->auth_key.len = 0;
                goto setup_ntlmv2_rsp_ret;
        }
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 4fbd92d2e113..a763cd3d9e7c 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -2999,8 +2999,7 @@ ip_rfc1001_connect(struct TCP_Server_Info *server)
        if (ses_init_buf) {
                ses_init_buf->trailer.session_req.called_len = 32;
-                if (server->server_RFC1001_name &&
+                if (server->server_RFC1001_name[0] != 0)
-                    server->server_RFC1001_name[0] != 0)
                        rfc1002mangle(ses_init_buf->trailer.
                                      session_req.called_name,
                                      server->server_RFC1001_name,
diff --git a/fs/direct-io.c b/fs/direct-io.c
index 1b2f7ffc8b84..d6a9012d42ad 100644
--- a/fs/direct-io.c
+++ b/fs/direct-io.c
@@ -472,8 +472,8 @@ static int dio_bio_complete(struct dio *dio, struct bio *bio)
                dio->io_error = -EIO;
        if (dio->is_async && dio->rw == READ && dio->should_dirty) {
-                bio_check_pages_dirty(bio);     /* transfers ownership */
                err = bio->bi_error;
+                bio_check_pages_dirty(bio);     /* transfers ownership */
        } else {
                bio_for_each_segment_all(bvec, bio, i) {
                        struct page *page = bvec->bv_page;
diff --git a/fs/efivarfs/file.c b/fs/efivarfs/file.c
index c424e4813ec8..d48e0d261d78 100644
--- a/fs/efivarfs/file.c
+++ b/fs/efivarfs/file.c
@@ -10,6 +10,7 @@
 #include <linux/efi.h>
 #include <linux/fs.h>
 #include <linux/slab.h>
+#include <linux/mount.h>
 #include "internal.h"
@@ -103,9 +104,78 @@ out_free:
        return size;
 }
+static int
+efivarfs_ioc_getxflags(struct file *file, void __user *arg)
+{
+        struct inode *inode = file->f_mapping->host;
+        unsigned int i_flags;
+        unsigned int flags = 0;
+        i_flags = inode->i_flags;
+        if (i_flags & S_IMMUTABLE)
+                flags |= FS_IMMUTABLE_FL;
+        if (copy_to_user(arg, &flags, sizeof(flags)))
+                return -EFAULT;
+        return 0;
+}
+static int
+efivarfs_ioc_setxflags(struct file *file, void __user *arg)
+{
+        struct inode *inode = file->f_mapping->host;
+        unsigned int flags;
+        unsigned int i_flags = 0;
+        int error;
+        if (!inode_owner_or_capable(inode))
+                return -EACCES;
+        if (copy_from_user(&flags, arg, sizeof(flags)))
+                return -EFAULT;
+        if (flags & ~FS_IMMUTABLE_FL)
+                return -EOPNOTSUPP;
+        if (!capable(CAP_LINUX_IMMUTABLE))
+                return -EPERM;
+        if (flags & FS_IMMUTABLE_FL)
+                i_flags |= S_IMMUTABLE;
+        error = mnt_want_write_file(file);
+        if (error)
+                return error;
+        inode_lock(inode);
+        inode_set_flags(inode, i_flags, S_IMMUTABLE);
+        inode_unlock(inode);
+        mnt_drop_write_file(file);
+        return 0;
+}
+long
+efivarfs_file_ioctl(struct file *file, unsigned int cmd, unsigned long p)
+{
+        void __user *arg = (void __user *)p;
+        switch (cmd) {
+        case FS_IOC_GETFLAGS:
+                return efivarfs_ioc_getxflags(file, arg);
+        case FS_IOC_SETFLAGS:
+                return efivarfs_ioc_setxflags(file, arg);
+        }
+        return -ENOTTY;
+}
 const struct file_operations efivarfs_file_operations = {
        .open   = simple_open,
        .read   = efivarfs_file_read,
        .write  = efivarfs_file_write,
        .llseek = no_llseek,
+        .unlocked_ioctl = efivarfs_file_ioctl,
 };
diff --git a/fs/efivarfs/inode.c b/fs/efivarfs/inode.c
index 3381b9da9ee6..e2ab6d0497f2 100644
--- a/fs/efivarfs/inode.c
+++ b/fs/efivarfs/inode.c
@@ -15,7 +15,8 @@
 #include "internal.h"
 struct inode *efivarfs_get_inode(struct super_block *sb,
-                                const struct inode *dir, int mode, dev_t dev)
+                                const struct inode *dir, int mode,
+                                dev_t dev, bool is_removable)
 {
        struct inode *inode = new_inode(sb);
@@ -23,6 +24,7 @@ struct inode *efivarfs_get_inode(struct super_block *sb,
                inode->i_ino = get_next_ino();
                inode->i_mode = mode;
                inode->i_atime = inode->i_mtime = inode->i_ctime = CURRENT_TIME;
+                inode->i_flags = is_removable ? 0 : S_IMMUTABLE;
                switch (mode & S_IFMT) {
                case S_IFREG:
                        inode->i_fop = &efivarfs_file_operations;
@@ -102,22 +104,17 @@ static void efivarfs_hex_to_guid(const char *str, efi_guid_t *guid)
 static int efivarfs_create(struct inode *dir, struct dentry *dentry,
                          umode_t mode, bool excl)
 {
-        struct inode *inode;
+        struct inode *inode = NULL;
        struct efivar_entry *var;
        int namelen, i = 0, err = 0;
+        bool is_removable = false;
        if (!efivarfs_valid_name(dentry->d_name.name, dentry->d_name.len))
                return -EINVAL;
-        inode = efivarfs_get_inode(dir->i_sb, dir, mode, 0);
-        if (!inode)
-                return -ENOMEM;
        var = kzalloc(sizeof(struct efivar_entry), GFP_KERNEL);
-        if (!var) {
+        if (!var)
-                err = -ENOMEM;
+                return -ENOMEM;
-                goto out;
-        }
        /* length of the variable name itself: remove GUID and separator */
        namelen = dentry->d_name.len - EFI_VARIABLE_GUID_LEN - 1;
@@ -125,6 +122,16 @@ static int efivarfs_create(struct inode *dir, struct dentry *dentry,
        efivarfs_hex_to_guid(dentry->d_name.name + namelen + 1,
                        &var->var.VendorGuid);
+        if (efivar_variable_is_removable(var->var.VendorGuid,
+                                         dentry->d_name.name, namelen))
+                is_removable = true;
+        inode = efivarfs_get_inode(dir->i_sb, dir, mode, 0, is_removable);
+        if (!inode) {
+                err = -ENOMEM;
+                goto out;
+        }
        for (i = 0; i < namelen; i++)
                var->var.VariableName[i] = dentry->d_name.name[i];
@@ -138,7 +145,8 @@ static int efivarfs_create(struct inode *dir, struct dentry *dentry,
 out:
        if (err) {
                kfree(var);
-                iput(inode);
+                if (inode)
+                        iput(inode);
        }
        return err;
 }
diff --git a/fs/efivarfs/internal.h b/fs/efivarfs/internal.h
index b5ff16addb7c..b4505188e799 100644
--- a/fs/efivarfs/internal.h
+++ b/fs/efivarfs/internal.h
@@ -15,7 +15,8 @@ extern const struct file_operations efivarfs_file_operations;
 extern const struct inode_operations efivarfs_dir_inode_operations;
 extern bool efivarfs_valid_name(const char *str, int len);
 extern struct inode *efivarfs_get_inode(struct super_block *sb,
-                        const struct inode *dir, int mode, dev_t dev);
+                        const struct inode *dir, int mode, dev_t dev,
+                        bool is_removable);
 extern struct list_head efivarfs_list;
diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c
index b8a564f29107..dd029d13ea61 100644
--- a/fs/efivarfs/super.c
+++ b/fs/efivarfs/super.c
@@ -118,8 +118,9 @@ static int efivarfs_callback(efi_char16_t *name16, efi_guid_t vendor,
        struct dentry *dentry, *root = sb->s_root;
        unsigned long size = 0;
        char *name;
-        int len, i;
+        int len;
        int err = -ENOMEM;
+        bool is_removable = false;
        entry = kzalloc(sizeof(*entry), GFP_KERNEL);
        if (!entry)
@@ -128,15 +129,17 @@ static int efivarfs_callback(efi_char16_t *name16, efi_guid_t vendor,
        memcpy(entry->var.VariableName, name16, name_size);
        memcpy(&(entry->var.VendorGuid), &vendor, sizeof(efi_guid_t));
-        len = ucs2_strlen(entry->var.VariableName);
+        len = ucs2_utf8size(entry->var.VariableName);
        /* name, plus '-', plus GUID, plus NUL*/
        name = kmalloc(len + 1 + EFI_VARIABLE_GUID_LEN + 1, GFP_KERNEL);
        if (!name)
                goto fail;
-        for (i = 0; i < len; i++)
+        ucs2_as_utf8(name, entry->var.VariableName, len);
-                name[i] = entry->var.VariableName[i] & 0xFF;
+        if (efivar_variable_is_removable(entry->var.VendorGuid, name, len))
+                is_removable = true;
        name[len] = '-';
@@ -144,7 +147,8 @@ static int efivarfs_callback(efi_char16_t *name16, efi_guid_t vendor,
        name[len + EFI_VARIABLE_GUID_LEN+1] = '\0';
-        inode = efivarfs_get_inode(sb, d_inode(root), S_IFREG | 0644, 0);
+        inode = efivarfs_get_inode(sb, d_inode(root), S_IFREG | 0644, 0,
+                                   is_removable);
        if (!inode)
                goto fail_name;
@@ -200,7 +204,7 @@ static int efivarfs_fill_super(struct super_block *sb, void *data, int silent)
        sb->s_d_op              = &efivarfs_d_ops;
        sb->s_time_gran         = 1;
-        inode = efivarfs_get_inode(sb, NULL, S_IFDIR | 0755, 0);
+        inode = efivarfs_get_inode(sb, NULL, S_IFDIR | 0755, 0, true);
        if (!inode)
                return -ENOMEM;
        inode->i_op = &efivarfs_dir_inode_operations;
diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
index ec0668a60678..fe1f50fe764f 100644
--- a/fs/ext4/balloc.c
+++ b/fs/ext4/balloc.c
@@ -191,7 +191,6 @@ static int ext4_init_block_bitmap(struct super_block *sb,
        /* If checksum is bad mark all blocks used to prevent allocation
         * essentially implementing a per-group read-only flag. */
        if (!ext4_group_desc_csum_verify(sb, block_group, gdp)) {
-                ext4_error(sb, "Checksum bad for group %u", block_group);
                grp = ext4_get_group_info(sb, block_group);
                if (!EXT4_MB_GRP_BBITMAP_CORRUPT(grp))
                        percpu_counter_sub(&sbi->s_freeclusters_counter,
@@ -442,14 +441,16 @@ ext4_read_block_bitmap_nowait(struct super_block *sb, ext4_group_t block_group)
        }
        ext4_lock_group(sb, block_group);
        if (desc->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT)) {
                err = ext4_init_block_bitmap(sb, bh, block_group, desc);
                set_bitmap_uptodate(bh);
                set_buffer_uptodate(bh);
                ext4_unlock_group(sb, block_group);
                unlock_buffer(bh);
-                if (err)
+                if (err) {
+                        ext4_error(sb, "Failed to init block bitmap for group "
+                                   "%u: %d", block_group, err);
                        goto out;
+                }
                goto verify;
        }
        ext4_unlock_group(sb, block_group);
diff --git a/fs/ext4/crypto.c b/fs/ext4/crypto.c
index c8021208a7eb..38f7562489bb 100644
--- a/fs/ext4/crypto.c
+++ b/fs/ext4/crypto.c
@@ -467,3 +467,59 @@ uint32_t ext4_validate_encryption_key_size(uint32_t mode, uint32_t size)
                return size;
        return 0;
 }
+/*
+ * Validate dentries for encrypted directories to make sure we aren't
+ * potentially caching stale data after a key has been added or
+ * removed.
+ */
+static int ext4_d_revalidate(struct dentry *dentry, unsigned int flags)
+{
+        struct inode *dir = d_inode(dentry->d_parent);
+        struct ext4_crypt_info *ci = EXT4_I(dir)->i_crypt_info;
+        int dir_has_key, cached_with_key;
+        if (!ext4_encrypted_inode(dir))
+                return 0;
+        if (ci && ci->ci_keyring_key &&
+            (ci->ci_keyring_key->flags & ((1 << KEY_FLAG_INVALIDATED) |
+                                          (1 << KEY_FLAG_REVOKED) |
+                                          (1 << KEY_FLAG_DEAD))))
+                ci = NULL;
+        /* this should eventually be an flag in d_flags */
+        cached_with_key = dentry->d_fsdata != NULL;
+        dir_has_key = (ci != NULL);
+        /*
+         * If the dentry was cached without the key, and it is a
+         * negative dentry, it might be a valid name.  We can't check
+         * if the key has since been made available due to locking
+         * reasons, so we fail the validation so ext4_lookup() can do
+         * this check.
+         *
+         * We also fail the validation if the dentry was created with
+         * the key present, but we no longer have the key, or vice versa.
+         */
+        if ((!cached_with_key && d_is_negative(dentry)) ||
+            (!cached_with_key && dir_has_key) ||
+            (cached_with_key && !dir_has_key)) {
+#if 0                           /* Revalidation debug */
+                char buf[80];
+                char *cp = simple_dname(dentry, buf, sizeof(buf));
+                if (IS_ERR(cp))
+                        cp = (char *) "???";
+                pr_err("revalidate: %s %p %d %d %d\n", cp, dentry->d_fsdata,
+                       cached_with_key, d_is_negative(dentry),
+                       dir_has_key);
+#endif
+                return 0;
+        }
+        return 1;
+}
+const struct dentry_operations ext4_encrypted_d_ops = {
+        .d_revalidate = ext4_d_revalidate,
+};
diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c
index 1d1bca74f844..33f5e2a50cf8 100644
--- a/fs/ext4/dir.c
+++ b/fs/ext4/dir.c
@@ -111,6 +111,12 @@ static int ext4_readdir(struct file *file, struct dir_context *ctx)
        int dir_has_error = 0;
        struct ext4_str fname_crypto_str = {.name = NULL, .len = 0};
+        if (ext4_encrypted_inode(inode)) {
+                err = ext4_get_encryption_info(inode);
+                if (err && err != -ENOKEY)
+                        return err;
+        }
        if (is_dx_dir(inode)) {
                err = ext4_dx_readdir(file, ctx);
                if (err != ERR_BAD_DX_DIR) {
@@ -157,8 +163,11 @@ static int ext4_readdir(struct file *file, struct dir_context *ctx)
                                        index, 1);
                        file->f_ra.prev_pos = (loff_t)index << PAGE_CACHE_SHIFT;
                        bh = ext4_bread(NULL, inode, map.m_lblk, 0);
-                        if (IS_ERR(bh))
+                        if (IS_ERR(bh)) {
-                                return PTR_ERR(bh);
+                                err = PTR_ERR(bh);
+                                bh = NULL;
+                                goto errout;
+                        }
                }
                if (!bh) {
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index 0662b285dc8a..157b458a69d4 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -2302,6 +2302,7 @@ struct page *ext4_encrypt(struct inode *inode,
 int ext4_decrypt(struct page *page);
 int ext4_encrypted_zeroout(struct inode *inode, ext4_lblk_t lblk,
                           ext4_fsblk_t pblk, ext4_lblk_t len);
+extern const struct dentry_operations ext4_encrypted_d_ops;
 #ifdef CONFIG_EXT4_FS_ENCRYPTION
 int ext4_init_crypto(void);
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 0ffabaf90aa5..3753ceb0b0dd 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -3928,7 +3928,7 @@ static int
 convert_initialized_extent(handle_t *handle, struct inode *inode,
                           struct ext4_map_blocks *map,
                           struct ext4_ext_path **ppath, int flags,
-                           unsigned int allocated, ext4_fsblk_t newblock)
+                           unsigned int allocated)
 {
        struct ext4_ext_path *path = *ppath;
        struct ext4_extent *ex;
@@ -4347,7 +4347,7 @@ int ext4_ext_map_blocks(handle_t *handle, struct inode *inode,
                            (flags & EXT4_GET_BLOCKS_CONVERT_UNWRITTEN)) {
                                allocated = convert_initialized_extent(
                                                handle, inode, map, &path,
-                                                flags, allocated, newblock);
+                                                flags, allocated);
                                goto out2;
                        } else if (!ext4_ext_is_unwritten(ex))
                                goto out;
diff --git a/fs/ext4/file.c b/fs/ext4/file.c
index 1126436dada1..474f1a4d2ca8 100644
--- a/fs/ext4/file.c
+++ b/fs/ext4/file.c
@@ -350,6 +350,7 @@ static int ext4_file_open(struct inode * inode, struct file * filp)
        struct super_block *sb = inode->i_sb;
        struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
        struct vfsmount *mnt = filp->f_path.mnt;
+        struct inode *dir = filp->f_path.dentry->d_parent->d_inode;
        struct path path;
        char buf[64], *cp;
        int ret;
@@ -393,6 +394,14 @@ static int ext4_file_open(struct inode * inode, struct file * filp)
                if (ext4_encryption_info(inode) == NULL)
                        return -ENOKEY;
        }
+        if (ext4_encrypted_inode(dir) &&
+            !ext4_is_child_context_consistent_with_parent(dir, inode)) {
+                ext4_warning(inode->i_sb,
+                             "Inconsistent encryption contexts: %lu/%lu\n",
+                             (unsigned long) dir->i_ino,
+                             (unsigned long) inode->i_ino);
+                return -EPERM;
+        }
        /*
         * Set up the jbd2_inode if we are opening the inode for
         * writing and the journal is present
diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
index 3fcfd50a2e8a..acc0ad56bf2f 100644
--- a/fs/ext4/ialloc.c
+++ b/fs/ext4/ialloc.c
@@ -76,7 +76,6 @@ static int ext4_init_inode_bitmap(struct super_block *sb,
        /* If checksum is bad mark all blocks and inodes use to prevent
         * allocation, essentially implementing a per-group read-only flag. */
        if (!ext4_group_desc_csum_verify(sb, block_group, gdp)) {
-                ext4_error(sb, "Checksum bad for group %u", block_group);
                grp = ext4_get_group_info(sb, block_group);
                if (!EXT4_MB_GRP_BBITMAP_CORRUPT(grp))
                        percpu_counter_sub(&sbi->s_freeclusters_counter,
@@ -191,8 +190,11 @@ ext4_read_inode_bitmap(struct super_block *sb, ext4_group_t block_group)
                set_buffer_verified(bh);
                ext4_unlock_group(sb, block_group);
                unlock_buffer(bh);
-                if (err)
+                if (err) {
+                        ext4_error(sb, "Failed to init inode bitmap for group "
+                                   "%u: %d", block_group, err);
                        goto out;
+                }
                return bh;
        }
        ext4_unlock_group(sb, block_group);
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 83bc8bfb3bea..9cc57c3b4661 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -686,6 +686,34 @@ out_sem:
        return retval;
 }
+/*
+ * Update EXT4_MAP_FLAGS in bh->b_state. For buffer heads attached to pages
+ * we have to be careful as someone else may be manipulating b_state as well.
+ */
+static void ext4_update_bh_state(struct buffer_head *bh, unsigned long flags)
+{
+        unsigned long old_state;
+        unsigned long new_state;
+        flags &= EXT4_MAP_FLAGS;
+        /* Dummy buffer_head? Set non-atomically. */
+        if (!bh->b_page) {
+                bh->b_state = (bh->b_state & ~EXT4_MAP_FLAGS) | flags;
+                return;
+        }
+        /*
+         * Someone else may be modifying b_state. Be careful! This is ugly but
+         * once we get rid of using bh as a container for mapping information
+         * to pass to / from get_block functions, this can go away.
+         */
+        do {
+                old_state = READ_ONCE(bh->b_state);
+                new_state = (old_state & ~EXT4_MAP_FLAGS) | flags;
+        } while (unlikely(
+                 cmpxchg(&bh->b_state, old_state, new_state) != old_state));
+}
 /* Maximum number of blocks we map for direct IO at once. */
 #define DIO_MAX_BLOCKS 4096
@@ -722,7 +750,7 @@ static int _ext4_get_block(struct inode *inode, sector_t iblock,
                ext4_io_end_t *io_end = ext4_inode_aio(inode);
                map_bh(bh, inode->i_sb, map.m_pblk);
-                bh->b_state = (bh->b_state & ~EXT4_MAP_FLAGS) | map.m_flags;
+                ext4_update_bh_state(bh, map.m_flags);
                if (io_end && io_end->flag & EXT4_IO_END_UNWRITTEN)
                        set_buffer_defer_completion(bh);
                bh->b_size = inode->i_sb->s_blocksize * map.m_len;
@@ -1685,7 +1713,7 @@ int ext4_da_get_block_prep(struct inode *inode, sector_t iblock,
                return ret;
        map_bh(bh, inode->i_sb, map.m_pblk);
-        bh->b_state = (bh->b_state & ~EXT4_MAP_FLAGS) | map.m_flags;
+        ext4_update_bh_state(bh, map.m_flags);
        if (buffer_unwritten(bh)) {
                /* A delayed write to unwritten bh should be marked
@@ -3253,29 +3281,29 @@ static ssize_t ext4_ext_direct_IO(struct kiocb *iocb, struct iov_iter *iter,
         * case, we allocate an io_end structure to hook to the iocb.
         */
        iocb->private = NULL;
-        ext4_inode_aio_set(inode, NULL);
-        if (!is_sync_kiocb(iocb)) {
-                io_end = ext4_init_io_end(inode, GFP_NOFS);
-                if (!io_end) {
-                        ret = -ENOMEM;
-                        goto retake_lock;
-                }
-                /*
-                 * Grab reference for DIO. Will be dropped in ext4_end_io_dio()
-                 */
-                iocb->private = ext4_get_io_end(io_end);
-                /*
-                 * we save the io structure for current async direct
-                 * IO, so that later ext4_map_blocks() could flag the
-                 * io structure whether there is a unwritten extents
-                 * needs to be converted when IO is completed.
-                 */
-                ext4_inode_aio_set(inode, io_end);
-        }
        if (overwrite) {
                get_block_func = ext4_get_block_overwrite;
        } else {
+                ext4_inode_aio_set(inode, NULL);
+                if (!is_sync_kiocb(iocb)) {
+                        io_end = ext4_init_io_end(inode, GFP_NOFS);
+                        if (!io_end) {
+                                ret = -ENOMEM;
+                                goto retake_lock;
+                        }
+                        /*
+                         * Grab reference for DIO. Will be dropped in
+                         * ext4_end_io_dio()
+                         */
+                        iocb->private = ext4_get_io_end(io_end);
+                        /*
+                         * we save the io structure for current async direct
+                         * IO, so that later ext4_map_blocks() could flag the
+                         * io structure whether there is a unwritten extents
+                         * needs to be converted when IO is completed.
+                         */
+                        ext4_inode_aio_set(inode, io_end);
+                }
                get_block_func = ext4_get_block_write;
                dio_flags = DIO_LOCKING;
        }
diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
index 0f6c36922c24..a99b010e2194 100644
--- a/fs/ext4/ioctl.c
+++ b/fs/ext4/ioctl.c
@@ -208,7 +208,7 @@ static int ext4_ioctl_setflags(struct inode *inode,
 {
        struct ext4_inode_info *ei = EXT4_I(inode);
        handle_t *handle = NULL;
-        int err = EPERM, migrate = 0;
+        int err = -EPERM, migrate = 0;
        struct ext4_iloc iloc;
        unsigned int oldflags, mask, i;
        unsigned int jflag;
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index 61eaf74dca37..4424b7bf8ac6 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -2285,7 +2285,7 @@ static int ext4_mb_seq_groups_show(struct seq_file *seq, void *v)
        if (group == 0)
                seq_puts(seq, "#group: free  frags first ["
                              " 2^0   2^1   2^2   2^3   2^4   2^5   2^6  "
-                              " 2^7   2^8   2^9   2^10  2^11  2^12  2^13  ]");
+                              " 2^7   2^8   2^9   2^10  2^11  2^12  2^13  ]\n");
        i = (sb->s_blocksize_bits + 2) * sizeof(sg.info.bb_counters[0]) +
                sizeof(struct ext4_group_info);
diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c
index fb6f11709ae6..e032a0423e35 100644
--- a/fs/ext4/move_extent.c
+++ b/fs/ext4/move_extent.c
@@ -265,11 +265,12 @@ move_extent_per_page(struct file *o_filp, struct inode *donor_inode,
        ext4_lblk_t orig_blk_offset, donor_blk_offset;
        unsigned long blocksize = orig_inode->i_sb->s_blocksize;
        unsigned int tmp_data_size, data_size, replaced_size;
-        int err2, jblocks, retries = 0;
+        int i, err2, jblocks, retries = 0;
        int replaced_count = 0;
        int from = data_offset_in_page << orig_inode->i_blkbits;
        int blocks_per_page = PAGE_CACHE_SIZE >> orig_inode->i_blkbits;
        struct super_block *sb = orig_inode->i_sb;
+        struct buffer_head *bh = NULL;
        /*
         * It needs twice the amount of ordinary journal buffers because
@@ -380,8 +381,16 @@ data_copy:
        }
        /* Perform all necessary steps similar write_begin()/write_end()
         * but keeping in mind that i_size will not change */
-        *err = __block_write_begin(pagep[0], from, replaced_size,
+        if (!page_has_buffers(pagep[0]))
-                                   ext4_get_block);
+                create_empty_buffers(pagep[0], 1 << orig_inode->i_blkbits, 0);
+        bh = page_buffers(pagep[0]);
+        for (i = 0; i < data_offset_in_page; i++)
+                bh = bh->b_this_page;
+        for (i = 0; i < block_len_in_page; i++) {
+                *err = ext4_get_block(orig_inode, orig_blk_offset + i, bh, 0);
+                if (*err < 0)
+                        break;
+        }
        if (!*err)
                *err = block_commit_write(pagep[0], from, from + replaced_size);
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index 06574dd77614..48e4b8907826 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -1558,6 +1558,24 @@ static struct dentry *ext4_lookup(struct inode *dir, struct dentry *dentry, unsi
        struct ext4_dir_entry_2 *de;
        struct buffer_head *bh;
+       if (ext4_encrypted_inode(dir)) {
+               int res = ext4_get_encryption_info(dir);
+                /*
+                 * This should be a properly defined flag for
+                 * dentry->d_flags when we uplift this to the VFS.
+                 * d_fsdata is set to (void *) 1 if if the dentry is
+                 * created while the directory was encrypted and we
+                 * don't have access to the key.
+                 */
+               dentry->d_fsdata = NULL;
+               if (ext4_encryption_info(dir))
+                       dentry->d_fsdata = (void *) 1;
+               d_set_d_op(dentry, &ext4_encrypted_d_ops);
+               if (res && res != -ENOKEY)
+                       return ERR_PTR(res);
+       }
        if (dentry->d_name.len > EXT4_NAME_LEN)
                return ERR_PTR(-ENAMETOOLONG);
@@ -1585,11 +1603,15 @@ static struct dentry *ext4_lookup(struct inode *dir, struct dentry *dentry, unsi
                        return ERR_PTR(-EFSCORRUPTED);
                }
                if (!IS_ERR(inode) && ext4_encrypted_inode(dir) &&
-                    (S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode) ||
+                    (S_ISDIR(inode->i_mode) || S_ISLNK(inode->i_mode)) &&
-                     S_ISLNK(inode->i_mode)) &&
                    !ext4_is_child_context_consistent_with_parent(dir,
                                                                  inode)) {
+                        int nokey = ext4_encrypted_inode(inode) &&
+                                !ext4_encryption_info(inode);
                        iput(inode);
+                        if (nokey)
+                                return ERR_PTR(-ENOKEY);
                        ext4_warning(inode->i_sb,
                                     "Inconsistent encryption contexts: %lu/%lu\n",
                                     (unsigned long) dir->i_ino,
diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
index ad62d7acc315..34038e3598d5 100644
--- a/fs/ext4/resize.c
+++ b/fs/ext4/resize.c
@@ -198,7 +198,7 @@ static struct ext4_new_flex_group_data *alloc_flex_gd(unsigned long flexbg_size)
        if (flex_gd == NULL)
                goto out3;
-        if (flexbg_size >= UINT_MAX / sizeof(struct ext4_new_flex_group_data))
+        if (flexbg_size >= UINT_MAX / sizeof(struct ext4_new_group_data))
                goto out2;
        flex_gd->count = flexbg_size;
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index 6915c950e6e8..1f76d8950a57 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -317,6 +317,7 @@ static void inode_switch_wbs_work_fn(struct work_struct *work)
        struct inode_switch_wbs_context *isw =
                container_of(work, struct inode_switch_wbs_context, work);
        struct inode *inode = isw->inode;
+        struct super_block *sb = inode->i_sb;
        struct address_space *mapping = inode->i_mapping;
        struct bdi_writeback *old_wb = inode->i_wb;
        struct bdi_writeback *new_wb = isw->new_wb;
@@ -423,6 +424,7 @@ skip_switch:
        wb_put(new_wb);
        iput(inode);
+        deactivate_super(sb);
        kfree(isw);
 }
@@ -469,11 +471,14 @@ static void inode_switch_wbs(struct inode *inode, int new_wb_id)
        /* while holding I_WB_SWITCH, no one else can update the association */
        spin_lock(&inode->i_lock);
        if (inode->i_state & (I_WB_SWITCH | I_FREEING) ||
-            inode_to_wb(inode) == isw->new_wb) {
+            inode_to_wb(inode) == isw->new_wb)
-                spin_unlock(&inode->i_lock);
+                goto out_unlock;
-                goto out_free;
-        }
+        if (!atomic_inc_not_zero(&inode->i_sb->s_active))
+                goto out_unlock;
        inode->i_state |= I_WB_SWITCH;
        spin_unlock(&inode->i_lock);
@@ -489,6 +494,8 @@ static void inode_switch_wbs(struct inode *inode, int new_wb_id)
        call_rcu(&isw->rcu_head, inode_switch_wbs_rcu_fn);
        return;
+out_unlock:
+        spin_unlock(&inode->i_lock);
 out_free:
        if (isw->new_wb)
                wb_put(isw->new_wb);
diff --git a/fs/inode.c b/fs/inode.c
index 9f62db3bcc3e..69b8b526c194 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -154,6 +154,12 @@ int inode_init_always(struct super_block *sb, struct inode *inode)
        inode->i_rdev = 0;
        inode->dirtied_when = 0;
+#ifdef CONFIG_CGROUP_WRITEBACK
+        inode->i_wb_frn_winner = 0;
+        inode->i_wb_frn_avg_time = 0;
+        inode->i_wb_frn_history = 0;
+#endif
        if (security_inode_alloc(inode))
                goto out;
        spin_lock_init(&inode->i_lock);
diff --git a/fs/notify/mark.c b/fs/notify/mark.c
index cfcbf114676e..7115c5d7d373 100644
--- a/fs/notify/mark.c
+++ b/fs/notify/mark.c
@@ -91,7 +91,14 @@
 #include <linux/fsnotify_backend.h>
 #include "fsnotify.h"
+#define FSNOTIFY_REAPER_DELAY   (1)     /* 1 jiffy */
 struct srcu_struct fsnotify_mark_srcu;
+static DEFINE_SPINLOCK(destroy_lock);
+static LIST_HEAD(destroy_list);
+static void fsnotify_mark_destroy(struct work_struct *work);
+static DECLARE_DELAYED_WORK(reaper_work, fsnotify_mark_destroy);
 void fsnotify_get_mark(struct fsnotify_mark *mark)
 {
@@ -165,19 +172,10 @@ void fsnotify_detach_mark(struct fsnotify_mark *mark)
        atomic_dec(&group->num_marks);
 }
-static void
-fsnotify_mark_free_rcu(struct rcu_head *rcu)
-{
-        struct fsnotify_mark    *mark;
-        mark = container_of(rcu, struct fsnotify_mark, g_rcu);
-        fsnotify_put_mark(mark);
-}
 /*
- * Free fsnotify mark. The freeing is actually happening from a call_srcu
+ * Free fsnotify mark. The freeing is actually happening from a kthread which
- * callback. Caller must have a reference to the mark or be protected by
+ * first waits for srcu period end. Caller must have a reference to the mark
- * fsnotify_mark_srcu.
+ * or be protected by fsnotify_mark_srcu.
 */
 void fsnotify_free_mark(struct fsnotify_mark *mark)
 {
@@ -192,7 +190,11 @@ void fsnotify_free_mark(struct fsnotify_mark *mark)
        mark->flags &= ~FSNOTIFY_MARK_FLAG_ALIVE;
        spin_unlock(&mark->lock);
-        call_srcu(&fsnotify_mark_srcu, &mark->g_rcu, fsnotify_mark_free_rcu);
+        spin_lock(&destroy_lock);
+        list_add(&mark->g_list, &destroy_list);
+        spin_unlock(&destroy_lock);
+        queue_delayed_work(system_unbound_wq, &reaper_work,
+                                FSNOTIFY_REAPER_DELAY);
        /*
         * Some groups like to know that marks are being freed.  This is a
@@ -388,7 +390,12 @@ err:
        spin_unlock(&mark->lock);
-        call_srcu(&fsnotify_mark_srcu, &mark->g_rcu, fsnotify_mark_free_rcu);
+        spin_lock(&destroy_lock);
+        list_add(&mark->g_list, &destroy_list);
+        spin_unlock(&destroy_lock);
+        queue_delayed_work(system_unbound_wq, &reaper_work,
+                                FSNOTIFY_REAPER_DELAY);
        return ret;
 }
@@ -491,3 +498,21 @@ void fsnotify_init_mark(struct fsnotify_mark *mark,
        atomic_set(&mark->refcnt, 1);
        mark->free_mark = free_mark;
 }
+static void fsnotify_mark_destroy(struct work_struct *work)
+{
+        struct fsnotify_mark *mark, *next;
+        struct list_head private_destroy_list;
+        spin_lock(&destroy_lock);
+        /* exchange the list head */
+        list_replace_init(&destroy_list, &private_destroy_list);
+        spin_unlock(&destroy_lock);
+        synchronize_srcu(&fsnotify_mark_srcu);
+        list_for_each_entry_safe(mark, next, &private_destroy_list, g_list) {
+                list_del_init(&mark->g_list);
+                fsnotify_put_mark(mark);
+        }
+}
diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
index 0b3c0d39ef75..c370b261c720 100644
--- a/include/asm-generic/pgtable.h
+++ b/include/asm-generic/pgtable.h
@@ -239,6 +239,14 @@ extern void pmdp_invalidate(struct vm_area_struct *vma, unsigned long address,
                            pmd_t *pmdp);
 #endif
+#ifndef __HAVE_ARCH_PMDP_HUGE_SPLIT_PREPARE
+static inline void pmdp_huge_split_prepare(struct vm_area_struct *vma,
+                                           unsigned long address, pmd_t *pmdp)
+{
+}
+#endif
 #ifndef __HAVE_ARCH_PTE_SAME
 static inline int pte_same(pte_t pte_a, pte_t pte_b)
 {
diff --git a/include/drm/drm_crtc.h b/include/drm/drm_crtc.h
index c65a212db77e..c5b4b81a831b 100644
--- a/include/drm/drm_crtc.h
+++ b/include/drm/drm_crtc.h
@@ -1166,6 +1166,7 @@ struct drm_connector {
        struct drm_mode_object base;
        char *name;
+        int connector_id;
        int connector_type;
        int connector_type_id;
        bool interlace_allowed;
@@ -2047,6 +2048,7 @@ struct drm_mode_config {
        struct list_head fb_list;
        int num_connector;
+        struct ida connector_ida;
        struct list_head connector_list;
        int num_encoder;
        struct list_head encoder_list;
@@ -2200,7 +2202,11 @@ int drm_connector_register(struct drm_connector *connector);
 void drm_connector_unregister(struct drm_connector *connector);
 extern void drm_connector_cleanup(struct drm_connector *connector);
-extern unsigned int drm_connector_index(struct drm_connector *connector);
+static inline unsigned drm_connector_index(struct drm_connector *connector)
+{
+        return connector->connector_id;
+}
 /* helper to unplug all connectors from sysfs for device */
 extern void drm_connector_unplug_all(struct drm_device *dev);
diff --git a/include/dt-bindings/clock/tegra210-car.h b/include/dt-bindings/clock/tegra210-car.h
index 6f45aea49e4f..0a05b0d36ae7 100644
--- a/include/dt-bindings/clock/tegra210-car.h
+++ b/include/dt-bindings/clock/tegra210-car.h
@@ -126,7 +126,7 @@
 /* 104 */
 /* 105 */
 #define TEGRA210_CLK_D_AUDIO 106
-/* 107 ( affects abp -> ape) */
+#define TEGRA210_CLK_APB2APE 107
 /* 108 */
 /* 109 */
 /* 110 */
diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index 00b042c49ccd..48f5aab117ae 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -144,7 +144,7 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
 */
 #define if(cond, ...) __trace_if( (cond , ## __VA_ARGS__) )
 #define __trace_if(cond) \
-        if (__builtin_constant_p((cond)) ? !!(cond) :                   \
+        if (__builtin_constant_p(!!(cond)) ? !!(cond) :                 \
        ({                                                              \
                int ______r;                                            \
                static struct ftrace_branch_data                        \
diff --git a/include/linux/efi.h b/include/linux/efi.h
index 569b5a866bb1..47be3ad7d3e5 100644
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
@@ -1199,7 +1199,10 @@ int efivar_entry_iter(int (*func)(struct efivar_entry *, void *),
 struct efivar_entry *efivar_entry_find(efi_char16_t *name, efi_guid_t guid,
                                       struct list_head *head, bool remove);
-bool efivar_validate(efi_char16_t *var_name, u8 *data, unsigned long len);
+bool efivar_validate(efi_guid_t vendor, efi_char16_t *var_name, u8 *data,
+                     unsigned long data_size);
+bool efivar_variable_is_removable(efi_guid_t vendor, const char *name,
+                                  size_t len);
 extern struct work_struct efivar_work;
 void efivar_run_worker(void);
diff --git a/include/linux/fsnotify_backend.h b/include/linux/fsnotify_backend.h
index 6b7e89f45aa4..533c4408529a 100644
--- a/include/linux/fsnotify_backend.h
+++ b/include/linux/fsnotify_backend.h
@@ -220,10 +220,7 @@ struct fsnotify_mark {
        /* List of marks by group->i_fsnotify_marks. Also reused for queueing
         * mark into destroy_list when it's waiting for the end of SRCU period
         * before it can be freed. [group->mark_mutex] */
-        union {
+        struct list_head g_list;
-                struct list_head g_list;
-                struct rcu_head g_rcu;
-        };
        /* Protects inode / mnt pointers, flags, masks */
        spinlock_t lock;
        /* List of marks for inode / vfsmount [obj_lock] */
diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h
index 81de7123959d..c2b340e23f62 100644
--- a/include/linux/ftrace.h
+++ b/include/linux/ftrace.h
@@ -603,6 +603,7 @@ extern int ftrace_arch_read_dyn_info(char *buf, int size);
 extern int skip_trace(unsigned long ip);
 extern void ftrace_module_init(struct module *mod);
+extern void ftrace_module_enable(struct module *mod);
 extern void ftrace_release_mod(struct module *mod);
 extern void ftrace_disable_daemon(void);
@@ -612,8 +613,9 @@ static inline int skip_trace(unsigned long ip) { return 0; }
 static inline int ftrace_force_update(void) { return 0; }
 static inline void ftrace_disable_daemon(void) { }
 static inline void ftrace_enable_daemon(void) { }
-static inline void ftrace_release_mod(struct module *mod) {}
+static inline void ftrace_module_init(struct module *mod) { }
-static inline void ftrace_module_init(struct module *mod) {}
+static inline void ftrace_module_enable(struct module *mod) { }
+static inline void ftrace_release_mod(struct module *mod) { }
 static inline __init int register_ftrace_command(struct ftrace_func_command *cmd)
 {
        return -EINVAL;
diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h
index 821273ca4873..2d9b650047a5 100644
--- a/include/linux/intel-iommu.h
+++ b/include/linux/intel-iommu.h
@@ -235,6 +235,9 @@ static inline void dmar_writeq(void __iomem *addr, u64 val)
 /* low 64 bit */
 #define dma_frcd_page_addr(d) (d & (((u64)-1) << PAGE_SHIFT))
+/* PRS_REG */
+#define DMA_PRS_PPR     ((u32)1)
 #define IOMMU_WAIT_OP(iommu, offset, op, cond, sts)                     \
 do {                                                                    \
        cycles_t start_time = get_cycles();                             \
diff --git a/include/linux/lightnvm.h b/include/linux/lightnvm.h
index d6750111e48e..2190419bdf0a 100644
--- a/include/linux/lightnvm.h
+++ b/include/linux/lightnvm.h
@@ -135,6 +135,10 @@ enum {
        /* Memory types */
        NVM_ID_FMTYPE_SLC       = 0,
        NVM_ID_FMTYPE_MLC       = 1,
+        /* Device capabilities */
+        NVM_ID_DCAP_BBLKMGMT    = 0x1,
+        NVM_UD_DCAP_ECC         = 0x2,
 };
 struct nvm_id_lp_mlc {
diff --git a/include/linux/tracepoint.h b/include/linux/tracepoint.h
index acd522a91539..acfdbf353a0b 100644
--- a/include/linux/tracepoint.h
+++ b/include/linux/tracepoint.h
@@ -14,8 +14,10 @@
 * See the file COPYING for more details.
 */
+#include <linux/smp.h>
 #include <linux/errno.h>
 #include <linux/types.h>
+#include <linux/cpumask.h>
 #include <linux/rcupdate.h>
 #include <linux/tracepoint-defs.h>
@@ -132,6 +134,9 @@ extern void syscall_unregfunc(void);
                void *it_func;                                          \
                void *__data;                                           \
                                                                        \
+                if (!cpu_online(raw_smp_processor_id()))                \
+                        return;                                         \
+                                                                        \
                if (!(cond))                                            \
                        return;                                         \
                prercu;                                                 \
diff --git a/include/linux/ucs2_string.h b/include/linux/ucs2_string.h
index cbb20afdbc01..bb679b48f408 100644
--- a/include/linux/ucs2_string.h
+++ b/include/linux/ucs2_string.h
@@ -11,4 +11,8 @@ unsigned long ucs2_strlen(const ucs2_char_t *s);
 unsigned long ucs2_strsize(const ucs2_char_t *data, unsigned long maxlength);
 int ucs2_strncmp(const ucs2_char_t *a, const ucs2_char_t *b, size_t len);
+unsigned long ucs2_utf8size(const ucs2_char_t *src);
+unsigned long ucs2_as_utf8(u8 *dest, const ucs2_char_t *src,
+                           unsigned long maxlength);
 #endif /* _LINUX_UCS2_STRING_H_ */
diff --git a/ipc/shm.c b/ipc/shm.c
index ed3027d0f277..331fc1b0b3c7 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -156,11 +156,12 @@ static inline struct shmid_kernel *shm_lock(struct ipc_namespace *ns, int id)
        struct kern_ipc_perm *ipcp = ipc_lock(&shm_ids(ns), id);
        /*
-         * We raced in the idr lookup or with shm_destroy().  Either way, the
+         * Callers of shm_lock() must validate the status of the returned ipc
-         * ID is busted.
+         * object pointer (as returned by ipc_lock()), and error out as
+         * appropriate.
         */
-        WARN_ON(IS_ERR(ipcp));
+        if (IS_ERR(ipcp))
+                return (void *)ipcp;
        return container_of(ipcp, struct shmid_kernel, shm_perm);
 }
@@ -186,18 +187,33 @@ static inline void shm_rmid(struct ipc_namespace *ns, struct shmid_kernel *s)
 }
-/* This is called by fork, once for every shm attach. */
+static int __shm_open(struct vm_area_struct *vma)
-static void shm_open(struct vm_area_struct *vma)
 {
        struct file *file = vma->vm_file;
        struct shm_file_data *sfd = shm_file_data(file);
        struct shmid_kernel *shp;
        shp = shm_lock(sfd->ns, sfd->id);
+        if (IS_ERR(shp))
+                return PTR_ERR(shp);
        shp->shm_atim = get_seconds();
        shp->shm_lprid = task_tgid_vnr(current);
        shp->shm_nattch++;
        shm_unlock(shp);
+        return 0;
+}
+/* This is called by fork, once for every shm attach. */
+static void shm_open(struct vm_area_struct *vma)
+{
+        int err = __shm_open(vma);
+        /*
+         * We raced in the idr lookup or with shm_destroy().
+         * Either way, the ID is busted.
+         */
+        WARN_ON_ONCE(err);
 }
 /*
@@ -260,6 +276,14 @@ static void shm_close(struct vm_area_struct *vma)
        down_write(&shm_ids(ns).rwsem);
        /* remove from the list of attaches of the shm segment */
        shp = shm_lock(ns, sfd->id);
+        /*
+         * We raced in the idr lookup or with shm_destroy().
+         * Either way, the ID is busted.
+         */
+        if (WARN_ON_ONCE(IS_ERR(shp)))
+                goto done; /* no-op */
        shp->shm_lprid = task_tgid_vnr(current);
        shp->shm_dtim = get_seconds();
        shp->shm_nattch--;
@@ -267,6 +291,7 @@ static void shm_close(struct vm_area_struct *vma)
                shm_destroy(ns, shp);
        else
                shm_unlock(shp);
+done:
        up_write(&shm_ids(ns).rwsem);
 }
@@ -388,17 +413,25 @@ static int shm_mmap(struct file *file, struct vm_area_struct *vma)
        struct shm_file_data *sfd = shm_file_data(file);
        int ret;
+        /*
+         * In case of remap_file_pages() emulation, the file can represent
+         * removed IPC ID: propogate shm_lock() error to caller.
+         */
+        ret =__shm_open(vma);
+        if (ret)
+                return ret;
        ret = sfd->file->f_op->mmap(sfd->file, vma);
-        if (ret != 0)
+        if (ret) {
+                shm_close(vma);
                return ret;
+        }
        sfd->vm_ops = vma->vm_ops;
 #ifdef CONFIG_MMU
        WARN_ON(!sfd->vm_ops->fault);
 #endif
        vma->vm_ops = &shm_vm_ops;
-        shm_open(vma);
+        return 0;
-        return ret;
 }
 static int shm_release(struct inode *ino, struct file *file)
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 5946460b2425..0d58522103cd 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -9206,7 +9206,7 @@ static void perf_event_init_cpu(int cpu)
        struct swevent_htable *swhash = &per_cpu(swevent_htable, cpu);
        mutex_lock(&swhash->hlist_mutex);
-        if (swhash->hlist_refcount > 0) {
+        if (swhash->hlist_refcount > 0 && !swevent_hlist_deref(swhash)) {
                struct swevent_hlist *hlist;
                hlist = kzalloc_node(sizeof(*hlist), GFP_KERNEL, cpu_to_node(cpu));
@@ -9282,11 +9282,9 @@ perf_cpu_notify(struct notifier_block *self, unsigned long action, void *hcpu)
        switch (action & ~CPU_TASKS_FROZEN) {
        case CPU_UP_PREPARE:
-        case CPU_DOWN_FAILED:
                perf_event_init_cpu(cpu);
                break;
-        case CPU_UP_CANCELED:
        case CPU_DOWN_PREPARE:
                perf_event_exit_cpu(cpu);
                break;
diff --git a/kernel/memremap.c b/kernel/memremap.c
index 2c468dea60bc..7a1b5c3ef14e 100644
--- a/kernel/memremap.c
+++ b/kernel/memremap.c
@@ -114,7 +114,7 @@ EXPORT_SYMBOL(memunmap);
 static void devm_memremap_release(struct device *dev, void *res)
 {
-        memunmap(res);
+        memunmap(*(void **)res);
 }
 static int devm_memremap_match(struct device *dev, void *res, void *match_data)
diff --git a/kernel/module.c b/kernel/module.c
index 9537da37ce87..794ebe8e878d 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -984,6 +984,8 @@ SYSCALL_DEFINE2(delete_module, const char __user *, name_user,
                mod->exit();
        blocking_notifier_call_chain(&module_notify_list,
                                     MODULE_STATE_GOING, mod);
+        ftrace_release_mod(mod);
        async_synchronize_full();
        /* Store the name of the last unloaded module for diagnostic purposes */
@@ -3313,6 +3315,7 @@ fail:
        module_put(mod);
        blocking_notifier_call_chain(&module_notify_list,
                                     MODULE_STATE_GOING, mod);
+        ftrace_release_mod(mod);
        free_module(mod);
        wake_up_all(&module_wq);
        return ret;
@@ -3389,6 +3392,7 @@ static int complete_formation(struct module *mod, struct load_info *info)
        mod->state = MODULE_STATE_COMING;
        mutex_unlock(&module_mutex);
+        ftrace_module_enable(mod);
        blocking_notifier_call_chain(&module_notify_list,
                                     MODULE_STATE_COMING, mod);
        return 0;
diff --git a/kernel/resource.c b/kernel/resource.c
index 09c0597840b0..3669d1bfc425 100644
--- a/kernel/resource.c
+++ b/kernel/resource.c
@@ -1083,9 +1083,10 @@ struct resource * __request_region(struct resource *parent,
                if (!conflict)
                        break;
                if (conflict != parent) {
-                        parent = conflict;
+                        if (!(conflict->flags & IORESOURCE_BUSY)) {
-                        if (!(conflict->flags & IORESOURCE_BUSY))
+                                parent = conflict;
                                continue;
+                        }
                }
                if (conflict->flags & flags & IORESOURCE_MUXED) {
                        add_wait_queue(&muxed_resource_wait, &wait);
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index eca592f977b2..57a6eea84694 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -4961,7 +4961,7 @@ void ftrace_release_mod(struct module *mod)
        mutex_unlock(&ftrace_lock);
 }
-static void ftrace_module_enable(struct module *mod)
+void ftrace_module_enable(struct module *mod)
 {
        struct dyn_ftrace *rec;
        struct ftrace_page *pg;
@@ -5038,38 +5038,8 @@ void ftrace_module_init(struct module *mod)
        ftrace_process_locs(mod, mod->ftrace_callsites,
                            mod->ftrace_callsites + mod->num_ftrace_callsites);
 }
-static int ftrace_module_notify(struct notifier_block *self,
-                                unsigned long val, void *data)
-{
-        struct module *mod = data;
-        switch (val) {
-        case MODULE_STATE_COMING:
-                ftrace_module_enable(mod);
-                break;
-        case MODULE_STATE_GOING:
-                ftrace_release_mod(mod);
-                break;
-        default:
-                break;
-        }
-        return 0;
-}
-#else
-static int ftrace_module_notify(struct notifier_block *self,
-                                unsigned long val, void *data)
-{
-        return 0;
-}
 #endif /* CONFIG_MODULES */
-struct notifier_block ftrace_module_nb = {
-        .notifier_call = ftrace_module_notify,
-        .priority = INT_MIN,    /* Run after anything that can remove kprobes */
-};
 void __init ftrace_init(void)
 {
        extern unsigned long __start_mcount_loc[];
@@ -5098,10 +5068,6 @@ void __init ftrace_init(void)
                                  __start_mcount_loc,
                                  __stop_mcount_loc);
-        ret = register_module_notifier(&ftrace_module_nb);
-        if (ret)
-                pr_warning("Failed to register trace ftrace module exit notifier\n");
        set_ftrace_early_filters();
        return;
diff --git a/lib/ucs2_string.c b/lib/ucs2_string.c
index 6f500ef2301d..f0b323abb4c6 100644
--- a/lib/ucs2_string.c
+++ b/lib/ucs2_string.c
@@ -49,3 +49,65 @@ ucs2_strncmp(const ucs2_char_t *a, const ucs2_char_t *b, size_t len)
        }
 }
 EXPORT_SYMBOL(ucs2_strncmp);
+unsigned long
+ucs2_utf8size(const ucs2_char_t *src)
+{
+        unsigned long i;
+        unsigned long j = 0;
+        for (i = 0; i < ucs2_strlen(src); i++) {
+                u16 c = src[i];
+                if (c >= 0x800)
+                        j += 3;
+                else if (c >= 0x80)
+                        j += 2;
+                else
+                        j += 1;
+        }
+        return j;
+}
+EXPORT_SYMBOL(ucs2_utf8size);
+/*
+ * copy at most maxlength bytes of whole utf8 characters to dest from the
+ * ucs2 string src.
+ *
+ * The return value is the number of characters copied, not including the
+ * final NUL character.
+ */
+unsigned long
+ucs2_as_utf8(u8 *dest, const ucs2_char_t *src, unsigned long maxlength)
+{
+        unsigned int i;
+        unsigned long j = 0;
+        unsigned long limit = ucs2_strnlen(src, maxlength);
+        for (i = 0; maxlength && i < limit; i++) {
+                u16 c = src[i];
+                if (c >= 0x800) {
+                        if (maxlength < 3)
+                                break;
+                        maxlength -= 3;
+                        dest[j++] = 0xe0 | (c & 0xf000) >> 12;
+                        dest[j++] = 0x80 | (c & 0x0fc0) >> 6;
+                        dest[j++] = 0x80 | (c & 0x003f);
+                } else if (c >= 0x80) {
+                        if (maxlength < 2)
+                                break;
+                        maxlength -= 2;
+                        dest[j++] = 0xc0 | (c & 0x7c0) >> 6;
+                        dest[j++] = 0x80 | (c & 0x03f);
+                } else {
+                        maxlength -= 1;
+                        dest[j++] = c & 0x7f;
+                }
+        }
+        if (maxlength)
+                dest[j] = '\0';
+        return j;
+}
+EXPORT_SYMBOL(ucs2_as_utf8);
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 08fc0ba2207e..1c317b85ea7d 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1700,7 +1700,8 @@ bool move_huge_pmd(struct vm_area_struct *vma, struct vm_area_struct *new_vma,
                pmd = pmdp_huge_get_and_clear(mm, old_addr, old_pmd);
                VM_BUG_ON(!pmd_none(*new_pmd));
-                if (pmd_move_must_withdraw(new_ptl, old_ptl)) {
+                if (pmd_move_must_withdraw(new_ptl, old_ptl) &&
+                                vma_is_anonymous(vma)) {
                        pgtable_t pgtable;
                        pgtable = pgtable_trans_huge_withdraw(mm, old_pmd);
                        pgtable_trans_huge_deposit(mm, new_pmd, pgtable);
@@ -2860,6 +2861,7 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd,
        young = pmd_young(*pmd);
        dirty = pmd_dirty(*pmd);
+        pmdp_huge_split_prepare(vma, haddr, pmd);
        pgtable = pgtable_trans_huge_withdraw(mm, pmd);
        pmd_populate(mm, &_pmd, pgtable);
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 06ae13e869d0..01f2b48c8618 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2630,8 +2630,10 @@ static int __init hugetlb_init(void)
                        hugetlb_add_hstate(HUGETLB_PAGE_ORDER);
        }
        default_hstate_idx = hstate_index(size_to_hstate(default_hstate_size));
-        if (default_hstate_max_huge_pages)
+        if (default_hstate_max_huge_pages) {
-                default_hstate.max_huge_pages = default_hstate_max_huge_pages;
+                if (!default_hstate.max_huge_pages)
+                        default_hstate.max_huge_pages = default_hstate_max_huge_pages;
+        }
        hugetlb_init_hstates();
        gather_bootmem_prealloc();
diff --git a/mm/mmap.c b/mm/mmap.c
index 2f2415a7a688..76d1ec29149b 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -2664,12 +2664,29 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size,
        if (!vma || !(vma->vm_flags & VM_SHARED))
                goto out;
-        if (start < vma->vm_start || start + size > vma->vm_end)
+        if (start < vma->vm_start)
                goto out;
-        if (pgoff == linear_page_index(vma, start)) {
+        if (start + size > vma->vm_end) {
-                ret = 0;
+                struct vm_area_struct *next;
-                goto out;
+                for (next = vma->vm_next; next; next = next->vm_next) {
+                        /* hole between vmas ? */
+                        if (next->vm_start != next->vm_prev->vm_end)
+                                goto out;
+                        if (next->vm_file != vma->vm_file)
+                                goto out;
+                        if (next->vm_flags != vma->vm_flags)
+                                goto out;
+                        if (start + size <= next->vm_end)
+                                break;
+                }
+                if (!next)
+                        goto out;
        }
        prot |= vma->vm_flags & VM_READ ? PROT_READ : 0;
@@ -2679,9 +2696,16 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size,
        flags &= MAP_NONBLOCK;
        flags |= MAP_SHARED | MAP_FIXED | MAP_POPULATE;
        if (vma->vm_flags & VM_LOCKED) {
+                struct vm_area_struct *tmp;
                flags |= MAP_LOCKED;
                /* drop PG_Mlocked flag for over-mapped range */
-                munlock_vma_pages_range(vma, start, start + size);
+                for (tmp = vma; tmp->vm_start >= start + size;
+                                tmp = tmp->vm_next) {
+                        munlock_vma_pages_range(tmp,
+                                        max(tmp->vm_start, start),
+                                        min(tmp->vm_end, start + size));
+                }
        }
        file = get_file(vma->vm_file);
diff --git a/mm/slab.c b/mm/slab.c
index 6ecc697a8bc4..621fbcb35a36 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -2275,7 +2275,7 @@ __kmem_cache_create (struct kmem_cache *cachep, unsigned long flags)
        err = setup_cpu_cache(cachep, gfp);
        if (err) {
-                __kmem_cache_shutdown(cachep);
+                __kmem_cache_release(cachep);
                return err;
        }
@@ -2414,12 +2414,13 @@ int __kmem_cache_shrink(struct kmem_cache *cachep, bool deactivate)
 int __kmem_cache_shutdown(struct kmem_cache *cachep)
 {
+        return __kmem_cache_shrink(cachep, false);
+}
+void __kmem_cache_release(struct kmem_cache *cachep)
+{
        int i;
        struct kmem_cache_node *n;
-        int rc = __kmem_cache_shrink(cachep, false);
-        if (rc)
-                return rc;
        free_percpu(cachep->cpu_cache);
@@ -2430,7 +2431,6 @@ int __kmem_cache_shutdown(struct kmem_cache *cachep)
                kfree(n);
                cachep->node[i] = NULL;
        }
-        return 0;
 }
 /*
diff --git a/mm/slab.h b/mm/slab.h
index 834ad240c0bb..2eedacea439d 100644
--- a/mm/slab.h
+++ b/mm/slab.h
@@ -140,6 +140,7 @@ static inline unsigned long kmem_cache_flags(unsigned long object_size,
 #define CACHE_CREATE_MASK (SLAB_CORE_FLAGS | SLAB_DEBUG_FLAGS | SLAB_CACHE_FLAGS)
 int __kmem_cache_shutdown(struct kmem_cache *);
+void __kmem_cache_release(struct kmem_cache *);
 int __kmem_cache_shrink(struct kmem_cache *, bool);
 void slab_kmem_cache_release(struct kmem_cache *);
diff --git a/mm/slab_common.c b/mm/slab_common.c
index b50aef01ccf7..065b7bdabdc3 100644
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -693,6 +693,7 @@ static inline int shutdown_memcg_caches(struct kmem_cache *s,
 void slab_kmem_cache_release(struct kmem_cache *s)
 {
+        __kmem_cache_release(s);
        destroy_memcg_params(s);
        kfree_const(s->name);
        kmem_cache_free(kmem_cache, s);
diff --git a/mm/slob.c b/mm/slob.c
index 17e8f8cc7c53..5ec158054ffe 100644
--- a/mm/slob.c
+++ b/mm/slob.c
@@ -630,6 +630,10 @@ int __kmem_cache_shutdown(struct kmem_cache *c)
        return 0;
 }
+void __kmem_cache_release(struct kmem_cache *c)
+{
+}
 int __kmem_cache_shrink(struct kmem_cache *d, bool deactivate)
 {
        return 0;
diff --git a/mm/slub.c b/mm/slub.c
index 2e1355ac056b..d8fbd4a6ed59 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -1592,18 +1592,12 @@ static inline void add_partial(struct kmem_cache_node *n,
        __add_partial(n, page, tail);
 }
-static inline void
-__remove_partial(struct kmem_cache_node *n, struct page *page)
-{
-        list_del(&page->lru);
-        n->nr_partial--;
-}
 static inline void remove_partial(struct kmem_cache_node *n,
                                        struct page *page)
 {
        lockdep_assert_held(&n->list_lock);
-        __remove_partial(n, page);
+        list_del(&page->lru);
+        n->nr_partial--;
 }
 /*
@@ -3184,6 +3178,12 @@ static void free_kmem_cache_nodes(struct kmem_cache *s)
        }
 }
+void __kmem_cache_release(struct kmem_cache *s)
+{
+        free_percpu(s->cpu_slab);
+        free_kmem_cache_nodes(s);
+}
 static int init_kmem_cache_nodes(struct kmem_cache *s)
 {
        int node;
@@ -3443,28 +3443,31 @@ static void list_slab_objects(struct kmem_cache *s, struct page *page,
 /*
 * Attempt to free all partial slabs on a node.
- * This is called from kmem_cache_close(). We must be the last thread
+ * This is called from __kmem_cache_shutdown(). We must take list_lock
- * using the cache and therefore we do not need to lock anymore.
+ * because sysfs file might still access partial list after the shutdowning.
 */
 static void free_partial(struct kmem_cache *s, struct kmem_cache_node *n)
 {
        struct page *page, *h;
+        BUG_ON(irqs_disabled());
+        spin_lock_irq(&n->list_lock);
        list_for_each_entry_safe(page, h, &n->partial, lru) {
                if (!page->inuse) {
-                        __remove_partial(n, page);
+                        remove_partial(n, page);
                        discard_slab(s, page);
                } else {
                        list_slab_objects(s, page,
-                        "Objects remaining in %s on kmem_cache_close()");
+                        "Objects remaining in %s on __kmem_cache_shutdown()");
                }
        }
+        spin_unlock_irq(&n->list_lock);
 }
 /*
 * Release all resources used by a slab cache.
 */
-static inline int kmem_cache_close(struct kmem_cache *s)
+int __kmem_cache_shutdown(struct kmem_cache *s)
 {
        int node;
        struct kmem_cache_node *n;
@@ -3476,16 +3479,9 @@ static inline int kmem_cache_close(struct kmem_cache *s)
                if (n->nr_partial || slabs_node(s, node))
                        return 1;
        }
-        free_percpu(s->cpu_slab);
-        free_kmem_cache_nodes(s);
        return 0;
 }
-int __kmem_cache_shutdown(struct kmem_cache *s)
-{
-        return kmem_cache_close(s);
-}
 /********************************************************************
 *              Kmalloc subsystem
 *******************************************************************/
@@ -3980,7 +3976,7 @@ int __kmem_cache_create(struct kmem_cache *s, unsigned long flags)
        memcg_propagate_slab_attrs(s);
        err = sysfs_slab_add(s);
        if (err)
-                kmem_cache_close(s);
+                __kmem_cache_release(s);
        return err;
 }
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index fadd3eb8e8bb..9106d8e2300e 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -74,6 +74,18 @@ static int snd_pcm_open(struct file *file, struct snd_pcm *pcm, int stream);
 static DEFINE_RWLOCK(snd_pcm_link_rwlock);
 static DECLARE_RWSEM(snd_pcm_link_rwsem);
+/* Writer in rwsem may block readers even during its waiting in queue,
+ * and this may lead to a deadlock when the code path takes read sem
+ * twice (e.g. one in snd_pcm_action_nonatomic() and another in
+ * snd_pcm_stream_lock()).  As a (suboptimal) workaround, let writer to
+ * spin until it gets the lock.
+ */
+static inline void down_write_nonblock(struct rw_semaphore *lock)
+{
+        while (!down_write_trylock(lock))
+                cond_resched();
+}
 /**
 * snd_pcm_stream_lock - Lock the PCM stream
 * @substream: PCM substream
@@ -1813,7 +1825,7 @@ static int snd_pcm_link(struct snd_pcm_substream *substream, int fd)
                res = -ENOMEM;
                goto _nolock;
        }
-        down_write(&snd_pcm_link_rwsem);
+        down_write_nonblock(&snd_pcm_link_rwsem);
        write_lock_irq(&snd_pcm_link_rwlock);
        if (substream->runtime->status->state == SNDRV_PCM_STATE_OPEN ||
            substream->runtime->status->state != substream1->runtime->status->state ||
@@ -1860,7 +1872,7 @@ static int snd_pcm_unlink(struct snd_pcm_substream *substream)
        struct snd_pcm_substream *s;
        int res = 0;
-        down_write(&snd_pcm_link_rwsem);
+        down_write_nonblock(&snd_pcm_link_rwsem);
        write_lock_irq(&snd_pcm_link_rwlock);
        if (!snd_pcm_stream_linked(substream)) {
                res = -EALREADY;
diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c
index 801076687bb1..c850345c43b5 100644
--- a/sound/core/seq/seq_memory.c
+++ b/sound/core/seq/seq_memory.c
@@ -383,15 +383,20 @@ int snd_seq_pool_init(struct snd_seq_pool *pool)
        if (snd_BUG_ON(!pool))
                return -EINVAL;
-        if (pool->ptr)                  /* should be atomic? */
-                return 0;
-        pool->ptr = vmalloc(sizeof(struct snd_seq_event_cell) * pool->size);
+        cellptr = vmalloc(sizeof(struct snd_seq_event_cell) * pool->size);
-        if (!pool->ptr)
+        if (!cellptr)
                return -ENOMEM;
        /* add new cells to the free cell list */
        spin_lock_irqsave(&pool->lock, flags);
+        if (pool->ptr) {
+                spin_unlock_irqrestore(&pool->lock, flags);
+                vfree(cellptr);
+                return 0;
+        }
+        pool->ptr = cellptr;
        pool->free = NULL;
        for (cell = 0; cell < pool->size; cell++) {
diff --git a/sound/core/seq/seq_ports.c b/sound/core/seq/seq_ports.c
index 921fb2bd8fad..fe686ee41c6d 100644
--- a/sound/core/seq/seq_ports.c
+++ b/sound/core/seq/seq_ports.c
@@ -535,19 +535,22 @@ static void delete_and_unsubscribe_port(struct snd_seq_client *client,
                                        bool is_src, bool ack)
 {
        struct snd_seq_port_subs_info *grp;
+        struct list_head *list;
+        bool empty;
        grp = is_src ? &port->c_src : &port->c_dest;
+        list = is_src ? &subs->src_list : &subs->dest_list;
        down_write(&grp->list_mutex);
        write_lock_irq(&grp->list_lock);
-        if (is_src)
+        empty = list_empty(list);
-                list_del(&subs->src_list);
+        if (!empty)
-        else
+                list_del_init(list);
-                list_del(&subs->dest_list);
        grp->exclusive = 0;
        write_unlock_irq(&grp->list_lock);
        up_write(&grp->list_mutex);
-        unsubscribe_port(client, port, grp, &subs->info, ack);
+        if (!empty)
+                unsubscribe_port(client, port, grp, &subs->info, ack);
 }
 /* connect two ports */
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 4045dca3d699..ce6b97f31390 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -2168,10 +2168,10 @@ static void azx_remove(struct pci_dev *pci)
        struct hda_intel *hda;
        if (card) {
-                /* flush the pending probing work */
+                /* cancel the pending probing work */
                chip = card->private_data;
                hda = container_of(chip, struct hda_intel, chip);
-                flush_work(&hda->probe_work);
+                cancel_work_sync(&hda->probe_work);
                snd_card_free(card);
        }
diff --git a/tools/testing/selftests/efivarfs/efivarfs.sh b/tools/testing/selftests/efivarfs/efivarfs.sh
index 77edcdcc016b..057278448515 100755
--- a/tools/testing/selftests/efivarfs/efivarfs.sh
+++ b/tools/testing/selftests/efivarfs/efivarfs.sh
@@ -88,7 +88,11 @@ test_delete()
                exit 1
        fi
-        rm $file
+        rm $file 2>/dev/null
+        if [ $? -ne 0 ]; then
+                chattr -i $file
+                rm $file
+        fi
        if [ -e $file ]; then
                echo "$file couldn't be deleted" >&2
@@ -111,6 +115,7 @@ test_zero_size_delete()
                exit 1
        fi
+        chattr -i $file
        printf "$attrs" > $file
        if [ -e $file ]; then
@@ -141,7 +146,11 @@ test_valid_filenames()
                        echo "$file could not be created" >&2
                        ret=1
                else
-                        rm $file
+                        rm $file 2>/dev/null
+                        if [ $? -ne 0 ]; then
+                                chattr -i $file
+                                rm $file
+                        fi
                fi
        done
@@ -174,7 +183,11 @@ test_invalid_filenames()
                if [ -e $file ]; then
                        echo "Creating $file should have failed" >&2
-                        rm $file
+                        rm $file 2>/dev/null
+                        if [ $? -ne 0 ]; then
+                                chattr -i $file
+                                rm $file
+                        fi
                        ret=1
                fi
        done
diff --git a/tools/testing/selftests/efivarfs/open-unlink.c b/tools/testing/selftests/efivarfs/open-unlink.c
index 8c0764407b3c..4af74f733036 100644
--- a/tools/testing/selftests/efivarfs/open-unlink.c
+++ b/tools/testing/selftests/efivarfs/open-unlink.c
@@ -1,10 +1,68 @@
+#include <errno.h>
 #include <stdio.h>
 #include <stdint.h>
 #include <stdlib.h>
 #include <unistd.h>
+#include <sys/ioctl.h>
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <fcntl.h>
+#include <linux/fs.h>
+static int set_immutable(const char *path, int immutable)
+{
+        unsigned int flags;
+        int fd;
+        int rc;
+        int error;
+        fd = open(path, O_RDONLY);
+        if (fd < 0)
+                return fd;
+        rc = ioctl(fd, FS_IOC_GETFLAGS, &flags);
+        if (rc < 0) {
+                error = errno;
+                close(fd);
+                errno = error;
+                return rc;
+        }
+        if (immutable)
+                flags |= FS_IMMUTABLE_FL;
+        else
+                flags &= ~FS_IMMUTABLE_FL;
+        rc = ioctl(fd, FS_IOC_SETFLAGS, &flags);
+        error = errno;
+        close(fd);
+        errno = error;
+        return rc;
+}
+static int get_immutable(const char *path)
+{
+        unsigned int flags;
+        int fd;
+        int rc;
+        int error;
+        fd = open(path, O_RDONLY);
+        if (fd < 0)
+                return fd;
+        rc = ioctl(fd, FS_IOC_GETFLAGS, &flags);
+        if (rc < 0) {
+                error = errno;
+                close(fd);
+                errno = error;
+                return rc;
+        }
+        close(fd);
+        if (flags & FS_IMMUTABLE_FL)
+                return 1;
+        return 0;
+}
 int main(int argc, char **argv)
 {
@@ -27,7 +85,7 @@ int main(int argc, char **argv)
        buf[4] = 0;
        /* create a test variable */
-        fd = open(path, O_WRONLY | O_CREAT);
+        fd = open(path, O_WRONLY | O_CREAT, 0600);
        if (fd < 0) {
                perror("open(O_WRONLY)");
                return EXIT_FAILURE;
@@ -41,6 +99,18 @@ int main(int argc, char **argv)
        close(fd);
+        rc = get_immutable(path);
+        if (rc < 0) {
+                perror("ioctl(FS_IOC_GETFLAGS)");
+                return EXIT_FAILURE;
+        } else if (rc) {
+                rc = set_immutable(path, 0);
+                if (rc < 0) {
+                        perror("ioctl(FS_IOC_SETFLAGS)");
+                        return EXIT_FAILURE;
+                }
+        }
        fd = open(path, O_RDONLY);
        if (fd < 0) {
                perror("open");
diff --git a/virt/kvm/arm/arch_timer.c b/virt/kvm/arm/arch_timer.c
index 69bca185c471..ea6064696fe4 100644
--- a/virt/kvm/arm/arch_timer.c
+++ b/virt/kvm/arm/arch_timer.c
@@ -143,7 +143,7 @@ static void kvm_timer_update_irq(struct kvm_vcpu *vcpu, bool new_level)
 * Check if there was a change in the timer state (should we raise or lower
 * the line level to the GIC).
 */
-static void kvm_timer_update_state(struct kvm_vcpu *vcpu)
+static int kvm_timer_update_state(struct kvm_vcpu *vcpu)
 {
        struct arch_timer_cpu *timer = &vcpu->arch.timer_cpu;
@@ -154,10 +154,12 @@ static void kvm_timer_update_state(struct kvm_vcpu *vcpu)
         * until we call this function from kvm_timer_flush_hwstate.
         */
        if (!vgic_initialized(vcpu->kvm))
-            return;
+                return -ENODEV;
        if (kvm_timer_should_fire(vcpu) != timer->irq.level)
                kvm_timer_update_irq(vcpu, !timer->irq.level);
+        return 0;
 }
 /*
@@ -218,7 +220,8 @@ void kvm_timer_flush_hwstate(struct kvm_vcpu *vcpu)
        bool phys_active;
        int ret;
-        kvm_timer_update_state(vcpu);
+        if (kvm_timer_update_state(vcpu))
+                return;
        /*
        * If we enter the guest with the virtual input level to the VGIC
author	Ingo Molnar <mingo@kernel.org>	2016-02-23 01:36:46 -0500
committer	Ingo Molnar <mingo@kernel.org>	2016-02-23 01:36:46 -0500
commit	fb86780bf7708cd6553f592a6318f10eda766127 (patch)
tree	b59737c56a407c9f82166576209ef8e8cd09ecc6
parent	8f8e2aec9944dd12671182a1a26b8e1a35872a1d (diff)
parent	dd71a17b1193dd4a4c35ecd0ba227aac3d110836 (diff)