964 files changed, 10692 insertions, 6149 deletions

diff --git a/.mailmap b/.mailmap
index 977f958eedbe..b4091b7a78fe 100644
--- a/.mailmap
+++ b/.mailmap
@@ -116,6 +116,7 @@ Shiraz Hashim <shiraz.linux.kernel@gmail.com> <shiraz.hashim@st.com>
 Simon Kelley <simon@thekelleys.org.uk>
 Stéphane Witzmann <stephane.witzmann@ubpmes.univ-bpclermont.fr>
 Stephen Hemminger <shemminger@osdl.org>
+Sudeep Holla <sudeep.holla@arm.com> Sudeep KarkadaNagesha <sudeep.karkadanagesha@arm.com>
 Sumit Semwal <sumit.semwal@ti.com>
 Tejun Heo <htejun@gmail.com>
 Thomas Graf <tgraf@suug.ch>
@@ -125,7 +126,9 @@ Uwe Kleine-König <ukleinek@informatik.uni-freiburg.de>
 Uwe Kleine-König <ukl@pengutronix.de>
 Uwe Kleine-König <Uwe.Kleine-Koenig@digi.com>
 Valdis Kletnieks <Valdis.Kletnieks@vt.edu>
-Viresh Kumar <viresh.linux@gmail.com> <viresh.kumar@st.com>
+Viresh Kumar <vireshk@kernel.org> <viresh.kumar@st.com>
+Viresh Kumar <vireshk@kernel.org> <viresh.linux@gmail.com>
+Viresh Kumar <vireshk@kernel.org> <viresh.kumar2@arm.com>
 Takashi YOSHII <takashi.yoshii.zj@renesas.com>
 Yusuke Goda <goda.yusuke@renesas.com>
 Gustavo Padovan <gustavo@las.ic.unicamp.br>
diff --git a/Documentation/ABI/testing/sysfs-bus-iio b/Documentation/ABI/testing/sysfs-bus-iio
index bbed111c31b4..70c9b1ac66db 100644
--- a/Documentation/ABI/testing/sysfs-bus-iio
+++ b/Documentation/ABI/testing/sysfs-bus-iio
@@ -1234,10 +1234,8 @@ Description:
                 object is near the sensor, usually be observing
                 reflectivity of infrared or ultrasound emitted.
                 Often these sensors are unit less and as such conversion
-                to SI units is not possible.  Where it is, the units should
-                be meters.  If such a conversion is not possible, the reported
-                values should behave in the same way as a distance, i.e. lower
-                values indicate something is closer to the sensor.
+                to SI units is not possible. Higher proximity measurements
+                indicate closer objects, and vice versa.
 
 What:           /sys/.../iio:deviceX/in_illuminance_input
 What:           /sys/.../iio:deviceX/in_illuminance_raw
diff --git a/Documentation/DocBook/drm.tmpl b/Documentation/DocBook/drm.tmpl
index c0312cbd023d..2fb9a5457522 100644
--- a/Documentation/DocBook/drm.tmpl
+++ b/Documentation/DocBook/drm.tmpl
@@ -3383,7 +3383,7 @@ void intel_crt_init(struct drm_device *dev)
         <td valign="top" >TBD</td>
         </tr>
         <tr>
-        <td rowspan="2" valign="top" >omap</td>
+        <td valign="top" >omap</td>
         <td valign="top" >Generic</td>
         <td valign="top" >“zorder”</td>
         <td valign="top" >RANGE</td>
diff --git a/Documentation/arm/SPEAr/overview.txt b/Documentation/arm/SPEAr/overview.txt
index 65610bf52ebf..1b049be6c84f 100644
--- a/Documentation/arm/SPEAr/overview.txt
+++ b/Documentation/arm/SPEAr/overview.txt
@@ -60,4 +60,4 @@ Introduction
   Document Author
   ---------------
 
-  Viresh Kumar <viresh.linux@gmail.com>, (c) 2010-2012 ST Microelectronics
+  Viresh Kumar <vireshk@kernel.org>, (c) 2010-2012 ST Microelectronics
diff --git a/Documentation/arm/sunxi/README b/Documentation/arm/sunxi/README
index 1fe2d7fd4108..5e38e1582f95 100644
--- a/Documentation/arm/sunxi/README
+++ b/Documentation/arm/sunxi/README
@@ -36,7 +36,7 @@ SunXi family
         + User Manual
           http://dl.linux-sunxi.org/A20/A20%20User%20Manual%202013-03-22.pdf
 
-      - Allwinner A23
+      - Allwinner A23 (sun8i)
         + Datasheet
           http://dl.linux-sunxi.org/A23/A23%20Datasheet%20V1.0%2020130830.pdf
         + User Manual
@@ -55,7 +55,23 @@ SunXi family
         + User Manual
           http://dl.linux-sunxi.org/A31/A3x_release_document/A31s/IC/A31s%20User%20Manual%20%20V1.0%2020130322.pdf
 
+      - Allwinner A33 (sun8i)
+        + Datasheet
+          http://dl.linux-sunxi.org/A33/A33%20Datasheet%20release%201.1.pdf
+        + User Manual
+          http://dl.linux-sunxi.org/A33/A33%20user%20manual%20release%201.1.pdf
+
+      - Allwinner H3 (sun8i)
+        + Datasheet
+          http://dl.linux-sunxi.org/H3/Allwinner_H3_Datasheet_V1.0.pdf
+
     * Quad ARM Cortex-A15, Quad ARM Cortex-A7 based SoCs
       - Allwinner A80
         + Datasheet
           http://dl.linux-sunxi.org/A80/A80_Datasheet_Revision_1.0_0404.pdf
+
+    * Octa ARM Cortex-A7 based SoCs
+      - Allwinner A83T
+        + Not Supported
+        + Datasheet
+          http://dl.linux-sunxi.org/A83T/A83T_datasheet_Revision_1.1.pdf
diff --git a/Documentation/device-mapper/cache.txt b/Documentation/device-mapper/cache.txt
index 82960cffbad3..785eab87aa71 100644
--- a/Documentation/device-mapper/cache.txt
+++ b/Documentation/device-mapper/cache.txt
@@ -258,6 +258,12 @@ cache metadata mode      : ro if read-only, rw if read-write
         no further I/O will be permitted and the status will just
         contain the string 'Fail'.  The userspace recovery tools
         should then be used.
+needs_check              : 'needs_check' if set, '-' if not set
+        A metadata operation has failed, resulting in the needs_check
+        flag being set in the metadata's superblock.  The metadata
+        device must be deactivated and checked/repaired before the
+        cache can be made fully operational again.  '-' indicates
+        needs_check is not set.
 
 Messages
 --------
diff --git a/Documentation/device-mapper/thin-provisioning.txt b/Documentation/device-mapper/thin-provisioning.txt
index 4f67578b2954..1699a55b7b70 100644
--- a/Documentation/device-mapper/thin-provisioning.txt
+++ b/Documentation/device-mapper/thin-provisioning.txt
@@ -296,7 +296,7 @@ ii) Status
         underlying device.  When this is enabled when loading the table,
         it can get disabled if the underlying device doesn't support it.
 
-    ro|rw
+    ro|rw|out_of_data_space
         If the pool encounters certain types of device failures it will
         drop into a read-only metadata mode in which no changes to
         the pool metadata (like allocating new blocks) are permitted.
@@ -314,6 +314,13 @@ ii) Status
         module parameter can be used to change this timeout -- it
         defaults to 60 seconds but may be disabled using a value of 0.
 
+    needs_check
+        A metadata operation has failed, resulting in the needs_check
+        flag being set in the metadata's superblock.  The metadata
+        device must be deactivated and checked/repaired before the
+        thin-pool can be made fully operational again.  '-' indicates
+        needs_check is not set.
+
 iii) Messages
 
     create_thin <dev id>
diff --git a/Documentation/devicetree/bindings/arm/sunxi.txt b/Documentation/devicetree/bindings/arm/sunxi.txt
index 42941fdefb11..67da20539540 100644
--- a/Documentation/devicetree/bindings/arm/sunxi.txt
+++ b/Documentation/devicetree/bindings/arm/sunxi.txt
@@ -9,4 +9,6 @@ using one of the following compatible strings:
   allwinner,sun6i-a31
   allwinner,sun7i-a20
   allwinner,sun8i-a23
+  allwinner,sun8i-a33
+  allwinner,sun8i-h3
   allwinner,sun9i-a80
diff --git a/Documentation/devicetree/bindings/drm/imx/fsl-imx-drm.txt b/Documentation/devicetree/bindings/drm/imx/fsl-imx-drm.txt
index e75f0e549fff..971c3eedb1c7 100644
--- a/Documentation/devicetree/bindings/drm/imx/fsl-imx-drm.txt
+++ b/Documentation/devicetree/bindings/drm/imx/fsl-imx-drm.txt
@@ -65,8 +65,10 @@ Optional properties:
 - edid: verbatim EDID data block describing attached display.
 - ddc: phandle describing the i2c bus handling the display data
   channel
-- port: A port node with endpoint definitions as defined in
+- port@[0-1]: Port nodes with endpoint definitions as defined in
   Documentation/devicetree/bindings/media/video-interfaces.txt.
+  Port 0 is the input port connected to the IPU display interface,
+  port 1 is the output port connected to a panel.
 
 example:
 
@@ -75,9 +77,29 @@ display@di0 {
         edid = [edid-data];
         interface-pix-fmt = "rgb24";
 
-        port {
+        port@0 {
+                reg = <0>;
+
                 display_in: endpoint {
                         remote-endpoint = <&ipu_di0_disp0>;
                 };
         };
+
+        port@1 {
+                reg = <1>;
+
+                display_out: endpoint {
+                        remote-endpoint = <&panel_in>;
+                };
+        };
+};
+
+panel {
+        ...
+
+        port {
+                panel_in: endpoint {
+                        remote-endpoint = <&display_out>;
+                };
+        };
 };
diff --git a/Documentation/devicetree/bindings/iommu/arm,smmu-v3.txt b/Documentation/devicetree/bindings/iommu/arm,smmu-v3.txt
index c03eec116872..3443e0f838df 100644
--- a/Documentation/devicetree/bindings/iommu/arm,smmu-v3.txt
+++ b/Documentation/devicetree/bindings/iommu/arm,smmu-v3.txt
@@ -35,3 +35,6 @@ the PCIe specification.
 
                       NOTE: this only applies to the SMMU itself, not
                       masters connected upstream of the SMMU.
+
+- hisilicon,broken-prefetch-cmd
+                    : Avoid sending CMD_PREFETCH_* commands to the SMMU.
diff --git a/Documentation/devicetree/bindings/memory-controllers/ti/emif.txt b/Documentation/devicetree/bindings/memory-controllers/ti/emif.txt
index 938f8e1ba205..0db60470ebb6 100644
--- a/Documentation/devicetree/bindings/memory-controllers/ti/emif.txt
+++ b/Documentation/devicetree/bindings/memory-controllers/ti/emif.txt
@@ -8,6 +8,7 @@ of the EMIF IP and memory parts attached to it.
 Required properties:
 - compatible    : Should be of the form "ti,emif-<ip-rev>" where <ip-rev>
   is the IP revision of the specific EMIF instance.
+                  For am437x should be ti,emif-am4372.
 
 - phy-type      : <u32> indicating the DDR phy type. Following are the
   allowed values
diff --git a/Documentation/devicetree/bindings/mmc/fsl-imx-esdhc.txt b/Documentation/devicetree/bindings/mmc/fsl-imx-esdhc.txt
index 5d0376b8f202..211e7785f4d2 100644
--- a/Documentation/devicetree/bindings/mmc/fsl-imx-esdhc.txt
+++ b/Documentation/devicetree/bindings/mmc/fsl-imx-esdhc.txt
@@ -17,7 +17,6 @@ Required properties:
                "fsl,imx6sx-usdhc"
 
 Optional properties:
-- fsl,cd-controller : Indicate to use controller internal card detection
 - fsl,wp-controller : Indicate to use controller internal write protection
 - fsl,delay-line : Specify the number of delay cells for override mode.
   This is used to set the clock delay for DLL(Delay Line) on override mode
@@ -35,7 +34,6 @@ esdhc@70004000 {
         compatible = "fsl,imx51-esdhc";
         reg = <0x70004000 0x4000>;
         interrupts = <1>;
-        fsl,cd-controller;
         fsl,wp-controller;
 };
 
diff --git a/Documentation/kbuild/makefiles.txt b/Documentation/kbuild/makefiles.txt
index e63b446d973c..13f888a02a3d 100644
--- a/Documentation/kbuild/makefiles.txt
+++ b/Documentation/kbuild/makefiles.txt
@@ -952,6 +952,14 @@ When kbuild executes, the following steps are followed (roughly):
         $(KBUILD_ARFLAGS) set by the top level Makefile to "D" (deterministic
         mode) if this option is supported by $(AR).
 
+    ARCH_CPPFLAGS, ARCH_AFLAGS, ARCH_CFLAGS   Overrides the kbuild defaults
+
+        These variables are appended to the KBUILD_CPPFLAGS,
+        KBUILD_AFLAGS, and KBUILD_CFLAGS, respectively, after the
+        top-level Makefile has set any other flags. This provides a
+        means for an architecture to override the defaults.
+
+
 --- 6.2 Add prerequisites to archheaders:
 
         The archheaders: rule is used to generate header files that
diff --git a/Documentation/power/swsusp.txt b/Documentation/power/swsusp.txt
index f732a8321e8a..8cc17ca71813 100644
--- a/Documentation/power/swsusp.txt
+++ b/Documentation/power/swsusp.txt
@@ -410,8 +410,17 @@ Documentation/usb/persist.txt.
 
 Q: Can I suspend-to-disk using a swap partition under LVM?
 
-A: No. You can suspend successfully, but you'll not be able to
-resume. uswsusp should be able to work with LVM. See suspend.sf.net.
+A: Yes and No.  You can suspend successfully, but the kernel will not be able
+to resume on its own.  You need an initramfs that can recognize the resume
+situation, activate the logical volume containing the swap volume (but not
+touch any filesystems!), and eventually call
+
+echo -n "$major:$minor" > /sys/power/resume
+
+where $major and $minor are the respective major and minor device numbers of
+the swap volume.
+
+uswsusp works with LVM, too.  See http://suspend.sourceforge.net/
 
 Q: I upgraded the kernel from 2.6.15 to 2.6.16. Both kernels were
 compiled with the similar configuration files. Anyway I found that
diff --git a/MAINTAINERS b/MAINTAINERS
index 8133cefb6b6e..9289ecb57b68 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -361,11 +361,11 @@ S:	Supported
 F:      drivers/input/touchscreen/ad7879.c
 
 ADDRESS SPACE LAYOUT RANDOMIZATION (ASLR)
-M:      Jiri Kosina <jkosina@suse.cz>
+M:      Jiri Kosina <jkosina@suse.com>
 S:      Maintained
 
 ADM1025 HARDWARE MONITOR DRIVER
-M:      Jean Delvare <jdelvare@suse.de>
+M:      Jean Delvare <jdelvare@suse.com>
 L:      lm-sensors@lm-sensors.org
 S:      Maintained
 F:      Documentation/hwmon/adm1025
@@ -430,7 +430,7 @@ S:	Maintained
 F:      drivers/macintosh/therm_adt746x.c
 
 ADT7475 HARDWARE MONITOR DRIVER
-M:      Jean Delvare <jdelvare@suse.de>
+M:      Jean Delvare <jdelvare@suse.com>
 L:      lm-sensors@lm-sensors.org
 S:      Maintained
 F:      Documentation/hwmon/adt7475
@@ -445,7 +445,7 @@ F:	drivers/input/misc/adxl34x.c
 
 ADVANSYS SCSI DRIVER
 M:      Matthew Wilcox <matthew@wil.cx>
-M:      Hannes Reinecke <hare@suse.de>
+M:      Hannes Reinecke <hare@suse.com>
 L:      linux-scsi@vger.kernel.org
 S:      Maintained
 F:      Documentation/scsi/advansys.txt
@@ -506,7 +506,7 @@ F:	drivers/scsi/aha152x*
 F:      drivers/scsi/pcmcia/aha152x*
 
 AIC7XXX / AIC79XX SCSI DRIVER
-M:      Hannes Reinecke <hare@suse.de>
+M:      Hannes Reinecke <hare@suse.com>
 L:      linux-scsi@vger.kernel.org
 S:      Maintained
 F:      drivers/scsi/aic7xxx/
@@ -746,7 +746,7 @@ S:	Maintained
 F:      sound/aoa/
 
 APM DRIVER
-M:      Jiri Kosina <jkosina@suse.cz>
+M:      Jiri Kosina <jkosina@suse.com>
 S:      Odd fixes
 F:      arch/x86/kernel/apm_32.c
 F:      include/linux/apm_bios.h
@@ -1001,6 +1001,7 @@ ARM/CONEXANT DIGICOLOR MACHINE SUPPORT
 M:      Baruch Siach <baruch@tkos.co.il>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
+F:      arch/arm/boot/dts/cx92755*
 N:      digicolor
 
 ARM/EBSA110 MACHINE SUPPORT
@@ -1324,7 +1325,7 @@ F:	arch/arm/mach-pxa/include/mach/palmtc.h
 F:      arch/arm/mach-pxa/palmtc.c
 
 ARM/PALM TREO SUPPORT
-M:      Tomas Cech <sleep_walker@suse.cz>
+M:      Tomas Cech <sleep_walker@suse.com>
 L:      linux-arm-kernel@lists.infradead.org
 W:      http://hackndev.com
 S:      Maintained
@@ -1614,6 +1615,7 @@ M:	Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
 F:      arch/arm/boot/dts/vexpress*
+F:      arch/arm64/boot/dts/arm/vexpress*
 F:      arch/arm/mach-vexpress/
 F:      */*/vexpress*
 F:      */*/*/vexpress*
@@ -2404,7 +2406,7 @@ F:	drivers/gpio/gpio-bt8xx.c
 BTRFS FILE SYSTEM
 M:      Chris Mason <clm@fb.com>
 M:      Josef Bacik <jbacik@fb.com>
-M:      David Sterba <dsterba@suse.cz>
+M:      David Sterba <dsterba@suse.com>
 L:      linux-btrfs@vger.kernel.org
 W:      http://btrfs.wiki.kernel.org/
 Q:      http://patchwork.kernel.org/project/linux-btrfs/list/
@@ -2562,19 +2564,31 @@ F:	arch/powerpc/include/uapi/asm/spu*.h
 F:      arch/powerpc/oprofile/*cell*
 F:      arch/powerpc/platforms/cell/
 
-CEPH DISTRIBUTED FILE SYSTEM CLIENT
+CEPH COMMON CODE (LIBCEPH)
+M:      Ilya Dryomov <idryomov@gmail.com>
 M:      "Yan, Zheng" <zyan@redhat.com>
 M:      Sage Weil <sage@redhat.com>
 L:      ceph-devel@vger.kernel.org
 W:      http://ceph.com/
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client.git
+T:      git git://github.com/ceph/ceph-client.git
 S:      Supported
-F:      Documentation/filesystems/ceph.txt
-F:      fs/ceph/
 F:      net/ceph/
 F:      include/linux/ceph/
 F:      include/linux/crush/
 
+CEPH DISTRIBUTED FILE SYSTEM CLIENT (CEPH)
+M:      "Yan, Zheng" <zyan@redhat.com>
+M:      Sage Weil <sage@redhat.com>
+M:      Ilya Dryomov <idryomov@gmail.com>
+L:      ceph-devel@vger.kernel.org
+W:      http://ceph.com/
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client.git
+T:      git git://github.com/ceph/ceph-client.git
+S:      Supported
+F:      Documentation/filesystems/ceph.txt
+F:      fs/ceph/
+
 CERTIFIED WIRELESS USB (WUSB) SUBSYSTEM:
 L:      linux-usb@vger.kernel.org
 S:      Orphan
@@ -2735,7 +2749,7 @@ COCCINELLE/Semantic Patches (SmPL)
 M:      Julia Lawall <Julia.Lawall@lip6.fr>
 M:      Gilles Muller <Gilles.Muller@lip6.fr>
 M:      Nicolas Palix <nicolas.palix@imag.fr>
-M:      Michal Marek <mmarek@suse.cz>
+M:      Michal Marek <mmarek@suse.com>
 L:      cocci@systeme.lip6.fr (moderated for non-subscribers)
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild.git misc
 W:      http://coccinelle.lip6.fr/
@@ -2851,7 +2865,7 @@ F:	kernel/cpuset.c
 
 CONTROL GROUP - MEMORY RESOURCE CONTROLLER (MEMCG)
 M:      Johannes Weiner <hannes@cmpxchg.org>
-M:      Michal Hocko <mhocko@suse.cz>
+M:      Michal Hocko <mhocko@kernel.org>
 L:      cgroups@vger.kernel.org
 L:      linux-mm@kvack.org
 S:      Maintained
@@ -2932,7 +2946,7 @@ F:	arch/x86/kernel/cpuid.c
 F:      arch/x86/kernel/msr.c
 
 CPU POWER MONITORING SUBSYSTEM
-M:      Thomas Renninger <trenn@suse.de>
+M:      Thomas Renninger <trenn@suse.com>
 L:      linux-pm@vger.kernel.org
 S:      Maintained
 F:      tools/power/cpupower/
@@ -3162,7 +3176,7 @@ F:	Documentation/networking/dmfe.txt
 F:      drivers/net/ethernet/dec/tulip/dmfe.c
 
 DC390/AM53C974 SCSI driver
-M:      Hannes Reinecke <hare@suse.de>
+M:      Hannes Reinecke <hare@suse.com>
 L:      linux-scsi@vger.kernel.org
 S:      Maintained
 F:      drivers/scsi/am53c974.c
@@ -3366,7 +3380,7 @@ W:	http://www.win.tue.nl/~aeb/partitions/partition_types-1.html
 S:      Maintained
 
 DISKQUOTA
-M:      Jan Kara <jack@suse.cz>
+M:      Jan Kara <jack@suse.com>
 S:      Maintained
 F:      Documentation/filesystems/quota.txt
 F:      fs/quota/
@@ -3422,7 +3436,7 @@ F:	Documentation/hwmon/dme1737
 F:      drivers/hwmon/dme1737.c
 
 DMI/SMBIOS SUPPORT
-M:      Jean Delvare <jdelvare@suse.de>
+M:      Jean Delvare <jdelvare@suse.com>
 S:      Maintained
 T:      quilt http://jdelvare.nerim.net/devel/linux/jdelvare-dmi/
 F:      Documentation/ABI/testing/sysfs-firmware-dmi-tables
@@ -4038,7 +4052,7 @@ F:	drivers/of/of_mdio.c
 F:      drivers/of/of_net.c
 
 EXT2 FILE SYSTEM
-M:      Jan Kara <jack@suse.cz>
+M:      Jan Kara <jack@suse.com>
 L:      linux-ext4@vger.kernel.org
 S:      Maintained
 F:      Documentation/filesystems/ext2.txt
@@ -4046,7 +4060,7 @@ F:	fs/ext2/
 F:      include/linux/ext2*
 
 EXT3 FILE SYSTEM
-M:      Jan Kara <jack@suse.cz>
+M:      Jan Kara <jack@suse.com>
 M:      Andrew Morton <akpm@linux-foundation.org>
 M:      Andreas Dilger <adilger.kernel@dilger.ca>
 L:      linux-ext4@vger.kernel.org
@@ -4096,7 +4110,7 @@ F:	drivers/video/fbdev/exynos/exynos_mipi*
 F:      include/video/exynos_mipi*
 
 F71805F HARDWARE MONITORING DRIVER
-M:      Jean Delvare <jdelvare@suse.de>
+M:      Jean Delvare <jdelvare@suse.com>
 L:      lm-sensors@lm-sensors.org
 S:      Maintained
 F:      Documentation/hwmon/f71805f
@@ -4231,7 +4245,7 @@ S:	Maintained
 F:      drivers/block/rsxx/
 
 FLOPPY DRIVER
-M:      Jiri Kosina <jkosina@suse.cz>
+M:      Jiri Kosina <jkosina@suse.com>
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jikos/floppy.git
 S:      Odd fixes
 F:      drivers/block/floppy.c
@@ -4652,7 +4666,7 @@ F:	drivers/media/usb/stk1160/
 
 H8/300 ARCHITECTURE
 M:      Yoshinori Sato <ysato@users.sourceforge.jp>
-L:      uclinux-h8-devel@lists.sourceforge.jp
+L:      uclinux-h8-devel@lists.sourceforge.jp (moderated for non-subscribers)
 W:      http://uclinux-h8.sourceforge.jp
 T:      git git://git.sourceforge.jp/gitroot/uclinux-h8/linux.git
 S:      Maintained
@@ -4699,7 +4713,7 @@ S:	Maintained
 F:      drivers/media/usb/hackrf/
 
 HARDWARE MONITORING
-M:      Jean Delvare <jdelvare@suse.de>
+M:      Jean Delvare <jdelvare@suse.com>
 M:      Guenter Roeck <linux@roeck-us.net>
 L:      lm-sensors@lm-sensors.org
 W:      http://www.lm-sensors.org/
@@ -4802,7 +4816,7 @@ F:	include/linux/pm.h
 F:      arch/*/include/asm/suspend*.h
 
 HID CORE LAYER
-M:      Jiri Kosina <jkosina@suse.cz>
+M:      Jiri Kosina <jkosina@suse.com>
 L:      linux-input@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid.git
 S:      Maintained
@@ -4811,7 +4825,7 @@ F:	include/linux/hid*
 F:      include/uapi/linux/hid*
 
 HID SENSOR HUB DRIVERS
-M:      Jiri Kosina <jkosina@suse.cz>
+M:      Jiri Kosina <jkosina@suse.com>
 M:      Jonathan Cameron <jic23@kernel.org>
 M:      Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
 L:      linux-input@vger.kernel.org
@@ -4945,7 +4959,7 @@ F:	include/linux/hyperv.h
 F:      tools/hv/
 
 I2C OVER PARALLEL PORT
-M:      Jean Delvare <jdelvare@suse.de>
+M:      Jean Delvare <jdelvare@suse.com>
 L:      linux-i2c@vger.kernel.org
 S:      Maintained
 F:      Documentation/i2c/busses/i2c-parport
@@ -4954,7 +4968,7 @@ F:	drivers/i2c/busses/i2c-parport.c
 F:      drivers/i2c/busses/i2c-parport-light.c
 
 I2C/SMBUS CONTROLLER DRIVERS FOR PC
-M:      Jean Delvare <jdelvare@suse.de>
+M:      Jean Delvare <jdelvare@suse.com>
 L:      linux-i2c@vger.kernel.org
 S:      Maintained
 F:      Documentation/i2c/busses/i2c-ali1535
@@ -4995,7 +5009,7 @@ F:	drivers/i2c/busses/i2c-ismt.c
 F:      Documentation/i2c/busses/i2c-ismt
 
 I2C/SMBUS STUB DRIVER
-M:      Jean Delvare <jdelvare@suse.de>
+M:      Jean Delvare <jdelvare@suse.com>
 L:      linux-i2c@vger.kernel.org
 S:      Maintained
 F:      drivers/i2c/i2c-stub.c
@@ -5022,7 +5036,7 @@ L:	linux-acpi@vger.kernel.org
 S:      Maintained
 
 I2C-TAOS-EVM DRIVER
-M:      Jean Delvare <jdelvare@suse.de>
+M:      Jean Delvare <jdelvare@suse.com>
 L:      linux-i2c@vger.kernel.org
 S:      Maintained
 F:      Documentation/i2c/busses/i2c-taos-evm
@@ -5551,8 +5565,8 @@ F:	include/uapi/linux/ip_vs.h
 F:      net/netfilter/ipvs/
 
 IPWIRELESS DRIVER
-M:      Jiri Kosina <jkosina@suse.cz>
-M:      David Sterba <dsterba@suse.cz>
+M:      Jiri Kosina <jkosina@suse.com>
+M:      David Sterba <dsterba@suse.com>
 S:      Odd Fixes
 F:      drivers/tty/ipwireless/
 
@@ -5672,7 +5686,7 @@ S:	Maintained
 F:      drivers/isdn/hardware/eicon/
 
 IT87 HARDWARE MONITORING DRIVER
-M:      Jean Delvare <jdelvare@suse.de>
+M:      Jean Delvare <jdelvare@suse.com>
 L:      lm-sensors@lm-sensors.org
 S:      Maintained
 F:      Documentation/hwmon/it87
@@ -5739,7 +5753,7 @@ F:	include/uapi/linux/jffs2.h
 
 JOURNALLING LAYER FOR BLOCK DEVICES (JBD)
 M:      Andrew Morton <akpm@linux-foundation.org>
-M:      Jan Kara <jack@suse.cz>
+M:      Jan Kara <jack@suse.com>
 L:      linux-ext4@vger.kernel.org
 S:      Maintained
 F:      fs/jbd/
@@ -5803,7 +5817,7 @@ S:	Maintained
 F:      fs/autofs4/
 
 KERNEL BUILD + files below scripts/ (unless maintained elsewhere)
-M:      Michal Marek <mmarek@suse.cz>
+M:      Michal Marek <mmarek@suse.com>
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild.git for-next
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild.git rc-fixes
 L:      linux-kbuild@vger.kernel.org
@@ -5867,7 +5881,7 @@ F:	arch/x86/include/asm/svm.h
 F:      arch/x86/kvm/svm.c
 
 KERNEL VIRTUAL MACHINE (KVM) FOR POWERPC
-M:      Alexander Graf <agraf@suse.de>
+M:      Alexander Graf <agraf@suse.com>
 L:      kvm-ppc@vger.kernel.org
 W:      http://kvm.qumranet.com
 T:      git git://github.com/agraf/linux-2.6.git
@@ -5885,7 +5899,6 @@ S:	Supported
 F:      Documentation/s390/kvm.txt
 F:      arch/s390/include/asm/kvm*
 F:      arch/s390/kvm/
-F:      drivers/s390/kvm/
 
 KERNEL VIRTUAL MACHINE (KVM) FOR ARM
 M:      Christoffer Dall <christoffer.dall@linaro.org>
@@ -6024,7 +6037,7 @@ F:	drivers/leds/
 F:      include/linux/leds.h
 
 LEGACY EEPROM DRIVER
-M:      Jean Delvare <jdelvare@suse.de>
+M:      Jean Delvare <jdelvare@suse.com>
 S:      Maintained
 F:      Documentation/misc-devices/eeprom
 F:      drivers/misc/eeprom/eeprom.c
@@ -6077,7 +6090,7 @@ F:	include/linux/ata.h
 F:      include/linux/libata.h
 
 LIBATA PATA ARASAN COMPACT FLASH CONTROLLER
-M:      Viresh Kumar <viresh.linux@gmail.com>
+M:      Viresh Kumar <vireshk@kernel.org>
 L:      linux-ide@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata.git
 S:      Maintained
@@ -6147,6 +6160,7 @@ L:	linux-nvdimm@lists.01.org
 Q:      https://patchwork.kernel.org/project/linux-nvdimm/list/
 S:      Supported
 F:      drivers/nvdimm/pmem.c
+F:      include/linux/pmem.h
 
 LINUX FOR IBM pSERIES (RS/6000)
 M:      Paul Mackerras <paulus@au.ibm.com>
@@ -6161,7 +6175,7 @@ M:	Michael Ellerman <mpe@ellerman.id.au>
 W:      http://www.penguinppc.org/
 L:      linuxppc-dev@lists.ozlabs.org
 Q:      http://patchwork.ozlabs.org/project/linuxppc-dev/list/
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git
 S:      Supported
 F:      Documentation/powerpc/
 F:      arch/powerpc/
@@ -6237,8 +6251,8 @@ F:	drivers/platform/x86/hp_accel.c
 LIVE PATCHING
 M:      Josh Poimboeuf <jpoimboe@redhat.com>
 M:      Seth Jennings <sjenning@redhat.com>
-M:      Jiri Kosina <jkosina@suse.cz>
-M:      Vojtech Pavlik <vojtech@suse.cz>
+M:      Jiri Kosina <jkosina@suse.com>
+M:      Vojtech Pavlik <vojtech@suse.com>
 S:      Maintained
 F:      kernel/livepatch/
 F:      include/linux/livepatch.h
@@ -6264,21 +6278,21 @@ S:	Maintained
 F:      drivers/hwmon/lm73.c
 
 LM78 HARDWARE MONITOR DRIVER
-M:      Jean Delvare <jdelvare@suse.de>
+M:      Jean Delvare <jdelvare@suse.com>
 L:      lm-sensors@lm-sensors.org
 S:      Maintained
 F:      Documentation/hwmon/lm78
 F:      drivers/hwmon/lm78.c
 
 LM83 HARDWARE MONITOR DRIVER
-M:      Jean Delvare <jdelvare@suse.de>
+M:      Jean Delvare <jdelvare@suse.com>
 L:      lm-sensors@lm-sensors.org
 S:      Maintained
 F:      Documentation/hwmon/lm83
 F:      drivers/hwmon/lm83.c
 
 LM90 HARDWARE MONITOR DRIVER
-M:      Jean Delvare <jdelvare@suse.de>
+M:      Jean Delvare <jdelvare@suse.com>
 L:      lm-sensors@lm-sensors.org
 S:      Maintained
 F:      Documentation/hwmon/lm90
@@ -6824,6 +6838,12 @@ T:	git git://linuxtv.org/anttip/media_tree.git
 S:      Maintained
 F:      drivers/media/usb/msi2500/
 
+MSYSTEMS DISKONCHIP G3 MTD DRIVER
+M:      Robert Jarzmik <robert.jarzmik@free.fr>
+L:      linux-mtd@lists.infradead.org
+S:      Maintained
+F:      drivers/mtd/devices/docg3*
+
 MT9M032 APTINA SENSOR DRIVER
 M:      Laurent Pinchart <laurent.pinchart@ideasonboard.com>
 L:      linux-media@vger.kernel.org
@@ -7005,6 +7025,7 @@ F:	include/uapi/linux/netfilter/
 F:      net/*/netfilter.c
 F:      net/*/netfilter/
 F:      net/netfilter/
+F:      net/bridge/br_netfilter*.c
 
 NETLABEL
 M:      Paul Moore <paul@paul-moore.com>
@@ -7704,7 +7725,7 @@ S:	Maintained
 F:      drivers/char/pc8736x_gpio.c
 
 PC87427 HARDWARE MONITORING DRIVER
-M:      Jean Delvare <jdelvare@suse.de>
+M:      Jean Delvare <jdelvare@suse.com>
 L:      lm-sensors@lm-sensors.org
 S:      Maintained
 F:      Documentation/hwmon/pc87427
@@ -7981,7 +8002,7 @@ S:	Maintained
 F:      drivers/pinctrl/samsung/
 
 PIN CONTROLLER - ST SPEAR
-M:      Viresh Kumar <viresh.linux@gmail.com>
+M:      Viresh Kumar <vireshk@kernel.org>
 L:      spear-devel@list.st.com
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 W:      http://www.st.com/spear
@@ -7989,7 +8010,7 @@ S:	Maintained
 F:      drivers/pinctrl/spear/
 
 PKTCDVD DRIVER
-M:      Jiri Kosina <jkosina@suse.cz>
+M:      Jiri Kosina <jkosina@suse.com>
 S:      Maintained
 F:      drivers/block/pktcdvd.c
 F:      include/linux/pktcdvd.h
@@ -8366,10 +8387,12 @@ RADOS BLOCK DEVICE (RBD)
 M:      Ilya Dryomov <idryomov@gmail.com>
 M:      Sage Weil <sage@redhat.com>
 M:      Alex Elder <elder@kernel.org>
-M:      ceph-devel@vger.kernel.org
+L:      ceph-devel@vger.kernel.org
 W:      http://ceph.com/
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client.git
+T:      git git://github.com/ceph/ceph-client.git
 S:      Supported
+F:      Documentation/ABI/testing/sysfs-bus-rbd
 F:      drivers/block/rbd.c
 F:      drivers/block/rbd_types.h
 
@@ -8878,7 +8901,7 @@ S:	Maintained
 F:      drivers/tty/serial/
 
 SYNOPSYS DESIGNWARE DMAC DRIVER
-M:      Viresh Kumar <viresh.linux@gmail.com>
+M:      Viresh Kumar <vireshk@kernel.org>
 M:      Andy Shevchenko <andriy.shevchenko@linux.intel.com>
 S:      Maintained
 F:      include/linux/dma/dw.h
@@ -9045,7 +9068,7 @@ S:	Maintained
 F:      drivers/mmc/host/sdhci-s3c*
 
 SECURE DIGITAL HOST CONTROLLER INTERFACE (SDHCI) ST SPEAR DRIVER
-M:      Viresh Kumar <viresh.linux@gmail.com>
+M:      Viresh Kumar <vireshk@kernel.org>
 L:      spear-devel@list.st.com
 L:      linux-mmc@vger.kernel.org
 S:      Maintained
@@ -9407,7 +9430,7 @@ F:	Documentation/hwmon/sch5627
 F:      drivers/hwmon/sch5627.c
 
 SMSC47B397 HARDWARE MONITOR DRIVER
-M:      Jean Delvare <jdelvare@suse.de>
+M:      Jean Delvare <jdelvare@suse.com>
 L:      lm-sensors@lm-sensors.org
 S:      Maintained
 F:      Documentation/hwmon/smsc47b397
@@ -9456,7 +9479,7 @@ S:	Supported
 F:      drivers/media/pci/solo6x10/
 
 SOFTWARE RAID (Multiple Disks) SUPPORT
-M:      Neil Brown <neilb@suse.de>
+M:      Neil Brown <neilb@suse.com>
 L:      linux-raid@vger.kernel.org
 S:      Supported
 F:      drivers/md/
@@ -9499,7 +9522,7 @@ F:	drivers/memstick/core/ms_block.*
 
 SOUND
 M:      Jaroslav Kysela <perex@perex.cz>
-M:      Takashi Iwai <tiwai@suse.de>
+M:      Takashi Iwai <tiwai@suse.com>
 L:      alsa-devel@alsa-project.org (moderated for non-subscribers)
 W:      http://www.alsa-project.org/
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git
@@ -9583,7 +9606,7 @@ S:	Maintained
 F:      include/linux/compiler.h
 
 SPEAR PLATFORM SUPPORT
-M:      Viresh Kumar <viresh.linux@gmail.com>
+M:      Viresh Kumar <vireshk@kernel.org>
 M:      Shiraz Hashim <shiraz.linux.kernel@gmail.com>
 L:      spear-devel@list.st.com
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
@@ -9592,7 +9615,7 @@ S:	Maintained
 F:      arch/arm/mach-spear/
 
 SPEAR CLOCK FRAMEWORK SUPPORT
-M:      Viresh Kumar <viresh.linux@gmail.com>
+M:      Viresh Kumar <vireshk@kernel.org>
 L:      spear-devel@list.st.com
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 W:      http://www.st.com/spear
@@ -10382,7 +10405,7 @@ K:	^Subject:.*(?i)trivial
 
 TTY LAYER
 M:      Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-M:      Jiri Slaby <jslaby@suse.cz>
+M:      Jiri Slaby <jslaby@suse.com>
 S:      Supported
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git
 F:      Documentation/serial/
@@ -10456,7 +10479,7 @@ F:	arch/m68k/*/*_no.*
 F:      arch/m68k/include/asm/*_no.*
 
 UDF FILESYSTEM
-M:      Jan Kara <jack@suse.cz>
+M:      Jan Kara <jack@suse.com>
 S:      Maintained
 F:      Documentation/filesystems/udf.txt
 F:      fs/udf/
@@ -10599,7 +10622,7 @@ F:	drivers/usb/gadget/
 F:      include/linux/usb/gadget*
 
 USB HID/HIDBP DRIVERS (USB KEYBOARDS, MICE, REMOTE CONTROLS, ...)
-M:      Jiri Kosina <jkosina@suse.cz>
+M:      Jiri Kosina <jkosina@suse.com>
 L:      linux-usb@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid.git
 S:      Maintained
@@ -10724,7 +10747,7 @@ S:	Maintained
 F:      drivers/usb/host/uhci*
 
 USB "USBNET" DRIVER FRAMEWORK
-M:      Oliver Neukum <oneukum@suse.de>
+M:      Oliver Neukum <oneukum@suse.com>
 L:      netdev@vger.kernel.org
 W:      http://www.linux-usb.org/usbnet
 S:      Maintained
@@ -10878,6 +10901,15 @@ F:	drivers/block/virtio_blk.c
 F:      include/linux/virtio_*.h
 F:      include/uapi/linux/virtio_*.h
 
+VIRTIO DRIVERS FOR S390
+M:      Christian Borntraeger <borntraeger@de.ibm.com>
+M:      Cornelia Huck <cornelia.huck@de.ibm.com>
+L:      linux-s390@vger.kernel.org
+L:      virtualization@lists.linux-foundation.org
+L:      kvm@vger.kernel.org
+S:      Supported
+F:      drivers/s390/virtio/
+
 VIRTIO GPU DRIVER
 M:      David Airlie <airlied@linux.ie>
 M:      Gerd Hoffmann <kraxel@redhat.com>
@@ -11051,7 +11083,7 @@ F:	Documentation/hwmon/w83793
 F:      drivers/hwmon/w83793.c
 
 W83795 HARDWARE MONITORING DRIVER
-M:      Jean Delvare <jdelvare@suse.de>
+M:      Jean Delvare <jdelvare@suse.com>
 L:      lm-sensors@lm-sensors.org
 S:      Maintained
 F:      drivers/hwmon/w83795.c
diff --git a/Makefile b/Makefile
index 13270c0a9336..afabc44a349b 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 4
 PATCHLEVEL = 2
 SUBLEVEL = 0
-EXTRAVERSION = -rc1
+EXTRAVERSION = -rc4
 NAME = Hurr durr I'ma sheep
 
 # *DOCUMENTATION*
@@ -780,10 +780,11 @@ endif
 include scripts/Makefile.kasan
 include scripts/Makefile.extrawarn
 
-# Add user supplied CPPFLAGS, AFLAGS and CFLAGS as the last assignments
-KBUILD_CPPFLAGS += $(KCPPFLAGS)
-KBUILD_AFLAGS += $(KAFLAGS)
-KBUILD_CFLAGS += $(KCFLAGS)
+# Add any arch overrides and user supplied CPPFLAGS, AFLAGS and CFLAGS as the
+# last assignments
+KBUILD_CPPFLAGS += $(ARCH_CPPFLAGS) $(KCPPFLAGS)
+KBUILD_AFLAGS   += $(ARCH_AFLAGS)   $(KAFLAGS)
+KBUILD_CFLAGS   += $(ARCH_CFLAGS)   $(KCFLAGS)
 
 # Use --build-id when available.
 LDFLAGS_BUILD_ID = $(patsubst -Wl$(comma)%,%,\
diff --git a/arch/Kconfig b/arch/Kconfig
index bec6666a3cc4..8a8ea7110de8 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -221,6 +221,10 @@ config ARCH_TASK_STRUCT_ALLOCATOR
 config ARCH_THREAD_INFO_ALLOCATOR
         bool
 
+# Select if arch wants to size task_struct dynamically via arch_task_struct_size:
+config ARCH_WANTS_DYNAMIC_TASK_STRUCT
+        bool
+
 config HAVE_REGS_AND_STACK_ACCESS_API
         bool
         help
diff --git a/arch/alpha/include/asm/Kbuild b/arch/alpha/include/asm/Kbuild
index cde23cd03609..ffd9cf5ec8c4 100644
--- a/arch/alpha/include/asm/Kbuild
+++ b/arch/alpha/include/asm/Kbuild
@@ -5,6 +5,7 @@ generic-y += cputime.h
 generic-y += exec.h
 generic-y += irq_work.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += preempt.h
 generic-y += sections.h
 generic-y += trace_clock.h
diff --git a/arch/alpha/include/asm/mm-arch-hooks.h b/arch/alpha/include/asm/mm-arch-hooks.h
deleted file mode 100644
index b07fd862fec3..000000000000
--- a/arch/alpha/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#ifndef _ASM_ALPHA_MM_ARCH_HOOKS_H
-#define _ASM_ALPHA_MM_ARCH_HOOKS_H
-
-#endif /* _ASM_ALPHA_MM_ARCH_HOOKS_H */
diff --git a/arch/arc/Kconfig b/arch/arc/Kconfig
index e7cee0a5c56d..91cf4055acab 100644
--- a/arch/arc/Kconfig
+++ b/arch/arc/Kconfig
@@ -115,6 +115,7 @@ if ISA_ARCOMPACT
 
 config ARC_CPU_750D
         bool "ARC750D"
+        select ARC_CANT_LLSC
         help
           Support for ARC750 core
 
@@ -362,7 +363,7 @@ config ARC_CANT_LLSC
 config ARC_HAS_LLSC
         bool "Insn: LLOCK/SCOND (efficient atomic ops)"
         default y
-        depends on !ARC_CPU_750D && !ARC_CANT_LLSC
+        depends on !ARC_CANT_LLSC
 
 config ARC_HAS_SWAPE
         bool "Insn: SWAPE (endian-swap)"
diff --git a/arch/arc/Makefile b/arch/arc/Makefile
index 6107062c0111..46d87310220d 100644
--- a/arch/arc/Makefile
+++ b/arch/arc/Makefile
@@ -49,7 +49,8 @@ endif
 
 ifndef CONFIG_CC_OPTIMIZE_FOR_SIZE
 # Generic build system uses -O2, we want -O3
-cflags-y  += -O3
+# Note: No need to add to cflags-y as that happens anyways
+ARCH_CFLAGS += -O3
 endif
 
 # small data is default for elf32 tool-chain. If not usable, disable it
diff --git a/arch/arc/boot/dts/axc003.dtsi b/arch/arc/boot/dts/axc003.dtsi
index 15c8d6226c9d..1cd5e82f5dc2 100644
--- a/arch/arc/boot/dts/axc003.dtsi
+++ b/arch/arc/boot/dts/axc003.dtsi
@@ -12,7 +12,7 @@
 
 / {
         compatible = "snps,arc";
-        clock-frequency = <75000000>;
+        clock-frequency = <90000000>;
         #address-cells = <1>;
         #size-cells = <1>;
 
diff --git a/arch/arc/boot/dts/axc003_idu.dtsi b/arch/arc/boot/dts/axc003_idu.dtsi
index 199d42820eca..2f0b33257db2 100644
--- a/arch/arc/boot/dts/axc003_idu.dtsi
+++ b/arch/arc/boot/dts/axc003_idu.dtsi
@@ -12,7 +12,7 @@
 
 / {
         compatible = "snps,arc";
-        clock-frequency = <75000000>;
+        clock-frequency = <90000000>;
         #address-cells = <1>;
         #size-cells = <1>;
 
diff --git a/arch/arc/include/asm/Kbuild b/arch/arc/include/asm/Kbuild
index 1a80cc91a03b..7611b10a2d23 100644
--- a/arch/arc/include/asm/Kbuild
+++ b/arch/arc/include/asm/Kbuild
@@ -22,6 +22,7 @@ generic-y += kvm_para.h
 generic-y += local.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += mman.h
 generic-y += msgbuf.h
 generic-y += param.h
diff --git a/arch/arc/include/asm/bitops.h b/arch/arc/include/asm/bitops.h
index 99fe118d3730..57c1f33844d4 100644
--- a/arch/arc/include/asm/bitops.h
+++ b/arch/arc/include/asm/bitops.h
@@ -50,8 +50,7 @@ static inline void op##_bit(unsigned long nr, volatile unsigned long *m)\
          * done for const @nr, but no code is generated due to gcc      \
          * const prop.                                                  \
          */                                                             \
-        if (__builtin_constant_p(nr))                                   \
-                nr &= 0x1f;                                             \
+        nr &= 0x1f;                                                     \
                                                                         \
         __asm__ __volatile__(                                           \
         "1:     llock       %0, [%1]            \n"                     \
@@ -82,8 +81,7 @@ static inline int test_and_##op##_bit(unsigned long nr, volatile unsigned long *
                                                                         \
         m += nr >> 5;                                                   \
                                                                         \
-        if (__builtin_constant_p(nr))                                   \
-                nr &= 0x1f;                                             \
+        nr &= 0x1f;                                                     \
                                                                         \
         /*                                                              \
          * Explicit full memory barrier needed before/after as          \
@@ -129,16 +127,13 @@ static inline void op##_bit(unsigned long nr, volatile unsigned long *m)\
         unsigned long temp, flags;                                      \
         m += nr >> 5;                                                   \
                                                                         \
-        if (__builtin_constant_p(nr))                                   \
-                nr &= 0x1f;                                             \
-                                                                        \
         /*                                                              \
          * spin lock/unlock provide the needed smp_mb() before/after    \
          */                                                             \
         bitops_lock(flags);                                             \
                                                                         \
         temp = *m;                                                      \
-        *m = temp c_op (1UL << nr);                                     \
+        *m = temp c_op (1UL << (nr & 0x1f));                                    \
                                                                         \
         bitops_unlock(flags);                                           \
 }
@@ -149,17 +144,14 @@ static inline int test_and_##op##_bit(unsigned long nr, volatile unsigned long *
         unsigned long old, flags;                                       \
         m += nr >> 5;                                                   \
                                                                         \
-        if (__builtin_constant_p(nr))                                   \
-                nr &= 0x1f;                                             \
-                                                                        \
         bitops_lock(flags);                                             \
                                                                         \
         old = *m;                                                       \
-        *m = old c_op (1 << nr);                                        \
+        *m = old c_op (1UL << (nr & 0x1f));                             \
                                                                         \
         bitops_unlock(flags);                                           \
                                                                         \
-        return (old & (1 << nr)) != 0;                                  \
+        return (old & (1UL << (nr & 0x1f))) != 0;                       \
 }
 
 #endif /* CONFIG_ARC_HAS_LLSC */
@@ -174,11 +166,8 @@ static inline void __##op##_bit(unsigned long nr, volatile unsigned long *m)	\
         unsigned long temp;                                             \
         m += nr >> 5;                                                   \
                                                                         \
-        if (__builtin_constant_p(nr))                                   \
-                nr &= 0x1f;                                             \
-                                                                        \
         temp = *m;                                                      \
-        *m = temp c_op (1UL << nr);                                     \
+        *m = temp c_op (1UL << (nr & 0x1f));                            \
 }
 
 #define __TEST_N_BIT_OP(op, c_op, asm_op)                               \
@@ -187,13 +176,10 @@ static inline int __test_and_##op##_bit(unsigned long nr, volatile unsigned long
         unsigned long old;                                              \
         m += nr >> 5;                                                   \
                                                                         \
-        if (__builtin_constant_p(nr))                                   \
-                nr &= 0x1f;                                             \
-                                                                        \
         old = *m;                                                       \
-        *m = old c_op (1 << nr);                                        \
+        *m = old c_op (1UL << (nr & 0x1f));                             \
                                                                         \
-        return (old & (1 << nr)) != 0;                                  \
+        return (old & (1UL << (nr & 0x1f))) != 0;                       \
 }
 
 #define BIT_OPS(op, c_op, asm_op)                                       \
@@ -224,10 +210,7 @@ test_bit(unsigned int nr, const volatile unsigned long *addr)
 
         addr += nr >> 5;
 
-        if (__builtin_constant_p(nr))
-                nr &= 0x1f;
-
-        mask = 1 << nr;
+        mask = 1UL << (nr & 0x1f);
 
         return ((mask & *addr) != 0);
 }
diff --git a/arch/arc/include/asm/futex.h b/arch/arc/include/asm/futex.h
index 05b5aaf5b0f9..70cfe16b742d 100644
--- a/arch/arc/include/asm/futex.h
+++ b/arch/arc/include/asm/futex.h
@@ -16,12 +16,40 @@
 #include <linux/uaccess.h>
 #include <asm/errno.h>
 
+#ifdef CONFIG_ARC_HAS_LLSC
+
+#define __futex_atomic_op(insn, ret, oldval, uaddr, oparg)\
+                                                        \
+        __asm__ __volatile__(                           \
+        "1:     llock   %1, [%2]                \n"     \
+                insn                            "\n"    \
+        "2:     scond   %0, [%2]                \n"     \
+        "       bnz     1b                      \n"     \
+        "       mov %0, 0                       \n"     \
+        "3:                                     \n"     \
+        "       .section .fixup,\"ax\"          \n"     \
+        "       .align  4                       \n"     \
+        "4:     mov %0, %4                      \n"     \
+        "       b   3b                          \n"     \
+        "       .previous                       \n"     \
+        "       .section __ex_table,\"a\"       \n"     \
+        "       .align  4                       \n"     \
+        "       .word   1b, 4b                  \n"     \
+        "       .word   2b, 4b                  \n"     \
+        "       .previous                       \n"     \
+                                                        \
+        : "=&r" (ret), "=&r" (oldval)                   \
+        : "r" (uaddr), "r" (oparg), "ir" (-EFAULT)      \
+        : "cc", "memory")
+
+#else   /* !CONFIG_ARC_HAS_LLSC */
+
 #define __futex_atomic_op(insn, ret, oldval, uaddr, oparg)\
                                                         \
         __asm__ __volatile__(                           \
-        "1:     ld  %1, [%2]                    \n"     \
+        "1:     ld      %1, [%2]                \n"     \
                 insn                            "\n"    \
-        "2:     st  %0, [%2]                    \n"     \
+        "2:     st      %0, [%2]                \n"     \
         "       mov %0, 0                       \n"     \
         "3:                                     \n"     \
         "       .section .fixup,\"ax\"          \n"     \
@@ -39,6 +67,8 @@
         : "r" (uaddr), "r" (oparg), "ir" (-EFAULT)      \
         : "cc", "memory")
 
+#endif
+
 static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
 {
         int op = (encoded_op >> 28) & 7;
@@ -123,11 +153,17 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr, u32 oldval,
 
         pagefault_disable();
 
-        /* TBD : can use llock/scond */
         __asm__ __volatile__(
-        "1:     ld    %0, [%3]  \n"
-        "       brne  %0, %1, 3f        \n"
-        "2:     st    %2, [%3]  \n"
+#ifdef CONFIG_ARC_HAS_LLSC
+        "1:     llock   %0, [%3]                \n"
+        "       brne    %0, %1, 3f              \n"
+        "2:     scond   %2, [%3]                \n"
+        "       bnz     1b                      \n"
+#else
+        "1:     ld      %0, [%3]                \n"
+        "       brne    %0, %1, 3f              \n"
+        "2:     st      %2, [%3]                \n"
+#endif
         "3:     \n"
         "       .section .fixup,\"ax\"  \n"
         "4:     mov %0, %4      \n"
diff --git a/arch/arc/include/asm/mm-arch-hooks.h b/arch/arc/include/asm/mm-arch-hooks.h
deleted file mode 100644
index c37541c5f8ba..000000000000
--- a/arch/arc/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#ifndef _ASM_ARC_MM_ARCH_HOOKS_H
-#define _ASM_ARC_MM_ARCH_HOOKS_H
-
-#endif /* _ASM_ARC_MM_ARCH_HOOKS_H */
diff --git a/arch/arc/include/asm/ptrace.h b/arch/arc/include/asm/ptrace.h
index 91755972b9a2..91694ec1ce95 100644
--- a/arch/arc/include/asm/ptrace.h
+++ b/arch/arc/include/asm/ptrace.h
@@ -106,7 +106,7 @@ struct callee_regs {
         long r25, r24, r23, r22, r21, r20, r19, r18, r17, r16, r15, r14, r13;
 };
 
-#define instruction_pointer(regs)       ((regs)->ret)
+#define instruction_pointer(regs)       (unsigned long)((regs)->ret)
 #define profile_pc(regs)                instruction_pointer(regs)
 
 /* return 1 if user mode or 0 if kernel mode */
diff --git a/arch/arc/kernel/intc-arcv2.c b/arch/arc/kernel/intc-arcv2.c
index 6208c630abed..26c156827479 100644
--- a/arch/arc/kernel/intc-arcv2.c
+++ b/arch/arc/kernel/intc-arcv2.c
@@ -12,7 +12,6 @@
 #include <linux/of.h>
 #include <linux/irqdomain.h>
 #include <linux/irqchip.h>
-#include "../../drivers/irqchip/irqchip.h"
 #include <asm/irq.h>
 
 /*
diff --git a/arch/arc/kernel/intc-compact.c b/arch/arc/kernel/intc-compact.c
index fcdddb631766..039fac30b5c1 100644
--- a/arch/arc/kernel/intc-compact.c
+++ b/arch/arc/kernel/intc-compact.c
@@ -12,7 +12,6 @@
 #include <linux/of.h>
 #include <linux/irqdomain.h>
 #include <linux/irqchip.h>
-#include "../../drivers/irqchip/irqchip.h"
 #include <asm/irq.h>
 
 /*
diff --git a/arch/arc/kernel/mcip.c b/arch/arc/kernel/mcip.c
index 30284e8de6ff..2fb86589054d 100644
--- a/arch/arc/kernel/mcip.c
+++ b/arch/arc/kernel/mcip.c
@@ -175,7 +175,6 @@ void mcip_init_early_smp(void)
 #include <linux/irqchip.h>
 #include <linux/of.h>
 #include <linux/of_irq.h>
-#include "../../drivers/irqchip/irqchip.h"
 
 /*
  * Set the DEST for @cmn_irq to @cpu_mask (1 bit per core)
@@ -218,11 +217,28 @@ static void idu_irq_unmask(struct irq_data *data)
         raw_spin_unlock_irqrestore(&mcip_lock, flags);
 }
 
+#ifdef CONFIG_SMP
 static int
-idu_irq_set_affinity(struct irq_data *d, const struct cpumask *cpumask, bool f)
+idu_irq_set_affinity(struct irq_data *data, const struct cpumask *cpumask,
+                     bool force)
 {
+        unsigned long flags;
+        cpumask_t online;
+
+        /* errout if no online cpu per @cpumask */
+        if (!cpumask_and(&online, cpumask, cpu_online_mask))
+                return -EINVAL;
+
+        raw_spin_lock_irqsave(&mcip_lock, flags);
+
+        idu_set_dest(data->hwirq, cpumask_bits(&online)[0]);
+        idu_set_mode(data->hwirq, IDU_M_TRIG_LEVEL, IDU_M_DISTRI_RR);
+
+        raw_spin_unlock_irqrestore(&mcip_lock, flags);
+
         return IRQ_SET_MASK_OK;
 }
+#endif
 
 static struct irq_chip idu_irq_chip = {
         .name                   = "MCIP IDU Intc",
@@ -330,8 +346,7 @@ idu_of_init(struct device_node *intc, struct device_node *parent)
                 if (!i)
                         idu_first_irq = irq;
 
-                irq_set_handler_data(irq, domain);
-                irq_set_chained_handler(irq, idu_cascade_isr);
+                irq_set_chained_handler_and_data(irq, idu_cascade_isr, domain);
         }
 
         __mcip_cmd(CMD_IDU_ENABLE, 0);
diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c
index a3d186211ed3..18cc01591c96 100644
--- a/arch/arc/kernel/setup.c
+++ b/arch/arc/kernel/setup.c
@@ -142,17 +142,22 @@ static void read_arc_build_cfg_regs(void)
 }
 
 static const struct cpuinfo_data arc_cpu_tbl[] = {
+#ifdef CONFIG_ISA_ARCOMPACT
         { {0x20, "ARC 600"      }, 0x2F},
         { {0x30, "ARC 700"      }, 0x33},
         { {0x34, "ARC 700 R4.10"}, 0x34},
         { {0x35, "ARC 700 R4.11"}, 0x35},
-        { {0x50, "ARC HS38"     }, 0x51},
+#else
+        { {0x50, "ARC HS38 R2.0"}, 0x51},
+        { {0x52, "ARC HS38 R2.1"}, 0x52},
+#endif
         { {0x00, NULL           } }
 };
 
-#define IS_AVAIL1(v, str)       ((v) ? str : "")
-#define IS_USED(cfg)            (IS_ENABLED(cfg) ? "" : "(not used) ")
-#define IS_AVAIL2(v, str, cfg)  IS_AVAIL1(v, str), IS_AVAIL1(v, IS_USED(cfg))
+#define IS_AVAIL1(v, s)         ((v) ? s : "")
+#define IS_USED_RUN(v)          ((v) ? "" : "(not used) ")
+#define IS_USED_CFG(cfg)        IS_USED_RUN(IS_ENABLED(cfg))
+#define IS_AVAIL2(v, s, cfg)    IS_AVAIL1(v, s), IS_AVAIL1(v, IS_USED_CFG(cfg))
 
 static char *arc_cpu_mumbojumbo(int cpu_id, char *buf, int len)
 {
@@ -226,7 +231,7 @@ static char *arc_cpu_mumbojumbo(int cpu_id, char *buf, int len)
                         n += scnprintf(buf + n, len - n, "mpy[opt %d] ", opt);
                 }
                 n += scnprintf(buf + n, len - n, "%s",
-                               IS_USED(CONFIG_ARC_HAS_HW_MPY));
+                               IS_USED_CFG(CONFIG_ARC_HAS_HW_MPY));
         }
 
         n += scnprintf(buf + n, len - n, "%s%s%s%s%s%s%s%s\n",
diff --git a/arch/arc/kernel/troubleshoot.c b/arch/arc/kernel/troubleshoot.c
index 807f7d61d7a7..a6f91e88ce36 100644
--- a/arch/arc/kernel/troubleshoot.c
+++ b/arch/arc/kernel/troubleshoot.c
@@ -58,7 +58,6 @@ static void show_callee_regs(struct callee_regs *cregs)
 
 static void print_task_path_n_nm(struct task_struct *tsk, char *buf)
 {
-        struct path path;
         char *path_nm = NULL;
         struct mm_struct *mm;
         struct file *exe_file;
diff --git a/arch/arc/mm/cache.c b/arch/arc/mm/cache.c
index b29d62ed4f7e..1cd6695b6ab5 100644
--- a/arch/arc/mm/cache.c
+++ b/arch/arc/mm/cache.c
@@ -468,10 +468,18 @@ static void __ic_line_inv_vaddr(unsigned long paddr, unsigned long vaddr,
 noinline void slc_op(unsigned long paddr, unsigned long sz, const int op)
 {
 #ifdef CONFIG_ISA_ARCV2
+        /*
+         * SLC is shared between all cores and concurrent aux operations from
+         * multiple cores need to be serialized using a spinlock
+         * A concurrent operation can be silently ignored and/or the old/new
+         * operation can remain incomplete forever (lockup in SLC_CTRL_BUSY loop
+         * below)
+         */
+        static DEFINE_SPINLOCK(lock);
         unsigned long flags;
         unsigned int ctrl;
 
-        local_irq_save(flags);
+        spin_lock_irqsave(&lock, flags);
 
         /*
          * The Region Flush operation is specified by CTRL.RGN_OP[11..9]
@@ -504,7 +512,7 @@ noinline void slc_op(unsigned long paddr, unsigned long sz, const int op)
 
         while (read_aux_reg(ARC_REG_SLC_CTRL) & SLC_CTRL_BUSY);
 
-        local_irq_restore(flags);
+        spin_unlock_irqrestore(&lock, flags);
 #endif
 }
 
diff --git a/arch/arc/mm/dma.c b/arch/arc/mm/dma.c
index 74a637a1cfc4..57706a9c6948 100644
--- a/arch/arc/mm/dma.c
+++ b/arch/arc/mm/dma.c
@@ -60,8 +60,8 @@ void *dma_alloc_coherent(struct device *dev, size_t size,
 
         /* This is kernel Virtual address (0x7000_0000 based) */
         kvaddr = ioremap_nocache((unsigned long)paddr, size);
-        if (kvaddr != NULL)
-                memset(kvaddr, 0, size);
+        if (kvaddr == NULL)
+                return NULL;
 
         /* This is bus address, platform dependent */
         *dma_handle = (dma_addr_t)paddr;
diff --git a/arch/arm/boot/dts/am335x-boneblack.dts b/arch/arm/boot/dts/am335x-boneblack.dts
index 901739fcb85a..5c42d259fa68 100644
--- a/arch/arm/boot/dts/am335x-boneblack.dts
+++ b/arch/arm/boot/dts/am335x-boneblack.dts
@@ -80,3 +80,7 @@
                 status = "okay";
         };
 };
+
+&rtc {
+        system-power-controller;
+};
diff --git a/arch/arm/boot/dts/am335x-pepper.dts b/arch/arm/boot/dts/am335x-pepper.dts
index 0d35ab64641c..7106114c7464 100644
--- a/arch/arm/boot/dts/am335x-pepper.dts
+++ b/arch/arm/boot/dts/am335x-pepper.dts
@@ -74,6 +74,7 @@
         audio_codec: tlv320aic3106@1b {
                 compatible = "ti,tlv320aic3106";
                 reg = <0x1b>;
+                ai3x-micbias-vg = <0x2>;
         };
 
         accel: lis331dlh@1d {
@@ -153,7 +154,7 @@
         ti,audio-routing =
                 "Headphone Jack",       "HPLOUT",
                 "Headphone Jack",       "HPROUT",
-                "LINE1L",               "Line In";
+                "MIC3L",                "Mic3L Switch";
 };
 
 &mcasp0 {
@@ -438,41 +439,50 @@
         regulators {
                 dcdc1_reg: regulator@0 {
                         /* VDD_1V8 system supply */
+                        regulator-always-on;
                 };
 
                 dcdc2_reg: regulator@1 {
                         /* VDD_CORE voltage limits 0.95V - 1.26V with +/-4% tolerance */
                         regulator-name = "vdd_core";
                         regulator-min-microvolt = <925000>;
-                        regulator-max-microvolt = <1325000>;
+                        regulator-max-microvolt = <1150000>;
                         regulator-boot-on;
+                        regulator-always-on;
                 };
 
                 dcdc3_reg: regulator@2 {
                         /* VDD_MPU voltage limits 0.95V - 1.1V with +/-4% tolerance */
                         regulator-name = "vdd_mpu";
                         regulator-min-microvolt = <925000>;
-                        regulator-max-microvolt = <1150000>;
+                        regulator-max-microvolt = <1325000>;
                         regulator-boot-on;
+                        regulator-always-on;
                 };
 
                 ldo1_reg: regulator@3 {
                         /* VRTC 1.8V always-on supply */
+                        regulator-name = "vrtc,vdds";
                         regulator-always-on;
                 };
 
                 ldo2_reg: regulator@4 {
                         /* 3.3V rail */
+                        regulator-name = "vdd_3v3aux";
+                        regulator-always-on;
                 };
 
                 ldo3_reg: regulator@5 {
                         /* VDD_3V3A 3.3V rail */
+                        regulator-name = "vdd_3v3a";
                         regulator-min-microvolt = <3300000>;
                         regulator-max-microvolt = <3300000>;
                 };
 
                 ldo4_reg: regulator@6 {
                         /* VDD_3V3B 3.3V rail */
+                        regulator-name = "vdd_3v3b";
+                        regulator-always-on;
                 };
         };
 };
diff --git a/arch/arm/boot/dts/am4372.dtsi b/arch/arm/boot/dts/am4372.dtsi
index c80a3e233792..ade28c790f4b 100644
--- a/arch/arm/boot/dts/am4372.dtsi
+++ b/arch/arm/boot/dts/am4372.dtsi
@@ -132,6 +132,12 @@
                         };
                 };
 
+                emif: emif@4c000000 {
+                        compatible = "ti,emif-am4372";
+                        reg = <0x4c000000 0x1000000>;
+                        ti,hwmods = "emif";
+                };
+
                 edma: edma@49000000 {
                         compatible = "ti,edma3";
                         ti,hwmods = "tpcc", "tptc0", "tptc1", "tptc2";
@@ -941,6 +947,7 @@
                                 ti,hwmods = "dss_rfbi";
                                 clocks = <&disp_clk>;
                                 clock-names = "fck";
+                                status = "disabled";
                         };
                 };
 
diff --git a/arch/arm/boot/dts/am57xx-beagle-x15.dts b/arch/arm/boot/dts/am57xx-beagle-x15.dts
index a42cc377a862..a63bf78191ea 100644
--- a/arch/arm/boot/dts/am57xx-beagle-x15.dts
+++ b/arch/arm/boot/dts/am57xx-beagle-x15.dts
@@ -605,6 +605,10 @@
         phy-supply = <&ldousb_reg>;
 };
 
+&usb2_phy2 {
+        phy-supply = <&ldousb_reg>;
+};
+
 &usb1 {
         dr_mode = "host";
         pinctrl-names = "default";
diff --git a/arch/arm/boot/dts/atlas7.dtsi b/arch/arm/boot/dts/atlas7.dtsi
index 5dfd3a44bf82..3e21311f9514 100644
--- a/arch/arm/boot/dts/atlas7.dtsi
+++ b/arch/arm/boot/dts/atlas7.dtsi
@@ -135,6 +135,1025 @@
                         compatible = "sirf,atlas7-ioc";
                         reg = <0x18880000 0x1000>,
                                 <0x10E40000 0x1000>;
+
+                        audio_ac97_pmx: audio_ac97@0 {
+                                audio_ac97 {
+                                        groups = "audio_ac97_grp";
+                                        function = "audio_ac97";
+                                };
+                        };
+
+                        audio_func_dbg_pmx: audio_func_dbg@0 {
+                                audio_func_dbg {
+                                        groups = "audio_func_dbg_grp";
+                                        function = "audio_func_dbg";
+                                };
+                        };
+
+                        audio_i2s_pmx: audio_i2s@0 {
+                                audio_i2s {
+                                        groups = "audio_i2s_grp";
+                                        function = "audio_i2s";
+                                };
+                        };
+
+                        audio_i2s_2ch_pmx: audio_i2s_2ch@0 {
+                                audio_i2s_2ch {
+                                        groups = "audio_i2s_2ch_grp";
+                                        function = "audio_i2s_2ch";
+                                };
+                        };
+
+                        audio_i2s_extclk_pmx: audio_i2s_extclk@0 {
+                                audio_i2s_extclk {
+                                        groups = "audio_i2s_extclk_grp";
+                                        function = "audio_i2s_extclk";
+                                };
+                        };
+
+                        audio_uart0_pmx: audio_uart0@0 {
+                                audio_uart0 {
+                                        groups = "audio_uart0_grp";
+                                        function = "audio_uart0";
+                                };
+                        };
+
+                        audio_uart1_pmx: audio_uart1@0 {
+                                audio_uart1 {
+                                        groups = "audio_uart1_grp";
+                                        function = "audio_uart1";
+                                };
+                        };
+
+                        audio_uart2_pmx0: audio_uart2@0 {
+                                audio_uart2_0 {
+                                        groups = "audio_uart2_grp0";
+                                        function = "audio_uart2_m0";
+                                };
+                        };
+
+                        audio_uart2_pmx1: audio_uart2@1 {
+                                audio_uart2_1 {
+                                        groups = "audio_uart2_grp1";
+                                        function = "audio_uart2_m1";
+                                };
+                        };
+
+                        c_can_trnsvr_pmx: c_can_trnsvr@0 {
+                                c_can_trnsvr {
+                                        groups = "c_can_trnsvr_grp";
+                                        function = "c_can_trnsvr";
+                                };
+                        };
+
+                        c0_can_pmx0: c0_can@0 {
+                                c0_can_0 {
+                                        groups = "c0_can_grp0";
+                                        function = "c0_can_m0";
+                                };
+                        };
+
+                        c0_can_pmx1: c0_can@1 {
+                                c0_can_1 {
+                                        groups = "c0_can_grp1";
+                                        function = "c0_can_m1";
+                                };
+                        };
+
+                        c1_can_pmx0: c1_can@0 {
+                                c1_can_0 {
+                                        groups = "c1_can_grp0";
+                                        function = "c1_can_m0";
+                                };
+                        };
+
+                        c1_can_pmx1: c1_can@1 {
+                                c1_can_1 {
+                                        groups = "c1_can_grp1";
+                                        function = "c1_can_m1";
+                                };
+                        };
+
+                        c1_can_pmx2: c1_can@2 {
+                                c1_can_2 {
+                                        groups = "c1_can_grp2";
+                                        function = "c1_can_m2";
+                                };
+                        };
+
+                        ca_audio_lpc_pmx: ca_audio_lpc@0 {
+                                ca_audio_lpc {
+                                        groups = "ca_audio_lpc_grp";
+                                        function = "ca_audio_lpc";
+                                };
+                        };
+
+                        ca_bt_lpc_pmx: ca_bt_lpc@0 {
+                                ca_bt_lpc {
+                                        groups = "ca_bt_lpc_grp";
+                                        function = "ca_bt_lpc";
+                                };
+                        };
+
+                        ca_coex_pmx: ca_coex@0 {
+                                ca_coex {
+                                        groups = "ca_coex_grp";
+                                        function = "ca_coex";
+                                };
+                        };
+
+                        ca_curator_lpc_pmx: ca_curator_lpc@0 {
+                                ca_curator_lpc {
+                                        groups = "ca_curator_lpc_grp";
+                                        function = "ca_curator_lpc";
+                                };
+                        };
+
+                        ca_pcm_debug_pmx: ca_pcm_debug@0 {
+                                ca_pcm_debug {
+                                        groups = "ca_pcm_debug_grp";
+                                        function = "ca_pcm_debug";
+                                };
+                        };
+
+                        ca_pio_pmx: ca_pio@0 {
+                                ca_pio {
+                                        groups = "ca_pio_grp";
+                                        function = "ca_pio";
+                                };
+                        };
+
+                        ca_sdio_debug_pmx: ca_sdio_debug@0 {
+                                ca_sdio_debug {
+                                        groups = "ca_sdio_debug_grp";
+                                        function = "ca_sdio_debug";
+                                };
+                        };
+
+                        ca_spi_pmx: ca_spi@0 {
+                                ca_spi {
+                                        groups = "ca_spi_grp";
+                                        function = "ca_spi";
+                                };
+                        };
+
+                        ca_trb_pmx: ca_trb@0 {
+                                ca_trb {
+                                        groups = "ca_trb_grp";
+                                        function = "ca_trb";
+                                };
+                        };
+
+                        ca_uart_debug_pmx: ca_uart_debug@0 {
+                                ca_uart_debug {
+                                        groups = "ca_uart_debug_grp";
+                                        function = "ca_uart_debug";
+                                };
+                        };
+
+                        clkc_pmx0: clkc@0 {
+                                clkc_0 {
+                                        groups = "clkc_grp0";
+                                        function = "clkc_m0";
+                                };
+                        };
+
+                        clkc_pmx1: clkc@1 {
+                                clkc_1 {
+                                        groups = "clkc_grp1";
+                                        function = "clkc_m1";
+                                };
+                        };
+
+                        gn_gnss_i2c_pmx: gn_gnss_i2c@0 {
+                                gn_gnss_i2c {
+                                        groups = "gn_gnss_i2c_grp";
+                                        function = "gn_gnss_i2c";
+                                };
+                        };
+
+                        gn_gnss_uart_nopause_pmx: gn_gnss_uart_nopause@0 {
+                                gn_gnss_uart_nopause {
+                                        groups = "gn_gnss_uart_nopause_grp";
+                                        function = "gn_gnss_uart_nopause";
+                                };
+                        };
+
+                        gn_gnss_uart_pmx: gn_gnss_uart@0 {
+                                gn_gnss_uart {
+                                        groups = "gn_gnss_uart_grp";
+                                        function = "gn_gnss_uart";
+                                };
+                        };
+
+                        gn_trg_spi_pmx0: gn_trg_spi@0 {
+                                gn_trg_spi_0 {
+                                        groups = "gn_trg_spi_grp0";
+                                        function = "gn_trg_spi_m0";
+                                };
+                        };
+
+                        gn_trg_spi_pmx1: gn_trg_spi@1 {
+                                gn_trg_spi_1 {
+                                        groups = "gn_trg_spi_grp1";
+                                        function = "gn_trg_spi_m1";
+                                };
+                        };
+
+                        cvbs_dbg_pmx: cvbs_dbg@0 {
+                                cvbs_dbg {
+                                        groups = "cvbs_dbg_grp";
+                                        function = "cvbs_dbg";
+                                };
+                        };
+
+                        cvbs_dbg_test_pmx0: cvbs_dbg_test@0 {
+                                cvbs_dbg_test_0 {
+                                        groups = "cvbs_dbg_test_grp0";
+                                        function = "cvbs_dbg_test_m0";
+                                };
+                        };
+
+                        cvbs_dbg_test_pmx1: cvbs_dbg_test@1 {
+                                cvbs_dbg_test_1 {
+                                        groups = "cvbs_dbg_test_grp1";
+                                        function = "cvbs_dbg_test_m1";
+                                };
+                        };
+
+                        cvbs_dbg_test_pmx2: cvbs_dbg_test@2 {
+                                cvbs_dbg_test_2 {
+                                        groups = "cvbs_dbg_test_grp2";
+                                        function = "cvbs_dbg_test_m2";
+                                };
+                        };
+
+                        cvbs_dbg_test_pmx3: cvbs_dbg_test@3 {
+                                cvbs_dbg_test_3 {
+                                        groups = "cvbs_dbg_test_grp3";
+                                        function = "cvbs_dbg_test_m3";
+                                };
+                        };
+
+                        cvbs_dbg_test_pmx4: cvbs_dbg_test@4 {
+                                cvbs_dbg_test_4 {
+                                        groups = "cvbs_dbg_test_grp4";
+                                        function = "cvbs_dbg_test_m4";
+                                };
+                        };
+
+                        cvbs_dbg_test_pmx5: cvbs_dbg_test@5 {
+                                cvbs_dbg_test_5 {
+                                        groups = "cvbs_dbg_test_grp5";
+                                        function = "cvbs_dbg_test_m5";
+                                };
+                        };
+
+                        cvbs_dbg_test_pmx6: cvbs_dbg_test@6 {
+                                cvbs_dbg_test_6 {
+                                        groups = "cvbs_dbg_test_grp6";
+                                        function = "cvbs_dbg_test_m6";
+                                };
+                        };
+
+                        cvbs_dbg_test_pmx7: cvbs_dbg_test@7 {
+                                cvbs_dbg_test_7 {
+                                        groups = "cvbs_dbg_test_grp7";
+                                        function = "cvbs_dbg_test_m7";
+                                };
+                        };
+
+                        cvbs_dbg_test_pmx8: cvbs_dbg_test@8 {
+                                cvbs_dbg_test_8 {
+                                        groups = "cvbs_dbg_test_grp8";
+                                        function = "cvbs_dbg_test_m8";
+                                };
+                        };
+
+                        cvbs_dbg_test_pmx9: cvbs_dbg_test@9 {
+                                cvbs_dbg_test_9 {
+                                        groups = "cvbs_dbg_test_grp9";
+                                        function = "cvbs_dbg_test_m9";
+                                };
+                        };
+
+                        cvbs_dbg_test_pmx10: cvbs_dbg_test@10 {
+                                cvbs_dbg_test_10 {
+                                        groups = "cvbs_dbg_test_grp10";
+                                        function = "cvbs_dbg_test_m10";
+                                };
+                        };
+
+                        cvbs_dbg_test_pmx11: cvbs_dbg_test@11 {
+                                cvbs_dbg_test_11 {
+                                        groups = "cvbs_dbg_test_grp11";
+                                        function = "cvbs_dbg_test_m11";
+                                };
+                        };
+
+                        cvbs_dbg_test_pmx12: cvbs_dbg_test@12 {
+                                cvbs_dbg_test_12 {
+                                        groups = "cvbs_dbg_test_grp12";
+                                        function = "cvbs_dbg_test_m12";
+                                };
+                        };
+
+                        cvbs_dbg_test_pmx13: cvbs_dbg_test@13 {
+                                cvbs_dbg_test_13 {
+                                        groups = "cvbs_dbg_test_grp13";
+                                        function = "cvbs_dbg_test_m13";
+                                };
+                        };
+
+                        cvbs_dbg_test_pmx14: cvbs_dbg_test@14 {
+                                cvbs_dbg_test_14 {
+                                        groups = "cvbs_dbg_test_grp14";
+                                        function = "cvbs_dbg_test_m14";
+                                };
+                        };
+
+                        cvbs_dbg_test_pmx15: cvbs_dbg_test@15 {
+                                cvbs_dbg_test_15 {
+                                        groups = "cvbs_dbg_test_grp15";
+                                        function = "cvbs_dbg_test_m15";
+                                };
+                        };
+
+                        gn_gnss_power_pmx: gn_gnss_power@0 {
+                                gn_gnss_power {
+                                        groups = "gn_gnss_power_grp";
+                                        function = "gn_gnss_power";
+                                };
+                        };
+
+                        gn_gnss_sw_status_pmx: gn_gnss_sw_status@0 {
+                                gn_gnss_sw_status {
+                                        groups = "gn_gnss_sw_status_grp";
+                                        function = "gn_gnss_sw_status";
+                                };
+                        };
+
+                        gn_gnss_eclk_pmx: gn_gnss_eclk@0 {
+                                gn_gnss_eclk {
+                                        groups = "gn_gnss_eclk_grp";
+                                        function = "gn_gnss_eclk";
+                                };
+                        };
+
+                        gn_gnss_irq1_pmx0: gn_gnss_irq1@0 {
+                                gn_gnss_irq1_0 {
+                                        groups = "gn_gnss_irq1_grp0";
+                                        function = "gn_gnss_irq1_m0";
+                                };
+                        };
+
+                        gn_gnss_irq2_pmx0: gn_gnss_irq2@0 {
+                                gn_gnss_irq2_0 {
+                                        groups = "gn_gnss_irq2_grp0";
+                                        function = "gn_gnss_irq2_m0";
+                                };
+                        };
+
+                        gn_gnss_tm_pmx: gn_gnss_tm@0 {
+                                gn_gnss_tm {
+                                        groups = "gn_gnss_tm_grp";
+                                        function = "gn_gnss_tm";
+                                };
+                        };
+
+                        gn_gnss_tsync_pmx: gn_gnss_tsync@0 {
+                                gn_gnss_tsync {
+                                        groups = "gn_gnss_tsync_grp";
+                                        function = "gn_gnss_tsync";
+                                };
+                        };
+
+                        gn_io_gnsssys_sw_cfg_pmx: gn_io_gnsssys_sw_cfg@0 {
+                                gn_io_gnsssys_sw_cfg {
+                                        groups = "gn_io_gnsssys_sw_cfg_grp";
+                                        function = "gn_io_gnsssys_sw_cfg";
+                                };
+                        };
+
+                        gn_trg_pmx0: gn_trg@0 {
+                                gn_trg_0 {
+                                        groups = "gn_trg_grp0";
+                                        function = "gn_trg_m0";
+                                };
+                        };
+
+                        gn_trg_pmx1: gn_trg@1 {
+                                gn_trg_1 {
+                                        groups = "gn_trg_grp1";
+                                        function = "gn_trg_m1";
+                                };
+                        };
+
+                        gn_trg_shutdown_pmx0: gn_trg_shutdown@0 {
+                                gn_trg_shutdown_0 {
+                                        groups = "gn_trg_shutdown_grp0";
+                                        function = "gn_trg_shutdown_m0";
+                                };
+                        };
+
+                        gn_trg_shutdown_pmx1: gn_trg_shutdown@1 {
+                                gn_trg_shutdown_1 {
+                                        groups = "gn_trg_shutdown_grp1";
+                                        function = "gn_trg_shutdown_m1";
+                                };
+                        };
+
+                        gn_trg_shutdown_pmx2: gn_trg_shutdown@2 {
+                                gn_trg_shutdown_2 {
+                                        groups = "gn_trg_shutdown_grp2";
+                                        function = "gn_trg_shutdown_m2";
+                                };
+                        };
+
+                        gn_trg_shutdown_pmx3: gn_trg_shutdown@3 {
+                                gn_trg_shutdown_3 {
+                                        groups = "gn_trg_shutdown_grp3";
+                                        function = "gn_trg_shutdown_m3";
+                                };
+                        };
+
+                        i2c0_pmx: i2c0@0 {
+                                i2c0 {
+                                        groups = "i2c0_grp";
+                                        function = "i2c0";
+                                };
+                        };
+
+                        i2c1_pmx: i2c1@0 {
+                                i2c1 {
+                                        groups = "i2c1_grp";
+                                        function = "i2c1";
+                                };
+                        };
+
+                        jtag_pmx0: jtag@0 {
+                                jtag_0 {
+                                        groups = "jtag_grp0";
+                                        function = "jtag_m0";
+                                };
+                        };
+
+                        ks_kas_spi_pmx0: ks_kas_spi@0 {
+                                ks_kas_spi_0 {
+                                        groups = "ks_kas_spi_grp0";
+                                        function = "ks_kas_spi_m0";
+                                };
+                        };
+
+                        ld_ldd_pmx: ld_ldd@0 {
+                                ld_ldd {
+                                        groups = "ld_ldd_grp";
+                                        function = "ld_ldd";
+                                };
+                        };
+
+                        ld_ldd_16bit_pmx: ld_ldd_16bit@0 {
+                                ld_ldd_16bit {
+                                        groups = "ld_ldd_16bit_grp";
+                                        function = "ld_ldd_16bit";
+                                };
+                        };
+
+                        ld_ldd_fck_pmx: ld_ldd_fck@0 {
+                                ld_ldd_fck {
+                                        groups = "ld_ldd_fck_grp";
+                                        function = "ld_ldd_fck";
+                                };
+                        };
+
+                        ld_ldd_lck_pmx: ld_ldd_lck@0 {
+                                ld_ldd_lck {
+                                        groups = "ld_ldd_lck_grp";
+                                        function = "ld_ldd_lck";
+                                };
+                        };
+
+                        lr_lcdrom_pmx: lr_lcdrom@0 {
+                                lr_lcdrom {
+                                        groups = "lr_lcdrom_grp";
+                                        function = "lr_lcdrom";
+                                };
+                        };
+
+                        lvds_analog_pmx: lvds_analog@0 {
+                                lvds_analog {
+                                        groups = "lvds_analog_grp";
+                                        function = "lvds_analog";
+                                };
+                        };
+
+                        nd_df_pmx: nd_df@0 {
+                                nd_df {
+                                        groups = "nd_df_grp";
+                                        function = "nd_df";
+                                };
+                        };
+
+                        nd_df_nowp_pmx: nd_df_nowp@0 {
+                                nd_df_nowp {
+                                        groups = "nd_df_nowp_grp";
+                                        function = "nd_df_nowp";
+                                };
+                        };
+
+                        ps_pmx: ps@0 {
+                                ps {
+                                        groups = "ps_grp";
+                                        function = "ps";
+                                };
+                        };
+
+                        pwc_core_on_pmx: pwc_core_on@0 {
+                                pwc_core_on {
+                                        groups = "pwc_core_on_grp";
+                                        function = "pwc_core_on";
+                                };
+                        };
+
+                        pwc_ext_on_pmx: pwc_ext_on@0 {
+                                pwc_ext_on {
+                                        groups = "pwc_ext_on_grp";
+                                        function = "pwc_ext_on";
+                                };
+                        };
+
+                        pwc_gpio3_clk_pmx: pwc_gpio3_clk@0 {
+                                pwc_gpio3_clk {
+                                        groups = "pwc_gpio3_clk_grp";
+                                        function = "pwc_gpio3_clk";
+                                };
+                        };
+
+                        pwc_io_on_pmx: pwc_io_on@0 {
+                                pwc_io_on {
+                                        groups = "pwc_io_on_grp";
+                                        function = "pwc_io_on";
+                                };
+                        };
+
+                        pwc_lowbatt_b_pmx0: pwc_lowbatt_b@0 {
+                                pwc_lowbatt_b_0 {
+                                        groups = "pwc_lowbatt_b_grp0";
+                                        function = "pwc_lowbatt_b_m0";
+                                };
+                        };
+
+                        pwc_mem_on_pmx: pwc_mem_on@0 {
+                                pwc_mem_on {
+                                        groups = "pwc_mem_on_grp";
+                                        function = "pwc_mem_on";
+                                };
+                        };
+
+                        pwc_on_key_b_pmx0: pwc_on_key_b@0 {
+                                pwc_on_key_b_0 {
+                                        groups = "pwc_on_key_b_grp0";
+                                        function = "pwc_on_key_b_m0";
+                                };
+                        };
+
+                        pwc_wakeup_src0_pmx: pwc_wakeup_src0@0 {
+                                pwc_wakeup_src0 {
+                                        groups = "pwc_wakeup_src0_grp";
+                                        function = "pwc_wakeup_src0";
+                                };
+                        };
+
+                        pwc_wakeup_src1_pmx: pwc_wakeup_src1@0 {
+                                pwc_wakeup_src1 {
+                                        groups = "pwc_wakeup_src1_grp";
+                                        function = "pwc_wakeup_src1";
+                                };
+                        };
+
+                        pwc_wakeup_src2_pmx: pwc_wakeup_src2@0 {
+                                pwc_wakeup_src2 {
+                                        groups = "pwc_wakeup_src2_grp";
+                                        function = "pwc_wakeup_src2";
+                                };
+                        };
+
+                        pwc_wakeup_src3_pmx: pwc_wakeup_src3@0 {
+                                pwc_wakeup_src3 {
+                                        groups = "pwc_wakeup_src3_grp";
+                                        function = "pwc_wakeup_src3";
+                                };
+                        };
+
+                        pw_cko0_pmx0: pw_cko0@0 {
+                                pw_cko0_0 {
+                                        groups = "pw_cko0_grp0";
+                                        function = "pw_cko0_m0";
+                                };
+                        };
+
+                        pw_cko0_pmx1: pw_cko0@1 {
+                                pw_cko0_1 {
+                                        groups = "pw_cko0_grp1";
+                                        function = "pw_cko0_m1";
+                                };
+                        };
+
+                        pw_cko0_pmx2: pw_cko0@2 {
+                                pw_cko0_2 {
+                                        groups = "pw_cko0_grp2";
+                                        function = "pw_cko0_m2";
+                                };
+                        };
+
+                        pw_cko1_pmx0: pw_cko1@0 {
+                                pw_cko1_0 {
+                                        groups = "pw_cko1_grp0";
+                                        function = "pw_cko1_m0";
+                                };
+                        };
+
+                        pw_cko1_pmx1: pw_cko1@1 {
+                                pw_cko1_1 {
+                                        groups = "pw_cko1_grp1";
+                                        function = "pw_cko1_m1";
+                                };
+                        };
+
+                        pw_i2s01_clk_pmx0: pw_i2s01_clk@0 {
+                                pw_i2s01_clk_0 {
+                                        groups = "pw_i2s01_clk_grp0";
+                                        function = "pw_i2s01_clk_m0";
+                                };
+                        };
+
+                        pw_i2s01_clk_pmx1: pw_i2s01_clk@1 {
+                                pw_i2s01_clk_1 {
+                                        groups = "pw_i2s01_clk_grp1";
+                                        function = "pw_i2s01_clk_m1";
+                                };
+                        };
+
+                        pw_pwm0_pmx: pw_pwm0@0 {
+                                pw_pwm0 {
+                                        groups = "pw_pwm0_grp";
+                                        function = "pw_pwm0";
+                                };
+                        };
+
+                        pw_pwm1_pmx: pw_pwm1@0 {
+                                pw_pwm1 {
+                                        groups = "pw_pwm1_grp";
+                                        function = "pw_pwm1";
+                                };
+                        };
+
+                        pw_pwm2_pmx0: pw_pwm2@0 {
+                                pw_pwm2_0 {
+                                        groups = "pw_pwm2_grp0";
+                                        function = "pw_pwm2_m0";
+                                };
+                        };
+
+                        pw_pwm2_pmx1: pw_pwm2@1 {
+                                pw_pwm2_1 {
+                                        groups = "pw_pwm2_grp1";
+                                        function = "pw_pwm2_m1";
+                                };
+                        };
+
+                        pw_pwm3_pmx0: pw_pwm3@0 {
+                                pw_pwm3_0 {
+                                        groups = "pw_pwm3_grp0";
+                                        function = "pw_pwm3_m0";
+                                };
+                        };
+
+                        pw_pwm3_pmx1: pw_pwm3@1 {
+                                pw_pwm3_1 {
+                                        groups = "pw_pwm3_grp1";
+                                        function = "pw_pwm3_m1";
+                                };
+                        };
+
+                        pw_pwm_cpu_vol_pmx0: pw_pwm_cpu_vol@0 {
+                                pw_pwm_cpu_vol_0 {
+                                        groups = "pw_pwm_cpu_vol_grp0";
+                                        function = "pw_pwm_cpu_vol_m0";
+                                };
+                        };
+
+                        pw_pwm_cpu_vol_pmx1: pw_pwm_cpu_vol@1 {
+                                pw_pwm_cpu_vol_1 {
+                                        groups = "pw_pwm_cpu_vol_grp1";
+                                        function = "pw_pwm_cpu_vol_m1";
+                                };
+                        };
+
+                        pw_backlight_pmx0: pw_backlight@0 {
+                                pw_backlight_0 {
+                                        groups = "pw_backlight_grp0";
+                                        function = "pw_backlight_m0";
+                                };
+                        };
+
+                        pw_backlight_pmx1: pw_backlight@1 {
+                                pw_backlight_1 {
+                                        groups = "pw_backlight_grp1";
+                                        function = "pw_backlight_m1";
+                                };
+                        };
+
+                        rg_eth_mac_pmx: rg_eth_mac@0 {
+                                rg_eth_mac {
+                                        groups = "rg_eth_mac_grp";
+                                        function = "rg_eth_mac";
+                                };
+                        };
+
+                        rg_gmac_phy_intr_n_pmx: rg_gmac_phy_intr_n@0 {
+                                rg_gmac_phy_intr_n {
+                                        groups = "rg_gmac_phy_intr_n_grp";
+                                        function = "rg_gmac_phy_intr_n";
+                                };
+                        };
+
+                        rg_rgmii_mac_pmx: rg_rgmii_mac@0 {
+                                rg_rgmii_mac {
+                                        groups = "rg_rgmii_mac_grp";
+                                        function = "rg_rgmii_mac";
+                                };
+                        };
+
+                        rg_rgmii_phy_ref_clk_pmx0: rg_rgmii_phy_ref_clk@0 {
+                                rg_rgmii_phy_ref_clk_0 {
+                                        groups =
+                                                "rg_rgmii_phy_ref_clk_grp0";
+                                        function =
+                                                "rg_rgmii_phy_ref_clk_m0";
+                                };
+                        };
+
+                        rg_rgmii_phy_ref_clk_pmx1: rg_rgmii_phy_ref_clk@1 {
+                                rg_rgmii_phy_ref_clk_1 {
+                                        groups =
+                                                "rg_rgmii_phy_ref_clk_grp1";
+                                        function =
+                                                "rg_rgmii_phy_ref_clk_m1";
+                                };
+                        };
+
+                        sd0_pmx: sd0@0 {
+                                sd0 {
+                                        groups = "sd0_grp";
+                                        function = "sd0";
+                                };
+                        };
+
+                        sd0_4bit_pmx: sd0_4bit@0 {
+                                sd0_4bit {
+                                        groups = "sd0_4bit_grp";
+                                        function = "sd0_4bit";
+                                };
+                        };
+
+                        sd1_pmx: sd1@0 {
+                                sd1 {
+                                        groups = "sd1_grp";
+                                        function = "sd1";
+                                };
+                        };
+
+                        sd1_4bit_pmx0: sd1_4bit@0 {
+                                sd1_4bit_0 {
+                                        groups = "sd1_4bit_grp0";
+                                        function = "sd1_4bit_m0";
+                                };
+                        };
+
+                        sd1_4bit_pmx1: sd1_4bit@1 {
+                                sd1_4bit_1 {
+                                        groups = "sd1_4bit_grp1";
+                                        function = "sd1_4bit_m1";
+                                };
+                        };
+
+                        sd2_pmx0: sd2@0 {
+                                sd2_0 {
+                                        groups = "sd2_grp0";
+                                        function = "sd2_m0";
+                                };
+                        };
+
+                        sd2_no_cdb_pmx0: sd2_no_cdb@0 {
+                                sd2_no_cdb_0 {
+                                        groups = "sd2_no_cdb_grp0";
+                                        function = "sd2_no_cdb_m0";
+                                };
+                        };
+
+                        sd3_pmx: sd3@0 {
+                                sd3 {
+                                        groups = "sd3_grp";
+                                        function = "sd3";
+                                };
+                        };
+
+                        sd5_pmx: sd5@0 {
+                                sd5 {
+                                        groups = "sd5_grp";
+                                        function = "sd5";
+                                };
+                        };
+
+                        sd6_pmx0: sd6@0 {
+                                sd6_0 {
+                                        groups = "sd6_grp0";
+                                        function = "sd6_m0";
+                                };
+                        };
+
+                        sd6_pmx1: sd6@1 {
+                                sd6_1 {
+                                        groups = "sd6_grp1";
+                                        function = "sd6_m1";
+                                };
+                        };
+
+                        sp0_ext_ldo_on_pmx: sp0_ext_ldo_on@0 {
+                                sp0_ext_ldo_on {
+                                        groups = "sp0_ext_ldo_on_grp";
+                                        function = "sp0_ext_ldo_on";
+                                };
+                        };
+
+                        sp0_qspi_pmx: sp0_qspi@0 {
+                                sp0_qspi {
+                                        groups = "sp0_qspi_grp";
+                                        function = "sp0_qspi";
+                                };
+                        };
+
+                        sp1_spi_pmx: sp1_spi@0 {
+                                sp1_spi {
+                                        groups = "sp1_spi_grp";
+                                        function = "sp1_spi";
+                                };
+                        };
+
+                        tpiu_trace_pmx: tpiu_trace@0 {
+                                tpiu_trace {
+                                        groups = "tpiu_trace_grp";
+                                        function = "tpiu_trace";
+                                };
+                        };
+
+                        uart0_pmx: uart0@0 {
+                                uart0 {
+                                        groups = "uart0_grp";
+                                        function = "uart0";
+                                };
+                        };
+
+                        uart0_nopause_pmx: uart0_nopause@0 {
+                                uart0_nopause {
+                                        groups = "uart0_nopause_grp";
+                                        function = "uart0_nopause";
+                                };
+                        };
+
+                        uart1_pmx: uart1@0 {
+                                uart1 {
+                                        groups = "uart1_grp";
+                                        function = "uart1";
+                                };
+                        };
+
+                        uart2_pmx: uart2@0 {
+                                uart2 {
+                                        groups = "uart2_grp";
+                                        function = "uart2";
+                                };
+                        };
+
+                        uart3_pmx0: uart3@0 {
+                                uart3_0 {
+                                        groups = "uart3_grp0";
+                                        function = "uart3_m0";
+                                };
+                        };
+
+                        uart3_pmx1: uart3@1 {
+                                uart3_1 {
+                                        groups = "uart3_grp1";
+                                        function = "uart3_m1";
+                                };
+                        };
+
+                        uart3_pmx2: uart3@2 {
+                                uart3_2 {
+                                        groups = "uart3_grp2";
+                                        function = "uart3_m2";
+                                };
+                        };
+
+                        uart3_pmx3: uart3@3 {
+                                uart3_3 {
+                                        groups = "uart3_grp3";
+                                        function = "uart3_m3";
+                                };
+                        };
+
+                        uart3_nopause_pmx0: uart3_nopause@0 {
+                                uart3_nopause_0 {
+                                        groups = "uart3_nopause_grp0";
+                                        function = "uart3_nopause_m0";
+                                };
+                        };
+
+                        uart3_nopause_pmx1: uart3_nopause@1 {
+                                uart3_nopause_1 {
+                                        groups = "uart3_nopause_grp1";
+                                        function = "uart3_nopause_m1";
+                                };
+                        };
+
+                        uart4_pmx0: uart4@0 {
+                                uart4_0 {
+                                        groups = "uart4_grp0";
+                                        function = "uart4_m0";
+                                };
+                        };
+
+                        uart4_pmx1: uart4@1 {
+                                uart4_1 {
+                                        groups = "uart4_grp1";
+                                        function = "uart4_m1";
+                                };
+                        };
+
+                        uart4_pmx2: uart4@2 {
+                                uart4_2 {
+                                        groups = "uart4_grp2";
+                                        function = "uart4_m2";
+                                };
+                        };
+
+                        uart4_nopause_pmx: uart4_nopause@0 {
+                                uart4_nopause {
+                                        groups = "uart4_nopause_grp";
+                                        function = "uart4_nopause";
+                                };
+                        };
+
+                        usb0_drvvbus_pmx: usb0_drvvbus@0 {
+                                usb0_drvvbus {
+                                        groups = "usb0_drvvbus_grp";
+                                        function = "usb0_drvvbus";
+                                };
+                        };
+
+                        usb1_drvvbus_pmx: usb1_drvvbus@0 {
+                                usb1_drvvbus {
+                                        groups = "usb1_drvvbus_grp";
+                                        function = "usb1_drvvbus";
+                                };
+                        };
+
+                        visbus_dout_pmx: visbus_dout@0 {
+                                visbus_dout {
+                                        groups = "visbus_dout_grp";
+                                        function = "visbus_dout";
+                                };
+                        };
+
+                        vi_vip1_pmx: vi_vip1@0 {
+                                vi_vip1 {
+                                        groups = "vi_vip1_grp";
+                                        function = "vi_vip1";
+                                };
+                        };
+
+                        vi_vip1_ext_pmx: vi_vip1_ext@0 {
+                                vi_vip1_ext {
+                                        groups = "vi_vip1_ext_grp";
+                                        function = "vi_vip1_ext";
+                                };
+                        };
+
+                        vi_vip1_low8bit_pmx: vi_vip1_low8bit@0 {
+                                vi_vip1_low8bit {
+                                        groups = "vi_vip1_low8bit_grp";
+                                        function = "vi_vip1_low8bit";
+                                };
+                        };
+
+                        vi_vip1_high8bit_pmx: vi_vip1_high8bit@0 {
+                                vi_vip1_high8bit {
+                                        groups = "vi_vip1_high8bit_grp";
+                                        function = "vi_vip1_high8bit";
+                                };
+                        };
                 };
 
                 pmipc {
@@ -356,6 +1375,12 @@
                                 clock-names = "gpio0_io";
                                 gpio-controller;
                                 interrupt-controller;
+
+                                gpio-banks = <2>;
+                                gpio-ranges = <&pinctrl 0 0 0>,
+                                                <&pinctrl 32 0 0>;
+                                gpio-ranges-group-names = "lvds_gpio_grp",
+                                                        "uart_nand_gpio_grp";
                         };
 
                         nand@17050000 {
@@ -461,11 +1486,22 @@
                                 #interrupt-cells = <2>;
                                 compatible = "sirf,atlas7-gpio";
                                 reg = <0x13300000 0x1000>;
-                                interrupts = <0 43 0>, <0 44 0>, <0 45 0>;
+                                interrupts = <0 43 0>, <0 44 0>,
+                                                <0 45 0>, <0 46 0>;
                                 clocks = <&car 84>;
                                 clock-names = "gpio1_io";
                                 gpio-controller;
                                 interrupt-controller;
+
+                                gpio-banks = <4>;
+                                gpio-ranges = <&pinctrl 0 0 0>,
+                                                <&pinctrl 32 0 0>,
+                                                <&pinctrl 64 0 0>,
+                                                <&pinctrl 96 0 0>;
+                                gpio-ranges-group-names = "gnss_gpio_grp",
+                                                        "lcd_vip_gpio_grp",
+                                                        "sdio_i2s_gpio_grp",
+                                                        "sp_rgmii_gpio_grp";
                         };
 
                         sd2: sdhci@14200000 {
@@ -744,6 +1780,10 @@
                                 interrupts = <0 47 0>;
                                 gpio-controller;
                                 interrupt-controller;
+
+                                gpio-banks = <1>;
+                                gpio-ranges = <&pinctrl 0 0 0>;
+                                gpio-ranges-group-names = "rtc_gpio_grp";
                         };
 
                         rtc-iobg@18840000 {
diff --git a/arch/arm/boot/dts/cros-ec-keyboard.dtsi b/arch/arm/boot/dts/cros-ec-keyboard.dtsi
index 9c7fb0acae79..4e42f30cb318 100644
--- a/arch/arm/boot/dts/cros-ec-keyboard.dtsi
+++ b/arch/arm/boot/dts/cros-ec-keyboard.dtsi
@@ -22,6 +22,7 @@
                         MATRIX_KEY(0x00, 0x02, KEY_F1)
                         MATRIX_KEY(0x00, 0x03, KEY_B)
                         MATRIX_KEY(0x00, 0x04, KEY_F10)
+                        MATRIX_KEY(0x00, 0x05, KEY_RO)
                         MATRIX_KEY(0x00, 0x06, KEY_N)
                         MATRIX_KEY(0x00, 0x08, KEY_EQUAL)
                         MATRIX_KEY(0x00, 0x0a, KEY_RIGHTALT)
@@ -34,6 +35,7 @@
                         MATRIX_KEY(0x01, 0x08, KEY_APOSTROPHE)
                         MATRIX_KEY(0x01, 0x09, KEY_F9)
                         MATRIX_KEY(0x01, 0x0b, KEY_BACKSPACE)
+                        MATRIX_KEY(0x01, 0x0c, KEY_HENKAN)
 
                         MATRIX_KEY(0x02, 0x00, KEY_LEFTCTRL)
                         MATRIX_KEY(0x02, 0x01, KEY_TAB)
@@ -45,6 +47,7 @@
                         MATRIX_KEY(0x02, 0x07, KEY_102ND)
                         MATRIX_KEY(0x02, 0x08, KEY_LEFTBRACE)
                         MATRIX_KEY(0x02, 0x09, KEY_F8)
+                        MATRIX_KEY(0x02, 0x0a, KEY_YEN)
 
                         MATRIX_KEY(0x03, 0x01, KEY_GRAVE)
                         MATRIX_KEY(0x03, 0x02, KEY_F2)
@@ -53,6 +56,7 @@
                         MATRIX_KEY(0x03, 0x06, KEY_6)
                         MATRIX_KEY(0x03, 0x08, KEY_MINUS)
                         MATRIX_KEY(0x03, 0x0b, KEY_BACKSLASH)
+                        MATRIX_KEY(0x03, 0x0c, KEY_MUHENKAN)
 
                         MATRIX_KEY(0x04, 0x00, KEY_RIGHTCTRL)
                         MATRIX_KEY(0x04, 0x01, KEY_A)
diff --git a/arch/arm/boot/dts/dra7-evm.dts b/arch/arm/boot/dts/dra7-evm.dts
index aa465904f6cc..096f68be99e2 100644
--- a/arch/arm/boot/dts/dra7-evm.dts
+++ b/arch/arm/boot/dts/dra7-evm.dts
@@ -686,7 +686,8 @@
 
 &dcan1 {
         status = "ok";
-        pinctrl-names = "default", "sleep";
-        pinctrl-0 = <&dcan1_pins_default>;
+        pinctrl-names = "default", "sleep", "active";
+        pinctrl-0 = <&dcan1_pins_sleep>;
         pinctrl-1 = <&dcan1_pins_sleep>;
+        pinctrl-2 = <&dcan1_pins_default>;
 };
diff --git a/arch/arm/boot/dts/dra72-evm.dts b/arch/arm/boot/dts/dra72-evm.dts
index 4e1b60581782..803738414086 100644
--- a/arch/arm/boot/dts/dra72-evm.dts
+++ b/arch/arm/boot/dts/dra72-evm.dts
@@ -587,9 +587,10 @@
 
 &dcan1 {
         status = "ok";
-        pinctrl-names = "default", "sleep";
-        pinctrl-0 = <&dcan1_pins_default>;
+        pinctrl-names = "default", "sleep", "active";
+        pinctrl-0 = <&dcan1_pins_sleep>;
         pinctrl-1 = <&dcan1_pins_sleep>;
+        pinctrl-2 = <&dcan1_pins_default>;
 };
 
 &qspi {
diff --git a/arch/arm/boot/dts/imx23.dtsi b/arch/arm/boot/dts/imx23.dtsi
index c892d58e8dad..b995333ea22b 100644
--- a/arch/arm/boot/dts/imx23.dtsi
+++ b/arch/arm/boot/dts/imx23.dtsi
@@ -468,6 +468,7 @@
                                 interrupts = <36 37 38 39 40 41 42 43 44>;
                                 status = "disabled";
                                 clocks = <&clks 26>;
+                                #io-channel-cells = <1>;
                         };
 
                         spdif@80054000 {
diff --git a/arch/arm/boot/dts/imx25-pdk.dts b/arch/arm/boot/dts/imx25-pdk.dts
index dd45e6971bc3..9351296356dc 100644
--- a/arch/arm/boot/dts/imx25-pdk.dts
+++ b/arch/arm/boot/dts/imx25-pdk.dts
@@ -10,6 +10,7 @@
  */
 
 /dts-v1/;
+#include <dt-bindings/gpio/gpio.h>
 #include <dt-bindings/input/input.h>
 #include "imx25.dtsi"
 
@@ -114,8 +115,8 @@
 &esdhc1 {
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_esdhc1>;
-        cd-gpios = <&gpio2 1 0>;
-        wp-gpios = <&gpio2 0 0>;
+        cd-gpios = <&gpio2 1 GPIO_ACTIVE_LOW>;
+        wp-gpios = <&gpio2 0 GPIO_ACTIVE_HIGH>;
         status = "okay";
 };
 
diff --git a/arch/arm/boot/dts/imx27.dtsi b/arch/arm/boot/dts/imx27.dtsi
index bc215e4b75fd..b69be5c499cf 100644
--- a/arch/arm/boot/dts/imx27.dtsi
+++ b/arch/arm/boot/dts/imx27.dtsi
@@ -108,7 +108,7 @@
                         };
 
                         gpt1: timer@10003000 {
-                                compatible = "fsl,imx27-gpt", "fsl,imx1-gpt";
+                                compatible = "fsl,imx27-gpt", "fsl,imx21-gpt";
                                 reg = <0x10003000 0x1000>;
                                 interrupts = <26>;
                                 clocks = <&clks IMX27_CLK_GPT1_IPG_GATE>,
@@ -117,7 +117,7 @@
                         };
 
                         gpt2: timer@10004000 {
-                                compatible = "fsl,imx27-gpt", "fsl,imx1-gpt";
+                                compatible = "fsl,imx27-gpt", "fsl,imx21-gpt";
                                 reg = <0x10004000 0x1000>;
                                 interrupts = <25>;
                                 clocks = <&clks IMX27_CLK_GPT2_IPG_GATE>,
@@ -126,7 +126,7 @@
                         };
 
                         gpt3: timer@10005000 {
-                                compatible = "fsl,imx27-gpt", "fsl,imx1-gpt";
+                                compatible = "fsl,imx27-gpt", "fsl,imx21-gpt";
                                 reg = <0x10005000 0x1000>;
                                 interrupts = <24>;
                                 clocks = <&clks IMX27_CLK_GPT3_IPG_GATE>,
@@ -376,7 +376,7 @@
                         };
 
                         gpt4: timer@10019000 {
-                                compatible = "fsl,imx27-gpt", "fsl,imx1-gpt";
+                                compatible = "fsl,imx27-gpt", "fsl,imx21-gpt";
                                 reg = <0x10019000 0x1000>;
                                 interrupts = <4>;
                                 clocks = <&clks IMX27_CLK_GPT4_IPG_GATE>,
@@ -385,7 +385,7 @@
                         };
 
                         gpt5: timer@1001a000 {
-                                compatible = "fsl,imx27-gpt", "fsl,imx1-gpt";
+                                compatible = "fsl,imx27-gpt", "fsl,imx21-gpt";
                                 reg = <0x1001a000 0x1000>;
                                 interrupts = <3>;
                                 clocks = <&clks IMX27_CLK_GPT5_IPG_GATE>,
@@ -436,7 +436,7 @@
                         };
 
                         gpt6: timer@1001f000 {
-                                compatible = "fsl,imx27-gpt", "fsl,imx1-gpt";
+                                compatible = "fsl,imx27-gpt", "fsl,imx21-gpt";
                                 reg = <0x1001f000 0x1000>;
                                 interrupts = <2>;
                                 clocks = <&clks IMX27_CLK_GPT6_IPG_GATE>,
diff --git a/arch/arm/boot/dts/imx51-apf51dev.dts b/arch/arm/boot/dts/imx51-apf51dev.dts
index 93d3ea12328c..0f3fe29b816e 100644
--- a/arch/arm/boot/dts/imx51-apf51dev.dts
+++ b/arch/arm/boot/dts/imx51-apf51dev.dts
@@ -98,7 +98,7 @@
 &esdhc1 {
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_esdhc1>;
-        cd-gpios = <&gpio2 29 GPIO_ACTIVE_HIGH>;
+        cd-gpios = <&gpio2 29 GPIO_ACTIVE_LOW>;
         bus-width = <4>;
         status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx53-ard.dts b/arch/arm/boot/dts/imx53-ard.dts
index e9337ad52f59..3bc18835fb4b 100644
--- a/arch/arm/boot/dts/imx53-ard.dts
+++ b/arch/arm/boot/dts/imx53-ard.dts
@@ -103,8 +103,8 @@
 &esdhc1 {
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_esdhc1>;
-        cd-gpios = <&gpio1 1 0>;
-        wp-gpios = <&gpio1 9 0>;
+        cd-gpios = <&gpio1 1 GPIO_ACTIVE_LOW>;
+        wp-gpios = <&gpio1 9 GPIO_ACTIVE_HIGH>;
         status = "okay";
 };
 
diff --git a/arch/arm/boot/dts/imx53-m53evk.dts b/arch/arm/boot/dts/imx53-m53evk.dts
index d0e0f57eb432..53f40885c530 100644
--- a/arch/arm/boot/dts/imx53-m53evk.dts
+++ b/arch/arm/boot/dts/imx53-m53evk.dts
@@ -124,8 +124,8 @@
 &esdhc1 {
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_esdhc1>;
-        cd-gpios = <&gpio1 1 0>;
-        wp-gpios = <&gpio1 9 0>;
+        cd-gpios = <&gpio1 1 GPIO_ACTIVE_LOW>;
+        wp-gpios = <&gpio1 9 GPIO_ACTIVE_HIGH>;
         status = "okay";
 };
 
diff --git a/arch/arm/boot/dts/imx53-qsb-common.dtsi b/arch/arm/boot/dts/imx53-qsb-common.dtsi
index 181ae5ebf23f..b0d5542ac829 100644
--- a/arch/arm/boot/dts/imx53-qsb-common.dtsi
+++ b/arch/arm/boot/dts/imx53-qsb-common.dtsi
@@ -147,8 +147,8 @@
 &esdhc3 {
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_esdhc3>;
-        cd-gpios = <&gpio3 11 0>;
-        wp-gpios = <&gpio3 12 0>;
+        cd-gpios = <&gpio3 11 GPIO_ACTIVE_LOW>;
+        wp-gpios = <&gpio3 12 GPIO_ACTIVE_HIGH>;
         bus-width = <8>;
         status = "okay";
 };
@@ -295,9 +295,10 @@
 &tve {
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_vga_sync>;
+        ddc-i2c-bus = <&i2c2>;
         fsl,tve-mode = "vga";
-        fsl,hsync-pin = <4>;
-        fsl,vsync-pin = <6>;
+        fsl,hsync-pin = <7>;    /* IPU DI1 PIN7 via EIM_OE */
+        fsl,vsync-pin = <8>;    /* IPU DI1 PIN8 via EIM_RW */
         status = "okay";
 };
 
diff --git a/arch/arm/boot/dts/imx53-smd.dts b/arch/arm/boot/dts/imx53-smd.dts
index 1d325576bcc0..fc89ce1e5763 100644
--- a/arch/arm/boot/dts/imx53-smd.dts
+++ b/arch/arm/boot/dts/imx53-smd.dts
@@ -41,8 +41,8 @@
 &esdhc1 {
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_esdhc1>;
-        cd-gpios = <&gpio3 13 0>;
-        wp-gpios = <&gpio4 11 0>;
+        cd-gpios = <&gpio3 13 GPIO_ACTIVE_LOW>;
+        wp-gpios = <&gpio4 11 GPIO_ACTIVE_HIGH>;
         status = "okay";
 };
 
diff --git a/arch/arm/boot/dts/imx53-tqma53.dtsi b/arch/arm/boot/dts/imx53-tqma53.dtsi
index 4f1f0e2868bf..e03373a58760 100644
--- a/arch/arm/boot/dts/imx53-tqma53.dtsi
+++ b/arch/arm/boot/dts/imx53-tqma53.dtsi
@@ -41,8 +41,8 @@
         pinctrl-0 = <&pinctrl_esdhc2>,
                     <&pinctrl_esdhc2_cdwp>;
         vmmc-supply = <&reg_3p3v>;
-        wp-gpios = <&gpio1 2 0>;
-        cd-gpios = <&gpio1 4 0>;
+        wp-gpios = <&gpio1 2 GPIO_ACTIVE_HIGH>;
+        cd-gpios = <&gpio1 4 GPIO_ACTIVE_LOW>;
         status = "disabled";
 };
 
diff --git a/arch/arm/boot/dts/imx53-tx53.dtsi b/arch/arm/boot/dts/imx53-tx53.dtsi
index 704bd72cbfec..d3e50b22064f 100644
--- a/arch/arm/boot/dts/imx53-tx53.dtsi
+++ b/arch/arm/boot/dts/imx53-tx53.dtsi
@@ -183,7 +183,7 @@
 };
 
 &esdhc1 {
-        cd-gpios = <&gpio3 24 GPIO_ACTIVE_HIGH>;
+        cd-gpios = <&gpio3 24 GPIO_ACTIVE_LOW>;
         fsl,wp-controller;
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_esdhc1>;
@@ -191,7 +191,7 @@
 };
 
 &esdhc2 {
-        cd-gpios = <&gpio3 25 GPIO_ACTIVE_HIGH>;
+        cd-gpios = <&gpio3 25 GPIO_ACTIVE_LOW>;
         fsl,wp-controller;
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_esdhc2>;
diff --git a/arch/arm/boot/dts/imx53-voipac-bsb.dts b/arch/arm/boot/dts/imx53-voipac-bsb.dts
index c17d3ad6dba5..fc51b87ad208 100644
--- a/arch/arm/boot/dts/imx53-voipac-bsb.dts
+++ b/arch/arm/boot/dts/imx53-voipac-bsb.dts
@@ -119,8 +119,8 @@
 &esdhc2 {
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_esdhc2>;
-        cd-gpios = <&gpio3 25 0>;
-        wp-gpios = <&gpio2 19 0>;
+        cd-gpios = <&gpio3 25 GPIO_ACTIVE_LOW>;
+        wp-gpios = <&gpio2 19 GPIO_ACTIVE_HIGH>;
         vmmc-supply = <&reg_3p3v>;
         status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6dl-riotboard.dts b/arch/arm/boot/dts/imx6dl-riotboard.dts
index 43cb3fd76be7..5111f5170d53 100644
--- a/arch/arm/boot/dts/imx6dl-riotboard.dts
+++ b/arch/arm/boot/dts/imx6dl-riotboard.dts
@@ -305,8 +305,8 @@
 &usdhc2 {
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_usdhc2>;
-        cd-gpios = <&gpio1 4 0>;
-        wp-gpios = <&gpio1 2 0>;
+        cd-gpios = <&gpio1 4 GPIO_ACTIVE_LOW>;
+        wp-gpios = <&gpio1 2 GPIO_ACTIVE_HIGH>;
         vmmc-supply = <&reg_3p3v>;
         status = "okay";
 };
@@ -314,8 +314,8 @@
 &usdhc3 {
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_usdhc3>;
-        cd-gpios = <&gpio7 0 0>;
-        wp-gpios = <&gpio7 1 0>;
+        cd-gpios = <&gpio7 0 GPIO_ACTIVE_LOW>;
+        wp-gpios = <&gpio7 1 GPIO_ACTIVE_HIGH>;
         vmmc-supply = <&reg_3p3v>;
         status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6q-arm2.dts b/arch/arm/boot/dts/imx6q-arm2.dts
index 78df05e9d1ce..d6515f7a56c4 100644
--- a/arch/arm/boot/dts/imx6q-arm2.dts
+++ b/arch/arm/boot/dts/imx6q-arm2.dts
@@ -11,6 +11,7 @@
  */
 
 /dts-v1/;
+#include <dt-bindings/gpio/gpio.h>
 #include "imx6q.dtsi"
 
 / {
@@ -196,8 +197,8 @@
 };
 
 &usdhc3 {
-        cd-gpios = <&gpio6 11 0>;
-        wp-gpios = <&gpio6 14 0>;
+        cd-gpios = <&gpio6 11 GPIO_ACTIVE_LOW>;
+        wp-gpios = <&gpio6 14 GPIO_ACTIVE_HIGH>;
         vmmc-supply = <&reg_3p3v>;
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_usdhc3
diff --git a/arch/arm/boot/dts/imx6q-gk802.dts b/arch/arm/boot/dts/imx6q-gk802.dts
index 703539cf36d3..00bd63e63d0c 100644
--- a/arch/arm/boot/dts/imx6q-gk802.dts
+++ b/arch/arm/boot/dts/imx6q-gk802.dts
@@ -7,6 +7,7 @@
  */
 
 /dts-v1/;
+#include <dt-bindings/gpio/gpio.h>
 #include "imx6q.dtsi"
 
 / {
@@ -161,7 +162,7 @@
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_usdhc3>;
         bus-width = <4>;
-        cd-gpios = <&gpio6 11 0>;
+        cd-gpios = <&gpio6 11 GPIO_ACTIVE_LOW>;
         vmmc-supply = <&reg_3p3v>;
         status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6q-tbs2910.dts b/arch/arm/boot/dts/imx6q-tbs2910.dts
index a43abfa21e33..5645d52850a7 100644
--- a/arch/arm/boot/dts/imx6q-tbs2910.dts
+++ b/arch/arm/boot/dts/imx6q-tbs2910.dts
@@ -251,7 +251,7 @@
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_usdhc2>;
         bus-width = <4>;
-        cd-gpios = <&gpio2 2 GPIO_ACTIVE_HIGH>;
+        cd-gpios = <&gpio2 2 GPIO_ACTIVE_LOW>;
         vmmc-supply = <&reg_3p3v>;
         status = "okay";
 };
@@ -260,7 +260,7 @@
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_usdhc3>;
         bus-width = <4>;
-        cd-gpios = <&gpio2 0 GPIO_ACTIVE_HIGH>;
+        cd-gpios = <&gpio2 0 GPIO_ACTIVE_LOW>;
         wp-gpios = <&gpio2 1 GPIO_ACTIVE_HIGH>;
         vmmc-supply = <&reg_3p3v>;
         status = "okay";
diff --git a/arch/arm/boot/dts/imx6qdl-aristainetos.dtsi b/arch/arm/boot/dts/imx6qdl-aristainetos.dtsi
index e6d9195a1da7..f4d6ae564ead 100644
--- a/arch/arm/boot/dts/imx6qdl-aristainetos.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-aristainetos.dtsi
@@ -173,7 +173,7 @@
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_usdhc1>;
         vmmc-supply = <&reg_3p3v>;
-        cd-gpios = <&gpio4 7 GPIO_ACTIVE_HIGH>;
+        cd-gpios = <&gpio4 7 GPIO_ACTIVE_LOW>;
         status = "okay";
 };
 
@@ -181,7 +181,7 @@
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_usdhc2>;
         vmmc-supply = <&reg_3p3v>;
-        cd-gpios = <&gpio4 8 GPIO_ACTIVE_HIGH>;
+        cd-gpios = <&gpio4 8 GPIO_ACTIVE_LOW>;
         status = "okay";
 };
 
diff --git a/arch/arm/boot/dts/imx6qdl-aristainetos2.dtsi b/arch/arm/boot/dts/imx6qdl-aristainetos2.dtsi
index 1d85de2befb3..a47a0399a172 100644
--- a/arch/arm/boot/dts/imx6qdl-aristainetos2.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-aristainetos2.dtsi
@@ -392,7 +392,7 @@
 &usdhc1 {
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_usdhc1>;
-        cd-gpios = <&gpio1 27 GPIO_ACTIVE_HIGH>;
+        cd-gpios = <&gpio1 27 GPIO_ACTIVE_LOW>;
         no-1-8-v;
         status = "okay";
 };
@@ -400,7 +400,7 @@
 &usdhc2 {
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_usdhc2>;
-        cd-gpios = <&gpio4 5 GPIO_ACTIVE_HIGH>;
+        cd-gpios = <&gpio4 5 GPIO_ACTIVE_LOW>;
         wp-gpios = <&gpio2 10 GPIO_ACTIVE_HIGH>;
         no-1-8-v;
         status = "okay";
diff --git a/arch/arm/boot/dts/imx6qdl-cubox-i.dtsi b/arch/arm/boot/dts/imx6qdl-cubox-i.dtsi
index 59e5d15e3ec4..ff41f83551de 100644
--- a/arch/arm/boot/dts/imx6qdl-cubox-i.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-cubox-i.dtsi
@@ -258,6 +258,6 @@
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_cubox_i_usdhc2_aux &pinctrl_cubox_i_usdhc2>;
         vmmc-supply = <&reg_3p3v>;
-        cd-gpios = <&gpio1 4 0>;
+        cd-gpios = <&gpio1 4 GPIO_ACTIVE_LOW>;
         status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6qdl-dfi-fs700-m60.dtsi b/arch/arm/boot/dts/imx6qdl-dfi-fs700-m60.dtsi
index 2c253d6d20bd..45e7c39e80d5 100644
--- a/arch/arm/boot/dts/imx6qdl-dfi-fs700-m60.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-dfi-fs700-m60.dtsi
@@ -1,3 +1,5 @@
+#include <dt-bindings/gpio/gpio.h>
+
 / {
         regulators {
                 compatible = "simple-bus";
@@ -181,7 +183,7 @@
 &usdhc2 { /* module slot */
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_usdhc2>;
-        cd-gpios = <&gpio2 2 0>;
+        cd-gpios = <&gpio2 2 GPIO_ACTIVE_LOW>;
         status = "okay";
 };
 
diff --git a/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi b/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi
index b5756c21ea1d..4493f6e99330 100644
--- a/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi
@@ -318,7 +318,7 @@
 &usdhc3 {
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_usdhc3>;
-        cd-gpios = <&gpio7 0 GPIO_ACTIVE_HIGH>;
+        cd-gpios = <&gpio7 0 GPIO_ACTIVE_LOW>;
         vmmc-supply = <&reg_3p3v>;
         status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6qdl-gw53xx.dtsi b/arch/arm/boot/dts/imx6qdl-gw53xx.dtsi
index 86f03c1b147c..a857d1294609 100644
--- a/arch/arm/boot/dts/imx6qdl-gw53xx.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-gw53xx.dtsi
@@ -324,7 +324,7 @@
 &usdhc3 {
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_usdhc3>;
-        cd-gpios = <&gpio7 0 GPIO_ACTIVE_HIGH>;
+        cd-gpios = <&gpio7 0 GPIO_ACTIVE_LOW>;
         vmmc-supply = <&reg_3p3v>;
         status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6qdl-gw54xx.dtsi b/arch/arm/boot/dts/imx6qdl-gw54xx.dtsi
index 4a8d97f47759..1afe3385e2d2 100644
--- a/arch/arm/boot/dts/imx6qdl-gw54xx.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-gw54xx.dtsi
@@ -417,7 +417,7 @@
 &usdhc3 {
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_usdhc3>;
-        cd-gpios = <&gpio7 0 GPIO_ACTIVE_HIGH>;
+        cd-gpios = <&gpio7 0 GPIO_ACTIVE_LOW>;
         vmmc-supply = <&reg_3p3v>;
         status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6qdl-hummingboard.dtsi b/arch/arm/boot/dts/imx6qdl-hummingboard.dtsi
index 62a82f3eba88..6dd0b764e036 100644
--- a/arch/arm/boot/dts/imx6qdl-hummingboard.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-hummingboard.dtsi
@@ -299,6 +299,6 @@
                 &pinctrl_hummingboard_usdhc2
         >;
         vmmc-supply = <&reg_3p3v>;
-        cd-gpios = <&gpio1 4 0>;
+        cd-gpios = <&gpio1 4 GPIO_ACTIVE_LOW>;
         status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6qdl-nitrogen6x.dtsi b/arch/arm/boot/dts/imx6qdl-nitrogen6x.dtsi
index 3af16dfe417b..d7fe6672d00c 100644
--- a/arch/arm/boot/dts/imx6qdl-nitrogen6x.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-nitrogen6x.dtsi
@@ -453,7 +453,7 @@
 &usdhc3 {
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_usdhc3>;
-        cd-gpios = <&gpio7 0 0>;
+        cd-gpios = <&gpio7 0 GPIO_ACTIVE_LOW>;
         vmmc-supply = <&reg_3p3v>;
         status = "okay";
 };
@@ -461,7 +461,7 @@
 &usdhc4 {
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_usdhc4>;
-        cd-gpios = <&gpio2 6 0>;
+        cd-gpios = <&gpio2 6 GPIO_ACTIVE_LOW>;
         vmmc-supply = <&reg_3p3v>;
         status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi b/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi
index 1ce6133b67f5..9e6ecd99b472 100644
--- a/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi
@@ -409,8 +409,8 @@
 &usdhc2 {
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_usdhc2>;
-        cd-gpios = <&gpio1 4 0>;
-        wp-gpios = <&gpio1 2 0>;
+        cd-gpios = <&gpio1 4 GPIO_ACTIVE_LOW>;
+        wp-gpios = <&gpio1 2 GPIO_ACTIVE_HIGH>;
         status = "disabled";
 };
 
@@ -418,7 +418,7 @@
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_usdhc3
                      &pinctrl_usdhc3_cdwp>;
-        cd-gpios = <&gpio1 27 0>;
-        wp-gpios = <&gpio1 29 0>;
+        cd-gpios = <&gpio1 27 GPIO_ACTIVE_LOW>;
+        wp-gpios = <&gpio1 29 GPIO_ACTIVE_HIGH>;
         status = "disabled";
 };
diff --git a/arch/arm/boot/dts/imx6qdl-rex.dtsi b/arch/arm/boot/dts/imx6qdl-rex.dtsi
index 488a640796ac..3373fd958e95 100644
--- a/arch/arm/boot/dts/imx6qdl-rex.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-rex.dtsi
@@ -342,7 +342,7 @@
         pinctrl-0 = <&pinctrl_usdhc2>;
         bus-width = <4>;
         cd-gpios = <&gpio2 2 GPIO_ACTIVE_LOW>;
-        wp-gpios = <&gpio2 3 GPIO_ACTIVE_LOW>;
+        wp-gpios = <&gpio2 3 GPIO_ACTIVE_HIGH>;
         status = "okay";
 };
 
@@ -351,6 +351,6 @@
         pinctrl-0 = <&pinctrl_usdhc3>;
         bus-width = <4>;
         cd-gpios = <&gpio2 0 GPIO_ACTIVE_LOW>;
-        wp-gpios = <&gpio2 1 GPIO_ACTIVE_LOW>;
+        wp-gpios = <&gpio2 1 GPIO_ACTIVE_HIGH>;
         status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi b/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi
index 3b24b12651b2..e329ca5c3322 100644
--- a/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi
@@ -467,8 +467,8 @@
         pinctrl-0 = <&pinctrl_usdhc3>;
         pinctrl-1 = <&pinctrl_usdhc3_100mhz>;
         pinctrl-2 = <&pinctrl_usdhc3_200mhz>;
-        cd-gpios = <&gpio6 15 0>;
-        wp-gpios = <&gpio1 13 0>;
+        cd-gpios = <&gpio6 15 GPIO_ACTIVE_LOW>;
+        wp-gpios = <&gpio1 13 GPIO_ACTIVE_HIGH>;
         status = "okay";
 };
 
diff --git a/arch/arm/boot/dts/imx6qdl-sabrelite.dtsi b/arch/arm/boot/dts/imx6qdl-sabrelite.dtsi
index e00c44f6a0df..782379320517 100644
--- a/arch/arm/boot/dts/imx6qdl-sabrelite.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-sabrelite.dtsi
@@ -448,8 +448,8 @@
 &usdhc3 {
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_usdhc3>;
-        cd-gpios = <&gpio7 0 0>;
-        wp-gpios = <&gpio7 1 0>;
+        cd-gpios = <&gpio7 0 GPIO_ACTIVE_LOW>;
+        wp-gpios = <&gpio7 1 GPIO_ACTIVE_HIGH>;
         vmmc-supply = <&reg_3p3v>;
         status = "okay";
 };
@@ -457,7 +457,7 @@
 &usdhc4 {
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_usdhc4>;
-        cd-gpios = <&gpio2 6 0>;
+        cd-gpios = <&gpio2 6 GPIO_ACTIVE_LOW>;
         vmmc-supply = <&reg_3p3v>;
         status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6qdl-sabresd.dtsi b/arch/arm/boot/dts/imx6qdl-sabresd.dtsi
index a626e6dd8022..944eb81cb2b8 100644
--- a/arch/arm/boot/dts/imx6qdl-sabresd.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-sabresd.dtsi
@@ -562,8 +562,8 @@
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_usdhc2>;
         bus-width = <8>;
-        cd-gpios = <&gpio2 2 0>;
-        wp-gpios = <&gpio2 3 0>;
+        cd-gpios = <&gpio2 2 GPIO_ACTIVE_LOW>;
+        wp-gpios = <&gpio2 3 GPIO_ACTIVE_HIGH>;
         status = "okay";
 };
 
@@ -571,8 +571,8 @@
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_usdhc3>;
         bus-width = <8>;
-        cd-gpios = <&gpio2 0 0>;
-        wp-gpios = <&gpio2 1 0>;
+        cd-gpios = <&gpio2 0 GPIO_ACTIVE_LOW>;
+        wp-gpios = <&gpio2 1 GPIO_ACTIVE_HIGH>;
         status = "okay";
 };
 
diff --git a/arch/arm/boot/dts/imx6qdl-tx6.dtsi b/arch/arm/boot/dts/imx6qdl-tx6.dtsi
index f02b80b41d4f..da08de324e9e 100644
--- a/arch/arm/boot/dts/imx6qdl-tx6.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-tx6.dtsi
@@ -680,7 +680,7 @@
         pinctrl-0 = <&pinctrl_usdhc1>;
         bus-width = <4>;
         no-1-8-v;
-        cd-gpios = <&gpio7 2 0>;
+        cd-gpios = <&gpio7 2 GPIO_ACTIVE_LOW>;
         fsl,wp-controller;
         status = "okay";
 };
@@ -690,7 +690,7 @@
         pinctrl-0 = <&pinctrl_usdhc2>;
         bus-width = <4>;
         no-1-8-v;
-        cd-gpios = <&gpio7 3 0>;
+        cd-gpios = <&gpio7 3 GPIO_ACTIVE_LOW>;
         fsl,wp-controller;
         status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6qdl-wandboard.dtsi b/arch/arm/boot/dts/imx6qdl-wandboard.dtsi
index 5fb091675582..9e096d811bed 100644
--- a/arch/arm/boot/dts/imx6qdl-wandboard.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-wandboard.dtsi
@@ -9,6 +9,8 @@
  *
  */
 
+#include <dt-bindings/gpio/gpio.h>
+
 / {
         regulators {
                 compatible = "simple-bus";
@@ -250,13 +252,13 @@
 &usdhc1 {
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_usdhc1>;
-        cd-gpios = <&gpio1 2 0>;
+        cd-gpios = <&gpio1 2 GPIO_ACTIVE_LOW>;
         status = "okay";
 };
 
 &usdhc3 {
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_usdhc3>;
-        cd-gpios = <&gpio3 9 0>;
+        cd-gpios = <&gpio3 9 GPIO_ACTIVE_LOW>;
         status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6sl-evk.dts b/arch/arm/boot/dts/imx6sl-evk.dts
index 945887d3fdb3..b84dff2e94ea 100644
--- a/arch/arm/boot/dts/imx6sl-evk.dts
+++ b/arch/arm/boot/dts/imx6sl-evk.dts
@@ -617,8 +617,8 @@
         pinctrl-1 = <&pinctrl_usdhc1_100mhz>;
         pinctrl-2 = <&pinctrl_usdhc1_200mhz>;
         bus-width = <8>;
-        cd-gpios = <&gpio4 7 0>;
-        wp-gpios = <&gpio4 6 0>;
+        cd-gpios = <&gpio4 7 GPIO_ACTIVE_LOW>;
+        wp-gpios = <&gpio4 6 GPIO_ACTIVE_HIGH>;
         status = "okay";
 };
 
@@ -627,8 +627,8 @@
         pinctrl-0 = <&pinctrl_usdhc2>;
         pinctrl-1 = <&pinctrl_usdhc2_100mhz>;
         pinctrl-2 = <&pinctrl_usdhc2_200mhz>;
-        cd-gpios = <&gpio5 0 0>;
-        wp-gpios = <&gpio4 29 0>;
+        cd-gpios = <&gpio5 0 GPIO_ACTIVE_LOW>;
+        wp-gpios = <&gpio4 29 GPIO_ACTIVE_HIGH>;
         status = "okay";
 };
 
@@ -637,6 +637,6 @@
         pinctrl-0 = <&pinctrl_usdhc3>;
         pinctrl-1 = <&pinctrl_usdhc3_100mhz>;
         pinctrl-2 = <&pinctrl_usdhc3_200mhz>;
-        cd-gpios = <&gpio3 22 0>;
+        cd-gpios = <&gpio3 22 GPIO_ACTIVE_LOW>;
         status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6sx-sabreauto.dts b/arch/arm/boot/dts/imx6sx-sabreauto.dts
index e3c0b63c2205..115f3fd78971 100644
--- a/arch/arm/boot/dts/imx6sx-sabreauto.dts
+++ b/arch/arm/boot/dts/imx6sx-sabreauto.dts
@@ -49,7 +49,7 @@
         pinctrl-1 = <&pinctrl_usdhc3_100mhz>;
         pinctrl-2 = <&pinctrl_usdhc3_200mhz>;
         bus-width = <8>;
-        cd-gpios = <&gpio7 10 GPIO_ACTIVE_HIGH>;
+        cd-gpios = <&gpio7 10 GPIO_ACTIVE_LOW>;
         wp-gpios = <&gpio3 19 GPIO_ACTIVE_HIGH>;
         keep-power-in-suspend;
         enable-sdio-wakeup;
@@ -61,7 +61,7 @@
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_usdhc4>;
         bus-width = <8>;
-        cd-gpios = <&gpio7 11 GPIO_ACTIVE_HIGH>;
+        cd-gpios = <&gpio7 11 GPIO_ACTIVE_LOW>;
         no-1-8-v;
         keep-power-in-suspend;
         enable-sdio-wakup;
diff --git a/arch/arm/boot/dts/imx6sx-sdb.dtsi b/arch/arm/boot/dts/imx6sx-sdb.dtsi
index cef04cef3a80..ac88c3467078 100644
--- a/arch/arm/boot/dts/imx6sx-sdb.dtsi
+++ b/arch/arm/boot/dts/imx6sx-sdb.dtsi
@@ -293,7 +293,7 @@
         pinctrl-1 = <&pinctrl_usdhc3_100mhz>;
         pinctrl-2 = <&pinctrl_usdhc3_200mhz>;
         bus-width = <8>;
-        cd-gpios = <&gpio2 10 GPIO_ACTIVE_HIGH>;
+        cd-gpios = <&gpio2 10 GPIO_ACTIVE_LOW>;
         wp-gpios = <&gpio2 15 GPIO_ACTIVE_HIGH>;
         keep-power-in-suspend;
         enable-sdio-wakeup;
@@ -304,7 +304,7 @@
 &usdhc4 {
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_usdhc4>;
-        cd-gpios = <&gpio6 21 GPIO_ACTIVE_HIGH>;
+        cd-gpios = <&gpio6 21 GPIO_ACTIVE_LOW>;
         wp-gpios = <&gpio6 20 GPIO_ACTIVE_HIGH>;
         status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx7d-sdb.dts b/arch/arm/boot/dts/imx7d-sdb.dts
index 4d1a4b977d84..fdd1d7c9a5cc 100644
--- a/arch/arm/boot/dts/imx7d-sdb.dts
+++ b/arch/arm/boot/dts/imx7d-sdb.dts
@@ -234,8 +234,8 @@
 &usdhc1 {
         pinctrl-names = "default";
         pinctrl-0 = <&pinctrl_usdhc1>;
-        cd-gpios = <&gpio5 0 0>;
-        wp-gpios = <&gpio5 1 0>;
+        cd-gpios = <&gpio5 0 GPIO_ACTIVE_LOW>;
+        wp-gpios = <&gpio5 1 GPIO_ACTIVE_HIGH>;
         enable-sdio-wakeup;
         keep-power-in-suspend;
         status = "okay";
diff --git a/arch/arm/boot/dts/k2e.dtsi b/arch/arm/boot/dts/k2e.dtsi
index 50e555eab50d..1b6494fbdb91 100644
--- a/arch/arm/boot/dts/k2e.dtsi
+++ b/arch/arm/boot/dts/k2e.dtsi
@@ -86,7 +86,7 @@
                         gpio,syscon-dev = <&devctrl 0x240>;
                 };
 
-                pcie@21020000 {
+                pcie1: pcie@21020000 {
                         compatible = "ti,keystone-pcie","snps,dw-pcie";
                         clocks = <&clkpcie1>;
                         clock-names = "pcie";
@@ -96,6 +96,7 @@
                         ranges = <0x81000000 0 0 0x23260000 0x4000 0x4000
                                 0x82000000 0 0x60000000 0x60000000 0 0x10000000>;
 
+                        status = "disabled";
                         device_type = "pci";
                         num-lanes = <2>;
 
diff --git a/arch/arm/boot/dts/keystone.dtsi b/arch/arm/boot/dts/keystone.dtsi
index c06542b2c954..e7a6f6deabb6 100644
--- a/arch/arm/boot/dts/keystone.dtsi
+++ b/arch/arm/boot/dts/keystone.dtsi
@@ -286,7 +286,7 @@
                         ti,syscon-dev = <&devctrl 0x2a0>;
                 };
 
-                pcie@21800000 {
+                pcie0: pcie@21800000 {
                         compatible = "ti,keystone-pcie", "snps,dw-pcie";
                         clocks = <&clkpcie>;
                         clock-names = "pcie";
@@ -296,6 +296,7 @@
                         ranges = <0x81000000 0 0 0x23250000 0 0x4000
                                 0x82000000 0 0x50000000 0x50000000 0 0x10000000>;
 
+                        status = "disabled";
                         device_type = "pci";
                         num-lanes = <2>;
 
diff --git a/arch/arm/boot/dts/omap3-overo-common-lcd35.dtsi b/arch/arm/boot/dts/omap3-overo-common-lcd35.dtsi
index 233c69e50ae3..df8908adb0cb 100644
--- a/arch/arm/boot/dts/omap3-overo-common-lcd35.dtsi
+++ b/arch/arm/boot/dts/omap3-overo-common-lcd35.dtsi
@@ -120,7 +120,7 @@
 
         lcd0: display@0 {
                 compatible = "lgphilips,lb035q02";
-                label = "lcd";
+                label = "lcd35";
 
                 reg = <1>;                                      /* CS1 */
                 spi-max-frequency = <10000000>;
diff --git a/arch/arm/boot/dts/omap3-overo-common-lcd43.dtsi b/arch/arm/boot/dts/omap3-overo-common-lcd43.dtsi
index f5395b7da912..048fd216970a 100644
--- a/arch/arm/boot/dts/omap3-overo-common-lcd43.dtsi
+++ b/arch/arm/boot/dts/omap3-overo-common-lcd43.dtsi
@@ -98,7 +98,7 @@
 
         lcd0: display@0 {
                 compatible = "samsung,lte430wq-f0c", "panel-dpi";
-                label = "lcd";
+                label = "lcd43";
 
                 pinctrl-names = "default";
                 pinctrl-0 = <&lte430_pins>;
diff --git a/arch/arm/boot/dts/omap4.dtsi b/arch/arm/boot/dts/omap4.dtsi
index f884d6adb71e..7d31c6ff246f 100644
--- a/arch/arm/boot/dts/omap4.dtsi
+++ b/arch/arm/boot/dts/omap4.dtsi
@@ -551,6 +551,7 @@
                         reg = <0x4a066000 0x100>;
                         interrupts = <GIC_SPI 28 IRQ_TYPE_LEVEL_HIGH>;
                         ti,hwmods = "mmu_dsp";
+                        #iommu-cells = <0>;
                 };
 
                 mmu_ipu: mmu@55082000 {
@@ -558,6 +559,7 @@
                         reg = <0x55082000 0x100>;
                         interrupts = <GIC_SPI 100 IRQ_TYPE_LEVEL_HIGH>;
                         ti,hwmods = "mmu_ipu";
+                        #iommu-cells = <0>;
                         ti,iommu-bus-err-back;
                 };
 
diff --git a/arch/arm/boot/dts/omap5.dtsi b/arch/arm/boot/dts/omap5.dtsi
index 7d24ae0306b5..c8fd648a7108 100644
--- a/arch/arm/boot/dts/omap5.dtsi
+++ b/arch/arm/boot/dts/omap5.dtsi
@@ -612,6 +612,7 @@
                         reg = <0x4a066000 0x100>;
                         interrupts = <GIC_SPI 28 IRQ_TYPE_LEVEL_HIGH>;
                         ti,hwmods = "mmu_dsp";
+                        #iommu-cells = <0>;
                 };
 
                 mmu_ipu: mmu@55082000 {
@@ -619,6 +620,7 @@
                         reg = <0x55082000 0x100>;
                         interrupts = <GIC_SPI 100 IRQ_TYPE_LEVEL_HIGH>;
                         ti,hwmods = "mmu_ipu";
+                        #iommu-cells = <0>;
                         ti,iommu-bus-err-back;
                 };
 
diff --git a/arch/arm/boot/dts/socfpga_cyclone5_sockit.dts b/arch/arm/boot/dts/socfpga_cyclone5_sockit.dts
index 71468a7eb28f..5e17fd147728 100644
--- a/arch/arm/boot/dts/socfpga_cyclone5_sockit.dts
+++ b/arch/arm/boot/dts/socfpga_cyclone5_sockit.dts
@@ -60,27 +60,27 @@
         rxc-skew-ps = <2000>;
 };
 
-&mmc0 {
-        vmmc-supply = <&regulator_3_3v>;
-        vqmmc-supply = <&regulator_3_3v>;
-};
-
-&usb1 {
-        status = "okay";
-};
-
 &gpio2 {
         status = "okay";
 };
 
-&i2c1{
+&i2c1 {
         status = "okay";
 
-        accel1: accel1@53{
-                compatible = "adxl34x";
+        accel1: accelerometer@53 {
+                compatible = "adi,adxl345";
                 reg = <0x53>;
 
-                interrupt-parent = < &portc >;
+                interrupt-parent = <&portc>;
                 interrupts = <3 2>;
         };
 };
+
+&mmc0 {
+        vmmc-supply = <&regulator_3_3v>;
+        vqmmc-supply = <&regulator_3_3v>;
+};
+
+&usb1 {
+        status = "okay";
+};
diff --git a/arch/arm/boot/dts/spear1310-evb.dts b/arch/arm/boot/dts/spear1310-evb.dts
index d42c84b1df8d..e48857249ce7 100644
--- a/arch/arm/boot/dts/spear1310-evb.dts
+++ b/arch/arm/boot/dts/spear1310-evb.dts
@@ -1,7 +1,7 @@
 /*
  * DTS file for SPEAr1310 Evaluation Baord
  *
- * Copyright 2012 Viresh Kumar <viresh.linux@gmail.com>
+ * Copyright 2012 Viresh Kumar <vireshk@kernel.org>
  *
  * The code contained herein is licensed under the GNU General Public
  * License. You may obtain a copy of the GNU General Public License
diff --git a/arch/arm/boot/dts/spear1310.dtsi b/arch/arm/boot/dts/spear1310.dtsi
index 9d342920695a..54bc6d3cf290 100644
--- a/arch/arm/boot/dts/spear1310.dtsi
+++ b/arch/arm/boot/dts/spear1310.dtsi
@@ -1,7 +1,7 @@
 /*
  * DTS file for all SPEAr1310 SoCs
  *
- * Copyright 2012 Viresh Kumar <viresh.linux@gmail.com>
+ * Copyright 2012 Viresh Kumar <vireshk@kernel.org>
  *
  * The code contained herein is licensed under the GNU General Public
  * License. You may obtain a copy of the GNU General Public License
diff --git a/arch/arm/boot/dts/spear1340-evb.dts b/arch/arm/boot/dts/spear1340-evb.dts
index b23e05ed1d60..c611f5606dfe 100644
--- a/arch/arm/boot/dts/spear1340-evb.dts
+++ b/arch/arm/boot/dts/spear1340-evb.dts
@@ -1,7 +1,7 @@
 /*
  * DTS file for SPEAr1340 Evaluation Baord
  *
- * Copyright 2012 Viresh Kumar <viresh.linux@gmail.com>
+ * Copyright 2012 Viresh Kumar <vireshk@kernel.org>
  *
  * The code contained herein is licensed under the GNU General Public
  * License. You may obtain a copy of the GNU General Public License
diff --git a/arch/arm/boot/dts/spear1340.dtsi b/arch/arm/boot/dts/spear1340.dtsi
index 13e1aa33daa2..df2232d767ed 100644
--- a/arch/arm/boot/dts/spear1340.dtsi
+++ b/arch/arm/boot/dts/spear1340.dtsi
@@ -1,7 +1,7 @@
 /*
  * DTS file for all SPEAr1340 SoCs
  *
- * Copyright 2012 Viresh Kumar <viresh.linux@gmail.com>
+ * Copyright 2012 Viresh Kumar <vireshk@kernel.org>
  *
  * The code contained herein is licensed under the GNU General Public
  * License. You may obtain a copy of the GNU General Public License
diff --git a/arch/arm/boot/dts/spear13xx.dtsi b/arch/arm/boot/dts/spear13xx.dtsi
index 40accc87e3a2..14594ce8c18a 100644
--- a/arch/arm/boot/dts/spear13xx.dtsi
+++ b/arch/arm/boot/dts/spear13xx.dtsi
@@ -1,7 +1,7 @@
 /*
  * DTS file for all SPEAr13xx SoCs
  *
- * Copyright 2012 Viresh Kumar <viresh.linux@gmail.com>
+ * Copyright 2012 Viresh Kumar <vireshk@kernel.org>
  *
  * The code contained herein is licensed under the GNU General Public
  * License. You may obtain a copy of the GNU General Public License
diff --git a/arch/arm/boot/dts/spear300-evb.dts b/arch/arm/boot/dts/spear300-evb.dts
index 5de1431653e4..e859e8288bcd 100644
--- a/arch/arm/boot/dts/spear300-evb.dts
+++ b/arch/arm/boot/dts/spear300-evb.dts
@@ -1,7 +1,7 @@
 /*
  * DTS file for SPEAr300 Evaluation Baord
  *
- * Copyright 2012 Viresh Kumar <viresh.linux@gmail.com>
+ * Copyright 2012 Viresh Kumar <vireshk@kernel.org>
  *
  * The code contained herein is licensed under the GNU General Public
  * License. You may obtain a copy of the GNU General Public License
diff --git a/arch/arm/boot/dts/spear300.dtsi b/arch/arm/boot/dts/spear300.dtsi
index f79b3dfaabe6..f4e92e599729 100644
--- a/arch/arm/boot/dts/spear300.dtsi
+++ b/arch/arm/boot/dts/spear300.dtsi
@@ -1,7 +1,7 @@
 /*
  * DTS file for SPEAr300 SoC
  *
- * Copyright 2012 Viresh Kumar <viresh.linux@gmail.com>
+ * Copyright 2012 Viresh Kumar <vireshk@kernel.org>
  *
  * The code contained herein is licensed under the GNU General Public
  * License. You may obtain a copy of the GNU General Public License
diff --git a/arch/arm/boot/dts/spear310-evb.dts b/arch/arm/boot/dts/spear310-evb.dts
index b09632963d15..070f2c1b7851 100644
--- a/arch/arm/boot/dts/spear310-evb.dts
+++ b/arch/arm/boot/dts/spear310-evb.dts
@@ -1,7 +1,7 @@
 /*
  * DTS file for SPEAr310 Evaluation Baord
  *
- * Copyright 2012 Viresh Kumar <viresh.linux@gmail.com>
+ * Copyright 2012 Viresh Kumar <vireshk@kernel.org>
  *
  * The code contained herein is licensed under the GNU General Public
  * License. You may obtain a copy of the GNU General Public License
diff --git a/arch/arm/boot/dts/spear310.dtsi b/arch/arm/boot/dts/spear310.dtsi
index 95372080eea6..da210b454753 100644
--- a/arch/arm/boot/dts/spear310.dtsi
+++ b/arch/arm/boot/dts/spear310.dtsi
@@ -1,7 +1,7 @@
 /*
  * DTS file for SPEAr310 SoC
  *
- * Copyright 2012 Viresh Kumar <viresh.linux@gmail.com>
+ * Copyright 2012 Viresh Kumar <vireshk@kernel.org>
  *
  * The code contained herein is licensed under the GNU General Public
  * License. You may obtain a copy of the GNU General Public License
diff --git a/arch/arm/boot/dts/spear320-evb.dts b/arch/arm/boot/dts/spear320-evb.dts
index fdedbb514102..1b1034477923 100644
--- a/arch/arm/boot/dts/spear320-evb.dts
+++ b/arch/arm/boot/dts/spear320-evb.dts
@@ -1,7 +1,7 @@
 /*
  * DTS file for SPEAr320 Evaluation Baord
  *
- * Copyright 2012 Viresh Kumar <viresh.linux@gmail.com>
+ * Copyright 2012 Viresh Kumar <vireshk@kernel.org>
  *
  * The code contained herein is licensed under the GNU General Public
  * License. You may obtain a copy of the GNU General Public License
diff --git a/arch/arm/boot/dts/spear320.dtsi b/arch/arm/boot/dts/spear320.dtsi
index ffea342aeec9..22be6e5edaac 100644
--- a/arch/arm/boot/dts/spear320.dtsi
+++ b/arch/arm/boot/dts/spear320.dtsi
@@ -1,7 +1,7 @@
 /*
  * DTS file for SPEAr320 SoC
  *
- * Copyright 2012 Viresh Kumar <viresh.linux@gmail.com>
+ * Copyright 2012 Viresh Kumar <vireshk@kernel.org>
  *
  * The code contained herein is licensed under the GNU General Public
  * License. You may obtain a copy of the GNU General Public License
diff --git a/arch/arm/boot/dts/spear3xx.dtsi b/arch/arm/boot/dts/spear3xx.dtsi
index f0e3fcf8e323..118135d75899 100644
--- a/arch/arm/boot/dts/spear3xx.dtsi
+++ b/arch/arm/boot/dts/spear3xx.dtsi
@@ -1,7 +1,7 @@
 /*
  * DTS file for all SPEAr3xx SoCs
  *
- * Copyright 2012 Viresh Kumar <viresh.linux@gmail.com>
+ * Copyright 2012 Viresh Kumar <vireshk@kernel.org>
  *
  * The code contained herein is licensed under the GNU General Public
  * License. You may obtain a copy of the GNU General Public License
diff --git a/arch/arm/boot/dts/ste-ccu8540.dts b/arch/arm/boot/dts/ste-ccu8540.dts
index 32dd55e5f4e6..6eaaf638e52e 100644
--- a/arch/arm/boot/dts/ste-ccu8540.dts
+++ b/arch/arm/boot/dts/ste-ccu8540.dts
@@ -17,6 +17,13 @@
         model = "ST-Ericsson U8540 platform with Device Tree";
         compatible = "st-ericsson,ccu8540", "st-ericsson,u8540";
 
+        /* This stablilizes the serial port enumeration */
+        aliases {
+                serial0 = &ux500_serial0;
+                serial1 = &ux500_serial1;
+                serial2 = &ux500_serial2;
+        };
+
         memory@0 {
                 device_type = "memory";
                 reg = <0x20000000 0x1f000000>, <0xc0000000 0x3f000000>;
diff --git a/arch/arm/boot/dts/ste-ccu9540.dts b/arch/arm/boot/dts/ste-ccu9540.dts
index 651c56d400a4..c8b815819cfe 100644
--- a/arch/arm/boot/dts/ste-ccu9540.dts
+++ b/arch/arm/boot/dts/ste-ccu9540.dts
@@ -16,6 +16,13 @@
         model = "ST-Ericsson CCU9540 platform with Device Tree";
         compatible = "st-ericsson,ccu9540", "st-ericsson,u9540";
 
+        /* This stablilizes the serial port enumeration */
+        aliases {
+                serial0 = &ux500_serial0;
+                serial1 = &ux500_serial1;
+                serial2 = &ux500_serial2;
+        };
+
         memory {
                 reg = <0x00000000 0x20000000>;
         };
diff --git a/arch/arm/boot/dts/ste-dbx5x0.dtsi b/arch/arm/boot/dts/ste-dbx5x0.dtsi
index 853684ad7773..a75f3289e653 100644
--- a/arch/arm/boot/dts/ste-dbx5x0.dtsi
+++ b/arch/arm/boot/dts/ste-dbx5x0.dtsi
@@ -971,7 +971,7 @@
                         power-domains = <&pm_domains DOMAIN_VAPE>;
                 };
 
-                uart@80120000 {
+                ux500_serial0: uart@80120000 {
                         compatible = "arm,pl011", "arm,primecell";
                         reg = <0x80120000 0x1000>;
                         interrupts = <0 11 IRQ_TYPE_LEVEL_HIGH>;
@@ -986,7 +986,7 @@
                         status = "disabled";
                 };
 
-                uart@80121000 {
+                ux500_serial1: uart@80121000 {
                         compatible = "arm,pl011", "arm,primecell";
                         reg = <0x80121000 0x1000>;
                         interrupts = <0 19 IRQ_TYPE_LEVEL_HIGH>;
@@ -1001,7 +1001,7 @@
                         status = "disabled";
                 };
 
-                uart@80007000 {
+                ux500_serial2: uart@80007000 {
                         compatible = "arm,pl011", "arm,primecell";
                         reg = <0x80007000 0x1000>;
                         interrupts = <0 26 IRQ_TYPE_LEVEL_HIGH>;
diff --git a/arch/arm/boot/dts/ste-href.dtsi b/arch/arm/boot/dts/ste-href.dtsi
index 744c1e3a744d..6d8ce154347e 100644
--- a/arch/arm/boot/dts/ste-href.dtsi
+++ b/arch/arm/boot/dts/ste-href.dtsi
@@ -32,11 +32,11 @@
                         status = "okay";
                 };
 
+                /* This UART is unused and thus left disabled */
                 uart@80121000 {
                         pinctrl-names = "default", "sleep";
                         pinctrl-0 = <&uart1_default_mode>;
                         pinctrl-1 = <&uart1_sleep_mode>;
-                        status = "okay";
                 };
 
                 uart@80007000 {
diff --git a/arch/arm/boot/dts/ste-hrefprev60-stuib.dts b/arch/arm/boot/dts/ste-hrefprev60-stuib.dts
index 2b1cb5b584b6..18e9795a94f9 100644
--- a/arch/arm/boot/dts/ste-hrefprev60-stuib.dts
+++ b/arch/arm/boot/dts/ste-hrefprev60-stuib.dts
@@ -17,6 +17,13 @@
         model = "ST-Ericsson HREF (pre-v60) and ST UIB";
         compatible = "st-ericsson,mop500", "st-ericsson,u8500";
 
+        /* This stablilizes the serial port enumeration */
+        aliases {
+                serial0 = &ux500_serial0;
+                serial1 = &ux500_serial1;
+                serial2 = &ux500_serial2;
+        };
+
         soc {
                 /* Reset line for the BU21013 touchscreen */
                 i2c@80110000 {
diff --git a/arch/arm/boot/dts/ste-hrefprev60-tvk.dts b/arch/arm/boot/dts/ste-hrefprev60-tvk.dts
index 59523f866812..24739914e689 100644
--- a/arch/arm/boot/dts/ste-hrefprev60-tvk.dts
+++ b/arch/arm/boot/dts/ste-hrefprev60-tvk.dts
@@ -16,4 +16,11 @@
 / {
         model = "ST-Ericsson HREF (pre-v60) and TVK1281618 UIB";
         compatible = "st-ericsson,mop500", "st-ericsson,u8500";
+
+        /* This stablilizes the serial port enumeration */
+        aliases {
+                serial0 = &ux500_serial0;
+                serial1 = &ux500_serial1;
+                serial2 = &ux500_serial2;
+        };
 };
diff --git a/arch/arm/boot/dts/ste-hrefprev60.dtsi b/arch/arm/boot/dts/ste-hrefprev60.dtsi
index 7f3975b58d16..b0278f4c486c 100644
--- a/arch/arm/boot/dts/ste-hrefprev60.dtsi
+++ b/arch/arm/boot/dts/ste-hrefprev60.dtsi
@@ -23,6 +23,11 @@
         };
 
         soc {
+                /* Enable UART1 on this board */
+                uart@80121000 {
+                        status = "okay";
+                };
+
                 i2c@80004000 {
                         tps61052@33 {
                                 compatible = "tps61052";
diff --git a/arch/arm/boot/dts/ste-hrefv60plus-stuib.dts b/arch/arm/boot/dts/ste-hrefv60plus-stuib.dts
index 8c6a2de56cf1..c2e1ba019a2f 100644
--- a/arch/arm/boot/dts/ste-hrefv60plus-stuib.dts
+++ b/arch/arm/boot/dts/ste-hrefv60plus-stuib.dts
@@ -19,6 +19,13 @@
         model = "ST-Ericsson HREF (v60+) and ST UIB";
         compatible = "st-ericsson,hrefv60+", "st-ericsson,u8500";
 
+        /* This stablilizes the serial port enumeration */
+        aliases {
+                serial0 = &ux500_serial0;
+                serial1 = &ux500_serial1;
+                serial2 = &ux500_serial2;
+        };
+
         soc {
                 /* Reset line for the BU21013 touchscreen */
                 i2c@80110000 {
diff --git a/arch/arm/boot/dts/ste-hrefv60plus-tvk.dts b/arch/arm/boot/dts/ste-hrefv60plus-tvk.dts
index d53cccdce776..ebd8547e98f1 100644
--- a/arch/arm/boot/dts/ste-hrefv60plus-tvk.dts
+++ b/arch/arm/boot/dts/ste-hrefv60plus-tvk.dts
@@ -18,4 +18,11 @@
 / {
         model = "ST-Ericsson HREF (v60+) and TVK1281618 UIB";
         compatible = "st-ericsson,hrefv60+", "st-ericsson,u8500";
+
+        /* This stablilizes the serial port enumeration */
+        aliases {
+                serial0 = &ux500_serial0;
+                serial1 = &ux500_serial1;
+                serial2 = &ux500_serial2;
+        };
 };
diff --git a/arch/arm/boot/dts/ste-hrefv60plus.dtsi b/arch/arm/boot/dts/ste-hrefv60plus.dtsi
index a4bc9e77d640..810cda743b6d 100644
--- a/arch/arm/boot/dts/ste-hrefv60plus.dtsi
+++ b/arch/arm/boot/dts/ste-hrefv60plus.dtsi
@@ -43,15 +43,26 @@
                                   <&vaudio_hf_hrefv60_mode>,
                                   <&gbf_hrefv60_mode>,
                                   <&hdtv_hrefv60_mode>,
-                                  <&touch_hrefv60_mode>;
+                                  <&touch_hrefv60_mode>,
+                                  <&gpios_hrefv60_mode>;
 
                         sdi0 {
-                                /* SD card detect GPIO pin, extend default state */
                                 sdi0_default_mode: sdi0_default {
+                                        /* SD card detect GPIO pin, extend default state */
                                         default_hrefv60_cfg1 {
                                                 pins = "GPIO95_E8";
                                                 ste,config = <&gpio_in_pu>;
                                         };
+                                        /* VMMCI level-shifter enable */
+                                        default_hrefv60_cfg2 {
+                                                pins = "GPIO169_D22";
+                                                ste,config = <&gpio_out_lo>;
+                                        };
+                                        /* VMMCI level-shifter voltage select */
+                                        default_hrefv60_cfg3 {
+                                                pins = "GPIO5_AG6";
+                                                ste,config = <&gpio_out_hi>;
+                                        };
                                 };
                         };
                         ipgpio {
@@ -213,6 +224,16 @@
                                         };
                                 };
                         };
+                        gpios {
+                                /* Dangling GPIO pins */
+                                gpios_hrefv60_mode: gpios_hrefv60 {
+                                        default_cfg1 {
+                                                /* Normally UART1 RXD, now dangling */
+                                                pins = "GPIO4_AH6";
+                                                ste,config = <&in_pu>;
+                                        };
+                                };
+                        };
                 };
         };
 };
diff --git a/arch/arm/boot/dts/ste-snowball.dts b/arch/arm/boot/dts/ste-snowball.dts
index 9edadc37719f..32a5ccb14e7e 100644
--- a/arch/arm/boot/dts/ste-snowball.dts
+++ b/arch/arm/boot/dts/ste-snowball.dts
@@ -18,6 +18,13 @@
         model = "Calao Systems Snowball platform with device tree";
         compatible = "calaosystems,snowball-a9500", "st-ericsson,u9500";
 
+        /* This stablilizes the serial port enumeration */
+        aliases {
+                serial0 = &ux500_serial0;
+                serial1 = &ux500_serial1;
+                serial2 = &ux500_serial2;
+        };
+
         memory {
                 reg = <0x00000000 0x20000000>;
         };
@@ -223,11 +230,11 @@
                         status = "okay";
                 };
 
+                /* This UART is unused and thus left disabled */
                 uart@80121000 {
                         pinctrl-names = "default", "sleep";
                         pinctrl-0 = <&uart1_default_mode>;
                         pinctrl-1 = <&uart1_sleep_mode>;
-                        status = "okay";
                 };
 
                 uart@80007000 {
@@ -452,7 +459,21 @@
                                                 pins = "GPIO21_AB3"; /* DAT31DIR */
                                                 ste,config = <&out_hi>;
                                         };
-
+                                        /* SD card detect GPIO pin, extend default state */
+                                        snowball_cfg2 {
+                                                pins = "GPIO218_AH11";
+                                                ste,config = <&gpio_in_pu>;
+                                        };
+                                        /* VMMCI level-shifter enable */
+                                        snowball_cfg3 {
+                                                pins = "GPIO217_AH12";
+                                                ste,config = <&gpio_out_lo>;
+                                        };
+                                        /* VMMCI level-shifter voltage select */
+                                        snowball_cfg4 {
+                                                pins = "GPIO228_AJ6";
+                                                ste,config = <&gpio_out_hi>;
+                                        };
                                 };
                         };
                         ssp0 {
diff --git a/arch/arm/boot/dts/vexpress-v2p-ca15_a7.dts b/arch/arm/boot/dts/vexpress-v2p-ca15_a7.dts
index 107395c32d82..17f63f7dfd9e 100644
--- a/arch/arm/boot/dts/vexpress-v2p-ca15_a7.dts
+++ b/arch/arm/boot/dts/vexpress-v2p-ca15_a7.dts
@@ -150,6 +150,16 @@
                         interface-type = "ace";
                         reg = <0x5000 0x1000>;
                 };
+
+                pmu@9000 {
+                         compatible = "arm,cci-400-pmu,r0";
+                         reg = <0x9000 0x5000>;
+                         interrupts = <0 105 4>,
+                                      <0 101 4>,
+                                      <0 102 4>,
+                                      <0 103 4>,
+                                      <0 104 4>;
+                };
         };
 
         memory-controller@7ffd0000 {
@@ -187,11 +197,22 @@
                              <1 10 0xf08>;
         };
 
-        pmu {
+        pmu_a15 {
                 compatible = "arm,cortex-a15-pmu";
                 interrupts = <0 68 4>,
                              <0 69 4>;
-                interrupt-affinity = <&cpu0>, <&cpu1>;
+                interrupt-affinity = <&cpu0>,
+                                     <&cpu1>;
+        };
+
+        pmu_a7 {
+                compatible = "arm,cortex-a7-pmu";
+                interrupts = <0 128 4>,
+                             <0 129 4>,
+                             <0 130 4>;
+                interrupt-affinity = <&cpu2>,
+                                     <&cpu3>,
+                                     <&cpu4>;
         };
 
         oscclk6a: oscclk6a {
diff --git a/arch/arm/configs/multi_v7_defconfig b/arch/arm/configs/multi_v7_defconfig
index 6d83a1bf0c74..5fd8df6f50ea 100644
--- a/arch/arm/configs/multi_v7_defconfig
+++ b/arch/arm/configs/multi_v7_defconfig
@@ -353,7 +353,6 @@ CONFIG_POWER_RESET_AS3722=y
 CONFIG_POWER_RESET_GPIO=y
 CONFIG_POWER_RESET_GPIO_RESTART=y
 CONFIG_POWER_RESET_KEYSTONE=y
-CONFIG_POWER_RESET_SUN6I=y
 CONFIG_POWER_RESET_RMOBILE=y
 CONFIG_SENSORS_LM90=y
 CONFIG_SENSORS_LM95245=y
diff --git a/arch/arm/configs/sunxi_defconfig b/arch/arm/configs/sunxi_defconfig
index 8ecba00dcd83..7ebc346bf9fa 100644
--- a/arch/arm/configs/sunxi_defconfig
+++ b/arch/arm/configs/sunxi_defconfig
@@ -2,6 +2,7 @@ CONFIG_NO_HZ=y
 CONFIG_HIGH_RES_TIMERS=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_PERF_EVENTS=y
+CONFIG_MODULES=y
 CONFIG_ARCH_SUNXI=y
 CONFIG_SMP=y
 CONFIG_NR_CPUS=8
@@ -77,7 +78,6 @@ CONFIG_SPI_SUN6I=y
 CONFIG_GPIO_SYSFS=y
 CONFIG_POWER_SUPPLY=y
 CONFIG_POWER_RESET=y
-CONFIG_POWER_RESET_SUN6I=y
 CONFIG_THERMAL=y
 CONFIG_CPU_THERMAL=y
 CONFIG_WATCHDOG=y
@@ -87,6 +87,10 @@ CONFIG_REGULATOR=y
 CONFIG_REGULATOR_FIXED_VOLTAGE=y
 CONFIG_REGULATOR_AXP20X=y
 CONFIG_REGULATOR_GPIO=y
+CONFIG_FB=y
+CONFIG_FB_SIMPLE=y
+CONFIG_FRAMEBUFFER_CONSOLE=y
+CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY=y
 CONFIG_USB=y
 CONFIG_USB_EHCI_HCD=y
 CONFIG_USB_EHCI_HCD_PLATFORM=y
diff --git a/arch/arm/include/asm/Kbuild b/arch/arm/include/asm/Kbuild
index 83c50193626c..30b3bc1666d2 100644
--- a/arch/arm/include/asm/Kbuild
+++ b/arch/arm/include/asm/Kbuild
@@ -13,6 +13,7 @@ generic-y += kdebug.h
 generic-y += local.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += msgbuf.h
 generic-y += param.h
 generic-y += parport.h
diff --git a/arch/arm/include/asm/memory.h b/arch/arm/include/asm/memory.h
index 6f225acc07c5..b7f6fb462ea0 100644
--- a/arch/arm/include/asm/memory.h
+++ b/arch/arm/include/asm/memory.h
@@ -286,7 +286,7 @@ extern phys_addr_t (*arch_virt_to_idmap)(unsigned long x);
  */
 static inline phys_addr_t __virt_to_idmap(unsigned long x)
 {
-        if (arch_virt_to_idmap)
+        if (IS_ENABLED(CONFIG_MMU) && arch_virt_to_idmap)
                 return arch_virt_to_idmap(x);
         else
                 return __virt_to_phys(x);
diff --git a/arch/arm/include/asm/mm-arch-hooks.h b/arch/arm/include/asm/mm-arch-hooks.h
deleted file mode 100644
index 7056660c7cc4..000000000000
--- a/arch/arm/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#ifndef _ASM_ARM_MM_ARCH_HOOKS_H
-#define _ASM_ARM_MM_ARCH_HOOKS_H
-
-#endif /* _ASM_ARM_MM_ARCH_HOOKS_H */
diff --git a/arch/arm/kernel/perf_event.c b/arch/arm/kernel/perf_event.c
index 357f57ea83f4..54272e0be713 100644
--- a/arch/arm/kernel/perf_event.c
+++ b/arch/arm/kernel/perf_event.c
@@ -818,12 +818,13 @@ static int of_pmu_irq_cfg(struct arm_pmu *pmu)
                         if (arch_find_n_match_cpu_physical_id(dn, cpu, NULL))
                                 break;
 
-                of_node_put(dn);
                 if (cpu >= nr_cpu_ids) {
                         pr_warn("Failed to find logical CPU for %s\n",
                                 dn->name);
+                        of_node_put(dn);
                         break;
                 }
+                of_node_put(dn);
 
                 irqs[i] = cpu;
                 cpumask_set_cpu(cpu, &pmu->supported_cpus);
diff --git a/arch/arm/kernel/reboot.c b/arch/arm/kernel/reboot.c
index 1a4d232796be..38269358fd25 100644
--- a/arch/arm/kernel/reboot.c
+++ b/arch/arm/kernel/reboot.c
@@ -50,7 +50,7 @@ static void __soft_restart(void *addr)
         flush_cache_all();
 
         /* Switch to the identity mapping. */
-        phys_reset = (phys_reset_t)(unsigned long)virt_to_phys(cpu_reset);
+        phys_reset = (phys_reset_t)(unsigned long)virt_to_idmap(cpu_reset);
         phys_reset((unsigned long)addr);
 
         /* Should never get here. */
diff --git a/arch/arm/mach-imx/gpc.c b/arch/arm/mach-imx/gpc.c
index 80bad29d609a..8c4467fad837 100644
--- a/arch/arm/mach-imx/gpc.c
+++ b/arch/arm/mach-imx/gpc.c
@@ -291,8 +291,6 @@ void __init imx_gpc_check_dt(void)
         }
 }
 
-#ifdef CONFIG_PM_GENERIC_DOMAINS
-
 static void _imx6q_pm_pu_power_off(struct generic_pm_domain *genpd)
 {
         int iso, iso2sw;
@@ -399,7 +397,6 @@ static struct genpd_onecell_data imx_gpc_onecell_data = {
 static int imx_gpc_genpd_init(struct device *dev, struct regulator *pu_reg)
 {
         struct clk *clk;
-        bool is_off;
         int i;
 
         imx6q_pu_domain.reg = pu_reg;
@@ -416,18 +413,13 @@ static int imx_gpc_genpd_init(struct device *dev, struct regulator *pu_reg)
         }
         imx6q_pu_domain.num_clks = i;
 
-        is_off = IS_ENABLED(CONFIG_PM);
-        if (is_off) {
-                _imx6q_pm_pu_power_off(&imx6q_pu_domain.base);
-        } else {
-                /*
-                 * Enable power if compiled without CONFIG_PM in case the
-                 * bootloader disabled it.
-                 */
-                imx6q_pm_pu_power_on(&imx6q_pu_domain.base);
-        }
+        /* Enable power always in case bootloader disabled it. */
+        imx6q_pm_pu_power_on(&imx6q_pu_domain.base);
+
+        if (!IS_ENABLED(CONFIG_PM_GENERIC_DOMAINS))
+                return 0;
 
-        pm_genpd_init(&imx6q_pu_domain.base, NULL, is_off);
+        pm_genpd_init(&imx6q_pu_domain.base, NULL, false);
         return of_genpd_add_provider_onecell(dev->of_node,
                                              &imx_gpc_onecell_data);
 
@@ -437,13 +429,6 @@ clk_err:
         return -EINVAL;
 }
 
-#else
-static inline int imx_gpc_genpd_init(struct device *dev, struct regulator *reg)
-{
-        return 0;
-}
-#endif /* CONFIG_PM_GENERIC_DOMAINS */
-
 static int imx_gpc_probe(struct platform_device *pdev)
 {
         struct regulator *pu_reg;
diff --git a/arch/arm/mach-omap2/Kconfig b/arch/arm/mach-omap2/Kconfig
index ecc04ff13e95..4a023e8d1bdb 100644
--- a/arch/arm/mach-omap2/Kconfig
+++ b/arch/arm/mach-omap2/Kconfig
@@ -60,6 +60,7 @@ config SOC_AM43XX
         select ARM_GIC
         select MACH_OMAP_GENERIC
         select MIGHT_HAVE_CACHE_L2X0
+        select HAVE_ARM_SCU
 
 config SOC_DRA7XX
         bool "TI DRA7XX"
diff --git a/arch/arm/mach-omap2/dma.c b/arch/arm/mach-omap2/dma.c
index e1a56d87599e..1ed4be184a29 100644
--- a/arch/arm/mach-omap2/dma.c
+++ b/arch/arm/mach-omap2/dma.c
@@ -117,7 +117,6 @@ static void omap2_show_dma_caps(void)
         u8 revision = dma_read(REVISION, 0) & 0xff;
         printk(KERN_INFO "OMAP DMA hardware revision %d.%d\n",
                                 revision >> 4, revision & 0xf);
-        return;
 }
 
 static unsigned configure_dma_errata(void)
diff --git a/arch/arm/mach-prima2/Kconfig b/arch/arm/mach-prima2/Kconfig
index e03d8b5c9ad0..9ab8932403e5 100644
--- a/arch/arm/mach-prima2/Kconfig
+++ b/arch/arm/mach-prima2/Kconfig
@@ -4,6 +4,7 @@ menuconfig ARCH_SIRF
         select ARCH_REQUIRE_GPIOLIB
         select GENERIC_IRQ_CHIP
         select NO_IOPORT_MAP
+        select REGMAP
         select PINCTRL
         select PINCTRL_SIRF
         help
diff --git a/arch/arm/mach-prima2/rtciobrg.c b/arch/arm/mach-prima2/rtciobrg.c
index 8f66d8f7ca75..d4852d24dc7d 100644
--- a/arch/arm/mach-prima2/rtciobrg.c
+++ b/arch/arm/mach-prima2/rtciobrg.c
@@ -1,5 +1,5 @@
 /*
- * RTC I/O Bridge interfaces for CSR SiRFprimaII
+ * RTC I/O Bridge interfaces for CSR SiRFprimaII/atlas7
  * ARM access the registers of SYSRTC, GPSRTC and PWRC through this module
  *
  * Copyright (c) 2011 Cambridge Silicon Radio Limited, a CSR plc group company.
@@ -10,6 +10,7 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/io.h>
+#include <linux/regmap.h>
 #include <linux/of.h>
 #include <linux/of_address.h>
 #include <linux/of_device.h>
@@ -66,6 +67,7 @@ u32 sirfsoc_rtc_iobrg_readl(u32 addr)
 {
         unsigned long flags, val;
 
+        /* TODO: add hwspinlock to sync with M3 */
         spin_lock_irqsave(&rtciobrg_lock, flags);
 
         val = __sirfsoc_rtc_iobrg_readl(addr);
@@ -90,6 +92,7 @@ void sirfsoc_rtc_iobrg_writel(u32 val, u32 addr)
 {
         unsigned long flags;
 
+         /* TODO: add hwspinlock to sync with M3 */
         spin_lock_irqsave(&rtciobrg_lock, flags);
 
         sirfsoc_rtc_iobrg_pre_writel(val, addr);
@@ -102,6 +105,45 @@ void sirfsoc_rtc_iobrg_writel(u32 val, u32 addr)
 }
 EXPORT_SYMBOL_GPL(sirfsoc_rtc_iobrg_writel);
 
+
+static int regmap_iobg_regwrite(void *context, unsigned int reg,
+                                   unsigned int val)
+{
+        sirfsoc_rtc_iobrg_writel(val, reg);
+        return 0;
+}
+
+static int regmap_iobg_regread(void *context, unsigned int reg,
+                                  unsigned int *val)
+{
+        *val = (u32)sirfsoc_rtc_iobrg_readl(reg);
+        return 0;
+}
+
+static struct regmap_bus regmap_iobg = {
+        .reg_write = regmap_iobg_regwrite,
+        .reg_read = regmap_iobg_regread,
+};
+
+/**
+ * devm_regmap_init_iobg(): Initialise managed register map
+ *
+ * @iobg: Device that will be interacted with
+ * @config: Configuration for register map
+ *
+ * The return value will be an ERR_PTR() on error or a valid pointer
+ * to a struct regmap.  The regmap will be automatically freed by the
+ * device management code.
+ */
+struct regmap *devm_regmap_init_iobg(struct device *dev,
+                                    const struct regmap_config *config)
+{
+        const struct regmap_bus *bus = &regmap_iobg;
+
+        return devm_regmap_init(dev, bus, dev, config);
+}
+EXPORT_SYMBOL_GPL(devm_regmap_init_iobg);
+
 static const struct of_device_id rtciobrg_ids[] = {
         { .compatible = "sirf,prima2-rtciobg" },
         {}
@@ -132,7 +174,7 @@ static int __init sirfsoc_rtciobrg_init(void)
 }
 postcore_initcall(sirfsoc_rtciobrg_init);
 
-MODULE_AUTHOR("Zhiwu Song <zhiwu.song@csr.com>, "
-                "Barry Song <baohua.song@csr.com>");
+MODULE_AUTHOR("Zhiwu Song <zhiwu.song@csr.com>");
+MODULE_AUTHOR("Barry Song <baohua.song@csr.com>");
 MODULE_DESCRIPTION("CSR SiRFprimaII rtc io bridge");
 MODULE_LICENSE("GPL v2");
diff --git a/arch/arm/mach-pxa/capc7117.c b/arch/arm/mach-pxa/capc7117.c
index c092730749b9..bf366b39fa61 100644
--- a/arch/arm/mach-pxa/capc7117.c
+++ b/arch/arm/mach-pxa/capc7117.c
@@ -24,6 +24,7 @@
 #include <linux/ata_platform.h>
 #include <linux/serial_8250.h>
 #include <linux/gpio.h>
+#include <linux/regulator/machine.h>
 
 #include <asm/mach-types.h>
 #include <asm/mach/arch.h>
@@ -144,6 +145,8 @@ static void __init capc7117_init(void)
 
         capc7117_uarts_init();
         capc7117_ide_init();
+
+        regulator_has_full_constraints();
 }
 
 MACHINE_START(CAPC7117,
diff --git a/arch/arm/mach-pxa/cm-x2xx.c b/arch/arm/mach-pxa/cm-x2xx.c
index bb99f59a36d8..a17a91eb8e9a 100644
--- a/arch/arm/mach-pxa/cm-x2xx.c
+++ b/arch/arm/mach-pxa/cm-x2xx.c
@@ -13,6 +13,7 @@
 #include <linux/syscore_ops.h>
 #include <linux/irq.h>
 #include <linux/gpio.h>
+#include <linux/regulator/machine.h>
 
 #include <linux/dm9000.h>
 #include <linux/leds.h>
@@ -466,6 +467,8 @@ static void __init cmx2xx_init(void)
         cmx2xx_init_ac97();
         cmx2xx_init_touchscreen();
         cmx2xx_init_leds();
+
+        regulator_has_full_constraints();
 }
 
 static void __init cmx2xx_init_irq(void)
diff --git a/arch/arm/mach-pxa/cm-x300.c b/arch/arm/mach-pxa/cm-x300.c
index 4d3588d26c2a..5851f4c254c1 100644
--- a/arch/arm/mach-pxa/cm-x300.c
+++ b/arch/arm/mach-pxa/cm-x300.c
@@ -835,6 +835,8 @@ static void __init cm_x300_init(void)
         cm_x300_init_ac97();
         cm_x300_init_wi2wi();
         cm_x300_init_bl();
+
+        regulator_has_full_constraints();
 }
 
 static void __init cm_x300_fixup(struct tag *tags, char **cmdline)
diff --git a/arch/arm/mach-pxa/colibri-pxa270.c b/arch/arm/mach-pxa/colibri-pxa270.c
index 5f9d9303b346..3503826333c7 100644
--- a/arch/arm/mach-pxa/colibri-pxa270.c
+++ b/arch/arm/mach-pxa/colibri-pxa270.c
@@ -18,6 +18,7 @@
 #include <linux/mtd/partitions.h>
 #include <linux/mtd/physmap.h>
 #include <linux/platform_device.h>
+#include <linux/regulator/machine.h>
 #include <linux/ucb1400.h>
 
 #include <asm/mach/arch.h>
@@ -294,6 +295,8 @@ static void __init colibri_pxa270_init(void)
                 printk(KERN_ERR "Illegal colibri_pxa270_baseboard type %d\n",
                                 colibri_pxa270_baseboard);
         }
+
+        regulator_has_full_constraints();
 }
 
 /* The "Income s.r.o. SH-Dmaster PXA270 SBC" board can be booted either
diff --git a/arch/arm/mach-pxa/em-x270.c b/arch/arm/mach-pxa/em-x270.c
index 51531ecffca8..9d7072b04045 100644
--- a/arch/arm/mach-pxa/em-x270.c
+++ b/arch/arm/mach-pxa/em-x270.c
@@ -1306,6 +1306,8 @@ static void __init em_x270_init(void)
         em_x270_init_i2c();
         em_x270_init_camera();
         em_x270_userspace_consumers_init();
+
+        regulator_has_full_constraints();
 }
 
 MACHINE_START(EM_X270, "Compulab EM-X270")
diff --git a/arch/arm/mach-pxa/icontrol.c b/arch/arm/mach-pxa/icontrol.c
index c98511c5abd1..9b0eb0252af6 100644
--- a/arch/arm/mach-pxa/icontrol.c
+++ b/arch/arm/mach-pxa/icontrol.c
@@ -26,6 +26,7 @@
 #include <linux/spi/spi.h>
 #include <linux/spi/pxa2xx_spi.h>
 #include <linux/can/platform/mcp251x.h>
+#include <linux/regulator/machine.h>
 
 #include "generic.h"
 
@@ -185,6 +186,8 @@ static void __init icontrol_init(void)
         mxm_8x10_mmc_init();
 
         icontrol_can_init();
+
+        regulator_has_full_constraints();
 }
 
 MACHINE_START(ICONTROL, "iControl/SafeTcam boards using Embedian MXM-8x10 CoM")
diff --git a/arch/arm/mach-pxa/trizeps4.c b/arch/arm/mach-pxa/trizeps4.c
index 872dcb20e757..066e3a250ee0 100644
--- a/arch/arm/mach-pxa/trizeps4.c
+++ b/arch/arm/mach-pxa/trizeps4.c
@@ -26,6 +26,7 @@
 #include <linux/dm9000.h>
 #include <linux/mtd/physmap.h>
 #include <linux/mtd/partitions.h>
+#include <linux/regulator/machine.h>
 #include <linux/i2c/pxa-i2c.h>
 
 #include <asm/types.h>
@@ -534,6 +535,8 @@ static void __init trizeps4_init(void)
 
         BCR_writew(trizeps_conxs_bcr);
         board_backlight_power(1);
+
+        regulator_has_full_constraints();
 }
 
 static void __init trizeps4_map_io(void)
diff --git a/arch/arm/mach-pxa/vpac270.c b/arch/arm/mach-pxa/vpac270.c
index aa89488f961e..54122a983ae3 100644
--- a/arch/arm/mach-pxa/vpac270.c
+++ b/arch/arm/mach-pxa/vpac270.c
@@ -24,6 +24,7 @@
 #include <linux/dm9000.h>
 #include <linux/ucb1400.h>
 #include <linux/ata_platform.h>
+#include <linux/regulator/machine.h>
 #include <linux/regulator/max1586.h>
 #include <linux/i2c/pxa-i2c.h>
 
@@ -711,6 +712,8 @@ static void __init vpac270_init(void)
         vpac270_ts_init();
         vpac270_rtc_init();
         vpac270_ide_init();
+
+        regulator_has_full_constraints();
 }
 
 MACHINE_START(VPAC270, "Voipac PXA270")
diff --git a/arch/arm/mach-pxa/zeus.c b/arch/arm/mach-pxa/zeus.c
index ac2ae5c71ab4..6158566fa0f7 100644
--- a/arch/arm/mach-pxa/zeus.c
+++ b/arch/arm/mach-pxa/zeus.c
@@ -868,6 +868,8 @@ static void __init zeus_init(void)
         i2c_register_board_info(0, ARRAY_AND_SIZE(zeus_i2c_devices));
         pxa2xx_set_spi_info(3, &pxa2xx_spi_ssp3_master_info);
         spi_register_board_info(zeus_spi_board_info, ARRAY_SIZE(zeus_spi_board_info));
+
+        regulator_has_full_constraints();
 }
 
 static struct map_desc zeus_io_desc[] __initdata = {
diff --git a/arch/arm/mach-spear/generic.h b/arch/arm/mach-spear/generic.h
index a99d90a4d09c..06640914d9a0 100644
--- a/arch/arm/mach-spear/generic.h
+++ b/arch/arm/mach-spear/generic.h
@@ -3,7 +3,7 @@
  *
  * Copyright (C) 2009-2012 ST Microelectronics
  * Rajeev Kumar <rajeev-dlh.kumar@st.com>
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
  *
  * This file is licensed under the terms of the GNU General Public
  * License version 2. This program is licensed "as is" without any
diff --git a/arch/arm/mach-spear/include/mach/irqs.h b/arch/arm/mach-spear/include/mach/irqs.h
index 92da0a8c6bce..7058720c5278 100644
--- a/arch/arm/mach-spear/include/mach/irqs.h
+++ b/arch/arm/mach-spear/include/mach/irqs.h
@@ -3,7 +3,7 @@
  *
  * Copyright (C) 2009-2012 ST Microelectronics
  * Rajeev Kumar <rajeev-dlh.kumar@st.com>
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
  *
  * This file is licensed under the terms of the GNU General Public
  * License version 2. This program is licensed "as is" without any
diff --git a/arch/arm/mach-spear/include/mach/misc_regs.h b/arch/arm/mach-spear/include/mach/misc_regs.h
index 935639ce59ba..cfaf7c665b58 100644
--- a/arch/arm/mach-spear/include/mach/misc_regs.h
+++ b/arch/arm/mach-spear/include/mach/misc_regs.h
@@ -4,7 +4,7 @@
  * Miscellaneous registers definitions for SPEAr3xx machine family
  *
  * Copyright (C) 2009 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
  *
  * This file is licensed under the terms of the GNU General Public
  * License version 2. This program is licensed "as is" without any
diff --git a/arch/arm/mach-spear/include/mach/spear.h b/arch/arm/mach-spear/include/mach/spear.h
index f2d6a0176575..5ed841ccf8a3 100644
--- a/arch/arm/mach-spear/include/mach/spear.h
+++ b/arch/arm/mach-spear/include/mach/spear.h
@@ -3,7 +3,7 @@
  *
  * Copyright (C) 2009,2012 ST Microelectronics
  * Rajeev Kumar<rajeev-dlh.kumar@st.com>
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
  *
  * This file is licensed under the terms of the GNU General Public
  * License version 2. This program is licensed "as is" without any
diff --git a/arch/arm/mach-spear/include/mach/uncompress.h b/arch/arm/mach-spear/include/mach/uncompress.h
index 51b2dc93e4da..8439b9c12edb 100644
--- a/arch/arm/mach-spear/include/mach/uncompress.h
+++ b/arch/arm/mach-spear/include/mach/uncompress.h
@@ -4,7 +4,7 @@
  * Serial port stubs for kernel decompress status messages
  *
  * Copyright (C) 2009 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
  *
  * This file is licensed under the terms of the GNU General Public
  * License version 2. This program is licensed "as is" without any
diff --git a/arch/arm/mach-spear/pl080.c b/arch/arm/mach-spear/pl080.c
index cfa1199d0f4a..b4529f3e0ee9 100644
--- a/arch/arm/mach-spear/pl080.c
+++ b/arch/arm/mach-spear/pl080.c
@@ -4,7 +4,7 @@
  * DMAC pl080 definitions for SPEAr platform
  *
  * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
  *
  * This file is licensed under the terms of the GNU General Public
  * License version 2. This program is licensed "as is" without any
diff --git a/arch/arm/mach-spear/pl080.h b/arch/arm/mach-spear/pl080.h
index eb6590ded40d..608dec6725ae 100644
--- a/arch/arm/mach-spear/pl080.h
+++ b/arch/arm/mach-spear/pl080.h
@@ -4,7 +4,7 @@
  * DMAC pl080 definitions for SPEAr platform
  *
  * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
  *
  * This file is licensed under the terms of the GNU General Public
  * License version 2. This program is licensed "as is" without any
diff --git a/arch/arm/mach-spear/restart.c b/arch/arm/mach-spear/restart.c
index ce5e098c4888..b4342155a783 100644
--- a/arch/arm/mach-spear/restart.c
+++ b/arch/arm/mach-spear/restart.c
@@ -4,7 +4,7 @@
  * SPEAr platform specific restart functions
  *
  * Copyright (C) 2009 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
  *
  * This file is licensed under the terms of the GNU General Public
  * License version 2. This program is licensed "as is" without any
diff --git a/arch/arm/mach-spear/spear1310.c b/arch/arm/mach-spear/spear1310.c
index d9ce4d8000f0..cd5d375d91f0 100644
--- a/arch/arm/mach-spear/spear1310.c
+++ b/arch/arm/mach-spear/spear1310.c
@@ -4,7 +4,7 @@
  * SPEAr1310 machine source file
  *
  * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
  *
  * This file is licensed under the terms of the GNU General Public
  * License version 2. This program is licensed "as is" without any
diff --git a/arch/arm/mach-spear/spear1340.c b/arch/arm/mach-spear/spear1340.c
index 3f3c0f124bd3..94594d5a446c 100644
--- a/arch/arm/mach-spear/spear1340.c
+++ b/arch/arm/mach-spear/spear1340.c
@@ -4,7 +4,7 @@
  * SPEAr1340 machine source file
  *
  * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
  *
  * This file is licensed under the terms of the GNU General Public
  * License version 2. This program is licensed "as is" without any
diff --git a/arch/arm/mach-spear/spear13xx.c b/arch/arm/mach-spear/spear13xx.c
index 2e463a93468d..b7afce6795f4 100644
--- a/arch/arm/mach-spear/spear13xx.c
+++ b/arch/arm/mach-spear/spear13xx.c
@@ -4,7 +4,7 @@
  * SPEAr13XX machines common source file
  *
  * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
  *
  * This file is licensed under the terms of the GNU General Public
  * License version 2. This program is licensed "as is" without any
diff --git a/arch/arm/mach-spear/spear300.c b/arch/arm/mach-spear/spear300.c
index b52e48f342f4..5b32edda2276 100644
--- a/arch/arm/mach-spear/spear300.c
+++ b/arch/arm/mach-spear/spear300.c
@@ -4,7 +4,7 @@
  * SPEAr300 machine source file
  *
  * Copyright (C) 2009-2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
  *
  * This file is licensed under the terms of the GNU General Public
  * License version 2. This program is licensed "as is" without any
diff --git a/arch/arm/mach-spear/spear310.c b/arch/arm/mach-spear/spear310.c
index ed2029db391f..86a44ac7ff67 100644
--- a/arch/arm/mach-spear/spear310.c
+++ b/arch/arm/mach-spear/spear310.c
@@ -4,7 +4,7 @@
  * SPEAr310 machine source file
  *
  * Copyright (C) 2009-2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
  *
  * This file is licensed under the terms of the GNU General Public
  * License version 2. This program is licensed "as is" without any
diff --git a/arch/arm/mach-spear/spear320.c b/arch/arm/mach-spear/spear320.c
index bf634b32a930..d45d751926c5 100644
--- a/arch/arm/mach-spear/spear320.c
+++ b/arch/arm/mach-spear/spear320.c
@@ -4,7 +4,7 @@
  * SPEAr320 machine source file
  *
  * Copyright (C) 2009-2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
  *
  * This file is licensed under the terms of the GNU General Public
  * License version 2. This program is licensed "as is" without any
diff --git a/arch/arm/mach-spear/spear3xx.c b/arch/arm/mach-spear/spear3xx.c
index bf3b1fd8cb23..23394ac76cf2 100644
--- a/arch/arm/mach-spear/spear3xx.c
+++ b/arch/arm/mach-spear/spear3xx.c
@@ -4,7 +4,7 @@
  * SPEAr3XX machines common source file
  *
  * Copyright (C) 2009-2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
  *
  * This file is licensed under the terms of the GNU General Public
  * License version 2. This program is licensed "as is" without any
diff --git a/arch/arm/mach-sunxi/Kconfig b/arch/arm/mach-sunxi/Kconfig
index 81502b90dd91..4efe2d43a126 100644
--- a/arch/arm/mach-sunxi/Kconfig
+++ b/arch/arm/mach-sunxi/Kconfig
@@ -35,7 +35,7 @@ config MACH_SUN7I
         select SUN5I_HSTIMER
 
 config MACH_SUN8I
-        bool "Allwinner A23 (sun8i) SoCs support"
+        bool "Allwinner sun8i Family SoCs support"
         default ARCH_SUNXI
         select ARM_GIC
         select MFD_SUN6I_PRCM
diff --git a/arch/arm/mach-sunxi/sunxi.c b/arch/arm/mach-sunxi/sunxi.c
index 1bc811a74a9f..65bab2876343 100644
--- a/arch/arm/mach-sunxi/sunxi.c
+++ b/arch/arm/mach-sunxi/sunxi.c
@@ -67,10 +67,13 @@ MACHINE_END
 
 static const char * const sun8i_board_dt_compat[] = {
         "allwinner,sun8i-a23",
+        "allwinner,sun8i-a33",
+        "allwinner,sun8i-h3",
         NULL,
 };
 
-DT_MACHINE_START(SUN8I_DT, "Allwinner sun8i (A23) Family")
+DT_MACHINE_START(SUN8I_DT, "Allwinner sun8i Family")
+        .init_time      = sun6i_timer_init,
         .dt_compat      = sun8i_board_dt_compat,
         .init_late      = sunxi_dt_cpufreq_init,
 MACHINE_END
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index 1ced8a0f7a52..cba12f34ff77 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -1971,7 +1971,7 @@ static int extend_iommu_mapping(struct dma_iommu_mapping *mapping)
 {
         int next_bitmap;
 
-        if (mapping->nr_bitmaps > mapping->extensions)
+        if (mapping->nr_bitmaps >= mapping->extensions)
                 return -EINVAL;
 
         next_bitmap = mapping->nr_bitmaps;
diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
index 0716bbe19872..de2b246fed38 100644
--- a/arch/arm/mm/proc-v7.S
+++ b/arch/arm/mm/proc-v7.S
@@ -274,7 +274,10 @@ __v7_ca15mp_setup:
 __v7_b15mp_setup:
 __v7_ca17mp_setup:
         mov     r10, #0
-1:
+1:      adr     r12, __v7_setup_stack           @ the local stack
+        stmia   r12, {r0-r5, lr}                @ v7_invalidate_l1 touches r0-r6
+        bl      v7_invalidate_l1
+        ldmia   r12, {r0-r5, lr}
 #ifdef CONFIG_SMP
         ALT_SMP(mrc     p15, 0, r0, c1, c0, 1)
         ALT_UP(mov      r0, #(1 << 6))          @ fake it for UP
@@ -283,7 +286,7 @@ __v7_ca17mp_setup:
         orreq   r0, r0, r10                     @ Enable CPU-specific SMP bits
         mcreq   p15, 0, r0, c1, c0, 1
 #endif
-        b       __v7_setup
+        b       __v7_setup_cont
 
 /*
  * Errata:
@@ -413,10 +416,11 @@ __v7_pj4b_setup:
 
 __v7_setup:
         adr     r12, __v7_setup_stack           @ the local stack
-        stmia   r12, {r0-r5, r7, r9, r11, lr}
+        stmia   r12, {r0-r5, lr}                @ v7_invalidate_l1 touches r0-r6
         bl      v7_invalidate_l1
-        ldmia   r12, {r0-r5, r7, r9, r11, lr}
+        ldmia   r12, {r0-r5, lr}
 
+__v7_setup_cont:
         and     r0, r9, #0xff000000             @ ARM?
         teq     r0, #0x41000000
         bne     __errata_finish
@@ -480,7 +484,7 @@ ENDPROC(__v7_setup)
 
         .align  2
 __v7_setup_stack:
-        .space  4 * 11                          @ 11 registers
+        .space  4 * 7                           @ 12 registers
 
         __INITDATA
 
diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c
index 4550d247e308..c011e2296cb1 100644
--- a/arch/arm/net/bpf_jit_32.c
+++ b/arch/arm/net/bpf_jit_32.c
@@ -74,32 +74,52 @@ struct jit_ctx {
 
 int bpf_jit_enable __read_mostly;
 
-static u64 jit_get_skb_b(struct sk_buff *skb, unsigned offset)
+static inline int call_neg_helper(struct sk_buff *skb, int offset, void *ret,
+                      unsigned int size)
+{
+        void *ptr = bpf_internal_load_pointer_neg_helper(skb, offset, size);
+
+        if (!ptr)
+                return -EFAULT;
+        memcpy(ret, ptr, size);
+        return 0;
+}
+
+static u64 jit_get_skb_b(struct sk_buff *skb, int offset)
 {
         u8 ret;
         int err;
 
-        err = skb_copy_bits(skb, offset, &ret, 1);
+        if (offset < 0)
+                err = call_neg_helper(skb, offset, &ret, 1);
+        else
+                err = skb_copy_bits(skb, offset, &ret, 1);
 
         return (u64)err << 32 | ret;
 }
 
-static u64 jit_get_skb_h(struct sk_buff *skb, unsigned offset)
+static u64 jit_get_skb_h(struct sk_buff *skb, int offset)
 {
         u16 ret;
         int err;
 
-        err = skb_copy_bits(skb, offset, &ret, 2);
+        if (offset < 0)
+                err = call_neg_helper(skb, offset, &ret, 2);
+        else
+                err = skb_copy_bits(skb, offset, &ret, 2);
 
         return (u64)err << 32 | ntohs(ret);
 }
 
-static u64 jit_get_skb_w(struct sk_buff *skb, unsigned offset)
+static u64 jit_get_skb_w(struct sk_buff *skb, int offset)
 {
         u32 ret;
         int err;
 
-        err = skb_copy_bits(skb, offset, &ret, 4);
+        if (offset < 0)
+                err = call_neg_helper(skb, offset, &ret, 4);
+        else
+                err = skb_copy_bits(skb, offset, &ret, 4);
 
         return (u64)err << 32 | ntohl(ret);
 }
@@ -536,9 +556,6 @@ static int build_body(struct jit_ctx *ctx)
                 case BPF_LD | BPF_B | BPF_ABS:
                         load_order = 0;
 load:
-                        /* the interpreter will deal with the negative K */
-                        if ((int)k < 0)
-                                return -ENOTSUPP;
                         emit_mov_i(r_off, k, ctx);
 load_common:
                         ctx->seen |= SEEN_DATA | SEEN_CALL;
@@ -547,12 +564,24 @@ load_common:
                                 emit(ARM_SUB_I(r_scratch, r_skb_hl,
                                                1 << load_order), ctx);
                                 emit(ARM_CMP_R(r_scratch, r_off), ctx);
-                                condt = ARM_COND_HS;
+                                condt = ARM_COND_GE;
                         } else {
                                 emit(ARM_CMP_R(r_skb_hl, r_off), ctx);
                                 condt = ARM_COND_HI;
                         }
 
+                        /*
+                         * test for negative offset, only if we are
+                         * currently scheduled to take the fast
+                         * path. this will update the flags so that
+                         * the slowpath instruction are ignored if the
+                         * offset is negative.
+                         *
+                         * for loard_order == 0 the HI condition will
+                         * make loads at offset 0 take the slow path too.
+                         */
+                        _emit(condt, ARM_CMP_I(r_off, 0), ctx);
+
                         _emit(condt, ARM_ADD_R(r_scratch, r_off, r_skb_data),
                               ctx);
 
@@ -860,9 +889,11 @@ b_epilogue:
                         off = offsetof(struct sk_buff, vlan_tci);
                         emit(ARM_LDRH_I(r_A, r_skb, off), ctx);
                         if (code == (BPF_ANC | SKF_AD_VLAN_TAG))
-                                OP_IMM3(ARM_AND, r_A, r_A, VLAN_VID_MASK, ctx);
-                        else
-                                OP_IMM3(ARM_AND, r_A, r_A, VLAN_TAG_PRESENT, ctx);
+                                OP_IMM3(ARM_AND, r_A, r_A, ~VLAN_TAG_PRESENT, ctx);
+                        else {
+                                OP_IMM3(ARM_LSR, r_A, r_A, 12, ctx);
+                                OP_IMM3(ARM_AND, r_A, r_A, 0x1, ctx);
+                        }
                         break;
                 case BPF_ANC | SKF_AD_QUEUE:
                         ctx->seen |= SEEN_SKB;
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index 0f6edb14b7e4..318175f62c24 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -23,9 +23,9 @@ config ARM64
         select BUILDTIME_EXTABLE_SORT
         select CLONE_BACKWARDS
         select COMMON_CLK
-        select EDAC_SUPPORT
         select CPU_PM if (SUSPEND || CPU_IDLE)
         select DCACHE_WORD_ACCESS
+        select EDAC_SUPPORT
         select GENERIC_ALLOCATOR
         select GENERIC_CLOCKEVENTS
         select GENERIC_CLOCKEVENTS_BROADCAST if SMP
diff --git a/arch/arm64/boot/dts/apm/apm-mustang.dts b/arch/arm64/boot/dts/apm/apm-mustang.dts
index 83578e766b94..4c55833d8a41 100644
--- a/arch/arm64/boot/dts/apm/apm-mustang.dts
+++ b/arch/arm64/boot/dts/apm/apm-mustang.dts
@@ -23,6 +23,16 @@
                 device_type = "memory";
                 reg = < 0x1 0x00000000 0x0 0x80000000 >; /* Updated by bootloader */
         };
+
+        gpio-keys {
+                compatible = "gpio-keys";
+                button@1 {
+                        label = "POWER";
+                        linux,code = <116>;
+                        linux,input-type = <0x1>;
+                        interrupts = <0x0 0x2d 0x1>;
+                };
+        };
 };
 
 &pcie0clk {
diff --git a/arch/arm64/boot/dts/arm/Makefile b/arch/arm64/boot/dts/arm/Makefile
index c5c98b91514e..bb3c07209676 100644
--- a/arch/arm64/boot/dts/arm/Makefile
+++ b/arch/arm64/boot/dts/arm/Makefile
@@ -1,6 +1,7 @@
 dtb-$(CONFIG_ARCH_VEXPRESS) += foundation-v8.dtb
 dtb-$(CONFIG_ARCH_VEXPRESS) += juno.dtb juno-r1.dtb
 dtb-$(CONFIG_ARCH_VEXPRESS) += rtsm_ve-aemv8a.dtb
+dtb-$(CONFIG_ARCH_VEXPRESS) += vexpress-v2f-1xv7-ca53x2.dtb
 
 always          := $(dtb-y)
 subdir-y        := $(dts-dirs)
diff --git a/arch/arm64/boot/dts/arm/vexpress-v2f-1xv7-ca53x2.dts b/arch/arm64/boot/dts/arm/vexpress-v2f-1xv7-ca53x2.dts
new file mode 100644
index 000000000000..5b1d0181023b
--- /dev/null
+++ b/arch/arm64/boot/dts/arm/vexpress-v2f-1xv7-ca53x2.dts
@@ -0,0 +1,191 @@
+/*
+ * ARM Ltd. Versatile Express
+ *
+ * LogicTile Express 20MG
+ * V2F-1XV7
+ *
+ * Cortex-A53 (2 cores) Soft Macrocell Model
+ *
+ * HBI-0247C
+ */
+
+/dts-v1/;
+
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+
+/ {
+        model = "V2F-1XV7 Cortex-A53x2 SMM";
+        arm,hbi = <0x247>;
+        arm,vexpress,site = <0xf>;
+        compatible = "arm,vexpress,v2f-1xv7,ca53x2", "arm,vexpress,v2f-1xv7", "arm,vexpress";
+        interrupt-parent = <&gic>;
+        #address-cells = <2>;
+        #size-cells = <2>;
+
+        chosen {
+                stdout-path = "serial0:38400n8";
+        };
+
+        aliases {
+                serial0 = &v2m_serial0;
+                serial1 = &v2m_serial1;
+                serial2 = &v2m_serial2;
+                serial3 = &v2m_serial3;
+                i2c0 = &v2m_i2c_dvi;
+                i2c1 = &v2m_i2c_pcie;
+        };
+
+        cpus {
+                #address-cells = <2>;
+                #size-cells = <0>;
+
+                cpu@0 {
+                        device_type = "cpu";
+                        compatible = "arm,cortex-a53", "arm,armv8";
+                        reg = <0 0>;
+                        next-level-cache = <&L2_0>;
+                };
+
+                cpu@1 {
+                        device_type = "cpu";
+                        compatible = "arm,cortex-a53", "arm,armv8";
+                        reg = <0 1>;
+                        next-level-cache = <&L2_0>;
+                };
+
+                L2_0: l2-cache0 {
+                        compatible = "cache";
+                };
+        };
+
+        memory@80000000 {
+                device_type = "memory";
+                reg = <0 0x80000000 0 0x80000000>; /* 2GB @ 2GB */
+        };
+
+        gic: interrupt-controller@2c001000 {
+                compatible = "arm,gic-400";
+                #interrupt-cells = <3>;
+                #address-cells = <0>;
+                interrupt-controller;
+                reg = <0 0x2c001000 0 0x1000>,
+                      <0 0x2c002000 0 0x2000>,
+                      <0 0x2c004000 0 0x2000>,
+                      <0 0x2c006000 0 0x2000>;
+                interrupts = <GIC_PPI 9 (GIC_CPU_MASK_SIMPLE(2) | IRQ_TYPE_LEVEL_HIGH)>;
+        };
+
+        timer {
+                compatible = "arm,armv8-timer";
+                interrupts = <GIC_PPI 13 (GIC_CPU_MASK_SIMPLE(2) | IRQ_TYPE_LEVEL_LOW)>,
+                             <GIC_PPI 14 (GIC_CPU_MASK_SIMPLE(2) | IRQ_TYPE_LEVEL_LOW)>,
+                             <GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(2) | IRQ_TYPE_LEVEL_LOW)>,
+                             <GIC_PPI 10 (GIC_CPU_MASK_SIMPLE(2) | IRQ_TYPE_LEVEL_LOW)>;
+        };
+
+        pmu {
+                compatible = "arm,armv8-pmuv3";
+                interrupts = <GIC_SPI 68 IRQ_TYPE_LEVEL_HIGH>,
+                             <GIC_SPI 69 IRQ_TYPE_LEVEL_HIGH>;
+        };
+
+        dcc {
+                compatible = "arm,vexpress,config-bus";
+                arm,vexpress,config-bridge = <&v2m_sysreg>;
+
+                smbclk: osc@4 {
+                        /* SMC clock */
+                        compatible = "arm,vexpress-osc";
+                        arm,vexpress-sysreg,func = <1 4>;
+                        freq-range = <40000000 40000000>;
+                        #clock-cells = <0>;
+                        clock-output-names = "smclk";
+                };
+
+                volt@0 {
+                        /* VIO to expansion board above */
+                        compatible = "arm,vexpress-volt";
+                        arm,vexpress-sysreg,func = <2 0>;
+                        regulator-name = "VIO_UP";
+                        regulator-min-microvolt = <800000>;
+                        regulator-max-microvolt = <1800000>;
+                        regulator-always-on;
+                };
+
+                volt@1 {
+                        /* 12V from power connector J6 */
+                        compatible = "arm,vexpress-volt";
+                        arm,vexpress-sysreg,func = <2 1>;
+                        regulator-name = "12";
+                        regulator-always-on;
+                };
+
+                temp@0 {
+                        /* FPGA temperature */
+                        compatible = "arm,vexpress-temp";
+                        arm,vexpress-sysreg,func = <4 0>;
+                        label = "FPGA";
+                };
+        };
+
+        smb {
+                compatible = "simple-bus";
+
+                #address-cells = <2>;
+                #size-cells = <1>;
+                ranges = <0 0 0 0x08000000 0x04000000>,
+                         <1 0 0 0x14000000 0x04000000>,
+                         <2 0 0 0x18000000 0x04000000>,
+                         <3 0 0 0x1c000000 0x04000000>,
+                         <4 0 0 0x0c000000 0x04000000>,
+                         <5 0 0 0x10000000 0x04000000>;
+
+                #interrupt-cells = <1>;
+                interrupt-map-mask = <0 0 63>;
+                interrupt-map = <0 0  0 &gic GIC_SPI  0 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0  1 &gic GIC_SPI  1 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0  2 &gic GIC_SPI  2 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0  3 &gic GIC_SPI  3 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0  4 &gic GIC_SPI  4 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0  5 &gic GIC_SPI  5 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0  6 &gic GIC_SPI  6 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0  7 &gic GIC_SPI  7 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0  8 &gic GIC_SPI  8 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0  9 &gic GIC_SPI  9 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0 10 &gic GIC_SPI 10 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0 11 &gic GIC_SPI 11 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0 12 &gic GIC_SPI 12 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0 13 &gic GIC_SPI 13 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0 14 &gic GIC_SPI 14 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0 15 &gic GIC_SPI 15 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0 16 &gic GIC_SPI 16 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0 17 &gic GIC_SPI 17 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0 18 &gic GIC_SPI 18 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0 19 &gic GIC_SPI 19 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0 20 &gic GIC_SPI 20 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0 21 &gic GIC_SPI 21 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0 22 &gic GIC_SPI 22 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0 23 &gic GIC_SPI 23 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0 24 &gic GIC_SPI 24 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0 25 &gic GIC_SPI 25 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0 26 &gic GIC_SPI 26 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0 27 &gic GIC_SPI 27 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0 28 &gic GIC_SPI 28 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0 29 &gic GIC_SPI 29 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0 30 &gic GIC_SPI 30 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0 31 &gic GIC_SPI 31 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0 32 &gic GIC_SPI 32 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0 33 &gic GIC_SPI 33 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0 34 &gic GIC_SPI 34 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0 35 &gic GIC_SPI 35 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0 36 &gic GIC_SPI 36 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0 37 &gic GIC_SPI 37 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0 38 &gic GIC_SPI 38 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0 39 &gic GIC_SPI 39 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0 40 &gic GIC_SPI 40 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0 41 &gic GIC_SPI 41 IRQ_TYPE_LEVEL_HIGH>,
+                                <0 0 42 &gic GIC_SPI 42 IRQ_TYPE_LEVEL_HIGH>;
+
+                /include/ "../../../../arm/boot/dts/vexpress-v2m-rs1.dtsi"
+        };
+};
diff --git a/arch/arm64/boot/dts/cavium/thunder-88xx.dtsi b/arch/arm64/boot/dts/cavium/thunder-88xx.dtsi
index d8c0bdc51882..9cb7cf94284a 100644
--- a/arch/arm64/boot/dts/cavium/thunder-88xx.dtsi
+++ b/arch/arm64/boot/dts/cavium/thunder-88xx.dtsi
@@ -376,10 +376,19 @@
                 gic0: interrupt-controller@8010,00000000 {
                         compatible = "arm,gic-v3";
                         #interrupt-cells = <3>;
+                        #address-cells = <2>;
+                        #size-cells = <2>;
+                        ranges;
                         interrupt-controller;
                         reg = <0x8010 0x00000000 0x0 0x010000>, /* GICD */
                               <0x8010 0x80000000 0x0 0x600000>; /* GICR */
                         interrupts = <1 9 0xf04>;
+
+                        its: gic-its@8010,00020000 {
+                                compatible = "arm,gic-v3-its";
+                                msi-controller;
+                                reg = <0x8010 0x20000 0x0 0x200000>;
+                        };
                 };
 
                 uaa0: serial@87e0,24000000 {
diff --git a/arch/arm64/configs/defconfig b/arch/arm64/configs/defconfig
index f38c94f1d898..4e17e7ede33d 100644
--- a/arch/arm64/configs/defconfig
+++ b/arch/arm64/configs/defconfig
@@ -83,6 +83,7 @@ CONFIG_BLK_DEV_SD=y
 CONFIG_ATA=y
 CONFIG_SATA_AHCI=y
 CONFIG_SATA_AHCI_PLATFORM=y
+CONFIG_AHCI_CEVA=y
 CONFIG_AHCI_XGENE=y
 CONFIG_PATA_PLATFORM=y
 CONFIG_PATA_OF_PLATFORM=y
diff --git a/arch/arm64/include/asm/Kbuild b/arch/arm64/include/asm/Kbuild
index b112a39834d0..70fd9ffb58cf 100644
--- a/arch/arm64/include/asm/Kbuild
+++ b/arch/arm64/include/asm/Kbuild
@@ -25,6 +25,7 @@ generic-y += kvm_para.h
 generic-y += local.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += mman.h
 generic-y += msgbuf.h
 generic-y += msi.h
diff --git a/arch/arm64/include/asm/acpi.h b/arch/arm64/include/asm/acpi.h
index 39248d3adf5d..406485ed110a 100644
--- a/arch/arm64/include/asm/acpi.h
+++ b/arch/arm64/include/asm/acpi.h
@@ -19,6 +19,14 @@
 #include <asm/psci.h>
 #include <asm/smp_plat.h>
 
+/* Macros for consistency checks of the GICC subtable of MADT */
+#define ACPI_MADT_GICC_LENGTH   \
+        (acpi_gbl_FADT.header.revision < 6 ? 76 : 80)
+
+#define BAD_MADT_GICC_ENTRY(entry, end)                                         \
+        (!(entry) || (unsigned long)(entry) + sizeof(*(entry)) > (end) ||       \
+         (entry)->header.length != ACPI_MADT_GICC_LENGTH)
+
 /* Basic configuration for ACPI */
 #ifdef  CONFIG_ACPI
 /* ACPI table mapping after acpi_gbl_permanent_mmap is set */
diff --git a/arch/arm64/include/asm/mm-arch-hooks.h b/arch/arm64/include/asm/mm-arch-hooks.h
deleted file mode 100644
index 562b655f5ba9..000000000000
--- a/arch/arm64/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#ifndef _ASM_ARM64_MM_ARCH_HOOKS_H
-#define _ASM_ARM64_MM_ARCH_HOOKS_H
-
-#endif /* _ASM_ARM64_MM_ARCH_HOOKS_H */
diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
index a7691a378668..e16351819fed 100644
--- a/arch/arm64/kernel/entry.S
+++ b/arch/arm64/kernel/entry.S
@@ -352,8 +352,8 @@ el1_inv:
         // TODO: add support for undefined instructions in kernel mode
         enable_dbg
         mov     x0, sp
+        mov     x2, x1
         mov     x1, #BAD_SYNC
-        mrs     x2, esr_el1
         b       bad_mode
 ENDPROC(el1_sync)
 
@@ -553,7 +553,7 @@ el0_inv:
         ct_user_exit
         mov     x0, sp
         mov     x1, #BAD_SYNC
-        mrs     x2, esr_el1
+        mov     x2, x25
         bl      bad_mode
         b       ret_to_user
 ENDPROC(el0_sync)
@@ -585,7 +585,8 @@ ENDPROC(el0_irq)
  *
  */
 ENTRY(cpu_switch_to)
-        add     x8, x0, #THREAD_CPU_CONTEXT
+        mov     x10, #THREAD_CPU_CONTEXT
+        add     x8, x0, x10
         mov     x9, sp
         stp     x19, x20, [x8], #16             // store callee-saved registers
         stp     x21, x22, [x8], #16
@@ -594,7 +595,7 @@ ENTRY(cpu_switch_to)
         stp     x27, x28, [x8], #16
         stp     x29, x9, [x8], #16
         str     lr, [x8]
-        add     x8, x1, #THREAD_CPU_CONTEXT
+        add     x8, x1, x10
         ldp     x19, x20, [x8], #16             // restore callee-saved registers
         ldp     x21, x22, [x8], #16
         ldp     x23, x24, [x8], #16
diff --git a/arch/arm64/kernel/entry32.S b/arch/arm64/kernel/entry32.S
index bd9bfaa9269b..f332d5d1f6b4 100644
--- a/arch/arm64/kernel/entry32.S
+++ b/arch/arm64/kernel/entry32.S
@@ -32,13 +32,11 @@
 
 ENTRY(compat_sys_sigreturn_wrapper)
         mov     x0, sp
-        mov     x27, #0         // prevent syscall restart handling (why)
         b       compat_sys_sigreturn
 ENDPROC(compat_sys_sigreturn_wrapper)
 
 ENTRY(compat_sys_rt_sigreturn_wrapper)
         mov     x0, sp
-        mov     x27, #0         // prevent syscall restart handling (why)
         b       compat_sys_rt_sigreturn
 ENDPROC(compat_sys_rt_sigreturn_wrapper)
 
diff --git a/arch/arm64/kernel/irq.c b/arch/arm64/kernel/irq.c
index 240b75c0e94f..463fa2e7e34c 100644
--- a/arch/arm64/kernel/irq.c
+++ b/arch/arm64/kernel/irq.c
@@ -61,7 +61,7 @@ void __init init_IRQ(void)
 static bool migrate_one_irq(struct irq_desc *desc)
 {
         struct irq_data *d = irq_desc_get_irq_data(desc);
-        const struct cpumask *affinity = d->affinity;
+        const struct cpumask *affinity = irq_data_get_affinity_mask(d);
         struct irq_chip *c;
         bool ret = false;
 
@@ -81,7 +81,7 @@ static bool migrate_one_irq(struct irq_desc *desc)
         if (!c->irq_set_affinity)
                 pr_debug("IRQ%u: unable to set affinity\n", d->irq);
         else if (c->irq_set_affinity(d, affinity, false) == IRQ_SET_MASK_OK && ret)
-                cpumask_copy(d->affinity, affinity);
+                cpumask_copy(irq_data_get_affinity_mask(d), affinity);
 
         return ret;
 }
diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c
index 695801a54ca5..50fb4696654e 100644
--- a/arch/arm64/kernel/smp.c
+++ b/arch/arm64/kernel/smp.c
@@ -438,7 +438,7 @@ acpi_parse_gic_cpu_interface(struct acpi_subtable_header *header,
         struct acpi_madt_generic_interrupt *processor;
 
         processor = (struct acpi_madt_generic_interrupt *)header;
-        if (BAD_MADT_ENTRY(processor, end))
+        if (BAD_MADT_GICC_ENTRY(processor, end))
                 return -EINVAL;
 
         acpi_table_print_madt_entry(header);
diff --git a/arch/arm64/mm/Makefile b/arch/arm64/mm/Makefile
index 9d84feb41a16..773d37a14039 100644
--- a/arch/arm64/mm/Makefile
+++ b/arch/arm64/mm/Makefile
@@ -4,5 +4,3 @@ obj-y				:= dma-mapping.o extable.o fault.o init.o \
                                    context.o proc.o pageattr.o
 obj-$(CONFIG_HUGETLB_PAGE)      += hugetlbpage.o
 obj-$(CONFIG_ARM64_PTDUMP)      += dump.o
-
-CFLAGS_mmu.o                    := -I$(srctree)/scripts/dtc/libfdt/
diff --git a/arch/avr32/include/asm/Kbuild b/arch/avr32/include/asm/Kbuild
index 1d66afdfac07..f61f2dd67464 100644
--- a/arch/avr32/include/asm/Kbuild
+++ b/arch/avr32/include/asm/Kbuild
@@ -12,6 +12,7 @@ generic-y += irq_work.h
 generic-y += local.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += param.h
 generic-y += percpu.h
 generic-y += preempt.h
diff --git a/arch/avr32/include/asm/mm-arch-hooks.h b/arch/avr32/include/asm/mm-arch-hooks.h
deleted file mode 100644
index 145452ffbdad..000000000000
--- a/arch/avr32/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#ifndef _ASM_AVR32_MM_ARCH_HOOKS_H
-#define _ASM_AVR32_MM_ARCH_HOOKS_H
-
-#endif /* _ASM_AVR32_MM_ARCH_HOOKS_H */
diff --git a/arch/avr32/kernel/time.c b/arch/avr32/kernel/time.c
index d0f771be9e96..a124c55733db 100644
--- a/arch/avr32/kernel/time.c
+++ b/arch/avr32/kernel/time.c
@@ -18,6 +18,7 @@
 
 #include <mach/pm.h>
 
+static bool disable_cpu_idle_poll;
 
 static cycle_t read_cycle_count(struct clocksource *cs)
 {
@@ -80,45 +81,45 @@ static int comparator_next_event(unsigned long delta,
         return 0;
 }
 
-static void comparator_mode(enum clock_event_mode mode,
-                struct clock_event_device *evdev)
+static int comparator_shutdown(struct clock_event_device *evdev)
 {
-        switch (mode) {
-        case CLOCK_EVT_MODE_ONESHOT:
-                pr_debug("%s: start\n", evdev->name);
-                /* FALLTHROUGH */
-        case CLOCK_EVT_MODE_RESUME:
+        pr_debug("%s: %s\n", __func__, evdev->name);
+        sysreg_write(COMPARE, 0);
+
+        if (disable_cpu_idle_poll) {
+                disable_cpu_idle_poll = false;
                 /*
-                 * If we're using the COUNT and COMPARE registers we
-                 * need to force idle poll.
+                 * Only disable idle poll if we have forced that
+                 * in a previous call.
                  */
-                cpu_idle_poll_ctrl(true);
-                break;
-        case CLOCK_EVT_MODE_UNUSED:
-        case CLOCK_EVT_MODE_SHUTDOWN:
-                sysreg_write(COMPARE, 0);
-                pr_debug("%s: stop\n", evdev->name);
-                if (evdev->mode == CLOCK_EVT_MODE_ONESHOT ||
-                    evdev->mode == CLOCK_EVT_MODE_RESUME) {
-                        /*
-                         * Only disable idle poll if we have forced that
-                         * in a previous call.
-                         */
-                        cpu_idle_poll_ctrl(false);
-                }
-                break;
-        default:
-                BUG();
+                cpu_idle_poll_ctrl(false);
         }
+        return 0;
+}
+
+static int comparator_set_oneshot(struct clock_event_device *evdev)
+{
+        pr_debug("%s: %s\n", __func__, evdev->name);
+
+        disable_cpu_idle_poll = true;
+        /*
+         * If we're using the COUNT and COMPARE registers we
+         * need to force idle poll.
+         */
+        cpu_idle_poll_ctrl(true);
+
+        return 0;
 }
 
 static struct clock_event_device comparator = {
-        .name           = "avr32_comparator",
-        .features       = CLOCK_EVT_FEAT_ONESHOT,
-        .shift          = 16,
-        .rating         = 50,
-        .set_next_event = comparator_next_event,
-        .set_mode       = comparator_mode,
+        .name                   = "avr32_comparator",
+        .features               = CLOCK_EVT_FEAT_ONESHOT,
+        .shift                  = 16,
+        .rating                 = 50,
+        .set_next_event         = comparator_next_event,
+        .set_state_shutdown     = comparator_shutdown,
+        .set_state_oneshot      = comparator_set_oneshot,
+        .tick_resume            = comparator_set_oneshot,
 };
 
 void read_persistent_clock(struct timespec *ts)
diff --git a/arch/blackfin/include/asm/Kbuild b/arch/blackfin/include/asm/Kbuild
index 07051a63415d..61cd1e786a14 100644
--- a/arch/blackfin/include/asm/Kbuild
+++ b/arch/blackfin/include/asm/Kbuild
@@ -21,6 +21,7 @@ generic-y += kvm_para.h
 generic-y += local.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += mman.h
 generic-y += msgbuf.h
 generic-y += mutex.h
diff --git a/arch/blackfin/include/asm/mm-arch-hooks.h b/arch/blackfin/include/asm/mm-arch-hooks.h
deleted file mode 100644
index 1c5211ec338f..000000000000
--- a/arch/blackfin/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#ifndef _ASM_BLACKFIN_MM_ARCH_HOOKS_H
-#define _ASM_BLACKFIN_MM_ARCH_HOOKS_H
-
-#endif /* _ASM_BLACKFIN_MM_ARCH_HOOKS_H */
diff --git a/arch/c6x/include/asm/Kbuild b/arch/c6x/include/asm/Kbuild
index 7aeb32272975..f17c4dc6050c 100644
--- a/arch/c6x/include/asm/Kbuild
+++ b/arch/c6x/include/asm/Kbuild
@@ -26,6 +26,7 @@ generic-y += kdebug.h
 generic-y += kmap_types.h
 generic-y += local.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += mman.h
 generic-y += mmu.h
 generic-y += mmu_context.h
diff --git a/arch/c6x/include/asm/mm-arch-hooks.h b/arch/c6x/include/asm/mm-arch-hooks.h
deleted file mode 100644
index bb3c4a6ce8e9..000000000000
--- a/arch/c6x/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#ifndef _ASM_C6X_MM_ARCH_HOOKS_H
-#define _ASM_C6X_MM_ARCH_HOOKS_H
-
-#endif /* _ASM_C6X_MM_ARCH_HOOKS_H */
diff --git a/arch/cris/arch-v32/drivers/sync_serial.c b/arch/cris/arch-v32/drivers/sync_serial.c
index 4dda9bd6b8fb..e989cee77414 100644
--- a/arch/cris/arch-v32/drivers/sync_serial.c
+++ b/arch/cris/arch-v32/drivers/sync_serial.c
@@ -1464,7 +1464,7 @@ static inline void handle_rx_packet(struct sync_port *port)
                 if (port->write_ts_idx == NBR_IN_DESCR)
                         port->write_ts_idx = 0;
                 idx = port->write_ts_idx++;
-                do_posix_clock_monotonic_gettime(&port->timestamp[idx]);
+                ktime_get_ts(&port->timestamp[idx]);
                 port->in_buffer_len += port->inbufchunk;
         }
         spin_unlock_irqrestore(&port->lock, flags);
diff --git a/arch/cris/include/asm/Kbuild b/arch/cris/include/asm/Kbuild
index d294f6aaff1d..ad2244f35bca 100644
--- a/arch/cris/include/asm/Kbuild
+++ b/arch/cris/include/asm/Kbuild
@@ -18,6 +18,7 @@ generic-y += linkage.h
 generic-y += local.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += module.h
 generic-y += percpu.h
 generic-y += preempt.h
diff --git a/arch/cris/include/asm/mm-arch-hooks.h b/arch/cris/include/asm/mm-arch-hooks.h
deleted file mode 100644
index 314f774db2b0..000000000000
--- a/arch/cris/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#ifndef _ASM_CRIS_MM_ARCH_HOOKS_H
-#define _ASM_CRIS_MM_ARCH_HOOKS_H
-
-#endif /* _ASM_CRIS_MM_ARCH_HOOKS_H */
diff --git a/arch/frv/include/asm/Kbuild b/arch/frv/include/asm/Kbuild
index 30edce31e5c2..8e47b832cc76 100644
--- a/arch/frv/include/asm/Kbuild
+++ b/arch/frv/include/asm/Kbuild
@@ -4,5 +4,6 @@ generic-y += cputime.h
 generic-y += exec.h
 generic-y += irq_work.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += preempt.h
 generic-y += trace_clock.h
diff --git a/arch/frv/include/asm/mm-arch-hooks.h b/arch/frv/include/asm/mm-arch-hooks.h
deleted file mode 100644
index 51d13a870404..000000000000
--- a/arch/frv/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#ifndef _ASM_FRV_MM_ARCH_HOOKS_H
-#define _ASM_FRV_MM_ARCH_HOOKS_H
-
-#endif /* _ASM_FRV_MM_ARCH_HOOKS_H */
diff --git a/arch/h8300/include/asm/Kbuild b/arch/h8300/include/asm/Kbuild
index 00379d64f707..70e6ae1e7006 100644
--- a/arch/h8300/include/asm/Kbuild
+++ b/arch/h8300/include/asm/Kbuild
@@ -33,6 +33,7 @@ generic-y += linkage.h
 generic-y += local.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += mman.h
 generic-y += mmu.h
 generic-y += mmu_context.h
diff --git a/arch/hexagon/include/asm/Kbuild b/arch/hexagon/include/asm/Kbuild
index 5ade4a163558..daee37bd0999 100644
--- a/arch/hexagon/include/asm/Kbuild
+++ b/arch/hexagon/include/asm/Kbuild
@@ -28,6 +28,7 @@ generic-y += kmap_types.h
 generic-y += local.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += mman.h
 generic-y += msgbuf.h
 generic-y += pci.h
diff --git a/arch/hexagon/include/asm/mm-arch-hooks.h b/arch/hexagon/include/asm/mm-arch-hooks.h
deleted file mode 100644
index 05e8b939e416..000000000000
--- a/arch/hexagon/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#ifndef _ASM_HEXAGON_MM_ARCH_HOOKS_H
-#define _ASM_HEXAGON_MM_ARCH_HOOKS_H
-
-#endif /* _ASM_HEXAGON_MM_ARCH_HOOKS_H */
diff --git a/arch/ia64/include/asm/Kbuild b/arch/ia64/include/asm/Kbuild
index ccff13d33fa2..9de3ba12f6b9 100644
--- a/arch/ia64/include/asm/Kbuild
+++ b/arch/ia64/include/asm/Kbuild
@@ -4,6 +4,7 @@ generic-y += exec.h
 generic-y += irq_work.h
 generic-y += kvm_para.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += preempt.h
 generic-y += trace_clock.h
 generic-y += vtime.h
diff --git a/arch/ia64/include/asm/mm-arch-hooks.h b/arch/ia64/include/asm/mm-arch-hooks.h
deleted file mode 100644
index ab4b5c698322..000000000000
--- a/arch/ia64/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#ifndef _ASM_IA64_MM_ARCH_HOOKS_H
-#define _ASM_IA64_MM_ARCH_HOOKS_H
-
-#endif /* _ASM_IA64_MM_ARCH_HOOKS_H */
diff --git a/arch/m32r/include/asm/Kbuild b/arch/m32r/include/asm/Kbuild
index ba1cdc018731..e0eb704ca1fa 100644
--- a/arch/m32r/include/asm/Kbuild
+++ b/arch/m32r/include/asm/Kbuild
@@ -4,6 +4,7 @@ generic-y += cputime.h
 generic-y += exec.h
 generic-y += irq_work.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += module.h
 generic-y += preempt.h
 generic-y += sections.h
diff --git a/arch/m32r/include/asm/io.h b/arch/m32r/include/asm/io.h
index 0c3f25ee3381..f8de767ce2bc 100644
--- a/arch/m32r/include/asm/io.h
+++ b/arch/m32r/include/asm/io.h
@@ -174,6 +174,11 @@ static inline void _writel(unsigned long l, unsigned long addr)
 #define iowrite16 writew
 #define iowrite32 writel
 
+#define ioread16be(addr)        be16_to_cpu(readw(addr))
+#define ioread32be(addr)        be32_to_cpu(readl(addr))
+#define iowrite16be(v, addr)    writew(cpu_to_be16(v), (addr))
+#define iowrite32be(v, addr)    writel(cpu_to_be32(v), (addr))
+
 #define mmiowb()
 
 #define flush_write_buffers() do { } while (0)  /* M32R_FIXME */
diff --git a/arch/m32r/include/asm/mm-arch-hooks.h b/arch/m32r/include/asm/mm-arch-hooks.h
deleted file mode 100644
index 6d60b4750f41..000000000000
--- a/arch/m32r/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#ifndef _ASM_M32R_MM_ARCH_HOOKS_H
-#define _ASM_M32R_MM_ARCH_HOOKS_H
-
-#endif /* _ASM_M32R_MM_ARCH_HOOKS_H */
diff --git a/arch/m68k/Kconfig.cpu b/arch/m68k/Kconfig.cpu
index 33013dfcd3e1..c496d48a8c8d 100644
--- a/arch/m68k/Kconfig.cpu
+++ b/arch/m68k/Kconfig.cpu
@@ -125,6 +125,13 @@ endif # M68KCLASSIC
 
 if COLDFIRE
 
+choice
+        prompt "ColdFire SoC type"
+        default M520x
+        help
+          Select the type of ColdFire System-on-Chip (SoC) that you want
+          to build for.
+
 config M5206
         bool "MCF5206"
         depends on !MMU
@@ -174,9 +181,6 @@ config M525x
         help
           Freescale (Motorola) Coldfire 5251/5253 processor support.
 
-config M527x
-        bool
-
 config M5271
         bool "MCF5271"
         depends on !MMU
@@ -223,9 +227,6 @@ config M5307
         help
           Motorola ColdFire 5307 processor support.
 
-config M53xx
-        bool
-
 config M532x
         bool "MCF532x"
         depends on !MMU
@@ -251,9 +252,6 @@ config M5407
         help
           Motorola ColdFire 5407 processor support.
 
-config M54xx
-        bool
-
 config M547x
         bool "MCF547x"
         select M54xx
@@ -280,6 +278,17 @@ config M5441x
         help
           Freescale Coldfire 54410/54415/54416/54417/54418 processor support.
 
+endchoice
+
+config M527x
+        bool
+
+config M53xx
+        bool
+
+config M54xx
+        bool
+
 endif # COLDFIRE
 
 
@@ -416,22 +425,18 @@ config HAVE_MBAR
 config HAVE_IPSBAR
         bool
 
-config CLOCK_SET
-        bool "Enable setting the CPU clock frequency"
-        depends on COLDFIRE
-        default n
-        help
-          On some CPU's you do not need to know what the core CPU clock
-          frequency is. On these you can disable clock setting. On some
-          traditional 68K parts, and on all ColdFire parts you need to set
-          the appropriate CPU clock frequency. On these devices many of the
-          onboard peripherals derive their timing from the master CPU clock
-          frequency.
-
 config CLOCK_FREQ
         int "Set the core clock frequency"
+        default "25000000" if M5206
+        default "54000000" if M5206e
+        default "166666666" if M520x
+        default "140000000" if M5249
+        default "150000000" if M527x || M523x
+        default "90000000" if M5307
+        default "50000000" if M5407
+        default "266000000" if M54xx
         default "66666666"
-        depends on CLOCK_SET
+        depends on COLDFIRE
         help
           Define the CPU clock frequency in use. This is the core clock
           frequency, it may or may not be the same as the external clock
diff --git a/arch/m68k/configs/m5208evb_defconfig b/arch/m68k/configs/m5208evb_defconfig
index e7292f460af4..4c7b7938d53a 100644
--- a/arch/m68k/configs/m5208evb_defconfig
+++ b/arch/m68k/configs/m5208evb_defconfig
@@ -1,10 +1,6 @@
-# CONFIG_MMU is not set
-CONFIG_EXPERIMENTAL=y
 CONFIG_LOG_BUF_SHIFT=14
-# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
 CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
-# CONFIG_HOTPLUG is not set
 # CONFIG_FUTEX is not set
 # CONFIG_EPOLL is not set
 # CONFIG_SIGNALFD is not set
@@ -16,17 +12,12 @@ CONFIG_EXPERT=y
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_IOSCHED_DEADLINE is not set
 # CONFIG_IOSCHED_CFQ is not set
-CONFIG_M520x=y
-CONFIG_CLOCK_SET=y
-CONFIG_CLOCK_FREQ=166666666
-CONFIG_CLOCK_DIV=2
-CONFIG_M5208EVB=y
+# CONFIG_MMU is not set
 # CONFIG_4KSTACKS is not set
 CONFIG_RAMBASE=0x40000000
 CONFIG_RAMSIZE=0x2000000
 CONFIG_VECTORBASE=0x40000000
 CONFIG_KERNELBASE=0x40020000
-CONFIG_RAM16BIT=y
 CONFIG_BINFMT_FLAT=y
 CONFIG_NET=y
 CONFIG_PACKET=y
@@ -40,24 +31,19 @@ CONFIG_INET=y
 # CONFIG_IPV6 is not set
 # CONFIG_FW_LOADER is not set
 CONFIG_MTD=y
-CONFIG_MTD_CHAR=y
 CONFIG_MTD_BLOCK=y
 CONFIG_MTD_RAM=y
 CONFIG_MTD_UCLINUX=y
 CONFIG_BLK_DEV_RAM=y
-# CONFIG_MISC_DEVICES is not set
 CONFIG_NETDEVICES=y
-CONFIG_NET_ETHERNET=y
 CONFIG_FEC=y
-# CONFIG_NETDEV_1000 is not set
-# CONFIG_NETDEV_10000 is not set
 # CONFIG_INPUT is not set
 # CONFIG_SERIO is not set
 # CONFIG_VT is not set
+# CONFIG_UNIX98_PTYS is not set
 CONFIG_SERIAL_MCF=y
 CONFIG_SERIAL_MCF_BAUDRATE=115200
 CONFIG_SERIAL_MCF_CONSOLE=y
-# CONFIG_UNIX98_PTYS is not set
 # CONFIG_HW_RANDOM is not set
 # CONFIG_HWMON is not set
 # CONFIG_USB_SUPPORT is not set
@@ -68,8 +54,6 @@ CONFIG_EXT2_FS=y
 CONFIG_ROMFS_FS=y
 CONFIG_ROMFS_BACKED_BY_MTD=y
 # CONFIG_NETWORK_FILESYSTEMS is not set
-# CONFIG_RCU_CPU_STALL_DETECTOR is not set
-CONFIG_SYSCTL_SYSCALL_CHECK=y
-CONFIG_FULLDEBUG=y
 CONFIG_BOOTPARAM=y
 CONFIG_BOOTPARAM_STRING="root=/dev/mtdblock0"
+CONFIG_FULLDEBUG=y
diff --git a/arch/m68k/configs/m5249evb_defconfig b/arch/m68k/configs/m5249evb_defconfig
index 0cd4b39f325b..a782f368650f 100644
--- a/arch/m68k/configs/m5249evb_defconfig
+++ b/arch/m68k/configs/m5249evb_defconfig
@@ -1,10 +1,6 @@
-# CONFIG_MMU is not set
-CONFIG_EXPERIMENTAL=y
 CONFIG_LOG_BUF_SHIFT=14
-# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
 CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
-# CONFIG_HOTPLUG is not set
 # CONFIG_FUTEX is not set
 # CONFIG_EPOLL is not set
 # CONFIG_SIGNALFD is not set
@@ -16,10 +12,8 @@ CONFIG_EXPERT=y
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_IOSCHED_DEADLINE is not set
 # CONFIG_IOSCHED_CFQ is not set
+# CONFIG_MMU is not set
 CONFIG_M5249=y
-CONFIG_CLOCK_SET=y
-CONFIG_CLOCK_FREQ=140000000
-CONFIG_CLOCK_DIV=2
 CONFIG_M5249C3=y
 CONFIG_RAMBASE=0x00000000
 CONFIG_RAMSIZE=0x00800000
@@ -38,23 +32,18 @@ CONFIG_INET=y
 # CONFIG_IPV6 is not set
 # CONFIG_FW_LOADER is not set
 CONFIG_MTD=y
-CONFIG_MTD_CHAR=y
 CONFIG_MTD_BLOCK=y
 CONFIG_MTD_RAM=y
 CONFIG_MTD_UCLINUX=y
 CONFIG_BLK_DEV_RAM=y
-# CONFIG_MISC_DEVICES is not set
 CONFIG_NETDEVICES=y
-CONFIG_NET_ETHERNET=y
-# CONFIG_NETDEV_1000 is not set
-# CONFIG_NETDEV_10000 is not set
 CONFIG_PPP=y
 # CONFIG_INPUT is not set
 # CONFIG_SERIO is not set
 # CONFIG_VT is not set
+# CONFIG_UNIX98_PTYS is not set
 CONFIG_SERIAL_MCF=y
 CONFIG_SERIAL_MCF_CONSOLE=y
-# CONFIG_UNIX98_PTYS is not set
 # CONFIG_HWMON is not set
 # CONFIG_USB_SUPPORT is not set
 CONFIG_EXT2_FS=y
@@ -62,7 +51,5 @@ CONFIG_EXT2_FS=y
 CONFIG_ROMFS_FS=y
 CONFIG_ROMFS_BACKED_BY_MTD=y
 # CONFIG_NETWORK_FILESYSTEMS is not set
-# CONFIG_RCU_CPU_STALL_DETECTOR is not set
 CONFIG_BOOTPARAM=y
 CONFIG_BOOTPARAM_STRING="root=/dev/mtdblock0"
-# CONFIG_CRC32 is not set
diff --git a/arch/m68k/configs/m5272c3_defconfig b/arch/m68k/configs/m5272c3_defconfig
index a60cb3509135..6f5fb92f5cbf 100644
--- a/arch/m68k/configs/m5272c3_defconfig
+++ b/arch/m68k/configs/m5272c3_defconfig
@@ -1,10 +1,6 @@
-# CONFIG_MMU is not set
-CONFIG_EXPERIMENTAL=y
 CONFIG_LOG_BUF_SHIFT=14
-# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
 CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
-# CONFIG_HOTPLUG is not set
 # CONFIG_FUTEX is not set
 # CONFIG_EPOLL is not set
 # CONFIG_SIGNALFD is not set
@@ -16,8 +12,8 @@ CONFIG_EXPERT=y
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_IOSCHED_DEADLINE is not set
 # CONFIG_IOSCHED_CFQ is not set
+# CONFIG_MMU is not set
 CONFIG_M5272=y
-CONFIG_CLOCK_SET=y
 CONFIG_M5272C3=y
 CONFIG_RAMBASE=0x00000000
 CONFIG_RAMSIZE=0x00800000
@@ -36,23 +32,18 @@ CONFIG_INET=y
 # CONFIG_IPV6 is not set
 # CONFIG_FW_LOADER is not set
 CONFIG_MTD=y
-CONFIG_MTD_CHAR=y
 CONFIG_MTD_BLOCK=y
 CONFIG_MTD_RAM=y
 CONFIG_MTD_UCLINUX=y
 CONFIG_BLK_DEV_RAM=y
-# CONFIG_MISC_DEVICES is not set
 CONFIG_NETDEVICES=y
-CONFIG_NET_ETHERNET=y
 CONFIG_FEC=y
-# CONFIG_NETDEV_1000 is not set
-# CONFIG_NETDEV_10000 is not set
 # CONFIG_INPUT is not set
 # CONFIG_SERIO is not set
 # CONFIG_VT is not set
+# CONFIG_UNIX98_PTYS is not set
 CONFIG_SERIAL_MCF=y
 CONFIG_SERIAL_MCF_CONSOLE=y
-# CONFIG_UNIX98_PTYS is not set
 # CONFIG_HWMON is not set
 # CONFIG_USB_SUPPORT is not set
 CONFIG_EXT2_FS=y
@@ -61,6 +52,5 @@ CONFIG_EXT2_FS=y
 CONFIG_ROMFS_FS=y
 CONFIG_ROMFS_BACKED_BY_MTD=y
 # CONFIG_NETWORK_FILESYSTEMS is not set
-# CONFIG_RCU_CPU_STALL_DETECTOR is not set
 CONFIG_BOOTPARAM=y
 CONFIG_BOOTPARAM_STRING="root=/dev/mtdblock0"
diff --git a/arch/m68k/configs/m5275evb_defconfig b/arch/m68k/configs/m5275evb_defconfig
index e6502ab7cb2f..b5d7cd1ce856 100644
--- a/arch/m68k/configs/m5275evb_defconfig
+++ b/arch/m68k/configs/m5275evb_defconfig
@@ -1,10 +1,6 @@
-# CONFIG_MMU is not set
-CONFIG_EXPERIMENTAL=y
 CONFIG_LOG_BUF_SHIFT=14
-# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
 CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
-# CONFIG_HOTPLUG is not set
 # CONFIG_FUTEX is not set
 # CONFIG_EPOLL is not set
 # CONFIG_SIGNALFD is not set
@@ -16,11 +12,8 @@ CONFIG_EXPERT=y
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_IOSCHED_DEADLINE is not set
 # CONFIG_IOSCHED_CFQ is not set
+# CONFIG_MMU is not set
 CONFIG_M5275=y
-CONFIG_CLOCK_SET=y
-CONFIG_CLOCK_FREQ=150000000
-CONFIG_CLOCK_DIV=2
-CONFIG_M5275EVB=y
 # CONFIG_4KSTACKS is not set
 CONFIG_RAMBASE=0x00000000
 CONFIG_RAMSIZE=0x00000000
@@ -39,24 +32,19 @@ CONFIG_INET=y
 # CONFIG_IPV6 is not set
 # CONFIG_FW_LOADER is not set
 CONFIG_MTD=y
-CONFIG_MTD_CHAR=y
 CONFIG_MTD_BLOCK=y
 CONFIG_MTD_RAM=y
 CONFIG_MTD_UCLINUX=y
 CONFIG_BLK_DEV_RAM=y
-# CONFIG_MISC_DEVICES is not set
 CONFIG_NETDEVICES=y
-CONFIG_NET_ETHERNET=y
 CONFIG_FEC=y
-# CONFIG_NETDEV_1000 is not set
-# CONFIG_NETDEV_10000 is not set
 CONFIG_PPP=y
 # CONFIG_INPUT is not set
 # CONFIG_SERIO is not set
 # CONFIG_VT is not set
+# CONFIG_UNIX98_PTYS is not set
 CONFIG_SERIAL_MCF=y
 CONFIG_SERIAL_MCF_CONSOLE=y
-# CONFIG_UNIX98_PTYS is not set
 # CONFIG_HWMON is not set
 # CONFIG_USB_SUPPORT is not set
 CONFIG_EXT2_FS=y
@@ -65,8 +53,5 @@ CONFIG_EXT2_FS=y
 CONFIG_ROMFS_FS=y
 CONFIG_ROMFS_BACKED_BY_MTD=y
 # CONFIG_NETWORK_FILESYSTEMS is not set
-# CONFIG_RCU_CPU_STALL_DETECTOR is not set
-CONFIG_SYSCTL_SYSCALL_CHECK=y
 CONFIG_BOOTPARAM=y
 CONFIG_BOOTPARAM_STRING="root=/dev/mtdblock0"
-# CONFIG_CRC32 is not set
diff --git a/arch/m68k/configs/m5307c3_defconfig b/arch/m68k/configs/m5307c3_defconfig
index 023812abd2e6..1b4c09461c40 100644
--- a/arch/m68k/configs/m5307c3_defconfig
+++ b/arch/m68k/configs/m5307c3_defconfig
@@ -1,10 +1,6 @@
-# CONFIG_MMU is not set
-CONFIG_EXPERIMENTAL=y
 CONFIG_LOG_BUF_SHIFT=14
-# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
 CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
-# CONFIG_HOTPLUG is not set
 # CONFIG_FUTEX is not set
 # CONFIG_EPOLL is not set
 # CONFIG_SIGNALFD is not set
@@ -16,10 +12,8 @@ CONFIG_EXPERT=y
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_IOSCHED_DEADLINE is not set
 # CONFIG_IOSCHED_CFQ is not set
+# CONFIG_MMU is not set
 CONFIG_M5307=y
-CONFIG_CLOCK_SET=y
-CONFIG_CLOCK_FREQ=90000000
-CONFIG_CLOCK_DIV=2
 CONFIG_M5307C3=y
 CONFIG_RAMBASE=0x00000000
 CONFIG_RAMSIZE=0x00800000
@@ -38,16 +32,11 @@ CONFIG_INET=y
 # CONFIG_IPV6 is not set
 # CONFIG_FW_LOADER is not set
 CONFIG_MTD=y
-CONFIG_MTD_CHAR=y
 CONFIG_MTD_BLOCK=y
 CONFIG_MTD_RAM=y
 CONFIG_MTD_UCLINUX=y
 CONFIG_BLK_DEV_RAM=y
-# CONFIG_MISC_DEVICES is not set
 CONFIG_NETDEVICES=y
-CONFIG_NET_ETHERNET=y
-# CONFIG_NETDEV_1000 is not set
-# CONFIG_NETDEV_10000 is not set
 CONFIG_PPP=y
 CONFIG_SLIP=y
 CONFIG_SLIP_COMPRESSED=y
@@ -56,21 +45,17 @@ CONFIG_SLIP_COMPRESSED=y
 # CONFIG_INPUT_MOUSE is not set
 # CONFIG_SERIO is not set
 # CONFIG_VT is not set
+# CONFIG_LEGACY_PTYS is not set
 CONFIG_SERIAL_MCF=y
 CONFIG_SERIAL_MCF_CONSOLE=y
-# CONFIG_LEGACY_PTYS is not set
 # CONFIG_HW_RANDOM is not set
 # CONFIG_HWMON is not set
-# CONFIG_HID_SUPPORT is not set
 # CONFIG_USB_SUPPORT is not set
 CONFIG_EXT2_FS=y
 # CONFIG_DNOTIFY is not set
 CONFIG_ROMFS_FS=y
 CONFIG_ROMFS_BACKED_BY_MTD=y
 # CONFIG_NETWORK_FILESYSTEMS is not set
-# CONFIG_RCU_CPU_STALL_DETECTOR is not set
-CONFIG_SYSCTL_SYSCALL_CHECK=y
-CONFIG_FULLDEBUG=y
 CONFIG_BOOTPARAM=y
 CONFIG_BOOTPARAM_STRING="root=/dev/mtdblock0"
-# CONFIG_CRC32 is not set
+CONFIG_FULLDEBUG=y
diff --git a/arch/m68k/configs/m5407c3_defconfig b/arch/m68k/configs/m5407c3_defconfig
index 557b39f3be90..275ad543d4bc 100644
--- a/arch/m68k/configs/m5407c3_defconfig
+++ b/arch/m68k/configs/m5407c3_defconfig
@@ -1,10 +1,6 @@
-# CONFIG_MMU is not set
-CONFIG_EXPERIMENTAL=y
 CONFIG_LOG_BUF_SHIFT=14
-# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
 CONFIG_EXPERT=y
 # CONFIG_KALLSYMS is not set
-# CONFIG_HOTPLUG is not set
 # CONFIG_FUTEX is not set
 # CONFIG_EPOLL is not set
 # CONFIG_SIGNALFD is not set
@@ -17,9 +13,8 @@ CONFIG_MODULE_UNLOAD=y
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_IOSCHED_DEADLINE is not set
 # CONFIG_IOSCHED_CFQ is not set
+# CONFIG_MMU is not set
 CONFIG_M5407=y
-CONFIG_CLOCK_SET=y
-CONFIG_CLOCK_FREQ=50000000
 CONFIG_M5407C3=y
 CONFIG_RAMBASE=0x00000000
 CONFIG_RAMSIZE=0x00000000
@@ -38,22 +33,17 @@ CONFIG_INET=y
 # CONFIG_IPV6 is not set
 # CONFIG_FW_LOADER is not set
 CONFIG_MTD=y
-CONFIG_MTD_CHAR=y
 CONFIG_MTD_BLOCK=y
 CONFIG_MTD_RAM=y
 CONFIG_MTD_UCLINUX=y
 CONFIG_BLK_DEV_RAM=y
-# CONFIG_MISC_DEVICES is not set
 CONFIG_NETDEVICES=y
-CONFIG_NET_ETHERNET=y
-# CONFIG_NETDEV_1000 is not set
-# CONFIG_NETDEV_10000 is not set
 CONFIG_PPP=y
 # CONFIG_INPUT is not set
 # CONFIG_VT is not set
+# CONFIG_UNIX98_PTYS is not set
 CONFIG_SERIAL_MCF=y
 CONFIG_SERIAL_MCF_CONSOLE=y
-# CONFIG_UNIX98_PTYS is not set
 # CONFIG_HW_RANDOM is not set
 # CONFIG_HWMON is not set
 # CONFIG_USB_SUPPORT is not set
@@ -63,8 +53,5 @@ CONFIG_EXT2_FS=y
 CONFIG_ROMFS_FS=y
 CONFIG_ROMFS_BACKED_BY_MTD=y
 # CONFIG_NETWORK_FILESYSTEMS is not set
-# CONFIG_RCU_CPU_STALL_DETECTOR is not set
-CONFIG_SYSCTL_SYSCALL_CHECK=y
 CONFIG_BOOTPARAM=y
 CONFIG_BOOTPARAM_STRING="root=/dev/mtdblock0"
-# CONFIG_CRC32 is not set
diff --git a/arch/m68k/configs/m5475evb_defconfig b/arch/m68k/configs/m5475evb_defconfig
index c5018a68819b..4f4ccd13c11b 100644
--- a/arch/m68k/configs/m5475evb_defconfig
+++ b/arch/m68k/configs/m5475evb_defconfig
@@ -1,11 +1,7 @@
-CONFIG_EXPERIMENTAL=y
 # CONFIG_SWAP is not set
 CONFIG_LOG_BUF_SHIFT=14
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
 CONFIG_SYSCTL_SYSCALL=y
 # CONFIG_KALLSYMS is not set
-# CONFIG_HOTPLUG is not set
 # CONFIG_FUTEX is not set
 # CONFIG_EPOLL is not set
 # CONFIG_SIGNALFD is not set
@@ -20,19 +16,16 @@ CONFIG_MODULES=y
 # CONFIG_IOSCHED_DEADLINE is not set
 # CONFIG_IOSCHED_CFQ is not set
 CONFIG_COLDFIRE=y
-CONFIG_M547x=y
-CONFIG_CLOCK_SET=y
-CONFIG_CLOCK_FREQ=266000000
 # CONFIG_4KSTACKS is not set
 CONFIG_RAMBASE=0x0
 CONFIG_RAMSIZE=0x2000000
 CONFIG_VECTORBASE=0x0
 CONFIG_MBAR=0xff000000
 CONFIG_KERNELBASE=0x20000
+CONFIG_PCI=y
 # CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
 # CONFIG_FW_LOADER is not set
 CONFIG_MTD=y
-CONFIG_MTD_CHAR=y
 CONFIG_MTD_BLOCK=y
 CONFIG_MTD_CFI=y
 CONFIG_MTD_JEDECPROBE=y
diff --git a/arch/m68k/include/asm/Kbuild b/arch/m68k/include/asm/Kbuild
index 1555bc189c7d..eb85bd9c6180 100644
--- a/arch/m68k/include/asm/Kbuild
+++ b/arch/m68k/include/asm/Kbuild
@@ -18,6 +18,7 @@ generic-y += kvm_para.h
 generic-y += local.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += mman.h
 generic-y += mutex.h
 generic-y += percpu.h
diff --git a/arch/m68k/include/asm/coldfire.h b/arch/m68k/include/asm/coldfire.h
index c94557b91448..50aa4dac9ca2 100644
--- a/arch/m68k/include/asm/coldfire.h
+++ b/arch/m68k/include/asm/coldfire.h
@@ -19,7 +19,7 @@
  *      in any case new boards come along from time to time that have yet
  *      another different clocking frequency.
  */
-#ifdef CONFIG_CLOCK_SET
+#ifdef CONFIG_CLOCK_FREQ
 #define MCF_CLK         CONFIG_CLOCK_FREQ
 #else
 #error "Don't know what your ColdFire CPU clock frequency is??"
diff --git a/arch/m68k/include/asm/io_mm.h b/arch/m68k/include/asm/io_mm.h
index 618c85d3c786..f55cad529400 100644
--- a/arch/m68k/include/asm/io_mm.h
+++ b/arch/m68k/include/asm/io_mm.h
@@ -413,7 +413,8 @@ static inline void isa_delay(void)
 #define writew(val, addr)       out_le16((addr), (val))
 #endif /* CONFIG_ATARI_ROM_ISA */
 
-#if !defined(CONFIG_ISA) && !defined(CONFIG_ATARI_ROM_ISA)
+#if !defined(CONFIG_ISA) && !defined(CONFIG_ATARI_ROM_ISA) && \
+    !(defined(CONFIG_PCI) && defined(CONFIG_COLDFIRE))
 /*
  * We need to define dummy functions for GENERIC_IOMAP support.
  */
diff --git a/arch/m68k/include/asm/mm-arch-hooks.h b/arch/m68k/include/asm/mm-arch-hooks.h
deleted file mode 100644
index 7e8709bc90ae..000000000000
--- a/arch/m68k/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#ifndef _ASM_M68K_MM_ARCH_HOOKS_H
-#define _ASM_M68K_MM_ARCH_HOOKS_H
-
-#endif /* _ASM_M68K_MM_ARCH_HOOKS_H */
diff --git a/arch/metag/include/asm/Kbuild b/arch/metag/include/asm/Kbuild
index 199320f3c345..df31353fd200 100644
--- a/arch/metag/include/asm/Kbuild
+++ b/arch/metag/include/asm/Kbuild
@@ -25,6 +25,7 @@ generic-y += kvm_para.h
 generic-y += local.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += msgbuf.h
 generic-y += mutex.h
 generic-y += param.h
diff --git a/arch/metag/include/asm/mm-arch-hooks.h b/arch/metag/include/asm/mm-arch-hooks.h
deleted file mode 100644
index b0072b2eb0de..000000000000
--- a/arch/metag/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#ifndef _ASM_METAG_MM_ARCH_HOOKS_H
-#define _ASM_METAG_MM_ARCH_HOOKS_H
-
-#endif /* _ASM_METAG_MM_ARCH_HOOKS_H */
diff --git a/arch/microblaze/include/asm/Kbuild b/arch/microblaze/include/asm/Kbuild
index 9989ddb169ca..2f222f355c4b 100644
--- a/arch/microblaze/include/asm/Kbuild
+++ b/arch/microblaze/include/asm/Kbuild
@@ -6,6 +6,7 @@ generic-y += device.h
 generic-y += exec.h
 generic-y += irq_work.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += preempt.h
 generic-y += syscalls.h
 generic-y += trace_clock.h
diff --git a/arch/microblaze/include/asm/mm-arch-hooks.h b/arch/microblaze/include/asm/mm-arch-hooks.h
deleted file mode 100644
index 5c4065911bda..000000000000
--- a/arch/microblaze/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#ifndef _ASM_MICROBLAZE_MM_ARCH_HOOKS_H
-#define _ASM_MICROBLAZE_MM_ARCH_HOOKS_H
-
-#endif /* _ASM_MICROBLAZE_MM_ARCH_HOOKS_H */
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 2a14585c90d2..cee5f93e5712 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -1427,6 +1427,7 @@ config CPU_MIPS64_R6
         select CPU_SUPPORTS_HIGHMEM
         select CPU_SUPPORTS_MSA
         select GENERIC_CSUM
+        select MIPS_O32_FP64_SUPPORT if MIPS32_O32
         help
           Choose this option to build a kernel for release 6 or later of the
           MIPS64 architecture.  New MIPS processors, starting with the Warrior
@@ -2231,7 +2232,7 @@ config MIPS_CMP
 
 config MIPS_CPS
         bool "MIPS Coherent Processing System support"
-        depends on SYS_SUPPORTS_MIPS_CPS && !64BIT
+        depends on SYS_SUPPORTS_MIPS_CPS
         select MIPS_CM
         select MIPS_CPC
         select MIPS_CPS_PM if HOTPLUG_CPU
@@ -2262,11 +2263,6 @@ config MIPS_CM
 config MIPS_CPC
         bool
 
-config SB1_PASS_1_WORKAROUNDS
-        bool
-        depends on CPU_SB1_PASS_1
-        default y
-
 config SB1_PASS_2_WORKAROUNDS
         bool
         depends on CPU_SB1 && (CPU_SB1_PASS_2_2 || CPU_SB1_PASS_2)
diff --git a/arch/mips/Makefile b/arch/mips/Makefile
index ae2dd59050f7..252e347958f3 100644
--- a/arch/mips/Makefile
+++ b/arch/mips/Makefile
@@ -181,13 +181,6 @@ cflags-$(CONFIG_CPU_R4000_WORKAROUNDS)	+= $(call cc-option,-mfix-r4000,)
 cflags-$(CONFIG_CPU_R4400_WORKAROUNDS)  += $(call cc-option,-mfix-r4400,)
 cflags-$(CONFIG_CPU_DADDI_WORKAROUNDS)  += $(call cc-option,-mno-daddi,)
 
-ifdef CONFIG_CPU_SB1
-ifdef CONFIG_SB1_PASS_1_WORKAROUNDS
-KBUILD_AFLAGS_MODULE += -msb1-pass1-workarounds
-KBUILD_CFLAGS_MODULE += -msb1-pass1-workarounds
-endif
-endif
-
 # For smartmips configurations, there are hundreds of warnings due to ISA overrides
 # in assembly and header files. smartmips is only supported for MIPS32r1 onwards
 # and there is no support for 64-bit. Various '.set mips2' or '.set mips3' or
diff --git a/arch/mips/include/asm/Kbuild b/arch/mips/include/asm/Kbuild
index 7fe5c61a3cb8..1f8546081d20 100644
--- a/arch/mips/include/asm/Kbuild
+++ b/arch/mips/include/asm/Kbuild
@@ -7,6 +7,7 @@ generic-y += emergency-restart.h
 generic-y += irq_work.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += mutex.h
 generic-y += parport.h
 generic-y += percpu.h
diff --git a/arch/mips/include/asm/fpu.h b/arch/mips/include/asm/fpu.h
index 084780b355aa..1b0625189835 100644
--- a/arch/mips/include/asm/fpu.h
+++ b/arch/mips/include/asm/fpu.h
@@ -74,7 +74,7 @@ static inline int __enable_fpu(enum fpu_mode mode)
                 goto fr_common;
 
         case FPU_64BIT:
-#if !(defined(CONFIG_CPU_MIPS32_R2) || defined(CONFIG_CPU_MIPS32_R6) \
+#if !(defined(CONFIG_CPU_MIPSR2) || defined(CONFIG_CPU_MIPSR6) \
       || defined(CONFIG_64BIT))
                 /* we only have a 32-bit FPU */
                 return SIGFPE;
diff --git a/arch/mips/include/asm/mach-loongson64/mmzone.h b/arch/mips/include/asm/mach-loongson64/mmzone.h
index 37c08a27b4f0..c9f7e231e66b 100644
--- a/arch/mips/include/asm/mach-loongson64/mmzone.h
+++ b/arch/mips/include/asm/mach-loongson64/mmzone.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2010 Loongson Inc. & Lemote Inc. &
- *                    Insititute of Computing Technology
+ *                    Institute of Computing Technology
  * Author:  Xiang Gao, gaoxiang@ict.ac.cn
  *          Huacai Chen, chenhc@lemote.com
  *          Xiaofu Meng, Shuangshuang Zhang
diff --git a/arch/mips/include/asm/mach-sibyte/war.h b/arch/mips/include/asm/mach-sibyte/war.h
index 0a227d426b9c..520f8fc2c806 100644
--- a/arch/mips/include/asm/mach-sibyte/war.h
+++ b/arch/mips/include/asm/mach-sibyte/war.h
@@ -13,8 +13,7 @@
 #define R4600_V2_HIT_CACHEOP_WAR        0
 #define R5432_CP0_INTERRUPT_WAR         0
 
-#if defined(CONFIG_SB1_PASS_1_WORKAROUNDS) || \
-    defined(CONFIG_SB1_PASS_2_WORKAROUNDS)
+#if defined(CONFIG_SB1_PASS_2_WORKAROUNDS)
 
 #ifndef __ASSEMBLY__
 extern int sb1250_m3_workaround_needed(void);
diff --git a/arch/mips/include/asm/mm-arch-hooks.h b/arch/mips/include/asm/mm-arch-hooks.h
deleted file mode 100644
index b5609fe8e475..000000000000
--- a/arch/mips/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#ifndef _ASM_MIPS_MM_ARCH_HOOKS_H
-#define _ASM_MIPS_MM_ARCH_HOOKS_H
-
-#endif /* _ASM_MIPS_MM_ARCH_HOOKS_H */
diff --git a/arch/mips/include/asm/smp.h b/arch/mips/include/asm/smp.h
index 2b25d1ba1ea0..16f1ea9ab191 100644
--- a/arch/mips/include/asm/smp.h
+++ b/arch/mips/include/asm/smp.h
@@ -23,6 +23,7 @@
 extern int smp_num_siblings;
 extern cpumask_t cpu_sibling_map[];
 extern cpumask_t cpu_core_map[];
+extern cpumask_t cpu_foreign_map;
 
 #define raw_smp_processor_id() (current_thread_info()->cpu)
 
diff --git a/arch/mips/include/uapi/asm/sigcontext.h b/arch/mips/include/uapi/asm/sigcontext.h
index 6c9906f59c6e..9081d88ae44f 100644
--- a/arch/mips/include/uapi/asm/sigcontext.h
+++ b/arch/mips/include/uapi/asm/sigcontext.h
@@ -16,7 +16,7 @@
 
 /*
  * Keep this struct definition in sync with the sigcontext fragment
- * in arch/mips/tools/offset.c
+ * in arch/mips/kernel/asm-offsets.c
  */
 struct sigcontext {
         unsigned int            sc_regmask;     /* Unused */
@@ -46,7 +46,7 @@ struct sigcontext {
 #include <linux/posix_types.h>
 /*
  * Keep this struct definition in sync with the sigcontext fragment
- * in arch/mips/tools/offset.c
+ * in arch/mips/kernel/asm-offsets.c
  *
  * Warning: this structure illdefined with sc_badvaddr being just an unsigned
  * int so it was changed to unsigned long in 2.6.0-test1.  This may break
diff --git a/arch/mips/kernel/asm-offsets.c b/arch/mips/kernel/asm-offsets.c
index beabe19ff8e5..072fab13645d 100644
--- a/arch/mips/kernel/asm-offsets.c
+++ b/arch/mips/kernel/asm-offsets.c
@@ -1,5 +1,5 @@
 /*
- * offset.c: Calculate pt_regs and task_struct offsets.
+ * asm-offsets.c: Calculate pt_regs and task_struct offsets.
  *
  * Copyright (C) 1996 David S. Miller
  * Copyright (C) 1997, 1998, 1999, 2000, 2001, 2002, 2003 Ralf Baechle
diff --git a/arch/mips/kernel/branch.c b/arch/mips/kernel/branch.c
index c0c5e5972256..d8f9b357b222 100644
--- a/arch/mips/kernel/branch.c
+++ b/arch/mips/kernel/branch.c
@@ -600,7 +600,7 @@ int __compute_return_epc_for_insn(struct pt_regs *regs,
                 break;
 
         case blezl_op: /* not really i_format */
-                if (NO_R6EMU)
+                if (!insn.i_format.rt && NO_R6EMU)
                         goto sigill_r6;
         case blez_op:
                 /*
@@ -635,7 +635,7 @@ int __compute_return_epc_for_insn(struct pt_regs *regs,
                 break;
 
         case bgtzl_op:
-                if (NO_R6EMU)
+                if (!insn.i_format.rt && NO_R6EMU)
                         goto sigill_r6;
         case bgtz_op:
                 /*
diff --git a/arch/mips/kernel/cps-vec.S b/arch/mips/kernel/cps-vec.S
index 55b759a0019e..1b6ca634e646 100644
--- a/arch/mips/kernel/cps-vec.S
+++ b/arch/mips/kernel/cps-vec.S
@@ -60,7 +60,7 @@ LEAF(mips_cps_core_entry)
          nop
 
         /* This is an NMI */
-        la      k0, nmi_handler
+        PTR_LA  k0, nmi_handler
         jr      k0
          nop
 
@@ -107,10 +107,10 @@ not_nmi:
         mul     t1, t1, t0
         mul     t1, t1, t2
 
-        li      a0, KSEG0
-        add     a1, a0, t1
+        li      a0, CKSEG0
+        PTR_ADD a1, a0, t1
 1:      cache   Index_Store_Tag_I, 0(a0)
-        add     a0, a0, t0
+        PTR_ADD a0, a0, t0
         bne     a0, a1, 1b
          nop
 icache_done:
@@ -134,12 +134,12 @@ icache_done:
         mul     t1, t1, t0
         mul     t1, t1, t2
 
-        li      a0, KSEG0
-        addu    a1, a0, t1
-        subu    a1, a1, t0
+        li      a0, CKSEG0
+        PTR_ADDU a1, a0, t1
+        PTR_SUBU a1, a1, t0
 1:      cache   Index_Store_Tag_D, 0(a0)
         bne     a0, a1, 1b
-         add    a0, a0, t0
+         PTR_ADD a0, a0, t0
 dcache_done:
 
         /* Set Kseg0 CCA to that in s0 */
@@ -152,11 +152,11 @@ dcache_done:
 
         /* Enter the coherent domain */
         li      t0, 0xff
-        sw      t0, GCR_CL_COHERENCE_OFS(v1)
+        PTR_S   t0, GCR_CL_COHERENCE_OFS(v1)
         ehb
 
         /* Jump to kseg0 */
-        la      t0, 1f
+        PTR_LA  t0, 1f
         jr      t0
          nop
 
@@ -178,9 +178,9 @@ dcache_done:
          nop
 
         /* Off we go! */
-        lw      t1, VPEBOOTCFG_PC(v0)
-        lw      gp, VPEBOOTCFG_GP(v0)
-        lw      sp, VPEBOOTCFG_SP(v0)
+        PTR_L   t1, VPEBOOTCFG_PC(v0)
+        PTR_L   gp, VPEBOOTCFG_GP(v0)
+        PTR_L   sp, VPEBOOTCFG_SP(v0)
         jr      t1
          nop
         END(mips_cps_core_entry)
@@ -217,7 +217,7 @@ LEAF(excep_intex)
 
 .org 0x480
 LEAF(excep_ejtag)
-        la      k0, ejtag_debug_handler
+        PTR_LA  k0, ejtag_debug_handler
         jr      k0
          nop
         END(excep_ejtag)
@@ -229,7 +229,7 @@ LEAF(mips_cps_core_init)
          nop
 
         .set    push
-        .set    mips32r2
+        .set    mips64r2
         .set    mt
 
         /* Only allow 1 TC per VPE to execute... */
@@ -237,7 +237,7 @@ LEAF(mips_cps_core_init)
 
         /* ...and for the moment only 1 VPE */
         dvpe
-        la      t1, 1f
+        PTR_LA  t1, 1f
         jr.hb   t1
          nop
 
@@ -250,25 +250,25 @@ LEAF(mips_cps_core_init)
         mfc0    t0, CP0_MVPCONF0
         srl     t0, t0, MVPCONF0_PVPE_SHIFT
         andi    t0, t0, (MVPCONF0_PVPE >> MVPCONF0_PVPE_SHIFT)
-        addiu   t7, t0, 1
+        addiu   ta3, t0, 1
 
         /* If there's only 1, we're done */
         beqz    t0, 2f
          nop
 
         /* Loop through each VPE within this core */
-        li      t5, 1
+        li      ta1, 1
 
 1:      /* Operate on the appropriate TC */
-        mtc0    t5, CP0_VPECONTROL
+        mtc0    ta1, CP0_VPECONTROL
         ehb
 
         /* Bind TC to VPE (1:1 TC:VPE mapping) */
-        mttc0   t5, CP0_TCBIND
+        mttc0   ta1, CP0_TCBIND
 
         /* Set exclusive TC, non-active, master */
         li      t0, VPECONF0_MVP
-        sll     t1, t5, VPECONF0_XTC_SHIFT
+        sll     t1, ta1, VPECONF0_XTC_SHIFT
         or      t0, t0, t1
         mttc0   t0, CP0_VPECONF0
 
@@ -280,8 +280,8 @@ LEAF(mips_cps_core_init)
         mttc0   t0, CP0_TCHALT
 
         /* Next VPE */
-        addiu   t5, t5, 1
-        slt     t0, t5, t7
+        addiu   ta1, ta1, 1
+        slt     t0, ta1, ta3
         bnez    t0, 1b
          nop
 
@@ -298,19 +298,19 @@ LEAF(mips_cps_core_init)
 
 LEAF(mips_cps_boot_vpes)
         /* Retrieve CM base address */
-        la      t0, mips_cm_base
-        lw      t0, 0(t0)
+        PTR_LA  t0, mips_cm_base
+        PTR_L   t0, 0(t0)
 
         /* Calculate a pointer to this cores struct core_boot_config */
-        lw      t0, GCR_CL_ID_OFS(t0)
+        PTR_L   t0, GCR_CL_ID_OFS(t0)
         li      t1, COREBOOTCFG_SIZE
         mul     t0, t0, t1
-        la      t1, mips_cps_core_bootcfg
-        lw      t1, 0(t1)
-        addu    t0, t0, t1
+        PTR_LA  t1, mips_cps_core_bootcfg
+        PTR_L   t1, 0(t1)
+        PTR_ADDU t0, t0, t1
 
         /* Calculate this VPEs ID. If the core doesn't support MT use 0 */
-        has_mt  t6, 1f
+        has_mt  ta2, 1f
          li     t9, 0
 
         /* Find the number of VPEs present in the core */
@@ -334,24 +334,24 @@ LEAF(mips_cps_boot_vpes)
 1:      /* Calculate a pointer to this VPEs struct vpe_boot_config */
         li      t1, VPEBOOTCFG_SIZE
         mul     v0, t9, t1
-        lw      t7, COREBOOTCFG_VPECONFIG(t0)
-        addu    v0, v0, t7
+        PTR_L   ta3, COREBOOTCFG_VPECONFIG(t0)
+        PTR_ADDU v0, v0, ta3
 
 #ifdef CONFIG_MIPS_MT
 
         /* If the core doesn't support MT then return */
-        bnez    t6, 1f
+        bnez    ta2, 1f
          nop
         jr      ra
          nop
 
         .set    push
-        .set    mips32r2
+        .set    mips64r2
         .set    mt
 
 1:      /* Enter VPE configuration state */
         dvpe
-        la      t1, 1f
+        PTR_LA  t1, 1f
         jr.hb   t1
          nop
 1:      mfc0    t1, CP0_MVPCONTROL
@@ -360,12 +360,12 @@ LEAF(mips_cps_boot_vpes)
         ehb
 
         /* Loop through each VPE */
-        lw      t6, COREBOOTCFG_VPEMASK(t0)
-        move    t8, t6
-        li      t5, 0
+        PTR_L   ta2, COREBOOTCFG_VPEMASK(t0)
+        move    t8, ta2
+        li      ta1, 0
 
         /* Check whether the VPE should be running. If not, skip it */
-1:      andi    t0, t6, 1
+1:      andi    t0, ta2, 1
         beqz    t0, 2f
          nop
 
@@ -373,7 +373,7 @@ LEAF(mips_cps_boot_vpes)
         mfc0    t0, CP0_VPECONTROL
         ori     t0, t0, VPECONTROL_TARGTC
         xori    t0, t0, VPECONTROL_TARGTC
-        or      t0, t0, t5
+        or      t0, t0, ta1
         mtc0    t0, CP0_VPECONTROL
         ehb
 
@@ -384,8 +384,8 @@ LEAF(mips_cps_boot_vpes)
 
         /* Calculate a pointer to the VPEs struct vpe_boot_config */
         li      t0, VPEBOOTCFG_SIZE
-        mul     t0, t0, t5
-        addu    t0, t0, t7
+        mul     t0, t0, ta1
+        addu    t0, t0, ta3
 
         /* Set the TC restart PC */
         lw      t1, VPEBOOTCFG_PC(t0)
@@ -423,9 +423,9 @@ LEAF(mips_cps_boot_vpes)
         mttc0   t0, CP0_VPECONF0
 
         /* Next VPE */
-2:      srl     t6, t6, 1
-        addiu   t5, t5, 1
-        bnez    t6, 1b
+2:      srl     ta2, ta2, 1
+        addiu   ta1, ta1, 1
+        bnez    ta2, 1b
          nop
 
         /* Leave VPE configuration state */
@@ -445,7 +445,7 @@ LEAF(mips_cps_boot_vpes)
         /* This VPE should be offline, halt the TC */
         li      t0, TCHALT_H
         mtc0    t0, CP0_TCHALT
-        la      t0, 1f
+        PTR_LA  t0, 1f
 1:      jr.hb   t0
          nop
 
@@ -466,10 +466,10 @@ LEAF(mips_cps_boot_vpes)
         .set    noat
         lw      $1, TI_CPU(gp)
         sll     $1, $1, LONGLOG
-        la      \dest, __per_cpu_offset
+        PTR_LA  \dest, __per_cpu_offset
         addu    $1, $1, \dest
         lw      $1, 0($1)
-        la      \dest, cps_cpu_state
+        PTR_LA  \dest, cps_cpu_state
         addu    \dest, \dest, $1
         .set    pop
         .endm
diff --git a/arch/mips/kernel/scall32-o32.S b/arch/mips/kernel/scall32-o32.S
index 6e8de80bb446..4cc13508d967 100644
--- a/arch/mips/kernel/scall32-o32.S
+++ b/arch/mips/kernel/scall32-o32.S
@@ -73,10 +73,11 @@ NESTED(handle_sys, PT_SIZE, sp)
         .set    noreorder
         .set    nomacro
 
-1:      user_lw(t5, 16(t0))             # argument #5 from usp
-4:      user_lw(t6, 20(t0))             # argument #6 from usp
-3:      user_lw(t7, 24(t0))             # argument #7 from usp
-2:      user_lw(t8, 28(t0))             # argument #8 from usp
+load_a4: user_lw(t5, 16(t0))            # argument #5 from usp
+load_a5: user_lw(t6, 20(t0))            # argument #6 from usp
+load_a6: user_lw(t7, 24(t0))            # argument #7 from usp
+load_a7: user_lw(t8, 28(t0))            # argument #8 from usp
+loads_done:
 
         sw      t5, 16(sp)              # argument #5 to ksp
         sw      t6, 20(sp)              # argument #6 to ksp
@@ -85,10 +86,10 @@ NESTED(handle_sys, PT_SIZE, sp)
         .set    pop
 
         .section __ex_table,"a"
-        PTR     1b,bad_stack
-        PTR     2b,bad_stack
-        PTR     3b,bad_stack
-        PTR     4b,bad_stack
+        PTR     load_a4, bad_stack_a4
+        PTR     load_a5, bad_stack_a5
+        PTR     load_a6, bad_stack_a6
+        PTR     load_a7, bad_stack_a7
         .previous
 
         lw      t0, TI_FLAGS($28)       # syscall tracing enabled?
@@ -153,8 +154,8 @@ syscall_trace_entry:
 /* ------------------------------------------------------------------------ */
 
         /*
-         * The stackpointer for a call with more than 4 arguments is bad.
-         * We probably should handle this case a bit more drastic.
+         * Our open-coded access area sanity test for the stack pointer
+         * failed. We probably should handle this case a bit more drastic.
          */
 bad_stack:
         li      v0, EFAULT
@@ -163,6 +164,22 @@ bad_stack:
         sw      t0, PT_R7(sp)
         j       o32_syscall_exit
 
+bad_stack_a4:
+        li      t5, 0
+        b       load_a5
+
+bad_stack_a5:
+        li      t6, 0
+        b       load_a6
+
+bad_stack_a6:
+        li      t7, 0
+        b       load_a7
+
+bad_stack_a7:
+        li      t8, 0
+        b       loads_done
+
         /*
          * The system call does not exist in this kernel
          */
diff --git a/arch/mips/kernel/scall64-o32.S b/arch/mips/kernel/scall64-o32.S
index d07b210fbeff..f543ff4feef9 100644
--- a/arch/mips/kernel/scall64-o32.S
+++ b/arch/mips/kernel/scall64-o32.S
@@ -69,16 +69,17 @@ NESTED(handle_sys, PT_SIZE, sp)
         daddu   t1, t0, 32
         bltz    t1, bad_stack
 
-1:      lw      a4, 16(t0)              # argument #5 from usp
-2:      lw      a5, 20(t0)              # argument #6 from usp
-3:      lw      a6, 24(t0)              # argument #7 from usp
-4:      lw      a7, 28(t0)              # argument #8 from usp (for indirect syscalls)
+load_a4: lw     a4, 16(t0)              # argument #5 from usp
+load_a5: lw     a5, 20(t0)              # argument #6 from usp
+load_a6: lw     a6, 24(t0)              # argument #7 from usp
+load_a7: lw     a7, 28(t0)              # argument #8 from usp
+loads_done:
 
         .section __ex_table,"a"
-        PTR     1b, bad_stack
-        PTR     2b, bad_stack
-        PTR     3b, bad_stack
-        PTR     4b, bad_stack
+        PTR     load_a4, bad_stack_a4
+        PTR     load_a5, bad_stack_a5
+        PTR     load_a6, bad_stack_a6
+        PTR     load_a7, bad_stack_a7
         .previous
 
         li      t1, _TIF_WORK_SYSCALL_ENTRY
@@ -167,6 +168,22 @@ bad_stack:
         sd      t0, PT_R7(sp)
         j       o32_syscall_exit
 
+bad_stack_a4:
+        li      a4, 0
+        b       load_a5
+
+bad_stack_a5:
+        li      a5, 0
+        b       load_a6
+
+bad_stack_a6:
+        li      a6, 0
+        b       load_a7
+
+bad_stack_a7:
+        li      a7, 0
+        b       loads_done
+
 not_o32_scall:
         /*
          * This is not an o32 compatibility syscall, pass it on
@@ -383,7 +400,7 @@ EXPORT(sys32_call_table)
         PTR     sys_connect                     /* 4170 */
         PTR     sys_getpeername
         PTR     sys_getsockname
-        PTR     sys_getsockopt
+        PTR     compat_sys_getsockopt
         PTR     sys_listen
         PTR     compat_sys_recv                 /* 4175 */
         PTR     compat_sys_recvfrom
diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c
index be73c491182b..008b3378653a 100644
--- a/arch/mips/kernel/setup.c
+++ b/arch/mips/kernel/setup.c
@@ -337,6 +337,11 @@ static void __init bootmem_init(void)
                         min_low_pfn = start;
                 if (end <= reserved_end)
                         continue;
+#ifdef CONFIG_BLK_DEV_INITRD
+                /* mapstart should be after initrd_end */
+                if (initrd_end && end <= (unsigned long)PFN_UP(__pa(initrd_end)))
+                        continue;
+#endif
                 if (start >= mapstart)
                         continue;
                 mapstart = max(reserved_end, start);
@@ -366,14 +371,6 @@ static void __init bootmem_init(void)
                 max_low_pfn = PFN_DOWN(HIGHMEM_START);
         }
 
-#ifdef CONFIG_BLK_DEV_INITRD
-        /*
-         * mapstart should be after initrd_end
-         */
-        if (initrd_end)
-                mapstart = max(mapstart, (unsigned long)PFN_UP(__pa(initrd_end)));
-#endif
-
         /*
          * Initialize the boot-time allocator with low memory only.
          */
diff --git a/arch/mips/kernel/smp-cps.c b/arch/mips/kernel/smp-cps.c
index 4251d390b5b6..c88937745b4e 100644
--- a/arch/mips/kernel/smp-cps.c
+++ b/arch/mips/kernel/smp-cps.c
@@ -133,7 +133,7 @@ static void __init cps_prepare_cpus(unsigned int max_cpus)
         /*
          * Patch the start of mips_cps_core_entry to provide:
          *
-         * v0 = CM base address
+         * v1 = CM base address
          * s0 = kseg0 CCA
          */
         entry_code = (u32 *)&mips_cps_core_entry;
@@ -369,7 +369,7 @@ void play_dead(void)
 
 static void wait_for_sibling_halt(void *ptr_cpu)
 {
-        unsigned cpu = (unsigned)ptr_cpu;
+        unsigned cpu = (unsigned long)ptr_cpu;
         unsigned vpe_id = cpu_vpe_id(&cpu_data[cpu]);
         unsigned halted;
         unsigned long flags;
@@ -430,7 +430,7 @@ static void cps_cpu_die(unsigned int cpu)
                  */
                 err = smp_call_function_single(cpu_death_sibling,
                                                wait_for_sibling_halt,
-                                               (void *)cpu, 1);
+                                               (void *)(unsigned long)cpu, 1);
                 if (err)
                         panic("Failed to call remote sibling CPU\n");
         }
diff --git a/arch/mips/kernel/smp.c b/arch/mips/kernel/smp.c
index faa46ebd9dda..d0744cc77ea7 100644
--- a/arch/mips/kernel/smp.c
+++ b/arch/mips/kernel/smp.c
@@ -63,6 +63,13 @@ EXPORT_SYMBOL(cpu_sibling_map);
 cpumask_t cpu_core_map[NR_CPUS] __read_mostly;
 EXPORT_SYMBOL(cpu_core_map);
 
+/*
+ * A logcal cpu mask containing only one VPE per core to
+ * reduce the number of IPIs on large MT systems.
+ */
+cpumask_t cpu_foreign_map __read_mostly;
+EXPORT_SYMBOL(cpu_foreign_map);
+
 /* representing cpus for which sibling maps can be computed */
 static cpumask_t cpu_sibling_setup_map;
 
@@ -103,6 +110,29 @@ static inline void set_cpu_core_map(int cpu)
         }
 }
 
+/*
+ * Calculate a new cpu_foreign_map mask whenever a
+ * new cpu appears or disappears.
+ */
+static inline void calculate_cpu_foreign_map(void)
+{
+        int i, k, core_present;
+        cpumask_t temp_foreign_map;
+
+        /* Re-calculate the mask */
+        for_each_online_cpu(i) {
+                core_present = 0;
+                for_each_cpu(k, &temp_foreign_map)
+                        if (cpu_data[i].package == cpu_data[k].package &&
+                            cpu_data[i].core == cpu_data[k].core)
+                                core_present = 1;
+                if (!core_present)
+                        cpumask_set_cpu(i, &temp_foreign_map);
+        }
+
+        cpumask_copy(&cpu_foreign_map, &temp_foreign_map);
+}
+
 struct plat_smp_ops *mp_ops;
 EXPORT_SYMBOL(mp_ops);
 
@@ -146,6 +176,8 @@ asmlinkage void start_secondary(void)
         set_cpu_sibling_map(cpu);
         set_cpu_core_map(cpu);
 
+        calculate_cpu_foreign_map();
+
         cpumask_set_cpu(cpu, &cpu_callin_map);
 
         synchronise_count_slave(cpu);
@@ -173,9 +205,18 @@ void __irq_entry smp_call_function_interrupt(void)
 static void stop_this_cpu(void *dummy)
 {
         /*
-         * Remove this CPU:
+         * Remove this CPU. Be a bit slow here and
+         * set the bits for every online CPU so we don't miss
+         * any IPI whilst taking this VPE down.
          */
+
+        cpumask_copy(&cpu_foreign_map, cpu_online_mask);
+
+        /* Make it visible to every other CPU */
+        smp_mb();
+
         set_cpu_online(smp_processor_id(), false);
+        calculate_cpu_foreign_map();
         local_irq_disable();
         while (1);
 }
@@ -197,6 +238,7 @@ void __init smp_prepare_cpus(unsigned int max_cpus)
         mp_ops->prepare_cpus(max_cpus);
         set_cpu_sibling_map(0);
         set_cpu_core_map(0);
+        calculate_cpu_foreign_map();
 #ifndef CONFIG_HOTPLUG_CPU
         init_cpu_present(cpu_possible_mask);
 #endif
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index 2a7b38ed23f0..e207a43b5f8f 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -2130,10 +2130,10 @@ void per_cpu_trap_init(bool is_boot_cpu)
         BUG_ON(current->mm);
         enter_lazy_tlb(&init_mm, current);
 
-                /* Boot CPU's cache setup in setup_arch(). */
-                if (!is_boot_cpu)
-                        cpu_cache_init();
-                tlb_init();
+        /* Boot CPU's cache setup in setup_arch(). */
+        if (!is_boot_cpu)
+                cpu_cache_init();
+        tlb_init();
         TLBMISS_HANDLER_SETUP();
 }
 
diff --git a/arch/mips/loongson64/common/bonito-irq.c b/arch/mips/loongson64/common/bonito-irq.c
index cc0e4fd548e6..4e116d23bab3 100644
--- a/arch/mips/loongson64/common/bonito-irq.c
+++ b/arch/mips/loongson64/common/bonito-irq.c
@@ -3,7 +3,7 @@
  * Author: Jun Sun, jsun@mvista.com or jsun@junsun.net
  * Copyright (C) 2000, 2001 Ralf Baechle (ralf@gnu.org)
  *
- * Copyright (C) 2007 Lemote Inc. & Insititute of Computing Technology
+ * Copyright (C) 2007 Lemote Inc. & Institute of Computing Technology
  * Author: Fuxin Zhang, zhangfx@lemote.com
  *
  *  This program is free software; you can redistribute  it and/or modify it
diff --git a/arch/mips/loongson64/common/cmdline.c b/arch/mips/loongson64/common/cmdline.c
index 72fed003a536..01fbed137028 100644
--- a/arch/mips/loongson64/common/cmdline.c
+++ b/arch/mips/loongson64/common/cmdline.c
@@ -6,7 +6,7 @@
  * Copyright 2003 ICT CAS
  * Author: Michael Guo <guoyi@ict.ac.cn>
  *
- * Copyright (C) 2007 Lemote Inc. & Insititute of Computing Technology
+ * Copyright (C) 2007 Lemote Inc. & Institute of Computing Technology
  * Author: Fuxin Zhang, zhangfx@lemote.com
  *
  * Copyright (C) 2009 Lemote Inc.
diff --git a/arch/mips/loongson64/common/cs5536/cs5536_mfgpt.c b/arch/mips/loongson64/common/cs5536/cs5536_mfgpt.c
index 12c75db23420..875037063a80 100644
--- a/arch/mips/loongson64/common/cs5536/cs5536_mfgpt.c
+++ b/arch/mips/loongson64/common/cs5536/cs5536_mfgpt.c
@@ -1,7 +1,7 @@
 /*
  * CS5536 General timer functions
  *
- * Copyright (C) 2007 Lemote Inc. & Insititute of Computing Technology
+ * Copyright (C) 2007 Lemote Inc. & Institute of Computing Technology
  * Author: Yanhua, yanh@lemote.com
  *
  * Copyright (C) 2009 Lemote Inc.
diff --git a/arch/mips/loongson64/common/env.c b/arch/mips/loongson64/common/env.c
index 22f04ca2ff3e..f6c44dd332e2 100644
--- a/arch/mips/loongson64/common/env.c
+++ b/arch/mips/loongson64/common/env.c
@@ -6,7 +6,7 @@
  * Copyright 2003 ICT CAS
  * Author: Michael Guo <guoyi@ict.ac.cn>
  *
- * Copyright (C) 2007 Lemote Inc. & Insititute of Computing Technology
+ * Copyright (C) 2007 Lemote Inc. & Institute of Computing Technology
  * Author: Fuxin Zhang, zhangfx@lemote.com
  *
  * Copyright (C) 2009 Lemote Inc.
diff --git a/arch/mips/loongson64/common/irq.c b/arch/mips/loongson64/common/irq.c
index 687003b19b45..d36d969a4a87 100644
--- a/arch/mips/loongson64/common/irq.c
+++ b/arch/mips/loongson64/common/irq.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Lemote Inc. & Insititute of Computing Technology
+ * Copyright (C) 2007 Lemote Inc. & Institute of Computing Technology
  * Author: Fuxin Zhang, zhangfx@lemote.com
  *
  *  This program is free software; you can redistribute  it and/or modify it
diff --git a/arch/mips/loongson64/common/setup.c b/arch/mips/loongson64/common/setup.c
index d477dd6bb326..2dc5122f0e09 100644
--- a/arch/mips/loongson64/common/setup.c
+++ b/arch/mips/loongson64/common/setup.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Lemote Inc. & Insititute of Computing Technology
+ * Copyright (C) 2007 Lemote Inc. & Institute of Computing Technology
  * Author: Fuxin Zhang, zhangfx@lemote.com
  *
  *  This program is free software; you can redistribute  it and/or modify it
diff --git a/arch/mips/loongson64/fuloong-2e/irq.c b/arch/mips/loongson64/fuloong-2e/irq.c
index ef5ec8f3de5f..892963f860b7 100644
--- a/arch/mips/loongson64/fuloong-2e/irq.c
+++ b/arch/mips/loongson64/fuloong-2e/irq.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Lemote Inc. & Insititute of Computing Technology
+ * Copyright (C) 2007 Lemote Inc. & Institute of Computing Technology
  * Author: Fuxin Zhang, zhangfx@lemote.com
  *
  *  This program is free software; you can redistribute  it and/or modify it
diff --git a/arch/mips/loongson64/lemote-2f/clock.c b/arch/mips/loongson64/lemote-2f/clock.c
index 462e34d46b4a..a78fb657068c 100644
--- a/arch/mips/loongson64/lemote-2f/clock.c
+++ b/arch/mips/loongson64/lemote-2f/clock.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006 - 2008 Lemote Inc. & Insititute of Computing Technology
+ * Copyright (C) 2006 - 2008 Lemote Inc. & Institute of Computing Technology
  * Author: Yanhua, yanh@lemote.com
  *
  * This file is subject to the terms and conditions of the GNU General Public
@@ -15,7 +15,7 @@
 #include <linux/spinlock.h>
 
 #include <asm/clock.h>
-#include <asm/mach-loongson/loongson.h>
+#include <asm/mach-loongson64/loongson.h>
 
 static LIST_HEAD(clock_list);
 static DEFINE_SPINLOCK(clock_lock);
diff --git a/arch/mips/loongson64/loongson-3/numa.c b/arch/mips/loongson64/loongson-3/numa.c
index 12d14ed48778..6f9e010cec4d 100644
--- a/arch/mips/loongson64/loongson-3/numa.c
+++ b/arch/mips/loongson64/loongson-3/numa.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2010 Loongson Inc. & Lemote Inc. &
- *                    Insititute of Computing Technology
+ *                    Institute of Computing Technology
  * Author:  Xiang Gao, gaoxiang@ict.ac.cn
  *          Huacai Chen, chenhc@lemote.com
  *          Xiaofu Meng, Shuangshuang Zhang
diff --git a/arch/mips/math-emu/cp1emu.c b/arch/mips/math-emu/cp1emu.c
index 22b9b2cb9219..712f17a2ecf2 100644
--- a/arch/mips/math-emu/cp1emu.c
+++ b/arch/mips/math-emu/cp1emu.c
@@ -451,7 +451,7 @@ static int isBranchInstr(struct pt_regs *regs, struct mm_decoded_insn dec_insn,
                         /* Fall through */
                 case jr_op:
                         /* For R6, JR already emulated in jalr_op */
-                        if (NO_R6EMU && insn.r_format.opcode == jr_op)
+                        if (NO_R6EMU && insn.r_format.func == jr_op)
                                 break;
                         *contpc = regs->regs[insn.r_format.rs];
                         return 1;
@@ -551,7 +551,7 @@ static int isBranchInstr(struct pt_regs *regs, struct mm_decoded_insn dec_insn,
                                 dec_insn.next_pc_inc;
                 return 1;
         case blezl_op:
-                if (NO_R6EMU)
+                if (!insn.i_format.rt && NO_R6EMU)
                         break;
         case blez_op:
 
@@ -588,7 +588,7 @@ static int isBranchInstr(struct pt_regs *regs, struct mm_decoded_insn dec_insn,
                                 dec_insn.next_pc_inc;
                 return 1;
         case bgtzl_op:
-                if (NO_R6EMU)
+                if (!insn.i_format.rt && NO_R6EMU)
                         break;
         case bgtz_op:
                 /*
diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c
index 7f660dc67596..fbea4432f3f2 100644
--- a/arch/mips/mm/c-r4k.c
+++ b/arch/mips/mm/c-r4k.c
@@ -37,6 +37,7 @@
 #include <asm/cacheflush.h> /* for run_uncached() */
 #include <asm/traps.h>
 #include <asm/dma-coherence.h>
+#include <asm/mips-cm.h>
 
 /*
  * Special Variant of smp_call_function for use by cache functions:
@@ -51,9 +52,16 @@ static inline void r4k_on_each_cpu(void (*func) (void *info), void *info)
 {
         preempt_disable();
 
-#ifndef CONFIG_MIPS_MT_SMP
-        smp_call_function(func, info, 1);
-#endif
+        /*
+         * The Coherent Manager propagates address-based cache ops to other
+         * cores but not index-based ops. However, r4k_on_each_cpu is used
+         * in both cases so there is no easy way to tell what kind of op is
+         * executed to the other cores. The best we can probably do is
+         * to restrict that call when a CM is not present because both
+         * CM-based SMP protocols (CMP & CPS) restrict index-based cache ops.
+         */
+        if (!mips_cm_present())
+                smp_call_function_many(&cpu_foreign_map, func, info, 1);
         func(info);
         preempt_enable();
 }
@@ -937,7 +945,9 @@ static void b5k_instruction_hazard(void)
 }
 
 static char *way_string[] = { NULL, "direct mapped", "2-way",
-        "3-way", "4-way", "5-way", "6-way", "7-way", "8-way"
+        "3-way", "4-way", "5-way", "6-way", "7-way", "8-way",
+        "9-way", "10-way", "11-way", "12-way",
+        "13-way", "14-way", "15-way", "16-way",
 };
 
 static void probe_pcache(void)
diff --git a/arch/mips/mti-malta/malta-time.c b/arch/mips/mti-malta/malta-time.c
index 185e68261f45..5625b190edc0 100644
--- a/arch/mips/mti-malta/malta-time.c
+++ b/arch/mips/mti-malta/malta-time.c
@@ -119,18 +119,24 @@ void read_persistent_clock(struct timespec *ts)
 
 int get_c0_fdc_int(void)
 {
-        int mips_cpu_fdc_irq;
+        /*
+         * Some cores claim the FDC is routable through the GIC, but it doesn't
+         * actually seem to be connected for those Malta bitstreams.
+         */
+        switch (current_cpu_type()) {
+        case CPU_INTERAPTIV:
+        case CPU_PROAPTIV:
+                return -1;
+        };
 
         if (cpu_has_veic)
-                mips_cpu_fdc_irq = -1;
+                return -1;
         else if (gic_present)
-                mips_cpu_fdc_irq = gic_get_c0_fdc_int();
+                return gic_get_c0_fdc_int();
         else if (cp0_fdc_irq >= 0)
-                mips_cpu_fdc_irq = MIPS_CPU_IRQ_BASE + cp0_fdc_irq;
+                return MIPS_CPU_IRQ_BASE + cp0_fdc_irq;
         else
-                mips_cpu_fdc_irq = -1;
-
-        return mips_cpu_fdc_irq;
+                return -1;
 }
 
 int get_c0_perfcount_int(void)
diff --git a/arch/mips/pistachio/init.c b/arch/mips/pistachio/init.c
index d2dc836523a3..8bd8ebb20a72 100644
--- a/arch/mips/pistachio/init.c
+++ b/arch/mips/pistachio/init.c
@@ -63,13 +63,19 @@ void __init plat_mem_setup(void)
         plat_setup_iocoherency();
 }
 
-#define DEFAULT_CPC_BASE_ADDR 0x1bde0000
+#define DEFAULT_CPC_BASE_ADDR   0x1bde0000
+#define DEFAULT_CDMM_BASE_ADDR  0x1bdd0000
 
 phys_addr_t mips_cpc_default_phys_base(void)
 {
         return DEFAULT_CPC_BASE_ADDR;
 }
 
+phys_addr_t mips_cdmm_phys_base(void)
+{
+        return DEFAULT_CDMM_BASE_ADDR;
+}
+
 static void __init mips_nmi_setup(void)
 {
         void *base;
diff --git a/arch/mips/pistachio/time.c b/arch/mips/pistachio/time.c
index 67889fcea8aa..7c73fcb92a10 100644
--- a/arch/mips/pistachio/time.c
+++ b/arch/mips/pistachio/time.c
@@ -27,6 +27,11 @@ int get_c0_perfcount_int(void)
         return gic_get_c0_perfcount_int();
 }
 
+int get_c0_fdc_int(void)
+{
+        return gic_get_c0_fdc_int();
+}
+
 void __init plat_time_init(void)
 {
         struct device_node *np;
diff --git a/arch/mips/sibyte/Kconfig b/arch/mips/sibyte/Kconfig
index a8bb972fd9fd..cb9a095f5c5e 100644
--- a/arch/mips/sibyte/Kconfig
+++ b/arch/mips/sibyte/Kconfig
@@ -81,11 +81,6 @@ choice
         prompt "SiByte SOC Stepping"
         depends on SIBYTE_SB1xxx_SOC
 
-config CPU_SB1_PASS_1
-        bool "1250 Pass1"
-        depends on SIBYTE_SB1250
-        select CPU_HAS_PREFETCH
-
 config CPU_SB1_PASS_2_1250
         bool "1250 An"
         depends on SIBYTE_SB1250
diff --git a/arch/mips/sibyte/common/bus_watcher.c b/arch/mips/sibyte/common/bus_watcher.c
index 5581844c9194..41a1d2242211 100644
--- a/arch/mips/sibyte/common/bus_watcher.c
+++ b/arch/mips/sibyte/common/bus_watcher.c
@@ -81,10 +81,7 @@ void check_bus_watcher(void)
 {
         u32 status, l2_err, memio_err;
 
-#ifdef CONFIG_SB1_PASS_1_WORKAROUNDS
-        /* Destructive read, clears register and interrupt */
-        status = csr_in32(IOADDR(A_SCD_BUS_ERR_STATUS));
-#elif defined(CONFIG_SIBYTE_BCM112X) || defined(CONFIG_SIBYTE_SB1250)
+#if defined(CONFIG_SIBYTE_BCM112X) || defined(CONFIG_SIBYTE_SB1250)
         /* Use non-destructive register */
         status = csr_in32(IOADDR(A_SCD_BUS_ERR_STATUS_DEBUG));
 #elif defined(CONFIG_SIBYTE_BCM1x55) || defined(CONFIG_SIBYTE_BCM1x80)
diff --git a/arch/mips/sibyte/sb1250/setup.c b/arch/mips/sibyte/sb1250/setup.c
index 3c02b2a77ae9..9d3c24efdf4a 100644
--- a/arch/mips/sibyte/sb1250/setup.c
+++ b/arch/mips/sibyte/sb1250/setup.c
@@ -202,12 +202,10 @@ void __init sb1250_setup(void)
 
         switch (war_pass) {
         case K_SYS_REVISION_BCM1250_PASS1:
-#ifndef CONFIG_SB1_PASS_1_WORKAROUNDS
                 printk("@@@@ This is a BCM1250 A0-A2 (Pass 1) board, "
                             "and the kernel doesn't have the proper "
                             "workarounds compiled in. @@@@\n");
                 bad_config = 1;
-#endif
                 break;
         case K_SYS_REVISION_BCM1250_PASS2:
                 /* Pass 2 - easiest as default for now - so many numbers */
diff --git a/arch/mn10300/include/asm/Kbuild b/arch/mn10300/include/asm/Kbuild
index de30b0c88796..6edb9ee6128e 100644
--- a/arch/mn10300/include/asm/Kbuild
+++ b/arch/mn10300/include/asm/Kbuild
@@ -5,6 +5,7 @@ generic-y += cputime.h
 generic-y += exec.h
 generic-y += irq_work.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += preempt.h
 generic-y += sections.h
 generic-y += trace_clock.h
diff --git a/arch/mn10300/include/asm/mm-arch-hooks.h b/arch/mn10300/include/asm/mm-arch-hooks.h
deleted file mode 100644
index e2029a652f4c..000000000000
--- a/arch/mn10300/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#ifndef _ASM_MN10300_MM_ARCH_HOOKS_H
-#define _ASM_MN10300_MM_ARCH_HOOKS_H
-
-#endif /* _ASM_MN10300_MM_ARCH_HOOKS_H */
diff --git a/arch/nios2/include/asm/Kbuild b/arch/nios2/include/asm/Kbuild
index 434639d510b3..914864eb5a25 100644
--- a/arch/nios2/include/asm/Kbuild
+++ b/arch/nios2/include/asm/Kbuild
@@ -30,6 +30,7 @@ generic-y += kmap_types.h
 generic-y += kvm_para.h
 generic-y += local.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += mman.h
 generic-y += module.h
 generic-y += msgbuf.h
diff --git a/arch/nios2/include/asm/mm-arch-hooks.h b/arch/nios2/include/asm/mm-arch-hooks.h
deleted file mode 100644
index d7290dc68558..000000000000
--- a/arch/nios2/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#ifndef _ASM_NIOS2_MM_ARCH_HOOKS_H
-#define _ASM_NIOS2_MM_ARCH_HOOKS_H
-
-#endif /* _ASM_NIOS2_MM_ARCH_HOOKS_H */
diff --git a/arch/openrisc/Kconfig b/arch/openrisc/Kconfig
index e5a693b16da2..443f44de1020 100644
--- a/arch/openrisc/Kconfig
+++ b/arch/openrisc/Kconfig
@@ -17,6 +17,7 @@ config OPENRISC
         select GENERIC_IRQ_SHOW
         select GENERIC_IOMAP
         select GENERIC_CPU_DEVICES
+        select HAVE_UID16
         select GENERIC_ATOMIC64
         select GENERIC_CLOCKEVENTS
         select GENERIC_STRNCPY_FROM_USER
@@ -31,9 +32,6 @@ config MMU
 config HAVE_DMA_ATTRS
         def_bool y
 
-config UID16
-        def_bool y
-
 config RWSEM_GENERIC_SPINLOCK
         def_bool y
 
diff --git a/arch/openrisc/include/asm/Kbuild b/arch/openrisc/include/asm/Kbuild
index 2a2e39b8109a..2832f031fb11 100644
--- a/arch/openrisc/include/asm/Kbuild
+++ b/arch/openrisc/include/asm/Kbuild
@@ -36,6 +36,7 @@ generic-y += kmap_types.h
 generic-y += kvm_para.h
 generic-y += local.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += mman.h
 generic-y += module.h
 generic-y += msgbuf.h
diff --git a/arch/openrisc/include/asm/mm-arch-hooks.h b/arch/openrisc/include/asm/mm-arch-hooks.h
deleted file mode 100644
index 6d33cb555fe1..000000000000
--- a/arch/openrisc/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#ifndef _ASM_OPENRISC_MM_ARCH_HOOKS_H
-#define _ASM_OPENRISC_MM_ARCH_HOOKS_H
-
-#endif /* _ASM_OPENRISC_MM_ARCH_HOOKS_H */
diff --git a/arch/parisc/include/asm/Kbuild b/arch/parisc/include/asm/Kbuild
index 12b341d04f88..f9b3a81aefcd 100644
--- a/arch/parisc/include/asm/Kbuild
+++ b/arch/parisc/include/asm/Kbuild
@@ -15,6 +15,7 @@ generic-y += kvm_para.h
 generic-y += local.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += mutex.h
 generic-y += param.h
 generic-y += percpu.h
diff --git a/arch/parisc/include/asm/mm-arch-hooks.h b/arch/parisc/include/asm/mm-arch-hooks.h
deleted file mode 100644
index 654ec63b0ee9..000000000000
--- a/arch/parisc/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#ifndef _ASM_PARISC_MM_ARCH_HOOKS_H
-#define _ASM_PARISC_MM_ARCH_HOOKS_H
-
-#endif /* _ASM_PARISC_MM_ARCH_HOOKS_H */
diff --git a/arch/parisc/include/asm/pgalloc.h b/arch/parisc/include/asm/pgalloc.h
index 3a08eae3318f..3edbb9fc91b4 100644
--- a/arch/parisc/include/asm/pgalloc.h
+++ b/arch/parisc/include/asm/pgalloc.h
@@ -72,7 +72,7 @@ static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long address)
 
 static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
 {
-        if(pmd_flag(*pmd) & PxD_FLAG_ATTACHED)
+        if (pmd_flag(*pmd) & PxD_FLAG_ATTACHED) {
                 /*
                  * This is the permanent pmd attached to the pgd;
                  * cannot free it.
@@ -81,6 +81,7 @@ static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
                  */
                 mm_inc_nr_pmds(mm);
                 return;
+        }
         free_pages((unsigned long)pmd, PMD_ORDER);
 }
 
diff --git a/arch/parisc/include/asm/pgtable.h b/arch/parisc/include/asm/pgtable.h
index 0a183756d6ec..f93c4a4e6580 100644
--- a/arch/parisc/include/asm/pgtable.h
+++ b/arch/parisc/include/asm/pgtable.h
@@ -16,7 +16,7 @@
 #include <asm/processor.h>
 #include <asm/cache.h>
 
-extern spinlock_t pa_dbit_lock;
+extern spinlock_t pa_tlb_lock;
 
 /*
  * kern_addr_valid(ADDR) tests if ADDR is pointing to valid kernel
@@ -33,6 +33,19 @@ extern spinlock_t pa_dbit_lock;
  */
 #define kern_addr_valid(addr)   (1)
 
+/* Purge data and instruction TLB entries.  Must be called holding
+ * the pa_tlb_lock.  The TLB purge instructions are slow on SMP
+ * machines since the purge must be broadcast to all CPUs.
+ */
+
+static inline void purge_tlb_entries(struct mm_struct *mm, unsigned long addr)
+{
+        mtsp(mm->context, 1);
+        pdtlb(addr);
+        if (unlikely(split_tlb))
+                pitlb(addr);
+}
+
 /* Certain architectures need to do special things when PTEs
  * within a page table are directly modified.  Thus, the following
  * hook is made available.
@@ -42,15 +55,20 @@ extern spinlock_t pa_dbit_lock;
                 *(pteptr) = (pteval);                           \
         } while(0)
 
-extern void purge_tlb_entries(struct mm_struct *, unsigned long);
+#define pte_inserted(x)                                         \
+        ((pte_val(x) & (_PAGE_PRESENT|_PAGE_ACCESSED))          \
+         == (_PAGE_PRESENT|_PAGE_ACCESSED))
 
-#define set_pte_at(mm, addr, ptep, pteval)                      \
-        do {                                                    \
+#define set_pte_at(mm, addr, ptep, pteval)                      \
+        do {                                                    \
+                pte_t old_pte;                                  \
                 unsigned long flags;                            \
-                spin_lock_irqsave(&pa_dbit_lock, flags);        \
-                set_pte(ptep, pteval);                          \
-                purge_tlb_entries(mm, addr);                    \
-                spin_unlock_irqrestore(&pa_dbit_lock, flags);   \
+                spin_lock_irqsave(&pa_tlb_lock, flags);         \
+                old_pte = *ptep;                                \
+                set_pte(ptep, pteval);                          \
+                if (pte_inserted(old_pte))                      \
+                        purge_tlb_entries(mm, addr);            \
+                spin_unlock_irqrestore(&pa_tlb_lock, flags);    \
         } while (0)
 
 #endif /* !__ASSEMBLY__ */
@@ -268,7 +286,7 @@ extern unsigned long *empty_zero_page;
 
 #define pte_none(x)     (pte_val(x) == 0)
 #define pte_present(x)  (pte_val(x) & _PAGE_PRESENT)
-#define pte_clear(mm,addr,xp)   do { pte_val(*(xp)) = 0; } while (0)
+#define pte_clear(mm, addr, xp)  set_pte_at(mm, addr, xp, __pte(0))
 
 #define pmd_flag(x)     (pmd_val(x) & PxD_FLAG_MASK)
 #define pmd_address(x)  ((unsigned long)(pmd_val(x) &~ PxD_FLAG_MASK) << PxD_VALUE_SHIFT)
@@ -435,15 +453,15 @@ static inline int ptep_test_and_clear_young(struct vm_area_struct *vma, unsigned
         if (!pte_young(*ptep))
                 return 0;
 
-        spin_lock_irqsave(&pa_dbit_lock, flags);
+        spin_lock_irqsave(&pa_tlb_lock, flags);
         pte = *ptep;
         if (!pte_young(pte)) {
-                spin_unlock_irqrestore(&pa_dbit_lock, flags);
+                spin_unlock_irqrestore(&pa_tlb_lock, flags);
                 return 0;
         }
         set_pte(ptep, pte_mkold(pte));
         purge_tlb_entries(vma->vm_mm, addr);
-        spin_unlock_irqrestore(&pa_dbit_lock, flags);
+        spin_unlock_irqrestore(&pa_tlb_lock, flags);
         return 1;
 }
 
@@ -453,11 +471,12 @@ static inline pte_t ptep_get_and_clear(struct mm_struct *mm, unsigned long addr,
         pte_t old_pte;
         unsigned long flags;
 
-        spin_lock_irqsave(&pa_dbit_lock, flags);
+        spin_lock_irqsave(&pa_tlb_lock, flags);
         old_pte = *ptep;
-        pte_clear(mm,addr,ptep);
-        purge_tlb_entries(mm, addr);
-        spin_unlock_irqrestore(&pa_dbit_lock, flags);
+        set_pte(ptep, __pte(0));
+        if (pte_inserted(old_pte))
+                purge_tlb_entries(mm, addr);
+        spin_unlock_irqrestore(&pa_tlb_lock, flags);
 
         return old_pte;
 }
@@ -465,10 +484,10 @@ static inline pte_t ptep_get_and_clear(struct mm_struct *mm, unsigned long addr,
 static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
 {
         unsigned long flags;
-        spin_lock_irqsave(&pa_dbit_lock, flags);
+        spin_lock_irqsave(&pa_tlb_lock, flags);
         set_pte(ptep, pte_wrprotect(*ptep));
         purge_tlb_entries(mm, addr);
-        spin_unlock_irqrestore(&pa_dbit_lock, flags);
+        spin_unlock_irqrestore(&pa_tlb_lock, flags);
 }
 
 #define pte_same(A,B)   (pte_val(A) == pte_val(B))
diff --git a/arch/parisc/include/asm/tlbflush.h b/arch/parisc/include/asm/tlbflush.h
index 9d086a599fa0..e84b96478193 100644
--- a/arch/parisc/include/asm/tlbflush.h
+++ b/arch/parisc/include/asm/tlbflush.h
@@ -13,6 +13,9 @@
  * active at any one time on the Merced bus.  This tlb purge
  * synchronisation is fairly lightweight and harmless so we activate
  * it on all systems not just the N class.
+
+ * It is also used to ensure PTE updates are atomic and consistent
+ * with the TLB.
  */
 extern spinlock_t pa_tlb_lock;
 
@@ -24,20 +27,24 @@ extern void flush_tlb_all_local(void *);
 
 #define smp_flush_tlb_all()     flush_tlb_all()
 
+int __flush_tlb_range(unsigned long sid,
+        unsigned long start, unsigned long end);
+
+#define flush_tlb_range(vma, start, end) \
+        __flush_tlb_range((vma)->vm_mm->context, start, end)
+
+#define flush_tlb_kernel_range(start, end) \
+        __flush_tlb_range(0, start, end)
+
 /*
  * flush_tlb_mm()
  *
- * XXX This code is NOT valid for HP-UX compatibility processes,
- * (although it will probably work 99% of the time). HP-UX
- * processes are free to play with the space id's and save them
- * over long periods of time, etc. so we have to preserve the
- * space and just flush the entire tlb. We need to check the
- * personality in order to do that, but the personality is not
- * currently being set correctly.
- *
- * Of course, Linux processes could do the same thing, but
- * we don't support that (and the compilers, dynamic linker,
- * etc. do not do that).
+ * The code to switch to a new context is NOT valid for processes
+ * which play with the space id's.  Thus, we have to preserve the
+ * space and just flush the entire tlb.  However, the compilers,
+ * dynamic linker, etc, do not manipulate space id's, so there
+ * could be a significant performance benefit in switching contexts
+ * and not flushing the whole tlb.
  */
 
 static inline void flush_tlb_mm(struct mm_struct *mm)
@@ -45,10 +52,18 @@ static inline void flush_tlb_mm(struct mm_struct *mm)
         BUG_ON(mm == &init_mm); /* Should never happen */
 
 #if 1 || defined(CONFIG_SMP)
+        /* Except for very small threads, flushing the whole TLB is
+         * faster than using __flush_tlb_range.  The pdtlb and pitlb
+         * instructions are very slow because of the TLB broadcast.
+         * It might be faster to do local range flushes on all CPUs
+         * on PA 2.0 systems.
+         */
         flush_tlb_all();
 #else
         /* FIXME: currently broken, causing space id and protection ids
-         *  to go out of sync, resulting in faults on userspace accesses.
+         * to go out of sync, resulting in faults on userspace accesses.
+         * This approach needs further investigation since running many
+         * small applications (e.g., GCC testsuite) is faster on HP-UX.
          */
         if (mm) {
                 if (mm->context != 0)
@@ -65,22 +80,12 @@ static inline void flush_tlb_page(struct vm_area_struct *vma,
 {
         unsigned long flags, sid;
 
-        /* For one page, it's not worth testing the split_tlb variable */
-
-        mb();
         sid = vma->vm_mm->context;
         purge_tlb_start(flags);
         mtsp(sid, 1);
         pdtlb(addr);
-        pitlb(addr);
+        if (unlikely(split_tlb))
+                pitlb(addr);
         purge_tlb_end(flags);
 }
-
-void __flush_tlb_range(unsigned long sid,
-        unsigned long start, unsigned long end);
-
-#define flush_tlb_range(vma,start,end) __flush_tlb_range((vma)->vm_mm->context,start,end)
-
-#define flush_tlb_kernel_range(start, end) __flush_tlb_range(0,start,end)
-
 #endif
diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c
index f6448c7c62b5..cda6dbbe9842 100644
--- a/arch/parisc/kernel/cache.c
+++ b/arch/parisc/kernel/cache.c
@@ -342,12 +342,15 @@ EXPORT_SYMBOL(flush_data_cache_local);
 EXPORT_SYMBOL(flush_kernel_icache_range_asm);
 
 #define FLUSH_THRESHOLD 0x80000 /* 0.5MB */
-int parisc_cache_flush_threshold __read_mostly = FLUSH_THRESHOLD;
+static unsigned long parisc_cache_flush_threshold __read_mostly = FLUSH_THRESHOLD;
+
+#define FLUSH_TLB_THRESHOLD (2*1024*1024) /* 2MB initial TLB threshold */
+static unsigned long parisc_tlb_flush_threshold __read_mostly = FLUSH_TLB_THRESHOLD;
 
 void __init parisc_setup_cache_timing(void)
 {
         unsigned long rangetime, alltime;
-        unsigned long size;
+        unsigned long size, start;
 
         alltime = mfctl(16);
         flush_data_cache();
@@ -364,14 +367,43 @@ void __init parisc_setup_cache_timing(void)
         /* Racy, but if we see an intermediate value, it's ok too... */
         parisc_cache_flush_threshold = size * alltime / rangetime;
 
-        parisc_cache_flush_threshold = (parisc_cache_flush_threshold + L1_CACHE_BYTES - 1) &~ (L1_CACHE_BYTES - 1); 
+        parisc_cache_flush_threshold = L1_CACHE_ALIGN(parisc_cache_flush_threshold);
         if (!parisc_cache_flush_threshold)
                 parisc_cache_flush_threshold = FLUSH_THRESHOLD;
 
         if (parisc_cache_flush_threshold > cache_info.dc_size)
                 parisc_cache_flush_threshold = cache_info.dc_size;
 
-        printk(KERN_INFO "Setting cache flush threshold to %x (%d CPUs online)\n", parisc_cache_flush_threshold, num_online_cpus());
+        printk(KERN_INFO "Setting cache flush threshold to %lu kB\n",
+                parisc_cache_flush_threshold/1024);
+
+        /* calculate TLB flush threshold */
+
+        alltime = mfctl(16);
+        flush_tlb_all();
+        alltime = mfctl(16) - alltime;
+
+        size = PAGE_SIZE;
+        start = (unsigned long) _text;
+        rangetime = mfctl(16);
+        while (start < (unsigned long) _end) {
+                flush_tlb_kernel_range(start, start + PAGE_SIZE);
+                start += PAGE_SIZE;
+                size += PAGE_SIZE;
+        }
+        rangetime = mfctl(16) - rangetime;
+
+        printk(KERN_DEBUG "Whole TLB flush %lu cycles, flushing %lu bytes %lu cycles\n",
+                alltime, size, rangetime);
+
+        parisc_tlb_flush_threshold = size * alltime / rangetime;
+        parisc_tlb_flush_threshold *= num_online_cpus();
+        parisc_tlb_flush_threshold = PAGE_ALIGN(parisc_tlb_flush_threshold);
+        if (!parisc_tlb_flush_threshold)
+                parisc_tlb_flush_threshold = FLUSH_TLB_THRESHOLD;
+
+        printk(KERN_INFO "Setting TLB flush threshold to %lu kB\n",
+                parisc_tlb_flush_threshold/1024);
 }
 
 extern void purge_kernel_dcache_page_asm(unsigned long);
@@ -403,48 +435,45 @@ void copy_user_page(void *vto, void *vfrom, unsigned long vaddr,
 }
 EXPORT_SYMBOL(copy_user_page);
 
-void purge_tlb_entries(struct mm_struct *mm, unsigned long addr)
-{
-        unsigned long flags;
-
-        /* Note: purge_tlb_entries can be called at startup with
-           no context.  */
-
-        purge_tlb_start(flags);
-        mtsp(mm->context, 1);
-        pdtlb(addr);
-        pitlb(addr);
-        purge_tlb_end(flags);
-}
-EXPORT_SYMBOL(purge_tlb_entries);
-
-void __flush_tlb_range(unsigned long sid, unsigned long start,
-                       unsigned long end)
+/* __flush_tlb_range()
+ *
+ * returns 1 if all TLBs were flushed.
+ */
+int __flush_tlb_range(unsigned long sid, unsigned long start,
+                      unsigned long end)
 {
-        unsigned long npages;
+        unsigned long flags, size;
 
-        npages = ((end - (start & PAGE_MASK)) + (PAGE_SIZE - 1)) >> PAGE_SHIFT;
-        if (npages >= 512)  /* 2MB of space: arbitrary, should be tuned */
+        size = (end - start);
+        if (size >= parisc_tlb_flush_threshold) {
                 flush_tlb_all();
-        else {
-                unsigned long flags;
+                return 1;
+        }
 
+        /* Purge TLB entries for small ranges using the pdtlb and
+           pitlb instructions.  These instructions execute locally
+           but cause a purge request to be broadcast to other TLBs.  */
+        if (likely(!split_tlb)) {
+                while (start < end) {
+                        purge_tlb_start(flags);
+                        mtsp(sid, 1);
+                        pdtlb(start);
+                        purge_tlb_end(flags);
+                        start += PAGE_SIZE;
+                }
+                return 0;
+        }
+
+        /* split TLB case */
+        while (start < end) {
                 purge_tlb_start(flags);
                 mtsp(sid, 1);
-                if (split_tlb) {
-                        while (npages--) {
-                                pdtlb(start);
-                                pitlb(start);
-                                start += PAGE_SIZE;
-                        }
-                } else {
-                        while (npages--) {
-                                pdtlb(start);
-                                start += PAGE_SIZE;
-                        }
-                }
+                pdtlb(start);
+                pitlb(start);
                 purge_tlb_end(flags);
+                start += PAGE_SIZE;
         }
+        return 0;
 }
 
 static void cacheflush_h_tmp_function(void *dummy)
diff --git a/arch/parisc/kernel/entry.S b/arch/parisc/kernel/entry.S
index 75819617f93b..c5ef4081b01d 100644
--- a/arch/parisc/kernel/entry.S
+++ b/arch/parisc/kernel/entry.S
@@ -45,7 +45,7 @@
         .level 2.0
 #endif
 
-        .import         pa_dbit_lock,data
+        .import         pa_tlb_lock,data
 
         /* space_to_prot macro creates a prot id from a space id */
 
@@ -420,8 +420,8 @@
         SHLREG          %r9,PxD_VALUE_SHIFT,\pmd
         extru           \va,31-PAGE_SHIFT,ASM_BITS_PER_PTE,\index
         dep             %r0,31,PAGE_SHIFT,\pmd  /* clear offset */
-        shladd          \index,BITS_PER_PTE_ENTRY,\pmd,\pmd
-        LDREG           %r0(\pmd),\pte          /* pmd is now pte */
+        shladd          \index,BITS_PER_PTE_ENTRY,\pmd,\pmd /* pmd is now pte */
+        LDREG           %r0(\pmd),\pte
         bb,>=,n         \pte,_PAGE_PRESENT_BIT,\fault
         .endm
 
@@ -453,57 +453,53 @@
         L2_ptep         \pgd,\pte,\index,\va,\fault
         .endm
 
-        /* Acquire pa_dbit_lock lock. */
-        .macro          dbit_lock       spc,tmp,tmp1
+        /* Acquire pa_tlb_lock lock and recheck page is still present. */
+        .macro          tlb_lock        spc,ptp,pte,tmp,tmp1,fault
 #ifdef CONFIG_SMP
         cmpib,COND(=),n 0,\spc,2f
-        load32          PA(pa_dbit_lock),\tmp
+        load32          PA(pa_tlb_lock),\tmp
 1:      LDCW            0(\tmp),\tmp1
         cmpib,COND(=)   0,\tmp1,1b
         nop
+        LDREG           0(\ptp),\pte
+        bb,<,n          \pte,_PAGE_PRESENT_BIT,2f
+        b               \fault
+        stw              \spc,0(\tmp)
 2:
 #endif
         .endm
 
-        /* Release pa_dbit_lock lock without reloading lock address. */
-        .macro          dbit_unlock0    spc,tmp
+        /* Release pa_tlb_lock lock without reloading lock address. */
+        .macro          tlb_unlock0     spc,tmp
 #ifdef CONFIG_SMP
         or,COND(=)      %r0,\spc,%r0
         stw             \spc,0(\tmp)
 #endif
         .endm
 
-        /* Release pa_dbit_lock lock. */
-        .macro          dbit_unlock1    spc,tmp
+        /* Release pa_tlb_lock lock. */
+        .macro          tlb_unlock1     spc,tmp
 #ifdef CONFIG_SMP
-        load32          PA(pa_dbit_lock),\tmp
-        dbit_unlock0    \spc,\tmp
+        load32          PA(pa_tlb_lock),\tmp
+        tlb_unlock0     \spc,\tmp
 #endif
         .endm
 
         /* Set the _PAGE_ACCESSED bit of the PTE.  Be clever and
          * don't needlessly dirty the cache line if it was already set */
-        .macro          update_ptep     spc,ptep,pte,tmp,tmp1
-#ifdef CONFIG_SMP
-        or,COND(=)      %r0,\spc,%r0
-        LDREG           0(\ptep),\pte
-#endif
+        .macro          update_accessed ptp,pte,tmp,tmp1
         ldi             _PAGE_ACCESSED,\tmp1
         or              \tmp1,\pte,\tmp
         and,COND(<>)    \tmp1,\pte,%r0
-        STREG           \tmp,0(\ptep)
+        STREG           \tmp,0(\ptp)
         .endm
 
         /* Set the dirty bit (and accessed bit).  No need to be
          * clever, this is only used from the dirty fault */
-        .macro          update_dirty    spc,ptep,pte,tmp
-#ifdef CONFIG_SMP
-        or,COND(=)      %r0,\spc,%r0
-        LDREG           0(\ptep),\pte
-#endif
+        .macro          update_dirty    ptp,pte,tmp
         ldi             _PAGE_ACCESSED|_PAGE_DIRTY,\tmp
         or              \tmp,\pte,\pte
-        STREG           \pte,0(\ptep)
+        STREG           \pte,0(\ptp)
         .endm
 
         /* bitshift difference between a PFN (based on kernel's PAGE_SIZE)
@@ -1148,14 +1144,14 @@ dtlb_miss_20w:
 
         L3_ptep         ptp,pte,t0,va,dtlb_check_alias_20w
 
-        dbit_lock       spc,t0,t1
-        update_ptep     spc,ptp,pte,t0,t1
+        tlb_lock        spc,ptp,pte,t0,t1,dtlb_check_alias_20w
+        update_accessed ptp,pte,t0,t1
 
         make_insert_tlb spc,pte,prot
         
         idtlbt          pte,prot
-        dbit_unlock1    spc,t0
 
+        tlb_unlock1     spc,t0
         rfir
         nop
 
@@ -1174,14 +1170,14 @@ nadtlb_miss_20w:
 
         L3_ptep         ptp,pte,t0,va,nadtlb_check_alias_20w
 
-        dbit_lock       spc,t0,t1
-        update_ptep     spc,ptp,pte,t0,t1
+        tlb_lock        spc,ptp,pte,t0,t1,nadtlb_check_alias_20w
+        update_accessed ptp,pte,t0,t1
 
         make_insert_tlb spc,pte,prot
 
         idtlbt          pte,prot
-        dbit_unlock1    spc,t0
 
+        tlb_unlock1     spc,t0
         rfir
         nop
 
@@ -1202,20 +1198,20 @@ dtlb_miss_11:
 
         L2_ptep         ptp,pte,t0,va,dtlb_check_alias_11
 
-        dbit_lock       spc,t0,t1
-        update_ptep     spc,ptp,pte,t0,t1
+        tlb_lock        spc,ptp,pte,t0,t1,dtlb_check_alias_11
+        update_accessed ptp,pte,t0,t1
 
         make_insert_tlb_11      spc,pte,prot
 
-        mfsp            %sr1,t0  /* Save sr1 so we can use it in tlb inserts */
+        mfsp            %sr1,t1  /* Save sr1 so we can use it in tlb inserts */
         mtsp            spc,%sr1
 
         idtlba          pte,(%sr1,va)
         idtlbp          prot,(%sr1,va)
 
-        mtsp            t0, %sr1        /* Restore sr1 */
-        dbit_unlock1    spc,t0
+        mtsp            t1, %sr1        /* Restore sr1 */
 
+        tlb_unlock1     spc,t0
         rfir
         nop
 
@@ -1235,21 +1231,20 @@ nadtlb_miss_11:
 
         L2_ptep         ptp,pte,t0,va,nadtlb_check_alias_11
 
-        dbit_lock       spc,t0,t1
-        update_ptep     spc,ptp,pte,t0,t1
+        tlb_lock        spc,ptp,pte,t0,t1,nadtlb_check_alias_11
+        update_accessed ptp,pte,t0,t1
 
         make_insert_tlb_11      spc,pte,prot
 
-
-        mfsp            %sr1,t0  /* Save sr1 so we can use it in tlb inserts */
+        mfsp            %sr1,t1  /* Save sr1 so we can use it in tlb inserts */
         mtsp            spc,%sr1
 
         idtlba          pte,(%sr1,va)
         idtlbp          prot,(%sr1,va)
 
-        mtsp            t0, %sr1        /* Restore sr1 */
-        dbit_unlock1    spc,t0
+        mtsp            t1, %sr1        /* Restore sr1 */
 
+        tlb_unlock1     spc,t0
         rfir
         nop
 
@@ -1269,16 +1264,16 @@ dtlb_miss_20:
 
         L2_ptep         ptp,pte,t0,va,dtlb_check_alias_20
 
-        dbit_lock       spc,t0,t1
-        update_ptep     spc,ptp,pte,t0,t1
+        tlb_lock        spc,ptp,pte,t0,t1,dtlb_check_alias_20
+        update_accessed ptp,pte,t0,t1
 
         make_insert_tlb spc,pte,prot
 
-        f_extend        pte,t0
+        f_extend        pte,t1
 
         idtlbt          pte,prot
-        dbit_unlock1    spc,t0
 
+        tlb_unlock1     spc,t0
         rfir
         nop
 
@@ -1297,16 +1292,16 @@ nadtlb_miss_20:
 
         L2_ptep         ptp,pte,t0,va,nadtlb_check_alias_20
 
-        dbit_lock       spc,t0,t1
-        update_ptep     spc,ptp,pte,t0,t1
+        tlb_lock        spc,ptp,pte,t0,t1,nadtlb_check_alias_20
+        update_accessed ptp,pte,t0,t1
 
         make_insert_tlb spc,pte,prot
 
-        f_extend        pte,t0
+        f_extend        pte,t1
         
-        idtlbt          pte,prot
-        dbit_unlock1    spc,t0
+        idtlbt          pte,prot
 
+        tlb_unlock1     spc,t0
         rfir
         nop
 
@@ -1406,14 +1401,14 @@ itlb_miss_20w:
 
         L3_ptep         ptp,pte,t0,va,itlb_fault
 
-        dbit_lock       spc,t0,t1
-        update_ptep     spc,ptp,pte,t0,t1
+        tlb_lock        spc,ptp,pte,t0,t1,itlb_fault
+        update_accessed ptp,pte,t0,t1
 
         make_insert_tlb spc,pte,prot
         
         iitlbt          pte,prot
-        dbit_unlock1    spc,t0
 
+        tlb_unlock1     spc,t0
         rfir
         nop
 
@@ -1430,14 +1425,14 @@ naitlb_miss_20w:
 
         L3_ptep         ptp,pte,t0,va,naitlb_check_alias_20w
 
-        dbit_lock       spc,t0,t1
-        update_ptep     spc,ptp,pte,t0,t1
+        tlb_lock        spc,ptp,pte,t0,t1,naitlb_check_alias_20w
+        update_accessed ptp,pte,t0,t1
 
         make_insert_tlb spc,pte,prot
 
         iitlbt          pte,prot
-        dbit_unlock1    spc,t0
 
+        tlb_unlock1     spc,t0
         rfir
         nop
 
@@ -1458,20 +1453,20 @@ itlb_miss_11:
 
         L2_ptep         ptp,pte,t0,va,itlb_fault
 
-        dbit_lock       spc,t0,t1
-        update_ptep     spc,ptp,pte,t0,t1
+        tlb_lock        spc,ptp,pte,t0,t1,itlb_fault
+        update_accessed ptp,pte,t0,t1
 
         make_insert_tlb_11      spc,pte,prot
 
-        mfsp            %sr1,t0  /* Save sr1 so we can use it in tlb inserts */
+        mfsp            %sr1,t1  /* Save sr1 so we can use it in tlb inserts */
         mtsp            spc,%sr1
 
         iitlba          pte,(%sr1,va)
         iitlbp          prot,(%sr1,va)
 
-        mtsp            t0, %sr1        /* Restore sr1 */
-        dbit_unlock1    spc,t0
+        mtsp            t1, %sr1        /* Restore sr1 */
 
+        tlb_unlock1     spc,t0
         rfir
         nop
 
@@ -1482,20 +1477,20 @@ naitlb_miss_11:
 
         L2_ptep         ptp,pte,t0,va,naitlb_check_alias_11
 
-        dbit_lock       spc,t0,t1
-        update_ptep     spc,ptp,pte,t0,t1
+        tlb_lock        spc,ptp,pte,t0,t1,naitlb_check_alias_11
+        update_accessed ptp,pte,t0,t1
 
         make_insert_tlb_11      spc,pte,prot
 
-        mfsp            %sr1,t0  /* Save sr1 so we can use it in tlb inserts */
+        mfsp            %sr1,t1  /* Save sr1 so we can use it in tlb inserts */
         mtsp            spc,%sr1
 
         iitlba          pte,(%sr1,va)
         iitlbp          prot,(%sr1,va)
 
-        mtsp            t0, %sr1        /* Restore sr1 */
-        dbit_unlock1    spc,t0
+        mtsp            t1, %sr1        /* Restore sr1 */
 
+        tlb_unlock1     spc,t0
         rfir
         nop
 
@@ -1516,16 +1511,16 @@ itlb_miss_20:
 
         L2_ptep         ptp,pte,t0,va,itlb_fault
 
-        dbit_lock       spc,t0,t1
-        update_ptep     spc,ptp,pte,t0,t1
+        tlb_lock        spc,ptp,pte,t0,t1,itlb_fault
+        update_accessed ptp,pte,t0,t1
 
         make_insert_tlb spc,pte,prot
 
-        f_extend        pte,t0  
+        f_extend        pte,t1
 
         iitlbt          pte,prot
-        dbit_unlock1    spc,t0
 
+        tlb_unlock1     spc,t0
         rfir
         nop
 
@@ -1536,16 +1531,16 @@ naitlb_miss_20:
 
         L2_ptep         ptp,pte,t0,va,naitlb_check_alias_20
 
-        dbit_lock       spc,t0,t1
-        update_ptep     spc,ptp,pte,t0,t1
+        tlb_lock        spc,ptp,pte,t0,t1,naitlb_check_alias_20
+        update_accessed ptp,pte,t0,t1
 
         make_insert_tlb spc,pte,prot
 
-        f_extend        pte,t0
+        f_extend        pte,t1
 
         iitlbt          pte,prot
-        dbit_unlock1    spc,t0
 
+        tlb_unlock1     spc,t0
         rfir
         nop
 
@@ -1568,14 +1563,14 @@ dbit_trap_20w:
 
         L3_ptep         ptp,pte,t0,va,dbit_fault
 
-        dbit_lock       spc,t0,t1
-        update_dirty    spc,ptp,pte,t1
+        tlb_lock        spc,ptp,pte,t0,t1,dbit_fault
+        update_dirty    ptp,pte,t1
 
         make_insert_tlb spc,pte,prot
                 
         idtlbt          pte,prot
-        dbit_unlock0    spc,t0
 
+        tlb_unlock0     spc,t0
         rfir
         nop
 #else
@@ -1588,8 +1583,8 @@ dbit_trap_11:
 
         L2_ptep         ptp,pte,t0,va,dbit_fault
 
-        dbit_lock       spc,t0,t1
-        update_dirty    spc,ptp,pte,t1
+        tlb_lock        spc,ptp,pte,t0,t1,dbit_fault
+        update_dirty    ptp,pte,t1
 
         make_insert_tlb_11      spc,pte,prot
 
@@ -1600,8 +1595,8 @@ dbit_trap_11:
         idtlbp          prot,(%sr1,va)
 
         mtsp            t1, %sr1     /* Restore sr1 */
-        dbit_unlock0    spc,t0
 
+        tlb_unlock0     spc,t0
         rfir
         nop
 
@@ -1612,16 +1607,16 @@ dbit_trap_20:
 
         L2_ptep         ptp,pte,t0,va,dbit_fault
 
-        dbit_lock       spc,t0,t1
-        update_dirty    spc,ptp,pte,t1
+        tlb_lock        spc,ptp,pte,t0,t1,dbit_fault
+        update_dirty    ptp,pte,t1
 
         make_insert_tlb spc,pte,prot
 
         f_extend        pte,t1
         
-        idtlbt          pte,prot
-        dbit_unlock0    spc,t0
+        idtlbt          pte,prot
 
+        tlb_unlock0     spc,t0
         rfir
         nop
 #endif
diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c
index 6548fd1d2e62..b99b39f1da02 100644
--- a/arch/parisc/kernel/traps.c
+++ b/arch/parisc/kernel/traps.c
@@ -43,10 +43,6 @@
 
 #include "../math-emu/math-emu.h"       /* for handle_fpe() */
 
-#if defined(CONFIG_SMP) || defined(CONFIG_DEBUG_SPINLOCK)
-DEFINE_SPINLOCK(pa_dbit_lock);
-#endif
-
 static void parisc_show_stack(struct task_struct *task, unsigned long *sp,
         struct pt_regs *regs);
 
diff --git a/arch/powerpc/kernel/idle_power7.S b/arch/powerpc/kernel/idle_power7.S
index ccde8f084ce4..112ccf497562 100644
--- a/arch/powerpc/kernel/idle_power7.S
+++ b/arch/powerpc/kernel/idle_power7.S
@@ -52,6 +52,22 @@
         .text
 
 /*
+ * Used by threads when the lock bit of core_idle_state is set.
+ * Threads will spin in HMT_LOW until the lock bit is cleared.
+ * r14 - pointer to core_idle_state
+ * r15 - used to load contents of core_idle_state
+ */
+
+core_idle_lock_held:
+        HMT_LOW
+3:      lwz     r15,0(r14)
+        andi.   r15,r15,PNV_CORE_IDLE_LOCK_BIT
+        bne     3b
+        HMT_MEDIUM
+        lwarx   r15,0,r14
+        blr
+
+/*
  * Pass requested state in r3:
  *      r3 - PNV_THREAD_NAP/SLEEP/WINKLE
  *
@@ -150,6 +166,10 @@ power7_enter_nap_mode:
         ld      r14,PACA_CORE_IDLE_STATE_PTR(r13)
 lwarx_loop1:
         lwarx   r15,0,r14
+
+        andi.   r9,r15,PNV_CORE_IDLE_LOCK_BIT
+        bnel    core_idle_lock_held
+
         andc    r15,r15,r7                      /* Clear thread bit */
 
         andi.   r15,r15,PNV_CORE_IDLE_THREAD_BITS
@@ -294,7 +314,7 @@ lwarx_loop2:
          * workaround undo code or resyncing timebase or restoring context
          * In either case loop until the lock bit is cleared.
          */
-        bne     core_idle_lock_held
+        bnel    core_idle_lock_held
 
         cmpwi   cr2,r15,0
         lbz     r4,PACA_SUBCORE_SIBLING_MASK(r13)
@@ -319,15 +339,6 @@ lwarx_loop2:
         isync
         b       common_exit
 
-core_idle_lock_held:
-        HMT_LOW
-core_idle_lock_loop:
-        lwz     r15,0(14)
-        andi.   r9,r15,PNV_CORE_IDLE_LOCK_BIT
-        bne     core_idle_lock_loop
-        HMT_MEDIUM
-        b       lwarx_loop2
-
 first_thread_in_subcore:
         /* First thread in subcore to wakeup */
         ori     r15,r15,PNV_CORE_IDLE_LOCK_BIT
diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
index 6530f1b8874d..37de90f8a845 100644
--- a/arch/powerpc/kernel/traps.c
+++ b/arch/powerpc/kernel/traps.c
@@ -297,6 +297,8 @@ long machine_check_early(struct pt_regs *regs)
 
         __this_cpu_inc(irq_stat.mce_exceptions);
 
+        add_taint(TAINT_MACHINE_CHECK, LOCKDEP_NOW_UNRELIABLE);
+
         if (cur_cpu_spec && cur_cpu_spec->machine_check_early)
                 handled = cur_cpu_spec->machine_check_early(regs);
         return handled;
diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
index 6d535973b200..a67c6d781c52 100644
--- a/arch/powerpc/mm/fault.c
+++ b/arch/powerpc/mm/fault.c
@@ -529,6 +529,10 @@ void bad_page_fault(struct pt_regs *regs, unsigned long address, int sig)
                 printk(KERN_ALERT "Unable to handle kernel paging request for "
                         "instruction fetch\n");
                 break;
+        case 0x600:
+                printk(KERN_ALERT "Unable to handle kernel paging request for "
+                        "unaligned access at address 0x%08lx\n", regs->dar);
+                break;
         default:
                 printk(KERN_ALERT "Unable to handle kernel paging request for "
                         "unknown fault\n");
diff --git a/arch/powerpc/perf/hv-24x7.c b/arch/powerpc/perf/hv-24x7.c
index ec2eb20631d1..df956295c2a7 100644
--- a/arch/powerpc/perf/hv-24x7.c
+++ b/arch/powerpc/perf/hv-24x7.c
@@ -320,6 +320,8 @@ static struct attribute *device_str_attr_create_(char *name, char *str)
         if (!attr)
                 return NULL;
 
+        sysfs_attr_init(&attr->attr.attr);
+
         attr->var = str;
         attr->attr.attr.name = name;
         attr->attr.attr.mode = 0444;
diff --git a/arch/powerpc/platforms/powernv/opal-elog.c b/arch/powerpc/platforms/powernv/opal-elog.c
index 4949ef0d9400..37f959bf392e 100644
--- a/arch/powerpc/platforms/powernv/opal-elog.c
+++ b/arch/powerpc/platforms/powernv/opal-elog.c
@@ -237,7 +237,7 @@ static struct elog_obj *create_elog_obj(uint64_t id, size_t size, uint64_t type)
         return elog;
 }
 
-static void elog_work_fn(struct work_struct *work)
+static irqreturn_t elog_event(int irq, void *data)
 {
         __be64 size;
         __be64 id;
@@ -251,7 +251,7 @@ static void elog_work_fn(struct work_struct *work)
         rc = opal_get_elog_size(&id, &size, &type);
         if (rc != OPAL_SUCCESS) {
                 pr_err("ELOG: OPAL log info read failed\n");
-                return;
+                return IRQ_HANDLED;
         }
 
         elog_size = be64_to_cpu(size);
@@ -270,16 +270,10 @@ static void elog_work_fn(struct work_struct *work)
          * entries.
          */
         if (kset_find_obj(elog_kset, name))
-                return;
+                return IRQ_HANDLED;
 
         create_elog_obj(log_id, elog_size, elog_type);
-}
-
-static DECLARE_WORK(elog_work, elog_work_fn);
 
-static irqreturn_t elog_event(int irq, void *data)
-{
-        schedule_work(&elog_work);
         return IRQ_HANDLED;
 }
 
@@ -304,8 +298,8 @@ int __init opal_elog_init(void)
                 return irq;
         }
 
-        rc = request_irq(irq, elog_event,
-                        IRQ_TYPE_LEVEL_HIGH, "opal-elog", NULL);
+        rc = request_threaded_irq(irq, NULL, elog_event,
+                        IRQF_TRIGGER_HIGH | IRQF_ONESHOT, "opal-elog", NULL);
         if (rc) {
                 pr_err("%s: Can't request OPAL event irq (%d)\n",
                        __func__, rc);
diff --git a/arch/powerpc/platforms/powernv/opal-prd.c b/arch/powerpc/platforms/powernv/opal-prd.c
index 46cb3feb0a13..4ece8e40dd54 100644
--- a/arch/powerpc/platforms/powernv/opal-prd.c
+++ b/arch/powerpc/platforms/powernv/opal-prd.c
@@ -112,6 +112,7 @@ static int opal_prd_open(struct inode *inode, struct file *file)
 static int opal_prd_mmap(struct file *file, struct vm_area_struct *vma)
 {
         size_t addr, size;
+        pgprot_t page_prot;
         int rc;
 
         pr_devel("opal_prd_mmap(0x%016lx, 0x%016lx, 0x%lx, 0x%lx)\n",
@@ -125,13 +126,11 @@ static int opal_prd_mmap(struct file *file, struct vm_area_struct *vma)
         if (!opal_prd_range_is_valid(addr, size))
                 return -EINVAL;
 
-        vma->vm_page_prot = __pgprot(pgprot_val(phys_mem_access_prot(file,
-                                                vma->vm_pgoff,
-                                                 size, vma->vm_page_prot))
-                                        | _PAGE_SPECIAL);
+        page_prot = phys_mem_access_prot(file, vma->vm_pgoff,
+                                         size, vma->vm_page_prot);
 
         rc = remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff, size,
-                        vma->vm_page_prot);
+                                page_prot);
 
         return rc;
 }
diff --git a/arch/powerpc/sysdev/ppc4xx_hsta_msi.c b/arch/powerpc/sysdev/ppc4xx_hsta_msi.c
index 0d88ba242754..af3c144b92c1 100644
--- a/arch/powerpc/sysdev/ppc4xx_hsta_msi.c
+++ b/arch/powerpc/sysdev/ppc4xx_hsta_msi.c
@@ -18,6 +18,7 @@
 #include <linux/pci.h>
 #include <linux/semaphore.h>
 #include <asm/msi_bitmap.h>
+#include <asm/ppc-pci.h>
 
 struct ppc4xx_hsta_msi {
         struct device *dev;
diff --git a/arch/s390/include/asm/Kbuild b/arch/s390/include/asm/Kbuild
index dc5385ebb071..5ad26dd94d77 100644
--- a/arch/s390/include/asm/Kbuild
+++ b/arch/s390/include/asm/Kbuild
@@ -3,5 +3,6 @@
 generic-y += clkdev.h
 generic-y += irq_work.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += preempt.h
 generic-y += trace_clock.h
diff --git a/arch/s390/include/asm/ctl_reg.h b/arch/s390/include/asm/ctl_reg.h
index cfad7fca01d6..d7697ab802f6 100644
--- a/arch/s390/include/asm/ctl_reg.h
+++ b/arch/s390/include/asm/ctl_reg.h
@@ -57,7 +57,10 @@ union ctlreg0 {
                 unsigned long lap  : 1; /* Low-address-protection control */
                 unsigned long      : 4;
                 unsigned long edat : 1; /* Enhanced-DAT-enablement control */
-                unsigned long      : 23;
+                unsigned long      : 4;
+                unsigned long afp  : 1; /* AFP-register control */
+                unsigned long vx   : 1; /* Vector enablement control */
+                unsigned long      : 17;
         };
 };
 
diff --git a/arch/s390/include/asm/hugetlb.h b/arch/s390/include/asm/hugetlb.h
index 0130d0379edd..d9be7c0c1291 100644
--- a/arch/s390/include/asm/hugetlb.h
+++ b/arch/s390/include/asm/hugetlb.h
@@ -14,6 +14,7 @@
 
 #define is_hugepage_only_range(mm, addr, len)   0
 #define hugetlb_free_pgd_range                  free_pgd_range
+#define hugepages_supported()                   (MACHINE_HAS_HPAGE)
 
 void set_huge_pte_at(struct mm_struct *mm, unsigned long addr,
                      pte_t *ptep, pte_t pte);
diff --git a/arch/s390/include/asm/mm-arch-hooks.h b/arch/s390/include/asm/mm-arch-hooks.h
deleted file mode 100644
index 07680b2f3c59..000000000000
--- a/arch/s390/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#ifndef _ASM_S390_MM_ARCH_HOOKS_H
-#define _ASM_S390_MM_ARCH_HOOKS_H
-
-#endif /* _ASM_S390_MM_ARCH_HOOKS_H */
diff --git a/arch/s390/include/asm/page.h b/arch/s390/include/asm/page.h
index dd345238d9a7..53eacbd4f09b 100644
--- a/arch/s390/include/asm/page.h
+++ b/arch/s390/include/asm/page.h
@@ -17,10 +17,7 @@
 #define PAGE_DEFAULT_ACC        0
 #define PAGE_DEFAULT_KEY        (PAGE_DEFAULT_ACC << 4)
 
-#include <asm/setup.h>
-#ifndef __ASSEMBLY__
-
-extern int HPAGE_SHIFT;
+#define HPAGE_SHIFT     20
 #define HPAGE_SIZE      (1UL << HPAGE_SHIFT)
 #define HPAGE_MASK      (~(HPAGE_SIZE - 1))
 #define HUGETLB_PAGE_ORDER      (HPAGE_SHIFT - PAGE_SHIFT)
@@ -30,6 +27,9 @@ extern int HPAGE_SHIFT;
 #define ARCH_HAS_PREPARE_HUGEPAGE
 #define ARCH_HAS_HUGEPAGE_CLEAR_FLUSH
 
+#include <asm/setup.h>
+#ifndef __ASSEMBLY__
+
 static inline void storage_key_init_range(unsigned long start, unsigned long end)
 {
 #if PAGE_DEFAULT_KEY
diff --git a/arch/s390/include/asm/perf_event.h b/arch/s390/include/asm/perf_event.h
index 4cb19fe76dd9..f897ec73dc8c 100644
--- a/arch/s390/include/asm/perf_event.h
+++ b/arch/s390/include/asm/perf_event.h
@@ -87,7 +87,15 @@ struct sf_raw_sample {
 } __packed;
 
 /* Perf hardware reserve and release functions */
+#ifdef CONFIG_PERF_EVENTS
 int perf_reserve_sampling(void);
 void perf_release_sampling(void);
+#else /* CONFIG_PERF_EVENTS */
+static inline int perf_reserve_sampling(void)
+{
+        return 0;
+}
+static inline void perf_release_sampling(void) {}
+#endif /* CONFIG_PERF_EVENTS */
 
 #endif /* _ASM_S390_PERF_EVENT_H */
diff --git a/arch/s390/kernel/asm-offsets.c b/arch/s390/kernel/asm-offsets.c
index c7d1b9d09011..a2da259d9327 100644
--- a/arch/s390/kernel/asm-offsets.c
+++ b/arch/s390/kernel/asm-offsets.c
@@ -23,15 +23,15 @@
 
 int main(void)
 {
-        DEFINE(__THREAD_info, offsetof(struct task_struct, stack));
-        DEFINE(__THREAD_ksp, offsetof(struct task_struct, thread.ksp));
-        DEFINE(__THREAD_mm_segment, offsetof(struct task_struct, thread.mm_segment));
-        BLANK();
+        DEFINE(__TASK_thread_info, offsetof(struct task_struct, stack));
+        DEFINE(__TASK_thread, offsetof(struct task_struct, thread));
         DEFINE(__TASK_pid, offsetof(struct task_struct, pid));
         BLANK();
-        DEFINE(__THREAD_per_cause, offsetof(struct task_struct, thread.per_event.cause));
-        DEFINE(__THREAD_per_address, offsetof(struct task_struct, thread.per_event.address));
-        DEFINE(__THREAD_per_paid, offsetof(struct task_struct, thread.per_event.paid));
+        DEFINE(__THREAD_ksp, offsetof(struct thread_struct, ksp));
+        DEFINE(__THREAD_per_cause, offsetof(struct thread_struct, per_event.cause));
+        DEFINE(__THREAD_per_address, offsetof(struct thread_struct, per_event.address));
+        DEFINE(__THREAD_per_paid, offsetof(struct thread_struct, per_event.paid));
+        DEFINE(__THREAD_trap_tdb, offsetof(struct thread_struct, trap_tdb));
         BLANK();
         DEFINE(__TI_task, offsetof(struct thread_info, task));
         DEFINE(__TI_flags, offsetof(struct thread_info, flags));
@@ -176,7 +176,6 @@ int main(void)
         DEFINE(__LC_VDSO_PER_CPU, offsetof(struct _lowcore, vdso_per_cpu_data));
         DEFINE(__LC_GMAP, offsetof(struct _lowcore, gmap));
         DEFINE(__LC_PGM_TDB, offsetof(struct _lowcore, pgm_tdb));
-        DEFINE(__THREAD_trap_tdb, offsetof(struct task_struct, thread.trap_tdb));
         DEFINE(__GMAP_ASCE, offsetof(struct gmap, asce));
         DEFINE(__SIE_PROG0C, offsetof(struct kvm_s390_sie_block, prog0c));
         DEFINE(__SIE_PROG20, offsetof(struct kvm_s390_sie_block, prog20));
diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S
index 3238893c9d4f..84062e7a77da 100644
--- a/arch/s390/kernel/entry.S
+++ b/arch/s390/kernel/entry.S
@@ -178,17 +178,21 @@ _PIF_WORK	= (_PIF_PER_TRAP)
  */
 ENTRY(__switch_to)
         stmg    %r6,%r15,__SF_GPRS(%r15)        # store gprs of prev task
-        stg     %r15,__THREAD_ksp(%r2)          # store kernel stack of prev
-        lg      %r4,__THREAD_info(%r2)          # get thread_info of prev
-        lg      %r5,__THREAD_info(%r3)          # get thread_info of next
+        lgr     %r1,%r2
+        aghi    %r1,__TASK_thread               # thread_struct of prev task
+        lg      %r4,__TASK_thread_info(%r2)     # get thread_info of prev
+        lg      %r5,__TASK_thread_info(%r3)     # get thread_info of next
+        stg     %r15,__THREAD_ksp(%r1)          # store kernel stack of prev
+        lgr     %r1,%r3
+        aghi    %r1,__TASK_thread               # thread_struct of next task
         lgr     %r15,%r5
         aghi    %r15,STACK_INIT                 # end of kernel stack of next
         stg     %r3,__LC_CURRENT                # store task struct of next
         stg     %r5,__LC_THREAD_INFO            # store thread info of next
         stg     %r15,__LC_KERNEL_STACK          # store end of kernel stack
+        lg      %r15,__THREAD_ksp(%r1)          # load kernel stack of next
         lctl    %c4,%c4,__TASK_pid(%r3)         # load pid to control reg. 4
         mvc     __LC_CURRENT_PID+4(4,%r0),__TASK_pid(%r3) # store pid of next
-        lg      %r15,__THREAD_ksp(%r3)          # load kernel stack of next
         lmg     %r6,%r15,__SF_GPRS(%r15)        # load gprs of next task
         br      %r14
 
@@ -417,6 +421,7 @@ ENTRY(pgm_check_handler)
         LAST_BREAK %r14
         lg      %r15,__LC_KERNEL_STACK
         lg      %r14,__TI_task(%r12)
+        aghi    %r14,__TASK_thread      # pointer to thread_struct
         lghi    %r13,__LC_PGM_TDB
         tm      __LC_PGM_ILC+2,0x02     # check for transaction abort
         jz      2f
diff --git a/arch/s390/kernel/nmi.c b/arch/s390/kernel/nmi.c
index 505c17c0ae1a..56b550893593 100644
--- a/arch/s390/kernel/nmi.c
+++ b/arch/s390/kernel/nmi.c
@@ -21,6 +21,7 @@
 #include <asm/nmi.h>
 #include <asm/crw.h>
 #include <asm/switch_to.h>
+#include <asm/ctl_reg.h>
 
 struct mcck_struct {
         int kill_task;
@@ -129,26 +130,30 @@ static int notrace s390_revalidate_registers(struct mci *mci)
         } else
                 asm volatile("lfpc 0(%0)" : : "a" (fpt_creg_save_area));
 
-        asm volatile(
-                "       ld      0,0(%0)\n"
-                "       ld      1,8(%0)\n"
-                "       ld      2,16(%0)\n"
-                "       ld      3,24(%0)\n"
-                "       ld      4,32(%0)\n"
-                "       ld      5,40(%0)\n"
-                "       ld      6,48(%0)\n"
-                "       ld      7,56(%0)\n"
-                "       ld      8,64(%0)\n"
-                "       ld      9,72(%0)\n"
-                "       ld      10,80(%0)\n"
-                "       ld      11,88(%0)\n"
-                "       ld      12,96(%0)\n"
-                "       ld      13,104(%0)\n"
-                "       ld      14,112(%0)\n"
-                "       ld      15,120(%0)\n"
-                : : "a" (fpt_save_area));
-        /* Revalidate vector registers */
-        if (MACHINE_HAS_VX && current->thread.vxrs) {
+        if (!MACHINE_HAS_VX) {
+                /* Revalidate floating point registers */
+                asm volatile(
+                        "       ld      0,0(%0)\n"
+                        "       ld      1,8(%0)\n"
+                        "       ld      2,16(%0)\n"
+                        "       ld      3,24(%0)\n"
+                        "       ld      4,32(%0)\n"
+                        "       ld      5,40(%0)\n"
+                        "       ld      6,48(%0)\n"
+                        "       ld      7,56(%0)\n"
+                        "       ld      8,64(%0)\n"
+                        "       ld      9,72(%0)\n"
+                        "       ld      10,80(%0)\n"
+                        "       ld      11,88(%0)\n"
+                        "       ld      12,96(%0)\n"
+                        "       ld      13,104(%0)\n"
+                        "       ld      14,112(%0)\n"
+                        "       ld      15,120(%0)\n"
+                        : : "a" (fpt_save_area));
+        } else {
+                /* Revalidate vector registers */
+                union ctlreg0 cr0;
+
                 if (!mci->vr) {
                         /*
                          * Vector registers can't be restored and therefore
@@ -156,8 +161,12 @@ static int notrace s390_revalidate_registers(struct mci *mci)
                          */
                         kill_task = 1;
                 }
+                cr0.val = S390_lowcore.cregs_save_area[0];
+                cr0.afp = cr0.vx = 1;
+                __ctl_load(cr0.val, 0, 0);
                 restore_vx_regs((__vector128 *)
-                                S390_lowcore.vector_save_area_addr);
+                                &S390_lowcore.vector_save_area);
+                __ctl_load(S390_lowcore.cregs_save_area[0], 0, 0);
         }
         /* Revalidate access registers */
         asm volatile(
diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
index dc5edc29b73a..8f587d871b9f 100644
--- a/arch/s390/kernel/process.c
+++ b/arch/s390/kernel/process.c
@@ -163,7 +163,7 @@ int copy_thread(unsigned long clone_flags, unsigned long new_stackp,
 asmlinkage void execve_tail(void)
 {
         current->thread.fp_regs.fpc = 0;
-        asm volatile("sfpc %0,%0" : : "d" (0));
+        asm volatile("sfpc %0" : : "d" (0));
 }
 
 /*
diff --git a/arch/s390/kernel/sclp.S b/arch/s390/kernel/sclp.S
index 43c3169ea49c..ada0c07fe1a8 100644
--- a/arch/s390/kernel/sclp.S
+++ b/arch/s390/kernel/sclp.S
@@ -270,6 +270,8 @@ ENTRY(_sclp_print_early)
         jno     .Lesa2
         ahi     %r15,-80
         stmh    %r6,%r15,96(%r15)               # store upper register halves
+        basr    %r13,0
+        lmh     %r0,%r15,.Lzeroes-.(%r13)       # clear upper register halves
 .Lesa2:
         lr      %r10,%r2                        # save string pointer
         lhi     %r2,0
@@ -291,6 +293,8 @@ ENTRY(_sclp_print_early)
 .Lesa3:
         lm      %r6,%r15,120(%r15)              # restore registers
         br      %r14
+.Lzeroes:
+        .fill   64,4,0
 
 .LwritedataS4:
         .long   0x00760005                      # SCLP command for write data
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index f7f027caaaaa..ca070d260af2 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -885,8 +885,6 @@ void __init setup_arch(char **cmdline_p)
          */
         setup_hwcaps();
 
-        HPAGE_SHIFT = MACHINE_HAS_HPAGE ? 20 : 0;
-
         /*
          * Create kernel page tables and switch to virtual addressing.
          */
diff --git a/arch/s390/kernel/traps.c b/arch/s390/kernel/traps.c
index 4d96c9f53455..7bea81d8a363 100644
--- a/arch/s390/kernel/traps.c
+++ b/arch/s390/kernel/traps.c
@@ -259,7 +259,7 @@ void vector_exception(struct pt_regs *regs)
         }
 
         /* get vector interrupt code from fpc */
-        asm volatile("stfpc %0" : "=m" (current->thread.fp_regs.fpc));
+        asm volatile("stfpc %0" : "=Q" (current->thread.fp_regs.fpc));
         vic = (current->thread.fp_regs.fpc & 0xf00) >> 8;
         switch (vic) {
         case 1: /* invalid vector operation */
@@ -297,7 +297,7 @@ void data_exception(struct pt_regs *regs)
 
         location = get_trap_ip(regs);
 
-        asm volatile("stfpc %0" : "=m" (current->thread.fp_regs.fpc));
+        asm volatile("stfpc %0" : "=Q" (current->thread.fp_regs.fpc));
         /* Check for vector register enablement */
         if (MACHINE_HAS_VX && !current->thread.vxrs &&
             (current->thread.fp_regs.fpc & FPC_DXC_MASK) == 0xfe00) {
diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c
index 33082d0d101b..b33f66110ca9 100644
--- a/arch/s390/mm/pgtable.c
+++ b/arch/s390/mm/pgtable.c
@@ -31,8 +31,6 @@
 #define ALLOC_ORDER     2
 #define FRAG_MASK       0x03
 
-int HPAGE_SHIFT;
-
 unsigned long *crst_table_alloc(struct mm_struct *mm)
 {
         struct page *page = alloc_pages(GFP_KERNEL, ALLOC_ORDER);
diff --git a/arch/s390/oprofile/init.c b/arch/s390/oprofile/init.c
index bc927a09a172..9cfa2ffaa9d6 100644
--- a/arch/s390/oprofile/init.c
+++ b/arch/s390/oprofile/init.c
@@ -16,6 +16,7 @@
 #include <linux/fs.h>
 #include <linux/module.h>
 #include <asm/processor.h>
+#include <asm/perf_event.h>
 
 #include "../../../drivers/oprofile/oprof.h"
 
diff --git a/arch/score/include/asm/Kbuild b/arch/score/include/asm/Kbuild
index 138fb3db45ba..92ffe397b893 100644
--- a/arch/score/include/asm/Kbuild
+++ b/arch/score/include/asm/Kbuild
@@ -7,6 +7,7 @@ generic-y += clkdev.h
 generic-y += cputime.h
 generic-y += irq_work.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += preempt.h
 generic-y += sections.h
 generic-y += trace_clock.h
diff --git a/arch/score/include/asm/mm-arch-hooks.h b/arch/score/include/asm/mm-arch-hooks.h
deleted file mode 100644
index 5e38689f189a..000000000000
--- a/arch/score/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#ifndef _ASM_SCORE_MM_ARCH_HOOKS_H
-#define _ASM_SCORE_MM_ARCH_HOOKS_H
-
-#endif /* _ASM_SCORE_MM_ARCH_HOOKS_H */
diff --git a/arch/sh/include/asm/Kbuild b/arch/sh/include/asm/Kbuild
index 9ac4626e7284..aac452b26aa8 100644
--- a/arch/sh/include/asm/Kbuild
+++ b/arch/sh/include/asm/Kbuild
@@ -16,6 +16,7 @@ generic-y += kvm_para.h
 generic-y += local.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += mman.h
 generic-y += msgbuf.h
 generic-y += param.h
diff --git a/arch/sh/include/asm/mm-arch-hooks.h b/arch/sh/include/asm/mm-arch-hooks.h
deleted file mode 100644
index 18087298b728..000000000000
--- a/arch/sh/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#ifndef _ASM_SH_MM_ARCH_HOOKS_H
-#define _ASM_SH_MM_ARCH_HOOKS_H
-
-#endif /* _ASM_SH_MM_ARCH_HOOKS_H */
diff --git a/arch/sparc/include/asm/Kbuild b/arch/sparc/include/asm/Kbuild
index 2b2a69dcc467..e928618838bc 100644
--- a/arch/sparc/include/asm/Kbuild
+++ b/arch/sparc/include/asm/Kbuild
@@ -12,6 +12,7 @@ generic-y += linkage.h
 generic-y += local.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += module.h
 generic-y += mutex.h
 generic-y += preempt.h
diff --git a/arch/sparc/include/asm/mm-arch-hooks.h b/arch/sparc/include/asm/mm-arch-hooks.h
deleted file mode 100644
index b89ba44c16f1..000000000000
--- a/arch/sparc/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#ifndef _ASM_SPARC_MM_ARCH_HOOKS_H
-#define _ASM_SPARC_MM_ARCH_HOOKS_H
-
-#endif /* _ASM_SPARC_MM_ARCH_HOOKS_H */
diff --git a/arch/tile/include/asm/Kbuild b/arch/tile/include/asm/Kbuild
index d53654488c2c..d8a843163471 100644
--- a/arch/tile/include/asm/Kbuild
+++ b/arch/tile/include/asm/Kbuild
@@ -19,6 +19,7 @@ generic-y += irq_regs.h
 generic-y += local.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += msgbuf.h
 generic-y += mutex.h
 generic-y += param.h
diff --git a/arch/tile/include/asm/mm-arch-hooks.h b/arch/tile/include/asm/mm-arch-hooks.h
deleted file mode 100644
index d1709ea774f7..000000000000
--- a/arch/tile/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#ifndef _ASM_TILE_MM_ARCH_HOOKS_H
-#define _ASM_TILE_MM_ARCH_HOOKS_H
-
-#endif /* _ASM_TILE_MM_ARCH_HOOKS_H */
diff --git a/arch/tile/kernel/setup.c b/arch/tile/kernel/setup.c
index 99c9ff87e018..6b755d125783 100644
--- a/arch/tile/kernel/setup.c
+++ b/arch/tile/kernel/setup.c
@@ -1139,7 +1139,7 @@ static void __init load_hv_initrd(void)
 
 void __init free_initrd_mem(unsigned long begin, unsigned long end)
 {
-        free_bootmem(__pa(begin), end - begin);
+        free_bootmem_late(__pa(begin), end - begin);
 }
 
 static int __init setup_initrd(char *str)
diff --git a/arch/tile/lib/memcpy_user_64.c b/arch/tile/lib/memcpy_user_64.c
index 88c7016492c4..97bbb6060b25 100644
--- a/arch/tile/lib/memcpy_user_64.c
+++ b/arch/tile/lib/memcpy_user_64.c
@@ -28,7 +28,7 @@
 #define _ST(p, inst, v)                                         \
         ({                                                      \
                 asm("1: " #inst " %0, %1;"                      \
-                    ".pushsection .coldtext.memcpy,\"ax\";"     \
+                    ".pushsection .coldtext,\"ax\";"    \
                     "2: { move r0, %2; jrp lr };"               \
                     ".section __ex_table,\"a\";"                \
                     ".align 8;"                                 \
@@ -41,7 +41,7 @@
         ({                                                      \
                 unsigned long __v;                              \
                 asm("1: " #inst " %0, %1;"                      \
-                    ".pushsection .coldtext.memcpy,\"ax\";"     \
+                    ".pushsection .coldtext,\"ax\";"    \
                     "2: { move r0, %2; jrp lr };"               \
                     ".section __ex_table,\"a\";"                \
                     ".align 8;"                                 \
diff --git a/arch/um/include/asm/Kbuild b/arch/um/include/asm/Kbuild
index 3d63ff6f583f..149ec55f9c46 100644
--- a/arch/um/include/asm/Kbuild
+++ b/arch/um/include/asm/Kbuild
@@ -16,6 +16,7 @@ generic-y += irq_regs.h
 generic-y += irq_work.h
 generic-y += kdebug.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += mutex.h
 generic-y += param.h
 generic-y += pci.h
diff --git a/arch/um/include/asm/mm-arch-hooks.h b/arch/um/include/asm/mm-arch-hooks.h
deleted file mode 100644
index a7c8b0dfdd4e..000000000000
--- a/arch/um/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#ifndef _ASM_UM_MM_ARCH_HOOKS_H
-#define _ASM_UM_MM_ARCH_HOOKS_H
-
-#endif /* _ASM_UM_MM_ARCH_HOOKS_H */
diff --git a/arch/unicore32/include/asm/Kbuild b/arch/unicore32/include/asm/Kbuild
index d12b377b5a8b..1fc7a286dc6f 100644
--- a/arch/unicore32/include/asm/Kbuild
+++ b/arch/unicore32/include/asm/Kbuild
@@ -26,6 +26,7 @@ generic-y += kdebug.h
 generic-y += kmap_types.h
 generic-y += local.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += mman.h
 generic-y += module.h
 generic-y += msgbuf.h
diff --git a/arch/unicore32/include/asm/mm-arch-hooks.h b/arch/unicore32/include/asm/mm-arch-hooks.h
deleted file mode 100644
index 4d79a850c509..000000000000
--- a/arch/unicore32/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#ifndef _ASM_UNICORE32_MM_ARCH_HOOKS_H
-#define _ASM_UNICORE32_MM_ARCH_HOOKS_H
-
-#endif /* _ASM_UNICORE32_MM_ARCH_HOOKS_H */
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 55bced17dc95..b3a1a5d77d92 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -41,6 +41,7 @@ config X86
         select ARCH_USE_CMPXCHG_LOCKREF         if X86_64
         select ARCH_USE_QUEUED_RWLOCKS
         select ARCH_USE_QUEUED_SPINLOCKS
+        select ARCH_WANTS_DYNAMIC_TASK_STRUCT
         select ARCH_WANT_FRAME_POINTERS
         select ARCH_WANT_IPC_PARSE_VERSION      if X86_32
         select ARCH_WANT_OPTIONAL_GPIOLIB
@@ -254,6 +255,11 @@ config ARCH_SUPPORTS_OPTIMIZED_INLINING
 config ARCH_SUPPORTS_DEBUG_PAGEALLOC
         def_bool y
 
+config KASAN_SHADOW_OFFSET
+        hex
+        depends on KASAN
+        default 0xdffffc0000000000
+
 config HAVE_INTEL_TXT
         def_bool y
         depends on INTEL_IOMMU && ACPI
@@ -2015,7 +2021,7 @@ config CMDLINE_BOOL
 
           To compile command line arguments into the kernel,
           set this option to 'Y', then fill in the
-          the boot arguments in CONFIG_CMDLINE.
+          boot arguments in CONFIG_CMDLINE.
 
           Systems with fully functional boot loaders (i.e. non-embedded)
           should leave this option set to 'N'.
diff --git a/arch/x86/Kconfig.debug b/arch/x86/Kconfig.debug
index a15893d17c55..d8c0d3266173 100644
--- a/arch/x86/Kconfig.debug
+++ b/arch/x86/Kconfig.debug
@@ -297,6 +297,18 @@ config OPTIMIZE_INLINING
 
           If unsure, say N.
 
+config DEBUG_ENTRY
+        bool "Debug low-level entry code"
+        depends on DEBUG_KERNEL
+        ---help---
+          This option enables sanity checks in x86's low-level entry code.
+          Some of these sanity checks may slow down kernel entries and
+          exits or otherwise impact performance.
+
+          This is currently used to help test NMI code.
+
+          If unsure, say N.
+
 config DEBUG_NMI_SELFTEST
         bool "NMI Selftest"
         depends on DEBUG_KERNEL && X86_LOCAL_APIC
diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index 3bb2c4302df1..8cb3e438f21e 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -1237,11 +1237,12 @@ ENTRY(nmi)
          *  If the variable is not set and the stack is not the NMI
          *  stack then:
          *    o Set the special variable on the stack
-         *    o Copy the interrupt frame into a "saved" location on the stack
-         *    o Copy the interrupt frame into a "copy" location on the stack
+         *    o Copy the interrupt frame into an "outermost" location on the
+         *      stack
+         *    o Copy the interrupt frame into an "iret" location on the stack
          *    o Continue processing the NMI
          *  If the variable is set or the previous stack is the NMI stack:
-         *    o Modify the "copy" location to jump to the repeate_nmi
+         *    o Modify the "iret" location to jump to the repeat_nmi
          *    o return back to the first NMI
          *
          * Now on exit of the first NMI, we first clear the stack variable
@@ -1250,31 +1251,151 @@ ENTRY(nmi)
          * a nested NMI that updated the copy interrupt stack frame, a
          * jump will be made to the repeat_nmi code that will handle the second
          * NMI.
+         *
+         * However, espfix prevents us from directly returning to userspace
+         * with a single IRET instruction.  Similarly, IRET to user mode
+         * can fault.  We therefore handle NMIs from user space like
+         * other IST entries.
          */
 
         /* Use %rdx as our temp variable throughout */
         pushq   %rdx
 
+        testb   $3, CS-RIP+8(%rsp)
+        jz      .Lnmi_from_kernel
+
+        /*
+         * NMI from user mode.  We need to run on the thread stack, but we
+         * can't go through the normal entry paths: NMIs are masked, and
+         * we don't want to enable interrupts, because then we'll end
+         * up in an awkward situation in which IRQs are on but NMIs
+         * are off.
+         */
+
+        SWAPGS
+        cld
+        movq    %rsp, %rdx
+        movq    PER_CPU_VAR(cpu_current_top_of_stack), %rsp
+        pushq   5*8(%rdx)       /* pt_regs->ss */
+        pushq   4*8(%rdx)       /* pt_regs->rsp */
+        pushq   3*8(%rdx)       /* pt_regs->flags */
+        pushq   2*8(%rdx)       /* pt_regs->cs */
+        pushq   1*8(%rdx)       /* pt_regs->rip */
+        pushq   $-1             /* pt_regs->orig_ax */
+        pushq   %rdi            /* pt_regs->di */
+        pushq   %rsi            /* pt_regs->si */
+        pushq   (%rdx)          /* pt_regs->dx */
+        pushq   %rcx            /* pt_regs->cx */
+        pushq   %rax            /* pt_regs->ax */
+        pushq   %r8             /* pt_regs->r8 */
+        pushq   %r9             /* pt_regs->r9 */
+        pushq   %r10            /* pt_regs->r10 */
+        pushq   %r11            /* pt_regs->r11 */
+        pushq   %rbx            /* pt_regs->rbx */
+        pushq   %rbp            /* pt_regs->rbp */
+        pushq   %r12            /* pt_regs->r12 */
+        pushq   %r13            /* pt_regs->r13 */
+        pushq   %r14            /* pt_regs->r14 */
+        pushq   %r15            /* pt_regs->r15 */
+
+        /*
+         * At this point we no longer need to worry about stack damage
+         * due to nesting -- we're on the normal thread stack and we're
+         * done with the NMI stack.
+         */
+
+        movq    %rsp, %rdi
+        movq    $-1, %rsi
+        call    do_nmi
+
+        /*
+         * Return back to user mode.  We must *not* do the normal exit
+         * work, because we don't want to enable interrupts.  Fortunately,
+         * do_nmi doesn't modify pt_regs.
+         */
+        SWAPGS
+        jmp     restore_c_regs_and_iret
+
+.Lnmi_from_kernel:
+        /*
+         * Here's what our stack frame will look like:
+         * +---------------------------------------------------------+
+         * | original SS                                             |
+         * | original Return RSP                                     |
+         * | original RFLAGS                                         |
+         * | original CS                                             |
+         * | original RIP                                            |
+         * +---------------------------------------------------------+
+         * | temp storage for rdx                                    |
+         * +---------------------------------------------------------+
+         * | "NMI executing" variable                                |
+         * +---------------------------------------------------------+
+         * | iret SS          } Copied from "outermost" frame        |
+         * | iret Return RSP  } on each loop iteration; overwritten  |
+         * | iret RFLAGS      } by a nested NMI to force another     |
+         * | iret CS          } iteration if needed.                 |
+         * | iret RIP         }                                      |
+         * +---------------------------------------------------------+
+         * | outermost SS          } initialized in first_nmi;       |
+         * | outermost Return RSP  } will not be changed before      |
+         * | outermost RFLAGS      } NMI processing is done.         |
+         * | outermost CS          } Copied to "iret" frame on each  |
+         * | outermost RIP         } iteration.                      |
+         * +---------------------------------------------------------+
+         * | pt_regs                                                 |
+         * +---------------------------------------------------------+
+         *
+         * The "original" frame is used by hardware.  Before re-enabling
+         * NMIs, we need to be done with it, and we need to leave enough
+         * space for the asm code here.
+         *
+         * We return by executing IRET while RSP points to the "iret" frame.
+         * That will either return for real or it will loop back into NMI
+         * processing.
+         *
+         * The "outermost" frame is copied to the "iret" frame on each
+         * iteration of the loop, so each iteration starts with the "iret"
+         * frame pointing to the final return target.
+         */
+
         /*
-         * If %cs was not the kernel segment, then the NMI triggered in user
-         * space, which means it is definitely not nested.
+         * Determine whether we're a nested NMI.
+         *
+         * If we interrupted kernel code between repeat_nmi and
+         * end_repeat_nmi, then we are a nested NMI.  We must not
+         * modify the "iret" frame because it's being written by
+         * the outer NMI.  That's okay; the outer NMI handler is
+         * about to about to call do_nmi anyway, so we can just
+         * resume the outer NMI.
          */
-        cmpl    $__KERNEL_CS, 16(%rsp)
-        jne     first_nmi
+
+        movq    $repeat_nmi, %rdx
+        cmpq    8(%rsp), %rdx
+        ja      1f
+        movq    $end_repeat_nmi, %rdx
+        cmpq    8(%rsp), %rdx
+        ja      nested_nmi_out
+1:
 
         /*
-         * Check the special variable on the stack to see if NMIs are
-         * executing.
+         * Now check "NMI executing".  If it's set, then we're nested.
+         * This will not detect if we interrupted an outer NMI just
+         * before IRET.
          */
         cmpl    $1, -8(%rsp)
         je      nested_nmi
 
         /*
-         * Now test if the previous stack was an NMI stack.
-         * We need the double check. We check the NMI stack to satisfy the
-         * race when the first NMI clears the variable before returning.
-         * We check the variable because the first NMI could be in a
-         * breakpoint routine using a breakpoint stack.
+         * Now test if the previous stack was an NMI stack.  This covers
+         * the case where we interrupt an outer NMI after it clears
+         * "NMI executing" but before IRET.  We need to be careful, though:
+         * there is one case in which RSP could point to the NMI stack
+         * despite there being no NMI active: naughty userspace controls
+         * RSP at the very beginning of the SYSCALL targets.  We can
+         * pull a fast one on naughty userspace, though: we program
+         * SYSCALL to mask DF, so userspace cannot cause DF to be set
+         * if it controls the kernel's RSP.  We set DF before we clear
+         * "NMI executing".
          */
         lea     6*8(%rsp), %rdx
         /* Compare the NMI stack (rdx) with the stack we came from (4*8(%rsp)) */
@@ -1286,25 +1407,20 @@ ENTRY(nmi)
         cmpq    %rdx, 4*8(%rsp)
         /* If it is below the NMI stack, it is a normal NMI */
         jb      first_nmi
-        /* Ah, it is within the NMI stack, treat it as nested */
+
+        /* Ah, it is within the NMI stack. */
+
+        testb   $(X86_EFLAGS_DF >> 8), (3*8 + 1)(%rsp)
+        jz      first_nmi       /* RSP was user controlled. */
+
+        /* This is a nested NMI. */
 
 nested_nmi:
         /*
-         * Do nothing if we interrupted the fixup in repeat_nmi.
-         * It's about to repeat the NMI handler, so we are fine
-         * with ignoring this one.
+         * Modify the "iret" frame to point to repeat_nmi, forcing another
+         * iteration of NMI handling.
          */
-        movq    $repeat_nmi, %rdx
-        cmpq    8(%rsp), %rdx
-        ja      1f
-        movq    $end_repeat_nmi, %rdx
-        cmpq    8(%rsp), %rdx
-        ja      nested_nmi_out
-
-1:
-        /* Set up the interrupted NMIs stack to jump to repeat_nmi */
-        leaq    -1*8(%rsp), %rdx
-        movq    %rdx, %rsp
+        subq    $8, %rsp
         leaq    -10*8(%rsp), %rdx
         pushq   $__KERNEL_DS
         pushq   %rdx
@@ -1318,61 +1434,42 @@ nested_nmi:
 nested_nmi_out:
         popq    %rdx
 
-        /* No need to check faults here */
+        /* We are returning to kernel mode, so this cannot result in a fault. */
         INTERRUPT_RETURN
 
 first_nmi:
-        /*
-         * Because nested NMIs will use the pushed location that we
-         * stored in rdx, we must keep that space available.
-         * Here's what our stack frame will look like:
-         * +-------------------------+
-         * | original SS             |
-         * | original Return RSP     |
-         * | original RFLAGS         |
-         * | original CS             |
-         * | original RIP            |
-         * +-------------------------+
-         * | temp storage for rdx    |
-         * +-------------------------+
-         * | NMI executing variable  |
-         * +-------------------------+
-         * | copied SS               |
-         * | copied Return RSP       |
-         * | copied RFLAGS           |
-         * | copied CS               |
-         * | copied RIP              |
-         * +-------------------------+
-         * | Saved SS                |
-         * | Saved Return RSP        |
-         * | Saved RFLAGS            |
-         * | Saved CS                |
-         * | Saved RIP               |
-         * +-------------------------+
-         * | pt_regs                 |
-         * +-------------------------+
-         *
-         * The saved stack frame is used to fix up the copied stack frame
-         * that a nested NMI may change to make the interrupted NMI iret jump
-         * to the repeat_nmi. The original stack frame and the temp storage
-         * is also used by nested NMIs and can not be trusted on exit.
-         */
-        /* Do not pop rdx, nested NMIs will corrupt that part of the stack */
+        /* Restore rdx. */
         movq    (%rsp), %rdx
 
-        /* Set the NMI executing variable on the stack. */
-        pushq   $1
+        /* Make room for "NMI executing". */
+        pushq   $0
 
-        /* Leave room for the "copied" frame */
+        /* Leave room for the "iret" frame */
         subq    $(5*8), %rsp
 
-        /* Copy the stack frame to the Saved frame */
+        /* Copy the "original" frame to the "outermost" frame */
         .rept 5
         pushq   11*8(%rsp)
         .endr
 
         /* Everything up to here is safe from nested NMIs */
 
+#ifdef CONFIG_DEBUG_ENTRY
+        /*
+         * For ease of testing, unmask NMIs right away.  Disabled by
+         * default because IRET is very expensive.
+         */
+        pushq   $0              /* SS */
+        pushq   %rsp            /* RSP (minus 8 because of the previous push) */
+        addq    $8, (%rsp)      /* Fix up RSP */
+        pushfq                  /* RFLAGS */
+        pushq   $__KERNEL_CS    /* CS */
+        pushq   $1f             /* RIP */
+        INTERRUPT_RETURN        /* continues at repeat_nmi below */
+1:
+#endif
+
+repeat_nmi:
         /*
          * If there was a nested NMI, the first NMI's iret will return
          * here. But NMIs are still enabled and we can take another
@@ -1381,16 +1478,20 @@ first_nmi:
          * it will just return, as we are about to repeat an NMI anyway.
          * This makes it safe to copy to the stack frame that a nested
          * NMI will update.
+         *
+         * RSP is pointing to "outermost RIP".  gsbase is unknown, but, if
+         * we're repeating an NMI, gsbase has the same value that it had on
+         * the first iteration.  paranoid_entry will load the kernel
+         * gsbase if needed before we call do_nmi.  "NMI executing"
+         * is zero.
          */
-repeat_nmi:
+        movq    $1, 10*8(%rsp)          /* Set "NMI executing". */
+
         /*
-         * Update the stack variable to say we are still in NMI (the update
-         * is benign for the non-repeat case, where 1 was pushed just above
-         * to this very stack slot).
+         * Copy the "outermost" frame to the "iret" frame.  NMIs that nest
+         * here must not modify the "iret" frame while we're writing to
+         * it or it will end up containing garbage.
          */
-        movq    $1, 10*8(%rsp)
-
-        /* Make another copy, this one may be modified by nested NMIs */
         addq    $(10*8), %rsp
         .rept 5
         pushq   -6*8(%rsp)
@@ -1399,9 +1500,9 @@ repeat_nmi:
 end_repeat_nmi:
 
         /*
-         * Everything below this point can be preempted by a nested
-         * NMI if the first NMI took an exception and reset our iret stack
-         * so that we repeat another NMI.
+         * Everything below this point can be preempted by a nested NMI.
+         * If this happens, then the inner NMI will change the "iret"
+         * frame to point back to repeat_nmi.
          */
         pushq   $-1                             /* ORIG_RAX: no syscall to restart */
         ALLOC_PT_GPREGS_ON_STACK
@@ -1415,28 +1516,11 @@ end_repeat_nmi:
          */
         call    paranoid_entry
 
-        /*
-         * Save off the CR2 register. If we take a page fault in the NMI then
-         * it could corrupt the CR2 value. If the NMI preempts a page fault
-         * handler before it was able to read the CR2 register, and then the
-         * NMI itself takes a page fault, the page fault that was preempted
-         * will read the information from the NMI page fault and not the
-         * origin fault. Save it off and restore it if it changes.
-         * Use the r12 callee-saved register.
-         */
-        movq    %cr2, %r12
-
         /* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */
         movq    %rsp, %rdi
         movq    $-1, %rsi
         call    do_nmi
 
-        /* Did the NMI take a page fault? Restore cr2 if it did */
-        movq    %cr2, %rcx
-        cmpq    %rcx, %r12
-        je      1f
-        movq    %r12, %cr2
-1:
         testl   %ebx, %ebx                      /* swapgs needed? */
         jnz     nmi_restore
 nmi_swapgs:
@@ -1444,11 +1528,26 @@ nmi_swapgs:
 nmi_restore:
         RESTORE_EXTRA_REGS
         RESTORE_C_REGS
-        /* Pop the extra iret frame at once */
+
+        /* Point RSP at the "iret" frame. */
         REMOVE_PT_GPREGS_FROM_STACK 6*8
 
-        /* Clear the NMI executing stack variable */
-        movq    $0, 5*8(%rsp)
+        /*
+         * Clear "NMI executing".  Set DF first so that we can easily
+         * distinguish the remaining code between here and IRET from
+         * the SYSCALL entry and exit paths.  On a native kernel, we
+         * could just inspect RIP, but, on paravirt kernels,
+         * INTERRUPT_RETURN can translate into a jump into a
+         * hypercall page.
+         */
+        std
+        movq    $0, 5*8(%rsp)           /* clear "NMI executing" */
+
+        /*
+         * INTERRUPT_RETURN reads the "iret" frame and exits the NMI
+         * stack in a single instruction.  We are returning to kernel
+         * mode, so this cannot result in a fault.
+         */
         INTERRUPT_RETURN
 END(nmi)
 
diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S
index bb187a6a877c..5a1844765a7a 100644
--- a/arch/x86/entry/entry_64_compat.S
+++ b/arch/x86/entry/entry_64_compat.S
@@ -205,7 +205,6 @@ sysexit_from_sys_call:
         movl    RDX(%rsp), %edx         /* arg3 */
         movl    RSI(%rsp), %ecx         /* arg4 */
         movl    RDI(%rsp), %r8d         /* arg5 */
-        movl    %ebp, %r9d              /* arg6 */
         .endm
 
         .macro auditsys_exit exit
@@ -236,6 +235,7 @@ sysexit_from_sys_call:
 
 sysenter_auditsys:
         auditsys_entry_common
+        movl    %ebp, %r9d              /* reload 6th syscall arg */
         jmp     sysenter_dispatch
 
 sysexit_audit:
@@ -336,7 +336,7 @@ ENTRY(entry_SYSCALL_compat)
          * 32-bit zero extended:
          */
         ASM_STAC
-1:      movl    (%r8), %ebp
+1:      movl    (%r8), %r9d
         _ASM_EXTABLE(1b, ia32_badarg)
         ASM_CLAC
         orl     $TS_COMPAT, ASM_THREAD_INFO(TI_status, %rsp, SIZEOF_PTREGS)
@@ -346,7 +346,7 @@ ENTRY(entry_SYSCALL_compat)
 cstar_do_call:
         /* 32-bit syscall -> 64-bit C ABI argument conversion */
         movl    %edi, %r8d              /* arg5 */
-        movl    %ebp, %r9d              /* arg6 */
+        /* r9 already loaded */         /* arg6 */
         xchg    %ecx, %esi              /* rsi:arg2, rcx:arg4 */
         movl    %ebx, %edi              /* arg1 */
         movl    %edx, %edx              /* arg3 (zero extension) */
@@ -358,7 +358,6 @@ cstar_dispatch:
         call    *ia32_sys_call_table(, %rax, 8)
         movq    %rax, RAX(%rsp)
 1:
-        movl    RCX(%rsp), %ebp
         DISABLE_INTERRUPTS(CLBR_NONE)
         TRACE_IRQS_OFF
         testl   $_TIF_ALLWORK_MASK, ASM_THREAD_INFO(TI_flags, %rsp, SIZEOF_PTREGS)
@@ -392,7 +391,9 @@ sysretl_from_sys_call:
 
 #ifdef CONFIG_AUDITSYSCALL
 cstar_auditsys:
+        movl    %r9d, R9(%rsp)          /* register to be clobbered by call */
         auditsys_entry_common
+        movl    R9(%rsp), %r9d          /* reload 6th syscall arg */
         jmp     cstar_dispatch
 
 sysretl_audit:
@@ -404,14 +405,16 @@ cstar_tracesys:
         testl   $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT), ASM_THREAD_INFO(TI_flags, %rsp, SIZEOF_PTREGS)
         jz      cstar_auditsys
 #endif
+        xchgl   %r9d, %ebp
         SAVE_EXTRA_REGS
         xorl    %eax, %eax              /* Do not leak kernel information */
         movq    %rax, R11(%rsp)
         movq    %rax, R10(%rsp)
-        movq    %rax, R9(%rsp)
+        movq    %r9, R9(%rsp)
         movq    %rax, R8(%rsp)
         movq    %rsp, %rdi              /* &pt_regs -> arg1 */
         call    syscall_trace_enter
+        movl    R9(%rsp), %r9d
 
         /* Reload arg registers from stack. (see sysenter_tracesys) */
         movl    RCX(%rsp), %ecx
@@ -421,6 +424,7 @@ cstar_tracesys:
         movl    %eax, %eax              /* zero extension */
 
         RESTORE_EXTRA_REGS
+        xchgl   %ebp, %r9d
         jmp     cstar_do_call
 END(entry_SYSCALL_compat)
 
diff --git a/arch/x86/include/asm/Kbuild b/arch/x86/include/asm/Kbuild
index 4dd1f2d770af..aeac434c9feb 100644
--- a/arch/x86/include/asm/Kbuild
+++ b/arch/x86/include/asm/Kbuild
@@ -9,3 +9,4 @@ generic-y += cputime.h
 generic-y += dma-contiguous.h
 generic-y += early_ioremap.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
diff --git a/arch/x86/include/asm/espfix.h b/arch/x86/include/asm/espfix.h
index 99efebb2f69d..ca3ce9ab9385 100644
--- a/arch/x86/include/asm/espfix.h
+++ b/arch/x86/include/asm/espfix.h
@@ -9,7 +9,7 @@ DECLARE_PER_CPU_READ_MOSTLY(unsigned long, espfix_stack);
 DECLARE_PER_CPU_READ_MOSTLY(unsigned long, espfix_waddr);
 
 extern void init_espfix_bsp(void);
-extern void init_espfix_ap(void);
+extern void init_espfix_ap(int cpu);
 
 #endif /* CONFIG_X86_64 */
 
diff --git a/arch/x86/include/asm/fpu/types.h b/arch/x86/include/asm/fpu/types.h
index 0637826292de..c49c5173158e 100644
--- a/arch/x86/include/asm/fpu/types.h
+++ b/arch/x86/include/asm/fpu/types.h
@@ -189,6 +189,7 @@ union fpregs_state {
         struct fxregs_state             fxsave;
         struct swregs_state             soft;
         struct xregs_state              xsave;
+        u8 __padding[PAGE_SIZE];
 };
 
 /*
@@ -198,40 +199,6 @@ union fpregs_state {
  */
 struct fpu {
         /*
-         * @state:
-         *
-         * In-memory copy of all FPU registers that we save/restore
-         * over context switches. If the task is using the FPU then
-         * the registers in the FPU are more recent than this state
-         * copy. If the task context-switches away then they get
-         * saved here and represent the FPU state.
-         *
-         * After context switches there may be a (short) time period
-         * during which the in-FPU hardware registers are unchanged
-         * and still perfectly match this state, if the tasks
-         * scheduled afterwards are not using the FPU.
-         *
-         * This is the 'lazy restore' window of optimization, which
-         * we track though 'fpu_fpregs_owner_ctx' and 'fpu->last_cpu'.
-         *
-         * We detect whether a subsequent task uses the FPU via setting
-         * CR0::TS to 1, which causes any FPU use to raise a #NM fault.
-         *
-         * During this window, if the task gets scheduled again, we
-         * might be able to skip having to do a restore from this
-         * memory buffer to the hardware registers - at the cost of
-         * incurring the overhead of #NM fault traps.
-         *
-         * Note that on modern CPUs that support the XSAVEOPT (or other
-         * optimized XSAVE instructions), we don't use #NM traps anymore,
-         * as the hardware can track whether FPU registers need saving
-         * or not. On such CPUs we activate the non-lazy ('eagerfpu')
-         * logic, which unconditionally saves/restores all FPU state
-         * across context switches. (if FPU state exists.)
-         */
-        union fpregs_state              state;
-
-        /*
          * @last_cpu:
          *
          * Records the last CPU on which this context was loaded into
@@ -288,6 +255,43 @@ struct fpu {
          * deal with bursty apps that only use the FPU for a short time:
          */
         unsigned char                   counter;
+        /*
+         * @state:
+         *
+         * In-memory copy of all FPU registers that we save/restore
+         * over context switches. If the task is using the FPU then
+         * the registers in the FPU are more recent than this state
+         * copy. If the task context-switches away then they get
+         * saved here and represent the FPU state.
+         *
+         * After context switches there may be a (short) time period
+         * during which the in-FPU hardware registers are unchanged
+         * and still perfectly match this state, if the tasks
+         * scheduled afterwards are not using the FPU.
+         *
+         * This is the 'lazy restore' window of optimization, which
+         * we track though 'fpu_fpregs_owner_ctx' and 'fpu->last_cpu'.
+         *
+         * We detect whether a subsequent task uses the FPU via setting
+         * CR0::TS to 1, which causes any FPU use to raise a #NM fault.
+         *
+         * During this window, if the task gets scheduled again, we
+         * might be able to skip having to do a restore from this
+         * memory buffer to the hardware registers - at the cost of
+         * incurring the overhead of #NM fault traps.
+         *
+         * Note that on modern CPUs that support the XSAVEOPT (or other
+         * optimized XSAVE instructions), we don't use #NM traps anymore,
+         * as the hardware can track whether FPU registers need saving
+         * or not. On such CPUs we activate the non-lazy ('eagerfpu')
+         * logic, which unconditionally saves/restores all FPU state
+         * across context switches. (if FPU state exists.)
+         */
+        union fpregs_state              state;
+        /*
+         * WARNING: 'state' is dynamically-sized.  Do not put
+         * anything after it here.
+         */
 };
 
 #endif /* _ASM_X86_FPU_H */
diff --git a/arch/x86/include/asm/intel_pmc_ipc.h b/arch/x86/include/asm/intel_pmc_ipc.h
index 200ec2e7821d..cd0310e186f4 100644
--- a/arch/x86/include/asm/intel_pmc_ipc.h
+++ b/arch/x86/include/asm/intel_pmc_ipc.h
@@ -25,36 +25,9 @@
 
 #if IS_ENABLED(CONFIG_INTEL_PMC_IPC)
 
-/*
- * intel_pmc_ipc_simple_command
- * @cmd: command
- * @sub: sub type
- */
 int intel_pmc_ipc_simple_command(int cmd, int sub);
-
-/*
- * intel_pmc_ipc_raw_cmd
- * @cmd: command
- * @sub: sub type
- * @in: input data
- * @inlen: input length in bytes
- * @out: output data
- * @outlen: output length in dwords
- * @sptr: data writing to SPTR register
- * @dptr: data writing to DPTR register
- */
 int intel_pmc_ipc_raw_cmd(u32 cmd, u32 sub, u8 *in, u32 inlen,
                 u32 *out, u32 outlen, u32 dptr, u32 sptr);
-
-/*
- * intel_pmc_ipc_command
- * @cmd: command
- * @sub: sub type
- * @in: input data
- * @inlen: input length in bytes
- * @out: output data
- * @outlen: output length in dwords
- */
 int intel_pmc_ipc_command(u32 cmd, u32 sub, u8 *in, u32 inlen,
                 u32 *out, u32 outlen);
 
diff --git a/arch/x86/include/asm/kasan.h b/arch/x86/include/asm/kasan.h
index 8b22422fbad8..74a2a8dc9908 100644
--- a/arch/x86/include/asm/kasan.h
+++ b/arch/x86/include/asm/kasan.h
@@ -14,15 +14,11 @@
 
 #ifndef __ASSEMBLY__
 
-extern pte_t kasan_zero_pte[];
-extern pte_t kasan_zero_pmd[];
-extern pte_t kasan_zero_pud[];
-
 #ifdef CONFIG_KASAN
-void __init kasan_map_early_shadow(pgd_t *pgd);
+void __init kasan_early_init(void);
 void __init kasan_init(void);
 #else
-static inline void kasan_map_early_shadow(pgd_t *pgd) { }
+static inline void kasan_early_init(void) { }
 static inline void kasan_init(void) { }
 #endif
 
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index 2a7f5d782c33..49ec9038ec14 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -604,6 +604,8 @@ struct kvm_arch {
         bool iommu_noncoherent;
 #define __KVM_HAVE_ARCH_NONCOHERENT_DMA
         atomic_t noncoherent_dma_count;
+#define __KVM_HAVE_ARCH_ASSIGNED_DEVICE
+        atomic_t assigned_device_count;
         struct kvm_pic *vpic;
         struct kvm_ioapic *vioapic;
         struct kvm_pit *vpit;
diff --git a/arch/x86/include/asm/mm-arch-hooks.h b/arch/x86/include/asm/mm-arch-hooks.h
deleted file mode 100644
index 4e881a342236..000000000000
--- a/arch/x86/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#ifndef _ASM_X86_MM_ARCH_HOOKS_H
-#define _ASM_X86_MM_ARCH_HOOKS_H
-
-#endif /* _ASM_X86_MM_ARCH_HOOKS_H */
diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h
index 5e8daee7c5c9..804a3a6030ca 100644
--- a/arch/x86/include/asm/mmu_context.h
+++ b/arch/x86/include/asm/mmu_context.h
@@ -23,7 +23,7 @@ extern struct static_key rdpmc_always_available;
 
 static inline void load_mm_cr4(struct mm_struct *mm)
 {
-        if (static_key_true(&rdpmc_always_available) ||
+        if (static_key_false(&rdpmc_always_available) ||
             atomic_read(&mm->context.perf_rdpmc_allowed))
                 cr4_set_bits(X86_CR4_PCE);
         else
diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
index 43e6519df0d5..944f1785ed0d 100644
--- a/arch/x86/include/asm/processor.h
+++ b/arch/x86/include/asm/processor.h
@@ -390,9 +390,6 @@ struct thread_struct {
 #endif
         unsigned long           gs;
 
-        /* Floating point and extended processor state */
-        struct fpu              fpu;
-
         /* Save middle states of ptrace breakpoints */
         struct perf_event       *ptrace_bps[HBP_NUM];
         /* Debug status used for traps, single steps, etc... */
@@ -418,6 +415,13 @@ struct thread_struct {
         unsigned long           iopl;
         /* Max allowed port in the bitmap, in bytes: */
         unsigned                io_bitmap_max;
+
+        /* Floating point and extended processor state */
+        struct fpu              fpu;
+        /*
+         * WARNING: 'fpu' is dynamically-sized.  It *MUST* be at
+         * the end.
+         */
 };
 
 /*
diff --git a/arch/x86/include/uapi/asm/hyperv.h b/arch/x86/include/uapi/asm/hyperv.h
index 8fba544e9cc4..f36d56bd7632 100644
--- a/arch/x86/include/uapi/asm/hyperv.h
+++ b/arch/x86/include/uapi/asm/hyperv.h
@@ -108,6 +108,8 @@
 #define HV_X64_HYPERCALL_PARAMS_XMM_AVAILABLE           (1 << 4)
 /* Support for a virtual guest idle state is available */
 #define HV_X64_GUEST_IDLE_STATE_AVAILABLE               (1 << 5)
+/* Guest crash data handler available */
+#define HV_X64_GUEST_CRASH_MSR_AVAILABLE                (1 << 10)
 
 /*
  * Implementation recommendations. Indicates which behaviors the hypervisor
diff --git a/arch/x86/include/uapi/asm/kvm.h b/arch/x86/include/uapi/asm/kvm.h
index a4ae82eb82aa..cd54147cb365 100644
--- a/arch/x86/include/uapi/asm/kvm.h
+++ b/arch/x86/include/uapi/asm/kvm.h
@@ -354,7 +354,7 @@ struct kvm_xcrs {
 struct kvm_sync_regs {
 };
 
-#define KVM_QUIRK_LINT0_REENABLED       (1 << 0)
-#define KVM_QUIRK_CD_NW_CLEARED         (1 << 1)
+#define KVM_X86_QUIRK_LINT0_REENABLED   (1 << 0)
+#define KVM_X86_QUIRK_CD_NW_CLEARED     (1 << 1)
 
 #endif /* _ASM_X86_KVM_H */
diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c
index 28eba2d38b15..f813261d9740 100644
--- a/arch/x86/kernel/apic/vector.c
+++ b/arch/x86/kernel/apic/vector.c
@@ -409,12 +409,6 @@ static void __setup_vector_irq(int cpu)
         int irq, vector;
         struct apic_chip_data *data;
 
-        /*
-         * vector_lock will make sure that we don't run into irq vector
-         * assignments that might be happening on another cpu in parallel,
-         * while we setup our initial vector to irq mappings.
-         */
-        raw_spin_lock(&vector_lock);
         /* Mark the inuse vectors */
         for_each_active_irq(irq) {
                 data = apic_chip_data(irq_get_irq_data(irq));
@@ -436,16 +430,16 @@ static void __setup_vector_irq(int cpu)
                 if (!cpumask_test_cpu(cpu, data->domain))
                         per_cpu(vector_irq, cpu)[vector] = VECTOR_UNDEFINED;
         }
-        raw_spin_unlock(&vector_lock);
 }
 
 /*
- * Setup the vector to irq mappings.
+ * Setup the vector to irq mappings. Must be called with vector_lock held.
  */
 void setup_vector_irq(int cpu)
 {
         int irq;
 
+        lockdep_assert_held(&vector_lock);
         /*
          * On most of the platforms, legacy PIC delivers the interrupts on the
          * boot cpu. But there are certain platforms where PIC interrupts are
diff --git a/arch/x86/kernel/cpu/perf_event_intel_cqm.c b/arch/x86/kernel/cpu/perf_event_intel_cqm.c
index 188076161c1b..63eb68b73589 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_cqm.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_cqm.c
@@ -952,6 +952,14 @@ static u64 intel_cqm_event_count(struct perf_event *event)
                 return 0;
 
         /*
+         * Getting up-to-date values requires an SMP IPI which is not
+         * possible if we're being called in interrupt context. Return
+         * the cached values instead.
+         */
+        if (unlikely(in_interrupt()))
+                goto out;
+
+        /*
          * Notice that we don't perform the reading of an RMID
          * atomically, because we can't hold a spin lock across the
          * IPIs.
diff --git a/arch/x86/kernel/early_printk.c b/arch/x86/kernel/early_printk.c
index 89427d8d4fc5..eec40f595ab9 100644
--- a/arch/x86/kernel/early_printk.c
+++ b/arch/x86/kernel/early_printk.c
@@ -175,7 +175,9 @@ static __init void early_serial_init(char *s)
         }
 
         if (*s) {
-                if (kstrtoul(s, 0, &baud) < 0 || baud == 0)
+                baud = simple_strtoull(s, &e, 0);
+
+                if (baud == 0 || s == e)
                         baud = DEFAULT_BAUD;
         }
 
diff --git a/arch/x86/kernel/espfix_64.c b/arch/x86/kernel/espfix_64.c
index f5d0730e7b08..ce95676abd60 100644
--- a/arch/x86/kernel/espfix_64.c
+++ b/arch/x86/kernel/espfix_64.c
@@ -131,25 +131,24 @@ void __init init_espfix_bsp(void)
         init_espfix_random();
 
         /* The rest is the same as for any other processor */
-        init_espfix_ap();
+        init_espfix_ap(0);
 }
 
-void init_espfix_ap(void)
+void init_espfix_ap(int cpu)
 {
-        unsigned int cpu, page;
+        unsigned int page;
         unsigned long addr;
         pud_t pud, *pud_p;
         pmd_t pmd, *pmd_p;
         pte_t pte, *pte_p;
-        int n;
+        int n, node;
         void *stack_page;
         pteval_t ptemask;
 
         /* We only have to do this once... */
-        if (likely(this_cpu_read(espfix_stack)))
+        if (likely(per_cpu(espfix_stack, cpu)))
                 return;         /* Already initialized */
 
-        cpu = smp_processor_id();
         addr = espfix_base_addr(cpu);
         page = cpu/ESPFIX_STACKS_PER_PAGE;
 
@@ -165,12 +164,15 @@ void init_espfix_ap(void)
         if (stack_page)
                 goto unlock_done;
 
+        node = cpu_to_node(cpu);
         ptemask = __supported_pte_mask;
 
         pud_p = &espfix_pud_page[pud_index(addr)];
         pud = *pud_p;
         if (!pud_present(pud)) {
-                pmd_p = (pmd_t *)__get_free_page(PGALLOC_GFP);
+                struct page *page = alloc_pages_node(node, PGALLOC_GFP, 0);
+
+                pmd_p = (pmd_t *)page_address(page);
                 pud = __pud(__pa(pmd_p) | (PGTABLE_PROT & ptemask));
                 paravirt_alloc_pmd(&init_mm, __pa(pmd_p) >> PAGE_SHIFT);
                 for (n = 0; n < ESPFIX_PUD_CLONES; n++)
@@ -180,7 +182,9 @@ void init_espfix_ap(void)
         pmd_p = pmd_offset(&pud, addr);
         pmd = *pmd_p;
         if (!pmd_present(pmd)) {
-                pte_p = (pte_t *)__get_free_page(PGALLOC_GFP);
+                struct page *page = alloc_pages_node(node, PGALLOC_GFP, 0);
+
+                pte_p = (pte_t *)page_address(page);
                 pmd = __pmd(__pa(pte_p) | (PGTABLE_PROT & ptemask));
                 paravirt_alloc_pte(&init_mm, __pa(pte_p) >> PAGE_SHIFT);
                 for (n = 0; n < ESPFIX_PMD_CLONES; n++)
@@ -188,7 +192,7 @@ void init_espfix_ap(void)
         }
 
         pte_p = pte_offset_kernel(&pmd, addr);
-        stack_page = (void *)__get_free_page(GFP_KERNEL);
+        stack_page = page_address(alloc_pages_node(node, GFP_KERNEL, 0));
         pte = __pte(__pa(stack_page) | (__PAGE_KERNEL_RO & ptemask));
         for (n = 0; n < ESPFIX_PTE_CLONES; n++)
                 set_pte(&pte_p[n*PTE_STRIDE], pte);
@@ -199,7 +203,7 @@ void init_espfix_ap(void)
 unlock_done:
         mutex_unlock(&espfix_init_mutex);
 done:
-        this_cpu_write(espfix_stack, addr);
-        this_cpu_write(espfix_waddr, (unsigned long)stack_page
-                       + (addr & ~PAGE_MASK));
+        per_cpu(espfix_stack, cpu) = addr;
+        per_cpu(espfix_waddr, cpu) = (unsigned long)stack_page
+                                      + (addr & ~PAGE_MASK);
 }
diff --git a/arch/x86/kernel/fpu/init.c b/arch/x86/kernel/fpu/init.c
index 32826791e675..1e173f6285c7 100644
--- a/arch/x86/kernel/fpu/init.c
+++ b/arch/x86/kernel/fpu/init.c
@@ -4,6 +4,8 @@
 #include <asm/fpu/internal.h>
 #include <asm/tlbflush.h>
 
+#include <linux/sched.h>
+
 /*
  * Initialize the TS bit in CR0 according to the style of context-switches
  * we are using:
@@ -136,6 +138,43 @@ static void __init fpu__init_system_generic(void)
 unsigned int xstate_size;
 EXPORT_SYMBOL_GPL(xstate_size);
 
+/* Enforce that 'MEMBER' is the last field of 'TYPE': */
+#define CHECK_MEMBER_AT_END_OF(TYPE, MEMBER) \
+        BUILD_BUG_ON(sizeof(TYPE) != offsetofend(TYPE, MEMBER))
+
+/*
+ * We append the 'struct fpu' to the task_struct:
+ */
+static void __init fpu__init_task_struct_size(void)
+{
+        int task_size = sizeof(struct task_struct);
+
+        /*
+         * Subtract off the static size of the register state.
+         * It potentially has a bunch of padding.
+         */
+        task_size -= sizeof(((struct task_struct *)0)->thread.fpu.state);
+
+        /*
+         * Add back the dynamically-calculated register state
+         * size.
+         */
+        task_size += xstate_size;
+
+        /*
+         * We dynamically size 'struct fpu', so we require that
+         * it be at the end of 'thread_struct' and that
+         * 'thread_struct' be at the end of 'task_struct'.  If
+         * you hit a compile error here, check the structure to
+         * see if something got added to the end.
+         */
+        CHECK_MEMBER_AT_END_OF(struct fpu, state);
+        CHECK_MEMBER_AT_END_OF(struct thread_struct, fpu);
+        CHECK_MEMBER_AT_END_OF(struct task_struct, thread);
+
+        arch_task_struct_size = task_size;
+}
+
 /*
  * Set up the xstate_size based on the legacy FPU context size.
  *
@@ -287,6 +326,7 @@ void __init fpu__init_system(struct cpuinfo_x86 *c)
         fpu__init_system_generic();
         fpu__init_system_xstate_size_legacy();
         fpu__init_system_xstate();
+        fpu__init_task_struct_size();
 
         fpu__init_system_ctx_switch();
 }
@@ -311,9 +351,15 @@ static int __init x86_noxsave_setup(char *s)
 
         setup_clear_cpu_cap(X86_FEATURE_XSAVE);
         setup_clear_cpu_cap(X86_FEATURE_XSAVEOPT);
+        setup_clear_cpu_cap(X86_FEATURE_XSAVEC);
         setup_clear_cpu_cap(X86_FEATURE_XSAVES);
         setup_clear_cpu_cap(X86_FEATURE_AVX);
         setup_clear_cpu_cap(X86_FEATURE_AVX2);
+        setup_clear_cpu_cap(X86_FEATURE_AVX512F);
+        setup_clear_cpu_cap(X86_FEATURE_AVX512PF);
+        setup_clear_cpu_cap(X86_FEATURE_AVX512ER);
+        setup_clear_cpu_cap(X86_FEATURE_AVX512CD);
+        setup_clear_cpu_cap(X86_FEATURE_MPX);
 
         return 1;
 }
diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
index 5a4668136e98..f129a9af6357 100644
--- a/arch/x86/kernel/head64.c
+++ b/arch/x86/kernel/head64.c
@@ -161,11 +161,12 @@ asmlinkage __visible void __init x86_64_start_kernel(char * real_mode_data)
         /* Kill off the identity-map trampoline */
         reset_early_page_tables();
 
-        kasan_map_early_shadow(early_level4_pgt);
-
-        /* clear bss before set_intr_gate with early_idt_handler */
         clear_bss();
 
+        clear_page(init_level4_pgt);
+
+        kasan_early_init();
+
         for (i = 0; i < NUM_EXCEPTION_VECTORS; i++)
                 set_intr_gate(i, early_idt_handler_array[i]);
         load_idt((const struct desc_ptr *)&idt_descr);
@@ -177,12 +178,9 @@ asmlinkage __visible void __init x86_64_start_kernel(char * real_mode_data)
          */
         load_ucode_bsp();
 
-        clear_page(init_level4_pgt);
         /* set init_level4_pgt kernel high mapping*/
         init_level4_pgt[511] = early_level4_pgt[511];
 
-        kasan_map_early_shadow(init_level4_pgt);
-
         x86_64_start_reservations(real_mode_data);
 }
 
diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S
index e5c27f729a38..1d40ca8a73f2 100644
--- a/arch/x86/kernel/head_64.S
+++ b/arch/x86/kernel/head_64.S
@@ -516,38 +516,9 @@ ENTRY(phys_base)
         /* This must match the first entry in level2_kernel_pgt */
         .quad   0x0000000000000000
 
-#ifdef CONFIG_KASAN
-#define FILL(VAL, COUNT)                                \
-        .rept (COUNT) ;                                 \
-        .quad   (VAL) ;                                 \
-        .endr
-
-NEXT_PAGE(kasan_zero_pte)
-        FILL(kasan_zero_page - __START_KERNEL_map + _KERNPG_TABLE, 512)
-NEXT_PAGE(kasan_zero_pmd)
-        FILL(kasan_zero_pte - __START_KERNEL_map + _KERNPG_TABLE, 512)
-NEXT_PAGE(kasan_zero_pud)
-        FILL(kasan_zero_pmd - __START_KERNEL_map + _KERNPG_TABLE, 512)
-
-#undef FILL
-#endif
-
-
 #include "../../x86/xen/xen-head.S"
         
         __PAGE_ALIGNED_BSS
 NEXT_PAGE(empty_zero_page)
         .skip PAGE_SIZE
 
-#ifdef CONFIG_KASAN
-/*
- * This page used as early shadow. We don't use empty_zero_page
- * at early stages, stack instrumentation could write some garbage
- * to this page.
- * Latter we reuse it as zero shadow for large ranges of memory
- * that allowed to access, but not instrumented by kasan
- * (vmalloc/vmemmap ...).
- */
-NEXT_PAGE(kasan_zero_page)
-        .skip PAGE_SIZE
-#endif
diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c
index 88b366487b0e..c7dfe1be784e 100644
--- a/arch/x86/kernel/irq.c
+++ b/arch/x86/kernel/irq.c
@@ -347,14 +347,22 @@ int check_irq_vectors_for_cpu_disable(void)
                         if (!desc)
                                 continue;
 
+                        /*
+                         * Protect against concurrent action removal,
+                         * affinity changes etc.
+                         */
+                        raw_spin_lock(&desc->lock);
                         data = irq_desc_get_irq_data(desc);
                         cpumask_copy(&affinity_new, data->affinity);
                         cpumask_clear_cpu(this_cpu, &affinity_new);
 
                         /* Do not count inactive or per-cpu irqs. */
-                        if (!irq_has_action(irq) || irqd_is_per_cpu(data))
+                        if (!irq_has_action(irq) || irqd_is_per_cpu(data)) {
+                                raw_spin_unlock(&desc->lock);
                                 continue;
+                        }
 
+                        raw_spin_unlock(&desc->lock);
                         /*
                          * A single irq may be mapped to multiple
                          * cpu's vector_irq[] (for example IOAPIC cluster
@@ -385,6 +393,9 @@ int check_irq_vectors_for_cpu_disable(void)
                  * vector. If the vector is marked in the used vectors
                  * bitmap or an irq is assigned to it, we don't count
                  * it as available.
+                 *
+                 * As this is an inaccurate snapshot anyway, we can do
+                 * this w/o holding vector_lock.
                  */
                 for (vector = FIRST_EXTERNAL_VECTOR;
                      vector < first_system_vector; vector++) {
@@ -486,6 +497,11 @@ void fixup_irqs(void)
          */
         mdelay(1);
 
+        /*
+         * We can walk the vector array of this cpu without holding
+         * vector_lock because the cpu is already marked !online, so
+         * nothing else will touch it.
+         */
         for (vector = FIRST_EXTERNAL_VECTOR; vector < NR_VECTORS; vector++) {
                 unsigned int irr;
 
@@ -497,9 +513,9 @@ void fixup_irqs(void)
                         irq = __this_cpu_read(vector_irq[vector]);
 
                         desc = irq_to_desc(irq);
+                        raw_spin_lock(&desc->lock);
                         data = irq_desc_get_irq_data(desc);
                         chip = irq_data_get_irq_chip(data);
-                        raw_spin_lock(&desc->lock);
                         if (chip->irq_retrigger) {
                                 chip->irq_retrigger(data);
                                 __this_cpu_write(vector_irq[vector], VECTOR_RETRIGGERED);
diff --git a/arch/x86/kernel/nmi.c b/arch/x86/kernel/nmi.c
index c3e985d1751c..d05bd2e2ee91 100644
--- a/arch/x86/kernel/nmi.c
+++ b/arch/x86/kernel/nmi.c
@@ -408,15 +408,15 @@ static void default_do_nmi(struct pt_regs *regs)
 NOKPROBE_SYMBOL(default_do_nmi);
 
 /*
- * NMIs can hit breakpoints which will cause it to lose its
- * NMI context with the CPU when the breakpoint does an iret.
- */
-#ifdef CONFIG_X86_32
-/*
- * For i386, NMIs use the same stack as the kernel, and we can
- * add a workaround to the iret problem in C (preventing nested
- * NMIs if an NMI takes a trap). Simply have 3 states the NMI
- * can be in:
+ * NMIs can page fault or hit breakpoints which will cause it to lose
+ * its NMI context with the CPU when the breakpoint or page fault does an IRET.
+ *
+ * As a result, NMIs can nest if NMIs get unmasked due an IRET during
+ * NMI processing.  On x86_64, the asm glue protects us from nested NMIs
+ * if the outer NMI came from kernel mode, but we can still nest if the
+ * outer NMI came from user mode.
+ *
+ * To handle these nested NMIs, we have three states:
  *
  *  1) not running
  *  2) executing
@@ -430,15 +430,14 @@ NOKPROBE_SYMBOL(default_do_nmi);
  * (Note, the latch is binary, thus multiple NMIs triggering,
  *  when one is running, are ignored. Only one NMI is restarted.)
  *
- * If an NMI hits a breakpoint that executes an iret, another
- * NMI can preempt it. We do not want to allow this new NMI
- * to run, but we want to execute it when the first one finishes.
- * We set the state to "latched", and the exit of the first NMI will
- * perform a dec_return, if the result is zero (NOT_RUNNING), then
- * it will simply exit the NMI handler. If not, the dec_return
- * would have set the state to NMI_EXECUTING (what we want it to
- * be when we are running). In this case, we simply jump back
- * to rerun the NMI handler again, and restart the 'latched' NMI.
+ * If an NMI executes an iret, another NMI can preempt it. We do not
+ * want to allow this new NMI to run, but we want to execute it when the
+ * first one finishes.  We set the state to "latched", and the exit of
+ * the first NMI will perform a dec_return, if the result is zero
+ * (NOT_RUNNING), then it will simply exit the NMI handler. If not, the
+ * dec_return would have set the state to NMI_EXECUTING (what we want it
+ * to be when we are running). In this case, we simply jump back to
+ * rerun the NMI handler again, and restart the 'latched' NMI.
  *
  * No trap (breakpoint or page fault) should be hit before nmi_restart,
  * thus there is no race between the first check of state for NOT_RUNNING
@@ -461,49 +460,36 @@ enum nmi_states {
 static DEFINE_PER_CPU(enum nmi_states, nmi_state);
 static DEFINE_PER_CPU(unsigned long, nmi_cr2);
 
-#define nmi_nesting_preprocess(regs)                                    \
-        do {                                                            \
-                if (this_cpu_read(nmi_state) != NMI_NOT_RUNNING) {      \
-                        this_cpu_write(nmi_state, NMI_LATCHED);         \
-                        return;                                         \
-                }                                                       \
-                this_cpu_write(nmi_state, NMI_EXECUTING);               \
-                this_cpu_write(nmi_cr2, read_cr2());                    \
-        } while (0);                                                    \
-        nmi_restart:
-
-#define nmi_nesting_postprocess()                                       \
-        do {                                                            \
-                if (unlikely(this_cpu_read(nmi_cr2) != read_cr2()))     \
-                        write_cr2(this_cpu_read(nmi_cr2));              \
-                if (this_cpu_dec_return(nmi_state))                     \
-                        goto nmi_restart;                               \
-        } while (0)
-#else /* x86_64 */
+#ifdef CONFIG_X86_64
 /*
- * In x86_64 things are a bit more difficult. This has the same problem
- * where an NMI hitting a breakpoint that calls iret will remove the
- * NMI context, allowing a nested NMI to enter. What makes this more
- * difficult is that both NMIs and breakpoints have their own stack.
- * When a new NMI or breakpoint is executed, the stack is set to a fixed
- * point. If an NMI is nested, it will have its stack set at that same
- * fixed address that the first NMI had, and will start corrupting the
- * stack. This is handled in entry_64.S, but the same problem exists with
- * the breakpoint stack.
+ * In x86_64, we need to handle breakpoint -> NMI -> breakpoint.  Without
+ * some care, the inner breakpoint will clobber the outer breakpoint's
+ * stack.
  *
- * If a breakpoint is being processed, and the debug stack is being used,
- * if an NMI comes in and also hits a breakpoint, the stack pointer
- * will be set to the same fixed address as the breakpoint that was
- * interrupted, causing that stack to be corrupted. To handle this case,
- * check if the stack that was interrupted is the debug stack, and if
- * so, change the IDT so that new breakpoints will use the current stack
- * and not switch to the fixed address. On return of the NMI, switch back
- * to the original IDT.
+ * If a breakpoint is being processed, and the debug stack is being
+ * used, if an NMI comes in and also hits a breakpoint, the stack
+ * pointer will be set to the same fixed address as the breakpoint that
+ * was interrupted, causing that stack to be corrupted. To handle this
+ * case, check if the stack that was interrupted is the debug stack, and
+ * if so, change the IDT so that new breakpoints will use the current
+ * stack and not switch to the fixed address. On return of the NMI,
+ * switch back to the original IDT.
  */
 static DEFINE_PER_CPU(int, update_debug_stack);
+#endif
 
-static inline void nmi_nesting_preprocess(struct pt_regs *regs)
+dotraplinkage notrace void
+do_nmi(struct pt_regs *regs, long error_code)
 {
+        if (this_cpu_read(nmi_state) != NMI_NOT_RUNNING) {
+                this_cpu_write(nmi_state, NMI_LATCHED);
+                return;
+        }
+        this_cpu_write(nmi_state, NMI_EXECUTING);
+        this_cpu_write(nmi_cr2, read_cr2());
+nmi_restart:
+
+#ifdef CONFIG_X86_64
         /*
          * If we interrupted a breakpoint, it is possible that
          * the nmi handler will have breakpoints too. We need to
@@ -514,22 +500,8 @@ static inline void nmi_nesting_preprocess(struct pt_regs *regs)
                 debug_stack_set_zero();
                 this_cpu_write(update_debug_stack, 1);
         }
-}
-
-static inline void nmi_nesting_postprocess(void)
-{
-        if (unlikely(this_cpu_read(update_debug_stack))) {
-                debug_stack_reset();
-                this_cpu_write(update_debug_stack, 0);
-        }
-}
 #endif
 
-dotraplinkage notrace void
-do_nmi(struct pt_regs *regs, long error_code)
-{
-        nmi_nesting_preprocess(regs);
-
         nmi_enter();
 
         inc_irq_stat(__nmi_count);
@@ -539,8 +511,17 @@ do_nmi(struct pt_regs *regs, long error_code)
 
         nmi_exit();
 
-        /* On i386, may loop back to preprocess */
-        nmi_nesting_postprocess();
+#ifdef CONFIG_X86_64
+        if (unlikely(this_cpu_read(update_debug_stack))) {
+                debug_stack_reset();
+                this_cpu_write(update_debug_stack, 0);
+        }
+#endif
+
+        if (unlikely(this_cpu_read(nmi_cr2) != read_cr2()))
+                write_cr2(this_cpu_read(nmi_cr2));
+        if (this_cpu_dec_return(nmi_state))
+                goto nmi_restart;
 }
 NOKPROBE_SYMBOL(do_nmi);
 
diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
index 9cad694ed7c4..397688beed4b 100644
--- a/arch/x86/kernel/process.c
+++ b/arch/x86/kernel/process.c
@@ -81,7 +81,7 @@ EXPORT_SYMBOL_GPL(idle_notifier_unregister);
  */
 int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src)
 {
-        *dst = *src;
+        memcpy(dst, src, arch_task_struct_size);
 
         return fpu__copy(&dst->thread.fpu, &src->thread.fpu);
 }
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index 8add66b22f33..b1f3ed9c7a9e 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -171,11 +171,6 @@ static void smp_callin(void)
         apic_ap_setup();
 
         /*
-         * Need to setup vector mappings before we enable interrupts.
-         */
-        setup_vector_irq(smp_processor_id());
-
-        /*
          * Save our processor parameters. Note: this information
          * is needed for clock calibration.
          */
@@ -239,18 +234,13 @@ static void notrace start_secondary(void *unused)
         check_tsc_sync_target();
 
         /*
-         * Enable the espfix hack for this CPU
-         */
-#ifdef CONFIG_X86_ESPFIX64
-        init_espfix_ap();
-#endif
-
-        /*
-         * We need to hold vector_lock so there the set of online cpus
-         * does not change while we are assigning vectors to cpus.  Holding
-         * this lock ensures we don't half assign or remove an irq from a cpu.
+         * Lock vector_lock and initialize the vectors on this cpu
+         * before setting the cpu online. We must set it online with
+         * vector_lock held to prevent a concurrent setup/teardown
+         * from seeing a half valid vector space.
          */
         lock_vector_lock();
+        setup_vector_irq(smp_processor_id());
         set_cpu_online(smp_processor_id(), true);
         unlock_vector_lock();
         cpu_set_state_online(smp_processor_id());
@@ -854,6 +844,13 @@ static int do_boot_cpu(int apicid, int cpu, struct task_struct *idle)
         initial_code = (unsigned long)start_secondary;
         stack_start  = idle->thread.sp;
 
+        /*
+         * Enable the espfix hack for this CPU
+        */
+#ifdef CONFIG_X86_ESPFIX64
+        init_espfix_ap(cpu);
+#endif
+
         /* So we see what's up */
         announce_cpu(cpu, apicid);
 
@@ -995,8 +992,17 @@ int native_cpu_up(unsigned int cpu, struct task_struct *tidle)
 
         common_cpu_up(cpu, tidle);
 
+        /*
+         * We have to walk the irq descriptors to setup the vector
+         * space for the cpu which comes online.  Prevent irq
+         * alloc/free across the bringup.
+         */
+        irq_lock_sparse();
+
         err = do_boot_cpu(apicid, cpu, tidle);
+
         if (err) {
+                irq_unlock_sparse();
                 pr_err("do_boot_cpu failed(%d) to wakeup CPU#%u\n", err, cpu);
                 return -EIO;
         }
@@ -1014,6 +1020,8 @@ int native_cpu_up(unsigned int cpu, struct task_struct *tidle)
                 touch_nmi_watchdog();
         }
 
+        irq_unlock_sparse();
+
         return 0;
 }
 
diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
index 505449700e0c..7437b41f6a47 100644
--- a/arch/x86/kernel/tsc.c
+++ b/arch/x86/kernel/tsc.c
@@ -598,10 +598,19 @@ static unsigned long quick_pit_calibrate(void)
                         if (!pit_expect_msb(0xff-i, &delta, &d2))
                                 break;
 
+                        delta -= tsc;
+
+                        /*
+                         * Extrapolate the error and fail fast if the error will
+                         * never be below 500 ppm.
+                         */
+                        if (i == 1 &&
+                            d1 + d2 >= (delta * MAX_QUICK_PIT_ITERATIONS) >> 11)
+                                return 0;
+
                         /*
                          * Iterate until the error is less than 500 ppm
                          */
-                        delta -= tsc;
                         if (d1+d2 >= delta >> 11)
                                 continue;
 
diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
index 64dd46793099..2fbea2544f24 100644
--- a/arch/x86/kvm/cpuid.c
+++ b/arch/x86/kvm/cpuid.c
@@ -98,6 +98,8 @@ int kvm_update_cpuid(struct kvm_vcpu *vcpu)
                 best->ebx = xstate_required_size(vcpu->arch.xcr0, true);
 
         vcpu->arch.eager_fpu = use_eager_fpu() || guest_cpuid_has_mpx(vcpu);
+        if (vcpu->arch.eager_fpu)
+                kvm_x86_ops->fpu_activate(vcpu);
 
         /*
          * The existing code assumes virtual address is 48-bit in the canonical
diff --git a/arch/x86/kvm/iommu.c b/arch/x86/kvm/iommu.c
index 7dbced309ddb..5c520ebf6343 100644
--- a/arch/x86/kvm/iommu.c
+++ b/arch/x86/kvm/iommu.c
@@ -200,6 +200,7 @@ int kvm_assign_device(struct kvm *kvm, struct pci_dev *pdev)
                         goto out_unmap;
         }
 
+        kvm_arch_start_assignment(kvm);
         pci_set_dev_assigned(pdev);
 
         dev_info(&pdev->dev, "kvm assign device\n");
@@ -224,6 +225,7 @@ int kvm_deassign_device(struct kvm *kvm, struct pci_dev *pdev)
         iommu_detach_device(domain, &pdev->dev);
 
         pci_clear_dev_assigned(pdev);
+        kvm_arch_end_assignment(kvm);
 
         dev_info(&pdev->dev, "kvm deassign device\n");
 
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index 954e98a8c2e3..2a5ca97c263b 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -1595,7 +1595,7 @@ void kvm_lapic_reset(struct kvm_vcpu *vcpu, bool init_event)
         for (i = 0; i < APIC_LVT_NUM; i++)
                 apic_set_reg(apic, APIC_LVTT + 0x10 * i, APIC_LVT_MASKED);
         apic_update_lvtt(apic);
-        if (!(vcpu->kvm->arch.disabled_quirks & KVM_QUIRK_LINT0_REENABLED))
+        if (kvm_check_has_quirk(vcpu->kvm, KVM_X86_QUIRK_LINT0_REENABLED))
                 apic_set_reg(apic, APIC_LVT0,
                              SET_APIC_DELIVERY_MODE(0, APIC_MODE_EXTINT));
         apic_manage_nmi_watchdog(apic, kvm_apic_get_reg(apic, APIC_LVT0));
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index f807496b62c2..44171462bd2a 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -2479,6 +2479,14 @@ static int mmu_need_write_protect(struct kvm_vcpu *vcpu, gfn_t gfn,
         return 0;
 }
 
+static bool kvm_is_mmio_pfn(pfn_t pfn)
+{
+        if (pfn_valid(pfn))
+                return !is_zero_pfn(pfn) && PageReserved(pfn_to_page(pfn));
+
+        return true;
+}
+
 static int set_spte(struct kvm_vcpu *vcpu, u64 *sptep,
                     unsigned pte_access, int level,
                     gfn_t gfn, pfn_t pfn, bool speculative,
@@ -2506,7 +2514,7 @@ static int set_spte(struct kvm_vcpu *vcpu, u64 *sptep,
                 spte |= PT_PAGE_SIZE_MASK;
         if (tdp_enabled)
                 spte |= kvm_x86_ops->get_mt_mask(vcpu, gfn,
-                        kvm_is_reserved_pfn(pfn));
+                        kvm_is_mmio_pfn(pfn));
 
         if (host_writable)
                 spte |= SPTE_HOST_WRITEABLE;
diff --git a/arch/x86/kvm/mtrr.c b/arch/x86/kvm/mtrr.c
index de1d2d8062e2..dc0a84a6f309 100644
--- a/arch/x86/kvm/mtrr.c
+++ b/arch/x86/kvm/mtrr.c
@@ -120,6 +120,16 @@ static u8 mtrr_default_type(struct kvm_mtrr *mtrr_state)
         return mtrr_state->deftype & IA32_MTRR_DEF_TYPE_TYPE_MASK;
 }
 
+static u8 mtrr_disabled_type(void)
+{
+        /*
+         * Intel SDM 11.11.2.2: all MTRRs are disabled when
+         * IA32_MTRR_DEF_TYPE.E bit is cleared, and the UC
+         * memory type is applied to all of physical memory.
+         */
+        return MTRR_TYPE_UNCACHABLE;
+}
+
 /*
 * Three terms are used in the following code:
 * - segment, it indicates the address segments covered by fixed MTRRs.
@@ -434,6 +444,8 @@ struct mtrr_iter {
 
         /* output fields. */
         int mem_type;
+        /* mtrr is completely disabled? */
+        bool mtrr_disabled;
         /* [start, end) is not fully covered in MTRRs? */
         bool partial_map;
 
@@ -549,7 +561,7 @@ static void mtrr_lookup_var_next(struct mtrr_iter *iter)
 static void mtrr_lookup_start(struct mtrr_iter *iter)
 {
         if (!mtrr_is_enabled(iter->mtrr_state)) {
-                iter->partial_map = true;
+                iter->mtrr_disabled = true;
                 return;
         }
 
@@ -563,6 +575,7 @@ static void mtrr_lookup_init(struct mtrr_iter *iter,
         iter->mtrr_state = mtrr_state;
         iter->start = start;
         iter->end = end;
+        iter->mtrr_disabled = false;
         iter->partial_map = false;
         iter->fixed = false;
         iter->range = NULL;
@@ -656,15 +669,19 @@ u8 kvm_mtrr_get_guest_memory_type(struct kvm_vcpu *vcpu, gfn_t gfn)
                 return MTRR_TYPE_WRBACK;
         }
 
-        /* It is not covered by MTRRs. */
-        if (iter.partial_map) {
-                /*
-                 * We just check one page, partially covered by MTRRs is
-                 * impossible.
-                 */
-                WARN_ON(type != -1);
-                type = mtrr_default_type(mtrr_state);
-        }
+        if (iter.mtrr_disabled)
+                return mtrr_disabled_type();
+
+        /*
+         * We just check one page, partially covered by MTRRs is
+         * impossible.
+         */
+        WARN_ON(iter.partial_map);
+
+        /* not contained in any MTRRs. */
+        if (type == -1)
+                return mtrr_default_type(mtrr_state);
+
         return type;
 }
 EXPORT_SYMBOL_GPL(kvm_mtrr_get_guest_memory_type);
@@ -689,6 +706,9 @@ bool kvm_mtrr_check_gfn_range_consistency(struct kvm_vcpu *vcpu, gfn_t gfn,
                         return false;
         }
 
+        if (iter.mtrr_disabled)
+                return true;
+
         if (!iter.partial_map)
                 return true;
 
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index 602b974a60a6..8e0c0844c6b9 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -865,6 +865,64 @@ static void svm_disable_lbrv(struct vcpu_svm *svm)
         set_msr_interception(msrpm, MSR_IA32_LASTINTTOIP, 0, 0);
 }
 
+#define MTRR_TYPE_UC_MINUS      7
+#define MTRR2PROTVAL_INVALID 0xff
+
+static u8 mtrr2protval[8];
+
+static u8 fallback_mtrr_type(int mtrr)
+{
+        /*
+         * WT and WP aren't always available in the host PAT.  Treat
+         * them as UC and UC- respectively.  Everything else should be
+         * there.
+         */
+        switch (mtrr)
+        {
+        case MTRR_TYPE_WRTHROUGH:
+                return MTRR_TYPE_UNCACHABLE;
+        case MTRR_TYPE_WRPROT:
+                return MTRR_TYPE_UC_MINUS;
+        default:
+                BUG();
+        }
+}
+
+static void build_mtrr2protval(void)
+{
+        int i;
+        u64 pat;
+
+        for (i = 0; i < 8; i++)
+                mtrr2protval[i] = MTRR2PROTVAL_INVALID;
+
+        /* Ignore the invalid MTRR types.  */
+        mtrr2protval[2] = 0;
+        mtrr2protval[3] = 0;
+
+        /*
+         * Use host PAT value to figure out the mapping from guest MTRR
+         * values to nested page table PAT/PCD/PWT values.  We do not
+         * want to change the host PAT value every time we enter the
+         * guest.
+         */
+        rdmsrl(MSR_IA32_CR_PAT, pat);
+        for (i = 0; i < 8; i++) {
+                u8 mtrr = pat >> (8 * i);
+
+                if (mtrr2protval[mtrr] == MTRR2PROTVAL_INVALID)
+                        mtrr2protval[mtrr] = __cm_idx2pte(i);
+        }
+
+        for (i = 0; i < 8; i++) {
+                if (mtrr2protval[i] == MTRR2PROTVAL_INVALID) {
+                        u8 fallback = fallback_mtrr_type(i);
+                        mtrr2protval[i] = mtrr2protval[fallback];
+                        BUG_ON(mtrr2protval[i] == MTRR2PROTVAL_INVALID);
+                }
+        }
+}
+
 static __init int svm_hardware_setup(void)
 {
         int cpu;
@@ -931,6 +989,7 @@ static __init int svm_hardware_setup(void)
         } else
                 kvm_disable_tdp();
 
+        build_mtrr2protval();
         return 0;
 
 err:
@@ -1085,6 +1144,39 @@ static u64 svm_compute_tsc_offset(struct kvm_vcpu *vcpu, u64 target_tsc)
         return target_tsc - tsc;
 }
 
+static void svm_set_guest_pat(struct vcpu_svm *svm, u64 *g_pat)
+{
+        struct kvm_vcpu *vcpu = &svm->vcpu;
+
+        /* Unlike Intel, AMD takes the guest's CR0.CD into account.
+         *
+         * AMD does not have IPAT.  To emulate it for the case of guests
+         * with no assigned devices, just set everything to WB.  If guests
+         * have assigned devices, however, we cannot force WB for RAM
+         * pages only, so use the guest PAT directly.
+         */
+        if (!kvm_arch_has_assigned_device(vcpu->kvm))
+                *g_pat = 0x0606060606060606;
+        else
+                *g_pat = vcpu->arch.pat;
+}
+
+static u64 svm_get_mt_mask(struct kvm_vcpu *vcpu, gfn_t gfn, bool is_mmio)
+{
+        u8 mtrr;
+
+        /*
+         * 1. MMIO: trust guest MTRR, so same as item 3.
+         * 2. No passthrough: always map as WB, and force guest PAT to WB as well
+         * 3. Passthrough: can't guarantee the result, try to trust guest.
+         */
+        if (!is_mmio && !kvm_arch_has_assigned_device(vcpu->kvm))
+                return 0;
+
+        mtrr = kvm_mtrr_get_guest_memory_type(vcpu, gfn);
+        return mtrr2protval[mtrr];
+}
+
 static void init_vmcb(struct vcpu_svm *svm, bool init_event)
 {
         struct vmcb_control_area *control = &svm->vmcb->control;
@@ -1180,6 +1272,7 @@ static void init_vmcb(struct vcpu_svm *svm, bool init_event)
                 clr_cr_intercept(svm, INTERCEPT_CR3_READ);
                 clr_cr_intercept(svm, INTERCEPT_CR3_WRITE);
                 save->g_pat = svm->vcpu.arch.pat;
+                svm_set_guest_pat(svm, &save->g_pat);
                 save->cr3 = 0;
                 save->cr4 = 0;
         }
@@ -1579,7 +1672,7 @@ static void svm_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0)
          * does not do it - this results in some delay at
          * reboot
          */
-        if (!(vcpu->kvm->arch.disabled_quirks & KVM_QUIRK_CD_NW_CLEARED))
+        if (kvm_check_has_quirk(vcpu->kvm, KVM_X86_QUIRK_CD_NW_CLEARED))
                 cr0 &= ~(X86_CR0_CD | X86_CR0_NW);
         svm->vmcb->save.cr0 = cr0;
         mark_dirty(svm->vmcb, VMCB_CR);
@@ -3254,6 +3347,16 @@ static int svm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr)
         case MSR_VM_IGNNE:
                 vcpu_unimpl(vcpu, "unimplemented wrmsr: 0x%x data 0x%llx\n", ecx, data);
                 break;
+        case MSR_IA32_CR_PAT:
+                if (npt_enabled) {
+                        if (!kvm_mtrr_valid(vcpu, MSR_IA32_CR_PAT, data))
+                                return 1;
+                        vcpu->arch.pat = data;
+                        svm_set_guest_pat(svm, &svm->vmcb->save.g_pat);
+                        mark_dirty(svm->vmcb, VMCB_NPT);
+                        break;
+                }
+                /* fall through */
         default:
                 return kvm_set_msr_common(vcpu, msr);
         }
@@ -4088,11 +4191,6 @@ static bool svm_has_high_real_mode_segbase(void)
         return true;
 }
 
-static u64 svm_get_mt_mask(struct kvm_vcpu *vcpu, gfn_t gfn, bool is_mmio)
-{
-        return 0;
-}
-
 static void svm_cpuid_update(struct kvm_vcpu *vcpu)
 {
 }
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index e856dd566f4c..83b7b5cd75d5 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -8632,22 +8632,17 @@ static u64 vmx_get_mt_mask(struct kvm_vcpu *vcpu, gfn_t gfn, bool is_mmio)
         u64 ipat = 0;
 
         /* For VT-d and EPT combination
-         * 1. MMIO: always map as UC
+         * 1. MMIO: guest may want to apply WC, trust it.
          * 2. EPT with VT-d:
          *   a. VT-d without snooping control feature: can't guarantee the
-         *      result, try to trust guest.
+         *      result, try to trust guest.  So the same as item 1.
          *   b. VT-d with snooping control feature: snooping control feature of
          *      VT-d engine can guarantee the cache correctness. Just set it
          *      to WB to keep consistent with host. So the same as item 3.
          * 3. EPT without VT-d: always map as WB and set IPAT=1 to keep
          *    consistent with host MTRR
          */
-        if (is_mmio) {
-                cache = MTRR_TYPE_UNCACHABLE;
-                goto exit;
-        }
-
-        if (!kvm_arch_has_noncoherent_dma(vcpu->kvm)) {
+        if (!is_mmio && !kvm_arch_has_noncoherent_dma(vcpu->kvm)) {
                 ipat = VMX_EPT_IPAT_BIT;
                 cache = MTRR_TYPE_WRBACK;
                 goto exit;
@@ -8655,7 +8650,10 @@ static u64 vmx_get_mt_mask(struct kvm_vcpu *vcpu, gfn_t gfn, bool is_mmio)
 
         if (kvm_read_cr0(vcpu) & X86_CR0_CD) {
                 ipat = VMX_EPT_IPAT_BIT;
-                cache = MTRR_TYPE_UNCACHABLE;
+                if (kvm_check_has_quirk(vcpu->kvm, KVM_X86_QUIRK_CD_NW_CLEARED))
+                        cache = MTRR_TYPE_WRBACK;
+                else
+                        cache = MTRR_TYPE_UNCACHABLE;
                 goto exit;
         }
 
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index bbaf44e8f0d3..5ef2560075bf 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -3157,8 +3157,7 @@ static void load_xsave(struct kvm_vcpu *vcpu, u8 *src)
                         cpuid_count(XSTATE_CPUID, index,
                                     &size, &offset, &ecx, &edx);
                         memcpy(dest, src + offset, size);
-                } else
-                        WARN_ON_ONCE(1);
+                }
 
                 valid -= feature;
         }
@@ -7315,11 +7314,6 @@ struct kvm_vcpu *kvm_arch_vcpu_create(struct kvm *kvm,
 
         vcpu = kvm_x86_ops->vcpu_create(kvm, id);
 
-        /*
-         * Activate fpu unconditionally in case the guest needs eager FPU.  It will be
-         * deactivated soon if it doesn't.
-         */
-        kvm_x86_ops->fpu_activate(vcpu);
         return vcpu;
 }
 
@@ -8218,6 +8212,24 @@ bool kvm_arch_can_inject_async_page_present(struct kvm_vcpu *vcpu)
                         kvm_x86_ops->interrupt_allowed(vcpu);
 }
 
+void kvm_arch_start_assignment(struct kvm *kvm)
+{
+        atomic_inc(&kvm->arch.assigned_device_count);
+}
+EXPORT_SYMBOL_GPL(kvm_arch_start_assignment);
+
+void kvm_arch_end_assignment(struct kvm *kvm)
+{
+        atomic_dec(&kvm->arch.assigned_device_count);
+}
+EXPORT_SYMBOL_GPL(kvm_arch_end_assignment);
+
+bool kvm_arch_has_assigned_device(struct kvm *kvm)
+{
+        return atomic_read(&kvm->arch.assigned_device_count);
+}
+EXPORT_SYMBOL_GPL(kvm_arch_has_assigned_device);
+
 void kvm_arch_register_noncoherent_dma(struct kvm *kvm)
 {
         atomic_inc(&kvm->arch.noncoherent_dma_count);
diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h
index edc8cdcd786b..0ca2f3e4803c 100644
--- a/arch/x86/kvm/x86.h
+++ b/arch/x86/kvm/x86.h
@@ -147,6 +147,11 @@ static inline void kvm_register_writel(struct kvm_vcpu *vcpu,
         return kvm_register_write(vcpu, reg, val);
 }
 
+static inline bool kvm_check_has_quirk(struct kvm *kvm, u64 quirk)
+{
+        return !(kvm->arch.disabled_quirks & quirk);
+}
+
 void kvm_before_handle_nmi(struct kvm_vcpu *vcpu);
 void kvm_after_handle_nmi(struct kvm_vcpu *vcpu);
 void kvm_set_pending_timer(struct kvm_vcpu *vcpu);
diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
index cc5ccc415cc0..b9c78f3bcd67 100644
--- a/arch/x86/mm/ioremap.c
+++ b/arch/x86/mm/ioremap.c
@@ -63,8 +63,6 @@ static int __ioremap_check_ram(unsigned long start_pfn, unsigned long nr_pages,
                     !PageReserved(pfn_to_page(start_pfn + i)))
                         return 1;
 
-        WARN_ONCE(1, "ioremap on RAM pfn 0x%lx\n", start_pfn);
-
         return 0;
 }
 
@@ -94,7 +92,6 @@ static void __iomem *__ioremap_caller(resource_size_t phys_addr,
         pgprot_t prot;
         int retval;
         void __iomem *ret_addr;
-        int ram_region;
 
         /* Don't allow wraparound or zero size */
         last_addr = phys_addr + size - 1;
@@ -117,23 +114,15 @@ static void __iomem *__ioremap_caller(resource_size_t phys_addr,
         /*
          * Don't allow anybody to remap normal RAM that we're using..
          */
-        /* First check if whole region can be identified as RAM or not */
-        ram_region = region_is_ram(phys_addr, size);
-        if (ram_region > 0) {
-                WARN_ONCE(1, "ioremap on RAM at 0x%lx - 0x%lx\n",
-                                (unsigned long int)phys_addr,
-                                (unsigned long int)last_addr);
+        pfn      = phys_addr >> PAGE_SHIFT;
+        last_pfn = last_addr >> PAGE_SHIFT;
+        if (walk_system_ram_range(pfn, last_pfn - pfn + 1, NULL,
+                                          __ioremap_check_ram) == 1) {
+                WARN_ONCE(1, "ioremap on RAM at %pa - %pa\n",
+                          &phys_addr, &last_addr);
                 return NULL;
         }
 
-        /* If could not be identified(-1), check page by page */
-        if (ram_region < 0) {
-                pfn      = phys_addr >> PAGE_SHIFT;
-                last_pfn = last_addr >> PAGE_SHIFT;
-                if (walk_system_ram_range(pfn, last_pfn - pfn + 1, NULL,
-                                          __ioremap_check_ram) == 1)
-                        return NULL;
-        }
         /*
          * Mappings have to be page-aligned
          */
diff --git a/arch/x86/mm/kasan_init_64.c b/arch/x86/mm/kasan_init_64.c
index 4860906c6b9f..e1840f3db5b5 100644
--- a/arch/x86/mm/kasan_init_64.c
+++ b/arch/x86/mm/kasan_init_64.c
@@ -1,3 +1,4 @@
+#define pr_fmt(fmt) "kasan: " fmt
 #include <linux/bootmem.h>
 #include <linux/kasan.h>
 #include <linux/kdebug.h>
@@ -11,7 +12,19 @@
 extern pgd_t early_level4_pgt[PTRS_PER_PGD];
 extern struct range pfn_mapped[E820_X_MAX];
 
-extern unsigned char kasan_zero_page[PAGE_SIZE];
+static pud_t kasan_zero_pud[PTRS_PER_PUD] __page_aligned_bss;
+static pmd_t kasan_zero_pmd[PTRS_PER_PMD] __page_aligned_bss;
+static pte_t kasan_zero_pte[PTRS_PER_PTE] __page_aligned_bss;
+
+/*
+ * This page used as early shadow. We don't use empty_zero_page
+ * at early stages, stack instrumentation could write some garbage
+ * to this page.
+ * Latter we reuse it as zero shadow for large ranges of memory
+ * that allowed to access, but not instrumented by kasan
+ * (vmalloc/vmemmap ...).
+ */
+static unsigned char kasan_zero_page[PAGE_SIZE] __page_aligned_bss;
 
 static int __init map_range(struct range *range)
 {
@@ -36,7 +49,7 @@ static void __init clear_pgds(unsigned long start,
                 pgd_clear(pgd_offset_k(start));
 }
 
-void __init kasan_map_early_shadow(pgd_t *pgd)
+static void __init kasan_map_early_shadow(pgd_t *pgd)
 {
         int i;
         unsigned long start = KASAN_SHADOW_START;
@@ -73,7 +86,7 @@ static int __init zero_pmd_populate(pud_t *pud, unsigned long addr,
         while (IS_ALIGNED(addr, PMD_SIZE) && addr + PMD_SIZE <= end) {
                 WARN_ON(!pmd_none(*pmd));
                 set_pmd(pmd, __pmd(__pa_nodebug(kasan_zero_pte)
-                                        | __PAGE_KERNEL_RO));
+                                        | _KERNPG_TABLE));
                 addr += PMD_SIZE;
                 pmd = pmd_offset(pud, addr);
         }
@@ -99,7 +112,7 @@ static int __init zero_pud_populate(pgd_t *pgd, unsigned long addr,
         while (IS_ALIGNED(addr, PUD_SIZE) && addr + PUD_SIZE <= end) {
                 WARN_ON(!pud_none(*pud));
                 set_pud(pud, __pud(__pa_nodebug(kasan_zero_pmd)
-                                        | __PAGE_KERNEL_RO));
+                                        | _KERNPG_TABLE));
                 addr += PUD_SIZE;
                 pud = pud_offset(pgd, addr);
         }
@@ -124,7 +137,7 @@ static int __init zero_pgd_populate(unsigned long addr, unsigned long end)
         while (IS_ALIGNED(addr, PGDIR_SIZE) && addr + PGDIR_SIZE <= end) {
                 WARN_ON(!pgd_none(*pgd));
                 set_pgd(pgd, __pgd(__pa_nodebug(kasan_zero_pud)
-                                        | __PAGE_KERNEL_RO));
+                                        | _KERNPG_TABLE));
                 addr += PGDIR_SIZE;
                 pgd = pgd_offset_k(addr);
         }
@@ -166,6 +179,26 @@ static struct notifier_block kasan_die_notifier = {
 };
 #endif
 
+void __init kasan_early_init(void)
+{
+        int i;
+        pteval_t pte_val = __pa_nodebug(kasan_zero_page) | __PAGE_KERNEL;
+        pmdval_t pmd_val = __pa_nodebug(kasan_zero_pte) | _KERNPG_TABLE;
+        pudval_t pud_val = __pa_nodebug(kasan_zero_pmd) | _KERNPG_TABLE;
+
+        for (i = 0; i < PTRS_PER_PTE; i++)
+                kasan_zero_pte[i] = __pte(pte_val);
+
+        for (i = 0; i < PTRS_PER_PMD; i++)
+                kasan_zero_pmd[i] = __pmd(pmd_val);
+
+        for (i = 0; i < PTRS_PER_PUD; i++)
+                kasan_zero_pud[i] = __pud(pud_val);
+
+        kasan_map_early_shadow(early_level4_pgt);
+        kasan_map_early_shadow(init_level4_pgt);
+}
+
 void __init kasan_init(void)
 {
         int i;
@@ -176,6 +209,7 @@ void __init kasan_init(void)
 
         memcpy(early_level4_pgt, init_level4_pgt, sizeof(early_level4_pgt));
         load_cr3(early_level4_pgt);
+        __flush_tlb_all();
 
         clear_pgds(KASAN_SHADOW_START, KASAN_SHADOW_END);
 
@@ -202,5 +236,8 @@ void __init kasan_init(void)
         memset(kasan_zero_page, 0, PAGE_SIZE);
 
         load_cr3(init_level4_pgt);
+        __flush_tlb_all();
         init_task.kasan_depth = 0;
+
+        pr_info("Kernel address sanitizer initialized\n");
 }
diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
index 9d518d693b4b..844b06d67df4 100644
--- a/arch/x86/mm/mmap.c
+++ b/arch/x86/mm/mmap.c
@@ -126,3 +126,10 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
                 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
         }
 }
+
+const char *arch_vma_name(struct vm_area_struct *vma)
+{
+        if (vma->vm_flags & VM_MPX)
+                return "[mpx]";
+        return NULL;
+}
diff --git a/arch/x86/mm/mpx.c b/arch/x86/mm/mpx.c
index 7a657f58bbea..db1b0bc5017c 100644
--- a/arch/x86/mm/mpx.c
+++ b/arch/x86/mm/mpx.c
@@ -20,20 +20,6 @@
 #define CREATE_TRACE_POINTS
 #include <asm/trace/mpx.h>
 
-static const char *mpx_mapping_name(struct vm_area_struct *vma)
-{
-        return "[mpx]";
-}
-
-static struct vm_operations_struct mpx_vma_ops = {
-        .name = mpx_mapping_name,
-};
-
-static int is_mpx_vma(struct vm_area_struct *vma)
-{
-        return (vma->vm_ops == &mpx_vma_ops);
-}
-
 static inline unsigned long mpx_bd_size_bytes(struct mm_struct *mm)
 {
         if (is_64bit_mm(mm))
@@ -53,9 +39,6 @@ static inline unsigned long mpx_bt_size_bytes(struct mm_struct *mm)
 /*
  * This is really a simplified "vm_mmap". it only handles MPX
  * bounds tables (the bounds directory is user-allocated).
- *
- * Later on, we use the vma->vm_ops to uniquely identify these
- * VMAs.
  */
 static unsigned long mpx_mmap(unsigned long len)
 {
@@ -101,7 +84,6 @@ static unsigned long mpx_mmap(unsigned long len)
                 ret = -ENOMEM;
                 goto out;
         }
-        vma->vm_ops = &mpx_vma_ops;
 
         if (vm_flags & VM_LOCKED) {
                 up_write(&mm->mmap_sem);
@@ -812,7 +794,7 @@ static noinline int zap_bt_entries_mapping(struct mm_struct *mm,
                  * so stop immediately and return an error.  This
                  * probably results in a SIGSEGV.
                  */
-                if (!is_mpx_vma(vma))
+                if (!(vma->vm_flags & VM_MPX))
                         return -EINVAL;
 
                 len = min(vma->vm_end, end) - addr;
@@ -945,9 +927,9 @@ static int try_unmap_single_bt(struct mm_struct *mm,
          * lots of tables even though we have no actual table
          * entries in use.
          */
-        while (next && is_mpx_vma(next))
+        while (next && (next->vm_flags & VM_MPX))
                 next = next->vm_next;
-        while (prev && is_mpx_vma(prev))
+        while (prev && (prev->vm_flags & VM_MPX))
                 prev = prev->vm_prev;
         /*
          * We know 'start' and 'end' lie within an area controlled
diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
index 3250f2371aea..90b924acd982 100644
--- a/arch/x86/mm/tlb.c
+++ b/arch/x86/mm/tlb.c
@@ -117,7 +117,7 @@ static void flush_tlb_func(void *info)
                 } else {
                         unsigned long addr;
                         unsigned long nr_pages =
-                                f->flush_end - f->flush_start / PAGE_SIZE;
+                                (f->flush_end - f->flush_start) / PAGE_SIZE;
                         addr = f->flush_start;
                         while (addr < f->flush_end) {
                                 __flush_tlb_single(addr);
diff --git a/arch/xtensa/include/asm/Kbuild b/arch/xtensa/include/asm/Kbuild
index 14d15bf1a95b..5b478accd5fc 100644
--- a/arch/xtensa/include/asm/Kbuild
+++ b/arch/xtensa/include/asm/Kbuild
@@ -19,6 +19,7 @@ generic-y += linkage.h
 generic-y += local.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
+generic-y += mm-arch-hooks.h
 generic-y += percpu.h
 generic-y += preempt.h
 generic-y += resource.h
diff --git a/arch/xtensa/include/asm/mm-arch-hooks.h b/arch/xtensa/include/asm/mm-arch-hooks.h
deleted file mode 100644
index d2e5cfd3dd02..000000000000
--- a/arch/xtensa/include/asm/mm-arch-hooks.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Architecture specific mm hooks
- *
- * Copyright (C) 2015, IBM Corporation
- * Author: Laurent Dufour <ldufour@linux.vnet.ibm.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#ifndef _ASM_XTENSA_MM_ARCH_HOOKS_H
-#define _ASM_XTENSA_MM_ARCH_HOOKS_H
-
-#endif /* _ASM_XTENSA_MM_ARCH_HOOKS_H */
diff --git a/block/bio-integrity.c b/block/bio-integrity.c
index 0436c21db7f2..719b7152aed1 100644
--- a/block/bio-integrity.c
+++ b/block/bio-integrity.c
@@ -51,7 +51,7 @@ struct bio_integrity_payload *bio_integrity_alloc(struct bio *bio,
         unsigned long idx = BIO_POOL_NONE;
         unsigned inline_vecs;
 
-        if (!bs) {
+        if (!bs || !bs->bio_integrity_pool) {
                 bip = kmalloc(sizeof(struct bio_integrity_payload) +
                               sizeof(struct bio_vec) * nr_vecs, gfp_mask);
                 inline_vecs = nr_vecs;
@@ -104,7 +104,7 @@ void bio_integrity_free(struct bio *bio)
                 kfree(page_address(bip->bip_vec->bv_page) +
                       bip->bip_vec->bv_offset);
 
-        if (bs) {
+        if (bs && bs->bio_integrity_pool) {
                 if (bip->bip_slab != BIO_POOL_NONE)
                         bvec_free(bs->bvec_integrity_pool, bip->bip_vec,
                                   bip->bip_slab);
diff --git a/block/bio.c b/block/bio.c
index 2a00d349cd68..d6e5ba3399f0 100644
--- a/block/bio.c
+++ b/block/bio.c
@@ -1831,8 +1831,9 @@ EXPORT_SYMBOL(bio_endio);
  * Allocates and returns a new bio which represents @sectors from the start of
  * @bio, and updates @bio to represent the remaining sectors.
  *
- * The newly allocated bio will point to @bio's bi_io_vec; it is the caller's
- * responsibility to ensure that @bio is not freed before the split.
+ * Unless this is a discard request the newly allocated bio will point
+ * to @bio's bi_io_vec; it is the caller's responsibility to ensure that
+ * @bio is not freed before the split.
  */
 struct bio *bio_split(struct bio *bio, int sectors,
                       gfp_t gfp, struct bio_set *bs)
@@ -1842,7 +1843,15 @@ struct bio *bio_split(struct bio *bio, int sectors,
         BUG_ON(sectors <= 0);
         BUG_ON(sectors >= bio_sectors(bio));
 
-        split = bio_clone_fast(bio, gfp, bs);
+        /*
+         * Discards need a mutable bio_vec to accommodate the payload
+         * required by the DSM TRIM and UNMAP commands.
+         */
+        if (bio->bi_rw & REQ_DISCARD)
+                split = bio_clone_bioset(bio, gfp, bs);
+        else
+                split = bio_clone_fast(bio, gfp, bs);
+
         if (!split)
                 return NULL;
 
@@ -2009,6 +2018,7 @@ int bio_associate_blkcg(struct bio *bio, struct cgroup_subsys_state *blkcg_css)
         bio->bi_css = blkcg_css;
         return 0;
 }
+EXPORT_SYMBOL_GPL(bio_associate_blkcg);
 
 /**
  * bio_associate_current - associate a bio with %current
@@ -2039,6 +2049,7 @@ int bio_associate_current(struct bio *bio)
         bio->bi_css = task_get_css(current, blkio_cgrp_id);
         return 0;
 }
+EXPORT_SYMBOL_GPL(bio_associate_current);
 
 /**
  * bio_disassociate_task - undo bio_associate_current()
diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
index 9f97da52d006..d6283b3f5db5 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -29,6 +29,14 @@
 
 #define MAX_KEY_LEN 100
 
+/*
+ * blkcg_pol_mutex protects blkcg_policy[] and policy [de]activation.
+ * blkcg_pol_register_mutex nests outside of it and synchronizes entire
+ * policy [un]register operations including cgroup file additions /
+ * removals.  Putting cgroup file registration outside blkcg_pol_mutex
+ * allows grabbing it from cgroup callbacks.
+ */
+static DEFINE_MUTEX(blkcg_pol_register_mutex);
 static DEFINE_MUTEX(blkcg_pol_mutex);
 
 struct blkcg blkcg_root;
@@ -38,6 +46,8 @@ struct cgroup_subsys_state * const blkcg_root_css = &blkcg_root.css;
 
 static struct blkcg_policy *blkcg_policy[BLKCG_MAX_POLS];
 
+static LIST_HEAD(all_blkcgs);           /* protected by blkcg_pol_mutex */
+
 static bool blkcg_policy_enabled(struct request_queue *q,
                                  const struct blkcg_policy *pol)
 {
@@ -453,20 +463,7 @@ static int blkcg_reset_stats(struct cgroup_subsys_state *css,
         struct blkcg_gq *blkg;
         int i;
 
-        /*
-         * XXX: We invoke cgroup_add/rm_cftypes() under blkcg_pol_mutex
-         * which ends up putting cgroup's internal cgroup_tree_mutex under
-         * it; however, cgroup_tree_mutex is nested above cgroup file
-         * active protection and grabbing blkcg_pol_mutex from a cgroup
-         * file operation creates a possible circular dependency.  cgroup
-         * internal locking is planned to go through further simplification
-         * and this issue should go away soon.  For now, let's trylock
-         * blkcg_pol_mutex and restart the write on failure.
-         *
-         * http://lkml.kernel.org/g/5363C04B.4010400@oracle.com
-         */
-        if (!mutex_trylock(&blkcg_pol_mutex))
-                return restart_syscall();
+        mutex_lock(&blkcg_pol_mutex);
         spin_lock_irq(&blkcg->lock);
 
         /*
@@ -721,8 +718,12 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
                 return -EINVAL;
 
         disk = get_gendisk(MKDEV(major, minor), &part);
-        if (!disk || part)
+        if (!disk)
+                return -EINVAL;
+        if (part) {
+                put_disk(disk);
                 return -EINVAL;
+        }
 
         rcu_read_lock();
         spin_lock_irq(disk->queue->queue_lock);
@@ -822,8 +823,17 @@ static void blkcg_css_free(struct cgroup_subsys_state *css)
 {
         struct blkcg *blkcg = css_to_blkcg(css);
 
-        if (blkcg != &blkcg_root)
+        mutex_lock(&blkcg_pol_mutex);
+        list_del(&blkcg->all_blkcgs_node);
+        mutex_unlock(&blkcg_pol_mutex);
+
+        if (blkcg != &blkcg_root) {
+                int i;
+
+                for (i = 0; i < BLKCG_MAX_POLS; i++)
+                        kfree(blkcg->pd[i]);
                 kfree(blkcg);
+        }
 }
 
 static struct cgroup_subsys_state *
@@ -833,6 +843,8 @@ blkcg_css_alloc(struct cgroup_subsys_state *parent_css)
         struct cgroup_subsys_state *ret;
         int i;
 
+        mutex_lock(&blkcg_pol_mutex);
+
         if (!parent_css) {
                 blkcg = &blkcg_root;
                 goto done;
@@ -875,14 +887,17 @@ done:
 #ifdef CONFIG_CGROUP_WRITEBACK
         INIT_LIST_HEAD(&blkcg->cgwb_list);
 #endif
+        list_add_tail(&blkcg->all_blkcgs_node, &all_blkcgs);
+
+        mutex_unlock(&blkcg_pol_mutex);
         return &blkcg->css;
 
 free_pd_blkcg:
         for (i--; i >= 0; i--)
                 kfree(blkcg->pd[i]);
-
 free_blkcg:
         kfree(blkcg);
+        mutex_unlock(&blkcg_pol_mutex);
         return ret;
 }
 
@@ -1037,10 +1052,8 @@ int blkcg_activate_policy(struct request_queue *q,
                           const struct blkcg_policy *pol)
 {
         LIST_HEAD(pds);
-        LIST_HEAD(cpds);
         struct blkcg_gq *blkg;
         struct blkg_policy_data *pd, *nd;
-        struct blkcg_policy_data *cpd, *cnd;
         int cnt = 0, ret;
 
         if (blkcg_policy_enabled(q, pol))
@@ -1053,10 +1066,7 @@ int blkcg_activate_policy(struct request_queue *q,
                 cnt++;
         spin_unlock_irq(q->queue_lock);
 
-        /*
-         * Allocate per-blkg and per-blkcg policy data
-         * for all existing blkgs.
-         */
+        /* allocate per-blkg policy data for all existing blkgs */
         while (cnt--) {
                 pd = kzalloc_node(pol->pd_size, GFP_KERNEL, q->node);
                 if (!pd) {
@@ -1064,15 +1074,6 @@ int blkcg_activate_policy(struct request_queue *q,
                         goto out_free;
                 }
                 list_add_tail(&pd->alloc_node, &pds);
-
-                if (!pol->cpd_size)
-                        continue;
-                cpd = kzalloc_node(pol->cpd_size, GFP_KERNEL, q->node);
-                if (!cpd) {
-                        ret = -ENOMEM;
-                        goto out_free;
-                }
-                list_add_tail(&cpd->alloc_node, &cpds);
         }
 
         /*
@@ -1082,32 +1083,17 @@ int blkcg_activate_policy(struct request_queue *q,
         spin_lock_irq(q->queue_lock);
 
         list_for_each_entry(blkg, &q->blkg_list, q_node) {
-                if (WARN_ON(list_empty(&pds)) ||
-                    WARN_ON(pol->cpd_size && list_empty(&cpds))) {
+                if (WARN_ON(list_empty(&pds))) {
                         /* umm... this shouldn't happen, just abort */
                         ret = -ENOMEM;
                         goto out_unlock;
                 }
-                cpd = list_first_entry(&cpds, struct blkcg_policy_data,
-                                       alloc_node);
-                list_del_init(&cpd->alloc_node);
                 pd = list_first_entry(&pds, struct blkg_policy_data, alloc_node);
                 list_del_init(&pd->alloc_node);
 
                 /* grab blkcg lock too while installing @pd on @blkg */
                 spin_lock(&blkg->blkcg->lock);
 
-                if (!pol->cpd_size)
-                        goto no_cpd;
-                if (!blkg->blkcg->pd[pol->plid]) {
-                        /* Per-policy per-blkcg data */
-                        blkg->blkcg->pd[pol->plid] = cpd;
-                        cpd->plid = pol->plid;
-                        pol->cpd_init_fn(blkg->blkcg);
-                } else { /* must free it as it has already been extracted */
-                        kfree(cpd);
-                }
-no_cpd:
                 blkg->pd[pol->plid] = pd;
                 pd->blkg = blkg;
                 pd->plid = pol->plid;
@@ -1124,8 +1110,6 @@ out_free:
         blk_queue_bypass_end(q);
         list_for_each_entry_safe(pd, nd, &pds, alloc_node)
                 kfree(pd);
-        list_for_each_entry_safe(cpd, cnd, &cpds, alloc_node)
-                kfree(cpd);
         return ret;
 }
 EXPORT_SYMBOL_GPL(blkcg_activate_policy);
@@ -1162,8 +1146,6 @@ void blkcg_deactivate_policy(struct request_queue *q,
 
                 kfree(blkg->pd[pol->plid]);
                 blkg->pd[pol->plid] = NULL;
-                kfree(blkg->blkcg->pd[pol->plid]);
-                blkg->blkcg->pd[pol->plid] = NULL;
 
                 spin_unlock(&blkg->blkcg->lock);
         }
@@ -1182,11 +1164,13 @@ EXPORT_SYMBOL_GPL(blkcg_deactivate_policy);
  */
 int blkcg_policy_register(struct blkcg_policy *pol)
 {
+        struct blkcg *blkcg;
         int i, ret;
 
         if (WARN_ON(pol->pd_size < sizeof(struct blkg_policy_data)))
                 return -EINVAL;
 
+        mutex_lock(&blkcg_pol_register_mutex);
         mutex_lock(&blkcg_pol_mutex);
 
         /* find an empty slot */
@@ -1195,19 +1179,49 @@ int blkcg_policy_register(struct blkcg_policy *pol)
                 if (!blkcg_policy[i])
                         break;
         if (i >= BLKCG_MAX_POLS)
-                goto out_unlock;
+                goto err_unlock;
 
-        /* register and update blkgs */
+        /* register @pol */
         pol->plid = i;
-        blkcg_policy[i] = pol;
+        blkcg_policy[pol->plid] = pol;
+
+        /* allocate and install cpd's */
+        if (pol->cpd_size) {
+                list_for_each_entry(blkcg, &all_blkcgs, all_blkcgs_node) {
+                        struct blkcg_policy_data *cpd;
+
+                        cpd = kzalloc(pol->cpd_size, GFP_KERNEL);
+                        if (!cpd) {
+                                mutex_unlock(&blkcg_pol_mutex);
+                                goto err_free_cpds;
+                        }
+
+                        blkcg->pd[pol->plid] = cpd;
+                        cpd->plid = pol->plid;
+                        pol->cpd_init_fn(blkcg);
+                }
+        }
+
+        mutex_unlock(&blkcg_pol_mutex);
 
         /* everything is in place, add intf files for the new policy */
         if (pol->cftypes)
                 WARN_ON(cgroup_add_legacy_cftypes(&blkio_cgrp_subsys,
                                                   pol->cftypes));
-        ret = 0;
-out_unlock:
+        mutex_unlock(&blkcg_pol_register_mutex);
+        return 0;
+
+err_free_cpds:
+        if (pol->cpd_size) {
+                list_for_each_entry(blkcg, &all_blkcgs, all_blkcgs_node) {
+                        kfree(blkcg->pd[pol->plid]);
+                        blkcg->pd[pol->plid] = NULL;
+                }
+        }
+        blkcg_policy[pol->plid] = NULL;
+err_unlock:
         mutex_unlock(&blkcg_pol_mutex);
+        mutex_unlock(&blkcg_pol_register_mutex);
         return ret;
 }
 EXPORT_SYMBOL_GPL(blkcg_policy_register);
@@ -1220,7 +1234,9 @@ EXPORT_SYMBOL_GPL(blkcg_policy_register);
  */
 void blkcg_policy_unregister(struct blkcg_policy *pol)
 {
-        mutex_lock(&blkcg_pol_mutex);
+        struct blkcg *blkcg;
+
+        mutex_lock(&blkcg_pol_register_mutex);
 
         if (WARN_ON(blkcg_policy[pol->plid] != pol))
                 goto out_unlock;
@@ -1229,9 +1245,19 @@ void blkcg_policy_unregister(struct blkcg_policy *pol)
         if (pol->cftypes)
                 cgroup_rm_cftypes(pol->cftypes);
 
-        /* unregister and update blkgs */
+        /* remove cpds and unregister */
+        mutex_lock(&blkcg_pol_mutex);
+
+        if (pol->cpd_size) {
+                list_for_each_entry(blkcg, &all_blkcgs, all_blkcgs_node) {
+                        kfree(blkcg->pd[pol->plid]);
+                        blkcg->pd[pol->plid] = NULL;
+                }
+        }
         blkcg_policy[pol->plid] = NULL;
-out_unlock:
+
         mutex_unlock(&blkcg_pol_mutex);
+out_unlock:
+        mutex_unlock(&blkcg_pol_register_mutex);
 }
 EXPORT_SYMBOL_GPL(blkcg_policy_unregister);
diff --git a/block/blk-core.c b/block/blk-core.c
index 82819e68f58b..627ed0c593fb 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -3370,7 +3370,7 @@ EXPORT_SYMBOL(blk_post_runtime_resume);
 int __init blk_dev_init(void)
 {
         BUILD_BUG_ON(__REQ_NR_BITS > 8 *
-                        sizeof(((struct request *)0)->cmd_flags));
+                        FIELD_SIZEOF(struct request, cmd_flags));
 
         /* used for unplugging and affects IO latency/throughput - HIGHPRI */
         kblockd_workqueue = alloc_workqueue("kblockd",
diff --git a/block/blk-mq.c b/block/blk-mq.c
index f53779692c77..7d842db59699 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -1998,7 +1998,7 @@ struct request_queue *blk_mq_init_allocated_queue(struct blk_mq_tag_set *set,
                 goto err_hctxs;
 
         setup_timer(&q->timeout, blk_mq_rq_timer, (unsigned long) q);
-        blk_queue_rq_timeout(q, set->timeout ? set->timeout : 30000);
+        blk_queue_rq_timeout(q, set->timeout ? set->timeout : 30 * HZ);
 
         q->nr_queues = nr_cpu_ids;
         q->nr_hw_queues = set->nr_hw_queues;
diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
index 569ee090343f..46b58abb08c5 100644
--- a/drivers/acpi/acpi_lpss.c
+++ b/drivers/acpi/acpi_lpss.c
@@ -352,13 +352,16 @@ static int acpi_lpss_create_device(struct acpi_device *adev,
                                 pdata->mmio_size = resource_size(rentry->res);
                         pdata->mmio_base = ioremap(rentry->res->start,
                                                    pdata->mmio_size);
-                        if (!pdata->mmio_base)
-                                goto err_out;
                         break;
                 }
 
         acpi_dev_free_resource_list(&resource_list);
 
+        if (!pdata->mmio_base) {
+                ret = -ENOMEM;
+                goto err_out;
+        }
+
         pdata->dev_desc = dev_desc;
 
         if (dev_desc->setup)
diff --git a/drivers/acpi/nfit.c b/drivers/acpi/nfit.c
index 2161fa178c8d..628a42c41ab1 100644
--- a/drivers/acpi/nfit.c
+++ b/drivers/acpi/nfit.c
@@ -18,6 +18,7 @@
 #include <linux/list.h>
 #include <linux/acpi.h>
 #include <linux/sort.h>
+#include <linux/pmem.h>
 #include <linux/io.h>
 #include "nfit.h"
 
@@ -305,6 +306,23 @@ static bool add_idt(struct acpi_nfit_desc *acpi_desc,
         return true;
 }
 
+static bool add_flush(struct acpi_nfit_desc *acpi_desc,
+                struct acpi_nfit_flush_address *flush)
+{
+        struct device *dev = acpi_desc->dev;
+        struct nfit_flush *nfit_flush = devm_kzalloc(dev, sizeof(*nfit_flush),
+                        GFP_KERNEL);
+
+        if (!nfit_flush)
+                return false;
+        INIT_LIST_HEAD(&nfit_flush->list);
+        nfit_flush->flush = flush;
+        list_add_tail(&nfit_flush->list, &acpi_desc->flushes);
+        dev_dbg(dev, "%s: nfit_flush handle: %d hint_count: %d\n", __func__,
+                        flush->device_handle, flush->hint_count);
+        return true;
+}
+
 static void *add_table(struct acpi_nfit_desc *acpi_desc, void *table,
                 const void *end)
 {
@@ -338,7 +356,8 @@ static void *add_table(struct acpi_nfit_desc *acpi_desc, void *table,
                         return err;
                 break;
         case ACPI_NFIT_TYPE_FLUSH_ADDRESS:
-                dev_dbg(dev, "%s: flush\n", __func__);
+                if (!add_flush(acpi_desc, table))
+                        return err;
                 break;
         case ACPI_NFIT_TYPE_SMBIOS:
                 dev_dbg(dev, "%s: smbios\n", __func__);
@@ -389,6 +408,7 @@ static int nfit_mem_add(struct acpi_nfit_desc *acpi_desc,
 {
         u16 dcr = __to_nfit_memdev(nfit_mem)->region_index;
         struct nfit_memdev *nfit_memdev;
+        struct nfit_flush *nfit_flush;
         struct nfit_dcr *nfit_dcr;
         struct nfit_bdw *nfit_bdw;
         struct nfit_idt *nfit_idt;
@@ -442,6 +462,14 @@ static int nfit_mem_add(struct acpi_nfit_desc *acpi_desc,
                         nfit_mem->idt_bdw = nfit_idt->idt;
                         break;
                 }
+
+                list_for_each_entry(nfit_flush, &acpi_desc->flushes, list) {
+                        if (nfit_flush->flush->device_handle !=
+                                        nfit_memdev->memdev->device_handle)
+                                continue;
+                        nfit_mem->nfit_flush = nfit_flush;
+                        break;
+                }
                 break;
         }
 
@@ -978,6 +1006,24 @@ static u64 to_interleave_offset(u64 offset, struct nfit_blk_mmio *mmio)
         return mmio->base_offset + line_offset + table_offset + sub_line_offset;
 }
 
+static void wmb_blk(struct nfit_blk *nfit_blk)
+{
+
+        if (nfit_blk->nvdimm_flush) {
+                /*
+                 * The first wmb() is needed to 'sfence' all previous writes
+                 * such that they are architecturally visible for the platform
+                 * buffer flush.  Note that we've already arranged for pmem
+                 * writes to avoid the cache via arch_memcpy_to_pmem().  The
+                 * final wmb() ensures ordering for the NVDIMM flush write.
+                 */
+                wmb();
+                writeq(1, nfit_blk->nvdimm_flush);
+                wmb();
+        } else
+                wmb_pmem();
+}
+
 static u64 read_blk_stat(struct nfit_blk *nfit_blk, unsigned int bw)
 {
         struct nfit_blk_mmio *mmio = &nfit_blk->mmio[DCR];
@@ -1012,7 +1058,10 @@ static void write_blk_ctl(struct nfit_blk *nfit_blk, unsigned int bw,
                 offset = to_interleave_offset(offset, mmio);
 
         writeq(cmd, mmio->base + offset);
-        /* FIXME: conditionally perform read-back if mandated by firmware */
+        wmb_blk(nfit_blk);
+
+        if (nfit_blk->dimm_flags & ND_BLK_DCR_LATCH)
+                readq(mmio->base + offset);
 }
 
 static int acpi_nfit_blk_single_io(struct nfit_blk *nfit_blk,
@@ -1026,7 +1075,6 @@ static int acpi_nfit_blk_single_io(struct nfit_blk *nfit_blk,
 
         base_offset = nfit_blk->bdw_offset + dpa % L1_CACHE_BYTES
                 + lane * mmio->size;
-        /* TODO: non-temporal access, flush hints, cache management etc... */
         write_blk_ctl(nfit_blk, lane, dpa, len, rw);
         while (len) {
                 unsigned int c;
@@ -1045,13 +1093,19 @@ static int acpi_nfit_blk_single_io(struct nfit_blk *nfit_blk,
                 }
 
                 if (rw)
-                        memcpy(mmio->aperture + offset, iobuf + copied, c);
+                        memcpy_to_pmem(mmio->aperture + offset,
+                                        iobuf + copied, c);
                 else
-                        memcpy(iobuf + copied, mmio->aperture + offset, c);
+                        memcpy_from_pmem(iobuf + copied,
+                                        mmio->aperture + offset, c);
 
                 copied += c;
                 len -= c;
         }
+
+        if (rw)
+                wmb_blk(nfit_blk);
+
         rc = read_blk_stat(nfit_blk, lane) ? -EIO : 0;
         return rc;
 }
@@ -1124,7 +1178,7 @@ static void nfit_spa_unmap(struct acpi_nfit_desc *acpi_desc,
 }
 
 static void __iomem *__nfit_spa_map(struct acpi_nfit_desc *acpi_desc,
-                struct acpi_nfit_system_address *spa)
+                struct acpi_nfit_system_address *spa, enum spa_map_type type)
 {
         resource_size_t start = spa->address;
         resource_size_t n = spa->length;
@@ -1152,8 +1206,15 @@ static void __iomem *__nfit_spa_map(struct acpi_nfit_desc *acpi_desc,
         if (!res)
                 goto err_mem;
 
-        /* TODO: cacheability based on the spa type */
-        spa_map->iomem = ioremap_nocache(start, n);
+        if (type == SPA_MAP_APERTURE) {
+                /*
+                 * TODO: memremap_pmem() support, but that requires cache
+                 * flushing when the aperture is moved.
+                 */
+                spa_map->iomem = ioremap_wc(start, n);
+        } else
+                spa_map->iomem = ioremap_nocache(start, n);
+
         if (!spa_map->iomem)
                 goto err_map;
 
@@ -1171,6 +1232,7 @@ static void __iomem *__nfit_spa_map(struct acpi_nfit_desc *acpi_desc,
  * nfit_spa_map - interleave-aware managed-mappings of acpi_nfit_system_address ranges
  * @nvdimm_bus: NFIT-bus that provided the spa table entry
  * @nfit_spa: spa table to map
+ * @type: aperture or control region
  *
  * In the case where block-data-window apertures and
  * dimm-control-regions are interleaved they will end up sharing a
@@ -1180,12 +1242,12 @@ static void __iomem *__nfit_spa_map(struct acpi_nfit_desc *acpi_desc,
  * unbound.
  */
 static void __iomem *nfit_spa_map(struct acpi_nfit_desc *acpi_desc,
-                struct acpi_nfit_system_address *spa)
+                struct acpi_nfit_system_address *spa, enum spa_map_type type)
 {
         void __iomem *iomem;
 
         mutex_lock(&acpi_desc->spa_map_mutex);
-        iomem = __nfit_spa_map(acpi_desc, spa);
+        iomem = __nfit_spa_map(acpi_desc, spa, type);
         mutex_unlock(&acpi_desc->spa_map_mutex);
 
         return iomem;
@@ -1206,12 +1268,35 @@ static int nfit_blk_init_interleave(struct nfit_blk_mmio *mmio,
         return 0;
 }
 
+static int acpi_nfit_blk_get_flags(struct nvdimm_bus_descriptor *nd_desc,
+                struct nvdimm *nvdimm, struct nfit_blk *nfit_blk)
+{
+        struct nd_cmd_dimm_flags flags;
+        int rc;
+
+        memset(&flags, 0, sizeof(flags));
+        rc = nd_desc->ndctl(nd_desc, nvdimm, ND_CMD_DIMM_FLAGS, &flags,
+                        sizeof(flags));
+
+        if (rc >= 0 && flags.status == 0)
+                nfit_blk->dimm_flags = flags.flags;
+        else if (rc == -ENOTTY) {
+                /* fall back to a conservative default */
+                nfit_blk->dimm_flags = ND_BLK_DCR_LATCH;
+                rc = 0;
+        } else
+                rc = -ENXIO;
+
+        return rc;
+}
+
 static int acpi_nfit_blk_region_enable(struct nvdimm_bus *nvdimm_bus,
                 struct device *dev)
 {
         struct nvdimm_bus_descriptor *nd_desc = to_nd_desc(nvdimm_bus);
         struct acpi_nfit_desc *acpi_desc = to_acpi_desc(nd_desc);
         struct nd_blk_region *ndbr = to_nd_blk_region(dev);
+        struct nfit_flush *nfit_flush;
         struct nfit_blk_mmio *mmio;
         struct nfit_blk *nfit_blk;
         struct nfit_mem *nfit_mem;
@@ -1223,8 +1308,8 @@ static int acpi_nfit_blk_region_enable(struct nvdimm_bus *nvdimm_bus,
         if (!nfit_mem || !nfit_mem->dcr || !nfit_mem->bdw) {
                 dev_dbg(dev, "%s: missing%s%s%s\n", __func__,
                                 nfit_mem ? "" : " nfit_mem",
-                                nfit_mem->dcr ? "" : " dcr",
-                                nfit_mem->bdw ? "" : " bdw");
+                                (nfit_mem && nfit_mem->dcr) ? "" : " dcr",
+                                (nfit_mem && nfit_mem->bdw) ? "" : " bdw");
                 return -ENXIO;
         }
 
@@ -1237,7 +1322,8 @@ static int acpi_nfit_blk_region_enable(struct nvdimm_bus *nvdimm_bus,
         /* map block aperture memory */
         nfit_blk->bdw_offset = nfit_mem->bdw->offset;
         mmio = &nfit_blk->mmio[BDW];
-        mmio->base = nfit_spa_map(acpi_desc, nfit_mem->spa_bdw);
+        mmio->base = nfit_spa_map(acpi_desc, nfit_mem->spa_bdw,
+                        SPA_MAP_APERTURE);
         if (!mmio->base) {
                 dev_dbg(dev, "%s: %s failed to map bdw\n", __func__,
                                 nvdimm_name(nvdimm));
@@ -1259,7 +1345,8 @@ static int acpi_nfit_blk_region_enable(struct nvdimm_bus *nvdimm_bus,
         nfit_blk->cmd_offset = nfit_mem->dcr->command_offset;
         nfit_blk->stat_offset = nfit_mem->dcr->status_offset;
         mmio = &nfit_blk->mmio[DCR];
-        mmio->base = nfit_spa_map(acpi_desc, nfit_mem->spa_dcr);
+        mmio->base = nfit_spa_map(acpi_desc, nfit_mem->spa_dcr,
+                        SPA_MAP_CONTROL);
         if (!mmio->base) {
                 dev_dbg(dev, "%s: %s failed to map dcr\n", __func__,
                                 nvdimm_name(nvdimm));
@@ -1277,6 +1364,24 @@ static int acpi_nfit_blk_region_enable(struct nvdimm_bus *nvdimm_bus,
                 return rc;
         }
 
+        rc = acpi_nfit_blk_get_flags(nd_desc, nvdimm, nfit_blk);
+        if (rc < 0) {
+                dev_dbg(dev, "%s: %s failed get DIMM flags\n",
+                                __func__, nvdimm_name(nvdimm));
+                return rc;
+        }
+
+        nfit_flush = nfit_mem->nfit_flush;
+        if (nfit_flush && nfit_flush->flush->hint_count != 0) {
+                nfit_blk->nvdimm_flush = devm_ioremap_nocache(dev,
+                                nfit_flush->flush->hint_address[0], 8);
+                if (!nfit_blk->nvdimm_flush)
+                        return -ENOMEM;
+        }
+
+        if (!arch_has_pmem_api() && !nfit_blk->nvdimm_flush)
+                dev_warn(dev, "unable to guarantee persistence of writes\n");
+
         if (mmio->line_size == 0)
                 return 0;
 
@@ -1459,6 +1564,7 @@ int acpi_nfit_init(struct acpi_nfit_desc *acpi_desc, acpi_size sz)
         INIT_LIST_HEAD(&acpi_desc->dcrs);
         INIT_LIST_HEAD(&acpi_desc->bdws);
         INIT_LIST_HEAD(&acpi_desc->idts);
+        INIT_LIST_HEAD(&acpi_desc->flushes);
         INIT_LIST_HEAD(&acpi_desc->memdevs);
         INIT_LIST_HEAD(&acpi_desc->dimms);
         mutex_init(&acpi_desc->spa_map_mutex);
diff --git a/drivers/acpi/nfit.h b/drivers/acpi/nfit.h
index 81f2e8c5a79c..79b6d83875c1 100644
--- a/drivers/acpi/nfit.h
+++ b/drivers/acpi/nfit.h
@@ -40,6 +40,10 @@ enum nfit_uuids {
         NFIT_UUID_MAX,
 };
 
+enum {
+        ND_BLK_DCR_LATCH = 2,
+};
+
 struct nfit_spa {
         struct acpi_nfit_system_address *spa;
         struct list_head list;
@@ -60,6 +64,11 @@ struct nfit_idt {
         struct list_head list;
 };
 
+struct nfit_flush {
+        struct acpi_nfit_flush_address *flush;
+        struct list_head list;
+};
+
 struct nfit_memdev {
         struct acpi_nfit_memory_map *memdev;
         struct list_head list;
@@ -77,6 +86,7 @@ struct nfit_mem {
         struct acpi_nfit_system_address *spa_bdw;
         struct acpi_nfit_interleave *idt_dcr;
         struct acpi_nfit_interleave *idt_bdw;
+        struct nfit_flush *nfit_flush;
         struct list_head list;
         struct acpi_device *adev;
         unsigned long dsm_mask;
@@ -88,6 +98,7 @@ struct acpi_nfit_desc {
         struct mutex spa_map_mutex;
         struct list_head spa_maps;
         struct list_head memdevs;
+        struct list_head flushes;
         struct list_head dimms;
         struct list_head spas;
         struct list_head dcrs;
@@ -109,7 +120,7 @@ struct nfit_blk {
         struct nfit_blk_mmio {
                 union {
                         void __iomem *base;
-                        void *aperture;
+                        void __pmem  *aperture;
                 };
                 u64 size;
                 u64 base_offset;
@@ -123,6 +134,13 @@ struct nfit_blk {
         u64 bdw_offset; /* post interleave offset */
         u64 stat_offset;
         u64 cmd_offset;
+        void __iomem *nvdimm_flush;
+        u32 dimm_flags;
+};
+
+enum spa_map_type {
+        SPA_MAP_CONTROL,
+        SPA_MAP_APERTURE,
 };
 
 struct nfit_spa_mapping {
diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
index c262e4acd68d..3b8963f21b36 100644
--- a/drivers/acpi/osl.c
+++ b/drivers/acpi/osl.c
@@ -175,10 +175,14 @@ static void __init acpi_request_region (struct acpi_generic_address *gas,
         if (!addr || !length)
                 return;
 
-        acpi_reserve_region(addr, length, gas->space_id, 0, desc);
+        /* Resources are never freed */
+        if (gas->space_id == ACPI_ADR_SPACE_SYSTEM_IO)
+                request_region(addr, length, desc);
+        else if (gas->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY)
+                request_mem_region(addr, length, desc);
 }
 
-static void __init acpi_reserve_resources(void)
+static int __init acpi_reserve_resources(void)
 {
         acpi_request_region(&acpi_gbl_FADT.xpm1a_event_block, acpi_gbl_FADT.pm1_event_length,
                 "ACPI PM1a_EVT_BLK");
@@ -207,7 +211,10 @@ static void __init acpi_reserve_resources(void)
         if (!(acpi_gbl_FADT.gpe1_block_length & 0x1))
                 acpi_request_region(&acpi_gbl_FADT.xgpe1_block,
                                acpi_gbl_FADT.gpe1_block_length, "ACPI GPE1_BLK");
+
+        return 0;
 }
+fs_initcall_sync(acpi_reserve_resources);
 
 void acpi_os_printf(const char *fmt, ...)
 {
@@ -1862,7 +1869,6 @@ acpi_status __init acpi_os_initialize(void)
 
 acpi_status __init acpi_os_initialize1(void)
 {
-        acpi_reserve_resources();
         kacpid_wq = alloc_workqueue("kacpid", 0, 1);
         kacpi_notify_wq = alloc_workqueue("kacpi_notify", 0, 1);
         kacpi_hotplug_wq = alloc_ordered_workqueue("kacpi_hotplug", 0);
diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
index 10561ce16ed1..f1c966e05078 100644
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -26,7 +26,6 @@
 #include <linux/device.h>
 #include <linux/export.h>
 #include <linux/ioport.h>
-#include <linux/list.h>
 #include <linux/slab.h>
 
 #ifdef CONFIG_X86
@@ -194,6 +193,7 @@ static bool acpi_decode_space(struct resource_win *win,
         u8 iodec = attr->granularity == 0xfff ? ACPI_DECODE_10 : ACPI_DECODE_16;
         bool wp = addr->info.mem.write_protect;
         u64 len = attr->address_length;
+        u64 start, end, offset = 0;
         struct resource *res = &win->res;
 
         /*
@@ -205,9 +205,6 @@ static bool acpi_decode_space(struct resource_win *win,
                 pr_debug("ACPI: Invalid address space min_addr_fix %d, max_addr_fix %d, len %llx\n",
                          addr->min_address_fixed, addr->max_address_fixed, len);
 
-        res->start = attr->minimum;
-        res->end = attr->maximum;
-
         /*
          * For bridges that translate addresses across the bridge,
          * translation_offset is the offset that must be added to the
@@ -215,12 +212,22 @@ static bool acpi_decode_space(struct resource_win *win,
          * primary side. Non-bridge devices must list 0 for all Address
          * Translation offset bits.
          */
-        if (addr->producer_consumer == ACPI_PRODUCER) {
-                res->start += attr->translation_offset;
-                res->end += attr->translation_offset;
-        } else if (attr->translation_offset) {
+        if (addr->producer_consumer == ACPI_PRODUCER)
+                offset = attr->translation_offset;
+        else if (attr->translation_offset)
                 pr_debug("ACPI: translation_offset(%lld) is invalid for non-bridge device.\n",
                          attr->translation_offset);
+        start = attr->minimum + offset;
+        end = attr->maximum + offset;
+
+        win->offset = offset;
+        res->start = start;
+        res->end = end;
+        if (sizeof(resource_size_t) < sizeof(u64) &&
+            (offset != win->offset || start != res->start || end != res->end)) {
+                pr_warn("acpi resource window ([%#llx-%#llx] ignored, not CPU addressable)\n",
+                        attr->minimum, attr->maximum);
+                return false;
         }
 
         switch (addr->resource_type) {
@@ -237,8 +244,6 @@ static bool acpi_decode_space(struct resource_win *win,
                 return false;
         }
 
-        win->offset = attr->translation_offset;
-
         if (addr->producer_consumer == ACPI_PRODUCER)
                 res->flags |= IORESOURCE_WINDOW;
 
@@ -622,164 +627,3 @@ int acpi_dev_filter_resource_type(struct acpi_resource *ares,
         return (type & types) ? 0 : 1;
 }
 EXPORT_SYMBOL_GPL(acpi_dev_filter_resource_type);
-
-struct reserved_region {
-        struct list_head node;
-        u64 start;
-        u64 end;
-};
-
-static LIST_HEAD(reserved_io_regions);
-static LIST_HEAD(reserved_mem_regions);
-
-static int request_range(u64 start, u64 end, u8 space_id, unsigned long flags,
-                         char *desc)
-{
-        unsigned int length = end - start + 1;
-        struct resource *res;
-
-        res = space_id == ACPI_ADR_SPACE_SYSTEM_IO ?
-                request_region(start, length, desc) :
-                request_mem_region(start, length, desc);
-        if (!res)
-                return -EIO;
-
-        res->flags &= ~flags;
-        return 0;
-}
-
-static int add_region_before(u64 start, u64 end, u8 space_id,
-                             unsigned long flags, char *desc,
-                             struct list_head *head)
-{
-        struct reserved_region *reg;
-        int error;
-
-        reg = kmalloc(sizeof(*reg), GFP_KERNEL);
-        if (!reg)
-                return -ENOMEM;
-
-        error = request_range(start, end, space_id, flags, desc);
-        if (error) {
-                kfree(reg);
-                return error;
-        }
-
-        reg->start = start;
-        reg->end = end;
-        list_add_tail(&reg->node, head);
-        return 0;
-}
-
-/**
- * acpi_reserve_region - Reserve an I/O or memory region as a system resource.
- * @start: Starting address of the region.
- * @length: Length of the region.
- * @space_id: Identifier of address space to reserve the region from.
- * @flags: Resource flags to clear for the region after requesting it.
- * @desc: Region description (for messages).
- *
- * Reserve an I/O or memory region as a system resource to prevent others from
- * using it.  If the new region overlaps with one of the regions (in the given
- * address space) already reserved by this routine, only the non-overlapping
- * parts of it will be reserved.
- *
- * Returned is either 0 (success) or a negative error code indicating a resource
- * reservation problem.  It is the code of the first encountered error, but the
- * routine doesn't abort until it has attempted to request all of the parts of
- * the new region that don't overlap with other regions reserved previously.
- *
- * The resources requested by this routine are never released.
- */
-int acpi_reserve_region(u64 start, unsigned int length, u8 space_id,
-                        unsigned long flags, char *desc)
-{
-        struct list_head *regions;
-        struct reserved_region *reg;
-        u64 end = start + length - 1;
-        int ret = 0, error = 0;
-
-        if (space_id == ACPI_ADR_SPACE_SYSTEM_IO)
-                regions = &reserved_io_regions;
-        else if (space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY)
-                regions = &reserved_mem_regions;
-        else
-                return -EINVAL;
-
-        if (list_empty(regions))
-                return add_region_before(start, end, space_id, flags, desc, regions);
-
-        list_for_each_entry(reg, regions, node)
-                if (reg->start == end + 1) {
-                        /* The new region can be prepended to this one. */
-                        ret = request_range(start, end, space_id, flags, desc);
-                        if (!ret)
-                                reg->start = start;
-
-                        return ret;
-                } else if (reg->start > end) {
-                        /* No overlap.  Add the new region here and get out. */
-                        return add_region_before(start, end, space_id, flags,
-                                                 desc, &reg->node);
-                } else if (reg->end == start - 1) {
-                        goto combine;
-                } else if (reg->end >= start) {
-                        goto overlap;
-                }
-
-        /* The new region goes after the last existing one. */
-        return add_region_before(start, end, space_id, flags, desc, regions);
-
- overlap:
-        /*
-         * The new region overlaps an existing one.
-         *
-         * The head part of the new region immediately preceding the existing
-         * overlapping one can be combined with it right away.
-         */
-        if (reg->start > start) {
-                error = request_range(start, reg->start - 1, space_id, flags, desc);
-                if (error)
-                        ret = error;
-                else
-                        reg->start = start;
-        }
-
- combine:
-        /*
-         * The new region is adjacent to an existing one.  If it extends beyond
-         * that region all the way to the next one, it is possible to combine
-         * all three of them.
-         */
-        while (reg->end < end) {
-                struct reserved_region *next = NULL;
-                u64 a = reg->end + 1, b = end;
-
-                if (!list_is_last(&reg->node, regions)) {
-                        next = list_next_entry(reg, node);
-                        if (next->start <= end)
-                                b = next->start - 1;
-                }
-                error = request_range(a, b, space_id, flags, desc);
-                if (!error) {
-                        if (next && next->start == b + 1) {
-                                reg->end = next->end;
-                                list_del(&next->node);
-                                kfree(next);
-                        } else {
-                                reg->end = end;
-                                break;
-                        }
-                } else if (next) {
-                        if (!ret)
-                                ret = error;
-
-                        reg = next;
-                } else {
-                        break;
-                }
-        }
-
-        return ret ? ret : error;
-}
-EXPORT_SYMBOL_GPL(acpi_reserve_region);
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index 2649a068671d..ec256352f423 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -1019,6 +1019,29 @@ static bool acpi_of_match_device(struct acpi_device *adev,
         return false;
 }
 
+static bool __acpi_match_device_cls(const struct acpi_device_id *id,
+                                    struct acpi_hardware_id *hwid)
+{
+        int i, msk, byte_shift;
+        char buf[3];
+
+        if (!id->cls)
+                return false;
+
+        /* Apply class-code bitmask, before checking each class-code byte */
+        for (i = 1; i <= 3; i++) {
+                byte_shift = 8 * (3 - i);
+                msk = (id->cls_msk >> byte_shift) & 0xFF;
+                if (!msk)
+                        continue;
+
+                sprintf(buf, "%02x", (id->cls >> byte_shift) & msk);
+                if (strncmp(buf, &hwid->id[(i - 1) * 2], 2))
+                        return false;
+        }
+        return true;
+}
+
 static const struct acpi_device_id *__acpi_match_device(
         struct acpi_device *device,
         const struct acpi_device_id *ids,
@@ -1036,9 +1059,12 @@ static const struct acpi_device_id *__acpi_match_device(
 
         list_for_each_entry(hwid, &device->pnp.ids, list) {
                 /* First, check the ACPI/PNP IDs provided by the caller. */
-                for (id = ids; id->id[0]; id++)
-                        if (!strcmp((char *) id->id, hwid->id))
+                for (id = ids; id->id[0] || id->cls; id++) {
+                        if (id->id[0] && !strcmp((char *) id->id, hwid->id))
                                 return id;
+                        else if (id->cls && __acpi_match_device_cls(id, hwid))
+                                return id;
+                }
 
                 /*
                  * Next, check ACPI_DT_NAMESPACE_HID and try to match the
@@ -2101,6 +2127,8 @@ static void acpi_set_pnp_ids(acpi_handle handle, struct acpi_device_pnp *pnp,
                 if (info->valid & ACPI_VALID_UID)
                         pnp->unique_id = kstrdup(info->unique_id.string,
                                                         GFP_KERNEL);
+                if (info->valid & ACPI_VALID_CLS)
+                        acpi_add_id(pnp, info->class_code.string);
 
                 kfree(info);
 
diff --git a/drivers/ata/Kconfig b/drivers/ata/Kconfig
index 6d17a3b65ef7..15e40ee62a94 100644
--- a/drivers/ata/Kconfig
+++ b/drivers/ata/Kconfig
@@ -48,7 +48,7 @@ config ATA_VERBOSE_ERROR
 
 config ATA_ACPI
         bool "ATA ACPI Support"
-        depends on ACPI && PCI
+        depends on ACPI
         default y
         help
           This option adds support for ATA-related ACPI objects.
diff --git a/drivers/ata/ahci_platform.c b/drivers/ata/ahci_platform.c
index 614c78f510f0..1befb114c384 100644
--- a/drivers/ata/ahci_platform.c
+++ b/drivers/ata/ahci_platform.c
@@ -20,6 +20,8 @@
 #include <linux/platform_device.h>
 #include <linux/libata.h>
 #include <linux/ahci_platform.h>
+#include <linux/acpi.h>
+#include <linux/pci_ids.h>
 #include "ahci.h"
 
 #define DRV_NAME "ahci"
@@ -79,12 +81,19 @@ static const struct of_device_id ahci_of_match[] = {
 };
 MODULE_DEVICE_TABLE(of, ahci_of_match);
 
+static const struct acpi_device_id ahci_acpi_match[] = {
+        { ACPI_DEVICE_CLASS(PCI_CLASS_STORAGE_SATA_AHCI, 0xffffff) },
+        {},
+};
+MODULE_DEVICE_TABLE(acpi, ahci_acpi_match);
+
 static struct platform_driver ahci_driver = {
         .probe = ahci_probe,
         .remove = ata_platform_remove_one,
         .driver = {
                 .name = DRV_NAME,
                 .of_match_table = ahci_of_match,
+                .acpi_match_table = ahci_acpi_match,
                 .pm = &ahci_pm_ops,
         },
 };
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index e83fc3d0da9c..db5d9f79a247 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -2478,6 +2478,10 @@ int ata_dev_configure(struct ata_device *dev)
                 dev->max_sectors = min_t(unsigned int, ATA_MAX_SECTORS_128,
                                          dev->max_sectors);
 
+        if (dev->horkage & ATA_HORKAGE_MAX_SEC_1024)
+                dev->max_sectors = min_t(unsigned int, ATA_MAX_SECTORS_1024,
+                                         dev->max_sectors);
+
         if (dev->horkage & ATA_HORKAGE_MAX_SEC_LBA48)
                 dev->max_sectors = ATA_MAX_SECTORS_LBA48;
 
@@ -4146,6 +4150,12 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
         { "Slimtype DVD A  DS8A8SH", NULL,      ATA_HORKAGE_MAX_SEC_LBA48 },
         { "Slimtype DVD A  DS8A9SH", NULL,      ATA_HORKAGE_MAX_SEC_LBA48 },
 
+        /*
+         * Causes silent data corruption with higher max sects.
+         * http://lkml.kernel.org/g/x49wpy40ysk.fsf@segfault.boston.devel.redhat.com
+         */
+        { "ST380013AS",         "3.20",         ATA_HORKAGE_MAX_SEC_1024 },
+
         /* Devices we expect to fail diagnostics */
 
         /* Devices where NCQ should be avoided */
@@ -4174,9 +4184,10 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
         { "ST3320[68]13AS",     "SD1[5-9]",     ATA_HORKAGE_NONCQ |
                                                 ATA_HORKAGE_FIRMWARE_WARN },
 
-        /* Seagate Momentus SpinPoint M8 seem to have FPMDA_AA issues */
+        /* drives which fail FPDMA_AA activation (some may freeze afterwards) */
         { "ST1000LM024 HN-M101MBB", "2AR10001", ATA_HORKAGE_BROKEN_FPDMA_AA },
         { "ST1000LM024 HN-M101MBB", "2BA30001", ATA_HORKAGE_BROKEN_FPDMA_AA },
+        { "VB0250EAVER",        "HPG7",         ATA_HORKAGE_BROKEN_FPDMA_AA },
 
         /* Blacklist entries taken from Silicon Image 3124/3132
            Windows driver .inf file - also several Linux problem reports */
@@ -4229,7 +4240,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
                                                 ATA_HORKAGE_ZERO_AFTER_TRIM, },
         { "Crucial_CT*M500*",           NULL,   ATA_HORKAGE_NO_NCQ_TRIM |
                                                 ATA_HORKAGE_ZERO_AFTER_TRIM, },
-        { "Micron_M5[15]0*",            "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
+        { "Micron_M5[15]0_*",           "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
                                                 ATA_HORKAGE_ZERO_AFTER_TRIM, },
         { "Crucial_CT*M550*",           "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
                                                 ATA_HORKAGE_ZERO_AFTER_TRIM, },
@@ -4238,6 +4249,9 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
         { "Samsung SSD 8*",             NULL,   ATA_HORKAGE_NO_NCQ_TRIM |
                                                 ATA_HORKAGE_ZERO_AFTER_TRIM, },
 
+        /* devices that don't properly handle TRIM commands */
+        { "SuperSSpeed S238*",          NULL,   ATA_HORKAGE_NOTRIM, },
+
         /*
          * As defined, the DRAT (Deterministic Read After Trim) and RZAT
          * (Return Zero After Trim) flags in the ATA Command Set are
@@ -4501,7 +4515,8 @@ static unsigned int ata_dev_set_xfermode(struct ata_device *dev)
         else /* In the ancient relic department - skip all of this */
                 return 0;
 
-        err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 0);
+        /* On some disks, this command causes spin-up, so we need longer timeout */
+        err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 15000);
 
         DPRINTK("EXIT, err_mask=%x\n", err_mask);
         return err_mask;
diff --git a/drivers/ata/libata-pmp.c b/drivers/ata/libata-pmp.c
index 7ccc084bf1df..85aa76116a30 100644
--- a/drivers/ata/libata-pmp.c
+++ b/drivers/ata/libata-pmp.c
@@ -460,6 +460,13 @@ static void sata_pmp_quirks(struct ata_port *ap)
                                        ATA_LFLAG_NO_SRST |
                                        ATA_LFLAG_ASSUME_ATA;
                 }
+        } else if (vendor == 0x11ab && devid == 0x4140) {
+                /* Marvell 4140 quirks */
+                ata_for_each_link(link, ap, EDGE) {
+                        /* port 4 is for SEMB device and it doesn't like SRST */
+                        if (link->pmp == 4)
+                                link->flags |= ATA_LFLAG_DISABLED;
+                }
         }
 }
 
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 3131adcc1f87..641a61a59e89 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -2568,7 +2568,8 @@ static unsigned int ata_scsiop_read_cap(struct ata_scsi_args *args, u8 *rbuf)
                 rbuf[14] = (lowest_aligned >> 8) & 0x3f;
                 rbuf[15] = lowest_aligned;
 
-                if (ata_id_has_trim(args->id)) {
+                if (ata_id_has_trim(args->id) &&
+                    !(dev->horkage & ATA_HORKAGE_NOTRIM)) {
                         rbuf[14] |= 0x80; /* LBPME */
 
                         if (ata_id_has_zero_after_trim(args->id) &&
diff --git a/drivers/ata/libata-transport.c b/drivers/ata/libata-transport.c
index d6c37bcd416d..e2d94972962d 100644
--- a/drivers/ata/libata-transport.c
+++ b/drivers/ata/libata-transport.c
@@ -569,6 +569,8 @@ show_ata_dev_trim(struct device *dev,
 
         if (!ata_id_has_trim(ata_dev->id))
                 mode = "unsupported";
+        else if (ata_dev->horkage & ATA_HORKAGE_NOTRIM)
+                mode = "forced_unsupported";
         else if (ata_dev->horkage & ATA_HORKAGE_NO_NCQ_TRIM)
                         mode = "forced_unqueued";
         else if (ata_fpdma_dsm_supported(ata_dev))
diff --git a/drivers/ata/pata_arasan_cf.c b/drivers/ata/pata_arasan_cf.c
index a9b0c820f2eb..5d9ee99c2148 100644
--- a/drivers/ata/pata_arasan_cf.c
+++ b/drivers/ata/pata_arasan_cf.c
@@ -4,7 +4,7 @@
  * Arasan Compact Flash host controller source file
  *
  * Copyright (C) 2011 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
  *
  * This file is licensed under the terms of the GNU General Public
  * License version 2. This program is licensed "as is" without any
@@ -968,7 +968,7 @@ static struct platform_driver arasan_cf_driver = {
 
 module_platform_driver(arasan_cf_driver);
 
-MODULE_AUTHOR("Viresh Kumar <viresh.linux@gmail.com>");
+MODULE_AUTHOR("Viresh Kumar <vireshk@kernel.org>");
 MODULE_DESCRIPTION("Arasan ATA Compact Flash driver");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("platform:" DRIVER_NAME);
diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
index 9c4288362a8e..894bda114224 100644
--- a/drivers/base/firmware_class.c
+++ b/drivers/base/firmware_class.c
@@ -563,10 +563,8 @@ static void fw_dev_release(struct device *dev)
         kfree(fw_priv);
 }
 
-static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env)
+static int do_firmware_uevent(struct firmware_priv *fw_priv, struct kobj_uevent_env *env)
 {
-        struct firmware_priv *fw_priv = to_firmware_priv(dev);
-
         if (add_uevent_var(env, "FIRMWARE=%s", fw_priv->buf->fw_id))
                 return -ENOMEM;
         if (add_uevent_var(env, "TIMEOUT=%i", loading_timeout))
@@ -577,6 +575,18 @@ static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env)
         return 0;
 }
 
+static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env)
+{
+        struct firmware_priv *fw_priv = to_firmware_priv(dev);
+        int err = 0;
+
+        mutex_lock(&fw_lock);
+        if (fw_priv->buf)
+                err = do_firmware_uevent(fw_priv, env);
+        mutex_unlock(&fw_lock);
+        return err;
+}
+
 static struct class firmware_class = {
         .name           = "firmware",
         .class_attrs    = firmware_class_attrs,
diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
index cdd547bd67df..0ee43c1056e0 100644
--- a/drivers/base/power/domain.c
+++ b/drivers/base/power/domain.c
@@ -6,6 +6,7 @@
  * This file is released under the GPLv2.
  */
 
+#include <linux/delay.h>
 #include <linux/kernel.h>
 #include <linux/io.h>
 #include <linux/platform_device.h>
@@ -19,6 +20,8 @@
 #include <linux/suspend.h>
 #include <linux/export.h>
 
+#define GENPD_RETRY_MAX_MS      250             /* Approximate */
+
 #define GENPD_DEV_CALLBACK(genpd, type, callback, dev)          \
 ({                                                              \
         type (*__routine)(struct device *__d);                  \
@@ -2131,6 +2134,7 @@ EXPORT_SYMBOL_GPL(of_genpd_get_from_provider);
 static void genpd_dev_pm_detach(struct device *dev, bool power_off)
 {
         struct generic_pm_domain *pd;
+        unsigned int i;
         int ret = 0;
 
         pd = pm_genpd_lookup_dev(dev);
@@ -2139,10 +2143,12 @@ static void genpd_dev_pm_detach(struct device *dev, bool power_off)
 
         dev_dbg(dev, "removing from PM domain %s\n", pd->name);
 
-        while (1) {
+        for (i = 1; i < GENPD_RETRY_MAX_MS; i <<= 1) {
                 ret = pm_genpd_remove_device(pd, dev);
                 if (ret != -EAGAIN)
                         break;
+
+                mdelay(i);
                 cond_resched();
         }
 
@@ -2183,6 +2189,7 @@ int genpd_dev_pm_attach(struct device *dev)
 {
         struct of_phandle_args pd_args;
         struct generic_pm_domain *pd;
+        unsigned int i;
         int ret;
 
         if (!dev->of_node)
@@ -2218,10 +2225,12 @@ int genpd_dev_pm_attach(struct device *dev)
 
         dev_dbg(dev, "adding to PM domain %s\n", pd->name);
 
-        while (1) {
+        for (i = 1; i < GENPD_RETRY_MAX_MS; i <<= 1) {
                 ret = pm_genpd_add_device(pd, dev);
                 if (ret != -EAGAIN)
                         break;
+
+                mdelay(i);
                 cond_resched();
         }
 
diff --git a/drivers/base/power/wakeirq.c b/drivers/base/power/wakeirq.c
index 7470004ca810..eb6e67451dec 100644
--- a/drivers/base/power/wakeirq.c
+++ b/drivers/base/power/wakeirq.c
@@ -45,14 +45,12 @@ static int dev_pm_attach_wake_irq(struct device *dev, int irq,
                 return -EEXIST;
         }
 
-        dev->power.wakeirq = wirq;
-        spin_unlock_irqrestore(&dev->power.lock, flags);
-
         err = device_wakeup_attach_irq(dev, wirq);
-        if (err)
-                return err;
+        if (!err)
+                dev->power.wakeirq = wirq;
 
-        return 0;
+        spin_unlock_irqrestore(&dev->power.lock, flags);
+        return err;
 }
 
 /**
@@ -105,10 +103,10 @@ void dev_pm_clear_wake_irq(struct device *dev)
                 return;
 
         spin_lock_irqsave(&dev->power.lock, flags);
+        device_wakeup_detach_irq(dev);
         dev->power.wakeirq = NULL;
         spin_unlock_irqrestore(&dev->power.lock, flags);
 
-        device_wakeup_detach_irq(dev);
         if (wirq->dedicated_irq)
                 free_irq(wirq->irq, wirq);
         kfree(wirq);
diff --git a/drivers/base/power/wakeup.c b/drivers/base/power/wakeup.c
index 40f71603378c..51f15bc15774 100644
--- a/drivers/base/power/wakeup.c
+++ b/drivers/base/power/wakeup.c
@@ -281,32 +281,25 @@ EXPORT_SYMBOL_GPL(device_wakeup_enable);
  * Attach a device wakeirq to the wakeup source so the device
  * wake IRQ can be configured automatically for suspend and
  * resume.
+ *
+ * Call under the device's power.lock lock.
  */
 int device_wakeup_attach_irq(struct device *dev,
                              struct wake_irq *wakeirq)
 {
         struct wakeup_source *ws;
-        int ret = 0;
 
-        spin_lock_irq(&dev->power.lock);
         ws = dev->power.wakeup;
         if (!ws) {
                 dev_err(dev, "forgot to call call device_init_wakeup?\n");
-                ret = -EINVAL;
-                goto unlock;
+                return -EINVAL;
         }
 
-        if (ws->wakeirq) {
-                ret = -EEXIST;
-                goto unlock;
-        }
+        if (ws->wakeirq)
+                return -EEXIST;
 
         ws->wakeirq = wakeirq;
-
-unlock:
-        spin_unlock_irq(&dev->power.lock);
-
-        return ret;
+        return 0;
 }
 
 /**
@@ -314,20 +307,16 @@ unlock:
  * @dev: Device to handle
  *
  * Removes a device wakeirq from the wakeup source.
+ *
+ * Call under the device's power.lock lock.
  */
 void device_wakeup_detach_irq(struct device *dev)
 {
         struct wakeup_source *ws;
 
-        spin_lock_irq(&dev->power.lock);
         ws = dev->power.wakeup;
-        if (!ws)
-                goto unlock;
-
-        ws->wakeirq = NULL;
-
-unlock:
-        spin_unlock_irq(&dev->power.lock);
+        if (ws)
+                ws->wakeirq = NULL;
 }
 
 /**
diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c
index 69de41a87b74..3177b245d2bd 100644
--- a/drivers/block/null_blk.c
+++ b/drivers/block/null_blk.c
@@ -240,19 +240,19 @@ static enum hrtimer_restart null_cmd_timer_expired(struct hrtimer *timer)
         while ((entry = llist_del_all(&cq->list)) != NULL) {
                 entry = llist_reverse_order(entry);
                 do {
+                        struct request_queue *q = NULL;
+
                         cmd = container_of(entry, struct nullb_cmd, ll_list);
                         entry = entry->next;
+                        if (cmd->rq)
+                                q = cmd->rq->q;
                         end_cmd(cmd);
 
-                        if (cmd->rq) {
-                                struct request_queue *q = cmd->rq->q;
-
-                                if (!q->mq_ops && blk_queue_stopped(q)) {
-                                        spin_lock(q->queue_lock);
-                                        if (blk_queue_stopped(q))
-                                                blk_start_queue(q);
-                                        spin_unlock(q->queue_lock);
-                                }
+                        if (q && !q->mq_ops && blk_queue_stopped(q)) {
+                                spin_lock(q->queue_lock);
+                                if (blk_queue_stopped(q))
+                                        blk_start_queue(q);
+                                spin_unlock(q->queue_lock);
                         }
                 } while (entry);
         }
diff --git a/drivers/block/nvme-core.c b/drivers/block/nvme-core.c
index d1d6141920d3..7920c2741b47 100644
--- a/drivers/block/nvme-core.c
+++ b/drivers/block/nvme-core.c
@@ -2108,8 +2108,17 @@ static void nvme_alloc_ns(struct nvme_dev *dev, unsigned nsid)
                 goto out_free_disk;
 
         add_disk(ns->disk);
-        if (ns->ms)
-                revalidate_disk(ns->disk);
+        if (ns->ms) {
+                struct block_device *bd = bdget_disk(ns->disk, 0);
+                if (!bd)
+                        return;
+                if (blkdev_get(bd, FMODE_READ, NULL)) {
+                        bdput(bd);
+                        return;
+                }
+                blkdev_reread_part(bd);
+                blkdev_put(bd, FMODE_READ);
+        }
         return;
  out_free_disk:
         kfree(disk);
diff --git a/drivers/bluetooth/btbcm.c b/drivers/bluetooth/btbcm.c
index 1e1a4323a71f..9ceb8ac68fdc 100644
--- a/drivers/bluetooth/btbcm.c
+++ b/drivers/bluetooth/btbcm.c
@@ -472,12 +472,11 @@ int btbcm_setup_apple(struct hci_dev *hdev)
 
         /* Read Verbose Config Version Info */
         skb = btbcm_read_verbose_config(hdev);
-        if (IS_ERR(skb))
-                return PTR_ERR(skb);
-
-        BT_INFO("%s: BCM: chip id %u build %4.4u", hdev->name, skb->data[1],
-                get_unaligned_le16(skb->data + 5));
-        kfree_skb(skb);
+        if (!IS_ERR(skb)) {
+                BT_INFO("%s: BCM: chip id %u build %4.4u", hdev->name, skb->data[1],
+                        get_unaligned_le16(skb->data + 5));
+                kfree_skb(skb);
+        }
 
         set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
 
diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c
index 283f00a7f036..1082d4bb016a 100644
--- a/drivers/char/tpm/tpm-chip.c
+++ b/drivers/char/tpm/tpm-chip.c
@@ -129,8 +129,9 @@ struct tpm_chip *tpmm_chip_alloc(struct device *dev,
 
         device_initialize(&chip->dev);
 
-        chip->cdev.owner = chip->pdev->driver->owner;
         cdev_init(&chip->cdev, &tpm_fops);
+        chip->cdev.owner = chip->pdev->driver->owner;
+        chip->cdev.kobj.parent = &chip->dev.kobj;
 
         return chip;
 }
diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c
index 44f9d20c19ac..1267322595da 100644
--- a/drivers/char/tpm/tpm_crb.c
+++ b/drivers/char/tpm/tpm_crb.c
@@ -233,6 +233,14 @@ static int crb_acpi_add(struct acpi_device *device)
                 return -ENODEV;
         }
 
+        /* At least some versions of AMI BIOS have a bug that TPM2 table has
+         * zero address for the control area and therefore we must fail.
+        */
+        if (!buf->control_area_pa) {
+                dev_err(dev, "TPM2 ACPI table has a zero address for the control area\n");
+                return -EINVAL;
+        }
+
         if (buf->hdr.length < sizeof(struct acpi_tpm2)) {
                 dev_err(dev, "TPM2 ACPI table has wrong size");
                 return -EINVAL;
diff --git a/drivers/clk/at91/clk-h32mx.c b/drivers/clk/at91/clk-h32mx.c
index 152dcb3f7b5f..61566bcefa53 100644
--- a/drivers/clk/at91/clk-h32mx.c
+++ b/drivers/clk/at91/clk-h32mx.c
@@ -116,8 +116,10 @@ void __init of_sama5d4_clk_h32mx_setup(struct device_node *np,
         h32mxclk->pmc = pmc;
 
         clk = clk_register(NULL, &h32mxclk->hw);
-        if (!clk)
+        if (!clk) {
+                kfree(h32mxclk);
                 return;
+        }
 
         of_clk_add_provider(np, of_clk_src_simple_get, clk);
 }
diff --git a/drivers/clk/at91/clk-main.c b/drivers/clk/at91/clk-main.c
index c2400456a044..27dfa965cfed 100644
--- a/drivers/clk/at91/clk-main.c
+++ b/drivers/clk/at91/clk-main.c
@@ -171,8 +171,10 @@ at91_clk_register_main_osc(struct at91_pmc *pmc,
         irq_set_status_flags(osc->irq, IRQ_NOAUTOEN);
         ret = request_irq(osc->irq, clk_main_osc_irq_handler,
                           IRQF_TRIGGER_HIGH, name, osc);
-        if (ret)
+        if (ret) {
+                kfree(osc);
                 return ERR_PTR(ret);
+        }
 
         if (bypass)
                 pmc_write(pmc, AT91_CKGR_MOR,
diff --git a/drivers/clk/at91/clk-master.c b/drivers/clk/at91/clk-master.c
index f98eafe9b12d..5b3ded5205a2 100644
--- a/drivers/clk/at91/clk-master.c
+++ b/drivers/clk/at91/clk-master.c
@@ -165,12 +165,16 @@ at91_clk_register_master(struct at91_pmc *pmc, unsigned int irq,
         irq_set_status_flags(master->irq, IRQ_NOAUTOEN);
         ret = request_irq(master->irq, clk_master_irq_handler,
                           IRQF_TRIGGER_HIGH, "clk-master", master);
-        if (ret)
+        if (ret) {
+                kfree(master);
                 return ERR_PTR(ret);
+        }
 
         clk = clk_register(NULL, &master->hw);
-        if (IS_ERR(clk))
+        if (IS_ERR(clk)) {
+                free_irq(master->irq, master);
                 kfree(master);
+        }
 
         return clk;
 }
diff --git a/drivers/clk/at91/clk-pll.c b/drivers/clk/at91/clk-pll.c
index cbbe40377ad6..18b60f4895a6 100644
--- a/drivers/clk/at91/clk-pll.c
+++ b/drivers/clk/at91/clk-pll.c
@@ -346,12 +346,16 @@ at91_clk_register_pll(struct at91_pmc *pmc, unsigned int irq, const char *name,
         irq_set_status_flags(pll->irq, IRQ_NOAUTOEN);
         ret = request_irq(pll->irq, clk_pll_irq_handler, IRQF_TRIGGER_HIGH,
                           id ? "clk-pllb" : "clk-plla", pll);
-        if (ret)
+        if (ret) {
+                kfree(pll);
                 return ERR_PTR(ret);
+        }
 
         clk = clk_register(NULL, &pll->hw);
-        if (IS_ERR(clk))
+        if (IS_ERR(clk)) {
+                free_irq(pll->irq, pll);
                 kfree(pll);
+        }
 
         return clk;
 }
diff --git a/drivers/clk/at91/clk-system.c b/drivers/clk/at91/clk-system.c
index a76d03fd577b..58008b3e8bc1 100644
--- a/drivers/clk/at91/clk-system.c
+++ b/drivers/clk/at91/clk-system.c
@@ -130,13 +130,17 @@ at91_clk_register_system(struct at91_pmc *pmc, const char *name,
                 irq_set_status_flags(sys->irq, IRQ_NOAUTOEN);
                 ret = request_irq(sys->irq, clk_system_irq_handler,
                                 IRQF_TRIGGER_HIGH, name, sys);
-                if (ret)
+                if (ret) {
+                        kfree(sys);
                         return ERR_PTR(ret);
+                }
         }
 
         clk = clk_register(NULL, &sys->hw);
-        if (IS_ERR(clk))
+        if (IS_ERR(clk)) {
+                free_irq(sys->irq, sys);
                 kfree(sys);
+        }
 
         return clk;
 }
diff --git a/drivers/clk/at91/clk-utmi.c b/drivers/clk/at91/clk-utmi.c
index ae3263bc1476..30dd697b1668 100644
--- a/drivers/clk/at91/clk-utmi.c
+++ b/drivers/clk/at91/clk-utmi.c
@@ -118,12 +118,16 @@ at91_clk_register_utmi(struct at91_pmc *pmc, unsigned int irq,
         irq_set_status_flags(utmi->irq, IRQ_NOAUTOEN);
         ret = request_irq(utmi->irq, clk_utmi_irq_handler,
                           IRQF_TRIGGER_HIGH, "clk-utmi", utmi);
-        if (ret)
+        if (ret) {
+                kfree(utmi);
                 return ERR_PTR(ret);
+        }
 
         clk = clk_register(NULL, &utmi->hw);
-        if (IS_ERR(clk))
+        if (IS_ERR(clk)) {
+                free_irq(utmi->irq, utmi);
                 kfree(utmi);
+        }
 
         return clk;
 }
diff --git a/drivers/clk/bcm/clk-iproc-asiu.c b/drivers/clk/bcm/clk-iproc-asiu.c
index e19c09cd9645..f630e1bbdcfe 100644
--- a/drivers/clk/bcm/clk-iproc-asiu.c
+++ b/drivers/clk/bcm/clk-iproc-asiu.c
@@ -222,10 +222,6 @@ void __init iproc_asiu_setup(struct device_node *node,
                 struct iproc_asiu_clk *asiu_clk;
                 const char *clk_name;
 
-                clk_name = kzalloc(IPROC_CLK_NAME_LEN, GFP_KERNEL);
-                if (WARN_ON(!clk_name))
-                        goto err_clk_register;
-
                 ret = of_property_read_string_index(node, "clock-output-names",
                                                     i, &clk_name);
                 if (WARN_ON(ret))
@@ -259,7 +255,7 @@ void __init iproc_asiu_setup(struct device_node *node,
 
 err_clk_register:
         for (i = 0; i < num_clks; i++)
-                kfree(asiu->clks[i].name);
+                clk_unregister(asiu->clk_data.clks[i]);
         iounmap(asiu->gate_base);
 
 err_iomap_gate:
diff --git a/drivers/clk/bcm/clk-iproc-pll.c b/drivers/clk/bcm/clk-iproc-pll.c
index 46fb84bc2674..2dda4e8295a9 100644
--- a/drivers/clk/bcm/clk-iproc-pll.c
+++ b/drivers/clk/bcm/clk-iproc-pll.c
@@ -366,7 +366,7 @@ static unsigned long iproc_pll_recalc_rate(struct clk_hw *hw,
         val = readl(pll->pll_base + ctrl->ndiv_int.offset);
         ndiv_int = (val >> ctrl->ndiv_int.shift) &
                 bit_mask(ctrl->ndiv_int.width);
-        ndiv = ndiv_int << ctrl->ndiv_int.shift;
+        ndiv = (u64)ndiv_int << ctrl->ndiv_int.shift;
 
         if (ctrl->flags & IPROC_CLK_PLL_HAS_NDIV_FRAC) {
                 val = readl(pll->pll_base + ctrl->ndiv_frac.offset);
@@ -374,7 +374,8 @@ static unsigned long iproc_pll_recalc_rate(struct clk_hw *hw,
                         bit_mask(ctrl->ndiv_frac.width);
 
                 if (ndiv_frac != 0)
-                        ndiv = (ndiv_int << ctrl->ndiv_int.shift) | ndiv_frac;
+                        ndiv = ((u64)ndiv_int << ctrl->ndiv_int.shift) |
+                                ndiv_frac;
         }
 
         val = readl(pll->pll_base + ctrl->pdiv.offset);
@@ -655,10 +656,6 @@ void __init iproc_pll_clk_setup(struct device_node *node,
                 memset(&init, 0, sizeof(init));
                 parent_name = node->name;
 
-                clk_name = kzalloc(IPROC_CLK_NAME_LEN, GFP_KERNEL);
-                if (WARN_ON(!clk_name))
-                        goto err_clk_register;
-
                 ret = of_property_read_string_index(node, "clock-output-names",
                                                     i, &clk_name);
                 if (WARN_ON(ret))
@@ -690,10 +687,8 @@ void __init iproc_pll_clk_setup(struct device_node *node,
         return;
 
 err_clk_register:
-        for (i = 0; i < num_clks; i++) {
-                kfree(pll->clks[i].name);
+        for (i = 0; i < num_clks; i++)
                 clk_unregister(pll->clk_data.clks[i]);
-        }
 
 err_pll_register:
         if (pll->asiu_base)
diff --git a/drivers/clk/clk-stm32f4.c b/drivers/clk/clk-stm32f4.c
index b9b12a742970..3f6f7ad39490 100644
--- a/drivers/clk/clk-stm32f4.c
+++ b/drivers/clk/clk-stm32f4.c
@@ -268,7 +268,7 @@ static int stm32f4_rcc_lookup_clk_idx(u8 primary, u8 secondary)
         memcpy(table, stm32f42xx_gate_map, sizeof(table));
 
         /* only bits set in table can be used as indices */
-        if (WARN_ON(secondary > 8 * sizeof(table) ||
+        if (WARN_ON(secondary >= BITS_PER_BYTE * sizeof(table) ||
                     0 == (table[BIT_ULL_WORD(secondary)] &
                           BIT_ULL_MASK(secondary))))
                 return -EINVAL;
diff --git a/drivers/clk/mediatek/clk-mt8173.c b/drivers/clk/mediatek/clk-mt8173.c
index 4b9e04cdf7e8..8b6523d15fb8 100644
--- a/drivers/clk/mediatek/clk-mt8173.c
+++ b/drivers/clk/mediatek/clk-mt8173.c
@@ -700,6 +700,22 @@ static const struct mtk_composite peri_clks[] __initconst = {
         MUX(CLK_PERI_UART3_SEL, "uart3_ck_sel", uart_ck_sel_parents, 0x40c, 3, 1),
 };
 
+static struct clk_onecell_data *mt8173_top_clk_data __initdata;
+static struct clk_onecell_data *mt8173_pll_clk_data __initdata;
+
+static void __init mtk_clk_enable_critical(void)
+{
+        if (!mt8173_top_clk_data || !mt8173_pll_clk_data)
+                return;
+
+        clk_prepare_enable(mt8173_pll_clk_data->clks[CLK_APMIXED_ARMCA15PLL]);
+        clk_prepare_enable(mt8173_pll_clk_data->clks[CLK_APMIXED_ARMCA7PLL]);
+        clk_prepare_enable(mt8173_top_clk_data->clks[CLK_TOP_MEM_SEL]);
+        clk_prepare_enable(mt8173_top_clk_data->clks[CLK_TOP_DDRPHYCFG_SEL]);
+        clk_prepare_enable(mt8173_top_clk_data->clks[CLK_TOP_CCI400_SEL]);
+        clk_prepare_enable(mt8173_top_clk_data->clks[CLK_TOP_RTC_SEL]);
+}
+
 static void __init mtk_topckgen_init(struct device_node *node)
 {
         struct clk_onecell_data *clk_data;
@@ -712,19 +728,19 @@ static void __init mtk_topckgen_init(struct device_node *node)
                 return;
         }
 
-        clk_data = mtk_alloc_clk_data(CLK_TOP_NR_CLK);
+        mt8173_top_clk_data = clk_data = mtk_alloc_clk_data(CLK_TOP_NR_CLK);
 
         mtk_clk_register_factors(root_clk_alias, ARRAY_SIZE(root_clk_alias), clk_data);
         mtk_clk_register_factors(top_divs, ARRAY_SIZE(top_divs), clk_data);
         mtk_clk_register_composites(top_muxes, ARRAY_SIZE(top_muxes), base,
                         &mt8173_clk_lock, clk_data);
 
-        clk_prepare_enable(clk_data->clks[CLK_TOP_CCI400_SEL]);
-
         r = of_clk_add_provider(node, of_clk_src_onecell_get, clk_data);
         if (r)
                 pr_err("%s(): could not register clock provider: %d\n",
                         __func__, r);
+
+        mtk_clk_enable_critical();
 }
 CLK_OF_DECLARE(mtk_topckgen, "mediatek,mt8173-topckgen", mtk_topckgen_init);
 
@@ -818,13 +834,13 @@ static void __init mtk_apmixedsys_init(struct device_node *node)
 {
         struct clk_onecell_data *clk_data;
 
-        clk_data = mtk_alloc_clk_data(CLK_APMIXED_NR_CLK);
+        mt8173_pll_clk_data = clk_data = mtk_alloc_clk_data(CLK_APMIXED_NR_CLK);
         if (!clk_data)
                 return;
 
         mtk_clk_register_plls(node, plls, ARRAY_SIZE(plls), clk_data);
 
-        clk_prepare_enable(clk_data->clks[CLK_APMIXED_ARMCA15PLL]);
+        mtk_clk_enable_critical();
 }
 CLK_OF_DECLARE(mtk_apmixedsys, "mediatek,mt8173-apmixedsys",
                 mtk_apmixedsys_init);
diff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c
index b95d17fbb8d7..92936f0912d2 100644
--- a/drivers/clk/qcom/clk-rcg2.c
+++ b/drivers/clk/qcom/clk-rcg2.c
@@ -530,19 +530,16 @@ static int clk_pixel_set_rate(struct clk_hw *hw, unsigned long rate,
         struct clk_rcg2 *rcg = to_clk_rcg2(hw);
         struct freq_tbl f = *rcg->freq_tbl;
         const struct frac_entry *frac = frac_table_pixel;
-        unsigned long request, src_rate;
+        unsigned long request;
         int delta = 100000;
         u32 mask = BIT(rcg->hid_width) - 1;
         u32 hid_div;
-        int index = qcom_find_src_index(hw, rcg->parent_map, f.src);
-        struct clk *parent = clk_get_parent_by_index(hw->clk, index);
 
         for (; frac->num; frac++) {
                 request = (rate * frac->den) / frac->num;
 
-                src_rate = __clk_round_rate(parent, request);
-                if ((src_rate < (request - delta)) ||
-                        (src_rate > (request + delta)))
+                if ((parent_rate < (request - delta)) ||
+                        (parent_rate > (request + delta)))
                         continue;
 
                 regmap_read(rcg->clkr.regmap, rcg->cmd_rcgr + CFG_REG,
diff --git a/drivers/clk/spear/clk-aux-synth.c b/drivers/clk/spear/clk-aux-synth.c
index bdfb4421c643..f271c350ef94 100644
--- a/drivers/clk/spear/clk-aux-synth.c
+++ b/drivers/clk/spear/clk-aux-synth.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
  *
  * This file is licensed under the terms of the GNU General Public
  * License version 2. This program is licensed "as is" without any
diff --git a/drivers/clk/spear/clk-frac-synth.c b/drivers/clk/spear/clk-frac-synth.c
index dffd4ce6c8b5..58d678b5b40a 100644
--- a/drivers/clk/spear/clk-frac-synth.c
+++ b/drivers/clk/spear/clk-frac-synth.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
  *
  * This file is licensed under the terms of the GNU General Public
  * License version 2. This program is licensed "as is" without any
diff --git a/drivers/clk/spear/clk-gpt-synth.c b/drivers/clk/spear/clk-gpt-synth.c
index 1afc18c4effc..1a722e99e76e 100644
--- a/drivers/clk/spear/clk-gpt-synth.c
+++ b/drivers/clk/spear/clk-gpt-synth.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
  *
  * This file is licensed under the terms of the GNU General Public
  * License version 2. This program is licensed "as is" without any
diff --git a/drivers/clk/spear/clk-vco-pll.c b/drivers/clk/spear/clk-vco-pll.c
index 1b9b65bca51e..5ebddc528145 100644
--- a/drivers/clk/spear/clk-vco-pll.c
+++ b/drivers/clk/spear/clk-vco-pll.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
  *
  * This file is licensed under the terms of the GNU General Public
  * License version 2. This program is licensed "as is" without any
diff --git a/drivers/clk/spear/clk.c b/drivers/clk/spear/clk.c
index 628b6d5ed3d9..157fe099ea6a 100644
--- a/drivers/clk/spear/clk.c
+++ b/drivers/clk/spear/clk.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
  *
  * This file is licensed under the terms of the GNU General Public
  * License version 2. This program is licensed "as is" without any
diff --git a/drivers/clk/spear/clk.h b/drivers/clk/spear/clk.h
index 931737677dfa..9834944f08b1 100644
--- a/drivers/clk/spear/clk.h
+++ b/drivers/clk/spear/clk.h
@@ -2,7 +2,7 @@
  * Clock framework definitions for SPEAr platform
  *
  * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
  *
  * This file is licensed under the terms of the GNU General Public
  * License version 2. This program is licensed "as is" without any
diff --git a/drivers/clk/spear/spear1310_clock.c b/drivers/clk/spear/spear1310_clock.c
index 4daa5977793a..222ce108b41a 100644
--- a/drivers/clk/spear/spear1310_clock.c
+++ b/drivers/clk/spear/spear1310_clock.c
@@ -4,7 +4,7 @@
  * SPEAr1310 machine clock framework source file
  *
  * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
  *
  * This file is licensed under the terms of the GNU General Public
  * License version 2. This program is licensed "as is" without any
diff --git a/drivers/clk/spear/spear1340_clock.c b/drivers/clk/spear/spear1340_clock.c
index 5a5c6648308d..973c9d3fbcf8 100644
--- a/drivers/clk/spear/spear1340_clock.c
+++ b/drivers/clk/spear/spear1340_clock.c
@@ -4,7 +4,7 @@
  * SPEAr1340 machine clock framework source file
  *
  * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
  *
  * This file is licensed under the terms of the GNU General Public
  * License version 2. This program is licensed "as is" without any
diff --git a/drivers/clk/spear/spear3xx_clock.c b/drivers/clk/spear/spear3xx_clock.c
index bb5f387774e2..404a55edd613 100644
--- a/drivers/clk/spear/spear3xx_clock.c
+++ b/drivers/clk/spear/spear3xx_clock.c
@@ -2,7 +2,7 @@
  * SPEAr3xx machines clock framework source file
  *
  * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
  *
  * This file is licensed under the terms of the GNU General Public
  * License version 2. This program is licensed "as is" without any
diff --git a/drivers/clk/spear/spear6xx_clock.c b/drivers/clk/spear/spear6xx_clock.c
index 4f649c9cb094..231061fa73a4 100644
--- a/drivers/clk/spear/spear6xx_clock.c
+++ b/drivers/clk/spear/spear6xx_clock.c
@@ -2,7 +2,7 @@
  * SPEAr6xx machines clock framework source file
  *
  * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
  *
  * This file is licensed under the terms of the GNU General Public
  * License version 2. This program is licensed "as is" without any
diff --git a/drivers/clk/st/clk-flexgen.c b/drivers/clk/st/clk-flexgen.c
index 657ca14ba709..8dd8cce27361 100644
--- a/drivers/clk/st/clk-flexgen.c
+++ b/drivers/clk/st/clk-flexgen.c
@@ -190,7 +190,7 @@ static struct clk *clk_register_flexgen(const char *name,
 
         init.name = name;
         init.ops = &flexgen_ops;
-        init.flags = CLK_IS_BASIC | flexgen_flags;
+        init.flags = CLK_IS_BASIC | CLK_GET_RATE_NOCACHE | flexgen_flags;
         init.parent_names = parent_names;
         init.num_parents = num_parents;
 
@@ -303,6 +303,8 @@ static void __init st_of_flexgen_setup(struct device_node *np)
         if (!rlock)
                 goto err;
 
+        spin_lock_init(rlock);
+
         for (i = 0; i < clk_data->clk_num; i++) {
                 struct clk *clk;
                 const char *clk_name;
diff --git a/drivers/clk/st/clkgen-fsyn.c b/drivers/clk/st/clkgen-fsyn.c
index e94197f04b0b..d9eb2e1d8471 100644
--- a/drivers/clk/st/clkgen-fsyn.c
+++ b/drivers/clk/st/clkgen-fsyn.c
@@ -340,7 +340,7 @@ static const struct clkgen_quadfs_data st_fs660c32_C_407 = {
                     CLKGEN_FIELD(0x30c, 0xf, 20),
                     CLKGEN_FIELD(0x310, 0xf, 20) },
         .lockstatus_present = true,
-        .lock_status = CLKGEN_FIELD(0x2A0, 0x1, 24),
+        .lock_status = CLKGEN_FIELD(0x2f0, 0x1, 24),
         .powerup_polarity = 1,
         .standby_polarity = 1,
         .pll_ops        = &st_quadfs_pll_c32_ops,
@@ -489,7 +489,7 @@ static int quadfs_pll_is_enabled(struct clk_hw *hw)
         struct st_clk_quadfs_pll *pll = to_quadfs_pll(hw);
         u32 npda = CLKGEN_READ(pll, npda);
 
-        return !!npda;
+        return pll->data->powerup_polarity ? !npda : !!npda;
 }
 
 static int clk_fs660c32_vco_get_rate(unsigned long input, struct stm_fs *fs,
@@ -635,7 +635,7 @@ static struct clk * __init st_clk_register_quadfs_pll(
 
         init.name = name;
         init.ops = quadfs->pll_ops;
-        init.flags = CLK_IS_BASIC;
+        init.flags = CLK_IS_BASIC | CLK_GET_RATE_NOCACHE;
         init.parent_names = &parent_name;
         init.num_parents = 1;
 
@@ -774,7 +774,7 @@ static void quadfs_fsynth_disable(struct clk_hw *hw)
         if (fs->lock)
                 spin_lock_irqsave(fs->lock, flags);
 
-        CLKGEN_WRITE(fs, nsb[fs->chan], !fs->data->standby_polarity);
+        CLKGEN_WRITE(fs, nsb[fs->chan], fs->data->standby_polarity);
 
         if (fs->lock)
                 spin_unlock_irqrestore(fs->lock, flags);
@@ -1082,10 +1082,6 @@ static const struct of_device_id quadfs_of_match[] = {
                 .compatible = "st,stih407-quadfs660-D",
                 .data = &st_fs660c32_D_407
         },
-        {
-                .compatible = "st,stih407-quadfs660-D",
-                .data = (void *)&st_fs660c32_D_407
-        },
         {}
 };
 
diff --git a/drivers/clk/st/clkgen-mux.c b/drivers/clk/st/clkgen-mux.c
index 4fbe6e099587..717c4a91a17b 100644
--- a/drivers/clk/st/clkgen-mux.c
+++ b/drivers/clk/st/clkgen-mux.c
@@ -237,7 +237,7 @@ static struct clk *clk_register_genamux(const char *name,
 
         init.name = name;
         init.ops = &clkgena_divmux_ops;
-        init.flags = CLK_IS_BASIC;
+        init.flags = CLK_IS_BASIC | CLK_GET_RATE_NOCACHE;
         init.parent_names = parent_names;
         init.num_parents = num_parents;
 
@@ -513,7 +513,8 @@ static void __init st_of_clkgena_prediv_setup(struct device_node *np)
                                           0, &clk_name))
                 return;
 
-        clk = clk_register_divider_table(NULL, clk_name, parent_name, 0,
+        clk = clk_register_divider_table(NULL, clk_name, parent_name,
+                                         CLK_GET_RATE_NOCACHE,
                                          reg + data->offset, data->shift, 1,
                                          0, data->table, NULL);
         if (IS_ERR(clk))
@@ -582,7 +583,7 @@ static struct clkgen_mux_data stih416_a9_mux_data = {
 };
 static struct clkgen_mux_data stih407_a9_mux_data = {
         .offset = 0x1a4,
-        .shift = 1,
+        .shift = 0,
         .width = 2,
 };
 
@@ -786,7 +787,8 @@ static void __init st_of_clkgen_vcc_setup(struct device_node *np)
                                              &mux->hw, &clk_mux_ops,
                                              &div->hw, &clk_divider_ops,
                                              &gate->hw, &clk_gate_ops,
-                                             data->clk_flags);
+                                             data->clk_flags |
+                                             CLK_GET_RATE_NOCACHE);
                 if (IS_ERR(clk)) {
                         kfree(gate);
                         kfree(div);
diff --git a/drivers/clk/st/clkgen-pll.c b/drivers/clk/st/clkgen-pll.c
index 106532207213..72d1c27eaffa 100644
--- a/drivers/clk/st/clkgen-pll.c
+++ b/drivers/clk/st/clkgen-pll.c
@@ -406,7 +406,7 @@ static struct clk * __init clkgen_pll_register(const char *parent_name,
         init.name = clk_name;
         init.ops = pll_data->ops;
 
-        init.flags = CLK_IS_BASIC;
+        init.flags = CLK_IS_BASIC | CLK_GET_RATE_NOCACHE;
         init.parent_names = &parent_name;
         init.num_parents  = 1;
 
diff --git a/drivers/clk/sunxi/clk-sunxi.c b/drivers/clk/sunxi/clk-sunxi.c
index 9a82f17d2d73..abf7b37faf73 100644
--- a/drivers/clk/sunxi/clk-sunxi.c
+++ b/drivers/clk/sunxi/clk-sunxi.c
@@ -1391,6 +1391,7 @@ static void __init sun6i_init_clocks(struct device_node *node)
 CLK_OF_DECLARE(sun6i_a31_clk_init, "allwinner,sun6i-a31", sun6i_init_clocks);
 CLK_OF_DECLARE(sun6i_a31s_clk_init, "allwinner,sun6i-a31s", sun6i_init_clocks);
 CLK_OF_DECLARE(sun8i_a23_clk_init, "allwinner,sun8i-a23", sun6i_init_clocks);
+CLK_OF_DECLARE(sun8i_a33_clk_init, "allwinner,sun8i-a33", sun6i_init_clocks);
 
 static void __init sun9i_init_clocks(struct device_node *node)
 {
diff --git a/drivers/clocksource/timer-imx-gpt.c b/drivers/clocksource/timer-imx-gpt.c
index 879c78423546..2d59038dec43 100644
--- a/drivers/clocksource/timer-imx-gpt.c
+++ b/drivers/clocksource/timer-imx-gpt.c
@@ -529,6 +529,7 @@ static void __init imx6dl_timer_init_dt(struct device_node *np)
 
 CLOCKSOURCE_OF_DECLARE(imx1_timer, "fsl,imx1-gpt", imx1_timer_init_dt);
 CLOCKSOURCE_OF_DECLARE(imx21_timer, "fsl,imx21-gpt", imx21_timer_init_dt);
+CLOCKSOURCE_OF_DECLARE(imx27_timer, "fsl,imx27-gpt", imx21_timer_init_dt);
 CLOCKSOURCE_OF_DECLARE(imx31_timer, "fsl,imx31-gpt", imx31_timer_init_dt);
 CLOCKSOURCE_OF_DECLARE(imx25_timer, "fsl,imx25-gpt", imx31_timer_init_dt);
 CLOCKSOURCE_OF_DECLARE(imx50_timer, "fsl,imx50-gpt", imx31_timer_init_dt);
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index b612411655f9..26063afb3eba 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -169,6 +169,15 @@ struct kobject *get_governor_parent_kobj(struct cpufreq_policy *policy)
 }
 EXPORT_SYMBOL_GPL(get_governor_parent_kobj);
 
+struct cpufreq_frequency_table *cpufreq_frequency_get_table(unsigned int cpu)
+{
+        struct cpufreq_policy *policy = per_cpu(cpufreq_cpu_data, cpu);
+
+        return policy && !policy_is_inactive(policy) ?
+                policy->freq_table : NULL;
+}
+EXPORT_SYMBOL_GPL(cpufreq_frequency_get_table);
+
 static inline u64 get_cpu_idle_time_jiffy(unsigned int cpu, u64 *wall)
 {
         u64 idle_time;
@@ -1132,6 +1141,7 @@ static struct cpufreq_policy *cpufreq_policy_restore(unsigned int cpu)
 
                 down_write(&policy->rwsem);
                 policy->cpu = cpu;
+                policy->governor = NULL;
                 up_write(&policy->rwsem);
         }
 
diff --git a/drivers/cpufreq/freq_table.c b/drivers/cpufreq/freq_table.c
index df14766a8e06..dfbbf981ed56 100644
--- a/drivers/cpufreq/freq_table.c
+++ b/drivers/cpufreq/freq_table.c
@@ -297,15 +297,6 @@ int cpufreq_table_validate_and_show(struct cpufreq_policy *policy,
 }
 EXPORT_SYMBOL_GPL(cpufreq_table_validate_and_show);
 
-struct cpufreq_policy *cpufreq_cpu_get_raw(unsigned int cpu);
-
-struct cpufreq_frequency_table *cpufreq_frequency_get_table(unsigned int cpu)
-{
-        struct cpufreq_policy *policy = cpufreq_cpu_get_raw(cpu);
-        return policy ? policy->freq_table : NULL;
-}
-EXPORT_SYMBOL_GPL(cpufreq_frequency_get_table);
-
 MODULE_AUTHOR("Dominik Brodowski <linux@brodo.de>");
 MODULE_DESCRIPTION("CPUfreq frequency table helpers");
 MODULE_LICENSE("GPL");
diff --git a/drivers/cpufreq/loongson2_cpufreq.c b/drivers/cpufreq/loongson2_cpufreq.c
index fc897babab55..e362860c2b50 100644
--- a/drivers/cpufreq/loongson2_cpufreq.c
+++ b/drivers/cpufreq/loongson2_cpufreq.c
@@ -3,7 +3,7 @@
  *
  * The 2E revision of loongson processor not support this feature.
  *
- * Copyright (C) 2006 - 2008 Lemote Inc. & Insititute of Computing Technology
+ * Copyright (C) 2006 - 2008 Lemote Inc. & Institute of Computing Technology
  * Author: Yanhua, yanh@lemote.com
  *
  * This file is subject to the terms and conditions of the GNU General Public
diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c
index e8e2775c3821..48b7228563ad 100644
--- a/drivers/cpuidle/cpuidle.c
+++ b/drivers/cpuidle/cpuidle.c
@@ -112,7 +112,12 @@ int cpuidle_find_deepest_state(struct cpuidle_driver *drv,
 static void enter_freeze_proper(struct cpuidle_driver *drv,
                                 struct cpuidle_device *dev, int index)
 {
-        tick_freeze();
+        /*
+         * trace_suspend_resume() called by tick_freeze() for the last CPU
+         * executing it contains RCU usage regarded as invalid in the idle
+         * context, so tell RCU about that.
+         */
+        RCU_NONIDLE(tick_freeze());
         /*
          * The state used here cannot be a "coupled" one, because the "coupled"
          * cpuidle mechanism enables interrupts and doing that with timekeeping
@@ -122,7 +127,7 @@ static void enter_freeze_proper(struct cpuidle_driver *drv,
         WARN_ON(!irqs_disabled());
         /*
          * timekeeping_resume() that will be called by tick_unfreeze() for the
-         * last CPU executing it calls functions containing RCU read-side
+         * first CPU executing it calls functions containing RCU read-side
          * critical sections, so tell RCU about that.
          */
         RCU_NONIDLE(tick_unfreeze());
diff --git a/drivers/crypto/nx/nx-aes-ccm.c b/drivers/crypto/nx/nx-aes-ccm.c
index 67f80813a06f..e4311ce0cd78 100644
--- a/drivers/crypto/nx/nx-aes-ccm.c
+++ b/drivers/crypto/nx/nx-aes-ccm.c
@@ -494,8 +494,9 @@ out:
 static int ccm4309_aes_nx_encrypt(struct aead_request *req)
 {
         struct nx_crypto_ctx *nx_ctx = crypto_tfm_ctx(req->base.tfm);
+        struct nx_gcm_rctx *rctx = aead_request_ctx(req);
         struct blkcipher_desc desc;
-        u8 *iv = nx_ctx->priv.ccm.iv;
+        u8 *iv = rctx->iv;
 
         iv[0] = 3;
         memcpy(iv + 1, nx_ctx->priv.ccm.nonce, 3);
@@ -525,8 +526,9 @@ static int ccm_aes_nx_encrypt(struct aead_request *req)
 static int ccm4309_aes_nx_decrypt(struct aead_request *req)
 {
         struct nx_crypto_ctx *nx_ctx = crypto_tfm_ctx(req->base.tfm);
+        struct nx_gcm_rctx *rctx = aead_request_ctx(req);
         struct blkcipher_desc desc;
-        u8 *iv = nx_ctx->priv.ccm.iv;
+        u8 *iv = rctx->iv;
 
         iv[0] = 3;
         memcpy(iv + 1, nx_ctx->priv.ccm.nonce, 3);
diff --git a/drivers/crypto/nx/nx-aes-ctr.c b/drivers/crypto/nx/nx-aes-ctr.c
index 2617cd4d54dd..dd7e9f3f5b6b 100644
--- a/drivers/crypto/nx/nx-aes-ctr.c
+++ b/drivers/crypto/nx/nx-aes-ctr.c
@@ -72,7 +72,7 @@ static int ctr3686_aes_nx_set_key(struct crypto_tfm *tfm,
         if (key_len < CTR_RFC3686_NONCE_SIZE)
                 return -EINVAL;
 
-        memcpy(nx_ctx->priv.ctr.iv,
+        memcpy(nx_ctx->priv.ctr.nonce,
                in_key + key_len - CTR_RFC3686_NONCE_SIZE,
                CTR_RFC3686_NONCE_SIZE);
 
@@ -131,14 +131,15 @@ static int ctr3686_aes_nx_crypt(struct blkcipher_desc *desc,
                                 unsigned int           nbytes)
 {
         struct nx_crypto_ctx *nx_ctx = crypto_blkcipher_ctx(desc->tfm);
-        u8 *iv = nx_ctx->priv.ctr.iv;
+        u8 iv[16];
 
+        memcpy(iv, nx_ctx->priv.ctr.nonce, CTR_RFC3686_IV_SIZE);
         memcpy(iv + CTR_RFC3686_NONCE_SIZE,
                desc->info, CTR_RFC3686_IV_SIZE);
         iv[12] = iv[13] = iv[14] = 0;
         iv[15] = 1;
 
-        desc->info = nx_ctx->priv.ctr.iv;
+        desc->info = iv;
 
         return ctr_aes_nx_crypt(desc, dst, src, nbytes);
 }
diff --git a/drivers/crypto/nx/nx-aes-gcm.c b/drivers/crypto/nx/nx-aes-gcm.c
index 08ac6d48688c..92c993f08213 100644
--- a/drivers/crypto/nx/nx-aes-gcm.c
+++ b/drivers/crypto/nx/nx-aes-gcm.c
@@ -317,6 +317,7 @@ out:
 static int gcm_aes_nx_crypt(struct aead_request *req, int enc)
 {
         struct nx_crypto_ctx *nx_ctx = crypto_tfm_ctx(req->base.tfm);
+        struct nx_gcm_rctx *rctx = aead_request_ctx(req);
         struct nx_csbcpb *csbcpb = nx_ctx->csbcpb;
         struct blkcipher_desc desc;
         unsigned int nbytes = req->cryptlen;
@@ -326,7 +327,7 @@ static int gcm_aes_nx_crypt(struct aead_request *req, int enc)
 
         spin_lock_irqsave(&nx_ctx->lock, irq_flags);
 
-        desc.info = nx_ctx->priv.gcm.iv;
+        desc.info = rctx->iv;
         /* initialize the counter */
         *(u32 *)(desc.info + NX_GCM_CTR_OFFSET) = 1;
 
@@ -424,8 +425,8 @@ out:
 
 static int gcm_aes_nx_encrypt(struct aead_request *req)
 {
-        struct nx_crypto_ctx *nx_ctx = crypto_tfm_ctx(req->base.tfm);
-        char *iv = nx_ctx->priv.gcm.iv;
+        struct nx_gcm_rctx *rctx = aead_request_ctx(req);
+        char *iv = rctx->iv;
 
         memcpy(iv, req->iv, 12);
 
@@ -434,8 +435,8 @@ static int gcm_aes_nx_encrypt(struct aead_request *req)
 
 static int gcm_aes_nx_decrypt(struct aead_request *req)
 {
-        struct nx_crypto_ctx *nx_ctx = crypto_tfm_ctx(req->base.tfm);
-        char *iv = nx_ctx->priv.gcm.iv;
+        struct nx_gcm_rctx *rctx = aead_request_ctx(req);
+        char *iv = rctx->iv;
 
         memcpy(iv, req->iv, 12);
 
@@ -445,7 +446,8 @@ static int gcm_aes_nx_decrypt(struct aead_request *req)
 static int gcm4106_aes_nx_encrypt(struct aead_request *req)
 {
         struct nx_crypto_ctx *nx_ctx = crypto_tfm_ctx(req->base.tfm);
-        char *iv = nx_ctx->priv.gcm.iv;
+        struct nx_gcm_rctx *rctx = aead_request_ctx(req);
+        char *iv = rctx->iv;
         char *nonce = nx_ctx->priv.gcm.nonce;
 
         memcpy(iv, nonce, NX_GCM4106_NONCE_LEN);
@@ -457,7 +459,8 @@ static int gcm4106_aes_nx_encrypt(struct aead_request *req)
 static int gcm4106_aes_nx_decrypt(struct aead_request *req)
 {
         struct nx_crypto_ctx *nx_ctx = crypto_tfm_ctx(req->base.tfm);
-        char *iv = nx_ctx->priv.gcm.iv;
+        struct nx_gcm_rctx *rctx = aead_request_ctx(req);
+        char *iv = rctx->iv;
         char *nonce = nx_ctx->priv.gcm.nonce;
 
         memcpy(iv, nonce, NX_GCM4106_NONCE_LEN);
diff --git a/drivers/crypto/nx/nx-aes-xcbc.c b/drivers/crypto/nx/nx-aes-xcbc.c
index 8c2faffab4a3..c2f7d4befb55 100644
--- a/drivers/crypto/nx/nx-aes-xcbc.c
+++ b/drivers/crypto/nx/nx-aes-xcbc.c
@@ -42,6 +42,7 @@ static int nx_xcbc_set_key(struct crypto_shash *desc,
                            unsigned int         key_len)
 {
         struct nx_crypto_ctx *nx_ctx = crypto_shash_ctx(desc);
+        struct nx_csbcpb *csbcpb = nx_ctx->csbcpb;
 
         switch (key_len) {
         case AES_KEYSIZE_128:
@@ -51,7 +52,7 @@ static int nx_xcbc_set_key(struct crypto_shash *desc,
                 return -EINVAL;
         }
 
-        memcpy(nx_ctx->priv.xcbc.key, in_key, key_len);
+        memcpy(csbcpb->cpb.aes_xcbc.key, in_key, key_len);
 
         return 0;
 }
@@ -148,32 +149,29 @@ out:
         return rc;
 }
 
-static int nx_xcbc_init(struct shash_desc *desc)
+static int nx_crypto_ctx_aes_xcbc_init2(struct crypto_tfm *tfm)
 {
-        struct xcbc_state *sctx = shash_desc_ctx(desc);
-        struct nx_crypto_ctx *nx_ctx = crypto_tfm_ctx(&desc->tfm->base);
+        struct nx_crypto_ctx *nx_ctx = crypto_tfm_ctx(tfm);
         struct nx_csbcpb *csbcpb = nx_ctx->csbcpb;
-        struct nx_sg *out_sg;
-        int len;
+        int err;
 
-        nx_ctx_init(nx_ctx, HCOP_FC_AES);
+        err = nx_crypto_ctx_aes_xcbc_init(tfm);
+        if (err)
+                return err;
 
-        memset(sctx, 0, sizeof *sctx);
+        nx_ctx_init(nx_ctx, HCOP_FC_AES);
 
         NX_CPB_SET_KEY_SIZE(csbcpb, NX_KS_AES_128);
         csbcpb->cpb.hdr.mode = NX_MODE_AES_XCBC_MAC;
 
-        memcpy(csbcpb->cpb.aes_xcbc.key, nx_ctx->priv.xcbc.key, AES_BLOCK_SIZE);
-        memset(nx_ctx->priv.xcbc.key, 0, sizeof *nx_ctx->priv.xcbc.key);
-
-        len = AES_BLOCK_SIZE;
-        out_sg = nx_build_sg_list(nx_ctx->out_sg, (u8 *)sctx->state,
-                                  &len, nx_ctx->ap->sglen);
+        return 0;
+}
 
-        if (len != AES_BLOCK_SIZE)
-                return -EINVAL;
+static int nx_xcbc_init(struct shash_desc *desc)
+{
+        struct xcbc_state *sctx = shash_desc_ctx(desc);
 
-        nx_ctx->op.outlen = (nx_ctx->out_sg - out_sg) * sizeof(struct nx_sg);
+        memset(sctx, 0, sizeof *sctx);
 
         return 0;
 }
@@ -186,6 +184,7 @@ static int nx_xcbc_update(struct shash_desc *desc,
         struct nx_crypto_ctx *nx_ctx = crypto_tfm_ctx(&desc->tfm->base);
         struct nx_csbcpb *csbcpb = nx_ctx->csbcpb;
         struct nx_sg *in_sg;
+        struct nx_sg *out_sg;
         u32 to_process = 0, leftover, total;
         unsigned int max_sg_len;
         unsigned long irq_flags;
@@ -213,6 +212,17 @@ static int nx_xcbc_update(struct shash_desc *desc,
         max_sg_len = min_t(u64, max_sg_len,
                                 nx_ctx->ap->databytelen/NX_PAGE_SIZE);
 
+        data_len = AES_BLOCK_SIZE;
+        out_sg = nx_build_sg_list(nx_ctx->out_sg, (u8 *)sctx->state,
+                                  &len, nx_ctx->ap->sglen);
+
+        if (data_len != AES_BLOCK_SIZE) {
+                rc = -EINVAL;
+                goto out;
+        }
+
+        nx_ctx->op.outlen = (nx_ctx->out_sg - out_sg) * sizeof(struct nx_sg);
+
         do {
                 to_process = total - to_process;
                 to_process = to_process & ~(AES_BLOCK_SIZE - 1);
@@ -235,8 +245,10 @@ static int nx_xcbc_update(struct shash_desc *desc,
                                                 (u8 *) sctx->buffer,
                                                 &data_len,
                                                 max_sg_len);
-                        if (data_len != sctx->count)
-                                return -EINVAL;
+                        if (data_len != sctx->count) {
+                                rc = -EINVAL;
+                                goto out;
+                        }
                 }
 
                 data_len = to_process - sctx->count;
@@ -245,8 +257,10 @@ static int nx_xcbc_update(struct shash_desc *desc,
                                         &data_len,
                                         max_sg_len);
 
-                if (data_len != to_process - sctx->count)
-                        return -EINVAL;
+                if (data_len != to_process - sctx->count) {
+                        rc = -EINVAL;
+                        goto out;
+                }
 
                 nx_ctx->op.inlen = (nx_ctx->in_sg - in_sg) *
                                         sizeof(struct nx_sg);
@@ -325,15 +339,19 @@ static int nx_xcbc_final(struct shash_desc *desc, u8 *out)
         in_sg = nx_build_sg_list(nx_ctx->in_sg, (u8 *)sctx->buffer,
                                  &len, nx_ctx->ap->sglen);
 
-        if (len != sctx->count)
-                return -EINVAL;
+        if (len != sctx->count) {
+                rc = -EINVAL;
+                goto out;
+        }
 
         len = AES_BLOCK_SIZE;
         out_sg = nx_build_sg_list(nx_ctx->out_sg, out, &len,
                                   nx_ctx->ap->sglen);
 
-        if (len != AES_BLOCK_SIZE)
-                return -EINVAL;
+        if (len != AES_BLOCK_SIZE) {
+                rc = -EINVAL;
+                goto out;
+        }
 
         nx_ctx->op.inlen = (nx_ctx->in_sg - in_sg) * sizeof(struct nx_sg);
         nx_ctx->op.outlen = (nx_ctx->out_sg - out_sg) * sizeof(struct nx_sg);
@@ -372,7 +390,7 @@ struct shash_alg nx_shash_aes_xcbc_alg = {
                 .cra_blocksize   = AES_BLOCK_SIZE,
                 .cra_module      = THIS_MODULE,
                 .cra_ctxsize     = sizeof(struct nx_crypto_ctx),
-                .cra_init        = nx_crypto_ctx_aes_xcbc_init,
+                .cra_init        = nx_crypto_ctx_aes_xcbc_init2,
                 .cra_exit        = nx_crypto_ctx_exit,
         }
 };
diff --git a/drivers/crypto/nx/nx-sha256.c b/drivers/crypto/nx/nx-sha256.c
index 4e91bdb83c59..08f8d5cd6334 100644
--- a/drivers/crypto/nx/nx-sha256.c
+++ b/drivers/crypto/nx/nx-sha256.c
@@ -29,34 +29,28 @@
 #include "nx.h"
 
 
-static int nx_sha256_init(struct shash_desc *desc)
+static int nx_crypto_ctx_sha256_init(struct crypto_tfm *tfm)
 {
-        struct sha256_state *sctx = shash_desc_ctx(desc);
-        struct nx_crypto_ctx *nx_ctx = crypto_tfm_ctx(&desc->tfm->base);
-        struct nx_sg *out_sg;
-        int len;
-        u32 max_sg_len;
+        struct nx_crypto_ctx *nx_ctx = crypto_tfm_ctx(tfm);
+        int err;
 
-        nx_ctx_init(nx_ctx, HCOP_FC_SHA);
+        err = nx_crypto_ctx_sha_init(tfm);
+        if (err)
+                return err;
 
-        memset(sctx, 0, sizeof *sctx);
+        nx_ctx_init(nx_ctx, HCOP_FC_SHA);
 
         nx_ctx->ap = &nx_ctx->props[NX_PROPS_SHA256];
 
         NX_CPB_SET_DIGEST_SIZE(nx_ctx->csbcpb, NX_DS_SHA256);
 
-        max_sg_len = min_t(u64, nx_ctx->ap->sglen,
-                        nx_driver.of.max_sg_len/sizeof(struct nx_sg));
-        max_sg_len = min_t(u64, max_sg_len,
-                        nx_ctx->ap->databytelen/NX_PAGE_SIZE);
+        return 0;
+}
 
-        len = SHA256_DIGEST_SIZE;
-        out_sg = nx_build_sg_list(nx_ctx->out_sg, (u8 *)sctx->state,
-                                  &len, max_sg_len);
-        nx_ctx->op.outlen = (nx_ctx->out_sg - out_sg) * sizeof(struct nx_sg);
+static int nx_sha256_init(struct shash_desc *desc) {
+        struct sha256_state *sctx = shash_desc_ctx(desc);
 
-        if (len != SHA256_DIGEST_SIZE)
-                return -EINVAL;
+        memset(sctx, 0, sizeof *sctx);
 
         sctx->state[0] = __cpu_to_be32(SHA256_H0);
         sctx->state[1] = __cpu_to_be32(SHA256_H1);
@@ -78,6 +72,7 @@ static int nx_sha256_update(struct shash_desc *desc, const u8 *data,
         struct nx_crypto_ctx *nx_ctx = crypto_tfm_ctx(&desc->tfm->base);
         struct nx_csbcpb *csbcpb = (struct nx_csbcpb *)nx_ctx->csbcpb;
         struct nx_sg *in_sg;
+        struct nx_sg *out_sg;
         u64 to_process = 0, leftover, total;
         unsigned long irq_flags;
         int rc = 0;
@@ -108,6 +103,16 @@ static int nx_sha256_update(struct shash_desc *desc, const u8 *data,
         max_sg_len = min_t(u64, max_sg_len,
                         nx_ctx->ap->databytelen/NX_PAGE_SIZE);
 
+        data_len = SHA256_DIGEST_SIZE;
+        out_sg = nx_build_sg_list(nx_ctx->out_sg, (u8 *)sctx->state,
+                                  &data_len, max_sg_len);
+        nx_ctx->op.outlen = (nx_ctx->out_sg - out_sg) * sizeof(struct nx_sg);
+
+        if (data_len != SHA256_DIGEST_SIZE) {
+                rc = -EINVAL;
+                goto out;
+        }
+
         do {
                 /*
                  * to_process: the SHA256_BLOCK_SIZE data chunk to process in
@@ -282,7 +287,7 @@ struct shash_alg nx_shash_sha256_alg = {
                 .cra_blocksize   = SHA256_BLOCK_SIZE,
                 .cra_module      = THIS_MODULE,
                 .cra_ctxsize     = sizeof(struct nx_crypto_ctx),
-                .cra_init        = nx_crypto_ctx_sha_init,
+                .cra_init        = nx_crypto_ctx_sha256_init,
                 .cra_exit        = nx_crypto_ctx_exit,
         }
 };
diff --git a/drivers/crypto/nx/nx-sha512.c b/drivers/crypto/nx/nx-sha512.c
index e6a58d2ee628..aff0fe58eac0 100644
--- a/drivers/crypto/nx/nx-sha512.c
+++ b/drivers/crypto/nx/nx-sha512.c
@@ -28,34 +28,29 @@
 #include "nx.h"
 
 
-static int nx_sha512_init(struct shash_desc *desc)
+static int nx_crypto_ctx_sha512_init(struct crypto_tfm *tfm)
 {
-        struct sha512_state *sctx = shash_desc_ctx(desc);
-        struct nx_crypto_ctx *nx_ctx = crypto_tfm_ctx(&desc->tfm->base);
-        struct nx_sg *out_sg;
-        int len;
-        u32 max_sg_len;
+        struct nx_crypto_ctx *nx_ctx = crypto_tfm_ctx(tfm);
+        int err;
 
-        nx_ctx_init(nx_ctx, HCOP_FC_SHA);
+        err = nx_crypto_ctx_sha_init(tfm);
+        if (err)
+                return err;
 
-        memset(sctx, 0, sizeof *sctx);
+        nx_ctx_init(nx_ctx, HCOP_FC_SHA);
 
         nx_ctx->ap = &nx_ctx->props[NX_PROPS_SHA512];
 
         NX_CPB_SET_DIGEST_SIZE(nx_ctx->csbcpb, NX_DS_SHA512);
 
-        max_sg_len = min_t(u64, nx_ctx->ap->sglen,
-                        nx_driver.of.max_sg_len/sizeof(struct nx_sg));
-        max_sg_len = min_t(u64, max_sg_len,
-                        nx_ctx->ap->databytelen/NX_PAGE_SIZE);
+        return 0;
+}
 
-        len = SHA512_DIGEST_SIZE;
-        out_sg = nx_build_sg_list(nx_ctx->out_sg, (u8 *)sctx->state,
-                                  &len, max_sg_len);
-        nx_ctx->op.outlen = (nx_ctx->out_sg - out_sg) * sizeof(struct nx_sg);
+static int nx_sha512_init(struct shash_desc *desc)
+{
+        struct sha512_state *sctx = shash_desc_ctx(desc);
 
-        if (len != SHA512_DIGEST_SIZE)
-                return -EINVAL;
+        memset(sctx, 0, sizeof *sctx);
 
         sctx->state[0] = __cpu_to_be64(SHA512_H0);
         sctx->state[1] = __cpu_to_be64(SHA512_H1);
@@ -77,6 +72,7 @@ static int nx_sha512_update(struct shash_desc *desc, const u8 *data,
         struct nx_crypto_ctx *nx_ctx = crypto_tfm_ctx(&desc->tfm->base);
         struct nx_csbcpb *csbcpb = (struct nx_csbcpb *)nx_ctx->csbcpb;
         struct nx_sg *in_sg;
+        struct nx_sg *out_sg;
         u64 to_process, leftover = 0, total;
         unsigned long irq_flags;
         int rc = 0;
@@ -107,6 +103,16 @@ static int nx_sha512_update(struct shash_desc *desc, const u8 *data,
         max_sg_len = min_t(u64, max_sg_len,
                         nx_ctx->ap->databytelen/NX_PAGE_SIZE);
 
+        data_len = SHA512_DIGEST_SIZE;
+        out_sg = nx_build_sg_list(nx_ctx->out_sg, (u8 *)sctx->state,
+                                  &data_len, max_sg_len);
+        nx_ctx->op.outlen = (nx_ctx->out_sg - out_sg) * sizeof(struct nx_sg);
+
+        if (data_len != SHA512_DIGEST_SIZE) {
+                rc = -EINVAL;
+                goto out;
+        }
+
         do {
                 /*
                  * to_process: the SHA512_BLOCK_SIZE data chunk to process in
@@ -288,7 +294,7 @@ struct shash_alg nx_shash_sha512_alg = {
                 .cra_blocksize   = SHA512_BLOCK_SIZE,
                 .cra_module      = THIS_MODULE,
                 .cra_ctxsize     = sizeof(struct nx_crypto_ctx),
-                .cra_init        = nx_crypto_ctx_sha_init,
+                .cra_init        = nx_crypto_ctx_sha512_init,
                 .cra_exit        = nx_crypto_ctx_exit,
         }
 };
diff --git a/drivers/crypto/nx/nx.c b/drivers/crypto/nx/nx.c
index f6198f29a4a8..436971343ff7 100644
--- a/drivers/crypto/nx/nx.c
+++ b/drivers/crypto/nx/nx.c
@@ -713,12 +713,15 @@ static int nx_crypto_ctx_init(struct nx_crypto_ctx *nx_ctx, u32 fc, u32 mode)
 /* entry points from the crypto tfm initializers */
 int nx_crypto_ctx_aes_ccm_init(struct crypto_tfm *tfm)
 {
+        crypto_aead_set_reqsize(__crypto_aead_cast(tfm),
+                                sizeof(struct nx_ccm_rctx));
         return nx_crypto_ctx_init(crypto_tfm_ctx(tfm), NX_FC_AES,
                                   NX_MODE_AES_CCM);
 }
 
 int nx_crypto_ctx_aes_gcm_init(struct crypto_aead *tfm)
 {
+        crypto_aead_set_reqsize(tfm, sizeof(struct nx_gcm_rctx));
         return nx_crypto_ctx_init(crypto_aead_ctx(tfm), NX_FC_AES,
                                   NX_MODE_AES_GCM);
 }
diff --git a/drivers/crypto/nx/nx.h b/drivers/crypto/nx/nx.h
index de3ea8738146..cdff03a42ae7 100644
--- a/drivers/crypto/nx/nx.h
+++ b/drivers/crypto/nx/nx.h
@@ -2,6 +2,8 @@
 #ifndef __NX_H__
 #define __NX_H__
 
+#include <crypto/ctr.h>
+
 #define NX_NAME         "nx-crypto"
 #define NX_STRING       "IBM Power7+ Nest Accelerator Crypto Driver"
 #define NX_VERSION      "1.0"
@@ -91,8 +93,11 @@ struct nx_crypto_driver {
 
 #define NX_GCM4106_NONCE_LEN            (4)
 #define NX_GCM_CTR_OFFSET               (12)
-struct nx_gcm_priv {
+struct nx_gcm_rctx {
         u8 iv[16];
+};
+
+struct nx_gcm_priv {
         u8 iauth_tag[16];
         u8 nonce[NX_GCM4106_NONCE_LEN];
 };
@@ -100,8 +105,11 @@ struct nx_gcm_priv {
 #define NX_CCM_AES_KEY_LEN              (16)
 #define NX_CCM4309_AES_KEY_LEN          (19)
 #define NX_CCM4309_NONCE_LEN            (3)
-struct nx_ccm_priv {
+struct nx_ccm_rctx {
         u8 iv[16];
+};
+
+struct nx_ccm_priv {
         u8 b0[16];
         u8 iauth_tag[16];
         u8 oauth_tag[16];
@@ -113,7 +121,7 @@ struct nx_xcbc_priv {
 };
 
 struct nx_ctr_priv {
-        u8 iv[16];
+        u8 nonce[CTR_RFC3686_NONCE_SIZE];
 };
 
 struct nx_crypto_ctx {
diff --git a/drivers/crypto/omap-des.c b/drivers/crypto/omap-des.c
index 46307098f8ba..0a70e46d5416 100644
--- a/drivers/crypto/omap-des.c
+++ b/drivers/crypto/omap-des.c
@@ -536,9 +536,6 @@ static int omap_des_crypt_dma_stop(struct omap_des_dev *dd)
         dmaengine_terminate_all(dd->dma_lch_in);
         dmaengine_terminate_all(dd->dma_lch_out);
 
-        dma_unmap_sg(dd->dev, dd->in_sg, dd->in_sg_len, DMA_TO_DEVICE);
-        dma_unmap_sg(dd->dev, dd->out_sg, dd->out_sg_len, DMA_FROM_DEVICE);
-
         return err;
 }
 
diff --git a/drivers/dma/dw/core.c b/drivers/dma/dw/core.c
index 1022c2e1a2b0..cf1c87fa1edd 100644
--- a/drivers/dma/dw/core.c
+++ b/drivers/dma/dw/core.c
@@ -1746,4 +1746,4 @@ EXPORT_SYMBOL_GPL(dw_dma_enable);
 MODULE_LICENSE("GPL v2");
 MODULE_DESCRIPTION("Synopsys DesignWare DMA Controller core driver");
 MODULE_AUTHOR("Haavard Skinnemoen (Atmel)");
-MODULE_AUTHOR("Viresh Kumar <viresh.linux@gmail.com>");
+MODULE_AUTHOR("Viresh Kumar <vireshk@kernel.org>");
diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c
index 4fd9961d552e..d42537425438 100644
--- a/drivers/firmware/efi/cper.c
+++ b/drivers/firmware/efi/cper.c
@@ -305,10 +305,17 @@ const char *cper_mem_err_unpack(struct trace_seq *p,
         return ret;
 }
 
-static void cper_print_mem(const char *pfx, const struct cper_sec_mem_err *mem)
+static void cper_print_mem(const char *pfx, const struct cper_sec_mem_err *mem,
+        int len)
 {
         struct cper_mem_err_compact cmem;
 
+        /* Don't trust UEFI 2.1/2.2 structure with bad validation bits */
+        if (len == sizeof(struct cper_sec_mem_err_old) &&
+            (mem->validation_bits & ~(CPER_MEM_VALID_RANK_NUMBER - 1))) {
+                pr_err(FW_WARN "valid bits set for fields beyond structure\n");
+                return;
+        }
         if (mem->validation_bits & CPER_MEM_VALID_ERROR_STATUS)
                 printk("%s""error_status: 0x%016llx\n", pfx, mem->error_status);
         if (mem->validation_bits & CPER_MEM_VALID_PA)
@@ -405,8 +412,10 @@ static void cper_estatus_print_section(
         } else if (!uuid_le_cmp(*sec_type, CPER_SEC_PLATFORM_MEM)) {
                 struct cper_sec_mem_err *mem_err = (void *)(gdata + 1);
                 printk("%s""section_type: memory error\n", newpfx);
-                if (gdata->error_data_length >= sizeof(*mem_err))
-                        cper_print_mem(newpfx, mem_err);
+                if (gdata->error_data_length >=
+                    sizeof(struct cper_sec_mem_err_old))
+                        cper_print_mem(newpfx, mem_err,
+                                       gdata->error_data_length);
                 else
                         goto err_section_too_small;
         } else if (!uuid_le_cmp(*sec_type, CPER_SEC_PCIE)) {
diff --git a/drivers/gpio/gpio-brcmstb.c b/drivers/gpio/gpio-brcmstb.c
index 7a3cb1fa0a76..4630a8133ea6 100644
--- a/drivers/gpio/gpio-brcmstb.c
+++ b/drivers/gpio/gpio-brcmstb.c
@@ -87,6 +87,15 @@ static int brcmstb_gpio_remove(struct platform_device *pdev)
         struct brcmstb_gpio_bank *bank;
         int ret = 0;
 
+        if (!priv) {
+                dev_err(&pdev->dev, "called %s without drvdata!\n", __func__);
+                return -EFAULT;
+        }
+
+        /*
+         * You can lose return values below, but we report all errors, and it's
+         * more important to actually perform all of the steps.
+         */
         list_for_each(pos, &priv->bank_list) {
                 bank = list_entry(pos, struct brcmstb_gpio_bank, node);
                 ret = bgpio_remove(&bank->bgc);
@@ -143,6 +152,8 @@ static int brcmstb_gpio_probe(struct platform_device *pdev)
         priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
         if (!priv)
                 return -ENOMEM;
+        platform_set_drvdata(pdev, priv);
+        INIT_LIST_HEAD(&priv->bank_list);
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         reg_base = devm_ioremap_resource(dev, res);
@@ -153,7 +164,6 @@ static int brcmstb_gpio_probe(struct platform_device *pdev)
         priv->reg_base = reg_base;
         priv->pdev = pdev;
 
-        INIT_LIST_HEAD(&priv->bank_list);
         if (brcmstb_gpio_sanity_check_banks(dev, np, res))
                 return -EINVAL;
 
@@ -221,8 +231,6 @@ static int brcmstb_gpio_probe(struct platform_device *pdev)
         dev_info(dev, "Registered %d banks (GPIO(s): %d-%d)\n",
                         priv->num_banks, priv->gpio_base, gpio_base - 1);
 
-        platform_set_drvdata(pdev, priv);
-
         return 0;
 
 fail:
diff --git a/drivers/gpio/gpio-davinci.c b/drivers/gpio/gpio-davinci.c
index c5e05c82d67c..c246ac3dda7c 100644
--- a/drivers/gpio/gpio-davinci.c
+++ b/drivers/gpio/gpio-davinci.c
@@ -578,15 +578,13 @@ static int davinci_gpio_irq_setup(struct platform_device *pdev)
                 writel_relaxed(~0, &g->clr_falling);
                 writel_relaxed(~0, &g->clr_rising);
 
-                /* set up all irqs in this bank */
-                irq_set_chained_handler(bank_irq, gpio_irq_handler);
-
                 /*
                  * Each chip handles 32 gpios, and each irq bank consists of 16
                  * gpio irqs. Pass the irq bank's corresponding controller to
                  * the chained irq handler.
                  */
-                irq_set_handler_data(bank_irq, &chips[gpio / 32]);
+                irq_set_chained_handler_and_data(bank_irq, gpio_irq_handler,
+                                                 &chips[gpio / 32]);
 
                 binten |= BIT(bank);
         }
diff --git a/drivers/gpio/gpio-max732x.c b/drivers/gpio/gpio-max732x.c
index aed4ca9338bc..7d3c90e9da71 100644
--- a/drivers/gpio/gpio-max732x.c
+++ b/drivers/gpio/gpio-max732x.c
@@ -603,6 +603,7 @@ static int max732x_setup_gpio(struct max732x_chip *chip,
         gc->base = gpio_start;
         gc->ngpio = port;
         gc->label = chip->client->name;
+        gc->dev = &chip->client->dev;
         gc->owner = THIS_MODULE;
 
         return port;
diff --git a/drivers/gpio/gpio-omap.c b/drivers/gpio/gpio-omap.c
index b0c57d505be7..61a731ff9a07 100644
--- a/drivers/gpio/gpio-omap.c
+++ b/drivers/gpio/gpio-omap.c
@@ -500,8 +500,10 @@ static int omap_gpio_irq_type(struct irq_data *d, unsigned type)
 
         spin_lock_irqsave(&bank->lock, flags);
         retval = omap_set_gpio_triggering(bank, offset, type);
-        if (retval)
+        if (retval) {
+                spin_unlock_irqrestore(&bank->lock, flags);
                 goto error;
+        }
         omap_gpio_init_irq(bank, offset);
         if (!omap_gpio_is_input(bank, offset)) {
                 spin_unlock_irqrestore(&bank->lock, flags);
@@ -1185,6 +1187,7 @@ static int omap_gpio_probe(struct platform_device *pdev)
         bank->irq = res->start;
         bank->dev = dev;
         bank->chip.dev = dev;
+        bank->chip.owner = THIS_MODULE;
         bank->dbck_flag = pdata->dbck_flag;
         bank->stride = pdata->bank_stride;
         bank->width = pdata->bank_width;
diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c
index d233eb3b8132..50caeb1ee350 100644
--- a/drivers/gpio/gpio-pca953x.c
+++ b/drivers/gpio/gpio-pca953x.c
@@ -570,6 +570,10 @@ static int pca953x_irq_setup(struct pca953x_chip *chip,
                                 "could not connect irqchip to gpiochip\n");
                         return ret;
                 }
+
+                gpiochip_set_chained_irqchip(&chip->gpio_chip,
+                                             &pca953x_irq_chip,
+                                             client->irq, NULL);
         }
 
         return 0;
diff --git a/drivers/gpio/gpio-xilinx.c b/drivers/gpio/gpio-xilinx.c
index 77fe5d3cb105..d5284dfe01fe 100644
--- a/drivers/gpio/gpio-xilinx.c
+++ b/drivers/gpio/gpio-xilinx.c
@@ -220,9 +220,9 @@ static void xgpio_save_regs(struct of_mm_gpio_chip *mm_gc)
         if (!chip->gpio_width[1])
                 return;
 
-        xgpio_writereg(mm_gc->regs + XGPIO_DATA_OFFSET + XGPIO_TRI_OFFSET,
+        xgpio_writereg(mm_gc->regs + XGPIO_DATA_OFFSET + XGPIO_CHANNEL_OFFSET,
                        chip->gpio_state[1]);
-        xgpio_writereg(mm_gc->regs + XGPIO_TRI_OFFSET + XGPIO_TRI_OFFSET,
+        xgpio_writereg(mm_gc->regs + XGPIO_TRI_OFFSET + XGPIO_CHANNEL_OFFSET,
                        chip->gpio_dir[1]);
 }
 
diff --git a/drivers/gpio/gpio-zynq.c b/drivers/gpio/gpio-zynq.c
index 2e87c4b8da26..a78882389836 100644
--- a/drivers/gpio/gpio-zynq.c
+++ b/drivers/gpio/gpio-zynq.c
@@ -757,6 +757,7 @@ static int zynq_gpio_remove(struct platform_device *pdev)
         gpiochip_remove(&gpio->chip);
         clk_disable_unprepare(gpio->clk);
         device_set_wakeup_capable(&pdev->dev, 0);
+        pm_runtime_disable(&pdev->dev);
         return 0;
 }
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
index 01657830b470..e9fde72cf038 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
@@ -1614,6 +1614,9 @@ struct amdgpu_uvd {
 #define AMDGPU_MAX_VCE_HANDLES  16
 #define AMDGPU_VCE_FIRMWARE_OFFSET 256
 
+#define AMDGPU_VCE_HARVEST_VCE0 (1 << 0)
+#define AMDGPU_VCE_HARVEST_VCE1 (1 << 1)
+
 struct amdgpu_vce {
         struct amdgpu_bo        *vcpu_bo;
         uint64_t                gpu_addr;
@@ -1626,6 +1629,7 @@ struct amdgpu_vce {
         const struct firmware   *fw;    /* VCE firmware */
         struct amdgpu_ring      ring[AMDGPU_MAX_VCE_RINGS];
         struct amdgpu_irq_src   irq;
+        unsigned                harvest_config;
 };
 
 /*
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
index d63135bf29c0..1f040d85ac47 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
@@ -669,6 +669,7 @@ static int amdgpu_cs_ib_fill(struct amdgpu_device *adev,
 static int amdgpu_cs_dependencies(struct amdgpu_device *adev,
                                   struct amdgpu_cs_parser *p)
 {
+        struct amdgpu_fpriv *fpriv = p->filp->driver_priv;
         struct amdgpu_ib *ib;
         int i, j, r;
 
@@ -694,6 +695,7 @@ static int amdgpu_cs_dependencies(struct amdgpu_device *adev,
                 for (j = 0; j < num_deps; ++j) {
                         struct amdgpu_fence *fence;
                         struct amdgpu_ring *ring;
+                        struct amdgpu_ctx *ctx;
 
                         r = amdgpu_cs_get_ring(adev, deps[j].ip_type,
                                                deps[j].ip_instance,
@@ -701,14 +703,21 @@ static int amdgpu_cs_dependencies(struct amdgpu_device *adev,
                         if (r)
                                 return r;
 
+                        ctx = amdgpu_ctx_get(fpriv, deps[j].ctx_id);
+                        if (ctx == NULL)
+                                return -EINVAL;
+
                         r = amdgpu_fence_recreate(ring, p->filp,
                                                   deps[j].handle,
                                                   &fence);
-                        if (r)
+                        if (r) {
+                                amdgpu_ctx_put(ctx);
                                 return r;
+                        }
 
                         amdgpu_sync_fence(&ib->sync, fence);
                         amdgpu_fence_unref(&fence);
+                        amdgpu_ctx_put(ctx);
                 }
         }
 
@@ -808,12 +817,16 @@ int amdgpu_cs_wait_ioctl(struct drm_device *dev, void *data,
 
         r = amdgpu_cs_get_ring(adev, wait->in.ip_type, wait->in.ip_instance,
                                wait->in.ring, &ring);
-        if (r)
+        if (r) {
+                amdgpu_ctx_put(ctx);
                 return r;
+        }
 
         r = amdgpu_fence_recreate(ring, filp, wait->in.handle, &fence);
-        if (r)
+        if (r) {
+                amdgpu_ctx_put(ctx);
                 return r;
+        }
 
         r = fence_wait_timeout(&fence->base, true, timeout);
         amdgpu_fence_unref(&fence);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index ba46be361c9b..d79009b65867 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -1207,10 +1207,15 @@ static int amdgpu_early_init(struct amdgpu_device *adev)
                 } else {
                         if (adev->ip_blocks[i].funcs->early_init) {
                                 r = adev->ip_blocks[i].funcs->early_init((void *)adev);
-                                if (r)
+                                if (r == -ENOENT)
+                                        adev->ip_block_enabled[i] = false;
+                                else if (r)
                                         return r;
+                                else
+                                        adev->ip_block_enabled[i] = true;
+                        } else {
+                                adev->ip_block_enabled[i] = true;
                         }
-                        adev->ip_block_enabled[i] = true;
                 }
         }
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
index 975edb1000a2..ae43b58c9733 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
@@ -352,7 +352,7 @@ unsigned long amdgpu_gem_timeout(uint64_t timeout_ns)
         if (((int64_t)timeout_ns) < 0)
                 return MAX_SCHEDULE_TIMEOUT;
 
-        timeout = ktime_sub_ns(ktime_get(), timeout_ns);
+        timeout = ktime_sub(ns_to_ktime(timeout_ns), ktime_get());
         if (ktime_to_ns(timeout) < 0)
                 return 0;
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
index 5533434c7a8f..31ad444c6386 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
@@ -459,6 +459,7 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file
                 memcpy(&dev_info.cu_bitmap[0], &cu_info.bitmap[0], sizeof(cu_info.bitmap));
                 dev_info.vram_type = adev->mc.vram_type;
                 dev_info.vram_bit_width = adev->mc.vram_width;
+                dev_info.vce_harvest_config = adev->vce.harvest_config;
 
                 return copy_to_user(out, &dev_info,
                                     min((size_t)size, sizeof(dev_info))) ? -EFAULT : 0;
diff --git a/drivers/gpu/drm/amd/amdgpu/cz_dpm.c b/drivers/gpu/drm/amd/amdgpu/cz_dpm.c
index f75a31df30bd..ace870afc7d4 100644
--- a/drivers/gpu/drm/amd/amdgpu/cz_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/cz_dpm.c
@@ -494,29 +494,67 @@ static void cz_dpm_fini(struct amdgpu_device *adev)
         amdgpu_free_extended_power_table(adev);
 }
 
+#define ixSMUSVI_NB_CURRENTVID 0xD8230044
+#define CURRENT_NB_VID_MASK 0xff000000
+#define CURRENT_NB_VID__SHIFT 24
+#define ixSMUSVI_GFX_CURRENTVID  0xD8230048
+#define CURRENT_GFX_VID_MASK 0xff000000
+#define CURRENT_GFX_VID__SHIFT 24
+
 static void
 cz_dpm_debugfs_print_current_performance_level(struct amdgpu_device *adev,
                                                struct seq_file *m)
 {
+        struct cz_power_info *pi = cz_get_pi(adev);
         struct amdgpu_clock_voltage_dependency_table *table =
                 &adev->pm.dpm.dyn_state.vddc_dependency_on_sclk;
-        u32 current_index =
-                (RREG32_SMC(ixTARGET_AND_CURRENT_PROFILE_INDEX) &
-                TARGET_AND_CURRENT_PROFILE_INDEX__CURR_SCLK_INDEX_MASK) >>
-                TARGET_AND_CURRENT_PROFILE_INDEX__CURR_SCLK_INDEX__SHIFT;
-        u32 sclk, tmp;
-        u16 vddc;
-
-        if (current_index >= NUM_SCLK_LEVELS) {
-                seq_printf(m, "invalid dpm profile %d\n", current_index);
+        struct amdgpu_uvd_clock_voltage_dependency_table *uvd_table =
+                &adev->pm.dpm.dyn_state.uvd_clock_voltage_dependency_table;
+        struct amdgpu_vce_clock_voltage_dependency_table *vce_table =
+                &adev->pm.dpm.dyn_state.vce_clock_voltage_dependency_table;
+        u32 sclk_index = REG_GET_FIELD(RREG32_SMC(ixTARGET_AND_CURRENT_PROFILE_INDEX),
+                                       TARGET_AND_CURRENT_PROFILE_INDEX, CURR_SCLK_INDEX);
+        u32 uvd_index = REG_GET_FIELD(RREG32_SMC(ixTARGET_AND_CURRENT_PROFILE_INDEX_2),
+                                      TARGET_AND_CURRENT_PROFILE_INDEX_2, CURR_UVD_INDEX);
+        u32 vce_index = REG_GET_FIELD(RREG32_SMC(ixTARGET_AND_CURRENT_PROFILE_INDEX_2),
+                                      TARGET_AND_CURRENT_PROFILE_INDEX_2, CURR_VCE_INDEX);
+        u32 sclk, vclk, dclk, ecclk, tmp;
+        u16 vddnb, vddgfx;
+
+        if (sclk_index >= NUM_SCLK_LEVELS) {
+                seq_printf(m, "invalid sclk dpm profile %d\n", sclk_index);
         } else {
-                sclk = table->entries[current_index].clk;
-                tmp = (RREG32_SMC(ixSMU_VOLTAGE_STATUS) &
-                        SMU_VOLTAGE_STATUS__SMU_VOLTAGE_CURRENT_LEVEL_MASK) >>
-                        SMU_VOLTAGE_STATUS__SMU_VOLTAGE_CURRENT_LEVEL__SHIFT;
-                vddc = cz_convert_8bit_index_to_voltage(adev, (u16)tmp);
-                seq_printf(m, "power level %d    sclk: %u vddc: %u\n",
-                           current_index, sclk, vddc);
+                sclk = table->entries[sclk_index].clk;
+                seq_printf(m, "%u sclk: %u\n", sclk_index, sclk);
+        }
+
+        tmp = (RREG32_SMC(ixSMUSVI_NB_CURRENTVID) &
+               CURRENT_NB_VID_MASK) >> CURRENT_NB_VID__SHIFT;
+        vddnb = cz_convert_8bit_index_to_voltage(adev, (u16)tmp);
+        tmp = (RREG32_SMC(ixSMUSVI_GFX_CURRENTVID) &
+               CURRENT_GFX_VID_MASK) >> CURRENT_GFX_VID__SHIFT;
+        vddgfx = cz_convert_8bit_index_to_voltage(adev, (u16)tmp);
+        seq_printf(m, "vddnb: %u vddgfx: %u\n", vddnb, vddgfx);
+
+        seq_printf(m, "uvd    %sabled\n", pi->uvd_power_gated ? "dis" : "en");
+        if (!pi->uvd_power_gated) {
+                if (uvd_index >= CZ_MAX_HARDWARE_POWERLEVELS) {
+                        seq_printf(m, "invalid uvd dpm level %d\n", uvd_index);
+                } else {
+                        vclk = uvd_table->entries[uvd_index].vclk;
+                        dclk = uvd_table->entries[uvd_index].dclk;
+                        seq_printf(m, "%u uvd vclk: %u dclk: %u\n", uvd_index, vclk, dclk);
+                }
+        }
+
+        seq_printf(m, "vce    %sabled\n", pi->vce_power_gated ? "dis" : "en");
+        if (!pi->vce_power_gated) {
+                if (vce_index >= CZ_MAX_HARDWARE_POWERLEVELS) {
+                        seq_printf(m, "invalid vce dpm level %d\n", vce_index);
+                } else {
+                        ecclk = vce_table->entries[vce_index].ecclk;
+                        seq_printf(m, "%u vce ecclk: %u\n", vce_index, ecclk);
+                }
         }
 }
 
@@ -1679,25 +1717,31 @@ static int cz_dpm_unforce_dpm_levels(struct amdgpu_device *adev)
         if (ret)
                 return ret;
 
-        DRM_INFO("DPM unforce state min=%d, max=%d.\n",
-                        pi->sclk_dpm.soft_min_clk,
-                        pi->sclk_dpm.soft_max_clk);
+        DRM_DEBUG("DPM unforce state min=%d, max=%d.\n",
+                  pi->sclk_dpm.soft_min_clk,
+                  pi->sclk_dpm.soft_max_clk);
 
         return 0;
 }
 
 static int cz_dpm_force_dpm_level(struct amdgpu_device *adev,
-                                enum amdgpu_dpm_forced_level level)
+                                  enum amdgpu_dpm_forced_level level)
 {
         int ret = 0;
 
         switch (level) {
         case AMDGPU_DPM_FORCED_LEVEL_HIGH:
+                ret = cz_dpm_unforce_dpm_levels(adev);
+                if (ret)
+                        return ret;
                 ret = cz_dpm_force_highest(adev);
                 if (ret)
                         return ret;
                 break;
         case AMDGPU_DPM_FORCED_LEVEL_LOW:
+                ret = cz_dpm_unforce_dpm_levels(adev);
+                if (ret)
+                        return ret;
                 ret = cz_dpm_force_lowest(adev);
                 if (ret)
                         return ret;
@@ -1711,6 +1755,8 @@ static int cz_dpm_force_dpm_level(struct amdgpu_device *adev,
                 break;
         }
 
+        adev->pm.dpm.forced_level = level;
+
         return ret;
 }
 
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
index 5cde635978f9..e70a26f587a0 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
@@ -2632,6 +2632,7 @@ static void dce_v10_0_crtc_dpms(struct drm_crtc *crtc, int mode)
         struct drm_device *dev = crtc->dev;
         struct amdgpu_device *adev = dev->dev_private;
         struct amdgpu_crtc *amdgpu_crtc = to_amdgpu_crtc(crtc);
+        unsigned type;
 
         switch (mode) {
         case DRM_MODE_DPMS_ON:
@@ -2640,6 +2641,9 @@ static void dce_v10_0_crtc_dpms(struct drm_crtc *crtc, int mode)
                 dce_v10_0_vga_enable(crtc, true);
                 amdgpu_atombios_crtc_blank(crtc, ATOM_DISABLE);
                 dce_v10_0_vga_enable(crtc, false);
+                /* Make sure VBLANK interrupt is still enabled */
+                type = amdgpu_crtc_idx_to_irq_type(adev, amdgpu_crtc->crtc_id);
+                amdgpu_irq_update(adev, &adev->crtc_irq, type);
                 drm_vblank_post_modeset(dev, amdgpu_crtc->crtc_id);
                 dce_v10_0_crtc_load_lut(crtc);
                 break;
@@ -3403,19 +3407,25 @@ static int dce_v10_0_crtc_irq(struct amdgpu_device *adev,
 
         switch (entry->src_data) {
         case 0: /* vblank */
-                if (disp_int & interrupt_status_offsets[crtc].vblank) {
+                if (disp_int & interrupt_status_offsets[crtc].vblank)
                         dce_v10_0_crtc_vblank_int_ack(adev, crtc);
-                        if (amdgpu_irq_enabled(adev, source, irq_type)) {
-                                drm_handle_vblank(adev->ddev, crtc);
-                        }
-                        DRM_DEBUG("IH: D%d vblank\n", crtc + 1);
+                else
+                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                if (amdgpu_irq_enabled(adev, source, irq_type)) {
+                        drm_handle_vblank(adev->ddev, crtc);
                 }
+                DRM_DEBUG("IH: D%d vblank\n", crtc + 1);
+
                 break;
         case 1: /* vline */
-                if (disp_int & interrupt_status_offsets[crtc].vline) {
+                if (disp_int & interrupt_status_offsets[crtc].vline)
                         dce_v10_0_crtc_vline_int_ack(adev, crtc);
-                        DRM_DEBUG("IH: D%d vline\n", crtc + 1);
-                }
+                else
+                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                DRM_DEBUG("IH: D%d vline\n", crtc + 1);
+
                 break;
         default:
                 DRM_DEBUG("Unhandled interrupt: %d %d\n", entry->src_id, entry->src_data);
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
index 95efd98b202d..dcb402ee048a 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
@@ -2631,6 +2631,7 @@ static void dce_v11_0_crtc_dpms(struct drm_crtc *crtc, int mode)
         struct drm_device *dev = crtc->dev;
         struct amdgpu_device *adev = dev->dev_private;
         struct amdgpu_crtc *amdgpu_crtc = to_amdgpu_crtc(crtc);
+        unsigned type;
 
         switch (mode) {
         case DRM_MODE_DPMS_ON:
@@ -2639,6 +2640,9 @@ static void dce_v11_0_crtc_dpms(struct drm_crtc *crtc, int mode)
                 dce_v11_0_vga_enable(crtc, true);
                 amdgpu_atombios_crtc_blank(crtc, ATOM_DISABLE);
                 dce_v11_0_vga_enable(crtc, false);
+                /* Make sure VBLANK interrupt is still enabled */
+                type = amdgpu_crtc_idx_to_irq_type(adev, amdgpu_crtc->crtc_id);
+                amdgpu_irq_update(adev, &adev->crtc_irq, type);
                 drm_vblank_post_modeset(dev, amdgpu_crtc->crtc_id);
                 dce_v11_0_crtc_load_lut(crtc);
                 break;
@@ -3402,19 +3406,25 @@ static int dce_v11_0_crtc_irq(struct amdgpu_device *adev,
 
         switch (entry->src_data) {
         case 0: /* vblank */
-                if (disp_int & interrupt_status_offsets[crtc].vblank) {
+                if (disp_int & interrupt_status_offsets[crtc].vblank)
                         dce_v11_0_crtc_vblank_int_ack(adev, crtc);
-                        if (amdgpu_irq_enabled(adev, source, irq_type)) {
-                                drm_handle_vblank(adev->ddev, crtc);
-                        }
-                        DRM_DEBUG("IH: D%d vblank\n", crtc + 1);
+                else
+                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                if (amdgpu_irq_enabled(adev, source, irq_type)) {
+                        drm_handle_vblank(adev->ddev, crtc);
                 }
+                DRM_DEBUG("IH: D%d vblank\n", crtc + 1);
+
                 break;
         case 1: /* vline */
-                if (disp_int & interrupt_status_offsets[crtc].vline) {
+                if (disp_int & interrupt_status_offsets[crtc].vline)
                         dce_v11_0_crtc_vline_int_ack(adev, crtc);
-                        DRM_DEBUG("IH: D%d vline\n", crtc + 1);
-                }
+                else
+                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                DRM_DEBUG("IH: D%d vline\n", crtc + 1);
+
                 break;
         default:
                 DRM_DEBUG("Unhandled interrupt: %d %d\n", entry->src_id, entry->src_data);
diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
index aaca8d663f2c..cc050a329c49 100644
--- a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
@@ -2566,6 +2566,7 @@ static void dce_v8_0_crtc_dpms(struct drm_crtc *crtc, int mode)
         struct drm_device *dev = crtc->dev;
         struct amdgpu_device *adev = dev->dev_private;
         struct amdgpu_crtc *amdgpu_crtc = to_amdgpu_crtc(crtc);
+        unsigned type;
 
         switch (mode) {
         case DRM_MODE_DPMS_ON:
@@ -2574,6 +2575,9 @@ static void dce_v8_0_crtc_dpms(struct drm_crtc *crtc, int mode)
                 dce_v8_0_vga_enable(crtc, true);
                 amdgpu_atombios_crtc_blank(crtc, ATOM_DISABLE);
                 dce_v8_0_vga_enable(crtc, false);
+                /* Make sure VBLANK interrupt is still enabled */
+                type = amdgpu_crtc_idx_to_irq_type(adev, amdgpu_crtc->crtc_id);
+                amdgpu_irq_update(adev, &adev->crtc_irq, type);
                 drm_vblank_post_modeset(dev, amdgpu_crtc->crtc_id);
                 dce_v8_0_crtc_load_lut(crtc);
                 break;
@@ -3237,19 +3241,25 @@ static int dce_v8_0_crtc_irq(struct amdgpu_device *adev,
 
         switch (entry->src_data) {
         case 0: /* vblank */
-                if (disp_int & interrupt_status_offsets[crtc].vblank) {
+                if (disp_int & interrupt_status_offsets[crtc].vblank)
                         WREG32(mmLB_VBLANK_STATUS + crtc_offsets[crtc], LB_VBLANK_STATUS__VBLANK_ACK_MASK);
-                        if (amdgpu_irq_enabled(adev, source, irq_type)) {
-                                drm_handle_vblank(adev->ddev, crtc);
-                        }
-                        DRM_DEBUG("IH: D%d vblank\n", crtc + 1);
+                else
+                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                if (amdgpu_irq_enabled(adev, source, irq_type)) {
+                        drm_handle_vblank(adev->ddev, crtc);
                 }
+                DRM_DEBUG("IH: D%d vblank\n", crtc + 1);
+
                 break;
         case 1: /* vline */
-                if (disp_int & interrupt_status_offsets[crtc].vline) {
+                if (disp_int & interrupt_status_offsets[crtc].vline)
                         WREG32(mmLB_VLINE_STATUS + crtc_offsets[crtc], LB_VLINE_STATUS__VLINE_ACK_MASK);
-                        DRM_DEBUG("IH: D%d vline\n", crtc + 1);
-                }
+                else
+                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                DRM_DEBUG("IH: D%d vline\n", crtc + 1);
+
                 break;
         default:
                 DRM_DEBUG("Unhandled interrupt: %d %d\n", entry->src_id, entry->src_data);
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
index 7b683fb2173c..1c7c992dea37 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
@@ -1813,10 +1813,7 @@ static u32 gfx_v8_0_get_rb_disabled(struct amdgpu_device *adev,
         u32 data, mask;
 
         data = RREG32(mmCC_RB_BACKEND_DISABLE);
-        if (data & 1)
-                data &= CC_RB_BACKEND_DISABLE__BACKEND_DISABLE_MASK;
-        else
-                data = 0;
+        data &= CC_RB_BACKEND_DISABLE__BACKEND_DISABLE_MASK;
 
         data |= RREG32(mmGC_USER_RB_BACKEND_DISABLE);
 
diff --git a/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c b/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
index d62c4002e39c..d1064ca3670e 100644
--- a/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
@@ -35,6 +35,8 @@
 #include "oss/oss_2_0_d.h"
 #include "oss/oss_2_0_sh_mask.h"
 #include "gca/gfx_8_0_d.h"
+#include "smu/smu_7_1_2_d.h"
+#include "smu/smu_7_1_2_sh_mask.h"
 
 #define GRBM_GFX_INDEX__VCE_INSTANCE__SHIFT     0x04
 #define GRBM_GFX_INDEX__VCE_INSTANCE_MASK       0x10
@@ -112,6 +114,10 @@ static int vce_v3_0_start(struct amdgpu_device *adev)
 
         mutex_lock(&adev->grbm_idx_mutex);
         for (idx = 0; idx < 2; ++idx) {
+
+                if (adev->vce.harvest_config & (1 << idx))
+                        continue;
+
                 if(idx == 0)
                         WREG32_P(mmGRBM_GFX_INDEX, 0,
                                 ~GRBM_GFX_INDEX__VCE_INSTANCE_MASK);
@@ -190,10 +196,52 @@ static int vce_v3_0_start(struct amdgpu_device *adev)
         return 0;
 }
 
+#define ixVCE_HARVEST_FUSE_MACRO__ADDRESS     0xC0014074
+#define VCE_HARVEST_FUSE_MACRO__SHIFT       27
+#define VCE_HARVEST_FUSE_MACRO__MASK        0x18000000
+
+static unsigned vce_v3_0_get_harvest_config(struct amdgpu_device *adev)
+{
+        u32 tmp;
+        unsigned ret;
+
+        if (adev->flags & AMDGPU_IS_APU)
+                tmp = (RREG32_SMC(ixVCE_HARVEST_FUSE_MACRO__ADDRESS) &
+                       VCE_HARVEST_FUSE_MACRO__MASK) >>
+                        VCE_HARVEST_FUSE_MACRO__SHIFT;
+        else
+                tmp = (RREG32_SMC(ixCC_HARVEST_FUSES) &
+                       CC_HARVEST_FUSES__VCE_DISABLE_MASK) >>
+                        CC_HARVEST_FUSES__VCE_DISABLE__SHIFT;
+
+        switch (tmp) {
+        case 1:
+                ret = AMDGPU_VCE_HARVEST_VCE0;
+                break;
+        case 2:
+                ret = AMDGPU_VCE_HARVEST_VCE1;
+                break;
+        case 3:
+                ret = AMDGPU_VCE_HARVEST_VCE0 | AMDGPU_VCE_HARVEST_VCE1;
+                break;
+        default:
+                ret = 0;
+        }
+
+        return ret;
+}
+
 static int vce_v3_0_early_init(void *handle)
 {
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
+        adev->vce.harvest_config = vce_v3_0_get_harvest_config(adev);
+
+        if ((adev->vce.harvest_config &
+             (AMDGPU_VCE_HARVEST_VCE0 | AMDGPU_VCE_HARVEST_VCE1)) ==
+            (AMDGPU_VCE_HARVEST_VCE0 | AMDGPU_VCE_HARVEST_VCE1))
+                return -ENOENT;
+
         vce_v3_0_set_ring_funcs(adev);
         vce_v3_0_set_irq_funcs(adev);
 
diff --git a/drivers/gpu/drm/amd/amdgpu/vi.c b/drivers/gpu/drm/amd/amdgpu/vi.c
index fa5a4448531d..68552da40287 100644
--- a/drivers/gpu/drm/amd/amdgpu/vi.c
+++ b/drivers/gpu/drm/amd/amdgpu/vi.c
@@ -122,6 +122,32 @@ static void vi_smc_wreg(struct amdgpu_device *adev, u32 reg, u32 v)
         spin_unlock_irqrestore(&adev->smc_idx_lock, flags);
 }
 
+/* smu_8_0_d.h */
+#define mmMP0PUB_IND_INDEX                                                      0x180
+#define mmMP0PUB_IND_DATA                                                       0x181
+
+static u32 cz_smc_rreg(struct amdgpu_device *adev, u32 reg)
+{
+        unsigned long flags;
+        u32 r;
+
+        spin_lock_irqsave(&adev->smc_idx_lock, flags);
+        WREG32(mmMP0PUB_IND_INDEX, (reg));
+        r = RREG32(mmMP0PUB_IND_DATA);
+        spin_unlock_irqrestore(&adev->smc_idx_lock, flags);
+        return r;
+}
+
+static void cz_smc_wreg(struct amdgpu_device *adev, u32 reg, u32 v)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&adev->smc_idx_lock, flags);
+        WREG32(mmMP0PUB_IND_INDEX, (reg));
+        WREG32(mmMP0PUB_IND_DATA, (v));
+        spin_unlock_irqrestore(&adev->smc_idx_lock, flags);
+}
+
 static u32 vi_uvd_ctx_rreg(struct amdgpu_device *adev, u32 reg)
 {
         unsigned long flags;
@@ -1222,8 +1248,13 @@ static int vi_common_early_init(void *handle)
         bool smc_enabled = false;
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
-        adev->smc_rreg = &vi_smc_rreg;
-        adev->smc_wreg = &vi_smc_wreg;
+        if (adev->flags & AMDGPU_IS_APU) {
+                adev->smc_rreg = &cz_smc_rreg;
+                adev->smc_wreg = &cz_smc_wreg;
+        } else {
+                adev->smc_rreg = &vi_smc_rreg;
+                adev->smc_wreg = &vi_smc_wreg;
+        }
         adev->pcie_rreg = &vi_pcie_rreg;
         adev->pcie_wreg = &vi_pcie_wreg;
         adev->uvd_ctx_rreg = &vi_uvd_ctx_rreg;
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process.c b/drivers/gpu/drm/amd/amdkfd/kfd_process.c
index 8a1f999daa24..9be007081b72 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_process.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_process.c
@@ -420,6 +420,12 @@ void kfd_unbind_process_from_device(struct kfd_dev *dev, unsigned int pasid)
         pqm_uninit(&p->pqm);
 
         pdd = kfd_get_process_device_data(dev, p);
+
+        if (!pdd) {
+                mutex_unlock(&p->mutex);
+                return;
+        }
+
         if (pdd->reset_wavefronts) {
                 dbgdev_wave_reset_wavefronts(pdd->dev, p);
                 pdd->reset_wavefronts = false;
@@ -431,8 +437,7 @@ void kfd_unbind_process_from_device(struct kfd_dev *dev, unsigned int pasid)
          * We don't call amd_iommu_unbind_pasid() here
          * because the IOMMU called us.
          */
-        if (pdd)
-                pdd->bound = false;
+        pdd->bound = false;
 
         mutex_unlock(&p->mutex);
 }
diff --git a/drivers/gpu/drm/armada/armada_crtc.c b/drivers/gpu/drm/armada/armada_crtc.c
index 42d2ffa08716..01ffe9bffe38 100644
--- a/drivers/gpu/drm/armada/armada_crtc.c
+++ b/drivers/gpu/drm/armada/armada_crtc.c
@@ -531,8 +531,6 @@ static int armada_drm_crtc_mode_set(struct drm_crtc *crtc,
 
         drm_crtc_vblank_off(crtc);
 
-        crtc->mode = *adj;
-
         val = dcrtc->dumb_ctrl & ~CFG_DUMB_ENA;
         if (val != dcrtc->dumb_ctrl) {
                 dcrtc->dumb_ctrl = val;
diff --git a/drivers/gpu/drm/armada/armada_gem.c b/drivers/gpu/drm/armada/armada_gem.c
index 580e10acaa3a..60a688ef81c7 100644
--- a/drivers/gpu/drm/armada/armada_gem.c
+++ b/drivers/gpu/drm/armada/armada_gem.c
@@ -69,8 +69,9 @@ void armada_gem_free_object(struct drm_gem_object *obj)
 
         if (dobj->obj.import_attach) {
                 /* We only ever display imported data */
-                dma_buf_unmap_attachment(dobj->obj.import_attach, dobj->sgt,
-                                         DMA_TO_DEVICE);
+                if (dobj->sgt)
+                        dma_buf_unmap_attachment(dobj->obj.import_attach,
+                                                 dobj->sgt, DMA_TO_DEVICE);
                 drm_prime_gem_destroy(&dobj->obj, NULL);
         }
 
diff --git a/drivers/gpu/drm/armada/armada_overlay.c b/drivers/gpu/drm/armada/armada_overlay.c
index c5b06fdb459c..e939faba7fcc 100644
--- a/drivers/gpu/drm/armada/armada_overlay.c
+++ b/drivers/gpu/drm/armada/armada_overlay.c
@@ -7,6 +7,7 @@
  * published by the Free Software Foundation.
  */
 #include <drm/drmP.h>
+#include <drm/drm_plane_helper.h>
 #include "armada_crtc.h"
 #include "armada_drm.h"
 #include "armada_fb.h"
@@ -85,16 +86,8 @@ static void armada_plane_vbl(struct armada_crtc *dcrtc, void *data)
 
         if (fb)
                 armada_drm_queue_unref_work(dcrtc->crtc.dev, fb);
-}
 
-static unsigned armada_limit(int start, unsigned size, unsigned max)
-{
-        int end = start + size;
-        if (end < 0)
-                return 0;
-        if (start < 0)
-                start = 0;
-        return (unsigned)end > max ? max - start : end - start;
+        wake_up(&dplane->vbl.wait);
 }
 
 static int
@@ -105,26 +98,39 @@ armada_plane_update(struct drm_plane *plane, struct drm_crtc *crtc,
 {
         struct armada_plane *dplane = drm_to_armada_plane(plane);
         struct armada_crtc *dcrtc = drm_to_armada_crtc(crtc);
+        struct drm_rect src = {
+                .x1 = src_x,
+                .y1 = src_y,
+                .x2 = src_x + src_w,
+                .y2 = src_y + src_h,
+        };
+        struct drm_rect dest = {
+                .x1 = crtc_x,
+                .y1 = crtc_y,
+                .x2 = crtc_x + crtc_w,
+                .y2 = crtc_y + crtc_h,
+        };
+        const struct drm_rect clip = {
+                .x2 = crtc->mode.hdisplay,
+                .y2 = crtc->mode.vdisplay,
+        };
         uint32_t val, ctrl0;
         unsigned idx = 0;
+        bool visible;
         int ret;
 
-        crtc_w = armada_limit(crtc_x, crtc_w, dcrtc->crtc.mode.hdisplay);
-        crtc_h = armada_limit(crtc_y, crtc_h, dcrtc->crtc.mode.vdisplay);
+        ret = drm_plane_helper_check_update(plane, crtc, fb, &src, &dest, &clip,
+                                            0, INT_MAX, true, false, &visible);
+        if (ret)
+                return ret;
+
         ctrl0 = CFG_DMA_FMT(drm_fb_to_armada_fb(fb)->fmt) |
                 CFG_DMA_MOD(drm_fb_to_armada_fb(fb)->mod) |
                 CFG_CBSH_ENA | CFG_DMA_HSMOOTH | CFG_DMA_ENA;
 
         /* Does the position/size result in nothing to display? */
-        if (crtc_w == 0 || crtc_h == 0) {
+        if (!visible)
                 ctrl0 &= ~CFG_DMA_ENA;
-        }
-
-        /*
-         * FIXME: if the starting point is off screen, we need to
-         * adjust src_x, src_y, src_w, src_h appropriately, and
-         * according to the scale.
-         */
 
         if (!dcrtc->plane) {
                 dcrtc->plane = plane;
@@ -134,15 +140,19 @@ armada_plane_update(struct drm_plane *plane, struct drm_crtc *crtc,
         /* FIXME: overlay on an interlaced display */
         /* Just updating the position/size? */
         if (plane->fb == fb && dplane->ctrl0 == ctrl0) {
-                val = (src_h & 0xffff0000) | src_w >> 16;
+                val = (drm_rect_height(&src) & 0xffff0000) |
+                      drm_rect_width(&src) >> 16;
                 dplane->src_hw = val;
                 writel_relaxed(val, dcrtc->base + LCD_SPU_DMA_HPXL_VLN);
-                val = crtc_h << 16 | crtc_w;
+
+                val = drm_rect_height(&dest) << 16 | drm_rect_width(&dest);
                 dplane->dst_hw = val;
                 writel_relaxed(val, dcrtc->base + LCD_SPU_DZM_HPXL_VLN);
-                val = crtc_y << 16 | crtc_x;
+
+                val = dest.y1 << 16 | dest.x1;
                 dplane->dst_yx = val;
                 writel_relaxed(val, dcrtc->base + LCD_SPU_DMA_OVSA_HPXL_VLN);
+
                 return 0;
         } else if (~dplane->ctrl0 & ctrl0 & CFG_DMA_ENA) {
                 /* Power up the Y/U/V FIFOs on ENA 0->1 transitions */
@@ -150,15 +160,14 @@ armada_plane_update(struct drm_plane *plane, struct drm_crtc *crtc,
                                dcrtc->base + LCD_SPU_SRAM_PARA1);
         }
 
-        ret = wait_event_timeout(dplane->vbl.wait,
-                                 list_empty(&dplane->vbl.update.node),
-                                 HZ/25);
-        if (ret < 0)
-                return ret;
+        wait_event_timeout(dplane->vbl.wait,
+                           list_empty(&dplane->vbl.update.node),
+                           HZ/25);
 
         if (plane->fb != fb) {
                 struct armada_gem_object *obj = drm_fb_obj(fb);
-                uint32_t sy, su, sv;
+                uint32_t addr[3], pixel_format;
+                int i, num_planes, hsub;
 
                 /*
                  * Take a reference on the new framebuffer - we want to
@@ -178,26 +187,39 @@ armada_plane_update(struct drm_plane *plane, struct drm_crtc *crtc,
                                                             older_fb);
                 }
 
-                src_y >>= 16;
-                src_x >>= 16;
-                sy = obj->dev_addr + fb->offsets[0] + src_y * fb->pitches[0] +
-                        src_x * fb->bits_per_pixel / 8;
-                su = obj->dev_addr + fb->offsets[1] + src_y * fb->pitches[1] +
-                        src_x;
-                sv = obj->dev_addr + fb->offsets[2] + src_y * fb->pitches[2] +
-                        src_x;
+                src_y = src.y1 >> 16;
+                src_x = src.x1 >> 16;
 
-                armada_reg_queue_set(dplane->vbl.regs, idx, sy,
+                pixel_format = fb->pixel_format;
+                hsub = drm_format_horz_chroma_subsampling(pixel_format);
+                num_planes = drm_format_num_planes(pixel_format);
+
+                /*
+                 * Annoyingly, shifting a YUYV-format image by one pixel
+                 * causes the U/V planes to toggle.  Toggle the UV swap.
+                 * (Unfortunately, this causes momentary colour flickering.)
+                 */
+                if (src_x & (hsub - 1) && num_planes == 1)
+                        ctrl0 ^= CFG_DMA_MOD(CFG_SWAPUV);
+
+                for (i = 0; i < num_planes; i++)
+                        addr[i] = obj->dev_addr + fb->offsets[i] +
+                                  src_y * fb->pitches[i] +
+                                  src_x * drm_format_plane_cpp(pixel_format, i);
+                for (; i < ARRAY_SIZE(addr); i++)
+                        addr[i] = 0;
+
+                armada_reg_queue_set(dplane->vbl.regs, idx, addr[0],
                                      LCD_SPU_DMA_START_ADDR_Y0);
-                armada_reg_queue_set(dplane->vbl.regs, idx, su,
+                armada_reg_queue_set(dplane->vbl.regs, idx, addr[1],
                                      LCD_SPU_DMA_START_ADDR_U0);
-                armada_reg_queue_set(dplane->vbl.regs, idx, sv,
+                armada_reg_queue_set(dplane->vbl.regs, idx, addr[2],
                                      LCD_SPU_DMA_START_ADDR_V0);
-                armada_reg_queue_set(dplane->vbl.regs, idx, sy,
+                armada_reg_queue_set(dplane->vbl.regs, idx, addr[0],
                                      LCD_SPU_DMA_START_ADDR_Y1);
-                armada_reg_queue_set(dplane->vbl.regs, idx, su,
+                armada_reg_queue_set(dplane->vbl.regs, idx, addr[1],
                                      LCD_SPU_DMA_START_ADDR_U1);
-                armada_reg_queue_set(dplane->vbl.regs, idx, sv,
+                armada_reg_queue_set(dplane->vbl.regs, idx, addr[2],
                                      LCD_SPU_DMA_START_ADDR_V1);
 
                 val = fb->pitches[0] << 16 | fb->pitches[0];
@@ -208,24 +230,27 @@ armada_plane_update(struct drm_plane *plane, struct drm_crtc *crtc,
                                      LCD_SPU_DMA_PITCH_UV);
         }
 
-        val = (src_h & 0xffff0000) | src_w >> 16;
+        val = (drm_rect_height(&src) & 0xffff0000) | drm_rect_width(&src) >> 16;
         if (dplane->src_hw != val) {
                 dplane->src_hw = val;
                 armada_reg_queue_set(dplane->vbl.regs, idx, val,
                                      LCD_SPU_DMA_HPXL_VLN);
         }
-        val = crtc_h << 16 | crtc_w;
+
+        val = drm_rect_height(&dest) << 16 | drm_rect_width(&dest);
         if (dplane->dst_hw != val) {
                 dplane->dst_hw = val;
                 armada_reg_queue_set(dplane->vbl.regs, idx, val,
                                      LCD_SPU_DZM_HPXL_VLN);
         }
-        val = crtc_y << 16 | crtc_x;
+
+        val = dest.y1 << 16 | dest.x1;
         if (dplane->dst_yx != val) {
                 dplane->dst_yx = val;
                 armada_reg_queue_set(dplane->vbl.regs, idx, val,
                                      LCD_SPU_DMA_OVSA_HPXL_VLN);
         }
+
         if (dplane->ctrl0 != ctrl0) {
                 dplane->ctrl0 = ctrl0;
                 armada_reg_queue_mod(dplane->vbl.regs, idx, ctrl0,
@@ -279,7 +304,11 @@ static int armada_plane_disable(struct drm_plane *plane)
 
 static void armada_plane_destroy(struct drm_plane *plane)
 {
-        kfree(plane);
+        struct armada_plane *dplane = drm_to_armada_plane(plane);
+
+        drm_plane_cleanup(plane);
+
+        kfree(dplane);
 }
 
 static int armada_plane_set_property(struct drm_plane *plane,
diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c
index f69b92535505..5ae5c6923128 100644
--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c
+++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c
@@ -355,6 +355,7 @@ int atmel_hlcdc_crtc_create(struct drm_device *dev)
                 planes->overlays[i]->base.possible_crtcs = 1 << crtc->id;
 
         drm_crtc_helper_add(&crtc->base, &lcdc_crtc_helper_funcs);
+        drm_crtc_vblank_reset(&crtc->base);
 
         dc->crtc = &crtc->base;
 
diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_dc.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_dc.c
index 60b0c13d7ff5..6fad1f9648f3 100644
--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_dc.c
+++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_dc.c
@@ -313,20 +313,20 @@ static int atmel_hlcdc_dc_load(struct drm_device *dev)
 
         pm_runtime_enable(dev->dev);
 
-        ret = atmel_hlcdc_dc_modeset_init(dev);
+        ret = drm_vblank_init(dev, 1);
         if (ret < 0) {
-                dev_err(dev->dev, "failed to initialize mode setting\n");
+                dev_err(dev->dev, "failed to initialize vblank\n");
                 goto err_periph_clk_disable;
         }
 
-        drm_mode_config_reset(dev);
-
-        ret = drm_vblank_init(dev, 1);
+        ret = atmel_hlcdc_dc_modeset_init(dev);
         if (ret < 0) {
-                dev_err(dev->dev, "failed to initialize vblank\n");
+                dev_err(dev->dev, "failed to initialize mode setting\n");
                 goto err_periph_clk_disable;
         }
 
+        drm_mode_config_reset(dev);
+
         pm_runtime_get_sync(dev->dev);
         ret = drm_irq_install(dev, dc->hlcdc->irq);
         pm_runtime_put_sync(dev->dev);
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index b9ba06176eb1..fed748311b92 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -2706,8 +2706,11 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
         if (!drm_core_check_feature(dev, DRIVER_MODESET))
                 return -EINVAL;
 
-        /* For some reason crtc x/y offsets are signed internally. */
-        if (crtc_req->x > INT_MAX || crtc_req->y > INT_MAX)
+        /*
+         * Universal plane src offsets are only 16.16, prevent havoc for
+         * drivers using universal plane code internally.
+         */
+        if (crtc_req->x & 0xffff0000 || crtc_req->y & 0xffff0000)
                 return -ERANGE;
 
         drm_modeset_lock_all(dev);
@@ -5395,12 +5398,9 @@ void drm_mode_config_reset(struct drm_device *dev)
                 if (encoder->funcs->reset)
                         encoder->funcs->reset(encoder);
 
-        list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
-                connector->status = connector_status_unknown;
-
+        list_for_each_entry(connector, &dev->mode_config.connector_list, head)
                 if (connector->funcs->reset)
                         connector->funcs->reset(connector);
-        }
 }
 EXPORT_SYMBOL(drm_mode_config_reset);
 
diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
index aa8bbb460c57..9cfcd0aef0df 100644
--- a/drivers/gpu/drm/drm_ioc32.c
+++ b/drivers/gpu/drm/drm_ioc32.c
@@ -70,6 +70,8 @@
 
 #define DRM_IOCTL_WAIT_VBLANK32         DRM_IOWR(0x3a, drm_wait_vblank32_t)
 
+#define DRM_IOCTL_MODE_ADDFB232         DRM_IOWR(0xb8, drm_mode_fb_cmd232_t)
+
 typedef struct drm_version_32 {
         int version_major;        /**< Major version */
         int version_minor;        /**< Minor version */
@@ -1016,6 +1018,63 @@ static int compat_drm_wait_vblank(struct file *file, unsigned int cmd,
         return 0;
 }
 
+typedef struct drm_mode_fb_cmd232 {
+        u32 fb_id;
+        u32 width;
+        u32 height;
+        u32 pixel_format;
+        u32 flags;
+        u32 handles[4];
+        u32 pitches[4];
+        u32 offsets[4];
+        u64 modifier[4];
+} __attribute__((packed)) drm_mode_fb_cmd232_t;
+
+static int compat_drm_mode_addfb2(struct file *file, unsigned int cmd,
+                                  unsigned long arg)
+{
+        struct drm_mode_fb_cmd232 __user *argp = (void __user *)arg;
+        struct drm_mode_fb_cmd232 req32;
+        struct drm_mode_fb_cmd2 __user *req64;
+        int i;
+        int err;
+
+        if (copy_from_user(&req32, argp, sizeof(req32)))
+                return -EFAULT;
+
+        req64 = compat_alloc_user_space(sizeof(*req64));
+
+        if (!access_ok(VERIFY_WRITE, req64, sizeof(*req64))
+            || __put_user(req32.width, &req64->width)
+            || __put_user(req32.height, &req64->height)
+            || __put_user(req32.pixel_format, &req64->pixel_format)
+            || __put_user(req32.flags, &req64->flags))
+                return -EFAULT;
+
+        for (i = 0; i < 4; i++) {
+                if (__put_user(req32.handles[i], &req64->handles[i]))
+                        return -EFAULT;
+                if (__put_user(req32.pitches[i], &req64->pitches[i]))
+                        return -EFAULT;
+                if (__put_user(req32.offsets[i], &req64->offsets[i]))
+                        return -EFAULT;
+                if (__put_user(req32.modifier[i], &req64->modifier[i]))
+                        return -EFAULT;
+        }
+
+        err = drm_ioctl(file, DRM_IOCTL_MODE_ADDFB2, (unsigned long)req64);
+        if (err)
+                return err;
+
+        if (__get_user(req32.fb_id, &req64->fb_id))
+                return -EFAULT;
+
+        if (copy_to_user(argp, &req32, sizeof(req32)))
+                return -EFAULT;
+
+        return 0;
+}
+
 static drm_ioctl_compat_t *drm_compat_ioctls[] = {
         [DRM_IOCTL_NR(DRM_IOCTL_VERSION32)] = compat_drm_version,
         [DRM_IOCTL_NR(DRM_IOCTL_GET_UNIQUE32)] = compat_drm_getunique,
@@ -1048,6 +1107,7 @@ static drm_ioctl_compat_t *drm_compat_ioctls[] = {
         [DRM_IOCTL_NR(DRM_IOCTL_UPDATE_DRAW32)] = compat_drm_update_draw,
 #endif
         [DRM_IOCTL_NR(DRM_IOCTL_WAIT_VBLANK32)] = compat_drm_wait_vblank,
+        [DRM_IOCTL_NR(DRM_IOCTL_MODE_ADDFB232)] = compat_drm_mode_addfb2,
 };
 
 /**
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 542fac628b28..5f27290201e0 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -826,6 +826,7 @@ struct intel_context {
         struct kref ref;
         int user_handle;
         uint8_t remap_slice;
+        struct drm_i915_private *i915;
         struct drm_i915_file_private *file_priv;
         struct i915_ctx_hang_stats hang_stats;
         struct i915_hw_ppgtt *ppgtt;
@@ -2036,8 +2037,6 @@ struct drm_i915_gem_object {
         unsigned int cache_level:3;
         unsigned int cache_dirty:1;
 
-        unsigned int has_dma_mapping:1;
-
         unsigned int frontbuffer_bits:INTEL_FRONTBUFFER_BITS;
 
         unsigned int pin_display;
@@ -3116,7 +3115,8 @@ void i915_debugfs_cleanup(struct drm_minor *minor);
 int i915_debugfs_connector_add(struct drm_connector *connector);
 void intel_display_crc_init(struct drm_device *dev);
 #else
-static inline int i915_debugfs_connector_add(struct drm_connector *connector) {}
+static inline int i915_debugfs_connector_add(struct drm_connector *connector)
+{ return 0; }
 static inline void intel_display_crc_init(struct drm_device *dev) {}
 #endif
 
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 248fd1ac7b3a..52b446b27b4d 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -213,7 +213,6 @@ i915_gem_object_get_pages_phys(struct drm_i915_gem_object *obj)
         sg_dma_len(sg) = obj->base.size;
 
         obj->pages = st;
-        obj->has_dma_mapping = true;
         return 0;
 }
 
@@ -265,8 +264,6 @@ i915_gem_object_put_pages_phys(struct drm_i915_gem_object *obj)
 
         sg_free_table(obj->pages);
         kfree(obj->pages);
-
-        obj->has_dma_mapping = false;
 }
 
 static void
@@ -2139,6 +2136,8 @@ i915_gem_object_put_pages_gtt(struct drm_i915_gem_object *obj)
                 obj->base.read_domains = obj->base.write_domain = I915_GEM_DOMAIN_CPU;
         }
 
+        i915_gem_gtt_finish_object(obj);
+
         if (i915_gem_object_needs_bit17_swizzle(obj))
                 i915_gem_object_save_bit_17_swizzle(obj);
 
@@ -2199,6 +2198,7 @@ i915_gem_object_get_pages_gtt(struct drm_i915_gem_object *obj)
         struct sg_page_iter sg_iter;
         struct page *page;
         unsigned long last_pfn = 0;     /* suppress gcc warning */
+        int ret;
         gfp_t gfp;
 
         /* Assert that the object is not currently in any GPU domain. As it
@@ -2246,8 +2246,10 @@ i915_gem_object_get_pages_gtt(struct drm_i915_gem_object *obj)
                          */
                         i915_gem_shrink_all(dev_priv);
                         page = shmem_read_mapping_page(mapping, i);
-                        if (IS_ERR(page))
+                        if (IS_ERR(page)) {
+                                ret = PTR_ERR(page);
                                 goto err_pages;
+                        }
                 }
 #ifdef CONFIG_SWIOTLB
                 if (swiotlb_nr_tbl()) {
@@ -2276,6 +2278,10 @@ i915_gem_object_get_pages_gtt(struct drm_i915_gem_object *obj)
                 sg_mark_end(sg);
         obj->pages = st;
 
+        ret = i915_gem_gtt_prepare_object(obj);
+        if (ret)
+                goto err_pages;
+
         if (i915_gem_object_needs_bit17_swizzle(obj))
                 i915_gem_object_do_bit_17_swizzle(obj);
 
@@ -2300,10 +2306,10 @@ err_pages:
          * space and so want to translate the error from shmemfs back to our
          * usual understanding of ENOMEM.
          */
-        if (PTR_ERR(page) == -ENOSPC)
-                return -ENOMEM;
-        else
-                return PTR_ERR(page);
+        if (ret == -ENOSPC)
+                ret = -ENOMEM;
+
+        return ret;
 }
 
 /* Ensure that the associated pages are gathered from the backing storage
@@ -2542,6 +2548,7 @@ int __i915_add_request(struct intel_engine_cs *ring,
         }
 
         request->emitted_jiffies = jiffies;
+        ring->last_submitted_seqno = request->seqno;
         list_add_tail(&request->list, &ring->request_list);
         request->file_priv = NULL;
 
@@ -3247,10 +3254,8 @@ int i915_vma_unbind(struct i915_vma *vma)
 
         /* Since the unbound list is global, only move to that list if
          * no more VMAs exist. */
-        if (list_empty(&obj->vma_list)) {
-                i915_gem_gtt_finish_object(obj);
+        if (list_empty(&obj->vma_list))
                 list_move_tail(&obj->global_list, &dev_priv->mm.unbound_list);
-        }
 
         /* And finally now the object is completely decoupled from this vma,
          * we can drop its hold on the backing storage and allow it to be
@@ -3768,22 +3773,16 @@ search_free:
                 goto err_remove_node;
         }
 
-        ret = i915_gem_gtt_prepare_object(obj);
-        if (ret)
-                goto err_remove_node;
-
         trace_i915_vma_bind(vma, flags);
         ret = i915_vma_bind(vma, obj->cache_level, flags);
         if (ret)
-                goto err_finish_gtt;
+                goto err_remove_node;
 
         list_move_tail(&obj->global_list, &dev_priv->mm.bound_list);
         list_add_tail(&vma->mm_list, &vm->inactive_list);
 
         return vma;
 
-err_finish_gtt:
-        i915_gem_gtt_finish_object(obj);
 err_remove_node:
         drm_mm_remove_node(&vma->node);
 err_free_vma:
diff --git a/drivers/gpu/drm/i915/i915_gem_context.c b/drivers/gpu/drm/i915/i915_gem_context.c
index 8867818b1401..48afa777e94a 100644
--- a/drivers/gpu/drm/i915/i915_gem_context.c
+++ b/drivers/gpu/drm/i915/i915_gem_context.c
@@ -135,8 +135,7 @@ static int get_context_size(struct drm_device *dev)
 
 void i915_gem_context_free(struct kref *ctx_ref)
 {
-        struct intel_context *ctx = container_of(ctx_ref,
-                                                 typeof(*ctx), ref);
+        struct intel_context *ctx = container_of(ctx_ref, typeof(*ctx), ref);
 
         trace_i915_context_free(ctx);
 
@@ -157,9 +156,7 @@ i915_gem_alloc_context_obj(struct drm_device *dev, size_t size)
         struct drm_i915_gem_object *obj;
         int ret;
 
-        obj = i915_gem_object_create_stolen(dev, size);
-        if (obj == NULL)
-                obj = i915_gem_alloc_object(dev, size);
+        obj = i915_gem_alloc_object(dev, size);
         if (obj == NULL)
                 return ERR_PTR(-ENOMEM);
 
@@ -197,6 +194,7 @@ __create_hw_context(struct drm_device *dev,
 
         kref_init(&ctx->ref);
         list_add_tail(&ctx->link, &dev_priv->context_list);
+        ctx->i915 = dev_priv;
 
         if (dev_priv->hw_context_size) {
                 struct drm_i915_gem_object *obj =
diff --git a/drivers/gpu/drm/i915/i915_gem_dmabuf.c b/drivers/gpu/drm/i915/i915_gem_dmabuf.c
index 7998da27c500..e9c2bfd85b52 100644
--- a/drivers/gpu/drm/i915/i915_gem_dmabuf.c
+++ b/drivers/gpu/drm/i915/i915_gem_dmabuf.c
@@ -256,7 +256,6 @@ static int i915_gem_object_get_pages_dmabuf(struct drm_i915_gem_object *obj)
                 return PTR_ERR(sg);
 
         obj->pages = sg;
-        obj->has_dma_mapping = true;
         return 0;
 }
 
@@ -264,7 +263,6 @@ static void i915_gem_object_put_pages_dmabuf(struct drm_i915_gem_object *obj)
 {
         dma_buf_unmap_attachment(obj->base.import_attach,
                                  obj->pages, DMA_BIDIRECTIONAL);
-        obj->has_dma_mapping = false;
 }
 
 static const struct drm_i915_gem_object_ops i915_gem_object_dmabuf_ops = {
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index 9daa2883ac18..56b52a4767d4 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -1723,9 +1723,6 @@ void i915_gem_suspend_gtt_mappings(struct drm_device *dev)
 
 int i915_gem_gtt_prepare_object(struct drm_i915_gem_object *obj)
 {
-        if (obj->has_dma_mapping)
-                return 0;
-
         if (!dma_map_sg(&obj->base.dev->pdev->dev,
                         obj->pages->sgl, obj->pages->nents,
                         PCI_DMA_BIDIRECTIONAL))
@@ -1972,10 +1969,8 @@ void i915_gem_gtt_finish_object(struct drm_i915_gem_object *obj)
 
         interruptible = do_idling(dev_priv);
 
-        if (!obj->has_dma_mapping)
-                dma_unmap_sg(&dev->pdev->dev,
-                             obj->pages->sgl, obj->pages->nents,
-                             PCI_DMA_BIDIRECTIONAL);
+        dma_unmap_sg(&dev->pdev->dev, obj->pages->sgl, obj->pages->nents,
+                     PCI_DMA_BIDIRECTIONAL);
 
         undo_idling(dev_priv, interruptible);
 }
@@ -2546,6 +2541,8 @@ void i915_gem_restore_gtt_mappings(struct drm_device *dev)
         struct drm_i915_private *dev_priv = dev->dev_private;
         struct drm_i915_gem_object *obj;
         struct i915_address_space *vm;
+        struct i915_vma *vma;
+        bool flush;
 
         i915_check_and_clear_faults(dev);
 
@@ -2555,16 +2552,23 @@ void i915_gem_restore_gtt_mappings(struct drm_device *dev)
                                        dev_priv->gtt.base.total,
                                        true);
 
+        /* Cache flush objects bound into GGTT and rebind them. */
+        vm = &dev_priv->gtt.base;
         list_for_each_entry(obj, &dev_priv->mm.bound_list, global_list) {
-                struct i915_vma *vma = i915_gem_obj_to_vma(obj,
-                                                           &dev_priv->gtt.base);
-                if (!vma)
-                        continue;
+                flush = false;
+                list_for_each_entry(vma, &obj->vma_list, vma_link) {
+                        if (vma->vm != vm)
+                                continue;
 
-                i915_gem_clflush_object(obj, obj->pin_display);
-                WARN_ON(i915_vma_bind(vma, obj->cache_level, PIN_UPDATE));
-        }
+                        WARN_ON(i915_vma_bind(vma, obj->cache_level,
+                                              PIN_UPDATE));
+
+                        flush = true;
+                }
 
+                if (flush)
+                        i915_gem_clflush_object(obj, obj->pin_display);
+        }
 
         if (INTEL_INFO(dev)->gen >= 8) {
                 if (IS_CHERRYVIEW(dev) || IS_BROXTON(dev))
diff --git a/drivers/gpu/drm/i915/i915_gem_stolen.c b/drivers/gpu/drm/i915/i915_gem_stolen.c
index 348ed5abcdbf..8b5b784c62fe 100644
--- a/drivers/gpu/drm/i915/i915_gem_stolen.c
+++ b/drivers/gpu/drm/i915/i915_gem_stolen.c
@@ -416,7 +416,6 @@ _i915_gem_object_create_stolen(struct drm_device *dev,
         if (obj->pages == NULL)
                 goto cleanup;
 
-        obj->has_dma_mapping = true;
         i915_gem_object_pin_pages(obj);
         obj->stolen = stolen;
 
diff --git a/drivers/gpu/drm/i915/i915_gem_userptr.c b/drivers/gpu/drm/i915/i915_gem_userptr.c
index 1f4e5a32a16e..8fd431bcdfd3 100644
--- a/drivers/gpu/drm/i915/i915_gem_userptr.c
+++ b/drivers/gpu/drm/i915/i915_gem_userptr.c
@@ -545,6 +545,26 @@ err:
         return ret;
 }
 
+static int
+__i915_gem_userptr_set_pages(struct drm_i915_gem_object *obj,
+                             struct page **pvec, int num_pages)
+{
+        int ret;
+
+        ret = st_set_pages(&obj->pages, pvec, num_pages);
+        if (ret)
+                return ret;
+
+        ret = i915_gem_gtt_prepare_object(obj);
+        if (ret) {
+                sg_free_table(obj->pages);
+                kfree(obj->pages);
+                obj->pages = NULL;
+        }
+
+        return ret;
+}
+
 static void
 __i915_gem_userptr_get_pages_worker(struct work_struct *_work)
 {
@@ -584,9 +604,12 @@ __i915_gem_userptr_get_pages_worker(struct work_struct *_work)
         if (obj->userptr.work != &work->work) {
                 ret = 0;
         } else if (pinned == num_pages) {
-                ret = st_set_pages(&obj->pages, pvec, num_pages);
+                ret = __i915_gem_userptr_set_pages(obj, pvec, num_pages);
                 if (ret == 0) {
                         list_add_tail(&obj->global_list, &to_i915(dev)->mm.unbound_list);
+                        obj->get_page.sg = obj->pages->sgl;
+                        obj->get_page.last = 0;
+
                         pinned = 0;
                 }
         }
@@ -693,7 +716,7 @@ i915_gem_userptr_get_pages(struct drm_i915_gem_object *obj)
                         }
                 }
         } else {
-                ret = st_set_pages(&obj->pages, pvec, num_pages);
+                ret = __i915_gem_userptr_set_pages(obj, pvec, num_pages);
                 if (ret == 0) {
                         obj->userptr.work = NULL;
                         pinned = 0;
@@ -715,6 +738,8 @@ i915_gem_userptr_put_pages(struct drm_i915_gem_object *obj)
         if (obj->madv != I915_MADV_WILLNEED)
                 obj->dirty = 0;
 
+        i915_gem_gtt_finish_object(obj);
+
         for_each_sg_page(obj->pages->sgl, &sg_iter, obj->pages->nents, 0) {
                 struct page *page = sg_page_iter_page(&sg_iter);
 
diff --git a/drivers/gpu/drm/i915/i915_ioc32.c b/drivers/gpu/drm/i915/i915_ioc32.c
index 176de6322e4d..23aa04cded6b 100644
--- a/drivers/gpu/drm/i915/i915_ioc32.c
+++ b/drivers/gpu/drm/i915/i915_ioc32.c
@@ -204,7 +204,7 @@ long i915_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
         drm_ioctl_compat_t *fn = NULL;
         int ret;
 
-        if (nr < DRM_COMMAND_BASE)
+        if (nr < DRM_COMMAND_BASE || nr >= DRM_COMMAND_END)
                 return drm_compat_ioctl(filp, cmd, arg);
 
         if (nr < DRM_COMMAND_BASE + ARRAY_SIZE(i915_compat_ioctls))
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index e6bb72dca3ff..984e2fe6688c 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -2706,18 +2706,11 @@ static void gen8_disable_vblank(struct drm_device *dev, int pipe)
         spin_unlock_irqrestore(&dev_priv->irq_lock, irqflags);
 }
 
-static struct drm_i915_gem_request *
-ring_last_request(struct intel_engine_cs *ring)
-{
-        return list_entry(ring->request_list.prev,
-                          struct drm_i915_gem_request, list);
-}
-
 static bool
-ring_idle(struct intel_engine_cs *ring)
+ring_idle(struct intel_engine_cs *ring, u32 seqno)
 {
         return (list_empty(&ring->request_list) ||
-                i915_gem_request_completed(ring_last_request(ring), false));
+                i915_seqno_passed(seqno, ring->last_submitted_seqno));
 }
 
 static bool
@@ -2939,7 +2932,7 @@ static void i915_hangcheck_elapsed(struct work_struct *work)
                 acthd = intel_ring_get_active_head(ring);
 
                 if (ring->hangcheck.seqno == seqno) {
-                        if (ring_idle(ring)) {
+                        if (ring_idle(ring, seqno)) {
                                 ring->hangcheck.action = HANGCHECK_IDLE;
 
                                 if (waitqueue_active(&ring->irq_queue)) {
diff --git a/drivers/gpu/drm/i915/i915_trace.h b/drivers/gpu/drm/i915/i915_trace.h
index 497cba5deb1e..849a2590e010 100644
--- a/drivers/gpu/drm/i915/i915_trace.h
+++ b/drivers/gpu/drm/i915/i915_trace.h
@@ -727,7 +727,7 @@ DECLARE_EVENT_CLASS(i915_context,
         TP_fast_assign(
                         __entry->ctx = ctx;
                         __entry->vm = ctx->ppgtt ? &ctx->ppgtt->base : NULL;
-                        __entry->dev = ctx->file_priv->dev_priv->dev->primary->index;
+                        __entry->dev = ctx->i915->dev->primary->index;
         ),
 
         TP_printk("dev=%u, ctx=%p, ctx_vm=%p",
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 1b61f9810387..30e0f54ba19d 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -4854,6 +4854,9 @@ static void intel_crtc_disable_planes(struct drm_crtc *crtc)
         struct intel_plane *intel_plane;
         int pipe = intel_crtc->pipe;
 
+        if (!intel_crtc->active)
+                return;
+
         intel_crtc_wait_for_pending_flips(crtc);
 
         intel_pre_disable_primary(crtc);
@@ -6312,9 +6315,6 @@ static void intel_crtc_disable(struct drm_crtc *crtc)
         struct drm_connector *connector;
         struct drm_i915_private *dev_priv = dev->dev_private;
 
-        /* crtc should still be enabled when we disable it. */
-        WARN_ON(!crtc->state->enable);
-
         intel_crtc_disable_planes(crtc);
         dev_priv->display.crtc_disable(crtc);
         dev_priv->display.off(crtc);
@@ -7887,7 +7887,7 @@ static void chv_crtc_clock_get(struct intel_crtc *crtc,
         int pipe = pipe_config->cpu_transcoder;
         enum dpio_channel port = vlv_pipe_to_channel(pipe);
         intel_clock_t clock;
-        u32 cmn_dw13, pll_dw0, pll_dw1, pll_dw2;
+        u32 cmn_dw13, pll_dw0, pll_dw1, pll_dw2, pll_dw3;
         int refclk = 100000;
 
         mutex_lock(&dev_priv->sb_lock);
@@ -7895,10 +7895,13 @@ static void chv_crtc_clock_get(struct intel_crtc *crtc,
         pll_dw0 = vlv_dpio_read(dev_priv, pipe, CHV_PLL_DW0(port));
         pll_dw1 = vlv_dpio_read(dev_priv, pipe, CHV_PLL_DW1(port));
         pll_dw2 = vlv_dpio_read(dev_priv, pipe, CHV_PLL_DW2(port));
+        pll_dw3 = vlv_dpio_read(dev_priv, pipe, CHV_PLL_DW3(port));
         mutex_unlock(&dev_priv->sb_lock);
 
         clock.m1 = (pll_dw1 & 0x7) == DPIO_CHV_M1_DIV_BY_2 ? 2 : 0;
-        clock.m2 = ((pll_dw0 & 0xff) << 22) | (pll_dw2 & 0x3fffff);
+        clock.m2 = (pll_dw0 & 0xff) << 22;
+        if (pll_dw3 & DPIO_CHV_FRAC_DIV_EN)
+                clock.m2 |= pll_dw2 & 0x3fffff;
         clock.n = (pll_dw1 >> DPIO_CHV_N_DIV_SHIFT) & 0xf;
         clock.p1 = (cmn_dw13 >> DPIO_CHV_P1_DIV_SHIFT) & 0x7;
         clock.p2 = (cmn_dw13 >> DPIO_CHV_P2_DIV_SHIFT) & 0x1f;
@@ -12585,7 +12588,8 @@ static int __intel_set_mode(struct drm_crtc *modeset_crtc,
                         continue;
 
                 if (!crtc_state->enable) {
-                        intel_crtc_disable(crtc);
+                        if (crtc->state->enable)
+                                intel_crtc_disable(crtc);
                 } else if (crtc->state->enable) {
                         intel_crtc_disable_planes(crtc);
                         dev_priv->display.crtc_disable(crtc);
@@ -13270,7 +13274,7 @@ intel_check_primary_plane(struct drm_plane *plane,
         if (ret)
                 return ret;
 
-        if (intel_crtc->active) {
+        if (crtc_state ? crtc_state->base.active : intel_crtc->active) {
                 struct intel_plane_state *old_state =
                         to_intel_plane_state(plane->state);
 
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.h b/drivers/gpu/drm/i915/intel_ringbuffer.h
index e539314ae87e..4be66f60504d 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.h
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.h
@@ -275,6 +275,13 @@ struct  intel_engine_cs {
          * Do we have some not yet emitted requests outstanding?
          */
         struct drm_i915_gem_request *outstanding_lazy_request;
+        /**
+         * Seqno of request most recently submitted to request_list.
+         * Used exclusively by hang checker to avoid grabbing lock while
+         * inspecting request list.
+         */
+        u32 last_submitted_seqno;
+
         bool gpu_caches_dirty;
 
         wait_queue_head_t irq_queue;
diff --git a/drivers/gpu/drm/i915/intel_uncore.c b/drivers/gpu/drm/i915/intel_uncore.c
index a6d8a3ee7750..260389acfb77 100644
--- a/drivers/gpu/drm/i915/intel_uncore.c
+++ b/drivers/gpu/drm/i915/intel_uncore.c
@@ -1274,10 +1274,12 @@ int i915_reg_read_ioctl(struct drm_device *dev,
         struct drm_i915_private *dev_priv = dev->dev_private;
         struct drm_i915_reg_read *reg = data;
         struct register_whitelist const *entry = whitelist;
+        unsigned size;
+        u64 offset;
         int i, ret = 0;
 
         for (i = 0; i < ARRAY_SIZE(whitelist); i++, entry++) {
-                if (entry->offset == reg->offset &&
+                if (entry->offset == (reg->offset & -entry->size) &&
                     (1 << INTEL_INFO(dev)->gen & entry->gen_bitmask))
                         break;
         }
@@ -1285,23 +1287,33 @@ int i915_reg_read_ioctl(struct drm_device *dev,
         if (i == ARRAY_SIZE(whitelist))
                 return -EINVAL;
 
+        /* We use the low bits to encode extra flags as the register should
+         * be naturally aligned (and those that are not so aligned merely
+         * limit the available flags for that register).
+         */
+        offset = entry->offset;
+        size = entry->size;
+        size |= reg->offset ^ offset;
+
         intel_runtime_pm_get(dev_priv);
 
-        switch (entry->size) {
+        switch (size) {
+        case 8 | 1:
+                reg->val = I915_READ64_2x32(offset, offset+4);
+                break;
         case 8:
-                reg->val = I915_READ64(reg->offset);
+                reg->val = I915_READ64(offset);
                 break;
         case 4:
-                reg->val = I915_READ(reg->offset);
+                reg->val = I915_READ(offset);
                 break;
         case 2:
-                reg->val = I915_READ16(reg->offset);
+                reg->val = I915_READ16(offset);
                 break;
         case 1:
-                reg->val = I915_READ8(reg->offset);
+                reg->val = I915_READ8(offset);
                 break;
         default:
-                MISSING_CASE(entry->size);
                 ret = -EINVAL;
                 goto out;
         }
diff --git a/drivers/gpu/drm/imx/imx-tve.c b/drivers/gpu/drm/imx/imx-tve.c
index 214eceefc981..e671ad369416 100644
--- a/drivers/gpu/drm/imx/imx-tve.c
+++ b/drivers/gpu/drm/imx/imx-tve.c
@@ -301,7 +301,7 @@ static void imx_tve_encoder_prepare(struct drm_encoder *encoder)
 
         switch (tve->mode) {
         case TVE_MODE_VGA:
-                imx_drm_set_bus_format_pins(encoder, MEDIA_BUS_FMT_YUV8_1X24,
+                imx_drm_set_bus_format_pins(encoder, MEDIA_BUS_FMT_GBR888_1X24,
                                             tve->hsync_pin, tve->vsync_pin);
                 break;
         case TVE_MODE_TVOUT:
diff --git a/drivers/gpu/drm/imx/parallel-display.c b/drivers/gpu/drm/imx/parallel-display.c
index 74a9ce40ddc4..b4deb9cf9d71 100644
--- a/drivers/gpu/drm/imx/parallel-display.c
+++ b/drivers/gpu/drm/imx/parallel-display.c
@@ -21,6 +21,7 @@
 #include <drm/drm_panel.h>
 #include <linux/videodev2.h>
 #include <video/of_display_timing.h>
+#include <linux/of_graph.h>
 
 #include "imx-drm.h"
 
@@ -208,7 +209,7 @@ static int imx_pd_bind(struct device *dev, struct device *master, void *data)
 {
         struct drm_device *drm = data;
         struct device_node *np = dev->of_node;
-        struct device_node *panel_node;
+        struct device_node *port;
         const u8 *edidp;
         struct imx_parallel_display *imxpd;
         int ret;
@@ -234,11 +235,19 @@ static int imx_pd_bind(struct device *dev, struct device *master, void *data)
                         imxpd->bus_format = MEDIA_BUS_FMT_RGB666_1X24_CPADHI;
         }
 
-        panel_node = of_parse_phandle(np, "fsl,panel", 0);
-        if (panel_node) {
-                imxpd->panel = of_drm_find_panel(panel_node);
-                if (!imxpd->panel)
-                        return -EPROBE_DEFER;
+        /* port@1 is the output port */
+        port = of_graph_get_port_by_id(np, 1);
+        if (port) {
+                struct device_node *endpoint, *remote;
+
+                endpoint = of_get_child_by_name(port, "endpoint");
+                if (endpoint) {
+                        remote = of_graph_get_remote_port_parent(endpoint);
+                        if (remote)
+                                imxpd->panel = of_drm_find_panel(remote);
+                        if (!imxpd->panel)
+                                return -EPROBE_DEFER;
+                }
         }
 
         imxpd->dev = dev;
diff --git a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
index f2daad8c3d96..7841970de48d 100644
--- a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
+++ b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
@@ -285,7 +285,7 @@ static int dmm_txn_commit(struct dmm_txn *txn, bool wait)
 
         if (wait) {
                 if (!wait_for_completion_timeout(&engine->compl,
-                                msecs_to_jiffies(1))) {
+                                msecs_to_jiffies(100))) {
                         dev_err(dmm->dev, "timed out waiting for done\n");
                         ret = -ETIMEDOUT;
                 }
diff --git a/drivers/gpu/drm/omapdrm/omap_drv.h b/drivers/gpu/drm/omapdrm/omap_drv.h
index ae2df41f216f..12081e61d45a 100644
--- a/drivers/gpu/drm/omapdrm/omap_drv.h
+++ b/drivers/gpu/drm/omapdrm/omap_drv.h
@@ -177,7 +177,7 @@ struct drm_framebuffer *omap_framebuffer_init(struct drm_device *dev,
                 struct drm_mode_fb_cmd2 *mode_cmd, struct drm_gem_object **bos);
 struct drm_gem_object *omap_framebuffer_bo(struct drm_framebuffer *fb, int p);
 int omap_framebuffer_pin(struct drm_framebuffer *fb);
-int omap_framebuffer_unpin(struct drm_framebuffer *fb);
+void omap_framebuffer_unpin(struct drm_framebuffer *fb);
 void omap_framebuffer_update_scanout(struct drm_framebuffer *fb,
                 struct omap_drm_window *win, struct omap_overlay_info *info);
 struct drm_connector *omap_framebuffer_get_next_connector(
@@ -211,7 +211,7 @@ void omap_gem_dma_sync(struct drm_gem_object *obj,
                 enum dma_data_direction dir);
 int omap_gem_get_paddr(struct drm_gem_object *obj,
                 dma_addr_t *paddr, bool remap);
-int omap_gem_put_paddr(struct drm_gem_object *obj);
+void omap_gem_put_paddr(struct drm_gem_object *obj);
 int omap_gem_get_pages(struct drm_gem_object *obj, struct page ***pages,
                 bool remap);
 int omap_gem_put_pages(struct drm_gem_object *obj);
@@ -236,7 +236,7 @@ static inline int align_pitch(int pitch, int width, int bpp)
         /* PVR needs alignment to 8 pixels.. right now that is the most
          * restrictive stride requirement..
          */
-        return ALIGN(pitch, 8 * bytespp);
+        return roundup(pitch, 8 * bytespp);
 }
 
 /* map crtc to vblank mask */
diff --git a/drivers/gpu/drm/omapdrm/omap_fb.c b/drivers/gpu/drm/omapdrm/omap_fb.c
index 0b967e76df1a..51b1219af87f 100644
--- a/drivers/gpu/drm/omapdrm/omap_fb.c
+++ b/drivers/gpu/drm/omapdrm/omap_fb.c
@@ -287,10 +287,10 @@ fail:
 }
 
 /* unpin, no longer being scanned out: */
-int omap_framebuffer_unpin(struct drm_framebuffer *fb)
+void omap_framebuffer_unpin(struct drm_framebuffer *fb)
 {
         struct omap_framebuffer *omap_fb = to_omap_framebuffer(fb);
-        int ret, i, n = drm_format_num_planes(fb->pixel_format);
+        int i, n = drm_format_num_planes(fb->pixel_format);
 
         mutex_lock(&omap_fb->lock);
 
@@ -298,24 +298,16 @@ int omap_framebuffer_unpin(struct drm_framebuffer *fb)
 
         if (omap_fb->pin_count > 0) {
                 mutex_unlock(&omap_fb->lock);
-                return 0;
+                return;
         }
 
         for (i = 0; i < n; i++) {
                 struct plane *plane = &omap_fb->planes[i];
-                ret = omap_gem_put_paddr(plane->bo);
-                if (ret)
-                        goto fail;
+                omap_gem_put_paddr(plane->bo);
                 plane->paddr = 0;
         }
 
         mutex_unlock(&omap_fb->lock);
-
-        return 0;
-
-fail:
-        mutex_unlock(&omap_fb->lock);
-        return ret;
 }
 
 struct drm_gem_object *omap_framebuffer_bo(struct drm_framebuffer *fb, int p)
diff --git a/drivers/gpu/drm/omapdrm/omap_fbdev.c b/drivers/gpu/drm/omapdrm/omap_fbdev.c
index 23b5a84389e3..720d16bce7e8 100644
--- a/drivers/gpu/drm/omapdrm/omap_fbdev.c
+++ b/drivers/gpu/drm/omapdrm/omap_fbdev.c
@@ -135,7 +135,7 @@ static int omap_fbdev_create(struct drm_fb_helper *helper,
         fbdev->ywrap_enabled = priv->has_dmm && ywrap_enabled;
         if (fbdev->ywrap_enabled) {
                 /* need to align pitch to page size if using DMM scrolling */
-                mode_cmd.pitches[0] = ALIGN(mode_cmd.pitches[0], PAGE_SIZE);
+                mode_cmd.pitches[0] = PAGE_ALIGN(mode_cmd.pitches[0]);
         }
 
         /* allocate backing bo */
diff --git a/drivers/gpu/drm/omapdrm/omap_gem.c b/drivers/gpu/drm/omapdrm/omap_gem.c
index 2ab77801cf5f..7ed08fdc4c42 100644
--- a/drivers/gpu/drm/omapdrm/omap_gem.c
+++ b/drivers/gpu/drm/omapdrm/omap_gem.c
@@ -808,10 +808,10 @@ fail:
 /* Release physical address, when DMA is no longer being performed.. this
  * could potentially unpin and unmap buffers from TILER
  */
-int omap_gem_put_paddr(struct drm_gem_object *obj)
+void omap_gem_put_paddr(struct drm_gem_object *obj)
 {
         struct omap_gem_object *omap_obj = to_omap_bo(obj);
-        int ret = 0;
+        int ret;
 
         mutex_lock(&obj->dev->struct_mutex);
         if (omap_obj->paddr_cnt > 0) {
@@ -821,7 +821,6 @@ int omap_gem_put_paddr(struct drm_gem_object *obj)
                         if (ret) {
                                 dev_err(obj->dev->dev,
                                         "could not unpin pages: %d\n", ret);
-                                goto fail;
                         }
                         ret = tiler_release(omap_obj->block);
                         if (ret) {
@@ -832,9 +831,8 @@ int omap_gem_put_paddr(struct drm_gem_object *obj)
                         omap_obj->block = NULL;
                 }
         }
-fail:
+
         mutex_unlock(&obj->dev->struct_mutex);
-        return ret;
 }
 
 /* Get rotated scanout address (only valid if already pinned), at the
@@ -1378,11 +1376,7 @@ struct drm_gem_object *omap_gem_new(struct drm_device *dev,
 
         omap_obj = kzalloc(sizeof(*omap_obj), GFP_KERNEL);
         if (!omap_obj)
-                goto fail;
-
-        spin_lock(&priv->list_lock);
-        list_add(&omap_obj->mm_list, &priv->obj_list);
-        spin_unlock(&priv->list_lock);
+                return NULL;
 
         obj = &omap_obj->base;
 
@@ -1392,11 +1386,19 @@ struct drm_gem_object *omap_gem_new(struct drm_device *dev,
                  */
                 omap_obj->vaddr =  dma_alloc_writecombine(dev->dev, size,
                                 &omap_obj->paddr, GFP_KERNEL);
-                if (omap_obj->vaddr)
-                        flags |= OMAP_BO_DMA;
+                if (!omap_obj->vaddr) {
+                        kfree(omap_obj);
+
+                        return NULL;
+                }
 
+                flags |= OMAP_BO_DMA;
         }
 
+        spin_lock(&priv->list_lock);
+        list_add(&omap_obj->mm_list, &priv->obj_list);
+        spin_unlock(&priv->list_lock);
+
         omap_obj->flags = flags;
 
         if (flags & OMAP_BO_TILED) {
diff --git a/drivers/gpu/drm/omapdrm/omap_plane.c b/drivers/gpu/drm/omapdrm/omap_plane.c
index cfa8276c4deb..098904696a5c 100644
--- a/drivers/gpu/drm/omapdrm/omap_plane.c
+++ b/drivers/gpu/drm/omapdrm/omap_plane.c
@@ -17,6 +17,7 @@
  * this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+#include <drm/drm_atomic.h>
 #include <drm/drm_atomic_helper.h>
 #include <drm/drm_plane_helper.h>
 
@@ -153,9 +154,34 @@ static void omap_plane_atomic_disable(struct drm_plane *plane,
         dispc_ovl_enable(omap_plane->id, false);
 }
 
+static int omap_plane_atomic_check(struct drm_plane *plane,
+                                   struct drm_plane_state *state)
+{
+        struct drm_crtc_state *crtc_state;
+
+        if (!state->crtc)
+                return 0;
+
+        crtc_state = drm_atomic_get_crtc_state(state->state, state->crtc);
+        if (IS_ERR(crtc_state))
+                return PTR_ERR(crtc_state);
+
+        if (state->crtc_x < 0 || state->crtc_y < 0)
+                return -EINVAL;
+
+        if (state->crtc_x + state->crtc_w > crtc_state->adjusted_mode.hdisplay)
+                return -EINVAL;
+
+        if (state->crtc_y + state->crtc_h > crtc_state->adjusted_mode.vdisplay)
+                return -EINVAL;
+
+        return 0;
+}
+
 static const struct drm_plane_helper_funcs omap_plane_helper_funcs = {
         .prepare_fb = omap_plane_prepare_fb,
         .cleanup_fb = omap_plane_cleanup_fb,
+        .atomic_check = omap_plane_atomic_check,
         .atomic_update = omap_plane_atomic_update,
         .atomic_disable = omap_plane_atomic_disable,
 };
diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c
index 8730562323a8..4a09947be244 100644
--- a/drivers/gpu/drm/radeon/ci_dpm.c
+++ b/drivers/gpu/drm/radeon/ci_dpm.c
@@ -5818,7 +5818,7 @@ int ci_dpm_init(struct radeon_device *rdev)
                         tmp |= DPM_ENABLED;
                         break;
                 default:
-                        DRM_ERROR("Invalid PCC GPIO: %u!\n", gpio.shift);
+                        DRM_DEBUG("Invalid PCC GPIO: %u!\n", gpio.shift);
                         break;
                 }
                 WREG32_SMC(CNB_PWRMGT_CNTL, tmp);
diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index 4ecf5caa8c6d..248953d2fdb7 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -7964,23 +7964,27 @@ restart_ih:
                 case 1: /* D1 vblank/vline */
                         switch (src_data) {
                         case 0: /* D1 vblank */
-                                if (rdev->irq.stat_regs.cik.disp_int & LB_D1_VBLANK_INTERRUPT) {
-                                        if (rdev->irq.crtc_vblank_int[0]) {
-                                                drm_handle_vblank(rdev->ddev, 0);
-                                                rdev->pm.vblank_sync = true;
-                                                wake_up(&rdev->irq.vblank_queue);
-                                        }
-                                        if (atomic_read(&rdev->irq.pflip[0]))
-                                                radeon_crtc_handle_vblank(rdev, 0);
-                                        rdev->irq.stat_regs.cik.disp_int &= ~LB_D1_VBLANK_INTERRUPT;
-                                        DRM_DEBUG("IH: D1 vblank\n");
+                                if (!(rdev->irq.stat_regs.cik.disp_int & LB_D1_VBLANK_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                if (rdev->irq.crtc_vblank_int[0]) {
+                                        drm_handle_vblank(rdev->ddev, 0);
+                                        rdev->pm.vblank_sync = true;
+                                        wake_up(&rdev->irq.vblank_queue);
                                 }
+                                if (atomic_read(&rdev->irq.pflip[0]))
+                                        radeon_crtc_handle_vblank(rdev, 0);
+                                rdev->irq.stat_regs.cik.disp_int &= ~LB_D1_VBLANK_INTERRUPT;
+                                DRM_DEBUG("IH: D1 vblank\n");
+
                                 break;
                         case 1: /* D1 vline */
-                                if (rdev->irq.stat_regs.cik.disp_int & LB_D1_VLINE_INTERRUPT) {
-                                        rdev->irq.stat_regs.cik.disp_int &= ~LB_D1_VLINE_INTERRUPT;
-                                        DRM_DEBUG("IH: D1 vline\n");
-                                }
+                                if (!(rdev->irq.stat_regs.cik.disp_int & LB_D1_VLINE_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.cik.disp_int &= ~LB_D1_VLINE_INTERRUPT;
+                                DRM_DEBUG("IH: D1 vline\n");
+
                                 break;
                         default:
                                 DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
@@ -7990,23 +7994,27 @@ restart_ih:
                 case 2: /* D2 vblank/vline */
                         switch (src_data) {
                         case 0: /* D2 vblank */
-                                if (rdev->irq.stat_regs.cik.disp_int_cont & LB_D2_VBLANK_INTERRUPT) {
-                                        if (rdev->irq.crtc_vblank_int[1]) {
-                                                drm_handle_vblank(rdev->ddev, 1);
-                                                rdev->pm.vblank_sync = true;
-                                                wake_up(&rdev->irq.vblank_queue);
-                                        }
-                                        if (atomic_read(&rdev->irq.pflip[1]))
-                                                radeon_crtc_handle_vblank(rdev, 1);
-                                        rdev->irq.stat_regs.cik.disp_int_cont &= ~LB_D2_VBLANK_INTERRUPT;
-                                        DRM_DEBUG("IH: D2 vblank\n");
+                                if (!(rdev->irq.stat_regs.cik.disp_int_cont & LB_D2_VBLANK_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                if (rdev->irq.crtc_vblank_int[1]) {
+                                        drm_handle_vblank(rdev->ddev, 1);
+                                        rdev->pm.vblank_sync = true;
+                                        wake_up(&rdev->irq.vblank_queue);
                                 }
+                                if (atomic_read(&rdev->irq.pflip[1]))
+                                        radeon_crtc_handle_vblank(rdev, 1);
+                                rdev->irq.stat_regs.cik.disp_int_cont &= ~LB_D2_VBLANK_INTERRUPT;
+                                DRM_DEBUG("IH: D2 vblank\n");
+
                                 break;
                         case 1: /* D2 vline */
-                                if (rdev->irq.stat_regs.cik.disp_int_cont & LB_D2_VLINE_INTERRUPT) {
-                                        rdev->irq.stat_regs.cik.disp_int_cont &= ~LB_D2_VLINE_INTERRUPT;
-                                        DRM_DEBUG("IH: D2 vline\n");
-                                }
+                                if (!(rdev->irq.stat_regs.cik.disp_int_cont & LB_D2_VLINE_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.cik.disp_int_cont &= ~LB_D2_VLINE_INTERRUPT;
+                                DRM_DEBUG("IH: D2 vline\n");
+
                                 break;
                         default:
                                 DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
@@ -8016,23 +8024,27 @@ restart_ih:
                 case 3: /* D3 vblank/vline */
                         switch (src_data) {
                         case 0: /* D3 vblank */
-                                if (rdev->irq.stat_regs.cik.disp_int_cont2 & LB_D3_VBLANK_INTERRUPT) {
-                                        if (rdev->irq.crtc_vblank_int[2]) {
-                                                drm_handle_vblank(rdev->ddev, 2);
-                                                rdev->pm.vblank_sync = true;
-                                                wake_up(&rdev->irq.vblank_queue);
-                                        }
-                                        if (atomic_read(&rdev->irq.pflip[2]))
-                                                radeon_crtc_handle_vblank(rdev, 2);
-                                        rdev->irq.stat_regs.cik.disp_int_cont2 &= ~LB_D3_VBLANK_INTERRUPT;
-                                        DRM_DEBUG("IH: D3 vblank\n");
+                                if (!(rdev->irq.stat_regs.cik.disp_int_cont2 & LB_D3_VBLANK_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                if (rdev->irq.crtc_vblank_int[2]) {
+                                        drm_handle_vblank(rdev->ddev, 2);
+                                        rdev->pm.vblank_sync = true;
+                                        wake_up(&rdev->irq.vblank_queue);
                                 }
+                                if (atomic_read(&rdev->irq.pflip[2]))
+                                        radeon_crtc_handle_vblank(rdev, 2);
+                                rdev->irq.stat_regs.cik.disp_int_cont2 &= ~LB_D3_VBLANK_INTERRUPT;
+                                DRM_DEBUG("IH: D3 vblank\n");
+
                                 break;
                         case 1: /* D3 vline */
-                                if (rdev->irq.stat_regs.cik.disp_int_cont2 & LB_D3_VLINE_INTERRUPT) {
-                                        rdev->irq.stat_regs.cik.disp_int_cont2 &= ~LB_D3_VLINE_INTERRUPT;
-                                        DRM_DEBUG("IH: D3 vline\n");
-                                }
+                                if (!(rdev->irq.stat_regs.cik.disp_int_cont2 & LB_D3_VLINE_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.cik.disp_int_cont2 &= ~LB_D3_VLINE_INTERRUPT;
+                                DRM_DEBUG("IH: D3 vline\n");
+
                                 break;
                         default:
                                 DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
@@ -8042,23 +8054,27 @@ restart_ih:
                 case 4: /* D4 vblank/vline */
                         switch (src_data) {
                         case 0: /* D4 vblank */
-                                if (rdev->irq.stat_regs.cik.disp_int_cont3 & LB_D4_VBLANK_INTERRUPT) {
-                                        if (rdev->irq.crtc_vblank_int[3]) {
-                                                drm_handle_vblank(rdev->ddev, 3);
-                                                rdev->pm.vblank_sync = true;
-                                                wake_up(&rdev->irq.vblank_queue);
-                                        }
-                                        if (atomic_read(&rdev->irq.pflip[3]))
-                                                radeon_crtc_handle_vblank(rdev, 3);
-                                        rdev->irq.stat_regs.cik.disp_int_cont3 &= ~LB_D4_VBLANK_INTERRUPT;
-                                        DRM_DEBUG("IH: D4 vblank\n");
+                                if (!(rdev->irq.stat_regs.cik.disp_int_cont3 & LB_D4_VBLANK_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                if (rdev->irq.crtc_vblank_int[3]) {
+                                        drm_handle_vblank(rdev->ddev, 3);
+                                        rdev->pm.vblank_sync = true;
+                                        wake_up(&rdev->irq.vblank_queue);
                                 }
+                                if (atomic_read(&rdev->irq.pflip[3]))
+                                        radeon_crtc_handle_vblank(rdev, 3);
+                                rdev->irq.stat_regs.cik.disp_int_cont3 &= ~LB_D4_VBLANK_INTERRUPT;
+                                DRM_DEBUG("IH: D4 vblank\n");
+
                                 break;
                         case 1: /* D4 vline */
-                                if (rdev->irq.stat_regs.cik.disp_int_cont3 & LB_D4_VLINE_INTERRUPT) {
-                                        rdev->irq.stat_regs.cik.disp_int_cont3 &= ~LB_D4_VLINE_INTERRUPT;
-                                        DRM_DEBUG("IH: D4 vline\n");
-                                }
+                                if (!(rdev->irq.stat_regs.cik.disp_int_cont3 & LB_D4_VLINE_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.cik.disp_int_cont3 &= ~LB_D4_VLINE_INTERRUPT;
+                                DRM_DEBUG("IH: D4 vline\n");
+
                                 break;
                         default:
                                 DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
@@ -8068,23 +8084,27 @@ restart_ih:
                 case 5: /* D5 vblank/vline */
                         switch (src_data) {
                         case 0: /* D5 vblank */
-                                if (rdev->irq.stat_regs.cik.disp_int_cont4 & LB_D5_VBLANK_INTERRUPT) {
-                                        if (rdev->irq.crtc_vblank_int[4]) {
-                                                drm_handle_vblank(rdev->ddev, 4);
-                                                rdev->pm.vblank_sync = true;
-                                                wake_up(&rdev->irq.vblank_queue);
-                                        }
-                                        if (atomic_read(&rdev->irq.pflip[4]))
-                                                radeon_crtc_handle_vblank(rdev, 4);
-                                        rdev->irq.stat_regs.cik.disp_int_cont4 &= ~LB_D5_VBLANK_INTERRUPT;
-                                        DRM_DEBUG("IH: D5 vblank\n");
+                                if (!(rdev->irq.stat_regs.cik.disp_int_cont4 & LB_D5_VBLANK_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                if (rdev->irq.crtc_vblank_int[4]) {
+                                        drm_handle_vblank(rdev->ddev, 4);
+                                        rdev->pm.vblank_sync = true;
+                                        wake_up(&rdev->irq.vblank_queue);
                                 }
+                                if (atomic_read(&rdev->irq.pflip[4]))
+                                        radeon_crtc_handle_vblank(rdev, 4);
+                                rdev->irq.stat_regs.cik.disp_int_cont4 &= ~LB_D5_VBLANK_INTERRUPT;
+                                DRM_DEBUG("IH: D5 vblank\n");
+
                                 break;
                         case 1: /* D5 vline */
-                                if (rdev->irq.stat_regs.cik.disp_int_cont4 & LB_D5_VLINE_INTERRUPT) {
-                                        rdev->irq.stat_regs.cik.disp_int_cont4 &= ~LB_D5_VLINE_INTERRUPT;
-                                        DRM_DEBUG("IH: D5 vline\n");
-                                }
+                                if (!(rdev->irq.stat_regs.cik.disp_int_cont4 & LB_D5_VLINE_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.cik.disp_int_cont4 &= ~LB_D5_VLINE_INTERRUPT;
+                                DRM_DEBUG("IH: D5 vline\n");
+
                                 break;
                         default:
                                 DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
@@ -8094,23 +8114,27 @@ restart_ih:
                 case 6: /* D6 vblank/vline */
                         switch (src_data) {
                         case 0: /* D6 vblank */
-                                if (rdev->irq.stat_regs.cik.disp_int_cont5 & LB_D6_VBLANK_INTERRUPT) {
-                                        if (rdev->irq.crtc_vblank_int[5]) {
-                                                drm_handle_vblank(rdev->ddev, 5);
-                                                rdev->pm.vblank_sync = true;
-                                                wake_up(&rdev->irq.vblank_queue);
-                                        }
-                                        if (atomic_read(&rdev->irq.pflip[5]))
-                                                radeon_crtc_handle_vblank(rdev, 5);
-                                        rdev->irq.stat_regs.cik.disp_int_cont5 &= ~LB_D6_VBLANK_INTERRUPT;
-                                        DRM_DEBUG("IH: D6 vblank\n");
+                                if (!(rdev->irq.stat_regs.cik.disp_int_cont5 & LB_D6_VBLANK_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                if (rdev->irq.crtc_vblank_int[5]) {
+                                        drm_handle_vblank(rdev->ddev, 5);
+                                        rdev->pm.vblank_sync = true;
+                                        wake_up(&rdev->irq.vblank_queue);
                                 }
+                                if (atomic_read(&rdev->irq.pflip[5]))
+                                        radeon_crtc_handle_vblank(rdev, 5);
+                                rdev->irq.stat_regs.cik.disp_int_cont5 &= ~LB_D6_VBLANK_INTERRUPT;
+                                DRM_DEBUG("IH: D6 vblank\n");
+
                                 break;
                         case 1: /* D6 vline */
-                                if (rdev->irq.stat_regs.cik.disp_int_cont5 & LB_D6_VLINE_INTERRUPT) {
-                                        rdev->irq.stat_regs.cik.disp_int_cont5 &= ~LB_D6_VLINE_INTERRUPT;
-                                        DRM_DEBUG("IH: D6 vline\n");
-                                }
+                                if (!(rdev->irq.stat_regs.cik.disp_int_cont5 & LB_D6_VLINE_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.cik.disp_int_cont5 &= ~LB_D6_VLINE_INTERRUPT;
+                                DRM_DEBUG("IH: D6 vline\n");
+
                                 break;
                         default:
                                 DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
@@ -8130,88 +8154,112 @@ restart_ih:
                 case 42: /* HPD hotplug */
                         switch (src_data) {
                         case 0:
-                                if (rdev->irq.stat_regs.cik.disp_int & DC_HPD1_INTERRUPT) {
-                                        rdev->irq.stat_regs.cik.disp_int &= ~DC_HPD1_INTERRUPT;
-                                        queue_hotplug = true;
-                                        DRM_DEBUG("IH: HPD1\n");
-                                }
+                                if (!(rdev->irq.stat_regs.cik.disp_int & DC_HPD1_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.cik.disp_int &= ~DC_HPD1_INTERRUPT;
+                                queue_hotplug = true;
+                                DRM_DEBUG("IH: HPD1\n");
+
                                 break;
                         case 1:
-                                if (rdev->irq.stat_regs.cik.disp_int_cont & DC_HPD2_INTERRUPT) {
-                                        rdev->irq.stat_regs.cik.disp_int_cont &= ~DC_HPD2_INTERRUPT;
-                                        queue_hotplug = true;
-                                        DRM_DEBUG("IH: HPD2\n");
-                                }
+                                if (!(rdev->irq.stat_regs.cik.disp_int_cont & DC_HPD2_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.cik.disp_int_cont &= ~DC_HPD2_INTERRUPT;
+                                queue_hotplug = true;
+                                DRM_DEBUG("IH: HPD2\n");
+
                                 break;
                         case 2:
-                                if (rdev->irq.stat_regs.cik.disp_int_cont2 & DC_HPD3_INTERRUPT) {
-                                        rdev->irq.stat_regs.cik.disp_int_cont2 &= ~DC_HPD3_INTERRUPT;
-                                        queue_hotplug = true;
-                                        DRM_DEBUG("IH: HPD3\n");
-                                }
+                                if (!(rdev->irq.stat_regs.cik.disp_int_cont2 & DC_HPD3_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.cik.disp_int_cont2 &= ~DC_HPD3_INTERRUPT;
+                                queue_hotplug = true;
+                                DRM_DEBUG("IH: HPD3\n");
+
                                 break;
                         case 3:
-                                if (rdev->irq.stat_regs.cik.disp_int_cont3 & DC_HPD4_INTERRUPT) {
-                                        rdev->irq.stat_regs.cik.disp_int_cont3 &= ~DC_HPD4_INTERRUPT;
-                                        queue_hotplug = true;
-                                        DRM_DEBUG("IH: HPD4\n");
-                                }
+                                if (!(rdev->irq.stat_regs.cik.disp_int_cont3 & DC_HPD4_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.cik.disp_int_cont3 &= ~DC_HPD4_INTERRUPT;
+                                queue_hotplug = true;
+                                DRM_DEBUG("IH: HPD4\n");
+
                                 break;
                         case 4:
-                                if (rdev->irq.stat_regs.cik.disp_int_cont4 & DC_HPD5_INTERRUPT) {
-                                        rdev->irq.stat_regs.cik.disp_int_cont4 &= ~DC_HPD5_INTERRUPT;
-                                        queue_hotplug = true;
-                                        DRM_DEBUG("IH: HPD5\n");
-                                }
+                                if (!(rdev->irq.stat_regs.cik.disp_int_cont4 & DC_HPD5_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.cik.disp_int_cont4 &= ~DC_HPD5_INTERRUPT;
+                                queue_hotplug = true;
+                                DRM_DEBUG("IH: HPD5\n");
+
                                 break;
                         case 5:
-                                if (rdev->irq.stat_regs.cik.disp_int_cont5 & DC_HPD6_INTERRUPT) {
-                                        rdev->irq.stat_regs.cik.disp_int_cont5 &= ~DC_HPD6_INTERRUPT;
-                                        queue_hotplug = true;
-                                        DRM_DEBUG("IH: HPD6\n");
-                                }
+                                if (!(rdev->irq.stat_regs.cik.disp_int_cont5 & DC_HPD6_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.cik.disp_int_cont5 &= ~DC_HPD6_INTERRUPT;
+                                queue_hotplug = true;
+                                DRM_DEBUG("IH: HPD6\n");
+
                                 break;
                         case 6:
-                                if (rdev->irq.stat_regs.cik.disp_int & DC_HPD1_RX_INTERRUPT) {
-                                        rdev->irq.stat_regs.cik.disp_int &= ~DC_HPD1_RX_INTERRUPT;
-                                        queue_dp = true;
-                                        DRM_DEBUG("IH: HPD_RX 1\n");
-                                }
+                                if (!(rdev->irq.stat_regs.cik.disp_int & DC_HPD1_RX_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.cik.disp_int &= ~DC_HPD1_RX_INTERRUPT;
+                                queue_dp = true;
+                                DRM_DEBUG("IH: HPD_RX 1\n");
+
                                 break;
                         case 7:
-                                if (rdev->irq.stat_regs.cik.disp_int_cont & DC_HPD2_RX_INTERRUPT) {
-                                        rdev->irq.stat_regs.cik.disp_int_cont &= ~DC_HPD2_RX_INTERRUPT;
-                                        queue_dp = true;
-                                        DRM_DEBUG("IH: HPD_RX 2\n");
-                                }
+                                if (!(rdev->irq.stat_regs.cik.disp_int_cont & DC_HPD2_RX_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.cik.disp_int_cont &= ~DC_HPD2_RX_INTERRUPT;
+                                queue_dp = true;
+                                DRM_DEBUG("IH: HPD_RX 2\n");
+
                                 break;
                         case 8:
-                                if (rdev->irq.stat_regs.cik.disp_int_cont2 & DC_HPD3_RX_INTERRUPT) {
-                                        rdev->irq.stat_regs.cik.disp_int_cont2 &= ~DC_HPD3_RX_INTERRUPT;
-                                        queue_dp = true;
-                                        DRM_DEBUG("IH: HPD_RX 3\n");
-                                }
+                                if (!(rdev->irq.stat_regs.cik.disp_int_cont2 & DC_HPD3_RX_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.cik.disp_int_cont2 &= ~DC_HPD3_RX_INTERRUPT;
+                                queue_dp = true;
+                                DRM_DEBUG("IH: HPD_RX 3\n");
+
                                 break;
                         case 9:
-                                if (rdev->irq.stat_regs.cik.disp_int_cont3 & DC_HPD4_RX_INTERRUPT) {
-                                        rdev->irq.stat_regs.cik.disp_int_cont3 &= ~DC_HPD4_RX_INTERRUPT;
-                                        queue_dp = true;
-                                        DRM_DEBUG("IH: HPD_RX 4\n");
-                                }
+                                if (!(rdev->irq.stat_regs.cik.disp_int_cont3 & DC_HPD4_RX_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.cik.disp_int_cont3 &= ~DC_HPD4_RX_INTERRUPT;
+                                queue_dp = true;
+                                DRM_DEBUG("IH: HPD_RX 4\n");
+
                                 break;
                         case 10:
-                                if (rdev->irq.stat_regs.cik.disp_int_cont4 & DC_HPD5_RX_INTERRUPT) {
-                                        rdev->irq.stat_regs.cik.disp_int_cont4 &= ~DC_HPD5_RX_INTERRUPT;
-                                        queue_dp = true;
-                                        DRM_DEBUG("IH: HPD_RX 5\n");
-                                }
+                                if (!(rdev->irq.stat_regs.cik.disp_int_cont4 & DC_HPD5_RX_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.cik.disp_int_cont4 &= ~DC_HPD5_RX_INTERRUPT;
+                                queue_dp = true;
+                                DRM_DEBUG("IH: HPD_RX 5\n");
+
                                 break;
                         case 11:
-                                if (rdev->irq.stat_regs.cik.disp_int_cont5 & DC_HPD6_RX_INTERRUPT) {
-                                        rdev->irq.stat_regs.cik.disp_int_cont5 &= ~DC_HPD6_RX_INTERRUPT;
-                                        queue_dp = true;
-                                        DRM_DEBUG("IH: HPD_RX 6\n");
-                                }
+                                if (!(rdev->irq.stat_regs.cik.disp_int_cont5 & DC_HPD6_RX_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.cik.disp_int_cont5 &= ~DC_HPD6_RX_INTERRUPT;
+                                queue_dp = true;
+                                DRM_DEBUG("IH: HPD_RX 6\n");
+
                                 break;
                         default:
                                 DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index 3a6d483a2c36..0acde1949c18 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -4924,7 +4924,7 @@ restart_ih:
                 return IRQ_NONE;
 
         rptr = rdev->ih.rptr;
-        DRM_DEBUG("r600_irq_process start: rptr %d, wptr %d\n", rptr, wptr);
+        DRM_DEBUG("evergreen_irq_process start: rptr %d, wptr %d\n", rptr, wptr);
 
         /* Order reading of wptr vs. reading of IH ring data */
         rmb();
@@ -4942,23 +4942,27 @@ restart_ih:
                 case 1: /* D1 vblank/vline */
                         switch (src_data) {
                         case 0: /* D1 vblank */
-                                if (rdev->irq.stat_regs.evergreen.disp_int & LB_D1_VBLANK_INTERRUPT) {
-                                        if (rdev->irq.crtc_vblank_int[0]) {
-                                                drm_handle_vblank(rdev->ddev, 0);
-                                                rdev->pm.vblank_sync = true;
-                                                wake_up(&rdev->irq.vblank_queue);
-                                        }
-                                        if (atomic_read(&rdev->irq.pflip[0]))
-                                                radeon_crtc_handle_vblank(rdev, 0);
-                                        rdev->irq.stat_regs.evergreen.disp_int &= ~LB_D1_VBLANK_INTERRUPT;
-                                        DRM_DEBUG("IH: D1 vblank\n");
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int & LB_D1_VBLANK_INTERRUPT))
+                                        DRM_DEBUG("IH: D1 vblank - IH event w/o asserted irq bit?\n");
+
+                                if (rdev->irq.crtc_vblank_int[0]) {
+                                        drm_handle_vblank(rdev->ddev, 0);
+                                        rdev->pm.vblank_sync = true;
+                                        wake_up(&rdev->irq.vblank_queue);
                                 }
+                                if (atomic_read(&rdev->irq.pflip[0]))
+                                        radeon_crtc_handle_vblank(rdev, 0);
+                                rdev->irq.stat_regs.evergreen.disp_int &= ~LB_D1_VBLANK_INTERRUPT;
+                                DRM_DEBUG("IH: D1 vblank\n");
+
                                 break;
                         case 1: /* D1 vline */
-                                if (rdev->irq.stat_regs.evergreen.disp_int & LB_D1_VLINE_INTERRUPT) {
-                                        rdev->irq.stat_regs.evergreen.disp_int &= ~LB_D1_VLINE_INTERRUPT;
-                                        DRM_DEBUG("IH: D1 vline\n");
-                                }
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int & LB_D1_VLINE_INTERRUPT))
+                                        DRM_DEBUG("IH: D1 vline - IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.evergreen.disp_int &= ~LB_D1_VLINE_INTERRUPT;
+                                DRM_DEBUG("IH: D1 vline\n");
+
                                 break;
                         default:
                                 DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
@@ -4968,23 +4972,27 @@ restart_ih:
                 case 2: /* D2 vblank/vline */
                         switch (src_data) {
                         case 0: /* D2 vblank */
-                                if (rdev->irq.stat_regs.evergreen.disp_int_cont & LB_D2_VBLANK_INTERRUPT) {
-                                        if (rdev->irq.crtc_vblank_int[1]) {
-                                                drm_handle_vblank(rdev->ddev, 1);
-                                                rdev->pm.vblank_sync = true;
-                                                wake_up(&rdev->irq.vblank_queue);
-                                        }
-                                        if (atomic_read(&rdev->irq.pflip[1]))
-                                                radeon_crtc_handle_vblank(rdev, 1);
-                                        rdev->irq.stat_regs.evergreen.disp_int_cont &= ~LB_D2_VBLANK_INTERRUPT;
-                                        DRM_DEBUG("IH: D2 vblank\n");
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int_cont & LB_D2_VBLANK_INTERRUPT))
+                                        DRM_DEBUG("IH: D2 vblank - IH event w/o asserted irq bit?\n");
+
+                                if (rdev->irq.crtc_vblank_int[1]) {
+                                        drm_handle_vblank(rdev->ddev, 1);
+                                        rdev->pm.vblank_sync = true;
+                                        wake_up(&rdev->irq.vblank_queue);
                                 }
+                                if (atomic_read(&rdev->irq.pflip[1]))
+                                        radeon_crtc_handle_vblank(rdev, 1);
+                                rdev->irq.stat_regs.evergreen.disp_int_cont &= ~LB_D2_VBLANK_INTERRUPT;
+                                DRM_DEBUG("IH: D2 vblank\n");
+
                                 break;
                         case 1: /* D2 vline */
-                                if (rdev->irq.stat_regs.evergreen.disp_int_cont & LB_D2_VLINE_INTERRUPT) {
-                                        rdev->irq.stat_regs.evergreen.disp_int_cont &= ~LB_D2_VLINE_INTERRUPT;
-                                        DRM_DEBUG("IH: D2 vline\n");
-                                }
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int_cont & LB_D2_VLINE_INTERRUPT))
+                                        DRM_DEBUG("IH: D2 vline - IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.evergreen.disp_int_cont &= ~LB_D2_VLINE_INTERRUPT;
+                                DRM_DEBUG("IH: D2 vline\n");
+
                                 break;
                         default:
                                 DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
@@ -4994,23 +5002,27 @@ restart_ih:
                 case 3: /* D3 vblank/vline */
                         switch (src_data) {
                         case 0: /* D3 vblank */
-                                if (rdev->irq.stat_regs.evergreen.disp_int_cont2 & LB_D3_VBLANK_INTERRUPT) {
-                                        if (rdev->irq.crtc_vblank_int[2]) {
-                                                drm_handle_vblank(rdev->ddev, 2);
-                                                rdev->pm.vblank_sync = true;
-                                                wake_up(&rdev->irq.vblank_queue);
-                                        }
-                                        if (atomic_read(&rdev->irq.pflip[2]))
-                                                radeon_crtc_handle_vblank(rdev, 2);
-                                        rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~LB_D3_VBLANK_INTERRUPT;
-                                        DRM_DEBUG("IH: D3 vblank\n");
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int_cont2 & LB_D3_VBLANK_INTERRUPT))
+                                        DRM_DEBUG("IH: D3 vblank - IH event w/o asserted irq bit?\n");
+
+                                if (rdev->irq.crtc_vblank_int[2]) {
+                                        drm_handle_vblank(rdev->ddev, 2);
+                                        rdev->pm.vblank_sync = true;
+                                        wake_up(&rdev->irq.vblank_queue);
                                 }
+                                if (atomic_read(&rdev->irq.pflip[2]))
+                                        radeon_crtc_handle_vblank(rdev, 2);
+                                rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~LB_D3_VBLANK_INTERRUPT;
+                                DRM_DEBUG("IH: D3 vblank\n");
+
                                 break;
                         case 1: /* D3 vline */
-                                if (rdev->irq.stat_regs.evergreen.disp_int_cont2 & LB_D3_VLINE_INTERRUPT) {
-                                        rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~LB_D3_VLINE_INTERRUPT;
-                                        DRM_DEBUG("IH: D3 vline\n");
-                                }
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int_cont2 & LB_D3_VLINE_INTERRUPT))
+                                        DRM_DEBUG("IH: D3 vline - IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~LB_D3_VLINE_INTERRUPT;
+                                DRM_DEBUG("IH: D3 vline\n");
+
                                 break;
                         default:
                                 DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
@@ -5020,23 +5032,27 @@ restart_ih:
                 case 4: /* D4 vblank/vline */
                         switch (src_data) {
                         case 0: /* D4 vblank */
-                                if (rdev->irq.stat_regs.evergreen.disp_int_cont3 & LB_D4_VBLANK_INTERRUPT) {
-                                        if (rdev->irq.crtc_vblank_int[3]) {
-                                                drm_handle_vblank(rdev->ddev, 3);
-                                                rdev->pm.vblank_sync = true;
-                                                wake_up(&rdev->irq.vblank_queue);
-                                        }
-                                        if (atomic_read(&rdev->irq.pflip[3]))
-                                                radeon_crtc_handle_vblank(rdev, 3);
-                                        rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~LB_D4_VBLANK_INTERRUPT;
-                                        DRM_DEBUG("IH: D4 vblank\n");
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int_cont3 & LB_D4_VBLANK_INTERRUPT))
+                                        DRM_DEBUG("IH: D4 vblank - IH event w/o asserted irq bit?\n");
+
+                                if (rdev->irq.crtc_vblank_int[3]) {
+                                        drm_handle_vblank(rdev->ddev, 3);
+                                        rdev->pm.vblank_sync = true;
+                                        wake_up(&rdev->irq.vblank_queue);
                                 }
+                                if (atomic_read(&rdev->irq.pflip[3]))
+                                        radeon_crtc_handle_vblank(rdev, 3);
+                                rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~LB_D4_VBLANK_INTERRUPT;
+                                DRM_DEBUG("IH: D4 vblank\n");
+
                                 break;
                         case 1: /* D4 vline */
-                                if (rdev->irq.stat_regs.evergreen.disp_int_cont3 & LB_D4_VLINE_INTERRUPT) {
-                                        rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~LB_D4_VLINE_INTERRUPT;
-                                        DRM_DEBUG("IH: D4 vline\n");
-                                }
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int_cont3 & LB_D4_VLINE_INTERRUPT))
+                                        DRM_DEBUG("IH: D4 vline - IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~LB_D4_VLINE_INTERRUPT;
+                                DRM_DEBUG("IH: D4 vline\n");
+
                                 break;
                         default:
                                 DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
@@ -5046,23 +5062,27 @@ restart_ih:
                 case 5: /* D5 vblank/vline */
                         switch (src_data) {
                         case 0: /* D5 vblank */
-                                if (rdev->irq.stat_regs.evergreen.disp_int_cont4 & LB_D5_VBLANK_INTERRUPT) {
-                                        if (rdev->irq.crtc_vblank_int[4]) {
-                                                drm_handle_vblank(rdev->ddev, 4);
-                                                rdev->pm.vblank_sync = true;
-                                                wake_up(&rdev->irq.vblank_queue);
-                                        }
-                                        if (atomic_read(&rdev->irq.pflip[4]))
-                                                radeon_crtc_handle_vblank(rdev, 4);
-                                        rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~LB_D5_VBLANK_INTERRUPT;
-                                        DRM_DEBUG("IH: D5 vblank\n");
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int_cont4 & LB_D5_VBLANK_INTERRUPT))
+                                        DRM_DEBUG("IH: D5 vblank - IH event w/o asserted irq bit?\n");
+
+                                if (rdev->irq.crtc_vblank_int[4]) {
+                                        drm_handle_vblank(rdev->ddev, 4);
+                                        rdev->pm.vblank_sync = true;
+                                        wake_up(&rdev->irq.vblank_queue);
                                 }
+                                if (atomic_read(&rdev->irq.pflip[4]))
+                                        radeon_crtc_handle_vblank(rdev, 4);
+                                rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~LB_D5_VBLANK_INTERRUPT;
+                                DRM_DEBUG("IH: D5 vblank\n");
+
                                 break;
                         case 1: /* D5 vline */
-                                if (rdev->irq.stat_regs.evergreen.disp_int_cont4 & LB_D5_VLINE_INTERRUPT) {
-                                        rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~LB_D5_VLINE_INTERRUPT;
-                                        DRM_DEBUG("IH: D5 vline\n");
-                                }
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int_cont4 & LB_D5_VLINE_INTERRUPT))
+                                        DRM_DEBUG("IH: D5 vline - IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~LB_D5_VLINE_INTERRUPT;
+                                DRM_DEBUG("IH: D5 vline\n");
+
                                 break;
                         default:
                                 DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
@@ -5072,23 +5092,27 @@ restart_ih:
                 case 6: /* D6 vblank/vline */
                         switch (src_data) {
                         case 0: /* D6 vblank */
-                                if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & LB_D6_VBLANK_INTERRUPT) {
-                                        if (rdev->irq.crtc_vblank_int[5]) {
-                                                drm_handle_vblank(rdev->ddev, 5);
-                                                rdev->pm.vblank_sync = true;
-                                                wake_up(&rdev->irq.vblank_queue);
-                                        }
-                                        if (atomic_read(&rdev->irq.pflip[5]))
-                                                radeon_crtc_handle_vblank(rdev, 5);
-                                        rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~LB_D6_VBLANK_INTERRUPT;
-                                        DRM_DEBUG("IH: D6 vblank\n");
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int_cont5 & LB_D6_VBLANK_INTERRUPT))
+                                        DRM_DEBUG("IH: D6 vblank - IH event w/o asserted irq bit?\n");
+
+                                if (rdev->irq.crtc_vblank_int[5]) {
+                                        drm_handle_vblank(rdev->ddev, 5);
+                                        rdev->pm.vblank_sync = true;
+                                        wake_up(&rdev->irq.vblank_queue);
                                 }
+                                if (atomic_read(&rdev->irq.pflip[5]))
+                                        radeon_crtc_handle_vblank(rdev, 5);
+                                rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~LB_D6_VBLANK_INTERRUPT;
+                                DRM_DEBUG("IH: D6 vblank\n");
+
                                 break;
                         case 1: /* D6 vline */
-                                if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & LB_D6_VLINE_INTERRUPT) {
-                                        rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~LB_D6_VLINE_INTERRUPT;
-                                        DRM_DEBUG("IH: D6 vline\n");
-                                }
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int_cont5 & LB_D6_VLINE_INTERRUPT))
+                                        DRM_DEBUG("IH: D6 vline - IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~LB_D6_VLINE_INTERRUPT;
+                                DRM_DEBUG("IH: D6 vline\n");
+
                                 break;
                         default:
                                 DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
@@ -5108,88 +5132,100 @@ restart_ih:
                 case 42: /* HPD hotplug */
                         switch (src_data) {
                         case 0:
-                                if (rdev->irq.stat_regs.evergreen.disp_int & DC_HPD1_INTERRUPT) {
-                                        rdev->irq.stat_regs.evergreen.disp_int &= ~DC_HPD1_INTERRUPT;
-                                        queue_hotplug = true;
-                                        DRM_DEBUG("IH: HPD1\n");
-                                }
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int & DC_HPD1_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.evergreen.disp_int &= ~DC_HPD1_INTERRUPT;
+                                queue_hotplug = true;
+                                DRM_DEBUG("IH: HPD1\n");
                                 break;
                         case 1:
-                                if (rdev->irq.stat_regs.evergreen.disp_int_cont & DC_HPD2_INTERRUPT) {
-                                        rdev->irq.stat_regs.evergreen.disp_int_cont &= ~DC_HPD2_INTERRUPT;
-                                        queue_hotplug = true;
-                                        DRM_DEBUG("IH: HPD2\n");
-                                }
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int_cont & DC_HPD2_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.evergreen.disp_int_cont &= ~DC_HPD2_INTERRUPT;
+                                queue_hotplug = true;
+                                DRM_DEBUG("IH: HPD2\n");
                                 break;
                         case 2:
-                                if (rdev->irq.stat_regs.evergreen.disp_int_cont2 & DC_HPD3_INTERRUPT) {
-                                        rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~DC_HPD3_INTERRUPT;
-                                        queue_hotplug = true;
-                                        DRM_DEBUG("IH: HPD3\n");
-                                }
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int_cont2 & DC_HPD3_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~DC_HPD3_INTERRUPT;
+                                queue_hotplug = true;
+                                DRM_DEBUG("IH: HPD3\n");
                                 break;
                         case 3:
-                                if (rdev->irq.stat_regs.evergreen.disp_int_cont3 & DC_HPD4_INTERRUPT) {
-                                        rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~DC_HPD4_INTERRUPT;
-                                        queue_hotplug = true;
-                                        DRM_DEBUG("IH: HPD4\n");
-                                }
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int_cont3 & DC_HPD4_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~DC_HPD4_INTERRUPT;
+                                queue_hotplug = true;
+                                DRM_DEBUG("IH: HPD4\n");
                                 break;
                         case 4:
-                                if (rdev->irq.stat_regs.evergreen.disp_int_cont4 & DC_HPD5_INTERRUPT) {
-                                        rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~DC_HPD5_INTERRUPT;
-                                        queue_hotplug = true;
-                                        DRM_DEBUG("IH: HPD5\n");
-                                }
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int_cont4 & DC_HPD5_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~DC_HPD5_INTERRUPT;
+                                queue_hotplug = true;
+                                DRM_DEBUG("IH: HPD5\n");
                                 break;
                         case 5:
-                                if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_INTERRUPT) {
-                                        rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~DC_HPD6_INTERRUPT;
-                                        queue_hotplug = true;
-                                        DRM_DEBUG("IH: HPD6\n");
-                                }
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~DC_HPD6_INTERRUPT;
+                                queue_hotplug = true;
+                                DRM_DEBUG("IH: HPD6\n");
                                 break;
                         case 6:
-                                if (rdev->irq.stat_regs.evergreen.disp_int & DC_HPD1_RX_INTERRUPT) {
-                                        rdev->irq.stat_regs.evergreen.disp_int &= ~DC_HPD1_RX_INTERRUPT;
-                                        queue_dp = true;
-                                        DRM_DEBUG("IH: HPD_RX 1\n");
-                                }
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int & DC_HPD1_RX_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.evergreen.disp_int &= ~DC_HPD1_RX_INTERRUPT;
+                                queue_dp = true;
+                                DRM_DEBUG("IH: HPD_RX 1\n");
                                 break;
                         case 7:
-                                if (rdev->irq.stat_regs.evergreen.disp_int_cont & DC_HPD2_RX_INTERRUPT) {
-                                        rdev->irq.stat_regs.evergreen.disp_int_cont &= ~DC_HPD2_RX_INTERRUPT;
-                                        queue_dp = true;
-                                        DRM_DEBUG("IH: HPD_RX 2\n");
-                                }
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int_cont & DC_HPD2_RX_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.evergreen.disp_int_cont &= ~DC_HPD2_RX_INTERRUPT;
+                                queue_dp = true;
+                                DRM_DEBUG("IH: HPD_RX 2\n");
                                 break;
                         case 8:
-                                if (rdev->irq.stat_regs.evergreen.disp_int_cont2 & DC_HPD3_RX_INTERRUPT) {
-                                        rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~DC_HPD3_RX_INTERRUPT;
-                                        queue_dp = true;
-                                        DRM_DEBUG("IH: HPD_RX 3\n");
-                                }
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int_cont2 & DC_HPD3_RX_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~DC_HPD3_RX_INTERRUPT;
+                                queue_dp = true;
+                                DRM_DEBUG("IH: HPD_RX 3\n");
                                 break;
                         case 9:
-                                if (rdev->irq.stat_regs.evergreen.disp_int_cont3 & DC_HPD4_RX_INTERRUPT) {
-                                        rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~DC_HPD4_RX_INTERRUPT;
-                                        queue_dp = true;
-                                        DRM_DEBUG("IH: HPD_RX 4\n");
-                                }
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int_cont3 & DC_HPD4_RX_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~DC_HPD4_RX_INTERRUPT;
+                                queue_dp = true;
+                                DRM_DEBUG("IH: HPD_RX 4\n");
                                 break;
                         case 10:
-                                if (rdev->irq.stat_regs.evergreen.disp_int_cont4 & DC_HPD5_RX_INTERRUPT) {
-                                        rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~DC_HPD5_RX_INTERRUPT;
-                                        queue_dp = true;
-                                        DRM_DEBUG("IH: HPD_RX 5\n");
-                                }
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int_cont4 & DC_HPD5_RX_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~DC_HPD5_RX_INTERRUPT;
+                                queue_dp = true;
+                                DRM_DEBUG("IH: HPD_RX 5\n");
                                 break;
                         case 11:
-                                if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_RX_INTERRUPT) {
-                                        rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~DC_HPD6_RX_INTERRUPT;
-                                        queue_dp = true;
-                                        DRM_DEBUG("IH: HPD_RX 6\n");
-                                }
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_RX_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~DC_HPD6_RX_INTERRUPT;
+                                queue_dp = true;
+                                DRM_DEBUG("IH: HPD_RX 6\n");
                                 break;
                         default:
                                 DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
@@ -5199,46 +5235,52 @@ restart_ih:
                 case 44: /* hdmi */
                         switch (src_data) {
                         case 0:
-                                if (rdev->irq.stat_regs.evergreen.afmt_status1 & AFMT_AZ_FORMAT_WTRIG) {
-                                        rdev->irq.stat_regs.evergreen.afmt_status1 &= ~AFMT_AZ_FORMAT_WTRIG;
-                                        queue_hdmi = true;
-                                        DRM_DEBUG("IH: HDMI0\n");
-                                }
+                                if (!(rdev->irq.stat_regs.evergreen.afmt_status1 & AFMT_AZ_FORMAT_WTRIG))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.evergreen.afmt_status1 &= ~AFMT_AZ_FORMAT_WTRIG;
+                                queue_hdmi = true;
+                                DRM_DEBUG("IH: HDMI0\n");
                                 break;
                         case 1:
-                                if (rdev->irq.stat_regs.evergreen.afmt_status2 & AFMT_AZ_FORMAT_WTRIG) {
-                                        rdev->irq.stat_regs.evergreen.afmt_status2 &= ~AFMT_AZ_FORMAT_WTRIG;
-                                        queue_hdmi = true;
-                                        DRM_DEBUG("IH: HDMI1\n");
-                                }
+                                if (!(rdev->irq.stat_regs.evergreen.afmt_status2 & AFMT_AZ_FORMAT_WTRIG))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.evergreen.afmt_status2 &= ~AFMT_AZ_FORMAT_WTRIG;
+                                queue_hdmi = true;
+                                DRM_DEBUG("IH: HDMI1\n");
                                 break;
                         case 2:
-                                if (rdev->irq.stat_regs.evergreen.afmt_status3 & AFMT_AZ_FORMAT_WTRIG) {
-                                        rdev->irq.stat_regs.evergreen.afmt_status3 &= ~AFMT_AZ_FORMAT_WTRIG;
-                                        queue_hdmi = true;
-                                        DRM_DEBUG("IH: HDMI2\n");
-                                }
+                                if (!(rdev->irq.stat_regs.evergreen.afmt_status3 & AFMT_AZ_FORMAT_WTRIG))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.evergreen.afmt_status3 &= ~AFMT_AZ_FORMAT_WTRIG;
+                                queue_hdmi = true;
+                                DRM_DEBUG("IH: HDMI2\n");
                                 break;
                         case 3:
-                                if (rdev->irq.stat_regs.evergreen.afmt_status4 & AFMT_AZ_FORMAT_WTRIG) {
-                                        rdev->irq.stat_regs.evergreen.afmt_status4 &= ~AFMT_AZ_FORMAT_WTRIG;
-                                        queue_hdmi = true;
-                                        DRM_DEBUG("IH: HDMI3\n");
-                                }
+                                if (!(rdev->irq.stat_regs.evergreen.afmt_status4 & AFMT_AZ_FORMAT_WTRIG))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.evergreen.afmt_status4 &= ~AFMT_AZ_FORMAT_WTRIG;
+                                queue_hdmi = true;
+                                DRM_DEBUG("IH: HDMI3\n");
                                 break;
                         case 4:
-                                if (rdev->irq.stat_regs.evergreen.afmt_status5 & AFMT_AZ_FORMAT_WTRIG) {
-                                        rdev->irq.stat_regs.evergreen.afmt_status5 &= ~AFMT_AZ_FORMAT_WTRIG;
-                                        queue_hdmi = true;
-                                        DRM_DEBUG("IH: HDMI4\n");
-                                }
+                                if (!(rdev->irq.stat_regs.evergreen.afmt_status5 & AFMT_AZ_FORMAT_WTRIG))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.evergreen.afmt_status5 &= ~AFMT_AZ_FORMAT_WTRIG;
+                                queue_hdmi = true;
+                                DRM_DEBUG("IH: HDMI4\n");
                                 break;
                         case 5:
-                                if (rdev->irq.stat_regs.evergreen.afmt_status6 & AFMT_AZ_FORMAT_WTRIG) {
-                                        rdev->irq.stat_regs.evergreen.afmt_status6 &= ~AFMT_AZ_FORMAT_WTRIG;
-                                        queue_hdmi = true;
-                                        DRM_DEBUG("IH: HDMI5\n");
-                                }
+                                if (!(rdev->irq.stat_regs.evergreen.afmt_status6 & AFMT_AZ_FORMAT_WTRIG))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.evergreen.afmt_status6 &= ~AFMT_AZ_FORMAT_WTRIG;
+                                queue_hdmi = true;
+                                DRM_DEBUG("IH: HDMI5\n");
                                 break;
                         default:
                                 DRM_ERROR("Unhandled interrupt: %d %d\n", src_id, src_data);
diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
index 8e5aeeb058a5..158872eb78e4 100644
--- a/drivers/gpu/drm/radeon/ni.c
+++ b/drivers/gpu/drm/radeon/ni.c
@@ -2162,18 +2162,20 @@ static int cayman_startup(struct radeon_device *rdev)
                         DRM_ERROR("radeon: failed initializing UVD (%d).\n", r);
         }
 
-        ring = &rdev->ring[TN_RING_TYPE_VCE1_INDEX];
-        if (ring->ring_size)
-                r = radeon_ring_init(rdev, ring, ring->ring_size, 0, 0x0);
+        if (rdev->family == CHIP_ARUBA) {
+                ring = &rdev->ring[TN_RING_TYPE_VCE1_INDEX];
+                if (ring->ring_size)
+                        r = radeon_ring_init(rdev, ring, ring->ring_size, 0, 0x0);
 
-        ring = &rdev->ring[TN_RING_TYPE_VCE2_INDEX];
-        if (ring->ring_size)
-                r = radeon_ring_init(rdev, ring, ring->ring_size, 0, 0x0);
+                ring = &rdev->ring[TN_RING_TYPE_VCE2_INDEX];
+                if (ring->ring_size)
+                        r = radeon_ring_init(rdev, ring, ring->ring_size, 0, 0x0);
 
-        if (!r)
-                r = vce_v1_0_init(rdev);
-        else if (r != -ENOENT)
-                DRM_ERROR("radeon: failed initializing VCE (%d).\n", r);
+                if (!r)
+                        r = vce_v1_0_init(rdev);
+                if (r)
+                        DRM_ERROR("radeon: failed initializing VCE (%d).\n", r);
+        }
 
         r = radeon_ib_pool_init(rdev);
         if (r) {
@@ -2396,7 +2398,8 @@ void cayman_fini(struct radeon_device *rdev)
         radeon_irq_kms_fini(rdev);
         uvd_v1_0_fini(rdev);
         radeon_uvd_fini(rdev);
-        radeon_vce_fini(rdev);
+        if (rdev->family == CHIP_ARUBA)
+                radeon_vce_fini(rdev);
         cayman_pcie_gart_fini(rdev);
         r600_vram_scratch_fini(rdev);
         radeon_gem_fini(rdev);
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index 35dafd77a639..4ea5b10ff5f4 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -4086,23 +4086,27 @@ restart_ih:
                 case 1: /* D1 vblank/vline */
                         switch (src_data) {
                         case 0: /* D1 vblank */
-                                if (rdev->irq.stat_regs.r600.disp_int & LB_D1_VBLANK_INTERRUPT) {
-                                        if (rdev->irq.crtc_vblank_int[0]) {
-                                                drm_handle_vblank(rdev->ddev, 0);
-                                                rdev->pm.vblank_sync = true;
-                                                wake_up(&rdev->irq.vblank_queue);
-                                        }
-                                        if (atomic_read(&rdev->irq.pflip[0]))
-                                                radeon_crtc_handle_vblank(rdev, 0);
-                                        rdev->irq.stat_regs.r600.disp_int &= ~LB_D1_VBLANK_INTERRUPT;
-                                        DRM_DEBUG("IH: D1 vblank\n");
+                                if (!(rdev->irq.stat_regs.r600.disp_int & LB_D1_VBLANK_INTERRUPT))
+                                        DRM_DEBUG("IH: D1 vblank - IH event w/o asserted irq bit?\n");
+
+                                if (rdev->irq.crtc_vblank_int[0]) {
+                                        drm_handle_vblank(rdev->ddev, 0);
+                                        rdev->pm.vblank_sync = true;
+                                        wake_up(&rdev->irq.vblank_queue);
                                 }
+                                if (atomic_read(&rdev->irq.pflip[0]))
+                                        radeon_crtc_handle_vblank(rdev, 0);
+                                rdev->irq.stat_regs.r600.disp_int &= ~LB_D1_VBLANK_INTERRUPT;
+                                DRM_DEBUG("IH: D1 vblank\n");
+
                                 break;
                         case 1: /* D1 vline */
-                                if (rdev->irq.stat_regs.r600.disp_int & LB_D1_VLINE_INTERRUPT) {
-                                        rdev->irq.stat_regs.r600.disp_int &= ~LB_D1_VLINE_INTERRUPT;
-                                        DRM_DEBUG("IH: D1 vline\n");
-                                }
+                                if (!(rdev->irq.stat_regs.r600.disp_int & LB_D1_VLINE_INTERRUPT))
+                                    DRM_DEBUG("IH: D1 vline - IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.r600.disp_int &= ~LB_D1_VLINE_INTERRUPT;
+                                DRM_DEBUG("IH: D1 vline\n");
+
                                 break;
                         default:
                                 DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
@@ -4112,23 +4116,27 @@ restart_ih:
                 case 5: /* D2 vblank/vline */
                         switch (src_data) {
                         case 0: /* D2 vblank */
-                                if (rdev->irq.stat_regs.r600.disp_int & LB_D2_VBLANK_INTERRUPT) {
-                                        if (rdev->irq.crtc_vblank_int[1]) {
-                                                drm_handle_vblank(rdev->ddev, 1);
-                                                rdev->pm.vblank_sync = true;
-                                                wake_up(&rdev->irq.vblank_queue);
-                                        }
-                                        if (atomic_read(&rdev->irq.pflip[1]))
-                                                radeon_crtc_handle_vblank(rdev, 1);
-                                        rdev->irq.stat_regs.r600.disp_int &= ~LB_D2_VBLANK_INTERRUPT;
-                                        DRM_DEBUG("IH: D2 vblank\n");
+                                if (!(rdev->irq.stat_regs.r600.disp_int & LB_D2_VBLANK_INTERRUPT))
+                                        DRM_DEBUG("IH: D2 vblank - IH event w/o asserted irq bit?\n");
+
+                                if (rdev->irq.crtc_vblank_int[1]) {
+                                        drm_handle_vblank(rdev->ddev, 1);
+                                        rdev->pm.vblank_sync = true;
+                                        wake_up(&rdev->irq.vblank_queue);
                                 }
+                                if (atomic_read(&rdev->irq.pflip[1]))
+                                        radeon_crtc_handle_vblank(rdev, 1);
+                                rdev->irq.stat_regs.r600.disp_int &= ~LB_D2_VBLANK_INTERRUPT;
+                                DRM_DEBUG("IH: D2 vblank\n");
+
                                 break;
                         case 1: /* D1 vline */
-                                if (rdev->irq.stat_regs.r600.disp_int & LB_D2_VLINE_INTERRUPT) {
-                                        rdev->irq.stat_regs.r600.disp_int &= ~LB_D2_VLINE_INTERRUPT;
-                                        DRM_DEBUG("IH: D2 vline\n");
-                                }
+                                if (!(rdev->irq.stat_regs.r600.disp_int & LB_D2_VLINE_INTERRUPT))
+                                        DRM_DEBUG("IH: D2 vline - IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.r600.disp_int &= ~LB_D2_VLINE_INTERRUPT;
+                                DRM_DEBUG("IH: D2 vline\n");
+
                                 break;
                         default:
                                 DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
@@ -4148,46 +4156,53 @@ restart_ih:
                 case 19: /* HPD/DAC hotplug */
                         switch (src_data) {
                         case 0:
-                                if (rdev->irq.stat_regs.r600.disp_int & DC_HPD1_INTERRUPT) {
-                                        rdev->irq.stat_regs.r600.disp_int &= ~DC_HPD1_INTERRUPT;
-                                        queue_hotplug = true;
-                                        DRM_DEBUG("IH: HPD1\n");
-                                }
+                                if (!(rdev->irq.stat_regs.r600.disp_int & DC_HPD1_INTERRUPT))
+                                        DRM_DEBUG("IH: HPD1 - IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.r600.disp_int &= ~DC_HPD1_INTERRUPT;
+                                queue_hotplug = true;
+                                DRM_DEBUG("IH: HPD1\n");
                                 break;
                         case 1:
-                                if (rdev->irq.stat_regs.r600.disp_int & DC_HPD2_INTERRUPT) {
-                                        rdev->irq.stat_regs.r600.disp_int &= ~DC_HPD2_INTERRUPT;
-                                        queue_hotplug = true;
-                                        DRM_DEBUG("IH: HPD2\n");
-                                }
+                                if (!(rdev->irq.stat_regs.r600.disp_int & DC_HPD2_INTERRUPT))
+                                        DRM_DEBUG("IH: HPD2 - IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.r600.disp_int &= ~DC_HPD2_INTERRUPT;
+                                queue_hotplug = true;
+                                DRM_DEBUG("IH: HPD2\n");
                                 break;
                         case 4:
-                                if (rdev->irq.stat_regs.r600.disp_int_cont & DC_HPD3_INTERRUPT) {
-                                        rdev->irq.stat_regs.r600.disp_int_cont &= ~DC_HPD3_INTERRUPT;
-                                        queue_hotplug = true;
-                                        DRM_DEBUG("IH: HPD3\n");
-                                }
+                                if (!(rdev->irq.stat_regs.r600.disp_int_cont & DC_HPD3_INTERRUPT))
+                                        DRM_DEBUG("IH: HPD3 - IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.r600.disp_int_cont &= ~DC_HPD3_INTERRUPT;
+                                queue_hotplug = true;
+                                DRM_DEBUG("IH: HPD3\n");
                                 break;
                         case 5:
-                                if (rdev->irq.stat_regs.r600.disp_int_cont & DC_HPD4_INTERRUPT) {
-                                        rdev->irq.stat_regs.r600.disp_int_cont &= ~DC_HPD4_INTERRUPT;
-                                        queue_hotplug = true;
-                                        DRM_DEBUG("IH: HPD4\n");
-                                }
+                                if (!(rdev->irq.stat_regs.r600.disp_int_cont & DC_HPD4_INTERRUPT))
+                                        DRM_DEBUG("IH: HPD4 - IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.r600.disp_int_cont &= ~DC_HPD4_INTERRUPT;
+                                queue_hotplug = true;
+                                DRM_DEBUG("IH: HPD4\n");
                                 break;
                         case 10:
-                                if (rdev->irq.stat_regs.r600.disp_int_cont2 & DC_HPD5_INTERRUPT) {
-                                        rdev->irq.stat_regs.r600.disp_int_cont2 &= ~DC_HPD5_INTERRUPT;
-                                        queue_hotplug = true;
-                                        DRM_DEBUG("IH: HPD5\n");
-                                }
+                                if (!(rdev->irq.stat_regs.r600.disp_int_cont2 & DC_HPD5_INTERRUPT))
+                                        DRM_DEBUG("IH: HPD5 - IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.r600.disp_int_cont2 &= ~DC_HPD5_INTERRUPT;
+                                queue_hotplug = true;
+                                DRM_DEBUG("IH: HPD5\n");
                                 break;
                         case 12:
-                                if (rdev->irq.stat_regs.r600.disp_int_cont2 & DC_HPD6_INTERRUPT) {
-                                        rdev->irq.stat_regs.r600.disp_int_cont2 &= ~DC_HPD6_INTERRUPT;
-                                        queue_hotplug = true;
-                                        DRM_DEBUG("IH: HPD6\n");
-                                }
+                                if (!(rdev->irq.stat_regs.r600.disp_int_cont2 & DC_HPD6_INTERRUPT))
+                                        DRM_DEBUG("IH: HPD6 - IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.r600.disp_int_cont2 &= ~DC_HPD6_INTERRUPT;
+                                queue_hotplug = true;
+                                DRM_DEBUG("IH: HPD6\n");
+
                                 break;
                         default:
                                 DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
@@ -4197,18 +4212,22 @@ restart_ih:
                 case 21: /* hdmi */
                         switch (src_data) {
                         case 4:
-                                if (rdev->irq.stat_regs.r600.hdmi0_status & HDMI0_AZ_FORMAT_WTRIG) {
-                                        rdev->irq.stat_regs.r600.hdmi0_status &= ~HDMI0_AZ_FORMAT_WTRIG;
-                                        queue_hdmi = true;
-                                        DRM_DEBUG("IH: HDMI0\n");
-                                }
+                                if (!(rdev->irq.stat_regs.r600.hdmi0_status & HDMI0_AZ_FORMAT_WTRIG))
+                                        DRM_DEBUG("IH: HDMI0 - IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.r600.hdmi0_status &= ~HDMI0_AZ_FORMAT_WTRIG;
+                                queue_hdmi = true;
+                                DRM_DEBUG("IH: HDMI0\n");
+
                                 break;
                         case 5:
-                                if (rdev->irq.stat_regs.r600.hdmi1_status & HDMI0_AZ_FORMAT_WTRIG) {
-                                        rdev->irq.stat_regs.r600.hdmi1_status &= ~HDMI0_AZ_FORMAT_WTRIG;
-                                        queue_hdmi = true;
-                                        DRM_DEBUG("IH: HDMI1\n");
-                                }
+                                if (!(rdev->irq.stat_regs.r600.hdmi1_status & HDMI0_AZ_FORMAT_WTRIG))
+                                        DRM_DEBUG("IH: HDMI1 - IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.r600.hdmi1_status &= ~HDMI0_AZ_FORMAT_WTRIG;
+                                queue_hdmi = true;
+                                DRM_DEBUG("IH: HDMI1\n");
+
                                 break;
                         default:
                                 DRM_ERROR("Unhandled interrupt: %d %d\n", src_id, src_data);
diff --git a/drivers/gpu/drm/radeon/r600_cp.c b/drivers/gpu/drm/radeon/r600_cp.c
index 09e3f39925fa..98f9adaccc3d 100644
--- a/drivers/gpu/drm/radeon/r600_cp.c
+++ b/drivers/gpu/drm/radeon/r600_cp.c
@@ -2483,7 +2483,7 @@ int r600_cp_dispatch_texture(struct drm_device *dev,
         struct drm_buf *buf;
         u32 *buffer;
         const u8 __user *data;
-        int size, pass_size;
+        unsigned int size, pass_size;
         u64 src_offset, dst_offset;
 
         if (!radeon_check_offset(dev_priv, tex->offset)) {
diff --git a/drivers/gpu/drm/radeon/radeon_cursor.c b/drivers/gpu/drm/radeon/radeon_cursor.c
index 45e54060ee97..afaf346bd50e 100644
--- a/drivers/gpu/drm/radeon/radeon_cursor.c
+++ b/drivers/gpu/drm/radeon/radeon_cursor.c
@@ -91,15 +91,34 @@ static void radeon_show_cursor(struct drm_crtc *crtc)
         struct radeon_device *rdev = crtc->dev->dev_private;
 
         if (ASIC_IS_DCE4(rdev)) {
+                WREG32(EVERGREEN_CUR_SURFACE_ADDRESS_HIGH + radeon_crtc->crtc_offset,
+                       upper_32_bits(radeon_crtc->cursor_addr));
+                WREG32(EVERGREEN_CUR_SURFACE_ADDRESS + radeon_crtc->crtc_offset,
+                       lower_32_bits(radeon_crtc->cursor_addr));
                 WREG32(RADEON_MM_INDEX, EVERGREEN_CUR_CONTROL + radeon_crtc->crtc_offset);
                 WREG32(RADEON_MM_DATA, EVERGREEN_CURSOR_EN |
                        EVERGREEN_CURSOR_MODE(EVERGREEN_CURSOR_24_8_PRE_MULT) |
                        EVERGREEN_CURSOR_URGENT_CONTROL(EVERGREEN_CURSOR_URGENT_1_2));
         } else if (ASIC_IS_AVIVO(rdev)) {
+                if (rdev->family >= CHIP_RV770) {
+                        if (radeon_crtc->crtc_id)
+                                WREG32(R700_D2CUR_SURFACE_ADDRESS_HIGH,
+                                       upper_32_bits(radeon_crtc->cursor_addr));
+                        else
+                                WREG32(R700_D1CUR_SURFACE_ADDRESS_HIGH,
+                                       upper_32_bits(radeon_crtc->cursor_addr));
+                }
+
+                WREG32(AVIVO_D1CUR_SURFACE_ADDRESS + radeon_crtc->crtc_offset,
+                       lower_32_bits(radeon_crtc->cursor_addr));
                 WREG32(RADEON_MM_INDEX, AVIVO_D1CUR_CONTROL + radeon_crtc->crtc_offset);
                 WREG32(RADEON_MM_DATA, AVIVO_D1CURSOR_EN |
                        (AVIVO_D1CURSOR_MODE_24BPP << AVIVO_D1CURSOR_MODE_SHIFT));
         } else {
+                /* offset is from DISP(2)_BASE_ADDRESS */
+                WREG32(RADEON_CUR_OFFSET + radeon_crtc->crtc_offset,
+                       radeon_crtc->cursor_addr - radeon_crtc->legacy_display_base_addr);
+
                 switch (radeon_crtc->crtc_id) {
                 case 0:
                         WREG32(RADEON_MM_INDEX, RADEON_CRTC_GEN_CNTL);
@@ -205,8 +224,9 @@ static int radeon_cursor_move_locked(struct drm_crtc *crtc, int x, int y)
                         | (x << 16)
                         | y));
                 /* offset is from DISP(2)_BASE_ADDRESS */
-                WREG32(RADEON_CUR_OFFSET + radeon_crtc->crtc_offset, (radeon_crtc->legacy_cursor_offset +
-                                                                      (yorigin * 256)));
+                WREG32(RADEON_CUR_OFFSET + radeon_crtc->crtc_offset,
+                       radeon_crtc->cursor_addr - radeon_crtc->legacy_display_base_addr +
+                       yorigin * 256);
         }
 
         radeon_crtc->cursor_x = x;
@@ -227,53 +247,6 @@ int radeon_crtc_cursor_move(struct drm_crtc *crtc,
         return ret;
 }
 
-static int radeon_set_cursor(struct drm_crtc *crtc, struct drm_gem_object *obj)
-{
-        struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
-        struct radeon_device *rdev = crtc->dev->dev_private;
-        struct radeon_bo *robj = gem_to_radeon_bo(obj);
-        uint64_t gpu_addr;
-        int ret;
-
-        ret = radeon_bo_reserve(robj, false);
-        if (unlikely(ret != 0))
-                goto fail;
-        /* Only 27 bit offset for legacy cursor */
-        ret = radeon_bo_pin_restricted(robj, RADEON_GEM_DOMAIN_VRAM,
-                                       ASIC_IS_AVIVO(rdev) ? 0 : 1 << 27,
-                                       &gpu_addr);
-        radeon_bo_unreserve(robj);
-        if (ret)
-                goto fail;
-
-        if (ASIC_IS_DCE4(rdev)) {
-                WREG32(EVERGREEN_CUR_SURFACE_ADDRESS_HIGH + radeon_crtc->crtc_offset,
-                       upper_32_bits(gpu_addr));
-                WREG32(EVERGREEN_CUR_SURFACE_ADDRESS + radeon_crtc->crtc_offset,
-                       gpu_addr & 0xffffffff);
-        } else if (ASIC_IS_AVIVO(rdev)) {
-                if (rdev->family >= CHIP_RV770) {
-                        if (radeon_crtc->crtc_id)
-                                WREG32(R700_D2CUR_SURFACE_ADDRESS_HIGH, upper_32_bits(gpu_addr));
-                        else
-                                WREG32(R700_D1CUR_SURFACE_ADDRESS_HIGH, upper_32_bits(gpu_addr));
-                }
-                WREG32(AVIVO_D1CUR_SURFACE_ADDRESS + radeon_crtc->crtc_offset,
-                       gpu_addr & 0xffffffff);
-        } else {
-                radeon_crtc->legacy_cursor_offset = gpu_addr - radeon_crtc->legacy_display_base_addr;
-                /* offset is from DISP(2)_BASE_ADDRESS */
-                WREG32(RADEON_CUR_OFFSET + radeon_crtc->crtc_offset, radeon_crtc->legacy_cursor_offset);
-        }
-
-        return 0;
-
-fail:
-        drm_gem_object_unreference_unlocked(obj);
-
-        return ret;
-}
-
 int radeon_crtc_cursor_set2(struct drm_crtc *crtc,
                             struct drm_file *file_priv,
                             uint32_t handle,
@@ -283,7 +256,9 @@ int radeon_crtc_cursor_set2(struct drm_crtc *crtc,
                             int32_t hot_y)
 {
         struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
+        struct radeon_device *rdev = crtc->dev->dev_private;
         struct drm_gem_object *obj;
+        struct radeon_bo *robj;
         int ret;
 
         if (!handle) {
@@ -305,6 +280,23 @@ int radeon_crtc_cursor_set2(struct drm_crtc *crtc,
                 return -ENOENT;
         }
 
+        robj = gem_to_radeon_bo(obj);
+        ret = radeon_bo_reserve(robj, false);
+        if (ret != 0) {
+                drm_gem_object_unreference_unlocked(obj);
+                return ret;
+        }
+        /* Only 27 bit offset for legacy cursor */
+        ret = radeon_bo_pin_restricted(robj, RADEON_GEM_DOMAIN_VRAM,
+                                       ASIC_IS_AVIVO(rdev) ? 0 : 1 << 27,
+                                       &radeon_crtc->cursor_addr);
+        radeon_bo_unreserve(robj);
+        if (ret) {
+                DRM_ERROR("Failed to pin new cursor BO (%d)\n", ret);
+                drm_gem_object_unreference_unlocked(obj);
+                return ret;
+        }
+
         radeon_crtc->cursor_width = width;
         radeon_crtc->cursor_height = height;
 
@@ -323,13 +315,7 @@ int radeon_crtc_cursor_set2(struct drm_crtc *crtc,
                 radeon_crtc->cursor_hot_y = hot_y;
         }
 
-        ret = radeon_set_cursor(crtc, obj);
-
-        if (ret)
-                DRM_ERROR("radeon_set_cursor returned %d, not changing cursor\n",
-                          ret);
-        else
-                radeon_show_cursor(crtc);
+        radeon_show_cursor(crtc);
 
         radeon_lock_cursor(crtc, false);
 
@@ -341,8 +327,7 @@ unpin:
                         radeon_bo_unpin(robj);
                         radeon_bo_unreserve(robj);
                 }
-                if (radeon_crtc->cursor_bo != obj)
-                        drm_gem_object_unreference_unlocked(radeon_crtc->cursor_bo);
+                drm_gem_object_unreference_unlocked(radeon_crtc->cursor_bo);
         }
 
         radeon_crtc->cursor_bo = obj;
@@ -360,7 +345,6 @@ unpin:
 void radeon_cursor_reset(struct drm_crtc *crtc)
 {
         struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
-        int ret;
 
         if (radeon_crtc->cursor_bo) {
                 radeon_lock_cursor(crtc, true);
@@ -368,12 +352,7 @@ void radeon_cursor_reset(struct drm_crtc *crtc)
                 radeon_cursor_move_locked(crtc, radeon_crtc->cursor_x,
                                           radeon_crtc->cursor_y);
 
-                ret = radeon_set_cursor(crtc, radeon_crtc->cursor_bo);
-                if (ret)
-                        DRM_ERROR("radeon_set_cursor returned %d, not showing "
-                                  "cursor\n", ret);
-                else
-                        radeon_show_cursor(crtc);
+                radeon_show_cursor(crtc);
 
                 radeon_lock_cursor(crtc, false);
         }
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index 2593b1168bd6..d8319dae8358 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -1080,6 +1080,22 @@ static bool radeon_check_pot_argument(int arg)
 }
 
 /**
+ * Determine a sensible default GART size according to ASIC family.
+ *
+ * @family ASIC family name
+ */
+static int radeon_gart_size_auto(enum radeon_family family)
+{
+        /* default to a larger gart size on newer asics */
+        if (family >= CHIP_TAHITI)
+                return 2048;
+        else if (family >= CHIP_RV770)
+                return 1024;
+        else
+                return 512;
+}
+
+/**
  * radeon_check_arguments - validate module params
  *
  * @rdev: radeon_device pointer
@@ -1097,27 +1113,17 @@ static void radeon_check_arguments(struct radeon_device *rdev)
         }
 
         if (radeon_gart_size == -1) {
-                /* default to a larger gart size on newer asics */
-                if (rdev->family >= CHIP_RV770)
-                        radeon_gart_size = 1024;
-                else
-                        radeon_gart_size = 512;
+                radeon_gart_size = radeon_gart_size_auto(rdev->family);
         }
         /* gtt size must be power of two and greater or equal to 32M */
         if (radeon_gart_size < 32) {
                 dev_warn(rdev->dev, "gart size (%d) too small\n",
                                 radeon_gart_size);
-                if (rdev->family >= CHIP_RV770)
-                        radeon_gart_size = 1024;
-                else
-                        radeon_gart_size = 512;
+                radeon_gart_size = radeon_gart_size_auto(rdev->family);
         } else if (!radeon_check_pot_argument(radeon_gart_size)) {
                 dev_warn(rdev->dev, "gart size (%d) must be a power of 2\n",
                                 radeon_gart_size);
-                if (rdev->family >= CHIP_RV770)
-                        radeon_gart_size = 1024;
-                else
-                        radeon_gart_size = 512;
+                radeon_gart_size = radeon_gart_size_auto(rdev->family);
         }
         rdev->mc.gtt_size = (uint64_t)radeon_gart_size << 20;
 
@@ -1572,11 +1578,21 @@ int radeon_suspend_kms(struct drm_device *dev, bool suspend, bool fbcon)
                 drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF);
         }
 
-        /* unpin the front buffers */
+        /* unpin the front buffers and cursors */
         list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
+                struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
                 struct radeon_framebuffer *rfb = to_radeon_framebuffer(crtc->primary->fb);
                 struct radeon_bo *robj;
 
+                if (radeon_crtc->cursor_bo) {
+                        struct radeon_bo *robj = gem_to_radeon_bo(radeon_crtc->cursor_bo);
+                        r = radeon_bo_reserve(robj, false);
+                        if (r == 0) {
+                                radeon_bo_unpin(robj);
+                                radeon_bo_unreserve(robj);
+                        }
+                }
+
                 if (rfb == NULL || rfb->obj == NULL) {
                         continue;
                 }
@@ -1639,6 +1655,7 @@ int radeon_resume_kms(struct drm_device *dev, bool resume, bool fbcon)
 {
         struct drm_connector *connector;
         struct radeon_device *rdev = dev->dev_private;
+        struct drm_crtc *crtc;
         int r;
 
         if (dev->switch_power_state == DRM_SWITCH_POWER_OFF)
@@ -1678,6 +1695,27 @@ int radeon_resume_kms(struct drm_device *dev, bool resume, bool fbcon)
 
         radeon_restore_bios_scratch_regs(rdev);
 
+        /* pin cursors */
+        list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
+                struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
+
+                if (radeon_crtc->cursor_bo) {
+                        struct radeon_bo *robj = gem_to_radeon_bo(radeon_crtc->cursor_bo);
+                        r = radeon_bo_reserve(robj, false);
+                        if (r == 0) {
+                                /* Only 27 bit offset for legacy cursor */
+                                r = radeon_bo_pin_restricted(robj,
+                                                             RADEON_GEM_DOMAIN_VRAM,
+                                                             ASIC_IS_AVIVO(rdev) ?
+                                                             0 : 1 << 27,
+                                                             &radeon_crtc->cursor_addr);
+                                if (r != 0)
+                                        DRM_ERROR("Failed to pin cursor BO (%d)\n", r);
+                                radeon_bo_unreserve(robj);
+                        }
+                }
+        }
+
         /* init dig PHYs, disp eng pll */
         if (rdev->is_atom_bios) {
                 radeon_atom_encoder_init(rdev);
diff --git a/drivers/gpu/drm/radeon/radeon_fb.c b/drivers/gpu/drm/radeon/radeon_fb.c
index 634793ea8418..aeb676708e60 100644
--- a/drivers/gpu/drm/radeon/radeon_fb.c
+++ b/drivers/gpu/drm/radeon/radeon_fb.c
@@ -257,6 +257,7 @@ static int radeonfb_create(struct drm_fb_helper *helper,
         }
 
         info->par = rfbdev;
+        info->skip_vt_switch = true;
 
         ret = radeon_framebuffer_init(rdev->ddev, &rfbdev->rfb, &mode_cmd, gobj);
         if (ret) {
diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c
index 5450fa95a47e..c4777c8d0312 100644
--- a/drivers/gpu/drm/radeon/radeon_gart.c
+++ b/drivers/gpu/drm/radeon/radeon_gart.c
@@ -260,8 +260,10 @@ void radeon_gart_unbind(struct radeon_device *rdev, unsigned offset,
                         }
                 }
         }
-        mb();
-        radeon_gart_tlb_flush(rdev);
+        if (rdev->gart.ptr) {
+                mb();
+                radeon_gart_tlb_flush(rdev);
+        }
 }
 
 /**
@@ -306,8 +308,10 @@ int radeon_gart_bind(struct radeon_device *rdev, unsigned offset,
                         page_base += RADEON_GPU_PAGE_SIZE;
                 }
         }
-        mb();
-        radeon_gart_tlb_flush(rdev);
+        if (rdev->gart.ptr) {
+                mb();
+                radeon_gart_tlb_flush(rdev);
+        }
         return 0;
 }
 
diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c
index ac3c1310b953..3dcc5733ff69 100644
--- a/drivers/gpu/drm/radeon/radeon_gem.c
+++ b/drivers/gpu/drm/radeon/radeon_gem.c
@@ -36,6 +36,7 @@ void radeon_gem_object_free(struct drm_gem_object *gobj)
         if (robj) {
                 if (robj->gem_base.import_attach)
                         drm_prime_gem_destroy(&robj->gem_base, robj->tbo.sg);
+                radeon_mn_unregister(robj);
                 radeon_bo_unref(&robj);
         }
 }
@@ -428,7 +429,6 @@ int radeon_gem_mmap_ioctl(struct drm_device *dev, void *data,
 int radeon_gem_busy_ioctl(struct drm_device *dev, void *data,
                           struct drm_file *filp)
 {
-        struct radeon_device *rdev = dev->dev_private;
         struct drm_radeon_gem_busy *args = data;
         struct drm_gem_object *gobj;
         struct radeon_bo *robj;
@@ -440,10 +440,16 @@ int radeon_gem_busy_ioctl(struct drm_device *dev, void *data,
                 return -ENOENT;
         }
         robj = gem_to_radeon_bo(gobj);
-        r = radeon_bo_wait(robj, &cur_placement, true);
+
+        r = reservation_object_test_signaled_rcu(robj->tbo.resv, true);
+        if (r == 0)
+                r = -EBUSY;
+        else
+                r = 0;
+
+        cur_placement = ACCESS_ONCE(robj->tbo.mem.mem_type);
         args->domain = radeon_mem_type_to_domain(cur_placement);
         drm_gem_object_unreference_unlocked(gobj);
-        r = radeon_gem_handle_lockup(rdev, r);
         return r;
 }
 
@@ -471,6 +477,7 @@ int radeon_gem_wait_idle_ioctl(struct drm_device *dev, void *data,
                 r = ret;
 
         /* Flush HDP cache via MMIO if necessary */
+        cur_placement = ACCESS_ONCE(robj->tbo.mem.mem_type);
         if (rdev->asic->mmio_hdp_flush &&
             radeon_mem_type_to_domain(cur_placement) == RADEON_GEM_DOMAIN_VRAM)
                 robj->rdev->asic->mmio_hdp_flush(rdev);
diff --git a/drivers/gpu/drm/radeon/radeon_mode.h b/drivers/gpu/drm/radeon/radeon_mode.h
index 6de5459316b5..07909d817381 100644
--- a/drivers/gpu/drm/radeon/radeon_mode.h
+++ b/drivers/gpu/drm/radeon/radeon_mode.h
@@ -343,7 +343,6 @@ struct radeon_crtc {
         int max_cursor_width;
         int max_cursor_height;
         uint32_t legacy_display_base_addr;
-        uint32_t legacy_cursor_offset;
         enum radeon_rmx_type rmx_type;
         u8 h_border;
         u8 v_border;
diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
index 318165d4855c..676362769b8d 100644
--- a/drivers/gpu/drm/radeon/radeon_object.c
+++ b/drivers/gpu/drm/radeon/radeon_object.c
@@ -75,7 +75,6 @@ static void radeon_ttm_bo_destroy(struct ttm_buffer_object *tbo)
         bo = container_of(tbo, struct radeon_bo, tbo);
 
         radeon_update_memory_usage(bo, bo->tbo.mem.mem_type, -1);
-        radeon_mn_unregister(bo);
 
         mutex_lock(&bo->rdev->gem.mutex);
         list_del_init(&bo->list);
diff --git a/drivers/gpu/drm/radeon/radeon_vm.c b/drivers/gpu/drm/radeon/radeon_vm.c
index ec10533a49b8..48d97c040f49 100644
--- a/drivers/gpu/drm/radeon/radeon_vm.c
+++ b/drivers/gpu/drm/radeon/radeon_vm.c
@@ -493,38 +493,35 @@ int radeon_vm_bo_set_addr(struct radeon_device *rdev,
         }
 
         if (bo_va->it.start || bo_va->it.last) {
-                spin_lock(&vm->status_lock);
-                if (list_empty(&bo_va->vm_status)) {
-                        /* add a clone of the bo_va to clear the old address */
-                        struct radeon_bo_va *tmp;
-                        spin_unlock(&vm->status_lock);
-                        tmp = kzalloc(sizeof(struct radeon_bo_va), GFP_KERNEL);
-                        if (!tmp) {
-                                mutex_unlock(&vm->mutex);
-                                r = -ENOMEM;
-                                goto error_unreserve;
-                        }
-                        tmp->it.start = bo_va->it.start;
-                        tmp->it.last = bo_va->it.last;
-                        tmp->vm = vm;
-                        tmp->bo = radeon_bo_ref(bo_va->bo);
-                        spin_lock(&vm->status_lock);
-                        list_add(&tmp->vm_status, &vm->freed);
+                /* add a clone of the bo_va to clear the old address */
+                struct radeon_bo_va *tmp;
+                tmp = kzalloc(sizeof(struct radeon_bo_va), GFP_KERNEL);
+                if (!tmp) {
+                        mutex_unlock(&vm->mutex);
+                        r = -ENOMEM;
+                        goto error_unreserve;
                 }
-                spin_unlock(&vm->status_lock);
+                tmp->it.start = bo_va->it.start;
+                tmp->it.last = bo_va->it.last;
+                tmp->vm = vm;
+                tmp->bo = radeon_bo_ref(bo_va->bo);
 
                 interval_tree_remove(&bo_va->it, &vm->va);
+                spin_lock(&vm->status_lock);
                 bo_va->it.start = 0;
                 bo_va->it.last = 0;
+                list_del_init(&bo_va->vm_status);
+                list_add(&tmp->vm_status, &vm->freed);
+                spin_unlock(&vm->status_lock);
         }
 
         if (soffset || eoffset) {
+                spin_lock(&vm->status_lock);
                 bo_va->it.start = soffset;
                 bo_va->it.last = eoffset - 1;
-                interval_tree_insert(&bo_va->it, &vm->va);
-                spin_lock(&vm->status_lock);
                 list_add(&bo_va->vm_status, &vm->cleared);
                 spin_unlock(&vm->status_lock);
+                interval_tree_insert(&bo_va->it, &vm->va);
         }
 
         bo_va->flags = flags;
@@ -1158,7 +1155,8 @@ void radeon_vm_bo_invalidate(struct radeon_device *rdev,
 
         list_for_each_entry(bo_va, &bo->va, bo_list) {
                 spin_lock(&bo_va->vm->status_lock);
-                if (list_empty(&bo_va->vm_status))
+                if (list_empty(&bo_va->vm_status) &&
+                    (bo_va->it.start || bo_va->it.last))
                         list_add(&bo_va->vm_status, &bo_va->vm->invalidated);
                 spin_unlock(&bo_va->vm->status_lock);
         }
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index 26388b5dd6ed..07037e32dea3 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -6466,23 +6466,27 @@ restart_ih:
                 case 1: /* D1 vblank/vline */
                         switch (src_data) {
                         case 0: /* D1 vblank */
-                                if (rdev->irq.stat_regs.evergreen.disp_int & LB_D1_VBLANK_INTERRUPT) {
-                                        if (rdev->irq.crtc_vblank_int[0]) {
-                                                drm_handle_vblank(rdev->ddev, 0);
-                                                rdev->pm.vblank_sync = true;
-                                                wake_up(&rdev->irq.vblank_queue);
-                                        }
-                                        if (atomic_read(&rdev->irq.pflip[0]))
-                                                radeon_crtc_handle_vblank(rdev, 0);
-                                        rdev->irq.stat_regs.evergreen.disp_int &= ~LB_D1_VBLANK_INTERRUPT;
-                                        DRM_DEBUG("IH: D1 vblank\n");
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int & LB_D1_VBLANK_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                if (rdev->irq.crtc_vblank_int[0]) {
+                                        drm_handle_vblank(rdev->ddev, 0);
+                                        rdev->pm.vblank_sync = true;
+                                        wake_up(&rdev->irq.vblank_queue);
                                 }
+                                if (atomic_read(&rdev->irq.pflip[0]))
+                                        radeon_crtc_handle_vblank(rdev, 0);
+                                rdev->irq.stat_regs.evergreen.disp_int &= ~LB_D1_VBLANK_INTERRUPT;
+                                DRM_DEBUG("IH: D1 vblank\n");
+
                                 break;
                         case 1: /* D1 vline */
-                                if (rdev->irq.stat_regs.evergreen.disp_int & LB_D1_VLINE_INTERRUPT) {
-                                        rdev->irq.stat_regs.evergreen.disp_int &= ~LB_D1_VLINE_INTERRUPT;
-                                        DRM_DEBUG("IH: D1 vline\n");
-                                }
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int & LB_D1_VLINE_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.evergreen.disp_int &= ~LB_D1_VLINE_INTERRUPT;
+                                DRM_DEBUG("IH: D1 vline\n");
+
                                 break;
                         default:
                                 DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
@@ -6492,23 +6496,27 @@ restart_ih:
                 case 2: /* D2 vblank/vline */
                         switch (src_data) {
                         case 0: /* D2 vblank */
-                                if (rdev->irq.stat_regs.evergreen.disp_int_cont & LB_D2_VBLANK_INTERRUPT) {
-                                        if (rdev->irq.crtc_vblank_int[1]) {
-                                                drm_handle_vblank(rdev->ddev, 1);
-                                                rdev->pm.vblank_sync = true;
-                                                wake_up(&rdev->irq.vblank_queue);
-                                        }
-                                        if (atomic_read(&rdev->irq.pflip[1]))
-                                                radeon_crtc_handle_vblank(rdev, 1);
-                                        rdev->irq.stat_regs.evergreen.disp_int_cont &= ~LB_D2_VBLANK_INTERRUPT;
-                                        DRM_DEBUG("IH: D2 vblank\n");
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int_cont & LB_D2_VBLANK_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                if (rdev->irq.crtc_vblank_int[1]) {
+                                        drm_handle_vblank(rdev->ddev, 1);
+                                        rdev->pm.vblank_sync = true;
+                                        wake_up(&rdev->irq.vblank_queue);
                                 }
+                                if (atomic_read(&rdev->irq.pflip[1]))
+                                        radeon_crtc_handle_vblank(rdev, 1);
+                                rdev->irq.stat_regs.evergreen.disp_int_cont &= ~LB_D2_VBLANK_INTERRUPT;
+                                DRM_DEBUG("IH: D2 vblank\n");
+
                                 break;
                         case 1: /* D2 vline */
-                                if (rdev->irq.stat_regs.evergreen.disp_int_cont & LB_D2_VLINE_INTERRUPT) {
-                                        rdev->irq.stat_regs.evergreen.disp_int_cont &= ~LB_D2_VLINE_INTERRUPT;
-                                        DRM_DEBUG("IH: D2 vline\n");
-                                }
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int_cont & LB_D2_VLINE_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.evergreen.disp_int_cont &= ~LB_D2_VLINE_INTERRUPT;
+                                DRM_DEBUG("IH: D2 vline\n");
+
                                 break;
                         default:
                                 DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
@@ -6518,23 +6526,27 @@ restart_ih:
                 case 3: /* D3 vblank/vline */
                         switch (src_data) {
                         case 0: /* D3 vblank */
-                                if (rdev->irq.stat_regs.evergreen.disp_int_cont2 & LB_D3_VBLANK_INTERRUPT) {
-                                        if (rdev->irq.crtc_vblank_int[2]) {
-                                                drm_handle_vblank(rdev->ddev, 2);
-                                                rdev->pm.vblank_sync = true;
-                                                wake_up(&rdev->irq.vblank_queue);
-                                        }
-                                        if (atomic_read(&rdev->irq.pflip[2]))
-                                                radeon_crtc_handle_vblank(rdev, 2);
-                                        rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~LB_D3_VBLANK_INTERRUPT;
-                                        DRM_DEBUG("IH: D3 vblank\n");
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int_cont2 & LB_D3_VBLANK_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                if (rdev->irq.crtc_vblank_int[2]) {
+                                        drm_handle_vblank(rdev->ddev, 2);
+                                        rdev->pm.vblank_sync = true;
+                                        wake_up(&rdev->irq.vblank_queue);
                                 }
+                                if (atomic_read(&rdev->irq.pflip[2]))
+                                        radeon_crtc_handle_vblank(rdev, 2);
+                                rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~LB_D3_VBLANK_INTERRUPT;
+                                DRM_DEBUG("IH: D3 vblank\n");
+
                                 break;
                         case 1: /* D3 vline */
-                                if (rdev->irq.stat_regs.evergreen.disp_int_cont2 & LB_D3_VLINE_INTERRUPT) {
-                                        rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~LB_D3_VLINE_INTERRUPT;
-                                        DRM_DEBUG("IH: D3 vline\n");
-                                }
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int_cont2 & LB_D3_VLINE_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~LB_D3_VLINE_INTERRUPT;
+                                DRM_DEBUG("IH: D3 vline\n");
+
                                 break;
                         default:
                                 DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
@@ -6544,23 +6556,27 @@ restart_ih:
                 case 4: /* D4 vblank/vline */
                         switch (src_data) {
                         case 0: /* D4 vblank */
-                                if (rdev->irq.stat_regs.evergreen.disp_int_cont3 & LB_D4_VBLANK_INTERRUPT) {
-                                        if (rdev->irq.crtc_vblank_int[3]) {
-                                                drm_handle_vblank(rdev->ddev, 3);
-                                                rdev->pm.vblank_sync = true;
-                                                wake_up(&rdev->irq.vblank_queue);
-                                        }
-                                        if (atomic_read(&rdev->irq.pflip[3]))
-                                                radeon_crtc_handle_vblank(rdev, 3);
-                                        rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~LB_D4_VBLANK_INTERRUPT;
-                                        DRM_DEBUG("IH: D4 vblank\n");
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int_cont3 & LB_D4_VBLANK_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                if (rdev->irq.crtc_vblank_int[3]) {
+                                        drm_handle_vblank(rdev->ddev, 3);
+                                        rdev->pm.vblank_sync = true;
+                                        wake_up(&rdev->irq.vblank_queue);
                                 }
+                                if (atomic_read(&rdev->irq.pflip[3]))
+                                        radeon_crtc_handle_vblank(rdev, 3);
+                                rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~LB_D4_VBLANK_INTERRUPT;
+                                DRM_DEBUG("IH: D4 vblank\n");
+
                                 break;
                         case 1: /* D4 vline */
-                                if (rdev->irq.stat_regs.evergreen.disp_int_cont3 & LB_D4_VLINE_INTERRUPT) {
-                                        rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~LB_D4_VLINE_INTERRUPT;
-                                        DRM_DEBUG("IH: D4 vline\n");
-                                }
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int_cont3 & LB_D4_VLINE_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~LB_D4_VLINE_INTERRUPT;
+                                DRM_DEBUG("IH: D4 vline\n");
+
                                 break;
                         default:
                                 DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
@@ -6570,23 +6586,27 @@ restart_ih:
                 case 5: /* D5 vblank/vline */
                         switch (src_data) {
                         case 0: /* D5 vblank */
-                                if (rdev->irq.stat_regs.evergreen.disp_int_cont4 & LB_D5_VBLANK_INTERRUPT) {
-                                        if (rdev->irq.crtc_vblank_int[4]) {
-                                                drm_handle_vblank(rdev->ddev, 4);
-                                                rdev->pm.vblank_sync = true;
-                                                wake_up(&rdev->irq.vblank_queue);
-                                        }
-                                        if (atomic_read(&rdev->irq.pflip[4]))
-                                                radeon_crtc_handle_vblank(rdev, 4);
-                                        rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~LB_D5_VBLANK_INTERRUPT;
-                                        DRM_DEBUG("IH: D5 vblank\n");
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int_cont4 & LB_D5_VBLANK_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                if (rdev->irq.crtc_vblank_int[4]) {
+                                        drm_handle_vblank(rdev->ddev, 4);
+                                        rdev->pm.vblank_sync = true;
+                                        wake_up(&rdev->irq.vblank_queue);
                                 }
+                                if (atomic_read(&rdev->irq.pflip[4]))
+                                        radeon_crtc_handle_vblank(rdev, 4);
+                                rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~LB_D5_VBLANK_INTERRUPT;
+                                DRM_DEBUG("IH: D5 vblank\n");
+
                                 break;
                         case 1: /* D5 vline */
-                                if (rdev->irq.stat_regs.evergreen.disp_int_cont4 & LB_D5_VLINE_INTERRUPT) {
-                                        rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~LB_D5_VLINE_INTERRUPT;
-                                        DRM_DEBUG("IH: D5 vline\n");
-                                }
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int_cont4 & LB_D5_VLINE_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~LB_D5_VLINE_INTERRUPT;
+                                DRM_DEBUG("IH: D5 vline\n");
+
                                 break;
                         default:
                                 DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
@@ -6596,23 +6616,27 @@ restart_ih:
                 case 6: /* D6 vblank/vline */
                         switch (src_data) {
                         case 0: /* D6 vblank */
-                                if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & LB_D6_VBLANK_INTERRUPT) {
-                                        if (rdev->irq.crtc_vblank_int[5]) {
-                                                drm_handle_vblank(rdev->ddev, 5);
-                                                rdev->pm.vblank_sync = true;
-                                                wake_up(&rdev->irq.vblank_queue);
-                                        }
-                                        if (atomic_read(&rdev->irq.pflip[5]))
-                                                radeon_crtc_handle_vblank(rdev, 5);
-                                        rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~LB_D6_VBLANK_INTERRUPT;
-                                        DRM_DEBUG("IH: D6 vblank\n");
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int_cont5 & LB_D6_VBLANK_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                if (rdev->irq.crtc_vblank_int[5]) {
+                                        drm_handle_vblank(rdev->ddev, 5);
+                                        rdev->pm.vblank_sync = true;
+                                        wake_up(&rdev->irq.vblank_queue);
                                 }
+                                if (atomic_read(&rdev->irq.pflip[5]))
+                                        radeon_crtc_handle_vblank(rdev, 5);
+                                rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~LB_D6_VBLANK_INTERRUPT;
+                                DRM_DEBUG("IH: D6 vblank\n");
+
                                 break;
                         case 1: /* D6 vline */
-                                if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & LB_D6_VLINE_INTERRUPT) {
-                                        rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~LB_D6_VLINE_INTERRUPT;
-                                        DRM_DEBUG("IH: D6 vline\n");
-                                }
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int_cont5 & LB_D6_VLINE_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~LB_D6_VLINE_INTERRUPT;
+                                DRM_DEBUG("IH: D6 vline\n");
+
                                 break;
                         default:
                                 DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
@@ -6632,88 +6656,112 @@ restart_ih:
                 case 42: /* HPD hotplug */
                         switch (src_data) {
                         case 0:
-                                if (rdev->irq.stat_regs.evergreen.disp_int & DC_HPD1_INTERRUPT) {
-                                        rdev->irq.stat_regs.evergreen.disp_int &= ~DC_HPD1_INTERRUPT;
-                                        queue_hotplug = true;
-                                        DRM_DEBUG("IH: HPD1\n");
-                                }
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int & DC_HPD1_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.evergreen.disp_int &= ~DC_HPD1_INTERRUPT;
+                                queue_hotplug = true;
+                                DRM_DEBUG("IH: HPD1\n");
+
                                 break;
                         case 1:
-                                if (rdev->irq.stat_regs.evergreen.disp_int_cont & DC_HPD2_INTERRUPT) {
-                                        rdev->irq.stat_regs.evergreen.disp_int_cont &= ~DC_HPD2_INTERRUPT;
-                                        queue_hotplug = true;
-                                        DRM_DEBUG("IH: HPD2\n");
-                                }
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int_cont & DC_HPD2_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.evergreen.disp_int_cont &= ~DC_HPD2_INTERRUPT;
+                                queue_hotplug = true;
+                                DRM_DEBUG("IH: HPD2\n");
+
                                 break;
                         case 2:
-                                if (rdev->irq.stat_regs.evergreen.disp_int_cont2 & DC_HPD3_INTERRUPT) {
-                                        rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~DC_HPD3_INTERRUPT;
-                                        queue_hotplug = true;
-                                        DRM_DEBUG("IH: HPD3\n");
-                                }
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int_cont2 & DC_HPD3_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~DC_HPD3_INTERRUPT;
+                                queue_hotplug = true;
+                                DRM_DEBUG("IH: HPD3\n");
+
                                 break;
                         case 3:
-                                if (rdev->irq.stat_regs.evergreen.disp_int_cont3 & DC_HPD4_INTERRUPT) {
-                                        rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~DC_HPD4_INTERRUPT;
-                                        queue_hotplug = true;
-                                        DRM_DEBUG("IH: HPD4\n");
-                                }
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int_cont3 & DC_HPD4_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~DC_HPD4_INTERRUPT;
+                                queue_hotplug = true;
+                                DRM_DEBUG("IH: HPD4\n");
+
                                 break;
                         case 4:
-                                if (rdev->irq.stat_regs.evergreen.disp_int_cont4 & DC_HPD5_INTERRUPT) {
-                                        rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~DC_HPD5_INTERRUPT;
-                                        queue_hotplug = true;
-                                        DRM_DEBUG("IH: HPD5\n");
-                                }
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int_cont4 & DC_HPD5_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~DC_HPD5_INTERRUPT;
+                                queue_hotplug = true;
+                                DRM_DEBUG("IH: HPD5\n");
+
                                 break;
                         case 5:
-                                if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_INTERRUPT) {
-                                        rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~DC_HPD6_INTERRUPT;
-                                        queue_hotplug = true;
-                                        DRM_DEBUG("IH: HPD6\n");
-                                }
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~DC_HPD6_INTERRUPT;
+                                queue_hotplug = true;
+                                DRM_DEBUG("IH: HPD6\n");
+
                                 break;
                         case 6:
-                                if (rdev->irq.stat_regs.evergreen.disp_int & DC_HPD1_RX_INTERRUPT) {
-                                        rdev->irq.stat_regs.evergreen.disp_int &= ~DC_HPD1_RX_INTERRUPT;
-                                        queue_dp = true;
-                                        DRM_DEBUG("IH: HPD_RX 1\n");
-                                }
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int & DC_HPD1_RX_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.evergreen.disp_int &= ~DC_HPD1_RX_INTERRUPT;
+                                queue_dp = true;
+                                DRM_DEBUG("IH: HPD_RX 1\n");
+
                                 break;
                         case 7:
-                                if (rdev->irq.stat_regs.evergreen.disp_int_cont & DC_HPD2_RX_INTERRUPT) {
-                                        rdev->irq.stat_regs.evergreen.disp_int_cont &= ~DC_HPD2_RX_INTERRUPT;
-                                        queue_dp = true;
-                                        DRM_DEBUG("IH: HPD_RX 2\n");
-                                }
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int_cont & DC_HPD2_RX_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.evergreen.disp_int_cont &= ~DC_HPD2_RX_INTERRUPT;
+                                queue_dp = true;
+                                DRM_DEBUG("IH: HPD_RX 2\n");
+
                                 break;
                         case 8:
-                                if (rdev->irq.stat_regs.evergreen.disp_int_cont2 & DC_HPD3_RX_INTERRUPT) {
-                                        rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~DC_HPD3_RX_INTERRUPT;
-                                        queue_dp = true;
-                                        DRM_DEBUG("IH: HPD_RX 3\n");
-                                }
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int_cont2 & DC_HPD3_RX_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~DC_HPD3_RX_INTERRUPT;
+                                queue_dp = true;
+                                DRM_DEBUG("IH: HPD_RX 3\n");
+
                                 break;
                         case 9:
-                                if (rdev->irq.stat_regs.evergreen.disp_int_cont3 & DC_HPD4_RX_INTERRUPT) {
-                                        rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~DC_HPD4_RX_INTERRUPT;
-                                        queue_dp = true;
-                                        DRM_DEBUG("IH: HPD_RX 4\n");
-                                }
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int_cont3 & DC_HPD4_RX_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~DC_HPD4_RX_INTERRUPT;
+                                queue_dp = true;
+                                DRM_DEBUG("IH: HPD_RX 4\n");
+
                                 break;
                         case 10:
-                                if (rdev->irq.stat_regs.evergreen.disp_int_cont4 & DC_HPD5_RX_INTERRUPT) {
-                                        rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~DC_HPD5_RX_INTERRUPT;
-                                        queue_dp = true;
-                                        DRM_DEBUG("IH: HPD_RX 5\n");
-                                }
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int_cont4 & DC_HPD5_RX_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~DC_HPD5_RX_INTERRUPT;
+                                queue_dp = true;
+                                DRM_DEBUG("IH: HPD_RX 5\n");
+
                                 break;
                         case 11:
-                                if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_RX_INTERRUPT) {
-                                        rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~DC_HPD6_RX_INTERRUPT;
-                                        queue_dp = true;
-                                        DRM_DEBUG("IH: HPD_RX 6\n");
-                                }
+                                if (!(rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_RX_INTERRUPT))
+                                        DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
+
+                                rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~DC_HPD6_RX_INTERRUPT;
+                                queue_dp = true;
+                                DRM_DEBUG("IH: HPD_RX 6\n");
+
                                 break;
                         default:
                                 DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
index 1dbdf3230dae..787cd8fd897f 100644
--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -2926,6 +2926,7 @@ static struct si_dpm_quirk si_dpm_quirk_list[] = {
         /* PITCAIRN - https://bugs.freedesktop.org/show_bug.cgi?id=76490 */
         { PCI_VENDOR_ID_ATI, 0x6810, 0x1462, 0x3036, 0, 120000 },
         { PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0xe271, 0, 120000 },
+        { PCI_VENDOR_ID_ATI, 0x6810, 0x174b, 0xe271, 85000, 90000 },
         { 0, 0, 0, 0 },
 };
 
diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_drv.c b/drivers/gpu/drm/rockchip/rockchip_drm_drv.c
index 01b558fe3695..9a0c2911272a 100644
--- a/drivers/gpu/drm/rockchip/rockchip_drm_drv.c
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_drv.c
@@ -555,7 +555,6 @@ static struct platform_driver rockchip_drm_platform_driver = {
         .probe = rockchip_drm_platform_probe,
         .remove = rockchip_drm_platform_remove,
         .driver = {
-                .owner = THIS_MODULE,
                 .name = "rockchip-drm",
                 .of_match_table = rockchip_drm_dt_ids,
                 .pm = &rockchip_drm_pm_ops,
diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_fb.c b/drivers/gpu/drm/rockchip/rockchip_drm_fb.c
index 77d52893d40f..002645bb5bbf 100644
--- a/drivers/gpu/drm/rockchip/rockchip_drm_fb.c
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_fb.c
@@ -162,7 +162,8 @@ static void rockchip_drm_output_poll_changed(struct drm_device *dev)
         struct rockchip_drm_private *private = dev->dev_private;
         struct drm_fb_helper *fb_helper = &private->fbdev_helper;
 
-        drm_fb_helper_hotplug_event(fb_helper);
+        if (fb_helper)
+                drm_fb_helper_hotplug_event(fb_helper);
 }
 
 static const struct drm_mode_config_funcs rockchip_drm_mode_config_funcs = {
diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
index eb2282cc4a56..eba5f8a52fbd 100644
--- a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
@@ -54,55 +54,56 @@ static void rockchip_gem_free_buf(struct rockchip_gem_object *rk_obj)
                        &rk_obj->dma_attrs);
 }
 
-int rockchip_gem_mmap_buf(struct drm_gem_object *obj,
-                          struct vm_area_struct *vma)
+static int rockchip_drm_gem_object_mmap(struct drm_gem_object *obj,
+                                        struct vm_area_struct *vma)
+
 {
+        int ret;
         struct rockchip_gem_object *rk_obj = to_rockchip_obj(obj);
         struct drm_device *drm = obj->dev;
-        unsigned long vm_size;
 
-        vma->vm_flags |= VM_IO | VM_DONTEXPAND | VM_DONTDUMP;
-        vm_size = vma->vm_end - vma->vm_start;
-
-        if (vm_size > obj->size)
-                return -EINVAL;
+        /*
+         * dma_alloc_attrs() allocated a struct page table for rk_obj, so clear
+         * VM_PFNMAP flag that was set by drm_gem_mmap_obj()/drm_gem_mmap().
+         */
+        vma->vm_flags &= ~VM_PFNMAP;
 
-        return dma_mmap_attrs(drm->dev, vma, rk_obj->kvaddr, rk_obj->dma_addr,
+        ret = dma_mmap_attrs(drm->dev, vma, rk_obj->kvaddr, rk_obj->dma_addr,
                              obj->size, &rk_obj->dma_attrs);
+        if (ret)
+                drm_gem_vm_close(vma);
+
+        return ret;
 }
 
-/* drm driver mmap file operations */
-int rockchip_gem_mmap(struct file *filp, struct vm_area_struct *vma)
+int rockchip_gem_mmap_buf(struct drm_gem_object *obj,
+                          struct vm_area_struct *vma)
 {
-        struct drm_file *priv = filp->private_data;
-        struct drm_device *dev = priv->minor->dev;
-        struct drm_gem_object *obj;
-        struct drm_vma_offset_node *node;
+        struct drm_device *drm = obj->dev;
         int ret;
 
-        if (drm_device_is_unplugged(dev))
-                return -ENODEV;
+        mutex_lock(&drm->struct_mutex);
+        ret = drm_gem_mmap_obj(obj, obj->size, vma);
+        mutex_unlock(&drm->struct_mutex);
+        if (ret)
+                return ret;
 
-        mutex_lock(&dev->struct_mutex);
+        return rockchip_drm_gem_object_mmap(obj, vma);
+}
 
-        node = drm_vma_offset_exact_lookup(dev->vma_offset_manager,
-                                           vma->vm_pgoff,
-                                           vma_pages(vma));
-        if (!node) {
-                mutex_unlock(&dev->struct_mutex);
-                DRM_ERROR("failed to find vma node.\n");
-                return -EINVAL;
-        } else if (!drm_vma_node_is_allowed(node, filp)) {
-                mutex_unlock(&dev->struct_mutex);
-                return -EACCES;
-        }
+/* drm driver mmap file operations */
+int rockchip_gem_mmap(struct file *filp, struct vm_area_struct *vma)
+{
+        struct drm_gem_object *obj;
+        int ret;
 
-        obj = container_of(node, struct drm_gem_object, vma_node);
-        ret = rockchip_gem_mmap_buf(obj, vma);
+        ret = drm_gem_mmap(filp, vma);
+        if (ret)
+                return ret;
 
-        mutex_unlock(&dev->struct_mutex);
+        obj = vma->vm_private_data;
 
-        return ret;
+        return rockchip_drm_gem_object_mmap(obj, vma);
 }
 
 struct rockchip_gem_object *
diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
index dc65161d7cad..34b78e736532 100644
--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
@@ -170,6 +170,7 @@ struct vop_win_phy {
 
         struct vop_reg enable;
         struct vop_reg format;
+        struct vop_reg rb_swap;
         struct vop_reg act_info;
         struct vop_reg dsp_info;
         struct vop_reg dsp_st;
@@ -199,8 +200,12 @@ struct vop_data {
 static const uint32_t formats_01[] = {
         DRM_FORMAT_XRGB8888,
         DRM_FORMAT_ARGB8888,
+        DRM_FORMAT_XBGR8888,
+        DRM_FORMAT_ABGR8888,
         DRM_FORMAT_RGB888,
+        DRM_FORMAT_BGR888,
         DRM_FORMAT_RGB565,
+        DRM_FORMAT_BGR565,
         DRM_FORMAT_NV12,
         DRM_FORMAT_NV16,
         DRM_FORMAT_NV24,
@@ -209,8 +214,12 @@ static const uint32_t formats_01[] = {
 static const uint32_t formats_234[] = {
         DRM_FORMAT_XRGB8888,
         DRM_FORMAT_ARGB8888,
+        DRM_FORMAT_XBGR8888,
+        DRM_FORMAT_ABGR8888,
         DRM_FORMAT_RGB888,
+        DRM_FORMAT_BGR888,
         DRM_FORMAT_RGB565,
+        DRM_FORMAT_BGR565,
 };
 
 static const struct vop_win_phy win01_data = {
@@ -218,6 +227,7 @@ static const struct vop_win_phy win01_data = {
         .nformats = ARRAY_SIZE(formats_01),
         .enable = VOP_REG(WIN0_CTRL0, 0x1, 0),
         .format = VOP_REG(WIN0_CTRL0, 0x7, 1),
+        .rb_swap = VOP_REG(WIN0_CTRL0, 0x1, 12),
         .act_info = VOP_REG(WIN0_ACT_INFO, 0x1fff1fff, 0),
         .dsp_info = VOP_REG(WIN0_DSP_INFO, 0x0fff0fff, 0),
         .dsp_st = VOP_REG(WIN0_DSP_ST, 0x1fff1fff, 0),
@@ -234,6 +244,7 @@ static const struct vop_win_phy win23_data = {
         .nformats = ARRAY_SIZE(formats_234),
         .enable = VOP_REG(WIN2_CTRL0, 0x1, 0),
         .format = VOP_REG(WIN2_CTRL0, 0x7, 1),
+        .rb_swap = VOP_REG(WIN2_CTRL0, 0x1, 12),
         .dsp_info = VOP_REG(WIN2_DSP_INFO0, 0x0fff0fff, 0),
         .dsp_st = VOP_REG(WIN2_DSP_ST0, 0x1fff1fff, 0),
         .yrgb_mst = VOP_REG(WIN2_MST0, 0xffffffff, 0),
@@ -242,15 +253,6 @@ static const struct vop_win_phy win23_data = {
         .dst_alpha_ctl = VOP_REG(WIN2_DST_ALPHA_CTRL, 0xff, 0),
 };
 
-static const struct vop_win_phy cursor_data = {
-        .data_formats = formats_234,
-        .nformats = ARRAY_SIZE(formats_234),
-        .enable = VOP_REG(HWC_CTRL0, 0x1, 0),
-        .format = VOP_REG(HWC_CTRL0, 0x7, 1),
-        .dsp_st = VOP_REG(HWC_DSP_ST, 0x1fff1fff, 0),
-        .yrgb_mst = VOP_REG(HWC_MST, 0xffffffff, 0),
-};
-
 static const struct vop_ctrl ctrl_data = {
         .standby = VOP_REG(SYS_CTRL, 0x1, 22),
         .gate_en = VOP_REG(SYS_CTRL, 0x1, 23),
@@ -282,14 +284,14 @@ static const struct vop_reg_data vop_init_reg_table[] = {
 /*
  * Note: rk3288 has a dedicated 'cursor' window, however, that window requires
  * special support to get alpha blending working.  For now, just use overlay
- * window 1 for the drm cursor.
+ * window 3 for the drm cursor.
+ *
  */
 static const struct vop_win_data rk3288_vop_win_data[] = {
         { .base = 0x00, .phy = &win01_data, .type = DRM_PLANE_TYPE_PRIMARY },
-        { .base = 0x40, .phy = &win01_data, .type = DRM_PLANE_TYPE_CURSOR },
+        { .base = 0x40, .phy = &win01_data, .type = DRM_PLANE_TYPE_OVERLAY },
         { .base = 0x00, .phy = &win23_data, .type = DRM_PLANE_TYPE_OVERLAY },
-        { .base = 0x50, .phy = &win23_data, .type = DRM_PLANE_TYPE_OVERLAY },
-        { .base = 0x00, .phy = &cursor_data, .type = DRM_PLANE_TYPE_OVERLAY },
+        { .base = 0x50, .phy = &win23_data, .type = DRM_PLANE_TYPE_CURSOR },
 };
 
 static const struct vop_data rk3288_vop = {
@@ -352,15 +354,32 @@ static inline void vop_mask_write_relaxed(struct vop *vop, uint32_t offset,
         }
 }
 
+static bool has_rb_swapped(uint32_t format)
+{
+        switch (format) {
+        case DRM_FORMAT_XBGR8888:
+        case DRM_FORMAT_ABGR8888:
+        case DRM_FORMAT_BGR888:
+        case DRM_FORMAT_BGR565:
+                return true;
+        default:
+                return false;
+        }
+}
+
 static enum vop_data_format vop_convert_format(uint32_t format)
 {
         switch (format) {
         case DRM_FORMAT_XRGB8888:
         case DRM_FORMAT_ARGB8888:
+        case DRM_FORMAT_XBGR8888:
+        case DRM_FORMAT_ABGR8888:
                 return VOP_FMT_ARGB8888;
         case DRM_FORMAT_RGB888:
+        case DRM_FORMAT_BGR888:
                 return VOP_FMT_RGB888;
         case DRM_FORMAT_RGB565:
+        case DRM_FORMAT_BGR565:
                 return VOP_FMT_RGB565;
         case DRM_FORMAT_NV12:
                 return VOP_FMT_YUV420SP;
@@ -378,6 +397,7 @@ static bool is_alpha_support(uint32_t format)
 {
         switch (format) {
         case DRM_FORMAT_ARGB8888:
+        case DRM_FORMAT_ABGR8888:
                 return true;
         default:
                 return false;
@@ -588,6 +608,7 @@ static int vop_update_plane_event(struct drm_plane *plane,
         enum vop_data_format format;
         uint32_t val;
         bool is_alpha;
+        bool rb_swap;
         bool visible;
         int ret;
         struct drm_rect dest = {
@@ -621,6 +642,7 @@ static int vop_update_plane_event(struct drm_plane *plane,
                 return 0;
 
         is_alpha = is_alpha_support(fb->pixel_format);
+        rb_swap = has_rb_swapped(fb->pixel_format);
         format = vop_convert_format(fb->pixel_format);
         if (format < 0)
                 return format;
@@ -689,6 +711,7 @@ static int vop_update_plane_event(struct drm_plane *plane,
         val = (dsp_sty - 1) << 16;
         val |= (dsp_stx - 1) & 0xffff;
         VOP_WIN_SET(vop, win, dsp_st, val);
+        VOP_WIN_SET(vop, win, rb_swap, rb_swap);
 
         if (is_alpha) {
                 VOP_WIN_SET(vop, win, dst_alpha_ctl,
diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
index 882cccdad272..ac6fe40b99f7 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -490,7 +490,8 @@ pgprot_t ttm_io_prot(uint32_t caching_flags, pgprot_t tmp)
         else if (boot_cpu_data.x86 > 3)
                 tmp = pgprot_noncached(tmp);
 #endif
-#if defined(__ia64__) || defined(__arm__) || defined(__powerpc__)
+#if defined(__ia64__) || defined(__arm__) || defined(__aarch64__) || \
+    defined(__powerpc__)
         if (caching_flags & TTM_PL_FLAG_WC)
                 tmp = pgprot_writecombine(tmp);
         else
diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
index 3077f1554099..624d941aaad1 100644
--- a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
+++ b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
@@ -963,14 +963,13 @@ void ttm_dma_unpopulate(struct ttm_dma_tt *ttm_dma, struct device *dev)
         } else {
                 pool->npages_free += count;
                 list_splice(&ttm_dma->pages_list, &pool->free_list);
-                npages = count;
-                if (pool->npages_free > _manager->options.max_size) {
+                /*
+                 * Wait to have at at least NUM_PAGES_TO_ALLOC number of pages
+                 * to free in order to minimize calls to set_memory_wb().
+                 */
+                if (pool->npages_free >= (_manager->options.max_size +
+                                          NUM_PAGES_TO_ALLOC))
                         npages = pool->npages_free - _manager->options.max_size;
-                        /* free at least NUM_PAGES_TO_ALLOC number of pages
-                         * to reduce calls to set_memory_wb */
-                        if (npages < NUM_PAGES_TO_ALLOC)
-                                npages = NUM_PAGES_TO_ALLOC;
-                }
         }
         spin_unlock_irqrestore(&pool->lock, irq_flags);
 
diff --git a/drivers/gpu/ipu-v3/ipu-common.c b/drivers/gpu/ipu-v3/ipu-common.c
index 6d2f39d36e44..00f2058944e5 100644
--- a/drivers/gpu/ipu-v3/ipu-common.c
+++ b/drivers/gpu/ipu-v3/ipu-common.c
@@ -1107,6 +1107,9 @@ static int ipu_irq_init(struct ipu_soc *ipu)
                 return ret;
         }
 
+        for (i = 0; i < IPU_NUM_IRQS; i += 32)
+                ipu_cm_write(ipu, 0, IPU_INT_CTRL(i / 32));
+
         for (i = 0; i < IPU_NUM_IRQS; i += 32) {
                 gc = irq_get_domain_generic_chip(ipu->domain, i);
                 gc->reg_base = ipu->cm_reg;
diff --git a/drivers/hid/hid-cp2112.c b/drivers/hid/hid-cp2112.c
index 3318de690e00..a2dbbbe0d8d7 100644
--- a/drivers/hid/hid-cp2112.c
+++ b/drivers/hid/hid-cp2112.c
@@ -356,6 +356,8 @@ static int cp2112_read(struct cp2112_device *dev, u8 *data, size_t size)
         struct cp2112_force_read_report report;
         int ret;
 
+        if (size > sizeof(dev->read_data))
+                size = sizeof(dev->read_data);
         report.report = CP2112_DATA_READ_FORCE_SEND;
         report.length = cpu_to_be16(size);
 
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index 6a9b05b328a9..7c811252c1ce 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -778,9 +778,16 @@ static int mt_input_mapping(struct hid_device *hdev, struct hid_input *hi,
         /*
          * some egalax touchscreens have "application == HID_DG_TOUCHSCREEN"
          * for the stylus.
+         * The check for mt_report_id ensures we don't process
+         * HID_DG_CONTACTCOUNT from the pen report as it is outside the physical
+         * collection, but within the report ID.
          */
         if (field->physical == HID_DG_STYLUS)
                 return 0;
+        else if ((field->physical == 0) &&
+                 (field->report->id != td->mt_report_id) &&
+                 (td->mt_report_id != -1))
+                return 0;
 
         if (field->application == HID_DG_TOUCHSCREEN ||
             field->application == HID_DG_TOUCHPAD)
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index 53e7de7cb9e2..20f9a653444c 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -87,6 +87,9 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOUSE_C05A, HID_QUIRK_ALWAYS_POLL },
         { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOUSE_C06A, HID_QUIRK_ALWAYS_POLL },
         { USB_VENDOR_ID_MGE, USB_DEVICE_ID_MGE_UPS, HID_QUIRK_NOGET },
+        { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_SURFACE_PRO_2, HID_QUIRK_NO_INIT_REPORTS },
+        { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_2, HID_QUIRK_NO_INIT_REPORTS },
+        { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TOUCH_COVER_2, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3_JP, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_POWER_COVER, HID_QUIRK_NO_INIT_REPORTS },
diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
index 4c0ffca97bef..44958d79d598 100644
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -1271,11 +1271,13 @@ fail_leds:
         pad_input_dev = NULL;
         wacom_wac->pad_registered = false;
 fail_register_pad_input:
-        input_unregister_device(touch_input_dev);
+        if (touch_input_dev)
+                input_unregister_device(touch_input_dev);
         wacom_wac->touch_input = NULL;
         wacom_wac->touch_registered = false;
 fail_register_touch_input:
-        input_unregister_device(pen_input_dev);
+        if (pen_input_dev)
+                input_unregister_device(pen_input_dev);
         wacom_wac->pen_input = NULL;
         wacom_wac->pen_registered = false;
 fail_register_pen_input:
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index 232da89f4e88..0d244239e55d 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -2213,6 +2213,9 @@ void wacom_setup_device_quirks(struct wacom *wacom)
                         features->x_max = 4096;
                         features->y_max = 4096;
                 }
+                else if (features->pktlen == WACOM_PKGLEN_BBTOUCH) {
+                        features->device_type |= WACOM_DEVICETYPE_PAD;
+                }
         }
 
         /*
diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
index 35ac23768ce9..577d58d1f1a1 100644
--- a/drivers/i2c/busses/Kconfig
+++ b/drivers/i2c/busses/Kconfig
@@ -633,6 +633,7 @@ config I2C_MPC
 config I2C_MT65XX
         tristate "MediaTek I2C adapter"
         depends on ARCH_MEDIATEK || COMPILE_TEST
+        depends on HAS_DMA
         help
           This selects the MediaTek(R) Integrated Inter Circuit bus driver
           for MT65xx and MT81xx.
diff --git a/drivers/i2c/busses/i2c-jz4780.c b/drivers/i2c/busses/i2c-jz4780.c
index 19b2d689a5ef..f325663c27c5 100644
--- a/drivers/i2c/busses/i2c-jz4780.c
+++ b/drivers/i2c/busses/i2c-jz4780.c
@@ -764,12 +764,15 @@ static int jz4780_i2c_probe(struct platform_device *pdev)
         if (IS_ERR(i2c->clk))
                 return PTR_ERR(i2c->clk);
 
-        clk_prepare_enable(i2c->clk);
+        ret = clk_prepare_enable(i2c->clk);
+        if (ret)
+                return ret;
 
-        if (of_property_read_u32(pdev->dev.of_node, "clock-frequency",
-                                 &clk_freq)) {
+        ret = of_property_read_u32(pdev->dev.of_node, "clock-frequency",
+                                   &clk_freq);
+        if (ret) {
                 dev_err(&pdev->dev, "clock-frequency not specified in DT");
-                return clk_freq;
+                goto err;
         }
 
         i2c->speed = clk_freq / 1000;
@@ -790,10 +793,8 @@ static int jz4780_i2c_probe(struct platform_device *pdev)
         i2c->irq = platform_get_irq(pdev, 0);
         ret = devm_request_irq(&pdev->dev, i2c->irq, jz4780_i2c_irq, 0,
                                dev_name(&pdev->dev), i2c);
-        if (ret) {
-                ret = -ENODEV;
+        if (ret)
                 goto err;
-        }
 
         ret = i2c_add_adapter(&i2c->adap);
         if (ret < 0) {
diff --git a/drivers/i2c/busses/i2c-xgene-slimpro.c b/drivers/i2c/busses/i2c-xgene-slimpro.c
index dcca7076231e..1c9cb65ac4cf 100644
--- a/drivers/i2c/busses/i2c-xgene-slimpro.c
+++ b/drivers/i2c/busses/i2c-xgene-slimpro.c
@@ -419,6 +419,7 @@ static int xgene_slimpro_i2c_probe(struct platform_device *pdev)
         rc = i2c_add_adapter(adapter);
         if (rc) {
                 dev_err(&pdev->dev, "Adapter registeration failed\n");
+                mbox_free_channel(ctx->mbox_chan);
                 return rc;
         }
 
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 069a41f116dd..e6d4935161e4 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -1012,6 +1012,8 @@ EXPORT_SYMBOL_GPL(i2c_new_device);
  */
 void i2c_unregister_device(struct i2c_client *client)
 {
+        if (client->dev.of_node)
+                of_node_clear_flag(client->dev.of_node, OF_POPULATED);
         device_unregister(&client->dev);
 }
 EXPORT_SYMBOL_GPL(i2c_unregister_device);
@@ -1320,8 +1322,11 @@ static void of_i2c_register_devices(struct i2c_adapter *adap)
 
         dev_dbg(&adap->dev, "of_i2c: walking child nodes\n");
 
-        for_each_available_child_of_node(adap->dev.of_node, node)
+        for_each_available_child_of_node(adap->dev.of_node, node) {
+                if (of_node_test_and_set_flag(node, OF_POPULATED))
+                        continue;
                 of_i2c_register_device(adap, node);
+        }
 }
 
 static int of_dev_node_match(struct device *dev, void *data)
@@ -1853,6 +1858,11 @@ static int of_i2c_notify(struct notifier_block *nb, unsigned long action,
                 if (adap == NULL)
                         return NOTIFY_OK;       /* not for us */
 
+                if (of_node_test_and_set_flag(rd->dn, OF_POPULATED)) {
+                        put_device(&adap->dev);
+                        return NOTIFY_OK;
+                }
+
                 client = of_i2c_register_device(adap, rd->dn);
                 put_device(&adap->dev);
 
@@ -1863,6 +1873,10 @@ static int of_i2c_notify(struct notifier_block *nb, unsigned long action,
                 }
                 break;
         case OF_RECONFIG_CHANGE_REMOVE:
+                /* already depopulated? */
+                if (!of_node_check_flag(rd->dn, OF_POPULATED))
+                        return NOTIFY_OK;
+
                 /* find our device by node */
                 client = of_find_i2c_device_by_node(rd->dn);
                 if (client == NULL)
diff --git a/drivers/iio/accel/bmc150-accel.c b/drivers/iio/accel/bmc150-accel.c
index 4e70f51c2370..cc5a35750b50 100644
--- a/drivers/iio/accel/bmc150-accel.c
+++ b/drivers/iio/accel/bmc150-accel.c
@@ -1464,7 +1464,7 @@ static void bmc150_accel_unregister_triggers(struct bmc150_accel_data *data,
 {
         int i;
 
-        for (i = from; i >= 0; i++) {
+        for (i = from; i >= 0; i--) {
                 if (data->triggers[i].indio_trig) {
                         iio_trigger_unregister(data->triggers[i].indio_trig);
                         data->triggers[i].indio_trig = NULL;
diff --git a/drivers/iio/accel/mma8452.c b/drivers/iio/accel/mma8452.c
index e8e2077c7244..13ea1ea23328 100644
--- a/drivers/iio/accel/mma8452.c
+++ b/drivers/iio/accel/mma8452.c
@@ -557,21 +557,21 @@ static void mma8452_transient_interrupt(struct iio_dev *indio_dev)
         if (src & MMA8452_TRANSIENT_SRC_XTRANSE)
                 iio_push_event(indio_dev,
                                IIO_MOD_EVENT_CODE(IIO_ACCEL, 0, IIO_MOD_X,
-                                                  IIO_EV_TYPE_THRESH,
+                                                  IIO_EV_TYPE_MAG,
                                                   IIO_EV_DIR_RISING),
                                ts);
 
         if (src & MMA8452_TRANSIENT_SRC_YTRANSE)
                 iio_push_event(indio_dev,
                                IIO_MOD_EVENT_CODE(IIO_ACCEL, 0, IIO_MOD_Y,
-                                                  IIO_EV_TYPE_THRESH,
+                                                  IIO_EV_TYPE_MAG,
                                                   IIO_EV_DIR_RISING),
                                ts);
 
         if (src & MMA8452_TRANSIENT_SRC_ZTRANSE)
                 iio_push_event(indio_dev,
                                IIO_MOD_EVENT_CODE(IIO_ACCEL, 0, IIO_MOD_Z,
-                                                  IIO_EV_TYPE_THRESH,
+                                                  IIO_EV_TYPE_MAG,
                                                   IIO_EV_DIR_RISING),
                                ts);
 }
@@ -644,7 +644,7 @@ static int mma8452_reg_access_dbg(struct iio_dev *indio_dev,
 
 static const struct iio_event_spec mma8452_transient_event[] = {
         {
-                .type = IIO_EV_TYPE_THRESH,
+                .type = IIO_EV_TYPE_MAG,
                 .dir = IIO_EV_DIR_RISING,
                 .mask_separate = BIT(IIO_EV_INFO_ENABLE),
                 .mask_shared_by_type = BIT(IIO_EV_INFO_VALUE) |
diff --git a/drivers/iio/adc/Kconfig b/drivers/iio/adc/Kconfig
index 7c5565891cb8..eb0cd897714a 100644
--- a/drivers/iio/adc/Kconfig
+++ b/drivers/iio/adc/Kconfig
@@ -153,8 +153,7 @@ config DA9150_GPADC
 
 config CC10001_ADC
         tristate "Cosmic Circuits 10001 ADC driver"
-        depends on HAVE_CLK || REGULATOR
-        depends on HAS_IOMEM
+        depends on HAS_IOMEM && HAVE_CLK && REGULATOR
         select IIO_BUFFER
         select IIO_TRIGGERED_BUFFER
         help
diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c
index 8a0eb4a04fb5..7b40925dd4ff 100644
--- a/drivers/iio/adc/at91_adc.c
+++ b/drivers/iio/adc/at91_adc.c
@@ -182,7 +182,7 @@ struct at91_adc_caps {
         u8      ts_pen_detect_sensitivity;
 
         /* startup time calculate function */
-        u32 (*calc_startup_ticks)(u8 startup_time, u32 adc_clk_khz);
+        u32 (*calc_startup_ticks)(u32 startup_time, u32 adc_clk_khz);
 
         u8      num_channels;
         struct at91_adc_reg_desc registers;
@@ -201,7 +201,7 @@ struct at91_adc_state {
         u8                      num_channels;
         void __iomem            *reg_base;
         struct at91_adc_reg_desc *registers;
-        u8                      startup_time;
+        u32                     startup_time;
         u8                      sample_hold_time;
         bool                    sleep_mode;
         struct iio_trigger      **trig;
@@ -779,7 +779,7 @@ ret:
         return ret;
 }
 
-static u32 calc_startup_ticks_9260(u8 startup_time, u32 adc_clk_khz)
+static u32 calc_startup_ticks_9260(u32 startup_time, u32 adc_clk_khz)
 {
         /*
          * Number of ticks needed to cover the startup time of the ADC
@@ -790,7 +790,7 @@ static u32 calc_startup_ticks_9260(u8 startup_time, u32 adc_clk_khz)
         return round_up((startup_time * adc_clk_khz / 1000) - 1, 8) / 8;
 }
 
-static u32 calc_startup_ticks_9x5(u8 startup_time, u32 adc_clk_khz)
+static u32 calc_startup_ticks_9x5(u32 startup_time, u32 adc_clk_khz)
 {
         /*
          * For sama5d3x and at91sam9x5, the formula changes to:
diff --git a/drivers/iio/adc/mcp320x.c b/drivers/iio/adc/mcp320x.c
index 8d9c9b9215dd..d819823f7257 100644
--- a/drivers/iio/adc/mcp320x.c
+++ b/drivers/iio/adc/mcp320x.c
@@ -299,6 +299,8 @@ static int mcp320x_probe(struct spi_device *spi)
         indio_dev->channels = chip_info->channels;
         indio_dev->num_channels = chip_info->num_channels;
 
+        adc->chip_info = chip_info;
+
         adc->transfer[0].tx_buf = &adc->tx_buf;
         adc->transfer[0].len = sizeof(adc->tx_buf);
         adc->transfer[1].rx_buf = adc->rx_buf;
diff --git a/drivers/iio/adc/rockchip_saradc.c b/drivers/iio/adc/rockchip_saradc.c
index 8d4e019ea4ca..9c311c1e1ac7 100644
--- a/drivers/iio/adc/rockchip_saradc.c
+++ b/drivers/iio/adc/rockchip_saradc.c
@@ -349,3 +349,7 @@ static struct platform_driver rockchip_saradc_driver = {
 };
 
 module_platform_driver(rockchip_saradc_driver);
+
+MODULE_AUTHOR("Heiko Stuebner <heiko@sntech.de>");
+MODULE_DESCRIPTION("Rockchip SARADC driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/iio/adc/twl4030-madc.c b/drivers/iio/adc/twl4030-madc.c
index 06f4792240f0..ebe415f10640 100644
--- a/drivers/iio/adc/twl4030-madc.c
+++ b/drivers/iio/adc/twl4030-madc.c
@@ -833,7 +833,8 @@ static int twl4030_madc_probe(struct platform_device *pdev)
         irq = platform_get_irq(pdev, 0);
         ret = devm_request_threaded_irq(&pdev->dev, irq, NULL,
                                    twl4030_madc_threaded_irq_handler,
-                                   IRQF_TRIGGER_RISING, "twl4030_madc", madc);
+                                   IRQF_TRIGGER_RISING | IRQF_ONESHOT,
+                                   "twl4030_madc", madc);
         if (ret) {
                 dev_err(&pdev->dev, "could not request irq\n");
                 goto err_i2c;
diff --git a/drivers/iio/adc/vf610_adc.c b/drivers/iio/adc/vf610_adc.c
index 480f335a0f9f..819632bf1fda 100644
--- a/drivers/iio/adc/vf610_adc.c
+++ b/drivers/iio/adc/vf610_adc.c
@@ -635,7 +635,7 @@ static int vf610_adc_reg_access(struct iio_dev *indio_dev,
         struct vf610_adc *info = iio_priv(indio_dev);
 
         if ((readval == NULL) ||
-                (!(reg % 4) || (reg > VF610_REG_ADC_PCTL)))
+                ((reg % 4) || (reg > VF610_REG_ADC_PCTL)))
                 return -EINVAL;
 
         *readval = readl(info->regs + reg);
diff --git a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
index 610fc98f88ef..595511022795 100644
--- a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
+++ b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
@@ -36,6 +36,8 @@ static int _hid_sensor_power_state(struct hid_sensor_common *st, bool state)
         s32 poll_value = 0;
 
         if (state) {
+                if (!atomic_read(&st->user_requested_state))
+                        return 0;
                 if (sensor_hub_device_open(st->hsdev))
                         return -EIO;
 
@@ -52,8 +54,12 @@ static int _hid_sensor_power_state(struct hid_sensor_common *st, bool state)
 
                 poll_value = hid_sensor_read_poll_value(st);
         } else {
-                if (!atomic_dec_and_test(&st->data_ready))
+                int val;
+
+                val = atomic_dec_if_positive(&st->data_ready);
+                if (val < 0)
                         return 0;
+
                 sensor_hub_device_close(st->hsdev);
                 state_val = hid_sensor_get_usage_index(st->hsdev,
                         st->power_state.report_id,
@@ -92,9 +98,11 @@ EXPORT_SYMBOL(hid_sensor_power_state);
 
 int hid_sensor_power_state(struct hid_sensor_common *st, bool state)
 {
+
 #ifdef CONFIG_PM
         int ret;
 
+        atomic_set(&st->user_requested_state, state);
         if (state)
                 ret = pm_runtime_get_sync(&st->pdev->dev);
         else {
@@ -109,6 +117,7 @@ int hid_sensor_power_state(struct hid_sensor_common *st, bool state)
 
         return 0;
 #else
+        atomic_set(&st->user_requested_state, state);
         return _hid_sensor_power_state(st, state);
 #endif
 }
diff --git a/drivers/iio/dac/ad5624r_spi.c b/drivers/iio/dac/ad5624r_spi.c
index 61bb9d4239ea..e98428df0d44 100644
--- a/drivers/iio/dac/ad5624r_spi.c
+++ b/drivers/iio/dac/ad5624r_spi.c
@@ -22,7 +22,7 @@
 #include "ad5624r.h"
 
 static int ad5624r_spi_write(struct spi_device *spi,
-                             u8 cmd, u8 addr, u16 val, u8 len)
+                             u8 cmd, u8 addr, u16 val, u8 shift)
 {
         u32 data;
         u8 msg[3];
@@ -35,7 +35,7 @@ static int ad5624r_spi_write(struct spi_device *spi,
          * 14-, 12-bit input code followed by 0, 2, or 4 don't care bits,
          * for the AD5664R, AD5644R, and AD5624R, respectively.
          */
-        data = (0 << 22) | (cmd << 19) | (addr << 16) | (val << (16 - len));
+        data = (0 << 22) | (cmd << 19) | (addr << 16) | (val << shift);
         msg[0] = data >> 16;
         msg[1] = data >> 8;
         msg[2] = data;
diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
index 17d4bb15be4d..65ce86837177 100644
--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
@@ -431,6 +431,23 @@ static int inv_mpu6050_write_gyro_scale(struct inv_mpu6050_state *st, int val)
         return -EINVAL;
 }
 
+static int inv_write_raw_get_fmt(struct iio_dev *indio_dev,
+                                 struct iio_chan_spec const *chan, long mask)
+{
+        switch (mask) {
+        case IIO_CHAN_INFO_SCALE:
+                switch (chan->type) {
+                case IIO_ANGL_VEL:
+                        return IIO_VAL_INT_PLUS_NANO;
+                default:
+                        return IIO_VAL_INT_PLUS_MICRO;
+                }
+        default:
+                return IIO_VAL_INT_PLUS_MICRO;
+        }
+
+        return -EINVAL;
+}
 static int inv_mpu6050_write_accel_scale(struct inv_mpu6050_state *st, int val)
 {
         int result, i;
@@ -696,6 +713,7 @@ static const struct iio_info mpu_info = {
         .driver_module = THIS_MODULE,
         .read_raw = &inv_mpu6050_read_raw,
         .write_raw = &inv_mpu6050_write_raw,
+        .write_raw_get_fmt = &inv_write_raw_get_fmt,
         .attrs = &inv_attribute_group,
         .validate_trigger = inv_mpu6050_validate_trigger,
 };
diff --git a/drivers/iio/light/Kconfig b/drivers/iio/light/Kconfig
index e6198b7c9cbf..a5c59251ec0e 100644
--- a/drivers/iio/light/Kconfig
+++ b/drivers/iio/light/Kconfig
@@ -188,6 +188,7 @@ config SENSORS_LM3533
 config LTR501
         tristate "LTR-501ALS-01 light sensor"
         depends on I2C
+        select REGMAP_I2C
         select IIO_BUFFER
         select IIO_TRIGGERED_BUFFER
         help
@@ -201,6 +202,7 @@ config LTR501
 config STK3310
         tristate "STK3310 ALS and proximity sensor"
         depends on I2C
+        select REGMAP_I2C
         help
          Say yes here to get support for the Sensortek STK3310 ambient light
          and proximity sensor. The STK3311 model is also supported by this
diff --git a/drivers/iio/light/cm3323.c b/drivers/iio/light/cm3323.c
index 869033e48a1f..a1d4905cc9d2 100644
--- a/drivers/iio/light/cm3323.c
+++ b/drivers/iio/light/cm3323.c
@@ -123,7 +123,7 @@ static int cm3323_set_it_bits(struct cm3323_data *data, int val, int val2)
         for (i = 0; i < ARRAY_SIZE(cm3323_int_time); i++) {
                 if (val == cm3323_int_time[i].val &&
                     val2 == cm3323_int_time[i].val2) {
-                        reg_conf = data->reg_conf;
+                        reg_conf = data->reg_conf & ~CM3323_CONF_IT_MASK;
                         reg_conf |= i << CM3323_CONF_IT_SHIFT;
 
                         ret = i2c_smbus_write_word_data(data->client,
diff --git a/drivers/iio/light/ltr501.c b/drivers/iio/light/ltr501.c
index 1ef7d3773ab9..b5a0e66b5f28 100644
--- a/drivers/iio/light/ltr501.c
+++ b/drivers/iio/light/ltr501.c
@@ -1302,7 +1302,7 @@ static int ltr501_init(struct ltr501_data *data)
         if (ret < 0)
                 return ret;
 
-        data->als_contr = ret | data->chip_info->als_mode_active;
+        data->als_contr = status | data->chip_info->als_mode_active;
 
         ret = regmap_read(data->regmap, LTR501_PS_CONTR, &status);
         if (ret < 0)
diff --git a/drivers/iio/light/stk3310.c b/drivers/iio/light/stk3310.c
index fee4297d7c8f..11a027adc204 100644
--- a/drivers/iio/light/stk3310.c
+++ b/drivers/iio/light/stk3310.c
@@ -43,7 +43,6 @@
 #define STK3311_CHIP_ID_VAL                     0x1D
 #define STK3310_PSINT_EN                        0x01
 #define STK3310_PS_MAX_VAL                      0xFFFF
-#define STK3310_THRESH_MAX                      0xFFFF
 
 #define STK3310_DRIVER_NAME                     "stk3310"
 #define STK3310_REGMAP_NAME                     "stk3310_regmap"
@@ -84,15 +83,13 @@ static const struct reg_field stk3310_reg_field_flag_psint =
                                 REG_FIELD(STK3310_REG_FLAG, 4, 4);
 static const struct reg_field stk3310_reg_field_flag_nf =
                                 REG_FIELD(STK3310_REG_FLAG, 0, 0);
-/*
- * Maximum PS values with regard to scale. Used to export the 'inverse'
- * PS value (high values for far objects, low values for near objects).
- */
+
+/* Estimate maximum proximity values with regard to measurement scale. */
 static const int stk3310_ps_max[4] = {
-        STK3310_PS_MAX_VAL / 64,
-        STK3310_PS_MAX_VAL / 16,
-        STK3310_PS_MAX_VAL /  4,
-        STK3310_PS_MAX_VAL,
+        STK3310_PS_MAX_VAL / 640,
+        STK3310_PS_MAX_VAL / 160,
+        STK3310_PS_MAX_VAL /  40,
+        STK3310_PS_MAX_VAL /  10
 };
 
 static const int stk3310_scale_table[][2] = {
@@ -128,14 +125,14 @@ static const struct iio_event_spec stk3310_events[] = {
         /* Proximity event */
         {
                 .type = IIO_EV_TYPE_THRESH,
-                .dir = IIO_EV_DIR_FALLING,
+                .dir = IIO_EV_DIR_RISING,
                 .mask_separate = BIT(IIO_EV_INFO_VALUE) |
                                  BIT(IIO_EV_INFO_ENABLE),
         },
         /* Out-of-proximity event */
         {
                 .type = IIO_EV_TYPE_THRESH,
-                .dir = IIO_EV_DIR_RISING,
+                .dir = IIO_EV_DIR_FALLING,
                 .mask_separate = BIT(IIO_EV_INFO_VALUE) |
                                  BIT(IIO_EV_INFO_ENABLE),
         },
@@ -203,25 +200,18 @@ static int stk3310_read_event(struct iio_dev *indio_dev,
                               int *val, int *val2)
 {
         u8 reg;
-        u16 buf;
+        __be16 buf;
         int ret;
-        unsigned int index;
         struct stk3310_data *data = iio_priv(indio_dev);
 
         if (info != IIO_EV_INFO_VALUE)
                 return -EINVAL;
 
-        /*
-         * Only proximity interrupts are implemented at the moment.
-         * Since we're inverting proximity values, the sensor's 'high'
-         * threshold will become our 'low' threshold, associated with
-         * 'near' events. Similarly, the sensor's 'low' threshold will
-         * be our 'high' threshold, associated with 'far' events.
-         */
+        /* Only proximity interrupts are implemented at the moment. */
         if (dir == IIO_EV_DIR_RISING)
-                reg = STK3310_REG_THDL_PS;
-        else if (dir == IIO_EV_DIR_FALLING)
                 reg = STK3310_REG_THDH_PS;
+        else if (dir == IIO_EV_DIR_FALLING)
+                reg = STK3310_REG_THDL_PS;
         else
                 return -EINVAL;
 
@@ -232,8 +222,7 @@ static int stk3310_read_event(struct iio_dev *indio_dev,
                 dev_err(&data->client->dev, "register read failed\n");
                 return ret;
         }
-        regmap_field_read(data->reg_ps_gain, &index);
-        *val = swab16(stk3310_ps_max[index] - buf);
+        *val = be16_to_cpu(buf);
 
         return IIO_VAL_INT;
 }
@@ -246,7 +235,7 @@ static int stk3310_write_event(struct iio_dev *indio_dev,
                                int val, int val2)
 {
         u8 reg;
-        u16 buf;
+        __be16 buf;
         int ret;
         unsigned int index;
         struct stk3310_data *data = iio_priv(indio_dev);
@@ -257,13 +246,13 @@ static int stk3310_write_event(struct iio_dev *indio_dev,
                 return -EINVAL;
 
         if (dir == IIO_EV_DIR_RISING)
-                reg = STK3310_REG_THDL_PS;
-        else if (dir == IIO_EV_DIR_FALLING)
                 reg = STK3310_REG_THDH_PS;
+        else if (dir == IIO_EV_DIR_FALLING)
+                reg = STK3310_REG_THDL_PS;
         else
                 return -EINVAL;
 
-        buf = swab16(stk3310_ps_max[index] - val);
+        buf = cpu_to_be16(val);
         ret = regmap_bulk_write(data->regmap, reg, &buf, 2);
         if (ret < 0)
                 dev_err(&client->dev, "failed to set PS threshold!\n");
@@ -312,7 +301,7 @@ static int stk3310_read_raw(struct iio_dev *indio_dev,
                             int *val, int *val2, long mask)
 {
         u8 reg;
-        u16 buf;
+        __be16 buf;
         int ret;
         unsigned int index;
         struct stk3310_data *data = iio_priv(indio_dev);
@@ -333,15 +322,7 @@ static int stk3310_read_raw(struct iio_dev *indio_dev,
                         mutex_unlock(&data->lock);
                         return ret;
                 }
-                *val = swab16(buf);
-                if (chan->type == IIO_PROXIMITY) {
-                        /*
-                         * Invert the proximity data so we return low values
-                         * for close objects and high values for far ones.
-                         */
-                        regmap_field_read(data->reg_ps_gain, &index);
-                        *val = stk3310_ps_max[index] - *val;
-                }
+                *val = be16_to_cpu(buf);
                 mutex_unlock(&data->lock);
                 return IIO_VAL_INT;
         case IIO_CHAN_INFO_INT_TIME:
@@ -581,8 +562,8 @@ static irqreturn_t stk3310_irq_event_handler(int irq, void *private)
         }
         event = IIO_UNMOD_EVENT_CODE(IIO_PROXIMITY, 1,
                                      IIO_EV_TYPE_THRESH,
-                                     (dir ? IIO_EV_DIR_RISING :
-                                            IIO_EV_DIR_FALLING));
+                                     (dir ? IIO_EV_DIR_FALLING :
+                                            IIO_EV_DIR_RISING));
         iio_push_event(indio_dev, event, data->timestamp);
 
         /* Reset the interrupt flag */
@@ -627,13 +608,7 @@ static int stk3310_probe(struct i2c_client *client,
         if (ret < 0)
                 return ret;
 
-        ret = iio_device_register(indio_dev);
-        if (ret < 0) {
-                dev_err(&client->dev, "device_register failed\n");
-                stk3310_set_state(data, STK3310_STATE_STANDBY);
-        }
-
-        if (client->irq <= 0)
+        if (client->irq < 0)
                 client->irq = stk3310_gpio_probe(client);
 
         if (client->irq >= 0) {
@@ -648,6 +623,12 @@ static int stk3310_probe(struct i2c_client *client,
                                         client->irq);
         }
 
+        ret = iio_device_register(indio_dev);
+        if (ret < 0) {
+                dev_err(&client->dev, "device_register failed\n");
+                stk3310_set_state(data, STK3310_STATE_STANDBY);
+        }
+
         return ret;
 }
 
diff --git a/drivers/iio/light/tcs3414.c b/drivers/iio/light/tcs3414.c
index 71c2bde275aa..f8b1df018abe 100644
--- a/drivers/iio/light/tcs3414.c
+++ b/drivers/iio/light/tcs3414.c
@@ -185,7 +185,7 @@ static int tcs3414_write_raw(struct iio_dev *indio_dev,
                 if (val != 0)
                         return -EINVAL;
                 for (i = 0; i < ARRAY_SIZE(tcs3414_times); i++) {
-                        if (val == tcs3414_times[i] * 1000) {
+                        if (val2 == tcs3414_times[i] * 1000) {
                                 data->timing &= ~TCS3414_INTEG_MASK;
                                 data->timing |= i;
                                 return i2c_smbus_write_byte_data(
diff --git a/drivers/iio/magnetometer/Kconfig b/drivers/iio/magnetometer/Kconfig
index dcadfc4f0661..efb9350b0d76 100644
--- a/drivers/iio/magnetometer/Kconfig
+++ b/drivers/iio/magnetometer/Kconfig
@@ -90,6 +90,7 @@ config IIO_ST_MAGN_SPI_3AXIS
 config BMC150_MAGN
         tristate "Bosch BMC150 Magnetometer Driver"
         depends on I2C
+        select REGMAP_I2C
         select IIO_BUFFER
         select IIO_TRIGGERED_BUFFER
         help
diff --git a/drivers/iio/magnetometer/bmc150_magn.c b/drivers/iio/magnetometer/bmc150_magn.c
index d4c178869991..1347a1f2e46f 100644
--- a/drivers/iio/magnetometer/bmc150_magn.c
+++ b/drivers/iio/magnetometer/bmc150_magn.c
@@ -706,11 +706,11 @@ static int bmc150_magn_init(struct bmc150_magn_data *data)
                 goto err_poweroff;
         }
         if (chip_id != BMC150_MAGN_CHIP_ID_VAL) {
-                dev_err(&data->client->dev, "Invalid chip id 0x%x\n", ret);
+                dev_err(&data->client->dev, "Invalid chip id 0x%x\n", chip_id);
                 ret = -ENODEV;
                 goto err_poweroff;
         }
-        dev_dbg(&data->client->dev, "Chip id %x\n", ret);
+        dev_dbg(&data->client->dev, "Chip id %x\n", chip_id);
 
         preset = bmc150_magn_presets_table[BMC150_MAGN_DEFAULT_PRESET];
         ret = bmc150_magn_set_odr(data, preset.odr);
diff --git a/drivers/iio/magnetometer/mmc35240.c b/drivers/iio/magnetometer/mmc35240.c
index 7a2ea71c659a..706ebfd6297f 100644
--- a/drivers/iio/magnetometer/mmc35240.c
+++ b/drivers/iio/magnetometer/mmc35240.c
@@ -84,10 +84,10 @@
 #define MMC35240_OTP_START_ADDR         0x1B
 
 enum mmc35240_resolution {
-        MMC35240_16_BITS_SLOW = 0, /* 100 Hz */
-        MMC35240_16_BITS_FAST,     /* 200 Hz */
-        MMC35240_14_BITS,          /* 333 Hz */
-        MMC35240_12_BITS,          /* 666 Hz */
+        MMC35240_16_BITS_SLOW = 0, /* 7.92 ms */
+        MMC35240_16_BITS_FAST,     /* 4.08 ms */
+        MMC35240_14_BITS,          /* 2.16 ms */
+        MMC35240_12_BITS,          /* 1.20 ms */
 };
 
 enum mmc35240_axis {
@@ -100,22 +100,22 @@ static const struct {
         int sens[3]; /* sensitivity per X, Y, Z axis */
         int nfo; /* null field output */
 } mmc35240_props_table[] = {
-        /* 16 bits, 100Hz ODR */
+        /* 16 bits, 125Hz ODR */
         {
                 {1024, 1024, 1024},
                 32768,
         },
-        /* 16 bits, 200Hz ODR */
+        /* 16 bits, 250Hz ODR */
         {
                 {1024, 1024, 770},
                 32768,
         },
-        /* 14 bits, 333Hz ODR */
+        /* 14 bits, 450Hz ODR */
         {
                 {256, 256, 193},
                 8192,
         },
-        /* 12 bits, 666Hz ODR */
+        /* 12 bits, 800Hz ODR */
         {
                 {64, 64, 48},
                 2048,
@@ -133,9 +133,15 @@ struct mmc35240_data {
         int axis_scale[3];
 };
 
-static const int mmc35240_samp_freq[] = {100, 200, 333, 666};
+static const struct {
+        int val;
+        int val2;
+} mmc35240_samp_freq[] = { {1, 500000},
+                           {13, 0},
+                           {25, 0},
+                           {50, 0} };
 
-static IIO_CONST_ATTR_SAMP_FREQ_AVAIL("100 200 333 666");
+static IIO_CONST_ATTR_SAMP_FREQ_AVAIL("1.5 13 25 50");
 
 #define MMC35240_CHANNEL(_axis) { \
         .type = IIO_MAGN, \
@@ -168,7 +174,8 @@ static int mmc35240_get_samp_freq_index(struct mmc35240_data *data,
         int i;
 
         for (i = 0; i < ARRAY_SIZE(mmc35240_samp_freq); i++)
-                if (mmc35240_samp_freq[i] == val)
+                if (mmc35240_samp_freq[i].val == val &&
+                    mmc35240_samp_freq[i].val2 == val2)
                         return i;
         return -EINVAL;
 }
@@ -195,8 +202,8 @@ static int mmc35240_hw_set(struct mmc35240_data *data, bool set)
                 coil_bit = MMC35240_CTRL0_RESET_BIT;
 
         return regmap_update_bits(data->regmap, MMC35240_REG_CTRL0,
-                                  MMC35240_CTRL0_REFILL_BIT,
-                                  coil_bit);
+                                  coil_bit, coil_bit);
+
 }
 
 static int mmc35240_init(struct mmc35240_data *data)
@@ -215,14 +222,15 @@ static int mmc35240_init(struct mmc35240_data *data)
 
         /*
          * make sure we restore sensor characteristics, by doing
-         * a RESET/SET sequence
+         * a SET/RESET sequence, the axis polarity being naturally
+         * aligned after RESET
          */
-        ret = mmc35240_hw_set(data, false);
+        ret = mmc35240_hw_set(data, true);
         if (ret < 0)
                 return ret;
         usleep_range(MMC53240_WAIT_SET_RESET, MMC53240_WAIT_SET_RESET + 1);
 
-        ret = mmc35240_hw_set(data, true);
+        ret = mmc35240_hw_set(data, false);
         if (ret < 0)
                 return ret;
 
@@ -378,9 +386,9 @@ static int mmc35240_read_raw(struct iio_dev *indio_dev,
                 if (i < 0 || i >= ARRAY_SIZE(mmc35240_samp_freq))
                         return -EINVAL;
 
-                *val = mmc35240_samp_freq[i];
-                *val2 = 0;
-                return IIO_VAL_INT;
+                *val = mmc35240_samp_freq[i].val;
+                *val2 = mmc35240_samp_freq[i].val2;
+                return IIO_VAL_INT_PLUS_MICRO;
         default:
                 return -EINVAL;
         }
@@ -496,6 +504,7 @@ static int mmc35240_probe(struct i2c_client *client,
         }
 
         data = iio_priv(indio_dev);
+        i2c_set_clientdata(client, indio_dev);
         data->client = client;
         data->regmap = regmap;
         data->res = MMC35240_16_BITS_SLOW;
diff --git a/drivers/iio/proximity/sx9500.c b/drivers/iio/proximity/sx9500.c
index 2042e375f835..3d756bd8c703 100644
--- a/drivers/iio/proximity/sx9500.c
+++ b/drivers/iio/proximity/sx9500.c
@@ -80,6 +80,7 @@
 #define SX9500_COMPSTAT_MASK            GENMASK(3, 0)
 
 #define SX9500_NUM_CHANNELS             4
+#define SX9500_CHAN_MASK                GENMASK(SX9500_NUM_CHANNELS - 1, 0)
 
 struct sx9500_data {
         struct mutex mutex;
@@ -281,7 +282,7 @@ static int sx9500_read_prox_data(struct sx9500_data *data,
         if (ret < 0)
                 return ret;
 
-        *val = 32767 - (s16)be16_to_cpu(regval);
+        *val = be16_to_cpu(regval);
 
         return IIO_VAL_INT;
 }
@@ -329,27 +330,29 @@ static int sx9500_read_proximity(struct sx9500_data *data,
         else
                 ret = sx9500_wait_for_sample(data);
 
-        if (ret < 0)
-                return ret;
-
         mutex_lock(&data->mutex);
 
-        ret = sx9500_read_prox_data(data, chan, val);
         if (ret < 0)
-                goto out;
+                goto out_dec_data_rdy;
 
-        ret = sx9500_dec_chan_users(data, chan->channel);
+        ret = sx9500_read_prox_data(data, chan, val);
         if (ret < 0)
-                goto out;
+                goto out_dec_data_rdy;
 
         ret = sx9500_dec_data_rdy_users(data);
         if (ret < 0)
+                goto out_dec_chan;
+
+        ret = sx9500_dec_chan_users(data, chan->channel);
+        if (ret < 0)
                 goto out;
 
         ret = IIO_VAL_INT;
 
         goto out;
 
+out_dec_data_rdy:
+        sx9500_dec_data_rdy_users(data);
 out_dec_chan:
         sx9500_dec_chan_users(data, chan->channel);
 out:
@@ -679,7 +682,7 @@ out:
 static int sx9500_buffer_preenable(struct iio_dev *indio_dev)
 {
         struct sx9500_data *data = iio_priv(indio_dev);
-        int ret, i;
+        int ret = 0, i;
 
         mutex_lock(&data->mutex);
 
@@ -703,7 +706,7 @@ static int sx9500_buffer_preenable(struct iio_dev *indio_dev)
 static int sx9500_buffer_predisable(struct iio_dev *indio_dev)
 {
         struct sx9500_data *data = iio_priv(indio_dev);
-        int ret, i;
+        int ret = 0, i;
 
         iio_triggered_buffer_predisable(indio_dev);
 
@@ -800,8 +803,7 @@ static int sx9500_init_compensation(struct iio_dev *indio_dev)
         unsigned int val;
 
         ret = regmap_update_bits(data->regmap, SX9500_REG_PROX_CTRL0,
-                                 GENMASK(SX9500_NUM_CHANNELS, 0),
-                                 GENMASK(SX9500_NUM_CHANNELS, 0));
+                                 SX9500_CHAN_MASK, SX9500_CHAN_MASK);
         if (ret < 0)
                 return ret;
 
@@ -821,7 +823,7 @@ static int sx9500_init_compensation(struct iio_dev *indio_dev)
 
 out:
         regmap_update_bits(data->regmap, SX9500_REG_PROX_CTRL0,
-                           GENMASK(SX9500_NUM_CHANNELS, 0), 0);
+                           SX9500_CHAN_MASK, 0);
         return ret;
 }
 
diff --git a/drivers/iio/temperature/mlx90614.c b/drivers/iio/temperature/mlx90614.c
index cb2e8ad8bfdc..7a2b639eaa96 100644
--- a/drivers/iio/temperature/mlx90614.c
+++ b/drivers/iio/temperature/mlx90614.c
@@ -204,7 +204,7 @@ static int mlx90614_read_raw(struct iio_dev *indio_dev,
                 *val = ret;
                 return IIO_VAL_INT;
         case IIO_CHAN_INFO_OFFSET:
-                *val = 13657;
+                *val = -13657;
                 *val2 = 500000;
                 return IIO_VAL_INT_PLUS_MICRO;
         case IIO_CHAN_INFO_SCALE:
diff --git a/drivers/iio/temperature/tmp006.c b/drivers/iio/temperature/tmp006.c
index fcc49f89b946..8f21f32f9739 100644
--- a/drivers/iio/temperature/tmp006.c
+++ b/drivers/iio/temperature/tmp006.c
@@ -132,6 +132,9 @@ static int tmp006_write_raw(struct iio_dev *indio_dev,
         struct tmp006_data *data = iio_priv(indio_dev);
         int i;
 
+        if (mask != IIO_CHAN_INFO_SAMP_FREQ)
+                return -EINVAL;
+
         for (i = 0; i < ARRAY_SIZE(tmp006_freqs); i++)
                 if ((val == tmp006_freqs[i][0]) &&
                     (val2 == tmp006_freqs[i][1])) {
diff --git a/drivers/infiniband/core/agent.c b/drivers/infiniband/core/agent.c
index c7dcfe4ca5f1..0429040304fd 100644
--- a/drivers/infiniband/core/agent.c
+++ b/drivers/infiniband/core/agent.c
@@ -88,7 +88,7 @@ void agent_send_response(const struct ib_mad_hdr *mad_hdr, const struct ib_grh *
         struct ib_ah *ah;
         struct ib_mad_send_wr_private *mad_send_wr;
 
-        if (device->node_type == RDMA_NODE_IB_SWITCH)
+        if (rdma_cap_ib_switch(device))
                 port_priv = ib_get_agent_port(device, 0);
         else
                 port_priv = ib_get_agent_port(device, port_num);
@@ -122,7 +122,7 @@ void agent_send_response(const struct ib_mad_hdr *mad_hdr, const struct ib_grh *
         memcpy(send_buf->mad, mad_hdr, resp_mad_len);
         send_buf->ah = ah;
 
-        if (device->node_type == RDMA_NODE_IB_SWITCH) {
+        if (rdma_cap_ib_switch(device)) {
                 mad_send_wr = container_of(send_buf,
                                            struct ib_mad_send_wr_private,
                                            send_buf);
diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
index dbddddd6fb5d..3a972ebf3c0d 100644
--- a/drivers/infiniband/core/cm.c
+++ b/drivers/infiniband/core/cm.c
@@ -169,6 +169,7 @@ struct cm_device {
         struct ib_device *ib_device;
         struct device *device;
         u8 ack_delay;
+        int going_down;
         struct cm_port *port[0];
 };
 
@@ -805,6 +806,11 @@ static void cm_enter_timewait(struct cm_id_private *cm_id_priv)
 {
         int wait_time;
         unsigned long flags;
+        struct cm_device *cm_dev;
+
+        cm_dev = ib_get_client_data(cm_id_priv->id.device, &cm_client);
+        if (!cm_dev)
+                return;
 
         spin_lock_irqsave(&cm.lock, flags);
         cm_cleanup_timewait(cm_id_priv->timewait_info);
@@ -818,8 +824,14 @@ static void cm_enter_timewait(struct cm_id_private *cm_id_priv)
          */
         cm_id_priv->id.state = IB_CM_TIMEWAIT;
         wait_time = cm_convert_to_ms(cm_id_priv->av.timeout);
-        queue_delayed_work(cm.wq, &cm_id_priv->timewait_info->work.work,
-                           msecs_to_jiffies(wait_time));
+
+        /* Check if the device started its remove_one */
+        spin_lock_irq(&cm.lock);
+        if (!cm_dev->going_down)
+                queue_delayed_work(cm.wq, &cm_id_priv->timewait_info->work.work,
+                                   msecs_to_jiffies(wait_time));
+        spin_unlock_irq(&cm.lock);
+
         cm_id_priv->timewait_info = NULL;
 }
 
@@ -3305,6 +3317,11 @@ static int cm_establish(struct ib_cm_id *cm_id)
         struct cm_work *work;
         unsigned long flags;
         int ret = 0;
+        struct cm_device *cm_dev;
+
+        cm_dev = ib_get_client_data(cm_id->device, &cm_client);
+        if (!cm_dev)
+                return -ENODEV;
 
         work = kmalloc(sizeof *work, GFP_ATOMIC);
         if (!work)
@@ -3343,7 +3360,17 @@ static int cm_establish(struct ib_cm_id *cm_id)
         work->remote_id = cm_id->remote_id;
         work->mad_recv_wc = NULL;
         work->cm_event.event = IB_CM_USER_ESTABLISHED;
-        queue_delayed_work(cm.wq, &work->work, 0);
+
+        /* Check if the device started its remove_one */
+        spin_lock_irq(&cm.lock);
+        if (!cm_dev->going_down) {
+                queue_delayed_work(cm.wq, &work->work, 0);
+        } else {
+                kfree(work);
+                ret = -ENODEV;
+        }
+        spin_unlock_irq(&cm.lock);
+
 out:
         return ret;
 }
@@ -3394,6 +3421,7 @@ static void cm_recv_handler(struct ib_mad_agent *mad_agent,
         enum ib_cm_event_type event;
         u16 attr_id;
         int paths = 0;
+        int going_down = 0;
 
         switch (mad_recv_wc->recv_buf.mad->mad_hdr.attr_id) {
         case CM_REQ_ATTR_ID:
@@ -3452,7 +3480,19 @@ static void cm_recv_handler(struct ib_mad_agent *mad_agent,
         work->cm_event.event = event;
         work->mad_recv_wc = mad_recv_wc;
         work->port = port;
-        queue_delayed_work(cm.wq, &work->work, 0);
+
+        /* Check if the device started its remove_one */
+        spin_lock_irq(&cm.lock);
+        if (!port->cm_dev->going_down)
+                queue_delayed_work(cm.wq, &work->work, 0);
+        else
+                going_down = 1;
+        spin_unlock_irq(&cm.lock);
+
+        if (going_down) {
+                kfree(work);
+                ib_free_recv_mad(mad_recv_wc);
+        }
 }
 
 static int cm_init_qp_init_attr(struct cm_id_private *cm_id_priv,
@@ -3771,7 +3811,7 @@ static void cm_add_one(struct ib_device *ib_device)
 
         cm_dev->ib_device = ib_device;
         cm_get_ack_delay(cm_dev);
-
+        cm_dev->going_down = 0;
         cm_dev->device = device_create(&cm_class, &ib_device->dev,
                                        MKDEV(0, 0), NULL,
                                        "%s", ib_device->name);
@@ -3864,14 +3904,23 @@ static void cm_remove_one(struct ib_device *ib_device)
         list_del(&cm_dev->list);
         write_unlock_irqrestore(&cm.device_lock, flags);
 
+        spin_lock_irq(&cm.lock);
+        cm_dev->going_down = 1;
+        spin_unlock_irq(&cm.lock);
+
         for (i = 1; i <= ib_device->phys_port_cnt; i++) {
                 if (!rdma_cap_ib_cm(ib_device, i))
                         continue;
 
                 port = cm_dev->port[i-1];
                 ib_modify_port(ib_device, port->port_num, 0, &port_modify);
-                ib_unregister_mad_agent(port->mad_agent);
+                /*
+                 * We flush the queue here after the going_down set, this
+                 * verify that no new works will be queued in the recv handler,
+                 * after that we can call the unregister_mad_agent
+                 */
                 flush_workqueue(cm.wq);
+                ib_unregister_mad_agent(port->mad_agent);
                 cm_remove_port_fs(port);
         }
         device_unregister(cm_dev->device);
diff --git a/drivers/infiniband/core/iwpm_msg.c b/drivers/infiniband/core/iwpm_msg.c
index e6ffa2e66c1a..22a3abee2a54 100644
--- a/drivers/infiniband/core/iwpm_msg.c
+++ b/drivers/infiniband/core/iwpm_msg.c
@@ -67,7 +67,8 @@ int iwpm_register_pid(struct iwpm_dev_data *pm_msg, u8 nl_client)
                 err_str = "Invalid port mapper client";
                 goto pid_query_error;
         }
-        if (iwpm_registered_client(nl_client))
+        if (iwpm_check_registration(nl_client, IWPM_REG_VALID) ||
+                        iwpm_user_pid == IWPM_PID_UNAVAILABLE)
                 return 0;
         skb = iwpm_create_nlmsg(RDMA_NL_IWPM_REG_PID, &nlh, nl_client);
         if (!skb) {
@@ -106,7 +107,6 @@ int iwpm_register_pid(struct iwpm_dev_data *pm_msg, u8 nl_client)
         ret = ibnl_multicast(skb, nlh, RDMA_NL_GROUP_IWPM, GFP_KERNEL);
         if (ret) {
                 skb = NULL; /* skb is freed in the netlink send-op handling */
-                iwpm_set_registered(nl_client, 1);
                 iwpm_user_pid = IWPM_PID_UNAVAILABLE;
                 err_str = "Unable to send a nlmsg";
                 goto pid_query_error;
@@ -144,12 +144,12 @@ int iwpm_add_mapping(struct iwpm_sa_data *pm_msg, u8 nl_client)
                 err_str = "Invalid port mapper client";
                 goto add_mapping_error;
         }
-        if (!iwpm_registered_client(nl_client)) {
+        if (!iwpm_valid_pid())
+                return 0;
+        if (!iwpm_check_registration(nl_client, IWPM_REG_VALID)) {
                 err_str = "Unregistered port mapper client";
                 goto add_mapping_error;
         }
-        if (!iwpm_valid_pid())
-                return 0;
         skb = iwpm_create_nlmsg(RDMA_NL_IWPM_ADD_MAPPING, &nlh, nl_client);
         if (!skb) {
                 err_str = "Unable to create a nlmsg";
@@ -214,12 +214,12 @@ int iwpm_add_and_query_mapping(struct iwpm_sa_data *pm_msg, u8 nl_client)
                 err_str = "Invalid port mapper client";
                 goto query_mapping_error;
         }
-        if (!iwpm_registered_client(nl_client)) {
+        if (!iwpm_valid_pid())
+                return 0;
+        if (!iwpm_check_registration(nl_client, IWPM_REG_VALID)) {
                 err_str = "Unregistered port mapper client";
                 goto query_mapping_error;
         }
-        if (!iwpm_valid_pid())
-                return 0;
         ret = -ENOMEM;
         skb = iwpm_create_nlmsg(RDMA_NL_IWPM_QUERY_MAPPING, &nlh, nl_client);
         if (!skb) {
@@ -288,12 +288,12 @@ int iwpm_remove_mapping(struct sockaddr_storage *local_addr, u8 nl_client)
                 err_str = "Invalid port mapper client";
                 goto remove_mapping_error;
         }
-        if (!iwpm_registered_client(nl_client)) {
+        if (!iwpm_valid_pid())
+                return 0;
+        if (iwpm_check_registration(nl_client, IWPM_REG_UNDEF)) {
                 err_str = "Unregistered port mapper client";
                 goto remove_mapping_error;
         }
-        if (!iwpm_valid_pid())
-                return 0;
         skb = iwpm_create_nlmsg(RDMA_NL_IWPM_REMOVE_MAPPING, &nlh, nl_client);
         if (!skb) {
                 ret = -ENOMEM;
@@ -388,7 +388,7 @@ int iwpm_register_pid_cb(struct sk_buff *skb, struct netlink_callback *cb)
         pr_debug("%s: iWarp Port Mapper (pid = %d) is available!\n",
                         __func__, iwpm_user_pid);
         if (iwpm_valid_client(nl_client))
-                iwpm_set_registered(nl_client, 1);
+                iwpm_set_registration(nl_client, IWPM_REG_VALID);
 register_pid_response_exit:
         nlmsg_request->request_done = 1;
         /* always for found nlmsg_request */
@@ -644,7 +644,6 @@ int iwpm_mapping_info_cb(struct sk_buff *skb, struct netlink_callback *cb)
 {
         struct nlattr *nltb[IWPM_NLA_MAPINFO_REQ_MAX];
         const char *msg_type = "Mapping Info response";
-        int iwpm_pid;
         u8 nl_client;
         char *iwpm_name;
         u16 iwpm_version;
@@ -669,14 +668,14 @@ int iwpm_mapping_info_cb(struct sk_buff *skb, struct netlink_callback *cb)
                                 __func__, nl_client);
                 return ret;
         }
-        iwpm_set_registered(nl_client, 0);
+        iwpm_set_registration(nl_client, IWPM_REG_INCOMPL);
         atomic_set(&echo_nlmsg_seq, cb->nlh->nlmsg_seq);
+        iwpm_user_pid = cb->nlh->nlmsg_pid;
         if (!iwpm_mapinfo_available())
                 return 0;
-        iwpm_pid = cb->nlh->nlmsg_pid;
         pr_debug("%s: iWarp Port Mapper (pid = %d) is available!\n",
-                 __func__, iwpm_pid);
-        ret = iwpm_send_mapinfo(nl_client, iwpm_pid);
+                 __func__, iwpm_user_pid);
+        ret = iwpm_send_mapinfo(nl_client, iwpm_user_pid);
         return ret;
 }
 EXPORT_SYMBOL(iwpm_mapping_info_cb);
diff --git a/drivers/infiniband/core/iwpm_util.c b/drivers/infiniband/core/iwpm_util.c
index a626795bf9c7..5fb089e91353 100644
--- a/drivers/infiniband/core/iwpm_util.c
+++ b/drivers/infiniband/core/iwpm_util.c
@@ -78,6 +78,7 @@ init_exit:
         mutex_unlock(&iwpm_admin_lock);
         if (!ret) {
                 iwpm_set_valid(nl_client, 1);
+                iwpm_set_registration(nl_client, IWPM_REG_UNDEF);
                 pr_debug("%s: Mapinfo and reminfo tables are created\n",
                                 __func__);
         }
@@ -106,6 +107,7 @@ int iwpm_exit(u8 nl_client)
         }
         mutex_unlock(&iwpm_admin_lock);
         iwpm_set_valid(nl_client, 0);
+        iwpm_set_registration(nl_client, IWPM_REG_UNDEF);
         return 0;
 }
 EXPORT_SYMBOL(iwpm_exit);
@@ -397,17 +399,23 @@ void iwpm_set_valid(u8 nl_client, int valid)
 }
 
 /* valid client */
-int iwpm_registered_client(u8 nl_client)
+u32 iwpm_get_registration(u8 nl_client)
 {
         return iwpm_admin.reg_list[nl_client];
 }
 
 /* valid client */
-void iwpm_set_registered(u8 nl_client, int reg)
+void iwpm_set_registration(u8 nl_client, u32 reg)
 {
         iwpm_admin.reg_list[nl_client] = reg;
 }
 
+/* valid client */
+u32 iwpm_check_registration(u8 nl_client, u32 reg)
+{
+        return (iwpm_get_registration(nl_client) & reg);
+}
+
 int iwpm_compare_sockaddr(struct sockaddr_storage *a_sockaddr,
                                 struct sockaddr_storage *b_sockaddr)
 {
diff --git a/drivers/infiniband/core/iwpm_util.h b/drivers/infiniband/core/iwpm_util.h
index ee2d9ff095be..b7b9e194ce81 100644
--- a/drivers/infiniband/core/iwpm_util.h
+++ b/drivers/infiniband/core/iwpm_util.h
@@ -58,6 +58,10 @@
 #define IWPM_PID_UNDEFINED     -1
 #define IWPM_PID_UNAVAILABLE   -2
 
+#define IWPM_REG_UNDEF          0x01
+#define IWPM_REG_VALID          0x02
+#define IWPM_REG_INCOMPL        0x04
+
 struct iwpm_nlmsg_request {
         struct list_head    inprocess_list;
         __u32               nlmsg_seq;
@@ -88,7 +92,7 @@ struct iwpm_admin_data {
         atomic_t refcount;
         atomic_t nlmsg_seq;
         int      client_list[RDMA_NL_NUM_CLIENTS];
-        int      reg_list[RDMA_NL_NUM_CLIENTS];
+        u32      reg_list[RDMA_NL_NUM_CLIENTS];
 };
 
 /**
@@ -159,19 +163,31 @@ int iwpm_valid_client(u8 nl_client);
 void iwpm_set_valid(u8 nl_client, int valid);
 
 /**
- * iwpm_registered_client - Check if the port mapper client is registered
+ * iwpm_check_registration - Check if the client registration
+ *                            matches the given one
  * @nl_client: The index of the netlink client
+ * @reg: The given registration type to compare with
  *
  * Call iwpm_register_pid() to register a client
+ * Returns true if the client registration matches reg,
+ * otherwise returns false
+ */
+u32 iwpm_check_registration(u8 nl_client, u32 reg);
+
+/**
+ * iwpm_set_registration - Set the client registration
+ * @nl_client: The index of the netlink client
+ * @reg: Registration type to set
  */
-int iwpm_registered_client(u8 nl_client);
+void iwpm_set_registration(u8 nl_client, u32 reg);
 
 /**
- * iwpm_set_registered - Set the port mapper client to registered or not
+ * iwpm_get_registration
  * @nl_client: The index of the netlink client
- * @reg: 1 if registered or 0 if not
+ *
+ * Returns the client registration type
  */
-void iwpm_set_registered(u8 nl_client, int reg);
+u32 iwpm_get_registration(u8 nl_client);
 
 /**
  * iwpm_send_mapinfo - Send local and mapped IPv4/IPv6 address info of
diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
index a4b1466c1bf6..786fc51bf04b 100644
--- a/drivers/infiniband/core/mad.c
+++ b/drivers/infiniband/core/mad.c
@@ -769,7 +769,7 @@ static int handle_outgoing_dr_smp(struct ib_mad_agent_private *mad_agent_priv,
         bool opa = rdma_cap_opa_mad(mad_agent_priv->qp_info->port_priv->device,
                                     mad_agent_priv->qp_info->port_priv->port_num);
 
-        if (device->node_type == RDMA_NODE_IB_SWITCH &&
+        if (rdma_cap_ib_switch(device) &&
             smp->mgmt_class == IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE)
                 port_num = send_wr->wr.ud.port_num;
         else
@@ -787,14 +787,15 @@ static int handle_outgoing_dr_smp(struct ib_mad_agent_private *mad_agent_priv,
                 if ((opa_get_smp_direction(opa_smp)
                      ? opa_smp->route.dr.dr_dlid : opa_smp->route.dr.dr_slid) ==
                      OPA_LID_PERMISSIVE &&
-                     opa_smi_handle_dr_smp_send(opa_smp, device->node_type,
+                     opa_smi_handle_dr_smp_send(opa_smp,
+                                                rdma_cap_ib_switch(device),
                                                 port_num) == IB_SMI_DISCARD) {
                         ret = -EINVAL;
                         dev_err(&device->dev, "OPA Invalid directed route\n");
                         goto out;
                 }
                 opa_drslid = be32_to_cpu(opa_smp->route.dr.dr_slid);
-                if (opa_drslid != OPA_LID_PERMISSIVE &&
+                if (opa_drslid != be32_to_cpu(OPA_LID_PERMISSIVE) &&
                     opa_drslid & 0xffff0000) {
                         ret = -EINVAL;
                         dev_err(&device->dev, "OPA Invalid dr_slid 0x%x\n",
@@ -810,7 +811,7 @@ static int handle_outgoing_dr_smp(struct ib_mad_agent_private *mad_agent_priv,
         } else {
                 if ((ib_get_smp_direction(smp) ? smp->dr_dlid : smp->dr_slid) ==
                      IB_LID_PERMISSIVE &&
-                     smi_handle_dr_smp_send(smp, device->node_type, port_num) ==
+                     smi_handle_dr_smp_send(smp, rdma_cap_ib_switch(device), port_num) ==
                      IB_SMI_DISCARD) {
                         ret = -EINVAL;
                         dev_err(&device->dev, "Invalid directed route\n");
@@ -2030,7 +2031,7 @@ static enum smi_action handle_ib_smi(const struct ib_mad_port_private *port_priv
         struct ib_smp *smp = (struct ib_smp *)recv->mad;
 
         if (smi_handle_dr_smp_recv(smp,
-                                   port_priv->device->node_type,
+                                   rdma_cap_ib_switch(port_priv->device),
                                    port_num,
                                    port_priv->device->phys_port_cnt) ==
                                    IB_SMI_DISCARD)
@@ -2042,13 +2043,13 @@ static enum smi_action handle_ib_smi(const struct ib_mad_port_private *port_priv
 
         if (retsmi == IB_SMI_SEND) { /* don't forward */
                 if (smi_handle_dr_smp_send(smp,
-                                           port_priv->device->node_type,
+                                           rdma_cap_ib_switch(port_priv->device),
                                            port_num) == IB_SMI_DISCARD)
                         return IB_SMI_DISCARD;
 
                 if (smi_check_local_smp(smp, port_priv->device) == IB_SMI_DISCARD)
                         return IB_SMI_DISCARD;
-        } else if (port_priv->device->node_type == RDMA_NODE_IB_SWITCH) {
+        } else if (rdma_cap_ib_switch(port_priv->device)) {
                 /* forward case for switches */
                 memcpy(response, recv, mad_priv_size(response));
                 response->header.recv_wc.wc = &response->header.wc;
@@ -2115,7 +2116,7 @@ handle_opa_smi(struct ib_mad_port_private *port_priv,
         struct opa_smp *smp = (struct opa_smp *)recv->mad;
 
         if (opa_smi_handle_dr_smp_recv(smp,
-                                   port_priv->device->node_type,
+                                   rdma_cap_ib_switch(port_priv->device),
                                    port_num,
                                    port_priv->device->phys_port_cnt) ==
                                    IB_SMI_DISCARD)
@@ -2127,7 +2128,7 @@ handle_opa_smi(struct ib_mad_port_private *port_priv,
 
         if (retsmi == IB_SMI_SEND) { /* don't forward */
                 if (opa_smi_handle_dr_smp_send(smp,
-                                           port_priv->device->node_type,
+                                           rdma_cap_ib_switch(port_priv->device),
                                            port_num) == IB_SMI_DISCARD)
                         return IB_SMI_DISCARD;
 
@@ -2135,7 +2136,7 @@ handle_opa_smi(struct ib_mad_port_private *port_priv,
                     IB_SMI_DISCARD)
                         return IB_SMI_DISCARD;
 
-        } else if (port_priv->device->node_type == RDMA_NODE_IB_SWITCH) {
+        } else if (rdma_cap_ib_switch(port_priv->device)) {
                 /* forward case for switches */
                 memcpy(response, recv, mad_priv_size(response));
                 response->header.recv_wc.wc = &response->header.wc;
@@ -2235,7 +2236,7 @@ static void ib_mad_recv_done_handler(struct ib_mad_port_private *port_priv,
                 goto out;
         }
 
-        if (port_priv->device->node_type == RDMA_NODE_IB_SWITCH)
+        if (rdma_cap_ib_switch(port_priv->device))
                 port_num = wc->port_num;
         else
                 port_num = port_priv->port_num;
@@ -3297,17 +3298,11 @@ static int ib_mad_port_close(struct ib_device *device, int port_num)
 
 static void ib_mad_init_device(struct ib_device *device)
 {
-        int start, end, i;
+        int start, i;
 
-        if (device->node_type == RDMA_NODE_IB_SWITCH) {
-                start = 0;
-                end   = 0;
-        } else {
-                start = 1;
-                end   = device->phys_port_cnt;
-        }
+        start = rdma_start_port(device);
 
-        for (i = start; i <= end; i++) {
+        for (i = start; i <= rdma_end_port(device); i++) {
                 if (!rdma_cap_ib_mad(device, i))
                         continue;
 
@@ -3342,17 +3337,9 @@ error:
 
 static void ib_mad_remove_device(struct ib_device *device)
 {
-        int start, end, i;
-
-        if (device->node_type == RDMA_NODE_IB_SWITCH) {
-                start = 0;
-                end   = 0;
-        } else {
-                start = 1;
-                end   = device->phys_port_cnt;
-        }
+        int i;
 
-        for (i = start; i <= end; i++) {
+        for (i = rdma_start_port(device); i <= rdma_end_port(device); i++) {
                 if (!rdma_cap_ib_mad(device, i))
                         continue;
 
diff --git a/drivers/infiniband/core/multicast.c b/drivers/infiniband/core/multicast.c
index 1244f02a5c6d..2cb865c7ce7a 100644
--- a/drivers/infiniband/core/multicast.c
+++ b/drivers/infiniband/core/multicast.c
@@ -812,12 +812,8 @@ static void mcast_add_one(struct ib_device *device)
         if (!dev)
                 return;
 
-        if (device->node_type == RDMA_NODE_IB_SWITCH)
-                dev->start_port = dev->end_port = 0;
-        else {
-                dev->start_port = 1;
-                dev->end_port = device->phys_port_cnt;
-        }
+        dev->start_port = rdma_start_port(device);
+        dev->end_port = rdma_end_port(device);
 
         for (i = 0; i <= dev->end_port - dev->start_port; i++) {
                 if (!rdma_cap_ib_mcast(device, dev->start_port + i))
diff --git a/drivers/infiniband/core/opa_smi.h b/drivers/infiniband/core/opa_smi.h
index 62d91bfa4cb7..3bfab3505a29 100644
--- a/drivers/infiniband/core/opa_smi.h
+++ b/drivers/infiniband/core/opa_smi.h
@@ -39,12 +39,12 @@
 
 #include "smi.h"
 
-enum smi_action opa_smi_handle_dr_smp_recv(struct opa_smp *smp, u8 node_type,
+enum smi_action opa_smi_handle_dr_smp_recv(struct opa_smp *smp, bool is_switch,
                                        int port_num, int phys_port_cnt);
 int opa_smi_get_fwd_port(struct opa_smp *smp);
 extern enum smi_forward_action opa_smi_check_forward_dr_smp(struct opa_smp *smp);
 extern enum smi_action opa_smi_handle_dr_smp_send(struct opa_smp *smp,
-                                              u8 node_type, int port_num);
+                                              bool is_switch, int port_num);
 
 /*
  * Return IB_SMI_HANDLE if the SMP should be handled by the local SMA/SM
diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
index 0fae85062a65..ca919f429666 100644
--- a/drivers/infiniband/core/sa_query.c
+++ b/drivers/infiniband/core/sa_query.c
@@ -1156,12 +1156,8 @@ static void ib_sa_add_one(struct ib_device *device)
         int s, e, i;
         int count = 0;
 
-        if (device->node_type == RDMA_NODE_IB_SWITCH)
-                s = e = 0;
-        else {
-                s = 1;
-                e = device->phys_port_cnt;
-        }
+        s = rdma_start_port(device);
+        e = rdma_end_port(device);
 
         sa_dev = kzalloc(sizeof *sa_dev +
                          (e - s + 1) * sizeof (struct ib_sa_port),
diff --git a/drivers/infiniband/core/smi.c b/drivers/infiniband/core/smi.c
index 368a561d1a5d..f19b23817c2b 100644
--- a/drivers/infiniband/core/smi.c
+++ b/drivers/infiniband/core/smi.c
@@ -41,7 +41,7 @@
 #include "smi.h"
 #include "opa_smi.h"
 
-static enum smi_action __smi_handle_dr_smp_send(u8 node_type, int port_num,
+static enum smi_action __smi_handle_dr_smp_send(bool is_switch, int port_num,
                                                 u8 *hop_ptr, u8 hop_cnt,
                                                 const u8 *initial_path,
                                                 const u8 *return_path,
@@ -64,7 +64,7 @@ static enum smi_action __smi_handle_dr_smp_send(u8 node_type, int port_num,
 
                 /* C14-9:2 */
                 if (*hop_ptr && *hop_ptr < hop_cnt) {
-                        if (node_type != RDMA_NODE_IB_SWITCH)
+                        if (!is_switch)
                                 return IB_SMI_DISCARD;
 
                         /* return_path set when received */
@@ -77,7 +77,7 @@ static enum smi_action __smi_handle_dr_smp_send(u8 node_type, int port_num,
                 if (*hop_ptr == hop_cnt) {
                         /* return_path set when received */
                         (*hop_ptr)++;
-                        return (node_type == RDMA_NODE_IB_SWITCH ||
+                        return (is_switch ||
                                 dr_dlid_is_permissive ?
                                 IB_SMI_HANDLE : IB_SMI_DISCARD);
                 }
@@ -96,7 +96,7 @@ static enum smi_action __smi_handle_dr_smp_send(u8 node_type, int port_num,
 
                 /* C14-13:2 */
                 if (2 <= *hop_ptr && *hop_ptr <= hop_cnt) {
-                        if (node_type != RDMA_NODE_IB_SWITCH)
+                        if (!is_switch)
                                 return IB_SMI_DISCARD;
 
                         (*hop_ptr)--;
@@ -108,7 +108,7 @@ static enum smi_action __smi_handle_dr_smp_send(u8 node_type, int port_num,
                 if (*hop_ptr == 1) {
                         (*hop_ptr)--;
                         /* C14-13:3 -- SMPs destined for SM shouldn't be here */
-                        return (node_type == RDMA_NODE_IB_SWITCH ||
+                        return (is_switch ||
                                 dr_slid_is_permissive ?
                                 IB_SMI_HANDLE : IB_SMI_DISCARD);
                 }
@@ -127,9 +127,9 @@ static enum smi_action __smi_handle_dr_smp_send(u8 node_type, int port_num,
  * Return IB_SMI_DISCARD if the SMP should be discarded
  */
 enum smi_action smi_handle_dr_smp_send(struct ib_smp *smp,
-                                       u8 node_type, int port_num)
+                                       bool is_switch, int port_num)
 {
-        return __smi_handle_dr_smp_send(node_type, port_num,
+        return __smi_handle_dr_smp_send(is_switch, port_num,
                                         &smp->hop_ptr, smp->hop_cnt,
                                         smp->initial_path,
                                         smp->return_path,
@@ -139,9 +139,9 @@ enum smi_action smi_handle_dr_smp_send(struct ib_smp *smp,
 }
 
 enum smi_action opa_smi_handle_dr_smp_send(struct opa_smp *smp,
-                                       u8 node_type, int port_num)
+                                       bool is_switch, int port_num)
 {
-        return __smi_handle_dr_smp_send(node_type, port_num,
+        return __smi_handle_dr_smp_send(is_switch, port_num,
                                         &smp->hop_ptr, smp->hop_cnt,
                                         smp->route.dr.initial_path,
                                         smp->route.dr.return_path,
@@ -152,7 +152,7 @@ enum smi_action opa_smi_handle_dr_smp_send(struct opa_smp *smp,
                                         OPA_LID_PERMISSIVE);
 }
 
-static enum smi_action __smi_handle_dr_smp_recv(u8 node_type, int port_num,
+static enum smi_action __smi_handle_dr_smp_recv(bool is_switch, int port_num,
                                                 int phys_port_cnt,
                                                 u8 *hop_ptr, u8 hop_cnt,
                                                 const u8 *initial_path,
@@ -173,7 +173,7 @@ static enum smi_action __smi_handle_dr_smp_recv(u8 node_type, int port_num,
 
                 /* C14-9:2 -- intermediate hop */
                 if (*hop_ptr && *hop_ptr < hop_cnt) {
-                        if (node_type != RDMA_NODE_IB_SWITCH)
+                        if (!is_switch)
                                 return IB_SMI_DISCARD;
 
                         return_path[*hop_ptr] = port_num;
@@ -188,7 +188,7 @@ static enum smi_action __smi_handle_dr_smp_recv(u8 node_type, int port_num,
                                 return_path[*hop_ptr] = port_num;
                         /* hop_ptr updated when sending */
 
-                        return (node_type == RDMA_NODE_IB_SWITCH ||
+                        return (is_switch ||
                                 dr_dlid_is_permissive ?
                                 IB_SMI_HANDLE : IB_SMI_DISCARD);
                 }
@@ -208,7 +208,7 @@ static enum smi_action __smi_handle_dr_smp_recv(u8 node_type, int port_num,
 
                 /* C14-13:2 */
                 if (2 <= *hop_ptr && *hop_ptr <= hop_cnt) {
-                        if (node_type != RDMA_NODE_IB_SWITCH)
+                        if (!is_switch)
                                 return IB_SMI_DISCARD;
 
                         /* hop_ptr updated when sending */
@@ -224,8 +224,7 @@ static enum smi_action __smi_handle_dr_smp_recv(u8 node_type, int port_num,
                                 return IB_SMI_HANDLE;
                         }
                         /* hop_ptr updated when sending */
-                        return (node_type == RDMA_NODE_IB_SWITCH ?
-                                IB_SMI_HANDLE : IB_SMI_DISCARD);
+                        return (is_switch ? IB_SMI_HANDLE : IB_SMI_DISCARD);
                 }
 
                 /* C14-13:4 -- hop_ptr = 0 -> give to SM */
@@ -238,10 +237,10 @@ static enum smi_action __smi_handle_dr_smp_recv(u8 node_type, int port_num,
  * Adjust information for a received SMP
  * Return IB_SMI_DISCARD if the SMP should be dropped
  */
-enum smi_action smi_handle_dr_smp_recv(struct ib_smp *smp, u8 node_type,
+enum smi_action smi_handle_dr_smp_recv(struct ib_smp *smp, bool is_switch,
                                        int port_num, int phys_port_cnt)
 {
-        return __smi_handle_dr_smp_recv(node_type, port_num, phys_port_cnt,
+        return __smi_handle_dr_smp_recv(is_switch, port_num, phys_port_cnt,
                                         &smp->hop_ptr, smp->hop_cnt,
                                         smp->initial_path,
                                         smp->return_path,
@@ -254,10 +253,10 @@ enum smi_action smi_handle_dr_smp_recv(struct ib_smp *smp, u8 node_type,
  * Adjust information for a received SMP
  * Return IB_SMI_DISCARD if the SMP should be dropped
  */
-enum smi_action opa_smi_handle_dr_smp_recv(struct opa_smp *smp, u8 node_type,
+enum smi_action opa_smi_handle_dr_smp_recv(struct opa_smp *smp, bool is_switch,
                                            int port_num, int phys_port_cnt)
 {
-        return __smi_handle_dr_smp_recv(node_type, port_num, phys_port_cnt,
+        return __smi_handle_dr_smp_recv(is_switch, port_num, phys_port_cnt,
                                         &smp->hop_ptr, smp->hop_cnt,
                                         smp->route.dr.initial_path,
                                         smp->route.dr.return_path,
diff --git a/drivers/infiniband/core/smi.h b/drivers/infiniband/core/smi.h
index aff96bac49b4..33c91c8a16e9 100644
--- a/drivers/infiniband/core/smi.h
+++ b/drivers/infiniband/core/smi.h
@@ -51,12 +51,12 @@ enum smi_forward_action {
         IB_SMI_FORWARD  /* SMP should be forwarded (for switches only) */
 };
 
-enum smi_action smi_handle_dr_smp_recv(struct ib_smp *smp, u8 node_type,
+enum smi_action smi_handle_dr_smp_recv(struct ib_smp *smp, bool is_switch,
                                        int port_num, int phys_port_cnt);
 int smi_get_fwd_port(struct ib_smp *smp);
 extern enum smi_forward_action smi_check_forward_dr_smp(struct ib_smp *smp);
 extern enum smi_action smi_handle_dr_smp_send(struct ib_smp *smp,
-                                              u8 node_type, int port_num);
+                                              bool is_switch, int port_num);
 
 /*
  * Return IB_SMI_HANDLE if the SMP should be handled by the local SMA/SM
diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
index ed6b6c85c334..0b84a9cdfe5b 100644
--- a/drivers/infiniband/core/sysfs.c
+++ b/drivers/infiniband/core/sysfs.c
@@ -870,7 +870,7 @@ int ib_device_register_sysfs(struct ib_device *device,
                 goto err_put;
         }
 
-        if (device->node_type == RDMA_NODE_IB_SWITCH) {
+        if (rdma_cap_ib_switch(device)) {
                 ret = add_port(device, 0, port_callback);
                 if (ret)
                         goto err_put;
diff --git a/drivers/infiniband/core/ucm.c b/drivers/infiniband/core/ucm.c
index 62c24b1452b8..009481073644 100644
--- a/drivers/infiniband/core/ucm.c
+++ b/drivers/infiniband/core/ucm.c
@@ -1193,6 +1193,7 @@ static int ib_ucm_close(struct inode *inode, struct file *filp)
         return 0;
 }
 
+static DECLARE_BITMAP(overflow_map, IB_UCM_MAX_DEVICES);
 static void ib_ucm_release_dev(struct device *dev)
 {
         struct ib_ucm_device *ucm_dev;
@@ -1202,7 +1203,7 @@ static void ib_ucm_release_dev(struct device *dev)
         if (ucm_dev->devnum < IB_UCM_MAX_DEVICES)
                 clear_bit(ucm_dev->devnum, dev_map);
         else
-                clear_bit(ucm_dev->devnum - IB_UCM_MAX_DEVICES, dev_map);
+                clear_bit(ucm_dev->devnum - IB_UCM_MAX_DEVICES, overflow_map);
         kfree(ucm_dev);
 }
 
@@ -1226,7 +1227,6 @@ static ssize_t show_ibdev(struct device *dev, struct device_attribute *attr,
 static DEVICE_ATTR(ibdev, S_IRUGO, show_ibdev, NULL);
 
 static dev_t overflow_maj;
-static DECLARE_BITMAP(overflow_map, IB_UCM_MAX_DEVICES);
 static int find_overflow_devnum(void)
 {
         int ret;
diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index ad45469f7582..29b21213ea75 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -1354,10 +1354,10 @@ static void ucma_lock_files(struct ucma_file *file1, struct ucma_file *file2)
         /* Acquire mutex's based on pointer comparison to prevent deadlock. */
         if (file1 < file2) {
                 mutex_lock(&file1->mut);
-                mutex_lock(&file2->mut);
+                mutex_lock_nested(&file2->mut, SINGLE_DEPTH_NESTING);
         } else {
                 mutex_lock(&file2->mut);
-                mutex_lock(&file1->mut);
+                mutex_lock_nested(&file1->mut, SINGLE_DEPTH_NESTING);
         }
 }
 
@@ -1616,6 +1616,7 @@ static void __exit ucma_cleanup(void)
         device_remove_file(ucma_misc.this_device, &dev_attr_abi_version);
         misc_deregister(&ucma_misc);
         idr_destroy(&ctx_idr);
+        idr_destroy(&multicast_idr);
 }
 
 module_init(ucma_init);
diff --git a/drivers/infiniband/hw/ehca/ehca_sqp.c b/drivers/infiniband/hw/ehca/ehca_sqp.c
index 12b5bc23832b..376b031c2c7f 100644
--- a/drivers/infiniband/hw/ehca/ehca_sqp.c
+++ b/drivers/infiniband/hw/ehca/ehca_sqp.c
@@ -226,8 +226,9 @@ int ehca_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
         const struct ib_mad *in_mad = (const struct ib_mad *)in;
         struct ib_mad *out_mad = (struct ib_mad *)out;
 
-        BUG_ON(in_mad_size != sizeof(*in_mad) ||
-               *out_mad_size != sizeof(*out_mad));
+        if (WARN_ON_ONCE(in_mad_size != sizeof(*in_mad) ||
+                         *out_mad_size != sizeof(*out_mad)))
+                return IB_MAD_RESULT_FAILURE;
 
         if (!port_num || port_num > ibdev->phys_port_cnt || !in_wc)
                 return IB_MAD_RESULT_FAILURE;
diff --git a/drivers/infiniband/hw/ipath/ipath_driver.c b/drivers/infiniband/hw/ipath/ipath_driver.c
index 2d7e503d13cb..871dbe56216a 100644
--- a/drivers/infiniband/hw/ipath/ipath_driver.c
+++ b/drivers/infiniband/hw/ipath/ipath_driver.c
@@ -31,6 +31,8 @@
  * SOFTWARE.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/sched.h>
 #include <linux/spinlock.h>
 #include <linux/idr.h>
@@ -399,8 +401,8 @@ static int ipath_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         u32 bar0 = 0, bar1 = 0;
 
 #ifdef CONFIG_X86_64
-        if (WARN(pat_enabled(),
-                 "ipath needs PAT disabled, boot with nopat kernel parameter\n")) {
+        if (pat_enabled()) {
+                pr_warn("ipath needs PAT disabled, boot with nopat kernel parameter\n");
                 ret = -ENODEV;
                 goto bail;
         }
diff --git a/drivers/infiniband/hw/ipath/ipath_mad.c b/drivers/infiniband/hw/ipath/ipath_mad.c
index 948188e37f95..ad3a926ab3c5 100644
--- a/drivers/infiniband/hw/ipath/ipath_mad.c
+++ b/drivers/infiniband/hw/ipath/ipath_mad.c
@@ -1499,8 +1499,9 @@ int ipath_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
         const struct ib_mad *in_mad = (const struct ib_mad *)in;
         struct ib_mad *out_mad = (struct ib_mad *)out;
 
-        BUG_ON(in_mad_size != sizeof(*in_mad) ||
-               *out_mad_size != sizeof(*out_mad));
+        if (WARN_ON_ONCE(in_mad_size != sizeof(*in_mad) ||
+                         *out_mad_size != sizeof(*out_mad)))
+                return IB_MAD_RESULT_FAILURE;
 
         switch (in_mad->mad_hdr.mgmt_class) {
         case IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE:
diff --git a/drivers/infiniband/hw/ipath/ipath_verbs.c b/drivers/infiniband/hw/ipath/ipath_verbs.c
index 48253b839a6f..30ba49c4a98c 100644
--- a/drivers/infiniband/hw/ipath/ipath_verbs.c
+++ b/drivers/infiniband/hw/ipath/ipath_verbs.c
@@ -2044,9 +2044,9 @@ int ipath_register_ib_device(struct ipath_devdata *dd)
 
         spin_lock_init(&idev->qp_table.lock);
         spin_lock_init(&idev->lk_table.lock);
-        idev->sm_lid = __constant_be16_to_cpu(IB_LID_PERMISSIVE);
+        idev->sm_lid = be16_to_cpu(IB_LID_PERMISSIVE);
         /* Set the prefix to the default value (see ch. 4.1.1) */
-        idev->gid_prefix = __constant_cpu_to_be64(0xfe80000000000000ULL);
+        idev->gid_prefix = cpu_to_be64(0xfe80000000000000ULL);
 
         ret = ipath_init_qp_table(idev, ib_ipath_qp_table_size);
         if (ret)
diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
index 85a50df2f203..68b3dfa922bf 100644
--- a/drivers/infiniband/hw/mlx4/mad.c
+++ b/drivers/infiniband/hw/mlx4/mad.c
@@ -860,21 +860,31 @@ int mlx4_ib_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
         struct mlx4_ib_dev *dev = to_mdev(ibdev);
         const struct ib_mad *in_mad = (const struct ib_mad *)in;
         struct ib_mad *out_mad = (struct ib_mad *)out;
+        enum rdma_link_layer link = rdma_port_get_link_layer(ibdev, port_num);
 
-        BUG_ON(in_mad_size != sizeof(*in_mad) ||
-               *out_mad_size != sizeof(*out_mad));
+        if (WARN_ON_ONCE(in_mad_size != sizeof(*in_mad) ||
+                         *out_mad_size != sizeof(*out_mad)))
+                return IB_MAD_RESULT_FAILURE;
 
-        switch (rdma_port_get_link_layer(ibdev, port_num)) {
-        case IB_LINK_LAYER_INFINIBAND:
-                if (!mlx4_is_slave(dev->dev))
-                        return ib_process_mad(ibdev, mad_flags, port_num, in_wc,
-                                              in_grh, in_mad, out_mad);
-        case IB_LINK_LAYER_ETHERNET:
-                return iboe_process_mad(ibdev, mad_flags, port_num, in_wc,
-                                          in_grh, in_mad, out_mad);
-        default:
-                return -EINVAL;
+        /* iboe_process_mad() which uses the HCA flow-counters to implement IB PMA
+         * queries, should be called only by VFs and for that specific purpose
+         */
+        if (link == IB_LINK_LAYER_INFINIBAND) {
+                if (mlx4_is_slave(dev->dev) &&
+                    in_mad->mad_hdr.mgmt_class == IB_MGMT_CLASS_PERF_MGMT &&
+                    in_mad->mad_hdr.attr_id == IB_PMA_PORT_COUNTERS)
+                        return iboe_process_mad(ibdev, mad_flags, port_num, in_wc,
+                                                in_grh, in_mad, out_mad);
+
+                return ib_process_mad(ibdev, mad_flags, port_num, in_wc,
+                                      in_grh, in_mad, out_mad);
         }
+
+        if (link == IB_LINK_LAYER_ETHERNET)
+                return iboe_process_mad(ibdev, mad_flags, port_num, in_wc,
+                                        in_grh, in_mad, out_mad);
+
+        return -EINVAL;
 }
 
 static void send_handler(struct ib_mad_agent *agent,
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index 067a691ecbed..8be6db816460 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -253,14 +253,15 @@ static int mlx4_ib_query_device(struct ib_device *ibdev,
         props->hca_core_clock = dev->dev->caps.hca_core_clock * 1000UL;
         props->timestamp_mask = 0xFFFFFFFFFFFFULL;
 
-        err = mlx4_get_internal_clock_params(dev->dev, &clock_params);
-        if (err)
-                goto out;
+        if (!mlx4_is_slave(dev->dev))
+                err = mlx4_get_internal_clock_params(dev->dev, &clock_params);
 
         if (uhw->outlen >= resp.response_length + sizeof(resp.hca_core_clock_offset)) {
-                resp.hca_core_clock_offset = clock_params.offset % PAGE_SIZE;
                 resp.response_length += sizeof(resp.hca_core_clock_offset);
-                resp.comp_mask |= QUERY_DEVICE_RESP_MASK_TIMESTAMP;
+                if (!err && !mlx4_is_slave(dev->dev)) {
+                        resp.comp_mask |= QUERY_DEVICE_RESP_MASK_TIMESTAMP;
+                        resp.hca_core_clock_offset = clock_params.offset % PAGE_SIZE;
+                }
         }
 
         if (uhw->outlen) {
@@ -2669,31 +2670,33 @@ static void do_slave_init(struct mlx4_ib_dev *ibdev, int slave, int do_init)
         dm = kcalloc(ports, sizeof(*dm), GFP_ATOMIC);
         if (!dm) {
                 pr_err("failed to allocate memory for tunneling qp update\n");
-                goto out;
+                return;
         }
 
         for (i = 0; i < ports; i++) {
                 dm[i] = kmalloc(sizeof (struct mlx4_ib_demux_work), GFP_ATOMIC);
                 if (!dm[i]) {
                         pr_err("failed to allocate memory for tunneling qp update work struct\n");
-                        for (i = 0; i < dev->caps.num_ports; i++) {
-                                if (dm[i])
-                                        kfree(dm[i]);
-                        }
+                        while (--i >= 0)
+                                kfree(dm[i]);
                         goto out;
                 }
-        }
-        /* initialize or tear down tunnel QPs for the slave */
-        for (i = 0; i < ports; i++) {
                 INIT_WORK(&dm[i]->work, mlx4_ib_tunnels_update_work);
                 dm[i]->port = first_port + i + 1;
                 dm[i]->slave = slave;
                 dm[i]->do_init = do_init;
                 dm[i]->dev = ibdev;
-                spin_lock_irqsave(&ibdev->sriov.going_down_lock, flags);
-                if (!ibdev->sriov.is_going_down)
+        }
+        /* initialize or tear down tunnel QPs for the slave */
+        spin_lock_irqsave(&ibdev->sriov.going_down_lock, flags);
+        if (!ibdev->sriov.is_going_down) {
+                for (i = 0; i < ports; i++)
                         queue_work(ibdev->sriov.demux[i].ud_wq, &dm[i]->work);
                 spin_unlock_irqrestore(&ibdev->sriov.going_down_lock, flags);
+        } else {
+                spin_unlock_irqrestore(&ibdev->sriov.going_down_lock, flags);
+                for (i = 0; i < ports; i++)
+                        kfree(dm[i]);
         }
 out:
         kfree(dm);
diff --git a/drivers/infiniband/hw/mlx5/mad.c b/drivers/infiniband/hw/mlx5/mad.c
index 01fc97db45d6..b84d13a487cc 100644
--- a/drivers/infiniband/hw/mlx5/mad.c
+++ b/drivers/infiniband/hw/mlx5/mad.c
@@ -68,8 +68,9 @@ int mlx5_ib_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
         const struct ib_mad *in_mad = (const struct ib_mad *)in;
         struct ib_mad *out_mad = (struct ib_mad *)out;
 
-        BUG_ON(in_mad_size != sizeof(*in_mad) ||
-               *out_mad_size != sizeof(*out_mad));
+        if (WARN_ON_ONCE(in_mad_size != sizeof(*in_mad) ||
+                         *out_mad_size != sizeof(*out_mad)))
+                return IB_MAD_RESULT_FAILURE;
 
         slid = in_wc ? in_wc->slid : be16_to_cpu(IB_LID_PERMISSIVE);
 
diff --git a/drivers/infiniband/hw/mthca/mthca_mad.c b/drivers/infiniband/hw/mthca/mthca_mad.c
index 6b2418b74c99..7c3f2fb44ba5 100644
--- a/drivers/infiniband/hw/mthca/mthca_mad.c
+++ b/drivers/infiniband/hw/mthca/mthca_mad.c
@@ -209,8 +209,9 @@ int mthca_process_mad(struct ib_device *ibdev,
         const struct ib_mad *in_mad = (const struct ib_mad *)in;
         struct ib_mad *out_mad = (struct ib_mad *)out;
 
-        BUG_ON(in_mad_size != sizeof(*in_mad) ||
-               *out_mad_size != sizeof(*out_mad));
+        if (WARN_ON_ONCE(in_mad_size != sizeof(*in_mad) ||
+                         *out_mad_size != sizeof(*out_mad)))
+                return IB_MAD_RESULT_FAILURE;
 
         /* Forward locally generated traps to the SM */
         if (in_mad->mad_hdr.method == IB_MGMT_METHOD_TRAP &&
diff --git a/drivers/infiniband/hw/nes/nes_cm.c b/drivers/infiniband/hw/nes/nes_cm.c
index 9047af429906..8a3ad170d790 100644
--- a/drivers/infiniband/hw/nes/nes_cm.c
+++ b/drivers/infiniband/hw/nes/nes_cm.c
@@ -1520,8 +1520,9 @@ static int nes_addr_resolve_neigh(struct nes_vnic *nesvnic, u32 dst_ip, int arpi
         int rc = arpindex;
         struct net_device *netdev;
         struct nes_adapter *nesadapter = nesvnic->nesdev->nesadapter;
+        __be32 dst_ipaddr = htonl(dst_ip);
 
-        rt = ip_route_output(&init_net, htonl(dst_ip), 0, 0, 0);
+        rt = ip_route_output(&init_net, dst_ipaddr, nesvnic->local_ipaddr, 0, 0);
         if (IS_ERR(rt)) {
                 printk(KERN_ERR "%s: ip_route_output_key failed for 0x%08X\n",
                        __func__, dst_ip);
@@ -1533,7 +1534,7 @@ static int nes_addr_resolve_neigh(struct nes_vnic *nesvnic, u32 dst_ip, int arpi
         else
                 netdev = nesvnic->netdev;
 
-        neigh = neigh_lookup(&arp_tbl, &rt->rt_gateway, netdev);
+        neigh = dst_neigh_lookup(&rt->dst, &dst_ipaddr);
 
         rcu_read_lock();
         if (neigh) {
diff --git a/drivers/infiniband/hw/nes/nes_hw.c b/drivers/infiniband/hw/nes/nes_hw.c
index 02120d340d50..4713dd7ed764 100644
--- a/drivers/infiniband/hw/nes/nes_hw.c
+++ b/drivers/infiniband/hw/nes/nes_hw.c
@@ -3861,7 +3861,7 @@ void nes_manage_arp_cache(struct net_device *netdev, unsigned char *mac_addr,
                                 (((u32)mac_addr[2]) << 24) | (((u32)mac_addr[3]) << 16) |
                                 (((u32)mac_addr[4]) << 8)  | (u32)mac_addr[5]);
                 cqp_wqe->wqe_words[NES_CQP_ARP_WQE_MAC_HIGH_IDX] = cpu_to_le32(
-                                (((u32)mac_addr[0]) << 16) | (u32)mac_addr[1]);
+                                (((u32)mac_addr[0]) << 8) | (u32)mac_addr[1]);
         } else {
                 cqp_wqe->wqe_words[NES_CQP_ARP_WQE_MAC_ADDR_LOW_IDX] = 0;
                 cqp_wqe->wqe_words[NES_CQP_ARP_WQE_MAC_HIGH_IDX] = 0;
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_ah.c b/drivers/infiniband/hw/ocrdma/ocrdma_ah.c
index 4bafa15708d0..29b27675dd70 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_ah.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_ah.c
@@ -215,8 +215,9 @@ int ocrdma_process_mad(struct ib_device *ibdev,
         const struct ib_mad *in_mad = (const struct ib_mad *)in;
         struct ib_mad *out_mad = (struct ib_mad *)out;
 
-        BUG_ON(in_mad_size != sizeof(*in_mad) ||
-               *out_mad_size != sizeof(*out_mad));
+        if (WARN_ON_ONCE(in_mad_size != sizeof(*in_mad) ||
+                         *out_mad_size != sizeof(*out_mad)))
+                return IB_MAD_RESULT_FAILURE;
 
         switch (in_mad->mad_hdr.mgmt_class) {
         case IB_MGMT_CLASS_PERF_MGMT:
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_main.c b/drivers/infiniband/hw/ocrdma/ocrdma_main.c
index 8a1398b253a2..d98a707a5eb9 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_main.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_main.c
@@ -696,6 +696,7 @@ static void __exit ocrdma_exit_module(void)
         ocrdma_unregister_inet6addr_notifier();
         ocrdma_unregister_inetaddr_notifier();
         ocrdma_rem_debugfs();
+        idr_destroy(&ocrdma_dev_id);
 }
 
 module_init(ocrdma_init_module);
diff --git a/drivers/infiniband/hw/qib/qib_mad.c b/drivers/infiniband/hw/qib/qib_mad.c
index 05e3242d8442..9625e7c438e5 100644
--- a/drivers/infiniband/hw/qib/qib_mad.c
+++ b/drivers/infiniband/hw/qib/qib_mad.c
@@ -2412,8 +2412,9 @@ int qib_process_mad(struct ib_device *ibdev, int mad_flags, u8 port,
         const struct ib_mad *in_mad = (const struct ib_mad *)in;
         struct ib_mad *out_mad = (struct ib_mad *)out;
 
-        BUG_ON(in_mad_size != sizeof(*in_mad) ||
-               *out_mad_size != sizeof(*out_mad));
+        if (WARN_ON_ONCE(in_mad_size != sizeof(*in_mad) ||
+                         *out_mad_size != sizeof(*out_mad)))
+                return IB_MAD_RESULT_FAILURE;
 
         switch (in_mad->mad_hdr.mgmt_class) {
         case IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE:
diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
index bd94b0a6e9e5..79859c4d43c9 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib.h
+++ b/drivers/infiniband/ulp/ipoib/ipoib.h
@@ -239,7 +239,7 @@ struct ipoib_cm_tx {
         struct net_device   *dev;
         struct ipoib_neigh  *neigh;
         struct ipoib_path   *path;
-        struct ipoib_cm_tx_buf *tx_ring;
+        struct ipoib_tx_buf *tx_ring;
         unsigned             tx_head;
         unsigned             tx_tail;
         unsigned long        flags;
@@ -504,6 +504,33 @@ int ipoib_mcast_stop_thread(struct net_device *dev);
 void ipoib_mcast_dev_down(struct net_device *dev);
 void ipoib_mcast_dev_flush(struct net_device *dev);
 
+int ipoib_dma_map_tx(struct ib_device *ca, struct ipoib_tx_buf *tx_req);
+void ipoib_dma_unmap_tx(struct ipoib_dev_priv *priv,
+                        struct ipoib_tx_buf *tx_req);
+
+static inline void ipoib_build_sge(struct ipoib_dev_priv *priv,
+                                   struct ipoib_tx_buf *tx_req)
+{
+        int i, off;
+        struct sk_buff *skb = tx_req->skb;
+        skb_frag_t *frags = skb_shinfo(skb)->frags;
+        int nr_frags = skb_shinfo(skb)->nr_frags;
+        u64 *mapping = tx_req->mapping;
+
+        if (skb_headlen(skb)) {
+                priv->tx_sge[0].addr         = mapping[0];
+                priv->tx_sge[0].length       = skb_headlen(skb);
+                off = 1;
+        } else
+                off = 0;
+
+        for (i = 0; i < nr_frags; ++i) {
+                priv->tx_sge[i + off].addr = mapping[i + off];
+                priv->tx_sge[i + off].length = skb_frag_size(&frags[i]);
+        }
+        priv->tx_wr.num_sge          = nr_frags + off;
+}
+
 #ifdef CONFIG_INFINIBAND_IPOIB_DEBUG
 struct ipoib_mcast_iter *ipoib_mcast_iter_init(struct net_device *dev);
 int ipoib_mcast_iter_next(struct ipoib_mcast_iter *iter);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index cf32a778e7d0..ee39be6ccfb0 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -694,14 +694,12 @@ repost:
 static inline int post_send(struct ipoib_dev_priv *priv,
                             struct ipoib_cm_tx *tx,
                             unsigned int wr_id,
-                            u64 addr, int len)
+                            struct ipoib_tx_buf *tx_req)
 {
         struct ib_send_wr *bad_wr;
 
-        priv->tx_sge[0].addr          = addr;
-        priv->tx_sge[0].length        = len;
+        ipoib_build_sge(priv, tx_req);
 
-        priv->tx_wr.num_sge     = 1;
         priv->tx_wr.wr_id       = wr_id | IPOIB_OP_CM;
 
         return ib_post_send(tx->qp, &priv->tx_wr, &bad_wr);
@@ -710,8 +708,7 @@ static inline int post_send(struct ipoib_dev_priv *priv,
 void ipoib_cm_send(struct net_device *dev, struct sk_buff *skb, struct ipoib_cm_tx *tx)
 {
         struct ipoib_dev_priv *priv = netdev_priv(dev);
-        struct ipoib_cm_tx_buf *tx_req;
-        u64 addr;
+        struct ipoib_tx_buf *tx_req;
         int rc;
 
         if (unlikely(skb->len > tx->mtu)) {
@@ -735,24 +732,21 @@ void ipoib_cm_send(struct net_device *dev, struct sk_buff *skb, struct ipoib_cm_
          */
         tx_req = &tx->tx_ring[tx->tx_head & (ipoib_sendq_size - 1)];
         tx_req->skb = skb;
-        addr = ib_dma_map_single(priv->ca, skb->data, skb->len, DMA_TO_DEVICE);
-        if (unlikely(ib_dma_mapping_error(priv->ca, addr))) {
+
+        if (unlikely(ipoib_dma_map_tx(priv->ca, tx_req))) {
                 ++dev->stats.tx_errors;
                 dev_kfree_skb_any(skb);
                 return;
         }
 
-        tx_req->mapping = addr;
-
         skb_orphan(skb);
         skb_dst_drop(skb);
 
-        rc = post_send(priv, tx, tx->tx_head & (ipoib_sendq_size - 1),
-                       addr, skb->len);
+        rc = post_send(priv, tx, tx->tx_head & (ipoib_sendq_size - 1), tx_req);
         if (unlikely(rc)) {
                 ipoib_warn(priv, "post_send failed, error %d\n", rc);
                 ++dev->stats.tx_errors;
-                ib_dma_unmap_single(priv->ca, addr, skb->len, DMA_TO_DEVICE);
+                ipoib_dma_unmap_tx(priv, tx_req);
                 dev_kfree_skb_any(skb);
         } else {
                 dev->trans_start = jiffies;
@@ -777,7 +771,7 @@ void ipoib_cm_handle_tx_wc(struct net_device *dev, struct ib_wc *wc)
         struct ipoib_dev_priv *priv = netdev_priv(dev);
         struct ipoib_cm_tx *tx = wc->qp->qp_context;
         unsigned int wr_id = wc->wr_id & ~IPOIB_OP_CM;
-        struct ipoib_cm_tx_buf *tx_req;
+        struct ipoib_tx_buf *tx_req;
         unsigned long flags;
 
         ipoib_dbg_data(priv, "cm send completion: id %d, status: %d\n",
@@ -791,7 +785,7 @@ void ipoib_cm_handle_tx_wc(struct net_device *dev, struct ib_wc *wc)
 
         tx_req = &tx->tx_ring[wr_id];
 
-        ib_dma_unmap_single(priv->ca, tx_req->mapping, tx_req->skb->len, DMA_TO_DEVICE);
+        ipoib_dma_unmap_tx(priv, tx_req);
 
         /* FIXME: is this right? Shouldn't we only increment on success? */
         ++dev->stats.tx_packets;
@@ -1036,6 +1030,9 @@ static struct ib_qp *ipoib_cm_create_tx_qp(struct net_device *dev, struct ipoib_
 
         struct ib_qp *tx_qp;
 
+        if (dev->features & NETIF_F_SG)
+                attr.cap.max_send_sge = MAX_SKB_FRAGS + 1;
+
         tx_qp = ib_create_qp(priv->pd, &attr);
         if (PTR_ERR(tx_qp) == -EINVAL) {
                 ipoib_warn(priv, "can't use GFP_NOIO for QPs on device %s, using GFP_KERNEL\n",
@@ -1170,7 +1167,7 @@ err_tx:
 static void ipoib_cm_tx_destroy(struct ipoib_cm_tx *p)
 {
         struct ipoib_dev_priv *priv = netdev_priv(p->dev);
-        struct ipoib_cm_tx_buf *tx_req;
+        struct ipoib_tx_buf *tx_req;
         unsigned long begin;
 
         ipoib_dbg(priv, "Destroy active connection 0x%x head 0x%x tail 0x%x\n",
@@ -1197,8 +1194,7 @@ timeout:
 
         while ((int) p->tx_tail - (int) p->tx_head < 0) {
                 tx_req = &p->tx_ring[p->tx_tail & (ipoib_sendq_size - 1)];
-                ib_dma_unmap_single(priv->ca, tx_req->mapping, tx_req->skb->len,
-                                    DMA_TO_DEVICE);
+                ipoib_dma_unmap_tx(priv, tx_req);
                 dev_kfree_skb_any(tx_req->skb);
                 ++p->tx_tail;
                 netif_tx_lock_bh(p->dev);
@@ -1455,7 +1451,6 @@ static void ipoib_cm_stale_task(struct work_struct *work)
         spin_unlock_irq(&priv->lock);
 }
 
-
 static ssize_t show_mode(struct device *d, struct device_attribute *attr,
                          char *buf)
 {
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index 63b92cbb29ad..d266667ca9b8 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -263,8 +263,7 @@ repost:
                            "for buf %d\n", wr_id);
 }
 
-static int ipoib_dma_map_tx(struct ib_device *ca,
-                            struct ipoib_tx_buf *tx_req)
+int ipoib_dma_map_tx(struct ib_device *ca, struct ipoib_tx_buf *tx_req)
 {
         struct sk_buff *skb = tx_req->skb;
         u64 *mapping = tx_req->mapping;
@@ -305,8 +304,8 @@ partial_error:
         return -EIO;
 }
 
-static void ipoib_dma_unmap_tx(struct ib_device *ca,
-                               struct ipoib_tx_buf *tx_req)
+void ipoib_dma_unmap_tx(struct ipoib_dev_priv *priv,
+                        struct ipoib_tx_buf *tx_req)
 {
         struct sk_buff *skb = tx_req->skb;
         u64 *mapping = tx_req->mapping;
@@ -314,7 +313,8 @@ static void ipoib_dma_unmap_tx(struct ib_device *ca,
         int off;
 
         if (skb_headlen(skb)) {
-                ib_dma_unmap_single(ca, mapping[0], skb_headlen(skb), DMA_TO_DEVICE);
+                ib_dma_unmap_single(priv->ca, mapping[0], skb_headlen(skb),
+                                    DMA_TO_DEVICE);
                 off = 1;
         } else
                 off = 0;
@@ -322,8 +322,8 @@ static void ipoib_dma_unmap_tx(struct ib_device *ca,
         for (i = 0; i < skb_shinfo(skb)->nr_frags; ++i) {
                 const skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
 
-                ib_dma_unmap_page(ca, mapping[i + off], skb_frag_size(frag),
-                                  DMA_TO_DEVICE);
+                ib_dma_unmap_page(priv->ca, mapping[i + off],
+                                  skb_frag_size(frag), DMA_TO_DEVICE);
         }
 }
 
@@ -389,7 +389,7 @@ static void ipoib_ib_handle_tx_wc(struct net_device *dev, struct ib_wc *wc)
 
         tx_req = &priv->tx_ring[wr_id];
 
-        ipoib_dma_unmap_tx(priv->ca, tx_req);
+        ipoib_dma_unmap_tx(priv, tx_req);
 
         ++dev->stats.tx_packets;
         dev->stats.tx_bytes += tx_req->skb->len;
@@ -514,24 +514,10 @@ static inline int post_send(struct ipoib_dev_priv *priv,
                             void *head, int hlen)
 {
         struct ib_send_wr *bad_wr;
-        int i, off;
         struct sk_buff *skb = tx_req->skb;
-        skb_frag_t *frags = skb_shinfo(skb)->frags;
-        int nr_frags = skb_shinfo(skb)->nr_frags;
-        u64 *mapping = tx_req->mapping;
 
-        if (skb_headlen(skb)) {
-                priv->tx_sge[0].addr         = mapping[0];
-                priv->tx_sge[0].length       = skb_headlen(skb);
-                off = 1;
-        } else
-                off = 0;
+        ipoib_build_sge(priv, tx_req);
 
-        for (i = 0; i < nr_frags; ++i) {
-                priv->tx_sge[i + off].addr = mapping[i + off];
-                priv->tx_sge[i + off].length = skb_frag_size(&frags[i]);
-        }
-        priv->tx_wr.num_sge          = nr_frags + off;
         priv->tx_wr.wr_id            = wr_id;
         priv->tx_wr.wr.ud.remote_qpn = qpn;
         priv->tx_wr.wr.ud.ah         = address;
@@ -617,7 +603,7 @@ void ipoib_send(struct net_device *dev, struct sk_buff *skb,
                 ipoib_warn(priv, "post_send failed, error %d\n", rc);
                 ++dev->stats.tx_errors;
                 --priv->tx_outstanding;
-                ipoib_dma_unmap_tx(priv->ca, tx_req);
+                ipoib_dma_unmap_tx(priv, tx_req);
                 dev_kfree_skb_any(skb);
                 if (netif_queue_stopped(dev))
                         netif_wake_queue(dev);
@@ -868,7 +854,7 @@ int ipoib_ib_dev_stop(struct net_device *dev)
                         while ((int) priv->tx_tail - (int) priv->tx_head < 0) {
                                 tx_req = &priv->tx_ring[priv->tx_tail &
                                                         (ipoib_sendq_size - 1)];
-                                ipoib_dma_unmap_tx(priv->ca, tx_req);
+                                ipoib_dma_unmap_tx(priv, tx_req);
                                 dev_kfree_skb_any(tx_req->skb);
                                 ++priv->tx_tail;
                                 --priv->tx_outstanding;
@@ -985,20 +971,21 @@ static inline int update_child_pkey(struct ipoib_dev_priv *priv)
 }
 
 static void __ipoib_ib_dev_flush(struct ipoib_dev_priv *priv,
-                                enum ipoib_flush_level level)
+                                enum ipoib_flush_level level,
+                                int nesting)
 {
         struct ipoib_dev_priv *cpriv;
         struct net_device *dev = priv->dev;
         int result;
 
-        down_read(&priv->vlan_rwsem);
+        down_read_nested(&priv->vlan_rwsem, nesting);
 
         /*
          * Flush any child interfaces too -- they might be up even if
          * the parent is down.
          */
         list_for_each_entry(cpriv, &priv->child_intfs, list)
-                __ipoib_ib_dev_flush(cpriv, level);
+                __ipoib_ib_dev_flush(cpriv, level, nesting + 1);
 
         up_read(&priv->vlan_rwsem);
 
@@ -1076,7 +1063,7 @@ void ipoib_ib_dev_flush_light(struct work_struct *work)
         struct ipoib_dev_priv *priv =
                 container_of(work, struct ipoib_dev_priv, flush_light);
 
-        __ipoib_ib_dev_flush(priv, IPOIB_FLUSH_LIGHT);
+        __ipoib_ib_dev_flush(priv, IPOIB_FLUSH_LIGHT, 0);
 }
 
 void ipoib_ib_dev_flush_normal(struct work_struct *work)
@@ -1084,7 +1071,7 @@ void ipoib_ib_dev_flush_normal(struct work_struct *work)
         struct ipoib_dev_priv *priv =
                 container_of(work, struct ipoib_dev_priv, flush_normal);
 
-        __ipoib_ib_dev_flush(priv, IPOIB_FLUSH_NORMAL);
+        __ipoib_ib_dev_flush(priv, IPOIB_FLUSH_NORMAL, 0);
 }
 
 void ipoib_ib_dev_flush_heavy(struct work_struct *work)
@@ -1092,7 +1079,7 @@ void ipoib_ib_dev_flush_heavy(struct work_struct *work)
         struct ipoib_dev_priv *priv =
                 container_of(work, struct ipoib_dev_priv, flush_heavy);
 
-        __ipoib_ib_dev_flush(priv, IPOIB_FLUSH_HEAVY);
+        __ipoib_ib_dev_flush(priv, IPOIB_FLUSH_HEAVY, 0);
 }
 
 void ipoib_ib_dev_cleanup(struct net_device *dev)
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index da149c278cb8..b2943c84a5dd 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -190,7 +190,7 @@ static netdev_features_t ipoib_fix_features(struct net_device *dev, netdev_featu
         struct ipoib_dev_priv *priv = netdev_priv(dev);
 
         if (test_bit(IPOIB_FLAG_ADMIN_CM, &priv->flags))
-                features &= ~(NETIF_F_SG | NETIF_F_IP_CSUM | NETIF_F_TSO);
+                features &= ~(NETIF_F_IP_CSUM | NETIF_F_TSO);
 
         return features;
 }
@@ -232,6 +232,7 @@ int ipoib_set_mode(struct net_device *dev, const char *buf)
                 ipoib_warn(priv, "enabling connected mode "
                            "will cause multicast packet drops\n");
                 netdev_update_features(dev);
+                dev_set_mtu(dev, ipoib_cm_max_mtu(dev));
                 rtnl_unlock();
                 priv->tx_wr.send_flags &= ~IB_SEND_IP_CSUM;
 
@@ -1577,7 +1578,8 @@ static struct net_device *ipoib_add_port(const char *format,
         SET_NETDEV_DEV(priv->dev, hca->dma_device);
         priv->dev->dev_id = port - 1;
 
-        if (!ib_query_port(hca, port, &attr))
+        result = ib_query_port(hca, port, &attr);
+        if (!result)
                 priv->max_ib_mtu = ib_mtu_enum_to_int(attr.max_mtu);
         else {
                 printk(KERN_WARNING "%s: ib_query_port %d failed\n",
@@ -1598,7 +1600,8 @@ static struct net_device *ipoib_add_port(const char *format,
                 goto device_init_failed;
         }
 
-        if (ipoib_set_dev_features(priv, hca))
+        result = ipoib_set_dev_features(priv, hca);
+        if (result)
                 goto device_init_failed;
 
         /*
@@ -1684,7 +1687,7 @@ static void ipoib_add_one(struct ib_device *device)
         struct list_head *dev_list;
         struct net_device *dev;
         struct ipoib_dev_priv *priv;
-        int s, e, p;
+        int p;
         int count = 0;
 
         dev_list = kmalloc(sizeof *dev_list, GFP_KERNEL);
@@ -1693,15 +1696,7 @@ static void ipoib_add_one(struct ib_device *device)
 
         INIT_LIST_HEAD(dev_list);
 
-        if (device->node_type == RDMA_NODE_IB_SWITCH) {
-                s = 0;
-                e = 0;
-        } else {
-                s = 1;
-                e = device->phys_port_cnt;
-        }
-
-        for (p = s; p <= e; ++p) {
+        for (p = rdma_start_port(device); p <= rdma_end_port(device); ++p) {
                 if (!rdma_protocol_ib(device, p))
                         continue;
                 dev = ipoib_add_port("ib%d", device, p);
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index 267dc4f75502..31a20b462266 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -161,13 +161,10 @@ static int srp_tmo_set(const char *val, const struct kernel_param *kp)
 {
         int tmo, res;
 
-        if (strncmp(val, "off", 3) != 0) {
-                res = kstrtoint(val, 0, &tmo);
-                if (res)
-                        goto out;
-        } else {
-                tmo = -1;
-        }
+        res = srp_parse_tmo(&tmo, val);
+        if (res)
+                goto out;
+
         if (kp->arg == &srp_reconnect_delay)
                 res = srp_tmo_valid(tmo, srp_fast_io_fail_tmo,
                                     srp_dev_loss_tmo);
@@ -3379,7 +3376,7 @@ static void srp_add_one(struct ib_device *device)
         struct srp_device *srp_dev;
         struct ib_device_attr *dev_attr;
         struct srp_host *host;
-        int mr_page_shift, s, e, p;
+        int mr_page_shift, p;
         u64 max_pages_per_mr;
 
         dev_attr = kmalloc(sizeof *dev_attr, GFP_KERNEL);
@@ -3443,15 +3440,7 @@ static void srp_add_one(struct ib_device *device)
         if (IS_ERR(srp_dev->mr))
                 goto err_pd;
 
-        if (device->node_type == RDMA_NODE_IB_SWITCH) {
-                s = 0;
-                e = 0;
-        } else {
-                s = 1;
-                e = device->phys_port_cnt;
-        }
-
-        for (p = s; p <= e; ++p) {
+        for (p = rdma_start_port(device); p <= rdma_end_port(device); ++p) {
                 host = srp_add_port(srp_dev, p);
                 if (host)
                         list_add_tail(&host->list, &srp_dev->dev_list);
diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
index 82897ca17f32..60ff0a2390e5 100644
--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
+++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
@@ -302,7 +302,7 @@ static void srpt_get_iou(struct ib_dm_mad *mad)
         int i;
 
         ioui = (struct ib_dm_iou_info *)mad->data;
-        ioui->change_id = __constant_cpu_to_be16(1);
+        ioui->change_id = cpu_to_be16(1);
         ioui->max_controllers = 16;
 
         /* set present for slot 1 and empty for the rest */
@@ -330,13 +330,13 @@ static void srpt_get_ioc(struct srpt_port *sport, u32 slot,
 
         if (!slot || slot > 16) {
                 mad->mad_hdr.status
-                        = __constant_cpu_to_be16(DM_MAD_STATUS_INVALID_FIELD);
+                        = cpu_to_be16(DM_MAD_STATUS_INVALID_FIELD);
                 return;
         }
 
         if (slot > 2) {
                 mad->mad_hdr.status
-                        = __constant_cpu_to_be16(DM_MAD_STATUS_NO_IOC);
+                        = cpu_to_be16(DM_MAD_STATUS_NO_IOC);
                 return;
         }
 
@@ -348,10 +348,10 @@ static void srpt_get_ioc(struct srpt_port *sport, u32 slot,
         iocp->device_version = cpu_to_be16(sdev->dev_attr.hw_ver);
         iocp->subsys_vendor_id = cpu_to_be32(sdev->dev_attr.vendor_id);
         iocp->subsys_device_id = 0x0;
-        iocp->io_class = __constant_cpu_to_be16(SRP_REV16A_IB_IO_CLASS);
-        iocp->io_subclass = __constant_cpu_to_be16(SRP_IO_SUBCLASS);
-        iocp->protocol = __constant_cpu_to_be16(SRP_PROTOCOL);
-        iocp->protocol_version = __constant_cpu_to_be16(SRP_PROTOCOL_VERSION);
+        iocp->io_class = cpu_to_be16(SRP_REV16A_IB_IO_CLASS);
+        iocp->io_subclass = cpu_to_be16(SRP_IO_SUBCLASS);
+        iocp->protocol = cpu_to_be16(SRP_PROTOCOL);
+        iocp->protocol_version = cpu_to_be16(SRP_PROTOCOL_VERSION);
         iocp->send_queue_depth = cpu_to_be16(sdev->srq_size);
         iocp->rdma_read_depth = 4;
         iocp->send_size = cpu_to_be32(srp_max_req_size);
@@ -379,13 +379,13 @@ static void srpt_get_svc_entries(u64 ioc_guid,
 
         if (!slot || slot > 16) {
                 mad->mad_hdr.status
-                        = __constant_cpu_to_be16(DM_MAD_STATUS_INVALID_FIELD);
+                        = cpu_to_be16(DM_MAD_STATUS_INVALID_FIELD);
                 return;
         }
 
         if (slot > 2 || lo > hi || hi > 1) {
                 mad->mad_hdr.status
-                        = __constant_cpu_to_be16(DM_MAD_STATUS_NO_IOC);
+                        = cpu_to_be16(DM_MAD_STATUS_NO_IOC);
                 return;
         }
 
@@ -436,7 +436,7 @@ static void srpt_mgmt_method_get(struct srpt_port *sp, struct ib_mad *rq_mad,
                 break;
         default:
                 rsp_mad->mad_hdr.status =
-                    __constant_cpu_to_be16(DM_MAD_STATUS_UNSUP_METHOD_ATTR);
+                    cpu_to_be16(DM_MAD_STATUS_UNSUP_METHOD_ATTR);
                 break;
         }
 }
@@ -493,11 +493,11 @@ static void srpt_mad_recv_handler(struct ib_mad_agent *mad_agent,
                 break;
         case IB_MGMT_METHOD_SET:
                 dm_mad->mad_hdr.status =
-                    __constant_cpu_to_be16(DM_MAD_STATUS_UNSUP_METHOD_ATTR);
+                    cpu_to_be16(DM_MAD_STATUS_UNSUP_METHOD_ATTR);
                 break;
         default:
                 dm_mad->mad_hdr.status =
-                    __constant_cpu_to_be16(DM_MAD_STATUS_UNSUP_METHOD);
+                    cpu_to_be16(DM_MAD_STATUS_UNSUP_METHOD);
                 break;
         }
 
@@ -1535,7 +1535,7 @@ static int srpt_build_cmd_rsp(struct srpt_rdma_ch *ch,
         memset(srp_rsp, 0, sizeof *srp_rsp);
         srp_rsp->opcode = SRP_RSP;
         srp_rsp->req_lim_delta =
-                __constant_cpu_to_be32(1 + atomic_xchg(&ch->req_lim_delta, 0));
+                cpu_to_be32(1 + atomic_xchg(&ch->req_lim_delta, 0));
         srp_rsp->tag = tag;
         srp_rsp->status = status;
 
@@ -1585,8 +1585,8 @@ static int srpt_build_tskmgmt_rsp(struct srpt_rdma_ch *ch,
         memset(srp_rsp, 0, sizeof *srp_rsp);
 
         srp_rsp->opcode = SRP_RSP;
-        srp_rsp->req_lim_delta = __constant_cpu_to_be32(1
-                                    + atomic_xchg(&ch->req_lim_delta, 0));
+        srp_rsp->req_lim_delta =
+                cpu_to_be32(1 + atomic_xchg(&ch->req_lim_delta, 0));
         srp_rsp->tag = tag;
 
         srp_rsp->flags |= SRP_RSP_FLAG_RSPVALID;
@@ -1630,7 +1630,7 @@ static uint64_t srpt_unpack_lun(const uint8_t *lun, int len)
         switch (len) {
         case 8:
                 if ((*((__be64 *)lun) &
-                     __constant_cpu_to_be64(0x0000FFFFFFFFFFFFLL)) != 0)
+                     cpu_to_be64(0x0000FFFFFFFFFFFFLL)) != 0)
                         goto out_err;
                 break;
         case 4:
@@ -2449,8 +2449,8 @@ static int srpt_cm_req_recv(struct ib_cm_id *cm_id,
         }
 
         if (it_iu_len > srp_max_req_size || it_iu_len < 64) {
-                rej->reason = __constant_cpu_to_be32(
-                                SRP_LOGIN_REJ_REQ_IT_IU_LENGTH_TOO_LARGE);
+                rej->reason = cpu_to_be32(
+                              SRP_LOGIN_REJ_REQ_IT_IU_LENGTH_TOO_LARGE);
                 ret = -EINVAL;
                 pr_err("rejected SRP_LOGIN_REQ because its"
                        " length (%d bytes) is out of range (%d .. %d)\n",
@@ -2459,8 +2459,8 @@ static int srpt_cm_req_recv(struct ib_cm_id *cm_id,
         }
 
         if (!sport->enabled) {
-                rej->reason = __constant_cpu_to_be32(
-                             SRP_LOGIN_REJ_INSUFFICIENT_RESOURCES);
+                rej->reason = cpu_to_be32(
+                              SRP_LOGIN_REJ_INSUFFICIENT_RESOURCES);
                 ret = -EINVAL;
                 pr_err("rejected SRP_LOGIN_REQ because the target port"
                        " has not yet been enabled\n");
@@ -2505,8 +2505,8 @@ static int srpt_cm_req_recv(struct ib_cm_id *cm_id,
         if (*(__be64 *)req->target_port_id != cpu_to_be64(srpt_service_guid)
             || *(__be64 *)(req->target_port_id + 8) !=
                cpu_to_be64(srpt_service_guid)) {
-                rej->reason = __constant_cpu_to_be32(
-                                SRP_LOGIN_REJ_UNABLE_ASSOCIATE_CHANNEL);
+                rej->reason = cpu_to_be32(
+                              SRP_LOGIN_REJ_UNABLE_ASSOCIATE_CHANNEL);
                 ret = -ENOMEM;
                 pr_err("rejected SRP_LOGIN_REQ because it"
                        " has an invalid target port identifier.\n");
@@ -2515,8 +2515,8 @@ static int srpt_cm_req_recv(struct ib_cm_id *cm_id,
 
         ch = kzalloc(sizeof *ch, GFP_KERNEL);
         if (!ch) {
-                rej->reason = __constant_cpu_to_be32(
-                                        SRP_LOGIN_REJ_INSUFFICIENT_RESOURCES);
+                rej->reason = cpu_to_be32(
+                              SRP_LOGIN_REJ_INSUFFICIENT_RESOURCES);
                 pr_err("rejected SRP_LOGIN_REQ because no memory.\n");
                 ret = -ENOMEM;
                 goto reject;
@@ -2552,8 +2552,8 @@ static int srpt_cm_req_recv(struct ib_cm_id *cm_id,
 
         ret = srpt_create_ch_ib(ch);
         if (ret) {
-                rej->reason = __constant_cpu_to_be32(
-                                SRP_LOGIN_REJ_INSUFFICIENT_RESOURCES);
+                rej->reason = cpu_to_be32(
+                              SRP_LOGIN_REJ_INSUFFICIENT_RESOURCES);
                 pr_err("rejected SRP_LOGIN_REQ because creating"
                        " a new RDMA channel failed.\n");
                 goto free_ring;
@@ -2561,8 +2561,7 @@ static int srpt_cm_req_recv(struct ib_cm_id *cm_id,
 
         ret = srpt_ch_qp_rtr(ch, ch->qp);
         if (ret) {
-                rej->reason = __constant_cpu_to_be32(
-                                SRP_LOGIN_REJ_INSUFFICIENT_RESOURCES);
+                rej->reason = cpu_to_be32(SRP_LOGIN_REJ_INSUFFICIENT_RESOURCES);
                 pr_err("rejected SRP_LOGIN_REQ because enabling"
                        " RTR failed (error code = %d)\n", ret);
                 goto destroy_ib;
@@ -2580,15 +2579,15 @@ static int srpt_cm_req_recv(struct ib_cm_id *cm_id,
         if (!nacl) {
                 pr_info("Rejected login because no ACL has been"
                         " configured yet for initiator %s.\n", ch->sess_name);
-                rej->reason = __constant_cpu_to_be32(
-                                SRP_LOGIN_REJ_CHANNEL_LIMIT_REACHED);
+                rej->reason = cpu_to_be32(
+                              SRP_LOGIN_REJ_CHANNEL_LIMIT_REACHED);
                 goto destroy_ib;
         }
 
         ch->sess = transport_init_session(TARGET_PROT_NORMAL);
         if (IS_ERR(ch->sess)) {
-                rej->reason = __constant_cpu_to_be32(
-                                SRP_LOGIN_REJ_INSUFFICIENT_RESOURCES);
+                rej->reason = cpu_to_be32(
+                              SRP_LOGIN_REJ_INSUFFICIENT_RESOURCES);
                 pr_debug("Failed to create session\n");
                 goto deregister_session;
         }
@@ -2604,8 +2603,8 @@ static int srpt_cm_req_recv(struct ib_cm_id *cm_id,
         rsp->max_it_iu_len = req->req_it_iu_len;
         rsp->max_ti_iu_len = req->req_it_iu_len;
         ch->max_ti_iu_len = it_iu_len;
-        rsp->buf_fmt = __constant_cpu_to_be16(SRP_BUF_FORMAT_DIRECT
-                                              | SRP_BUF_FORMAT_INDIRECT);
+        rsp->buf_fmt = cpu_to_be16(SRP_BUF_FORMAT_DIRECT
+                                   | SRP_BUF_FORMAT_INDIRECT);
         rsp->req_lim_delta = cpu_to_be32(ch->rq_size);
         atomic_set(&ch->req_lim, ch->rq_size);
         atomic_set(&ch->req_lim_delta, 0);
@@ -2655,8 +2654,8 @@ free_ch:
 reject:
         rej->opcode = SRP_LOGIN_REJ;
         rej->tag = req->tag;
-        rej->buf_fmt = __constant_cpu_to_be16(SRP_BUF_FORMAT_DIRECT
-                                              | SRP_BUF_FORMAT_INDIRECT);
+        rej->buf_fmt = cpu_to_be16(SRP_BUF_FORMAT_DIRECT
+                                   | SRP_BUF_FORMAT_INDIRECT);
 
         ib_send_cm_rej(cm_id, IB_CM_REJ_CONSUMER_DEFINED, NULL, 0,
                              (void *)rej, sizeof *rej);
diff --git a/drivers/input/input-leds.c b/drivers/input/input-leds.c
index 074a65ed17bb..766bf2660116 100644
--- a/drivers/input/input-leds.c
+++ b/drivers/input/input-leds.c
@@ -71,6 +71,18 @@ static void input_leds_event(struct input_handle *handle, unsigned int type,
 {
 }
 
+static int input_leds_get_count(struct input_dev *dev)
+{
+        unsigned int led_code;
+        int count = 0;
+
+        for_each_set_bit(led_code, dev->ledbit, LED_CNT)
+                if (input_led_info[led_code].name)
+                        count++;
+
+        return count;
+}
+
 static int input_leds_connect(struct input_handler *handler,
                               struct input_dev *dev,
                               const struct input_device_id *id)
@@ -81,7 +93,7 @@ static int input_leds_connect(struct input_handler *handler,
         int led_no;
         int error;
 
-        num_leds = bitmap_weight(dev->ledbit, LED_CNT);
+        num_leds = input_leds_get_count(dev);
         if (!num_leds)
                 return -ENXIO;
 
@@ -112,7 +124,7 @@ static int input_leds_connect(struct input_handler *handler,
                 led->handle = &leds->handle;
                 led->code = led_code;
 
-                if (WARN_ON(!input_led_info[led_code].name))
+                if (!input_led_info[led_code].name)
                         continue;
 
                 led->cdev.name = kasprintf(GFP_KERNEL, "%s::%s",
diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
index 62641f2adaf7..5b5f403d8ce6 100644
--- a/drivers/input/mouse/elan_i2c_core.c
+++ b/drivers/input/mouse/elan_i2c_core.c
@@ -771,7 +771,7 @@ static const struct attribute_group *elan_sysfs_groups[] = {
  */
 static void elan_report_contact(struct elan_tp_data *data,
                                 int contact_num, bool contact_valid,
-                                bool hover_event, u8 *finger_data)
+                                u8 *finger_data)
 {
         struct input_dev *input = data->input;
         unsigned int pos_x, pos_y;
@@ -815,9 +815,7 @@ static void elan_report_contact(struct elan_tp_data *data,
                 input_mt_report_slot_state(input, MT_TOOL_FINGER, true);
                 input_report_abs(input, ABS_MT_POSITION_X, pos_x);
                 input_report_abs(input, ABS_MT_POSITION_Y, data->max_y - pos_y);
-                input_report_abs(input, ABS_MT_DISTANCE, hover_event);
-                input_report_abs(input, ABS_MT_PRESSURE,
-                                 hover_event ? 0 : scaled_pressure);
+                input_report_abs(input, ABS_MT_PRESSURE, scaled_pressure);
                 input_report_abs(input, ABS_TOOL_WIDTH, mk_x);
                 input_report_abs(input, ABS_MT_TOUCH_MAJOR, major);
                 input_report_abs(input, ABS_MT_TOUCH_MINOR, minor);
@@ -839,14 +837,14 @@ static void elan_report_absolute(struct elan_tp_data *data, u8 *packet)
         hover_event = hover_info & 0x40;
         for (i = 0; i < ETP_MAX_FINGERS; i++) {
                 contact_valid = tp_info & (1U << (3 + i));
-                elan_report_contact(data, i, contact_valid, hover_event,
-                                    finger_data);
+                elan_report_contact(data, i, contact_valid, finger_data);
 
                 if (contact_valid)
                         finger_data += ETP_FINGER_DATA_LEN;
         }
 
         input_report_key(input, BTN_LEFT, tp_info & 0x01);
+        input_report_abs(input, ABS_DISTANCE, hover_event != 0);
         input_mt_report_pointer_emulation(input, true);
         input_sync(input);
 }
@@ -922,6 +920,7 @@ static int elan_setup_input_device(struct elan_tp_data *data)
         input_abs_set_res(input, ABS_Y, data->y_res);
         input_set_abs_params(input, ABS_PRESSURE, 0, ETP_MAX_PRESSURE, 0, 0);
         input_set_abs_params(input, ABS_TOOL_WIDTH, 0, ETP_FINGER_WIDTH, 0, 0);
+        input_set_abs_params(input, ABS_DISTANCE, 0, 1, 0, 0);
 
         /* And MT parameters */
         input_set_abs_params(input, ABS_MT_POSITION_X, 0, data->max_x, 0, 0);
@@ -934,7 +933,6 @@ static int elan_setup_input_device(struct elan_tp_data *data)
                              ETP_FINGER_WIDTH * max_width, 0, 0);
         input_set_abs_params(input, ABS_MT_TOUCH_MINOR, 0,
                              ETP_FINGER_WIDTH * min_width, 0, 0);
-        input_set_abs_params(input, ABS_MT_DISTANCE, 0, 1, 0, 0);
 
         data->input = input;
 
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index ce3d40004458..22b9ca901f4e 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -1167,7 +1167,7 @@ static int elantech_set_input_params(struct psmouse *psmouse)
         struct input_dev *dev = psmouse->dev;
         struct elantech_data *etd = psmouse->private;
         unsigned int x_min = 0, y_min = 0, x_max = 0, y_max = 0, width = 0;
-        unsigned int x_res = 0, y_res = 0;
+        unsigned int x_res = 31, y_res = 31;
 
         if (elantech_set_range(psmouse, &x_min, &y_min, &x_max, &y_max, &width))
                 return -1;
@@ -1232,8 +1232,6 @@ static int elantech_set_input_params(struct psmouse *psmouse)
                 /* For X to recognize me as touchpad. */
                 input_set_abs_params(dev, ABS_X, x_min, x_max, 0, 0);
                 input_set_abs_params(dev, ABS_Y, y_min, y_max, 0, 0);
-                input_abs_set_res(dev, ABS_X, x_res);
-                input_abs_set_res(dev, ABS_Y, y_res);
                 /*
                  * range of pressure and width is the same as v2,
                  * report ABS_PRESSURE, ABS_TOOL_WIDTH for compatibility.
@@ -1246,8 +1244,6 @@ static int elantech_set_input_params(struct psmouse *psmouse)
                 input_mt_init_slots(dev, ETP_MAX_FINGERS, 0);
                 input_set_abs_params(dev, ABS_MT_POSITION_X, x_min, x_max, 0, 0);
                 input_set_abs_params(dev, ABS_MT_POSITION_Y, y_min, y_max, 0, 0);
-                input_abs_set_res(dev, ABS_MT_POSITION_X, x_res);
-                input_abs_set_res(dev, ABS_MT_POSITION_Y, y_res);
                 input_set_abs_params(dev, ABS_MT_PRESSURE, ETP_PMIN_V2,
                                      ETP_PMAX_V2, 0, 0);
                 /*
@@ -1259,6 +1255,13 @@ static int elantech_set_input_params(struct psmouse *psmouse)
                 break;
         }
 
+        input_abs_set_res(dev, ABS_X, x_res);
+        input_abs_set_res(dev, ABS_Y, y_res);
+        if (etd->hw_version > 1) {
+                input_abs_set_res(dev, ABS_MT_POSITION_X, x_res);
+                input_abs_set_res(dev, ABS_MT_POSITION_Y, y_res);
+        }
+
         etd->y_max = y_max;
         etd->width = width;
 
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index 35c8d0ceabee..3a32caf06bf1 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -1199,7 +1199,7 @@ static void set_input_params(struct psmouse *psmouse,
                                         ABS_MT_POSITION_Y);
                 /* Image sensors can report per-contact pressure */
                 input_set_abs_params(dev, ABS_MT_PRESSURE, 0, 255, 0, 0);
-                input_mt_init_slots(dev, 3, INPUT_MT_POINTER | INPUT_MT_TRACK);
+                input_mt_init_slots(dev, 2, INPUT_MT_POINTER | INPUT_MT_TRACK);
 
                 /* Image sensors can signal 4 and 5 finger clicks */
                 __set_bit(BTN_TOOL_QUADTAP, dev->keybit);
diff --git a/drivers/input/touchscreen/goodix.c b/drivers/input/touchscreen/goodix.c
index b4d12e29abff..e36162b28c2a 100644
--- a/drivers/input/touchscreen/goodix.c
+++ b/drivers/input/touchscreen/goodix.c
@@ -15,6 +15,7 @@
  */
 
 #include <linux/kernel.h>
+#include <linux/dmi.h>
 #include <linux/i2c.h>
 #include <linux/input.h>
 #include <linux/input/mt.h>
@@ -34,6 +35,7 @@ struct goodix_ts_data {
         int abs_y_max;
         unsigned int max_touch_num;
         unsigned int int_trigger_type;
+        bool rotated_screen;
 };
 
 #define GOODIX_MAX_HEIGHT               4096
@@ -60,6 +62,30 @@ static const unsigned long goodix_irq_flags[] = {
         IRQ_TYPE_LEVEL_HIGH,
 };
 
+/*
+ * Those tablets have their coordinates origin at the bottom right
+ * of the tablet, as if rotated 180 degrees
+ */
+static const struct dmi_system_id rotated_screen[] = {
+#if defined(CONFIG_DMI) && defined(CONFIG_X86)
+        {
+                .ident = "WinBook TW100",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "WinBook"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "TW100")
+                }
+        },
+        {
+                .ident = "WinBook TW700",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "WinBook"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "TW700")
+                },
+        },
+#endif
+        {}
+};
+
 /**
  * goodix_i2c_read - read data from a register of the i2c slave device.
  *
@@ -129,6 +155,11 @@ static void goodix_ts_report_touch(struct goodix_ts_data *ts, u8 *coor_data)
         int input_y = get_unaligned_le16(&coor_data[3]);
         int input_w = get_unaligned_le16(&coor_data[5]);
 
+        if (ts->rotated_screen) {
+                input_x = ts->abs_x_max - input_x;
+                input_y = ts->abs_y_max - input_y;
+        }
+
         input_mt_slot(ts->input_dev, id);
         input_mt_report_slot_state(ts->input_dev, MT_TOOL_FINGER, true);
         input_report_abs(ts->input_dev, ABS_MT_POSITION_X, input_x);
@@ -223,6 +254,11 @@ static void goodix_read_config(struct goodix_ts_data *ts)
                 ts->abs_y_max = GOODIX_MAX_HEIGHT;
                 ts->max_touch_num = GOODIX_MAX_CONTACTS;
         }
+
+        ts->rotated_screen = dmi_check_system(rotated_screen);
+        if (ts->rotated_screen)
+                dev_dbg(&ts->client->dev,
+                         "Applying '180 degrees rotated screen' quirk\n");
 }
 
 /**
diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c
index f2c6c352c55a..2c41107240de 100644
--- a/drivers/input/touchscreen/usbtouchscreen.c
+++ b/drivers/input/touchscreen/usbtouchscreen.c
@@ -627,6 +627,9 @@ static int dmc_tsc10_init(struct usbtouch_usb *usbtouch)
                 goto err_out;
         }
 
+        /* TSC-25 data sheet specifies a delay after the RESET command */
+        msleep(150);
+
         /* set coordinate output rate */
         buf[0] = buf[1] = 0xFF;
         ret = usb_control_msg(dev, usb_rcvctrlpipe (dev, 0),
diff --git a/drivers/input/touchscreen/zforce_ts.c b/drivers/input/touchscreen/zforce_ts.c
index f58a196521a9..80285c71786e 100644
--- a/drivers/input/touchscreen/zforce_ts.c
+++ b/drivers/input/touchscreen/zforce_ts.c
@@ -429,7 +429,7 @@ static int zforce_read_packet(struct zforce_ts *ts, u8 *buf)
                 goto unlock;
         }
 
-        if (buf[PAYLOAD_LENGTH] == 0) {
+        if (buf[PAYLOAD_LENGTH] == 0 || buf[PAYLOAD_LENGTH] > FRAME_MAXSIZE) {
                 dev_err(&client->dev, "invalid payload length: %d\n",
                         buf[PAYLOAD_LENGTH]);
                 ret = -EIO;
diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c
index 8e9ec81ce4bb..da902baaa794 100644
--- a/drivers/iommu/arm-smmu-v3.c
+++ b/drivers/iommu/arm-smmu-v3.c
@@ -199,9 +199,10 @@
  * Stream table.
  *
  * Linear: Enough to cover 1 << IDR1.SIDSIZE entries
- * 2lvl: 8k L1 entries, 256 lazy entries per table (each table covers a PCI bus)
+ * 2lvl: 128k L1 entries,
+ *       256 lazy entries per table (each table covers a PCI bus)
  */
-#define STRTAB_L1_SZ_SHIFT              16
+#define STRTAB_L1_SZ_SHIFT              20
 #define STRTAB_SPLIT                    8
 
 #define STRTAB_L1_DESC_DWORDS           1
@@ -269,10 +270,10 @@
 #define ARM64_TCR_TG0_SHIFT             14
 #define ARM64_TCR_TG0_MASK              0x3UL
 #define CTXDESC_CD_0_TCR_IRGN0_SHIFT    8
-#define ARM64_TCR_IRGN0_SHIFT           24
+#define ARM64_TCR_IRGN0_SHIFT           8
 #define ARM64_TCR_IRGN0_MASK            0x3UL
 #define CTXDESC_CD_0_TCR_ORGN0_SHIFT    10
-#define ARM64_TCR_ORGN0_SHIFT           26
+#define ARM64_TCR_ORGN0_SHIFT           10
 #define ARM64_TCR_ORGN0_MASK            0x3UL
 #define CTXDESC_CD_0_TCR_SH0_SHIFT      12
 #define ARM64_TCR_SH0_SHIFT             12
@@ -542,6 +543,9 @@ struct arm_smmu_device {
 #define ARM_SMMU_FEAT_HYP               (1 << 12)
         u32                             features;
 
+#define ARM_SMMU_OPT_SKIP_PREFETCH      (1 << 0)
+        u32                             options;
+
         struct arm_smmu_cmdq            cmdq;
         struct arm_smmu_evtq            evtq;
         struct arm_smmu_priq            priq;
@@ -602,11 +606,35 @@ struct arm_smmu_domain {
 static DEFINE_SPINLOCK(arm_smmu_devices_lock);
 static LIST_HEAD(arm_smmu_devices);
 
+struct arm_smmu_option_prop {
+        u32 opt;
+        const char *prop;
+};
+
+static struct arm_smmu_option_prop arm_smmu_options[] = {
+        { ARM_SMMU_OPT_SKIP_PREFETCH, "hisilicon,broken-prefetch-cmd" },
+        { 0, NULL},
+};
+
 static struct arm_smmu_domain *to_smmu_domain(struct iommu_domain *dom)
 {
         return container_of(dom, struct arm_smmu_domain, domain);
 }
 
+static void parse_driver_options(struct arm_smmu_device *smmu)
+{
+        int i = 0;
+
+        do {
+                if (of_property_read_bool(smmu->dev->of_node,
+                                                arm_smmu_options[i].prop)) {
+                        smmu->options |= arm_smmu_options[i].opt;
+                        dev_notice(smmu->dev, "option %s\n",
+                                arm_smmu_options[i].prop);
+                }
+        } while (arm_smmu_options[++i].opt);
+}
+
 /* Low-level queue manipulation functions */
 static bool queue_full(struct arm_smmu_queue *q)
 {
@@ -1036,7 +1064,8 @@ static void arm_smmu_write_strtab_ent(struct arm_smmu_device *smmu, u32 sid,
         arm_smmu_sync_ste_for_sid(smmu, sid);
 
         /* It's likely that we'll want to use the new STE soon */
-        arm_smmu_cmdq_issue_cmd(smmu, &prefetch_cmd);
+        if (!(smmu->options & ARM_SMMU_OPT_SKIP_PREFETCH))
+                arm_smmu_cmdq_issue_cmd(smmu, &prefetch_cmd);
 }
 
 static void arm_smmu_init_bypass_stes(u64 *strtab, unsigned int nent)
@@ -1064,7 +1093,7 @@ static int arm_smmu_init_l2_strtab(struct arm_smmu_device *smmu, u32 sid)
                 return 0;
 
         size = 1 << (STRTAB_SPLIT + ilog2(STRTAB_STE_DWORDS) + 3);
-        strtab = &cfg->strtab[sid >> STRTAB_SPLIT << STRTAB_L1_DESC_DWORDS];
+        strtab = &cfg->strtab[(sid >> STRTAB_SPLIT) * STRTAB_L1_DESC_DWORDS];
 
         desc->span = STRTAB_SPLIT + 1;
         desc->l2ptr = dma_zalloc_coherent(smmu->dev, size, &desc->l2ptr_dma,
@@ -2020,21 +2049,23 @@ static int arm_smmu_init_strtab_2lvl(struct arm_smmu_device *smmu)
 {
         void *strtab;
         u64 reg;
-        u32 size;
+        u32 size, l1size;
         int ret;
         struct arm_smmu_strtab_cfg *cfg = &smmu->strtab_cfg;
 
         /* Calculate the L1 size, capped to the SIDSIZE */
         size = STRTAB_L1_SZ_SHIFT - (ilog2(STRTAB_L1_DESC_DWORDS) + 3);
         size = min(size, smmu->sid_bits - STRTAB_SPLIT);
-        if (size + STRTAB_SPLIT < smmu->sid_bits)
+        cfg->num_l1_ents = 1 << size;
+
+        size += STRTAB_SPLIT;
+        if (size < smmu->sid_bits)
                 dev_warn(smmu->dev,
                          "2-level strtab only covers %u/%u bits of SID\n",
-                         size + STRTAB_SPLIT, smmu->sid_bits);
+                         size, smmu->sid_bits);
 
-        cfg->num_l1_ents = 1 << size;
-        size = cfg->num_l1_ents * (STRTAB_L1_DESC_DWORDS << 3);
-        strtab = dma_zalloc_coherent(smmu->dev, size, &cfg->strtab_dma,
+        l1size = cfg->num_l1_ents * (STRTAB_L1_DESC_DWORDS << 3);
+        strtab = dma_zalloc_coherent(smmu->dev, l1size, &cfg->strtab_dma,
                                      GFP_KERNEL);
         if (!strtab) {
                 dev_err(smmu->dev,
@@ -2055,8 +2086,7 @@ static int arm_smmu_init_strtab_2lvl(struct arm_smmu_device *smmu)
         ret = arm_smmu_init_l1_strtab(smmu);
         if (ret)
                 dma_free_coherent(smmu->dev,
-                                  cfg->num_l1_ents *
-                                  (STRTAB_L1_DESC_DWORDS << 3),
+                                  l1size,
                                   strtab,
                                   cfg->strtab_dma);
         return ret;
@@ -2573,6 +2603,8 @@ static int arm_smmu_device_dt_probe(struct platform_device *pdev)
         if (irq > 0)
                 smmu->gerr_irq = irq;
 
+        parse_driver_options(smmu);
+
         /* Probe the h/w */
         ret = arm_smmu_device_probe(smmu);
         if (ret)
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index a98a7b27aca1..0649b94f5958 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -1830,8 +1830,9 @@ static int domain_init(struct dmar_domain *domain, int guest_width)
 
 static void domain_exit(struct dmar_domain *domain)
 {
+        struct dmar_drhd_unit *drhd;
+        struct intel_iommu *iommu;
         struct page *freelist = NULL;
-        int i;
 
         /* Domain 0 is reserved, so dont process it */
         if (!domain)
@@ -1851,8 +1852,10 @@ static void domain_exit(struct dmar_domain *domain)
 
         /* clear attached or cached domains */
         rcu_read_lock();
-        for_each_set_bit(i, domain->iommu_bmp, g_num_of_iommus)
-                iommu_detach_domain(domain, g_iommus[i]);
+        for_each_active_iommu(iommu, drhd)
+                if (domain_type_is_vm(domain) ||
+                    test_bit(iommu->seq_id, domain->iommu_bmp))
+                        iommu_detach_domain(domain, iommu);
         rcu_read_unlock();
 
         dma_free_pagelist(freelist);
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 63dbdec2f05b..1df956afb937 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -74,6 +74,13 @@ struct its_node {
 
 #define ITS_ITT_ALIGN           SZ_256
 
+struct event_lpi_map {
+        unsigned long           *lpi_map;
+        u16                     *col_map;
+        irq_hw_number_t         lpi_base;
+        int                     nr_lpis;
+};
+
 /*
  * The ITS view of a device - belongs to an ITS, a collection, owns an
  * interrupt translation table, and a list of interrupts.
@@ -81,11 +88,8 @@ struct its_node {
 struct its_device {
         struct list_head        entry;
         struct its_node         *its;
-        struct its_collection   *collection;
+        struct event_lpi_map    event_map;
         void                    *itt;
-        unsigned long           *lpi_map;
-        irq_hw_number_t         lpi_base;
-        int                     nr_lpis;
         u32                     nr_ites;
         u32                     device_id;
 };
@@ -98,6 +102,14 @@ static struct rdists *gic_rdists;
 #define gic_data_rdist()                (raw_cpu_ptr(gic_rdists->rdist))
 #define gic_data_rdist_rd_base()        (gic_data_rdist()->rd_base)
 
+static struct its_collection *dev_event_to_col(struct its_device *its_dev,
+                                               u32 event)
+{
+        struct its_node *its = its_dev->its;
+
+        return its->collections + its_dev->event_map.col_map[event];
+}
+
 /*
  * ITS command descriptors - parameters to be encoded in a command
  * block.
@@ -133,7 +145,7 @@ struct its_cmd_desc {
                 struct {
                         struct its_device *dev;
                         struct its_collection *col;
-                        u32 id;
+                        u32 event_id;
                 } its_movi_cmd;
 
                 struct {
@@ -240,7 +252,7 @@ static struct its_collection *its_build_mapd_cmd(struct its_cmd_block *cmd,
 
         its_fixup_cmd(cmd);
 
-        return desc->its_mapd_cmd.dev->collection;
+        return NULL;
 }
 
 static struct its_collection *its_build_mapc_cmd(struct its_cmd_block *cmd,
@@ -259,52 +271,72 @@ static struct its_collection *its_build_mapc_cmd(struct its_cmd_block *cmd,
 static struct its_collection *its_build_mapvi_cmd(struct its_cmd_block *cmd,
                                                   struct its_cmd_desc *desc)
 {
+        struct its_collection *col;
+
+        col = dev_event_to_col(desc->its_mapvi_cmd.dev,
+                               desc->its_mapvi_cmd.event_id);
+
         its_encode_cmd(cmd, GITS_CMD_MAPVI);
         its_encode_devid(cmd, desc->its_mapvi_cmd.dev->device_id);
         its_encode_event_id(cmd, desc->its_mapvi_cmd.event_id);
         its_encode_phys_id(cmd, desc->its_mapvi_cmd.phys_id);
-        its_encode_collection(cmd, desc->its_mapvi_cmd.dev->collection->col_id);
+        its_encode_collection(cmd, col->col_id);
 
         its_fixup_cmd(cmd);
 
-        return desc->its_mapvi_cmd.dev->collection;
+        return col;
 }
 
 static struct its_collection *its_build_movi_cmd(struct its_cmd_block *cmd,
                                                  struct its_cmd_desc *desc)
 {
+        struct its_collection *col;
+
+        col = dev_event_to_col(desc->its_movi_cmd.dev,
+                               desc->its_movi_cmd.event_id);
+
         its_encode_cmd(cmd, GITS_CMD_MOVI);
         its_encode_devid(cmd, desc->its_movi_cmd.dev->device_id);
-        its_encode_event_id(cmd, desc->its_movi_cmd.id);
+        its_encode_event_id(cmd, desc->its_movi_cmd.event_id);
         its_encode_collection(cmd, desc->its_movi_cmd.col->col_id);
 
         its_fixup_cmd(cmd);
 
-        return desc->its_movi_cmd.dev->collection;
+        return col;
 }
 
 static struct its_collection *its_build_discard_cmd(struct its_cmd_block *cmd,
                                                     struct its_cmd_desc *desc)
 {
+        struct its_collection *col;
+
+        col = dev_event_to_col(desc->its_discard_cmd.dev,
+                               desc->its_discard_cmd.event_id);
+
         its_encode_cmd(cmd, GITS_CMD_DISCARD);
         its_encode_devid(cmd, desc->its_discard_cmd.dev->device_id);
         its_encode_event_id(cmd, desc->its_discard_cmd.event_id);
 
         its_fixup_cmd(cmd);
 
-        return desc->its_discard_cmd.dev->collection;
+        return col;
 }
 
 static struct its_collection *its_build_inv_cmd(struct its_cmd_block *cmd,
                                                 struct its_cmd_desc *desc)
 {
+        struct its_collection *col;
+
+        col = dev_event_to_col(desc->its_inv_cmd.dev,
+                               desc->its_inv_cmd.event_id);
+
         its_encode_cmd(cmd, GITS_CMD_INV);
         its_encode_devid(cmd, desc->its_inv_cmd.dev->device_id);
         its_encode_event_id(cmd, desc->its_inv_cmd.event_id);
 
         its_fixup_cmd(cmd);
 
-        return desc->its_inv_cmd.dev->collection;
+        return col;
 }
 
 static struct its_collection *its_build_invall_cmd(struct its_cmd_block *cmd,
@@ -496,7 +528,7 @@ static void its_send_movi(struct its_device *dev,
 
         desc.its_movi_cmd.dev = dev;
         desc.its_movi_cmd.col = col;
-        desc.its_movi_cmd.id = id;
+        desc.its_movi_cmd.event_id = id;
 
         its_send_single_command(dev->its, its_build_movi_cmd, &desc);
 }
@@ -527,7 +559,7 @@ static void its_send_invall(struct its_node *its, struct its_collection *col)
 static inline u32 its_get_event_id(struct irq_data *d)
 {
         struct its_device *its_dev = irq_data_get_irq_chip_data(d);
-        return d->hwirq - its_dev->lpi_base;
+        return d->hwirq - its_dev->event_map.lpi_base;
 }
 
 static void lpi_set_config(struct irq_data *d, bool enable)
@@ -582,7 +614,7 @@ static int its_set_affinity(struct irq_data *d, const struct cpumask *mask_val,
 
         target_col = &its_dev->its->collections[cpu];
         its_send_movi(its_dev, target_col, id);
-        its_dev->collection = target_col;
+        its_dev->event_map.col_map[id] = cpu;
 
         return IRQ_SET_MASK_OK_DONE;
 }
@@ -712,8 +744,10 @@ out:
         return bitmap;
 }
 
-static void its_lpi_free(unsigned long *bitmap, int base, int nr_ids)
+static void its_lpi_free(struct event_lpi_map *map)
 {
+        int base = map->lpi_base;
+        int nr_ids = map->nr_lpis;
         int lpi;
 
         spin_lock(&lpi_lock);
@@ -730,7 +764,8 @@ static void its_lpi_free(unsigned long *bitmap, int base, int nr_ids)
 
         spin_unlock(&lpi_lock);
 
-        kfree(bitmap);
+        kfree(map->lpi_map);
+        kfree(map->col_map);
 }
 
 /*
@@ -1098,11 +1133,11 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id,
         struct its_device *dev;
         unsigned long *lpi_map;
         unsigned long flags;
+        u16 *col_map = NULL;
         void *itt;
         int lpi_base;
         int nr_lpis;
         int nr_ites;
-        int cpu;
         int sz;
 
         dev = kzalloc(sizeof(*dev), GFP_KERNEL);
@@ -1116,20 +1151,24 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id,
         sz = max(sz, ITS_ITT_ALIGN) + ITS_ITT_ALIGN - 1;
         itt = kzalloc(sz, GFP_KERNEL);
         lpi_map = its_lpi_alloc_chunks(nvecs, &lpi_base, &nr_lpis);
+        if (lpi_map)
+                col_map = kzalloc(sizeof(*col_map) * nr_lpis, GFP_KERNEL);
 
-        if (!dev || !itt || !lpi_map) {
+        if (!dev || !itt || !lpi_map || !col_map) {
                 kfree(dev);
                 kfree(itt);
                 kfree(lpi_map);
+                kfree(col_map);
                 return NULL;
         }
 
         dev->its = its;
         dev->itt = itt;
         dev->nr_ites = nr_ites;
-        dev->lpi_map = lpi_map;
-        dev->lpi_base = lpi_base;
-        dev->nr_lpis = nr_lpis;
+        dev->event_map.lpi_map = lpi_map;
+        dev->event_map.col_map = col_map;
+        dev->event_map.lpi_base = lpi_base;
+        dev->event_map.nr_lpis = nr_lpis;
         dev->device_id = dev_id;
         INIT_LIST_HEAD(&dev->entry);
 
@@ -1137,10 +1176,6 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id,
         list_add(&dev->entry, &its->its_device_list);
         raw_spin_unlock_irqrestore(&its->lock, flags);
 
-        /* Bind the device to the first possible CPU */
-        cpu = cpumask_first(cpu_online_mask);
-        dev->collection = &its->collections[cpu];
-
         /* Map device to its ITT */
         its_send_mapd(dev, 1);
 
@@ -1162,12 +1197,13 @@ static int its_alloc_device_irq(struct its_device *dev, irq_hw_number_t *hwirq)
 {
         int idx;
 
-        idx = find_first_zero_bit(dev->lpi_map, dev->nr_lpis);
-        if (idx == dev->nr_lpis)
+        idx = find_first_zero_bit(dev->event_map.lpi_map,
+                                  dev->event_map.nr_lpis);
+        if (idx == dev->event_map.nr_lpis)
                 return -ENOSPC;
 
-        *hwirq = dev->lpi_base + idx;
-        set_bit(idx, dev->lpi_map);
+        *hwirq = dev->event_map.lpi_base + idx;
+        set_bit(idx, dev->event_map.lpi_map);
 
         return 0;
 }
@@ -1287,7 +1323,8 @@ static int its_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
                 irq_domain_set_hwirq_and_chip(domain, virq + i,
                                               hwirq, &its_irq_chip, its_dev);
                 dev_dbg(info->scratchpad[1].ptr, "ID:%d pID:%d vID:%d\n",
-                        (int)(hwirq - its_dev->lpi_base), (int)hwirq, virq + i);
+                        (int)(hwirq - its_dev->event_map.lpi_base),
+                        (int)hwirq, virq + i);
         }
 
         return 0;
@@ -1299,6 +1336,9 @@ static void its_irq_domain_activate(struct irq_domain *domain,
         struct its_device *its_dev = irq_data_get_irq_chip_data(d);
         u32 event = its_get_event_id(d);
 
+        /* Bind the LPI to the first possible CPU */
+        its_dev->event_map.col_map[event] = cpumask_first(cpu_online_mask);
+
         /* Map the GIC IRQ and event to the device */
         its_send_mapvi(its_dev, d->hwirq, event);
 }
@@ -1326,17 +1366,16 @@ static void its_irq_domain_free(struct irq_domain *domain, unsigned int virq,
                 u32 event = its_get_event_id(data);
 
                 /* Mark interrupt index as unused */
-                clear_bit(event, its_dev->lpi_map);
+                clear_bit(event, its_dev->event_map.lpi_map);
 
                 /* Nuke the entry in the domain */
                 irq_domain_reset_irq_data(data);
         }
 
         /* If all interrupts have been freed, start mopping the floor */
-        if (bitmap_empty(its_dev->lpi_map, its_dev->nr_lpis)) {
-                its_lpi_free(its_dev->lpi_map,
-                             its_dev->lpi_base,
-                             its_dev->nr_lpis);
+        if (bitmap_empty(its_dev->event_map.lpi_map,
+                         its_dev->event_map.nr_lpis)) {
+                its_lpi_free(&its_dev->event_map);
 
                 /* Unmap device/itt */
                 its_send_mapd(its_dev, 0);
diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
index 80fde37076c4..29c544d0aaa9 100644
--- a/drivers/irqchip/irq-gic.c
+++ b/drivers/irqchip/irq-gic.c
@@ -1051,7 +1051,7 @@ gic_acpi_parse_madt_cpu(struct acpi_subtable_header *header,
 
         processor = (struct acpi_madt_generic_interrupt *)header;
 
-        if (BAD_MADT_ENTRY(processor, end))
+        if (BAD_MADT_GICC_ENTRY(processor, end))
                 return -EINVAL;
 
         /*
diff --git a/drivers/irqchip/irq-mips-gic.c b/drivers/irqchip/irq-mips-gic.c
index e670f651166d..2d36eca76bef 100644
--- a/drivers/irqchip/irq-mips-gic.c
+++ b/drivers/irqchip/irq-mips-gic.c
@@ -256,16 +256,6 @@ int gic_get_c0_fdc_int(void)
                 return MIPS_CPU_IRQ_BASE + cp0_fdc_irq;
         }
 
-        /*
-         * Some cores claim the FDC is routable but it doesn't actually seem to
-         * be connected.
-         */
-        switch (current_cpu_type()) {
-        case CPU_INTERAPTIV:
-        case CPU_PROAPTIV:
-                return -1;
-        }
-
         return irq_create_mapping(gic_irq_domain,
                                   GIC_LOCAL_TO_HWIRQ(GIC_LOCAL_INT_FDC));
 }
diff --git a/drivers/irqchip/spear-shirq.c b/drivers/irqchip/spear-shirq.c
index ee175d2b9926..4cbd9c5dc1e6 100644
--- a/drivers/irqchip/spear-shirq.c
+++ b/drivers/irqchip/spear-shirq.c
@@ -2,7 +2,7 @@
  * SPEAr platform shared irq layer source file
  *
  * Copyright (C) 2009-2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
  *
  * Copyright (C) 2012 ST Microelectronics
  * Shiraz Hashim <shiraz.linux.kernel@gmail.com>
diff --git a/drivers/isdn/gigaset/ser-gigaset.c b/drivers/isdn/gigaset/ser-gigaset.c
index 8c91fd5eb6fd..375be509e95f 100644
--- a/drivers/isdn/gigaset/ser-gigaset.c
+++ b/drivers/isdn/gigaset/ser-gigaset.c
@@ -524,9 +524,18 @@ gigaset_tty_open(struct tty_struct *tty)
         cs->hw.ser->tty = tty;
         atomic_set(&cs->hw.ser->refcnt, 1);
         init_completion(&cs->hw.ser->dead_cmp);
-
         tty->disc_data = cs;
 
+        /* Set the amount of data we're willing to receive per call
+         * from the hardware driver to half of the input buffer size
+         * to leave some reserve.
+         * Note: We don't do flow control towards the hardware driver.
+         * If more data is received than will fit into the input buffer,
+         * it will be dropped and an error will be logged. This should
+         * never happen as the device is slow and the buffer size ample.
+         */
+        tty->receive_room = RBUFSIZE/2;
+
         /* OK.. Initialization of the datastructures and the HW is done.. Now
          * startup system and notify the LL that we are ready to run
          */
@@ -598,28 +607,6 @@ static int gigaset_tty_hangup(struct tty_struct *tty)
 }
 
 /*
- * Read on the tty.
- * Unused, received data goes only to the Gigaset driver.
- */
-static ssize_t
-gigaset_tty_read(struct tty_struct *tty, struct file *file,
-                 unsigned char __user *buf, size_t count)
-{
-        return -EAGAIN;
-}
-
-/*
- * Write on the tty.
- * Unused, transmit data comes only from the Gigaset driver.
- */
-static ssize_t
-gigaset_tty_write(struct tty_struct *tty, struct file *file,
-                  const unsigned char *buf, size_t count)
-{
-        return -EAGAIN;
-}
-
-/*
  * Ioctl on the tty.
  * Called in process context only.
  * May be re-entered by multiple ioctl calling threads.
@@ -752,8 +739,6 @@ static struct tty_ldisc_ops gigaset_ldisc = {
         .open           = gigaset_tty_open,
         .close          = gigaset_tty_close,
         .hangup         = gigaset_tty_hangup,
-        .read           = gigaset_tty_read,
-        .write          = gigaset_tty_write,
         .ioctl          = gigaset_tty_ioctl,
         .receive_buf    = gigaset_tty_receive,
         .write_wakeup   = gigaset_tty_wakeup,
diff --git a/drivers/md/bcache/closure.h b/drivers/md/bcache/closure.h
index a08e3eeac3c5..79a6d63e8ed3 100644
--- a/drivers/md/bcache/closure.h
+++ b/drivers/md/bcache/closure.h
@@ -320,7 +320,6 @@ static inline void closure_wake_up(struct closure_waitlist *list)
 do {                                                                    \
         set_closure_fn(_cl, _fn, _wq);                                  \
         closure_sub(_cl, CLOSURE_RUNNING + 1);                          \
-        return;                                                         \
 } while (0)
 
 /**
@@ -349,7 +348,6 @@ do {									\
 do {                                                                    \
         set_closure_fn(_cl, _fn, _wq);                                  \
         closure_queue(_cl);                                             \
-        return;                                                         \
 } while (0)
 
 /**
@@ -365,7 +363,6 @@ do {									\
 do {                                                                    \
         set_closure_fn(_cl, _destructor, NULL);                         \
         closure_sub(_cl, CLOSURE_RUNNING - CLOSURE_DESTRUCTOR + 1);     \
-        return;                                                         \
 } while (0)
 
 /**
diff --git a/drivers/md/bcache/io.c b/drivers/md/bcache/io.c
index cb64e64a4789..bf6a9ca18403 100644
--- a/drivers/md/bcache/io.c
+++ b/drivers/md/bcache/io.c
@@ -105,6 +105,7 @@ void bch_generic_make_request(struct bio *bio, struct bio_split_pool *p)
         } while (n != bio);
 
         continue_at(&s->cl, bch_bio_submit_split_done, NULL);
+        return;
 submit:
         generic_make_request(bio);
 }
diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c
index ce64fc851251..418607a6ba33 100644
--- a/drivers/md/bcache/journal.c
+++ b/drivers/md/bcache/journal.c
@@ -592,12 +592,14 @@ static void journal_write_unlocked(struct closure *cl)
 
         if (!w->need_write) {
                 closure_return_with_destructor(cl, journal_write_unlock);
+                return;
         } else if (journal_full(&c->journal)) {
                 journal_reclaim(c);
                 spin_unlock(&c->journal.lock);
 
                 btree_flush_write(c);
                 continue_at(cl, journal_write, system_wq);
+                return;
         }
 
         c->journal.blocks_free -= set_blocks(w->data, block_bytes(c));
diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c
index 4afb2d26b148..f292790997d7 100644
--- a/drivers/md/bcache/request.c
+++ b/drivers/md/bcache/request.c
@@ -88,8 +88,10 @@ static void bch_data_insert_keys(struct closure *cl)
         if (journal_ref)
                 atomic_dec_bug(journal_ref);
 
-        if (!op->insert_data_done)
+        if (!op->insert_data_done) {
                 continue_at(cl, bch_data_insert_start, op->wq);
+                return;
+        }
 
         bch_keylist_free(&op->insert_keys);
         closure_return(cl);
@@ -216,8 +218,10 @@ static void bch_data_insert_start(struct closure *cl)
                 /* 1 for the device pointer and 1 for the chksum */
                 if (bch_keylist_realloc(&op->insert_keys,
                                         3 + (op->csum ? 1 : 0),
-                                        op->c))
+                                        op->c)) {
                         continue_at(cl, bch_data_insert_keys, op->wq);
+                        return;
+                }
 
                 k = op->insert_keys.top;
                 bkey_init(k);
@@ -255,6 +259,7 @@ static void bch_data_insert_start(struct closure *cl)
 
         op->insert_data_done = true;
         continue_at(cl, bch_data_insert_keys, op->wq);
+        return;
 err:
         /* bch_alloc_sectors() blocks if s->writeback = true */
         BUG_ON(op->writeback);
@@ -576,8 +581,10 @@ static void cache_lookup(struct closure *cl)
         ret = bch_btree_map_keys(&s->op, s->iop.c,
                                  &KEY(s->iop.inode, bio->bi_iter.bi_sector, 0),
                                  cache_lookup_fn, MAP_END_KEY);
-        if (ret == -EAGAIN)
+        if (ret == -EAGAIN) {
                 continue_at(cl, cache_lookup, bcache_wq);
+                return;
+        }
 
         closure_return(cl);
 }
@@ -1085,6 +1092,7 @@ static void flash_dev_make_request(struct request_queue *q, struct bio *bio)
                 continue_at_nobarrier(&s->cl,
                                       flash_dev_nodata,
                                       bcache_wq);
+                return;
         } else if (rw) {
                 bch_keybuf_check_overlapping(&s->iop.c->moving_gc_keys,
                                         &KEY(d->id, bio->bi_iter.bi_sector, 0),
diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
index ed2346ddf4c9..e51de52eeb94 100644
--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -494,7 +494,7 @@ static int bitmap_new_disk_sb(struct bitmap *bitmap)
         bitmap_super_t *sb;
         unsigned long chunksize, daemon_sleep, write_behind;
 
-        bitmap->storage.sb_page = alloc_page(GFP_KERNEL);
+        bitmap->storage.sb_page = alloc_page(GFP_KERNEL | __GFP_ZERO);
         if (bitmap->storage.sb_page == NULL)
                 return -ENOMEM;
         bitmap->storage.sb_page->index = 0;
@@ -541,6 +541,7 @@ static int bitmap_new_disk_sb(struct bitmap *bitmap)
         sb->state = cpu_to_le32(bitmap->flags);
         bitmap->events_cleared = bitmap->mddev->events;
         sb->events_cleared = cpu_to_le64(bitmap->mddev->events);
+        bitmap->mddev->bitmap_info.nodes = 0;
 
         kunmap_atomic(sb);
 
@@ -558,6 +559,7 @@ static int bitmap_read_sb(struct bitmap *bitmap)
         unsigned long sectors_reserved = 0;
         int err = -EINVAL;
         struct page *sb_page;
+        loff_t offset = bitmap->mddev->bitmap_info.offset;
 
         if (!bitmap->storage.file && !bitmap->mddev->bitmap_info.offset) {
                 chunksize = 128 * 1024 * 1024;
@@ -584,9 +586,9 @@ re_read:
                 bm_blocks = ((bm_blocks+7) >> 3) + sizeof(bitmap_super_t);
                 /* to 4k blocks */
                 bm_blocks = DIV_ROUND_UP_SECTOR_T(bm_blocks, 4096);
-                bitmap->mddev->bitmap_info.offset += bitmap->cluster_slot * (bm_blocks << 3);
+                offset = bitmap->mddev->bitmap_info.offset + (bitmap->cluster_slot * (bm_blocks << 3));
                 pr_info("%s:%d bm slot: %d offset: %llu\n", __func__, __LINE__,
-                        bitmap->cluster_slot, (unsigned long long)bitmap->mddev->bitmap_info.offset);
+                        bitmap->cluster_slot, offset);
         }
 
         if (bitmap->storage.file) {
@@ -597,7 +599,7 @@ re_read:
                                 bitmap, bytes, sb_page);
         } else {
                 err = read_sb_page(bitmap->mddev,
-                                   bitmap->mddev->bitmap_info.offset,
+                                   offset,
                                    sb_page,
                                    0, sizeof(bitmap_super_t));
         }
@@ -611,8 +613,16 @@ re_read:
         daemon_sleep = le32_to_cpu(sb->daemon_sleep) * HZ;
         write_behind = le32_to_cpu(sb->write_behind);
         sectors_reserved = le32_to_cpu(sb->sectors_reserved);
-        nodes = le32_to_cpu(sb->nodes);
-        strlcpy(bitmap->mddev->bitmap_info.cluster_name, sb->cluster_name, 64);
+        /* XXX: This is a hack to ensure that we don't use clustering
+         *  in case:
+         *      - dm-raid is in use and
+         *      - the nodes written in bitmap_sb is erroneous.
+         */
+        if (!bitmap->mddev->sync_super) {
+                nodes = le32_to_cpu(sb->nodes);
+                strlcpy(bitmap->mddev->bitmap_info.cluster_name,
+                                sb->cluster_name, 64);
+        }
 
         /* verify that the bitmap-specific fields are valid */
         if (sb->magic != cpu_to_le32(BITMAP_MAGIC))
@@ -671,7 +681,7 @@ out:
         kunmap_atomic(sb);
         /* Assiging chunksize is required for "re_read" */
         bitmap->mddev->bitmap_info.chunksize = chunksize;
-        if (nodes && (bitmap->cluster_slot < 0)) {
+        if (err == 0 && nodes && (bitmap->cluster_slot < 0)) {
                 err = md_setup_cluster(bitmap->mddev, nodes);
                 if (err) {
                         pr_err("%s: Could not setup cluster service (%d)\n",
@@ -1866,10 +1876,6 @@ int bitmap_copy_from_slot(struct mddev *mddev, int slot,
         if (IS_ERR(bitmap))
                 return PTR_ERR(bitmap);
 
-        rv = bitmap_read_sb(bitmap);
-        if (rv)
-                goto err;
-
         rv = bitmap_init_from_disk(bitmap, 0);
         if (rv)
                 goto err;
diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
index 1b4e1756b169..b680da5d7b93 100644
--- a/drivers/md/dm-cache-target.c
+++ b/drivers/md/dm-cache-target.c
@@ -424,7 +424,6 @@ static void free_migration(struct dm_cache_migration *mg)
                 wake_up(&cache->migration_wait);
 
         mempool_free(mg, cache->migration_pool);
-        wake_worker(cache);
 }
 
 static int prealloc_data_structs(struct cache *cache, struct prealloc *p)
@@ -1947,6 +1946,7 @@ static int commit_if_needed(struct cache *cache)
 
 static void process_deferred_bios(struct cache *cache)
 {
+        bool prealloc_used = false;
         unsigned long flags;
         struct bio_list bios;
         struct bio *bio;
@@ -1981,13 +1981,16 @@ static void process_deferred_bios(struct cache *cache)
                         process_discard_bio(cache, &structs, bio);
                 else
                         process_bio(cache, &structs, bio);
+                prealloc_used = true;
         }
 
-        prealloc_free_structs(cache, &structs);
+        if (prealloc_used)
+                prealloc_free_structs(cache, &structs);
 }
 
 static void process_deferred_cells(struct cache *cache)
 {
+        bool prealloc_used = false;
         unsigned long flags;
         struct dm_bio_prison_cell *cell, *tmp;
         struct list_head cells;
@@ -2015,9 +2018,11 @@ static void process_deferred_cells(struct cache *cache)
                 }
 
                 process_cell(cache, &structs, cell);
+                prealloc_used = true;
         }
 
-        prealloc_free_structs(cache, &structs);
+        if (prealloc_used)
+                prealloc_free_structs(cache, &structs);
 }
 
 static void process_deferred_flush_bios(struct cache *cache, bool submit_bios)
@@ -2062,7 +2067,7 @@ static void process_deferred_writethrough_bios(struct cache *cache)
 
 static void writeback_some_dirty_blocks(struct cache *cache)
 {
-        int r = 0;
+        bool prealloc_used = false;
         dm_oblock_t oblock;
         dm_cblock_t cblock;
         struct prealloc structs;
@@ -2072,23 +2077,21 @@ static void writeback_some_dirty_blocks(struct cache *cache)
         memset(&structs, 0, sizeof(structs));
 
         while (spare_migration_bandwidth(cache)) {
-                if (prealloc_data_structs(cache, &structs))
-                        break;
+                if (policy_writeback_work(cache->policy, &oblock, &cblock, busy))
+                        break; /* no work to do */
 
-                r = policy_writeback_work(cache->policy, &oblock, &cblock, busy);
-                if (r)
-                        break;
-
-                r = get_cell(cache, oblock, &structs, &old_ocell);
-                if (r) {
+                if (prealloc_data_structs(cache, &structs) ||
+                    get_cell(cache, oblock, &structs, &old_ocell)) {
                         policy_set_dirty(cache->policy, oblock);
                         break;
                 }
 
                 writeback(cache, &structs, oblock, cblock, old_ocell);
+                prealloc_used = true;
         }
 
-        prealloc_free_structs(cache, &structs);
+        if (prealloc_used)
+                prealloc_free_structs(cache, &structs);
 }
 
 /*----------------------------------------------------------------
@@ -3496,7 +3499,7 @@ static void cache_resume(struct dm_target *ti)
  * <#demotions> <#promotions> <#dirty>
  * <#features> <features>*
  * <#core args> <core args>
- * <policy name> <#policy args> <policy args>* <cache metadata mode>
+ * <policy name> <#policy args> <policy args>* <cache metadata mode> <needs_check>
  */
 static void cache_status(struct dm_target *ti, status_type_t type,
                          unsigned status_flags, char *result, unsigned maxlen)
@@ -3582,6 +3585,11 @@ static void cache_status(struct dm_target *ti, status_type_t type,
                 else
                         DMEMIT("rw ");
 
+                if (dm_cache_metadata_needs_check(cache->cmd))
+                        DMEMIT("needs_check ");
+                else
+                        DMEMIT("- ");
+
                 break;
 
         case STATUSTYPE_TABLE:
@@ -3820,7 +3828,7 @@ static void cache_io_hints(struct dm_target *ti, struct queue_limits *limits)
 
 static struct target_type cache_target = {
         .name = "cache",
-        .version = {1, 7, 0},
+        .version = {1, 8, 0},
         .module = THIS_MODULE,
         .ctr = cache_ctr,
         .dtr = cache_dtr,
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index c33f61a4cc28..1c50c580215c 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -18,6 +18,7 @@
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/slab.h>
+#include <linux/vmalloc.h>
 #include <linux/sort.h>
 #include <linux/rbtree.h>
 
@@ -268,7 +269,7 @@ struct pool {
         process_mapping_fn process_prepared_mapping;
         process_mapping_fn process_prepared_discard;
 
-        struct dm_bio_prison_cell *cell_sort_array[CELL_SORT_ARRAY_SIZE];
+        struct dm_bio_prison_cell **cell_sort_array;
 };
 
 static enum pool_mode get_pool_mode(struct pool *pool);
@@ -2281,18 +2282,23 @@ static void do_waker(struct work_struct *ws)
         queue_delayed_work(pool->wq, &pool->waker, COMMIT_PERIOD);
 }
 
+static void notify_of_pool_mode_change_to_oods(struct pool *pool);
+
 /*
  * We're holding onto IO to allow userland time to react.  After the
  * timeout either the pool will have been resized (and thus back in
- * PM_WRITE mode), or we degrade to PM_READ_ONLY and start erroring IO.
+ * PM_WRITE mode), or we degrade to PM_OUT_OF_DATA_SPACE w/ error_if_no_space.
  */
 static void do_no_space_timeout(struct work_struct *ws)
 {
         struct pool *pool = container_of(to_delayed_work(ws), struct pool,
                                          no_space_timeout);
 
-        if (get_pool_mode(pool) == PM_OUT_OF_DATA_SPACE && !pool->pf.error_if_no_space)
-                set_pool_mode(pool, PM_READ_ONLY);
+        if (get_pool_mode(pool) == PM_OUT_OF_DATA_SPACE && !pool->pf.error_if_no_space) {
+                pool->pf.error_if_no_space = true;
+                notify_of_pool_mode_change_to_oods(pool);
+                error_retry_list(pool);
+        }
 }
 
 /*----------------------------------------------------------------*/
@@ -2370,6 +2376,14 @@ static void notify_of_pool_mode_change(struct pool *pool, const char *new_mode)
                dm_device_name(pool->pool_md), new_mode);
 }
 
+static void notify_of_pool_mode_change_to_oods(struct pool *pool)
+{
+        if (!pool->pf.error_if_no_space)
+                notify_of_pool_mode_change(pool, "out-of-data-space (queue IO)");
+        else
+                notify_of_pool_mode_change(pool, "out-of-data-space (error IO)");
+}
+
 static bool passdown_enabled(struct pool_c *pt)
 {
         return pt->adjusted_pf.discard_passdown;
@@ -2454,7 +2468,7 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode)
                  * frequently seeing this mode.
                  */
                 if (old_mode != new_mode)
-                        notify_of_pool_mode_change(pool, "out-of-data-space");
+                        notify_of_pool_mode_change_to_oods(pool);
                 pool->process_bio = process_bio_read_only;
                 pool->process_discard = process_discard_bio;
                 pool->process_cell = process_cell_read_only;
@@ -2777,6 +2791,7 @@ static void __pool_destroy(struct pool *pool)
 {
         __pool_table_remove(pool);
 
+        vfree(pool->cell_sort_array);
         if (dm_pool_metadata_close(pool->pmd) < 0)
                 DMWARN("%s: dm_pool_metadata_close() failed.", __func__);
 
@@ -2889,6 +2904,13 @@ static struct pool *pool_create(struct mapped_device *pool_md,
                 goto bad_mapping_pool;
         }
 
+        pool->cell_sort_array = vmalloc(sizeof(*pool->cell_sort_array) * CELL_SORT_ARRAY_SIZE);
+        if (!pool->cell_sort_array) {
+                *error = "Error allocating cell sort array";
+                err_p = ERR_PTR(-ENOMEM);
+                goto bad_sort_array;
+        }
+
         pool->ref_count = 1;
         pool->last_commit_jiffies = jiffies;
         pool->pool_md = pool_md;
@@ -2897,6 +2919,8 @@ static struct pool *pool_create(struct mapped_device *pool_md,
 
         return pool;
 
+bad_sort_array:
+        mempool_destroy(pool->mapping_pool);
 bad_mapping_pool:
         dm_deferred_set_destroy(pool->all_io_ds);
 bad_all_io_ds:
@@ -3714,6 +3738,7 @@ static void emit_flags(struct pool_features *pf, char *result,
  * Status line is:
  *    <transaction id> <used metadata sectors>/<total metadata sectors>
  *    <used data sectors>/<total data sectors> <held metadata root>
+ *    <pool mode> <discard config> <no space config> <needs_check>
  */
 static void pool_status(struct dm_target *ti, status_type_t type,
                         unsigned status_flags, char *result, unsigned maxlen)
@@ -3815,6 +3840,11 @@ static void pool_status(struct dm_target *ti, status_type_t type,
                 else
                         DMEMIT("queue_if_no_space ");
 
+                if (dm_pool_metadata_needs_check(pool->pmd))
+                        DMEMIT("needs_check ");
+                else
+                        DMEMIT("- ");
+
                 break;
 
         case STATUSTYPE_TABLE:
@@ -3918,7 +3948,7 @@ static struct target_type pool_target = {
         .name = "thin-pool",
         .features = DM_TARGET_SINGLETON | DM_TARGET_ALWAYS_WRITEABLE |
                     DM_TARGET_IMMUTABLE,
-        .version = {1, 15, 0},
+        .version = {1, 16, 0},
         .module = THIS_MODULE,
         .ctr = pool_ctr,
         .dtr = pool_dtr,
@@ -4305,7 +4335,7 @@ static void thin_io_hints(struct dm_target *ti, struct queue_limits *limits)
 
 static struct target_type thin_target = {
         .name = "thin",
-        .version = {1, 15, 0},
+        .version = {1, 16, 0},
         .module = THIS_MODULE,
         .ctr = thin_ctr,
         .dtr = thin_dtr,
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index f331d888e7f5..ab37ae114e94 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -1067,13 +1067,10 @@ static void rq_end_stats(struct mapped_device *md, struct request *orig)
  */
 static void rq_completed(struct mapped_device *md, int rw, bool run_queue)
 {
-        int nr_requests_pending;
-
         atomic_dec(&md->pending[rw]);
 
         /* nudge anyone waiting on suspend queue */
-        nr_requests_pending = md_in_flight(md);
-        if (!nr_requests_pending)
+        if (!md_in_flight(md))
                 wake_up(&md->wait);
 
         /*
@@ -1085,8 +1082,7 @@ static void rq_completed(struct mapped_device *md, int rw, bool run_queue)
         if (run_queue) {
                 if (md->queue->mq_ops)
                         blk_mq_run_hw_queues(md->queue, true);
-                else if (!nr_requests_pending ||
-                         (nr_requests_pending >= md->queue->nr_congestion_on))
+                else
                         blk_run_queue_async(md->queue);
         }
 
@@ -2281,8 +2277,6 @@ static void dm_init_old_md_queue(struct mapped_device *md)
 
 static void cleanup_mapped_device(struct mapped_device *md)
 {
-        cleanup_srcu_struct(&md->io_barrier);
-
         if (md->wq)
                 destroy_workqueue(md->wq);
         if (md->kworker_task)
@@ -2294,6 +2288,8 @@ static void cleanup_mapped_device(struct mapped_device *md)
         if (md->bs)
                 bioset_free(md->bs);
 
+        cleanup_srcu_struct(&md->io_barrier);
+
         if (md->disk) {
                 spin_lock(&_minor_lock);
                 md->disk->private_data = NULL;
diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c
index fcfc4b9b2672..0072190515e0 100644
--- a/drivers/md/md-cluster.c
+++ b/drivers/md/md-cluster.c
@@ -44,6 +44,7 @@ struct resync_info {
 
 /* md_cluster_info flags */
 #define         MD_CLUSTER_WAITING_FOR_NEWDISK          1
+#define         MD_CLUSTER_SUSPEND_READ_BALANCING       2
 
 
 struct md_cluster_info {
@@ -275,6 +276,9 @@ clear_bit:
 
 static void recover_prep(void *arg)
 {
+        struct mddev *mddev = arg;
+        struct md_cluster_info *cinfo = mddev->cluster_info;
+        set_bit(MD_CLUSTER_SUSPEND_READ_BALANCING, &cinfo->state);
 }
 
 static void recover_slot(void *arg, struct dlm_slot *slot)
@@ -307,6 +311,7 @@ static void recover_done(void *arg, struct dlm_slot *slots,
 
         cinfo->slot_number = our_slot;
         complete(&cinfo->completion);
+        clear_bit(MD_CLUSTER_SUSPEND_READ_BALANCING, &cinfo->state);
 }
 
 static const struct dlm_lockspace_ops md_ls_ops = {
@@ -816,12 +821,17 @@ static void resync_finish(struct mddev *mddev)
         resync_send(mddev, RESYNCING, 0, 0);
 }
 
-static int area_resyncing(struct mddev *mddev, sector_t lo, sector_t hi)
+static int area_resyncing(struct mddev *mddev, int direction,
+                sector_t lo, sector_t hi)
 {
         struct md_cluster_info *cinfo = mddev->cluster_info;
         int ret = 0;
         struct suspend_info *s;
 
+        if ((direction == READ) &&
+                test_bit(MD_CLUSTER_SUSPEND_READ_BALANCING, &cinfo->state))
+                return 1;
+
         spin_lock_irq(&cinfo->suspend_lock);
         if (list_empty(&cinfo->suspend_list))
                 goto out;
diff --git a/drivers/md/md-cluster.h b/drivers/md/md-cluster.h
index 6817ee00e053..00defe2badbc 100644
--- a/drivers/md/md-cluster.h
+++ b/drivers/md/md-cluster.h
@@ -18,7 +18,7 @@ struct md_cluster_operations {
         int (*metadata_update_start)(struct mddev *mddev);
         int (*metadata_update_finish)(struct mddev *mddev);
         int (*metadata_update_cancel)(struct mddev *mddev);
-        int (*area_resyncing)(struct mddev *mddev, sector_t lo, sector_t hi);
+        int (*area_resyncing)(struct mddev *mddev, int direction, sector_t lo, sector_t hi);
         int (*add_new_disk_start)(struct mddev *mddev, struct md_rdev *rdev);
         int (*add_new_disk_finish)(struct mddev *mddev);
         int (*new_disk_ack)(struct mddev *mddev, bool ack);
diff --git a/drivers/md/md.c b/drivers/md/md.c
index d429c30cd514..0c2a4e8b873c 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -5382,6 +5382,8 @@ static void __md_stop(struct mddev *mddev)
 {
         struct md_personality *pers = mddev->pers;
         mddev_detach(mddev);
+        /* Ensure ->event_work is done */
+        flush_workqueue(md_misc_wq);
         spin_lock(&mddev->lock);
         mddev->ready = 0;
         mddev->pers = NULL;
@@ -7437,7 +7439,7 @@ int md_setup_cluster(struct mddev *mddev, int nodes)
         err = request_module("md-cluster");
         if (err) {
                 pr_err("md-cluster module not found.\n");
-                return err;
+                return -ENOENT;
         }
 
         spin_lock(&pers_lock);
diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c
index e04cfd2d60ef..9836c0ae897c 100644
--- a/drivers/md/persistent-data/dm-btree-remove.c
+++ b/drivers/md/persistent-data/dm-btree-remove.c
@@ -309,8 +309,8 @@ static void redistribute3(struct dm_btree_info *info, struct btree_node *parent,
 
                 if (s < 0 && nr_center < -s) {
                         /* not enough in central node */
-                        shift(left, center, nr_center);
-                        s = nr_center - target;
+                        shift(left, center, -nr_center);
+                        s += nr_center;
                         shift(left, right, s);
                         nr_right += s;
                 } else
@@ -323,7 +323,7 @@ static void redistribute3(struct dm_btree_info *info, struct btree_node *parent,
                 if (s > 0 && nr_center < s) {
                         /* not enough in central node */
                         shift(center, right, nr_center);
-                        s = target - nr_center;
+                        s -= nr_center;
                         shift(left, right, s);
                         nr_left -= s;
                 } else
diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c
index 200ac12a1d40..fdd3793e22f9 100644
--- a/drivers/md/persistent-data/dm-btree.c
+++ b/drivers/md/persistent-data/dm-btree.c
@@ -255,7 +255,7 @@ int dm_btree_del(struct dm_btree_info *info, dm_block_t root)
         int r;
         struct del_stack *s;
 
-        s = kmalloc(sizeof(*s), GFP_KERNEL);
+        s = kmalloc(sizeof(*s), GFP_NOIO);
         if (!s)
                 return -ENOMEM;
         s->info = info;
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index f80f1af61ce7..94f5b55069e0 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -336,7 +336,7 @@ static void raid1_end_read_request(struct bio *bio, int error)
                 spin_lock_irqsave(&conf->device_lock, flags);
                 if (r1_bio->mddev->degraded == conf->raid_disks ||
                     (r1_bio->mddev->degraded == conf->raid_disks-1 &&
-                     !test_bit(Faulty, &conf->mirrors[mirror].rdev->flags)))
+                     test_bit(In_sync, &conf->mirrors[mirror].rdev->flags)))
                         uptodate = 1;
                 spin_unlock_irqrestore(&conf->device_lock, flags);
         }
@@ -541,7 +541,7 @@ static int read_balance(struct r1conf *conf, struct r1bio *r1_bio, int *max_sect
 
         if ((conf->mddev->recovery_cp < this_sector + sectors) ||
             (mddev_is_clustered(conf->mddev) &&
-            md_cluster_ops->area_resyncing(conf->mddev, this_sector,
+            md_cluster_ops->area_resyncing(conf->mddev, READ, this_sector,
                     this_sector + sectors)))
                 choose_first = 1;
         else
@@ -1111,7 +1111,8 @@ static void make_request(struct mddev *mddev, struct bio * bio)
             ((bio_end_sector(bio) > mddev->suspend_lo &&
             bio->bi_iter.bi_sector < mddev->suspend_hi) ||
             (mddev_is_clustered(mddev) &&
-             md_cluster_ops->area_resyncing(mddev, bio->bi_iter.bi_sector, bio_end_sector(bio))))) {
+             md_cluster_ops->area_resyncing(mddev, WRITE,
+                     bio->bi_iter.bi_sector, bio_end_sector(bio))))) {
                 /* As the suspend_* range is controlled by
                  * userspace, we want an interruptible
                  * wait.
@@ -1124,7 +1125,7 @@ static void make_request(struct mddev *mddev, struct bio * bio)
                         if (bio_end_sector(bio) <= mddev->suspend_lo ||
                             bio->bi_iter.bi_sector >= mddev->suspend_hi ||
                             (mddev_is_clustered(mddev) &&
-                             !md_cluster_ops->area_resyncing(mddev,
+                             !md_cluster_ops->area_resyncing(mddev, WRITE,
                                      bio->bi_iter.bi_sector, bio_end_sector(bio))))
                                 break;
                         schedule();
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 940f2f365461..38c58e19cfce 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -3556,6 +3556,7 @@ static struct r10conf *setup_conf(struct mddev *mddev)
                         /* far_copies must be 1 */
                         conf->prev.stride = conf->dev_sectors;
         }
+        conf->reshape_safe = conf->reshape_progress;
         spin_lock_init(&conf->device_lock);
         INIT_LIST_HEAD(&conf->retry_list);
 
@@ -3760,7 +3761,6 @@ static int run(struct mddev *mddev)
                 }
                 conf->offset_diff = min_offset_diff;
 
-                conf->reshape_safe = conf->reshape_progress;
                 clear_bit(MD_RECOVERY_SYNC, &mddev->recovery);
                 clear_bit(MD_RECOVERY_CHECK, &mddev->recovery);
                 set_bit(MD_RECOVERY_RESHAPE, &mddev->recovery);
@@ -4103,6 +4103,7 @@ static int raid10_start_reshape(struct mddev *mddev)
                 conf->reshape_progress = size;
         } else
                 conf->reshape_progress = 0;
+        conf->reshape_safe = conf->reshape_progress;
         spin_unlock_irq(&conf->device_lock);
 
         if (mddev->delta_disks && mddev->bitmap) {
@@ -4170,6 +4171,7 @@ abort:
                 rdev->new_data_offset = rdev->data_offset;
         smp_wmb();
         conf->reshape_progress = MaxSector;
+        conf->reshape_safe = MaxSector;
         mddev->reshape_position = MaxSector;
         spin_unlock_irq(&conf->device_lock);
         return ret;
@@ -4524,6 +4526,7 @@ static void end_reshape(struct r10conf *conf)
         md_finish_reshape(conf->mddev);
         smp_wmb();
         conf->reshape_progress = MaxSector;
+        conf->reshape_safe = MaxSector;
         spin_unlock_irq(&conf->device_lock);
 
         /* read-ahead size must cover two whole stripes, which is
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 59e44e99eef3..643d217bfa13 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -2162,6 +2162,9 @@ static int resize_stripes(struct r5conf *conf, int newsize)
         if (!sc)
                 return -ENOMEM;
 
+        /* Need to ensure auto-resizing doesn't interfere */
+        mutex_lock(&conf->cache_size_mutex);
+
         for (i = conf->max_nr_stripes; i; i--) {
                 nsh = alloc_stripe(sc, GFP_KERNEL);
                 if (!nsh)
@@ -2178,6 +2181,7 @@ static int resize_stripes(struct r5conf *conf, int newsize)
                         kmem_cache_free(sc, nsh);
                 }
                 kmem_cache_destroy(sc);
+                mutex_unlock(&conf->cache_size_mutex);
                 return -ENOMEM;
         }
         /* Step 2 - Must use GFP_NOIO now.
@@ -2224,6 +2228,7 @@ static int resize_stripes(struct r5conf *conf, int newsize)
         } else
                 err = -ENOMEM;
 
+        mutex_unlock(&conf->cache_size_mutex);
         /* Step 4, return new stripes to service */
         while(!list_empty(&newstripes)) {
                 nsh = list_entry(newstripes.next, struct stripe_head, lru);
@@ -4061,8 +4066,10 @@ static void analyse_stripe(struct stripe_head *sh, struct stripe_head_state *s)
                                  &first_bad, &bad_sectors))
                         set_bit(R5_ReadRepl, &dev->flags);
                 else {
-                        if (rdev)
+                        if (rdev && !test_bit(Faulty, &rdev->flags))
                                 set_bit(R5_NeedReplace, &dev->flags);
+                        else
+                                clear_bit(R5_NeedReplace, &dev->flags);
                         rdev = rcu_dereference(conf->disks[i].rdev);
                         clear_bit(R5_ReadRepl, &dev->flags);
                 }
@@ -5857,12 +5864,14 @@ static void raid5d(struct md_thread *thread)
         pr_debug("%d stripes handled\n", handled);
 
         spin_unlock_irq(&conf->device_lock);
-        if (test_and_clear_bit(R5_ALLOC_MORE, &conf->cache_state)) {
+        if (test_and_clear_bit(R5_ALLOC_MORE, &conf->cache_state) &&
+            mutex_trylock(&conf->cache_size_mutex)) {
                 grow_one_stripe(conf, __GFP_NOWARN);
                 /* Set flag even if allocation failed.  This helps
                  * slow down allocation requests when mem is short
                  */
                 set_bit(R5_DID_ALLOC, &conf->cache_state);
+                mutex_unlock(&conf->cache_size_mutex);
         }
 
         async_tx_issue_pending_all();
@@ -5894,18 +5903,22 @@ raid5_set_cache_size(struct mddev *mddev, int size)
                 return -EINVAL;
 
         conf->min_nr_stripes = size;
+        mutex_lock(&conf->cache_size_mutex);
         while (size < conf->max_nr_stripes &&
                drop_one_stripe(conf))
                 ;
+        mutex_unlock(&conf->cache_size_mutex);
 
 
         err = md_allow_write(mddev);
         if (err)
                 return err;
 
+        mutex_lock(&conf->cache_size_mutex);
         while (size > conf->max_nr_stripes)
                 if (!grow_one_stripe(conf, GFP_KERNEL))
                         break;
+        mutex_unlock(&conf->cache_size_mutex);
 
         return 0;
 }
@@ -6371,11 +6384,18 @@ static unsigned long raid5_cache_scan(struct shrinker *shrink,
                                       struct shrink_control *sc)
 {
         struct r5conf *conf = container_of(shrink, struct r5conf, shrinker);
-        int ret = 0;
-        while (ret < sc->nr_to_scan) {
-                if (drop_one_stripe(conf) == 0)
-                        return SHRINK_STOP;
-                ret++;
+        unsigned long ret = SHRINK_STOP;
+
+        if (mutex_trylock(&conf->cache_size_mutex)) {
+                ret= 0;
+                while (ret < sc->nr_to_scan) {
+                        if (drop_one_stripe(conf) == 0) {
+                                ret = SHRINK_STOP;
+                                break;
+                        }
+                        ret++;
+                }
+                mutex_unlock(&conf->cache_size_mutex);
         }
         return ret;
 }
@@ -6444,6 +6464,7 @@ static struct r5conf *setup_conf(struct mddev *mddev)
                 goto abort;
         spin_lock_init(&conf->device_lock);
         seqcount_init(&conf->gen_lock);
+        mutex_init(&conf->cache_size_mutex);
         init_waitqueue_head(&conf->wait_for_quiescent);
         for (i = 0; i < NR_STRIPE_HASH_LOCKS; i++) {
                 init_waitqueue_head(&conf->wait_for_stripe[i]);
diff --git a/drivers/md/raid5.h b/drivers/md/raid5.h
index 02c3bf8fbfe7..d05144278690 100644
--- a/drivers/md/raid5.h
+++ b/drivers/md/raid5.h
@@ -482,7 +482,8 @@ struct r5conf {
          */
         int                     active_name;
         char                    cache_name[2][32];
-        struct kmem_cache               *slab_cache; /* for allocating stripes */
+        struct kmem_cache       *slab_cache; /* for allocating stripes */
+        struct mutex            cache_size_mutex; /* Protect changes to cache size */
 
         int                     seq_flush, seq_write;
         int                     quiesce;
diff --git a/drivers/media/pci/ivtv/ivtvfb.c b/drivers/media/pci/ivtv/ivtvfb.c
index 4cb365d4ffdc..8b95eefb610b 100644
--- a/drivers/media/pci/ivtv/ivtvfb.c
+++ b/drivers/media/pci/ivtv/ivtvfb.c
@@ -38,6 +38,8 @@
     Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/fb.h>
@@ -1171,6 +1173,13 @@ static int ivtvfb_init_card(struct ivtv *itv)
 {
         int rc;
 
+#ifdef CONFIG_X86_64
+        if (pat_enabled()) {
+                pr_warn("ivtvfb needs PAT disabled, boot with nopat kernel parameter\n");
+                return -ENODEV;
+        }
+#endif
+
         if (itv->osd_info) {
                 IVTVFB_ERR("Card %d already initialised\n", ivtvfb_card_id);
                 return -EBUSY;
@@ -1265,12 +1274,6 @@ static int __init ivtvfb_init(void)
         int registered = 0;
         int err;
 
-#ifdef CONFIG_X86_64
-        if (WARN(pat_enabled(),
-                 "ivtvfb needs PAT disabled, boot with nopat kernel parameter\n")) {
-                return -ENODEV;
-        }
-#endif
 
         if (ivtvfb_card_id < -1 || ivtvfb_card_id >= IVTV_MAX_CARDS) {
                 printk(KERN_ERR "ivtvfb:  ivtvfb_card_id parameter is out of range (valid range: -1 - %d)\n",
diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c
index 8911e51d410a..3a27a84ad3ec 100644
--- a/drivers/memory/omap-gpmc.c
+++ b/drivers/memory/omap-gpmc.c
@@ -2074,14 +2074,8 @@ static int gpmc_probe_dt(struct platform_device *pdev)
                         ret = gpmc_probe_nand_child(pdev, child);
                 else if (of_node_cmp(child->name, "onenand") == 0)
                         ret = gpmc_probe_onenand_child(pdev, child);
-                else if (of_node_cmp(child->name, "ethernet") == 0 ||
-                         of_node_cmp(child->name, "nor") == 0 ||
-                         of_node_cmp(child->name, "uart") == 0)
+                else
                         ret = gpmc_probe_generic_child(pdev, child);
-
-                if (WARN(ret < 0, "%s: probing gpmc child %s failed\n",
-                         __func__, child->full_name))
-                        of_node_put(child);
         }
 
         return 0;
diff --git a/drivers/mfd/stmpe-i2c.c b/drivers/mfd/stmpe-i2c.c
index 5c054031c3f8..e14c8c9d189b 100644
--- a/drivers/mfd/stmpe-i2c.c
+++ b/drivers/mfd/stmpe-i2c.c
@@ -6,7 +6,7 @@
  *
  * License Terms: GNU General Public License, version 2
  * Author: Rabin Vincent <rabin.vincent@stericsson.com> for ST-Ericsson
- * Author: Viresh Kumar <viresh.linux@gmail.com> for ST Microelectronics
+ * Author: Viresh Kumar <vireshk@kernel.org> for ST Microelectronics
  */
 
 #include <linux/i2c.h>
diff --git a/drivers/mfd/stmpe-spi.c b/drivers/mfd/stmpe-spi.c
index a81badbaa917..6fdb30e84a2b 100644
--- a/drivers/mfd/stmpe-spi.c
+++ b/drivers/mfd/stmpe-spi.c
@@ -4,7 +4,7 @@
  * Copyright (C) ST Microelectronics SA 2011
  *
  * License Terms: GNU General Public License, version 2
- * Author: Viresh Kumar <viresh.linux@gmail.com> for ST Microelectronics
+ * Author: Viresh Kumar <vireshk@kernel.org> for ST Microelectronics
  */
 
 #include <linux/spi/spi.h>
@@ -146,4 +146,4 @@ module_exit(stmpe_exit);
 
 MODULE_LICENSE("GPL v2");
 MODULE_DESCRIPTION("STMPE MFD SPI Interface Driver");
-MODULE_AUTHOR("Viresh Kumar <viresh.linux@gmail.com>");
+MODULE_AUTHOR("Viresh Kumar <vireshk@kernel.org>");
diff --git a/drivers/misc/cxl/api.c b/drivers/misc/cxl/api.c
index 0c77240ae2fc..729e0851167d 100644
--- a/drivers/misc/cxl/api.c
+++ b/drivers/misc/cxl/api.c
@@ -23,6 +23,7 @@ struct cxl_context *cxl_dev_context_init(struct pci_dev *dev)
 
         afu = cxl_pci_to_afu(dev);
 
+        get_device(&afu->dev);
         ctx = cxl_context_alloc();
         if (IS_ERR(ctx))
                 return ctx;
@@ -31,6 +32,7 @@ struct cxl_context *cxl_dev_context_init(struct pci_dev *dev)
         rc = cxl_context_init(ctx, afu, false, NULL);
         if (rc) {
                 kfree(ctx);
+                put_device(&afu->dev);
                 return ERR_PTR(-ENOMEM);
         }
         cxl_assign_psn_space(ctx);
@@ -60,6 +62,8 @@ int cxl_release_context(struct cxl_context *ctx)
         if (ctx->status != CLOSED)
                 return -EBUSY;
 
+        put_device(&ctx->afu->dev);
+
         cxl_context_free(ctx);
 
         return 0;
@@ -159,7 +163,6 @@ int cxl_start_context(struct cxl_context *ctx, u64 wed,
         }
 
         ctx->status = STARTED;
-        get_device(&ctx->afu->dev);
 out:
         mutex_unlock(&ctx->status_mutex);
         return rc;
@@ -175,12 +178,7 @@ EXPORT_SYMBOL_GPL(cxl_process_element);
 /* Stop a context.  Returns 0 on success, otherwise -Errno */
 int cxl_stop_context(struct cxl_context *ctx)
 {
-        int rc;
-
-        rc = __detach_context(ctx);
-        if (!rc)
-                put_device(&ctx->afu->dev);
-        return rc;
+        return __detach_context(ctx);
 }
 EXPORT_SYMBOL_GPL(cxl_stop_context);
 
diff --git a/drivers/misc/cxl/context.c b/drivers/misc/cxl/context.c
index 2a4c80ac322a..1287148629c0 100644
--- a/drivers/misc/cxl/context.c
+++ b/drivers/misc/cxl/context.c
@@ -113,11 +113,11 @@ static int cxl_mmap_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
 
         if (ctx->afu->current_mode == CXL_MODE_DEDICATED) {
                 area = ctx->afu->psn_phys;
-                if (offset > ctx->afu->adapter->ps_size)
+                if (offset >= ctx->afu->adapter->ps_size)
                         return VM_FAULT_SIGBUS;
         } else {
                 area = ctx->psn_phys;
-                if (offset > ctx->psn_size)
+                if (offset >= ctx->psn_size)
                         return VM_FAULT_SIGBUS;
         }
 
@@ -145,8 +145,16 @@ static const struct vm_operations_struct cxl_mmap_vmops = {
  */
 int cxl_context_iomap(struct cxl_context *ctx, struct vm_area_struct *vma)
 {
+        u64 start = vma->vm_pgoff << PAGE_SHIFT;
         u64 len = vma->vm_end - vma->vm_start;
-        len = min(len, ctx->psn_size);
+
+        if (ctx->afu->current_mode == CXL_MODE_DEDICATED) {
+                if (start + len > ctx->afu->adapter->ps_size)
+                        return -EINVAL;
+        } else {
+                if (start + len > ctx->psn_size)
+                        return -EINVAL;
+        }
 
         if (ctx->afu->current_mode != CXL_MODE_DEDICATED) {
                 /* make sure there is a valid per process space for this AFU */
diff --git a/drivers/misc/cxl/main.c b/drivers/misc/cxl/main.c
index 833348e2c9cb..4a164ab8b35a 100644
--- a/drivers/misc/cxl/main.c
+++ b/drivers/misc/cxl/main.c
@@ -73,7 +73,7 @@ static inline void cxl_slbia_core(struct mm_struct *mm)
                 spin_lock(&adapter->afu_list_lock);
                 for (slice = 0; slice < adapter->slices; slice++) {
                         afu = adapter->afu[slice];
-                        if (!afu->enabled)
+                        if (!afu || !afu->enabled)
                                 continue;
                         rcu_read_lock();
                         idr_for_each_entry(&afu->contexts_idr, ctx, id)
diff --git a/drivers/misc/cxl/pci.c b/drivers/misc/cxl/pci.c
index c68ef5806dbe..32ad09705949 100644
--- a/drivers/misc/cxl/pci.c
+++ b/drivers/misc/cxl/pci.c
@@ -539,7 +539,7 @@ err:
 
 static void cxl_unmap_slice_regs(struct cxl_afu *afu)
 {
-        if (afu->p1n_mmio)
+        if (afu->p2n_mmio)
                 iounmap(afu->p2n_mmio);
         if (afu->p1n_mmio)
                 iounmap(afu->p1n_mmio);
diff --git a/drivers/misc/cxl/vphb.c b/drivers/misc/cxl/vphb.c
index b1d1983a84a5..2eba002b580b 100644
--- a/drivers/misc/cxl/vphb.c
+++ b/drivers/misc/cxl/vphb.c
@@ -112,9 +112,10 @@ static int cxl_pcie_config_info(struct pci_bus *bus, unsigned int devfn,
         unsigned long addr;
 
         phb = pci_bus_to_host(bus);
-        afu = (struct cxl_afu *)phb->private_data;
         if (phb == NULL)
                 return PCIBIOS_DEVICE_NOT_FOUND;
+        afu = (struct cxl_afu *)phb->private_data;
+
         if (cxl_pcie_cfg_record(bus->number, devfn) > afu->crs_num)
                 return PCIBIOS_DEVICE_NOT_FOUND;
         if (offset >= (unsigned long)phb->cfg_data)
diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c
index 8eb0a9500a90..e9513d651cd3 100644
--- a/drivers/misc/mei/main.c
+++ b/drivers/misc/mei/main.c
@@ -682,7 +682,7 @@ int mei_register(struct mei_device *dev, struct device *parent)
         /* Fill in the data structures */
         devno = MKDEV(MAJOR(mei_devt), dev->minor);
         cdev_init(&dev->cdev, &mei_fops);
-        dev->cdev.owner = mei_fops.owner;
+        dev->cdev.owner = parent->driver->owner;
 
         /* Add the device */
         ret = cdev_add(&dev->cdev, devno, 1);
diff --git a/drivers/misc/mic/scif/scif_nodeqp.c b/drivers/misc/mic/scif/scif_nodeqp.c
index 41e3bdb10061..6dfdae3452d6 100644
--- a/drivers/misc/mic/scif/scif_nodeqp.c
+++ b/drivers/misc/mic/scif/scif_nodeqp.c
@@ -357,7 +357,7 @@ static void scif_p2p_freesg(struct scatterlist *sg)
 }
 
 static struct scatterlist *
-scif_p2p_setsg(void __iomem *va, int page_size, int page_cnt)
+scif_p2p_setsg(phys_addr_t pa, int page_size, int page_cnt)
 {
         struct scatterlist *sg;
         struct page *page;
@@ -368,16 +368,11 @@ scif_p2p_setsg(void __iomem *va, int page_size, int page_cnt)
                 return NULL;
         sg_init_table(sg, page_cnt);
         for (i = 0; i < page_cnt; i++) {
-                page = vmalloc_to_page((void __force *)va);
-                if (!page)
-                        goto p2p_sg_err;
+                page = pfn_to_page(pa >> PAGE_SHIFT);
                 sg_set_page(&sg[i], page, page_size, 0);
-                va += page_size;
+                pa += page_size;
         }
         return sg;
-p2p_sg_err:
-        kfree(sg);
-        return NULL;
 }
 
 /* Init p2p mappings required to access peerdev from scifdev */
@@ -395,14 +390,14 @@ scif_init_p2p_info(struct scif_dev *scifdev, struct scif_dev *peerdev)
         p2p = kzalloc(sizeof(*p2p), GFP_KERNEL);
         if (!p2p)
                 return NULL;
-        p2p->ppi_sg[SCIF_PPI_MMIO] = scif_p2p_setsg(psdev->mmio->va,
+        p2p->ppi_sg[SCIF_PPI_MMIO] = scif_p2p_setsg(psdev->mmio->pa,
                                                     PAGE_SIZE, num_mmio_pages);
         if (!p2p->ppi_sg[SCIF_PPI_MMIO])
                 goto free_p2p;
         p2p->sg_nentries[SCIF_PPI_MMIO] = num_mmio_pages;
         sg_page_shift = get_order(min(psdev->aper->len, (u64)(1 << 30)));
         num_aper_chunks = num_aper_pages >> (sg_page_shift - PAGE_SHIFT);
-        p2p->ppi_sg[SCIF_PPI_APER] = scif_p2p_setsg(psdev->aper->va,
+        p2p->ppi_sg[SCIF_PPI_APER] = scif_p2p_setsg(psdev->aper->pa,
                                                     1 << sg_page_shift,
                                                     num_aper_chunks);
         p2p->sg_nentries[SCIF_PPI_APER] = num_aper_chunks;
diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
index c9c3d20b784b..a1b820fcb2a6 100644
--- a/drivers/mmc/card/block.c
+++ b/drivers/mmc/card/block.c
@@ -208,6 +208,8 @@ static ssize_t power_ro_lock_show(struct device *dev,
 
         ret = snprintf(buf, PAGE_SIZE, "%d\n", locked);
 
+        mmc_blk_put(md);
+
         return ret;
 }
 
diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig
index fd9a58e216a5..6a0f9c79be26 100644
--- a/drivers/mmc/host/Kconfig
+++ b/drivers/mmc/host/Kconfig
@@ -779,6 +779,7 @@ config MMC_TOSHIBA_PCI
 
 config MMC_MTK
         tristate "MediaTek SD/MMC Card Interface support"
+        depends on HAS_DMA
         help
           This selects the MediaTek(R) Secure digital and Multimedia card Interface.
           If you have a machine with a integrated SD/MMC card reader, say Y or M here.
diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
index b2b411da297b..4d1203236890 100644
--- a/drivers/mmc/host/omap_hsmmc.c
+++ b/drivers/mmc/host/omap_hsmmc.c
@@ -1062,9 +1062,14 @@ static void omap_hsmmc_do_irq(struct omap_hsmmc_host *host, int status)
 
                 if (status & (CTO_EN | CCRC_EN))
                         end_cmd = 1;
+                if (host->data || host->response_busy) {
+                        end_trans = !end_cmd;
+                        host->response_busy = 0;
+                }
                 if (status & (CTO_EN | DTO_EN))
                         hsmmc_command_incomplete(host, -ETIMEDOUT, end_cmd);
-                else if (status & (CCRC_EN | DCRC_EN))
+                else if (status & (CCRC_EN | DCRC_EN | DEB_EN | CEB_EN |
+                                   BADA_EN))
                         hsmmc_command_incomplete(host, -EILSEQ, end_cmd);
 
                 if (status & ACE_EN) {
@@ -1081,10 +1086,6 @@ static void omap_hsmmc_do_irq(struct omap_hsmmc_host *host, int status)
                         }
                         dev_dbg(mmc_dev(host->mmc), "AC12 err: 0x%x\n", ac12);
                 }
-                if (host->data || host->response_busy) {
-                        end_trans = !end_cmd;
-                        host->response_busy = 0;
-                }
         }
 
         OMAP_HSMMC_WRITE(host->base, STAT, status);
diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
index faf0cb910c96..c6b9f6492e1a 100644
--- a/drivers/mmc/host/sdhci-esdhc-imx.c
+++ b/drivers/mmc/host/sdhci-esdhc-imx.c
@@ -581,13 +581,8 @@ static void esdhc_writeb_le(struct sdhci_host *host, u8 val, int reg)
 static unsigned int esdhc_pltfm_get_max_clock(struct sdhci_host *host)
 {
         struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
-        struct pltfm_imx_data *imx_data = pltfm_host->priv;
-        struct esdhc_platform_data *boarddata = &imx_data->boarddata;
 
-        if (boarddata->f_max && (boarddata->f_max < pltfm_host->clock))
-                return boarddata->f_max;
-        else
-                return pltfm_host->clock;
+        return pltfm_host->clock;
 }
 
 static unsigned int esdhc_pltfm_get_min_clock(struct sdhci_host *host)
@@ -878,34 +873,19 @@ static const struct sdhci_pltfm_data sdhci_esdhc_imx_pdata = {
 static int
 sdhci_esdhc_imx_probe_dt(struct platform_device *pdev,
                          struct sdhci_host *host,
-                         struct esdhc_platform_data *boarddata)
+                         struct pltfm_imx_data *imx_data)
 {
         struct device_node *np = pdev->dev.of_node;
-
-        if (!np)
-                return -ENODEV;
-
-        if (of_get_property(np, "non-removable", NULL))
-                boarddata->cd_type = ESDHC_CD_PERMANENT;
-
-        if (of_get_property(np, "fsl,cd-controller", NULL))
-                boarddata->cd_type = ESDHC_CD_CONTROLLER;
+        struct esdhc_platform_data *boarddata = &imx_data->boarddata;
+        int ret;
 
         if (of_get_property(np, "fsl,wp-controller", NULL))
                 boarddata->wp_type = ESDHC_WP_CONTROLLER;
 
-        boarddata->cd_gpio = of_get_named_gpio(np, "cd-gpios", 0);
-        if (gpio_is_valid(boarddata->cd_gpio))
-                boarddata->cd_type = ESDHC_CD_GPIO;
-
         boarddata->wp_gpio = of_get_named_gpio(np, "wp-gpios", 0);
         if (gpio_is_valid(boarddata->wp_gpio))
                 boarddata->wp_type = ESDHC_WP_GPIO;
 
-        of_property_read_u32(np, "bus-width", &boarddata->max_bus_width);
-
-        of_property_read_u32(np, "max-frequency", &boarddata->f_max);
-
         if (of_find_property(np, "no-1-8-v", NULL))
                 boarddata->support_vsel = false;
         else
@@ -916,29 +896,119 @@ sdhci_esdhc_imx_probe_dt(struct platform_device *pdev,
 
         mmc_of_parse_voltage(np, &host->ocr_mask);
 
+        /* sdr50 and sdr104 needs work on 1.8v signal voltage */
+        if ((boarddata->support_vsel) && esdhc_is_usdhc(imx_data) &&
+            !IS_ERR(imx_data->pins_default)) {
+                imx_data->pins_100mhz = pinctrl_lookup_state(imx_data->pinctrl,
+                                                ESDHC_PINCTRL_STATE_100MHZ);
+                imx_data->pins_200mhz = pinctrl_lookup_state(imx_data->pinctrl,
+                                                ESDHC_PINCTRL_STATE_200MHZ);
+                if (IS_ERR(imx_data->pins_100mhz) ||
+                                IS_ERR(imx_data->pins_200mhz)) {
+                        dev_warn(mmc_dev(host->mmc),
+                                "could not get ultra high speed state, work on normal mode\n");
+                        /*
+                         * fall back to not support uhs by specify no 1.8v quirk
+                         */
+                        host->quirks2 |= SDHCI_QUIRK2_NO_1_8_V;
+                }
+        } else {
+                host->quirks2 |= SDHCI_QUIRK2_NO_1_8_V;
+        }
+
         /* call to generic mmc_of_parse to support additional capabilities */
-        return mmc_of_parse(host->mmc);
+        ret = mmc_of_parse(host->mmc);
+        if (ret)
+                return ret;
+
+        if (!IS_ERR_VALUE(mmc_gpio_get_cd(host->mmc)))
+                host->quirks &= ~SDHCI_QUIRK_BROKEN_CARD_DETECTION;
+
+        return 0;
 }
 #else
 static inline int
 sdhci_esdhc_imx_probe_dt(struct platform_device *pdev,
                          struct sdhci_host *host,
-                         struct esdhc_platform_data *boarddata)
+                         struct pltfm_imx_data *imx_data)
 {
         return -ENODEV;
 }
 #endif
 
+static int sdhci_esdhc_imx_probe_nondt(struct platform_device *pdev,
+                         struct sdhci_host *host,
+                         struct pltfm_imx_data *imx_data)
+{
+        struct esdhc_platform_data *boarddata = &imx_data->boarddata;
+        int err;
+
+        if (!host->mmc->parent->platform_data) {
+                dev_err(mmc_dev(host->mmc), "no board data!\n");
+                return -EINVAL;
+        }
+
+        imx_data->boarddata = *((struct esdhc_platform_data *)
+                                host->mmc->parent->platform_data);
+        /* write_protect */
+        if (boarddata->wp_type == ESDHC_WP_GPIO) {
+                err = mmc_gpio_request_ro(host->mmc, boarddata->wp_gpio);
+                if (err) {
+                        dev_err(mmc_dev(host->mmc),
+                                "failed to request write-protect gpio!\n");
+                        return err;
+                }
+                host->mmc->caps2 |= MMC_CAP2_RO_ACTIVE_HIGH;
+        }
+
+        /* card_detect */
+        switch (boarddata->cd_type) {
+        case ESDHC_CD_GPIO:
+                err = mmc_gpio_request_cd(host->mmc, boarddata->cd_gpio, 0);
+                if (err) {
+                        dev_err(mmc_dev(host->mmc),
+                                "failed to request card-detect gpio!\n");
+                        return err;
+                }
+                /* fall through */
+
+        case ESDHC_CD_CONTROLLER:
+                /* we have a working card_detect back */
+                host->quirks &= ~SDHCI_QUIRK_BROKEN_CARD_DETECTION;
+                break;
+
+        case ESDHC_CD_PERMANENT:
+                host->mmc->caps |= MMC_CAP_NONREMOVABLE;
+                break;
+
+        case ESDHC_CD_NONE:
+                break;
+        }
+
+        switch (boarddata->max_bus_width) {
+        case 8:
+                host->mmc->caps |= MMC_CAP_8_BIT_DATA | MMC_CAP_4_BIT_DATA;
+                break;
+        case 4:
+                host->mmc->caps |= MMC_CAP_4_BIT_DATA;
+                break;
+        case 1:
+        default:
+                host->quirks |= SDHCI_QUIRK_FORCE_1_BIT_DATA;
+                break;
+        }
+
+        return 0;
+}
+
 static int sdhci_esdhc_imx_probe(struct platform_device *pdev)
 {
         const struct of_device_id *of_id =
                         of_match_device(imx_esdhc_dt_ids, &pdev->dev);
         struct sdhci_pltfm_host *pltfm_host;
         struct sdhci_host *host;
-        struct esdhc_platform_data *boarddata;
         int err;
         struct pltfm_imx_data *imx_data;
-        bool dt = true;
 
         host = sdhci_pltfm_init(pdev, &sdhci_esdhc_imx_pdata, 0);
         if (IS_ERR(host))
@@ -1030,84 +1100,12 @@ static int sdhci_esdhc_imx_probe(struct platform_device *pdev)
         if (imx_data->socdata->flags & ESDHC_FLAG_ERR004536)
                 host->quirks |= SDHCI_QUIRK_BROKEN_ADMA;
 
-        boarddata = &imx_data->boarddata;
-        if (sdhci_esdhc_imx_probe_dt(pdev, host, boarddata) < 0) {
-                if (!host->mmc->parent->platform_data) {
-                        dev_err(mmc_dev(host->mmc), "no board data!\n");
-                        err = -EINVAL;
-                        goto disable_clk;
-                }
-                imx_data->boarddata = *((struct esdhc_platform_data *)
-                                        host->mmc->parent->platform_data);
-                dt = false;
-        }
-        /* write_protect */
-        if (boarddata->wp_type == ESDHC_WP_GPIO && !dt) {
-                err = mmc_gpio_request_ro(host->mmc, boarddata->wp_gpio);
-                if (err) {
-                        dev_err(mmc_dev(host->mmc),
-                                "failed to request write-protect gpio!\n");
-                        goto disable_clk;
-                }
-                host->mmc->caps2 |= MMC_CAP2_RO_ACTIVE_HIGH;
-        }
-
-        /* card_detect */
-        switch (boarddata->cd_type) {
-        case ESDHC_CD_GPIO:
-                if (dt)
-                        break;
-                err = mmc_gpio_request_cd(host->mmc, boarddata->cd_gpio, 0);
-                if (err) {
-                        dev_err(mmc_dev(host->mmc),
-                                "failed to request card-detect gpio!\n");
-                        goto disable_clk;
-                }
-                /* fall through */
-
-        case ESDHC_CD_CONTROLLER:
-                /* we have a working card_detect back */
-                host->quirks &= ~SDHCI_QUIRK_BROKEN_CARD_DETECTION;
-                break;
-
-        case ESDHC_CD_PERMANENT:
-                host->mmc->caps |= MMC_CAP_NONREMOVABLE;
-                break;
-
-        case ESDHC_CD_NONE:
-                break;
-        }
-
-        switch (boarddata->max_bus_width) {
-        case 8:
-                host->mmc->caps |= MMC_CAP_8_BIT_DATA | MMC_CAP_4_BIT_DATA;
-                break;
-        case 4:
-                host->mmc->caps |= MMC_CAP_4_BIT_DATA;
-                break;
-        case 1:
-        default:
-                host->quirks |= SDHCI_QUIRK_FORCE_1_BIT_DATA;
-                break;
-        }
-
-        /* sdr50 and sdr104 needs work on 1.8v signal voltage */
-        if ((boarddata->support_vsel) && esdhc_is_usdhc(imx_data) &&
-            !IS_ERR(imx_data->pins_default)) {
-                imx_data->pins_100mhz = pinctrl_lookup_state(imx_data->pinctrl,
-                                                ESDHC_PINCTRL_STATE_100MHZ);
-                imx_data->pins_200mhz = pinctrl_lookup_state(imx_data->pinctrl,
-                                                ESDHC_PINCTRL_STATE_200MHZ);
-                if (IS_ERR(imx_data->pins_100mhz) ||
-                                IS_ERR(imx_data->pins_200mhz)) {
-                        dev_warn(mmc_dev(host->mmc),
-                                "could not get ultra high speed state, work on normal mode\n");
-                        /* fall back to not support uhs by specify no 1.8v quirk */
-                        host->quirks2 |= SDHCI_QUIRK2_NO_1_8_V;
-                }
-        } else {
-                host->quirks2 |= SDHCI_QUIRK2_NO_1_8_V;
-        }
+        if (of_id)
+                err = sdhci_esdhc_imx_probe_dt(pdev, host, imx_data);
+        else
+                err = sdhci_esdhc_imx_probe_nondt(pdev, host, imx_data);
+        if (err)
+                goto disable_clk;
 
         err = sdhci_add_host(host);
         if (err)
diff --git a/drivers/mmc/host/sdhci-esdhc.h b/drivers/mmc/host/sdhci-esdhc.h
index 3497cfaf683c..a870c42731d7 100644
--- a/drivers/mmc/host/sdhci-esdhc.h
+++ b/drivers/mmc/host/sdhci-esdhc.h
@@ -45,6 +45,6 @@
 #define ESDHC_DMA_SYSCTL        0x40c
 #define ESDHC_DMA_SNOOP         0x00000040
 
-#define ESDHC_HOST_CONTROL_RES  0x05
+#define ESDHC_HOST_CONTROL_RES  0x01
 
 #endif /* _DRIVERS_MMC_SDHCI_ESDHC_H */
diff --git a/drivers/mmc/host/sdhci-pxav3.c b/drivers/mmc/host/sdhci-pxav3.c
index 9cd5fc62f130..946d37f94a31 100644
--- a/drivers/mmc/host/sdhci-pxav3.c
+++ b/drivers/mmc/host/sdhci-pxav3.c
@@ -411,6 +411,7 @@ static int sdhci_pxav3_probe(struct platform_device *pdev)
                         goto err_of_parse;
                 sdhci_get_of_property(pdev);
                 pdata = pxav3_get_mmc_pdata(dev);
+                pdev->dev.platform_data = pdata;
         } else if (pdata) {
                 /* on-chip device */
                 if (pdata->flags & PXA_FLAG_CARD_PERMANENT)
diff --git a/drivers/mmc/host/sdhci-spear.c b/drivers/mmc/host/sdhci-spear.c
index df088343d60f..255a896769b8 100644
--- a/drivers/mmc/host/sdhci-spear.c
+++ b/drivers/mmc/host/sdhci-spear.c
@@ -4,7 +4,7 @@
  * Support of SDHCI platform devices for spear soc family
  *
  * Copyright (C) 2010 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
  *
  * Inspired by sdhci-pltfm.c
  *
@@ -211,5 +211,5 @@ static struct platform_driver sdhci_driver = {
 module_platform_driver(sdhci_driver);
 
 MODULE_DESCRIPTION("SPEAr Secure Digital Host Controller Interface driver");
-MODULE_AUTHOR("Viresh Kumar <viresh.linux@gmail.com>");
+MODULE_AUTHOR("Viresh Kumar <vireshk@kernel.org>");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
index bc1445238fb3..1dbe93232030 100644
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -2866,6 +2866,7 @@ int sdhci_add_host(struct sdhci_host *host)
         u32 max_current_caps;
         unsigned int ocr_avail;
         unsigned int override_timeout_clk;
+        u32 max_clk;
         int ret;
 
         WARN_ON(host == NULL);
@@ -2978,8 +2979,11 @@ int sdhci_add_host(struct sdhci_host *host)
                                                       GFP_KERNEL);
                 host->align_buffer = kmalloc(host->align_buffer_sz, GFP_KERNEL);
                 if (!host->adma_table || !host->align_buffer) {
-                        dma_free_coherent(mmc_dev(mmc), host->adma_table_sz,
-                                          host->adma_table, host->adma_addr);
+                        if (host->adma_table)
+                                dma_free_coherent(mmc_dev(mmc),
+                                                  host->adma_table_sz,
+                                                  host->adma_table,
+                                                  host->adma_addr);
                         kfree(host->align_buffer);
                         pr_warn("%s: Unable to allocate ADMA buffers - falling back to standard DMA\n",
                                 mmc_hostname(mmc));
@@ -3047,18 +3051,22 @@ int sdhci_add_host(struct sdhci_host *host)
          * Set host parameters.
          */
         mmc->ops = &sdhci_ops;
-        mmc->f_max = host->max_clk;
+        max_clk = host->max_clk;
+
         if (host->ops->get_min_clock)
                 mmc->f_min = host->ops->get_min_clock(host);
         else if (host->version >= SDHCI_SPEC_300) {
                 if (host->clk_mul) {
                         mmc->f_min = (host->max_clk * host->clk_mul) / 1024;
-                        mmc->f_max = host->max_clk * host->clk_mul;
+                        max_clk = host->max_clk * host->clk_mul;
                 } else
                         mmc->f_min = host->max_clk / SDHCI_MAX_DIV_SPEC_300;
         } else
                 mmc->f_min = host->max_clk / SDHCI_MAX_DIV_SPEC_200;
 
+        if (!mmc->f_max || (mmc->f_max && (mmc->f_max > max_clk)))
+                mmc->f_max = max_clk;
+
         if (!(host->quirks & SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK)) {
                 host->timeout_clk = (caps[0] & SDHCI_TIMEOUT_CLK_MASK) >>
                                         SDHCI_TIMEOUT_CLK_SHIFT;
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 19eb990d398c..e1ccefce9a9d 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -625,6 +625,23 @@ static void bond_set_dev_addr(struct net_device *bond_dev,
         call_netdevice_notifiers(NETDEV_CHANGEADDR, bond_dev);
 }
 
+static struct slave *bond_get_old_active(struct bonding *bond,
+                                         struct slave *new_active)
+{
+        struct slave *slave;
+        struct list_head *iter;
+
+        bond_for_each_slave(bond, slave, iter) {
+                if (slave == new_active)
+                        continue;
+
+                if (ether_addr_equal(bond->dev->dev_addr, slave->dev->dev_addr))
+                        return slave;
+        }
+
+        return NULL;
+}
+
 /* bond_do_fail_over_mac
  *
  * Perform special MAC address swapping for fail_over_mac settings
@@ -652,6 +669,9 @@ static void bond_do_fail_over_mac(struct bonding *bond,
                 if (!new_active)
                         return;
 
+                if (!old_active)
+                        old_active = bond_get_old_active(bond, new_active);
+
                 if (old_active) {
                         ether_addr_copy(tmp_mac, new_active->dev->dev_addr);
                         ether_addr_copy(saddr.sa_data,
@@ -689,40 +709,57 @@ out:
 
 }
 
-static bool bond_should_change_active(struct bonding *bond)
+static struct slave *bond_choose_primary_or_current(struct bonding *bond)
 {
         struct slave *prim = rtnl_dereference(bond->primary_slave);
         struct slave *curr = rtnl_dereference(bond->curr_active_slave);
 
-        if (!prim || !curr || curr->link != BOND_LINK_UP)
-                return true;
+        if (!prim || prim->link != BOND_LINK_UP) {
+                if (!curr || curr->link != BOND_LINK_UP)
+                        return NULL;
+                return curr;
+        }
+
         if (bond->force_primary) {
                 bond->force_primary = false;
-                return true;
+                return prim;
+        }
+
+        if (!curr || curr->link != BOND_LINK_UP)
+                return prim;
+
+        /* At this point, prim and curr are both up */
+        switch (bond->params.primary_reselect) {
+        case BOND_PRI_RESELECT_ALWAYS:
+                return prim;
+        case BOND_PRI_RESELECT_BETTER:
+                if (prim->speed < curr->speed)
+                        return curr;
+                if (prim->speed == curr->speed && prim->duplex <= curr->duplex)
+                        return curr;
+                return prim;
+        case BOND_PRI_RESELECT_FAILURE:
+                return curr;
+        default:
+                netdev_err(bond->dev, "impossible primary_reselect %d\n",
+                           bond->params.primary_reselect);
+                return curr;
         }
-        if (bond->params.primary_reselect == BOND_PRI_RESELECT_BETTER &&
-            (prim->speed < curr->speed ||
-             (prim->speed == curr->speed && prim->duplex <= curr->duplex)))
-                return false;
-        if (bond->params.primary_reselect == BOND_PRI_RESELECT_FAILURE)
-                return false;
-        return true;
 }
 
 /**
- * find_best_interface - select the best available slave to be the active one
+ * bond_find_best_slave - select the best available slave to be the active one
  * @bond: our bonding struct
  */
 static struct slave *bond_find_best_slave(struct bonding *bond)
 {
-        struct slave *slave, *bestslave = NULL, *primary;
+        struct slave *slave, *bestslave = NULL;
         struct list_head *iter;
         int mintime = bond->params.updelay;
 
-        primary = rtnl_dereference(bond->primary_slave);
-        if (primary && primary->link == BOND_LINK_UP &&
-            bond_should_change_active(bond))
-                return primary;
+        slave = bond_choose_primary_or_current(bond);
+        if (slave)
+                return slave;
 
         bond_for_each_slave(bond, slave, iter) {
                 if (slave->link == BOND_LINK_UP)
@@ -1708,9 +1745,16 @@ err_free:
 
 err_undo_flags:
         /* Enslave of first slave has failed and we need to fix master's mac */
-        if (!bond_has_slaves(bond) &&
-            ether_addr_equal_64bits(bond_dev->dev_addr, slave_dev->dev_addr))
-                eth_hw_addr_random(bond_dev);
+        if (!bond_has_slaves(bond)) {
+                if (ether_addr_equal_64bits(bond_dev->dev_addr,
+                                            slave_dev->dev_addr))
+                        eth_hw_addr_random(bond_dev);
+                if (bond_dev->type != ARPHRD_ETHER) {
+                        ether_setup(bond_dev);
+                        bond_dev->flags |= IFF_MASTER;
+                        bond_dev->priv_flags &= ~IFF_TX_SKB_SHARING;
+                }
+        }
 
         return res;
 }
@@ -1899,6 +1943,7 @@ static int  bond_release_and_destroy(struct net_device *bond_dev,
                 bond_dev->priv_flags |= IFF_DISABLE_NETPOLL;
                 netdev_info(bond_dev, "Destroying bond %s\n",
                             bond_dev->name);
+                bond_remove_proc_entry(bond);
                 unregister_netdevice(bond_dev);
         }
         return ret;
diff --git a/drivers/net/can/at91_can.c b/drivers/net/can/at91_can.c
index f4e40aa4d2a2..945c0955a967 100644
--- a/drivers/net/can/at91_can.c
+++ b/drivers/net/can/at91_can.c
@@ -577,10 +577,10 @@ static void at91_rx_overflow_err(struct net_device *dev)
 
         cf->can_id |= CAN_ERR_CRTL;
         cf->data[1] = CAN_ERR_CRTL_RX_OVERFLOW;
-        netif_receive_skb(skb);
 
         stats->rx_packets++;
         stats->rx_bytes += cf->can_dlc;
+        netif_receive_skb(skb);
 }
 
 /**
@@ -642,10 +642,10 @@ static void at91_read_msg(struct net_device *dev, unsigned int mb)
         }
 
         at91_read_mb(dev, mb, cf);
-        netif_receive_skb(skb);
 
         stats->rx_packets++;
         stats->rx_bytes += cf->can_dlc;
+        netif_receive_skb(skb);
 
         can_led_event(dev, CAN_LED_EVENT_RX);
 }
@@ -802,10 +802,10 @@ static int at91_poll_err(struct net_device *dev, int quota, u32 reg_sr)
                 return 0;
 
         at91_poll_err_frame(dev, cf, reg_sr);
-        netif_receive_skb(skb);
 
         dev->stats.rx_packets++;
         dev->stats.rx_bytes += cf->can_dlc;
+        netif_receive_skb(skb);
 
         return 1;
 }
@@ -1067,10 +1067,10 @@ static void at91_irq_err(struct net_device *dev)
                 return;
 
         at91_irq_err_state(dev, cf, new_state);
-        netif_rx(skb);
 
         dev->stats.rx_packets++;
         dev->stats.rx_bytes += cf->can_dlc;
+        netif_rx(skb);
 
         priv->can.state = new_state;
 }
diff --git a/drivers/net/can/bfin_can.c b/drivers/net/can/bfin_can.c
index 27ad312e7abf..57dadd52b428 100644
--- a/drivers/net/can/bfin_can.c
+++ b/drivers/net/can/bfin_can.c
@@ -424,10 +424,9 @@ static void bfin_can_rx(struct net_device *dev, u16 isrc)
                 cf->data[6 - i] = (6 - i) < cf->can_dlc ? (val >> 8) : 0;
         }
 
-        netif_rx(skb);
-
         stats->rx_packets++;
         stats->rx_bytes += cf->can_dlc;
+        netif_rx(skb);
 }
 
 static int bfin_can_err(struct net_device *dev, u16 isrc, u16 status)
@@ -508,10 +507,9 @@ static int bfin_can_err(struct net_device *dev, u16 isrc, u16 status)
 
         priv->can.state = state;
 
-        netif_rx(skb);
-
         stats->rx_packets++;
         stats->rx_bytes += cf->can_dlc;
+        netif_rx(skb);
 
         return 0;
 }
diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
index 041525d2595c..5d214d135332 100644
--- a/drivers/net/can/c_can/c_can.c
+++ b/drivers/net/can/c_can/c_can.c
@@ -592,6 +592,7 @@ static int c_can_start(struct net_device *dev)
 {
         struct c_can_priv *priv = netdev_priv(dev);
         int err;
+        struct pinctrl *p;
 
         /* basic c_can configuration */
         err = c_can_chip_config(dev);
@@ -604,8 +605,13 @@ static int c_can_start(struct net_device *dev)
 
         priv->can.state = CAN_STATE_ERROR_ACTIVE;
 
-        /* activate pins */
-        pinctrl_pm_select_default_state(dev->dev.parent);
+        /* Attempt to use "active" if available else use "default" */
+        p = pinctrl_get_select(priv->device, "active");
+        if (!IS_ERR(p))
+                pinctrl_put(p);
+        else
+                pinctrl_pm_select_default_state(priv->device);
+
         return 0;
 }
 
diff --git a/drivers/net/can/cc770/cc770.c b/drivers/net/can/cc770/cc770.c
index c11d44984036..70a8cbb29e75 100644
--- a/drivers/net/can/cc770/cc770.c
+++ b/drivers/net/can/cc770/cc770.c
@@ -504,10 +504,10 @@ static void cc770_rx(struct net_device *dev, unsigned int mo, u8 ctrl1)
                 for (i = 0; i < cf->can_dlc; i++)
                         cf->data[i] = cc770_read_reg(priv, msgobj[mo].data[i]);
         }
-        netif_rx(skb);
 
         stats->rx_packets++;
         stats->rx_bytes += cf->can_dlc;
+        netif_rx(skb);
 }
 
 static int cc770_err(struct net_device *dev, u8 status)
@@ -584,10 +584,10 @@ static int cc770_err(struct net_device *dev, u8 status)
                 }
         }
 
-        netif_rx(skb);
 
         stats->rx_packets++;
         stats->rx_bytes += cf->can_dlc;
+        netif_rx(skb);
 
         return 0;
 }
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index e9b1810d319f..aede704605c6 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -440,9 +440,6 @@ unsigned int can_get_echo_skb(struct net_device *dev, unsigned int idx)
                 struct can_frame *cf = (struct can_frame *)skb->data;
                 u8 dlc = cf->can_dlc;
 
-                if (!(skb->tstamp.tv64))
-                        __net_timestamp(skb);
-
                 netif_rx(priv->echo_skb[idx]);
                 priv->echo_skb[idx] = NULL;
 
@@ -578,7 +575,6 @@ struct sk_buff *alloc_can_skb(struct net_device *dev, struct can_frame **cf)
         if (unlikely(!skb))
                 return NULL;
 
-        __net_timestamp(skb);
         skb->protocol = htons(ETH_P_CAN);
         skb->pkt_type = PACKET_BROADCAST;
         skb->ip_summed = CHECKSUM_UNNECESSARY;
@@ -589,6 +585,7 @@ struct sk_buff *alloc_can_skb(struct net_device *dev, struct can_frame **cf)
 
         can_skb_reserve(skb);
         can_skb_prv(skb)->ifindex = dev->ifindex;
+        can_skb_prv(skb)->skbcnt = 0;
 
         *cf = (struct can_frame *)skb_put(skb, sizeof(struct can_frame));
         memset(*cf, 0, sizeof(struct can_frame));
@@ -607,7 +604,6 @@ struct sk_buff *alloc_canfd_skb(struct net_device *dev,
         if (unlikely(!skb))
                 return NULL;
 
-        __net_timestamp(skb);
         skb->protocol = htons(ETH_P_CANFD);
         skb->pkt_type = PACKET_BROADCAST;
         skb->ip_summed = CHECKSUM_UNNECESSARY;
@@ -618,6 +614,7 @@ struct sk_buff *alloc_canfd_skb(struct net_device *dev,
 
         can_skb_reserve(skb);
         can_skb_prv(skb)->ifindex = dev->ifindex;
+        can_skb_prv(skb)->skbcnt = 0;
 
         *cfd = (struct canfd_frame *)skb_put(skb, sizeof(struct canfd_frame));
         memset(*cfd, 0, sizeof(struct canfd_frame));
diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index 6201c5a1a884..b1e8d729851c 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -577,10 +577,10 @@ static int flexcan_poll_bus_err(struct net_device *dev, u32 reg_esr)
                 return 0;
 
         do_bus_err(dev, cf, reg_esr);
-        netif_receive_skb(skb);
 
         dev->stats.rx_packets++;
         dev->stats.rx_bytes += cf->can_dlc;
+        netif_receive_skb(skb);
 
         return 1;
 }
@@ -622,10 +622,9 @@ static int flexcan_poll_state(struct net_device *dev, u32 reg_esr)
         if (unlikely(new_state == CAN_STATE_BUS_OFF))
                 can_bus_off(dev);
 
-        netif_receive_skb(skb);
-
         dev->stats.rx_packets++;
         dev->stats.rx_bytes += cf->can_dlc;
+        netif_receive_skb(skb);
 
         return 1;
 }
@@ -670,10 +669,10 @@ static int flexcan_read_frame(struct net_device *dev)
         }
 
         flexcan_read_fifo(dev, cf);
-        netif_receive_skb(skb);
 
         stats->rx_packets++;
         stats->rx_bytes += cf->can_dlc;
+        netif_receive_skb(skb);
 
         can_led_event(dev, CAN_LED_EVENT_RX);
 
diff --git a/drivers/net/can/grcan.c b/drivers/net/can/grcan.c
index e3d7e22a4fa0..db9538d4b358 100644
--- a/drivers/net/can/grcan.c
+++ b/drivers/net/can/grcan.c
@@ -1216,11 +1216,12 @@ static int grcan_receive(struct net_device *dev, int budget)
                                 cf->data[i] = (u8)(slot[j] >> shift);
                         }
                 }
-                netif_receive_skb(skb);
 
                 /* Update statistics and read pointer */
                 stats->rx_packets++;
                 stats->rx_bytes += cf->can_dlc;
+                netif_receive_skb(skb);
+
                 rd = grcan_ring_add(rd, GRCAN_MSG_SIZE, dma->rx.size);
         }
 
diff --git a/drivers/net/can/rcar_can.c b/drivers/net/can/rcar_can.c
index 7deb80dcbe8c..7bd54191f962 100644
--- a/drivers/net/can/rcar_can.c
+++ b/drivers/net/can/rcar_can.c
@@ -508,7 +508,8 @@ static int rcar_can_open(struct net_device *ndev)
 
         err = clk_prepare_enable(priv->clk);
         if (err) {
-                netdev_err(ndev, "failed to enable periperal clock, error %d\n",
+                netdev_err(ndev,
+                           "failed to enable peripheral clock, error %d\n",
                            err);
                 goto out;
         }
@@ -526,7 +527,8 @@ static int rcar_can_open(struct net_device *ndev)
         napi_enable(&priv->napi);
         err = request_irq(ndev->irq, rcar_can_interrupt, 0, ndev->name, ndev);
         if (err) {
-                netdev_err(ndev, "error requesting interrupt %x\n", ndev->irq);
+                netdev_err(ndev, "request_irq(%d) failed, error %d\n",
+                           ndev->irq, err);
                 goto out_close;
         }
         can_led_event(ndev, CAN_LED_EVENT_OPEN);
@@ -758,8 +760,9 @@ static int rcar_can_probe(struct platform_device *pdev)
         }
 
         irq = platform_get_irq(pdev, 0);
-        if (!irq) {
+        if (irq < 0) {
                 dev_err(&pdev->dev, "No IRQ resource\n");
+                err = irq;
                 goto fail;
         }
 
@@ -782,7 +785,8 @@ static int rcar_can_probe(struct platform_device *pdev)
         priv->clk = devm_clk_get(&pdev->dev, "clkp1");
         if (IS_ERR(priv->clk)) {
                 err = PTR_ERR(priv->clk);
-                dev_err(&pdev->dev, "cannot get peripheral clock: %d\n", err);
+                dev_err(&pdev->dev, "cannot get peripheral clock, error %d\n",
+                        err);
                 goto fail_clk;
         }
 
@@ -794,7 +798,7 @@ static int rcar_can_probe(struct platform_device *pdev)
         priv->can_clk = devm_clk_get(&pdev->dev, clock_names[clock_select]);
         if (IS_ERR(priv->can_clk)) {
                 err = PTR_ERR(priv->can_clk);
-                dev_err(&pdev->dev, "cannot get CAN clock: %d\n", err);
+                dev_err(&pdev->dev, "cannot get CAN clock, error %d\n", err);
                 goto fail_clk;
         }
 
@@ -823,7 +827,7 @@ static int rcar_can_probe(struct platform_device *pdev)
 
         devm_can_led_init(ndev);
 
-        dev_info(&pdev->dev, "device registered (reg_base=%p, irq=%u)\n",
+        dev_info(&pdev->dev, "device registered (regs @ %p, IRQ%d)\n",
                  priv->regs, ndev->irq);
 
         return 0;
diff --git a/drivers/net/can/sja1000/sja1000.c b/drivers/net/can/sja1000/sja1000.c
index 32bd7f451aa4..7b92e911a616 100644
--- a/drivers/net/can/sja1000/sja1000.c
+++ b/drivers/net/can/sja1000/sja1000.c
@@ -377,10 +377,9 @@ static void sja1000_rx(struct net_device *dev)
         /* release receive buffer */
         sja1000_write_cmdreg(priv, CMD_RRB);
 
-        netif_rx(skb);
-
         stats->rx_packets++;
         stats->rx_bytes += cf->can_dlc;
+        netif_rx(skb);
 
         can_led_event(dev, CAN_LED_EVENT_RX);
 }
@@ -484,10 +483,9 @@ static int sja1000_err(struct net_device *dev, uint8_t isrc, uint8_t status)
                         can_bus_off(dev);
         }
 
-        netif_rx(skb);
-
         stats->rx_packets++;
         stats->rx_bytes += cf->can_dlc;
+        netif_rx(skb);
 
         return 0;
 }
diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c
index f64f5290d6f8..9a3f15cb7ef4 100644
--- a/drivers/net/can/slcan.c
+++ b/drivers/net/can/slcan.c
@@ -207,7 +207,6 @@ static void slc_bump(struct slcan *sl)
         if (!skb)
                 return;
 
-        __net_timestamp(skb);
         skb->dev = sl->dev;
         skb->protocol = htons(ETH_P_CAN);
         skb->pkt_type = PACKET_BROADCAST;
@@ -215,13 +214,14 @@ static void slc_bump(struct slcan *sl)
 
         can_skb_reserve(skb);
         can_skb_prv(skb)->ifindex = sl->dev->ifindex;
+        can_skb_prv(skb)->skbcnt = 0;
 
         memcpy(skb_put(skb, sizeof(struct can_frame)),
                &cf, sizeof(struct can_frame));
-        netif_rx_ni(skb);
 
         sl->dev->stats.rx_packets++;
         sl->dev->stats.rx_bytes += cf.can_dlc;
+        netif_rx_ni(skb);
 }
 
 /* parse tty input stream */
diff --git a/drivers/net/can/spi/mcp251x.c b/drivers/net/can/spi/mcp251x.c
index c1a95a34d62e..b7e83c212023 100644
--- a/drivers/net/can/spi/mcp251x.c
+++ b/drivers/net/can/spi/mcp251x.c
@@ -1086,8 +1086,8 @@ static int mcp251x_can_probe(struct spi_device *spi)
         if (ret)
                 goto out_clk;
 
-        priv->power = devm_regulator_get(&spi->dev, "vdd");
-        priv->transceiver = devm_regulator_get(&spi->dev, "xceiver");
+        priv->power = devm_regulator_get_optional(&spi->dev, "vdd");
+        priv->transceiver = devm_regulator_get_optional(&spi->dev, "xceiver");
         if ((PTR_ERR(priv->power) == -EPROBE_DEFER) ||
             (PTR_ERR(priv->transceiver) == -EPROBE_DEFER)) {
                 ret = -EPROBE_DEFER;
@@ -1222,17 +1222,16 @@ static int __maybe_unused mcp251x_can_resume(struct device *dev)
         struct spi_device *spi = to_spi_device(dev);
         struct mcp251x_priv *priv = spi_get_drvdata(spi);
 
-        if (priv->after_suspend & AFTER_SUSPEND_POWER) {
+        if (priv->after_suspend & AFTER_SUSPEND_POWER)
                 mcp251x_power_enable(priv->power, 1);
+
+        if (priv->after_suspend & AFTER_SUSPEND_UP) {
+                mcp251x_power_enable(priv->transceiver, 1);
                 queue_work(priv->wq, &priv->restart_work);
         } else {
-                if (priv->after_suspend & AFTER_SUSPEND_UP) {
-                        mcp251x_power_enable(priv->transceiver, 1);
-                        queue_work(priv->wq, &priv->restart_work);
-                } else {
-                        priv->after_suspend = 0;
-                }
+                priv->after_suspend = 0;
         }
+
         priv->force_quit = 0;
         enable_irq(spi->irq);
         return 0;
diff --git a/drivers/net/can/ti_hecc.c b/drivers/net/can/ti_hecc.c
index e95a9e1a889f..cf345cbfe819 100644
--- a/drivers/net/can/ti_hecc.c
+++ b/drivers/net/can/ti_hecc.c
@@ -747,9 +747,9 @@ static int ti_hecc_error(struct net_device *ndev, int int_status,
                 }
         }
 
-        netif_rx(skb);
         stats->rx_packets++;
         stats->rx_bytes += cf->can_dlc;
+        netif_rx(skb);
 
         return 0;
 }
diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c
index 866bac0ae7e9..2d390384ef3b 100644
--- a/drivers/net/can/usb/ems_usb.c
+++ b/drivers/net/can/usb/ems_usb.c
@@ -324,10 +324,9 @@ static void ems_usb_rx_can_msg(struct ems_usb *dev, struct ems_cpc_msg *msg)
                         cf->data[i] = msg->msg.can_msg.msg[i];
         }
 
-        netif_rx(skb);
-
         stats->rx_packets++;
         stats->rx_bytes += cf->can_dlc;
+        netif_rx(skb);
 }
 
 static void ems_usb_rx_err(struct ems_usb *dev, struct ems_cpc_msg *msg)
@@ -400,10 +399,9 @@ static void ems_usb_rx_err(struct ems_usb *dev, struct ems_cpc_msg *msg)
                 stats->rx_errors++;
         }
 
-        netif_rx(skb);
-
         stats->rx_packets++;
         stats->rx_bytes += cf->can_dlc;
+        netif_rx(skb);
 }
 
 /*
diff --git a/drivers/net/can/usb/esd_usb2.c b/drivers/net/can/usb/esd_usb2.c
index 411c1af92c62..0e5a4493ba4f 100644
--- a/drivers/net/can/usb/esd_usb2.c
+++ b/drivers/net/can/usb/esd_usb2.c
@@ -301,13 +301,12 @@ static void esd_usb2_rx_event(struct esd_usb2_net_priv *priv,
                         cf->data[7] = rxerr;
                 }
 
-                netif_rx(skb);
-
                 priv->bec.txerr = txerr;
                 priv->bec.rxerr = rxerr;
 
                 stats->rx_packets++;
                 stats->rx_bytes += cf->can_dlc;
+                netif_rx(skb);
         }
 }
 
@@ -347,10 +346,9 @@ static void esd_usb2_rx_can_msg(struct esd_usb2_net_priv *priv,
                                 cf->data[i] = msg->msg.rx.data[i];
                 }
 
-                netif_rx(skb);
-
                 stats->rx_packets++;
                 stats->rx_bytes += cf->can_dlc;
+                netif_rx(skb);
         }
 
         return;
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb.c b/drivers/net/can/usb/peak_usb/pcan_usb.c
index 72427f21edff..6b94007ae052 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb.c
@@ -526,9 +526,9 @@ static int pcan_usb_decode_error(struct pcan_usb_msg_context *mc, u8 n,
                 hwts->hwtstamp = timeval_to_ktime(tv);
         }
 
-        netif_rx(skb);
         mc->netdev->stats.rx_packets++;
         mc->netdev->stats.rx_bytes += cf->can_dlc;
+        netif_rx(skb);
 
         return 0;
 }
@@ -659,12 +659,11 @@ static int pcan_usb_decode_data(struct pcan_usb_msg_context *mc, u8 status_len)
         hwts = skb_hwtstamps(skb);
         hwts->hwtstamp = timeval_to_ktime(tv);
 
-        /* push the skb */
-        netif_rx(skb);
-
         /* update statistics */
         mc->netdev->stats.rx_packets++;
         mc->netdev->stats.rx_bytes += cf->can_dlc;
+        /* push the skb */
+        netif_rx(skb);
 
         return 0;
 
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_pro.c b/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
index dec51717635e..7d61b3279798 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
@@ -553,9 +553,9 @@ static int pcan_usb_pro_handle_canmsg(struct pcan_usb_pro_interface *usb_if,
         hwts = skb_hwtstamps(skb);
         hwts->hwtstamp = timeval_to_ktime(tv);
 
-        netif_rx(skb);
         netdev->stats.rx_packets++;
         netdev->stats.rx_bytes += can_frame->can_dlc;
+        netif_rx(skb);
 
         return 0;
 }
@@ -670,9 +670,9 @@ static int pcan_usb_pro_handle_error(struct pcan_usb_pro_interface *usb_if,
         peak_usb_get_ts_tv(&usb_if->time_ref, le32_to_cpu(er->ts32), &tv);
         hwts = skb_hwtstamps(skb);
         hwts->hwtstamp = timeval_to_ktime(tv);
-        netif_rx(skb);
         netdev->stats.rx_packets++;
         netdev->stats.rx_bytes += can_frame->can_dlc;
+        netif_rx(skb);
 
         return 0;
 }
diff --git a/drivers/net/can/usb/usb_8dev.c b/drivers/net/can/usb/usb_8dev.c
index dd52c7a4c80d..de95b1ccba3e 100644
--- a/drivers/net/can/usb/usb_8dev.c
+++ b/drivers/net/can/usb/usb_8dev.c
@@ -461,10 +461,9 @@ static void usb_8dev_rx_err_msg(struct usb_8dev_priv *priv,
         priv->bec.txerr = txerr;
         priv->bec.rxerr = rxerr;
 
-        netif_rx(skb);
-
         stats->rx_packets++;
         stats->rx_bytes += cf->can_dlc;
+        netif_rx(skb);
 }
 
 /* Read data and status frames */
@@ -494,10 +493,9 @@ static void usb_8dev_rx_can_msg(struct usb_8dev_priv *priv,
                 else
                         memcpy(cf->data, msg->data, cf->can_dlc);
 
-                netif_rx(skb);
-
                 stats->rx_packets++;
                 stats->rx_bytes += cf->can_dlc;
+                netif_rx(skb);
 
                 can_led_event(priv->netdev, CAN_LED_EVENT_RX);
         } else {
diff --git a/drivers/net/can/vcan.c b/drivers/net/can/vcan.c
index 0ce868de855d..674f367087c5 100644
--- a/drivers/net/can/vcan.c
+++ b/drivers/net/can/vcan.c
@@ -78,9 +78,6 @@ static void vcan_rx(struct sk_buff *skb, struct net_device *dev)
         skb->dev       = dev;
         skb->ip_summed = CHECKSUM_UNNECESSARY;
 
-        if (!(skb->tstamp.tv64))
-                __net_timestamp(skb);
-
         netif_rx_ni(skb);
 }
 
diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
index 972982f8bea7..079897b3a955 100644
--- a/drivers/net/dsa/bcm_sf2.c
+++ b/drivers/net/dsa/bcm_sf2.c
@@ -696,9 +696,20 @@ static int bcm_sf2_sw_setup(struct dsa_switch *ds)
         }
 
         /* Include the pseudo-PHY address and the broadcast PHY address to
-         * divert reads towards our workaround
+         * divert reads towards our workaround. This is only required for
+         * 7445D0, since 7445E0 disconnects the internal switch pseudo-PHY such
+         * that we can use the regular SWITCH_MDIO master controller instead.
+         *
+         * By default, DSA initializes ds->phys_mii_mask to ds->phys_port_mask
+         * to have a 1:1 mapping between Port address and PHY address in order
+         * to utilize the slave_mii_bus instance to read from Port PHYs. This is
+         * not what we want here, so we initialize phys_mii_mask 0 to always
+         * utilize the "master" MDIO bus backed by the "mdio-unimac" driver.
          */
-        ds->phys_mii_mask |= ((1 << BRCM_PSEUDO_PHY_ADDR) | (1 << 0));
+        if (of_machine_is_compatible("brcm,bcm7445d0"))
+                ds->phys_mii_mask |= ((1 << BRCM_PSEUDO_PHY_ADDR) | (1 << 0));
+        else
+                ds->phys_mii_mask = 0;
 
         rev = reg_readl(priv, REG_SWITCH_REVISION);
         priv->hw_params.top_rev = (rev >> SWITCH_TOP_REV_SHIFT) &
diff --git a/drivers/net/dsa/mv88e6xxx.c b/drivers/net/dsa/mv88e6xxx.c
index fd8547c2b79d..561342466076 100644
--- a/drivers/net/dsa/mv88e6xxx.c
+++ b/drivers/net/dsa/mv88e6xxx.c
@@ -1163,7 +1163,7 @@ int mv88e6xxx_leave_bridge(struct dsa_switch *ds, int port, u32 br_port_mask)
 
         newfid = __ffs(ps->fid_mask);
         ps->fid[port] = newfid;
-        ps->fid_mask &= (1 << newfid);
+        ps->fid_mask &= ~(1 << newfid);
         ps->bridge_mask[fid] &= ~(1 << port);
         ps->bridge_mask[newfid] = 1 << port;
 
diff --git a/drivers/net/ethernet/3com/3c59x.c b/drivers/net/ethernet/3com/3c59x.c
index 41095ebad97f..2d1ce3c5d0dd 100644
--- a/drivers/net/ethernet/3com/3c59x.c
+++ b/drivers/net/ethernet/3com/3c59x.c
@@ -2382,6 +2382,7 @@ boomerang_interrupt(int irq, void *dev_id)
         void __iomem *ioaddr;
         int status;
         int work_done = max_interrupt_work;
+        int handled = 0;
 
         ioaddr = vp->ioaddr;
 
@@ -2400,6 +2401,7 @@ boomerang_interrupt(int irq, void *dev_id)
 
         if ((status & IntLatch) == 0)
                 goto handler_exit;              /* No interrupt: shared IRQs can cause this */
+        handled = 1;
 
         if (status == 0xffff) {         /* h/w no longer present (hotplug)? */
                 if (vortex_debug > 1)
@@ -2501,7 +2503,7 @@ boomerang_interrupt(int irq, void *dev_id)
 handler_exit:
         vp->handling_irq = 0;
         spin_unlock(&vp->lock);
-        return IRQ_HANDLED;
+        return IRQ_RETVAL(handled);
 }
 
 static int vortex_rx(struct net_device *dev)
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-desc.c b/drivers/net/ethernet/amd/xgbe/xgbe-desc.c
index 661cdaa7ea96..b3bc87fe3764 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-desc.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-desc.c
@@ -303,7 +303,8 @@ static void xgbe_set_buffer_data(struct xgbe_buffer_data *bd,
         get_page(pa->pages);
         bd->pa = *pa;
 
-        bd->dma = pa->pages_dma + pa->pages_offset;
+        bd->dma_base = pa->pages_dma;
+        bd->dma_off = pa->pages_offset;
         bd->dma_len = len;
 
         pa->pages_offset += len;
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
index 506e832c9e9a..a4473d8ff4fa 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
@@ -1110,6 +1110,7 @@ static void xgbe_rx_desc_reset(struct xgbe_prv_data *pdata,
         unsigned int rx_usecs = pdata->rx_usecs;
         unsigned int rx_frames = pdata->rx_frames;
         unsigned int inte;
+        dma_addr_t hdr_dma, buf_dma;
 
         if (!rx_usecs && !rx_frames) {
                 /* No coalescing, interrupt for every descriptor */
@@ -1129,10 +1130,12 @@ static void xgbe_rx_desc_reset(struct xgbe_prv_data *pdata,
          *   Set buffer 2 (hi) address to buffer dma address (hi) and
          *     set control bits OWN and INTE
          */
-        rdesc->desc0 = cpu_to_le32(lower_32_bits(rdata->rx.hdr.dma));
-        rdesc->desc1 = cpu_to_le32(upper_32_bits(rdata->rx.hdr.dma));
-        rdesc->desc2 = cpu_to_le32(lower_32_bits(rdata->rx.buf.dma));
-        rdesc->desc3 = cpu_to_le32(upper_32_bits(rdata->rx.buf.dma));
+        hdr_dma = rdata->rx.hdr.dma_base + rdata->rx.hdr.dma_off;
+        buf_dma = rdata->rx.buf.dma_base + rdata->rx.buf.dma_off;
+        rdesc->desc0 = cpu_to_le32(lower_32_bits(hdr_dma));
+        rdesc->desc1 = cpu_to_le32(upper_32_bits(hdr_dma));
+        rdesc->desc2 = cpu_to_le32(lower_32_bits(buf_dma));
+        rdesc->desc3 = cpu_to_le32(upper_32_bits(buf_dma));
 
         XGMAC_SET_BITS_LE(rdesc->desc3, RX_NORMAL_DESC3, INTE, inte);
 
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
index 1e9c28d19ef8..aae9d5ecd182 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
@@ -1765,8 +1765,9 @@ static struct sk_buff *xgbe_create_skb(struct xgbe_prv_data *pdata,
         /* Start with the header buffer which may contain just the header
          * or the header plus data
          */
-        dma_sync_single_for_cpu(pdata->dev, rdata->rx.hdr.dma,
-                                rdata->rx.hdr.dma_len, DMA_FROM_DEVICE);
+        dma_sync_single_range_for_cpu(pdata->dev, rdata->rx.hdr.dma_base,
+                                      rdata->rx.hdr.dma_off,
+                                      rdata->rx.hdr.dma_len, DMA_FROM_DEVICE);
 
         packet = page_address(rdata->rx.hdr.pa.pages) +
                  rdata->rx.hdr.pa.pages_offset;
@@ -1778,8 +1779,11 @@ static struct sk_buff *xgbe_create_skb(struct xgbe_prv_data *pdata,
         len -= copy_len;
         if (len) {
                 /* Add the remaining data as a frag */
-                dma_sync_single_for_cpu(pdata->dev, rdata->rx.buf.dma,
-                                        rdata->rx.buf.dma_len, DMA_FROM_DEVICE);
+                dma_sync_single_range_for_cpu(pdata->dev,
+                                              rdata->rx.buf.dma_base,
+                                              rdata->rx.buf.dma_off,
+                                              rdata->rx.buf.dma_len,
+                                              DMA_FROM_DEVICE);
 
                 skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
                                 rdata->rx.buf.pa.pages,
@@ -1945,8 +1949,9 @@ read_again:
                                 if (!skb)
                                         error = 1;
                         } else if (rdesc_len) {
-                                dma_sync_single_for_cpu(pdata->dev,
-                                                        rdata->rx.buf.dma,
+                                dma_sync_single_range_for_cpu(pdata->dev,
+                                                        rdata->rx.buf.dma_base,
+                                                        rdata->rx.buf.dma_off,
                                                         rdata->rx.buf.dma_len,
                                                         DMA_FROM_DEVICE);
 
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe.h b/drivers/net/ethernet/amd/xgbe/xgbe.h
index 63d72a140053..717ce21b6077 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe.h
+++ b/drivers/net/ethernet/amd/xgbe/xgbe.h
@@ -337,7 +337,8 @@ struct xgbe_buffer_data {
         struct xgbe_page_alloc pa;
         struct xgbe_page_alloc pa_unmap;
 
-        dma_addr_t dma;
+        dma_addr_t dma_base;
+        unsigned long dma_off;
         unsigned int dma_len;
 };
 
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index 909ad7a0d480..4566cdf0bc39 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -1793,7 +1793,7 @@ static int bcm_sysport_probe(struct platform_device *pdev)
         macaddr = of_get_mac_address(dn);
         if (!macaddr || !is_valid_ether_addr(macaddr)) {
                 dev_warn(&pdev->dev, "using random Ethernet MAC\n");
-                random_ether_addr(dev->dev_addr);
+                eth_hw_addr_random(dev);
         } else {
                 ether_addr_copy(dev->dev_addr, macaddr);
         }
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
index b43b2cb9b830..64c1e9db6b0b 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -1230,7 +1230,6 @@ static struct sk_buff *bcmgenet_put_tx_csum(struct net_device *dev,
                 new_skb = skb_realloc_headroom(skb, sizeof(*status));
                 dev_kfree_skb(skb);
                 if (!new_skb) {
-                        dev->stats.tx_errors++;
                         dev->stats.tx_dropped++;
                         return NULL;
                 }
@@ -1465,7 +1464,6 @@ static unsigned int bcmgenet_desc_rx(struct bcmgenet_rx_ring *ring,
 
                 if (unlikely(!skb)) {
                         dev->stats.rx_dropped++;
-                        dev->stats.rx_errors++;
                         goto next;
                 }
 
@@ -1493,7 +1491,6 @@ static unsigned int bcmgenet_desc_rx(struct bcmgenet_rx_ring *ring,
                 if (unlikely(!(dma_flag & DMA_EOP) || !(dma_flag & DMA_SOP))) {
                         netif_err(priv, rx_status, dev,
                                   "dropping fragmented packet!\n");
-                        dev->stats.rx_dropped++;
                         dev->stats.rx_errors++;
                         dev_kfree_skb_any(skb);
                         goto next;
@@ -1515,7 +1512,6 @@ static unsigned int bcmgenet_desc_rx(struct bcmgenet_rx_ring *ring,
                                 dev->stats.rx_frame_errors++;
                         if (dma_flag & DMA_RX_LG)
                                 dev->stats.rx_length_errors++;
-                        dev->stats.rx_dropped++;
                         dev->stats.rx_errors++;
                         dev_kfree_skb_any(skb);
                         goto next;
diff --git a/drivers/net/ethernet/broadcom/sb1250-mac.c b/drivers/net/ethernet/broadcom/sb1250-mac.c
index ac27e24264a5..f557a2aaec23 100644
--- a/drivers/net/ethernet/broadcom/sb1250-mac.c
+++ b/drivers/net/ethernet/broadcom/sb1250-mac.c
@@ -1508,16 +1508,7 @@ static void sbmac_channel_start(struct sbmac_softc *s)
         __raw_writeq(reg, port);
         port = s->sbm_base + R_MAC_ETHERNET_ADDR;
 
-#ifdef CONFIG_SB1_PASS_1_WORKAROUNDS
-        /*
-         * Pass1 SOCs do not receive packets addressed to the
-         * destination address in the R_MAC_ETHERNET_ADDR register.
-         * Set the value to zero.
-         */
-        __raw_writeq(0, port);
-#else
         __raw_writeq(reg, port);
-#endif
 
         /*
          * Set the receive filter for no packets, and write values
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
index 484eb8c37489..a11485fbb33f 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
@@ -952,16 +952,23 @@ static int devlog_show(struct seq_file *seq, void *v)
                  * eventually have to put a format interpreter in here ...
                  */
                 seq_printf(seq, "%10d  %15llu  %8s  %8s  ",
-                           e->seqno, e->timestamp,
+                           be32_to_cpu(e->seqno),
+                           be64_to_cpu(e->timestamp),
                            (e->level < ARRAY_SIZE(devlog_level_strings)
                             ? devlog_level_strings[e->level]
                             : "UNKNOWN"),
                            (e->facility < ARRAY_SIZE(devlog_facility_strings)
                             ? devlog_facility_strings[e->facility]
                             : "UNKNOWN"));
-                seq_printf(seq, e->fmt, e->params[0], e->params[1],
-                           e->params[2], e->params[3], e->params[4],
-                           e->params[5], e->params[6], e->params[7]);
+                seq_printf(seq, e->fmt,
+                           be32_to_cpu(e->params[0]),
+                           be32_to_cpu(e->params[1]),
+                           be32_to_cpu(e->params[2]),
+                           be32_to_cpu(e->params[3]),
+                           be32_to_cpu(e->params[4]),
+                           be32_to_cpu(e->params[5]),
+                           be32_to_cpu(e->params[6]),
+                           be32_to_cpu(e->params[7]));
         }
         return 0;
 }
@@ -1043,23 +1050,17 @@ static int devlog_open(struct inode *inode, struct file *file)
                 return ret;
         }
 
-        /* Translate log multi-byte integral elements into host native format
-         * and determine where the first entry in the log is.
+        /* Find the earliest (lowest Sequence Number) log entry in the
+         * circular Device Log.
          */
         for (fseqno = ~((u32)0), index = 0; index < dinfo->nentries; index++) {
                 struct fw_devlog_e *e = &dinfo->log[index];
-                int i;
                 __u32 seqno;
 
                 if (e->timestamp == 0)
                         continue;
 
-                e->timestamp = (__force __be64)be64_to_cpu(e->timestamp);
                 seqno = be32_to_cpu(e->seqno);
-                for (i = 0; i < 8; i++)
-                        e->params[i] =
-                                (__force __be32)be32_to_cpu(e->params[i]);
-
                 if (seqno < fseqno) {
                         fseqno = seqno;
                         dinfo->first = index;
diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
index da2004e2a741..918a8e42139b 100644
--- a/drivers/net/ethernet/cisco/enic/enic_main.c
+++ b/drivers/net/ethernet/cisco/enic/enic_main.c
@@ -1170,7 +1170,7 @@ static int enic_poll(struct napi_struct *napi, int budget)
                                                  wq_work_done,
                                                  0 /* dont unmask intr */,
                                                  0 /* dont reset intr timer */);
-                return rq_work_done;
+                return budget;
         }
 
         if (budget > 0)
@@ -1191,6 +1191,7 @@ static int enic_poll(struct napi_struct *napi, int budget)
                         0 /* don't reset intr timer */);
 
         err = vnic_rq_fill(&enic->rq[0], enic_rq_alloc_buf);
+        enic_poll_unlock_napi(&enic->rq[cq_rq], napi);
 
         /* Buffer allocation failed. Stay in polling
          * mode so we can try to fill the ring again.
@@ -1208,7 +1209,6 @@ static int enic_poll(struct napi_struct *napi, int budget)
                 napi_complete(napi);
                 vnic_intr_unmask(&enic->intr[intr]);
         }
-        enic_poll_unlock_napi(&enic->rq[cq_rq], napi);
 
         return rq_work_done;
 }
diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
index 370e20ed224c..62e48bc0cb23 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -1462,7 +1462,7 @@ static int mvneta_rx(struct mvneta_port *pp, int rx_todo,
                      struct mvneta_rx_queue *rxq)
 {
         struct net_device *dev = pp->dev;
-        int rx_done, rx_filled;
+        int rx_done;
         u32 rcvd_pkts = 0;
         u32 rcvd_bytes = 0;
 
@@ -1473,7 +1473,6 @@ static int mvneta_rx(struct mvneta_port *pp, int rx_todo,
                 rx_todo = rx_done;
 
         rx_done = 0;
-        rx_filled = 0;
 
         /* Fairness NAPI loop */
         while (rx_done < rx_todo) {
@@ -1484,7 +1483,6 @@ static int mvneta_rx(struct mvneta_port *pp, int rx_todo,
                 int rx_bytes, err;
 
                 rx_done++;
-                rx_filled++;
                 rx_status = rx_desc->status;
                 rx_bytes = rx_desc->data_size - (ETH_FCS_LEN + MVNETA_MH_SIZE);
                 data = (unsigned char *)rx_desc->buf_cookie;
@@ -1524,6 +1522,14 @@ static int mvneta_rx(struct mvneta_port *pp, int rx_todo,
                         continue;
                 }
 
+                /* Refill processing */
+                err = mvneta_rx_refill(pp, rx_desc);
+                if (err) {
+                        netdev_err(dev, "Linux processing - Can't refill\n");
+                        rxq->missed++;
+                        goto err_drop_frame;
+                }
+
                 skb = build_skb(data, pp->frag_size > PAGE_SIZE ? 0 : pp->frag_size);
                 if (!skb)
                         goto err_drop_frame;
@@ -1543,14 +1549,6 @@ static int mvneta_rx(struct mvneta_port *pp, int rx_todo,
                 mvneta_rx_csum(pp, rx_status, skb);
 
                 napi_gro_receive(&pp->napi, skb);
-
-                /* Refill processing */
-                err = mvneta_rx_refill(pp, rx_desc);
-                if (err) {
-                        netdev_err(dev, "Linux processing - Can't refill\n");
-                        rxq->missed++;
-                        rx_filled--;
-                }
         }
 
         if (rcvd_pkts) {
@@ -1563,7 +1561,7 @@ static int mvneta_rx(struct mvneta_port *pp, int rx_todo,
         }
 
         /* Update rxq management counters */
-        mvneta_rxq_desc_num_update(pp, rxq, rx_done, rx_filled);
+        mvneta_rxq_desc_num_update(pp, rxq, rx_done, rx_done);
 
         return rx_done;
 }
diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index fd9745714d90..78849dd4ef8e 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -228,9 +228,7 @@ static void ravb_ring_format(struct net_device *ndev, int q)
         struct ravb_desc *desc = NULL;
         int rx_ring_size = sizeof(*rx_desc) * priv->num_rx_ring[q];
         int tx_ring_size = sizeof(*tx_desc) * priv->num_tx_ring[q];
-        struct sk_buff *skb;
         dma_addr_t dma_addr;
-        void *buffer;
         int i;
 
         priv->cur_rx[q] = 0;
@@ -241,41 +239,28 @@ static void ravb_ring_format(struct net_device *ndev, int q)
         memset(priv->rx_ring[q], 0, rx_ring_size);
         /* Build RX ring buffer */
         for (i = 0; i < priv->num_rx_ring[q]; i++) {
-                priv->rx_skb[q][i] = NULL;
-                skb = netdev_alloc_skb(ndev, PKT_BUF_SZ + RAVB_ALIGN - 1);
-                if (!skb)
-                        break;
-                ravb_set_buffer_align(skb);
                 /* RX descriptor */
                 rx_desc = &priv->rx_ring[q][i];
                 /* The size of the buffer should be on 16-byte boundary. */
                 rx_desc->ds_cc = cpu_to_le16(ALIGN(PKT_BUF_SZ, 16));
-                dma_addr = dma_map_single(&ndev->dev, skb->data,
+                dma_addr = dma_map_single(&ndev->dev, priv->rx_skb[q][i]->data,
                                           ALIGN(PKT_BUF_SZ, 16),
                                           DMA_FROM_DEVICE);
-                if (dma_mapping_error(&ndev->dev, dma_addr)) {
-                        dev_kfree_skb(skb);
-                        break;
-                }
-                priv->rx_skb[q][i] = skb;
+                /* We just set the data size to 0 for a failed mapping which
+                 * should prevent DMA from happening...
+                 */
+                if (dma_mapping_error(&ndev->dev, dma_addr))
+                        rx_desc->ds_cc = cpu_to_le16(0);
                 rx_desc->dptr = cpu_to_le32(dma_addr);
                 rx_desc->die_dt = DT_FEMPTY;
         }
         rx_desc = &priv->rx_ring[q][i];
         rx_desc->dptr = cpu_to_le32((u32)priv->rx_desc_dma[q]);
         rx_desc->die_dt = DT_LINKFIX; /* type */
-        priv->dirty_rx[q] = (u32)(i - priv->num_rx_ring[q]);
 
         memset(priv->tx_ring[q], 0, tx_ring_size);
         /* Build TX ring buffer */
         for (i = 0; i < priv->num_tx_ring[q]; i++) {
-                priv->tx_skb[q][i] = NULL;
-                priv->tx_buffers[q][i] = NULL;
-                buffer = kmalloc(PKT_BUF_SZ + RAVB_ALIGN - 1, GFP_KERNEL);
-                if (!buffer)
-                        break;
-                /* Aligned TX buffer */
-                priv->tx_buffers[q][i] = buffer;
                 tx_desc = &priv->tx_ring[q][i];
                 tx_desc->die_dt = DT_EEMPTY;
         }
@@ -298,7 +283,10 @@ static void ravb_ring_format(struct net_device *ndev, int q)
 static int ravb_ring_init(struct net_device *ndev, int q)
 {
         struct ravb_private *priv = netdev_priv(ndev);
+        struct sk_buff *skb;
         int ring_size;
+        void *buffer;
+        int i;
 
         /* Allocate RX and TX skb rings */
         priv->rx_skb[q] = kcalloc(priv->num_rx_ring[q],
@@ -308,12 +296,28 @@ static int ravb_ring_init(struct net_device *ndev, int q)
         if (!priv->rx_skb[q] || !priv->tx_skb[q])
                 goto error;
 
+        for (i = 0; i < priv->num_rx_ring[q]; i++) {
+                skb = netdev_alloc_skb(ndev, PKT_BUF_SZ + RAVB_ALIGN - 1);
+                if (!skb)
+                        goto error;
+                ravb_set_buffer_align(skb);
+                priv->rx_skb[q][i] = skb;
+        }
+
         /* Allocate rings for the aligned buffers */
         priv->tx_buffers[q] = kcalloc(priv->num_tx_ring[q],
                                       sizeof(*priv->tx_buffers[q]), GFP_KERNEL);
         if (!priv->tx_buffers[q])
                 goto error;
 
+        for (i = 0; i < priv->num_tx_ring[q]; i++) {
+                buffer = kmalloc(PKT_BUF_SZ + RAVB_ALIGN - 1, GFP_KERNEL);
+                if (!buffer)
+                        goto error;
+                /* Aligned TX buffer */
+                priv->tx_buffers[q][i] = buffer;
+        }
+
         /* Allocate all RX descriptors. */
         ring_size = sizeof(struct ravb_ex_rx_desc) * (priv->num_rx_ring[q] + 1);
         priv->rx_ring[q] = dma_alloc_coherent(NULL, ring_size,
@@ -524,6 +528,10 @@ static bool ravb_rx(struct net_device *ndev, int *quota, int q)
                 if (--boguscnt < 0)
                         break;
 
+                /* We use 0-byte descriptors to mark the DMA mapping errors */
+                if (!pkt_len)
+                        continue;
+
                 if (desc_status & MSC_MC)
                         stats->multicast++;
 
@@ -543,10 +551,9 @@ static bool ravb_rx(struct net_device *ndev, int *quota, int q)
 
                         skb = priv->rx_skb[q][entry];
                         priv->rx_skb[q][entry] = NULL;
-                        dma_sync_single_for_cpu(&ndev->dev,
-                                                le32_to_cpu(desc->dptr),
-                                                ALIGN(PKT_BUF_SZ, 16),
-                                                DMA_FROM_DEVICE);
+                        dma_unmap_single(&ndev->dev, le32_to_cpu(desc->dptr),
+                                         ALIGN(PKT_BUF_SZ, 16),
+                                         DMA_FROM_DEVICE);
                         get_ts &= (q == RAVB_NC) ?
                                         RAVB_RXTSTAMP_TYPE_V2_L2_EVENT :
                                         ~RAVB_RXTSTAMP_TYPE_V2_L2_EVENT;
@@ -584,17 +591,15 @@ static bool ravb_rx(struct net_device *ndev, int *quota, int q)
                         if (!skb)
                                 break;  /* Better luck next round. */
                         ravb_set_buffer_align(skb);
-                        dma_unmap_single(&ndev->dev, le32_to_cpu(desc->dptr),
-                                         ALIGN(PKT_BUF_SZ, 16),
-                                         DMA_FROM_DEVICE);
                         dma_addr = dma_map_single(&ndev->dev, skb->data,
                                                   le16_to_cpu(desc->ds_cc),
                                                   DMA_FROM_DEVICE);
                         skb_checksum_none_assert(skb);
-                        if (dma_mapping_error(&ndev->dev, dma_addr)) {
-                                dev_kfree_skb_any(skb);
-                                break;
-                        }
+                        /* We just set the data size to 0 for a failed mapping
+                         * which should prevent DMA  from happening...
+                         */
+                        if (dma_mapping_error(&ndev->dev, dma_addr))
+                                desc->ds_cc = cpu_to_le16(0);
                         desc->dptr = cpu_to_le32(dma_addr);
                         priv->rx_skb[q][entry] = skb;
                 }
@@ -1279,7 +1284,6 @@ static netdev_tx_t ravb_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         u32 dma_addr;
         void *buffer;
         u32 entry;
-        u32 tccr;
 
         spin_lock_irqsave(&priv->lock, flags);
         if (priv->cur_tx[q] - priv->dirty_tx[q] >= priv->num_tx_ring[q]) {
@@ -1328,9 +1332,7 @@ static netdev_tx_t ravb_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         dma_wmb();
         desc->die_dt = DT_FSINGLE;
 
-        tccr = ravb_read(ndev, TCCR);
-        if (!(tccr & (TCCR_TSRQ0 << q)))
-                ravb_write(ndev, tccr | (TCCR_TSRQ0 << q), TCCR);
+        ravb_write(ndev, ravb_read(ndev, TCCR) | (TCCR_TSRQ0 << q), TCCR);
 
         priv->cur_tx[q]++;
         if (priv->cur_tx[q] - priv->dirty_tx[q] >= priv->num_tx_ring[q] &&
diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index 847643455468..605cc8948594 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -101,6 +101,11 @@ static unsigned int efx_ef10_mem_map_size(struct efx_nic *efx)
         return resource_size(&efx->pci_dev->resource[bar]);
 }
 
+static bool efx_ef10_is_vf(struct efx_nic *efx)
+{
+        return efx->type->is_vf;
+}
+
 static int efx_ef10_get_pf_index(struct efx_nic *efx)
 {
         MCDI_DECLARE_BUF(outbuf, MC_CMD_GET_FUNCTION_INFO_OUT_LEN);
@@ -677,6 +682,48 @@ static int efx_ef10_probe_pf(struct efx_nic *efx)
         return efx_ef10_probe(efx);
 }
 
+int efx_ef10_vadaptor_alloc(struct efx_nic *efx, unsigned int port_id)
+{
+        MCDI_DECLARE_BUF(inbuf, MC_CMD_VADAPTOR_ALLOC_IN_LEN);
+
+        MCDI_SET_DWORD(inbuf, VADAPTOR_ALLOC_IN_UPSTREAM_PORT_ID, port_id);
+        return efx_mcdi_rpc(efx, MC_CMD_VADAPTOR_ALLOC, inbuf, sizeof(inbuf),
+                            NULL, 0, NULL);
+}
+
+int efx_ef10_vadaptor_free(struct efx_nic *efx, unsigned int port_id)
+{
+        MCDI_DECLARE_BUF(inbuf, MC_CMD_VADAPTOR_FREE_IN_LEN);
+
+        MCDI_SET_DWORD(inbuf, VADAPTOR_FREE_IN_UPSTREAM_PORT_ID, port_id);
+        return efx_mcdi_rpc(efx, MC_CMD_VADAPTOR_FREE, inbuf, sizeof(inbuf),
+                            NULL, 0, NULL);
+}
+
+int efx_ef10_vport_add_mac(struct efx_nic *efx,
+                           unsigned int port_id, u8 *mac)
+{
+        MCDI_DECLARE_BUF(inbuf, MC_CMD_VPORT_ADD_MAC_ADDRESS_IN_LEN);
+
+        MCDI_SET_DWORD(inbuf, VPORT_ADD_MAC_ADDRESS_IN_VPORT_ID, port_id);
+        ether_addr_copy(MCDI_PTR(inbuf, VPORT_ADD_MAC_ADDRESS_IN_MACADDR), mac);
+
+        return efx_mcdi_rpc(efx, MC_CMD_VPORT_ADD_MAC_ADDRESS, inbuf,
+                            sizeof(inbuf), NULL, 0, NULL);
+}
+
+int efx_ef10_vport_del_mac(struct efx_nic *efx,
+                           unsigned int port_id, u8 *mac)
+{
+        MCDI_DECLARE_BUF(inbuf, MC_CMD_VPORT_DEL_MAC_ADDRESS_IN_LEN);
+
+        MCDI_SET_DWORD(inbuf, VPORT_DEL_MAC_ADDRESS_IN_VPORT_ID, port_id);
+        ether_addr_copy(MCDI_PTR(inbuf, VPORT_DEL_MAC_ADDRESS_IN_MACADDR), mac);
+
+        return efx_mcdi_rpc(efx, MC_CMD_VPORT_DEL_MAC_ADDRESS, inbuf,
+                            sizeof(inbuf), NULL, 0, NULL);
+}
+
 #ifdef CONFIG_SFC_SRIOV
 static int efx_ef10_probe_vf(struct efx_nic *efx)
 {
@@ -3804,6 +3851,72 @@ static void efx_ef10_filter_sync_rx_mode(struct efx_nic *efx)
         WARN_ON(remove_failed);
 }
 
+static int efx_ef10_vport_set_mac_address(struct efx_nic *efx)
+{
+        struct efx_ef10_nic_data *nic_data = efx->nic_data;
+        u8 mac_old[ETH_ALEN];
+        int rc, rc2;
+
+        /* Only reconfigure a PF-created vport */
+        if (is_zero_ether_addr(nic_data->vport_mac))
+                return 0;
+
+        efx_device_detach_sync(efx);
+        efx_net_stop(efx->net_dev);
+        down_write(&efx->filter_sem);
+        efx_ef10_filter_table_remove(efx);
+        up_write(&efx->filter_sem);
+
+        rc = efx_ef10_vadaptor_free(efx, nic_data->vport_id);
+        if (rc)
+                goto restore_filters;
+
+        ether_addr_copy(mac_old, nic_data->vport_mac);
+        rc = efx_ef10_vport_del_mac(efx, nic_data->vport_id,
+                                    nic_data->vport_mac);
+        if (rc)
+                goto restore_vadaptor;
+
+        rc = efx_ef10_vport_add_mac(efx, nic_data->vport_id,
+                                    efx->net_dev->dev_addr);
+        if (!rc) {
+                ether_addr_copy(nic_data->vport_mac, efx->net_dev->dev_addr);
+        } else {
+                rc2 = efx_ef10_vport_add_mac(efx, nic_data->vport_id, mac_old);
+                if (rc2) {
+                        /* Failed to add original MAC, so clear vport_mac */
+                        eth_zero_addr(nic_data->vport_mac);
+                        goto reset_nic;
+                }
+        }
+
+restore_vadaptor:
+        rc2 = efx_ef10_vadaptor_alloc(efx, nic_data->vport_id);
+        if (rc2)
+                goto reset_nic;
+restore_filters:
+        down_write(&efx->filter_sem);
+        rc2 = efx_ef10_filter_table_probe(efx);
+        up_write(&efx->filter_sem);
+        if (rc2)
+                goto reset_nic;
+
+        rc2 = efx_net_open(efx->net_dev);
+        if (rc2)
+                goto reset_nic;
+
+        netif_device_attach(efx->net_dev);
+
+        return rc;
+
+reset_nic:
+        netif_err(efx, drv, efx->net_dev,
+                  "Failed to restore when changing MAC address - scheduling reset\n");
+        efx_schedule_reset(efx, RESET_TYPE_DATAPATH);
+
+        return rc ? rc : rc2;
+}
+
 static int efx_ef10_set_mac_address(struct efx_nic *efx)
 {
         MCDI_DECLARE_BUF(inbuf, MC_CMD_VADAPTOR_SET_MAC_IN_LEN);
@@ -3820,8 +3933,8 @@ static int efx_ef10_set_mac_address(struct efx_nic *efx)
                         efx->net_dev->dev_addr);
         MCDI_SET_DWORD(inbuf, VADAPTOR_SET_MAC_IN_UPSTREAM_PORT_ID,
                        nic_data->vport_id);
-        rc = efx_mcdi_rpc(efx, MC_CMD_VADAPTOR_SET_MAC, inbuf,
-                          sizeof(inbuf), NULL, 0, NULL);
+        rc = efx_mcdi_rpc_quiet(efx, MC_CMD_VADAPTOR_SET_MAC, inbuf,
+                                sizeof(inbuf), NULL, 0, NULL);
 
         efx_ef10_filter_table_probe(efx);
         up_write(&efx->filter_sem);
@@ -3829,38 +3942,27 @@ static int efx_ef10_set_mac_address(struct efx_nic *efx)
                 efx_net_open(efx->net_dev);
         netif_device_attach(efx->net_dev);
 
-#if !defined(CONFIG_SFC_SRIOV)
-        if (rc == -EPERM)
-                netif_err(efx, drv, efx->net_dev,
-                          "Cannot change MAC address; use sfboot to enable mac-spoofing"
-                          " on this interface\n");
-#else
-        if (rc == -EPERM) {
+#ifdef CONFIG_SFC_SRIOV
+        if (efx->pci_dev->is_virtfn && efx->pci_dev->physfn) {
                 struct pci_dev *pci_dev_pf = efx->pci_dev->physfn;
 
-                /* Switch to PF and change MAC address on vport */
-                if (efx->pci_dev->is_virtfn && pci_dev_pf) {
-                        struct efx_nic *efx_pf = pci_get_drvdata(pci_dev_pf);
+                if (rc == -EPERM) {
+                        struct efx_nic *efx_pf;
 
-                        if (!efx_ef10_sriov_set_vf_mac(efx_pf,
-                                                       nic_data->vf_index,
-                                                       efx->net_dev->dev_addr))
-                                return 0;
-                }
-                netif_err(efx, drv, efx->net_dev,
-                          "Cannot change MAC address; use sfboot to enable mac-spoofing"
-                          " on this interface\n");
-        } else if (efx->pci_dev->is_virtfn) {
-                /* Successfully changed by VF (with MAC spoofing), so update the
-                 * parent PF if possible.
-                 */
-                struct pci_dev *pci_dev_pf = efx->pci_dev->physfn;
+                        /* Switch to PF and change MAC address on vport */
+                        efx_pf = pci_get_drvdata(pci_dev_pf);
 
-                if (pci_dev_pf) {
+                        rc = efx_ef10_sriov_set_vf_mac(efx_pf,
+                                                       nic_data->vf_index,
+                                                       efx->net_dev->dev_addr);
+                } else if (!rc) {
                         struct efx_nic *efx_pf = pci_get_drvdata(pci_dev_pf);
                         struct efx_ef10_nic_data *nic_data = efx_pf->nic_data;
                         unsigned int i;
 
+                        /* MAC address successfully changed by VF (with MAC
+                         * spoofing) so update the parent PF if possible.
+                         */
                         for (i = 0; i < efx_pf->vf_count; ++i) {
                                 struct ef10_vf *vf = nic_data->vf + i;
 
@@ -3871,8 +3973,24 @@ static int efx_ef10_set_mac_address(struct efx_nic *efx)
                                 }
                         }
                 }
-        }
+        } else
 #endif
+        if (rc == -EPERM) {
+                netif_err(efx, drv, efx->net_dev,
+                          "Cannot change MAC address; use sfboot to enable"
+                          " mac-spoofing on this interface\n");
+        } else if (rc == -ENOSYS && !efx_ef10_is_vf(efx)) {
+                /* If the active MCFW does not support MC_CMD_VADAPTOR_SET_MAC
+                 * fall-back to the method of changing the MAC address on the
+                 * vport.  This only applies to PFs because such versions of
+                 * MCFW do not support VFs.
+                 */
+                rc = efx_ef10_vport_set_mac_address(efx);
+        } else {
+                efx_mcdi_display_error(efx, MC_CMD_VADAPTOR_SET_MAC,
+                                       sizeof(inbuf), NULL, 0, rc);
+        }
+
         return rc;
 }
 
diff --git a/drivers/net/ethernet/sfc/ef10_sriov.c b/drivers/net/ethernet/sfc/ef10_sriov.c
index 6c9b6e45509a..3c17f274e802 100644
--- a/drivers/net/ethernet/sfc/ef10_sriov.c
+++ b/drivers/net/ethernet/sfc/ef10_sriov.c
@@ -29,30 +29,6 @@ static int efx_ef10_evb_port_assign(struct efx_nic *efx, unsigned int port_id,
                             NULL, 0, NULL);
 }
 
-static int efx_ef10_vport_add_mac(struct efx_nic *efx,
-                                  unsigned int port_id, u8 *mac)
-{
-        MCDI_DECLARE_BUF(inbuf, MC_CMD_VPORT_ADD_MAC_ADDRESS_IN_LEN);
-
-        MCDI_SET_DWORD(inbuf, VPORT_ADD_MAC_ADDRESS_IN_VPORT_ID, port_id);
-        ether_addr_copy(MCDI_PTR(inbuf, VPORT_ADD_MAC_ADDRESS_IN_MACADDR), mac);
-
-        return efx_mcdi_rpc(efx, MC_CMD_VPORT_ADD_MAC_ADDRESS, inbuf,
-                            sizeof(inbuf), NULL, 0, NULL);
-}
-
-static int efx_ef10_vport_del_mac(struct efx_nic *efx,
-                                  unsigned int port_id, u8 *mac)
-{
-        MCDI_DECLARE_BUF(inbuf, MC_CMD_VPORT_DEL_MAC_ADDRESS_IN_LEN);
-
-        MCDI_SET_DWORD(inbuf, VPORT_DEL_MAC_ADDRESS_IN_VPORT_ID, port_id);
-        ether_addr_copy(MCDI_PTR(inbuf, VPORT_DEL_MAC_ADDRESS_IN_MACADDR), mac);
-
-        return efx_mcdi_rpc(efx, MC_CMD_VPORT_DEL_MAC_ADDRESS, inbuf,
-                            sizeof(inbuf), NULL, 0, NULL);
-}
-
 static int efx_ef10_vswitch_alloc(struct efx_nic *efx, unsigned int port_id,
                                   unsigned int vswitch_type)
 {
@@ -136,24 +112,6 @@ static int efx_ef10_vport_free(struct efx_nic *efx, unsigned int port_id)
                             NULL, 0, NULL);
 }
 
-static int efx_ef10_vadaptor_alloc(struct efx_nic *efx, unsigned int port_id)
-{
-        MCDI_DECLARE_BUF(inbuf, MC_CMD_VADAPTOR_ALLOC_IN_LEN);
-
-        MCDI_SET_DWORD(inbuf, VADAPTOR_ALLOC_IN_UPSTREAM_PORT_ID, port_id);
-        return efx_mcdi_rpc(efx, MC_CMD_VADAPTOR_ALLOC, inbuf, sizeof(inbuf),
-                            NULL, 0, NULL);
-}
-
-static int efx_ef10_vadaptor_free(struct efx_nic *efx, unsigned int port_id)
-{
-        MCDI_DECLARE_BUF(inbuf, MC_CMD_VADAPTOR_FREE_IN_LEN);
-
-        MCDI_SET_DWORD(inbuf, VADAPTOR_FREE_IN_UPSTREAM_PORT_ID, port_id);
-        return efx_mcdi_rpc(efx, MC_CMD_VADAPTOR_FREE, inbuf, sizeof(inbuf),
-                            NULL, 0, NULL);
-}
-
 static void efx_ef10_sriov_free_vf_vports(struct efx_nic *efx)
 {
         struct efx_ef10_nic_data *nic_data = efx->nic_data;
@@ -640,21 +598,21 @@ int efx_ef10_sriov_set_vf_vlan(struct efx_nic *efx, int vf_i, u16 vlan,
                                   MC_CMD_VPORT_ALLOC_IN_VPORT_TYPE_NORMAL,
                                   vf->vlan, &vf->vport_id);
         if (rc)
-                goto reset_nic;
+                goto reset_nic_up_write;
 
 restore_mac:
         if (!is_zero_ether_addr(vf->mac)) {
                 rc2 = efx_ef10_vport_add_mac(efx, vf->vport_id, vf->mac);
                 if (rc2) {
                         eth_zero_addr(vf->mac);
-                        goto reset_nic;
+                        goto reset_nic_up_write;
                 }
         }
 
 restore_evb_port:
         rc2 = efx_ef10_evb_port_assign(efx, vf->vport_id, vf_i);
         if (rc2)
-                goto reset_nic;
+                goto reset_nic_up_write;
         else
                 vf->vport_assigned = 1;
 
@@ -662,14 +620,16 @@ restore_vadaptor:
         if (vf->efx) {
                 rc2 = efx_ef10_vadaptor_alloc(vf->efx, EVB_PORT_ID_ASSIGNED);
                 if (rc2)
-                        goto reset_nic;
+                        goto reset_nic_up_write;
         }
 
 restore_filters:
         if (vf->efx) {
                 rc2 = vf->efx->type->filter_table_probe(vf->efx);
                 if (rc2)
-                        goto reset_nic;
+                        goto reset_nic_up_write;
+
+                up_write(&vf->efx->filter_sem);
 
                 up_write(&vf->efx->filter_sem);
 
@@ -681,9 +641,12 @@ restore_filters:
         }
         return rc;
 
+reset_nic_up_write:
+        if (vf->efx)
+                up_write(&vf->efx->filter_sem);
+
 reset_nic:
         if (vf->efx) {
-                up_write(&vf->efx->filter_sem);
                 netif_err(efx, drv, efx->net_dev,
                           "Failed to restore VF - scheduling reset.\n");
                 efx_schedule_reset(vf->efx, RESET_TYPE_DATAPATH);
diff --git a/drivers/net/ethernet/sfc/ef10_sriov.h b/drivers/net/ethernet/sfc/ef10_sriov.h
index db4ef537c610..6d25b92cb45e 100644
--- a/drivers/net/ethernet/sfc/ef10_sriov.h
+++ b/drivers/net/ethernet/sfc/ef10_sriov.h
@@ -65,5 +65,11 @@ int efx_ef10_vswitching_restore_pf(struct efx_nic *efx);
 int efx_ef10_vswitching_restore_vf(struct efx_nic *efx);
 void efx_ef10_vswitching_remove_pf(struct efx_nic *efx);
 void efx_ef10_vswitching_remove_vf(struct efx_nic *efx);
+int efx_ef10_vport_add_mac(struct efx_nic *efx,
+                           unsigned int port_id, u8 *mac);
+int efx_ef10_vport_del_mac(struct efx_nic *efx,
+                           unsigned int port_id, u8 *mac);
+int efx_ef10_vadaptor_alloc(struct efx_nic *efx, unsigned int port_id);
+int efx_ef10_vadaptor_free(struct efx_nic *efx, unsigned int port_id);
 
 #endif /* EF10_SRIOV_H */
diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c
index 804b9ad553d3..03bc03b67f08 100644
--- a/drivers/net/ethernet/sfc/efx.c
+++ b/drivers/net/ethernet/sfc/efx.c
@@ -245,11 +245,17 @@ static int efx_check_disabled(struct efx_nic *efx)
  */
 static int efx_process_channel(struct efx_channel *channel, int budget)
 {
+        struct efx_tx_queue *tx_queue;
         int spent;
 
         if (unlikely(!channel->enabled))
                 return 0;
 
+        efx_for_each_channel_tx_queue(tx_queue, channel) {
+                tx_queue->pkts_compl = 0;
+                tx_queue->bytes_compl = 0;
+        }
+
         spent = efx_nic_process_eventq(channel, budget);
         if (spent && efx_channel_has_rx_queue(channel)) {
                 struct efx_rx_queue *rx_queue =
@@ -259,6 +265,14 @@ static int efx_process_channel(struct efx_channel *channel, int budget)
                 efx_fast_push_rx_descriptors(rx_queue, true);
         }
 
+        /* Update BQL */
+        efx_for_each_channel_tx_queue(tx_queue, channel) {
+                if (tx_queue->bytes_compl) {
+                        netdev_tx_completed_queue(tx_queue->core_txq,
+                                tx_queue->pkts_compl, tx_queue->bytes_compl);
+                }
+        }
+
         return spent;
 }
 
diff --git a/drivers/net/ethernet/sfc/net_driver.h b/drivers/net/ethernet/sfc/net_driver.h
index d72f522bf9c3..47d1e3a96522 100644
--- a/drivers/net/ethernet/sfc/net_driver.h
+++ b/drivers/net/ethernet/sfc/net_driver.h
@@ -241,6 +241,8 @@ struct efx_tx_queue {
         unsigned int read_count ____cacheline_aligned_in_smp;
         unsigned int old_write_count;
         unsigned int merge_events;
+        unsigned int bytes_compl;
+        unsigned int pkts_compl;
 
         /* Members used only on the xmit path */
         unsigned int insert_count ____cacheline_aligned_in_smp;
diff --git a/drivers/net/ethernet/sfc/tx.c b/drivers/net/ethernet/sfc/tx.c
index aaf2987512b5..1833a0146571 100644
--- a/drivers/net/ethernet/sfc/tx.c
+++ b/drivers/net/ethernet/sfc/tx.c
@@ -617,7 +617,8 @@ void efx_xmit_done(struct efx_tx_queue *tx_queue, unsigned int index)
         EFX_BUG_ON_PARANOID(index > tx_queue->ptr_mask);
 
         efx_dequeue_buffers(tx_queue, index, &pkts_compl, &bytes_compl);
-        netdev_tx_completed_queue(tx_queue->core_txq, pkts_compl, bytes_compl);
+        tx_queue->pkts_compl += pkts_compl;
+        tx_queue->bytes_compl += bytes_compl;
 
         if (pkts_compl > 1)
                 ++tx_queue->merge_events;
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 50f7a7a26821..864b476f7fd5 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -2843,7 +2843,7 @@ int stmmac_dvr_probe(struct device *device,
         if (res->mac)
                 memcpy(priv->dev->dev_addr, res->mac, ETH_ALEN);
 
-        dev_set_drvdata(device, priv);
+        dev_set_drvdata(device, priv->dev);
 
         /* Verify driver arguments */
         stmmac_verify_args();
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 462820514fae..d155bf2573cd 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -138,19 +138,6 @@ do {								\
 #define CPSW_CMINTMAX_INTVL     (1000 / CPSW_CMINTMIN_CNT)
 #define CPSW_CMINTMIN_INTVL     ((1000 / CPSW_CMINTMAX_CNT) + 1)
 
-#define cpsw_enable_irq(priv)   \
-        do {                    \
-                u32 i;          \
-                for (i = 0; i < priv->num_irqs; i++) \
-                        enable_irq(priv->irqs_table[i]); \
-        } while (0)
-#define cpsw_disable_irq(priv)  \
-        do {                    \
-                u32 i;          \
-                for (i = 0; i < priv->num_irqs; i++) \
-                        disable_irq_nosync(priv->irqs_table[i]); \
-        } while (0)
-
 #define cpsw_slave_index(priv)                          \
                 ((priv->data.dual_emac) ? priv->emac_port :     \
                 priv->data.active_slave)
@@ -509,9 +496,11 @@ static const struct cpsw_stats cpsw_gstrings_stats[] = {
                                 (func)(slave++, ##arg);                 \
         } while (0)
 #define cpsw_get_slave_ndev(priv, __slave_no__)                         \
-        (priv->slaves[__slave_no__].ndev)
+        ((__slave_no__ < priv->data.slaves) ?                           \
+                priv->slaves[__slave_no__].ndev : NULL)
 #define cpsw_get_slave_priv(priv, __slave_no__)                         \
-        ((priv->slaves[__slave_no__].ndev) ?                            \
+        (((__slave_no__ < priv->data.slaves) &&                         \
+                (priv->slaves[__slave_no__].ndev)) ?                    \
                 netdev_priv(priv->slaves[__slave_no__].ndev) : NULL)    \
 
 #define cpsw_dual_emac_src_port_detect(status, priv, ndev, skb)         \
@@ -781,7 +770,7 @@ static irqreturn_t cpsw_rx_interrupt(int irq, void *dev_id)
 
         cpsw_intr_disable(priv);
         if (priv->irq_enabled == true) {
-                cpsw_disable_irq(priv);
+                disable_irq_nosync(priv->irqs_table[0]);
                 priv->irq_enabled = false;
         }
 
@@ -804,9 +793,7 @@ static irqreturn_t cpsw_rx_interrupt(int irq, void *dev_id)
 static int cpsw_poll(struct napi_struct *napi, int budget)
 {
         struct cpsw_priv        *priv = napi_to_priv(napi);
-        int                     num_tx, num_rx;
-
-        num_tx = cpdma_chan_process(priv->txch, 128);
+        int                     num_rx;
 
         num_rx = cpdma_chan_process(priv->rxch, budget);
         if (num_rx < budget) {
@@ -817,13 +804,12 @@ static int cpsw_poll(struct napi_struct *napi, int budget)
                 prim_cpsw = cpsw_get_slave_priv(priv, 0);
                 if (prim_cpsw->irq_enabled == false) {
                         prim_cpsw->irq_enabled = true;
-                        cpsw_enable_irq(priv);
+                        enable_irq(priv->irqs_table[0]);
                 }
         }
 
-        if (num_rx || num_tx)
-                cpsw_dbg(priv, intr, "poll %d rx, %d tx pkts\n",
-                         num_rx, num_tx);
+        if (num_rx)
+                cpsw_dbg(priv, intr, "poll %d rx pkts\n", num_rx);
 
         return num_rx;
 }
@@ -1333,7 +1319,7 @@ static int cpsw_ndo_open(struct net_device *ndev)
         if (prim_cpsw->irq_enabled == false) {
                 if ((priv == prim_cpsw) || !netif_running(prim_cpsw->ndev)) {
                         prim_cpsw->irq_enabled = true;
-                        cpsw_enable_irq(prim_cpsw);
+                        enable_irq(prim_cpsw->irqs_table[0]);
                 }
         }
 
diff --git a/drivers/net/ethernet/ti/netcp_core.c b/drivers/net/ethernet/ti/netcp_core.c
index 5ec4ed3f6c8d..ec8ed30196f3 100644
--- a/drivers/net/ethernet/ti/netcp_core.c
+++ b/drivers/net/ethernet/ti/netcp_core.c
@@ -1617,11 +1617,11 @@ static int netcp_ndo_open(struct net_device *ndev)
         }
         mutex_unlock(&netcp_modules_lock);
 
-        netcp_rxpool_refill(netcp);
         napi_enable(&netcp->rx_napi);
         napi_enable(&netcp->tx_napi);
         knav_queue_enable_notify(netcp->tx_compl_q);
         knav_queue_enable_notify(netcp->rx_queue);
+        netcp_rxpool_refill(netcp);
         netif_tx_wake_all_queues(ndev);
         dev_dbg(netcp->ndev_dev, "netcp device %s opened\n", ndev->name);
         return 0;
diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
index 4208dd7ef101..d95f9aae95e7 100644
--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
@@ -1530,9 +1530,9 @@ static int axienet_probe(struct platform_device *pdev)
         /* Map device registers */
         ethres = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         lp->regs = devm_ioremap_resource(&pdev->dev, ethres);
-        if (!lp->regs) {
+        if (IS_ERR(lp->regs)) {
                 dev_err(&pdev->dev, "could not map Axi Ethernet regs.\n");
-                ret = -ENOMEM;
+                ret = PTR_ERR(lp->regs);
                 goto free_netdev;
         }
 
@@ -1599,9 +1599,9 @@ static int axienet_probe(struct platform_device *pdev)
                 goto free_netdev;
         }
         lp->dma_regs = devm_ioremap_resource(&pdev->dev, &dmares);
-        if (!lp->dma_regs) {
+        if (IS_ERR(lp->dma_regs)) {
                 dev_err(&pdev->dev, "could not map DMA regs\n");
-                ret = -ENOMEM;
+                ret = PTR_ERR(lp->dma_regs);
                 goto free_netdev;
         }
         lp->rx_irq = irq_of_parse_and_map(np, 1);
diff --git a/drivers/net/hamradio/bpqether.c b/drivers/net/hamradio/bpqether.c
index 7856b6ccf5c5..d95a50ae996d 100644
--- a/drivers/net/hamradio/bpqether.c
+++ b/drivers/net/hamradio/bpqether.c
@@ -482,6 +482,7 @@ static void bpq_setup(struct net_device *dev)
         memcpy(dev->dev_addr,  &ax25_defaddr, AX25_ADDR_LEN);
 
         dev->flags      = 0;
+        dev->features   = NETIF_F_LLTX; /* Allow recursion */
 
 #if defined(CONFIG_AX25) || defined(CONFIG_AX25_MODULE)
         dev->header_ops      = &ax25_header_ops;
diff --git a/drivers/net/ipvlan/ipvlan.h b/drivers/net/ipvlan/ipvlan.h
index 953a97492fab..9542b7bac61a 100644
--- a/drivers/net/ipvlan/ipvlan.h
+++ b/drivers/net/ipvlan/ipvlan.h
@@ -67,8 +67,6 @@ struct ipvl_dev {
         struct ipvl_port        *port;
         struct net_device       *phy_dev;
         struct list_head        addrs;
-        int                     ipv4cnt;
-        int                     ipv6cnt;
         struct ipvl_pcpu_stats  __percpu *pcpu_stats;
         DECLARE_BITMAP(mac_filters, IPVLAN_MAC_FILTER_SIZE);
         netdev_features_t       sfeatures;
@@ -106,6 +104,11 @@ static inline struct ipvl_port *ipvlan_port_get_rcu(const struct net_device *d)
         return rcu_dereference(d->rx_handler_data);
 }
 
+static inline struct ipvl_port *ipvlan_port_get_rcu_bh(const struct net_device *d)
+{
+        return rcu_dereference_bh(d->rx_handler_data);
+}
+
 static inline struct ipvl_port *ipvlan_port_get_rtnl(const struct net_device *d)
 {
         return rtnl_dereference(d->rx_handler_data);
@@ -124,5 +127,5 @@ struct ipvl_addr *ipvlan_find_addr(const struct ipvl_dev *ipvlan,
 bool ipvlan_addr_busy(struct ipvl_port *port, void *iaddr, bool is_v6);
 struct ipvl_addr *ipvlan_ht_addr_lookup(const struct ipvl_port *port,
                                         const void *iaddr, bool is_v6);
-void ipvlan_ht_addr_del(struct ipvl_addr *addr, bool sync);
+void ipvlan_ht_addr_del(struct ipvl_addr *addr);
 #endif /* __IPVLAN_H */
diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c
index 8afbedad620d..207f62e8de9a 100644
--- a/drivers/net/ipvlan/ipvlan_core.c
+++ b/drivers/net/ipvlan/ipvlan_core.c
@@ -85,11 +85,9 @@ void ipvlan_ht_addr_add(struct ipvl_dev *ipvlan, struct ipvl_addr *addr)
                 hlist_add_head_rcu(&addr->hlnode, &port->hlhead[hash]);
 }
 
-void ipvlan_ht_addr_del(struct ipvl_addr *addr, bool sync)
+void ipvlan_ht_addr_del(struct ipvl_addr *addr)
 {
         hlist_del_init_rcu(&addr->hlnode);
-        if (sync)
-                synchronize_rcu();
 }
 
 struct ipvl_addr *ipvlan_find_addr(const struct ipvl_dev *ipvlan,
@@ -531,7 +529,7 @@ static int ipvlan_xmit_mode_l2(struct sk_buff *skb, struct net_device *dev)
 int ipvlan_queue_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct ipvl_dev *ipvlan = netdev_priv(dev);
-        struct ipvl_port *port = ipvlan_port_get_rcu(ipvlan->phy_dev);
+        struct ipvl_port *port = ipvlan_port_get_rcu_bh(ipvlan->phy_dev);
 
         if (!port)
                 goto out;
diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c
index 1acc283160d9..20b58bdecf75 100644
--- a/drivers/net/ipvlan/ipvlan_main.c
+++ b/drivers/net/ipvlan/ipvlan_main.c
@@ -153,10 +153,9 @@ static int ipvlan_open(struct net_device *dev)
         else
                 dev->flags &= ~IFF_NOARP;
 
-        if (ipvlan->ipv6cnt > 0 || ipvlan->ipv4cnt > 0) {
-                list_for_each_entry(addr, &ipvlan->addrs, anode)
-                        ipvlan_ht_addr_add(ipvlan, addr);
-        }
+        list_for_each_entry(addr, &ipvlan->addrs, anode)
+                ipvlan_ht_addr_add(ipvlan, addr);
+
         return dev_uc_add(phy_dev, phy_dev->dev_addr);
 }
 
@@ -171,10 +170,9 @@ static int ipvlan_stop(struct net_device *dev)
 
         dev_uc_del(phy_dev, phy_dev->dev_addr);
 
-        if (ipvlan->ipv6cnt > 0 || ipvlan->ipv4cnt > 0) {
-                list_for_each_entry(addr, &ipvlan->addrs, anode)
-                        ipvlan_ht_addr_del(addr, !dev->dismantle);
-        }
+        list_for_each_entry(addr, &ipvlan->addrs, anode)
+                ipvlan_ht_addr_del(addr);
+
         return 0;
 }
 
@@ -471,8 +469,6 @@ static int ipvlan_link_new(struct net *src_net, struct net_device *dev,
         ipvlan->port = port;
         ipvlan->sfeatures = IPVLAN_FEATURES;
         INIT_LIST_HEAD(&ipvlan->addrs);
-        ipvlan->ipv4cnt = 0;
-        ipvlan->ipv6cnt = 0;
 
         /* TODO Probably put random address here to be presented to the
          * world but keep using the physical-dev address for the outgoing
@@ -508,12 +504,12 @@ static void ipvlan_link_delete(struct net_device *dev, struct list_head *head)
         struct ipvl_dev *ipvlan = netdev_priv(dev);
         struct ipvl_addr *addr, *next;
 
-        if (ipvlan->ipv6cnt > 0 || ipvlan->ipv4cnt > 0) {
-                list_for_each_entry_safe(addr, next, &ipvlan->addrs, anode) {
-                        ipvlan_ht_addr_del(addr, !dev->dismantle);
-                        list_del(&addr->anode);
-                }
+        list_for_each_entry_safe(addr, next, &ipvlan->addrs, anode) {
+                ipvlan_ht_addr_del(addr);
+                list_del(&addr->anode);
+                kfree_rcu(addr, rcu);
         }
+
         list_del_rcu(&ipvlan->pnode);
         unregister_netdevice_queue(dev, head);
         netdev_upper_dev_unlink(ipvlan->phy_dev, dev);
@@ -627,7 +623,7 @@ static int ipvlan_add_addr6(struct ipvl_dev *ipvlan, struct in6_addr *ip6_addr)
         memcpy(&addr->ip6addr, ip6_addr, sizeof(struct in6_addr));
         addr->atype = IPVL_IPV6;
         list_add_tail(&addr->anode, &ipvlan->addrs);
-        ipvlan->ipv6cnt++;
+
         /* If the interface is not up, the address will be added to the hash
          * list by ipvlan_open.
          */
@@ -645,10 +641,8 @@ static void ipvlan_del_addr6(struct ipvl_dev *ipvlan, struct in6_addr *ip6_addr)
         if (!addr)
                 return;
 
-        ipvlan_ht_addr_del(addr, true);
+        ipvlan_ht_addr_del(addr);
         list_del(&addr->anode);
-        ipvlan->ipv6cnt--;
-        WARN_ON(ipvlan->ipv6cnt < 0);
         kfree_rcu(addr, rcu);
 
         return;
@@ -661,6 +655,10 @@ static int ipvlan_addr6_event(struct notifier_block *unused,
         struct net_device *dev = (struct net_device *)if6->idev->dev;
         struct ipvl_dev *ipvlan = netdev_priv(dev);
 
+        /* FIXME IPv6 autoconf calls us from bh without RTNL */
+        if (in_softirq())
+                return NOTIFY_DONE;
+
         if (!netif_is_ipvlan(dev))
                 return NOTIFY_DONE;
 
@@ -699,7 +697,7 @@ static int ipvlan_add_addr4(struct ipvl_dev *ipvlan, struct in_addr *ip4_addr)
         memcpy(&addr->ip4addr, ip4_addr, sizeof(struct in_addr));
         addr->atype = IPVL_IPV4;
         list_add_tail(&addr->anode, &ipvlan->addrs);
-        ipvlan->ipv4cnt++;
+
         /* If the interface is not up, the address will be added to the hash
          * list by ipvlan_open.
          */
@@ -717,10 +715,8 @@ static void ipvlan_del_addr4(struct ipvl_dev *ipvlan, struct in_addr *ip4_addr)
         if (!addr)
                 return;
 
-        ipvlan_ht_addr_del(addr, true);
+        ipvlan_ht_addr_del(addr);
         list_del(&addr->anode);
-        ipvlan->ipv4cnt--;
-        WARN_ON(ipvlan->ipv4cnt < 0);
         kfree_rcu(addr, rcu);
 
         return;
diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index f8370808a018..3b933bb5a8d5 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -1355,6 +1355,7 @@ static void macvtap_exit(void)
         class_unregister(macvtap_class);
         cdev_del(&macvtap_cdev);
         unregister_chrdev_region(macvtap_major, MACVTAP_NUM_DEVS);
+        idr_destroy(&minor_idr);
 }
 module_exit(macvtap_exit);
 
diff --git a/drivers/net/phy/Kconfig b/drivers/net/phy/Kconfig
index cf18940f4e84..cb86d7a01542 100644
--- a/drivers/net/phy/Kconfig
+++ b/drivers/net/phy/Kconfig
@@ -191,7 +191,7 @@ config MDIO_BUS_MUX_GPIO
 
 config MDIO_BUS_MUX_MMIOREG
         tristate "Support for MMIO device-controlled MDIO bus multiplexers"
-        depends on OF_MDIO
+        depends on OF_MDIO && HAS_IOMEM
         select MDIO_BUS_MUX
         help
           This module provides a driver for MDIO bus multiplexers that
diff --git a/drivers/net/phy/dp83867.c b/drivers/net/phy/dp83867.c
index c7a12e2e07b7..8a3bf5469892 100644
--- a/drivers/net/phy/dp83867.c
+++ b/drivers/net/phy/dp83867.c
@@ -164,7 +164,7 @@ static int dp83867_config_init(struct phy_device *phydev)
                         return ret;
         }
 
-        if ((phydev->interface >= PHY_INTERFACE_MODE_RGMII_ID) ||
+        if ((phydev->interface >= PHY_INTERFACE_MODE_RGMII_ID) &&
             (phydev->interface <= PHY_INTERFACE_MODE_RGMII_RXID)) {
                 val = phy_read_mmd_indirect(phydev, DP83867_RGMIICTL,
                                             DP83867_DEVADDR, phydev->addr);
diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index 095ef3fe369a..46a14cbb0215 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -421,6 +421,8 @@ static int mdio_bus_match(struct device *dev, struct device_driver *drv)
 {
         struct phy_device *phydev = to_phy_device(dev);
         struct phy_driver *phydrv = to_phy_driver(drv);
+        const int num_ids = ARRAY_SIZE(phydev->c45_ids.device_ids);
+        int i;
 
         if (of_driver_match_device(dev, drv))
                 return 1;
@@ -428,8 +430,21 @@ static int mdio_bus_match(struct device *dev, struct device_driver *drv)
         if (phydrv->match_phy_device)
                 return phydrv->match_phy_device(phydev);
 
-        return (phydrv->phy_id & phydrv->phy_id_mask) ==
-                (phydev->phy_id & phydrv->phy_id_mask);
+        if (phydev->is_c45) {
+                for (i = 1; i < num_ids; i++) {
+                        if (!(phydev->c45_ids.devices_in_package & (1 << i)))
+                                continue;
+
+                        if ((phydrv->phy_id & phydrv->phy_id_mask) ==
+                            (phydev->c45_ids.device_ids[i] &
+                             phydrv->phy_id_mask))
+                                return 1;
+                }
+                return 0;
+        } else {
+                return (phydrv->phy_id & phydrv->phy_id_mask) ==
+                        (phydev->phy_id & phydrv->phy_id_mask);
+        }
 }
 
 #ifdef CONFIG_PM
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 4545e78840b0..35a2bffe848a 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -523,6 +523,7 @@ static const struct driver_info wwan_info = {
 #define REALTEK_VENDOR_ID       0x0bda
 #define SAMSUNG_VENDOR_ID       0x04e8
 #define LENOVO_VENDOR_ID        0x17ef
+#define NVIDIA_VENDOR_ID        0x0955
 
 static const struct usb_device_id       products[] = {
 /* BLACKLIST !!
@@ -710,6 +711,13 @@ static const struct usb_device_id	products[] = {
         .driver_info = 0,
 },
 
+/* NVIDIA Tegra USB 3.0 Ethernet Adapters (based on Realtek RTL8153) */
+{
+        USB_DEVICE_AND_INTERFACE_INFO(NVIDIA_VENDOR_ID, 0x09ff, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
+        .driver_info = 0,
+},
+
 /* WHITELIST!!!
  *
  * CDC Ether uses two interfaces, not necessarily consecutive.
diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c
index e4b7a47a825c..efc18e05af0a 100644
--- a/drivers/net/usb/cdc_mbim.c
+++ b/drivers/net/usb/cdc_mbim.c
@@ -158,7 +158,7 @@ static int cdc_mbim_bind(struct usbnet *dev, struct usb_interface *intf)
         if (!cdc_ncm_comm_intf_is_mbim(intf->cur_altsetting))
                 goto err;
 
-        ret = cdc_ncm_bind_common(dev, intf, data_altsetting);
+        ret = cdc_ncm_bind_common(dev, intf, data_altsetting, 0);
         if (ret)
                 goto err;
 
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 8067b8fbb0ee..db40175b1a0b 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -6,7 +6,7 @@
  * Original author: Hans Petter Selasky <hans.petter.selasky@stericsson.com>
  *
  * USB Host Driver for Network Control Model (NCM)
- * http://www.usb.org/developers/devclass_docs/NCM10.zip
+ * http://www.usb.org/developers/docs/devclass_docs/NCM10_012011.zip
  *
  * The NCM encoding, decoding and initialization logic
  * derives from FreeBSD 8.x. if_cdce.c and if_cdcereg.h
@@ -684,10 +684,12 @@ static void cdc_ncm_free(struct cdc_ncm_ctx *ctx)
                 ctx->tx_curr_skb = NULL;
         }
 
+        kfree(ctx->delayed_ndp16);
+
         kfree(ctx);
 }
 
-int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_altsetting)
+int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_altsetting, int drvflags)
 {
         const struct usb_cdc_union_desc *union_desc = NULL;
         struct cdc_ncm_ctx *ctx;
@@ -855,6 +857,17 @@ advance:
         /* finish setting up the device specific data */
         cdc_ncm_setup(dev);
 
+        /* Device-specific flags */
+        ctx->drvflags = drvflags;
+
+        /* Allocate the delayed NDP if needed. */
+        if (ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END) {
+                ctx->delayed_ndp16 = kzalloc(ctx->max_ndp_size, GFP_KERNEL);
+                if (!ctx->delayed_ndp16)
+                        goto error2;
+                dev_info(&intf->dev, "NDP will be placed at end of frame for this device.");
+        }
+
         /* override ethtool_ops */
         dev->net->ethtool_ops = &cdc_ncm_ethtool_ops;
 
@@ -954,8 +967,11 @@ static int cdc_ncm_bind(struct usbnet *dev, struct usb_interface *intf)
         if (cdc_ncm_select_altsetting(intf) != CDC_NCM_COMM_ALTSETTING_NCM)
                 return -ENODEV;
 
-        /* The NCM data altsetting is fixed */
-        ret = cdc_ncm_bind_common(dev, intf, CDC_NCM_DATA_ALTSETTING_NCM);
+        /* The NCM data altsetting is fixed, so we hard-coded it.
+         * Additionally, generic NCM devices are assumed to accept arbitrarily
+         * placed NDP.
+         */
+        ret = cdc_ncm_bind_common(dev, intf, CDC_NCM_DATA_ALTSETTING_NCM, 0);
 
         /*
          * We should get an event when network connection is "connected" or
@@ -986,6 +1002,14 @@ static struct usb_cdc_ncm_ndp16 *cdc_ncm_ndp(struct cdc_ncm_ctx *ctx, struct sk_
         struct usb_cdc_ncm_nth16 *nth16 = (void *)skb->data;
         size_t ndpoffset = le16_to_cpu(nth16->wNdpIndex);
 
+        /* If NDP should be moved to the end of the NCM package, we can't follow the
+        * NTH16 header as we would normally do. NDP isn't written to the SKB yet, and
+        * the wNdpIndex field in the header is actually not consistent with reality. It will be later.
+        */
+        if (ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END)
+                if (ctx->delayed_ndp16->dwSignature == sign)
+                        return ctx->delayed_ndp16;
+
         /* follow the chain of NDPs, looking for a match */
         while (ndpoffset) {
                 ndp16 = (struct usb_cdc_ncm_ndp16 *)(skb->data + ndpoffset);
@@ -995,7 +1019,8 @@ static struct usb_cdc_ncm_ndp16 *cdc_ncm_ndp(struct cdc_ncm_ctx *ctx, struct sk_
         }
 
         /* align new NDP */
-        cdc_ncm_align_tail(skb, ctx->tx_ndp_modulus, 0, ctx->tx_max);
+        if (!(ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END))
+                cdc_ncm_align_tail(skb, ctx->tx_ndp_modulus, 0, ctx->tx_max);
 
         /* verify that there is room for the NDP and the datagram (reserve) */
         if ((ctx->tx_max - skb->len - reserve) < ctx->max_ndp_size)
@@ -1008,7 +1033,11 @@ static struct usb_cdc_ncm_ndp16 *cdc_ncm_ndp(struct cdc_ncm_ctx *ctx, struct sk_
                 nth16->wNdpIndex = cpu_to_le16(skb->len);
 
         /* push a new empty NDP */
-        ndp16 = (struct usb_cdc_ncm_ndp16 *)memset(skb_put(skb, ctx->max_ndp_size), 0, ctx->max_ndp_size);
+        if (!(ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END))
+                ndp16 = (struct usb_cdc_ncm_ndp16 *)memset(skb_put(skb, ctx->max_ndp_size), 0, ctx->max_ndp_size);
+        else
+                ndp16 = ctx->delayed_ndp16;
+
         ndp16->dwSignature = sign;
         ndp16->wLength = cpu_to_le16(sizeof(struct usb_cdc_ncm_ndp16) + sizeof(struct usb_cdc_ncm_dpe16));
         return ndp16;
@@ -1023,6 +1052,15 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign)
         struct sk_buff *skb_out;
         u16 n = 0, index, ndplen;
         u8 ready2send = 0;
+        u32 delayed_ndp_size;
+
+        /* When our NDP gets written in cdc_ncm_ndp(), then skb_out->len gets updated
+         * accordingly. Otherwise, we should check here.
+         */
+        if (ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END)
+                delayed_ndp_size = ctx->max_ndp_size;
+        else
+                delayed_ndp_size = 0;
 
         /* if there is a remaining skb, it gets priority */
         if (skb != NULL) {
@@ -1077,7 +1115,7 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign)
                 cdc_ncm_align_tail(skb_out,  ctx->tx_modulus, ctx->tx_remainder, ctx->tx_max);
 
                 /* check if we had enough room left for both NDP and frame */
-                if (!ndp16 || skb_out->len + skb->len > ctx->tx_max) {
+                if (!ndp16 || skb_out->len + skb->len + delayed_ndp_size > ctx->tx_max) {
                         if (n == 0) {
                                 /* won't fit, MTU problem? */
                                 dev_kfree_skb_any(skb);
@@ -1150,6 +1188,17 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign)
                 /* variables will be reset at next call */
         }
 
+        /* If requested, put NDP at end of frame. */
+        if (ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END) {
+                nth16 = (struct usb_cdc_ncm_nth16 *)skb_out->data;
+                cdc_ncm_align_tail(skb_out, ctx->tx_ndp_modulus, 0, ctx->tx_max);
+                nth16->wNdpIndex = cpu_to_le16(skb_out->len);
+                memcpy(skb_put(skb_out, ctx->max_ndp_size), ctx->delayed_ndp16, ctx->max_ndp_size);
+
+                /* Zero out delayed NDP - signature checking will naturally fail. */
+                ndp16 = memset(ctx->delayed_ndp16, 0, ctx->max_ndp_size);
+        }
+
         /* If collected data size is less or equal ctx->min_tx_pkt
          * bytes, we send buffers as it is. If we get more data, it
          * would be more efficient for USB HS mobile device with DMA
diff --git a/drivers/net/usb/huawei_cdc_ncm.c b/drivers/net/usb/huawei_cdc_ncm.c
index 735f7dadb9a0..2680a65cd5e4 100644
--- a/drivers/net/usb/huawei_cdc_ncm.c
+++ b/drivers/net/usb/huawei_cdc_ncm.c
@@ -73,11 +73,14 @@ static int huawei_cdc_ncm_bind(struct usbnet *usbnet_dev,
         struct usb_driver *subdriver = ERR_PTR(-ENODEV);
         int ret = -ENODEV;
         struct huawei_cdc_ncm_state *drvstate = (void *)&usbnet_dev->data;
+        int drvflags = 0;
 
         /* altsetting should always be 1 for NCM devices - so we hard-coded
-         * it here
+         * it here. Some huawei devices will need the NDP part of the NCM package to
+         * be at the end of the frame.
          */
-        ret = cdc_ncm_bind_common(usbnet_dev, intf, 1);
+        drvflags |= CDC_NCM_FLAG_NDP_TO_END;
+        ret = cdc_ncm_bind_common(usbnet_dev, intf, 1, drvflags);
         if (ret)
                 goto err;
 
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index f603f362504b..9d43460ce3c7 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -757,6 +757,7 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x1199, 0x901c, 8)},    /* Sierra Wireless EM7700 */
         {QMI_FIXED_INTF(0x1199, 0x901f, 8)},    /* Sierra Wireless EM7355 */
         {QMI_FIXED_INTF(0x1199, 0x9041, 8)},    /* Sierra Wireless MC7305/MC7355 */
+        {QMI_FIXED_INTF(0x1199, 0x9041, 10)},   /* Sierra Wireless MC7305/MC7355 */
         {QMI_FIXED_INTF(0x1199, 0x9051, 8)},    /* Netgear AirCard 340U */
         {QMI_FIXED_INTF(0x1199, 0x9053, 8)},    /* Sierra Wireless Modem */
         {QMI_FIXED_INTF(0x1199, 0x9054, 8)},    /* Sierra Wireless Modem */
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index aafa1a1898e4..7f6419ebb5e1 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -494,6 +494,7 @@ enum rtl8152_flags {
 #define VENDOR_ID_REALTEK               0x0bda
 #define VENDOR_ID_SAMSUNG               0x04e8
 #define VENDOR_ID_LENOVO                0x17ef
+#define VENDOR_ID_NVIDIA                0x0955
 
 #define MCU_TYPE_PLA                    0x0100
 #define MCU_TYPE_USB                    0x0000
@@ -4117,6 +4118,7 @@ static struct usb_device_id rtl8152_table[] = {
         {REALTEK_USB_DEVICE(VENDOR_ID_SAMSUNG, 0xa101)},
         {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO,  0x7205)},
         {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO,  0x304f)},
+        {REALTEK_USB_DEVICE(VENDOR_ID_NVIDIA,  0x09ff)},
         {}
 };
 
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 63c7810e1545..7fbca37a1adf 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -1828,7 +1828,8 @@ static int virtnet_probe(struct virtio_device *vdev)
         else
                 vi->hdr_len = sizeof(struct virtio_net_hdr);
 
-        if (virtio_has_feature(vdev, VIRTIO_F_ANY_LAYOUT))
+        if (virtio_has_feature(vdev, VIRTIO_F_ANY_LAYOUT) ||
+            virtio_has_feature(vdev, VIRTIO_F_VERSION_1))
                 vi->any_header_sg = true;
 
         if (virtio_has_feature(vdev, VIRTIO_NET_F_CTRL_VQ))
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index da11bb5e9c7f..46f4caddccbe 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -1216,7 +1216,7 @@ vmxnet3_rq_rx_complete(struct vmxnet3_rx_queue *rq,
         static const u32 rxprod_reg[2] = {
                 VMXNET3_REG_RXPROD, VMXNET3_REG_RXPROD2
         };
-        u32 num_rxd = 0;
+        u32 num_pkts = 0;
         bool skip_page_frags = false;
         struct Vmxnet3_RxCompDesc *rcd;
         struct vmxnet3_rx_ctx *ctx = &rq->rx_ctx;
@@ -1235,13 +1235,12 @@ vmxnet3_rq_rx_complete(struct vmxnet3_rx_queue *rq,
                 struct Vmxnet3_RxDesc *rxd;
                 u32 idx, ring_idx;
                 struct vmxnet3_cmd_ring *ring = NULL;
-                if (num_rxd >= quota) {
+                if (num_pkts >= quota) {
                         /* we may stop even before we see the EOP desc of
                          * the current pkt
                          */
                         break;
                 }
-                num_rxd++;
                 BUG_ON(rcd->rqID != rq->qid && rcd->rqID != rq->qid2);
                 idx = rcd->rxdIdx;
                 ring_idx = rcd->rqID < adapter->num_rx_queues ? 0 : 1;
@@ -1413,6 +1412,7 @@ not_lro:
                                 napi_gro_receive(&rq->napi, skb);
 
                         ctx->skb = NULL;
+                        num_pkts++;
                 }
 
 rcd_done:
@@ -1443,7 +1443,7 @@ rcd_done:
                                   &rq->comp_ring.base[rq->comp_ring.next2proc].rcd, &rxComp);
         }
 
-        return num_rxd;
+        return num_pkts;
 }
 
 
diff --git a/drivers/net/wan/z85230.c b/drivers/net/wan/z85230.c
index feacc3b994b7..2f0bd6955f33 100644
--- a/drivers/net/wan/z85230.c
+++ b/drivers/net/wan/z85230.c
@@ -1044,7 +1044,7 @@ EXPORT_SYMBOL(z8530_sync_dma_close);
  *      @dev: The network device to attach
  *      @c: The Z8530 channel to configure in sync DMA mode.
  *
- *      Set up a Z85x30 device for synchronous DMA tranmission. One
+ *      Set up a Z85x30 device for synchronous DMA transmission. One
  *      ISA DMA channel must be available for this to work. The receive
  *      side is run in PIO mode, but then it has the bigger FIFO.
  */
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 5e15e8e10ed3..a31a6804dc34 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -279,6 +279,7 @@ static void ath9k_hw_read_revisions(struct ath_hw *ah)
                 return;
         case AR9300_DEVID_QCA956X:
                 ah->hw_version.macVersion = AR_SREV_VERSION_9561;
+                return;
         }
 
         val = REG_READ(ah, AR_SREV) & AR_SREV_ID;
diff --git a/drivers/net/wireless/iwlwifi/iwl-fh.h b/drivers/net/wireless/iwlwifi/iwl-fh.h
index d56064861a9c..d45dc021cda2 100644
--- a/drivers/net/wireless/iwlwifi/iwl-fh.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fh.h
@@ -438,6 +438,12 @@ static inline unsigned int FH_MEM_CBBC_QUEUE(unsigned int chnl)
 #define RX_QUEUE_MASK                         255
 #define RX_QUEUE_SIZE_LOG                     8
 
+/*
+ * RX related structures and functions
+ */
+#define RX_FREE_BUFFERS 64
+#define RX_LOW_WATERMARK 8
+
 /**
  * struct iwl_rb_status - reserve buffer status
  *      host memory mapped FH registers
diff --git a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
index 80fefe7d7b8c..3b8e85e51002 100644
--- a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
+++ b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
@@ -540,13 +540,11 @@ static void iwl_set_hw_address_family_8000(struct device *dev,
                 hw_addr = (const u8 *)(mac_override +
                                  MAC_ADDRESS_OVERRIDE_FAMILY_8000);
 
-                /* The byte order is little endian 16 bit, meaning 214365 */
-                data->hw_addr[0] = hw_addr[1];
-                data->hw_addr[1] = hw_addr[0];
-                data->hw_addr[2] = hw_addr[3];
-                data->hw_addr[3] = hw_addr[2];
-                data->hw_addr[4] = hw_addr[5];
-                data->hw_addr[5] = hw_addr[4];
+                /*
+                 * Store the MAC address from MAO section.
+                 * No byte swapping is required in MAO section
+                 */
+                memcpy(data->hw_addr, hw_addr, ETH_ALEN);
 
                 /*
                  * Force the use of the OTP MAC address in case of reserved MAC
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
index 5e4cbdb44c60..737774a01c74 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
@@ -660,7 +660,8 @@ struct iwl_scan_config {
  * iwl_umac_scan_flags
  *@IWL_UMAC_SCAN_FLAG_PREEMPTIVE: scan process triggered by this scan request
  *      can be preempted by other scan requests with higher priority.
- *      The low priority scan is aborted.
+ *      The low priority scan will be resumed when the higher proirity scan is
+ *      completed.
  *@IWL_UMAC_SCAN_FLAG_START_NOTIF: notification will be sent to the driver
  *      when scan starts.
  */
diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
index 5de144968723..5000bfcded61 100644
--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
@@ -1109,6 +1109,9 @@ static int iwl_mvm_scan_umac(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
         cmd->uid = cpu_to_le32(uid);
         cmd->general_flags = cpu_to_le32(iwl_mvm_scan_umac_flags(mvm, params));
 
+        if (type == IWL_MVM_SCAN_SCHED)
+                cmd->flags = cpu_to_le32(IWL_UMAC_SCAN_FLAG_PREEMPTIVE);
+
         if (iwl_mvm_scan_use_ebs(mvm, vif, n_iterations))
                 cmd->channel_flags = IWL_SCAN_CHANNEL_FLAG_EBS |
                                      IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
diff --git a/drivers/net/wireless/iwlwifi/mvm/sta.c b/drivers/net/wireless/iwlwifi/mvm/sta.c
index d68dc697a4a0..26f076e82149 100644
--- a/drivers/net/wireless/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/iwlwifi/mvm/sta.c
@@ -1401,6 +1401,7 @@ int iwl_mvm_set_sta_key(struct iwl_mvm *mvm,
         bool mcast = !(keyconf->flags & IEEE80211_KEY_FLAG_PAIRWISE);
         u8 sta_id;
         int ret;
+        static const u8 __maybe_unused zero_addr[ETH_ALEN] = {0};
 
         lockdep_assert_held(&mvm->mutex);
 
@@ -1467,7 +1468,7 @@ int iwl_mvm_set_sta_key(struct iwl_mvm *mvm,
 end:
         IWL_DEBUG_WEP(mvm, "key: cipher=%x len=%d idx=%d sta=%pM ret=%d\n",
                       keyconf->cipher, keyconf->keylen, keyconf->keyidx,
-                      sta->addr, ret);
+                      sta ? sta->addr : zero_addr, ret);
         return ret;
 }
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/time-event.c b/drivers/net/wireless/iwlwifi/mvm/time-event.c
index d24b6a83e68c..e472729e5f14 100644
--- a/drivers/net/wireless/iwlwifi/mvm/time-event.c
+++ b/drivers/net/wireless/iwlwifi/mvm/time-event.c
@@ -86,7 +86,7 @@ void iwl_mvm_te_clear_data(struct iwl_mvm *mvm,
 {
         lockdep_assert_held(&mvm->time_event_lock);
 
-        if (te_data->id == TE_MAX)
+        if (!te_data->vif)
                 return;
 
         list_del(&te_data->list);
diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c
index 7ba7a118ff5c..89116864d2a0 100644
--- a/drivers/net/wireless/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/mvm/tx.c
@@ -252,7 +252,7 @@ void iwl_mvm_set_tx_cmd_rate(struct iwl_mvm *mvm, struct iwl_tx_cmd *tx_cmd,
 
         if (info->band == IEEE80211_BAND_2GHZ &&
             !iwl_mvm_bt_coex_is_shared_ant_avail(mvm))
-                rate_flags = BIT(mvm->cfg->non_shared_ant) << RATE_MCS_ANT_POS;
+                rate_flags = mvm->cfg->non_shared_ant << RATE_MCS_ANT_POS;
         else
                 rate_flags =
                         BIT(mvm->mgmt_last_antenna_idx) << RATE_MCS_ANT_POS;
diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
index 2ed1e4d2774d..9f65c1cff1b1 100644
--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
@@ -368,12 +368,14 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
 /* 3165 Series */
         {IWL_PCI_DEVICE(0x3165, 0x4010, iwl3165_2ac_cfg)},
         {IWL_PCI_DEVICE(0x3165, 0x4012, iwl3165_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x3166, 0x4212, iwl3165_2ac_cfg)},
         {IWL_PCI_DEVICE(0x3165, 0x4410, iwl3165_2ac_cfg)},
         {IWL_PCI_DEVICE(0x3165, 0x4510, iwl3165_2ac_cfg)},
         {IWL_PCI_DEVICE(0x3165, 0x4110, iwl3165_2ac_cfg)},
         {IWL_PCI_DEVICE(0x3166, 0x4310, iwl3165_2ac_cfg)},
         {IWL_PCI_DEVICE(0x3166, 0x4210, iwl3165_2ac_cfg)},
         {IWL_PCI_DEVICE(0x3165, 0x8010, iwl3165_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x3165, 0x8110, iwl3165_2ac_cfg)},
 
 /* 7265 Series */
         {IWL_PCI_DEVICE(0x095A, 0x5010, iwl7265_2ac_cfg)},
@@ -426,9 +428,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x24F4, 0x1130, iwl8260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x24F4, 0x1030, iwl8260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x24F3, 0xC010, iwl8260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x24F3, 0xC110, iwl8260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x24F3, 0xD010, iwl8260_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x24F4, 0xC030, iwl8260_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x24F4, 0xD030, iwl8260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x24F3, 0xC050, iwl8260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x24F3, 0xD050, iwl8260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x24F3, 0x8010, iwl8260_2ac_cfg)},
diff --git a/drivers/net/wireless/iwlwifi/pcie/internal.h b/drivers/net/wireless/iwlwifi/pcie/internal.h
index 31f72a61cc3f..376b84e54ad7 100644
--- a/drivers/net/wireless/iwlwifi/pcie/internal.h
+++ b/drivers/net/wireless/iwlwifi/pcie/internal.h
@@ -44,15 +44,6 @@
 #include "iwl-io.h"
 #include "iwl-op-mode.h"
 
-/*
- * RX related structures and functions
- */
-#define RX_NUM_QUEUES 1
-#define RX_POST_REQ_ALLOC 2
-#define RX_CLAIM_REQ_ALLOC 8
-#define RX_POOL_SIZE ((RX_CLAIM_REQ_ALLOC - RX_POST_REQ_ALLOC) * RX_NUM_QUEUES)
-#define RX_LOW_WATERMARK 8
-
 struct iwl_host_cmd;
 
 /*This file includes the declaration that are internal to the
@@ -86,29 +77,29 @@ struct isr_statistics {
  * struct iwl_rxq - Rx queue
  * @bd: driver's pointer to buffer of receive buffer descriptors (rbd)
  * @bd_dma: bus address of buffer of receive buffer descriptors (rbd)
+ * @pool:
+ * @queue:
  * @read: Shared index to newest available Rx buffer
  * @write: Shared index to oldest written Rx packet
  * @free_count: Number of pre-allocated buffers in rx_free
- * @used_count: Number of RBDs handled to allocator to use for allocation
  * @write_actual:
- * @rx_free: list of RBDs with allocated RB ready for use
- * @rx_used: list of RBDs with no RB attached
+ * @rx_free: list of free SKBs for use
+ * @rx_used: List of Rx buffers with no SKB
  * @need_update: flag to indicate we need to update read/write index
  * @rb_stts: driver's pointer to receive buffer status
  * @rb_stts_dma: bus address of receive buffer status
  * @lock:
- * @pool: initial pool of iwl_rx_mem_buffer for the queue
- * @queue: actual rx queue
  *
  * NOTE:  rx_free and rx_used are used as a FIFO for iwl_rx_mem_buffers
  */
 struct iwl_rxq {
         __le32 *bd;
         dma_addr_t bd_dma;
+        struct iwl_rx_mem_buffer pool[RX_QUEUE_SIZE + RX_FREE_BUFFERS];
+        struct iwl_rx_mem_buffer *queue[RX_QUEUE_SIZE];
         u32 read;
         u32 write;
         u32 free_count;
-        u32 used_count;
         u32 write_actual;
         struct list_head rx_free;
         struct list_head rx_used;
@@ -116,32 +107,6 @@ struct iwl_rxq {
         struct iwl_rb_status *rb_stts;
         dma_addr_t rb_stts_dma;
         spinlock_t lock;
-        struct iwl_rx_mem_buffer pool[RX_QUEUE_SIZE];
-        struct iwl_rx_mem_buffer *queue[RX_QUEUE_SIZE];
-};
-
-/**
- * struct iwl_rb_allocator - Rx allocator
- * @pool: initial pool of allocator
- * @req_pending: number of requests the allcator had not processed yet
- * @req_ready: number of requests honored and ready for claiming
- * @rbd_allocated: RBDs with pages allocated and ready to be handled to
- *      the queue. This is a list of &struct iwl_rx_mem_buffer
- * @rbd_empty: RBDs with no page attached for allocator use. This is a list
- *      of &struct iwl_rx_mem_buffer
- * @lock: protects the rbd_allocated and rbd_empty lists
- * @alloc_wq: work queue for background calls
- * @rx_alloc: work struct for background calls
- */
-struct iwl_rb_allocator {
-        struct iwl_rx_mem_buffer pool[RX_POOL_SIZE];
-        atomic_t req_pending;
-        atomic_t req_ready;
-        struct list_head rbd_allocated;
-        struct list_head rbd_empty;
-        spinlock_t lock;
-        struct workqueue_struct *alloc_wq;
-        struct work_struct rx_alloc;
 };
 
 struct iwl_dma_ptr {
@@ -285,7 +250,7 @@ iwl_pcie_get_scratchbuf_dma(struct iwl_txq *txq, int idx)
 /**
  * struct iwl_trans_pcie - PCIe transport specific data
  * @rxq: all the RX queue data
- * @rba: allocator for RX replenishing
+ * @rx_replenish: work that will be called when buffers need to be allocated
  * @drv - pointer to iwl_drv
  * @trans: pointer to the generic transport area
  * @scd_base_addr: scheduler sram base address in SRAM
@@ -308,7 +273,7 @@ iwl_pcie_get_scratchbuf_dma(struct iwl_txq *txq, int idx)
  */
 struct iwl_trans_pcie {
         struct iwl_rxq rxq;
-        struct iwl_rb_allocator rba;
+        struct work_struct rx_replenish;
         struct iwl_trans *trans;
         struct iwl_drv *drv;
 
diff --git a/drivers/net/wireless/iwlwifi/pcie/rx.c b/drivers/net/wireless/iwlwifi/pcie/rx.c
index a3fbaa0ef5e0..adad8d0fae7f 100644
--- a/drivers/net/wireless/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/rx.c
@@ -1,7 +1,7 @@
 /******************************************************************************
  *
  * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
- * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
  *
  * Portions of this file are derived from the ipw3945 project, as well
  * as portions of the ieee80211 subsystem header files.
@@ -74,29 +74,16 @@
  * resets the Rx queue buffers with new memory.
  *
  * The management in the driver is as follows:
- * + A list of pre-allocated RBDs is stored in iwl->rxq->rx_free.
- *   When the interrupt handler is called, the request is processed.
- *   The page is either stolen - transferred to the upper layer
- *   or reused - added immediately to the iwl->rxq->rx_free list.
- * + When the page is stolen - the driver updates the matching queue's used
- *   count, detaches the RBD and transfers it to the queue used list.
- *   When there are two used RBDs - they are transferred to the allocator empty
- *   list. Work is then scheduled for the allocator to start allocating
- *   eight buffers.
- *   When there are another 6 used RBDs - they are transferred to the allocator
- *   empty list and the driver tries to claim the pre-allocated buffers and
- *   add them to iwl->rxq->rx_free. If it fails - it continues to claim them
- *   until ready.
- *   When there are 8+ buffers in the free list - either from allocation or from
- *   8 reused unstolen pages - restock is called to update the FW and indexes.
- * + In order to make sure the allocator always has RBDs to use for allocation
- *   the allocator has initial pool in the size of num_queues*(8-2) - the
- *   maximum missing RBDs per allocation request (request posted with 2
- *    empty RBDs, there is no guarantee when the other 6 RBDs are supplied).
- *   The queues supplies the recycle of the rest of the RBDs.
+ * + A list of pre-allocated SKBs is stored in iwl->rxq->rx_free.  When
+ *   iwl->rxq->free_count drops to or below RX_LOW_WATERMARK, work is scheduled
+ *   to replenish the iwl->rxq->rx_free.
+ * + In iwl_pcie_rx_replenish (scheduled) if 'processed' != 'read' then the
+ *   iwl->rxq is replenished and the READ INDEX is updated (updating the
+ *   'processed' and 'read' driver indexes as well)
  * + A received packet is processed and handed to the kernel network stack,
  *   detached from the iwl->rxq.  The driver 'processed' index is updated.
- * + If there are no allocated buffers in iwl->rxq->rx_free,
+ * + The Host/Firmware iwl->rxq is replenished at irq thread time from the
+ *   rx_free list. If there are no allocated buffers in iwl->rxq->rx_free,
  *   the READ INDEX is not incremented and iwl->status(RX_STALLED) is set.
  *   If there were enough free buffers and RX_STALLED is set it is cleared.
  *
@@ -105,32 +92,18 @@
  *
  * iwl_rxq_alloc()            Allocates rx_free
  * iwl_pcie_rx_replenish()    Replenishes rx_free list from rx_used, and calls
- *                            iwl_pcie_rxq_restock.
- *                            Used only during initialization.
+ *                            iwl_pcie_rxq_restock
  * iwl_pcie_rxq_restock()     Moves available buffers from rx_free into Rx
  *                            queue, updates firmware pointers, and updates
- *                            the WRITE index.
- * iwl_pcie_rx_allocator()     Background work for allocating pages.
+ *                            the WRITE index.  If insufficient rx_free buffers
+ *                            are available, schedules iwl_pcie_rx_replenish
  *
  * -- enable interrupts --
  * ISR - iwl_rx()             Detach iwl_rx_mem_buffers from pool up to the
  *                            READ INDEX, detaching the SKB from the pool.
  *                            Moves the packet buffer from queue to rx_used.
- *                            Posts and claims requests to the allocator.
  *                            Calls iwl_pcie_rxq_restock to refill any empty
  *                            slots.
- *
- * RBD life-cycle:
- *
- * Init:
- * rxq.pool -> rxq.rx_used -> rxq.rx_free -> rxq.queue
- *
- * Regular Receive interrupt:
- * Page Stolen:
- * rxq.queue -> rxq.rx_used -> allocator.rbd_empty ->
- * allocator.rbd_allocated -> rxq.rx_free -> rxq.queue
- * Page not Stolen:
- * rxq.queue -> rxq.rx_free -> rxq.queue
  * ...
  *
  */
@@ -267,6 +240,10 @@ static void iwl_pcie_rxq_restock(struct iwl_trans *trans)
                 rxq->free_count--;
         }
         spin_unlock(&rxq->lock);
+        /* If the pre-allocated buffer pool is dropping low, schedule to
+         * refill it */
+        if (rxq->free_count <= RX_LOW_WATERMARK)
+                schedule_work(&trans_pcie->rx_replenish);
 
         /* If we've added more space for the firmware to place data, tell it.
          * Increment device's write pointer in multiples of 8. */
@@ -278,44 +255,6 @@ static void iwl_pcie_rxq_restock(struct iwl_trans *trans)
 }
 
 /*
- * iwl_pcie_rx_alloc_page - allocates and returns a page.
- *
- */
-static struct page *iwl_pcie_rx_alloc_page(struct iwl_trans *trans)
-{
-        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-        struct iwl_rxq *rxq = &trans_pcie->rxq;
-        struct page *page;
-        gfp_t gfp_mask = GFP_KERNEL;
-
-        if (rxq->free_count > RX_LOW_WATERMARK)
-                gfp_mask |= __GFP_NOWARN;
-
-        if (trans_pcie->rx_page_order > 0)
-                gfp_mask |= __GFP_COMP;
-
-        /* Alloc a new receive buffer */
-        page = alloc_pages(gfp_mask, trans_pcie->rx_page_order);
-        if (!page) {
-                if (net_ratelimit())
-                        IWL_DEBUG_INFO(trans, "alloc_pages failed, order: %d\n",
-                                       trans_pcie->rx_page_order);
-                /* Issue an error if the hardware has consumed more than half
-                 * of its free buffer list and we don't have enough
-                 * pre-allocated buffers.
-`                */
-                if (rxq->free_count <= RX_LOW_WATERMARK &&
-                    iwl_rxq_space(rxq) > (RX_QUEUE_SIZE / 2) &&
-                    net_ratelimit())
-                        IWL_CRIT(trans,
-                                 "Failed to alloc_pages with GFP_KERNEL. Only %u free buffers remaining.\n",
-                                 rxq->free_count);
-                return NULL;
-        }
-        return page;
-}
-
-/*
  * iwl_pcie_rxq_alloc_rbs - allocate a page for each used RBD
  *
  * A used RBD is an Rx buffer that has been given to the stack. To use it again
@@ -324,12 +263,13 @@ static struct page *iwl_pcie_rx_alloc_page(struct iwl_trans *trans)
  * iwl_pcie_rxq_restock. The latter function will update the HW to use the newly
  * allocated buffers.
  */
-static void iwl_pcie_rxq_alloc_rbs(struct iwl_trans *trans)
+static void iwl_pcie_rxq_alloc_rbs(struct iwl_trans *trans, gfp_t priority)
 {
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         struct iwl_rxq *rxq = &trans_pcie->rxq;
         struct iwl_rx_mem_buffer *rxb;
         struct page *page;
+        gfp_t gfp_mask = priority;
 
         while (1) {
                 spin_lock(&rxq->lock);
@@ -339,10 +279,32 @@ static void iwl_pcie_rxq_alloc_rbs(struct iwl_trans *trans)
                 }
                 spin_unlock(&rxq->lock);
 
+                if (rxq->free_count > RX_LOW_WATERMARK)
+                        gfp_mask |= __GFP_NOWARN;
+
+                if (trans_pcie->rx_page_order > 0)
+                        gfp_mask |= __GFP_COMP;
+
                 /* Alloc a new receive buffer */
-                page = iwl_pcie_rx_alloc_page(trans);
-                if (!page)
+                page = alloc_pages(gfp_mask, trans_pcie->rx_page_order);
+                if (!page) {
+                        if (net_ratelimit())
+                                IWL_DEBUG_INFO(trans, "alloc_pages failed, "
+                                           "order: %d\n",
+                                           trans_pcie->rx_page_order);
+
+                        if ((rxq->free_count <= RX_LOW_WATERMARK) &&
+                            net_ratelimit())
+                                IWL_CRIT(trans, "Failed to alloc_pages with %s."
+                                         "Only %u free buffers remaining.\n",
+                                         priority == GFP_ATOMIC ?
+                                         "GFP_ATOMIC" : "GFP_KERNEL",
+                                         rxq->free_count);
+                        /* We don't reschedule replenish work here -- we will
+                         * call the restock method and if it still needs
+                         * more buffers it will schedule replenish */
                         return;
+                }
 
                 spin_lock(&rxq->lock);
 
@@ -393,7 +355,7 @@ static void iwl_pcie_rxq_free_rbs(struct iwl_trans *trans)
 
         lockdep_assert_held(&rxq->lock);
 
-        for (i = 0; i < RX_QUEUE_SIZE; i++) {
+        for (i = 0; i < RX_FREE_BUFFERS + RX_QUEUE_SIZE; i++) {
                 if (!rxq->pool[i].page)
                         continue;
                 dma_unmap_page(trans->dev, rxq->pool[i].page_dma,
@@ -410,144 +372,32 @@ static void iwl_pcie_rxq_free_rbs(struct iwl_trans *trans)
  * When moving to rx_free an page is allocated for the slot.
  *
  * Also restock the Rx queue via iwl_pcie_rxq_restock.
- * This is called only during initialization
+ * This is called as a scheduled work item (except for during initialization)
  */
-static void iwl_pcie_rx_replenish(struct iwl_trans *trans)
+static void iwl_pcie_rx_replenish(struct iwl_trans *trans, gfp_t gfp)
 {
-        iwl_pcie_rxq_alloc_rbs(trans);
+        iwl_pcie_rxq_alloc_rbs(trans, gfp);
 
         iwl_pcie_rxq_restock(trans);
 }
 
-/*
- * iwl_pcie_rx_allocator - Allocates pages in the background for RX queues
- *
- * Allocates for each received request 8 pages
- * Called as a scheduled work item.
- */
-static void iwl_pcie_rx_allocator(struct iwl_trans *trans)
-{
-        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-        struct iwl_rb_allocator *rba = &trans_pcie->rba;
-
-        while (atomic_read(&rba->req_pending)) {
-                int i;
-                struct list_head local_empty;
-                struct list_head local_allocated;
-
-                INIT_LIST_HEAD(&local_allocated);
-                spin_lock(&rba->lock);
-                /* swap out the entire rba->rbd_empty to a local list */
-                list_replace_init(&rba->rbd_empty, &local_empty);
-                spin_unlock(&rba->lock);
-
-                for (i = 0; i < RX_CLAIM_REQ_ALLOC;) {
-                        struct iwl_rx_mem_buffer *rxb;
-                        struct page *page;
-
-                        /* List should never be empty - each reused RBD is
-                         * returned to the list, and initial pool covers any
-                         * possible gap between the time the page is allocated
-                         * to the time the RBD is added.
-                         */
-                        BUG_ON(list_empty(&local_empty));
-                        /* Get the first rxb from the rbd list */
-                        rxb = list_first_entry(&local_empty,
-                                               struct iwl_rx_mem_buffer, list);
-                        BUG_ON(rxb->page);
-
-                        /* Alloc a new receive buffer */
-                        page = iwl_pcie_rx_alloc_page(trans);
-                        if (!page)
-                                continue;
-                        rxb->page = page;
-
-                        /* Get physical address of the RB */
-                        rxb->page_dma = dma_map_page(trans->dev, page, 0,
-                                        PAGE_SIZE << trans_pcie->rx_page_order,
-                                        DMA_FROM_DEVICE);
-                        if (dma_mapping_error(trans->dev, rxb->page_dma)) {
-                                rxb->page = NULL;
-                                __free_pages(page, trans_pcie->rx_page_order);
-                                continue;
-                        }
-                        /* dma address must be no more than 36 bits */
-                        BUG_ON(rxb->page_dma & ~DMA_BIT_MASK(36));
-                        /* and also 256 byte aligned! */
-                        BUG_ON(rxb->page_dma & DMA_BIT_MASK(8));
-
-                        /* move the allocated entry to the out list */
-                        list_move(&rxb->list, &local_allocated);
-                        i++;
-                }
-
-                spin_lock(&rba->lock);
-                /* add the allocated rbds to the allocator allocated list */
-                list_splice_tail(&local_allocated, &rba->rbd_allocated);
-                /* add the unused rbds back to the allocator empty list */
-                list_splice_tail(&local_empty, &rba->rbd_empty);
-                spin_unlock(&rba->lock);
-
-                atomic_dec(&rba->req_pending);
-                atomic_inc(&rba->req_ready);
-        }
-}
-
-/*
- * iwl_pcie_rx_allocator_get - Returns the pre-allocated pages
-.*
-.* Called by queue when the queue posted allocation request and
- * has freed 8 RBDs in order to restock itself.
- */
-static int iwl_pcie_rx_allocator_get(struct iwl_trans *trans,
-                                     struct iwl_rx_mem_buffer
-                                     *out[RX_CLAIM_REQ_ALLOC])
-{
-        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-        struct iwl_rb_allocator *rba = &trans_pcie->rba;
-        int i;
-
-        if (atomic_dec_return(&rba->req_ready) < 0) {
-                atomic_inc(&rba->req_ready);
-                IWL_DEBUG_RX(trans,
-                             "Allocation request not ready, pending requests = %d\n",
-                             atomic_read(&rba->req_pending));
-                return -ENOMEM;
-        }
-
-        spin_lock(&rba->lock);
-        for (i = 0; i < RX_CLAIM_REQ_ALLOC; i++) {
-                /* Get next free Rx buffer, remove it from free list */
-                out[i] = list_first_entry(&rba->rbd_allocated,
-                               struct iwl_rx_mem_buffer, list);
-                list_del(&out[i]->list);
-        }
-        spin_unlock(&rba->lock);
-
-        return 0;
-}
-
-static void iwl_pcie_rx_allocator_work(struct work_struct *data)
+static void iwl_pcie_rx_replenish_work(struct work_struct *data)
 {
-        struct iwl_rb_allocator *rba_p =
-                container_of(data, struct iwl_rb_allocator, rx_alloc);
         struct iwl_trans_pcie *trans_pcie =
-                container_of(rba_p, struct iwl_trans_pcie, rba);
+            container_of(data, struct iwl_trans_pcie, rx_replenish);
 
-        iwl_pcie_rx_allocator(trans_pcie->trans);
+        iwl_pcie_rx_replenish(trans_pcie->trans, GFP_KERNEL);
 }
 
 static int iwl_pcie_rx_alloc(struct iwl_trans *trans)
 {
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         struct iwl_rxq *rxq = &trans_pcie->rxq;
-        struct iwl_rb_allocator *rba = &trans_pcie->rba;
         struct device *dev = trans->dev;
 
         memset(&trans_pcie->rxq, 0, sizeof(trans_pcie->rxq));
 
         spin_lock_init(&rxq->lock);
-        spin_lock_init(&rba->lock);
 
         if (WARN_ON(rxq->bd || rxq->rb_stts))
                 return -EINVAL;
@@ -637,49 +487,15 @@ static void iwl_pcie_rx_init_rxb_lists(struct iwl_rxq *rxq)
         INIT_LIST_HEAD(&rxq->rx_free);
         INIT_LIST_HEAD(&rxq->rx_used);
         rxq->free_count = 0;
-        rxq->used_count = 0;
 
-        for (i = 0; i < RX_QUEUE_SIZE; i++)
+        for (i = 0; i < RX_FREE_BUFFERS + RX_QUEUE_SIZE; i++)
                 list_add(&rxq->pool[i].list, &rxq->rx_used);
 }
 
-static void iwl_pcie_rx_init_rba(struct iwl_rb_allocator *rba)
-{
-        int i;
-
-        lockdep_assert_held(&rba->lock);
-
-        INIT_LIST_HEAD(&rba->rbd_allocated);
-        INIT_LIST_HEAD(&rba->rbd_empty);
-
-        for (i = 0; i < RX_POOL_SIZE; i++)
-                list_add(&rba->pool[i].list, &rba->rbd_empty);
-}
-
-static void iwl_pcie_rx_free_rba(struct iwl_trans *trans)
-{
-        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-        struct iwl_rb_allocator *rba = &trans_pcie->rba;
-        int i;
-
-        lockdep_assert_held(&rba->lock);
-
-        for (i = 0; i < RX_POOL_SIZE; i++) {
-                if (!rba->pool[i].page)
-                        continue;
-                dma_unmap_page(trans->dev, rba->pool[i].page_dma,
-                               PAGE_SIZE << trans_pcie->rx_page_order,
-                               DMA_FROM_DEVICE);
-                __free_pages(rba->pool[i].page, trans_pcie->rx_page_order);
-                rba->pool[i].page = NULL;
-        }
-}
-
 int iwl_pcie_rx_init(struct iwl_trans *trans)
 {
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         struct iwl_rxq *rxq = &trans_pcie->rxq;
-        struct iwl_rb_allocator *rba = &trans_pcie->rba;
         int i, err;
 
         if (!rxq->bd) {
@@ -687,21 +503,11 @@ int iwl_pcie_rx_init(struct iwl_trans *trans)
                 if (err)
                         return err;
         }
-        if (!rba->alloc_wq)
-                rba->alloc_wq = alloc_workqueue("rb_allocator",
-                                                WQ_HIGHPRI | WQ_UNBOUND, 1);
-        INIT_WORK(&rba->rx_alloc, iwl_pcie_rx_allocator_work);
-
-        spin_lock(&rba->lock);
-        atomic_set(&rba->req_pending, 0);
-        atomic_set(&rba->req_ready, 0);
-        /* free all first - we might be reconfigured for a different size */
-        iwl_pcie_rx_free_rba(trans);
-        iwl_pcie_rx_init_rba(rba);
-        spin_unlock(&rba->lock);
 
         spin_lock(&rxq->lock);
 
+        INIT_WORK(&trans_pcie->rx_replenish, iwl_pcie_rx_replenish_work);
+
         /* free all first - we might be reconfigured for a different size */
         iwl_pcie_rxq_free_rbs(trans);
         iwl_pcie_rx_init_rxb_lists(rxq);
@@ -716,7 +522,7 @@ int iwl_pcie_rx_init(struct iwl_trans *trans)
         memset(rxq->rb_stts, 0, sizeof(*rxq->rb_stts));
         spin_unlock(&rxq->lock);
 
-        iwl_pcie_rx_replenish(trans);
+        iwl_pcie_rx_replenish(trans, GFP_KERNEL);
 
         iwl_pcie_rx_hw_init(trans, rxq);
 
@@ -731,7 +537,6 @@ void iwl_pcie_rx_free(struct iwl_trans *trans)
 {
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         struct iwl_rxq *rxq = &trans_pcie->rxq;
-        struct iwl_rb_allocator *rba = &trans_pcie->rba;
 
         /*if rxq->bd is NULL, it means that nothing has been allocated,
          * exit now */
@@ -740,15 +545,7 @@ void iwl_pcie_rx_free(struct iwl_trans *trans)
                 return;
         }
 
-        cancel_work_sync(&rba->rx_alloc);
-        if (rba->alloc_wq) {
-                destroy_workqueue(rba->alloc_wq);
-                rba->alloc_wq = NULL;
-        }
-
-        spin_lock(&rba->lock);
-        iwl_pcie_rx_free_rba(trans);
-        spin_unlock(&rba->lock);
+        cancel_work_sync(&trans_pcie->rx_replenish);
 
         spin_lock(&rxq->lock);
         iwl_pcie_rxq_free_rbs(trans);
@@ -769,43 +566,6 @@ void iwl_pcie_rx_free(struct iwl_trans *trans)
         rxq->rb_stts = NULL;
 }
 
-/*
- * iwl_pcie_rx_reuse_rbd - Recycle used RBDs
- *
- * Called when a RBD can be reused. The RBD is transferred to the allocator.
- * When there are 2 empty RBDs - a request for allocation is posted
- */
-static void iwl_pcie_rx_reuse_rbd(struct iwl_trans *trans,
-                                  struct iwl_rx_mem_buffer *rxb,
-                                  struct iwl_rxq *rxq)
-{
-        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-        struct iwl_rb_allocator *rba = &trans_pcie->rba;
-
-        /* Count the used RBDs */
-        rxq->used_count++;
-
-        /* Move the RBD to the used list, will be moved to allocator in batches
-         * before claiming or posting a request*/
-        list_add_tail(&rxb->list, &rxq->rx_used);
-
-        /* If we have RX_POST_REQ_ALLOC new released rx buffers -
-         * issue a request for allocator. Modulo RX_CLAIM_REQ_ALLOC is
-         * used for the case we failed to claim RX_CLAIM_REQ_ALLOC,
-         * after but we still need to post another request.
-         */
-        if ((rxq->used_count % RX_CLAIM_REQ_ALLOC) == RX_POST_REQ_ALLOC) {
-                /* Move the 2 RBDs to the allocator ownership.
-                 Allocator has another 6 from pool for the request completion*/
-                spin_lock(&rba->lock);
-                list_splice_tail_init(&rxq->rx_used, &rba->rbd_empty);
-                spin_unlock(&rba->lock);
-
-                atomic_inc(&rba->req_pending);
-                queue_work(rba->alloc_wq, &rba->rx_alloc);
-        }
-}
-
 static void iwl_pcie_rx_handle_rb(struct iwl_trans *trans,
                                 struct iwl_rx_mem_buffer *rxb)
 {
@@ -928,13 +688,13 @@ static void iwl_pcie_rx_handle_rb(struct iwl_trans *trans,
                          */
                         __free_pages(rxb->page, trans_pcie->rx_page_order);
                         rxb->page = NULL;
-                        iwl_pcie_rx_reuse_rbd(trans, rxb, rxq);
+                        list_add_tail(&rxb->list, &rxq->rx_used);
                 } else {
                         list_add_tail(&rxb->list, &rxq->rx_free);
                         rxq->free_count++;
                 }
         } else
-                iwl_pcie_rx_reuse_rbd(trans, rxb, rxq);
+                list_add_tail(&rxb->list, &rxq->rx_used);
 }
 
 /*
@@ -944,7 +704,10 @@ static void iwl_pcie_rx_handle(struct iwl_trans *trans)
 {
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         struct iwl_rxq *rxq = &trans_pcie->rxq;
-        u32 r, i, j;
+        u32 r, i;
+        u8 fill_rx = 0;
+        u32 count = 8;
+        int total_empty;
 
 restart:
         spin_lock(&rxq->lock);
@@ -957,6 +720,14 @@ restart:
         if (i == r)
                 IWL_DEBUG_RX(trans, "HW = SW = %d\n", r);
 
+        /* calculate total frames need to be restock after handling RX */
+        total_empty = r - rxq->write_actual;
+        if (total_empty < 0)
+                total_empty += RX_QUEUE_SIZE;
+
+        if (total_empty > (RX_QUEUE_SIZE / 2))
+                fill_rx = 1;
+
         while (i != r) {
                 struct iwl_rx_mem_buffer *rxb;
 
@@ -968,48 +739,29 @@ restart:
                 iwl_pcie_rx_handle_rb(trans, rxb);
 
                 i = (i + 1) & RX_QUEUE_MASK;
-
-                /* If we have RX_CLAIM_REQ_ALLOC released rx buffers -
-                 * try to claim the pre-allocated buffers from the allocator */
-                if (rxq->used_count >= RX_CLAIM_REQ_ALLOC) {
-                        struct iwl_rb_allocator *rba = &trans_pcie->rba;
-                        struct iwl_rx_mem_buffer *out[RX_CLAIM_REQ_ALLOC];
-
-                        /* Add the remaining 6 empty RBDs for allocator use */
-                        spin_lock(&rba->lock);
-                        list_splice_tail_init(&rxq->rx_used, &rba->rbd_empty);
-                        spin_unlock(&rba->lock);
-
-                        /* If not ready - continue, will try to reclaim later.
-                        * No need to reschedule work - allocator exits only on
-                        * success */
-                        if (!iwl_pcie_rx_allocator_get(trans, out)) {
-                                /* If success - then RX_CLAIM_REQ_ALLOC
-                                 * buffers were retrieved and should be added
-                                 * to free list */
-                                rxq->used_count -= RX_CLAIM_REQ_ALLOC;
-                                for (j = 0; j < RX_CLAIM_REQ_ALLOC; j++) {
-                                        list_add_tail(&out[j]->list,
-                                                      &rxq->rx_free);
-                                        rxq->free_count++;
-                                }
+                /* If there are a lot of unused frames,
+                 * restock the Rx queue so ucode wont assert. */
+                if (fill_rx) {
+                        count++;
+                        if (count >= 8) {
+                                rxq->read = i;
+                                spin_unlock(&rxq->lock);
+                                iwl_pcie_rx_replenish(trans, GFP_ATOMIC);
+                                count = 0;
+                                goto restart;
                         }
                 }
-                /* handle restock for two cases:
-                * - we just pulled buffers from the allocator
-                * - we have 8+ unstolen pages accumulated */
-                if (rxq->free_count >=  RX_CLAIM_REQ_ALLOC) {
-                        rxq->read = i;
-                        spin_unlock(&rxq->lock);
-                        iwl_pcie_rxq_restock(trans);
-                        goto restart;
-                }
         }
 
         /* Backtrack one entry */
         rxq->read = i;
         spin_unlock(&rxq->lock);
 
+        if (fill_rx)
+                iwl_pcie_rx_replenish(trans, GFP_ATOMIC);
+        else
+                iwl_pcie_rxq_restock(trans);
+
         if (trans_pcie->napi.poll)
                 napi_gro_flush(&trans_pcie->napi, false);
 }
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index 43ae658af6ec..6203c4ad9bba 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -182,7 +182,7 @@ static void iwl_trans_pcie_write_shr(struct iwl_trans *trans, u32 reg, u32 val)
 
 static void iwl_pcie_set_pwr(struct iwl_trans *trans, bool vaux)
 {
-        if (!trans->cfg->apmg_not_supported)
+        if (trans->cfg->apmg_not_supported)
                 return;
 
         if (vaux && pci_pme_capable(to_pci_dev(trans->dev), PCI_D3cold))
@@ -2459,7 +2459,7 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
         struct iwl_trans_pcie *trans_pcie;
         struct iwl_trans *trans;
         u16 pci_cmd;
-        int err;
+        int ret;
 
         trans = iwl_trans_alloc(sizeof(struct iwl_trans_pcie),
                                 &pdev->dev, cfg, &trans_ops_pcie, 0);
@@ -2474,8 +2474,8 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
         spin_lock_init(&trans_pcie->ref_lock);
         init_waitqueue_head(&trans_pcie->ucode_write_waitq);
 
-        err = pci_enable_device(pdev);
-        if (err)
+        ret = pci_enable_device(pdev);
+        if (ret)
                 goto out_no_pci;
 
         if (!cfg->base_params->pcie_l1_allowed) {
@@ -2491,23 +2491,23 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
 
         pci_set_master(pdev);
 
-        err = pci_set_dma_mask(pdev, DMA_BIT_MASK(36));
-        if (!err)
-                err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(36));
-        if (err) {
-                err = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
-                if (!err)
-                        err = pci_set_consistent_dma_mask(pdev,
+        ret = pci_set_dma_mask(pdev, DMA_BIT_MASK(36));
+        if (!ret)
+                ret = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(36));
+        if (ret) {
+                ret = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
+                if (!ret)
+                        ret = pci_set_consistent_dma_mask(pdev,
                                                           DMA_BIT_MASK(32));
                 /* both attempts failed: */
-                if (err) {
+                if (ret) {
                         dev_err(&pdev->dev, "No suitable DMA available\n");
                         goto out_pci_disable_device;
                 }
         }
 
-        err = pci_request_regions(pdev, DRV_NAME);
-        if (err) {
+        ret = pci_request_regions(pdev, DRV_NAME);
+        if (ret) {
                 dev_err(&pdev->dev, "pci_request_regions failed\n");
                 goto out_pci_disable_device;
         }
@@ -2515,7 +2515,7 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
         trans_pcie->hw_base = pci_ioremap_bar(pdev, 0);
         if (!trans_pcie->hw_base) {
                 dev_err(&pdev->dev, "pci_ioremap_bar failed\n");
-                err = -ENODEV;
+                ret = -ENODEV;
                 goto out_pci_release_regions;
         }
 
@@ -2527,9 +2527,9 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
         trans_pcie->pci_dev = pdev;
         iwl_disable_interrupts(trans);
 
-        err = pci_enable_msi(pdev);
-        if (err) {
-                dev_err(&pdev->dev, "pci_enable_msi failed(0X%x)\n", err);
+        ret = pci_enable_msi(pdev);
+        if (ret) {
+                dev_err(&pdev->dev, "pci_enable_msi failed(0X%x)\n", ret);
                 /* enable rfkill interrupt: hw bug w/a */
                 pci_read_config_word(pdev, PCI_COMMAND, &pci_cmd);
                 if (pci_cmd & PCI_COMMAND_INTX_DISABLE) {
@@ -2547,11 +2547,16 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
          */
         if (trans->cfg->device_family == IWL_DEVICE_FAMILY_8000) {
                 unsigned long flags;
-                int ret;
 
                 trans->hw_rev = (trans->hw_rev & 0xfff0) |
                                 (CSR_HW_REV_STEP(trans->hw_rev << 2) << 2);
 
+                ret = iwl_pcie_prepare_card_hw(trans);
+                if (ret) {
+                        IWL_WARN(trans, "Exit HW not ready\n");
+                        goto out_pci_disable_msi;
+                }
+
                 /*
                  * in-order to recognize C step driver should read chip version
                  * id located at the AUX bus MISC address space.
@@ -2591,13 +2596,14 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
         /* Initialize the wait queue for commands */
         init_waitqueue_head(&trans_pcie->wait_command_queue);
 
-        if (iwl_pcie_alloc_ict(trans))
+        ret = iwl_pcie_alloc_ict(trans);
+        if (ret)
                 goto out_pci_disable_msi;
 
-        err = request_threaded_irq(pdev->irq, iwl_pcie_isr,
+        ret = request_threaded_irq(pdev->irq, iwl_pcie_isr,
                                    iwl_pcie_irq_handler,
                                    IRQF_SHARED, DRV_NAME, trans);
-        if (err) {
+        if (ret) {
                 IWL_ERR(trans, "Error allocating IRQ %d\n", pdev->irq);
                 goto out_free_ict;
         }
@@ -2617,5 +2623,5 @@ out_pci_disable_device:
         pci_disable_device(pdev);
 out_no_pci:
         iwl_trans_free(trans);
-        return ERR_PTR(err);
+        return ERR_PTR(ret);
 }
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index 880d0d63e872..7d50711476fe 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -1566,13 +1566,13 @@ static inline void xenvif_tx_dealloc_action(struct xenvif_queue *queue)
                 smp_rmb();
 
                 while (dc != dp) {
-                        BUG_ON(gop - queue->tx_unmap_ops > MAX_PENDING_REQS);
+                        BUG_ON(gop - queue->tx_unmap_ops >= MAX_PENDING_REQS);
                         pending_idx =
                                 queue->dealloc_ring[pending_index(dc++)];
 
-                        pending_idx_release[gop-queue->tx_unmap_ops] =
+                        pending_idx_release[gop - queue->tx_unmap_ops] =
                                 pending_idx;
-                        queue->pages_to_unmap[gop-queue->tx_unmap_ops] =
+                        queue->pages_to_unmap[gop - queue->tx_unmap_ops] =
                                 queue->mmap_pages[pending_idx];
                         gnttab_set_unmap_op(gop,
                                             idx_to_kaddr(queue, pending_idx),
diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c
index 8eb22c0ca7ce..7e2c43f701bc 100644
--- a/drivers/nvdimm/bus.c
+++ b/drivers/nvdimm/bus.c
@@ -535,8 +535,6 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
                                         __func__, dimm_name, cmd_name, i);
                         return -ENXIO;
                 }
-                if (!access_ok(VERIFY_READ, p + in_len, in_size))
-                        return -EFAULT;
                 if (in_len < sizeof(in_env))
                         copy = min_t(u32, sizeof(in_env) - in_len, in_size);
                 else
@@ -557,8 +555,6 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
                                         __func__, dimm_name, cmd_name, i);
                         return -EFAULT;
                 }
-                if (!access_ok(VERIFY_WRITE, p + in_len + out_len, out_size))
-                        return -EFAULT;
                 if (out_len < sizeof(out_env))
                         copy = min_t(u32, sizeof(out_env) - out_len, out_size);
                 else
@@ -570,9 +566,6 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
         }
 
         buf_len = out_len + in_len;
-        if (!access_ok(VERIFY_WRITE, p, sizeof(buf_len)))
-                return -EFAULT;
-
         if (buf_len > ND_IOCTL_MAX_BUFLEN) {
                 dev_dbg(dev, "%s:%s cmd: %s buf_len: %zu > %d\n", __func__,
                                 dimm_name, cmd_name, buf_len,
@@ -706,8 +699,10 @@ int __init nvdimm_bus_init(void)
         nvdimm_major = rc;
 
         nd_class = class_create(THIS_MODULE, "nd");
-        if (IS_ERR(nd_class))
+        if (IS_ERR(nd_class)) {
+                rc = PTR_ERR(nd_class);
                 goto err_class;
+        }
 
         return 0;
 
diff --git a/drivers/nvdimm/region_devs.c b/drivers/nvdimm/region_devs.c
index a5233422f9dc..7384455792bf 100644
--- a/drivers/nvdimm/region_devs.c
+++ b/drivers/nvdimm/region_devs.c
@@ -458,10 +458,15 @@ static void nd_region_notify_driver_action(struct nvdimm_bus *nvdimm_bus,
                 nvdimm_bus_unlock(dev);
         }
         if (is_nd_btt(dev) && probe) {
+                struct nd_btt *nd_btt = to_nd_btt(dev);
+
                 nd_region = to_nd_region(dev->parent);
                 nvdimm_bus_lock(dev);
                 if (nd_region->btt_seed == dev)
                         nd_region_create_btt_seed(nd_region);
+                if (nd_region->ns_seed == &nd_btt->ndns->dev &&
+                                is_nd_blk(dev->parent))
+                        nd_region_create_blk_seed(nd_region);
                 nvdimm_bus_unlock(dev);
         }
 }
diff --git a/drivers/parport/share.c b/drivers/parport/share.c
index 8067f54ce050..5ce5ef211bdb 100644
--- a/drivers/parport/share.c
+++ b/drivers/parport/share.c
@@ -891,8 +891,10 @@ parport_register_dev_model(struct parport *port, const char *name,
         par_dev->dev.release = free_pardevice;
         par_dev->devmodel = true;
         ret = device_register(&par_dev->dev);
-        if (ret)
-                goto err_put_dev;
+        if (ret) {
+                put_device(&par_dev->dev);
+                goto err_put_port;
+        }
 
         /* Chain this onto the list */
         par_dev->prev = NULL;
@@ -907,7 +909,8 @@ parport_register_dev_model(struct parport *port, const char *name,
                         spin_unlock(&port->physport->pardevice_lock);
                         pr_debug("%s: cannot grant exclusive access for device %s\n",
                                  port->name, name);
-                        goto err_put_dev;
+                        device_unregister(&par_dev->dev);
+                        goto err_put_port;
                 }
                 port->flags |= PARPORT_FLAG_EXCL;
         }
@@ -938,8 +941,6 @@ parport_register_dev_model(struct parport *port, const char *name,
 
         return par_dev;
 
-err_put_dev:
-        put_device(&par_dev->dev);
 err_free_devname:
         kfree(devname);
 err_free_par_dev:
diff --git a/drivers/phy/Kconfig b/drivers/phy/Kconfig
index c0e6ede3e27d..6b8dd162f644 100644
--- a/drivers/phy/Kconfig
+++ b/drivers/phy/Kconfig
@@ -56,6 +56,7 @@ config PHY_EXYNOS_MIPI_VIDEO
 
 config PHY_PXA_28NM_HSIC
         tristate "Marvell USB HSIC 28nm PHY Driver"
+        depends on HAS_IOMEM
         select GENERIC_PHY
         help
           Enable this to support Marvell USB HSIC PHY driver for Marvell
@@ -66,6 +67,7 @@ config PHY_PXA_28NM_HSIC
 
 config PHY_PXA_28NM_USB2
         tristate "Marvell USB 2.0 28nm PHY Driver"
+        depends on HAS_IOMEM
         select GENERIC_PHY
         help
           Enable this to support Marvell USB 2.0 PHY driver for Marvell
diff --git a/drivers/phy/phy-berlin-usb.c b/drivers/phy/phy-berlin-usb.c
index c6fc95b53083..335e06d66ed9 100644
--- a/drivers/phy/phy-berlin-usb.c
+++ b/drivers/phy/phy-berlin-usb.c
@@ -105,9 +105,9 @@
 
 static const u32 phy_berlin_pll_dividers[] = {
         /* Berlin 2 */
-        CLK_REF_DIV(0xc) | FEEDBACK_CLK_DIV(0x54),
-        /* Berlin 2CD */
         CLK_REF_DIV(0x6) | FEEDBACK_CLK_DIV(0x55),
+        /* Berlin 2CD/Q */
+        CLK_REF_DIV(0xc) | FEEDBACK_CLK_DIV(0x54),
 };
 
 struct phy_berlin_usb_priv {
diff --git a/drivers/phy/phy-ti-pipe3.c b/drivers/phy/phy-ti-pipe3.c
index 53f295c1bab1..3510b81db3fa 100644
--- a/drivers/phy/phy-ti-pipe3.c
+++ b/drivers/phy/phy-ti-pipe3.c
@@ -28,7 +28,6 @@
 #include <linux/delay.h>
 #include <linux/phy/omap_control_phy.h>
 #include <linux/of_platform.h>
-#include <linux/spinlock.h>
 
 #define PLL_STATUS              0x00000004
 #define PLL_GO                  0x00000008
@@ -83,10 +82,6 @@ struct ti_pipe3 {
         struct clk              *refclk;
         struct clk              *div_clk;
         struct pipe3_dpll_map   *dpll_map;
-        bool                    enabled;
-        spinlock_t              lock;   /* serialize clock enable/disable */
-        /* the below flag is needed specifically for SATA */
-        bool                    refclk_enabled;
 };
 
 static struct pipe3_dpll_map dpll_map_usb[] = {
@@ -137,6 +132,9 @@ static struct pipe3_dpll_params *ti_pipe3_get_dpll_params(struct ti_pipe3 *phy)
         return NULL;
 }
 
+static int ti_pipe3_enable_clocks(struct ti_pipe3 *phy);
+static void ti_pipe3_disable_clocks(struct ti_pipe3 *phy);
+
 static int ti_pipe3_power_off(struct phy *x)
 {
         struct ti_pipe3 *phy = phy_get_drvdata(x);
@@ -217,6 +215,7 @@ static int ti_pipe3_init(struct phy *x)
         u32 val;
         int ret = 0;
 
+        ti_pipe3_enable_clocks(phy);
         /*
          * Set pcie_pcs register to 0x96 for proper functioning of phy
          * as recommended in AM572x TRM SPRUHZ6, section 18.5.2.2, table
@@ -250,33 +249,35 @@ static int ti_pipe3_exit(struct phy *x)
         u32 val;
         unsigned long timeout;
 
-        /* SATA DPLL can't be powered down due to Errata i783 and PCIe
-         * does not have internal DPLL
-         */
-        if (of_device_is_compatible(phy->dev->of_node, "ti,phy-pipe3-sata") ||
-            of_device_is_compatible(phy->dev->of_node, "ti,phy-pipe3-pcie"))
+        /* SATA DPLL can't be powered down due to Errata i783 */
+        if (of_device_is_compatible(phy->dev->of_node, "ti,phy-pipe3-sata"))
                 return 0;
 
-        /* Put DPLL in IDLE mode */
-        val = ti_pipe3_readl(phy->pll_ctrl_base, PLL_CONFIGURATION2);
-        val |= PLL_IDLE;
-        ti_pipe3_writel(phy->pll_ctrl_base, PLL_CONFIGURATION2, val);
-
-        /* wait for LDO and Oscillator to power down */
-        timeout = jiffies + msecs_to_jiffies(PLL_IDLE_TIME);
-        do {
-                cpu_relax();
-                val = ti_pipe3_readl(phy->pll_ctrl_base, PLL_STATUS);
-                if ((val & PLL_TICOPWDN) && (val & PLL_LDOPWDN))
-                        break;
-        } while (!time_after(jiffies, timeout));
+        /* PCIe doesn't have internal DPLL */
+        if (!of_device_is_compatible(phy->dev->of_node, "ti,phy-pipe3-pcie")) {
+                /* Put DPLL in IDLE mode */
+                val = ti_pipe3_readl(phy->pll_ctrl_base, PLL_CONFIGURATION2);
+                val |= PLL_IDLE;
+                ti_pipe3_writel(phy->pll_ctrl_base, PLL_CONFIGURATION2, val);
 
-        if (!(val & PLL_TICOPWDN) || !(val & PLL_LDOPWDN)) {
-                dev_err(phy->dev, "Failed to power down: PLL_STATUS 0x%x\n",
-                        val);
-                return -EBUSY;
+                /* wait for LDO and Oscillator to power down */
+                timeout = jiffies + msecs_to_jiffies(PLL_IDLE_TIME);
+                do {
+                        cpu_relax();
+                        val = ti_pipe3_readl(phy->pll_ctrl_base, PLL_STATUS);
+                        if ((val & PLL_TICOPWDN) && (val & PLL_LDOPWDN))
+                                break;
+                } while (!time_after(jiffies, timeout));
+
+                if (!(val & PLL_TICOPWDN) || !(val & PLL_LDOPWDN)) {
+                        dev_err(phy->dev, "Failed to power down: PLL_STATUS 0x%x\n",
+                                val);
+                        return -EBUSY;
+                }
         }
 
+        ti_pipe3_disable_clocks(phy);
+
         return 0;
 }
 static struct phy_ops ops = {
@@ -306,7 +307,6 @@ static int ti_pipe3_probe(struct platform_device *pdev)
                 return -ENOMEM;
 
         phy->dev                = &pdev->dev;
-        spin_lock_init(&phy->lock);
 
         if (!of_device_is_compatible(node, "ti,phy-pipe3-pcie")) {
                 match = of_match_device(ti_pipe3_id_table, &pdev->dev);
@@ -402,6 +402,10 @@ static int ti_pipe3_probe(struct platform_device *pdev)
 
         platform_set_drvdata(pdev, phy);
         pm_runtime_enable(phy->dev);
+        /* Prevent auto-disable of refclk for SATA PHY due to Errata i783 */
+        if (of_device_is_compatible(node, "ti,phy-pipe3-sata"))
+                if (!IS_ERR(phy->refclk))
+                        clk_prepare_enable(phy->refclk);
 
         generic_phy = devm_phy_create(phy->dev, NULL, &ops);
         if (IS_ERR(generic_phy))
@@ -413,63 +417,33 @@ static int ti_pipe3_probe(struct platform_device *pdev)
         if (IS_ERR(phy_provider))
                 return PTR_ERR(phy_provider);
 
-        pm_runtime_get(&pdev->dev);
-
         return 0;
 }
 
 static int ti_pipe3_remove(struct platform_device *pdev)
 {
-        if (!pm_runtime_suspended(&pdev->dev))
-                pm_runtime_put(&pdev->dev);
         pm_runtime_disable(&pdev->dev);
 
         return 0;
 }
 
-#ifdef CONFIG_PM
-static int ti_pipe3_enable_refclk(struct ti_pipe3 *phy)
+static int ti_pipe3_enable_clocks(struct ti_pipe3 *phy)
 {
-        if (!IS_ERR(phy->refclk) && !phy->refclk_enabled) {
-                int ret;
+        int ret = 0;
 
+        if (!IS_ERR(phy->refclk)) {
                 ret = clk_prepare_enable(phy->refclk);
                 if (ret) {
                         dev_err(phy->dev, "Failed to enable refclk %d\n", ret);
                         return ret;
                 }
-                phy->refclk_enabled = true;
         }
 
-        return 0;
-}
-
-static void ti_pipe3_disable_refclk(struct ti_pipe3 *phy)
-{
-        if (!IS_ERR(phy->refclk))
-                clk_disable_unprepare(phy->refclk);
-
-        phy->refclk_enabled = false;
-}
-
-static int ti_pipe3_enable_clocks(struct ti_pipe3 *phy)
-{
-        int ret = 0;
-        unsigned long flags;
-
-        spin_lock_irqsave(&phy->lock, flags);
-        if (phy->enabled)
-                goto err1;
-
-        ret = ti_pipe3_enable_refclk(phy);
-        if (ret)
-                goto err1;
-
         if (!IS_ERR(phy->wkupclk)) {
                 ret = clk_prepare_enable(phy->wkupclk);
                 if (ret) {
                         dev_err(phy->dev, "Failed to enable wkupclk %d\n", ret);
-                        goto err2;
+                        goto disable_refclk;
                 }
         }
 
@@ -477,96 +451,33 @@ static int ti_pipe3_enable_clocks(struct ti_pipe3 *phy)
                 ret = clk_prepare_enable(phy->div_clk);
                 if (ret) {
                         dev_err(phy->dev, "Failed to enable div_clk %d\n", ret);
-                        goto err3;
+                        goto disable_wkupclk;
                 }
         }
 
-        phy->enabled = true;
-        spin_unlock_irqrestore(&phy->lock, flags);
         return 0;
 
-err3:
+disable_wkupclk:
         if (!IS_ERR(phy->wkupclk))
                 clk_disable_unprepare(phy->wkupclk);
 
-err2:
+disable_refclk:
         if (!IS_ERR(phy->refclk))
                 clk_disable_unprepare(phy->refclk);
 
-        ti_pipe3_disable_refclk(phy);
-err1:
-        spin_unlock_irqrestore(&phy->lock, flags);
         return ret;
 }
 
 static void ti_pipe3_disable_clocks(struct ti_pipe3 *phy)
 {
-        unsigned long flags;
-
-        spin_lock_irqsave(&phy->lock, flags);
-        if (!phy->enabled) {
-                spin_unlock_irqrestore(&phy->lock, flags);
-                return;
-        }
-
         if (!IS_ERR(phy->wkupclk))
                 clk_disable_unprepare(phy->wkupclk);
-        /* Don't disable refclk for SATA PHY due to Errata i783 */
-        if (!of_device_is_compatible(phy->dev->of_node, "ti,phy-pipe3-sata"))
-                ti_pipe3_disable_refclk(phy);
+        if (!IS_ERR(phy->refclk))
+                clk_disable_unprepare(phy->refclk);
         if (!IS_ERR(phy->div_clk))
                 clk_disable_unprepare(phy->div_clk);
-        phy->enabled = false;
-        spin_unlock_irqrestore(&phy->lock, flags);
-}
-
-static int ti_pipe3_runtime_suspend(struct device *dev)
-{
-        struct ti_pipe3 *phy = dev_get_drvdata(dev);
-
-        ti_pipe3_disable_clocks(phy);
-        return 0;
 }
 
-static int ti_pipe3_runtime_resume(struct device *dev)
-{
-        struct ti_pipe3 *phy = dev_get_drvdata(dev);
-        int ret = 0;
-
-        ret = ti_pipe3_enable_clocks(phy);
-        return ret;
-}
-
-static int ti_pipe3_suspend(struct device *dev)
-{
-        struct ti_pipe3 *phy = dev_get_drvdata(dev);
-
-        ti_pipe3_disable_clocks(phy);
-        return 0;
-}
-
-static int ti_pipe3_resume(struct device *dev)
-{
-        struct ti_pipe3 *phy = dev_get_drvdata(dev);
-        int ret;
-
-        ret = ti_pipe3_enable_clocks(phy);
-        if (ret)
-                return ret;
-
-        pm_runtime_disable(dev);
-        pm_runtime_set_active(dev);
-        pm_runtime_enable(dev);
-        return 0;
-}
-#endif
-
-static const struct dev_pm_ops ti_pipe3_pm_ops = {
-        SET_RUNTIME_PM_OPS(ti_pipe3_runtime_suspend,
-                           ti_pipe3_runtime_resume, NULL)
-        SET_SYSTEM_SLEEP_PM_OPS(ti_pipe3_suspend, ti_pipe3_resume)
-};
-
 static const struct of_device_id ti_pipe3_id_table[] = {
         {
                 .compatible = "ti,phy-usb3",
@@ -592,7 +503,6 @@ static struct platform_driver ti_pipe3_driver = {
         .remove         = ti_pipe3_remove,
         .driver         = {
                 .name   = "ti-pipe3",
-                .pm     = &ti_pipe3_pm_ops,
                 .of_match_table = ti_pipe3_id_table,
         },
 };
diff --git a/drivers/pinctrl/bcm/pinctrl-bcm2835.c b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
index efcf2a2b3975..6177315ab74e 100644
--- a/drivers/pinctrl/bcm/pinctrl-bcm2835.c
+++ b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
@@ -473,6 +473,8 @@ static void bcm2835_gpio_irq_disable(struct irq_data *data)
 
         spin_lock_irqsave(&pc->irq_lock[bank], flags);
         bcm2835_gpio_irq_config(pc, gpio, false);
+        /* Clear events that were latched prior to clearing event sources */
+        bcm2835_gpio_set_bit(pc, GPEDS0, gpio);
         clear_bit(offset, &pc->enabled_irq_map[bank]);
         spin_unlock_irqrestore(&pc->irq_lock[bank], flags);
 }
diff --git a/drivers/pinctrl/freescale/pinctrl-imx1-core.c b/drivers/pinctrl/freescale/pinctrl-imx1-core.c
index 5fd4437cee15..88a7fac11bd4 100644
--- a/drivers/pinctrl/freescale/pinctrl-imx1-core.c
+++ b/drivers/pinctrl/freescale/pinctrl-imx1-core.c
@@ -403,14 +403,13 @@ static int imx1_pinconf_set(struct pinctrl_dev *pctldev,
                              unsigned num_configs)
 {
         struct imx1_pinctrl *ipctl = pinctrl_dev_get_drvdata(pctldev);
-        const struct imx1_pinctrl_soc_info *info = ipctl->info;
         int i;
 
         for (i = 0; i != num_configs; ++i) {
                 imx1_write_bit(ipctl, pin_id, configs[i] & 0x01, MX1_PUEN);
 
                 dev_dbg(ipctl->dev, "pinconf set pullup pin %s\n",
-                        info->pins[pin_id].name);
+                        pin_desc_get(pctldev, pin_id)->name);
         }
 
         return 0;
diff --git a/drivers/pinctrl/nomadik/pinctrl-abx500.c b/drivers/pinctrl/nomadik/pinctrl-abx500.c
index 557d0f2a3031..97681fac082e 100644
--- a/drivers/pinctrl/nomadik/pinctrl-abx500.c
+++ b/drivers/pinctrl/nomadik/pinctrl-abx500.c
@@ -787,7 +787,6 @@ static const struct pinmux_ops abx500_pinmux_ops = {
         .set_mux = abx500_pmx_set,
         .gpio_request_enable = abx500_gpio_request_enable,
         .gpio_disable_free = abx500_gpio_disable_free,
-        .strict = true,
 };
 
 static int abx500_get_groups_cnt(struct pinctrl_dev *pctldev)
diff --git a/drivers/pinctrl/pinctrl-lpc18xx.c b/drivers/pinctrl/pinctrl-lpc18xx.c
index ef0b697639a7..347c763a6a78 100644
--- a/drivers/pinctrl/pinctrl-lpc18xx.c
+++ b/drivers/pinctrl/pinctrl-lpc18xx.c
@@ -823,7 +823,7 @@ static int lpc18xx_pconf_set_i2c0(struct pinctrl_dev *pctldev,
                 break;
 
         case PIN_CONFIG_INPUT_SCHMITT_ENABLE:
-                if (param)
+                if (param_val)
                         *reg &= ~(LPC18XX_SCU_I2C0_ZIF << shift);
                 else
                         *reg |= (LPC18XX_SCU_I2C0_ZIF << shift);
@@ -876,7 +876,7 @@ static int lpc18xx_pconf_set_pin(struct pinctrl_dev *pctldev,
                 break;
 
         case PIN_CONFIG_INPUT_SCHMITT_ENABLE:
-                if (param)
+                if (param_val)
                         *reg &= ~LPC18XX_SCU_PIN_ZIF;
                 else
                         *reg |= LPC18XX_SCU_PIN_ZIF;
diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
index b2de09d3b1a0..0b8d480171a3 100644
--- a/drivers/pinctrl/pinctrl-single.c
+++ b/drivers/pinctrl/pinctrl-single.c
@@ -1760,7 +1760,8 @@ static int pcs_irq_init_chained_handler(struct pcs_device *pcs,
                 int res;
 
                 res = request_irq(pcs_soc->irq, pcs_irq_handler,
-                                  IRQF_SHARED | IRQF_NO_SUSPEND,
+                                  IRQF_SHARED | IRQF_NO_SUSPEND |
+                                  IRQF_NO_THREAD,
                                   name, pcs_soc);
                 if (res) {
                         pcs_soc->irq = -1;
diff --git a/drivers/pinctrl/samsung/pinctrl-samsung.c b/drivers/pinctrl/samsung/pinctrl-samsung.c
index 3dd5a3b2ac62..c760bf43d116 100644
--- a/drivers/pinctrl/samsung/pinctrl-samsung.c
+++ b/drivers/pinctrl/samsung/pinctrl-samsung.c
@@ -33,11 +33,6 @@
 #include "../core.h"
 #include "pinctrl-samsung.h"
 
-#define GROUP_SUFFIX            "-grp"
-#define GSUFFIX_LEN             sizeof(GROUP_SUFFIX)
-#define FUNCTION_SUFFIX         "-mux"
-#define FSUFFIX_LEN             sizeof(FUNCTION_SUFFIX)
-
 /* list of all possible config options supported */
 static struct pin_config {
         const char *property;
diff --git a/drivers/pinctrl/sh-pfc/sh_pfc.h b/drivers/pinctrl/sh-pfc/sh_pfc.h
index c7508d5f6886..0874cfee6889 100644
--- a/drivers/pinctrl/sh-pfc/sh_pfc.h
+++ b/drivers/pinctrl/sh-pfc/sh_pfc.h
@@ -224,7 +224,7 @@ struct sh_pfc_soc_info {
 
 /* PINMUX_GPIO_GP_ALL - Expand to a list of sh_pfc_pin entries */
 #define _GP_GPIO(bank, _pin, _name, sfx)                                \
-        [(bank * 32) + _pin] = {                                        \
+        {                                                               \
                 .pin = (bank * 32) + _pin,                              \
                 .name = __stringify(_name),                             \
                 .enum_id = _name##_DATA,                                \
diff --git a/drivers/pinctrl/spear/pinctrl-spear.c b/drivers/pinctrl/spear/pinctrl-spear.c
index f87a5eaf75da..0afaf79a4e51 100644
--- a/drivers/pinctrl/spear/pinctrl-spear.c
+++ b/drivers/pinctrl/spear/pinctrl-spear.c
@@ -2,7 +2,7 @@
  * Driver for the ST Microelectronics SPEAr pinmux
  *
  * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
  *
  * Inspired from:
  * - U300 Pinctl drivers
diff --git a/drivers/pinctrl/spear/pinctrl-spear.h b/drivers/pinctrl/spear/pinctrl-spear.h
index dc8bf85ecb2a..27c2cc8d83ad 100644
--- a/drivers/pinctrl/spear/pinctrl-spear.h
+++ b/drivers/pinctrl/spear/pinctrl-spear.h
@@ -2,7 +2,7 @@
  * Driver header file for the ST Microelectronics SPEAr pinmux
  *
  * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
  *
  * This file is licensed under the terms of the GNU General Public
  * License version 2. This program is licensed "as is" without any
diff --git a/drivers/pinctrl/spear/pinctrl-spear1310.c b/drivers/pinctrl/spear/pinctrl-spear1310.c
index a7bdc537efa7..92611bb757ac 100644
--- a/drivers/pinctrl/spear/pinctrl-spear1310.c
+++ b/drivers/pinctrl/spear/pinctrl-spear1310.c
@@ -2,7 +2,7 @@
  * Driver for the ST Microelectronics SPEAr1310 pinmux
  *
  * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
  *
  * This file is licensed under the terms of the GNU General Public
  * License version 2. This program is licensed "as is" without any
@@ -2730,7 +2730,7 @@ static void __exit spear1310_pinctrl_exit(void)
 }
 module_exit(spear1310_pinctrl_exit);
 
-MODULE_AUTHOR("Viresh Kumar <viresh.linux@gmail.com>");
+MODULE_AUTHOR("Viresh Kumar <vireshk@kernel.org>");
 MODULE_DESCRIPTION("ST Microelectronics SPEAr1310 pinctrl driver");
 MODULE_LICENSE("GPL v2");
 MODULE_DEVICE_TABLE(of, spear1310_pinctrl_of_match);
diff --git a/drivers/pinctrl/spear/pinctrl-spear1340.c b/drivers/pinctrl/spear/pinctrl-spear1340.c
index f43ec85a0328..f842e9dc40d0 100644
--- a/drivers/pinctrl/spear/pinctrl-spear1340.c
+++ b/drivers/pinctrl/spear/pinctrl-spear1340.c
@@ -2,7 +2,7 @@
  * Driver for the ST Microelectronics SPEAr1340 pinmux
  *
  * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
  *
  * This file is licensed under the terms of the GNU General Public
  * License version 2. This program is licensed "as is" without any
@@ -2046,7 +2046,7 @@ static void __exit spear1340_pinctrl_exit(void)
 }
 module_exit(spear1340_pinctrl_exit);
 
-MODULE_AUTHOR("Viresh Kumar <viresh.linux@gmail.com>");
+MODULE_AUTHOR("Viresh Kumar <vireshk@kernel.org>");
 MODULE_DESCRIPTION("ST Microelectronics SPEAr1340 pinctrl driver");
 MODULE_LICENSE("GPL v2");
 MODULE_DEVICE_TABLE(of, spear1340_pinctrl_of_match);
diff --git a/drivers/pinctrl/spear/pinctrl-spear300.c b/drivers/pinctrl/spear/pinctrl-spear300.c
index da8990a8eeef..d998a2ccff48 100644
--- a/drivers/pinctrl/spear/pinctrl-spear300.c
+++ b/drivers/pinctrl/spear/pinctrl-spear300.c
@@ -2,7 +2,7 @@
  * Driver for the ST Microelectronics SPEAr300 pinmux
  *
  * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
  *
  * This file is licensed under the terms of the GNU General Public
  * License version 2. This program is licensed "as is" without any
@@ -703,7 +703,7 @@ static void __exit spear300_pinctrl_exit(void)
 }
 module_exit(spear300_pinctrl_exit);
 
-MODULE_AUTHOR("Viresh Kumar <viresh.linux@gmail.com>");
+MODULE_AUTHOR("Viresh Kumar <vireshk@kernel.org>");
 MODULE_DESCRIPTION("ST Microelectronics SPEAr300 pinctrl driver");
 MODULE_LICENSE("GPL v2");
 MODULE_DEVICE_TABLE(of, spear300_pinctrl_of_match);
diff --git a/drivers/pinctrl/spear/pinctrl-spear310.c b/drivers/pinctrl/spear/pinctrl-spear310.c
index 31ede51e819b..609b18aceb16 100644
--- a/drivers/pinctrl/spear/pinctrl-spear310.c
+++ b/drivers/pinctrl/spear/pinctrl-spear310.c
@@ -2,7 +2,7 @@
  * Driver for the ST Microelectronics SPEAr310 pinmux
  *
  * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
  *
  * This file is licensed under the terms of the GNU General Public
  * License version 2. This program is licensed "as is" without any
@@ -426,7 +426,7 @@ static void __exit spear310_pinctrl_exit(void)
 }
 module_exit(spear310_pinctrl_exit);
 
-MODULE_AUTHOR("Viresh Kumar <viresh.linux@gmail.com>");
+MODULE_AUTHOR("Viresh Kumar <vireshk@kernel.org>");
 MODULE_DESCRIPTION("ST Microelectronics SPEAr310 pinctrl driver");
 MODULE_LICENSE("GPL v2");
 MODULE_DEVICE_TABLE(of, spear310_pinctrl_of_match);
diff --git a/drivers/pinctrl/spear/pinctrl-spear320.c b/drivers/pinctrl/spear/pinctrl-spear320.c
index 506e40b641e0..c07114431bd4 100644
--- a/drivers/pinctrl/spear/pinctrl-spear320.c
+++ b/drivers/pinctrl/spear/pinctrl-spear320.c
@@ -2,7 +2,7 @@
  * Driver for the ST Microelectronics SPEAr320 pinmux
  *
  * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
  *
  * This file is licensed under the terms of the GNU General Public
  * License version 2. This program is licensed "as is" without any
@@ -3467,7 +3467,7 @@ static void __exit spear320_pinctrl_exit(void)
 }
 module_exit(spear320_pinctrl_exit);
 
-MODULE_AUTHOR("Viresh Kumar <viresh.linux@gmail.com>");
+MODULE_AUTHOR("Viresh Kumar <vireshk@kernel.org>");
 MODULE_DESCRIPTION("ST Microelectronics SPEAr320 pinctrl driver");
 MODULE_LICENSE("GPL v2");
 MODULE_DEVICE_TABLE(of, spear320_pinctrl_of_match);
diff --git a/drivers/pinctrl/spear/pinctrl-spear3xx.c b/drivers/pinctrl/spear/pinctrl-spear3xx.c
index 12ee21af766b..d3119aafe709 100644
--- a/drivers/pinctrl/spear/pinctrl-spear3xx.c
+++ b/drivers/pinctrl/spear/pinctrl-spear3xx.c
@@ -2,7 +2,7 @@
  * Driver for the ST Microelectronics SPEAr3xx pinmux
  *
  * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
  *
  * This file is licensed under the terms of the GNU General Public
  * License version 2. This program is licensed "as is" without any
diff --git a/drivers/pinctrl/spear/pinctrl-spear3xx.h b/drivers/pinctrl/spear/pinctrl-spear3xx.h
index 7860b36053c4..ce19dcf8f08b 100644
--- a/drivers/pinctrl/spear/pinctrl-spear3xx.h
+++ b/drivers/pinctrl/spear/pinctrl-spear3xx.h
@@ -2,7 +2,7 @@
  * Header file for the ST Microelectronics SPEAr3xx pinmux
  *
  * Copyright (C) 2012 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
  *
  * This file is licensed under the terms of the GNU General Public
  * License version 2. This program is licensed "as is" without any
diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
index ed317ccac4a2..aaeeae81e3a9 100644
--- a/drivers/platform/x86/dell-laptop.c
+++ b/drivers/platform/x86/dell-laptop.c
@@ -309,12 +309,15 @@ static const struct dmi_system_id dell_quirks[] __initconst = {
 static struct calling_interface_buffer *buffer;
 static DEFINE_MUTEX(buffer_mutex);
 
-static int hwswitch_state;
+static void clear_buffer(void)
+{
+        memset(buffer, 0, sizeof(struct calling_interface_buffer));
+}
 
 static void get_buffer(void)
 {
         mutex_lock(&buffer_mutex);
-        memset(buffer, 0, sizeof(struct calling_interface_buffer));
+        clear_buffer();
 }
 
 static void release_buffer(void)
@@ -548,21 +551,41 @@ static int dell_rfkill_set(void *data, bool blocked)
         int disable = blocked ? 1 : 0;
         unsigned long radio = (unsigned long)data;
         int hwswitch_bit = (unsigned long)data - 1;
+        int hwswitch;
+        int status;
+        int ret;
 
         get_buffer();
+
+        dell_send_request(buffer, 17, 11);
+        ret = buffer->output[0];
+        status = buffer->output[1];
+
+        if (ret != 0)
+                goto out;
+
+        clear_buffer();
+
+        buffer->input[0] = 0x2;
         dell_send_request(buffer, 17, 11);
+        ret = buffer->output[0];
+        hwswitch = buffer->output[1];
 
         /* If the hardware switch controls this radio, and the hardware
            switch is disabled, always disable the radio */
-        if ((hwswitch_state & BIT(hwswitch_bit)) &&
-            !(buffer->output[1] & BIT(16)))
+        if (ret == 0 && (hwswitch & BIT(hwswitch_bit)) &&
+            (status & BIT(0)) && !(status & BIT(16)))
                 disable = 1;
 
+        clear_buffer();
+
         buffer->input[0] = (1 | (radio<<8) | (disable << 16));
         dell_send_request(buffer, 17, 11);
+        ret = buffer->output[0];
 
+ out:
         release_buffer();
-        return 0;
+        return dell_smi_error(ret);
 }
 
 /* Must be called with the buffer held */
@@ -572,6 +595,7 @@ static void dell_rfkill_update_sw_state(struct rfkill *rfkill, int radio,
         if (status & BIT(0)) {
                 /* Has hw-switch, sync sw_state to BIOS */
                 int block = rfkill_blocked(rfkill);
+                clear_buffer();
                 buffer->input[0] = (1 | (radio << 8) | (block << 16));
                 dell_send_request(buffer, 17, 11);
         } else {
@@ -581,23 +605,43 @@ static void dell_rfkill_update_sw_state(struct rfkill *rfkill, int radio,
 }
 
 static void dell_rfkill_update_hw_state(struct rfkill *rfkill, int radio,
-                                        int status)
+                                        int status, int hwswitch)
 {
-        if (hwswitch_state & (BIT(radio - 1)))
+        if (hwswitch & (BIT(radio - 1)))
                 rfkill_set_hw_state(rfkill, !(status & BIT(16)));
 }
 
 static void dell_rfkill_query(struct rfkill *rfkill, void *data)
 {
+        int radio = ((unsigned long)data & 0xF);
+        int hwswitch;
         int status;
+        int ret;
 
         get_buffer();
+
         dell_send_request(buffer, 17, 11);
+        ret = buffer->output[0];
         status = buffer->output[1];
 
-        dell_rfkill_update_hw_state(rfkill, (unsigned long)data, status);
+        if (ret != 0 || !(status & BIT(0))) {
+                release_buffer();
+                return;
+        }
+
+        clear_buffer();
+
+        buffer->input[0] = 0x2;
+        dell_send_request(buffer, 17, 11);
+        ret = buffer->output[0];
+        hwswitch = buffer->output[1];
 
         release_buffer();
+
+        if (ret != 0)
+                return;
+
+        dell_rfkill_update_hw_state(rfkill, radio, status, hwswitch);
 }
 
 static const struct rfkill_ops dell_rfkill_ops = {
@@ -609,13 +653,27 @@ static struct dentry *dell_laptop_dir;
 
 static int dell_debugfs_show(struct seq_file *s, void *data)
 {
+        int hwswitch_state;
+        int hwswitch_ret;
         int status;
+        int ret;
 
         get_buffer();
+
         dell_send_request(buffer, 17, 11);
+        ret = buffer->output[0];
         status = buffer->output[1];
+
+        clear_buffer();
+
+        buffer->input[0] = 0x2;
+        dell_send_request(buffer, 17, 11);
+        hwswitch_ret = buffer->output[0];
+        hwswitch_state = buffer->output[1];
+
         release_buffer();
 
+        seq_printf(s, "return:\t%d\n", ret);
         seq_printf(s, "status:\t0x%X\n", status);
         seq_printf(s, "Bit 0 : Hardware switch supported:   %lu\n",
                    status & BIT(0));
@@ -657,7 +715,8 @@ static int dell_debugfs_show(struct seq_file *s, void *data)
         seq_printf(s, "Bit 21: WiGig is blocked:            %lu\n",
                   (status & BIT(21)) >> 21);
 
-        seq_printf(s, "\nhwswitch_state:\t0x%X\n", hwswitch_state);
+        seq_printf(s, "\nhwswitch_return:\t%d\n", hwswitch_ret);
+        seq_printf(s, "hwswitch_state:\t0x%X\n", hwswitch_state);
         seq_printf(s, "Bit 0 : Wifi controlled by switch:      %lu\n",
                    hwswitch_state & BIT(0));
         seq_printf(s, "Bit 1 : Bluetooth controlled by switch: %lu\n",
@@ -693,25 +752,43 @@ static const struct file_operations dell_debugfs_fops = {
 
 static void dell_update_rfkill(struct work_struct *ignored)
 {
+        int hwswitch = 0;
         int status;
+        int ret;
 
         get_buffer();
+
         dell_send_request(buffer, 17, 11);
+        ret = buffer->output[0];
         status = buffer->output[1];
 
+        if (ret != 0)
+                goto out;
+
+        clear_buffer();
+
+        buffer->input[0] = 0x2;
+        dell_send_request(buffer, 17, 11);
+        ret = buffer->output[0];
+
+        if (ret == 0 && (status & BIT(0)))
+                hwswitch = buffer->output[1];
+
         if (wifi_rfkill) {
-                dell_rfkill_update_hw_state(wifi_rfkill, 1, status);
+                dell_rfkill_update_hw_state(wifi_rfkill, 1, status, hwswitch);
                 dell_rfkill_update_sw_state(wifi_rfkill, 1, status);
         }
         if (bluetooth_rfkill) {
-                dell_rfkill_update_hw_state(bluetooth_rfkill, 2, status);
+                dell_rfkill_update_hw_state(bluetooth_rfkill, 2, status,
+                                            hwswitch);
                 dell_rfkill_update_sw_state(bluetooth_rfkill, 2, status);
         }
         if (wwan_rfkill) {
-                dell_rfkill_update_hw_state(wwan_rfkill, 3, status);
+                dell_rfkill_update_hw_state(wwan_rfkill, 3, status, hwswitch);
                 dell_rfkill_update_sw_state(wwan_rfkill, 3, status);
         }
 
+ out:
         release_buffer();
 }
 static DECLARE_DELAYED_WORK(dell_rfkill_work, dell_update_rfkill);
@@ -773,21 +850,17 @@ static int __init dell_setup_rfkill(void)
 
         get_buffer();
         dell_send_request(buffer, 17, 11);
+        ret = buffer->output[0];
         status = buffer->output[1];
-        buffer->input[0] = 0x2;
-        dell_send_request(buffer, 17, 11);
-        hwswitch_state = buffer->output[1];
         release_buffer();
 
-        if (!(status & BIT(0))) {
-                if (force_rfkill) {
-                        /* No hwsitch, clear all hw-controlled bits */
-                        hwswitch_state &= ~7;
-                } else {
-                        /* rfkill is only tested on laptops with a hwswitch */
-                        return 0;
-                }
-        }
+        /* dell wireless info smbios call is not supported */
+        if (ret != 0)
+                return 0;
+
+        /* rfkill is only tested on laptops with a hwswitch */
+        if (!(status & BIT(0)) && !force_rfkill)
+                return 0;
 
         if ((status & (1<<2|1<<8)) == (1<<2|1<<8)) {
                 wifi_rfkill = rfkill_alloc("dell-wifi", &platform_device->dev,
@@ -932,47 +1005,50 @@ static void dell_cleanup_rfkill(void)
 
 static int dell_send_intensity(struct backlight_device *bd)
 {
-        int ret = 0;
+        int token;
+        int ret;
+
+        token = find_token_location(BRIGHTNESS_TOKEN);
+        if (token == -1)
+                return -ENODEV;
 
         get_buffer();
-        buffer->input[0] = find_token_location(BRIGHTNESS_TOKEN);
+        buffer->input[0] = token;
         buffer->input[1] = bd->props.brightness;
 
-        if (buffer->input[0] == -1) {
-                ret = -ENODEV;
-                goto out;
-        }
-
         if (power_supply_is_system_supplied() > 0)
                 dell_send_request(buffer, 1, 2);
         else
                 dell_send_request(buffer, 1, 1);
 
- out:
+        ret = dell_smi_error(buffer->output[0]);
+
         release_buffer();
         return ret;
 }
 
 static int dell_get_intensity(struct backlight_device *bd)
 {
-        int ret = 0;
+        int token;
+        int ret;
 
-        get_buffer();
-        buffer->input[0] = find_token_location(BRIGHTNESS_TOKEN);
+        token = find_token_location(BRIGHTNESS_TOKEN);
+        if (token == -1)
+                return -ENODEV;
 
-        if (buffer->input[0] == -1) {
-                ret = -ENODEV;
-                goto out;
-        }
+        get_buffer();
+        buffer->input[0] = token;
 
         if (power_supply_is_system_supplied() > 0)
                 dell_send_request(buffer, 0, 2);
         else
                 dell_send_request(buffer, 0, 1);
 
-        ret = buffer->output[1];
+        if (buffer->output[0])
+                ret = dell_smi_error(buffer->output[0]);
+        else
+                ret = buffer->output[1];
 
- out:
         release_buffer();
         return ret;
 }
@@ -2036,6 +2112,7 @@ static void kbd_led_exit(void)
 static int __init dell_init(void)
 {
         int max_intensity = 0;
+        int token;
         int ret;
 
         if (!dmi_check_system(dell_device_table))
@@ -2094,13 +2171,15 @@ static int __init dell_init(void)
         if (acpi_video_get_backlight_type() != acpi_backlight_vendor)
                 return 0;
 
-        get_buffer();
-        buffer->input[0] = find_token_location(BRIGHTNESS_TOKEN);
-        if (buffer->input[0] != -1) {
+        token = find_token_location(BRIGHTNESS_TOKEN);
+        if (token != -1) {
+                get_buffer();
+                buffer->input[0] = token;
                 dell_send_request(buffer, 0, 2);
-                max_intensity = buffer->output[3];
+                if (buffer->output[0] == 0)
+                        max_intensity = buffer->output[3];
+                release_buffer();
         }
-        release_buffer();
 
         if (max_intensity) {
                 struct backlight_properties props;
diff --git a/drivers/platform/x86/intel_pmc_ipc.c b/drivers/platform/x86/intel_pmc_ipc.c
index d734763dab69..105cfffe82c6 100644
--- a/drivers/platform/x86/intel_pmc_ipc.c
+++ b/drivers/platform/x86/intel_pmc_ipc.c
@@ -96,18 +96,18 @@ static struct intel_pmc_ipc_dev {
         struct completion cmd_complete;
 
         /* The following PMC BARs share the same ACPI device with the IPC */
-        void *acpi_io_base;
+        resource_size_t acpi_io_base;
         int acpi_io_size;
         struct platform_device *tco_dev;
 
         /* gcr */
-        void *gcr_base;
+        resource_size_t gcr_base;
         int gcr_size;
 
         /* punit */
-        void *punit_base;
+        resource_size_t punit_base;
         int punit_size;
-        void *punit_base2;
+        resource_size_t punit_base2;
         int punit_size2;
         struct platform_device *punit_dev;
 } ipcdev;
@@ -210,10 +210,15 @@ static int intel_pmc_ipc_check_status(void)
         return ret;
 }
 
-/*
- * intel_pmc_ipc_simple_command
- * @cmd: command
- * @sub: sub type
+/**
+ * intel_pmc_ipc_simple_command() - Simple IPC command
+ * @cmd:        IPC command code.
+ * @sub:        IPC command sub type.
+ *
+ * Send a simple IPC command to PMC when don't need to specify
+ * input/output data and source/dest pointers.
+ *
+ * Return:      an IPC error code or 0 on success.
  */
 int intel_pmc_ipc_simple_command(int cmd, int sub)
 {
@@ -232,16 +237,20 @@ int intel_pmc_ipc_simple_command(int cmd, int sub)
 }
 EXPORT_SYMBOL_GPL(intel_pmc_ipc_simple_command);
 
-/*
- * intel_pmc_ipc_raw_cmd
- * @cmd: command
- * @sub: sub type
- * @in: input data
- * @inlen: input length in bytes
- * @out: output data
- * @outlen: output length in dwords
- * @sptr: data writing to SPTR register
- * @dptr: data writing to DPTR register
+/**
+ * intel_pmc_ipc_raw_cmd() - IPC command with data and pointers
+ * @cmd:        IPC command code.
+ * @sub:        IPC command sub type.
+ * @in:         input data of this IPC command.
+ * @inlen:      input data length in bytes.
+ * @out:        output data of this IPC command.
+ * @outlen:     output data length in dwords.
+ * @sptr:       data writing to SPTR register.
+ * @dptr:       data writing to DPTR register.
+ *
+ * Send an IPC command to PMC with input/output data and source/dest pointers.
+ *
+ * Return:      an IPC error code or 0 on success.
  */
 int intel_pmc_ipc_raw_cmd(u32 cmd, u32 sub, u8 *in, u32 inlen, u32 *out,
                           u32 outlen, u32 dptr, u32 sptr)
@@ -278,14 +287,18 @@ int intel_pmc_ipc_raw_cmd(u32 cmd, u32 sub, u8 *in, u32 inlen, u32 *out,
 }
 EXPORT_SYMBOL_GPL(intel_pmc_ipc_raw_cmd);
 
-/*
- * intel_pmc_ipc_command
- * @cmd: command
- * @sub: sub type
- * @in: input data
- * @inlen: input length in bytes
- * @out: output data
- * @outlen: output length in dwords
+/**
+ * intel_pmc_ipc_command() -  IPC command with input/output data
+ * @cmd:        IPC command code.
+ * @sub:        IPC command sub type.
+ * @in:         input data of this IPC command.
+ * @inlen:      input data length in bytes.
+ * @out:        output data of this IPC command.
+ * @outlen:     output data length in dwords.
+ *
+ * Send an IPC command to PMC with input/output data.
+ *
+ * Return:      an IPC error code or 0 on success.
  */
 int intel_pmc_ipc_command(u32 cmd, u32 sub, u8 *in, u32 inlen,
                           u32 *out, u32 outlen)
@@ -480,11 +493,11 @@ static int ipc_create_punit_device(void)
         pdev->dev.parent = ipcdev.dev;
 
         res = punit_res;
-        res->start = (resource_size_t)ipcdev.punit_base;
+        res->start = ipcdev.punit_base;
         res->end = res->start + ipcdev.punit_size - 1;
 
         res = punit_res + PUNIT_RESOURCE_INTER;
-        res->start = (resource_size_t)ipcdev.punit_base2;
+        res->start = ipcdev.punit_base2;
         res->end = res->start + ipcdev.punit_size2 - 1;
 
         ret = platform_device_add_resources(pdev, punit_res,
@@ -522,15 +535,15 @@ static int ipc_create_tco_device(void)
         pdev->dev.parent = ipcdev.dev;
 
         res = tco_res + TCO_RESOURCE_ACPI_IO;
-        res->start = (resource_size_t)ipcdev.acpi_io_base + TCO_BASE_OFFSET;
+        res->start = ipcdev.acpi_io_base + TCO_BASE_OFFSET;
         res->end = res->start + TCO_REGS_SIZE - 1;
 
         res = tco_res + TCO_RESOURCE_SMI_EN_IO;
-        res->start = (resource_size_t)ipcdev.acpi_io_base + SMI_EN_OFFSET;
+        res->start = ipcdev.acpi_io_base + SMI_EN_OFFSET;
         res->end = res->start + SMI_EN_SIZE - 1;
 
         res = tco_res + TCO_RESOURCE_GCR_MEM;
-        res->start = (resource_size_t)ipcdev.gcr_base;
+        res->start = ipcdev.gcr_base;
         res->end = res->start + ipcdev.gcr_size - 1;
 
         ret = platform_device_add_resources(pdev, tco_res, ARRAY_SIZE(tco_res));
@@ -589,7 +602,7 @@ static int ipc_plat_get_res(struct platform_device *pdev)
                 return -ENXIO;
         }
         size = resource_size(res);
-        ipcdev.acpi_io_base = (void *)res->start;
+        ipcdev.acpi_io_base = res->start;
         ipcdev.acpi_io_size = size;
         dev_info(&pdev->dev, "io res: %llx %x\n",
                  (long long)res->start, (int)resource_size(res));
@@ -601,7 +614,7 @@ static int ipc_plat_get_res(struct platform_device *pdev)
                 return -ENXIO;
         }
         size = resource_size(res);
-        ipcdev.punit_base = (void *)res->start;
+        ipcdev.punit_base = res->start;
         ipcdev.punit_size = size;
         dev_info(&pdev->dev, "punit data res: %llx %x\n",
                  (long long)res->start, (int)resource_size(res));
@@ -613,7 +626,7 @@ static int ipc_plat_get_res(struct platform_device *pdev)
                 return -ENXIO;
         }
         size = resource_size(res);
-        ipcdev.punit_base2 = (void *)res->start;
+        ipcdev.punit_base2 = res->start;
         ipcdev.punit_size2 = size;
         dev_info(&pdev->dev, "punit interface res: %llx %x\n",
                  (long long)res->start, (int)resource_size(res));
@@ -637,7 +650,7 @@ static int ipc_plat_get_res(struct platform_device *pdev)
         }
         ipcdev.ipc_base = addr;
 
-        ipcdev.gcr_base = (void *)(res->start + size);
+        ipcdev.gcr_base = res->start + size;
         ipcdev.gcr_size = PLAT_RESOURCE_GCR_SIZE;
         dev_info(&pdev->dev, "ipc res: %llx %x\n",
                  (long long)res->start, (int)resource_size(res));
diff --git a/drivers/platform/x86/intel_scu_ipc.c b/drivers/platform/x86/intel_scu_ipc.c
index 001b199a8c33..187d1086d15c 100644
--- a/drivers/platform/x86/intel_scu_ipc.c
+++ b/drivers/platform/x86/intel_scu_ipc.c
@@ -216,13 +216,13 @@ static int pwr_reg_rdwr(u16 *addr, u8 *data, u32 count, u32 op, u32 id)
         int nc;
         u32 offset = 0;
         int err;
-        u8 cbuf[IPC_WWBUF_SIZE] = { };
+        u8 cbuf[IPC_WWBUF_SIZE];
         u32 *wbuf = (u32 *)&cbuf;
 
-        mutex_lock(&ipclock);
-
         memset(cbuf, 0, sizeof(cbuf));
 
+        mutex_lock(&ipclock);
+
         if (ipcdev.pdev == NULL) {
                 mutex_unlock(&ipclock);
                 return -ENODEV;
diff --git a/drivers/pnp/system.c b/drivers/pnp/system.c
index 515f33882ab8..49c1720df59a 100644
--- a/drivers/pnp/system.c
+++ b/drivers/pnp/system.c
@@ -7,7 +7,6 @@
  *      Bjorn Helgaas <bjorn.helgaas@hp.com>
  */
 
-#include <linux/acpi.h>
 #include <linux/pnp.h>
 #include <linux/device.h>
 #include <linux/init.h>
@@ -23,41 +22,25 @@ static const struct pnp_device_id pnp_dev_table[] = {
         {"", 0}
 };
 
-#ifdef CONFIG_ACPI
-static bool __reserve_range(u64 start, unsigned int length, bool io, char *desc)
-{
-        u8 space_id = io ? ACPI_ADR_SPACE_SYSTEM_IO : ACPI_ADR_SPACE_SYSTEM_MEMORY;
-        return !acpi_reserve_region(start, length, space_id, IORESOURCE_BUSY, desc);
-}
-#else
-static bool __reserve_range(u64 start, unsigned int length, bool io, char *desc)
-{
-        struct resource *res;
-
-        res = io ? request_region(start, length, desc) :
-                request_mem_region(start, length, desc);
-        if (res) {
-                res->flags &= ~IORESOURCE_BUSY;
-                return true;
-        }
-        return false;
-}
-#endif
-
 static void reserve_range(struct pnp_dev *dev, struct resource *r, int port)
 {
         char *regionid;
         const char *pnpid = dev_name(&dev->dev);
         resource_size_t start = r->start, end = r->end;
-        bool reserved;
+        struct resource *res;
 
         regionid = kmalloc(16, GFP_KERNEL);
         if (!regionid)
                 return;
 
         snprintf(regionid, 16, "pnp %s", pnpid);
-        reserved = __reserve_range(start, end - start + 1, !!port, regionid);
-        if (!reserved)
+        if (port)
+                res = request_region(start, end - start + 1, regionid);
+        else
+                res = request_mem_region(start, end - start + 1, regionid);
+        if (res)
+                res->flags &= ~IORESOURCE_BUSY;
+        else
                 kfree(regionid);
 
         /*
@@ -66,7 +49,7 @@ static void reserve_range(struct pnp_dev *dev, struct resource *r, int port)
          * have double reservations.
          */
         dev_info(&dev->dev, "%pR %s reserved\n", r,
-                 reserved ? "has been" : "could not be");
+                 res ? "has been" : "could not be");
 }
 
 static void reserve_resources_of_dev(struct pnp_dev *dev)
diff --git a/drivers/regulator/88pm800.c b/drivers/regulator/88pm800.c
index 832932bdc977..7fd4f511d78f 100644
--- a/drivers/regulator/88pm800.c
+++ b/drivers/regulator/88pm800.c
@@ -130,7 +130,7 @@ struct pm800_regulators {
                 .owner  = THIS_MODULE,                                  \
                 .n_voltages = ARRAY_SIZE(ldo_volt_table),               \
                 .vsel_reg       = PM800_##vreg##_VOUT,                  \
-                .vsel_mask      = 0x1f,                                 \
+                .vsel_mask      = 0xf,                                  \
                 .enable_reg     = PM800_##ereg,                         \
                 .enable_mask    = 1 << (ebit),                          \
                 .volt_table     = ldo_volt_table,                       \
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index c9f72019bd68..78387a6cbae5 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -109,6 +109,7 @@ static int _regulator_do_set_voltage(struct regulator_dev *rdev,
 static struct regulator *create_regulator(struct regulator_dev *rdev,
                                           struct device *dev,
                                           const char *supply_name);
+static void _regulator_put(struct regulator *regulator);
 
 static const char *rdev_get_name(struct regulator_dev *rdev)
 {
@@ -1105,6 +1106,9 @@ static int set_supply(struct regulator_dev *rdev,
 
         rdev_info(rdev, "supplied by %s\n", rdev_get_name(supply_rdev));
 
+        if (!try_module_get(supply_rdev->owner))
+                return -ENODEV;
+
         rdev->supply = create_regulator(supply_rdev, &rdev->dev, "SUPPLY");
         if (rdev->supply == NULL) {
                 err = -ENOMEM;
@@ -1381,9 +1385,13 @@ static int regulator_resolve_supply(struct regulator_dev *rdev)
         }
 
         if (!r) {
-                dev_err(dev, "Failed to resolve %s-supply for %s\n",
-                        rdev->supply_name, rdev->desc->name);
-                return -EPROBE_DEFER;
+                if (have_full_constraints()) {
+                        r = dummy_regulator_rdev;
+                } else {
+                        dev_err(dev, "Failed to resolve %s-supply for %s\n",
+                                rdev->supply_name, rdev->desc->name);
+                        return -EPROBE_DEFER;
+                }
         }
 
         /* Recursively resolve the supply of the supply */
@@ -1398,8 +1406,11 @@ static int regulator_resolve_supply(struct regulator_dev *rdev)
         /* Cascade always-on state to supply */
         if (_regulator_is_enabled(rdev)) {
                 ret = regulator_enable(rdev->supply);
-                if (ret < 0)
+                if (ret < 0) {
+                        if (rdev->supply)
+                                _regulator_put(rdev->supply);
                         return ret;
+                }
         }
 
         return 0;
diff --git a/drivers/regulator/max8973-regulator.c b/drivers/regulator/max8973-regulator.c
index 6f2bdad8b4d8..e94ddcf97722 100644
--- a/drivers/regulator/max8973-regulator.c
+++ b/drivers/regulator/max8973-regulator.c
@@ -450,7 +450,7 @@ static struct max8973_regulator_platform_data *max8973_parse_dt(
                 pdata->control_flags  |= MAX8973_CONTROL_FREQ_SHIFT_9PER_ENABLE;
 
         if (of_property_read_bool(np, "maxim,enable-bias-control"))
-                pdata->control_flags  |= MAX8973_BIAS_ENABLE;
+                pdata->control_flags  |= MAX8973_CONTROL_BIAS_ENABLE;
 
         return pdata;
 }
diff --git a/drivers/regulator/s2mps11.c b/drivers/regulator/s2mps11.c
index 326ffb553371..72fc3c32db49 100644
--- a/drivers/regulator/s2mps11.c
+++ b/drivers/regulator/s2mps11.c
@@ -34,6 +34,8 @@
 #include <linux/mfd/samsung/s2mps14.h>
 #include <linux/mfd/samsung/s2mpu02.h>
 
+/* The highest number of possible regulators for supported devices. */
+#define S2MPS_REGULATOR_MAX             S2MPS13_REGULATOR_MAX
 struct s2mps11_info {
         unsigned int rdev_num;
         int ramp_delay2;
@@ -49,7 +51,7 @@ struct s2mps11_info {
          * One bit for each S2MPS13/S2MPS14/S2MPU02 regulator whether
          * the suspend mode was enabled.
          */
-        unsigned long long s2mps14_suspend_state:50;
+        DECLARE_BITMAP(suspend_state, S2MPS_REGULATOR_MAX);
 
         /* Array of size rdev_num with GPIO-s for external sleep control */
         int *ext_control_gpio;
@@ -500,7 +502,7 @@ static int s2mps14_regulator_enable(struct regulator_dev *rdev)
         switch (s2mps11->dev_type) {
         case S2MPS13X:
         case S2MPS14X:
-                if (s2mps11->s2mps14_suspend_state & (1 << rdev_get_id(rdev)))
+                if (test_bit(rdev_get_id(rdev), s2mps11->suspend_state))
                         val = S2MPS14_ENABLE_SUSPEND;
                 else if (gpio_is_valid(s2mps11->ext_control_gpio[rdev_get_id(rdev)]))
                         val = S2MPS14_ENABLE_EXT_CONTROL;
@@ -508,7 +510,7 @@ static int s2mps14_regulator_enable(struct regulator_dev *rdev)
                         val = rdev->desc->enable_mask;
                 break;
         case S2MPU02:
-                if (s2mps11->s2mps14_suspend_state & (1 << rdev_get_id(rdev)))
+                if (test_bit(rdev_get_id(rdev), s2mps11->suspend_state))
                         val = S2MPU02_ENABLE_SUSPEND;
                 else
                         val = rdev->desc->enable_mask;
@@ -562,7 +564,7 @@ static int s2mps14_regulator_set_suspend_disable(struct regulator_dev *rdev)
         if (ret < 0)
                 return ret;
 
-        s2mps11->s2mps14_suspend_state |= (1 << rdev_get_id(rdev));
+        set_bit(rdev_get_id(rdev), s2mps11->suspend_state);
         /*
          * Don't enable suspend mode if regulator is already disabled because
          * this would effectively for a short time turn on the regulator after
@@ -960,18 +962,22 @@ static int s2mps11_pmic_probe(struct platform_device *pdev)
         case S2MPS11X:
                 s2mps11->rdev_num = ARRAY_SIZE(s2mps11_regulators);
                 regulators = s2mps11_regulators;
+                BUILD_BUG_ON(S2MPS_REGULATOR_MAX < s2mps11->rdev_num);
                 break;
         case S2MPS13X:
                 s2mps11->rdev_num = ARRAY_SIZE(s2mps13_regulators);
                 regulators = s2mps13_regulators;
+                BUILD_BUG_ON(S2MPS_REGULATOR_MAX < s2mps11->rdev_num);
                 break;
         case S2MPS14X:
                 s2mps11->rdev_num = ARRAY_SIZE(s2mps14_regulators);
                 regulators = s2mps14_regulators;
+                BUILD_BUG_ON(S2MPS_REGULATOR_MAX < s2mps11->rdev_num);
                 break;
         case S2MPU02:
                 s2mps11->rdev_num = ARRAY_SIZE(s2mpu02_regulators);
                 regulators = s2mpu02_regulators;
+                BUILD_BUG_ON(S2MPS_REGULATOR_MAX < s2mps11->rdev_num);
                 break;
         default:
                 dev_err(&pdev->dev, "Invalid device type: %u\n",
diff --git a/drivers/rtc/rtc-armada38x.c b/drivers/rtc/rtc-armada38x.c
index 4b62d1a875e4..2b08cac62f07 100644
--- a/drivers/rtc/rtc-armada38x.c
+++ b/drivers/rtc/rtc-armada38x.c
@@ -88,7 +88,7 @@ static int armada38x_rtc_set_time(struct device *dev, struct rtc_time *tm)
 {
         struct armada38x_rtc *rtc = dev_get_drvdata(dev);
         int ret = 0;
-        unsigned long time, flags;
+        unsigned long time;
 
         ret = rtc_tm_to_time(tm, &time);
 
diff --git a/drivers/rtc/rtc-mt6397.c b/drivers/rtc/rtc-mt6397.c
index c0090b698ff3..eab230be5a54 100644
--- a/drivers/rtc/rtc-mt6397.c
+++ b/drivers/rtc/rtc-mt6397.c
@@ -343,6 +343,8 @@ static int mtk_rtc_probe(struct platform_device *pdev)
                 goto out_dispose_irq;
         }
 
+        device_init_wakeup(&pdev->dev, 1);
+
         rtc->rtc_dev = rtc_device_register("mt6397-rtc", &pdev->dev,
                                            &mtk_rtc_ops, THIS_MODULE);
         if (IS_ERR(rtc->rtc_dev)) {
@@ -351,8 +353,6 @@ static int mtk_rtc_probe(struct platform_device *pdev)
                 goto out_free_irq;
         }
 
-        device_init_wakeup(&pdev->dev, 1);
-
         return 0;
 
 out_free_irq:
diff --git a/drivers/s390/Makefile b/drivers/s390/Makefile
index 95bccfd3f169..e5225ad9c5b1 100644
--- a/drivers/s390/Makefile
+++ b/drivers/s390/Makefile
@@ -2,7 +2,7 @@
 # Makefile for the S/390 specific device drivers
 #
 
-obj-y += cio/ block/ char/ crypto/ net/ scsi/ kvm/
+obj-y += cio/ block/ char/ crypto/ net/ scsi/ virtio/
 
 drivers-y += drivers/s390/built-in.o
 
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index 1aec8ff0b587..f73d2f579a7e 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -1863,6 +1863,33 @@ static void __dasd_device_check_expire(struct dasd_device *device)
 }
 
 /*
+ * return 1 when device is not eligible for IO
+ */
+static int __dasd_device_is_unusable(struct dasd_device *device,
+                                     struct dasd_ccw_req *cqr)
+{
+        int mask = ~(DASD_STOPPED_DC_WAIT | DASD_UNRESUMED_PM);
+
+        if (test_bit(DASD_FLAG_OFFLINE, &device->flags)) {
+                /* dasd is being set offline. */
+                return 1;
+        }
+        if (device->stopped) {
+                if (device->stopped & mask) {
+                        /* stopped and CQR will not change that. */
+                        return 1;
+                }
+                if (!test_bit(DASD_CQR_VERIFY_PATH, &cqr->flags)) {
+                        /* CQR is not able to change device to
+                         * operational. */
+                        return 1;
+                }
+                /* CQR required to get device operational. */
+        }
+        return 0;
+}
+
+/*
  * Take a look at the first request on the ccw queue and check
  * if it needs to be started.
  */
@@ -1876,13 +1903,8 @@ static void __dasd_device_start_head(struct dasd_device *device)
         cqr = list_entry(device->ccw_queue.next, struct dasd_ccw_req, devlist);
         if (cqr->status != DASD_CQR_QUEUED)
                 return;
-        /* when device is stopped, return request to previous layer
-         * exception: only the disconnect or unresumed bits are set and the
-         * cqr is a path verification request
-         */
-        if (device->stopped &&
-            !(!(device->stopped & ~(DASD_STOPPED_DC_WAIT | DASD_UNRESUMED_PM))
-              && test_bit(DASD_CQR_VERIFY_PATH, &cqr->flags))) {
+        /* if device is not usable return request to upper layer */
+        if (__dasd_device_is_unusable(device, cqr)) {
                 cqr->intrc = -EAGAIN;
                 cqr->status = DASD_CQR_CLEARED;
                 dasd_schedule_device_bh(device);
diff --git a/drivers/s390/block/dasd_alias.c b/drivers/s390/block/dasd_alias.c
index a2597e683e79..ee3a6faae22a 100644
--- a/drivers/s390/block/dasd_alias.c
+++ b/drivers/s390/block/dasd_alias.c
@@ -699,7 +699,8 @@ struct dasd_device *dasd_alias_get_start_dev(struct dasd_device *base_device)
                                                struct dasd_device, alias_list);
         spin_unlock_irqrestore(&lcu->lock, flags);
         alias_priv = (struct dasd_eckd_private *) alias_device->private;
-        if ((alias_priv->count < private->count) && !alias_device->stopped)
+        if ((alias_priv->count < private->count) && !alias_device->stopped &&
+            !test_bit(DASD_FLAG_OFFLINE, &alias_device->flags))
                 return alias_device;
         else
                 return NULL;
diff --git a/drivers/s390/char/sclp_early.c b/drivers/s390/char/sclp_early.c
index aeed7969fd79..7bc6df3100ef 100644
--- a/drivers/s390/char/sclp_early.c
+++ b/drivers/s390/char/sclp_early.c
@@ -7,6 +7,7 @@
 #define KMSG_COMPONENT "sclp_early"
 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
 
+#include <linux/errno.h>
 #include <asm/ctl_reg.h>
 #include <asm/sclp.h>
 #include <asm/ipl.h>
diff --git a/drivers/s390/crypto/zcrypt_api.c b/drivers/s390/crypto/zcrypt_api.c
index 08f1830cbfc4..01bf1f5cf2e9 100644
--- a/drivers/s390/crypto/zcrypt_api.c
+++ b/drivers/s390/crypto/zcrypt_api.c
@@ -54,6 +54,10 @@ MODULE_DESCRIPTION("Cryptographic Coprocessor interface, " \
                    "Copyright IBM Corp. 2001, 2012");
 MODULE_LICENSE("GPL");
 
+static int zcrypt_hwrng_seed = 1;
+module_param_named(hwrng_seed, zcrypt_hwrng_seed, int, S_IRUSR|S_IRGRP);
+MODULE_PARM_DESC(hwrng_seed, "Turn on/off hwrng auto seed, default is 1 (on).");
+
 static DEFINE_SPINLOCK(zcrypt_device_lock);
 static LIST_HEAD(zcrypt_device_list);
 static int zcrypt_device_count = 0;
@@ -1373,6 +1377,7 @@ static int zcrypt_rng_data_read(struct hwrng *rng, u32 *data)
 static struct hwrng zcrypt_rng_dev = {
         .name           = "zcrypt",
         .data_read      = zcrypt_rng_data_read,
+        .quality        = 990,
 };
 
 static int zcrypt_rng_device_add(void)
@@ -1387,6 +1392,8 @@ static int zcrypt_rng_device_add(void)
                         goto out;
                 }
                 zcrypt_rng_buffer_index = 0;
+                if (!zcrypt_hwrng_seed)
+                        zcrypt_rng_dev.quality = 0;
                 rc = hwrng_register(&zcrypt_rng_dev);
                 if (rc)
                         goto out_free;
diff --git a/drivers/s390/kvm/Makefile b/drivers/s390/virtio/Makefile
index 241891a57caf..241891a57caf 100644
--- a/drivers/s390/kvm/Makefile
+++ b/drivers/s390/virtio/Makefile
diff --git a/drivers/s390/kvm/kvm_virtio.c b/drivers/s390/virtio/kvm_virtio.c
index 53fb975c404b..53fb975c404b 100644
--- a/drivers/s390/kvm/kvm_virtio.c
+++ b/drivers/s390/virtio/kvm_virtio.c
diff --git a/drivers/s390/kvm/virtio_ccw.c b/drivers/s390/virtio/virtio_ccw.c
index f8d8fdb26b72..f8d8fdb26b72 100644
--- a/drivers/s390/kvm/virtio_ccw.c
+++ b/drivers/s390/virtio/virtio_ccw.c
diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index 1ac38e73df7e..9ad41168d26d 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -859,7 +859,7 @@ sdev_store_queue_depth(struct device *dev, struct device_attribute *attr,
 
         depth = simple_strtoul(buf, NULL, 0);
 
-        if (depth < 1 || depth > sht->can_queue)
+        if (depth < 1 || depth > sdev->host->can_queue)
                 return -EINVAL;
 
         retval = sht->change_queue_depth(sdev, depth);
diff --git a/drivers/scsi/scsi_transport_srp.c b/drivers/scsi/scsi_transport_srp.c
index a85292b1d09d..e3cd3ece4412 100644
--- a/drivers/scsi/scsi_transport_srp.c
+++ b/drivers/scsi/scsi_transport_srp.c
@@ -203,7 +203,7 @@ static ssize_t srp_show_tmo(char *buf, int tmo)
         return tmo >= 0 ? sprintf(buf, "%d\n", tmo) : sprintf(buf, "off\n");
 }
 
-static int srp_parse_tmo(int *tmo, const char *buf)
+int srp_parse_tmo(int *tmo, const char *buf)
 {
         int res = 0;
 
@@ -214,6 +214,7 @@ static int srp_parse_tmo(int *tmo, const char *buf)
 
         return res;
 }
+EXPORT_SYMBOL(srp_parse_tmo);
 
 static ssize_t show_reconnect_delay(struct device *dev,
                                     struct device_attribute *attr, char *buf)
diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
index 3f25b8fa921d..871f3553987d 100644
--- a/drivers/scsi/st.c
+++ b/drivers/scsi/st.c
@@ -1329,9 +1329,9 @@ static int st_open(struct inode *inode, struct file *filp)
         spin_lock(&st_use_lock);
         STp->in_use = 0;
         spin_unlock(&st_use_lock);
-        scsi_tape_put(STp);
         if (resumed)
                 scsi_autopm_put_device(STp->device);
+        scsi_tape_put(STp);
         return retval;
 
 }
diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c
index 285f77544c36..7dbbb29d24c6 100644
--- a/drivers/scsi/virtio_scsi.c
+++ b/drivers/scsi/virtio_scsi.c
@@ -949,7 +949,7 @@ static int virtscsi_probe(struct virtio_device *vdev)
 {
         struct Scsi_Host *shost;
         struct virtio_scsi *vscsi;
-        int err, host_prot;
+        int err;
         u32 sg_elems, num_targets;
         u32 cmd_per_lun;
         u32 num_queues;
@@ -1009,6 +1009,8 @@ static int virtscsi_probe(struct virtio_device *vdev)
 
 #ifdef CONFIG_BLK_DEV_INTEGRITY
         if (virtio_has_feature(vdev, VIRTIO_SCSI_F_T10_PI)) {
+                int host_prot;
+
                 host_prot = SHOST_DIF_TYPE1_PROTECTION | SHOST_DIF_TYPE2_PROTECTION |
                             SHOST_DIF_TYPE3_PROTECTION | SHOST_DIX_TYPE1_PROTECTION |
                             SHOST_DIX_TYPE2_PROTECTION | SHOST_DIX_TYPE3_PROTECTION;
diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig
index 0cae1694014d..b0f30fb68914 100644
--- a/drivers/spi/Kconfig
+++ b/drivers/spi/Kconfig
@@ -612,7 +612,7 @@ config SPI_XTENSA_XTFPGA
 
 config SPI_ZYNQMP_GQSPI
         tristate "Xilinx ZynqMP GQSPI controller"
-        depends on SPI_MASTER
+        depends on SPI_MASTER && HAS_DMA
         help
           Enables Xilinx GQSPI controller driver for Zynq UltraScale+ MPSoC.
 
diff --git a/drivers/spi/spi-img-spfi.c b/drivers/spi/spi-img-spfi.c
index 788e2b176a4f..acce90ac7371 100644
--- a/drivers/spi/spi-img-spfi.c
+++ b/drivers/spi/spi-img-spfi.c
@@ -40,6 +40,7 @@
 #define SPFI_CONTROL_SOFT_RESET                 BIT(11)
 #define SPFI_CONTROL_SEND_DMA                   BIT(10)
 #define SPFI_CONTROL_GET_DMA                    BIT(9)
+#define SPFI_CONTROL_SE                 BIT(8)
 #define SPFI_CONTROL_TMODE_SHIFT                5
 #define SPFI_CONTROL_TMODE_MASK                 0x7
 #define SPFI_CONTROL_TMODE_SINGLE               0
@@ -491,6 +492,7 @@ static void img_spfi_config(struct spi_master *master, struct spi_device *spi,
         else if (xfer->tx_nbits == SPI_NBITS_QUAD &&
                  xfer->rx_nbits == SPI_NBITS_QUAD)
                 val |= SPFI_CONTROL_TMODE_QUAD << SPFI_CONTROL_TMODE_SHIFT;
+        val |= SPFI_CONTROL_SE;
         spfi_writel(spfi, val, SPFI_CONTROL);
 }
 
diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
index eb7d3a6fb14c..f9deb84e4e55 100644
--- a/drivers/spi/spi-imx.c
+++ b/drivers/spi/spi-imx.c
@@ -201,8 +201,9 @@ static bool spi_imx_can_dma(struct spi_master *master, struct spi_device *spi,
 {
         struct spi_imx_data *spi_imx = spi_master_get_devdata(master);
 
-        if (spi_imx->dma_is_inited && (transfer->len > spi_imx->rx_wml)
-            && (transfer->len > spi_imx->tx_wml))
+        if (spi_imx->dma_is_inited
+            && transfer->len > spi_imx->rx_wml * sizeof(u32)
+            && transfer->len > spi_imx->tx_wml * sizeof(u32))
                 return true;
         return false;
 }
diff --git a/drivers/spi/spi-zynqmp-gqspi.c b/drivers/spi/spi-zynqmp-gqspi.c
index 87b20a511a6b..f23f36ebaf3d 100644
--- a/drivers/spi/spi-zynqmp-gqspi.c
+++ b/drivers/spi/spi-zynqmp-gqspi.c
@@ -214,6 +214,7 @@ static void zynqmp_gqspi_selectslave(struct zynqmp_qspi *instanceptr,
         case GQSPI_SELECT_FLASH_CS_BOTH:
                 instanceptr->genfifocs = GQSPI_GENFIFO_CS_LOWER |
                         GQSPI_GENFIFO_CS_UPPER;
+                break;
         case GQSPI_SELECT_FLASH_CS_UPPER:
                 instanceptr->genfifocs = GQSPI_GENFIFO_CS_UPPER;
                 break;
diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c
index dd616ff0ffc5..c7de64171c45 100644
--- a/drivers/spi/spidev.c
+++ b/drivers/spi/spidev.c
@@ -693,6 +693,7 @@ static struct class *spidev_class;
 #ifdef CONFIG_OF
 static const struct of_device_id spidev_dt_ids[] = {
         { .compatible = "rohm,dh2228fv" },
+        { .compatible = "lineartechnology,ltc2488" },
         {},
 };
 MODULE_DEVICE_TABLE(of, spidev_dt_ids);
diff --git a/drivers/staging/board/Kconfig b/drivers/staging/board/Kconfig
index b8ee81840666..3f287c48e082 100644
--- a/drivers/staging/board/Kconfig
+++ b/drivers/staging/board/Kconfig
@@ -1,6 +1,6 @@
 config STAGING_BOARD
         bool "Staging Board Support"
-        depends on OF_ADDRESS
+        depends on OF_ADDRESS && OF_IRQ && CLKDEV_LOOKUP
         help
           Select to enable per-board staging support code.
 
diff --git a/drivers/staging/lustre/lnet/klnds/socklnd/socklnd.h b/drivers/staging/lustre/lnet/klnds/socklnd/socklnd.h
index 7125eb955ae5..8a9d4a0de129 100644
--- a/drivers/staging/lustre/lnet/klnds/socklnd/socklnd.h
+++ b/drivers/staging/lustre/lnet/klnds/socklnd/socklnd.h
@@ -31,7 +31,6 @@
 #define DEBUG_PORTAL_ALLOC
 #define DEBUG_SUBSYSTEM S_LND
 
-#include <asm/irq.h>
 #include <linux/crc32.h>
 #include <linux/errno.h>
 #include <linux/if.h>
diff --git a/drivers/staging/vt6655/device_main.c b/drivers/staging/vt6655/device_main.c
index ed040fbb7df8..b0c8e235b982 100644
--- a/drivers/staging/vt6655/device_main.c
+++ b/drivers/staging/vt6655/device_main.c
@@ -1418,7 +1418,7 @@ static void vnt_bss_info_changed(struct ieee80211_hw *hw,
 
         priv->current_aid = conf->aid;
 
-        if (changed & BSS_CHANGED_BSSID) {
+        if (changed & BSS_CHANGED_BSSID && conf->bssid) {
                 unsigned long flags;
 
                 spin_lock_irqsave(&priv->lock, flags);
diff --git a/drivers/staging/vt6656/main_usb.c b/drivers/staging/vt6656/main_usb.c
index f97323f19acf..af572d718135 100644
--- a/drivers/staging/vt6656/main_usb.c
+++ b/drivers/staging/vt6656/main_usb.c
@@ -701,7 +701,7 @@ static void vnt_bss_info_changed(struct ieee80211_hw *hw,
 
         priv->current_aid = conf->aid;
 
-        if (changed & BSS_CHANGED_BSSID)
+        if (changed & BSS_CHANGED_BSSID && conf->bssid)
                 vnt_mac_set_bssid_addr(priv, (u8 *)conf->bssid);
 
 
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index c9c27f69e101..ee8bfacf2071 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -1108,19 +1108,29 @@ static void eraser(unsigned char c, struct tty_struct *tty)
  *      Locking: ctrl_lock
  */
 
-static void isig(int sig, struct tty_struct *tty)
+static void __isig(int sig, struct tty_struct *tty)
 {
-        struct n_tty_data *ldata = tty->disc_data;
         struct pid *tty_pgrp = tty_get_pgrp(tty);
         if (tty_pgrp) {
                 kill_pgrp(tty_pgrp, sig, 1);
                 put_pid(tty_pgrp);
         }
+}
 
-        if (!L_NOFLSH(tty)) {
+static void isig(int sig, struct tty_struct *tty)
+{
+        struct n_tty_data *ldata = tty->disc_data;
+
+        if (L_NOFLSH(tty)) {
+                /* signal only */
+                __isig(sig, tty);
+
+        } else { /* signal and flush */
                 up_read(&tty->termios_rwsem);
                 down_write(&tty->termios_rwsem);
 
+                __isig(sig, tty);
+
                 /* clear echo buffer */
                 mutex_lock(&ldata->output_lock);
                 ldata->echo_head = ldata->echo_tail = 0;
diff --git a/drivers/tty/serial/Kconfig b/drivers/tty/serial/Kconfig
index 76e65b714471..15b4079a335e 100644
--- a/drivers/tty/serial/Kconfig
+++ b/drivers/tty/serial/Kconfig
@@ -1185,7 +1185,7 @@ config SERIAL_SC16IS7XX_CORE
 config SERIAL_SC16IS7XX
         tristate "SC16IS7xx serial support"
         select SERIAL_CORE
-        depends on I2C || SPI_MASTER
+        depends on (SPI_MASTER && !I2C) || I2C
         help
           This selects support for SC16IS7xx serial ports.
           Supported ICs are SC16IS740, SC16IS741, SC16IS750, SC16IS752,
diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
index 50cf5b10ceed..fd27e986b1dd 100644
--- a/drivers/tty/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
@@ -2310,8 +2310,8 @@ static int pl011_setup_port(struct device *dev, struct uart_amba_port *uap,
         void __iomem *base;
 
         base = devm_ioremap_resource(dev, mmiobase);
-        if (!base)
-                return -ENOMEM;
+        if (IS_ERR(base))
+                return PTR_ERR(base);
 
         index = pl011_probe_dt_alias(index, dev);
 
diff --git a/drivers/tty/serial/etraxfs-uart.c b/drivers/tty/serial/etraxfs-uart.c
index a57301a6fe42..679709f51fd4 100644
--- a/drivers/tty/serial/etraxfs-uart.c
+++ b/drivers/tty/serial/etraxfs-uart.c
@@ -950,7 +950,7 @@ static int etraxfs_uart_remove(struct platform_device *pdev)
 
         port = platform_get_drvdata(pdev);
         uart_remove_one_port(&etraxfs_uart_driver, port);
-        etraxfs_uart_ports[pdev->id] = NULL;
+        etraxfs_uart_ports[port->line] = NULL;
 
         return 0;
 }
diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
index 2c90dc31bfaa..54fdc7866ea1 100644
--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -1121,11 +1121,6 @@ static int imx_startup(struct uart_port *port)
 
         writel(temp & ~UCR4_DREN, sport->port.membase + UCR4);
 
-        /* Can we enable the DMA support? */
-        if (is_imx6q_uart(sport) && !uart_console(port) &&
-            !sport->dma_is_inited)
-                imx_uart_dma_init(sport);
-
         spin_lock_irqsave(&sport->port.lock, flags);
         /* Reset fifo's and state machines */
         i = 100;
@@ -1143,9 +1138,6 @@ static int imx_startup(struct uart_port *port)
         writel(USR1_RTSD, sport->port.membase + USR1);
         writel(USR2_ORE, sport->port.membase + USR2);
 
-        if (sport->dma_is_inited && !sport->dma_is_enabled)
-                imx_enable_dma(sport);
-
         temp = readl(sport->port.membase + UCR1);
         temp |= UCR1_RRDYEN | UCR1_RTSDEN | UCR1_UARTEN;
 
@@ -1316,6 +1308,11 @@ imx_set_termios(struct uart_port *port, struct ktermios *termios,
                         } else {
                                 ucr2 |= UCR2_CTSC;
                         }
+
+                        /* Can we enable the DMA support? */
+                        if (is_imx6q_uart(sport) && !uart_console(port)
+                                && !sport->dma_is_inited)
+                                imx_uart_dma_init(sport);
                 } else {
                         termios->c_cflag &= ~CRTSCTS;
                 }
@@ -1432,6 +1429,8 @@ imx_set_termios(struct uart_port *port, struct ktermios *termios,
         if (UART_ENABLE_MS(&sport->port, termios->c_cflag))
                 imx_enable_ms(&sport->port);
 
+        if (sport->dma_is_inited && !sport->dma_is_enabled)
+                imx_enable_dma(sport);
         spin_unlock_irqrestore(&sport->port.lock, flags);
 }
 
diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c
index 9e6576004a42..5ccc698cbbfa 100644
--- a/drivers/tty/serial/sc16is7xx.c
+++ b/drivers/tty/serial/sc16is7xx.c
@@ -354,6 +354,26 @@ static void sc16is7xx_port_write(struct uart_port *port, u8 reg, u8 val)
                      (reg << SC16IS7XX_REG_SHIFT) | port->line, val);
 }
 
+static void sc16is7xx_fifo_read(struct uart_port *port, unsigned int rxlen)
+{
+        struct sc16is7xx_port *s = dev_get_drvdata(port->dev);
+        u8 addr = (SC16IS7XX_RHR_REG << SC16IS7XX_REG_SHIFT) | port->line;
+
+        regcache_cache_bypass(s->regmap, true);
+        regmap_raw_read(s->regmap, addr, s->buf, rxlen);
+        regcache_cache_bypass(s->regmap, false);
+}
+
+static void sc16is7xx_fifo_write(struct uart_port *port, u8 to_send)
+{
+        struct sc16is7xx_port *s = dev_get_drvdata(port->dev);
+        u8 addr = (SC16IS7XX_THR_REG << SC16IS7XX_REG_SHIFT) | port->line;
+
+        regcache_cache_bypass(s->regmap, true);
+        regmap_raw_write(s->regmap, addr, s->buf, to_send);
+        regcache_cache_bypass(s->regmap, false);
+}
+
 static void sc16is7xx_port_update(struct uart_port *port, u8 reg,
                                   u8 mask, u8 val)
 {
@@ -508,10 +528,7 @@ static void sc16is7xx_handle_rx(struct uart_port *port, unsigned int rxlen,
                         s->buf[0] = sc16is7xx_port_read(port, SC16IS7XX_RHR_REG);
                         bytes_read = 1;
                 } else {
-                        regcache_cache_bypass(s->regmap, true);
-                        regmap_raw_read(s->regmap, SC16IS7XX_RHR_REG,
-                                        s->buf, rxlen);
-                        regcache_cache_bypass(s->regmap, false);
+                        sc16is7xx_fifo_read(port, rxlen);
                         bytes_read = rxlen;
                 }
 
@@ -591,9 +608,8 @@ static void sc16is7xx_handle_tx(struct uart_port *port)
                         s->buf[i] = xmit->buf[xmit->tail];
                         xmit->tail = (xmit->tail + 1) & (UART_XMIT_SIZE - 1);
                 }
-                regcache_cache_bypass(s->regmap, true);
-                regmap_raw_write(s->regmap, SC16IS7XX_THR_REG, s->buf, to_send);
-                regcache_cache_bypass(s->regmap, false);
+
+                sc16is7xx_fifo_write(port, to_send);
         }
 
         if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index 7ae1592f7ec9..f36852067f20 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -1418,7 +1418,7 @@ static void uart_close(struct tty_struct *tty, struct file *filp)
         mutex_lock(&port->mutex);
         uart_shutdown(tty, state);
         tty_port_tty_set(port, NULL);
-        tty->closing = 0;
+
         spin_lock_irqsave(&port->lock, flags);
 
         if (port->blocked_open) {
@@ -1444,6 +1444,7 @@ static void uart_close(struct tty_struct *tty, struct file *filp)
         mutex_unlock(&port->mutex);
 
         tty_ldisc_flush(tty);
+        tty->closing = 0;
 }
 
 static void uart_wait_until_sent(struct tty_struct *tty, int timeout)
diff --git a/drivers/tty/vt/selection.c b/drivers/tty/vt/selection.c
index ea27804d87af..381a2b13682c 100644
--- a/drivers/tty/vt/selection.c
+++ b/drivers/tty/vt/selection.c
@@ -356,6 +356,7 @@ int paste_selection(struct tty_struct *tty)
                         schedule();
                         continue;
                 }
+                __set_current_state(TASK_RUNNING);
                 count = sel_buffer_lth - pasted;
                 count = tty_ldisc_receive_buf(ld, sel_buffer + pasted, NULL,
                                               count);
diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
index 8fe52989b380..4462d167900c 100644
--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -742,6 +742,8 @@ static void visual_init(struct vc_data *vc, int num, int init)
         __module_get(vc->vc_sw->owner);
         vc->vc_num = num;
         vc->vc_display_fg = &master_display_fg;
+        if (vc->vc_uni_pagedir_loc)
+                con_free_unimap(vc);
         vc->vc_uni_pagedir_loc = &vc->vc_uni_pagedir;
         vc->vc_uni_pagedir = NULL;
         vc->vc_hi_font_mask = 0;
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 519a77ba214c..b30e7423549b 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1944,6 +1944,7 @@ static void __exit acm_exit(void)
         usb_deregister(&acm_driver);
         tty_unregister_driver(acm_tty_driver);
         put_tty_driver(acm_tty_driver);
+        idr_destroy(&acm_minors);
 }
 
 module_init(acm_init);
diff --git a/drivers/usb/common/ulpi.c b/drivers/usb/common/ulpi.c
index 0e6f968e93fe..01c0c0477a9e 100644
--- a/drivers/usb/common/ulpi.c
+++ b/drivers/usb/common/ulpi.c
@@ -242,7 +242,7 @@ static int __init ulpi_init(void)
 {
         return bus_register(&ulpi_bus);
 }
-module_init(ulpi_init);
+subsys_initcall(ulpi_init);
 
 static void __exit ulpi_exit(void)
 {
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index be5b2074f906..cbcd0920fb51 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -1022,9 +1022,12 @@ static int register_root_hub(struct usb_hcd *hcd)
                                 dev_name(&usb_dev->dev), retval);
                 return (retval < 0) ? retval : -EMSGSIZE;
         }
-        if (usb_dev->speed == USB_SPEED_SUPER) {
+
+        if (le16_to_cpu(usb_dev->descriptor.bcdUSB) >= 0x0201) {
                 retval = usb_get_bos_descriptor(usb_dev);
-                if (retval < 0) {
+                if (!retval) {
+                        usb_dev->lpm_capable = usb_device_supports_lpm(usb_dev);
+                } else if (usb_dev->speed == USB_SPEED_SUPER) {
                         mutex_unlock(&usb_bus_list_lock);
                         dev_dbg(parent_dev, "can't read %s bos descriptor %d\n",
                                         dev_name(&usb_dev->dev), retval);
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 43cb2f2e3b43..73dfa194160b 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -122,7 +122,7 @@ struct usb_hub *usb_hub_to_struct_hub(struct usb_device *hdev)
         return usb_get_intfdata(hdev->actconfig->interface[0]);
 }
 
-static int usb_device_supports_lpm(struct usb_device *udev)
+int usb_device_supports_lpm(struct usb_device *udev)
 {
         /* USB 2.1 (and greater) devices indicate LPM support through
          * their USB 2.0 Extended Capabilities BOS descriptor.
diff --git a/drivers/usb/core/usb.h b/drivers/usb/core/usb.h
index 7eb1e26798e5..457255a3306a 100644
--- a/drivers/usb/core/usb.h
+++ b/drivers/usb/core/usb.h
@@ -65,6 +65,7 @@ extern int  usb_hub_init(void);
 extern void usb_hub_cleanup(void);
 extern int usb_major_init(void);
 extern void usb_major_cleanup(void);
+extern int usb_device_supports_lpm(struct usb_device *udev);
 
 #ifdef  CONFIG_PM
 
diff --git a/drivers/usb/dwc2/core.c b/drivers/usb/dwc2/core.c
index e5b546f1152e..c3cc1a78d1e2 100644
--- a/drivers/usb/dwc2/core.c
+++ b/drivers/usb/dwc2/core.c
@@ -72,17 +72,7 @@ static int dwc2_backup_host_registers(struct dwc2_hsotg *hsotg)
         dev_dbg(hsotg->dev, "%s\n", __func__);
 
         /* Backup Host regs */
-        hr = hsotg->hr_backup;
-        if (!hr) {
-                hr = devm_kzalloc(hsotg->dev, sizeof(*hr), GFP_KERNEL);
-                if (!hr) {
-                        dev_err(hsotg->dev, "%s: can't allocate host regs\n",
-                                        __func__);
-                        return -ENOMEM;
-                }
-
-                hsotg->hr_backup = hr;
-        }
+        hr = &hsotg->hr_backup;
         hr->hcfg = readl(hsotg->regs + HCFG);
         hr->haintmsk = readl(hsotg->regs + HAINTMSK);
         for (i = 0; i < hsotg->core_params->host_channels; ++i)
@@ -90,6 +80,7 @@ static int dwc2_backup_host_registers(struct dwc2_hsotg *hsotg)
 
         hr->hprt0 = readl(hsotg->regs + HPRT0);
         hr->hfir = readl(hsotg->regs + HFIR);
+        hr->valid = true;
 
         return 0;
 }
@@ -109,12 +100,13 @@ static int dwc2_restore_host_registers(struct dwc2_hsotg *hsotg)
         dev_dbg(hsotg->dev, "%s\n", __func__);
 
         /* Restore host regs */
-        hr = hsotg->hr_backup;
-        if (!hr) {
+        hr = &hsotg->hr_backup;
+        if (!hr->valid) {
                 dev_err(hsotg->dev, "%s: no host registers to restore\n",
                                 __func__);
                 return -EINVAL;
         }
+        hr->valid = false;
 
         writel(hr->hcfg, hsotg->regs + HCFG);
         writel(hr->haintmsk, hsotg->regs + HAINTMSK);
@@ -152,17 +144,7 @@ static int dwc2_backup_device_registers(struct dwc2_hsotg *hsotg)
         dev_dbg(hsotg->dev, "%s\n", __func__);
 
         /* Backup dev regs */
-        dr = hsotg->dr_backup;
-        if (!dr) {
-                dr = devm_kzalloc(hsotg->dev, sizeof(*dr), GFP_KERNEL);
-                if (!dr) {
-                        dev_err(hsotg->dev, "%s: can't allocate device regs\n",
-                                        __func__);
-                        return -ENOMEM;
-                }
-
-                hsotg->dr_backup = dr;
-        }
+        dr = &hsotg->dr_backup;
 
         dr->dcfg = readl(hsotg->regs + DCFG);
         dr->dctl = readl(hsotg->regs + DCTL);
@@ -195,7 +177,7 @@ static int dwc2_backup_device_registers(struct dwc2_hsotg *hsotg)
                 dr->doeptsiz[i] = readl(hsotg->regs + DOEPTSIZ(i));
                 dr->doepdma[i] = readl(hsotg->regs + DOEPDMA(i));
         }
-
+        dr->valid = true;
         return 0;
 }
 
@@ -215,12 +197,13 @@ static int dwc2_restore_device_registers(struct dwc2_hsotg *hsotg)
         dev_dbg(hsotg->dev, "%s\n", __func__);
 
         /* Restore dev regs */
-        dr = hsotg->dr_backup;
-        if (!dr) {
+        dr = &hsotg->dr_backup;
+        if (!dr->valid) {
                 dev_err(hsotg->dev, "%s: no device registers to restore\n",
                                 __func__);
                 return -EINVAL;
         }
+        dr->valid = false;
 
         writel(dr->dcfg, hsotg->regs + DCFG);
         writel(dr->dctl, hsotg->regs + DCTL);
@@ -268,17 +251,7 @@ static int dwc2_backup_global_registers(struct dwc2_hsotg *hsotg)
         int i;
 
         /* Backup global regs */
-        gr = hsotg->gr_backup;
-        if (!gr) {
-                gr = devm_kzalloc(hsotg->dev, sizeof(*gr), GFP_KERNEL);
-                if (!gr) {
-                        dev_err(hsotg->dev, "%s: can't allocate global regs\n",
-                                        __func__);
-                        return -ENOMEM;
-                }
-
-                hsotg->gr_backup = gr;
-        }
+        gr = &hsotg->gr_backup;
 
         gr->gotgctl = readl(hsotg->regs + GOTGCTL);
         gr->gintmsk = readl(hsotg->regs + GINTMSK);
@@ -291,6 +264,7 @@ static int dwc2_backup_global_registers(struct dwc2_hsotg *hsotg)
         for (i = 0; i < MAX_EPS_CHANNELS; i++)
                 gr->dtxfsiz[i] = readl(hsotg->regs + DPTXFSIZN(i));
 
+        gr->valid = true;
         return 0;
 }
 
@@ -309,12 +283,13 @@ static int dwc2_restore_global_registers(struct dwc2_hsotg *hsotg)
         dev_dbg(hsotg->dev, "%s\n", __func__);
 
         /* Restore global regs */
-        gr = hsotg->gr_backup;
-        if (!gr) {
+        gr = &hsotg->gr_backup;
+        if (!gr->valid) {
                 dev_err(hsotg->dev, "%s: no global registers to restore\n",
                                 __func__);
                 return -EINVAL;
         }
+        gr->valid = false;
 
         writel(0xffffffff, hsotg->regs + GINTSTS);
         writel(gr->gotgctl, hsotg->regs + GOTGCTL);
diff --git a/drivers/usb/dwc2/core.h b/drivers/usb/dwc2/core.h
index 53b8de03f102..0ed87620941b 100644
--- a/drivers/usb/dwc2/core.h
+++ b/drivers/usb/dwc2/core.h
@@ -492,6 +492,7 @@ struct dwc2_gregs_backup {
         u32 gdfifocfg;
         u32 dtxfsiz[MAX_EPS_CHANNELS];
         u32 gpwrdn;
+        bool valid;
 };
 
 /**
@@ -521,6 +522,7 @@ struct dwc2_dregs_backup {
         u32 doepctl[MAX_EPS_CHANNELS];
         u32 doeptsiz[MAX_EPS_CHANNELS];
         u32 doepdma[MAX_EPS_CHANNELS];
+        bool valid;
 };
 
 /**
@@ -538,6 +540,7 @@ struct dwc2_hregs_backup {
         u32 hcintmsk[MAX_EPS_CHANNELS];
         u32 hprt0;
         u32 hfir;
+        bool valid;
 };
 
 /**
@@ -705,9 +708,9 @@ struct dwc2_hsotg {
         struct work_struct wf_otg;
         struct timer_list wkp_timer;
         enum dwc2_lx_state lx_state;
-        struct dwc2_gregs_backup *gr_backup;
-        struct dwc2_dregs_backup *dr_backup;
-        struct dwc2_hregs_backup *hr_backup;
+        struct dwc2_gregs_backup gr_backup;
+        struct dwc2_dregs_backup dr_backup;
+        struct dwc2_hregs_backup hr_backup;
 
         struct dentry *debug_root;
         struct debugfs_regset32 *regset;
diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
index b10377c65064..f845c41fe9e5 100644
--- a/drivers/usb/dwc2/hcd.c
+++ b/drivers/usb/dwc2/hcd.c
@@ -359,10 +359,9 @@ void dwc2_hcd_stop(struct dwc2_hsotg *hsotg)
 
 /* Caller must hold driver lock */
 static int dwc2_hcd_urb_enqueue(struct dwc2_hsotg *hsotg,
-                                struct dwc2_hcd_urb *urb, void **ep_handle,
-                                gfp_t mem_flags)
+                                struct dwc2_hcd_urb *urb, struct dwc2_qh *qh,
+                                struct dwc2_qtd *qtd)
 {
-        struct dwc2_qtd *qtd;
         u32 intr_mask;
         int retval;
         int dev_speed;
@@ -386,18 +385,15 @@ static int dwc2_hcd_urb_enqueue(struct dwc2_hsotg *hsotg,
                         return -ENODEV;
         }
 
-        qtd = kzalloc(sizeof(*qtd), mem_flags);
         if (!qtd)
-                return -ENOMEM;
+                return -EINVAL;
 
         dwc2_hcd_qtd_init(qtd, urb);
-        retval = dwc2_hcd_qtd_add(hsotg, qtd, (struct dwc2_qh **)ep_handle,
-                                  mem_flags);
+        retval = dwc2_hcd_qtd_add(hsotg, qtd, qh);
         if (retval) {
                 dev_err(hsotg->dev,
                         "DWC OTG HCD URB Enqueue failed adding QTD. Error status %d\n",
                         retval);
-                kfree(qtd);
                 return retval;
         }
 
@@ -2445,6 +2441,9 @@ static int _dwc2_hcd_urb_enqueue(struct usb_hcd *hcd, struct urb *urb,
         u32 tflags = 0;
         void *buf;
         unsigned long flags;
+        struct dwc2_qh *qh;
+        bool qh_allocated = false;
+        struct dwc2_qtd *qtd;
 
         if (dbg_urb(urb)) {
                 dev_vdbg(hsotg->dev, "DWC OTG HCD URB Enqueue\n");
@@ -2523,15 +2522,32 @@ static int _dwc2_hcd_urb_enqueue(struct usb_hcd *hcd, struct urb *urb,
                                                  urb->iso_frame_desc[i].length);
 
         urb->hcpriv = dwc2_urb;
+        qh = (struct dwc2_qh *) ep->hcpriv;
+        /* Create QH for the endpoint if it doesn't exist */
+        if (!qh) {
+                qh = dwc2_hcd_qh_create(hsotg, dwc2_urb, mem_flags);
+                if (!qh) {
+                        retval = -ENOMEM;
+                        goto fail0;
+                }
+                ep->hcpriv = qh;
+                qh_allocated = true;
+        }
+
+        qtd = kzalloc(sizeof(*qtd), mem_flags);
+        if (!qtd) {
+                retval = -ENOMEM;
+                goto fail1;
+        }
 
         spin_lock_irqsave(&hsotg->lock, flags);
         retval = usb_hcd_link_urb_to_ep(hcd, urb);
         if (retval)
-                goto fail1;
+                goto fail2;
 
-        retval = dwc2_hcd_urb_enqueue(hsotg, dwc2_urb, &ep->hcpriv, mem_flags);
+        retval = dwc2_hcd_urb_enqueue(hsotg, dwc2_urb, qh, qtd);
         if (retval)
-                goto fail2;
+                goto fail3;
 
         if (alloc_bandwidth) {
                 dwc2_allocate_bus_bandwidth(hcd,
@@ -2543,12 +2559,25 @@ static int _dwc2_hcd_urb_enqueue(struct usb_hcd *hcd, struct urb *urb,
 
         return 0;
 
-fail2:
+fail3:
         dwc2_urb->priv = NULL;
         usb_hcd_unlink_urb_from_ep(hcd, urb);
-fail1:
+fail2:
         spin_unlock_irqrestore(&hsotg->lock, flags);
         urb->hcpriv = NULL;
+        kfree(qtd);
+fail1:
+        if (qh_allocated) {
+                struct dwc2_qtd *qtd2, *qtd2_tmp;
+
+                ep->hcpriv = NULL;
+                dwc2_hcd_qh_unlink(hsotg, qh);
+                /* Free each QTD in the QH's QTD list */
+                list_for_each_entry_safe(qtd2, qtd2_tmp, &qh->qtd_list,
+                                                         qtd_list_entry)
+                        dwc2_hcd_qtd_unlink_and_free(hsotg, qtd2, qh);
+                dwc2_hcd_qh_free(hsotg, qh);
+        }
 fail0:
         kfree(dwc2_urb);
 
diff --git a/drivers/usb/dwc2/hcd.h b/drivers/usb/dwc2/hcd.h
index 7b5841c40033..fc1054965552 100644
--- a/drivers/usb/dwc2/hcd.h
+++ b/drivers/usb/dwc2/hcd.h
@@ -463,6 +463,9 @@ extern void dwc2_hcd_queue_transactions(struct dwc2_hsotg *hsotg,
 /* Schedule Queue Functions */
 /* Implemented in hcd_queue.c */
 extern void dwc2_hcd_init_usecs(struct dwc2_hsotg *hsotg);
+extern struct dwc2_qh *dwc2_hcd_qh_create(struct dwc2_hsotg *hsotg,
+                                          struct dwc2_hcd_urb *urb,
+                                          gfp_t mem_flags);
 extern void dwc2_hcd_qh_free(struct dwc2_hsotg *hsotg, struct dwc2_qh *qh);
 extern int dwc2_hcd_qh_add(struct dwc2_hsotg *hsotg, struct dwc2_qh *qh);
 extern void dwc2_hcd_qh_unlink(struct dwc2_hsotg *hsotg, struct dwc2_qh *qh);
@@ -471,7 +474,7 @@ extern void dwc2_hcd_qh_deactivate(struct dwc2_hsotg *hsotg, struct dwc2_qh *qh,
 
 extern void dwc2_hcd_qtd_init(struct dwc2_qtd *qtd, struct dwc2_hcd_urb *urb);
 extern int dwc2_hcd_qtd_add(struct dwc2_hsotg *hsotg, struct dwc2_qtd *qtd,
-                            struct dwc2_qh **qh, gfp_t mem_flags);
+                            struct dwc2_qh *qh);
 
 /* Unlinks and frees a QTD */
 static inline void dwc2_hcd_qtd_unlink_and_free(struct dwc2_hsotg *hsotg,
diff --git a/drivers/usb/dwc2/hcd_queue.c b/drivers/usb/dwc2/hcd_queue.c
index 9b5c36256627..3ad63d392e13 100644
--- a/drivers/usb/dwc2/hcd_queue.c
+++ b/drivers/usb/dwc2/hcd_queue.c
@@ -191,7 +191,7 @@ static void dwc2_qh_init(struct dwc2_hsotg *hsotg, struct dwc2_qh *qh,
  *
  * Return: Pointer to the newly allocated QH, or NULL on error
  */
-static struct dwc2_qh *dwc2_hcd_qh_create(struct dwc2_hsotg *hsotg,
+struct dwc2_qh *dwc2_hcd_qh_create(struct dwc2_hsotg *hsotg,
                                           struct dwc2_hcd_urb *urb,
                                           gfp_t mem_flags)
 {
@@ -767,57 +767,32 @@ void dwc2_hcd_qtd_init(struct dwc2_qtd *qtd, struct dwc2_hcd_urb *urb)
  *
  * @hsotg:        The DWC HCD structure
  * @qtd:          The QTD to add
- * @qh:           Out parameter to return queue head
- * @atomic_alloc: Flag to do atomic alloc if needed
+ * @qh:           Queue head to add qtd to
  *
  * Return: 0 if successful, negative error code otherwise
  *
- * Finds the correct QH to place the QTD into. If it does not find a QH, it
- * will create a new QH. If the QH to which the QTD is added is not currently
- * scheduled, it is placed into the proper schedule based on its EP type.
+ * If the QH to which the QTD is added is not currently scheduled, it is placed
+ * into the proper schedule based on its EP type.
  */
 int dwc2_hcd_qtd_add(struct dwc2_hsotg *hsotg, struct dwc2_qtd *qtd,
-                     struct dwc2_qh **qh, gfp_t mem_flags)
+                     struct dwc2_qh *qh)
 {
-        struct dwc2_hcd_urb *urb = qtd->urb;
-        int allocated = 0;
         int retval;
 
-        /*
-         * Get the QH which holds the QTD-list to insert to. Create QH if it
-         * doesn't exist.
-         */
-        if (*qh == NULL) {
-                *qh = dwc2_hcd_qh_create(hsotg, urb, mem_flags);
-                if (*qh == NULL)
-                        return -ENOMEM;
-                allocated = 1;
+        if (unlikely(!qh)) {
+                dev_err(hsotg->dev, "%s: Invalid QH\n", __func__);
+                retval = -EINVAL;
+                goto fail;
         }
 
-        retval = dwc2_hcd_qh_add(hsotg, *qh);
+        retval = dwc2_hcd_qh_add(hsotg, qh);
         if (retval)
                 goto fail;
 
-        qtd->qh = *qh;
-        list_add_tail(&qtd->qtd_list_entry, &(*qh)->qtd_list);
+        qtd->qh = qh;
+        list_add_tail(&qtd->qtd_list_entry, &qh->qtd_list);
 
         return 0;
-
 fail:
-        if (allocated) {
-                struct dwc2_qtd *qtd2, *qtd2_tmp;
-                struct dwc2_qh *qh_tmp = *qh;
-
-                *qh = NULL;
-                dwc2_hcd_qh_unlink(hsotg, qh_tmp);
-
-                /* Free each QTD in the QH's QTD list */
-                list_for_each_entry_safe(qtd2, qtd2_tmp, &qh_tmp->qtd_list,
-                                         qtd_list_entry)
-                        dwc2_hcd_qtd_unlink_and_free(hsotg, qtd2, qh_tmp);
-
-                dwc2_hcd_qh_free(hsotg, qh_tmp);
-        }
-
         return retval;
 }
diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index 5c110d8e293b..ff5773c66b84 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -446,10 +446,12 @@ static int dwc3_phy_setup(struct dwc3 *dwc)
         /* Select the HS PHY interface */
         switch (DWC3_GHWPARAMS3_HSPHY_IFC(dwc->hwparams.hwparams3)) {
         case DWC3_GHWPARAMS3_HSPHY_IFC_UTMI_ULPI:
-                if (!strncmp(dwc->hsphy_interface, "utmi", 4)) {
+                if (dwc->hsphy_interface &&
+                                !strncmp(dwc->hsphy_interface, "utmi", 4)) {
                         reg &= ~DWC3_GUSB2PHYCFG_ULPI_UTMI;
                         break;
-                } else if (!strncmp(dwc->hsphy_interface, "ulpi", 4)) {
+                } else if (dwc->hsphy_interface &&
+                                !strncmp(dwc->hsphy_interface, "ulpi", 4)) {
                         reg |= DWC3_GUSB2PHYCFG_ULPI_UTMI;
                         dwc3_writel(dwc->regs, DWC3_GUSB2PHYCFG(0), reg);
                 } else {
diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
index 2ef3c8d6a9db..69e769c35cf5 100644
--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -727,6 +727,10 @@ static int dwc3_ep0_std_request(struct dwc3 *dwc, struct usb_ctrlrequest *ctrl)
                 dwc3_trace(trace_dwc3_ep0, "USB_REQ_SET_ISOCH_DELAY");
                 ret = dwc3_ep0_set_isoch_delay(dwc, ctrl);
                 break;
+        case USB_REQ_SET_INTERFACE:
+                dwc3_trace(trace_dwc3_ep0, "USB_REQ_SET_INTERFACE");
+                dwc->start_config_issued = false;
+                /* Fall through */
         default:
                 dwc3_trace(trace_dwc3_ep0, "Forwarding to gadget driver");
                 ret = dwc3_ep0_delegate_req(dwc, ctrl);
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index 4e3447bbd097..58b4657fc721 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -1758,10 +1758,13 @@ unknown:
                  * take such requests too, if that's ever needed:  to work
                  * in config 0, etc.
                  */
-                list_for_each_entry(f, &cdev->config->functions, list)
-                        if (f->req_match && f->req_match(f, ctrl))
-                                goto try_fun_setup;
-                f = NULL;
+                if (cdev->config) {
+                        list_for_each_entry(f, &cdev->config->functions, list)
+                                if (f->req_match && f->req_match(f, ctrl))
+                                        goto try_fun_setup;
+                        f = NULL;
+                }
+
                 switch (ctrl->bRequestType & USB_RECIP_MASK) {
                 case USB_RECIP_INTERFACE:
                         if (!cdev->config || intf >= MAX_CONFIG_INTERFACES)
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 0495c94a23d7..289e20119fea 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -571,7 +571,7 @@ static struct config_group *function_make(
         if (IS_ERR(fi))
                 return ERR_CAST(fi);
 
-        ret = config_item_set_name(&fi->group.cg_item, name);
+        ret = config_item_set_name(&fi->group.cg_item, "%s", name);
         if (ret) {
                 usb_put_function_instance(fi);
                 return ERR_PTR(ret);
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 45b8c8b338df..6e7be91e6097 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -924,7 +924,8 @@ static ssize_t ffs_epfile_write_iter(struct kiocb *kiocb, struct iov_iter *from)
 
         kiocb->private = p;
 
-        kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
+        if (p->aio)
+                kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
 
         res = ffs_epfile_io(kiocb->ki_filp, p);
         if (res == -EIOCBQUEUED)
@@ -968,7 +969,8 @@ static ssize_t ffs_epfile_read_iter(struct kiocb *kiocb, struct iov_iter *to)
 
         kiocb->private = p;
 
-        kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
+        if (p->aio)
+                kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
 
         res = ffs_epfile_io(kiocb->ki_filp, p);
         if (res == -EIOCBQUEUED)
diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c
index d2259c663996..f936268d26c6 100644
--- a/drivers/usb/gadget/function/f_mass_storage.c
+++ b/drivers/usb/gadget/function/f_mass_storage.c
@@ -2786,7 +2786,7 @@ int fsg_common_set_nluns(struct fsg_common *common, int nluns)
                 return -EINVAL;
         }
 
-        curlun = kcalloc(nluns, sizeof(*curlun), GFP_KERNEL);
+        curlun = kcalloc(FSG_MAX_LUNS, sizeof(*curlun), GFP_KERNEL);
         if (unlikely(!curlun))
                 return -ENOMEM;
 
@@ -2796,8 +2796,6 @@ int fsg_common_set_nluns(struct fsg_common *common, int nluns)
         common->luns = curlun;
         common->nluns = nluns;
 
-        pr_info("Number of LUNs=%d\n", common->nluns);
-
         return 0;
 }
 EXPORT_SYMBOL_GPL(fsg_common_set_nluns);
@@ -3563,14 +3561,26 @@ static struct usb_function *fsg_alloc(struct usb_function_instance *fi)
         struct fsg_opts *opts = fsg_opts_from_func_inst(fi);
         struct fsg_common *common = opts->common;
         struct fsg_dev *fsg;
+        unsigned nluns, i;
 
         fsg = kzalloc(sizeof(*fsg), GFP_KERNEL);
         if (unlikely(!fsg))
                 return ERR_PTR(-ENOMEM);
 
         mutex_lock(&opts->lock);
+        if (!opts->refcnt) {
+                for (nluns = i = 0; i < FSG_MAX_LUNS; ++i)
+                        if (common->luns[i])
+                                nluns = i + 1;
+                if (!nluns)
+                        pr_warn("No LUNS defined, continuing anyway\n");
+                else
+                        common->nluns = nluns;
+                pr_info("Number of LUNs=%u\n", common->nluns);
+        }
         opts->refcnt++;
         mutex_unlock(&opts->lock);
+
         fsg->function.name      = FSG_DRIVER_DESC;
         fsg->function.bind      = fsg_bind;
         fsg->function.unbind    = fsg_unbind;
diff --git a/drivers/usb/gadget/function/f_midi.c b/drivers/usb/gadget/function/f_midi.c
index 6316aa5b1c49..ad50a67c1465 100644
--- a/drivers/usb/gadget/function/f_midi.c
+++ b/drivers/usb/gadget/function/f_midi.c
@@ -1145,7 +1145,7 @@ static struct usb_function *f_midi_alloc(struct usb_function_instance *fi)
         if (opts->id && !midi->id) {
                 status = -ENOMEM;
                 mutex_unlock(&opts->lock);
-                goto kstrdup_fail;
+                goto setup_fail;
         }
         midi->in_ports = opts->in_ports;
         midi->out_ports = opts->out_ports;
@@ -1164,8 +1164,6 @@ static struct usb_function *f_midi_alloc(struct usb_function_instance *fi)
 
         return &midi->func;
 
-kstrdup_fail:
-        f_midi_unregister_card(midi);
 setup_fail:
         for (--i; i >= 0; i--)
                 kfree(midi->in_port[i]);
diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c
index e547ea7f56b1..1137e3384218 100644
--- a/drivers/usb/gadget/udc/fotg210-udc.c
+++ b/drivers/usb/gadget/udc/fotg210-udc.c
@@ -1171,7 +1171,7 @@ static int fotg210_udc_probe(struct platform_device *pdev)
                           udc_name, fotg210);
         if (ret < 0) {
                 pr_err("request_irq error (%d)\n", ret);
-                goto err_irq;
+                goto err_req;
         }
 
         ret = usb_add_gadget_udc(&pdev->dev, &fotg210->gadget);
@@ -1183,7 +1183,6 @@ static int fotg210_udc_probe(struct platform_device *pdev)
         return 0;
 
 err_add_udc:
-err_irq:
         free_irq(ires->start, fotg210);
 
 err_req:
diff --git a/drivers/usb/gadget/udc/mv_udc_core.c b/drivers/usb/gadget/udc/mv_udc_core.c
index d32160d6463f..5da37c957b53 100644
--- a/drivers/usb/gadget/udc/mv_udc_core.c
+++ b/drivers/usb/gadget/udc/mv_udc_core.c
@@ -2167,7 +2167,7 @@ static int mv_udc_probe(struct platform_device *pdev)
                 return -ENODEV;
         }
 
-        udc->phy_regs = ioremap(r->start, resource_size(r));
+        udc->phy_regs = devm_ioremap(&pdev->dev, r->start, resource_size(r));
         if (udc->phy_regs == NULL) {
                 dev_err(&pdev->dev, "failed to map phy I/O memory\n");
                 return -EBUSY;
diff --git a/drivers/usb/gadget/udc/udc-core.c b/drivers/usb/gadget/udc/udc-core.c
index d69c35558f68..362ee8af5fce 100644
--- a/drivers/usb/gadget/udc/udc-core.c
+++ b/drivers/usb/gadget/udc/udc-core.c
@@ -60,13 +60,15 @@ static DEFINE_MUTEX(udc_lock);
 int usb_gadget_map_request(struct usb_gadget *gadget,
                 struct usb_request *req, int is_in)
 {
+        struct device *dev = gadget->dev.parent;
+
         if (req->length == 0)
                 return 0;
 
         if (req->num_sgs) {
                 int     mapped;
 
-                mapped = dma_map_sg(&gadget->dev, req->sg, req->num_sgs,
+                mapped = dma_map_sg(dev, req->sg, req->num_sgs,
                                 is_in ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
                 if (mapped == 0) {
                         dev_err(&gadget->dev, "failed to map SGs\n");
@@ -75,11 +77,11 @@ int usb_gadget_map_request(struct usb_gadget *gadget,
 
                 req->num_mapped_sgs = mapped;
         } else {
-                req->dma = dma_map_single(&gadget->dev, req->buf, req->length,
+                req->dma = dma_map_single(dev, req->buf, req->length,
                                 is_in ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
 
-                if (dma_mapping_error(&gadget->dev, req->dma)) {
-                        dev_err(&gadget->dev, "failed to map buffer\n");
+                if (dma_mapping_error(dev, req->dma)) {
+                        dev_err(dev, "failed to map buffer\n");
                         return -EFAULT;
                 }
         }
@@ -95,12 +97,12 @@ void usb_gadget_unmap_request(struct usb_gadget *gadget,
                 return;
 
         if (req->num_mapped_sgs) {
-                dma_unmap_sg(&gadget->dev, req->sg, req->num_mapped_sgs,
+                dma_unmap_sg(gadget->dev.parent, req->sg, req->num_mapped_sgs,
                                 is_in ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
 
                 req->num_mapped_sgs = 0;
         } else {
-                dma_unmap_single(&gadget->dev, req->dma, req->length,
+                dma_unmap_single(gadget->dev.parent, req->dma, req->length,
                                 is_in ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
         }
 }
diff --git a/drivers/usb/host/ohci-q.c b/drivers/usb/host/ohci-q.c
index f7d561ed3c23..d029bbe9eb36 100644
--- a/drivers/usb/host/ohci-q.c
+++ b/drivers/usb/host/ohci-q.c
@@ -981,10 +981,6 @@ rescan_all:
                 int                     completed, modified;
                 __hc32                  *prev;
 
-                /* Is this ED already invisible to the hardware? */
-                if (ed->state == ED_IDLE)
-                        goto ed_idle;
-
                 /* only take off EDs that the HC isn't using, accounting for
                  * frame counter wraps and EDs with partially retired TDs
                  */
@@ -1012,12 +1008,10 @@ skip_ed:
                 }
 
                 /* ED's now officially unlinked, hc doesn't see */
-                ed->state = ED_IDLE;
                 ed->hwHeadP &= ~cpu_to_hc32(ohci, ED_H);
                 ed->hwNextED = 0;
                 wmb();
                 ed->hwINFO &= ~cpu_to_hc32(ohci, ED_SKIP | ED_DEQUEUE);
-ed_idle:
 
                 /* reentrancy:  if we drop the schedule lock, someone might
                  * have modified this list.  normally it's just prepending
@@ -1088,6 +1082,7 @@ rescan_this:
                 if (list_empty(&ed->td_list)) {
                         *last = ed->ed_next;
                         ed->ed_next = NULL;
+                        ed->state = ED_IDLE;
                         list_del(&ed->in_use_list);
                 } else if (ohci->rh_state == OHCI_RH_RUNNING) {
                         *last = ed->ed_next;
diff --git a/drivers/usb/host/ohci-tmio.c b/drivers/usb/host/ohci-tmio.c
index e9a6eec39142..cfcfadfc94fc 100644
--- a/drivers/usb/host/ohci-tmio.c
+++ b/drivers/usb/host/ohci-tmio.c
@@ -58,7 +58,7 @@
 #define CCR_PM_CKRNEN    0x0002
 #define CCR_PM_USBPW1    0x0004
 #define CCR_PM_USBPW2    0x0008
-#define CCR_PM_USBPW3    0x0008
+#define CCR_PM_USBPW3    0x0010
 #define CCR_PM_PMEE      0x0100
 #define CCR_PM_PMES      0x8000
 
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index e75c565feb53..78241b5550df 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -484,10 +484,13 @@ static void xhci_hub_report_usb3_link_state(struct xhci_hcd *xhci,
         u32 pls = status_reg & PORT_PLS_MASK;
 
         /* resume state is a xHCI internal state.
-         * Do not report it to usb core.
+         * Do not report it to usb core, instead, pretend to be U3,
+         * thus usb core knows it's not ready for transfer
          */
-        if (pls == XDEV_RESUME)
+        if (pls == XDEV_RESUME) {
+                *status |= USB_SS_PORT_LS_U3;
                 return;
+        }
 
         /* When the CAS bit is set then warm reset
          * should be performed on port
@@ -588,7 +591,14 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
                 status |= USB_PORT_STAT_C_RESET << 16;
         /* USB3.0 only */
         if (hcd->speed == HCD_USB3) {
-                if ((raw_port_status & PORT_PLC))
+                /* Port link change with port in resume state should not be
+                 * reported to usbcore, as this is an internal state to be
+                 * handled by xhci driver. Reporting PLC to usbcore may
+                 * cause usbcore clearing PLC first and port change event
+                 * irq won't be generated.
+                 */
+                if ((raw_port_status & PORT_PLC) &&
+                        (raw_port_status & PORT_PLS_MASK) != XDEV_RESUME)
                         status |= USB_PORT_STAT_C_LINK_STATE << 16;
                 if ((raw_port_status & PORT_WRC))
                         status |= USB_PORT_STAT_C_BH_RESET << 16;
@@ -1120,10 +1130,10 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
         spin_lock_irqsave(&xhci->lock, flags);
 
         if (hcd->self.root_hub->do_remote_wakeup) {
-                if (bus_state->resuming_ports) {
+                if (bus_state->resuming_ports ||        /* USB2 */
+                    bus_state->port_remote_wakeup) {    /* USB3 */
                         spin_unlock_irqrestore(&xhci->lock, flags);
-                        xhci_dbg(xhci, "suspend failed because "
-                                                "a port is resuming\n");
+                        xhci_dbg(xhci, "suspend failed because a port is resuming\n");
                         return -EBUSY;
                 }
         }
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index f8336408ef07..3e442f77a2b9 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -1427,10 +1427,10 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
                 /* Attempt to use the ring cache */
                 if (virt_dev->num_rings_cached == 0)
                         return -ENOMEM;
+                virt_dev->num_rings_cached--;
                 virt_dev->eps[ep_index].new_ring =
                         virt_dev->ring_cache[virt_dev->num_rings_cached];
                 virt_dev->ring_cache[virt_dev->num_rings_cached] = NULL;
-                virt_dev->num_rings_cached--;
                 xhci_reinit_cached_ring(xhci, virt_dev->eps[ep_index].new_ring,
                                         1, type);
         }
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 4a4cb1d91ac8..5590eac2b22d 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -23,10 +23,15 @@
 #include <linux/pci.h>
 #include <linux/slab.h>
 #include <linux/module.h>
+#include <linux/acpi.h>
 
 #include "xhci.h"
 #include "xhci-trace.h"
 
+#define PORT2_SSIC_CONFIG_REG2  0x883c
+#define PROG_DONE               (1 << 30)
+#define SSIC_PORT_UNUSED        (1 << 31)
+
 /* Device for a quirk */
 #define PCI_VENDOR_ID_FRESCO_LOGIC      0x1b73
 #define PCI_DEVICE_ID_FRESCO_LOGIC_PDK  0x1000
@@ -176,20 +181,63 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
 }
 
 /*
+ * In some Intel xHCI controllers, in order to get D3 working,
+ * through a vendor specific SSIC CONFIG register at offset 0x883c,
+ * SSIC PORT need to be marked as "unused" before putting xHCI
+ * into D3. After D3 exit, the SSIC port need to be marked as "used".
+ * Without this change, xHCI might not enter D3 state.
  * Make sure PME works on some Intel xHCI controllers by writing 1 to clear
  * the Internal PME flag bit in vendor specific PMCTRL register at offset 0x80a4
  */
-static void xhci_pme_quirk(struct xhci_hcd *xhci)
+static void xhci_pme_quirk(struct usb_hcd *hcd, bool suspend)
 {
+        struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+        struct pci_dev          *pdev = to_pci_dev(hcd->self.controller);
         u32 val;
         void __iomem *reg;
 
+        if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
+                 pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI) {
+
+                reg = (void __iomem *) xhci->cap_regs + PORT2_SSIC_CONFIG_REG2;
+
+                /* Notify SSIC that SSIC profile programming is not done */
+                val = readl(reg) & ~PROG_DONE;
+                writel(val, reg);
+
+                /* Mark SSIC port as unused(suspend) or used(resume) */
+                val = readl(reg);
+                if (suspend)
+                        val |= SSIC_PORT_UNUSED;
+                else
+                        val &= ~SSIC_PORT_UNUSED;
+                writel(val, reg);
+
+                /* Notify SSIC that SSIC profile programming is done */
+                val = readl(reg) | PROG_DONE;
+                writel(val, reg);
+                readl(reg);
+        }
+
         reg = (void __iomem *) xhci->cap_regs + 0x80a4;
         val = readl(reg);
         writel(val | BIT(28), reg);
         readl(reg);
 }
 
+#ifdef CONFIG_ACPI
+static void xhci_pme_acpi_rtd3_enable(struct pci_dev *dev)
+{
+        static const u8 intel_dsm_uuid[] = {
+                0xb7, 0x0c, 0x34, 0xac, 0x01, 0xe9, 0xbf, 0x45,
+                0xb7, 0xe6, 0x2b, 0x34, 0xec, 0x93, 0x1e, 0x23,
+        };
+        acpi_evaluate_dsm(ACPI_HANDLE(&dev->dev), intel_dsm_uuid, 3, 1, NULL);
+}
+#else
+        static void xhci_pme_acpi_rtd3_enable(struct pci_dev *dev) { }
+#endif /* CONFIG_ACPI */
+
 /* called during probe() after chip reset completes */
 static int xhci_pci_setup(struct usb_hcd *hcd)
 {
@@ -263,6 +311,9 @@ static int xhci_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
                         HCC_MAX_PSA(xhci->hcc_params) >= 4)
                 xhci->shared_hcd->can_do_streams = 1;
 
+        if (xhci->quirks & XHCI_PME_STUCK_QUIRK)
+                xhci_pme_acpi_rtd3_enable(dev);
+
         /* USB-2 and USB-3 roothubs initialized, allow runtime pm suspend */
         pm_runtime_put_noidle(&dev->dev);
 
@@ -307,7 +358,7 @@ static int xhci_pci_suspend(struct usb_hcd *hcd, bool do_wakeup)
                 pdev->no_d3cold = true;
 
         if (xhci->quirks & XHCI_PME_STUCK_QUIRK)
-                xhci_pme_quirk(xhci);
+                xhci_pme_quirk(hcd, true);
 
         return xhci_suspend(xhci, do_wakeup);
 }
@@ -340,7 +391,7 @@ static int xhci_pci_resume(struct usb_hcd *hcd, bool hibernated)
                 usb_enable_intel_xhci_ports(pdev);
 
         if (xhci->quirks & XHCI_PME_STUCK_QUIRK)
-                xhci_pme_quirk(xhci);
+                xhci_pme_quirk(hcd, false);
 
         retval = xhci_resume(xhci, hibernated);
         return retval;
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 94416ff70810..6a8fc52aed58 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1546,6 +1546,9 @@ static void handle_port_status(struct xhci_hcd *xhci,
                 usb_hcd_resume_root_hub(hcd);
         }
 
+        if (hcd->speed == HCD_USB3 && (temp & PORT_PLS_MASK) == XDEV_INACTIVE)
+                bus_state->port_remote_wakeup &= ~(1 << faked_port_index);
+
         if ((temp & PORT_PLC) && (temp & PORT_PLS_MASK) == XDEV_RESUME) {
                 xhci_dbg(xhci, "port resume event for port %d\n", port_id);
 
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 7da0d6043d33..526ebc0c7e72 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -3453,6 +3453,9 @@ int xhci_discover_or_reset_device(struct usb_hcd *hcd, struct usb_device *udev)
                         return -EINVAL;
         }
 
+        if (virt_dev->tt_info)
+                old_active_eps = virt_dev->tt_info->active_eps;
+
         if (virt_dev->udev != udev) {
                 /* If the virt_dev and the udev does not match, this virt_dev
                  * may belong to another udev.
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 31e46cc55807..ed2ebf647c38 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -285,6 +285,7 @@ struct xhci_op_regs {
 #define XDEV_U0         (0x0 << 5)
 #define XDEV_U2         (0x2 << 5)
 #define XDEV_U3         (0x3 << 5)
+#define XDEV_INACTIVE   (0x6 << 5)
 #define XDEV_RESUME     (0xf << 5)
 /* true: port has power (see HCC_PPC) */
 #define PORT_POWER      (1 << 9)
diff --git a/drivers/usb/musb/musb_virthub.c b/drivers/usb/musb/musb_virthub.c
index 30842bc195f5..92d5f718659b 100644
--- a/drivers/usb/musb/musb_virthub.c
+++ b/drivers/usb/musb/musb_virthub.c
@@ -275,9 +275,7 @@ static int musb_has_gadget(struct musb *musb)
 #ifdef CONFIG_USB_MUSB_HOST
         return 1;
 #else
-        if (musb->port_mode == MUSB_PORT_MODE_HOST)
-                return 1;
-        return musb->g.dev.driver != NULL;
+        return musb->port_mode == MUSB_PORT_MODE_HOST;
 #endif
 }
 
diff --git a/drivers/usb/phy/phy-mxs-usb.c b/drivers/usb/phy/phy-mxs-usb.c
index 8f7cb068d29b..3fcc0483a081 100644
--- a/drivers/usb/phy/phy-mxs-usb.c
+++ b/drivers/usb/phy/phy-mxs-usb.c
@@ -217,6 +217,9 @@ static bool mxs_phy_get_vbus_status(struct mxs_phy *mxs_phy)
 {
         unsigned int vbus_value;
 
+        if (!mxs_phy->regmap_anatop)
+                return false;
+
         if (mxs_phy->port_id == 0)
                 regmap_read(mxs_phy->regmap_anatop,
                         ANADIG_USB1_VBUS_DET_STAT,
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index ffd739e31bfc..eac7ccaa3c85 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -187,6 +187,7 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(0x1FB9, 0x0602) }, /* Lake Shore Model 648 Magnet Power Supply */
         { USB_DEVICE(0x1FB9, 0x0700) }, /* Lake Shore Model 737 VSM Controller */
         { USB_DEVICE(0x1FB9, 0x0701) }, /* Lake Shore Model 776 Hall Matrix */
+        { USB_DEVICE(0x2626, 0xEA60) }, /* Aruba Networks 7xxx USB Serial Console */
         { USB_DEVICE(0x3195, 0xF190) }, /* Link Instruments MSO-19 */
         { USB_DEVICE(0x3195, 0xF280) }, /* Link Instruments MSO-28 */
         { USB_DEVICE(0x3195, 0xF281) }, /* Link Instruments MSO-28 */
diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
index 4f70df33975a..78b4f64c6b00 100644
--- a/drivers/usb/serial/mos7720.c
+++ b/drivers/usb/serial/mos7720.c
@@ -121,26 +121,26 @@ static DEFINE_SPINLOCK(release_lock);
 static const unsigned int dummy; /* for clarity in register access fns */
 
 enum mos_regs {
-        THR,              /* serial port regs */
-        RHR,
-        IER,
-        FCR,
-        ISR,
-        LCR,
-        MCR,
-        LSR,
-        MSR,
-        SPR,
-        DLL,
-        DLM,
-        DPR,              /* parallel port regs */
-        DSR,
-        DCR,
-        ECR,
-        SP1_REG,          /* device control regs */
-        SP2_REG,          /* serial port 2 (7720 only) */
-        PP_REG,
-        SP_CONTROL_REG,
+        MOS7720_THR,              /* serial port regs */
+        MOS7720_RHR,
+        MOS7720_IER,
+        MOS7720_FCR,
+        MOS7720_ISR,
+        MOS7720_LCR,
+        MOS7720_MCR,
+        MOS7720_LSR,
+        MOS7720_MSR,
+        MOS7720_SPR,
+        MOS7720_DLL,
+        MOS7720_DLM,
+        MOS7720_DPR,              /* parallel port regs */
+        MOS7720_DSR,
+        MOS7720_DCR,
+        MOS7720_ECR,
+        MOS7720_SP1_REG,          /* device control regs */
+        MOS7720_SP2_REG,          /* serial port 2 (7720 only) */
+        MOS7720_PP_REG,
+        MOS7720_SP_CONTROL_REG,
 };
 
 /*
@@ -150,26 +150,26 @@ enum mos_regs {
 static inline __u16 get_reg_index(enum mos_regs reg)
 {
         static const __u16 mos7715_index_lookup_table[] = {
-                0x00,           /* THR */
-                0x00,           /* RHR */
-                0x01,           /* IER */
-                0x02,           /* FCR */
-                0x02,           /* ISR */
-                0x03,           /* LCR */
-                0x04,           /* MCR */
-                0x05,           /* LSR */
-                0x06,           /* MSR */
-                0x07,           /* SPR */
-                0x00,           /* DLL */
-                0x01,           /* DLM */
-                0x00,           /* DPR */
-                0x01,           /* DSR */
-                0x02,           /* DCR */
-                0x0a,           /* ECR */
-                0x01,           /* SP1_REG */
-                0x02,           /* SP2_REG (7720 only) */
-                0x04,           /* PP_REG (7715 only) */
-                0x08,           /* SP_CONTROL_REG */
+                0x00,           /* MOS7720_THR */
+                0x00,           /* MOS7720_RHR */
+                0x01,           /* MOS7720_IER */
+                0x02,           /* MOS7720_FCR */
+                0x02,           /* MOS7720_ISR */
+                0x03,           /* MOS7720_LCR */
+                0x04,           /* MOS7720_MCR */
+                0x05,           /* MOS7720_LSR */
+                0x06,           /* MOS7720_MSR */
+                0x07,           /* MOS7720_SPR */
+                0x00,           /* MOS7720_DLL */
+                0x01,           /* MOS7720_DLM */
+                0x00,           /* MOS7720_DPR */
+                0x01,           /* MOS7720_DSR */
+                0x02,           /* MOS7720_DCR */
+                0x0a,           /* MOS7720_ECR */
+                0x01,           /* MOS7720_SP1_REG */
+                0x02,           /* MOS7720_SP2_REG (7720 only) */
+                0x04,           /* MOS7720_PP_REG (7715 only) */
+                0x08,           /* MOS7720_SP_CONTROL_REG */
         };
         return mos7715_index_lookup_table[reg];
 }
@@ -181,10 +181,10 @@ static inline __u16 get_reg_index(enum mos_regs reg)
 static inline __u16 get_reg_value(enum mos_regs reg,
                                   unsigned int serial_portnum)
 {
-        if (reg >= SP1_REG)           /* control reg */
+        if (reg >= MOS7720_SP1_REG)     /* control reg */
                 return 0x0000;
 
-        else if (reg >= DPR)          /* parallel port reg (7715 only) */
+        else if (reg >= MOS7720_DPR)    /* parallel port reg (7715 only) */
                 return 0x0100;
 
         else                          /* serial port reg */
@@ -252,7 +252,8 @@ static inline int mos7715_change_mode(struct mos7715_parport *mos_parport,
                                       enum mos7715_pp_modes mode)
 {
         mos_parport->shadowECR = mode;
-        write_mos_reg(mos_parport->serial, dummy, ECR, mos_parport->shadowECR);
+        write_mos_reg(mos_parport->serial, dummy, MOS7720_ECR,
+                      mos_parport->shadowECR);
         return 0;
 }
 
@@ -486,7 +487,7 @@ static void parport_mos7715_write_data(struct parport *pp, unsigned char d)
         if (parport_prologue(pp) < 0)
                 return;
         mos7715_change_mode(mos_parport, SPP);
-        write_mos_reg(mos_parport->serial, dummy, DPR, (__u8)d);
+        write_mos_reg(mos_parport->serial, dummy, MOS7720_DPR, (__u8)d);
         parport_epilogue(pp);
 }
 
@@ -497,7 +498,7 @@ static unsigned char parport_mos7715_read_data(struct parport *pp)
 
         if (parport_prologue(pp) < 0)
                 return 0;
-        read_mos_reg(mos_parport->serial, dummy, DPR, &d);
+        read_mos_reg(mos_parport->serial, dummy, MOS7720_DPR, &d);
         parport_epilogue(pp);
         return d;
 }
@@ -510,7 +511,7 @@ static void parport_mos7715_write_control(struct parport *pp, unsigned char d)
         if (parport_prologue(pp) < 0)
                 return;
         data = ((__u8)d & 0x0f) | (mos_parport->shadowDCR & 0xf0);
-        write_mos_reg(mos_parport->serial, dummy, DCR, data);
+        write_mos_reg(mos_parport->serial, dummy, MOS7720_DCR, data);
         mos_parport->shadowDCR = data;
         parport_epilogue(pp);
 }
@@ -543,7 +544,8 @@ static unsigned char parport_mos7715_frob_control(struct parport *pp,
         if (parport_prologue(pp) < 0)
                 return 0;
         mos_parport->shadowDCR = (mos_parport->shadowDCR & (~mask)) ^ val;
-        write_mos_reg(mos_parport->serial, dummy, DCR, mos_parport->shadowDCR);
+        write_mos_reg(mos_parport->serial, dummy, MOS7720_DCR,
+                      mos_parport->shadowDCR);
         dcr = mos_parport->shadowDCR & 0x0f;
         parport_epilogue(pp);
         return dcr;
@@ -581,7 +583,8 @@ static void parport_mos7715_data_forward(struct parport *pp)
                 return;
         mos7715_change_mode(mos_parport, PS2);
         mos_parport->shadowDCR &=  ~0x20;
-        write_mos_reg(mos_parport->serial, dummy, DCR, mos_parport->shadowDCR);
+        write_mos_reg(mos_parport->serial, dummy, MOS7720_DCR,
+                      mos_parport->shadowDCR);
         parport_epilogue(pp);
 }
 
@@ -593,7 +596,8 @@ static void parport_mos7715_data_reverse(struct parport *pp)
                 return;
         mos7715_change_mode(mos_parport, PS2);
         mos_parport->shadowDCR |= 0x20;
-        write_mos_reg(mos_parport->serial, dummy, DCR, mos_parport->shadowDCR);
+        write_mos_reg(mos_parport->serial, dummy, MOS7720_DCR,
+                      mos_parport->shadowDCR);
         parport_epilogue(pp);
 }
 
@@ -633,8 +637,10 @@ static void parport_mos7715_restore_state(struct parport *pp,
                 spin_unlock(&release_lock);
                 return;
         }
-        write_parport_reg_nonblock(mos_parport, DCR, mos_parport->shadowDCR);
-        write_parport_reg_nonblock(mos_parport, ECR, mos_parport->shadowECR);
+        write_parport_reg_nonblock(mos_parport, MOS7720_DCR,
+                                   mos_parport->shadowDCR);
+        write_parport_reg_nonblock(mos_parport, MOS7720_ECR,
+                                   mos_parport->shadowECR);
         spin_unlock(&release_lock);
 }
 
@@ -714,14 +720,16 @@ static int mos7715_parport_init(struct usb_serial *serial)
         init_completion(&mos_parport->syncmsg_compl);
 
         /* cycle parallel port reset bit */
-        write_mos_reg(mos_parport->serial, dummy, PP_REG, (__u8)0x80);
-        write_mos_reg(mos_parport->serial, dummy, PP_REG, (__u8)0x00);
+        write_mos_reg(mos_parport->serial, dummy, MOS7720_PP_REG, (__u8)0x80);
+        write_mos_reg(mos_parport->serial, dummy, MOS7720_PP_REG, (__u8)0x00);
 
         /* initialize device registers */
         mos_parport->shadowDCR = DCR_INIT_VAL;
-        write_mos_reg(mos_parport->serial, dummy, DCR, mos_parport->shadowDCR);
+        write_mos_reg(mos_parport->serial, dummy, MOS7720_DCR,
+                      mos_parport->shadowDCR);
         mos_parport->shadowECR = ECR_INIT_VAL;
-        write_mos_reg(mos_parport->serial, dummy, ECR, mos_parport->shadowECR);
+        write_mos_reg(mos_parport->serial, dummy, MOS7720_ECR,
+                      mos_parport->shadowECR);
 
         /* register with parport core */
         mos_parport->pp = parport_register_port(0, PARPORT_IRQ_NONE,
@@ -1033,45 +1041,49 @@ static int mos7720_open(struct tty_struct *tty, struct usb_serial_port *port)
          /* Initialize MCS7720 -- Write Init values to corresponding Registers
           *
           * Register Index
-          * 0 : THR/RHR
-          * 1 : IER
-          * 2 : FCR
-          * 3 : LCR
-          * 4 : MCR
-          * 5 : LSR
-          * 6 : MSR
-          * 7 : SPR
+          * 0 : MOS7720_THR/MOS7720_RHR
+          * 1 : MOS7720_IER
+          * 2 : MOS7720_FCR
+          * 3 : MOS7720_LCR
+          * 4 : MOS7720_MCR
+          * 5 : MOS7720_LSR
+          * 6 : MOS7720_MSR
+          * 7 : MOS7720_SPR
           *
           * 0x08 : SP1/2 Control Reg
           */
         port_number = port->port_number;
-        read_mos_reg(serial, port_number, LSR, &data);
+        read_mos_reg(serial, port_number, MOS7720_LSR, &data);
 
         dev_dbg(&port->dev, "SS::%p LSR:%x\n", mos7720_port, data);
 
-        write_mos_reg(serial, dummy, SP1_REG, 0x02);
-        write_mos_reg(serial, dummy, SP2_REG, 0x02);
+        write_mos_reg(serial, dummy, MOS7720_SP1_REG, 0x02);
+        write_mos_reg(serial, dummy, MOS7720_SP2_REG, 0x02);
 
-        write_mos_reg(serial, port_number, IER, 0x00);
-        write_mos_reg(serial, port_number, FCR, 0x00);
+        write_mos_reg(serial, port_number, MOS7720_IER, 0x00);
+        write_mos_reg(serial, port_number, MOS7720_FCR, 0x00);
 
-        write_mos_reg(serial, port_number, FCR, 0xcf);
+        write_mos_reg(serial, port_number, MOS7720_FCR, 0xcf);
         mos7720_port->shadowLCR = 0x03;
-        write_mos_reg(serial, port_number, LCR, mos7720_port->shadowLCR);
+        write_mos_reg(serial, port_number, MOS7720_LCR,
+                      mos7720_port->shadowLCR);
         mos7720_port->shadowMCR = 0x0b;
-        write_mos_reg(serial, port_number, MCR, mos7720_port->shadowMCR);
+        write_mos_reg(serial, port_number, MOS7720_MCR,
+                      mos7720_port->shadowMCR);
 
-        write_mos_reg(serial, port_number, SP_CONTROL_REG, 0x00);
-        read_mos_reg(serial, dummy, SP_CONTROL_REG, &data);
+        write_mos_reg(serial, port_number, MOS7720_SP_CONTROL_REG, 0x00);
+        read_mos_reg(serial, dummy, MOS7720_SP_CONTROL_REG, &data);
         data = data | (port->port_number + 1);
-        write_mos_reg(serial, dummy, SP_CONTROL_REG, data);
+        write_mos_reg(serial, dummy, MOS7720_SP_CONTROL_REG, data);
         mos7720_port->shadowLCR = 0x83;
-        write_mos_reg(serial, port_number, LCR, mos7720_port->shadowLCR);
-        write_mos_reg(serial, port_number, THR, 0x0c);
-        write_mos_reg(serial, port_number, IER, 0x00);
+        write_mos_reg(serial, port_number, MOS7720_LCR,
+                      mos7720_port->shadowLCR);
+        write_mos_reg(serial, port_number, MOS7720_THR, 0x0c);
+        write_mos_reg(serial, port_number, MOS7720_IER, 0x00);
         mos7720_port->shadowLCR = 0x03;
-        write_mos_reg(serial, port_number, LCR, mos7720_port->shadowLCR);
-        write_mos_reg(serial, port_number, IER, 0x0c);
+        write_mos_reg(serial, port_number, MOS7720_LCR,
+                      mos7720_port->shadowLCR);
+        write_mos_reg(serial, port_number, MOS7720_IER, 0x0c);
 
         response = usb_submit_urb(port->read_urb, GFP_KERNEL);
         if (response)
@@ -1144,8 +1156,8 @@ static void mos7720_close(struct usb_serial_port *port)
         usb_kill_urb(port->write_urb);
         usb_kill_urb(port->read_urb);
 
-        write_mos_reg(serial, port->port_number, MCR, 0x00);
-        write_mos_reg(serial, port->port_number, IER, 0x00);
+        write_mos_reg(serial, port->port_number, MOS7720_MCR, 0x00);
+        write_mos_reg(serial, port->port_number, MOS7720_IER, 0x00);
 
         mos7720_port->open = 0;
 }
@@ -1169,7 +1181,8 @@ static void mos7720_break(struct tty_struct *tty, int break_state)
                 data = mos7720_port->shadowLCR & ~UART_LCR_SBC;
 
         mos7720_port->shadowLCR  = data;
-        write_mos_reg(serial, port->port_number, LCR, mos7720_port->shadowLCR);
+        write_mos_reg(serial, port->port_number, MOS7720_LCR,
+                      mos7720_port->shadowLCR);
 }
 
 /*
@@ -1297,7 +1310,7 @@ static void mos7720_throttle(struct tty_struct *tty)
         /* if we are implementing RTS/CTS, toggle that line */
         if (tty->termios.c_cflag & CRTSCTS) {
                 mos7720_port->shadowMCR &= ~UART_MCR_RTS;
-                write_mos_reg(port->serial, port->port_number, MCR,
+                write_mos_reg(port->serial, port->port_number, MOS7720_MCR,
                               mos7720_port->shadowMCR);
         }
 }
@@ -1327,7 +1340,7 @@ static void mos7720_unthrottle(struct tty_struct *tty)
         /* if we are implementing RTS/CTS, toggle that line */
         if (tty->termios.c_cflag & CRTSCTS) {
                 mos7720_port->shadowMCR |= UART_MCR_RTS;
-                write_mos_reg(port->serial, port->port_number, MCR,
+                write_mos_reg(port->serial, port->port_number, MOS7720_MCR,
                               mos7720_port->shadowMCR);
         }
 }
@@ -1352,35 +1365,39 @@ static int set_higher_rates(struct moschip_port *mos7720_port,
         dev_dbg(&port->dev, "Sending Setting Commands ..........\n");
         port_number = port->port_number;
 
-        write_mos_reg(serial, port_number, IER, 0x00);
-        write_mos_reg(serial, port_number, FCR, 0x00);
-        write_mos_reg(serial, port_number, FCR, 0xcf);
+        write_mos_reg(serial, port_number, MOS7720_IER, 0x00);
+        write_mos_reg(serial, port_number, MOS7720_FCR, 0x00);
+        write_mos_reg(serial, port_number, MOS7720_FCR, 0xcf);
         mos7720_port->shadowMCR = 0x0b;
-        write_mos_reg(serial, port_number, MCR, mos7720_port->shadowMCR);
-        write_mos_reg(serial, dummy, SP_CONTROL_REG, 0x00);
+        write_mos_reg(serial, port_number, MOS7720_MCR,
+                      mos7720_port->shadowMCR);
+        write_mos_reg(serial, dummy, MOS7720_SP_CONTROL_REG, 0x00);
 
         /***********************************************
          *              Set for higher rates           *
          ***********************************************/
         /* writing baud rate verbatum into uart clock field clearly not right */
         if (port_number == 0)
-                sp_reg = SP1_REG;
+                sp_reg = MOS7720_SP1_REG;
         else
-                sp_reg = SP2_REG;
+                sp_reg = MOS7720_SP2_REG;
         write_mos_reg(serial, dummy, sp_reg, baud * 0x10);
-        write_mos_reg(serial, dummy, SP_CONTROL_REG, 0x03);
+        write_mos_reg(serial, dummy, MOS7720_SP_CONTROL_REG, 0x03);
         mos7720_port->shadowMCR = 0x2b;
-        write_mos_reg(serial, port_number, MCR, mos7720_port->shadowMCR);
+        write_mos_reg(serial, port_number, MOS7720_MCR,
+                      mos7720_port->shadowMCR);
 
         /***********************************************
          *              Set DLL/DLM
          ***********************************************/
         mos7720_port->shadowLCR = mos7720_port->shadowLCR | UART_LCR_DLAB;
-        write_mos_reg(serial, port_number, LCR, mos7720_port->shadowLCR);
-        write_mos_reg(serial, port_number, DLL, 0x01);
-        write_mos_reg(serial, port_number, DLM, 0x00);
+        write_mos_reg(serial, port_number, MOS7720_LCR,
+                      mos7720_port->shadowLCR);
+        write_mos_reg(serial, port_number, MOS7720_DLL, 0x01);
+        write_mos_reg(serial, port_number, MOS7720_DLM, 0x00);
         mos7720_port->shadowLCR = mos7720_port->shadowLCR & ~UART_LCR_DLAB;
-        write_mos_reg(serial, port_number, LCR, mos7720_port->shadowLCR);
+        write_mos_reg(serial, port_number, MOS7720_LCR,
+                      mos7720_port->shadowLCR);
 
         return 0;
 }
@@ -1488,15 +1505,16 @@ static int send_cmd_write_baud_rate(struct moschip_port *mos7720_port,
 
         /* Enable access to divisor latch */
         mos7720_port->shadowLCR = mos7720_port->shadowLCR | UART_LCR_DLAB;
-        write_mos_reg(serial, number, LCR, mos7720_port->shadowLCR);
+        write_mos_reg(serial, number, MOS7720_LCR, mos7720_port->shadowLCR);
 
         /* Write the divisor */
-        write_mos_reg(serial, number, DLL, (__u8)(divisor & 0xff));
-        write_mos_reg(serial, number, DLM, (__u8)((divisor & 0xff00) >> 8));
+        write_mos_reg(serial, number, MOS7720_DLL, (__u8)(divisor & 0xff));
+        write_mos_reg(serial, number, MOS7720_DLM,
+                      (__u8)((divisor & 0xff00) >> 8));
 
         /* Disable access to divisor latch */
         mos7720_port->shadowLCR = mos7720_port->shadowLCR & ~UART_LCR_DLAB;
-        write_mos_reg(serial, number, LCR, mos7720_port->shadowLCR);
+        write_mos_reg(serial, number, MOS7720_LCR, mos7720_port->shadowLCR);
 
         return status;
 }
@@ -1600,14 +1618,16 @@ static void change_port_settings(struct tty_struct *tty,
 
 
         /* Disable Interrupts */
-        write_mos_reg(serial, port_number, IER, 0x00);
-        write_mos_reg(serial, port_number, FCR, 0x00);
-        write_mos_reg(serial, port_number, FCR, 0xcf);
+        write_mos_reg(serial, port_number, MOS7720_IER, 0x00);
+        write_mos_reg(serial, port_number, MOS7720_FCR, 0x00);
+        write_mos_reg(serial, port_number, MOS7720_FCR, 0xcf);
 
         /* Send the updated LCR value to the mos7720 */
-        write_mos_reg(serial, port_number, LCR, mos7720_port->shadowLCR);
+        write_mos_reg(serial, port_number, MOS7720_LCR,
+                      mos7720_port->shadowLCR);
         mos7720_port->shadowMCR = 0x0b;
-        write_mos_reg(serial, port_number, MCR, mos7720_port->shadowMCR);
+        write_mos_reg(serial, port_number, MOS7720_MCR,
+                      mos7720_port->shadowMCR);
 
         /* set up the MCR register and send it to the mos7720 */
         mos7720_port->shadowMCR = UART_MCR_OUT2;
@@ -1619,14 +1639,17 @@ static void change_port_settings(struct tty_struct *tty,
                 /* To set hardware flow control to the specified *
                  * serial port, in SP1/2_CONTROL_REG             */
                 if (port_number)
-                        write_mos_reg(serial, dummy, SP_CONTROL_REG, 0x01);
+                        write_mos_reg(serial, dummy, MOS7720_SP_CONTROL_REG,
+                                      0x01);
                 else
-                        write_mos_reg(serial, dummy, SP_CONTROL_REG, 0x02);
+                        write_mos_reg(serial, dummy, MOS7720_SP_CONTROL_REG,
+                                      0x02);
 
         } else
                 mos7720_port->shadowMCR &= ~(UART_MCR_XONANY);
 
-        write_mos_reg(serial, port_number, MCR, mos7720_port->shadowMCR);
+        write_mos_reg(serial, port_number, MOS7720_MCR,
+                      mos7720_port->shadowMCR);
 
         /* Determine divisor based on baud rate */
         baud = tty_get_baud_rate(tty);
@@ -1639,7 +1662,7 @@ static void change_port_settings(struct tty_struct *tty,
         if (baud >= 230400) {
                 set_higher_rates(mos7720_port, baud);
                 /* Enable Interrupts */
-                write_mos_reg(serial, port_number, IER, 0x0c);
+                write_mos_reg(serial, port_number, MOS7720_IER, 0x0c);
                 return;
         }
 
@@ -1650,7 +1673,7 @@ static void change_port_settings(struct tty_struct *tty,
         if (cflag & CBAUD)
                 tty_encode_baud_rate(tty, baud, baud);
         /* Enable Interrupts */
-        write_mos_reg(serial, port_number, IER, 0x0c);
+        write_mos_reg(serial, port_number, MOS7720_IER, 0x0c);
 
         if (port->read_urb->status != -EINPROGRESS) {
                 status = usb_submit_urb(port->read_urb, GFP_KERNEL);
@@ -1725,7 +1748,7 @@ static int get_lsr_info(struct tty_struct *tty,
 
         count = mos7720_chars_in_buffer(tty);
         if (count == 0) {
-                read_mos_reg(port->serial, port_number, LSR, &data);
+                read_mos_reg(port->serial, port_number, MOS7720_LSR, &data);
                 if ((data & (UART_LSR_TEMT | UART_LSR_THRE))
                                         == (UART_LSR_TEMT | UART_LSR_THRE)) {
                         dev_dbg(&port->dev, "%s -- Empty\n", __func__);
@@ -1782,7 +1805,7 @@ static int mos7720_tiocmset(struct tty_struct *tty,
                 mcr &= ~UART_MCR_LOOP;
 
         mos7720_port->shadowMCR = mcr;
-        write_mos_reg(port->serial, port->port_number, MCR,
+        write_mos_reg(port->serial, port->port_number, MOS7720_MCR,
                       mos7720_port->shadowMCR);
 
         return 0;
@@ -1827,7 +1850,7 @@ static int set_modem_info(struct moschip_port *mos7720_port, unsigned int cmd,
         }
 
         mos7720_port->shadowMCR = mcr;
-        write_mos_reg(port->serial, port->port_number, MCR,
+        write_mos_reg(port->serial, port->port_number, MOS7720_MCR,
                       mos7720_port->shadowMCR);
 
         return 0;
@@ -1942,7 +1965,7 @@ static int mos7720_startup(struct usb_serial *serial)
         }
 #endif
         /* LSR For Port 1 */
-        read_mos_reg(serial, 0, LSR, &data);
+        read_mos_reg(serial, 0, MOS7720_LSR, &data);
         dev_dbg(&dev->dev, "LSR:%x\n", data);
 
         return 0;
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index f0c0c53359ad..19b85ee98a72 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -1765,6 +1765,7 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) },
         { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
         { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
+        { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) },                /* OLICARD300 - MT6225 */
         { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) },
         { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) },
         { } /* Terminating entry */
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index 529066bbc7e8..46f1f13b41f1 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -1306,6 +1306,7 @@ static void __exit usb_serial_exit(void)
         tty_unregister_driver(usb_serial_tty_driver);
         put_tty_driver(usb_serial_tty_driver);
         bus_unregister(&usb_serial_bus_type);
+        idr_destroy(&serial_minors);
 }
 
 
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index caf188800c67..6b2479123de7 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -2065,6 +2065,18 @@ UNUSUAL_DEV( 0x1908, 0x3335, 0x0200, 0x0200,
                 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                 US_FL_NO_READ_DISC_INFO ),
 
+/* Reported by Oliver Neukum <oneukum@suse.com>
+ * This device morphes spontaneously into another device if the access
+ * pattern of Windows isn't followed. Thus writable media would be dirty
+ * if the initial instance is used. So the device is limited to its
+ * virtual CD.
+ * And yes, the concept that BCD goes up to 9 is not heeded */
+UNUSUAL_DEV( 0x19d2, 0x1225, 0x0000, 0xffff,
+                "ZTE,Incorporated",
+                "ZTE WCDMA Technologies MSM",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_SINGLE_LUN ),
+
 /* Reported by Sven Geggus <sven-usbst@geggus.net>
  * This encrypted pen drive returns bogus data for the initial READ(10).
  */
@@ -2074,6 +2086,17 @@ UNUSUAL_DEV(  0x1b1c, 0x1ab5, 0x0200, 0x0200,
                 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                 US_FL_INITIAL_READ10 ),
 
+/* Reported by Hans de Goede <hdegoede@redhat.com>
+ * These are mini projectors using USB for both power and video data transport
+ * The usb-storage interface is a virtual windows driver CD, which the gm12u320
+ * driver automatically converts into framebuffer & kms dri device nodes.
+ */
+UNUSUAL_DEV( 0x1de1, 0xc102, 0x0000, 0xffff,
+                "Grain-media Technology Corp.",
+                "USB3.0 Device GM12U320",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_IGNORE_DEVICE ),
+
 /* Patch by Richard Schütz <r.schtz@t-online.de>
  * This external hard drive enclosure uses a JMicron chip which
  * needs the US_FL_IGNORE_RESIDUE flag to work properly. */
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 9e8e004bb1c3..a9fe859f43c8 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -22,14 +22,20 @@
 #include <linux/file.h>
 #include <linux/highmem.h>
 #include <linux/slab.h>
+#include <linux/vmalloc.h>
 #include <linux/kthread.h>
 #include <linux/cgroup.h>
 #include <linux/module.h>
+#include <linux/sort.h>
 
 #include "vhost.h"
 
+static ushort max_mem_regions = 64;
+module_param(max_mem_regions, ushort, 0444);
+MODULE_PARM_DESC(max_mem_regions,
+        "Maximum number of memory regions in memory map. (default: 64)");
+
 enum {
-        VHOST_MEMORY_MAX_NREGIONS = 64,
         VHOST_MEMORY_F_LOG = 0x1,
 };
 
@@ -543,7 +549,7 @@ void vhost_dev_cleanup(struct vhost_dev *dev, bool locked)
                 fput(dev->log_file);
         dev->log_file = NULL;
         /* No one will access memory at this point */
-        kfree(dev->memory);
+        kvfree(dev->memory);
         dev->memory = NULL;
         WARN_ON(!list_empty(&dev->work_list));
         if (dev->worker) {
@@ -663,6 +669,28 @@ int vhost_vq_access_ok(struct vhost_virtqueue *vq)
 }
 EXPORT_SYMBOL_GPL(vhost_vq_access_ok);
 
+static int vhost_memory_reg_sort_cmp(const void *p1, const void *p2)
+{
+        const struct vhost_memory_region *r1 = p1, *r2 = p2;
+        if (r1->guest_phys_addr < r2->guest_phys_addr)
+                return 1;
+        if (r1->guest_phys_addr > r2->guest_phys_addr)
+                return -1;
+        return 0;
+}
+
+static void *vhost_kvzalloc(unsigned long size)
+{
+        void *n = kzalloc(size, GFP_KERNEL | __GFP_NOWARN | __GFP_REPEAT);
+
+        if (!n) {
+                n = vzalloc(size);
+                if (!n)
+                        return ERR_PTR(-ENOMEM);
+        }
+        return n;
+}
+
 static long vhost_set_memory(struct vhost_dev *d, struct vhost_memory __user *m)
 {
         struct vhost_memory mem, *newmem, *oldmem;
@@ -673,21 +701,23 @@ static long vhost_set_memory(struct vhost_dev *d, struct vhost_memory __user *m)
                 return -EFAULT;
         if (mem.padding)
                 return -EOPNOTSUPP;
-        if (mem.nregions > VHOST_MEMORY_MAX_NREGIONS)
+        if (mem.nregions > max_mem_regions)
                 return -E2BIG;
-        newmem = kmalloc(size + mem.nregions * sizeof *m->regions, GFP_KERNEL);
+        newmem = vhost_kvzalloc(size + mem.nregions * sizeof(*m->regions));
         if (!newmem)
                 return -ENOMEM;
 
         memcpy(newmem, &mem, size);
         if (copy_from_user(newmem->regions, m->regions,
                            mem.nregions * sizeof *m->regions)) {
-                kfree(newmem);
+                kvfree(newmem);
                 return -EFAULT;
         }
+        sort(newmem->regions, newmem->nregions, sizeof(*newmem->regions),
+                vhost_memory_reg_sort_cmp, NULL);
 
         if (!memory_access_ok(d, newmem, 0)) {
-                kfree(newmem);
+                kvfree(newmem);
                 return -EFAULT;
         }
         oldmem = d->memory;
@@ -699,7 +729,7 @@ static long vhost_set_memory(struct vhost_dev *d, struct vhost_memory __user *m)
                 d->vqs[i]->memory = newmem;
                 mutex_unlock(&d->vqs[i]->mutex);
         }
-        kfree(oldmem);
+        kvfree(oldmem);
         return 0;
 }
 
@@ -992,17 +1022,22 @@ EXPORT_SYMBOL_GPL(vhost_dev_ioctl);
 static const struct vhost_memory_region *find_region(struct vhost_memory *mem,
                                                      __u64 addr, __u32 len)
 {
-        struct vhost_memory_region *reg;
-        int i;
+        const struct vhost_memory_region *reg;
+        int start = 0, end = mem->nregions;
 
-        /* linear search is not brilliant, but we really have on the order of 6
-         * regions in practice */
-        for (i = 0; i < mem->nregions; ++i) {
-                reg = mem->regions + i;
-                if (reg->guest_phys_addr <= addr &&
-                    reg->guest_phys_addr + reg->memory_size - 1 >= addr)
-                        return reg;
+        while (start < end) {
+                int slot = start + (end - start) / 2;
+                reg = mem->regions + slot;
+                if (addr >= reg->guest_phys_addr)
+                        end = slot;
+                else
+                        start = slot + 1;
         }
+
+        reg = mem->regions + start;
+        if (addr >= reg->guest_phys_addr &&
+                reg->guest_phys_addr + reg->memory_size > addr)
+                return reg;
         return NULL;
 }
 
diff --git a/drivers/video/fbdev/stifb.c b/drivers/video/fbdev/stifb.c
index 86621fabbb8b..735355b0e023 100644
--- a/drivers/video/fbdev/stifb.c
+++ b/drivers/video/fbdev/stifb.c
@@ -121,6 +121,7 @@ static int __initdata stifb_bpp_pref[MAX_STI_ROMS];
 #define REG_3           0x0004a0
 #define REG_4           0x000600
 #define REG_6           0x000800
+#define REG_7           0x000804
 #define REG_8           0x000820
 #define REG_9           0x000a04
 #define REG_10          0x018000
@@ -135,6 +136,8 @@ static int __initdata stifb_bpp_pref[MAX_STI_ROMS];
 #define REG_21          0x200218
 #define REG_22          0x0005a0
 #define REG_23          0x0005c0
+#define REG_24          0x000808
+#define REG_25          0x000b00
 #define REG_26          0x200118
 #define REG_27          0x200308
 #define REG_32          0x21003c
@@ -429,6 +432,9 @@ ARTIST_ENABLE_DISABLE_DISPLAY(struct stifb_info *fb, int enable)
 #define SET_LENXY_START_RECFILL(fb, lenxy) \
         WRITE_WORD(lenxy, fb, REG_9)
 
+#define SETUP_COPYAREA(fb) \
+        WRITE_BYTE(0, fb, REG_16b1)
+
 static void
 HYPER_ENABLE_DISABLE_DISPLAY(struct stifb_info *fb, int enable)
 {
@@ -1004,6 +1010,36 @@ stifb_blank(int blank_mode, struct fb_info *info)
         return 0;
 }
 
+static void
+stifb_copyarea(struct fb_info *info, const struct fb_copyarea *area)
+{
+        struct stifb_info *fb = container_of(info, struct stifb_info, info);
+
+        SETUP_COPYAREA(fb);
+
+        SETUP_HW(fb);
+        if (fb->info.var.bits_per_pixel == 32) {
+                WRITE_WORD(0xBBA0A000, fb, REG_10);
+
+                NGLE_REALLY_SET_IMAGE_PLANEMASK(fb, 0xffffffff);
+        } else {
+                WRITE_WORD(fb->id == S9000_ID_HCRX ? 0x13a02000 : 0x13a01000, fb, REG_10);
+
+                NGLE_REALLY_SET_IMAGE_PLANEMASK(fb, 0xff);
+        }
+
+        NGLE_QUICK_SET_IMAGE_BITMAP_OP(fb,
+                IBOvals(RopSrc, MaskAddrOffset(0),
+                BitmapExtent08, StaticReg(1),
+                DataDynamic, MaskOtc, BGx(0), FGx(0)));
+
+        WRITE_WORD(((area->sx << 16) | area->sy), fb, REG_24);
+        WRITE_WORD(((area->width << 16) | area->height), fb, REG_7);
+        WRITE_WORD(((area->dx << 16) | area->dy), fb, REG_25);
+
+        SETUP_FB(fb);
+}
+
 static void __init
 stifb_init_display(struct stifb_info *fb)
 {
@@ -1069,7 +1105,7 @@ static struct fb_ops stifb_ops = {
         .fb_setcolreg   = stifb_setcolreg,
         .fb_blank       = stifb_blank,
         .fb_fillrect    = cfb_fillrect,
-        .fb_copyarea    = cfb_copyarea,
+        .fb_copyarea    = stifb_copyarea,
         .fb_imageblit   = cfb_imageblit,
 };
 
@@ -1258,7 +1294,7 @@ static int __init stifb_init_fb(struct sti_struct *sti, int bpp_pref)
         info->fbops = &stifb_ops;
         info->screen_base = ioremap_nocache(REGION_BASE(fb,1), fix->smem_len);
         info->screen_size = fix->smem_len;
-        info->flags = FBINFO_DEFAULT;
+        info->flags = FBINFO_DEFAULT | FBINFO_HWACCEL_COPYAREA;
         info->pseudo_palette = &fb->pseudo_palette;
 
         /* This has to be done !!! */
diff --git a/drivers/watchdog/sp805_wdt.c b/drivers/watchdog/sp805_wdt.c
index c1b03f4235b9..4e7fec36f5c3 100644
--- a/drivers/watchdog/sp805_wdt.c
+++ b/drivers/watchdog/sp805_wdt.c
@@ -4,7 +4,7 @@
  * Watchdog driver for ARM SP805 watchdog module
  *
  * Copyright (C) 2010 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
  *
  * This file is licensed under the terms of the GNU General Public
  * License version 2 or later. This program is licensed "as is" without any
@@ -303,6 +303,6 @@ static struct amba_driver sp805_wdt_driver = {
 
 module_amba_driver(sp805_wdt_driver);
 
-MODULE_AUTHOR("Viresh Kumar <viresh.linux@gmail.com>");
+MODULE_AUTHOR("Viresh Kumar <vireshk@kernel.org>");
 MODULE_DESCRIPTION("ARM SP805 Watchdog Driver");
 MODULE_LICENSE("GPL");
diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
index 510040b04c96..b1dc51888048 100644
--- a/fs/9p/vfs_inode.c
+++ b/fs/9p/vfs_inode.c
@@ -540,8 +540,7 @@ static struct inode *v9fs_qid_iget(struct super_block *sb,
         unlock_new_inode(inode);
         return inode;
 error:
-        unlock_new_inode(inode);
-        iput(inode);
+        iget_failed(inode);
         return ERR_PTR(retval);
 
 }
diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c
index 09e4433717b8..e8aa57dc8d6d 100644
--- a/fs/9p/vfs_inode_dotl.c
+++ b/fs/9p/vfs_inode_dotl.c
@@ -149,8 +149,7 @@ static struct inode *v9fs_qid_iget_dotl(struct super_block *sb,
         unlock_new_inode(inode);
         return inode;
 error:
-        unlock_new_inode(inode);
-        iput(inode);
+        iget_failed(inode);
         return ERR_PTR(retval);
 
 }
diff --git a/fs/btrfs/btrfs_inode.h b/fs/btrfs/btrfs_inode.h
index 0ef5cc13fae2..81220b2203c6 100644
--- a/fs/btrfs/btrfs_inode.h
+++ b/fs/btrfs/btrfs_inode.h
@@ -44,6 +44,8 @@
 #define BTRFS_INODE_IN_DELALLOC_LIST            9
 #define BTRFS_INODE_READDIO_NEED_LOCK           10
 #define BTRFS_INODE_HAS_PROPS                   11
+/* DIO is ready to submit */
+#define BTRFS_INODE_DIO_READY                   12
 /*
  * The following 3 bits are meant only for the btree inode.
  * When any of them is set, it means an error happened while writing an
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 80a9aefb0c46..aac314e14188 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -1778,6 +1778,7 @@ struct btrfs_fs_info {
         spinlock_t unused_bgs_lock;
         struct list_head unused_bgs;
         struct mutex unused_bg_unpin_mutex;
+        struct mutex delete_unused_bgs_mutex;
 
         /* For btrfs to record security options */
         struct security_mnt_opts security_opts;
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 3f43bfea3684..a9aadb2ad525 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -1751,6 +1751,7 @@ static int cleaner_kthread(void *arg)
 {
         struct btrfs_root *root = arg;
         int again;
+        struct btrfs_trans_handle *trans;
 
         do {
                 again = 0;
@@ -1772,7 +1773,6 @@ static int cleaner_kthread(void *arg)
                 }
 
                 btrfs_run_delayed_iputs(root);
-                btrfs_delete_unused_bgs(root->fs_info);
                 again = btrfs_clean_one_deleted_snapshot(root);
                 mutex_unlock(&root->fs_info->cleaner_mutex);
 
@@ -1781,6 +1781,16 @@ static int cleaner_kthread(void *arg)
                  * needn't do anything special here.
                  */
                 btrfs_run_defrag_inodes(root->fs_info);
+
+                /*
+                 * Acquires fs_info->delete_unused_bgs_mutex to avoid racing
+                 * with relocation (btrfs_relocate_chunk) and relocation
+                 * acquires fs_info->cleaner_mutex (btrfs_relocate_block_group)
+                 * after acquiring fs_info->delete_unused_bgs_mutex. So we
+                 * can't hold, nor need to, fs_info->cleaner_mutex when deleting
+                 * unused block groups.
+                 */
+                btrfs_delete_unused_bgs(root->fs_info);
 sleep:
                 if (!try_to_freeze() && !again) {
                         set_current_state(TASK_INTERRUPTIBLE);
@@ -1789,6 +1799,34 @@ sleep:
                         __set_current_state(TASK_RUNNING);
                 }
         } while (!kthread_should_stop());
+
+        /*
+         * Transaction kthread is stopped before us and wakes us up.
+         * However we might have started a new transaction and COWed some
+         * tree blocks when deleting unused block groups for example. So
+         * make sure we commit the transaction we started to have a clean
+         * shutdown when evicting the btree inode - if it has dirty pages
+         * when we do the final iput() on it, eviction will trigger a
+         * writeback for it which will fail with null pointer dereferences
+         * since work queues and other resources were already released and
+         * destroyed by the time the iput/eviction/writeback is made.
+         */
+        trans = btrfs_attach_transaction(root);
+        if (IS_ERR(trans)) {
+                if (PTR_ERR(trans) != -ENOENT)
+                        btrfs_err(root->fs_info,
+                                  "cleaner transaction attach returned %ld",
+                                  PTR_ERR(trans));
+        } else {
+                int ret;
+
+                ret = btrfs_commit_transaction(trans, root);
+                if (ret)
+                        btrfs_err(root->fs_info,
+                                  "cleaner open transaction commit returned %d",
+                                  ret);
+        }
+
         return 0;
 }
 
@@ -2492,6 +2530,7 @@ int open_ctree(struct super_block *sb,
         spin_lock_init(&fs_info->unused_bgs_lock);
         rwlock_init(&fs_info->tree_mod_log_lock);
         mutex_init(&fs_info->unused_bg_unpin_mutex);
+        mutex_init(&fs_info->delete_unused_bgs_mutex);
         mutex_init(&fs_info->reloc_mutex);
         mutex_init(&fs_info->delalloc_root_mutex);
         seqlock_init(&fs_info->profiles_lock);
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 38b76cc02f48..171312d51799 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -2296,9 +2296,22 @@ static int run_one_delayed_ref(struct btrfs_trans_handle *trans,
 static inline struct btrfs_delayed_ref_node *
 select_delayed_ref(struct btrfs_delayed_ref_head *head)
 {
+        struct btrfs_delayed_ref_node *ref;
+
         if (list_empty(&head->ref_list))
                 return NULL;
 
+        /*
+         * Select a delayed ref of type BTRFS_ADD_DELAYED_REF first.
+         * This is to prevent a ref count from going down to zero, which deletes
+         * the extent item from the extent tree, when there still are references
+         * to add, which would fail because they would not find the extent item.
+         */
+        list_for_each_entry(ref, &head->ref_list, list) {
+                if (ref->action == BTRFS_ADD_DELAYED_REF)
+                        return ref;
+        }
+
         return list_entry(head->ref_list.next, struct btrfs_delayed_ref_node,
                           list);
 }
@@ -9889,6 +9902,8 @@ void btrfs_delete_unused_bgs(struct btrfs_fs_info *fs_info)
                 }
                 spin_unlock(&fs_info->unused_bgs_lock);
 
+                mutex_lock(&root->fs_info->delete_unused_bgs_mutex);
+
                 /* Don't want to race with allocators so take the groups_sem */
                 down_write(&space_info->groups_sem);
                 spin_lock(&block_group->lock);
@@ -9983,6 +9998,7 @@ void btrfs_delete_unused_bgs(struct btrfs_fs_info *fs_info)
 end_trans:
                 btrfs_end_transaction(trans, root);
 next:
+                mutex_unlock(&root->fs_info->delete_unused_bgs_mutex);
                 btrfs_put_block_group(block_group);
                 spin_lock(&fs_info->unused_bgs_lock);
         }
diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c
index f6a596d5a637..d4a582ac3f73 100644
--- a/fs/btrfs/inode-map.c
+++ b/fs/btrfs/inode-map.c
@@ -246,6 +246,7 @@ void btrfs_unpin_free_ino(struct btrfs_root *root)
 {
         struct btrfs_free_space_ctl *ctl = root->free_ino_ctl;
         struct rb_root *rbroot = &root->free_ino_pinned->free_space_offset;
+        spinlock_t *rbroot_lock = &root->free_ino_pinned->tree_lock;
         struct btrfs_free_space *info;
         struct rb_node *n;
         u64 count;
@@ -254,24 +255,30 @@ void btrfs_unpin_free_ino(struct btrfs_root *root)
                 return;
 
         while (1) {
+                bool add_to_ctl = true;
+
+                spin_lock(rbroot_lock);
                 n = rb_first(rbroot);
-                if (!n)
+                if (!n) {
+                        spin_unlock(rbroot_lock);
                         break;
+                }
 
                 info = rb_entry(n, struct btrfs_free_space, offset_index);
                 BUG_ON(info->bitmap); /* Logic error */
 
                 if (info->offset > root->ino_cache_progress)
-                        goto free;
+                        add_to_ctl = false;
                 else if (info->offset + info->bytes > root->ino_cache_progress)
                         count = root->ino_cache_progress - info->offset + 1;
                 else
                         count = info->bytes;
 
-                __btrfs_add_free_space(ctl, info->offset, count);
-free:
                 rb_erase(&info->offset_index, rbroot);
-                kfree(info);
+                spin_unlock(rbroot_lock);
+                if (add_to_ctl)
+                        __btrfs_add_free_space(ctl, info->offset, count);
+                kmem_cache_free(btrfs_free_space_cachep, info);
         }
 }
 
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 855935f6671a..e33dff356460 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -4209,7 +4209,7 @@ int btrfs_truncate_inode_items(struct btrfs_trans_handle *trans,
         u64 extent_num_bytes = 0;
         u64 extent_offset = 0;
         u64 item_end = 0;
-        u64 last_size = (u64)-1;
+        u64 last_size = new_size;
         u32 found_type = (u8)-1;
         int found_extent;
         int del_item;
@@ -4493,8 +4493,7 @@ out:
                         btrfs_abort_transaction(trans, root, ret);
         }
 error:
-        if (last_size != (u64)-1 &&
-            root->root_key.objectid != BTRFS_TREE_LOG_OBJECTID)
+        if (root->root_key.objectid != BTRFS_TREE_LOG_OBJECTID)
                 btrfs_ordered_update_i_size(inode, last_size, NULL);
 
         btrfs_free_path(path);
@@ -4989,8 +4988,9 @@ static void evict_inode_truncate_pages(struct inode *inode)
         /*
          * Keep looping until we have no more ranges in the io tree.
          * We can have ongoing bios started by readpages (called from readahead)
-         * that didn't get their end io callbacks called yet or they are still
-         * in progress ((extent_io.c:end_bio_extent_readpage()). This means some
+         * that have their endio callback (extent_io.c:end_bio_extent_readpage)
+         * still in progress (unlocked the pages in the bio but did not yet
+         * unlocked the ranges in the io tree). Therefore this means some
          * ranges can still be locked and eviction started because before
          * submitting those bios, which are executed by a separate task (work
          * queue kthread), inode references (inode->i_count) were not taken
@@ -7546,6 +7546,7 @@ unlock:
 
                 current->journal_info = outstanding_extents;
                 btrfs_free_reserved_data_space(inode, len);
+                set_bit(BTRFS_INODE_DIO_READY, &BTRFS_I(inode)->runtime_flags);
         }
 
         /*
@@ -7871,8 +7872,6 @@ static void btrfs_endio_direct_write(struct bio *bio, int err)
         struct bio *dio_bio;
         int ret;
 
-        if (err)
-                goto out_done;
 again:
         ret = btrfs_dec_test_first_ordered_pending(inode, &ordered,
                                                    &ordered_offset,
@@ -7895,7 +7894,6 @@ out_test:
                 ordered = NULL;
                 goto again;
         }
-out_done:
         dio_bio = dip->dio_bio;
 
         kfree(dip);
@@ -8163,9 +8161,8 @@ out_err:
 static void btrfs_submit_direct(int rw, struct bio *dio_bio,
                                 struct inode *inode, loff_t file_offset)
 {
-        struct btrfs_root *root = BTRFS_I(inode)->root;
-        struct btrfs_dio_private *dip;
-        struct bio *io_bio;
+        struct btrfs_dio_private *dip = NULL;
+        struct bio *io_bio = NULL;
         struct btrfs_io_bio *btrfs_bio;
         int skip_sum;
         int write = rw & REQ_WRITE;
@@ -8182,7 +8179,7 @@ static void btrfs_submit_direct(int rw, struct bio *dio_bio,
         dip = kzalloc(sizeof(*dip), GFP_NOFS);
         if (!dip) {
                 ret = -ENOMEM;
-                goto free_io_bio;
+                goto free_ordered;
         }
 
         dip->private = dio_bio->bi_private;
@@ -8210,25 +8207,55 @@ static void btrfs_submit_direct(int rw, struct bio *dio_bio,
 
         if (btrfs_bio->end_io)
                 btrfs_bio->end_io(btrfs_bio, ret);
-free_io_bio:
-        bio_put(io_bio);
 
 free_ordered:
         /*
-         * If this is a write, we need to clean up the reserved space and kill
-         * the ordered extent.
+         * If we arrived here it means either we failed to submit the dip
+         * or we either failed to clone the dio_bio or failed to allocate the
+         * dip. If we cloned the dio_bio and allocated the dip, we can just
+         * call bio_endio against our io_bio so that we get proper resource
+         * cleanup if we fail to submit the dip, otherwise, we must do the
+         * same as btrfs_endio_direct_[write|read] because we can't call these
+         * callbacks - they require an allocated dip and a clone of dio_bio.
          */
-        if (write) {
-                struct btrfs_ordered_extent *ordered;
-                ordered = btrfs_lookup_ordered_extent(inode, file_offset);
-                if (!test_bit(BTRFS_ORDERED_PREALLOC, &ordered->flags) &&
-                    !test_bit(BTRFS_ORDERED_NOCOW, &ordered->flags))
-                        btrfs_free_reserved_extent(root, ordered->start,
-                                                   ordered->disk_len, 1);
-                btrfs_put_ordered_extent(ordered);
-                btrfs_put_ordered_extent(ordered);
+        if (io_bio && dip) {
+                bio_endio(io_bio, ret);
+                /*
+                 * The end io callbacks free our dip, do the final put on io_bio
+                 * and all the cleanup and final put for dio_bio (through
+                 * dio_end_io()).
+                 */
+                dip = NULL;
+                io_bio = NULL;
+        } else {
+                if (write) {
+                        struct btrfs_ordered_extent *ordered;
+
+                        ordered = btrfs_lookup_ordered_extent(inode,
+                                                              file_offset);
+                        set_bit(BTRFS_ORDERED_IOERR, &ordered->flags);
+                        /*
+                         * Decrements our ref on the ordered extent and removes
+                         * the ordered extent from the inode's ordered tree,
+                         * doing all the proper resource cleanup such as for the
+                         * reserved space and waking up any waiters for this
+                         * ordered extent (through btrfs_remove_ordered_extent).
+                         */
+                        btrfs_finish_ordered_io(ordered);
+                } else {
+                        unlock_extent(&BTRFS_I(inode)->io_tree, file_offset,
+                              file_offset + dio_bio->bi_iter.bi_size - 1);
+                }
+                clear_bit(BIO_UPTODATE, &dio_bio->bi_flags);
+                /*
+                 * Releases and cleans up our dio_bio, no need to bio_put()
+                 * nor bio_endio()/bio_io_error() against dio_bio.
+                 */
+                dio_end_io(dio_bio, ret);
         }
-        bio_endio(dio_bio, ret);
+        if (io_bio)
+                bio_put(io_bio);
+        kfree(dip);
 }
 
 static ssize_t check_direct_IO(struct btrfs_root *root, struct kiocb *iocb,
@@ -8330,9 +8357,18 @@ static ssize_t btrfs_direct_IO(struct kiocb *iocb, struct iov_iter *iter,
                                    btrfs_submit_direct, flags);
         if (iov_iter_rw(iter) == WRITE) {
                 current->journal_info = NULL;
-                if (ret < 0 && ret != -EIOCBQUEUED)
-                        btrfs_delalloc_release_space(inode, count);
-                else if (ret >= 0 && (size_t)ret < count)
+                if (ret < 0 && ret != -EIOCBQUEUED) {
+                        /*
+                         * If the error comes from submitting stage,
+                         * btrfs_get_blocsk_direct() has free'd data space,
+                         * and metadata space will be handled by
+                         * finish_ordered_fn, don't do that again to make
+                         * sure bytes_may_use is correct.
+                         */
+                        if (!test_and_clear_bit(BTRFS_INODE_DIO_READY,
+                                     &BTRFS_I(inode)->runtime_flags))
+                                btrfs_delalloc_release_space(inode, count);
+                } else if (ret >= 0 && (size_t)ret < count)
                         btrfs_delalloc_release_space(inode,
                                                      count - (size_t)ret);
         }
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index c86b835da7a8..0770c91586ca 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -87,7 +87,8 @@ struct btrfs_ioctl_received_subvol_args_32 {
 
 
 static int btrfs_clone(struct inode *src, struct inode *inode,
-                       u64 off, u64 olen, u64 olen_aligned, u64 destoff);
+                       u64 off, u64 olen, u64 olen_aligned, u64 destoff,
+                       int no_time_update);
 
 /* Mask out flags that are inappropriate for the given type of inode. */
 static inline __u32 btrfs_mask_flags(umode_t mode, __u32 flags)
@@ -2765,14 +2766,11 @@ out:
         return ret;
 }
 
-static struct page *extent_same_get_page(struct inode *inode, u64 off)
+static struct page *extent_same_get_page(struct inode *inode, pgoff_t index)
 {
         struct page *page;
-        pgoff_t index;
         struct extent_io_tree *tree = &BTRFS_I(inode)->io_tree;
 
-        index = off >> PAGE_CACHE_SHIFT;
-
         page = grab_cache_page(inode->i_mapping, index);
         if (!page)
                 return NULL;
@@ -2793,6 +2791,20 @@ static struct page *extent_same_get_page(struct inode *inode, u64 off)
         return page;
 }
 
+static int gather_extent_pages(struct inode *inode, struct page **pages,
+                               int num_pages, u64 off)
+{
+        int i;
+        pgoff_t index = off >> PAGE_CACHE_SHIFT;
+
+        for (i = 0; i < num_pages; i++) {
+                pages[i] = extent_same_get_page(inode, index + i);
+                if (!pages[i])
+                        return -ENOMEM;
+        }
+        return 0;
+}
+
 static inline void lock_extent_range(struct inode *inode, u64 off, u64 len)
 {
         /* do any pending delalloc/csum calc on src, one way or
@@ -2818,52 +2830,120 @@ static inline void lock_extent_range(struct inode *inode, u64 off, u64 len)
         }
 }
 
-static void btrfs_double_unlock(struct inode *inode1, u64 loff1,
-                                struct inode *inode2, u64 loff2, u64 len)
+static void btrfs_double_inode_unlock(struct inode *inode1, struct inode *inode2)
 {
-        unlock_extent(&BTRFS_I(inode1)->io_tree, loff1, loff1 + len - 1);
-        unlock_extent(&BTRFS_I(inode2)->io_tree, loff2, loff2 + len - 1);
-
         mutex_unlock(&inode1->i_mutex);
         mutex_unlock(&inode2->i_mutex);
 }
 
-static void btrfs_double_lock(struct inode *inode1, u64 loff1,
-                              struct inode *inode2, u64 loff2, u64 len)
+static void btrfs_double_inode_lock(struct inode *inode1, struct inode *inode2)
+{
+        if (inode1 < inode2)
+                swap(inode1, inode2);
+
+        mutex_lock_nested(&inode1->i_mutex, I_MUTEX_PARENT);
+        if (inode1 != inode2)
+                mutex_lock_nested(&inode2->i_mutex, I_MUTEX_CHILD);
+}
+
+static void btrfs_double_extent_unlock(struct inode *inode1, u64 loff1,
+                                      struct inode *inode2, u64 loff2, u64 len)
+{
+        unlock_extent(&BTRFS_I(inode1)->io_tree, loff1, loff1 + len - 1);
+        unlock_extent(&BTRFS_I(inode2)->io_tree, loff2, loff2 + len - 1);
+}
+
+static void btrfs_double_extent_lock(struct inode *inode1, u64 loff1,
+                                     struct inode *inode2, u64 loff2, u64 len)
 {
         if (inode1 < inode2) {
                 swap(inode1, inode2);
                 swap(loff1, loff2);
         }
-
-        mutex_lock_nested(&inode1->i_mutex, I_MUTEX_PARENT);
         lock_extent_range(inode1, loff1, len);
-        if (inode1 != inode2) {
-                mutex_lock_nested(&inode2->i_mutex, I_MUTEX_CHILD);
+        if (inode1 != inode2)
                 lock_extent_range(inode2, loff2, len);
+}
+
+struct cmp_pages {
+        int             num_pages;
+        struct page     **src_pages;
+        struct page     **dst_pages;
+};
+
+static void btrfs_cmp_data_free(struct cmp_pages *cmp)
+{
+        int i;
+        struct page *pg;
+
+        for (i = 0; i < cmp->num_pages; i++) {
+                pg = cmp->src_pages[i];
+                if (pg)
+                        page_cache_release(pg);
+                pg = cmp->dst_pages[i];
+                if (pg)
+                        page_cache_release(pg);
+        }
+        kfree(cmp->src_pages);
+        kfree(cmp->dst_pages);
+}
+
+static int btrfs_cmp_data_prepare(struct inode *src, u64 loff,
+                                  struct inode *dst, u64 dst_loff,
+                                  u64 len, struct cmp_pages *cmp)
+{
+        int ret;
+        int num_pages = PAGE_CACHE_ALIGN(len) >> PAGE_CACHE_SHIFT;
+        struct page **src_pgarr, **dst_pgarr;
+
+        /*
+         * We must gather up all the pages before we initiate our
+         * extent locking. We use an array for the page pointers. Size
+         * of the array is bounded by len, which is in turn bounded by
+         * BTRFS_MAX_DEDUPE_LEN.
+         */
+        src_pgarr = kzalloc(num_pages * sizeof(struct page *), GFP_NOFS);
+        dst_pgarr = kzalloc(num_pages * sizeof(struct page *), GFP_NOFS);
+        if (!src_pgarr || !dst_pgarr) {
+                kfree(src_pgarr);
+                kfree(dst_pgarr);
+                return -ENOMEM;
         }
+        cmp->num_pages = num_pages;
+        cmp->src_pages = src_pgarr;
+        cmp->dst_pages = dst_pgarr;
+
+        ret = gather_extent_pages(src, cmp->src_pages, cmp->num_pages, loff);
+        if (ret)
+                goto out;
+
+        ret = gather_extent_pages(dst, cmp->dst_pages, cmp->num_pages, dst_loff);
+
+out:
+        if (ret)
+                btrfs_cmp_data_free(cmp);
+        return 0;
 }
 
 static int btrfs_cmp_data(struct inode *src, u64 loff, struct inode *dst,
-                          u64 dst_loff, u64 len)
+                          u64 dst_loff, u64 len, struct cmp_pages *cmp)
 {
         int ret = 0;
+        int i;
         struct page *src_page, *dst_page;
         unsigned int cmp_len = PAGE_CACHE_SIZE;
         void *addr, *dst_addr;
 
+        i = 0;
         while (len) {
                 if (len < PAGE_CACHE_SIZE)
                         cmp_len = len;
 
-                src_page = extent_same_get_page(src, loff);
-                if (!src_page)
-                        return -EINVAL;
-                dst_page = extent_same_get_page(dst, dst_loff);
-                if (!dst_page) {
-                        page_cache_release(src_page);
-                        return -EINVAL;
-                }
+                BUG_ON(i >= cmp->num_pages);
+
+                src_page = cmp->src_pages[i];
+                dst_page = cmp->dst_pages[i];
+
                 addr = kmap_atomic(src_page);
                 dst_addr = kmap_atomic(dst_page);
 
@@ -2875,15 +2955,12 @@ static int btrfs_cmp_data(struct inode *src, u64 loff, struct inode *dst,
 
                 kunmap_atomic(addr);
                 kunmap_atomic(dst_addr);
-                page_cache_release(src_page);
-                page_cache_release(dst_page);
 
                 if (ret)
                         break;
 
-                loff += cmp_len;
-                dst_loff += cmp_len;
                 len -= cmp_len;
+                i++;
         }
 
         return ret;
@@ -2914,27 +2991,62 @@ static int btrfs_extent_same(struct inode *src, u64 loff, u64 olen,
 {
         int ret;
         u64 len = olen;
+        struct cmp_pages cmp;
+        int same_inode = 0;
+        u64 same_lock_start = 0;
+        u64 same_lock_len = 0;
 
-        /*
-         * btrfs_clone() can't handle extents in the same file
-         * yet. Once that works, we can drop this check and replace it
-         * with a check for the same inode, but overlapping extents.
-         */
         if (src == dst)
-                return -EINVAL;
+                same_inode = 1;
 
         if (len == 0)
                 return 0;
 
-        btrfs_double_lock(src, loff, dst, dst_loff, len);
+        if (same_inode) {
+                mutex_lock(&src->i_mutex);
 
-        ret = extent_same_check_offsets(src, loff, &len, olen);
-        if (ret)
-                goto out_unlock;
+                ret = extent_same_check_offsets(src, loff, &len, olen);
+                if (ret)
+                        goto out_unlock;
 
-        ret = extent_same_check_offsets(dst, dst_loff, &len, olen);
-        if (ret)
-                goto out_unlock;
+                /*
+                 * Single inode case wants the same checks, except we
+                 * don't want our length pushed out past i_size as
+                 * comparing that data range makes no sense.
+                 *
+                 * extent_same_check_offsets() will do this for an
+                 * unaligned length at i_size, so catch it here and
+                 * reject the request.
+                 *
+                 * This effectively means we require aligned extents
+                 * for the single-inode case, whereas the other cases
+                 * allow an unaligned length so long as it ends at
+                 * i_size.
+                 */
+                if (len != olen) {
+                        ret = -EINVAL;
+                        goto out_unlock;
+                }
+
+                /* Check for overlapping ranges */
+                if (dst_loff + len > loff && dst_loff < loff + len) {
+                        ret = -EINVAL;
+                        goto out_unlock;
+                }
+
+                same_lock_start = min_t(u64, loff, dst_loff);
+                same_lock_len = max_t(u64, loff, dst_loff) + len - same_lock_start;
+        } else {
+                btrfs_double_inode_lock(src, dst);
+
+                ret = extent_same_check_offsets(src, loff, &len, olen);
+                if (ret)
+                        goto out_unlock;
+
+                ret = extent_same_check_offsets(dst, dst_loff, &len, olen);
+                if (ret)
+                        goto out_unlock;
+        }
 
         /* don't make the dst file partly checksummed */
         if ((BTRFS_I(src)->flags & BTRFS_INODE_NODATASUM) !=
@@ -2943,12 +3055,32 @@ static int btrfs_extent_same(struct inode *src, u64 loff, u64 olen,
                 goto out_unlock;
         }
 
-        ret = btrfs_cmp_data(src, loff, dst, dst_loff, len);
+        ret = btrfs_cmp_data_prepare(src, loff, dst, dst_loff, olen, &cmp);
+        if (ret)
+                goto out_unlock;
+
+        if (same_inode)
+                lock_extent_range(src, same_lock_start, same_lock_len);
+        else
+                btrfs_double_extent_lock(src, loff, dst, dst_loff, len);
+
+        /* pass original length for comparison so we stay within i_size */
+        ret = btrfs_cmp_data(src, loff, dst, dst_loff, olen, &cmp);
         if (ret == 0)
-                ret = btrfs_clone(src, dst, loff, olen, len, dst_loff);
+                ret = btrfs_clone(src, dst, loff, olen, len, dst_loff, 1);
+
+        if (same_inode)
+                unlock_extent(&BTRFS_I(src)->io_tree, same_lock_start,
+                              same_lock_start + same_lock_len - 1);
+        else
+                btrfs_double_extent_unlock(src, loff, dst, dst_loff, len);
 
+        btrfs_cmp_data_free(&cmp);
 out_unlock:
-        btrfs_double_unlock(src, loff, dst, dst_loff, len);
+        if (same_inode)
+                mutex_unlock(&src->i_mutex);
+        else
+                btrfs_double_inode_unlock(src, dst);
 
         return ret;
 }
@@ -2958,7 +3090,7 @@ out_unlock:
 static long btrfs_ioctl_file_extent_same(struct file *file,
                         struct btrfs_ioctl_same_args __user *argp)
 {
-        struct btrfs_ioctl_same_args *same;
+        struct btrfs_ioctl_same_args *same = NULL;
         struct btrfs_ioctl_same_extent_info *info;
         struct inode *src = file_inode(file);
         u64 off;
@@ -2988,6 +3120,7 @@ static long btrfs_ioctl_file_extent_same(struct file *file,
 
         if (IS_ERR(same)) {
                 ret = PTR_ERR(same);
+                same = NULL;
                 goto out;
         }
 
@@ -3058,6 +3191,7 @@ static long btrfs_ioctl_file_extent_same(struct file *file,
 
 out:
         mnt_drop_write_file(file);
+        kfree(same);
         return ret;
 }
 
@@ -3100,13 +3234,15 @@ static int clone_finish_inode_update(struct btrfs_trans_handle *trans,
                                      struct inode *inode,
                                      u64 endoff,
                                      const u64 destoff,
-                                     const u64 olen)
+                                     const u64 olen,
+                                     int no_time_update)
 {
         struct btrfs_root *root = BTRFS_I(inode)->root;
         int ret;
 
         inode_inc_iversion(inode);
-        inode->i_mtime = inode->i_ctime = CURRENT_TIME;
+        if (!no_time_update)
+                inode->i_mtime = inode->i_ctime = CURRENT_TIME;
         /*
          * We round up to the block size at eof when determining which
          * extents to clone above, but shouldn't round up the file size.
@@ -3191,13 +3327,13 @@ static void clone_update_extent_map(struct inode *inode,
  * @inode: Inode to clone to
  * @off: Offset within source to start clone from
  * @olen: Original length, passed by user, of range to clone
- * @olen_aligned: Block-aligned value of olen, extent_same uses
- *               identical values here
+ * @olen_aligned: Block-aligned value of olen
  * @destoff: Offset within @inode to start clone
+ * @no_time_update: Whether to update mtime/ctime on the target inode
  */
 static int btrfs_clone(struct inode *src, struct inode *inode,
                        const u64 off, const u64 olen, const u64 olen_aligned,
-                       const u64 destoff)
+                       const u64 destoff, int no_time_update)
 {
         struct btrfs_root *root = BTRFS_I(inode)->root;
         struct btrfs_path *path = NULL;
@@ -3452,6 +3588,20 @@ process_slot:
                                 u64 trim = 0;
                                 u64 aligned_end = 0;
 
+                                /*
+                                 * Don't copy an inline extent into an offset
+                                 * greater than zero. Having an inline extent
+                                 * at such an offset results in chaos as btrfs
+                                 * isn't prepared for such cases. Just skip
+                                 * this case for the same reasons as commented
+                                 * at btrfs_ioctl_clone().
+                                 */
+                                if (last_dest_end > 0) {
+                                        ret = -EOPNOTSUPP;
+                                        btrfs_end_transaction(trans, root);
+                                        goto out;
+                                }
+
                                 if (off > key.offset) {
                                         skip = off - key.offset;
                                         new_key.offset += skip;
@@ -3521,7 +3671,8 @@ process_slot:
                                               root->sectorsize);
                         ret = clone_finish_inode_update(trans, inode,
                                                         last_dest_end,
-                                                        destoff, olen);
+                                                        destoff, olen,
+                                                        no_time_update);
                         if (ret)
                                 goto out;
                         if (new_key.offset + datal >= destoff + len)
@@ -3559,7 +3710,7 @@ process_slot:
                 clone_update_extent_map(inode, trans, NULL, last_dest_end,
                                         destoff + len - last_dest_end);
                 ret = clone_finish_inode_update(trans, inode, destoff + len,
-                                                destoff, olen);
+                                                destoff, olen, no_time_update);
         }
 
 out:
@@ -3696,7 +3847,7 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
                 lock_extent_range(inode, destoff, len);
         }
 
-        ret = btrfs_clone(src, inode, off, olen, len, destoff);
+        ret = btrfs_clone(src, inode, off, olen, len, destoff, 0);
 
         if (same_inode) {
                 u64 lock_start = min_t(u64, off, destoff);
diff --git a/fs/btrfs/ordered-data.c b/fs/btrfs/ordered-data.c
index 89656d799ff6..52170cf1757e 100644
--- a/fs/btrfs/ordered-data.c
+++ b/fs/btrfs/ordered-data.c
@@ -552,6 +552,10 @@ void btrfs_put_ordered_extent(struct btrfs_ordered_extent *entry)
         trace_btrfs_ordered_extent_put(entry->inode, entry);
 
         if (atomic_dec_and_test(&entry->refs)) {
+                ASSERT(list_empty(&entry->log_list));
+                ASSERT(list_empty(&entry->trans_list));
+                ASSERT(list_empty(&entry->root_extent_list));
+                ASSERT(RB_EMPTY_NODE(&entry->rb_node));
                 if (entry->inode)
                         btrfs_add_delayed_iput(entry->inode);
                 while (!list_empty(&entry->list)) {
@@ -579,6 +583,7 @@ void btrfs_remove_ordered_extent(struct inode *inode,
         spin_lock_irq(&tree->lock);
         node = &entry->rb_node;
         rb_erase(node, &tree->tree);
+        RB_CLEAR_NODE(node);
         if (tree->last == node)
                 tree->last = NULL;
         set_bit(BTRFS_ORDERED_COMPLETE, &entry->flags);
diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index d5f1f033b7a0..e9ace099162c 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -1349,6 +1349,11 @@ int btrfs_limit_qgroup(struct btrfs_trans_handle *trans,
         struct btrfs_root *quota_root;
         struct btrfs_qgroup *qgroup;
         int ret = 0;
+        /* Sometimes we would want to clear the limit on this qgroup.
+         * To meet this requirement, we treat the -1 as a special value
+         * which tell kernel to clear the limit on this qgroup.
+         */
+        const u64 CLEAR_VALUE = -1;
 
         mutex_lock(&fs_info->qgroup_ioctl_lock);
         quota_root = fs_info->quota_root;
@@ -1364,14 +1369,42 @@ int btrfs_limit_qgroup(struct btrfs_trans_handle *trans,
         }
 
         spin_lock(&fs_info->qgroup_lock);
-        if (limit->flags & BTRFS_QGROUP_LIMIT_MAX_RFER)
-                qgroup->max_rfer = limit->max_rfer;
-        if (limit->flags & BTRFS_QGROUP_LIMIT_MAX_EXCL)
-                qgroup->max_excl = limit->max_excl;
-        if (limit->flags & BTRFS_QGROUP_LIMIT_RSV_RFER)
-                qgroup->rsv_rfer = limit->rsv_rfer;
-        if (limit->flags & BTRFS_QGROUP_LIMIT_RSV_EXCL)
-                qgroup->rsv_excl = limit->rsv_excl;
+        if (limit->flags & BTRFS_QGROUP_LIMIT_MAX_RFER) {
+                if (limit->max_rfer == CLEAR_VALUE) {
+                        qgroup->lim_flags &= ~BTRFS_QGROUP_LIMIT_MAX_RFER;
+                        limit->flags &= ~BTRFS_QGROUP_LIMIT_MAX_RFER;
+                        qgroup->max_rfer = 0;
+                } else {
+                        qgroup->max_rfer = limit->max_rfer;
+                }
+        }
+        if (limit->flags & BTRFS_QGROUP_LIMIT_MAX_EXCL) {
+                if (limit->max_excl == CLEAR_VALUE) {
+                        qgroup->lim_flags &= ~BTRFS_QGROUP_LIMIT_MAX_EXCL;
+                        limit->flags &= ~BTRFS_QGROUP_LIMIT_MAX_EXCL;
+                        qgroup->max_excl = 0;
+                } else {
+                        qgroup->max_excl = limit->max_excl;
+                }
+        }
+        if (limit->flags & BTRFS_QGROUP_LIMIT_RSV_RFER) {
+                if (limit->rsv_rfer == CLEAR_VALUE) {
+                        qgroup->lim_flags &= ~BTRFS_QGROUP_LIMIT_RSV_RFER;
+                        limit->flags &= ~BTRFS_QGROUP_LIMIT_RSV_RFER;
+                        qgroup->rsv_rfer = 0;
+                } else {
+                        qgroup->rsv_rfer = limit->rsv_rfer;
+                }
+        }
+        if (limit->flags & BTRFS_QGROUP_LIMIT_RSV_EXCL) {
+                if (limit->rsv_excl == CLEAR_VALUE) {
+                        qgroup->lim_flags &= ~BTRFS_QGROUP_LIMIT_RSV_EXCL;
+                        limit->flags &= ~BTRFS_QGROUP_LIMIT_RSV_EXCL;
+                        qgroup->rsv_excl = 0;
+                } else {
+                        qgroup->rsv_excl = limit->rsv_excl;
+                }
+        }
         qgroup->lim_flags |= limit->flags;
 
         spin_unlock(&fs_info->qgroup_lock);
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index 827951fbf7fc..88cbb5995667 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -4049,7 +4049,7 @@ restart:
         if (trans && progress && err == -ENOSPC) {
                 ret = btrfs_force_chunk_alloc(trans, rc->extent_root,
                                               rc->block_group->flags);
-                if (ret == 0) {
+                if (ret == 1) {
                         err = 0;
                         progress = 0;
                         goto restart;
diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
index 9f2feabe99f2..94db0fa5225a 100644
--- a/fs/btrfs/scrub.c
+++ b/fs/btrfs/scrub.c
@@ -3571,7 +3571,6 @@ static noinline_for_stack int scrub_supers(struct scrub_ctx *sctx,
 static noinline_for_stack int scrub_workers_get(struct btrfs_fs_info *fs_info,
                                                 int is_dev_replace)
 {
-        int ret = 0;
         unsigned int flags = WQ_FREEZABLE | WQ_UNBOUND;
         int max_active = fs_info->thread_pool_size;
 
@@ -3584,34 +3583,36 @@ static noinline_for_stack int scrub_workers_get(struct btrfs_fs_info *fs_info,
                         fs_info->scrub_workers =
                                 btrfs_alloc_workqueue("btrfs-scrub", flags,
                                                       max_active, 4);
-                if (!fs_info->scrub_workers) {
-                        ret = -ENOMEM;
-                        goto out;
-                }
+                if (!fs_info->scrub_workers)
+                        goto fail_scrub_workers;
+
                 fs_info->scrub_wr_completion_workers =
                         btrfs_alloc_workqueue("btrfs-scrubwrc", flags,
                                               max_active, 2);
-                if (!fs_info->scrub_wr_completion_workers) {
-                        ret = -ENOMEM;
-                        goto out;
-                }
+                if (!fs_info->scrub_wr_completion_workers)
+                        goto fail_scrub_wr_completion_workers;
+
                 fs_info->scrub_nocow_workers =
                         btrfs_alloc_workqueue("btrfs-scrubnc", flags, 1, 0);
-                if (!fs_info->scrub_nocow_workers) {
-                        ret = -ENOMEM;
-                        goto out;
-                }
+                if (!fs_info->scrub_nocow_workers)
+                        goto fail_scrub_nocow_workers;
                 fs_info->scrub_parity_workers =
                         btrfs_alloc_workqueue("btrfs-scrubparity", flags,
                                               max_active, 2);
-                if (!fs_info->scrub_parity_workers) {
-                        ret = -ENOMEM;
-                        goto out;
-                }
+                if (!fs_info->scrub_parity_workers)
+                        goto fail_scrub_parity_workers;
         }
         ++fs_info->scrub_workers_refcnt;
-out:
-        return ret;
+        return 0;
+
+fail_scrub_parity_workers:
+        btrfs_destroy_workqueue(fs_info->scrub_nocow_workers);
+fail_scrub_nocow_workers:
+        btrfs_destroy_workqueue(fs_info->scrub_wr_completion_workers);
+fail_scrub_wr_completion_workers:
+        btrfs_destroy_workqueue(fs_info->scrub_workers);
+fail_scrub_workers:
+        return -ENOMEM;
 }
 
 static noinline_for_stack void scrub_workers_put(struct btrfs_fs_info *fs_info)
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index c0f18e7266b6..51e0f0d0053e 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -761,7 +761,7 @@ static int __btrfs_end_transaction(struct btrfs_trans_handle *trans,
 
         if (!list_empty(&trans->ordered)) {
                 spin_lock(&info->trans_lock);
-                list_splice(&trans->ordered, &cur_trans->pending_ordered);
+                list_splice_init(&trans->ordered, &cur_trans->pending_ordered);
                 spin_unlock(&info->trans_lock);
         }
 
@@ -1866,7 +1866,7 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
         }
 
         spin_lock(&root->fs_info->trans_lock);
-        list_splice(&trans->ordered, &cur_trans->pending_ordered);
+        list_splice_init(&trans->ordered, &cur_trans->pending_ordered);
         if (cur_trans->state >= TRANS_STATE_COMMIT_START) {
                 spin_unlock(&root->fs_info->trans_lock);
                 atomic_inc(&cur_trans->use_count);
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 1ce80c1c4eb6..9c45431e69ab 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -4117,6 +4117,187 @@ static int logged_inode_size(struct btrfs_root *log, struct inode *inode,
         return 0;
 }
 
+/*
+ * At the moment we always log all xattrs. This is to figure out at log replay
+ * time which xattrs must have their deletion replayed. If a xattr is missing
+ * in the log tree and exists in the fs/subvol tree, we delete it. This is
+ * because if a xattr is deleted, the inode is fsynced and a power failure
+ * happens, causing the log to be replayed the next time the fs is mounted,
+ * we want the xattr to not exist anymore (same behaviour as other filesystems
+ * with a journal, ext3/4, xfs, f2fs, etc).
+ */
+static int btrfs_log_all_xattrs(struct btrfs_trans_handle *trans,
+                                struct btrfs_root *root,
+                                struct inode *inode,
+                                struct btrfs_path *path,
+                                struct btrfs_path *dst_path)
+{
+        int ret;
+        struct btrfs_key key;
+        const u64 ino = btrfs_ino(inode);
+        int ins_nr = 0;
+        int start_slot = 0;
+
+        key.objectid = ino;
+        key.type = BTRFS_XATTR_ITEM_KEY;
+        key.offset = 0;
+
+        ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
+        if (ret < 0)
+                return ret;
+
+        while (true) {
+                int slot = path->slots[0];
+                struct extent_buffer *leaf = path->nodes[0];
+                int nritems = btrfs_header_nritems(leaf);
+
+                if (slot >= nritems) {
+                        if (ins_nr > 0) {
+                                u64 last_extent = 0;
+
+                                ret = copy_items(trans, inode, dst_path, path,
+                                                 &last_extent, start_slot,
+                                                 ins_nr, 1, 0);
+                                /* can't be 1, extent items aren't processed */
+                                ASSERT(ret <= 0);
+                                if (ret < 0)
+                                        return ret;
+                                ins_nr = 0;
+                        }
+                        ret = btrfs_next_leaf(root, path);
+                        if (ret < 0)
+                                return ret;
+                        else if (ret > 0)
+                                break;
+                        continue;
+                }
+
+                btrfs_item_key_to_cpu(leaf, &key, slot);
+                if (key.objectid != ino || key.type != BTRFS_XATTR_ITEM_KEY)
+                        break;
+
+                if (ins_nr == 0)
+                        start_slot = slot;
+                ins_nr++;
+                path->slots[0]++;
+                cond_resched();
+        }
+        if (ins_nr > 0) {
+                u64 last_extent = 0;
+
+                ret = copy_items(trans, inode, dst_path, path,
+                                 &last_extent, start_slot,
+                                 ins_nr, 1, 0);
+                /* can't be 1, extent items aren't processed */
+                ASSERT(ret <= 0);
+                if (ret < 0)
+                        return ret;
+        }
+
+        return 0;
+}
+
+/*
+ * If the no holes feature is enabled we need to make sure any hole between the
+ * last extent and the i_size of our inode is explicitly marked in the log. This
+ * is to make sure that doing something like:
+ *
+ *      1) create file with 128Kb of data
+ *      2) truncate file to 64Kb
+ *      3) truncate file to 256Kb
+ *      4) fsync file
+ *      5) <crash/power failure>
+ *      6) mount fs and trigger log replay
+ *
+ * Will give us a file with a size of 256Kb, the first 64Kb of data match what
+ * the file had in its first 64Kb of data at step 1 and the last 192Kb of the
+ * file correspond to a hole. The presence of explicit holes in a log tree is
+ * what guarantees that log replay will remove/adjust file extent items in the
+ * fs/subvol tree.
+ *
+ * Here we do not need to care about holes between extents, that is already done
+ * by copy_items(). We also only need to do this in the full sync path, where we
+ * lookup for extents from the fs/subvol tree only. In the fast path case, we
+ * lookup the list of modified extent maps and if any represents a hole, we
+ * insert a corresponding extent representing a hole in the log tree.
+ */
+static int btrfs_log_trailing_hole(struct btrfs_trans_handle *trans,
+                                   struct btrfs_root *root,
+                                   struct inode *inode,
+                                   struct btrfs_path *path)
+{
+        int ret;
+        struct btrfs_key key;
+        u64 hole_start;
+        u64 hole_size;
+        struct extent_buffer *leaf;
+        struct btrfs_root *log = root->log_root;
+        const u64 ino = btrfs_ino(inode);
+        const u64 i_size = i_size_read(inode);
+
+        if (!btrfs_fs_incompat(root->fs_info, NO_HOLES))
+                return 0;
+
+        key.objectid = ino;
+        key.type = BTRFS_EXTENT_DATA_KEY;
+        key.offset = (u64)-1;
+
+        ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
+        ASSERT(ret != 0);
+        if (ret < 0)
+                return ret;
+
+        ASSERT(path->slots[0] > 0);
+        path->slots[0]--;
+        leaf = path->nodes[0];
+        btrfs_item_key_to_cpu(leaf, &key, path->slots[0]);
+
+        if (key.objectid != ino || key.type != BTRFS_EXTENT_DATA_KEY) {
+                /* inode does not have any extents */
+                hole_start = 0;
+                hole_size = i_size;
+        } else {
+                struct btrfs_file_extent_item *extent;
+                u64 len;
+
+                /*
+                 * If there's an extent beyond i_size, an explicit hole was
+                 * already inserted by copy_items().
+                 */
+                if (key.offset >= i_size)
+                        return 0;
+
+                extent = btrfs_item_ptr(leaf, path->slots[0],
+                                        struct btrfs_file_extent_item);
+
+                if (btrfs_file_extent_type(leaf, extent) ==
+                    BTRFS_FILE_EXTENT_INLINE) {
+                        len = btrfs_file_extent_inline_len(leaf,
+                                                           path->slots[0],
+                                                           extent);
+                        ASSERT(len == i_size);
+                        return 0;
+                }
+
+                len = btrfs_file_extent_num_bytes(leaf, extent);
+                /* Last extent goes beyond i_size, no need to log a hole. */
+                if (key.offset + len > i_size)
+                        return 0;
+                hole_start = key.offset + len;
+                hole_size = i_size - hole_start;
+        }
+        btrfs_release_path(path);
+
+        /* Last extent ends at i_size. */
+        if (hole_size == 0)
+                return 0;
+
+        hole_size = ALIGN(hole_size, root->sectorsize);
+        ret = btrfs_insert_file_extent(trans, log, ino, hole_start, 0, 0,
+                                       hole_size, 0, hole_size, 0, 0, 0);
+        return ret;
+}
+
 /* log a single inode in the tree log.
  * At least one parent directory for this inode must exist in the tree
  * or be logged already.
@@ -4155,6 +4336,7 @@ static int btrfs_log_inode(struct btrfs_trans_handle *trans,
         u64 ino = btrfs_ino(inode);
         struct extent_map_tree *em_tree = &BTRFS_I(inode)->extent_tree;
         u64 logged_isize = 0;
+        bool need_log_inode_item = true;
 
         path = btrfs_alloc_path();
         if (!path)
@@ -4263,11 +4445,6 @@ static int btrfs_log_inode(struct btrfs_trans_handle *trans,
                 } else {
                         if (inode_only == LOG_INODE_ALL)
                                 fast_search = true;
-                        ret = log_inode_item(trans, log, dst_path, inode);
-                        if (ret) {
-                                err = ret;
-                                goto out_unlock;
-                        }
                         goto log_extents;
                 }
 
@@ -4290,6 +4467,28 @@ again:
                 if (min_key.type > max_key.type)
                         break;
 
+                if (min_key.type == BTRFS_INODE_ITEM_KEY)
+                        need_log_inode_item = false;
+
+                /* Skip xattrs, we log them later with btrfs_log_all_xattrs() */
+                if (min_key.type == BTRFS_XATTR_ITEM_KEY) {
+                        if (ins_nr == 0)
+                                goto next_slot;
+                        ret = copy_items(trans, inode, dst_path, path,
+                                         &last_extent, ins_start_slot,
+                                         ins_nr, inode_only, logged_isize);
+                        if (ret < 0) {
+                                err = ret;
+                                goto out_unlock;
+                        }
+                        ins_nr = 0;
+                        if (ret) {
+                                btrfs_release_path(path);
+                                continue;
+                        }
+                        goto next_slot;
+                }
+
                 src = path->nodes[0];
                 if (ins_nr && ins_start_slot + ins_nr == path->slots[0]) {
                         ins_nr++;
@@ -4357,9 +4556,26 @@ next_slot:
                 ins_nr = 0;
         }
 
+        btrfs_release_path(path);
+        btrfs_release_path(dst_path);
+        err = btrfs_log_all_xattrs(trans, root, inode, path, dst_path);
+        if (err)
+                goto out_unlock;
+        if (max_key.type >= BTRFS_EXTENT_DATA_KEY && !fast_search) {
+                btrfs_release_path(path);
+                btrfs_release_path(dst_path);
+                err = btrfs_log_trailing_hole(trans, root, inode, path);
+                if (err)
+                        goto out_unlock;
+        }
 log_extents:
         btrfs_release_path(path);
         btrfs_release_path(dst_path);
+        if (need_log_inode_item) {
+                err = log_inode_item(trans, log, dst_path, inode);
+                if (err)
+                        goto out_unlock;
+        }
         if (fast_search) {
                 /*
                  * Some ordered extents started by fsync might have completed
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 4b438b4c8c91..fbe7c104531c 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -2766,6 +2766,20 @@ static int btrfs_relocate_chunk(struct btrfs_root *root,
         root = root->fs_info->chunk_root;
         extent_root = root->fs_info->extent_root;
 
+        /*
+         * Prevent races with automatic removal of unused block groups.
+         * After we relocate and before we remove the chunk with offset
+         * chunk_offset, automatic removal of the block group can kick in,
+         * resulting in a failure when calling btrfs_remove_chunk() below.
+         *
+         * Make sure to acquire this mutex before doing a tree search (dev
+         * or chunk trees) to find chunks. Otherwise the cleaner kthread might
+         * call btrfs_remove_chunk() (through btrfs_delete_unused_bgs()) after
+         * we release the path used to search the chunk/dev tree and before
+         * the current task acquires this mutex and calls us.
+         */
+        ASSERT(mutex_is_locked(&root->fs_info->delete_unused_bgs_mutex));
+
         ret = btrfs_can_relocate(extent_root, chunk_offset);
         if (ret)
                 return -ENOSPC;
@@ -2814,13 +2828,18 @@ again:
         key.type = BTRFS_CHUNK_ITEM_KEY;
 
         while (1) {
+                mutex_lock(&root->fs_info->delete_unused_bgs_mutex);
                 ret = btrfs_search_slot(NULL, chunk_root, &key, path, 0, 0);
-                if (ret < 0)
+                if (ret < 0) {
+                        mutex_unlock(&root->fs_info->delete_unused_bgs_mutex);
                         goto error;
+                }
                 BUG_ON(ret == 0); /* Corruption */
 
                 ret = btrfs_previous_item(chunk_root, path, key.objectid,
                                           key.type);
+                if (ret)
+                        mutex_unlock(&root->fs_info->delete_unused_bgs_mutex);
                 if (ret < 0)
                         goto error;
                 if (ret > 0)
@@ -2843,6 +2862,7 @@ again:
                         else
                                 BUG_ON(ret);
                 }
+                mutex_unlock(&root->fs_info->delete_unused_bgs_mutex);
 
                 if (found_key.offset == 0)
                         break;
@@ -3299,9 +3319,12 @@ again:
                         goto error;
                 }
 
+                mutex_lock(&fs_info->delete_unused_bgs_mutex);
                 ret = btrfs_search_slot(NULL, chunk_root, &key, path, 0, 0);
-                if (ret < 0)
+                if (ret < 0) {
+                        mutex_unlock(&fs_info->delete_unused_bgs_mutex);
                         goto error;
+                }
 
                 /*
                  * this shouldn't happen, it means the last relocate
@@ -3313,6 +3336,7 @@ again:
                 ret = btrfs_previous_item(chunk_root, path, 0,
                                           BTRFS_CHUNK_ITEM_KEY);
                 if (ret) {
+                        mutex_unlock(&fs_info->delete_unused_bgs_mutex);
                         ret = 0;
                         break;
                 }
@@ -3321,8 +3345,10 @@ again:
                 slot = path->slots[0];
                 btrfs_item_key_to_cpu(leaf, &found_key, slot);
 
-                if (found_key.objectid != key.objectid)
+                if (found_key.objectid != key.objectid) {
+                        mutex_unlock(&fs_info->delete_unused_bgs_mutex);
                         break;
+                }
 
                 chunk = btrfs_item_ptr(leaf, slot, struct btrfs_chunk);
 
@@ -3335,10 +3361,13 @@ again:
                 ret = should_balance_chunk(chunk_root, leaf, chunk,
                                            found_key.offset);
                 btrfs_release_path(path);
-                if (!ret)
+                if (!ret) {
+                        mutex_unlock(&fs_info->delete_unused_bgs_mutex);
                         goto loop;
+                }
 
                 if (counting) {
+                        mutex_unlock(&fs_info->delete_unused_bgs_mutex);
                         spin_lock(&fs_info->balance_lock);
                         bctl->stat.expected++;
                         spin_unlock(&fs_info->balance_lock);
@@ -3348,6 +3377,7 @@ again:
                 ret = btrfs_relocate_chunk(chunk_root,
                                            found_key.objectid,
                                            found_key.offset);
+                mutex_unlock(&fs_info->delete_unused_bgs_mutex);
                 if (ret && ret != -ENOSPC)
                         goto error;
                 if (ret == -ENOSPC) {
@@ -4087,11 +4117,16 @@ again:
         key.type = BTRFS_DEV_EXTENT_KEY;
 
         do {
+                mutex_lock(&root->fs_info->delete_unused_bgs_mutex);
                 ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
-                if (ret < 0)
+                if (ret < 0) {
+                        mutex_unlock(&root->fs_info->delete_unused_bgs_mutex);
                         goto done;
+                }
 
                 ret = btrfs_previous_item(root, path, 0, key.type);
+                if (ret)
+                        mutex_unlock(&root->fs_info->delete_unused_bgs_mutex);
                 if (ret < 0)
                         goto done;
                 if (ret) {
@@ -4105,6 +4140,7 @@ again:
                 btrfs_item_key_to_cpu(l, &key, path->slots[0]);
 
                 if (key.objectid != device->devid) {
+                        mutex_unlock(&root->fs_info->delete_unused_bgs_mutex);
                         btrfs_release_path(path);
                         break;
                 }
@@ -4113,6 +4149,7 @@ again:
                 length = btrfs_dev_extent_length(l, dev_extent);
 
                 if (key.offset + length <= new_size) {
+                        mutex_unlock(&root->fs_info->delete_unused_bgs_mutex);
                         btrfs_release_path(path);
                         break;
                 }
@@ -4122,6 +4159,7 @@ again:
                 btrfs_release_path(path);
 
                 ret = btrfs_relocate_chunk(root, chunk_objectid, chunk_offset);
+                mutex_unlock(&root->fs_info->delete_unused_bgs_mutex);
                 if (ret && ret != -ENOSPC)
                         goto done;
                 if (ret == -ENOSPC)
@@ -5715,7 +5753,6 @@ static inline void btrfs_end_bbio(struct btrfs_bio *bbio, struct bio *bio, int e
 static void btrfs_end_bio(struct bio *bio, int err)
 {
         struct btrfs_bio *bbio = bio->bi_private;
-        struct btrfs_device *dev = bbio->stripes[0].dev;
         int is_orig_bio = 0;
 
         if (err) {
@@ -5723,6 +5760,7 @@ static void btrfs_end_bio(struct bio *bio, int err)
                 if (err == -EIO || err == -EREMOTEIO) {
                         unsigned int stripe_index =
                                 btrfs_io_bio(bio)->stripe_index;
+                        struct btrfs_device *dev;
 
                         BUG_ON(stripe_index >= bbio->num_stripes);
                         dev = bbio->stripes[stripe_index].dev;
diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
index 6b8e2f091f5b..48851f6ea6ec 100644
--- a/fs/compat_ioctl.c
+++ b/fs/compat_ioctl.c
@@ -896,6 +896,7 @@ COMPATIBLE_IOCTL(FIGETBSZ)
 /* 'X' - originally XFS but some now in the VFS */
 COMPATIBLE_IOCTL(FIFREEZE)
 COMPATIBLE_IOCTL(FITHAW)
+COMPATIBLE_IOCTL(FITRIM)
 COMPATIBLE_IOCTL(KDGETKEYCODE)
 COMPATIBLE_IOCTL(KDSETKEYCODE)
 COMPATIBLE_IOCTL(KDGKBTYPE)
diff --git a/fs/configfs/item.c b/fs/configfs/item.c
index 4d6a30e76168..b863a09cd2f1 100644
--- a/fs/configfs/item.c
+++ b/fs/configfs/item.c
@@ -115,7 +115,7 @@ void config_item_init_type_name(struct config_item *item,
                                 const char *name,
                                 struct config_item_type *type)
 {
-        config_item_set_name(item, name);
+        config_item_set_name(item, "%s", name);
         item->ci_type = type;
         config_item_init(item);
 }
@@ -124,7 +124,7 @@ EXPORT_SYMBOL(config_item_init_type_name);
 void config_group_init_type_name(struct config_group *group, const char *name,
                          struct config_item_type *type)
 {
-        config_item_set_name(&group->cg_item, name);
+        config_item_set_name(&group->cg_item, "%s", name);
         group->cg_item.ci_type = type;
         config_group_init(group);
 }
diff --git a/fs/dcache.c b/fs/dcache.c
index 7a3f3e5f9cea..5c8ea15e73a5 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -642,7 +642,7 @@ static inline bool fast_dput(struct dentry *dentry)
 
         /*
          * If we have a d_op->d_delete() operation, we sould not
-         * let the dentry count go to zero, so use "put__or_lock".
+         * let the dentry count go to zero, so use "put_or_lock".
          */
         if (unlikely(dentry->d_flags & DCACHE_OP_DELETE))
                 return lockref_put_or_lock(&dentry->d_lockref);
@@ -697,7 +697,7 @@ static inline bool fast_dput(struct dentry *dentry)
          */
         smp_rmb();
         d_flags = ACCESS_ONCE(dentry->d_flags);
-        d_flags &= DCACHE_REFERENCED | DCACHE_LRU_LIST;
+        d_flags &= DCACHE_REFERENCED | DCACHE_LRU_LIST | DCACHE_DISCONNECTED;
 
         /* Nothing to do? Dropping the reference was all we needed? */
         if (d_flags == (DCACHE_REFERENCED | DCACHE_LRU_LIST) && !d_unhashed(dentry))
@@ -776,6 +776,9 @@ repeat:
         if (unlikely(d_unhashed(dentry)))
                 goto kill_it;
 
+        if (unlikely(dentry->d_flags & DCACHE_DISCONNECTED))
+                goto kill_it;
+
         if (unlikely(dentry->d_flags & DCACHE_OP_DELETE)) {
                 if (dentry->d_op->d_delete(dentry))
                         goto kill_it;
diff --git a/fs/ecryptfs/file.c b/fs/ecryptfs/file.c
index 72afcc629d7b..feef8a9c4de7 100644
--- a/fs/ecryptfs/file.c
+++ b/fs/ecryptfs/file.c
@@ -325,7 +325,6 @@ ecryptfs_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                 return rc;
 
         switch (cmd) {
-        case FITRIM:
         case FS_IOC32_GETFLAGS:
         case FS_IOC32_SETFLAGS:
         case FS_IOC32_GETVERSION:
diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
index cb8451246b30..1346cfa355d0 100644
--- a/fs/ext4/ioctl.c
+++ b/fs/ext4/ioctl.c
@@ -755,7 +755,6 @@ long ext4_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                 return err;
         }
         case EXT4_IOC_MOVE_EXT:
-        case FITRIM:
         case EXT4_IOC_RESIZE_FS:
         case EXT4_IOC_PRECACHE_EXTENTS:
         case EXT4_IOC_SET_ENCRYPTION_POLICY:
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index f0520bcf2094..518c6294bf6c 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -702,6 +702,7 @@ void wbc_account_io(struct writeback_control *wbc, struct page *page,
         else
                 wbc->wb_tcand_bytes -= min(bytes, wbc->wb_tcand_bytes);
 }
+EXPORT_SYMBOL_GPL(wbc_account_io);
 
 /**
  * inode_congested - test whether an inode is congested
diff --git a/fs/hpfs/alloc.c b/fs/hpfs/alloc.c
index f005046e1591..d6a4b55d2ab0 100644
--- a/fs/hpfs/alloc.c
+++ b/fs/hpfs/alloc.c
@@ -484,3 +484,98 @@ struct anode *hpfs_alloc_anode(struct super_block *s, secno near, anode_secno *a
         a->btree.first_free = cpu_to_le16(8);
         return a;
 }
+
+static unsigned find_run(__le32 *bmp, unsigned *idx)
+{
+        unsigned len;
+        while (tstbits(bmp, *idx, 1)) {
+                (*idx)++;
+                if (unlikely(*idx >= 0x4000))
+                        return 0;
+        }
+        len = 1;
+        while (!tstbits(bmp, *idx + len, 1))
+                len++;
+        return len;
+}
+
+static int do_trim(struct super_block *s, secno start, unsigned len, secno limit_start, secno limit_end, unsigned minlen, unsigned *result)
+{
+        int err;
+        secno end;
+        if (fatal_signal_pending(current))
+                return -EINTR;
+        end = start + len;
+        if (start < limit_start)
+                start = limit_start;
+        if (end > limit_end)
+                end = limit_end;
+        if (start >= end)
+                return 0;
+        if (end - start < minlen)
+                return 0;
+        err = sb_issue_discard(s, start, end - start, GFP_NOFS, 0);
+        if (err)
+                return err;
+        *result += end - start;
+        return 0;
+}
+
+int hpfs_trim_fs(struct super_block *s, u64 start, u64 end, u64 minlen, unsigned *result)
+{
+        int err = 0;
+        struct hpfs_sb_info *sbi = hpfs_sb(s);
+        unsigned idx, len, start_bmp, end_bmp;
+        __le32 *bmp;
+        struct quad_buffer_head qbh;
+
+        *result = 0;
+        if (!end || end > sbi->sb_fs_size)
+                end = sbi->sb_fs_size;
+        if (start >= sbi->sb_fs_size)
+                return 0;
+        if (minlen > 0x4000)
+                return 0;
+        if (start < sbi->sb_dirband_start + sbi->sb_dirband_size && end > sbi->sb_dirband_start) {
+                hpfs_lock(s);
+                if (s->s_flags & MS_RDONLY) {
+                        err = -EROFS;
+                        goto unlock_1;
+                }
+                if (!(bmp = hpfs_map_dnode_bitmap(s, &qbh))) {
+                        err = -EIO;
+                        goto unlock_1;
+                }
+                idx = 0;
+                while ((len = find_run(bmp, &idx)) && !err) {
+                        err = do_trim(s, sbi->sb_dirband_start + idx * 4, len * 4, start, end, minlen, result);
+                        idx += len;
+                }
+                hpfs_brelse4(&qbh);
+unlock_1:
+                hpfs_unlock(s);
+        }
+        start_bmp = start >> 14;
+        end_bmp = (end + 0x3fff) >> 14;
+        while (start_bmp < end_bmp && !err) {
+                hpfs_lock(s);
+                if (s->s_flags & MS_RDONLY) {
+                        err = -EROFS;
+                        goto unlock_2;
+                }
+                if (!(bmp = hpfs_map_bitmap(s, start_bmp, &qbh, "trim"))) {
+                        err = -EIO;
+                        goto unlock_2;
+                }
+                idx = 0;
+                while ((len = find_run(bmp, &idx)) && !err) {
+                        err = do_trim(s, (start_bmp << 14) + idx, len, start, end, minlen, result);
+                        idx += len;
+                }
+                hpfs_brelse4(&qbh);
+unlock_2:
+                hpfs_unlock(s);
+                start_bmp++;
+        }
+        return err;
+}
diff --git a/fs/hpfs/dir.c b/fs/hpfs/dir.c
index 2a8e07425de0..dc540bfcee1d 100644
--- a/fs/hpfs/dir.c
+++ b/fs/hpfs/dir.c
@@ -327,4 +327,5 @@ const struct file_operations hpfs_dir_ops =
         .iterate        = hpfs_readdir,
         .release        = hpfs_dir_release,
         .fsync          = hpfs_file_fsync,
+        .unlocked_ioctl = hpfs_ioctl,
 };
diff --git a/fs/hpfs/file.c b/fs/hpfs/file.c
index 6d8cfe9b52d6..7ca28d604bf7 100644
--- a/fs/hpfs/file.c
+++ b/fs/hpfs/file.c
@@ -203,6 +203,7 @@ const struct file_operations hpfs_file_ops =
         .release        = hpfs_file_release,
         .fsync          = hpfs_file_fsync,
         .splice_read    = generic_file_splice_read,
+        .unlocked_ioctl = hpfs_ioctl,
 };
 
 const struct inode_operations hpfs_file_iops =
diff --git a/fs/hpfs/hpfs_fn.h b/fs/hpfs/hpfs_fn.h
index bb04b58d1d69..c4867b5116dd 100644
--- a/fs/hpfs/hpfs_fn.h
+++ b/fs/hpfs/hpfs_fn.h
@@ -18,6 +18,8 @@
 #include <linux/pagemap.h>
 #include <linux/buffer_head.h>
 #include <linux/slab.h>
+#include <linux/sched.h>
+#include <linux/blkdev.h>
 #include <asm/unaligned.h>
 
 #include "hpfs.h"
@@ -200,6 +202,7 @@ void hpfs_free_dnode(struct super_block *, secno);
 struct dnode *hpfs_alloc_dnode(struct super_block *, secno, dnode_secno *, struct quad_buffer_head *);
 struct fnode *hpfs_alloc_fnode(struct super_block *, secno, fnode_secno *, struct buffer_head **);
 struct anode *hpfs_alloc_anode(struct super_block *, secno, anode_secno *, struct buffer_head **);
+int hpfs_trim_fs(struct super_block *, u64, u64, u64, unsigned *);
 
 /* anode.c */
 
@@ -318,6 +321,7 @@ __printf(2, 3)
 void hpfs_error(struct super_block *, const char *, ...);
 int hpfs_stop_cycles(struct super_block *, int, int *, int *, char *);
 unsigned hpfs_get_free_dnodes(struct super_block *);
+long hpfs_ioctl(struct file *file, unsigned cmd, unsigned long arg);
 
 /*
  * local time (HPFS) to GMT (Unix)
diff --git a/fs/hpfs/super.c b/fs/hpfs/super.c
index 7cd00d3a7c9b..68a9bed05628 100644
--- a/fs/hpfs/super.c
+++ b/fs/hpfs/super.c
@@ -52,17 +52,20 @@ static void unmark_dirty(struct super_block *s)
 }
 
 /* Filesystem error... */
-static char err_buf[1024];
-
 void hpfs_error(struct super_block *s, const char *fmt, ...)
 {
+        struct va_format vaf;
         va_list args;
 
         va_start(args, fmt);
-        vsnprintf(err_buf, sizeof(err_buf), fmt, args);
+
+        vaf.fmt = fmt;
+        vaf.va = &args;
+
+        pr_err("filesystem error: %pV", &vaf);
+
         va_end(args);
 
-        pr_err("filesystem error: %s", err_buf);
         if (!hpfs_sb(s)->sb_was_error) {
                 if (hpfs_sb(s)->sb_err == 2) {
                         pr_cont("; crashing the system because you wanted it\n");
@@ -196,12 +199,39 @@ static int hpfs_statfs(struct dentry *dentry, struct kstatfs *buf)
         return 0;
 }
 
+
+long hpfs_ioctl(struct file *file, unsigned cmd, unsigned long arg)
+{
+        switch (cmd) {
+                case FITRIM: {
+                        struct fstrim_range range;
+                        secno n_trimmed;
+                        int r;
+                        if (!capable(CAP_SYS_ADMIN))
+                                return -EPERM;
+                        if (copy_from_user(&range, (struct fstrim_range __user *)arg, sizeof(range)))
+                                return -EFAULT;
+                        r = hpfs_trim_fs(file_inode(file)->i_sb, range.start >> 9, (range.start + range.len) >> 9, (range.minlen + 511) >> 9, &n_trimmed);
+                        if (r)
+                                return r;
+                        range.len = (u64)n_trimmed << 9;
+                        if (copy_to_user((struct fstrim_range __user *)arg, &range, sizeof(range)))
+                                return -EFAULT;
+                        return 0;
+                }
+                default: {
+                        return -ENOIOCTLCMD;
+                }
+        }
+}
+
+
 static struct kmem_cache * hpfs_inode_cachep;
 
 static struct inode *hpfs_alloc_inode(struct super_block *sb)
 {
         struct hpfs_inode_info *ei;
-        ei = (struct hpfs_inode_info *)kmem_cache_alloc(hpfs_inode_cachep, GFP_NOFS);
+        ei = kmem_cache_alloc(hpfs_inode_cachep, GFP_NOFS);
         if (!ei)
                 return NULL;
         ei->vfs_inode.i_version = 1;
@@ -424,11 +454,14 @@ static int hpfs_remount_fs(struct super_block *s, int *flags, char *data)
         int o;
         struct hpfs_sb_info *sbi = hpfs_sb(s);
         char *new_opts = kstrdup(data, GFP_KERNEL);
-        
+
+        if (!new_opts)
+                return -ENOMEM;
+
         sync_filesystem(s);
 
         *flags |= MS_NOATIME;
-        
+
         hpfs_lock(s);
         uid = sbi->sb_uid; gid = sbi->sb_gid;
         umask = 0777 & ~sbi->sb_mode;
diff --git a/fs/jfs/file.c b/fs/jfs/file.c
index e98d39d75cf4..b9dc23cd04f2 100644
--- a/fs/jfs/file.c
+++ b/fs/jfs/file.c
@@ -76,7 +76,7 @@ static int jfs_open(struct inode *inode, struct file *file)
                 if (ji->active_ag == -1) {
                         struct jfs_sb_info *jfs_sb = JFS_SBI(inode->i_sb);
                         ji->active_ag = BLKTOAG(addressPXD(&ji->ixpxd), jfs_sb);
-                        atomic_inc( &jfs_sb->bmap->db_active[ji->active_ag]);
+                        atomic_inc(&jfs_sb->bmap->db_active[ji->active_ag]);
                 }
                 spin_unlock_irq(&ji->ag_lock);
         }
diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c
index 6f1cb2b5ee28..41aa3ca6a6a4 100644
--- a/fs/jfs/inode.c
+++ b/fs/jfs/inode.c
@@ -134,11 +134,11 @@ int jfs_write_inode(struct inode *inode, struct writeback_control *wbc)
          * It has been committed since the last change, but was still
          * on the dirty inode list.
          */
-         if (!test_cflag(COMMIT_Dirty, inode)) {
+        if (!test_cflag(COMMIT_Dirty, inode)) {
                 /* Make sure committed changes hit the disk */
                 jfs_flush_journal(JFS_SBI(inode->i_sb)->log, wait);
                 return 0;
-         }
+        }
 
         if (jfs_commit_inode(inode, wait)) {
                 jfs_err("jfs_write_inode: jfs_commit_inode failed!");
diff --git a/fs/jfs/ioctl.c b/fs/jfs/ioctl.c
index 93a1232894f6..8db8b7d61e40 100644
--- a/fs/jfs/ioctl.c
+++ b/fs/jfs/ioctl.c
@@ -180,9 +180,6 @@ long jfs_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
         case JFS_IOC_SETFLAGS32:
                 cmd = JFS_IOC_SETFLAGS;
                 break;
-        case FITRIM:
-                cmd = FITRIM;
-                break;
         }
         return jfs_ioctl(filp, cmd, arg);
 }
diff --git a/fs/jfs/namei.c b/fs/jfs/namei.c
index e33be921aa41..a5ac97b9a933 100644
--- a/fs/jfs/namei.c
+++ b/fs/jfs/namei.c
@@ -1160,7 +1160,7 @@ static int jfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                 rc = dtModify(tid, new_dir, &new_dname, &ino,
                               old_ip->i_ino, JFS_RENAME);
                 if (rc)
-                        goto out4;
+                        goto out_tx;
                 drop_nlink(new_ip);
                 if (S_ISDIR(new_ip->i_mode)) {
                         drop_nlink(new_ip);
@@ -1185,7 +1185,7 @@ static int jfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                         if ((new_size = commitZeroLink(tid, new_ip)) < 0) {
                                 txAbort(tid, 1);        /* Marks FS Dirty */
                                 rc = new_size;
-                                goto out4;
+                                goto out_tx;
                         }
                         tblk = tid_to_tblock(tid);
                         tblk->xflag |= COMMIT_DELETE;
@@ -1203,7 +1203,7 @@ static int jfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                 if (rc) {
                         jfs_err("jfs_rename didn't expect dtSearch to fail "
                                 "w/rc = %d", rc);
-                        goto out4;
+                        goto out_tx;
                 }
 
                 ino = old_ip->i_ino;
@@ -1211,7 +1211,7 @@ static int jfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                 if (rc) {
                         if (rc == -EIO)
                                 jfs_err("jfs_rename: dtInsert returned -EIO");
-                        goto out4;
+                        goto out_tx;
                 }
                 if (S_ISDIR(old_ip->i_mode))
                         inc_nlink(new_dir);
@@ -1226,7 +1226,7 @@ static int jfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                 jfs_err("jfs_rename did not expect dtDelete to return rc = %d",
                         rc);
                 txAbort(tid, 1);        /* Marks Filesystem dirty */
-                goto out4;
+                goto out_tx;
         }
         if (S_ISDIR(old_ip->i_mode)) {
                 drop_nlink(old_dir);
@@ -1285,7 +1285,7 @@ static int jfs_rename(struct inode *old_dir, struct dentry *old_dentry,
 
         rc = txCommit(tid, ipcount, iplist, commit_flag);
 
-      out4:
+      out_tx:
         txEnd(tid);
         if (new_ip)
                 mutex_unlock(&JFS_IP(new_ip)->commit_mutex);
@@ -1308,13 +1308,6 @@ static int jfs_rename(struct inode *old_dir, struct dentry *old_dentry,
         }
         if (new_ip && (new_ip->i_nlink == 0))
                 set_cflag(COMMIT_Nolink, new_ip);
-      out3:
-        free_UCSname(&new_dname);
-      out2:
-        free_UCSname(&old_dname);
-      out1:
-        if (new_ip && !S_ISDIR(new_ip->i_mode))
-                IWRITE_UNLOCK(new_ip);
         /*
          * Truncating the directory index table is not guaranteed.  It
          * may need to be done iteratively
@@ -1325,7 +1318,13 @@ static int jfs_rename(struct inode *old_dir, struct dentry *old_dentry,
 
                 clear_cflag(COMMIT_Stale, old_dir);
         }
-
+        if (new_ip && !S_ISDIR(new_ip->i_mode))
+                IWRITE_UNLOCK(new_ip);
+      out3:
+        free_UCSname(&new_dname);
+      out2:
+        free_UCSname(&old_dname);
+      out1:
         jfs_info("jfs_rename: returning %d", rc);
         return rc;
 }
diff --git a/fs/locks.c b/fs/locks.c
index 653faabb07f4..d3d558ba4da7 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -862,12 +862,11 @@ static int posix_locks_deadlock(struct file_lock *caller_fl,
  * whether or not a lock was successfully freed by testing the return
  * value for -ENOENT.
  */
-static int flock_lock_file(struct file *filp, struct file_lock *request)
+static int flock_lock_inode(struct inode *inode, struct file_lock *request)
 {
         struct file_lock *new_fl = NULL;
         struct file_lock *fl;
         struct file_lock_context *ctx;
-        struct inode *inode = file_inode(filp);
         int error = 0;
         bool found = false;
         LIST_HEAD(dispose);
@@ -890,7 +889,7 @@ static int flock_lock_file(struct file *filp, struct file_lock *request)
                 goto find_conflict;
 
         list_for_each_entry(fl, &ctx->flc_flock, fl_list) {
-                if (filp != fl->fl_file)
+                if (request->fl_file != fl->fl_file)
                         continue;
                 if (request->fl_type == fl->fl_type)
                         goto out;
@@ -1164,20 +1163,19 @@ int posix_lock_file(struct file *filp, struct file_lock *fl,
 EXPORT_SYMBOL(posix_lock_file);
 
 /**
- * posix_lock_file_wait - Apply a POSIX-style lock to a file
- * @filp: The file to apply the lock to
+ * posix_lock_inode_wait - Apply a POSIX-style lock to a file
+ * @inode: inode of file to which lock request should be applied
  * @fl: The lock to be applied
  *
- * Add a POSIX style lock to a file.
- * We merge adjacent & overlapping locks whenever possible.
- * POSIX locks are sorted by owner task, then by starting address
+ * Variant of posix_lock_file_wait that does not take a filp, and so can be
+ * used after the filp has already been torn down.
  */
-int posix_lock_file_wait(struct file *filp, struct file_lock *fl)
+int posix_lock_inode_wait(struct inode *inode, struct file_lock *fl)
 {
         int error;
         might_sleep ();
         for (;;) {
-                error = posix_lock_file(filp, fl, NULL);
+                error = __posix_lock_file(inode, fl, NULL);
                 if (error != FILE_LOCK_DEFERRED)
                         break;
                 error = wait_event_interruptible(fl->fl_wait, !fl->fl_next);
@@ -1189,7 +1187,7 @@ int posix_lock_file_wait(struct file *filp, struct file_lock *fl)
         }
         return error;
 }
-EXPORT_SYMBOL(posix_lock_file_wait);
+EXPORT_SYMBOL(posix_lock_inode_wait);
 
 /**
  * locks_mandatory_locked - Check for an active lock
@@ -1851,18 +1849,18 @@ int fcntl_setlease(unsigned int fd, struct file *filp, long arg)
 }
 
 /**
- * flock_lock_file_wait - Apply a FLOCK-style lock to a file
- * @filp: The file to apply the lock to
+ * flock_lock_inode_wait - Apply a FLOCK-style lock to a file
+ * @inode: inode of the file to apply to
  * @fl: The lock to be applied
  *
- * Add a FLOCK style lock to a file.
+ * Apply a FLOCK style lock request to an inode.
  */
-int flock_lock_file_wait(struct file *filp, struct file_lock *fl)
+int flock_lock_inode_wait(struct inode *inode, struct file_lock *fl)
 {
         int error;
         might_sleep();
         for (;;) {
-                error = flock_lock_file(filp, fl);
+                error = flock_lock_inode(inode, fl);
                 if (error != FILE_LOCK_DEFERRED)
                         break;
                 error = wait_event_interruptible(fl->fl_wait, !fl->fl_next);
@@ -1874,8 +1872,7 @@ int flock_lock_file_wait(struct file *filp, struct file_lock *fl)
         }
         return error;
 }
-
-EXPORT_SYMBOL(flock_lock_file_wait);
+EXPORT_SYMBOL(flock_lock_inode_wait);
 
 /**
  *      sys_flock: - flock() system call.
@@ -2401,7 +2398,8 @@ locks_remove_flock(struct file *filp)
                 .fl_type = F_UNLCK,
                 .fl_end = OFFSET_MAX,
         };
-        struct file_lock_context *flctx = file_inode(filp)->i_flctx;
+        struct inode *inode = file_inode(filp);
+        struct file_lock_context *flctx = inode->i_flctx;
 
         if (list_empty(&flctx->flc_flock))
                 return;
@@ -2409,7 +2407,7 @@ locks_remove_flock(struct file *filp)
         if (filp->f_op->flock)
                 filp->f_op->flock(filp, F_SETLKW, &fl);
         else
-                flock_lock_file(filp, &fl);
+                flock_lock_inode(inode, &fl);
 
         if (fl.fl_ops && fl.fl_ops->fl_release_private)
                 fl.fl_ops->fl_release_private(&fl);
diff --git a/fs/namespace.c b/fs/namespace.c
index c7cb8a526c05..2b8aa15fd6df 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1361,6 +1361,36 @@ enum umount_tree_flags {
         UMOUNT_PROPAGATE = 2,
         UMOUNT_CONNECTED = 4,
 };
+
+static bool disconnect_mount(struct mount *mnt, enum umount_tree_flags how)
+{
+        /* Leaving mounts connected is only valid for lazy umounts */
+        if (how & UMOUNT_SYNC)
+                return true;
+
+        /* A mount without a parent has nothing to be connected to */
+        if (!mnt_has_parent(mnt))
+                return true;
+
+        /* Because the reference counting rules change when mounts are
+         * unmounted and connected, umounted mounts may not be
+         * connected to mounted mounts.
+         */
+        if (!(mnt->mnt_parent->mnt.mnt_flags & MNT_UMOUNT))
+                return true;
+
+        /* Has it been requested that the mount remain connected? */
+        if (how & UMOUNT_CONNECTED)
+                return false;
+
+        /* Is the mount locked such that it needs to remain connected? */
+        if (IS_MNT_LOCKED(mnt))
+                return false;
+
+        /* By default disconnect the mount */
+        return true;
+}
+
 /*
  * mount_lock must be held
  * namespace_sem must be held for write
@@ -1398,10 +1428,7 @@ static void umount_tree(struct mount *mnt, enum umount_tree_flags how)
                 if (how & UMOUNT_SYNC)
                         p->mnt.mnt_flags |= MNT_SYNC_UMOUNT;
 
-                disconnect = !(((how & UMOUNT_CONNECTED) &&
-                                mnt_has_parent(p) &&
-                                (p->mnt_parent->mnt.mnt_flags & MNT_UMOUNT)) ||
-                               IS_MNT_LOCKED_AND_LAZY(p));
+                disconnect = disconnect_mount(p, how);
 
                 pin_insert_group(&p->mnt_umount, &p->mnt_parent->mnt,
                                  disconnect ? &unmounted : NULL);
@@ -1538,11 +1565,8 @@ void __detach_mounts(struct dentry *dentry)
         while (!hlist_empty(&mp->m_list)) {
                 mnt = hlist_entry(mp->m_list.first, struct mount, mnt_mp_list);
                 if (mnt->mnt.mnt_flags & MNT_UMOUNT) {
-                        struct mount *p, *tmp;
-                        list_for_each_entry_safe(p, tmp, &mnt->mnt_mounts,  mnt_child) {
-                                hlist_add_head(&p->mnt_umount.s_list, &unmounted);
-                                umount_mnt(p);
-                        }
+                        hlist_add_head(&mnt->mnt_umount.s_list, &unmounted);
+                        umount_mnt(mnt);
                 }
                 else umount_tree(mnt, UMOUNT_CONNECTED);
         }
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 6f228b5af819..8bee93469617 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -5439,15 +5439,15 @@ static int nfs4_proc_getlk(struct nfs4_state *state, int cmd, struct file_lock *
         return err;
 }
 
-static int do_vfs_lock(struct file *file, struct file_lock *fl)
+static int do_vfs_lock(struct inode *inode, struct file_lock *fl)
 {
         int res = 0;
         switch (fl->fl_flags & (FL_POSIX|FL_FLOCK)) {
                 case FL_POSIX:
-                        res = posix_lock_file_wait(file, fl);
+                        res = posix_lock_inode_wait(inode, fl);
                         break;
                 case FL_FLOCK:
-                        res = flock_lock_file_wait(file, fl);
+                        res = flock_lock_inode_wait(inode, fl);
                         break;
                 default:
                         BUG();
@@ -5484,7 +5484,6 @@ static struct nfs4_unlockdata *nfs4_alloc_unlockdata(struct file_lock *fl,
         atomic_inc(&lsp->ls_count);
         /* Ensure we don't close file until we're done freeing locks! */
         p->ctx = get_nfs_open_context(ctx);
-        get_file(fl->fl_file);
         memcpy(&p->fl, fl, sizeof(p->fl));
         p->server = NFS_SERVER(inode);
         return p;
@@ -5496,7 +5495,6 @@ static void nfs4_locku_release_calldata(void *data)
         nfs_free_seqid(calldata->arg.seqid);
         nfs4_put_lock_state(calldata->lsp);
         put_nfs_open_context(calldata->ctx);
-        fput(calldata->fl.fl_file);
         kfree(calldata);
 }
 
@@ -5509,7 +5507,7 @@ static void nfs4_locku_done(struct rpc_task *task, void *data)
         switch (task->tk_status) {
                 case 0:
                         renew_lease(calldata->server, calldata->timestamp);
-                        do_vfs_lock(calldata->fl.fl_file, &calldata->fl);
+                        do_vfs_lock(calldata->lsp->ls_state->inode, &calldata->fl);
                         if (nfs4_update_lock_stateid(calldata->lsp,
                                         &calldata->res.stateid))
                                 break;
@@ -5617,7 +5615,7 @@ static int nfs4_proc_unlck(struct nfs4_state *state, int cmd, struct file_lock *
         mutex_lock(&sp->so_delegreturn_mutex);
         /* Exclude nfs4_reclaim_open_stateid() - note nesting! */
         down_read(&nfsi->rwsem);
-        if (do_vfs_lock(request->fl_file, request) == -ENOENT) {
+        if (do_vfs_lock(inode, request) == -ENOENT) {
                 up_read(&nfsi->rwsem);
                 mutex_unlock(&sp->so_delegreturn_mutex);
                 goto out;
@@ -5758,7 +5756,7 @@ static void nfs4_lock_done(struct rpc_task *task, void *calldata)
                                 data->timestamp);
                 if (data->arg.new_lock) {
                         data->fl.fl_flags &= ~(FL_SLEEP | FL_ACCESS);
-                        if (do_vfs_lock(data->fl.fl_file, &data->fl) < 0) {
+                        if (do_vfs_lock(lsp->ls_state->inode, &data->fl) < 0) {
                                 rpc_restart_call_prepare(task);
                                 break;
                         }
@@ -6000,7 +5998,7 @@ static int _nfs4_proc_setlk(struct nfs4_state *state, int cmd, struct file_lock
         if (status != 0)
                 goto out;
         request->fl_flags |= FL_ACCESS;
-        status = do_vfs_lock(request->fl_file, request);
+        status = do_vfs_lock(state->inode, request);
         if (status < 0)
                 goto out;
         down_read(&nfsi->rwsem);
@@ -6008,7 +6006,7 @@ static int _nfs4_proc_setlk(struct nfs4_state *state, int cmd, struct file_lock
                 /* Yes: cache locks! */
                 /* ...but avoid races with delegation recall... */
                 request->fl_flags = fl_flags & ~FL_SLEEP;
-                status = do_vfs_lock(request->fl_file, request);
+                status = do_vfs_lock(state->inode, request);
                 up_read(&nfsi->rwsem);
                 goto out;
         }
diff --git a/fs/nilfs2/ioctl.c b/fs/nilfs2/ioctl.c
index 9a20e513d7eb..aba43811d6ef 100644
--- a/fs/nilfs2/ioctl.c
+++ b/fs/nilfs2/ioctl.c
@@ -1369,7 +1369,6 @@ long nilfs_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
         case NILFS_IOCTL_SYNC:
         case NILFS_IOCTL_RESIZE:
         case NILFS_IOCTL_SET_ALLOC_RANGE:
-        case FITRIM:
                 break;
         default:
                 return -ENOIOCTLCMD;
diff --git a/fs/ocfs2/ioctl.c b/fs/ocfs2/ioctl.c
index 53e6c40ed4c6..3cb097ccce60 100644
--- a/fs/ocfs2/ioctl.c
+++ b/fs/ocfs2/ioctl.c
@@ -980,7 +980,6 @@ long ocfs2_compat_ioctl(struct file *file, unsigned cmd, unsigned long arg)
         case OCFS2_IOC_GROUP_EXTEND:
         case OCFS2_IOC_GROUP_ADD:
         case OCFS2_IOC_GROUP_ADD64:
-        case FITRIM:
                 break;
         case OCFS2_IOC_REFLINK:
                 if (copy_from_user(&args, argp, sizeof(args)))
diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
index f140e3dbfb7b..d9da5a4e9382 100644
--- a/fs/overlayfs/inode.c
+++ b/fs/overlayfs/inode.c
@@ -343,6 +343,9 @@ struct inode *ovl_d_select_inode(struct dentry *dentry, unsigned file_flags)
         struct path realpath;
         enum ovl_path_type type;
 
+        if (d_is_dir(dentry))
+                return d_backing_inode(dentry);
+
         type = ovl_path_real(dentry, &realpath);
         if (ovl_open_need_copy_up(file_flags, type, realpath.dentry)) {
                 err = ovl_want_write(dentry);
diff --git a/fs/pnode.h b/fs/pnode.h
index 7114ce6e6b9e..0fcdbe7ca648 100644
--- a/fs/pnode.h
+++ b/fs/pnode.h
@@ -20,8 +20,6 @@
 #define SET_MNT_MARK(m) ((m)->mnt.mnt_flags |= MNT_MARKED)
 #define CLEAR_MNT_MARK(m) ((m)->mnt.mnt_flags &= ~MNT_MARKED)
 #define IS_MNT_LOCKED(m) ((m)->mnt.mnt_flags & MNT_LOCKED)
-#define IS_MNT_LOCKED_AND_LAZY(m) \
-        (((m)->mnt.mnt_flags & (MNT_LOCKED|MNT_SYNC_UMOUNT)) == MNT_LOCKED)
 
 #define CL_EXPIRE               0x01
 #define CL_SLAVE                0x02
diff --git a/fs/proc/Kconfig b/fs/proc/Kconfig
index d751fcb637bb..1ade1206bb89 100644
--- a/fs/proc/Kconfig
+++ b/fs/proc/Kconfig
@@ -75,3 +75,9 @@ config PROC_PAGE_MONITOR
 config PROC_CHILDREN
         bool "Include /proc/<pid>/task/<tid>/children file"
         default n
+        help
+          Provides a fast way to retrieve first level children pids of a task. See
+          <file:Documentation/filesystems/proc.txt> for more information.
+
+          Say Y if you are running any user-space software which takes benefit from
+          this interface. For example, rkt is such a piece of software.
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 87782e874b6a..aa50d1ac28fc 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -243,6 +243,11 @@ static ssize_t proc_pid_cmdline_read(struct file *file, char __user *buf,
         len1 = arg_end - arg_start;
         len2 = env_end - env_start;
 
+        /* Empty ARGV. */
+        if (len1 == 0) {
+                rv = 0;
+                goto out_free_page;
+        }
         /*
          * Inherently racy -- command line shares address space
          * with code and data.
diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c
index 91a4e6426321..92e6726f6e37 100644
--- a/fs/proc/kcore.c
+++ b/fs/proc/kcore.c
@@ -92,7 +92,7 @@ static size_t get_kcore_size(int *nphdr, size_t *elf_buflen)
                              roundup(sizeof(CORE_STR), 4)) +
                         roundup(sizeof(struct elf_prstatus), 4) +
                         roundup(sizeof(struct elf_prpsinfo), 4) +
-                        roundup(sizeof(struct task_struct), 4);
+                        roundup(arch_task_struct_size, 4);
         *elf_buflen = PAGE_ALIGN(*elf_buflen);
         return size + *elf_buflen;
 }
@@ -415,7 +415,7 @@ static void elf_kcore_store_hdr(char *bufp, int nphdr, int dataoff)
         /* set up the task structure */
         notes[2].name   = CORE_STR;
         notes[2].type   = NT_TASKSTRUCT;
-        notes[2].datasz = sizeof(struct task_struct);
+        notes[2].datasz = arch_task_struct_size;
         notes[2].data   = current;
 
         nhdr->p_filesz  += notesize(&notes[2]);
diff --git a/fs/udf/inode.c b/fs/udf/inode.c
index 6afac3d561ac..8d0b3ade0ff0 100644
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -1652,17 +1652,9 @@ static int udf_update_inode(struct inode *inode, int do_sync)
                        iinfo->i_ext.i_data, inode->i_sb->s_blocksize -
                                         sizeof(struct unallocSpaceEntry));
                 use->descTag.tagIdent = cpu_to_le16(TAG_IDENT_USE);
-                use->descTag.tagLocation =
-                                cpu_to_le32(iinfo->i_location.logicalBlockNum);
-                crclen = sizeof(struct unallocSpaceEntry) +
-                                iinfo->i_lenAlloc - sizeof(struct tag);
-                use->descTag.descCRCLength = cpu_to_le16(crclen);
-                use->descTag.descCRC = cpu_to_le16(crc_itu_t(0, (char *)use +
-                                                           sizeof(struct tag),
-                                                           crclen));
-                use->descTag.tagChecksum = udf_tag_checksum(&use->descTag);
+                crclen = sizeof(struct unallocSpaceEntry);
 
-                goto out;
+                goto finish;
         }
 
         if (UDF_QUERY_FLAG(inode->i_sb, UDF_FLAG_UID_FORGET))
@@ -1782,6 +1774,8 @@ static int udf_update_inode(struct inode *inode, int do_sync)
                 efe->descTag.tagIdent = cpu_to_le16(TAG_IDENT_EFE);
                 crclen = sizeof(struct extendedFileEntry);
         }
+
+finish:
         if (iinfo->i_strat4096) {
                 fe->icbTag.strategyType = cpu_to_le16(4096);
                 fe->icbTag.strategyParameter = cpu_to_le16(1);
@@ -1791,7 +1785,9 @@ static int udf_update_inode(struct inode *inode, int do_sync)
                 fe->icbTag.numEntries = cpu_to_le16(1);
         }
 
-        if (S_ISDIR(inode->i_mode))
+        if (iinfo->i_use)
+                fe->icbTag.fileType = ICBTAG_FILE_TYPE_USE;
+        else if (S_ISDIR(inode->i_mode))
                 fe->icbTag.fileType = ICBTAG_FILE_TYPE_DIRECTORY;
         else if (S_ISREG(inode->i_mode))
                 fe->icbTag.fileType = ICBTAG_FILE_TYPE_REGULAR;
@@ -1828,7 +1824,6 @@ static int udf_update_inode(struct inode *inode, int do_sync)
                                                   crclen));
         fe->descTag.tagChecksum = udf_tag_checksum(&fe->descTag);
 
-out:
         set_buffer_uptodate(bh);
         unlock_buffer(bh);
 
diff --git a/include/asm-generic/mm-arch-hooks.h b/include/asm-generic/mm-arch-hooks.h
new file mode 100644
index 000000000000..5ff0e5193f85
--- /dev/null
+++ b/include/asm-generic/mm-arch-hooks.h
@@ -0,0 +1,16 @@
+/*
+ * Architecture specific mm hooks
+ */
+
+#ifndef _ASM_GENERIC_MM_ARCH_HOOKS_H
+#define _ASM_GENERIC_MM_ARCH_HOOKS_H
+
+/*
+ * This file should be included through arch/../include/asm/Kbuild for
+ * the architecture which doesn't need specific mm hooks.
+ *
+ * In that case, the generic hooks defined in include/linux/mm-arch-hooks.h
+ * are used.
+ */
+
+#endif /* _ASM_GENERIC_MM_ARCH_HOOKS_H */
diff --git a/include/linux/acpi.h b/include/linux/acpi.h
index c471dfc93b71..d2445fa9999f 100644
--- a/include/linux/acpi.h
+++ b/include/linux/acpi.h
@@ -58,6 +58,19 @@ static inline acpi_handle acpi_device_handle(struct acpi_device *adev)
         acpi_fwnode_handle(adev) : NULL)
 #define ACPI_HANDLE(dev)                acpi_device_handle(ACPI_COMPANION(dev))
 
+/**
+ * ACPI_DEVICE_CLASS - macro used to describe an ACPI device with
+ * the PCI-defined class-code information
+ *
+ * @_cls : the class, subclass, prog-if triple for this device
+ * @_msk : the class mask for this device
+ *
+ * This macro is used to create a struct acpi_device_id that matches a
+ * specific PCI class. The .id and .driver_data fields will be left
+ * initialized with the default value.
+ */
+#define ACPI_DEVICE_CLASS(_cls, _msk)   .cls = (_cls), .cls_msk = (_msk),
+
 static inline bool has_acpi_companion(struct device *dev)
 {
         return is_acpi_node(dev->fwnode);
@@ -309,9 +322,6 @@ int acpi_check_region(resource_size_t start, resource_size_t n,
 
 int acpi_resources_are_enforced(void);
 
-int acpi_reserve_region(u64 start, unsigned int length, u8 space_id,
-                        unsigned long flags, char *desc);
-
 #ifdef CONFIG_HIBERNATION
 void __init acpi_no_s4_hw_signature(void);
 #endif
@@ -446,6 +456,7 @@ struct platform_device *acpi_create_platform_device(struct acpi_device *);
 #define ACPI_COMPANION(dev)             (NULL)
 #define ACPI_COMPANION_SET(dev, adev)   do { } while (0)
 #define ACPI_HANDLE(dev)                (NULL)
+#define ACPI_DEVICE_CLASS(_cls, _msk)   .cls = (0), .cls_msk = (0),
 
 struct fwnode_handle;
 
@@ -507,13 +518,6 @@ static inline int acpi_check_region(resource_size_t start, resource_size_t n,
         return 0;
 }
 
-static inline int acpi_reserve_region(u64 start, unsigned int length,
-                                      u8 space_id, unsigned long flags,
-                                      char *desc)
-{
-        return -ENXIO;
-}
-
 struct acpi_table_header;
 static inline int acpi_table_parse(char *id,
                                 int (*handler)(struct acpi_table_header *))
diff --git a/include/linux/amba/sp810.h b/include/linux/amba/sp810.h
index c7df89f99115..58fe9e8b6fd7 100644
--- a/include/linux/amba/sp810.h
+++ b/include/linux/amba/sp810.h
@@ -2,7 +2,7 @@
  * ARM PrimeXsys System Controller SP810 header file
  *
  * Copyright (C) 2009 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
  *
  * This file is licensed under the terms of the GNU General Public
  * License version 2. This program is licensed "as is" without any
diff --git a/include/linux/ata.h b/include/linux/ata.h
index fed36418dd1c..6c78956aa470 100644
--- a/include/linux/ata.h
+++ b/include/linux/ata.h
@@ -45,6 +45,7 @@ enum {
         ATA_SECT_SIZE           = 512,
         ATA_MAX_SECTORS_128     = 128,
         ATA_MAX_SECTORS         = 256,
+        ATA_MAX_SECTORS_1024    = 1024,
         ATA_MAX_SECTORS_LBA48   = 65535,/* TODO: 65536? */
         ATA_MAX_SECTORS_TAPE    = 65535,
 
diff --git a/include/linux/blk-cgroup.h b/include/linux/blk-cgroup.h
index 58cfab80dd70..1b62d768c7df 100644
--- a/include/linux/blk-cgroup.h
+++ b/include/linux/blk-cgroup.h
@@ -47,6 +47,7 @@ struct blkcg {
 
         struct blkcg_policy_data        *pd[BLKCG_MAX_POLS];
 
+        struct list_head                all_blkcgs_node;
 #ifdef CONFIG_CGROUP_WRITEBACK
         struct list_head                cgwb_list;
 #endif
@@ -88,18 +89,12 @@ struct blkg_policy_data {
  * Policies that need to keep per-blkcg data which is independent
  * from any request_queue associated to it must specify its size
  * with the cpd_size field of the blkcg_policy structure and
- * embed a blkcg_policy_data in it. blkcg core allocates
- * policy-specific per-blkcg structures lazily the first time
- * they are actually needed, so it handles them together with
- * blkgs. cpd_init() is invoked to let each policy handle
- * per-blkcg data.
+ * embed a blkcg_policy_data in it.  cpd_init() is invoked to let
+ * each policy handle per-blkcg data.
  */
 struct blkcg_policy_data {
         /* the policy id this per-policy data belongs to */
         int                             plid;
-
-        /* used during policy activation */
-        struct list_head                alloc_node;
 };
 
 /* association between a blk cgroup and a request queue */
diff --git a/include/linux/can/skb.h b/include/linux/can/skb.h
index b6a52a4b457a..51bb6532785c 100644
--- a/include/linux/can/skb.h
+++ b/include/linux/can/skb.h
@@ -27,10 +27,12 @@
 /**
  * struct can_skb_priv - private additional data inside CAN sk_buffs
  * @ifindex:    ifindex of the first interface the CAN frame appeared on
+ * @skbcnt:     atomic counter to have an unique id together with skb pointer
  * @cf:         align to the following CAN frame at skb->data
  */
 struct can_skb_priv {
         int ifindex;
+        int skbcnt;
         struct can_frame cf[0];
 };
 
diff --git a/include/linux/ceph/messenger.h b/include/linux/ceph/messenger.h
index e15499422fdc..37753278987a 100644
--- a/include/linux/ceph/messenger.h
+++ b/include/linux/ceph/messenger.h
@@ -8,6 +8,7 @@
 #include <linux/radix-tree.h>
 #include <linux/uio.h>
 #include <linux/workqueue.h>
+#include <net/net_namespace.h>
 
 #include <linux/ceph/types.h>
 #include <linux/ceph/buffer.h>
@@ -56,6 +57,7 @@ struct ceph_messenger {
         struct ceph_entity_addr my_enc_addr;
 
         atomic_t stopping;
+        possible_net_t net;
         bool nocrc;
         bool tcp_nodelay;
 
@@ -267,6 +269,7 @@ extern void ceph_messenger_init(struct ceph_messenger *msgr,
                         u64 required_features,
                         bool nocrc,
                         bool tcp_nodelay);
+extern void ceph_messenger_fini(struct ceph_messenger *msgr);
 
 extern void ceph_con_init(struct ceph_connection *con, void *private,
                         const struct ceph_connection_operations *ops,
diff --git a/include/linux/clkdev.h b/include/linux/clkdev.h
index a240b18e86fa..08bffcc466de 100644
--- a/include/linux/clkdev.h
+++ b/include/linux/clkdev.h
@@ -33,18 +33,19 @@ struct clk_lookup {
         }
 
 struct clk_lookup *clkdev_alloc(struct clk *clk, const char *con_id,
-        const char *dev_fmt, ...);
+        const char *dev_fmt, ...) __printf(3, 4);
 
 void clkdev_add(struct clk_lookup *cl);
 void clkdev_drop(struct clk_lookup *cl);
 
 struct clk_lookup *clkdev_create(struct clk *clk, const char *con_id,
-        const char *dev_fmt, ...);
+        const char *dev_fmt, ...) __printf(3, 4);
 
 void clkdev_add_table(struct clk_lookup *, size_t);
 int clk_add_alias(const char *, const char *, const char *, struct device *);
 
-int clk_register_clkdev(struct clk *, const char *, const char *, ...);
+int clk_register_clkdev(struct clk *, const char *, const char *, ...)
+        __printf(3, 4);
 int clk_register_clkdevs(struct clk *, struct clk_lookup *, size_t);
 
 #ifdef CONFIG_COMMON_CLK
diff --git a/include/linux/compat.h b/include/linux/compat.h
index ab25814690bc..a76c9172b2eb 100644
--- a/include/linux/compat.h
+++ b/include/linux/compat.h
@@ -424,7 +424,7 @@ asmlinkage long compat_sys_settimeofday(struct compat_timeval __user *tv,
 
 asmlinkage long compat_sys_adjtimex(struct compat_timex __user *utp);
 
-extern int compat_printk(const char *fmt, ...);
+extern __printf(1, 2) int compat_printk(const char *fmt, ...);
 extern void sigset_from_compat(sigset_t *set, const compat_sigset_t *compat);
 extern void sigset_to_compat(compat_sigset_t *compat, const sigset_t *set);
 
diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index 7f8ad9593da7..e08a6ae7c0a4 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -17,11 +17,11 @@
 # define __release(x)   __context__(x,-1)
 # define __cond_lock(x,c)       ((c) ? ({ __acquire(x); 1; }) : 0)
 # define __percpu       __attribute__((noderef, address_space(3)))
+# define __pmem         __attribute__((noderef, address_space(5)))
 #ifdef CONFIG_SPARSE_RCU_POINTER
 # define __rcu          __attribute__((noderef, address_space(4)))
 #else
 # define __rcu
-# define __pmem         __attribute__((noderef, address_space(5)))
 #endif
 extern void __chk_user_ptr(const volatile void __user *);
 extern void __chk_io_ptr(const volatile void __iomem *);
diff --git a/include/linux/configfs.h b/include/linux/configfs.h
index c9e5c57e4edf..63a36e89d0eb 100644
--- a/include/linux/configfs.h
+++ b/include/linux/configfs.h
@@ -64,7 +64,8 @@ struct config_item {
         struct dentry           *ci_dentry;
 };
 
-extern int config_item_set_name(struct config_item *, const char *, ...);
+extern __printf(2, 3)
+int config_item_set_name(struct config_item *, const char *, ...);
 
 static inline char *config_item_name(struct config_item * item)
 {
diff --git a/include/linux/cper.h b/include/linux/cper.h
index 76abba4b238e..dcacb1a72e26 100644
--- a/include/linux/cper.h
+++ b/include/linux/cper.h
@@ -340,7 +340,27 @@ struct cper_ia_proc_ctx {
         __u64   mm_reg_addr;
 };
 
-/* Memory Error Section */
+/* Old Memory Error Section UEFI 2.1, 2.2 */
+struct cper_sec_mem_err_old {
+        __u64   validation_bits;
+        __u64   error_status;
+        __u64   physical_addr;
+        __u64   physical_addr_mask;
+        __u16   node;
+        __u16   card;
+        __u16   module;
+        __u16   bank;
+        __u16   device;
+        __u16   row;
+        __u16   column;
+        __u16   bit_pos;
+        __u64   requestor_id;
+        __u64   responder_id;
+        __u64   target_id;
+        __u8    error_type;
+};
+
+/* Memory Error Section UEFI >= 2.3 */
 struct cper_sec_mem_err {
         __u64   validation_bits;
         __u64   error_status;
diff --git a/include/linux/cpu.h b/include/linux/cpu.h
index c0fb6b1b4712..23c30bdcca86 100644
--- a/include/linux/cpu.h
+++ b/include/linux/cpu.h
@@ -40,9 +40,10 @@ extern void cpu_remove_dev_attr(struct device_attribute *attr);
 extern int cpu_add_dev_attr_group(struct attribute_group *attrs);
 extern void cpu_remove_dev_attr_group(struct attribute_group *attrs);
 
-extern struct device *cpu_device_create(struct device *parent, void *drvdata,
-                                        const struct attribute_group **groups,
-                                        const char *fmt, ...);
+extern __printf(4, 5)
+struct device *cpu_device_create(struct device *parent, void *drvdata,
+                                 const struct attribute_group **groups,
+                                 const char *fmt, ...);
 #ifdef CONFIG_HOTPLUG_CPU
 extern void unregister_cpu(struct cpu *cpu);
 extern ssize_t arch_cpu_probe(const char *, size_t);
diff --git a/include/linux/dcache.h b/include/linux/dcache.h
index d2d50249b7b2..d67ae119cf4e 100644
--- a/include/linux/dcache.h
+++ b/include/linux/dcache.h
@@ -327,7 +327,8 @@ static inline unsigned d_count(const struct dentry *dentry)
 /*
  * helper function for dentry_operations.d_dname() members
  */
-extern char *dynamic_dname(struct dentry *, char *, int, const char *, ...);
+extern __printf(4, 5)
+char *dynamic_dname(struct dentry *, char *, int, const char *, ...);
 extern char *simple_dname(struct dentry *, char *, int);
 
 extern char *__d_path(const struct path *, const struct path *, char *, int);
diff --git a/include/linux/device.h b/include/linux/device.h
index 22227e7fe463..3d3139ad5705 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -637,8 +637,9 @@ extern int devres_release_group(struct device *dev, void *id);
 
 /* managed devm_k.alloc/kfree for device drivers */
 extern void *devm_kmalloc(struct device *dev, size_t size, gfp_t gfp);
-extern char *devm_kvasprintf(struct device *dev, gfp_t gfp, const char *fmt,
-                             va_list ap);
+extern __printf(3, 0)
+char *devm_kvasprintf(struct device *dev, gfp_t gfp, const char *fmt,
+                      va_list ap);
 extern __printf(3, 4)
 char *devm_kasprintf(struct device *dev, gfp_t gfp, const char *fmt, ...);
 static inline void *devm_kzalloc(struct device *dev, size_t size, gfp_t gfp)
@@ -1015,12 +1016,10 @@ extern int __must_check device_reprobe(struct device *dev);
 /*
  * Easy functions for dynamically creating devices on the fly
  */
-extern struct device *device_create_vargs(struct class *cls,
-                                          struct device *parent,
-                                          dev_t devt,
-                                          void *drvdata,
-                                          const char *fmt,
-                                          va_list vargs);
+extern __printf(5, 0)
+struct device *device_create_vargs(struct class *cls, struct device *parent,
+                                   dev_t devt, void *drvdata,
+                                   const char *fmt, va_list vargs);
 extern __printf(5, 6)
 struct device *device_create(struct class *cls, struct device *parent,
                              dev_t devt, void *drvdata,
diff --git a/include/linux/fs.h b/include/linux/fs.h
index a0653e560c26..cc008c338f5a 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -1046,12 +1046,12 @@ extern void locks_remove_file(struct file *);
 extern void locks_release_private(struct file_lock *);
 extern void posix_test_lock(struct file *, struct file_lock *);
 extern int posix_lock_file(struct file *, struct file_lock *, struct file_lock *);
-extern int posix_lock_file_wait(struct file *, struct file_lock *);
+extern int posix_lock_inode_wait(struct inode *, struct file_lock *);
 extern int posix_unblock_lock(struct file_lock *);
 extern int vfs_test_lock(struct file *, struct file_lock *);
 extern int vfs_lock_file(struct file *, unsigned int, struct file_lock *, struct file_lock *);
 extern int vfs_cancel_lock(struct file *filp, struct file_lock *fl);
-extern int flock_lock_file_wait(struct file *filp, struct file_lock *fl);
+extern int flock_lock_inode_wait(struct inode *inode, struct file_lock *fl);
 extern int __break_lease(struct inode *inode, unsigned int flags, unsigned int type);
 extern void lease_get_mtime(struct inode *, struct timespec *time);
 extern int generic_setlease(struct file *, long, struct file_lock **, void **priv);
@@ -1137,7 +1137,8 @@ static inline int posix_lock_file(struct file *filp, struct file_lock *fl,
         return -ENOLCK;
 }
 
-static inline int posix_lock_file_wait(struct file *filp, struct file_lock *fl)
+static inline int posix_lock_inode_wait(struct inode *inode,
+                                        struct file_lock *fl)
 {
         return -ENOLCK;
 }
@@ -1163,8 +1164,8 @@ static inline int vfs_cancel_lock(struct file *filp, struct file_lock *fl)
         return 0;
 }
 
-static inline int flock_lock_file_wait(struct file *filp,
-                                       struct file_lock *request)
+static inline int flock_lock_inode_wait(struct inode *inode,
+                                        struct file_lock *request)
 {
         return -ENOLCK;
 }
@@ -1202,6 +1203,20 @@ static inline void show_fd_locks(struct seq_file *f,
                         struct file *filp, struct files_struct *files) {}
 #endif /* !CONFIG_FILE_LOCKING */
 
+static inline struct inode *file_inode(const struct file *f)
+{
+        return f->f_inode;
+}
+
+static inline int posix_lock_file_wait(struct file *filp, struct file_lock *fl)
+{
+        return posix_lock_inode_wait(file_inode(filp), fl);
+}
+
+static inline int flock_lock_file_wait(struct file *filp, struct file_lock *fl)
+{
+        return flock_lock_inode_wait(file_inode(filp), fl);
+}
 
 struct fasync_struct {
         spinlock_t              fa_lock;
@@ -2011,11 +2026,6 @@ extern void ihold(struct inode * inode);
 extern void iput(struct inode *);
 extern int generic_update_time(struct inode *, struct timespec *, int);
 
-static inline struct inode *file_inode(const struct file *f)
-{
-        return f->f_inode;
-}
-
 /* /sys/fs */
 extern struct kobject *fs_kobj;
 
diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h
index 1da602982cf9..6cd8c0ee4b6f 100644
--- a/include/linux/ftrace.h
+++ b/include/linux/ftrace.h
@@ -116,6 +116,7 @@ ftrace_func_t ftrace_ops_get_func(struct ftrace_ops *ops);
  *            SAVE_REGS. If another ops with this flag set is already registered
  *            for any of the functions that this ops will be registered for, then
  *            this ops will fail to register or set_filter_ip.
+ * PID     - Is affected by set_ftrace_pid (allows filtering on those pids)
  */
 enum {
         FTRACE_OPS_FL_ENABLED                   = 1 << 0,
@@ -132,6 +133,7 @@ enum {
         FTRACE_OPS_FL_MODIFYING                 = 1 << 11,
         FTRACE_OPS_FL_ALLOC_TRAMP               = 1 << 12,
         FTRACE_OPS_FL_IPMODIFY                  = 1 << 13,
+        FTRACE_OPS_FL_PID                       = 1 << 14,
 };
 
 #ifdef CONFIG_DYNAMIC_FTRACE
@@ -159,6 +161,7 @@ struct ftrace_ops {
         struct ftrace_ops               *next;
         unsigned long                   flags;
         void                            *private;
+        ftrace_func_t                   saved_func;
         int __percpu                    *disabled;
 #ifdef CONFIG_DYNAMIC_FTRACE
         int                             nr_trampolines;
diff --git a/include/linux/gpio/driver.h b/include/linux/gpio/driver.h
index cc7ec129b329..c8393cd4d44f 100644
--- a/include/linux/gpio/driver.h
+++ b/include/linux/gpio/driver.h
@@ -45,7 +45,7 @@ struct seq_file;
  * @base: identifies the first GPIO number handled by this chip;
  *      or, if negative during registration, requests dynamic ID allocation.
  *      DEPRECATION: providing anything non-negative and nailing the base
- *      base offset of GPIO chips is deprecated. Please pass -1 as base to
+ *      offset of GPIO chips is deprecated. Please pass -1 as base to
  *      let gpiolib select the chip base in all possible cases. We want to
  *      get rid of the static GPIO number space in the long run.
  * @ngpio: the number of GPIOs handled by this controller; the last GPIO
diff --git a/include/linux/hid-sensor-hub.h b/include/linux/hid-sensor-hub.h
index 0042bf330b99..c02b5ce6c5cd 100644
--- a/include/linux/hid-sensor-hub.h
+++ b/include/linux/hid-sensor-hub.h
@@ -230,6 +230,7 @@ struct hid_sensor_common {
         struct platform_device *pdev;
         unsigned usage_id;
         atomic_t data_ready;
+        atomic_t user_requested_state;
         struct iio_trigger *trigger;
         struct hid_sensor_hub_attribute_info poll;
         struct hid_sensor_hub_attribute_info report_state;
diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
index 205026175c42..d891f949466a 100644
--- a/include/linux/hugetlb.h
+++ b/include/linux/hugetlb.h
@@ -460,15 +460,14 @@ static inline spinlock_t *huge_pte_lockptr(struct hstate *h,
         return &mm->page_table_lock;
 }
 
-static inline bool hugepages_supported(void)
-{
-        /*
-         * Some platform decide whether they support huge pages at boot
-         * time. On these, such as powerpc, HPAGE_SHIFT is set to 0 when
-         * there is no such support
-         */
-        return HPAGE_SHIFT != 0;
-}
+#ifndef hugepages_supported
+/*
+ * Some platform decide whether they support huge pages at boot
+ * time. Some of them, such as powerpc, set HPAGE_SHIFT to 0
+ * when there is no such support
+ */
+#define hugepages_supported() (HPAGE_SHIFT != 0)
+#endif
 
 #else   /* CONFIG_HUGETLB_PAGE */
 struct hstate {};
diff --git a/include/linux/init.h b/include/linux/init.h
index 7c68c36d3fd8..b449f378f995 100644
--- a/include/linux/init.h
+++ b/include/linux/init.h
@@ -282,68 +282,8 @@ void __init parse_early_param(void);
 void __init parse_early_options(char *cmdline);
 #endif /* __ASSEMBLY__ */
 
-/**
- * module_init() - driver initialization entry point
- * @x: function to be run at kernel boot time or module insertion
- * 
- * module_init() will either be called during do_initcalls() (if
- * builtin) or at module insertion time (if a module).  There can only
- * be one per module.
- */
-#define module_init(x)  __initcall(x);
-
-/**
- * module_exit() - driver exit entry point
- * @x: function to be run when driver is removed
- * 
- * module_exit() will wrap the driver clean-up code
- * with cleanup_module() when used with rmmod when
- * the driver is a module.  If the driver is statically
- * compiled into the kernel, module_exit() has no effect.
- * There can only be one per module.
- */
-#define module_exit(x)  __exitcall(x);
-
 #else /* MODULE */
 
-/*
- * In most cases loadable modules do not need custom
- * initcall levels. There are still some valid cases where
- * a driver may be needed early if built in, and does not
- * matter when built as a loadable module. Like bus
- * snooping debug drivers.
- */
-#define early_initcall(fn)              module_init(fn)
-#define core_initcall(fn)               module_init(fn)
-#define core_initcall_sync(fn)          module_init(fn)
-#define postcore_initcall(fn)           module_init(fn)
-#define postcore_initcall_sync(fn)      module_init(fn)
-#define arch_initcall(fn)               module_init(fn)
-#define subsys_initcall(fn)             module_init(fn)
-#define subsys_initcall_sync(fn)        module_init(fn)
-#define fs_initcall(fn)                 module_init(fn)
-#define fs_initcall_sync(fn)            module_init(fn)
-#define rootfs_initcall(fn)             module_init(fn)
-#define device_initcall(fn)             module_init(fn)
-#define device_initcall_sync(fn)        module_init(fn)
-#define late_initcall(fn)               module_init(fn)
-#define late_initcall_sync(fn)          module_init(fn)
-
-#define console_initcall(fn)            module_init(fn)
-#define security_initcall(fn)           module_init(fn)
-
-/* Each module must use one module_init(). */
-#define module_init(initfn)                                     \
-        static inline initcall_t __inittest(void)               \
-        { return initfn; }                                      \
-        int init_module(void) __attribute__((alias(#initfn)));
-
-/* This is only required if you want to be unloadable. */
-#define module_exit(exitfn)                                     \
-        static inline exitcall_t __exittest(void)               \
-        { return exitfn; }                                      \
-        void cleanup_module(void) __attribute__((alias(#exitfn)));
-
 #define __setup_param(str, unique_id, fn)       /* nothing */
 #define __setup(str, func)                      /* nothing */
 #endif
@@ -351,24 +291,6 @@ void __init parse_early_options(char *cmdline);
 /* Data marked not to be saved by software suspend */
 #define __nosavedata __section(.data..nosave)
 
-/* This means "can be init if no module support, otherwise module load
-   may call it." */
-#ifdef CONFIG_MODULES
-#define __init_or_module
-#define __initdata_or_module
-#define __initconst_or_module
-#define __INIT_OR_MODULE        .text
-#define __INITDATA_OR_MODULE    .data
-#define __INITRODATA_OR_MODULE  .section ".rodata","a",%progbits
-#else
-#define __init_or_module __init
-#define __initdata_or_module __initdata
-#define __initconst_or_module __initconst
-#define __INIT_OR_MODULE __INIT
-#define __INITDATA_OR_MODULE __INITDATA
-#define __INITRODATA_OR_MODULE __INITRODATA
-#endif /*CONFIG_MODULES*/
-
 #ifdef MODULE
 #define __exit_p(x) x
 #else
diff --git a/include/linux/iommu.h b/include/linux/iommu.h
index dc767f7c3704..f9c1b6d0f2e4 100644
--- a/include/linux/iommu.h
+++ b/include/linux/iommu.h
@@ -258,7 +258,7 @@ extern int iommu_domain_set_attr(struct iommu_domain *domain, enum iommu_attr,
                                  void *data);
 struct device *iommu_device_create(struct device *parent, void *drvdata,
                                    const struct attribute_group **groups,
-                                   const char *fmt, ...);
+                                   const char *fmt, ...) __printf(4, 5);
 void iommu_device_destroy(struct device *dev);
 int iommu_device_link(struct device *dev, struct device *link);
 void iommu_device_unlink(struct device *dev, struct device *link);
diff --git a/include/linux/irqdesc.h b/include/linux/irqdesc.h
index 624a668e61f1..fcea4e48e21f 100644
--- a/include/linux/irqdesc.h
+++ b/include/linux/irqdesc.h
@@ -87,7 +87,12 @@ struct irq_desc {
         const char              *name;
 } ____cacheline_internodealigned_in_smp;
 
-#ifndef CONFIG_SPARSE_IRQ
+#ifdef CONFIG_SPARSE_IRQ
+extern void irq_lock_sparse(void);
+extern void irq_unlock_sparse(void);
+#else
+static inline void irq_lock_sparse(void) { }
+static inline void irq_unlock_sparse(void) { }
 extern struct irq_desc irq_desc[NR_IRQS];
 #endif
 
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index 5f0be58640ea..5582410727cb 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -411,7 +411,8 @@ extern __printf(3, 0)
 int vscnprintf(char *buf, size_t size, const char *fmt, va_list args);
 extern __printf(2, 3)
 char *kasprintf(gfp_t gfp, const char *fmt, ...);
-extern char *kvasprintf(gfp_t gfp, const char *fmt, va_list args);
+extern __printf(2, 0)
+char *kvasprintf(gfp_t gfp, const char *fmt, va_list args);
 
 extern __scanf(2, 3)
 int sscanf(const char *, const char *, ...);
@@ -679,10 +680,10 @@ do {									\
                 __ftrace_vprintk(_THIS_IP_, fmt, vargs);                \
 } while (0)
 
-extern int
+extern __printf(2, 0) int
 __ftrace_vbprintk(unsigned long ip, const char *fmt, va_list ap);
 
-extern int
+extern __printf(2, 0) int
 __ftrace_vprintk(unsigned long ip, const char *fmt, va_list ap);
 
 extern void ftrace_dump(enum ftrace_dump_mode oops_dump_mode);
@@ -702,7 +703,7 @@ int trace_printk(const char *fmt, ...)
 {
         return 0;
 }
-static inline int
+static __printf(1, 0) inline int
 ftrace_vprintk(const char *fmt, va_list ap)
 {
         return 0;
diff --git a/include/linux/kobject.h b/include/linux/kobject.h
index 2d61b909f414..637f67002c5a 100644
--- a/include/linux/kobject.h
+++ b/include/linux/kobject.h
@@ -80,8 +80,9 @@ struct kobject {
 
 extern __printf(2, 3)
 int kobject_set_name(struct kobject *kobj, const char *name, ...);
-extern int kobject_set_name_vargs(struct kobject *kobj, const char *fmt,
-                                  va_list vargs);
+extern __printf(2, 0)
+int kobject_set_name_vargs(struct kobject *kobj, const char *fmt,
+                           va_list vargs);
 
 static inline const char *kobject_name(const struct kobject *kobj)
 {
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index 9564fd78c547..05e99b8ef465 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -734,6 +734,24 @@ static inline bool kvm_arch_has_noncoherent_dma(struct kvm *kvm)
         return false;
 }
 #endif
+#ifdef __KVM_HAVE_ARCH_ASSIGNED_DEVICE
+void kvm_arch_start_assignment(struct kvm *kvm);
+void kvm_arch_end_assignment(struct kvm *kvm);
+bool kvm_arch_has_assigned_device(struct kvm *kvm);
+#else
+static inline void kvm_arch_start_assignment(struct kvm *kvm)
+{
+}
+
+static inline void kvm_arch_end_assignment(struct kvm *kvm)
+{
+}
+
+static inline bool kvm_arch_has_assigned_device(struct kvm *kvm)
+{
+        return false;
+}
+#endif
 
 static inline wait_queue_head_t *kvm_arch_vcpu_wq(struct kvm_vcpu *vcpu)
 {
diff --git a/include/linux/libata.h b/include/linux/libata.h
index 36ce37bcc963..c9cfbcdb8d14 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -431,6 +431,8 @@ enum {
         ATA_HORKAGE_WD_BROKEN_LPM = (1 << 21),  /* some WDs have broken LPM */
         ATA_HORKAGE_ZERO_AFTER_TRIM = (1 << 22),/* guarantees zero after trim */
         ATA_HORKAGE_NO_NCQ_LOG  = (1 << 23),    /* don't use NCQ for log read */
+        ATA_HORKAGE_NOTRIM      = (1 << 24),    /* don't use TRIM */
+        ATA_HORKAGE_MAX_SEC_1024 = (1 << 25),   /* Limit max sects to 1024 */
 
          /* DMA mask for user DMA control: User visible values; DO NOT
             renumber */
diff --git a/include/linux/mmiotrace.h b/include/linux/mmiotrace.h
index c5d52780d6a0..3ba327af055c 100644
--- a/include/linux/mmiotrace.h
+++ b/include/linux/mmiotrace.h
@@ -106,6 +106,6 @@ extern void enable_mmiotrace(void);
 extern void disable_mmiotrace(void);
 extern void mmio_trace_rw(struct mmiotrace_rw *rw);
 extern void mmio_trace_mapping(struct mmiotrace_map *map);
-extern int mmio_trace_printk(const char *fmt, va_list args);
+extern __printf(1, 0) int mmio_trace_printk(const char *fmt, va_list args);
 
 #endif /* _LINUX_MMIOTRACE_H */
diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h
index 8183d6640ca7..34f25b7bf642 100644
--- a/include/linux/mod_devicetable.h
+++ b/include/linux/mod_devicetable.h
@@ -189,6 +189,8 @@ struct css_device_id {
 struct acpi_device_id {
         __u8 id[ACPI_ID_LEN];
         kernel_ulong_t driver_data;
+        __u32 cls;
+        __u32 cls_msk;
 };
 
 #define PNP_ID_LEN      8
diff --git a/include/linux/module.h b/include/linux/module.h
index d67b1932cc59..3a19c79918e0 100644
--- a/include/linux/module.h
+++ b/include/linux/module.h
@@ -11,6 +11,7 @@
 #include <linux/compiler.h>
 #include <linux/cache.h>
 #include <linux/kmod.h>
+#include <linux/init.h>
 #include <linux/elf.h>
 #include <linux/stringify.h>
 #include <linux/kobject.h>
@@ -71,6 +72,89 @@ extern struct module_attribute module_uevent;
 extern int init_module(void);
 extern void cleanup_module(void);
 
+#ifndef MODULE
+/**
+ * module_init() - driver initialization entry point
+ * @x: function to be run at kernel boot time or module insertion
+ *
+ * module_init() will either be called during do_initcalls() (if
+ * builtin) or at module insertion time (if a module).  There can only
+ * be one per module.
+ */
+#define module_init(x)  __initcall(x);
+
+/**
+ * module_exit() - driver exit entry point
+ * @x: function to be run when driver is removed
+ *
+ * module_exit() will wrap the driver clean-up code
+ * with cleanup_module() when used with rmmod when
+ * the driver is a module.  If the driver is statically
+ * compiled into the kernel, module_exit() has no effect.
+ * There can only be one per module.
+ */
+#define module_exit(x)  __exitcall(x);
+
+#else /* MODULE */
+
+/*
+ * In most cases loadable modules do not need custom
+ * initcall levels. There are still some valid cases where
+ * a driver may be needed early if built in, and does not
+ * matter when built as a loadable module. Like bus
+ * snooping debug drivers.
+ */
+#define early_initcall(fn)              module_init(fn)
+#define core_initcall(fn)               module_init(fn)
+#define core_initcall_sync(fn)          module_init(fn)
+#define postcore_initcall(fn)           module_init(fn)
+#define postcore_initcall_sync(fn)      module_init(fn)
+#define arch_initcall(fn)               module_init(fn)
+#define subsys_initcall(fn)             module_init(fn)
+#define subsys_initcall_sync(fn)        module_init(fn)
+#define fs_initcall(fn)                 module_init(fn)
+#define fs_initcall_sync(fn)            module_init(fn)
+#define rootfs_initcall(fn)             module_init(fn)
+#define device_initcall(fn)             module_init(fn)
+#define device_initcall_sync(fn)        module_init(fn)
+#define late_initcall(fn)               module_init(fn)
+#define late_initcall_sync(fn)          module_init(fn)
+
+#define console_initcall(fn)            module_init(fn)
+#define security_initcall(fn)           module_init(fn)
+
+/* Each module must use one module_init(). */
+#define module_init(initfn)                                     \
+        static inline initcall_t __inittest(void)               \
+        { return initfn; }                                      \
+        int init_module(void) __attribute__((alias(#initfn)));
+
+/* This is only required if you want to be unloadable. */
+#define module_exit(exitfn)                                     \
+        static inline exitcall_t __exittest(void)               \
+        { return exitfn; }                                      \
+        void cleanup_module(void) __attribute__((alias(#exitfn)));
+
+#endif
+
+/* This means "can be init if no module support, otherwise module load
+   may call it." */
+#ifdef CONFIG_MODULES
+#define __init_or_module
+#define __initdata_or_module
+#define __initconst_or_module
+#define __INIT_OR_MODULE        .text
+#define __INITDATA_OR_MODULE    .data
+#define __INITRODATA_OR_MODULE  .section ".rodata","a",%progbits
+#else
+#define __init_or_module __init
+#define __initdata_or_module __initdata
+#define __initconst_or_module __initconst
+#define __INIT_OR_MODULE __INIT
+#define __INITDATA_OR_MODULE __INITDATA
+#define __INITRODATA_OR_MODULE __INITRODATA
+#endif /*CONFIG_MODULES*/
+
 /* Archs provide a method of finding the correct exception table. */
 struct exception_table_entry;
 
diff --git a/include/linux/mtd/nand.h b/include/linux/mtd/nand.h
index f25e2bdd188c..272f42952f34 100644
--- a/include/linux/mtd/nand.h
+++ b/include/linux/mtd/nand.h
@@ -178,17 +178,17 @@ typedef enum {
 /* Chip may not exist, so silence any errors in scan */
 #define NAND_SCAN_SILENT_NODEV  0x00040000
 /*
- * This option could be defined by controller drivers to protect against
- * kmap'ed, vmalloc'ed highmem buffers being passed from upper layers
- */
-#define NAND_USE_BOUNCE_BUFFER  0x00080000
-/*
  * Autodetect nand buswidth with readid/onfi.
  * This suppose the driver will configure the hardware in 8 bits mode
  * when calling nand_scan_ident, and update its configuration
  * before calling nand_scan_tail.
  */
 #define NAND_BUSWIDTH_AUTO      0x00080000
+/*
+ * This option could be defined by controller drivers to protect against
+ * kmap'ed, vmalloc'ed highmem buffers being passed from upper layers
+ */
+#define NAND_USE_BOUNCE_BUFFER  0x00100000
 
 /* Options set by nand scan */
 /* Nand scan has allocated controller struct */
diff --git a/include/linux/page_owner.h b/include/linux/page_owner.h
index b48c3471c254..cacaabea8a09 100644
--- a/include/linux/page_owner.h
+++ b/include/linux/page_owner.h
@@ -8,6 +8,7 @@ extern struct page_ext_operations page_owner_ops;
 extern void __reset_page_owner(struct page *page, unsigned int order);
 extern void __set_page_owner(struct page *page,
                         unsigned int order, gfp_t gfp_mask);
+extern gfp_t __get_page_owner_gfp(struct page *page);
 
 static inline void reset_page_owner(struct page *page, unsigned int order)
 {
@@ -25,6 +26,14 @@ static inline void set_page_owner(struct page *page,
 
         __set_page_owner(page, order, gfp_mask);
 }
+
+static inline gfp_t get_page_owner_gfp(struct page *page)
+{
+        if (likely(!page_owner_inited))
+                return 0;
+
+        return __get_page_owner_gfp(page);
+}
 #else
 static inline void reset_page_owner(struct page *page, unsigned int order)
 {
@@ -33,6 +42,10 @@ static inline void set_page_owner(struct page *page,
                         unsigned int order, gfp_t gfp_mask)
 {
 }
+static inline gfp_t get_page_owner_gfp(struct page *page)
+{
+        return 0;
+}
 
 #endif /* CONFIG_PAGE_OWNER */
 #endif /* __LINUX_PAGE_OWNER_H */
diff --git a/include/linux/pata_arasan_cf_data.h b/include/linux/pata_arasan_cf_data.h
index 3cc21c9cc1e8..9fade5dd2e86 100644
--- a/include/linux/pata_arasan_cf_data.h
+++ b/include/linux/pata_arasan_cf_data.h
@@ -4,7 +4,7 @@
  * Arasan Compact Flash host controller platform data header file
  *
  * Copyright (C) 2011 ST Microelectronics
- * Viresh Kumar <viresh.linux@gmail.com>
+ * Viresh Kumar <vireshk@kernel.org>
  *
  * This file is licensed under the terms of the GNU General Public
  * License version 2. This program is licensed "as is" without any
diff --git a/include/linux/platform_data/mmc-esdhc-imx.h b/include/linux/platform_data/mmc-esdhc-imx.h
index 75f70f6ac137..e1571efa3f2b 100644
--- a/include/linux/platform_data/mmc-esdhc-imx.h
+++ b/include/linux/platform_data/mmc-esdhc-imx.h
@@ -43,7 +43,6 @@ struct esdhc_platform_data {
         enum wp_types wp_type;
         enum cd_types cd_type;
         int max_bus_width;
-        unsigned int f_max;
         bool support_vsel;
         unsigned int delay_line;
 };
diff --git a/include/linux/printk.h b/include/linux/printk.h
index 58b1fec40d37..a6298b27ac99 100644
--- a/include/linux/printk.h
+++ b/include/linux/printk.h
@@ -122,7 +122,7 @@ static inline __printf(1, 2) __cold
 void early_printk(const char *s, ...) { }
 #endif
 
-typedef int(*printk_func_t)(const char *fmt, va_list args);
+typedef __printf(1, 0) int (*printk_func_t)(const char *fmt, va_list args);
 
 #ifdef CONFIG_PRINTK
 asmlinkage __printf(5, 0)
@@ -166,7 +166,7 @@ char *log_buf_addr_get(void);
 u32 log_buf_len_get(void);
 void log_buf_kexec_setup(void);
 void __init setup_log_buf(int early);
-void dump_stack_set_arch_desc(const char *fmt, ...);
+__printf(1, 2) void dump_stack_set_arch_desc(const char *fmt, ...);
 void dump_stack_print_info(const char *log_lvl);
 void show_regs_print_info(const char *log_lvl);
 #else
@@ -217,7 +217,7 @@ static inline void setup_log_buf(int early)
 {
 }
 
-static inline void dump_stack_set_arch_desc(const char *fmt, ...)
+static inline __printf(1, 2) void dump_stack_set_arch_desc(const char *fmt, ...)
 {
 }
 
diff --git a/include/linux/rtc/sirfsoc_rtciobrg.h b/include/linux/rtc/sirfsoc_rtciobrg.h
index 2c92e1c8e055..aefd997262e4 100644
--- a/include/linux/rtc/sirfsoc_rtciobrg.h
+++ b/include/linux/rtc/sirfsoc_rtciobrg.h
@@ -9,10 +9,14 @@
 #ifndef _SIRFSOC_RTC_IOBRG_H_
 #define _SIRFSOC_RTC_IOBRG_H_
 
+struct regmap_config;
+
 extern void sirfsoc_rtc_iobrg_besyncing(void);
 
 extern u32 sirfsoc_rtc_iobrg_readl(u32 addr);
 
 extern void sirfsoc_rtc_iobrg_writel(u32 val, u32 addr);
+struct regmap *devm_regmap_init_iobg(struct device *dev,
+                                    const struct regmap_config *config);
 
 #endif
diff --git a/include/linux/sched.h b/include/linux/sched.h
index ae21f1591615..04b5ada460b4 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1522,8 +1522,6 @@ struct task_struct {
 /* hung task detection */
         unsigned long last_switch_count;
 #endif
-/* CPU-specific state of this task */
-        struct thread_struct thread;
 /* filesystem information */
         struct fs_struct *fs;
 /* open file information */
@@ -1778,8 +1776,22 @@ struct task_struct {
         unsigned long   task_state_change;
 #endif
         int pagefault_disabled;
+/* CPU-specific state of this task */
+        struct thread_struct thread;
+/*
+ * WARNING: on x86, 'thread_struct' contains a variable-sized
+ * structure.  It *MUST* be at the end of 'task_struct'.
+ *
+ * Do not put anything below here!
+ */
 };
 
+#ifdef CONFIG_ARCH_WANTS_DYNAMIC_TASK_STRUCT
+extern int arch_task_struct_size __read_mostly;
+#else
+# define arch_task_struct_size (sizeof(struct task_struct))
+#endif
+
 /* Future-safe accessor for struct task_struct's cpus_allowed. */
 #define tsk_cpus_allowed(tsk) (&(tsk)->cpus_allowed)
 
diff --git a/include/linux/tick.h b/include/linux/tick.h
index 3741ba1a652c..edbfc9a5293e 100644
--- a/include/linux/tick.h
+++ b/include/linux/tick.h
@@ -67,10 +67,13 @@ extern void tick_broadcast_control(enum tick_broadcast_mode mode);
 static inline void tick_broadcast_control(enum tick_broadcast_mode mode) { }
 #endif /* BROADCAST */
 
-#if defined(CONFIG_GENERIC_CLOCKEVENTS_BROADCAST) && defined(CONFIG_TICK_ONESHOT)
+#ifdef CONFIG_GENERIC_CLOCKEVENTS
 extern int tick_broadcast_oneshot_control(enum tick_broadcast_state state);
 #else
-static inline int tick_broadcast_oneshot_control(enum tick_broadcast_state state) { return 0; }
+static inline int tick_broadcast_oneshot_control(enum tick_broadcast_state state)
+{
+        return 0;
+}
 #endif
 
 static inline void tick_broadcast_enable(void)
diff --git a/include/linux/timekeeping.h b/include/linux/timekeeping.h
index 3aa72e648650..6e191e4e6ab6 100644
--- a/include/linux/timekeeping.h
+++ b/include/linux/timekeeping.h
@@ -145,7 +145,6 @@ static inline void getboottime(struct timespec *ts)
 }
 #endif
 
-#define do_posix_clock_monotonic_gettime(ts) ktime_get_ts(ts)
 #define ktime_get_real_ts64(ts) getnstimeofday64(ts)
 
 /*
diff --git a/include/linux/usb/cdc_ncm.h b/include/linux/usb/cdc_ncm.h
index 7c9b484735c5..1f6526c76ee8 100644
--- a/include/linux/usb/cdc_ncm.h
+++ b/include/linux/usb/cdc_ncm.h
@@ -80,6 +80,9 @@
 #define CDC_NCM_TIMER_INTERVAL_MIN              5UL
 #define CDC_NCM_TIMER_INTERVAL_MAX              (U32_MAX / NSEC_PER_USEC)
 
+/* Driver flags */
+#define CDC_NCM_FLAG_NDP_TO_END 0x02            /* NDP is placed at end of frame */
+
 #define cdc_ncm_comm_intf_is_mbim(x)  ((x)->desc.bInterfaceSubClass == USB_CDC_SUBCLASS_MBIM && \
                                        (x)->desc.bInterfaceProtocol == USB_CDC_PROTO_NONE)
 #define cdc_ncm_data_intf_is_mbim(x)  ((x)->desc.bInterfaceProtocol == USB_CDC_MBIM_PROTO_NTB)
@@ -103,9 +106,11 @@ struct cdc_ncm_ctx {
 
         spinlock_t mtx;
         atomic_t stop;
+        int drvflags;
 
         u32 timer_interval;
         u32 max_ndp_size;
+        struct usb_cdc_ncm_ndp16 *delayed_ndp16;
 
         u32 tx_timer_pending;
         u32 tx_curr_frame_num;
@@ -133,7 +138,7 @@ struct cdc_ncm_ctx {
 };
 
 u8 cdc_ncm_select_altsetting(struct usb_interface *intf);
-int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_altsetting);
+int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_altsetting, int drvflags);
 void cdc_ncm_unbind(struct usbnet *dev, struct usb_interface *intf);
 struct sk_buff *cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign);
 int cdc_ncm_rx_verify_nth16(struct cdc_ncm_ctx *ctx, struct sk_buff *skb_in);
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index a741678f24a2..883fe1e7c5a1 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -4868,6 +4868,23 @@ bool cfg80211_reg_can_beacon(struct wiphy *wiphy,
                              struct cfg80211_chan_def *chandef,
                              enum nl80211_iftype iftype);
 
+/**
+ * cfg80211_reg_can_beacon_relax - check if beaconing is allowed with relaxation
+ * @wiphy: the wiphy
+ * @chandef: the channel definition
+ * @iftype: interface type
+ *
+ * Return: %true if there is no secondary channel or the secondary channel(s)
+ * can be used for beaconing (i.e. is not a radar channel etc.). This version
+ * also checks if IR-relaxation conditions apply, to allow beaconing under
+ * more permissive conditions.
+ *
+ * Requires the RTNL to be held.
+ */
+bool cfg80211_reg_can_beacon_relax(struct wiphy *wiphy,
+                                   struct cfg80211_chan_def *chandef,
+                                   enum nl80211_iftype iftype);
+
 /*
  * cfg80211_ch_switch_notify - update wdev channel and notify userspace
  * @dev: the device which switched channels
diff --git a/include/net/ip.h b/include/net/ip.h
index 0750a186ea63..d5fe9f2ab699 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -161,6 +161,7 @@ static inline __u8 get_rtconn_flags(struct ipcm_cookie* ipc, struct sock* sk)
 }
 
 /* datagram.c */
+int __ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len);
 int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len);
 
 void ip4_datagram_release_cb(struct sock *sk);
diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index 986fddb08579..b0f898e3b2e7 100644
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -1745,6 +1745,7 @@ struct ib_device {
         char                         node_desc[64];
         __be64                       node_guid;
         u32                          local_dma_lkey;
+        u16                          is_switch:1;
         u8                           node_type;
         u8                           phys_port_cnt;
 
@@ -1824,6 +1825,20 @@ enum rdma_link_layer rdma_port_get_link_layer(struct ib_device *device,
                                                u8 port_num);
 
 /**
+ * rdma_cap_ib_switch - Check if the device is IB switch
+ * @device: Device to check
+ *
+ * Device driver is responsible for setting is_switch bit on
+ * in ib_device structure at init time.
+ *
+ * Return: true if the device is IB switch.
+ */
+static inline bool rdma_cap_ib_switch(const struct ib_device *device)
+{
+        return device->is_switch;
+}
+
+/**
  * rdma_start_port - Return the first valid port number for the device
  * specified
  *
@@ -1833,7 +1848,7 @@ enum rdma_link_layer rdma_port_get_link_layer(struct ib_device *device,
  */
 static inline u8 rdma_start_port(const struct ib_device *device)
 {
-        return (device->node_type == RDMA_NODE_IB_SWITCH) ? 0 : 1;
+        return rdma_cap_ib_switch(device) ? 0 : 1;
 }
 
 /**
@@ -1846,8 +1861,7 @@ static inline u8 rdma_start_port(const struct ib_device *device)
  */
 static inline u8 rdma_end_port(const struct ib_device *device)
 {
-        return (device->node_type == RDMA_NODE_IB_SWITCH) ?
-                0 : device->phys_port_cnt;
+        return rdma_cap_ib_switch(device) ? 0 : device->phys_port_cnt;
 }
 
 static inline bool rdma_protocol_ib(const struct ib_device *device, u8 port_num)
diff --git a/include/scsi/scsi_transport_srp.h b/include/scsi/scsi_transport_srp.h
index cdb05dd1d440..d40d3ef25707 100644
--- a/include/scsi/scsi_transport_srp.h
+++ b/include/scsi/scsi_transport_srp.h
@@ -119,6 +119,7 @@ extern struct srp_rport *srp_rport_add(struct Scsi_Host *,
 extern void srp_rport_del(struct srp_rport *);
 extern int srp_tmo_valid(int reconnect_delay, int fast_io_fail_tmo,
                          int dev_loss_tmo);
+int srp_parse_tmo(int *tmo, const char *buf);
 extern int srp_reconnect_rport(struct srp_rport *rport);
 extern void srp_start_tl_fail_timers(struct srp_rport *rport);
 extern void srp_remove_host(struct Scsi_Host *);
diff --git a/include/uapi/drm/amdgpu_drm.h b/include/uapi/drm/amdgpu_drm.h
index b6fce900a833..d708a53b8fb1 100644
--- a/include/uapi/drm/amdgpu_drm.h
+++ b/include/uapi/drm/amdgpu_drm.h
@@ -614,6 +614,8 @@ struct drm_amdgpu_info_device {
         uint32_t vram_type;
         /** video memory bit width*/
         uint32_t vram_bit_width;
+        /* vce harvesting instance */
+        uint32_t vce_harvest_config;
 };
 
 struct drm_amdgpu_info_hw_ip {
diff --git a/include/uapi/drm/i915_drm.h b/include/uapi/drm/i915_drm.h
index 6e1a2ed116cb..db809b722985 100644
--- a/include/uapi/drm/i915_drm.h
+++ b/include/uapi/drm/i915_drm.h
@@ -1070,6 +1070,14 @@ struct drm_i915_reg_read {
         __u64 offset;
         __u64 val; /* Return value */
 };
+/* Known registers:
+ *
+ * Render engine timestamp - 0x2358 + 64bit - gen7+
+ * - Note this register returns an invalid value if using the default
+ *   single instruction 8byte read, in order to workaround that use
+ *   offset (0x2538 | 1) instead.
+ *
+ */
 
 struct drm_i915_reset_stats {
         __u32 ctx_id;
diff --git a/include/uapi/linux/netconf.h b/include/uapi/linux/netconf.h
index 669a1f0b1d97..23cbd34e4ac7 100644
--- a/include/uapi/linux/netconf.h
+++ b/include/uapi/linux/netconf.h
@@ -15,6 +15,7 @@ enum {
         NETCONFA_RP_FILTER,
         NETCONFA_MC_FORWARDING,
         NETCONFA_PROXY_NEIGH,
+        NETCONFA_IGNORE_ROUTES_WITH_LINKDOWN,
         __NETCONFA_MAX
 };
 #define NETCONFA_MAX    (__NETCONFA_MAX - 1)
diff --git a/include/uapi/linux/virtio_net.h b/include/uapi/linux/virtio_net.h
index 7bbee79ca293..ec32293a00db 100644
--- a/include/uapi/linux/virtio_net.h
+++ b/include/uapi/linux/virtio_net.h
@@ -34,6 +34,7 @@
 /* The feature bitmap for virtio net */
 #define VIRTIO_NET_F_CSUM       0       /* Host handles pkts w/ partial csum */
 #define VIRTIO_NET_F_GUEST_CSUM 1       /* Guest handles pkts w/ partial csum */
+#define VIRTIO_NET_F_CTRL_GUEST_OFFLOADS 2 /* Dynamic offload configuration. */
 #define VIRTIO_NET_F_MAC        5       /* Host has given MAC address. */
 #define VIRTIO_NET_F_GUEST_TSO4 7       /* Guest can handle TSOv4 in. */
 #define VIRTIO_NET_F_GUEST_TSO6 8       /* Guest can handle TSOv6 in. */
@@ -226,4 +227,19 @@ struct virtio_net_ctrl_mq {
  #define VIRTIO_NET_CTRL_MQ_VQ_PAIRS_MIN        1
  #define VIRTIO_NET_CTRL_MQ_VQ_PAIRS_MAX        0x8000
 
+/*
+ * Control network offloads
+ *
+ * Reconfigures the network offloads that Guest can handle.
+ *
+ * Available with the VIRTIO_NET_F_CTRL_GUEST_OFFLOADS feature bit.
+ *
+ * Command data format matches the feature bit mask exactly.
+ *
+ * See VIRTIO_NET_F_GUEST_* for the list of offloads
+ * that can be enabled/disabled.
+ */
+#define VIRTIO_NET_CTRL_GUEST_OFFLOADS   5
+#define VIRTIO_NET_CTRL_GUEST_OFFLOADS_SET        0
+
 #endif /* _LINUX_VIRTIO_NET_H */
diff --git a/include/uapi/linux/virtio_pci.h b/include/uapi/linux/virtio_pci.h
index 75301468359f..90007a1abcab 100644
--- a/include/uapi/linux/virtio_pci.h
+++ b/include/uapi/linux/virtio_pci.h
@@ -157,6 +157,12 @@ struct virtio_pci_common_cfg {
         __le32 queue_used_hi;           /* read-write */
 };
 
+/* Fields in VIRTIO_PCI_CAP_PCI_CFG: */
+struct virtio_pci_cfg_cap {
+        struct virtio_pci_cap cap;
+        __u8 pci_cfg_data[4]; /* Data for BAR access. */
+};
+
 /* Macro versions of offsets for the Old Timers! */
 #define VIRTIO_PCI_CAP_VNDR             0
 #define VIRTIO_PCI_CAP_NEXT             1
diff --git a/include/uapi/linux/virtio_ring.h b/include/uapi/linux/virtio_ring.h
index 915980ac68df..c07295969b7e 100644
--- a/include/uapi/linux/virtio_ring.h
+++ b/include/uapi/linux/virtio_ring.h
@@ -31,6 +31,9 @@
  * SUCH DAMAGE.
  *
  * Copyright Rusty Russell IBM Corporation 2007. */
+#ifndef __KERNEL__
+#include <stdint.h>
+#endif
 #include <linux/types.h>
 #include <linux/virtio_types.h>
 
@@ -143,7 +146,7 @@ static inline void vring_init(struct vring *vr, unsigned int num, void *p,
         vr->num = num;
         vr->desc = p;
         vr->avail = p + num*sizeof(struct vring_desc);
-        vr->used = (void *)(((unsigned long)&vr->avail->ring[num] + sizeof(__virtio16)
+        vr->used = (void *)(((uintptr_t)&vr->avail->ring[num] + sizeof(__virtio16)
                 + align-1) & ~(align - 1));
 }
 
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 09c65640cad6..e85bdfd15fed 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -1021,8 +1021,7 @@ static int audit_log_single_execve_arg(struct audit_context *context,
          * for strings that are too long, we should not have created
          * any.
          */
-        if (unlikely((len == 0) || len > MAX_ARG_STRLEN - 1)) {
-                WARN_ON(1);
+        if (WARN_ON_ONCE(len < 0 || len > MAX_ARG_STRLEN - 1)) {
                 send_sig(SIGKILL, current, 0);
                 return -1;
         }
diff --git a/kernel/cpu.c b/kernel/cpu.c
index 9c9c9fab16cc..5644ec5582b9 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -21,6 +21,7 @@
 #include <linux/suspend.h>
 #include <linux/lockdep.h>
 #include <linux/tick.h>
+#include <linux/irq.h>
 #include <trace/events/power.h>
 
 #include "smpboot.h"
@@ -392,13 +393,19 @@ static int __ref _cpu_down(unsigned int cpu, int tasks_frozen)
         smpboot_park_threads(cpu);
 
         /*
-         * So now all preempt/rcu users must observe !cpu_active().
+         * Prevent irq alloc/free while the dying cpu reorganizes the
+         * interrupt affinities.
          */
+        irq_lock_sparse();
 
+        /*
+         * So now all preempt/rcu users must observe !cpu_active().
+         */
         err = __stop_machine(take_cpu_down, &tcd_param, cpumask_of(cpu));
         if (err) {
                 /* CPU didn't die: tell everyone.  Can't complain. */
                 cpu_notify_nofail(CPU_DOWN_FAILED | mod, hcpu);
+                irq_unlock_sparse();
                 goto out_release;
         }
         BUG_ON(cpu_online(cpu));
@@ -415,6 +422,9 @@ static int __ref _cpu_down(unsigned int cpu, int tasks_frozen)
         smp_mb(); /* Read from cpu_dead_idle before __cpu_die(). */
         per_cpu(cpu_dead_idle, cpu) = false;
 
+        /* Interrupts are moved away from the dying cpu, reenable alloc/free */
+        irq_unlock_sparse();
+
         hotplug_cpu__broadcast_tick_pull(cpu);
         /* This actually kills the CPU. */
         __cpu_die(cpu);
@@ -519,6 +529,7 @@ static int _cpu_up(unsigned int cpu, int tasks_frozen)
 
         /* Arch-specific enabling code. */
         ret = __cpu_up(cpu, idle);
+
         if (ret != 0)
                 goto out_notify;
         BUG_ON(!cpu_online(cpu));
diff --git a/kernel/fork.c b/kernel/fork.c
index 1bfefc6f96a4..dbd9b8d7b7cc 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -287,6 +287,11 @@ static void set_max_threads(unsigned int max_threads_suggested)
         max_threads = clamp_t(u64, threads, MIN_THREADS, MAX_THREADS);
 }
 
+#ifdef CONFIG_ARCH_WANTS_DYNAMIC_TASK_STRUCT
+/* Initialized by the architecture: */
+int arch_task_struct_size __read_mostly;
+#endif
+
 void __init fork_init(void)
 {
 #ifndef CONFIG_ARCH_TASK_STRUCT_ALLOCATOR
@@ -295,7 +300,7 @@ void __init fork_init(void)
 #endif
         /* create a slab on which task_structs can be allocated */
         task_struct_cachep =
-                kmem_cache_create("task_struct", sizeof(struct task_struct),
+                kmem_cache_create("task_struct", arch_task_struct_size,
                         ARCH_MIN_TASKALIGN, SLAB_PANIC | SLAB_NOTRACK, NULL);
 #endif
 
diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h
index c8dd8d723ee2..eee4b385cffb 100644
--- a/kernel/irq/internals.h
+++ b/kernel/irq/internals.h
@@ -75,12 +75,8 @@ extern void unmask_threaded_irq(struct irq_desc *desc);
 
 #ifdef CONFIG_SPARSE_IRQ
 static inline void irq_mark_irq(unsigned int irq) { }
-extern void irq_lock_sparse(void);
-extern void irq_unlock_sparse(void);
 #else
 extern void irq_mark_irq(unsigned int irq);
-static inline void irq_lock_sparse(void) { }
-static inline void irq_unlock_sparse(void) { }
 #endif
 
 extern void init_kstat_irqs(struct irq_desc *desc, int node, int nr);
diff --git a/kernel/irq/resend.c b/kernel/irq/resend.c
index 32fc47c2c622..dd95f44f99b2 100644
--- a/kernel/irq/resend.c
+++ b/kernel/irq/resend.c
@@ -77,13 +77,21 @@ void check_irq_resend(struct irq_desc *desc)
                         unsigned int irq = irq_desc_get_irq(desc);
 
                         /*
-                         * If the interrupt has a parent irq and runs
-                         * in the thread context of the parent irq,
-                         * retrigger the parent.
+                         * If the interrupt is running in the thread
+                         * context of the parent irq we need to be
+                         * careful, because we cannot trigger it
+                         * directly.
                          */
-                        if (desc->parent_irq &&
-                            irq_settings_is_nested_thread(desc))
+                        if (irq_settings_is_nested_thread(desc)) {
+                                /*
+                                 * If the parent_irq is valid, we
+                                 * retrigger the parent, otherwise we
+                                 * do nothing.
+                                 */
+                                if (!desc->parent_irq)
+                                        return;
                                 irq = desc->parent_irq;
+                        }
                         /* Set it pending and activate the softirq: */
                         set_bit(irq, irqs_resend);
                         tasklet_schedule(&resend_tasklet);
diff --git a/kernel/module.c b/kernel/module.c
index 3e0e19763d24..4d2b82e610e2 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -3557,6 +3557,7 @@ static int load_module(struct load_info *info, const char __user *uargs,
         mutex_lock(&module_mutex);
         /* Unlink carefully: kallsyms could be walking list. */
         list_del_rcu(&mod->list);
+        mod_tree_remove(mod);
         wake_up_all(&module_wq);
         /* Wait for RCU-sched synchronizing before releasing mod->list. */
         synchronize_sched();
diff --git a/kernel/resource.c b/kernel/resource.c
index 90552aab5f2d..fed052a1bc9f 100644
--- a/kernel/resource.c
+++ b/kernel/resource.c
@@ -504,13 +504,13 @@ int region_is_ram(resource_size_t start, unsigned long size)
 {
         struct resource *p;
         resource_size_t end = start + size - 1;
-        int flags = IORESOURCE_MEM | IORESOURCE_BUSY;
+        unsigned long flags = IORESOURCE_MEM | IORESOURCE_BUSY;
         const char *name = "System RAM";
         int ret = -1;
 
         read_lock(&resource_lock);
         for (p = iomem_resource.child; p ; p = p->sibling) {
-                if (end < p->start)
+                if (p->end < start)
                         continue;
 
                 if (p->start <= start && end <= p->end) {
@@ -521,7 +521,7 @@ int region_is_ram(resource_size_t start, unsigned long size)
                                 ret = 1;
                         break;
                 }
-                if (p->end < start)
+                if (end < p->start)
                         break;  /* not found */
         }
         read_unlock(&resource_lock);
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 65c8f3ebdc3c..d113c3ba8bc4 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -3683,7 +3683,7 @@ static void throttle_cfs_rq(struct cfs_rq *cfs_rq)
         cfs_rq->throttled = 1;
         cfs_rq->throttled_clock = rq_clock(rq);
         raw_spin_lock(&cfs_b->lock);
-        empty = list_empty(&cfs_rq->throttled_list);
+        empty = list_empty(&cfs_b->throttled_cfs_rq);
 
         /*
          * Add to the _head_ of the list, so that an already-started
diff --git a/kernel/time/clockevents.c b/kernel/time/clockevents.c
index 08ccc3da3ca0..50eb107f1198 100644
--- a/kernel/time/clockevents.c
+++ b/kernel/time/clockevents.c
@@ -120,19 +120,25 @@ static int __clockevents_switch_state(struct clock_event_device *dev,
                 /* The clockevent device is getting replaced. Shut it down. */
 
         case CLOCK_EVT_STATE_SHUTDOWN:
-                return dev->set_state_shutdown(dev);
+                if (dev->set_state_shutdown)
+                        return dev->set_state_shutdown(dev);
+                return 0;
 
         case CLOCK_EVT_STATE_PERIODIC:
                 /* Core internal bug */
                 if (!(dev->features & CLOCK_EVT_FEAT_PERIODIC))
                         return -ENOSYS;
-                return dev->set_state_periodic(dev);
+                if (dev->set_state_periodic)
+                        return dev->set_state_periodic(dev);
+                return 0;
 
         case CLOCK_EVT_STATE_ONESHOT:
                 /* Core internal bug */
                 if (!(dev->features & CLOCK_EVT_FEAT_ONESHOT))
                         return -ENOSYS;
-                return dev->set_state_oneshot(dev);
+                if (dev->set_state_oneshot)
+                        return dev->set_state_oneshot(dev);
+                return 0;
 
         case CLOCK_EVT_STATE_ONESHOT_STOPPED:
                 /* Core internal bug */
@@ -471,18 +477,6 @@ static int clockevents_sanity_check(struct clock_event_device *dev)
         if (dev->features & CLOCK_EVT_FEAT_DUMMY)
                 return 0;
 
-        /* New state-specific callbacks */
-        if (!dev->set_state_shutdown)
-                return -EINVAL;
-
-        if ((dev->features & CLOCK_EVT_FEAT_PERIODIC) &&
-            !dev->set_state_periodic)
-                return -EINVAL;
-
-        if ((dev->features & CLOCK_EVT_FEAT_ONESHOT) &&
-            !dev->set_state_oneshot)
-                return -EINVAL;
-
         return 0;
 }
 
diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
index d39f32cdd1b5..f6aae7977824 100644
--- a/kernel/time/tick-broadcast.c
+++ b/kernel/time/tick-broadcast.c
@@ -159,7 +159,7 @@ int tick_device_uses_broadcast(struct clock_event_device *dev, int cpu)
 {
         struct clock_event_device *bc = tick_broadcast_device.evtdev;
         unsigned long flags;
-        int ret;
+        int ret = 0;
 
         raw_spin_lock_irqsave(&tick_broadcast_lock, flags);
 
@@ -221,13 +221,14 @@ int tick_device_uses_broadcast(struct clock_event_device *dev, int cpu)
                          * If we kept the cpu in the broadcast mask,
                          * tell the caller to leave the per cpu device
                          * in shutdown state. The periodic interrupt
-                         * is delivered by the broadcast device.
+                         * is delivered by the broadcast device, if
+                         * the broadcast device exists and is not
+                         * hrtimer based.
                          */
-                        ret = cpumask_test_cpu(cpu, tick_broadcast_mask);
+                        if (bc && !(bc->features & CLOCK_EVT_FEAT_HRTIMER))
+                                ret = cpumask_test_cpu(cpu, tick_broadcast_mask);
                         break;
                 default:
-                        /* Nothing to do */
-                        ret = 0;
                         break;
                 }
         }
@@ -265,8 +266,22 @@ static bool tick_do_broadcast(struct cpumask *mask)
          * Check, if the current cpu is in the mask
          */
         if (cpumask_test_cpu(cpu, mask)) {
+                struct clock_event_device *bc = tick_broadcast_device.evtdev;
+
                 cpumask_clear_cpu(cpu, mask);
-                local = true;
+                /*
+                 * We only run the local handler, if the broadcast
+                 * device is not hrtimer based. Otherwise we run into
+                 * a hrtimer recursion.
+                 *
+                 * local timer_interrupt()
+                 *   local_handler()
+                 *     expire_hrtimers()
+                 *       bc_handler()
+                 *         local_handler()
+                 *           expire_hrtimers()
+                 */
+                local = !(bc->features & CLOCK_EVT_FEAT_HRTIMER);
         }
 
         if (!cpumask_empty(mask)) {
@@ -301,6 +316,13 @@ static void tick_handle_periodic_broadcast(struct clock_event_device *dev)
         bool bc_local;
 
         raw_spin_lock(&tick_broadcast_lock);
+
+        /* Handle spurious interrupts gracefully */
+        if (clockevent_state_shutdown(tick_broadcast_device.evtdev)) {
+                raw_spin_unlock(&tick_broadcast_lock);
+                return;
+        }
+
         bc_local = tick_do_periodic_broadcast();
 
         if (clockevent_state_oneshot(dev)) {
@@ -359,8 +381,16 @@ void tick_broadcast_control(enum tick_broadcast_mode mode)
         case TICK_BROADCAST_ON:
                 cpumask_set_cpu(cpu, tick_broadcast_on);
                 if (!cpumask_test_and_set_cpu(cpu, tick_broadcast_mask)) {
-                        if (tick_broadcast_device.mode ==
-                            TICKDEV_MODE_PERIODIC)
+                        /*
+                         * Only shutdown the cpu local device, if:
+                         *
+                         * - the broadcast device exists
+                         * - the broadcast device is not a hrtimer based one
+                         * - the broadcast device is in periodic mode to
+                         *   avoid a hickup during switch to oneshot mode
+                         */
+                        if (bc && !(bc->features & CLOCK_EVT_FEAT_HRTIMER) &&
+                            tick_broadcast_device.mode == TICKDEV_MODE_PERIODIC)
                                 clockevents_shutdown(dev);
                 }
                 break;
@@ -379,14 +409,16 @@ void tick_broadcast_control(enum tick_broadcast_mode mode)
                 break;
         }
 
-        if (cpumask_empty(tick_broadcast_mask)) {
-                if (!bc_stopped)
-                        clockevents_shutdown(bc);
-        } else if (bc_stopped) {
-                if (tick_broadcast_device.mode == TICKDEV_MODE_PERIODIC)
-                        tick_broadcast_start_periodic(bc);
-                else
-                        tick_broadcast_setup_oneshot(bc);
+        if (bc) {
+                if (cpumask_empty(tick_broadcast_mask)) {
+                        if (!bc_stopped)
+                                clockevents_shutdown(bc);
+                } else if (bc_stopped) {
+                        if (tick_broadcast_device.mode == TICKDEV_MODE_PERIODIC)
+                                tick_broadcast_start_periodic(bc);
+                        else
+                                tick_broadcast_setup_oneshot(bc);
+                }
         }
         raw_spin_unlock(&tick_broadcast_lock);
 }
@@ -662,71 +694,82 @@ static void broadcast_shutdown_local(struct clock_event_device *bc,
         clockevents_switch_state(dev, CLOCK_EVT_STATE_SHUTDOWN);
 }
 
-/**
- * tick_broadcast_oneshot_control - Enter/exit broadcast oneshot mode
- * @state:      The target state (enter/exit)
- *
- * The system enters/leaves a state, where affected devices might stop
- * Returns 0 on success, -EBUSY if the cpu is used to broadcast wakeups.
- *
- * Called with interrupts disabled, so clockevents_lock is not
- * required here because the local clock event device cannot go away
- * under us.
- */
-int tick_broadcast_oneshot_control(enum tick_broadcast_state state)
+int __tick_broadcast_oneshot_control(enum tick_broadcast_state state)
 {
         struct clock_event_device *bc, *dev;
-        struct tick_device *td;
         int cpu, ret = 0;
         ktime_t now;
 
         /*
-         * Periodic mode does not care about the enter/exit of power
-         * states
+         * If there is no broadcast device, tell the caller not to go
+         * into deep idle.
          */
-        if (tick_broadcast_device.mode == TICKDEV_MODE_PERIODIC)
-                return 0;
+        if (!tick_broadcast_device.evtdev)
+                return -EBUSY;
 
-        /*
-         * We are called with preemtion disabled from the depth of the
-         * idle code, so we can't be moved away.
-         */
-        td = this_cpu_ptr(&tick_cpu_device);
-        dev = td->evtdev;
-
-        if (!(dev->features & CLOCK_EVT_FEAT_C3STOP))
-                return 0;
+        dev = this_cpu_ptr(&tick_cpu_device)->evtdev;
 
         raw_spin_lock(&tick_broadcast_lock);
         bc = tick_broadcast_device.evtdev;
         cpu = smp_processor_id();
 
         if (state == TICK_BROADCAST_ENTER) {
+                /*
+                 * If the current CPU owns the hrtimer broadcast
+                 * mechanism, it cannot go deep idle and we do not add
+                 * the CPU to the broadcast mask. We don't have to go
+                 * through the EXIT path as the local timer is not
+                 * shutdown.
+                 */
+                ret = broadcast_needs_cpu(bc, cpu);
+                if (ret)
+                        goto out;
+
+                /*
+                 * If the broadcast device is in periodic mode, we
+                 * return.
+                 */
+                if (tick_broadcast_device.mode == TICKDEV_MODE_PERIODIC) {
+                        /* If it is a hrtimer based broadcast, return busy */
+                        if (bc->features & CLOCK_EVT_FEAT_HRTIMER)
+                                ret = -EBUSY;
+                        goto out;
+                }
+
                 if (!cpumask_test_and_set_cpu(cpu, tick_broadcast_oneshot_mask)) {
                         WARN_ON_ONCE(cpumask_test_cpu(cpu, tick_broadcast_pending_mask));
+
+                        /* Conditionally shut down the local timer. */
                         broadcast_shutdown_local(bc, dev);
+
                         /*
                          * We only reprogram the broadcast timer if we
                          * did not mark ourself in the force mask and
                          * if the cpu local event is earlier than the
                          * broadcast event. If the current CPU is in
                          * the force mask, then we are going to be
-                         * woken by the IPI right away.
+                         * woken by the IPI right away; we return
+                         * busy, so the CPU does not try to go deep
+                         * idle.
                          */
-                        if (!cpumask_test_cpu(cpu, tick_broadcast_force_mask) &&
-                            dev->next_event.tv64 < bc->next_event.tv64)
+                        if (cpumask_test_cpu(cpu, tick_broadcast_force_mask)) {
+                                ret = -EBUSY;
+                        } else if (dev->next_event.tv64 < bc->next_event.tv64) {
                                 tick_broadcast_set_event(bc, cpu, dev->next_event);
+                                /*
+                                 * In case of hrtimer broadcasts the
+                                 * programming might have moved the
+                                 * timer to this cpu. If yes, remove
+                                 * us from the broadcast mask and
+                                 * return busy.
+                                 */
+                                ret = broadcast_needs_cpu(bc, cpu);
+                                if (ret) {
+                                        cpumask_clear_cpu(cpu,
+                                                tick_broadcast_oneshot_mask);
+                                }
+                        }
                 }
-                /*
-                 * If the current CPU owns the hrtimer broadcast
-                 * mechanism, it cannot go deep idle and we remove the
-                 * CPU from the broadcast mask. We don't have to go
-                 * through the EXIT path as the local timer is not
-                 * shutdown.
-                 */
-                ret = broadcast_needs_cpu(bc, cpu);
-                if (ret)
-                        cpumask_clear_cpu(cpu, tick_broadcast_oneshot_mask);
         } else {
                 if (cpumask_test_and_clear_cpu(cpu, tick_broadcast_oneshot_mask)) {
                         clockevents_switch_state(dev, CLOCK_EVT_STATE_ONESHOT);
@@ -796,7 +839,6 @@ out:
         raw_spin_unlock(&tick_broadcast_lock);
         return ret;
 }
-EXPORT_SYMBOL_GPL(tick_broadcast_oneshot_control);
 
 /*
  * Reset the one shot broadcast for a cpu
@@ -938,6 +980,16 @@ bool tick_broadcast_oneshot_available(void)
         return bc ? bc->features & CLOCK_EVT_FEAT_ONESHOT : false;
 }
 
+#else
+int __tick_broadcast_oneshot_control(enum tick_broadcast_state state)
+{
+        struct clock_event_device *bc = tick_broadcast_device.evtdev;
+
+        if (!bc || (bc->features & CLOCK_EVT_FEAT_HRTIMER))
+                return -EBUSY;
+
+        return 0;
+}
 #endif
 
 void __init tick_broadcast_init(void)
diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c
index 76446cb5dfe1..f8bf47571dda 100644
--- a/kernel/time/tick-common.c
+++ b/kernel/time/tick-common.c
@@ -343,6 +343,28 @@ out_bc:
         tick_install_broadcast_device(newdev);
 }
 
+/**
+ * tick_broadcast_oneshot_control - Enter/exit broadcast oneshot mode
+ * @state:      The target state (enter/exit)
+ *
+ * The system enters/leaves a state, where affected devices might stop
+ * Returns 0 on success, -EBUSY if the cpu is used to broadcast wakeups.
+ *
+ * Called with interrupts disabled, so clockevents_lock is not
+ * required here because the local clock event device cannot go away
+ * under us.
+ */
+int tick_broadcast_oneshot_control(enum tick_broadcast_state state)
+{
+        struct tick_device *td = this_cpu_ptr(&tick_cpu_device);
+
+        if (!(td->evtdev->features & CLOCK_EVT_FEAT_C3STOP))
+                return 0;
+
+        return __tick_broadcast_oneshot_control(state);
+}
+EXPORT_SYMBOL_GPL(tick_broadcast_oneshot_control);
+
 #ifdef CONFIG_HOTPLUG_CPU
 /*
  * Transfer the do_timer job away from a dying cpu.
diff --git a/kernel/time/tick-sched.h b/kernel/time/tick-sched.h
index 42fdf4958bcc..a4a8d4e9baa1 100644
--- a/kernel/time/tick-sched.h
+++ b/kernel/time/tick-sched.h
@@ -71,4 +71,14 @@ extern void tick_cancel_sched_timer(int cpu);
 static inline void tick_cancel_sched_timer(int cpu) { }
 #endif
 
+#ifdef CONFIG_GENERIC_CLOCKEVENTS_BROADCAST
+extern int __tick_broadcast_oneshot_control(enum tick_broadcast_state state);
+#else
+static inline int
+__tick_broadcast_oneshot_control(enum tick_broadcast_state state)
+{
+        return -EBUSY;
+}
+#endif
+
 #endif
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 02bece4a99ea..eb11011b5292 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -98,6 +98,13 @@ struct ftrace_pid {
         struct pid *pid;
 };
 
+static bool ftrace_pids_enabled(void)
+{
+        return !list_empty(&ftrace_pids);
+}
+
+static void ftrace_update_trampoline(struct ftrace_ops *ops);
+
 /*
  * ftrace_disabled is set when an anomaly is discovered.
  * ftrace_disabled is much stronger than ftrace_enabled.
@@ -109,7 +116,6 @@ static DEFINE_MUTEX(ftrace_lock);
 static struct ftrace_ops *ftrace_control_list __read_mostly = &ftrace_list_end;
 static struct ftrace_ops *ftrace_ops_list __read_mostly = &ftrace_list_end;
 ftrace_func_t ftrace_trace_function __read_mostly = ftrace_stub;
-ftrace_func_t ftrace_pid_function __read_mostly = ftrace_stub;
 static struct ftrace_ops global_ops;
 static struct ftrace_ops control_ops;
 
@@ -183,14 +189,7 @@ static void ftrace_pid_func(unsigned long ip, unsigned long parent_ip,
         if (!test_tsk_trace_trace(current))
                 return;
 
-        ftrace_pid_function(ip, parent_ip, op, regs);
-}
-
-static void set_ftrace_pid_function(ftrace_func_t func)
-{
-        /* do not set ftrace_pid_function to itself! */
-        if (func != ftrace_pid_func)
-                ftrace_pid_function = func;
+        op->saved_func(ip, parent_ip, op, regs);
 }
 
 /**
@@ -202,7 +201,6 @@ static void set_ftrace_pid_function(ftrace_func_t func)
 void clear_ftrace_function(void)
 {
         ftrace_trace_function = ftrace_stub;
-        ftrace_pid_function = ftrace_stub;
 }
 
 static void control_ops_disable_all(struct ftrace_ops *ops)
@@ -436,6 +434,12 @@ static int __register_ftrace_function(struct ftrace_ops *ops)
         } else
                 add_ftrace_ops(&ftrace_ops_list, ops);
 
+        /* Always save the function, and reset at unregistering */
+        ops->saved_func = ops->func;
+
+        if (ops->flags & FTRACE_OPS_FL_PID && ftrace_pids_enabled())
+                ops->func = ftrace_pid_func;
+
         ftrace_update_trampoline(ops);
 
         if (ftrace_enabled)
@@ -463,15 +467,28 @@ static int __unregister_ftrace_function(struct ftrace_ops *ops)
         if (ftrace_enabled)
                 update_ftrace_function();
 
+        ops->func = ops->saved_func;
+
         return 0;
 }
 
 static void ftrace_update_pid_func(void)
 {
+        bool enabled = ftrace_pids_enabled();
+        struct ftrace_ops *op;
+
         /* Only do something if we are tracing something */
         if (ftrace_trace_function == ftrace_stub)
                 return;
 
+        do_for_each_ftrace_op(op, ftrace_ops_list) {
+                if (op->flags & FTRACE_OPS_FL_PID) {
+                        op->func = enabled ? ftrace_pid_func :
+                                op->saved_func;
+                        ftrace_update_trampoline(op);
+                }
+        } while_for_each_ftrace_op(op);
+
         update_ftrace_function();
 }
 
@@ -1133,7 +1150,8 @@ static struct ftrace_ops global_ops = {
         .local_hash.filter_hash         = EMPTY_HASH,
         INIT_OPS_HASH(global_ops)
         .flags                          = FTRACE_OPS_FL_RECURSION_SAFE |
-                                          FTRACE_OPS_FL_INITIALIZED,
+                                          FTRACE_OPS_FL_INITIALIZED |
+                                          FTRACE_OPS_FL_PID,
 };
 
 /*
@@ -5023,7 +5041,9 @@ static void ftrace_update_trampoline(struct ftrace_ops *ops)
 
 static struct ftrace_ops global_ops = {
         .func                   = ftrace_stub,
-        .flags                  = FTRACE_OPS_FL_RECURSION_SAFE | FTRACE_OPS_FL_INITIALIZED,
+        .flags                  = FTRACE_OPS_FL_RECURSION_SAFE |
+                                  FTRACE_OPS_FL_INITIALIZED |
+                                  FTRACE_OPS_FL_PID,
 };
 
 static int __init ftrace_nodyn_init(void)
@@ -5080,11 +5100,6 @@ void ftrace_init_array_ops(struct trace_array *tr, ftrace_func_t func)
                 if (WARN_ON(tr->ops->func != ftrace_stub))
                         printk("ftrace ops had %pS for function\n",
                                tr->ops->func);
-                /* Only the top level instance does pid tracing */
-                if (!list_empty(&ftrace_pids)) {
-                        set_ftrace_pid_function(func);
-                        func = ftrace_pid_func;
-                }
         }
         tr->ops->func = func;
         tr->ops->private = tr;
@@ -5371,7 +5386,7 @@ static void *fpid_start(struct seq_file *m, loff_t *pos)
 {
         mutex_lock(&ftrace_lock);
 
-        if (list_empty(&ftrace_pids) && (!*pos))
+        if (!ftrace_pids_enabled() && (!*pos))
                 return (void *) 1;
 
         return seq_list_start(&ftrace_pids, *pos);
@@ -5610,6 +5625,7 @@ static struct ftrace_ops graph_ops = {
         .func                   = ftrace_stub,
         .flags                  = FTRACE_OPS_FL_RECURSION_SAFE |
                                    FTRACE_OPS_FL_INITIALIZED |
+                                   FTRACE_OPS_FL_PID |
                                    FTRACE_OPS_FL_STUB,
 #ifdef FTRACE_GRAPH_TRAMP_ADDR
         .trampoline             = FTRACE_GRAPH_TRAMP_ADDR,
diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
index f060716b02ae..74bde81601a9 100644
--- a/kernel/trace/trace.h
+++ b/kernel/trace/trace.h
@@ -444,6 +444,7 @@ enum {
 
         TRACE_CONTROL_BIT,
 
+        TRACE_BRANCH_BIT,
 /*
  * Abuse of the trace_recursion.
  * As we need a way to maintain state if we are tracing the function
diff --git a/kernel/trace/trace_branch.c b/kernel/trace/trace_branch.c
index a87b43f49eb4..e2e12ad3186f 100644
--- a/kernel/trace/trace_branch.c
+++ b/kernel/trace/trace_branch.c
@@ -36,9 +36,12 @@ probe_likely_condition(struct ftrace_branch_data *f, int val, int expect)
         struct trace_branch *entry;
         struct ring_buffer *buffer;
         unsigned long flags;
-        int cpu, pc;
+        int pc;
         const char *p;
 
+        if (current->trace_recursion & TRACE_BRANCH_BIT)
+                return;
+
         /*
          * I would love to save just the ftrace_likely_data pointer, but
          * this code can also be used by modules. Ugly things can happen
@@ -49,10 +52,10 @@ probe_likely_condition(struct ftrace_branch_data *f, int val, int expect)
         if (unlikely(!tr))
                 return;
 
-        local_irq_save(flags);
-        cpu = raw_smp_processor_id();
-        data = per_cpu_ptr(tr->trace_buffer.data, cpu);
-        if (atomic_inc_return(&data->disabled) != 1)
+        raw_local_irq_save(flags);
+        current->trace_recursion |= TRACE_BRANCH_BIT;
+        data = this_cpu_ptr(tr->trace_buffer.data);
+        if (atomic_read(&data->disabled))
                 goto out;
 
         pc = preempt_count();
@@ -81,8 +84,8 @@ probe_likely_condition(struct ftrace_branch_data *f, int val, int expect)
                 __buffer_unlock_commit(buffer, event);
 
  out:
-        atomic_dec(&data->disabled);
-        local_irq_restore(flags);
+        current->trace_recursion &= ~TRACE_BRANCH_BIT;
+        raw_local_irq_restore(flags);
 }
 
 static inline
diff --git a/lib/Kconfig.kasan b/lib/Kconfig.kasan
index 777eda7d1ab4..39f24d6721e5 100644
--- a/lib/Kconfig.kasan
+++ b/lib/Kconfig.kasan
@@ -18,10 +18,6 @@ config KASAN
           For better error detection enable CONFIG_STACKTRACE,
           and add slub_debug=U to boot cmdline.
 
-config KASAN_SHADOW_OFFSET
-        hex
-        default 0xdffffc0000000000 if X86_64
-
 choice
         prompt "Instrumentation type"
         depends on KASAN
diff --git a/lib/decompress.c b/lib/decompress.c
index 528ff932d8e4..62696dff5730 100644
--- a/lib/decompress.c
+++ b/lib/decompress.c
@@ -59,8 +59,11 @@ decompress_fn __init decompress_method(const unsigned char *inbuf, long len,
 {
         const struct compress_format *cf;
 
-        if (len < 2)
+        if (len < 2) {
+                if (name)
+                        *name = NULL;
                 return NULL;    /* Need at least this much... */
+        }
 
         pr_debug("Compressed data magic: %#.2x %#.2x\n", inbuf[0], inbuf[1]);
 
diff --git a/lib/dma-debug.c b/lib/dma-debug.c
index ae4b65e17e64..dace71fe41f7 100644
--- a/lib/dma-debug.c
+++ b/lib/dma-debug.c
@@ -574,6 +574,9 @@ void debug_dma_assert_idle(struct page *page)
         unsigned long flags;
         phys_addr_t cln;
 
+        if (dma_debug_disabled())
+                return;
+
         if (!page)
                 return;
 
diff --git a/lib/hexdump.c b/lib/hexdump.c
index 7ea09699855d..8d74c20d8595 100644
--- a/lib/hexdump.c
+++ b/lib/hexdump.c
@@ -11,6 +11,7 @@
 #include <linux/ctype.h>
 #include <linux/kernel.h>
 #include <linux/export.h>
+#include <asm/unaligned.h>
 
 const char hex_asc[] = "0123456789abcdef";
 EXPORT_SYMBOL(hex_asc);
@@ -139,7 +140,7 @@ int hex_dump_to_buffer(const void *buf, size_t len, int rowsize, int groupsize,
                 for (j = 0; j < ngroups; j++) {
                         ret = snprintf(linebuf + lx, linebuflen - lx,
                                        "%s%16.16llx", j ? " " : "",
-                                       (unsigned long long)*(ptr8 + j));
+                                       get_unaligned(ptr8 + j));
                         if (ret >= linebuflen - lx)
                                 goto overflow1;
                         lx += ret;
@@ -150,7 +151,7 @@ int hex_dump_to_buffer(const void *buf, size_t len, int rowsize, int groupsize,
                 for (j = 0; j < ngroups; j++) {
                         ret = snprintf(linebuf + lx, linebuflen - lx,
                                        "%s%8.8x", j ? " " : "",
-                                       *(ptr4 + j));
+                                       get_unaligned(ptr4 + j));
                         if (ret >= linebuflen - lx)
                                 goto overflow1;
                         lx += ret;
@@ -161,7 +162,7 @@ int hex_dump_to_buffer(const void *buf, size_t len, int rowsize, int groupsize,
                 for (j = 0; j < ngroups; j++) {
                         ret = snprintf(linebuf + lx, linebuflen - lx,
                                        "%s%4.4x", j ? " " : "",
-                                       *(ptr2 + j));
+                                       get_unaligned(ptr2 + j));
                         if (ret >= linebuflen - lx)
                                 goto overflow1;
                         lx += ret;
diff --git a/lib/kobject.c b/lib/kobject.c
index 2e3bd01964a9..3e3a5c3cb330 100644
--- a/lib/kobject.c
+++ b/lib/kobject.c
@@ -337,8 +337,9 @@ error:
 }
 EXPORT_SYMBOL(kobject_init);
 
-static int kobject_add_varg(struct kobject *kobj, struct kobject *parent,
-                            const char *fmt, va_list vargs)
+static __printf(3, 0) int kobject_add_varg(struct kobject *kobj,
+                                           struct kobject *parent,
+                                           const char *fmt, va_list vargs)
 {
         int retval;
 
diff --git a/lib/rhashtable.c b/lib/rhashtable.c
index a60a6d335a91..cc0c69710dcf 100644
--- a/lib/rhashtable.c
+++ b/lib/rhashtable.c
@@ -610,6 +610,8 @@ next:
                 iter->skip = 0;
         }
 
+        iter->p = NULL;
+
         /* Ensure we see any new tables. */
         smp_rmb();
 
@@ -620,8 +622,6 @@ next:
                 return ERR_PTR(-EAGAIN);
         }
 
-        iter->p = NULL;
-
         return NULL;
 }
 EXPORT_SYMBOL_GPL(rhashtable_walk_next);
diff --git a/mm/cma_debug.c b/mm/cma_debug.c
index 7621ee34daa0..f8e4b60db167 100644
--- a/mm/cma_debug.c
+++ b/mm/cma_debug.c
@@ -39,7 +39,7 @@ static int cma_used_get(void *data, u64 *val)
 
         mutex_lock(&cma->lock);
         /* pages counter is smaller than sizeof(int) */
-        used = bitmap_weight(cma->bitmap, (int)cma->count);
+        used = bitmap_weight(cma->bitmap, (int)cma_bitmap_maxno(cma));
         mutex_unlock(&cma->lock);
         *val = (u64)used << cma->order_per_bit;
 
@@ -52,13 +52,14 @@ static int cma_maxchunk_get(void *data, u64 *val)
         struct cma *cma = data;
         unsigned long maxchunk = 0;
         unsigned long start, end = 0;
+        unsigned long bitmap_maxno = cma_bitmap_maxno(cma);
 
         mutex_lock(&cma->lock);
         for (;;) {
-                start = find_next_zero_bit(cma->bitmap, cma->count, end);
+                start = find_next_zero_bit(cma->bitmap, bitmap_maxno, end);
                 if (start >= cma->count)
                         break;
-                end = find_next_bit(cma->bitmap, cma->count, start);
+                end = find_next_bit(cma->bitmap, bitmap_maxno, start);
                 maxchunk = max(end - start, maxchunk);
         }
         mutex_unlock(&cma->lock);
@@ -170,10 +171,10 @@ static void cma_debugfs_add_one(struct cma *cma, int idx)
 
         tmp = debugfs_create_dir(name, cma_debugfs_root);
 
-        debugfs_create_file("alloc", S_IWUSR, cma_debugfs_root, cma,
+        debugfs_create_file("alloc", S_IWUSR, tmp, cma,
                                 &cma_alloc_fops);
 
-        debugfs_create_file("free", S_IWUSR, cma_debugfs_root, cma,
+        debugfs_create_file("free", S_IWUSR, tmp, cma,
                                 &cma_free_fops);
 
         debugfs_create_file("base_pfn", S_IRUGO, tmp,
diff --git a/mm/memory.c b/mm/memory.c
index a84fbb772034..388dcf9aa283 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -2670,6 +2670,10 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
 
         pte_unmap(page_table);
 
+        /* File mapping without ->vm_ops ? */
+        if (vma->vm_flags & VM_SHARED)
+                return VM_FAULT_SIGBUS;
+
         /* Check if we need to add a guard page to the stack */
         if (check_stack_guard_page(vma, address) < 0)
                 return VM_FAULT_SIGSEGV;
@@ -3099,6 +3103,9 @@ static int do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
                         - vma->vm_start) >> PAGE_SHIFT) + vma->vm_pgoff;
 
         pte_unmap(page_table);
+        /* The VMA was not fully populated on mmap() or missing VM_DONTEXPAND */
+        if (!vma->vm_ops->fault)
+                return VM_FAULT_SIGBUS;
         if (!(flags & FAULT_FLAG_WRITE))
                 return do_read_fault(mm, vma, address, pmd, pgoff, flags,
                                 orig_pte);
@@ -3244,13 +3251,12 @@ static int handle_pte_fault(struct mm_struct *mm,
         barrier();
         if (!pte_present(entry)) {
                 if (pte_none(entry)) {
-                        if (vma->vm_ops) {
-                                if (likely(vma->vm_ops->fault))
-                                        return do_fault(mm, vma, address, pte,
-                                                        pmd, flags, entry);
-                        }
-                        return do_anonymous_page(mm, vma, address,
-                                                 pte, pmd, flags);
+                        if (vma->vm_ops)
+                                return do_fault(mm, vma, address, pte, pmd,
+                                                flags, entry);
+
+                        return do_anonymous_page(mm, vma, address, pte, pmd,
+                                        flags);
                 }
                 return do_swap_page(mm, vma, address,
                                         pte, pmd, flags, entry);
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 506eac8b38af..ef19f22b2b7d 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -246,9 +246,7 @@ static inline void reset_deferred_meminit(pg_data_t *pgdat)
 /* Returns true if the struct page for the pfn is uninitialised */
 static inline bool __meminit early_page_uninitialised(unsigned long pfn)
 {
-        int nid = early_pfn_to_nid(pfn);
-
-        if (pfn >= NODE_DATA(nid)->first_deferred_pfn)
+        if (pfn >= NODE_DATA(early_pfn_to_nid(pfn))->first_deferred_pfn)
                 return true;
 
         return false;
@@ -1950,6 +1948,7 @@ void free_hot_cold_page_list(struct list_head *list, bool cold)
 void split_page(struct page *page, unsigned int order)
 {
         int i;
+        gfp_t gfp_mask;
 
         VM_BUG_ON_PAGE(PageCompound(page), page);
         VM_BUG_ON_PAGE(!page_count(page), page);
@@ -1963,10 +1962,11 @@ void split_page(struct page *page, unsigned int order)
                 split_page(virt_to_page(page[0].shadow), order);
 #endif
 
-        set_page_owner(page, 0, 0);
+        gfp_mask = get_page_owner_gfp(page);
+        set_page_owner(page, 0, gfp_mask);
         for (i = 1; i < (1 << order); i++) {
                 set_page_refcounted(page + i);
-                set_page_owner(page + i, 0, 0);
+                set_page_owner(page + i, 0, gfp_mask);
         }
 }
 EXPORT_SYMBOL_GPL(split_page);
@@ -1996,6 +1996,8 @@ int __isolate_free_page(struct page *page, unsigned int order)
         zone->free_area[order].nr_free--;
         rmv_page_order(page);
 
+        set_page_owner(page, order, __GFP_MOVABLE);
+
         /* Set the pageblock if the isolated page is at least a pageblock */
         if (order >= pageblock_order - 1) {
                 struct page *endpage = page + (1 << order) - 1;
@@ -2007,7 +2009,7 @@ int __isolate_free_page(struct page *page, unsigned int order)
                 }
         }
 
-        set_page_owner(page, order, 0);
+
         return 1UL << order;
 }
 
diff --git a/mm/page_owner.c b/mm/page_owner.c
index bd5f842b56d2..983c3a10fa07 100644
--- a/mm/page_owner.c
+++ b/mm/page_owner.c
@@ -76,6 +76,13 @@ void __set_page_owner(struct page *page, unsigned int order, gfp_t gfp_mask)
         __set_bit(PAGE_EXT_OWNER, &page_ext->flags);
 }
 
+gfp_t __get_page_owner_gfp(struct page *page)
+{
+        struct page_ext *page_ext = lookup_page_ext(page);
+
+        return page_ext->gfp_mask;
+}
+
 static ssize_t
 print_page_owner(char __user *buf, size_t count, unsigned long pfn,
                 struct page *page, struct page_ext *page_ext)
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index 9dd49ca67dbc..6e70ddb158b4 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -704,6 +704,7 @@ static void p9_virtio_remove(struct virtio_device *vdev)
 
         mutex_unlock(&virtio_9p_lock);
 
+        vdev->config->reset(vdev);
         vdev->config->del_vqs(vdev);
 
         sysfs_remove_file(&(vdev->dev.kobj), &dev_attr_mount_tag.attr);
diff --git a/net/ax25/ax25_subr.c b/net/ax25/ax25_subr.c
index 1997538a5d23..3b78e8473a01 100644
--- a/net/ax25/ax25_subr.c
+++ b/net/ax25/ax25_subr.c
@@ -264,6 +264,7 @@ void ax25_disconnect(ax25_cb *ax25, int reason)
 {
         ax25_clear_queues(ax25);
 
+        ax25_stop_heartbeat(ax25);
         ax25_stop_t1timer(ax25);
         ax25_stop_t2timer(ax25);
         ax25_stop_t3timer(ax25);
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index e97572b5d2cc..0ff6e1bbca91 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -42,6 +42,7 @@ int br_dev_queue_push_xmit(struct sock *sk, struct sk_buff *skb)
         } else {
                 skb_push(skb, ETH_HLEN);
                 br_drop_fake_rtable(skb);
+                skb_sender_cpu_clear(skb);
                 dev_queue_xmit(skb);
         }
 
diff --git a/net/bridge/br_mdb.c b/net/bridge/br_mdb.c
index e29ad70b3000..1198a3dbad95 100644
--- a/net/bridge/br_mdb.c
+++ b/net/bridge/br_mdb.c
@@ -323,6 +323,7 @@ static int br_mdb_add_group(struct net_bridge *br, struct net_bridge_port *port,
         struct net_bridge_port_group *p;
         struct net_bridge_port_group __rcu **pp;
         struct net_bridge_mdb_htable *mdb;
+        unsigned long now = jiffies;
         int err;
 
         mdb = mlock_dereference(br->mdb, br);
@@ -347,8 +348,9 @@ static int br_mdb_add_group(struct net_bridge *br, struct net_bridge_port *port,
         if (unlikely(!p))
                 return -ENOMEM;
         rcu_assign_pointer(*pp, p);
+        if (state == MDB_TEMPORARY)
+                mod_timer(&p->timer, now + br->multicast_membership_interval);
 
-        br_mdb_notify(br->dev, port, group, RTM_NEWMDB);
         return 0;
 }
 
@@ -371,6 +373,7 @@ static int __br_mdb_add(struct net *net, struct net_bridge *br,
         if (!p || p->br != br || p->state == BR_STATE_DISABLED)
                 return -EINVAL;
 
+        memset(&ip, 0, sizeof(ip));
         ip.proto = entry->addr.proto;
         if (ip.proto == htons(ETH_P_IP))
                 ip.u.ip4 = entry->addr.u.ip4;
@@ -417,20 +420,14 @@ static int __br_mdb_del(struct net_bridge *br, struct br_mdb_entry *entry)
         if (!netif_running(br->dev) || br->multicast_disabled)
                 return -EINVAL;
 
+        memset(&ip, 0, sizeof(ip));
         ip.proto = entry->addr.proto;
-        if (ip.proto == htons(ETH_P_IP)) {
-                if (timer_pending(&br->ip4_other_query.timer))
-                        return -EBUSY;
-
+        if (ip.proto == htons(ETH_P_IP))
                 ip.u.ip4 = entry->addr.u.ip4;
 #if IS_ENABLED(CONFIG_IPV6)
-        } else {
-                if (timer_pending(&br->ip6_other_query.timer))
-                        return -EBUSY;
-
+        else
                 ip.u.ip6 = entry->addr.u.ip6;
 #endif
-        }
 
         spin_lock_bh(&br->multicast_lock);
         mdb = mlock_dereference(br->mdb, br);
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 742a6c27d7a2..79db489cdade 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -39,6 +39,16 @@ static void br_multicast_start_querier(struct net_bridge *br,
                                        struct bridge_mcast_own_query *query);
 static void br_multicast_add_router(struct net_bridge *br,
                                     struct net_bridge_port *port);
+static void br_ip4_multicast_leave_group(struct net_bridge *br,
+                                         struct net_bridge_port *port,
+                                         __be32 group,
+                                         __u16 vid);
+#if IS_ENABLED(CONFIG_IPV6)
+static void br_ip6_multicast_leave_group(struct net_bridge *br,
+                                         struct net_bridge_port *port,
+                                         const struct in6_addr *group,
+                                         __u16 vid);
+#endif
 unsigned int br_mdb_rehash_seq;
 
 static inline int br_ip_equal(const struct br_ip *a, const struct br_ip *b)
@@ -1010,9 +1020,15 @@ static int br_ip4_multicast_igmp3_report(struct net_bridge *br,
                         continue;
                 }
 
-                err = br_ip4_multicast_add_group(br, port, group, vid);
-                if (err)
-                        break;
+                if ((type == IGMPV3_CHANGE_TO_INCLUDE ||
+                     type == IGMPV3_MODE_IS_INCLUDE) &&
+                    ntohs(grec->grec_nsrcs) == 0) {
+                        br_ip4_multicast_leave_group(br, port, group, vid);
+                } else {
+                        err = br_ip4_multicast_add_group(br, port, group, vid);
+                        if (err)
+                                break;
+                }
         }
 
         return err;
@@ -1071,10 +1087,17 @@ static int br_ip6_multicast_mld2_report(struct net_bridge *br,
                         continue;
                 }
 
-                err = br_ip6_multicast_add_group(br, port, &grec->grec_mca,
-                                                 vid);
-                if (err)
-                        break;
+                if ((grec->grec_type == MLD2_CHANGE_TO_INCLUDE ||
+                     grec->grec_type == MLD2_MODE_IS_INCLUDE) &&
+                    ntohs(*nsrcs) == 0) {
+                        br_ip6_multicast_leave_group(br, port, &grec->grec_mca,
+                                                     vid);
+                } else {
+                        err = br_ip6_multicast_add_group(br, port,
+                                                         &grec->grec_mca, vid);
+                        if (!err)
+                                break;
+                }
         }
 
         return err;
diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c
index d89f4fac0bc5..c8b9bcfe997e 100644
--- a/net/bridge/br_netfilter_hooks.c
+++ b/net/bridge/br_netfilter_hooks.c
@@ -111,7 +111,7 @@ static inline __be16 pppoe_proto(const struct sk_buff *skb)
 /* largest possible L2 header, see br_nf_dev_queue_xmit() */
 #define NF_BRIDGE_MAX_MAC_HEADER_LENGTH (PPPOE_SES_HLEN + ETH_HLEN)
 
-#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV4)
+#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV4) || IS_ENABLED(CONFIG_NF_DEFRAG_IPV6)
 struct brnf_frag_data {
         char mac[NF_BRIDGE_MAX_MAC_HEADER_LENGTH];
         u8 encap_size;
@@ -694,6 +694,7 @@ static int br_nf_push_frag_xmit(struct sock *sk, struct sk_buff *skb)
 }
 #endif
 
+#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV4)
 static int br_nf_ip_fragment(struct sock *sk, struct sk_buff *skb,
                              int (*output)(struct sock *, struct sk_buff *))
 {
@@ -712,6 +713,7 @@ static int br_nf_ip_fragment(struct sock *sk, struct sk_buff *skb,
 
         return ip_do_fragment(sk, skb, output);
 }
+#endif
 
 static unsigned int nf_bridge_mtu_reduction(const struct sk_buff *skb)
 {
@@ -742,7 +744,7 @@ static int br_nf_dev_queue_xmit(struct sock *sk, struct sk_buff *skb)
                 struct brnf_frag_data *data;
 
                 if (br_validate_ipv4(skb))
-                        return NF_DROP;
+                        goto drop;
 
                 IPCB(skb)->frag_max_size = nf_bridge->frag_max_size;
 
@@ -767,7 +769,7 @@ static int br_nf_dev_queue_xmit(struct sock *sk, struct sk_buff *skb)
                 struct brnf_frag_data *data;
 
                 if (br_validate_ipv6(skb))
-                        return NF_DROP;
+                        goto drop;
 
                 IP6CB(skb)->frag_max_size = nf_bridge->frag_max_size;
 
@@ -782,12 +784,16 @@ static int br_nf_dev_queue_xmit(struct sock *sk, struct sk_buff *skb)
 
                 if (v6ops)
                         return v6ops->fragment(sk, skb, br_nf_push_frag_xmit);
-                else
-                        return -EMSGSIZE;
+
+                kfree_skb(skb);
+                return -EMSGSIZE;
         }
 #endif
         nf_bridge_info_free(skb);
         return br_dev_queue_push_xmit(sk, skb);
+ drop:
+        kfree_skb(skb);
+        return 0;
 }
 
 /* PF_BRIDGE/POST_ROUTING ********************************************/
diff --git a/net/bridge/br_netfilter_ipv6.c b/net/bridge/br_netfilter_ipv6.c
index 6d12d2675c80..13b7d1e3d185 100644
--- a/net/bridge/br_netfilter_ipv6.c
+++ b/net/bridge/br_netfilter_ipv6.c
@@ -104,7 +104,7 @@ int br_validate_ipv6(struct sk_buff *skb)
 {
         const struct ipv6hdr *hdr;
         struct net_device *dev = skb->dev;
-        struct inet6_dev *idev = in6_dev_get(skb->dev);
+        struct inet6_dev *idev = __in6_dev_get(skb->dev);
         u32 pkt_len;
         u8 ip6h_len = sizeof(struct ipv6hdr);
 
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index 6b67ed3831de..364bdc98bd9b 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -457,6 +457,8 @@ static int br_afspec(struct net_bridge *br,
                 if (nla_len(attr) != sizeof(struct bridge_vlan_info))
                         return -EINVAL;
                 vinfo = nla_data(attr);
+                if (!vinfo->vid || vinfo->vid >= VLAN_VID_MASK)
+                        return -EINVAL;
                 if (vinfo->flags & BRIDGE_VLAN_INFO_RANGE_BEGIN) {
                         if (vinfo_start)
                                 return -EINVAL;
diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
index 3cc71b9f5517..cc858919108e 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -121,12 +121,13 @@ static void caif_flow_ctrl(struct sock *sk, int mode)
  * Copied from sock.c:sock_queue_rcv_skb(), but changed so packets are
  * not dropped, but CAIF is sending flow off instead.
  */
-static int caif_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
+static void caif_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 {
         int err;
         unsigned long flags;
         struct sk_buff_head *list = &sk->sk_receive_queue;
         struct caifsock *cf_sk = container_of(sk, struct caifsock, sk);
+        bool queued = false;
 
         if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
                 (unsigned int)sk->sk_rcvbuf && rx_flow_is_on(cf_sk)) {
@@ -139,7 +140,8 @@ static int caif_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 
         err = sk_filter(sk, skb);
         if (err)
-                return err;
+                goto out;
+
         if (!sk_rmem_schedule(sk, skb, skb->truesize) && rx_flow_is_on(cf_sk)) {
                 set_rx_flow_off(cf_sk);
                 net_dbg_ratelimited("sending flow OFF due to rmem_schedule\n");
@@ -147,21 +149,16 @@ static int caif_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
         }
         skb->dev = NULL;
         skb_set_owner_r(skb, sk);
-        /* Cache the SKB length before we tack it onto the receive
-         * queue. Once it is added it no longer belongs to us and
-         * may be freed by other threads of control pulling packets
-         * from the queue.
-         */
         spin_lock_irqsave(&list->lock, flags);
-        if (!sock_flag(sk, SOCK_DEAD))
+        queued = !sock_flag(sk, SOCK_DEAD);
+        if (queued)
                 __skb_queue_tail(list, skb);
         spin_unlock_irqrestore(&list->lock, flags);
-
-        if (!sock_flag(sk, SOCK_DEAD))
+out:
+        if (queued)
                 sk->sk_data_ready(sk);
         else
                 kfree_skb(skb);
-        return 0;
 }
 
 /* Packet Receive Callback function called from CAIF Stack */
diff --git a/net/can/af_can.c b/net/can/af_can.c
index 7933e62a7318..166d436196c1 100644
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -89,6 +89,8 @@ struct timer_list can_stattimer;   /* timer for statistics update */
 struct s_stats    can_stats;       /* packet statistics */
 struct s_pstats   can_pstats;      /* receive list statistics */
 
+static atomic_t skbcounter = ATOMIC_INIT(0);
+
 /*
  * af_can socket functions
  */
@@ -310,12 +312,8 @@ int can_send(struct sk_buff *skb, int loop)
                 return err;
         }
 
-        if (newskb) {
-                if (!(newskb->tstamp.tv64))
-                        __net_timestamp(newskb);
-
+        if (newskb)
                 netif_rx_ni(newskb);
-        }
 
         /* update statistics */
         can_stats.tx_frames++;
@@ -683,6 +681,10 @@ static void can_receive(struct sk_buff *skb, struct net_device *dev)
         can_stats.rx_frames++;
         can_stats.rx_frames_delta++;
 
+        /* create non-zero unique skb identifier together with *skb */
+        while (!(can_skb_prv(skb)->skbcnt))
+                can_skb_prv(skb)->skbcnt = atomic_inc_return(&skbcounter);
+
         rcu_read_lock();
 
         /* deliver the packet to sockets listening on all devices */
diff --git a/net/can/bcm.c b/net/can/bcm.c
index b523453585be..a1ba6875c2a2 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -261,6 +261,7 @@ static void bcm_can_tx(struct bcm_op *op)
 
         can_skb_reserve(skb);
         can_skb_prv(skb)->ifindex = dev->ifindex;
+        can_skb_prv(skb)->skbcnt = 0;
 
         memcpy(skb_put(skb, CFSIZ), cf, CFSIZ);
 
@@ -1217,6 +1218,7 @@ static int bcm_tx_send(struct msghdr *msg, int ifindex, struct sock *sk)
         }
 
         can_skb_prv(skb)->ifindex = dev->ifindex;
+        can_skb_prv(skb)->skbcnt = 0;
         skb->dev = dev;
         can_skb_set_owner(skb, sk);
         err = can_send(skb, 1); /* send with loopback */
diff --git a/net/can/raw.c b/net/can/raw.c
index 31b9748cbb4e..2e67b1423cd3 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -75,7 +75,7 @@ MODULE_ALIAS("can-proto-1");
  */
 
 struct uniqframe {
-        ktime_t tstamp;
+        int skbcnt;
         const struct sk_buff *skb;
         unsigned int join_rx_count;
 };
@@ -133,7 +133,7 @@ static void raw_rcv(struct sk_buff *oskb, void *data)
 
         /* eliminate multiple filter matches for the same skb */
         if (this_cpu_ptr(ro->uniq)->skb == oskb &&
-            ktime_equal(this_cpu_ptr(ro->uniq)->tstamp, oskb->tstamp)) {
+            this_cpu_ptr(ro->uniq)->skbcnt == can_skb_prv(oskb)->skbcnt) {
                 if (ro->join_filters) {
                         this_cpu_inc(ro->uniq->join_rx_count);
                         /* drop frame until all enabled filters matched */
@@ -144,7 +144,7 @@ static void raw_rcv(struct sk_buff *oskb, void *data)
                 }
         } else {
                 this_cpu_ptr(ro->uniq)->skb = oskb;
-                this_cpu_ptr(ro->uniq)->tstamp = oskb->tstamp;
+                this_cpu_ptr(ro->uniq)->skbcnt = can_skb_prv(oskb)->skbcnt;
                 this_cpu_ptr(ro->uniq)->join_rx_count = 1;
                 /* drop first frame to check all enabled filters? */
                 if (ro->join_filters && ro->count > 1)
@@ -749,6 +749,7 @@ static int raw_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
 
         can_skb_reserve(skb);
         can_skb_prv(skb)->ifindex = dev->ifindex;
+        can_skb_prv(skb)->skbcnt = 0;
 
         err = memcpy_from_msg(skb_put(skb, size), msg, size);
         if (err < 0)
diff --git a/net/ceph/ceph_common.c b/net/ceph/ceph_common.c
index cb7db320dd27..f30329f72641 100644
--- a/net/ceph/ceph_common.c
+++ b/net/ceph/ceph_common.c
@@ -9,6 +9,7 @@
 #include <keys/ceph-type.h>
 #include <linux/module.h>
 #include <linux/mount.h>
+#include <linux/nsproxy.h>
 #include <linux/parser.h>
 #include <linux/sched.h>
 #include <linux/seq_file.h>
@@ -16,8 +17,6 @@
 #include <linux/statfs.h>
 #include <linux/string.h>
 #include <linux/vmalloc.h>
-#include <linux/nsproxy.h>
-#include <net/net_namespace.h>
 
 
 #include <linux/ceph/ceph_features.h>
@@ -131,6 +130,13 @@ int ceph_compare_options(struct ceph_options *new_opt,
         int i;
         int ret;
 
+        /*
+         * Don't bother comparing options if network namespaces don't
+         * match.
+         */
+        if (!net_eq(current->nsproxy->net_ns, read_pnet(&client->msgr.net)))
+                return -1;
+
         ret = memcmp(opt1, opt2, ofs);
         if (ret)
                 return ret;
@@ -335,9 +341,6 @@ ceph_parse_options(char *options, const char *dev_name,
         int err = -ENOMEM;
         substring_t argstr[MAX_OPT_ARGS];
 
-        if (current->nsproxy->net_ns != &init_net)
-                return ERR_PTR(-EINVAL);
-
         opt = kzalloc(sizeof(*opt), GFP_KERNEL);
         if (!opt)
                 return ERR_PTR(-ENOMEM);
@@ -608,6 +611,7 @@ struct ceph_client *ceph_create_client(struct ceph_options *opt, void *private,
 fail_monc:
         ceph_monc_stop(&client->monc);
 fail:
+        ceph_messenger_fini(&client->msgr);
         kfree(client);
         return ERR_PTR(err);
 }
@@ -621,8 +625,8 @@ void ceph_destroy_client(struct ceph_client *client)
 
         /* unmount */
         ceph_osdc_stop(&client->osdc);
-
         ceph_monc_stop(&client->monc);
+        ceph_messenger_fini(&client->msgr);
 
         ceph_debugfs_client_cleanup(client);
 
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index 1679f47280e2..e3be1d22a247 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -6,6 +6,7 @@
 #include <linux/inet.h>
 #include <linux/kthread.h>
 #include <linux/net.h>
+#include <linux/nsproxy.h>
 #include <linux/slab.h>
 #include <linux/socket.h>
 #include <linux/string.h>
@@ -479,7 +480,7 @@ static int ceph_tcp_connect(struct ceph_connection *con)
         int ret;
 
         BUG_ON(con->sock);
-        ret = sock_create_kern(&init_net, con->peer_addr.in_addr.ss_family,
+        ret = sock_create_kern(read_pnet(&con->msgr->net), paddr->ss_family,
                                SOCK_STREAM, IPPROTO_TCP, &sock);
         if (ret)
                 return ret;
@@ -1731,17 +1732,17 @@ static int verify_hello(struct ceph_connection *con)
 
 static bool addr_is_blank(struct sockaddr_storage *ss)
 {
+        struct in_addr *addr = &((struct sockaddr_in *)ss)->sin_addr;
+        struct in6_addr *addr6 = &((struct sockaddr_in6 *)ss)->sin6_addr;
+
         switch (ss->ss_family) {
         case AF_INET:
-                return ((struct sockaddr_in *)ss)->sin_addr.s_addr == 0;
+                return addr->s_addr == htonl(INADDR_ANY);
         case AF_INET6:
-                return
-                     ((struct sockaddr_in6 *)ss)->sin6_addr.s6_addr32[0] == 0 &&
-                     ((struct sockaddr_in6 *)ss)->sin6_addr.s6_addr32[1] == 0 &&
-                     ((struct sockaddr_in6 *)ss)->sin6_addr.s6_addr32[2] == 0 &&
-                     ((struct sockaddr_in6 *)ss)->sin6_addr.s6_addr32[3] == 0;
+                return ipv6_addr_any(addr6);
+        default:
+                return true;
         }
-        return false;
 }
 
 static int addr_port(struct sockaddr_storage *ss)
@@ -2944,11 +2945,18 @@ void ceph_messenger_init(struct ceph_messenger *msgr,
         msgr->tcp_nodelay = tcp_nodelay;
 
         atomic_set(&msgr->stopping, 0);
+        write_pnet(&msgr->net, get_net(current->nsproxy->net_ns));
 
         dout("%s %p\n", __func__, msgr);
 }
 EXPORT_SYMBOL(ceph_messenger_init);
 
+void ceph_messenger_fini(struct ceph_messenger *msgr)
+{
+        put_net(read_pnet(&msgr->net));
+}
+EXPORT_SYMBOL(ceph_messenger_fini);
+
 static void clear_standby(struct ceph_connection *con)
 {
         /* come back from STANDBY? */
diff --git a/net/core/datagram.c b/net/core/datagram.c
index b80fb91bb3f7..4967262b2707 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -131,6 +131,35 @@ out_noerr:
         goto out;
 }
 
+static int skb_set_peeked(struct sk_buff *skb)
+{
+        struct sk_buff *nskb;
+
+        if (skb->peeked)
+                return 0;
+
+        /* We have to unshare an skb before modifying it. */
+        if (!skb_shared(skb))
+                goto done;
+
+        nskb = skb_clone(skb, GFP_ATOMIC);
+        if (!nskb)
+                return -ENOMEM;
+
+        skb->prev->next = nskb;
+        skb->next->prev = nskb;
+        nskb->prev = skb->prev;
+        nskb->next = skb->next;
+
+        consume_skb(skb);
+        skb = nskb;
+
+done:
+        skb->peeked = 1;
+
+        return 0;
+}
+
 /**
  *      __skb_recv_datagram - Receive a datagram skbuff
  *      @sk: socket
@@ -165,7 +194,9 @@ out_noerr:
 struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
                                     int *peeked, int *off, int *err)
 {
+        struct sk_buff_head *queue = &sk->sk_receive_queue;
         struct sk_buff *skb, *last;
+        unsigned long cpu_flags;
         long timeo;
         /*
          * Caller is allowed not to check sk->sk_err before skb_recv_datagram()
@@ -184,8 +215,6 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
                  * Look at current nfs client by the way...
                  * However, this function was correct in any case. 8)
                  */
-                unsigned long cpu_flags;
-                struct sk_buff_head *queue = &sk->sk_receive_queue;
                 int _off = *off;
 
                 last = (struct sk_buff *)queue;
@@ -199,7 +228,11 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
                                         _off -= skb->len;
                                         continue;
                                 }
-                                skb->peeked = 1;
+
+                                error = skb_set_peeked(skb);
+                                if (error)
+                                        goto unlock_err;
+
                                 atomic_inc(&skb->users);
                         } else
                                 __skb_unlink(skb, queue);
@@ -223,6 +256,8 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
 
         return NULL;
 
+unlock_err:
+        spin_unlock_irqrestore(&queue->lock, cpu_flags);
 no_packet:
         *err = error;
         return NULL;
@@ -622,7 +657,8 @@ __sum16 __skb_checksum_complete_head(struct sk_buff *skb, int len)
                     !skb->csum_complete_sw)
                         netdev_rx_csum_fault(skb->dev);
         }
-        skb->csum_valid = !sum;
+        if (!skb_shared(skb))
+                skb->csum_valid = !sum;
         return sum;
 }
 EXPORT_SYMBOL(__skb_checksum_complete_head);
@@ -642,11 +678,13 @@ __sum16 __skb_checksum_complete(struct sk_buff *skb)
                         netdev_rx_csum_fault(skb->dev);
         }
 
-        /* Save full packet checksum */
-        skb->csum = csum;
-        skb->ip_summed = CHECKSUM_COMPLETE;
-        skb->csum_complete_sw = 1;
-        skb->csum_valid = !sum;
+        if (!skb_shared(skb)) {
+                /* Save full packet checksum */
+                skb->csum = csum;
+                skb->ip_summed = CHECKSUM_COMPLETE;
+                skb->csum_complete_sw = 1;
+                skb->csum_valid = !sum;
+        }
 
         return sum;
 }
diff --git a/net/core/dev.c b/net/core/dev.c
index 6778a9999d52..a8e4dd430285 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -677,10 +677,6 @@ int dev_get_iflink(const struct net_device *dev)
         if (dev->netdev_ops && dev->netdev_ops->ndo_get_iflink)
                 return dev->netdev_ops->ndo_get_iflink(dev);
 
-        /* If dev->rtnl_link_ops is set, it's a virtual interface. */
-        if (dev->rtnl_link_ops)
-                return 0;
-
         return dev->ifindex;
 }
 EXPORT_SYMBOL(dev_get_iflink);
@@ -3452,6 +3448,8 @@ static int enqueue_to_backlog(struct sk_buff *skb, int cpu,
         local_irq_save(flags);
 
         rps_lock(sd);
+        if (!netif_running(skb->dev))
+                goto drop;
         qlen = skb_queue_len(&sd->input_pkt_queue);
         if (qlen <= netdev_max_backlog && !skb_flow_limit(skb, qlen)) {
                 if (qlen) {
@@ -3473,6 +3471,7 @@ enqueue:
                 goto enqueue;
         }
 
+drop:
         sd->dropped++;
         rps_unlock(sd);
 
@@ -3775,8 +3774,6 @@ static int __netif_receive_skb_core(struct sk_buff *skb, bool pfmemalloc)
 
         pt_prev = NULL;
 
-        rcu_read_lock();
-
 another_round:
         skb->skb_iif = skb->dev->ifindex;
 
@@ -3786,7 +3783,7 @@ another_round:
             skb->protocol == cpu_to_be16(ETH_P_8021AD)) {
                 skb = skb_vlan_untag(skb);
                 if (unlikely(!skb))
-                        goto unlock;
+                        goto out;
         }
 
 #ifdef CONFIG_NET_CLS_ACT
@@ -3816,10 +3813,10 @@ skip_taps:
         if (static_key_false(&ingress_needed)) {
                 skb = handle_ing(skb, &pt_prev, &ret, orig_dev);
                 if (!skb)
-                        goto unlock;
+                        goto out;
 
                 if (nf_ingress(skb, &pt_prev, &ret, orig_dev) < 0)
-                        goto unlock;
+                        goto out;
         }
 #endif
 #ifdef CONFIG_NET_CLS_ACT
@@ -3837,7 +3834,7 @@ ncls:
                 if (vlan_do_receive(&skb))
                         goto another_round;
                 else if (unlikely(!skb))
-                        goto unlock;
+                        goto out;
         }
 
         rx_handler = rcu_dereference(skb->dev->rx_handler);
@@ -3849,7 +3846,7 @@ ncls:
                 switch (rx_handler(&skb)) {
                 case RX_HANDLER_CONSUMED:
                         ret = NET_RX_SUCCESS;
-                        goto unlock;
+                        goto out;
                 case RX_HANDLER_ANOTHER:
                         goto another_round;
                 case RX_HANDLER_EXACT:
@@ -3903,8 +3900,7 @@ drop:
                 ret = NET_RX_DROP;
         }
 
-unlock:
-        rcu_read_unlock();
+out:
         return ret;
 }
 
@@ -3935,29 +3931,30 @@ static int __netif_receive_skb(struct sk_buff *skb)
 
 static int netif_receive_skb_internal(struct sk_buff *skb)
 {
+        int ret;
+
         net_timestamp_check(netdev_tstamp_prequeue, skb);
 
         if (skb_defer_rx_timestamp(skb))
                 return NET_RX_SUCCESS;
 
+        rcu_read_lock();
+
 #ifdef CONFIG_RPS
         if (static_key_false(&rps_needed)) {
                 struct rps_dev_flow voidflow, *rflow = &voidflow;
-                int cpu, ret;
-
-                rcu_read_lock();
-
-                cpu = get_rps_cpu(skb->dev, skb, &rflow);
+                int cpu = get_rps_cpu(skb->dev, skb, &rflow);
 
                 if (cpu >= 0) {
                         ret = enqueue_to_backlog(skb, cpu, &rflow->last_qtail);
                         rcu_read_unlock();
                         return ret;
                 }
-                rcu_read_unlock();
         }
 #endif
-        return __netif_receive_skb(skb);
+        ret = __netif_receive_skb(skb);
+        rcu_read_unlock();
+        return ret;
 }
 
 /**
@@ -4502,8 +4499,10 @@ static int process_backlog(struct napi_struct *napi, int quota)
                 struct sk_buff *skb;
 
                 while ((skb = __skb_dequeue(&sd->process_queue))) {
+                        rcu_read_lock();
                         local_irq_enable();
                         __netif_receive_skb(skb);
+                        rcu_read_unlock();
                         local_irq_disable();
                         input_queue_head_incr(sd);
                         if (++work >= quota) {
@@ -6139,6 +6138,7 @@ static void rollback_registered_many(struct list_head *head)
                 unlist_netdevice(dev);
 
                 dev->reg_state = NETREG_UNREGISTERING;
+                on_each_cpu(flush_backlog, dev, 1);
         }
 
         synchronize_net();
@@ -6409,7 +6409,8 @@ static int netif_alloc_netdev_queues(struct net_device *dev)
         struct netdev_queue *tx;
         size_t sz = count * sizeof(*tx);
 
-        BUG_ON(count < 1 || count > 0xffff);
+        if (count < 1 || count > 0xffff)
+                return -EINVAL;
 
         tx = kzalloc(sz, GFP_KERNEL | __GFP_NOWARN | __GFP_REPEAT);
         if (!tx) {
@@ -6773,8 +6774,6 @@ void netdev_run_todo(void)
 
                 dev->reg_state = NETREG_UNREGISTERED;
 
-                on_each_cpu(flush_backlog, dev, 1);
-
                 netdev_wait_allrefs(dev);
 
                 /* paranoia */
diff --git a/net/core/dst.c b/net/core/dst.c
index e956ce6d1378..002144bea935 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -284,7 +284,9 @@ void dst_release(struct dst_entry *dst)
                 int newrefcnt;
 
                 newrefcnt = atomic_dec_return(&dst->__refcnt);
-                WARN_ON(newrefcnt < 0);
+                if (unlikely(newrefcnt < 0))
+                        net_warn_ratelimited("%s: dst:%p refcnt:%d\n",
+                                             __func__, dst, newrefcnt);
                 if (unlikely(dst->flags & DST_NOCACHE) && !newrefcnt)
                         call_rcu(&dst->rcu_head, dst_destroy_rcu);
         }
diff --git a/net/core/gen_estimator.c b/net/core/gen_estimator.c
index 9dfb88a933e7..92d886f4adcb 100644
--- a/net/core/gen_estimator.c
+++ b/net/core/gen_estimator.c
@@ -66,7 +66,7 @@
 
    NOTES.
 
-   * avbps is scaled by 2^5, avpps is scaled by 2^10.
+   * avbps and avpps are scaled by 2^5.
    * both values are reported as 32 bit unsigned values. bps can
      overflow for fast links : max speed being 34360Mbit/sec
    * Minimal interval is HZ/4=250msec (it is the greatest common divisor
@@ -85,10 +85,10 @@ struct gen_estimator
         struct gnet_stats_rate_est64    *rate_est;
         spinlock_t              *stats_lock;
         int                     ewma_log;
+        u32                     last_packets;
+        unsigned long           avpps;
         u64                     last_bytes;
         u64                     avbps;
-        u32                     last_packets;
-        u32                     avpps;
         struct rcu_head         e_rcu;
         struct rb_node          node;
         struct gnet_stats_basic_cpu __percpu *cpu_bstats;
@@ -118,8 +118,8 @@ static void est_timer(unsigned long arg)
         rcu_read_lock();
         list_for_each_entry_rcu(e, &elist[idx].list, list) {
                 struct gnet_stats_basic_packed b = {0};
+                unsigned long rate;
                 u64 brate;
-                u32 rate;
 
                 spin_lock(e->stats_lock);
                 read_lock(&est_lock);
@@ -133,10 +133,11 @@ static void est_timer(unsigned long arg)
                 e->avbps += (brate >> e->ewma_log) - (e->avbps >> e->ewma_log);
                 e->rate_est->bps = (e->avbps+0xF)>>5;
 
-                rate = (b.packets - e->last_packets)<<(12 - idx);
+                rate = b.packets - e->last_packets;
+                rate <<= (7 - idx);
                 e->last_packets = b.packets;
                 e->avpps += (rate >> e->ewma_log) - (e->avpps >> e->ewma_log);
-                e->rate_est->pps = (e->avpps+0x1FF)>>10;
+                e->rate_est->pps = (e->avpps + 0xF) >> 5;
 skip:
                 read_unlock(&est_lock);
                 spin_unlock(e->stats_lock);
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 05badbb58865..1ebdf1c0d118 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -3571,13 +3571,6 @@ static int pktgen_thread_worker(void *arg)
         pr_debug("%s removing thread\n", t->tsk->comm);
         pktgen_rem_thread(t);
 
-        /* Wait for kthread_stop */
-        while (!kthread_should_stop()) {
-                set_current_state(TASK_INTERRUPTIBLE);
-                schedule();
-        }
-        __set_current_state(TASK_RUNNING);
-
         return 0;
 }
 
@@ -3769,6 +3762,7 @@ static int __net_init pktgen_create_thread(int cpu, struct pktgen_net *pn)
         }
 
         t->net = pn;
+        get_task_struct(p);
         wake_up_process(p);
         wait_for_completion(&t->start_done);
 
@@ -3891,6 +3885,7 @@ static void __net_exit pg_net_exit(struct net *net)
                 t = list_entry(q, struct pktgen_thread, th_list);
                 list_del(&t->th_list);
                 kthread_stop(t->tsk);
+                put_task_struct(t->tsk);
                 kfree(t);
         }
 
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 01ced4a889e0..dc004b1e1f85 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1328,10 +1328,6 @@ static const struct nla_policy ifla_info_policy[IFLA_INFO_MAX+1] = {
         [IFLA_INFO_SLAVE_DATA]  = { .type = NLA_NESTED },
 };
 
-static const struct nla_policy ifla_vfinfo_policy[IFLA_VF_INFO_MAX+1] = {
-        [IFLA_VF_INFO]          = { .type = NLA_NESTED },
-};
-
 static const struct nla_policy ifla_vf_policy[IFLA_VF_MAX+1] = {
         [IFLA_VF_MAC]           = { .len = sizeof(struct ifla_vf_mac) },
         [IFLA_VF_VLAN]          = { .len = sizeof(struct ifla_vf_vlan) },
@@ -1488,96 +1484,98 @@ static int validate_linkmsg(struct net_device *dev, struct nlattr *tb[])
         return 0;
 }
 
-static int do_setvfinfo(struct net_device *dev, struct nlattr *attr)
+static int do_setvfinfo(struct net_device *dev, struct nlattr **tb)
 {
-        int rem, err = -EINVAL;
-        struct nlattr *vf;
         const struct net_device_ops *ops = dev->netdev_ops;
+        int err = -EINVAL;
 
-        nla_for_each_nested(vf, attr, rem) {
-                switch (nla_type(vf)) {
-                case IFLA_VF_MAC: {
-                        struct ifla_vf_mac *ivm;
-                        ivm = nla_data(vf);
-                        err = -EOPNOTSUPP;
-                        if (ops->ndo_set_vf_mac)
-                                err = ops->ndo_set_vf_mac(dev, ivm->vf,
-                                                          ivm->mac);
-                        break;
-                }
-                case IFLA_VF_VLAN: {
-                        struct ifla_vf_vlan *ivv;
-                        ivv = nla_data(vf);
-                        err = -EOPNOTSUPP;
-                        if (ops->ndo_set_vf_vlan)
-                                err = ops->ndo_set_vf_vlan(dev, ivv->vf,
-                                                           ivv->vlan,
-                                                           ivv->qos);
-                        break;
-                }
-                case IFLA_VF_TX_RATE: {
-                        struct ifla_vf_tx_rate *ivt;
-                        struct ifla_vf_info ivf;
-                        ivt = nla_data(vf);
-                        err = -EOPNOTSUPP;
-                        if (ops->ndo_get_vf_config)
-                                err = ops->ndo_get_vf_config(dev, ivt->vf,
-                                                             &ivf);
-                        if (err)
-                                break;
-                        err = -EOPNOTSUPP;
-                        if (ops->ndo_set_vf_rate)
-                                err = ops->ndo_set_vf_rate(dev, ivt->vf,
-                                                           ivf.min_tx_rate,
-                                                           ivt->rate);
-                        break;
-                }
-                case IFLA_VF_RATE: {
-                        struct ifla_vf_rate *ivt;
-                        ivt = nla_data(vf);
-                        err = -EOPNOTSUPP;
-                        if (ops->ndo_set_vf_rate)
-                                err = ops->ndo_set_vf_rate(dev, ivt->vf,
-                                                           ivt->min_tx_rate,
-                                                           ivt->max_tx_rate);
-                        break;
-                }
-                case IFLA_VF_SPOOFCHK: {
-                        struct ifla_vf_spoofchk *ivs;
-                        ivs = nla_data(vf);
-                        err = -EOPNOTSUPP;
-                        if (ops->ndo_set_vf_spoofchk)
-                                err = ops->ndo_set_vf_spoofchk(dev, ivs->vf,
-                                                               ivs->setting);
-                        break;
-                }
-                case IFLA_VF_LINK_STATE: {
-                        struct ifla_vf_link_state *ivl;
-                        ivl = nla_data(vf);
-                        err = -EOPNOTSUPP;
-                        if (ops->ndo_set_vf_link_state)
-                                err = ops->ndo_set_vf_link_state(dev, ivl->vf,
-                                                                 ivl->link_state);
-                        break;
-                }
-                case IFLA_VF_RSS_QUERY_EN: {
-                        struct ifla_vf_rss_query_en *ivrssq_en;
+        if (tb[IFLA_VF_MAC]) {
+                struct ifla_vf_mac *ivm = nla_data(tb[IFLA_VF_MAC]);
 
-                        ivrssq_en = nla_data(vf);
-                        err = -EOPNOTSUPP;
-                        if (ops->ndo_set_vf_rss_query_en)
-                                err = ops->ndo_set_vf_rss_query_en(dev,
-                                                            ivrssq_en->vf,
-                                                            ivrssq_en->setting);
-                        break;
-                }
-                default:
-                        err = -EINVAL;
-                        break;
-                }
-                if (err)
-                        break;
+                err = -EOPNOTSUPP;
+                if (ops->ndo_set_vf_mac)
+                        err = ops->ndo_set_vf_mac(dev, ivm->vf,
+                                                  ivm->mac);
+                if (err < 0)
+                        return err;
+        }
+
+        if (tb[IFLA_VF_VLAN]) {
+                struct ifla_vf_vlan *ivv = nla_data(tb[IFLA_VF_VLAN]);
+
+                err = -EOPNOTSUPP;
+                if (ops->ndo_set_vf_vlan)
+                        err = ops->ndo_set_vf_vlan(dev, ivv->vf, ivv->vlan,
+                                                   ivv->qos);
+                if (err < 0)
+                        return err;
+        }
+
+        if (tb[IFLA_VF_TX_RATE]) {
+                struct ifla_vf_tx_rate *ivt = nla_data(tb[IFLA_VF_TX_RATE]);
+                struct ifla_vf_info ivf;
+
+                err = -EOPNOTSUPP;
+                if (ops->ndo_get_vf_config)
+                        err = ops->ndo_get_vf_config(dev, ivt->vf, &ivf);
+                if (err < 0)
+                        return err;
+
+                err = -EOPNOTSUPP;
+                if (ops->ndo_set_vf_rate)
+                        err = ops->ndo_set_vf_rate(dev, ivt->vf,
+                                                   ivf.min_tx_rate,
+                                                   ivt->rate);
+                if (err < 0)
+                        return err;
+        }
+
+        if (tb[IFLA_VF_RATE]) {
+                struct ifla_vf_rate *ivt = nla_data(tb[IFLA_VF_RATE]);
+
+                err = -EOPNOTSUPP;
+                if (ops->ndo_set_vf_rate)
+                        err = ops->ndo_set_vf_rate(dev, ivt->vf,
+                                                   ivt->min_tx_rate,
+                                                   ivt->max_tx_rate);
+                if (err < 0)
+                        return err;
+        }
+
+        if (tb[IFLA_VF_SPOOFCHK]) {
+                struct ifla_vf_spoofchk *ivs = nla_data(tb[IFLA_VF_SPOOFCHK]);
+
+                err = -EOPNOTSUPP;
+                if (ops->ndo_set_vf_spoofchk)
+                        err = ops->ndo_set_vf_spoofchk(dev, ivs->vf,
+                                                       ivs->setting);
+                if (err < 0)
+                        return err;
         }
+
+        if (tb[IFLA_VF_LINK_STATE]) {
+                struct ifla_vf_link_state *ivl = nla_data(tb[IFLA_VF_LINK_STATE]);
+
+                err = -EOPNOTSUPP;
+                if (ops->ndo_set_vf_link_state)
+                        err = ops->ndo_set_vf_link_state(dev, ivl->vf,
+                                                         ivl->link_state);
+                if (err < 0)
+                        return err;
+        }
+
+        if (tb[IFLA_VF_RSS_QUERY_EN]) {
+                struct ifla_vf_rss_query_en *ivrssq_en;
+
+                err = -EOPNOTSUPP;
+                ivrssq_en = nla_data(tb[IFLA_VF_RSS_QUERY_EN]);
+                if (ops->ndo_set_vf_rss_query_en)
+                        err = ops->ndo_set_vf_rss_query_en(dev, ivrssq_en->vf,
+                                                           ivrssq_en->setting);
+                if (err < 0)
+                        return err;
+        }
+
         return err;
 }
 
@@ -1773,14 +1771,21 @@ static int do_setlink(const struct sk_buff *skb,
         }
 
         if (tb[IFLA_VFINFO_LIST]) {
+                struct nlattr *vfinfo[IFLA_VF_MAX + 1];
                 struct nlattr *attr;
                 int rem;
+
                 nla_for_each_nested(attr, tb[IFLA_VFINFO_LIST], rem) {
-                        if (nla_type(attr) != IFLA_VF_INFO) {
+                        if (nla_type(attr) != IFLA_VF_INFO ||
+                            nla_len(attr) < NLA_HDRLEN) {
                                 err = -EINVAL;
                                 goto errout;
                         }
-                        err = do_setvfinfo(dev, attr);
+                        err = nla_parse_nested(vfinfo, IFLA_VF_MAX, attr,
+                                               ifla_vf_policy);
+                        if (err < 0)
+                                goto errout;
+                        err = do_setvfinfo(dev, vfinfo);
                         if (err < 0)
                                 goto errout;
                         status |= DO_SETLINK_NOTIFY;
@@ -1799,10 +1804,13 @@ static int do_setlink(const struct sk_buff *skb,
                         goto errout;
 
                 nla_for_each_nested(attr, tb[IFLA_VF_PORTS], rem) {
-                        if (nla_type(attr) != IFLA_VF_PORT)
-                                continue;
-                        err = nla_parse_nested(port, IFLA_PORT_MAX,
-                                attr, ifla_port_policy);
+                        if (nla_type(attr) != IFLA_VF_PORT ||
+                            nla_len(attr) < NLA_HDRLEN) {
+                                err = -EINVAL;
+                                goto errout;
+                        }
+                        err = nla_parse_nested(port, IFLA_PORT_MAX, attr,
+                                               ifla_port_policy);
                         if (err < 0)
                                 goto errout;
                         if (!port[IFLA_PORT_VF]) {
diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c
index 392e29a0227d..b445d492c115 100644
--- a/net/dsa/dsa.c
+++ b/net/dsa/dsa.c
@@ -630,7 +630,7 @@ static int dsa_of_probe(struct device *dev)
                         continue;
 
                 cd->sw_addr = be32_to_cpup(sw_addr);
-                if (cd->sw_addr > PHY_MAX_ADDR)
+                if (cd->sw_addr >= PHY_MAX_ADDR)
                         continue;
 
                 if (!of_property_read_u32(child, "eeprom-length", &eeprom_len))
@@ -642,6 +642,8 @@ static int dsa_of_probe(struct device *dev)
                                 continue;
 
                         port_index = be32_to_cpup(port_reg);
+                        if (port_index >= DSA_MAX_PORTS)
+                                break;
 
                         port_name = of_get_property(port, "label", NULL);
                         if (!port_name)
@@ -666,8 +668,6 @@ static int dsa_of_probe(struct device *dev)
                                         goto out_free_chip;
                         }
 
-                        if (port_index == DSA_MAX_PORTS)
-                                break;
                 }
         }
 
diff --git a/net/ipv4/datagram.c b/net/ipv4/datagram.c
index 90c0e8386116..574fad9cca05 100644
--- a/net/ipv4/datagram.c
+++ b/net/ipv4/datagram.c
@@ -20,7 +20,7 @@
 #include <net/route.h>
 #include <net/tcp_states.h>
 
-int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+int __ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 {
         struct inet_sock *inet = inet_sk(sk);
         struct sockaddr_in *usin = (struct sockaddr_in *) uaddr;
@@ -39,8 +39,6 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 
         sk_dst_reset(sk);
 
-        lock_sock(sk);
-
         oif = sk->sk_bound_dev_if;
         saddr = inet->inet_saddr;
         if (ipv4_is_multicast(usin->sin_addr.s_addr)) {
@@ -82,9 +80,19 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         sk_dst_set(sk, &rt->dst);
         err = 0;
 out:
-        release_sock(sk);
         return err;
 }
+EXPORT_SYMBOL(__ip4_datagram_connect);
+
+int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+{
+        int res;
+
+        lock_sock(sk);
+        res = __ip4_datagram_connect(sk, uaddr, addr_len);
+        release_sock(sk);
+        return res;
+}
 EXPORT_SYMBOL(ip4_datagram_connect);
 
 /* Because UDP xmit path can manipulate sk_dst_cache without holding
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 7498716e8f54..e813196c91c7 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -1740,6 +1740,8 @@ static int inet_netconf_msgsize_devconf(int type)
                 size += nla_total_size(4);
         if (type == -1 || type == NETCONFA_PROXY_NEIGH)
                 size += nla_total_size(4);
+        if (type == -1 || type == NETCONFA_IGNORE_ROUTES_WITH_LINKDOWN)
+                size += nla_total_size(4);
 
         return size;
 }
@@ -1780,6 +1782,10 @@ static int inet_netconf_fill_devconf(struct sk_buff *skb, int ifindex,
             nla_put_s32(skb, NETCONFA_PROXY_NEIGH,
                         IPV4_DEVCONF(*devconf, PROXY_ARP)) < 0)
                 goto nla_put_failure;
+        if ((type == -1 || type == NETCONFA_IGNORE_ROUTES_WITH_LINKDOWN) &&
+            nla_put_s32(skb, NETCONFA_IGNORE_ROUTES_WITH_LINKDOWN,
+                        IPV4_DEVCONF(*devconf, IGNORE_ROUTES_WITH_LINKDOWN)) < 0)
+                goto nla_put_failure;
 
         nlmsg_end(skb, nlh);
         return 0;
@@ -1819,6 +1825,7 @@ static const struct nla_policy devconf_ipv4_policy[NETCONFA_MAX+1] = {
         [NETCONFA_FORWARDING]   = { .len = sizeof(int) },
         [NETCONFA_RP_FILTER]    = { .len = sizeof(int) },
         [NETCONFA_PROXY_NEIGH]  = { .len = sizeof(int) },
+        [NETCONFA_IGNORE_ROUTES_WITH_LINKDOWN]  = { .len = sizeof(int) },
 };
 
 static int inet_netconf_get_devconf(struct sk_buff *in_skb,
@@ -2048,6 +2055,12 @@ static int devinet_conf_proc(struct ctl_table *ctl, int write,
                         inet_netconf_notify_devconf(net, NETCONFA_PROXY_NEIGH,
                                                     ifindex, cnf);
                 }
+                if (i == IPV4_DEVCONF_IGNORE_ROUTES_WITH_LINKDOWN - 1 &&
+                    new_value != old_value) {
+                        ifindex = devinet_conf_ifindex(net, cnf);
+                        inet_netconf_notify_devconf(net, NETCONFA_IGNORE_ROUTES_WITH_LINKDOWN,
+                                                    ifindex, cnf);
+                }
         }
 
         return ret;
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index 9bc26677058e..c3b1f3a0f4cf 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -152,8 +152,8 @@ int inet_sk_diag_fill(struct sock *sk, struct inet_connection_sock *icsk,
                                        inet6_sk(sk)->tclass) < 0)
                                 goto errout;
 
-                if (ipv6_only_sock(sk) &&
-                    nla_put_u8(skb, INET_DIAG_SKV6ONLY, 1))
+                if (((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE)) &&
+                    nla_put_u8(skb, INET_DIAG_SKV6ONLY, ipv6_only_sock(sk)))
                         goto errout;
         }
 #endif
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 5f9b063bbe8a..0cb9165421d4 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -624,22 +624,21 @@ EXPORT_SYMBOL_GPL(inet_hashinfo_init);
 
 int inet_ehash_locks_alloc(struct inet_hashinfo *hashinfo)
 {
+        unsigned int locksz = sizeof(spinlock_t);
         unsigned int i, nblocks = 1;
 
-        if (sizeof(spinlock_t) != 0) {
+        if (locksz != 0) {
                 /* allocate 2 cache lines or at least one spinlock per cpu */
-                nblocks = max_t(unsigned int,
-                                2 * L1_CACHE_BYTES / sizeof(spinlock_t),
-                                1);
+                nblocks = max(2U * L1_CACHE_BYTES / locksz, 1U);
                 nblocks = roundup_pow_of_two(nblocks * num_possible_cpus());
 
                 /* no more locks than number of hash buckets */
                 nblocks = min(nblocks, hashinfo->ehash_mask + 1);
 
-                hashinfo->ehash_locks = kmalloc_array(nblocks, sizeof(spinlock_t),
+                hashinfo->ehash_locks = kmalloc_array(nblocks, locksz,
                                                       GFP_KERNEL | __GFP_NOWARN);
                 if (!hashinfo->ehash_locks)
-                        hashinfo->ehash_locks = vmalloc(nblocks * sizeof(spinlock_t));
+                        hashinfo->ehash_locks = vmalloc(nblocks * locksz);
 
                 if (!hashinfo->ehash_locks)
                         return -ENOMEM;
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index a50dc6d408d1..31f71b15cfba 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -351,7 +351,7 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
         ihl = ip_hdrlen(skb);
 
         /* Determine the position of this fragment. */
-        end = offset + skb->len - ihl;
+        end = offset + skb->len - skb_network_offset(skb) - ihl;
         err = -EINVAL;
 
         /* Is this the final fragment? */
@@ -381,7 +381,7 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
                 goto err;
 
         err = -ENOMEM;
-        if (!pskb_pull(skb, ihl))
+        if (!pskb_pull(skb, skb_network_offset(skb) + ihl))
                 goto err;
 
         err = pskb_trim_rcsum(skb, end - offset);
@@ -641,6 +641,8 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev,
                 iph->frag_off = 0;
         }
 
+        ip_send_check(iph);
+
         IP_INC_STATS_BH(net, IPSTATS_MIB_REASMOKS);
         qp->q.fragments = NULL;
         qp->q.fragments_tail = NULL;
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index 4c2c3ba4ba65..626d9e56a6bd 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -586,7 +586,8 @@ int ip_tunnel_encap(struct sk_buff *skb, struct ip_tunnel *t,
 EXPORT_SYMBOL(ip_tunnel_encap);
 
 static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb,
-                            struct rtable *rt, __be16 df)
+                            struct rtable *rt, __be16 df,
+                            const struct iphdr *inner_iph)
 {
         struct ip_tunnel *tunnel = netdev_priv(dev);
         int pkt_size = skb->len - tunnel->hlen - dev->hard_header_len;
@@ -603,7 +604,8 @@ static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb,
 
         if (skb->protocol == htons(ETH_P_IP)) {
                 if (!skb_is_gso(skb) &&
-                    (df & htons(IP_DF)) && mtu < pkt_size) {
+                    (inner_iph->frag_off & htons(IP_DF)) &&
+                    mtu < pkt_size) {
                         memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
                         icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu));
                         return -E2BIG;
@@ -737,7 +739,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
                 goto tx_error;
         }
 
-        if (tnl_update_pmtu(dev, skb, rt, tnl_params->frag_off)) {
+        if (tnl_update_pmtu(dev, skb, rt, tnl_params->frag_off, inner_iph)) {
                 ip_rt_put(rt);
                 goto tx_error;
         }
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 95c9b6eece25..92305a1a021a 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -254,9 +254,10 @@ unsigned int arpt_do_table(struct sk_buff *skb,
         static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
         unsigned int verdict = NF_DROP;
         const struct arphdr *arp;
-        struct arpt_entry *e, *back;
+        struct arpt_entry *e, **jumpstack;
         const char *indev, *outdev;
         const void *table_base;
+        unsigned int cpu, stackidx = 0;
         const struct xt_table_info *private;
         struct xt_action_param acpar;
         unsigned int addend;
@@ -270,15 +271,16 @@ unsigned int arpt_do_table(struct sk_buff *skb,
         local_bh_disable();
         addend = xt_write_recseq_begin();
         private = table->private;
+        cpu     = smp_processor_id();
         /*
          * Ensure we load private-> members after we've fetched the base
          * pointer.
          */
         smp_read_barrier_depends();
         table_base = private->entries;
+        jumpstack  = (struct arpt_entry **)private->jumpstack[cpu];
 
         e = get_entry(table_base, private->hook_entry[hook]);
-        back = get_entry(table_base, private->underflow[hook]);
 
         acpar.in      = state->in;
         acpar.out     = state->out;
@@ -312,18 +314,23 @@ unsigned int arpt_do_table(struct sk_buff *skb,
                                         verdict = (unsigned int)(-v) - 1;
                                         break;
                                 }
-                                e = back;
-                                back = get_entry(table_base, back->comefrom);
+                                if (stackidx == 0) {
+                                        e = get_entry(table_base,
+                                                      private->underflow[hook]);
+                                } else {
+                                        e = jumpstack[--stackidx];
+                                        e = arpt_next_entry(e);
+                                }
                                 continue;
                         }
                         if (table_base + v
                             != arpt_next_entry(e)) {
-                                /* Save old back ptr in next entry */
-                                struct arpt_entry *next = arpt_next_entry(e);
-                                next->comefrom = (void *)back - table_base;
 
-                                /* set back pointer to next entry */
-                                back = next;
+                                if (stackidx >= private->stacksize) {
+                                        verdict = NF_DROP;
+                                        break;
+                                }
+                                jumpstack[stackidx++] = e;
                         }
 
                         e = get_entry(table_base, v);
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 684f095d196e..728f5b3d3c64 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1917,14 +1917,13 @@ void tcp_enter_loss(struct sock *sk)
         const struct inet_connection_sock *icsk = inet_csk(sk);
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *skb;
-        bool new_recovery = false;
+        bool new_recovery = icsk->icsk_ca_state < TCP_CA_Recovery;
         bool is_reneg;                  /* is receiver reneging on SACKs? */
 
         /* Reduce ssthresh if it has not yet been made inside this window. */
         if (icsk->icsk_ca_state <= TCP_CA_Disorder ||
             !after(tp->high_seq, tp->snd_una) ||
             (icsk->icsk_ca_state == TCP_CA_Loss && !icsk->icsk_retransmits)) {
-                new_recovery = true;
                 tp->prior_ssthresh = tcp_current_ssthresh(sk);
                 tp->snd_ssthresh = icsk->icsk_ca_ops->ssthresh(sk);
                 tcp_ca_event(sk, CA_EVENT_LOSS);
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 62d908e64eeb..b10a88986a98 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -40,7 +40,7 @@ static bool ipv6_mapped_addr_any(const struct in6_addr *a)
         return ipv6_addr_v4mapped(a) && (a->s6_addr32[3] == 0);
 }
 
-int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+static int __ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 {
         struct sockaddr_in6     *usin = (struct sockaddr_in6 *) uaddr;
         struct inet_sock        *inet = inet_sk(sk);
@@ -56,7 +56,7 @@ int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         if (usin->sin6_family == AF_INET) {
                 if (__ipv6_only_sock(sk))
                         return -EAFNOSUPPORT;
-                err = ip4_datagram_connect(sk, uaddr, addr_len);
+                err = __ip4_datagram_connect(sk, uaddr, addr_len);
                 goto ipv4_connected;
         }
 
@@ -98,9 +98,9 @@ int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                 sin.sin_addr.s_addr = daddr->s6_addr32[3];
                 sin.sin_port = usin->sin6_port;
 
-                err = ip4_datagram_connect(sk,
-                                           (struct sockaddr *) &sin,
-                                           sizeof(sin));
+                err = __ip4_datagram_connect(sk,
+                                             (struct sockaddr *) &sin,
+                                             sizeof(sin));
 
 ipv4_connected:
                 if (err)
@@ -204,6 +204,16 @@ out:
         fl6_sock_release(flowlabel);
         return err;
 }
+
+int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+{
+        int res;
+
+        lock_sock(sk);
+        res = __ip6_datagram_connect(sk, uaddr, addr_len);
+        release_sock(sk);
+        return res;
+}
 EXPORT_SYMBOL_GPL(ip6_datagram_connect);
 
 int ip6_datagram_connect_v6_only(struct sock *sk, struct sockaddr *uaddr,
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index f2e464eba5ef..57990c929cd8 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -331,10 +331,10 @@ int ip6_mc_input(struct sk_buff *skb)
                                 if (offset < 0)
                                         goto out;
 
-                                if (!ipv6_is_mld(skb, nexthdr, offset))
-                                        goto out;
+                                if (ipv6_is_mld(skb, nexthdr, offset))
+                                        deliver = true;
 
-                                deliver = true;
+                                goto out;
                         }
                         /* unknown RA - process it normally */
                 }
diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
index e893cd18612f..08b62047c67f 100644
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c
@@ -292,8 +292,6 @@ static struct packet_offload ipv6_packet_offload __read_mostly = {
 static const struct net_offload sit_offload = {
         .callbacks = {
                 .gso_segment    = ipv6_gso_segment,
-                .gro_receive    = ipv6_gro_receive,
-                .gro_complete   = ipv6_gro_complete,
         },
 };
 
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 1a1122a6bbf5..6090969937f8 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -369,10 +369,7 @@ static void ip6_dst_destroy(struct dst_entry *dst)
         struct inet6_dev *idev;
 
         dst_destroy_metrics_generic(dst);
-
-        if (rt->rt6i_pcpu)
-                free_percpu(rt->rt6i_pcpu);
-
+        free_percpu(rt->rt6i_pcpu);
         rt6_uncached_list_del(rt);
 
         idev = rt->rt6i_idev;
diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index 29236e832e44..c09c0131bfa2 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -723,6 +723,7 @@ void ieee80211_debugfs_remove_netdev(struct ieee80211_sub_if_data *sdata)
 
         debugfs_remove_recursive(sdata->vif.debugfs_dir);
         sdata->vif.debugfs_dir = NULL;
+        sdata->debugfs.subdir_stations = NULL;
 }
 
 void ieee80211_debugfs_rename_netdev(struct ieee80211_sub_if_data *sdata)
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index ed1edac14372..553ac6dd4867 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1863,10 +1863,6 @@ void ieee80211_sdata_stop(struct ieee80211_sub_if_data *sdata)
         ieee80211_teardown_sdata(sdata);
 }
 
-/*
- * Remove all interfaces, may only be called at hardware unregistration
- * time because it doesn't do RCU-safe list removals.
- */
 void ieee80211_remove_interfaces(struct ieee80211_local *local)
 {
         struct ieee80211_sub_if_data *sdata, *tmp;
@@ -1875,14 +1871,21 @@ void ieee80211_remove_interfaces(struct ieee80211_local *local)
 
         ASSERT_RTNL();
 
-        /*
-         * Close all AP_VLAN interfaces first, as otherwise they
-         * might be closed while the AP interface they belong to
-         * is closed, causing unregister_netdevice_many() to crash.
+        /* Before destroying the interfaces, make sure they're all stopped so
+         * that the hardware is stopped. Otherwise, the driver might still be
+         * iterating the interfaces during the shutdown, e.g. from a worker
+         * or from RX processing or similar, and if it does so (using atomic
+         * iteration) while we're manipulating the list, the iteration will
+         * crash.
+         *
+         * After this, the hardware should be stopped and the driver should
+         * have stopped all of its activities, so that we can do RCU-unaware
+         * manipulations of the interface list below.
          */
-        list_for_each_entry(sdata, &local->interfaces, list)
-                if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-                        dev_close(sdata->dev);
+        cfg80211_shutdown_all_interfaces(local->hw.wiphy);
+
+        WARN(local->open_count, "%s: open count remains %d\n",
+             wiphy_name(local->hw.wiphy), local->open_count);
 
         mutex_lock(&local->iflist_mtx);
         list_for_each_entry_safe(sdata, tmp, &local->interfaces, list) {
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index 5438d13e2f00..3b59099413fb 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -306,7 +306,7 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
                 if (action == WLAN_SP_MESH_PEERING_CONFIRM) {
                         /* AID */
                         pos = skb_put(skb, 2);
-                        put_unaligned_le16(plid, pos + 2);
+                        put_unaligned_le16(plid, pos);
                 }
                 if (ieee80211_add_srates_ie(sdata, skb, true, band) ||
                     ieee80211_add_ext_srates_ie(sdata, skb, true, band) ||
@@ -1122,6 +1122,9 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata,
                                                 WLAN_SP_MESH_PEERING_CONFIRM) {
                 baseaddr += 4;
                 baselen += 4;
+
+                if (baselen > len)
+                        return;
         }
         ieee802_11_parse_elems(baseaddr, len - baselen, true, &elems);
         mesh_process_plink_frame(sdata, mgmt, &elems);
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index 06b60980c62c..b676b9fa707b 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -76,6 +76,22 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
                         if (sdata->vif.type != NL80211_IFTYPE_STATION)
                                 continue;
                         ieee80211_mgd_quiesce(sdata);
+                        /* If suspended during TX in progress, and wowlan
+                         * is enabled (connection will be active) there
+                         * can be a race where the driver is put out
+                         * of power-save due to TX and during suspend
+                         * dynamic_ps_timer is cancelled and TX packet
+                         * is flushed, leaving the driver in ACTIVE even
+                         * after resuming until dynamic_ps_timer puts
+                         * driver back in DOZE.
+                         */
+                        if (sdata->u.mgd.associated &&
+                            sdata->u.mgd.powersave &&
+                             !(local->hw.conf.flags & IEEE80211_CONF_PS)) {
+                                local->hw.conf.flags |= IEEE80211_CONF_PS;
+                                ieee80211_hw_config(local,
+                                                    IEEE80211_CONF_CHANGE_PS);
+                        }
                 }
 
                 err = drv_suspend(local, wowlan);
diff --git a/net/mac80211/tdls.c b/net/mac80211/tdls.c
index ad31b2dab4f5..8db6e2994bbc 100644
--- a/net/mac80211/tdls.c
+++ b/net/mac80211/tdls.c
@@ -60,6 +60,7 @@ ieee80211_tdls_add_subband(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_channel *ch;
         struct cfg80211_chan_def chandef;
         int i, subband_start;
+        struct wiphy *wiphy = sdata->local->hw.wiphy;
 
         for (i = start; i <= end; i += spacing) {
                 if (!ch_cnt)
@@ -70,9 +71,8 @@ ieee80211_tdls_add_subband(struct ieee80211_sub_if_data *sdata,
                         /* we will be active on the channel */
                         cfg80211_chandef_create(&chandef, ch,
                                                 NL80211_CHAN_NO_HT);
-                        if (cfg80211_reg_can_beacon(sdata->local->hw.wiphy,
-                                                    &chandef,
-                                                    sdata->wdev.iftype)) {
+                        if (cfg80211_reg_can_beacon_relax(wiphy, &chandef,
+                                                          sdata->wdev.iftype)) {
                                 ch_cnt++;
                                 /*
                                  * check if the next channel is also part of
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 8410bb3bf5e8..b8233505bf9f 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1117,7 +1117,9 @@ static bool ieee80211_tx_prep_agg(struct ieee80211_tx_data *tx,
                         queued = true;
                         info->control.vif = &tx->sdata->vif;
                         info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
-                        info->flags &= ~IEEE80211_TX_TEMPORARY_FLAGS;
+                        info->flags &= ~IEEE80211_TX_TEMPORARY_FLAGS |
+                                        IEEE80211_TX_CTL_NO_PS_BUFFER |
+                                        IEEE80211_TX_STATUS_EOSP;
                         __skb_queue_tail(&tid_tx->pending, skb);
                         if (skb_queue_len(&tid_tx->pending) > STA_MAX_TX_BUFFER)
                                 purge_skb = __skb_dequeue(&tid_tx->pending);
diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
index cd60d397fe05..8a8b2abc35ff 100644
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -213,7 +213,7 @@ void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict)
 
         if (verdict == NF_ACCEPT) {
         next_hook:
-                verdict = nf_iterate(&nf_hooks[entry->state.pf][entry->state.hook],
+                verdict = nf_iterate(entry->state.hook_list,
                                      skb, &entry->state, &elem);
         }
 
diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
index 8b117c90ecd7..0c0e8ecf02ab 100644
--- a/net/netfilter/nfnetlink.c
+++ b/net/netfilter/nfnetlink.c
@@ -269,6 +269,12 @@ static void nfnl_err_deliver(struct list_head *err_list, struct sk_buff *skb)
         }
 }
 
+enum {
+        NFNL_BATCH_FAILURE      = (1 << 0),
+        NFNL_BATCH_DONE         = (1 << 1),
+        NFNL_BATCH_REPLAY       = (1 << 2),
+};
+
 static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh,
                                 u_int16_t subsys_id)
 {
@@ -276,13 +282,15 @@ static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh,
         struct net *net = sock_net(skb->sk);
         const struct nfnetlink_subsystem *ss;
         const struct nfnl_callback *nc;
-        bool success = true, done = false;
         static LIST_HEAD(err_list);
+        u32 status;
         int err;
 
         if (subsys_id >= NFNL_SUBSYS_COUNT)
                 return netlink_ack(skb, nlh, -EINVAL);
 replay:
+        status = 0;
+
         skb = netlink_skb_clone(oskb, GFP_KERNEL);
         if (!skb)
                 return netlink_ack(oskb, nlh, -ENOMEM);
@@ -336,10 +344,10 @@ replay:
                 if (type == NFNL_MSG_BATCH_BEGIN) {
                         /* Malformed: Batch begin twice */
                         nfnl_err_reset(&err_list);
-                        success = false;
+                        status |= NFNL_BATCH_FAILURE;
                         goto done;
                 } else if (type == NFNL_MSG_BATCH_END) {
-                        done = true;
+                        status |= NFNL_BATCH_DONE;
                         goto done;
                 } else if (type < NLMSG_MIN_TYPE) {
                         err = -EINVAL;
@@ -382,11 +390,8 @@ replay:
                          * original skb.
                          */
                         if (err == -EAGAIN) {
-                                nfnl_err_reset(&err_list);
-                                ss->abort(oskb);
-                                nfnl_unlock(subsys_id);
-                                kfree_skb(skb);
-                                goto replay;
+                                status |= NFNL_BATCH_REPLAY;
+                                goto next;
                         }
                 }
 ack:
@@ -402,7 +407,7 @@ ack:
                                  */
                                 nfnl_err_reset(&err_list);
                                 netlink_ack(skb, nlmsg_hdr(oskb), -ENOMEM);
-                                success = false;
+                                status |= NFNL_BATCH_FAILURE;
                                 goto done;
                         }
                         /* We don't stop processing the batch on errors, thus,
@@ -410,19 +415,26 @@ ack:
                          * triggers.
                          */
                         if (err)
-                                success = false;
+                                status |= NFNL_BATCH_FAILURE;
                 }
-
+next:
                 msglen = NLMSG_ALIGN(nlh->nlmsg_len);
                 if (msglen > skb->len)
                         msglen = skb->len;
                 skb_pull(skb, msglen);
         }
 done:
-        if (success && done)
+        if (status & NFNL_BATCH_REPLAY) {
+                ss->abort(oskb);
+                nfnl_err_reset(&err_list);
+                nfnl_unlock(subsys_id);
+                kfree_skb(skb);
+                goto replay;
+        } else if (status == NFNL_BATCH_DONE) {
                 ss->commit(oskb);
-        else
+        } else {
                 ss->abort(oskb);
+        }
 
         nfnl_err_deliver(&err_list, oskb);
         nfnl_unlock(subsys_id);
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index dea925388a5b..d8e2e3918ce2 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -158,7 +158,7 @@ static int __netlink_remove_tap(struct netlink_tap *nt)
 out:
         spin_unlock(&netlink_tap_lock);
 
-        if (found && nt->module)
+        if (found)
                 module_put(nt->module);
 
         return found ? 0 : -ENODEV;
@@ -357,25 +357,52 @@ err1:
         return NULL;
 }
 
+
+static void
+__netlink_set_ring(struct sock *sk, struct nl_mmap_req *req, bool tx_ring, void **pg_vec,
+                   unsigned int order)
+{
+        struct netlink_sock *nlk = nlk_sk(sk);
+        struct sk_buff_head *queue;
+        struct netlink_ring *ring;
+
+        queue = tx_ring ? &sk->sk_write_queue : &sk->sk_receive_queue;
+        ring  = tx_ring ? &nlk->tx_ring : &nlk->rx_ring;
+
+        spin_lock_bh(&queue->lock);
+
+        ring->frame_max         = req->nm_frame_nr - 1;
+        ring->head              = 0;
+        ring->frame_size        = req->nm_frame_size;
+        ring->pg_vec_pages      = req->nm_block_size / PAGE_SIZE;
+
+        swap(ring->pg_vec_len, req->nm_block_nr);
+        swap(ring->pg_vec_order, order);
+        swap(ring->pg_vec, pg_vec);
+
+        __skb_queue_purge(queue);
+        spin_unlock_bh(&queue->lock);
+
+        WARN_ON(atomic_read(&nlk->mapped));
+
+        if (pg_vec)
+                free_pg_vec(pg_vec, order, req->nm_block_nr);
+}
+
 static int netlink_set_ring(struct sock *sk, struct nl_mmap_req *req,
-                            bool closing, bool tx_ring)
+                            bool tx_ring)
 {
         struct netlink_sock *nlk = nlk_sk(sk);
         struct netlink_ring *ring;
-        struct sk_buff_head *queue;
         void **pg_vec = NULL;
         unsigned int order = 0;
-        int err;
 
         ring  = tx_ring ? &nlk->tx_ring : &nlk->rx_ring;
-        queue = tx_ring ? &sk->sk_write_queue : &sk->sk_receive_queue;
 
-        if (!closing) {
-                if (atomic_read(&nlk->mapped))
-                        return -EBUSY;
-                if (atomic_read(&ring->pending))
-                        return -EBUSY;
-        }
+        if (atomic_read(&nlk->mapped))
+                return -EBUSY;
+        if (atomic_read(&ring->pending))
+                return -EBUSY;
 
         if (req->nm_block_nr) {
                 if (ring->pg_vec != NULL)
@@ -407,31 +434,19 @@ static int netlink_set_ring(struct sock *sk, struct nl_mmap_req *req,
                         return -EINVAL;
         }
 
-        err = -EBUSY;
         mutex_lock(&nlk->pg_vec_lock);
-        if (closing || atomic_read(&nlk->mapped) == 0) {
-                err = 0;
-                spin_lock_bh(&queue->lock);
-
-                ring->frame_max         = req->nm_frame_nr - 1;
-                ring->head              = 0;
-                ring->frame_size        = req->nm_frame_size;
-                ring->pg_vec_pages      = req->nm_block_size / PAGE_SIZE;
-
-                swap(ring->pg_vec_len, req->nm_block_nr);
-                swap(ring->pg_vec_order, order);
-                swap(ring->pg_vec, pg_vec);
-
-                __skb_queue_purge(queue);
-                spin_unlock_bh(&queue->lock);
-
-                WARN_ON(atomic_read(&nlk->mapped));
+        if (atomic_read(&nlk->mapped) == 0) {
+                __netlink_set_ring(sk, req, tx_ring, pg_vec, order);
+                mutex_unlock(&nlk->pg_vec_lock);
+                return 0;
         }
+
         mutex_unlock(&nlk->pg_vec_lock);
 
         if (pg_vec)
                 free_pg_vec(pg_vec, order, req->nm_block_nr);
-        return err;
+
+        return -EBUSY;
 }
 
 static void netlink_mm_open(struct vm_area_struct *vma)
@@ -900,10 +915,10 @@ static void netlink_sock_destruct(struct sock *sk)
 
                 memset(&req, 0, sizeof(req));
                 if (nlk->rx_ring.pg_vec)
-                        netlink_set_ring(sk, &req, true, false);
+                        __netlink_set_ring(sk, &req, false, NULL, 0);
                 memset(&req, 0, sizeof(req));
                 if (nlk->tx_ring.pg_vec)
-                        netlink_set_ring(sk, &req, true, true);
+                        __netlink_set_ring(sk, &req, true, NULL, 0);
         }
 #endif /* CONFIG_NETLINK_MMAP */
 
@@ -2223,7 +2238,7 @@ static int netlink_setsockopt(struct socket *sock, int level, int optname,
                         return -EINVAL;
                 if (copy_from_user(&req, optval, sizeof(req)))
                         return -EFAULT;
-                err = netlink_set_ring(sk, &req, false,
+                err = netlink_set_ring(sk, &req,
                                        optname == NETLINK_TX_RING);
                 break;
         }
diff --git a/net/openvswitch/flow_table.c b/net/openvswitch/flow_table.c
index 4613df8c8290..65523948fb95 100644
--- a/net/openvswitch/flow_table.c
+++ b/net/openvswitch/flow_table.c
@@ -752,7 +752,7 @@ int ovs_flow_init(void)
         BUILD_BUG_ON(sizeof(struct sw_flow_key) % sizeof(long));
 
         flow_cache = kmem_cache_create("sw_flow", sizeof(struct sw_flow)
-                                       + (num_possible_nodes()
+                                       + (nr_node_ids
                                           * sizeof(struct flow_stats *)),
                                        0, 0, NULL);
         if (flow_cache == NULL)
diff --git a/net/rds/ib_rdma.c b/net/rds/ib_rdma.c
index 273b8bff6ba4..657ba9f5d308 100644
--- a/net/rds/ib_rdma.c
+++ b/net/rds/ib_rdma.c
@@ -759,8 +759,10 @@ void *rds_ib_get_mr(struct scatterlist *sg, unsigned long nents,
         }
 
         ibmr = rds_ib_alloc_fmr(rds_ibdev);
-        if (IS_ERR(ibmr))
+        if (IS_ERR(ibmr)) {
+                rds_ib_dev_put(rds_ibdev);
                 return ibmr;
+        }
 
         ret = rds_ib_map_fmr(rds_ibdev, ibmr, sg, nents);
         if (ret == 0)
diff --git a/net/rds/transport.c b/net/rds/transport.c
index 8b4a6cd2c3a7..83498e1c75b8 100644
--- a/net/rds/transport.c
+++ b/net/rds/transport.c
@@ -73,7 +73,7 @@ EXPORT_SYMBOL_GPL(rds_trans_unregister);
 
 void rds_trans_put(struct rds_transport *trans)
 {
-        if (trans && trans->t_owner)
+        if (trans)
                 module_put(trans->t_owner);
 }
 
diff --git a/net/sched/act_bpf.c b/net/sched/act_bpf.c
index 1d56903fd4c7..1df78289e248 100644
--- a/net/sched/act_bpf.c
+++ b/net/sched/act_bpf.c
@@ -339,6 +339,9 @@ static void tcf_bpf_cleanup(struct tc_action *act, int bind)
                 bpf_prog_put(prog->filter);
         else
                 bpf_prog_destroy(prog->filter);
+
+        kfree(prog->bpf_ops);
+        kfree(prog->bpf_name);
 }
 
 static struct tc_action_ops act_bpf_ops __read_mostly = {
diff --git a/net/sched/cls_bpf.c b/net/sched/cls_bpf.c
index c79ecfd36e0f..e5168f8b9640 100644
--- a/net/sched/cls_bpf.c
+++ b/net/sched/cls_bpf.c
@@ -378,7 +378,7 @@ static int cls_bpf_change(struct net *net, struct sk_buff *in_skb,
                 goto errout;
 
         if (oldprog) {
-                list_replace_rcu(&prog->link, &oldprog->link);
+                list_replace_rcu(&oldprog->link, &prog->link);
                 tcf_unbind_filter(tp, &oldprog->res);
                 call_rcu(&oldprog->rcu, __cls_bpf_delete_prog);
         } else {
diff --git a/net/sched/cls_flow.c b/net/sched/cls_flow.c
index 76bc3a20ffdb..bb2a0f529c1f 100644
--- a/net/sched/cls_flow.c
+++ b/net/sched/cls_flow.c
@@ -425,6 +425,8 @@ static int flow_change(struct net *net, struct sk_buff *in_skb,
         if (!fnew)
                 goto err2;
 
+        tcf_exts_init(&fnew->exts, TCA_FLOW_ACT, TCA_FLOW_POLICE);
+
         fold = (struct flow_filter *)*arg;
         if (fold) {
                 err = -EINVAL;
@@ -486,7 +488,6 @@ static int flow_change(struct net *net, struct sk_buff *in_skb,
                 fnew->mask  = ~0U;
                 fnew->tp = tp;
                 get_random_bytes(&fnew->hashrnd, 4);
-                tcf_exts_init(&fnew->exts, TCA_FLOW_ACT, TCA_FLOW_POLICE);
         }
 
         fnew->perturb_timer.function = flow_perturbation;
@@ -526,7 +527,7 @@ static int flow_change(struct net *net, struct sk_buff *in_skb,
         if (*arg == 0)
                 list_add_tail_rcu(&fnew->list, &head->filters);
         else
-                list_replace_rcu(&fnew->list, &fold->list);
+                list_replace_rcu(&fold->list, &fnew->list);
 
         *arg = (unsigned long)fnew;
 
diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
index 9d37ccd95062..2f3d03f99487 100644
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -499,7 +499,7 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
         *arg = (unsigned long) fnew;
 
         if (fold) {
-                list_replace_rcu(&fnew->list, &fold->list);
+                list_replace_rcu(&fold->list, &fnew->list);
                 tcf_unbind_filter(tp, &fold->res);
                 call_rcu(&fold->rcu, fl_destroy_filter);
         } else {
diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c
index d75993f89fac..21ca33c9f036 100644
--- a/net/sched/sch_fq_codel.c
+++ b/net/sched/sch_fq_codel.c
@@ -155,14 +155,23 @@ static unsigned int fq_codel_drop(struct Qdisc *sch)
         skb = dequeue_head(flow);
         len = qdisc_pkt_len(skb);
         q->backlogs[idx] -= len;
-        kfree_skb(skb);
         sch->q.qlen--;
         qdisc_qstats_drop(sch);
         qdisc_qstats_backlog_dec(sch, skb);
+        kfree_skb(skb);
         flow->dropped++;
         return idx;
 }
 
+static unsigned int fq_codel_qdisc_drop(struct Qdisc *sch)
+{
+        unsigned int prev_backlog;
+
+        prev_backlog = sch->qstats.backlog;
+        fq_codel_drop(sch);
+        return prev_backlog - sch->qstats.backlog;
+}
+
 static int fq_codel_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 {
         struct fq_codel_sched_data *q = qdisc_priv(sch);
@@ -604,7 +613,7 @@ static struct Qdisc_ops fq_codel_qdisc_ops __read_mostly = {
         .enqueue        =       fq_codel_enqueue,
         .dequeue        =       fq_codel_dequeue,
         .peek           =       qdisc_peek_dequeued,
-        .drop           =       fq_codel_drop,
+        .drop           =       fq_codel_qdisc_drop,
         .init           =       fq_codel_init,
         .reset          =       fq_codel_reset,
         .destroy        =       fq_codel_destroy,
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index 7d1492663360..52f75a5473e1 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -306,10 +306,10 @@ drop:
                 len = qdisc_pkt_len(skb);
                 slot->backlog -= len;
                 sfq_dec(q, x);
-                kfree_skb(skb);
                 sch->q.qlen--;
                 qdisc_qstats_drop(sch);
                 qdisc_qstats_backlog_dec(sch, skb);
+                kfree_skb(skb);
                 return len;
         }
 
diff --git a/net/switchdev/switchdev.c b/net/switchdev/switchdev.c
index 84f77a054025..9f2add3cba26 100644
--- a/net/switchdev/switchdev.c
+++ b/net/switchdev/switchdev.c
@@ -171,8 +171,10 @@ int switchdev_port_attr_set(struct net_device *dev, struct switchdev_attr *attr)
                  * released.
                  */
 
-                attr->trans = SWITCHDEV_TRANS_ABORT;
-                __switchdev_port_attr_set(dev, attr);
+                if (err != -EOPNOTSUPP) {
+                        attr->trans = SWITCHDEV_TRANS_ABORT;
+                        __switchdev_port_attr_set(dev, attr);
+                }
 
                 return err;
         }
@@ -249,8 +251,10 @@ int switchdev_port_obj_add(struct net_device *dev, struct switchdev_obj *obj)
                  * released.
                  */
 
-                obj->trans = SWITCHDEV_TRANS_ABORT;
-                __switchdev_port_obj_add(dev, obj);
+                if (err != -EOPNOTSUPP) {
+                        obj->trans = SWITCHDEV_TRANS_ABORT;
+                        __switchdev_port_obj_add(dev, obj);
+                }
 
                 return err;
         }
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 46b6ed534ef2..3a7567f690f3 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -2007,6 +2007,7 @@ static int tipc_accept(struct socket *sock, struct socket *new_sock, int flags)
         res = tipc_sk_create(sock_net(sock->sk), new_sock, 0, 1);
         if (res)
                 goto exit;
+        security_sk_clone(sock->sk, new_sock->sk);
 
         new_sk = new_sock->sk;
         new_tsock = tipc_sk(new_sk);
diff --git a/net/wireless/chan.c b/net/wireless/chan.c
index 915b328b9ac5..59cabc9bce69 100644
--- a/net/wireless/chan.c
+++ b/net/wireless/chan.c
@@ -797,23 +797,18 @@ static bool cfg80211_ir_permissive_chan(struct wiphy *wiphy,
         return false;
 }
 
-bool cfg80211_reg_can_beacon(struct wiphy *wiphy,
-                             struct cfg80211_chan_def *chandef,
-                             enum nl80211_iftype iftype)
+static bool _cfg80211_reg_can_beacon(struct wiphy *wiphy,
+                                     struct cfg80211_chan_def *chandef,
+                                     enum nl80211_iftype iftype,
+                                     bool check_no_ir)
 {
         bool res;
         u32 prohibited_flags = IEEE80211_CHAN_DISABLED |
                                IEEE80211_CHAN_RADAR;
 
-        trace_cfg80211_reg_can_beacon(wiphy, chandef, iftype);
+        trace_cfg80211_reg_can_beacon(wiphy, chandef, iftype, check_no_ir);
 
-        /*
-         * Under certain conditions suggested by some regulatory bodies a
-         * GO/STA can IR on channels marked with IEEE80211_NO_IR. Set this flag
-         * only if such relaxations are not enabled and the conditions are not
-         * met.
-         */
-        if (!cfg80211_ir_permissive_chan(wiphy, iftype, chandef->chan))
+        if (check_no_ir)
                 prohibited_flags |= IEEE80211_CHAN_NO_IR;
 
         if (cfg80211_chandef_dfs_required(wiphy, chandef, iftype) > 0 &&
@@ -827,8 +822,36 @@ bool cfg80211_reg_can_beacon(struct wiphy *wiphy,
         trace_cfg80211_return_bool(res);
         return res;
 }
+
+bool cfg80211_reg_can_beacon(struct wiphy *wiphy,
+                             struct cfg80211_chan_def *chandef,
+                             enum nl80211_iftype iftype)
+{
+        return _cfg80211_reg_can_beacon(wiphy, chandef, iftype, true);
+}
 EXPORT_SYMBOL(cfg80211_reg_can_beacon);
 
+bool cfg80211_reg_can_beacon_relax(struct wiphy *wiphy,
+                                   struct cfg80211_chan_def *chandef,
+                                   enum nl80211_iftype iftype)
+{
+        bool check_no_ir;
+
+        ASSERT_RTNL();
+
+        /*
+         * Under certain conditions suggested by some regulatory bodies a
+         * GO/STA can IR on channels marked with IEEE80211_NO_IR. Set this flag
+         * only if such relaxations are not enabled and the conditions are not
+         * met.
+         */
+        check_no_ir = !cfg80211_ir_permissive_chan(wiphy, iftype,
+                                                   chandef->chan);
+
+        return _cfg80211_reg_can_beacon(wiphy, chandef, iftype, check_no_ir);
+}
+EXPORT_SYMBOL(cfg80211_reg_can_beacon_relax);
+
 int cfg80211_set_monitor_channel(struct cfg80211_registered_device *rdev,
                                  struct cfg80211_chan_def *chandef)
 {
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index c264effd00a6..76b41578a838 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -2003,7 +2003,8 @@ static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
         switch (iftype) {
         case NL80211_IFTYPE_AP:
         case NL80211_IFTYPE_P2P_GO:
-                if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef, iftype)) {
+                if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
+                                                   iftype)) {
                         result = -EINVAL;
                         break;
                 }
@@ -3403,8 +3404,8 @@ static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
         } else if (!nl80211_get_ap_channel(rdev, &params))
                 return -EINVAL;
 
-        if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef,
-                                     wdev->iftype))
+        if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
+                                           wdev->iftype))
                 return -EINVAL;
 
         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
@@ -6492,8 +6493,8 @@ skip_beacons:
         if (err)
                 return err;
 
-        if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef,
-                                     wdev->iftype))
+        if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
+                                           wdev->iftype))
                 return -EINVAL;
 
         err = cfg80211_chandef_dfs_required(wdev->wiphy,
@@ -10170,7 +10171,8 @@ static int nl80211_tdls_channel_switch(struct sk_buff *skb,
                 return -EINVAL;
 
         /* we will be active on the TDLS link */
-        if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef, wdev->iftype))
+        if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
+                                           wdev->iftype))
                 return -EINVAL;
 
         /* don't allow switching to DFS channels */
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index d359e0610198..aa2d75482017 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -544,15 +544,15 @@ static int call_crda(const char *alpha2)
         reg_regdb_query(alpha2);
 
         if (reg_crda_timeouts > REG_MAX_CRDA_TIMEOUTS) {
-                pr_info("Exceeded CRDA call max attempts. Not calling CRDA\n");
+                pr_debug("Exceeded CRDA call max attempts. Not calling CRDA\n");
                 return -EINVAL;
         }
 
         if (!is_world_regdom((char *) alpha2))
-                pr_info("Calling CRDA for country: %c%c\n",
+                pr_debug("Calling CRDA for country: %c%c\n",
                         alpha2[0], alpha2[1]);
         else
-                pr_info("Calling CRDA to update world regulatory domain\n");
+                pr_debug("Calling CRDA to update world regulatory domain\n");
 
         return kobject_uevent_env(&reg_pdev->dev.kobj, KOBJ_CHANGE, env);
 }
@@ -1589,7 +1589,7 @@ static bool reg_wdev_chan_valid(struct wiphy *wiphy, struct wireless_dev *wdev)
         case NL80211_IFTYPE_AP:
         case NL80211_IFTYPE_P2P_GO:
         case NL80211_IFTYPE_ADHOC:
-                return cfg80211_reg_can_beacon(wiphy, &chandef, iftype);
+                return cfg80211_reg_can_beacon_relax(wiphy, &chandef, iftype);
         case NL80211_IFTYPE_STATION:
         case NL80211_IFTYPE_P2P_CLIENT:
                 return cfg80211_chandef_usable(wiphy, &chandef,
diff --git a/net/wireless/trace.h b/net/wireless/trace.h
index af3617c9879e..a808279a432a 100644
--- a/net/wireless/trace.h
+++ b/net/wireless/trace.h
@@ -2358,20 +2358,23 @@ TRACE_EVENT(cfg80211_cqm_rssi_notify,
 
 TRACE_EVENT(cfg80211_reg_can_beacon,
         TP_PROTO(struct wiphy *wiphy, struct cfg80211_chan_def *chandef,
-                 enum nl80211_iftype iftype),
-        TP_ARGS(wiphy, chandef, iftype),
+                 enum nl80211_iftype iftype, bool check_no_ir),
+        TP_ARGS(wiphy, chandef, iftype, check_no_ir),
         TP_STRUCT__entry(
                 WIPHY_ENTRY
                 CHAN_DEF_ENTRY
                 __field(enum nl80211_iftype, iftype)
+                __field(bool, check_no_ir)
         ),
         TP_fast_assign(
                 WIPHY_ASSIGN;
                 CHAN_DEF_ASSIGN(chandef);
                 __entry->iftype = iftype;
+                __entry->check_no_ir = check_no_ir;
         ),
-        TP_printk(WIPHY_PR_FMT ", " CHAN_DEF_PR_FMT ", iftype=%d",
-                  WIPHY_PR_ARG, CHAN_DEF_PR_ARG, __entry->iftype)
+        TP_printk(WIPHY_PR_FMT ", " CHAN_DEF_PR_FMT ", iftype=%d check_no_ir=%s",
+                  WIPHY_PR_ARG, CHAN_DEF_PR_ARG, __entry->iftype,
+                  BOOL_TO_STR(__entry->check_no_ir))
 );
 
 TRACE_EVENT(cfg80211_chandef_dfs_required,
diff --git a/samples/trace_events/trace-events-sample.h b/samples/trace_events/trace-events-sample.h
index 8965d1bb8811..125d6402f64f 100644
--- a/samples/trace_events/trace-events-sample.h
+++ b/samples/trace_events/trace-events-sample.h
@@ -168,7 +168,10 @@
  *
  *      For __dynamic_array(int, foo, bar) use __get_dynamic_array(foo)
  *            Use __get_dynamic_array_len(foo) to get the length of the array
- *            saved.
+ *            saved. Note, __get_dynamic_array_len() returns the total allocated
+ *            length of the dynamic array; __print_array() expects the second
+ *            parameter to be the number of elements. To get that, the array length
+ *            needs to be divided by the element size.
  *
  *      For __string(foo, bar) use __get_str(foo)
  *
@@ -288,7 +291,7 @@ TRACE_EVENT(foo_bar,
  *    This prints out the array that is defined by __array in a nice format.
  */
                   __print_array(__get_dynamic_array(list),
-                                __get_dynamic_array_len(list),
+                                __get_dynamic_array_len(list) / sizeof(int),
                                 sizeof(int)),
                   __get_str(str), __get_bitmask(cpus))
 );
diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index 90e1edc8dd42..d5c8e9a3a73c 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -2599,7 +2599,7 @@ sub process {
 # if LONG_LINE is ignored, the other 2 types are also ignored
 #
 
-                if ($length > $max_line_length) {
+                if ($line =~ /^\+/ && $length > $max_line_length) {
                         my $msg_type = "LONG_LINE";
 
                         # Check the allowed long line types first
diff --git a/scripts/mod/devicetable-offsets.c b/scripts/mod/devicetable-offsets.c
index eff7de1fc82e..e70fcd12eeeb 100644
--- a/scripts/mod/devicetable-offsets.c
+++ b/scripts/mod/devicetable-offsets.c
@@ -63,6 +63,8 @@ int main(void)
 
         DEVID(acpi_device_id);
         DEVID_FIELD(acpi_device_id, id);
+        DEVID_FIELD(acpi_device_id, cls);
+        DEVID_FIELD(acpi_device_id, cls_msk);
 
         DEVID(pnp_device_id);
         DEVID_FIELD(pnp_device_id, id);
diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c
index 84c86f3cd6cd..5f2088209132 100644
--- a/scripts/mod/file2alias.c
+++ b/scripts/mod/file2alias.c
@@ -523,12 +523,40 @@ static int do_serio_entry(const char *filename,
 }
 ADD_TO_DEVTABLE("serio", serio_device_id, do_serio_entry);
 
-/* looks like: "acpi:ACPI0003 or acpi:PNP0C0B" or "acpi:LNXVIDEO" */
+/* looks like: "acpi:ACPI0003" or "acpi:PNP0C0B" or "acpi:LNXVIDEO" or
+ *             "acpi:bbsspp" (bb=base-class, ss=sub-class, pp=prog-if)
+ *
+ * NOTE: Each driver should use one of the following : _HID, _CIDs
+ *       or _CLS. Also, bb, ss, and pp can be substituted with ??
+ *       as don't care byte.
+ */
 static int do_acpi_entry(const char *filename,
                         void *symval, char *alias)
 {
         DEF_FIELD_ADDR(symval, acpi_device_id, id);
-        sprintf(alias, "acpi*:%s:*", *id);
+        DEF_FIELD_ADDR(symval, acpi_device_id, cls);
+        DEF_FIELD_ADDR(symval, acpi_device_id, cls_msk);
+
+        if (id && strlen((const char *)*id))
+                sprintf(alias, "acpi*:%s:*", *id);
+        else if (cls) {
+                int i, byte_shift, cnt = 0;
+                unsigned int msk;
+
+                sprintf(&alias[cnt], "acpi*:");
+                cnt = 6;
+                for (i = 1; i <= 3; i++) {
+                        byte_shift = 8 * (3-i);
+                        msk = (*cls_msk >> byte_shift) & 0xFF;
+                        if (msk)
+                                sprintf(&alias[cnt], "%02x",
+                                        (*cls >> byte_shift) & 0xFF);
+                        else
+                                sprintf(&alias[cnt], "??");
+                        cnt += 2;
+                }
+                sprintf(&alias[cnt], ":*");
+        }
         return 1;
 }
 ADD_TO_DEVTABLE("acpi", acpi_device_id, do_acpi_entry);
diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
index 91ee1b2e0f9a..12d3db3bd46b 100644
--- a/scripts/mod/modpost.c
+++ b/scripts/mod/modpost.c
@@ -886,7 +886,8 @@ static void check_section(const char *modname, struct elf_info *elf,
 #define TEXT_SECTIONS ".text", ".text.unlikely", ".sched.text", \
                 ".kprobes.text"
 #define OTHER_TEXT_SECTIONS ".ref.text", ".head.text", ".spinlock.text", \
-                ".fixup", ".entry.text", ".exception.text", ".text.*"
+                ".fixup", ".entry.text", ".exception.text", ".text.*", \
+                ".coldtext"
 
 #define INIT_SECTIONS      ".init.*"
 #define MEM_INIT_SECTIONS  ".meminit.*"
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 623108199641..564079c5c49d 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -3283,7 +3283,8 @@ static int file_map_prot_check(struct file *file, unsigned long prot, int shared
         int rc = 0;
 
         if (default_noexec &&
-            (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
+            (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
+                                   (!shared && (prot & PROT_WRITE)))) {
                 /*
                  * We are making executable an anonymous mapping or a
                  * private file mapping that will also be writable.
diff --git a/security/selinux/ss/ebitmap.c b/security/selinux/ss/ebitmap.c
index afe6a269ec17..57644b1dc42e 100644
--- a/security/selinux/ss/ebitmap.c
+++ b/security/selinux/ss/ebitmap.c
@@ -153,6 +153,12 @@ int ebitmap_netlbl_import(struct ebitmap *ebmap,
                 if (offset == (u32)-1)
                         return 0;
 
+                /* don't waste ebitmap space if the netlabel bitmap is empty */
+                if (bitmap == 0) {
+                        offset += EBITMAP_UNIT_SIZE;
+                        continue;
+                }
+
                 if (e_iter == NULL ||
                     offset >= e_iter->startbit + EBITMAP_SIZE) {
                         e_prev = e_iter;
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index d126c03361ae..75888dd38a7f 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -85,7 +85,7 @@ static DECLARE_RWSEM(snd_pcm_link_rwsem);
 void snd_pcm_stream_lock(struct snd_pcm_substream *substream)
 {
         if (substream->pcm->nonatomic) {
-                down_read(&snd_pcm_link_rwsem);
+                down_read_nested(&snd_pcm_link_rwsem, SINGLE_DEPTH_NESTING);
                 mutex_lock(&substream->self_group.mutex);
         } else {
                 read_lock(&snd_pcm_link_rwlock);
diff --git a/sound/hda/hdac_i915.c b/sound/hda/hdac_i915.c
index 442500e06b7c..5676b849379d 100644
--- a/sound/hda/hdac_i915.c
+++ b/sound/hda/hdac_i915.c
@@ -56,8 +56,11 @@ int snd_hdac_display_power(struct hdac_bus *bus, bool enable)
                 enable ? "enable" : "disable");
 
         if (enable) {
-                if (!bus->i915_power_refcount++)
+                if (!bus->i915_power_refcount++) {
                         acomp->ops->get_power(acomp->dev);
+                        snd_hdac_set_codec_wakeup(bus, true);
+                        snd_hdac_set_codec_wakeup(bus, false);
+                }
         } else {
                 WARN_ON(!bus->i915_power_refcount);
                 if (!--bus->i915_power_refcount)
diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
index ac0db1679f09..b077bb644434 100644
--- a/sound/pci/hda/hda_generic.c
+++ b/sound/pci/hda/hda_generic.c
@@ -5175,7 +5175,7 @@ static int alt_playback_pcm_open(struct hda_pcm_stream *hinfo,
         int err = 0;
 
         mutex_lock(&spec->pcm_mutex);
-        if (!spec->indep_hp_enabled)
+        if (spec->indep_hp && !spec->indep_hp_enabled)
                 err = -EBUSY;
         else
                 spec->active_streams |= 1 << STREAM_INDEP_HP;
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 745535d1840a..735bdcb04ce8 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -979,14 +979,16 @@ static int azx_runtime_resume(struct device *dev)
         if (!azx_has_pm_runtime(chip))
                 return 0;
 
-        if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL
-                && hda->need_i915_power) {
-                bus =  azx_bus(chip);
-                snd_hdac_display_power(bus, true);
-                haswell_set_bclk(hda);
-                /* toggle codec wakeup bit for STATESTS read */
-                snd_hdac_set_codec_wakeup(bus, true);
-                snd_hdac_set_codec_wakeup(bus, false);
+        if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL) {
+                bus = azx_bus(chip);
+                if (hda->need_i915_power) {
+                        snd_hdac_display_power(bus, true);
+                        haswell_set_bclk(hda);
+                } else {
+                        /* toggle codec wakeup bit for STATESTS read */
+                        snd_hdac_set_codec_wakeup(bus, true);
+                        snd_hdac_set_codec_wakeup(bus, false);
+                }
         }
 
         /* Read STATESTS before controller reset */
@@ -2182,6 +2184,8 @@ static const struct pci_device_id azx_ids[] = {
         /* ATI HDMI */
         { PCI_DEVICE(0x1002, 0x1308),
           .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+        { PCI_DEVICE(0x1002, 0x157a),
+          .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
         { PCI_DEVICE(0x1002, 0x793b),
           .driver_data = AZX_DRIVER_ATIHDMI | AZX_DCAPS_PRESET_ATI_HDMI },
         { PCI_DEVICE(0x1002, 0x7919),
@@ -2236,8 +2240,14 @@ static const struct pci_device_id azx_ids[] = {
           .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
         { PCI_DEVICE(0x1002, 0xaab0),
           .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+        { PCI_DEVICE(0x1002, 0xaac0),
+          .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
         { PCI_DEVICE(0x1002, 0xaac8),
           .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+        { PCI_DEVICE(0x1002, 0xaad8),
+          .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+        { PCI_DEVICE(0x1002, 0xaae8),
+          .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
         /* VIA VT8251/VT8237A */
         { PCI_DEVICE(0x1106, 0x3288),
           .driver_data = AZX_DRIVER_VIA | AZX_DCAPS_POSFIX_VIA },
diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index 2f2433845d04..a97db5fc8a15 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -3512,6 +3512,7 @@ static const struct hda_codec_preset snd_hda_preset_hdmi[] = {
 { .id = 0x10de0070, .name = "GPU 70 HDMI/DP",   .patch = patch_nvhdmi },
 { .id = 0x10de0071, .name = "GPU 71 HDMI/DP",   .patch = patch_nvhdmi },
 { .id = 0x10de0072, .name = "GPU 72 HDMI/DP",   .patch = patch_nvhdmi },
+{ .id = 0x10de007d, .name = "GPU 7d HDMI/DP",   .patch = patch_nvhdmi },
 { .id = 0x10de8001, .name = "MCP73 HDMI",       .patch = patch_nvhdmi_2ch },
 { .id = 0x11069f80, .name = "VX900 HDMI/DP",    .patch = patch_via_hdmi },
 { .id = 0x11069f81, .name = "VX900 HDMI/DP",    .patch = patch_via_hdmi },
@@ -3527,6 +3528,7 @@ static const struct hda_codec_preset snd_hda_preset_hdmi[] = {
 { .id = 0x80862807, .name = "Haswell HDMI",     .patch = patch_generic_hdmi },
 { .id = 0x80862808, .name = "Broadwell HDMI",   .patch = patch_generic_hdmi },
 { .id = 0x80862809, .name = "Skylake HDMI",     .patch = patch_generic_hdmi },
+{ .id = 0x8086280a, .name = "Broxton HDMI",     .patch = patch_generic_hdmi },
 { .id = 0x80862880, .name = "CedarTrail HDMI",  .patch = patch_generic_hdmi },
 { .id = 0x80862882, .name = "Valleyview2 HDMI", .patch = patch_generic_hdmi },
 { .id = 0x80862883, .name = "Braswell HDMI",    .patch = patch_generic_hdmi },
@@ -3575,6 +3577,7 @@ MODULE_ALIAS("snd-hda-codec-id:10de0067");
 MODULE_ALIAS("snd-hda-codec-id:10de0070");
 MODULE_ALIAS("snd-hda-codec-id:10de0071");
 MODULE_ALIAS("snd-hda-codec-id:10de0072");
+MODULE_ALIAS("snd-hda-codec-id:10de007d");
 MODULE_ALIAS("snd-hda-codec-id:10de8001");
 MODULE_ALIAS("snd-hda-codec-id:11069f80");
 MODULE_ALIAS("snd-hda-codec-id:11069f81");
@@ -3591,6 +3594,7 @@ MODULE_ALIAS("snd-hda-codec-id:80862806");
 MODULE_ALIAS("snd-hda-codec-id:80862807");
 MODULE_ALIAS("snd-hda-codec-id:80862808");
 MODULE_ALIAS("snd-hda-codec-id:80862809");
+MODULE_ALIAS("snd-hda-codec-id:8086280a");
 MODULE_ALIAS("snd-hda-codec-id:80862880");
 MODULE_ALIAS("snd-hda-codec-id:80862882");
 MODULE_ALIAS("snd-hda-codec-id:80862883");
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index b3b44681d3cf..742fc626f9e1 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4441,6 +4441,55 @@ static void alc290_fixup_mono_speakers(struct hda_codec *codec,
         }
 }
 
+/* Hook to update amp GPIO4 for automute */
+static void alc280_hp_gpio4_automute_hook(struct hda_codec *codec,
+                                          struct hda_jack_callback *jack)
+{
+        struct alc_spec *spec = codec->spec;
+
+        snd_hda_gen_hp_automute(codec, jack);
+        /* mute_led_polarity is set to 0, so we pass inverted value here */
+        alc_update_gpio_led(codec, 0x10, !spec->gen.hp_jack_present);
+}
+
+/* Manage GPIOs for HP EliteBook Folio 9480m.
+ *
+ * GPIO4 is the headphone amplifier power control
+ * GPIO3 is the audio output mute indicator LED
+ */
+
+static void alc280_fixup_hp_9480m(struct hda_codec *codec,
+                                  const struct hda_fixup *fix,
+                                  int action)
+{
+        struct alc_spec *spec = codec->spec;
+        static const struct hda_verb gpio_init[] = {
+                { 0x01, AC_VERB_SET_GPIO_MASK, 0x18 },
+                { 0x01, AC_VERB_SET_GPIO_DIRECTION, 0x18 },
+                {}
+        };
+
+        if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+                /* Set the hooks to turn the headphone amp on/off
+                 * as needed
+                 */
+                spec->gen.vmaster_mute.hook = alc_fixup_gpio_mute_hook;
+                spec->gen.hp_automute_hook = alc280_hp_gpio4_automute_hook;
+
+                /* The GPIOs are currently off */
+                spec->gpio_led = 0;
+
+                /* GPIO3 is connected to the output mute LED,
+                 * high is on, low is off
+                 */
+                spec->mute_led_polarity = 0;
+                spec->gpio_mute_led_mask = 0x08;
+
+                /* Initialize GPIO configuration */
+                snd_hda_add_verbs(codec, gpio_init);
+        }
+}
+
 /* for hda_fixup_thinkpad_acpi() */
 #include "thinkpad_helper.c"
 
@@ -4521,6 +4570,7 @@ enum {
         ALC286_FIXUP_HP_GPIO_LED,
         ALC280_FIXUP_HP_GPIO2_MIC_HOTKEY,
         ALC280_FIXUP_HP_DOCK_PINS,
+        ALC280_FIXUP_HP_9480M,
         ALC288_FIXUP_DELL_HEADSET_MODE,
         ALC288_FIXUP_DELL1_MIC_NO_PRESENCE,
         ALC288_FIXUP_DELL_XPS_13_GPIO6,
@@ -5011,7 +5061,7 @@ static const struct hda_fixup alc269_fixups[] = {
                         { 0x14, 0x90170110 },
                         { 0x17, 0x40000008 },
                         { 0x18, 0x411111f0 },
-                        { 0x19, 0x411111f0 },
+                        { 0x19, 0x01a1913c },
                         { 0x1a, 0x411111f0 },
                         { 0x1b, 0x411111f0 },
                         { 0x1d, 0x40f89b2d },
@@ -5043,6 +5093,10 @@ static const struct hda_fixup alc269_fixups[] = {
                 .chained = true,
                 .chain_id = ALC280_FIXUP_HP_GPIO4
         },
+        [ALC280_FIXUP_HP_9480M] = {
+                .type = HDA_FIXUP_FUNC,
+                .v.func = alc280_fixup_hp_9480m,
+        },
         [ALC288_FIXUP_DELL_HEADSET_MODE] = {
                 .type = HDA_FIXUP_FUNC,
                 .v.func = alc_fixup_headset_mode_dell_alc288,
@@ -5161,6 +5215,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x103c, 0x22b7, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
         SND_PCI_QUIRK(0x103c, 0x22bf, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
         SND_PCI_QUIRK(0x103c, 0x22cf, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+        SND_PCI_QUIRK(0x103c, 0x22db, "HP", ALC280_FIXUP_HP_9480M),
         SND_PCI_QUIRK(0x103c, 0x22dc, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
         SND_PCI_QUIRK(0x103c, 0x22fb, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED),
         /* ALC290 */
@@ -5375,8 +5430,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
         {0x15, 0x0221401f}, \
         {0x1a, 0x411111f0}, \
         {0x1b, 0x411111f0}, \
-        {0x1d, 0x40700001}, \
-        {0x1e, 0x411111f0}
+        {0x1d, 0x40700001}
 
 #define ALC298_STANDARD_PINS \
         {0x18, 0x411111f0}, \
@@ -5408,6 +5462,17 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
                 {0x1d, 0x40700001},
                 {0x21, 0x02211030}),
         SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+                {0x12, 0x40000000},
+                {0x14, 0x90170130},
+                {0x17, 0x411111f0},
+                {0x18, 0x411111f0},
+                {0x19, 0x411111f0},
+                {0x1a, 0x411111f0},
+                {0x1b, 0x01014020},
+                {0x1d, 0x4054c029},
+                {0x1e, 0x411111f0},
+                {0x21, 0x0221103f}),
+        SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
                 {0x12, 0x90a60160},
                 {0x14, 0x90170120},
                 {0x17, 0x90170140},
@@ -5635,35 +5700,48 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
                 {0x13, 0x411111f0},
                 {0x16, 0x01014020},
                 {0x18, 0x411111f0},
-                {0x19, 0x01a19030}),
+                {0x19, 0x01a19030},
+                {0x1e, 0x411111f0}),
         SND_HDA_PIN_QUIRK(0x10ec0292, 0x1028, "Dell", ALC269_FIXUP_DELL2_MIC_NO_PRESENCE,
                 ALC292_STANDARD_PINS,
                 {0x12, 0x90a60140},
                 {0x13, 0x411111f0},
                 {0x16, 0x01014020},
                 {0x18, 0x02a19031},
-                {0x19, 0x01a1903e}),
+                {0x19, 0x01a1903e},
+                {0x1e, 0x411111f0}),
         SND_HDA_PIN_QUIRK(0x10ec0292, 0x1028, "Dell", ALC269_FIXUP_DELL3_MIC_NO_PRESENCE,
                 ALC292_STANDARD_PINS,
                 {0x12, 0x90a60140},
                 {0x13, 0x411111f0},
                 {0x16, 0x411111f0},
                 {0x18, 0x411111f0},
-                {0x19, 0x411111f0}),
+                {0x19, 0x411111f0},
+                {0x1e, 0x411111f0}),
         SND_HDA_PIN_QUIRK(0x10ec0293, 0x1028, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE,
                 ALC292_STANDARD_PINS,
                 {0x12, 0x40000000},
                 {0x13, 0x90a60140},
                 {0x16, 0x21014020},
                 {0x18, 0x411111f0},
-                {0x19, 0x21a19030}),
+                {0x19, 0x21a19030},
+                {0x1e, 0x411111f0}),
         SND_HDA_PIN_QUIRK(0x10ec0293, 0x1028, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE,
                 ALC292_STANDARD_PINS,
                 {0x12, 0x40000000},
                 {0x13, 0x90a60140},
                 {0x16, 0x411111f0},
                 {0x18, 0x411111f0},
-                {0x19, 0x411111f0}),
+                {0x19, 0x411111f0},
+                {0x1e, 0x411111f0}),
+        SND_HDA_PIN_QUIRK(0x10ec0293, 0x1028, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE,
+                ALC292_STANDARD_PINS,
+                {0x12, 0x40000000},
+                {0x13, 0x90a60140},
+                {0x16, 0x21014020},
+                {0x18, 0x411111f0},
+                {0x19, 0x21a19030},
+                {0x1e, 0x411111ff}),
         SND_HDA_PIN_QUIRK(0x10ec0298, 0x1028, "Dell", ALC298_FIXUP_DELL1_MIC_NO_PRESENCE,
                 ALC298_STANDARD_PINS,
                 {0x12, 0x90a60130},
diff --git a/sound/sparc/amd7930.c b/sound/sparc/amd7930.c
index 1b1a89e80d13..784ceb85b2d9 100644
--- a/sound/sparc/amd7930.c
+++ b/sound/sparc/amd7930.c
@@ -956,6 +956,7 @@ static int snd_amd7930_create(struct snd_card *card,
         if (!amd->regs) {
                 snd_printk(KERN_ERR
                            "amd7930-%d: Unable to map chip registers.\n", dev);
+                kfree(amd);
                 return -EIO;
         }
 
diff --git a/sound/usb/line6/pcm.c b/sound/usb/line6/pcm.c
index 8461d6bf992f..204cc074adb9 100644
--- a/sound/usb/line6/pcm.c
+++ b/sound/usb/line6/pcm.c
@@ -186,12 +186,8 @@ static int line6_stream_start(struct snd_line6_pcm *line6pcm, int direction,
         int ret = 0;
 
         spin_lock_irqsave(&pstr->lock, flags);
-        if (!test_and_set_bit(type, &pstr->running)) {
-                if (pstr->active_urbs || pstr->unlink_urbs) {
-                        ret = -EBUSY;
-                        goto error;
-                }
-
+        if (!test_and_set_bit(type, &pstr->running) &&
+            !(pstr->active_urbs || pstr->unlink_urbs)) {
                 pstr->count = 0;
                 /* Submit all currently available URBs */
                 if (direction == SNDRV_PCM_STREAM_PLAYBACK)
@@ -199,7 +195,6 @@ static int line6_stream_start(struct snd_line6_pcm *line6pcm, int direction,
                 else
                         ret = line6_submit_audio_in_all_urbs(line6pcm);
         }
- error:
         if (ret < 0)
                 clear_bit(type, &pstr->running);
         spin_unlock_irqrestore(&pstr->lock, flags);
diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
index 2f6d3e9a1bcd..e4756651a52c 100644
--- a/sound/usb/quirks-table.h
+++ b/sound/usb/quirks-table.h
@@ -2512,6 +2512,74 @@ YAMAHA_DEVICE(0x7010, "UB99"),
         }
 },
 
+/* Steinberg devices */
+{
+        /* Steinberg MI2 */
+        USB_DEVICE_VENDOR_SPEC(0x0a4e, 0x2040),
+        .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+                .ifnum = QUIRK_ANY_INTERFACE,
+                .type = QUIRK_COMPOSITE,
+                .data = & (const struct snd_usb_audio_quirk[]) {
+                        {
+                                .ifnum = 0,
+                                .type = QUIRK_AUDIO_STANDARD_INTERFACE
+                        },
+                        {
+                                .ifnum = 1,
+                                .type = QUIRK_AUDIO_STANDARD_INTERFACE
+                        },
+                        {
+                                .ifnum = 2,
+                                .type = QUIRK_AUDIO_STANDARD_INTERFACE
+                        },
+                        {
+                                .ifnum = 3,
+                                .type = QUIRK_MIDI_FIXED_ENDPOINT,
+                                .data = &(const struct snd_usb_midi_endpoint_info) {
+                                        .out_cables = 0x0001,
+                                        .in_cables  = 0x0001
+                                }
+                        },
+                        {
+                                .ifnum = -1
+                        }
+                }
+        }
+},
+{
+        /* Steinberg MI4 */
+        USB_DEVICE_VENDOR_SPEC(0x0a4e, 0x4040),
+        .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+                .ifnum = QUIRK_ANY_INTERFACE,
+                .type = QUIRK_COMPOSITE,
+                .data = & (const struct snd_usb_audio_quirk[]) {
+                        {
+                                .ifnum = 0,
+                                .type = QUIRK_AUDIO_STANDARD_INTERFACE
+                        },
+                        {
+                                .ifnum = 1,
+                                .type = QUIRK_AUDIO_STANDARD_INTERFACE
+                        },
+                        {
+                                .ifnum = 2,
+                                .type = QUIRK_AUDIO_STANDARD_INTERFACE
+                        },
+                        {
+                                .ifnum = 3,
+                                .type = QUIRK_MIDI_FIXED_ENDPOINT,
+                                .data = &(const struct snd_usb_midi_endpoint_info) {
+                                        .out_cables = 0x0001,
+                                        .in_cables  = 0x0001
+                                }
+                        },
+                        {
+                                .ifnum = -1
+                        }
+                }
+        }
+},
+
 /* TerraTec devices */
 {
         USB_DEVICE_VENDOR_SPEC(0x0ccd, 0x0012),
diff --git a/tools/lib/api/Makefile b/tools/lib/api/Makefile
index 8bd960658463..fe1b02c2c95b 100644
--- a/tools/lib/api/Makefile
+++ b/tools/lib/api/Makefile
@@ -36,7 +36,7 @@ $(LIBFILE): $(API_IN)
 
 clean:
         $(call QUIET_CLEAN, libapi) $(RM) $(LIBFILE); \
-        find $(if $(OUTPUT),$(OUTPUT),.) -name \*.o | xargs $(RM)
+        find $(if $(OUTPUT),$(OUTPUT),.) -name \*.o -or -name \*.o.cmd -or -name \*.o.d | xargs $(RM)
 
 FORCE:
 
diff --git a/tools/lib/hweight.c b/tools/lib/hweight.c
new file mode 100644
index 000000000000..0b859b884339
--- /dev/null
+++ b/tools/lib/hweight.c
@@ -0,0 +1,62 @@
+#include <linux/bitops.h>
+#include <asm/types.h>
+
+/**
+ * hweightN - returns the hamming weight of a N-bit word
+ * @x: the word to weigh
+ *
+ * The Hamming Weight of a number is the total number of bits set in it.
+ */
+
+unsigned int __sw_hweight32(unsigned int w)
+{
+#ifdef CONFIG_ARCH_HAS_FAST_MULTIPLIER
+        w -= (w >> 1) & 0x55555555;
+        w =  (w & 0x33333333) + ((w >> 2) & 0x33333333);
+        w =  (w + (w >> 4)) & 0x0f0f0f0f;
+        return (w * 0x01010101) >> 24;
+#else
+        unsigned int res = w - ((w >> 1) & 0x55555555);
+        res = (res & 0x33333333) + ((res >> 2) & 0x33333333);
+        res = (res + (res >> 4)) & 0x0F0F0F0F;
+        res = res + (res >> 8);
+        return (res + (res >> 16)) & 0x000000FF;
+#endif
+}
+
+unsigned int __sw_hweight16(unsigned int w)
+{
+        unsigned int res = w - ((w >> 1) & 0x5555);
+        res = (res & 0x3333) + ((res >> 2) & 0x3333);
+        res = (res + (res >> 4)) & 0x0F0F;
+        return (res + (res >> 8)) & 0x00FF;
+}
+
+unsigned int __sw_hweight8(unsigned int w)
+{
+        unsigned int res = w - ((w >> 1) & 0x55);
+        res = (res & 0x33) + ((res >> 2) & 0x33);
+        return (res + (res >> 4)) & 0x0F;
+}
+
+unsigned long __sw_hweight64(__u64 w)
+{
+#if BITS_PER_LONG == 32
+        return __sw_hweight32((unsigned int)(w >> 32)) +
+               __sw_hweight32((unsigned int)w);
+#elif BITS_PER_LONG == 64
+#ifdef CONFIG_ARCH_HAS_FAST_MULTIPLIER
+        w -= (w >> 1) & 0x5555555555555555ul;
+        w =  (w & 0x3333333333333333ul) + ((w >> 2) & 0x3333333333333333ul);
+        w =  (w + (w >> 4)) & 0x0f0f0f0f0f0f0f0ful;
+        return (w * 0x0101010101010101ul) >> 56;
+#else
+        __u64 res = w - ((w >> 1) & 0x5555555555555555ul);
+        res = (res & 0x3333333333333333ul) + ((res >> 2) & 0x3333333333333333ul);
+        res = (res + (res >> 4)) & 0x0F0F0F0F0F0F0F0Ful;
+        res = res + (res >> 8);
+        res = res + (res >> 16);
+        return (res + (res >> 32)) & 0x00000000000000FFul;
+#endif
+#endif
+}
diff --git a/tools/lib/traceevent/Makefile b/tools/lib/traceevent/Makefile
index 6daaff652aff..7851df1490e0 100644
--- a/tools/lib/traceevent/Makefile
+++ b/tools/lib/traceevent/Makefile
@@ -268,7 +268,7 @@ install: install_lib
 
 clean:
         $(call QUIET_CLEAN, libtraceevent) \
-                $(RM) *.o *~ $(TARGETS) *.a *.so $(VERSION_FILES) .*.d \
+                $(RM) *.o *~ $(TARGETS) *.a *.so $(VERSION_FILES) .*.d .*.cmd \
                 $(RM) TRACEEVENT-CFLAGS tags TAGS
 
 PHONY += force plugins
diff --git a/tools/perf/MANIFEST b/tools/perf/MANIFEST
index 09dc0aabb515..d01a0aad5a01 100644
--- a/tools/perf/MANIFEST
+++ b/tools/perf/MANIFEST
@@ -18,6 +18,7 @@ tools/arch/x86/include/asm/atomic.h
 tools/arch/x86/include/asm/rmwcc.h
 tools/lib/traceevent
 tools/lib/api
+tools/lib/hweight.c
 tools/lib/rbtree.c
 tools/lib/symbol/kallsyms.c
 tools/lib/symbol/kallsyms.h
@@ -57,7 +58,6 @@ include/linux/perf_event.h
 include/linux/list.h
 include/linux/hash.h
 include/linux/stringify.h
-lib/hweight.c
 include/linux/swab.h
 arch/*/include/asm/unistd*.h
 arch/*/include/uapi/asm/unistd*.h
diff --git a/tools/perf/Makefile.perf b/tools/perf/Makefile.perf
index 7a4b549214e3..bba34636b733 100644
--- a/tools/perf/Makefile.perf
+++ b/tools/perf/Makefile.perf
@@ -109,9 +109,22 @@ $(OUTPUT)PERF-VERSION-FILE: ../../.git/HEAD
         $(Q)$(SHELL_PATH) util/PERF-VERSION-GEN $(OUTPUT)
         $(Q)touch $(OUTPUT)PERF-VERSION-FILE
 
-CC = $(CROSS_COMPILE)gcc
-LD ?= $(CROSS_COMPILE)ld
-AR = $(CROSS_COMPILE)ar
+# Makefiles suck: This macro sets a default value of $(2) for the
+# variable named by $(1), unless the variable has been set by
+# environment or command line. This is necessary for CC and AR
+# because make sets default values, so the simpler ?= approach
+# won't work as expected.
+define allow-override
+  $(if $(or $(findstring environment,$(origin $(1))),\
+            $(findstring command line,$(origin $(1)))),,\
+    $(eval $(1) = $(2)))
+endef
+
+# Allow setting CC and AR and LD, or setting CROSS_COMPILE as a prefix.
+$(call allow-override,CC,$(CROSS_COMPILE)gcc)
+$(call allow-override,AR,$(CROSS_COMPILE)ar)
+$(call allow-override,LD,$(CROSS_COMPILE)ld)
+
 PKG_CONFIG = $(CROSS_COMPILE)pkg-config
 
 RM      = rm -f
diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
index 37e301a32f43..d99d850e1444 100644
--- a/tools/perf/builtin-stat.c
+++ b/tools/perf/builtin-stat.c
@@ -343,7 +343,7 @@ static int read_counter(struct perf_evsel *counter)
         return 0;
 }
 
-static void read_counters(bool close)
+static void read_counters(bool close_counters)
 {
         struct perf_evsel *counter;
 
@@ -354,7 +354,7 @@ static void read_counters(bool close)
                 if (process_counter(counter))
                         pr_warning("failed to process counter %s\n", counter->name);
 
-                if (close) {
+                if (close_counters) {
                         perf_evsel__close_fd(counter, perf_evsel__nr_cpus(counter),
                                              thread_map__nr(evsel_list->threads));
                 }
diff --git a/tools/perf/ui/browsers/hists.c b/tools/perf/ui/browsers/hists.c
index 7629bef2fd79..fa67613976a8 100644
--- a/tools/perf/ui/browsers/hists.c
+++ b/tools/perf/ui/browsers/hists.c
@@ -48,7 +48,7 @@ static struct rb_node *hists__filter_entries(struct rb_node *nd,
 
 static bool hist_browser__has_filter(struct hist_browser *hb)
 {
-        return hists__has_filter(hb->hists) || hb->min_pcnt;
+        return hists__has_filter(hb->hists) || hb->min_pcnt || symbol_conf.has_filter;
 }
 
 static int hist_browser__get_folding(struct hist_browser *browser)
diff --git a/tools/perf/util/Build b/tools/perf/util/Build
index 601d11440596..d2d318c59b37 100644
--- a/tools/perf/util/Build
+++ b/tools/perf/util/Build
@@ -143,6 +143,6 @@ $(OUTPUT)util/rbtree.o: ../lib/rbtree.c FORCE
         $(call rule_mkdir)
         $(call if_changed_dep,cc_o_c)
 
-$(OUTPUT)util/hweight.o: ../../lib/hweight.c FORCE
+$(OUTPUT)util/hweight.o: ../lib/hweight.c FORCE
         $(call rule_mkdir)
         $(call if_changed_dep,cc_o_c)
diff --git a/tools/perf/util/auxtrace.c b/tools/perf/util/auxtrace.c
index 7e7405c9b936..83d9dd96fe08 100644
--- a/tools/perf/util/auxtrace.c
+++ b/tools/perf/util/auxtrace.c
@@ -53,11 +53,6 @@ int auxtrace_mmap__mmap(struct auxtrace_mmap *mm,
 {
         struct perf_event_mmap_page *pc = userpg;
 
-#if BITS_PER_LONG != 64 && !defined(HAVE_SYNC_COMPARE_AND_SWAP_SUPPORT)
-        pr_err("Cannot use AUX area tracing mmaps\n");
-        return -1;
-#endif
-
         WARN_ONCE(mm->base, "Uninitialized auxtrace_mmap\n");
 
         mm->userpg = userpg;
@@ -73,6 +68,11 @@ int auxtrace_mmap__mmap(struct auxtrace_mmap *mm,
                 return 0;
         }
 
+#if BITS_PER_LONG != 64 && !defined(HAVE_SYNC_COMPARE_AND_SWAP_SUPPORT)
+        pr_err("Cannot use AUX area tracing mmaps\n");
+        return -1;
+#endif
+
         pc->aux_offset = mp->offset;
         pc->aux_size = mp->len;
 
diff --git a/tools/perf/util/python-ext-sources b/tools/perf/util/python-ext-sources
index e23ded40c79e..0766d98c5da5 100644
--- a/tools/perf/util/python-ext-sources
+++ b/tools/perf/util/python-ext-sources
@@ -10,7 +10,7 @@ util/ctype.c
 util/evlist.c
 util/evsel.c
 util/cpumap.c
-../../lib/hweight.c
+../lib/hweight.c
 util/thread_map.c
 util/util.c
 util/xyarray.c
@@ -19,5 +19,5 @@ util/rblist.c
 util/stat.c
 util/strlist.c
 util/trace-event.c
-../../lib/rbtree.c
+../lib/rbtree.c
 util/string.c
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index 48b588c6951a..60f11414bb5c 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -1911,6 +1911,8 @@ int setup_list(struct strlist **list, const char *list_str,
                 pr_err("problems parsing %s list\n", list_name);
                 return -1;
         }
+
+        symbol_conf.has_filter = true;
         return 0;
 }
 
diff --git a/tools/perf/util/symbol.h b/tools/perf/util/symbol.h
index bef47ead1d9b..b98ce51af142 100644
--- a/tools/perf/util/symbol.h
+++ b/tools/perf/util/symbol.h
@@ -105,7 +105,8 @@ struct symbol_conf {
                         demangle_kernel,
                         filter_relative,
                         show_hist_headers,
-                        branch_callstack;
+                        branch_callstack,
+                        has_filter;
         const char      *vmlinux_name,
                         *kallsyms_name,
                         *source_prefix,
diff --git a/tools/perf/util/thread_map.c b/tools/perf/util/thread_map.c
index da7646d767fe..292ae2c90e06 100644
--- a/tools/perf/util/thread_map.c
+++ b/tools/perf/util/thread_map.c
@@ -136,8 +136,7 @@ struct thread_map *thread_map__new_by_uid(uid_t uid)
                 if (grow) {
                         struct thread_map *tmp;
 
-                        tmp = realloc(threads, (sizeof(*threads) +
-                                                max_threads * sizeof(pid_t)));
+                        tmp = thread_map__realloc(threads, max_threads);
                         if (tmp == NULL)
                                 goto out_free_namelist;
 
diff --git a/tools/perf/util/vdso.c b/tools/perf/util/vdso.c
index 4b89118f158d..44d440da15dc 100644
--- a/tools/perf/util/vdso.c
+++ b/tools/perf/util/vdso.c
@@ -236,18 +236,16 @@ static struct dso *__machine__findnew_compat(struct machine *machine,
         const char *file_name;
         struct dso *dso;
 
-        pthread_rwlock_wrlock(&machine->dsos.lock);
         dso = __dsos__find(&machine->dsos, vdso_file->dso_name, true);
         if (dso)
-                goto out_unlock;
+                goto out;
 
         file_name = vdso__get_compat_file(vdso_file);
         if (!file_name)
-                goto out_unlock;
+                goto out;
 
         dso = __machine__addnew_vdso(machine, vdso_file->dso_name, file_name);
-out_unlock:
-        pthread_rwlock_unlock(&machine->dsos.lock);
+out:
         return dso;
 }
 
diff --git a/tools/testing/nvdimm/Kbuild b/tools/testing/nvdimm/Kbuild
index 8e9b64520ec1..f56914c7929b 100644
--- a/tools/testing/nvdimm/Kbuild
+++ b/tools/testing/nvdimm/Kbuild
@@ -1,3 +1,6 @@
+ldflags-y += --wrap=ioremap_wt
+ldflags-y += --wrap=ioremap_wc
+ldflags-y += --wrap=devm_ioremap_nocache
 ldflags-y += --wrap=ioremap_cache
 ldflags-y += --wrap=ioremap_nocache
 ldflags-y += --wrap=iounmap
diff --git a/tools/testing/nvdimm/test/iomap.c b/tools/testing/nvdimm/test/iomap.c
index c85a6f6ba559..64bfaa50831c 100644
--- a/tools/testing/nvdimm/test/iomap.c
+++ b/tools/testing/nvdimm/test/iomap.c
@@ -65,6 +65,21 @@ void __iomem *__nfit_test_ioremap(resource_size_t offset, unsigned long size,
         return fallback_fn(offset, size);
 }
 
+void __iomem *__wrap_devm_ioremap_nocache(struct device *dev,
+                resource_size_t offset, unsigned long size)
+{
+        struct nfit_test_resource *nfit_res;
+
+        rcu_read_lock();
+        nfit_res = get_nfit_res(offset);
+        rcu_read_unlock();
+        if (nfit_res)
+                return (void __iomem *) nfit_res->buf + offset
+                        - nfit_res->res->start;
+        return devm_ioremap_nocache(dev, offset, size);
+}
+EXPORT_SYMBOL(__wrap_devm_ioremap_nocache);
+
 void __iomem *__wrap_ioremap_cache(resource_size_t offset, unsigned long size)
 {
         return __nfit_test_ioremap(offset, size, ioremap_cache);
@@ -77,6 +92,18 @@ void __iomem *__wrap_ioremap_nocache(resource_size_t offset, unsigned long size)
 }
 EXPORT_SYMBOL(__wrap_ioremap_nocache);
 
+void __iomem *__wrap_ioremap_wt(resource_size_t offset, unsigned long size)
+{
+        return __nfit_test_ioremap(offset, size, ioremap_wt);
+}
+EXPORT_SYMBOL(__wrap_ioremap_wt);
+
+void __iomem *__wrap_ioremap_wc(resource_size_t offset, unsigned long size)
+{
+        return __nfit_test_ioremap(offset, size, ioremap_wc);
+}
+EXPORT_SYMBOL(__wrap_ioremap_wc);
+
 void __wrap_iounmap(volatile void __iomem *addr)
 {
         struct nfit_test_resource *nfit_res;
diff --git a/tools/testing/nvdimm/test/nfit.c b/tools/testing/nvdimm/test/nfit.c
index 4b69b8368de0..d0bdae40ccc9 100644
--- a/tools/testing/nvdimm/test/nfit.c
+++ b/tools/testing/nvdimm/test/nfit.c
@@ -128,6 +128,8 @@ struct nfit_test {
         int num_pm;
         void **dimm;
         dma_addr_t *dimm_dma;
+        void **flush;
+        dma_addr_t *flush_dma;
         void **label;
         dma_addr_t *label_dma;
         void **spa_set;
@@ -155,7 +157,7 @@ static int nfit_test_ctl(struct nvdimm_bus_descriptor *nd_desc,
         int i, rc;
 
         if (!nfit_mem || !test_bit(cmd, &nfit_mem->dsm_mask))
-                return -ENXIO;
+                return -ENOTTY;
 
         /* lookup label space for the given dimm */
         for (i = 0; i < ARRAY_SIZE(handle); i++)
@@ -331,7 +333,8 @@ static int nfit_test0_alloc(struct nfit_test *t)
                         + sizeof(struct acpi_nfit_system_address) * NUM_SPA
                         + sizeof(struct acpi_nfit_memory_map) * NUM_MEM
                         + sizeof(struct acpi_nfit_control_region) * NUM_DCR
-                        + sizeof(struct acpi_nfit_data_region) * NUM_BDW;
+                        + sizeof(struct acpi_nfit_data_region) * NUM_BDW
+                        + sizeof(struct acpi_nfit_flush_address) * NUM_DCR;
         int i;
 
         t->nfit_buf = test_alloc(t, nfit_size, &t->nfit_dma);
@@ -356,6 +359,10 @@ static int nfit_test0_alloc(struct nfit_test *t)
                 if (!t->label[i])
                         return -ENOMEM;
                 sprintf(t->label[i], "label%d", i);
+
+                t->flush[i] = test_alloc(t, 8, &t->flush_dma[i]);
+                if (!t->flush[i])
+                        return -ENOMEM;
         }
 
         for (i = 0; i < NUM_DCR; i++) {
@@ -408,6 +415,7 @@ static void nfit_test0_setup(struct nfit_test *t)
         struct acpi_nfit_system_address *spa;
         struct acpi_nfit_control_region *dcr;
         struct acpi_nfit_data_region *bdw;
+        struct acpi_nfit_flush_address *flush;
         unsigned int offset;
 
         nfit_test_init_header(nfit_buf, size);
@@ -831,6 +839,39 @@ static void nfit_test0_setup(struct nfit_test *t)
         bdw->capacity = DIMM_SIZE;
         bdw->start_address = 0;
 
+        offset = offset + sizeof(struct acpi_nfit_data_region) * 4;
+        /* flush0 (dimm0) */
+        flush = nfit_buf + offset;
+        flush->header.type = ACPI_NFIT_TYPE_FLUSH_ADDRESS;
+        flush->header.length = sizeof(struct acpi_nfit_flush_address);
+        flush->device_handle = handle[0];
+        flush->hint_count = 1;
+        flush->hint_address[0] = t->flush_dma[0];
+
+        /* flush1 (dimm1) */
+        flush = nfit_buf + offset + sizeof(struct acpi_nfit_flush_address) * 1;
+        flush->header.type = ACPI_NFIT_TYPE_FLUSH_ADDRESS;
+        flush->header.length = sizeof(struct acpi_nfit_flush_address);
+        flush->device_handle = handle[1];
+        flush->hint_count = 1;
+        flush->hint_address[0] = t->flush_dma[1];
+
+        /* flush2 (dimm2) */
+        flush = nfit_buf + offset + sizeof(struct acpi_nfit_flush_address) * 2;
+        flush->header.type = ACPI_NFIT_TYPE_FLUSH_ADDRESS;
+        flush->header.length = sizeof(struct acpi_nfit_flush_address);
+        flush->device_handle = handle[2];
+        flush->hint_count = 1;
+        flush->hint_address[0] = t->flush_dma[2];
+
+        /* flush3 (dimm3) */
+        flush = nfit_buf + offset + sizeof(struct acpi_nfit_flush_address) * 3;
+        flush->header.type = ACPI_NFIT_TYPE_FLUSH_ADDRESS;
+        flush->header.length = sizeof(struct acpi_nfit_flush_address);
+        flush->device_handle = handle[3];
+        flush->hint_count = 1;
+        flush->hint_address[0] = t->flush_dma[3];
+
         acpi_desc = &t->acpi_desc;
         set_bit(ND_CMD_GET_CONFIG_SIZE, &acpi_desc->dimm_dsm_force_en);
         set_bit(ND_CMD_GET_CONFIG_DATA, &acpi_desc->dimm_dsm_force_en);
@@ -933,6 +974,10 @@ static int nfit_test_probe(struct platform_device *pdev)
                                 GFP_KERNEL);
                 nfit_test->dimm_dma = devm_kcalloc(dev, num, sizeof(dma_addr_t),
                                 GFP_KERNEL);
+                nfit_test->flush = devm_kcalloc(dev, num, sizeof(void *),
+                                GFP_KERNEL);
+                nfit_test->flush_dma = devm_kcalloc(dev, num, sizeof(dma_addr_t),
+                                GFP_KERNEL);
                 nfit_test->label = devm_kcalloc(dev, num, sizeof(void *),
                                 GFP_KERNEL);
                 nfit_test->label_dma = devm_kcalloc(dev, num,
@@ -943,7 +988,8 @@ static int nfit_test_probe(struct platform_device *pdev)
                                 sizeof(dma_addr_t), GFP_KERNEL);
                 if (nfit_test->dimm && nfit_test->dimm_dma && nfit_test->label
                                 && nfit_test->label_dma && nfit_test->dcr
-                                && nfit_test->dcr_dma)
+                                && nfit_test->dcr_dma && nfit_test->flush
+                                && nfit_test->flush_dma)
                         /* pass */;
                 else
                         return -ENOMEM;
diff --git a/virt/kvm/vfio.c b/virt/kvm/vfio.c
index 620e37f741b8..1dd087da6f31 100644
--- a/virt/kvm/vfio.c
+++ b/virt/kvm/vfio.c
@@ -155,6 +155,8 @@ static int kvm_vfio_set_group(struct kvm_device *dev, long attr, u64 arg)
                 list_add_tail(&kvg->node, &kv->group_list);
                 kvg->vfio_group = vfio_group;
 
+                kvm_arch_start_assignment(dev->kvm);
+
                 mutex_unlock(&kv->lock);
 
                 kvm_vfio_update_coherency(dev);
@@ -190,6 +192,8 @@ static int kvm_vfio_set_group(struct kvm_device *dev, long attr, u64 arg)
                         break;
                 }
 
+                kvm_arch_end_assignment(dev->kvm);
+
                 mutex_unlock(&kv->lock);
 
                 kvm_vfio_group_put_external_user(vfio_group);
@@ -239,6 +243,7 @@ static void kvm_vfio_destroy(struct kvm_device *dev)
                 kvm_vfio_group_put_external_user(kvg->vfio_group);
                 list_del(&kvg->node);
                 kfree(kvg);
+                kvm_arch_end_assignment(dev->kvm);
         }
 
         kvm_vfio_update_coherency(dev);