Backmerge tag 'v4.13-rc2' into drm-next

Linux 4.13-rc2 This is required for drm-misc fixing.
author: Dave Airlie <airlied@redhat.com> 2017-07-26 18:15:43 -0400
committer: Dave Airlie <airlied@redhat.com> 2017-07-26 18:15:43 -0400
commit: 0eb2c0ae578ba00f97c7541e01abbce022d14909 (patch)
tree: 172db28b9232906ddac61b4bf20c4b0c60c85139
parent: 542aefb5a2da8f67b8fb74a24f60ecb3ec479a06 (diff)
parent: 520eccdfe187591a51ea9ab4c1a024ae4d0f68d9 (diff)
450 files changed, 11729 insertions, 4384 deletions
diff --git a/Documentation/devicetree/bindings/net/brcm,amac.txt b/Documentation/devicetree/bindings/net/brcm,amac.txt
index 2fefa1a44afd..ad16c1f481f7 100644
--- a/Documentation/devicetree/bindings/net/brcm,amac.txt
+++ b/Documentation/devicetree/bindings/net/brcm,amac.txt
@@ -11,6 +11,7 @@ Required properties:
 - reg-names:   Names of the registers.
                "amac_base":    Address and length of the GMAC registers
                "idm_base":     Address and length of the GMAC IDM registers
+                                (required for NSP and Northstar2)
                "nicpm_base":   Address and length of the NIC Port Manager
                                registers (required for Northstar2)
 - interrupts:  Interrupt number
diff --git a/Documentation/devicetree/bindings/net/brcm,bgmac-nsp.txt b/Documentation/devicetree/bindings/net/brcm,bgmac-nsp.txt
deleted file mode 100644
index 022946caa7e2..000000000000
--- a/Documentation/devicetree/bindings/net/brcm,bgmac-nsp.txt
+++ /dev/null
@@ -1,24 +0,0 @@
-Broadcom GMAC Ethernet Controller Device Tree Bindings
-------------------------------------------------------------
-Required properties:
- - compatible:  "brcm,bgmac-nsp"
- - reg:         Address and length of the GMAC registers,
-                Address and length of the GMAC IDM registers
- - reg-names:   Names of the registers.  Must have both "gmac_base" and
-                "idm_base"
- - interrupts:  Interrupt number
-Optional properties:
- mac-address:  See ethernet.txt file in the same directory
-Examples:
-gmac0: ethernet@18022000 {
-        compatible = "brcm,bgmac-nsp";
-        reg = <0x18022000 0x1000>,
-              <0x18110000 0x1000>;
-        reg-names = "gmac_base", "idm_base";
-        interrupts = <GIC_SPI 147 IRQ_TYPE_LEVEL_HIGH>;
-        status = "disabled";
-};
diff --git a/Documentation/devicetree/bindings/nvmem/rockchip-efuse.txt b/Documentation/devicetree/bindings/nvmem/rockchip-efuse.txt
index 194926f77194..1ff02afdc55a 100644
--- a/Documentation/devicetree/bindings/nvmem/rockchip-efuse.txt
+++ b/Documentation/devicetree/bindings/nvmem/rockchip-efuse.txt
@@ -4,7 +4,7 @@ Required properties:
 - compatible: Should be one of the following.
  - "rockchip,rk3066a-efuse" - for RK3066a SoCs.
  - "rockchip,rk3188-efuse" - for RK3188 SoCs.
-  - "rockchip,rk322x-efuse" - for RK322x SoCs.
+  - "rockchip,rk3228-efuse" - for RK3228 SoCs.
  - "rockchip,rk3288-efuse" - for RK3288 SoCs.
  - "rockchip,rk3399-efuse" - for RK3399 SoCs.
 - reg: Should contain the registers location and exact eFuse size
diff --git a/Documentation/devicetree/bindings/ptp/brcm,ptp-dte.txt b/Documentation/devicetree/bindings/ptp/brcm,ptp-dte.txt
index 07590bcdad15..7c04e22a5d6a 100644
--- a/Documentation/devicetree/bindings/ptp/brcm,ptp-dte.txt
+++ b/Documentation/devicetree/bindings/ptp/brcm,ptp-dte.txt
@@ -1,13 +1,20 @@
-* Broadcom Digital Timing Engine(DTE) based PTP clock driver
+* Broadcom Digital Timing Engine(DTE) based PTP clock
 Required properties:
- compatible: should be "brcm,ptp-dte"
+- compatible: should contain the core compatibility string
+              and the SoC compatibility string. The SoC
+              compatibility string is to handle SoC specific
+              hardware differences.
+              Core compatibility string:
+                 "brcm,ptp-dte"
+              SoC compatibility strings:
+                 "brcm,iproc-ptp-dte" - for iproc based SoC's
 - reg: address and length of the DTE block's NCO registers
 Example:
-ptp_dte: ptp_dte@180af650 {
+ptp: ptp-dte@180af650 {
-        compatible = "brcm,ptp-dte";
+        compatible = "brcm,iproc-ptp-dte", "brcm,ptp-dte";
        reg = <0x180af650 0x10>;
        status = "okay";
 };
diff --git a/Documentation/devicetree/bindings/serial/fsl-imx-uart.txt b/Documentation/devicetree/bindings/serial/fsl-imx-uart.txt
index e6b572409cf5..574c3a2c77d5 100644
--- a/Documentation/devicetree/bindings/serial/fsl-imx-uart.txt
+++ b/Documentation/devicetree/bindings/serial/fsl-imx-uart.txt
@@ -9,7 +9,6 @@ Optional properties:
 - fsl,irda-mode : Indicate the uart supports irda mode
 - fsl,dte-mode : Indicate the uart works in DTE mode. The uart works
                  in DCE mode by default.
- fsl,dma-size : Indicate the size of the DMA buffer and its periods
 Please check Documentation/devicetree/bindings/serial/serial.txt
 for the complete list of generic properties.
@@ -29,5 +28,4 @@ uart1: serial@73fbc000 {
        interrupts = <31>;
        uart-has-rtscts;
        fsl,dte-mode;
-        fsl,dma-size = <1024 4>;
 };
diff --git a/MAINTAINERS b/MAINTAINERS
index 9387e6aed3b8..a1e772e899ed 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -205,7 +205,6 @@ F:	include/net/9p/
 F:      include/uapi/linux/virtio_9p.h
 F:      include/trace/events/9p.h
 A8293 MEDIA DRIVER
 M:      Antti Palosaari <crope@iki.fi>
 L:      linux-media@vger.kernel.org
@@ -492,13 +491,6 @@ S:	Maintained
 F:      Documentation/hwmon/adt7475
 F:      drivers/hwmon/adt7475.c
-ADXL34X THREE-AXIS DIGITAL ACCELEROMETER DRIVER (ADXL345/ADXL346)
-M:      Michael Hennerich <michael.hennerich@analog.com>
-W:      http://wiki.analog.com/ADXL345
-W:      http://ez.analog.com/community/linux-device-drivers
-S:      Supported
-F:      drivers/input/misc/adxl34x.c
 ADVANSYS SCSI DRIVER
 M:      Matthew Wilcox <matthew@wil.cx>
 M:      Hannes Reinecke <hare@suse.com>
@@ -507,6 +499,13 @@ S:	Maintained
 F:      Documentation/scsi/advansys.txt
 F:      drivers/scsi/advansys.c
+ADXL34X THREE-AXIS DIGITAL ACCELEROMETER DRIVER (ADXL345/ADXL346)
+M:      Michael Hennerich <michael.hennerich@analog.com>
+W:      http://wiki.analog.com/ADXL345
+W:      http://ez.analog.com/community/linux-device-drivers
+S:      Supported
+F:      drivers/input/misc/adxl34x.c
 AEDSP16 DRIVER
 M:      Riccardo Facchetti <fizban@tin.it>
 S:      Maintained
@@ -808,6 +807,12 @@ W:	http://blackfin.uclinux.org/
 S:      Supported
 F:      sound/soc/blackfin/*
+ANALOG DEVICES INC DMA DRIVERS
+M:      Lars-Peter Clausen <lars@metafoo.de>
+W:      http://ez.analog.com/community/linux-device-drivers
+S:      Supported
+F:      drivers/dma/dma-axi-dmac.c
 ANALOG DEVICES INC IIO DRIVERS
 M:      Lars-Peter Clausen <lars@metafoo.de>
 M:      Michael Hennerich <Michael.Hennerich@analog.com>
@@ -820,12 +825,6 @@ X:	drivers/iio/*/adjd*
 F:      drivers/staging/iio/*/ad*
 F:      drivers/staging/iio/trigger/iio-trig-bfin-timer.c
-ANALOG DEVICES INC DMA DRIVERS
-M:      Lars-Peter Clausen <lars@metafoo.de>
-W:      http://ez.analog.com/community/linux-device-drivers
-S:      Supported
-F:      drivers/dma/dma-axi-dmac.c
 ANDROID CONFIG FRAGMENTS
 M:      Rob Herring <robh@kernel.org>
 S:      Supported
@@ -872,6 +871,15 @@ F:	include/linux/apm_bios.h
 F:      include/uapi/linux/apm_bios.h
 F:      drivers/char/apm-emulation.c
+APPARMOR SECURITY MODULE
+M:      John Johansen <john.johansen@canonical.com>
+L:      apparmor@lists.ubuntu.com (subscribers-only, general discussion)
+W:      apparmor.wiki.kernel.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jj/apparmor-dev.git
+S:      Supported
+F:      security/apparmor/
+F:      Documentation/admin-guide/LSM/apparmor.rst
 APPLE BCM5974 MULTITOUCH DRIVER
 M:      Henrik Rydberg <rydberg@bitmath.org>
 L:      linux-input@vger.kernel.org
@@ -895,6 +903,18 @@ M:	Duc Dang <dhdang@apm.com>
 S:      Supported
 F:      arch/arm64/boot/dts/apm/
+APPLIED MICRO (APM) X-GENE SOC EDAC
+M:      Loc Ho <lho@apm.com>
+S:      Supported
+F:      drivers/edac/xgene_edac.c
+F:      Documentation/devicetree/bindings/edac/apm-xgene-edac.txt
+APPLIED MICRO (APM) X-GENE SOC ETHERNET (V2) DRIVER
+M:      Iyappan Subramanian <isubramanian@apm.com>
+M:      Keyur Chudgar <kchudgar@apm.com>
+S:      Supported
+F:      drivers/net/ethernet/apm/xgene-v2/
 APPLIED MICRO (APM) X-GENE SOC ETHERNET DRIVER
 M:      Iyappan Subramanian <isubramanian@apm.com>
 M:      Keyur Chudgar <kchudgar@apm.com>
@@ -905,12 +925,6 @@ F:	drivers/net/phy/mdio-xgene.c
 F:      Documentation/devicetree/bindings/net/apm-xgene-enet.txt
 F:      Documentation/devicetree/bindings/net/apm-xgene-mdio.txt
-APPLIED MICRO (APM) X-GENE SOC ETHERNET (V2) DRIVER
-M:      Iyappan Subramanian <isubramanian@apm.com>
-M:      Keyur Chudgar <kchudgar@apm.com>
-S:      Supported
-F:      drivers/net/ethernet/apm/xgene-v2/
 APPLIED MICRO (APM) X-GENE SOC PMU
 M:      Tai Nguyen <ttnguyen@apm.com>
 S:      Supported
@@ -930,6 +944,12 @@ S:	Maintained
 F:      drivers/video/fbdev/arcfb.c
 F:      drivers/video/fbdev/core/fb_defio.c
+ARC PGU DRM DRIVER
+M:      Alexey Brodkin <abrodkin@synopsys.com>
+S:      Supported
+F:      drivers/gpu/drm/arc/
+F:      Documentation/devicetree/bindings/display/snps,arcpgu.txt
 ARCNET NETWORK LAYER
 M:      Michael Grzeschik <m.grzeschik@pengutronix.de>
 L:      netdev@vger.kernel.org
@@ -937,12 +957,6 @@ S:	Maintained
 F:      drivers/net/arcnet/
 F:      include/uapi/linux/if_arcnet.h
-ARC PGU DRM DRIVER
-M:      Alexey Brodkin <abrodkin@synopsys.com>
-S:      Supported
-F:      drivers/gpu/drm/arc/
-F:      Documentation/devicetree/bindings/display/snps,arcpgu.txt
 ARM ARCHITECTED TIMER DRIVER
 M:      Mark Rutland <mark.rutland@arm.com>
 M:      Marc Zyngier <marc.zyngier@arm.com>
@@ -995,18 +1009,17 @@ S:	Maintained
 T:      git git://git.armlinux.org.uk/~rmk/linux-arm.git
 F:      arch/arm/
-ARM SUB-ARCHITECTURES
-L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
-S:      Maintained
-F:      arch/arm/mach-*/
-F:      arch/arm/plat-*/
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc.git
 ARM PRIMECELL AACI PL041 DRIVER
 M:      Russell King <linux@armlinux.org.uk>
 S:      Maintained
 F:      sound/arm/aaci.*
+ARM PRIMECELL BUS SUPPORT
+M:      Russell King <linux@armlinux.org.uk>
+S:      Maintained
+F:      drivers/amba/
+F:      include/linux/amba/bus.h
 ARM PRIMECELL CLCD PL110 DRIVER
 M:      Russell King <linux@armlinux.org.uk>
 S:      Maintained
@@ -1030,11 +1043,22 @@ S:	Maintained
 F:      drivers/tty/serial/amba-pl01*.c
 F:      include/linux/amba/serial.h
-ARM PRIMECELL BUS SUPPORT
+ARM SMMU DRIVERS
-M:      Russell King <linux@armlinux.org.uk>
+M:      Will Deacon <will.deacon@arm.com>
+R:      Robin Murphy <robin.murphy@arm.com>
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
-F:      drivers/amba/
+F:      drivers/iommu/arm-smmu.c
-F:      include/linux/amba/bus.h
+F:      drivers/iommu/arm-smmu-v3.c
+F:      drivers/iommu/io-pgtable-arm.c
+F:      drivers/iommu/io-pgtable-arm-v7s.c
+ARM SUB-ARCHITECTURES
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+S:      Maintained
+F:      arch/arm/mach-*/
+F:      arch/arm/plat-*/
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc.git
 ARM/ACTIONS SEMI ARCHITECTURE
 M:      Andreas Färber <afaerber@suse.de>
@@ -1067,6 +1091,11 @@ M:	Lennert Buytenhek <kernel@wantstofly.org>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
+ARM/Allwinner SoC Clock Support
+M:      Emilio López <emilio@elopez.com.ar>
+S:      Maintained
+F:      drivers/clk/sunxi/
 ARM/Allwinner sunXi SoC support
 M:      Maxime Ripard <maxime.ripard@free-electrons.com>
 M:      Chen-Yu Tsai <wens@csie.org>
@@ -1081,10 +1110,15 @@ F:	drivers/pinctrl/sunxi/
 F:      drivers/soc/sunxi/
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux.git
-ARM/Allwinner SoC Clock Support
+ARM/Amlogic Meson SoC CLOCK FRAMEWORK
-M:      Emilio López <emilio@elopez.com.ar>
+M:      Neil Armstrong <narmstrong@baylibre.com>
+M:      Jerome Brunet <jbrunet@baylibre.com>
+L:      linux-amlogic@lists.infradead.org
 S:      Maintained
-F:      drivers/clk/sunxi/
+F:      drivers/clk/meson/
+F:      include/dt-bindings/clock/meson*
+F:      include/dt-bindings/clock/gxbb*
+F:      Documentation/devicetree/bindings/clock/amlogic*
 ARM/Amlogic Meson SoC support
 M:      Carlo Caione <carlo@caione.org>
@@ -1096,20 +1130,10 @@ S:	Maintained
 F:      arch/arm/mach-meson/
 F:      arch/arm/boot/dts/meson*
 F:      arch/arm64/boot/dts/amlogic/
-F:      drivers/pinctrl/meson/
+F:      drivers/pinctrl/meson/
 F:      drivers/mmc/host/meson*
 N:      meson
-ARM/Amlogic Meson SoC CLOCK FRAMEWORK
-M:      Neil Armstrong <narmstrong@baylibre.com>
-M:      Jerome Brunet <jbrunet@baylibre.com>
-L:      linux-amlogic@lists.infradead.org
-S:      Maintained
-F:      drivers/clk/meson/
-F:      include/dt-bindings/clock/meson*
-F:      include/dt-bindings/clock/gxbb*
-F:      Documentation/devicetree/bindings/clock/amlogic*
 ARM/Annapurna Labs ALPINE ARCHITECTURE
 M:      Tsahee Zidenberg <tsahee@annapurnalabs.com>
 M:      Antoine Tenart <antoine.tenart@free-electrons.com>
@@ -1132,13 +1156,6 @@ F:	drivers/clk/axis
 F:      drivers/pinctrl/pinctrl-artpec*
 F:      Documentation/devicetree/bindings/pinctrl/axis,artpec6-pinctrl.txt
-ARM/ASPEED MACHINE SUPPORT
-M:      Joel Stanley <joel@jms.id.au>
-S:      Maintained
-F:      arch/arm/mach-aspeed/
-F:      arch/arm/boot/dts/aspeed-*
-F:      drivers/*/*aspeed*
 ARM/ASPEED I2C DRIVER
 M:      Brendan Higgins <brendanhiggins@google.com>
 R:      Benjamin Herrenschmidt <benh@kernel.crashing.org>
@@ -1151,6 +1168,18 @@ F:	drivers/i2c/busses/i2c-aspeed.c
 F:      Documentation/devicetree/bindings/interrupt-controller/aspeed,ast2400-i2c-ic.txt
 F:      Documentation/devicetree/bindings/i2c/i2c-aspeed.txt
+ARM/ASPEED MACHINE SUPPORT
+M:      Joel Stanley <joel@jms.id.au>
+S:      Maintained
+F:      arch/arm/mach-aspeed/
+F:      arch/arm/boot/dts/aspeed-*
+F:      drivers/*/*aspeed*
+ARM/ATMEL AT91 Clock Support
+M:      Boris Brezillon <boris.brezillon@free-electrons.com>
+S:      Maintained
+F:      drivers/clk/at91
 ARM/ATMEL AT91RM9200, AT91SAM9 AND SAMA5 SOC SUPPORT
 M:      Nicolas Ferre <nicolas.ferre@microchip.com>
 M:      Alexandre Belloni <alexandre.belloni@free-electrons.com>
@@ -1167,11 +1196,6 @@ F:	arch/arm/boot/dts/sama*.dtsi
 F:      arch/arm/include/debug/at91.S
 F:      drivers/memory/atmel*
-ARM/ATMEL AT91 Clock Support
-M:      Boris Brezillon <boris.brezillon@free-electrons.com>
-S:      Maintained
-F:      drivers/clk/at91
 ARM/CALXEDA HIGHBANK ARCHITECTURE
 M:      Rob Herring <robh@kernel.org>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
@@ -1198,6 +1222,11 @@ L:	linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Odd Fixes
 N:      clps711x
+ARM/CIRRUS LOGIC EDB9315A MACHINE SUPPORT
+M:      Lennert Buytenhek <kernel@wantstofly.org>
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+S:      Maintained
 ARM/CIRRUS LOGIC EP93XX ARM ARCHITECTURE
 M:      Hartley Sweeten <hsweeten@visionengravers.com>
 M:      Alexander Sverdlin <alexander.sverdlin@gmail.com>
@@ -1206,11 +1235,6 @@ S:	Maintained
 F:      arch/arm/mach-ep93xx/
 F:      arch/arm/mach-ep93xx/include/mach/
-ARM/CIRRUS LOGIC EDB9315A MACHINE SUPPORT
-M:      Lennert Buytenhek <kernel@wantstofly.org>
-L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
-S:      Maintained
 ARM/CLKDEV SUPPORT
 M:      Russell King <linux@armlinux.org.uk>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
@@ -1224,6 +1248,13 @@ M:	Mike Rapoport <mike@compulab.co.il>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
+ARM/CONEXANT DIGICOLOR MACHINE SUPPORT
+M:      Baruch Siach <baruch@tkos.co.il>
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+S:      Maintained
+F:      arch/arm/boot/dts/cx92755*
+N:      digicolor
 ARM/CONTEC MICRO9 MACHINE SUPPORT
 M:      Hubert Feurstein <hubert.feurstein@contec.at>
 S:      Maintained
@@ -1269,13 +1300,6 @@ F:	drivers/clocksource/timer-prima2.c
 F:      drivers/clocksource/timer-atlas7.c
 N:      [^a-z]sirf
-ARM/CONEXANT DIGICOLOR MACHINE SUPPORT
-M:      Baruch Siach <baruch@tkos.co.il>
-L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
-S:      Maintained
-F:      arch/arm/boot/dts/cx92755*
-N:      digicolor
 ARM/EBSA110 MACHINE SUPPORT
 M:      Russell King <linux@armlinux.org.uk>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
@@ -1389,6 +1413,11 @@ L:	linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
 F:      arch/arm/mach-pxa/colibri-pxa270-income.c
+ARM/INTEL IOP13XX ARM ARCHITECTURE
+M:      Lennert Buytenhek <kernel@wantstofly.org>
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+S:      Maintained
 ARM/INTEL IOP32X ARM ARCHITECTURE
 M:      Lennert Buytenhek <kernel@wantstofly.org>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
@@ -1398,11 +1427,6 @@ ARM/INTEL IOP33X ARM ARCHITECTURE
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Orphan
-ARM/INTEL IOP13XX ARM ARCHITECTURE
-M:      Lennert Buytenhek <kernel@wantstofly.org>
-L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
-S:      Maintained
 ARM/INTEL IQ81342EX MACHINE SUPPORT
 M:      Lennert Buytenhek <kernel@wantstofly.org>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
@@ -1437,39 +1461,6 @@ M:	Lennert Buytenhek <kernel@wantstofly.org>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
-ARM/TEXAS INSTRUMENT KEYSTONE ARCHITECTURE
-M:      Santosh Shilimkar <ssantosh@kernel.org>
-L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
-S:      Maintained
-F:      arch/arm/mach-keystone/
-F:      arch/arm/boot/dts/keystone-*
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/ssantosh/linux-keystone.git
-ARM/TEXAS INSTRUMENT KEYSTONE CLOCK FRAMEWORK
-M:      Santosh Shilimkar <ssantosh@kernel.org>
-L:      linux-kernel@vger.kernel.org
-S:      Maintained
-F:      drivers/clk/keystone/
-ARM/TEXAS INSTRUMENT KEYSTONE ClOCKSOURCE
-M:      Santosh Shilimkar <ssantosh@kernel.org>
-L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
-L:      linux-kernel@vger.kernel.org
-S:      Maintained
-F:      drivers/clocksource/timer-keystone.c
-ARM/TEXAS INSTRUMENT KEYSTONE RESET DRIVER
-M:      Santosh Shilimkar <ssantosh@kernel.org>
-L:      linux-kernel@vger.kernel.org
-S:      Maintained
-F:      drivers/power/reset/keystone-reset.c
-ARM/TEXAS INSTRUMENT AEMIF/EMIF DRIVERS
-M:      Santosh Shilimkar <ssantosh@kernel.org>
-L:      linux-kernel@vger.kernel.org
-S:      Maintained
-F:      drivers/memory/*emif*
 ARM/LG1K ARCHITECTURE
 M:      Chanho Min <chanho.min@lge.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
@@ -1512,24 +1503,6 @@ ARM/MAGICIAN MACHINE SUPPORT
 M:      Philipp Zabel <philipp.zabel@gmail.com>
 S:      Maintained
-ARM/Marvell Kirkwood and Armada 370, 375, 38x, 39x, XP, 3700, 7K/8K SOC support
-M:      Jason Cooper <jason@lakedaemon.net>
-M:      Andrew Lunn <andrew@lunn.ch>
-M:      Gregory Clement <gregory.clement@free-electrons.com>
-M:      Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com>
-L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
-S:      Maintained
-F:      arch/arm/boot/dts/armada*
-F:      arch/arm/boot/dts/kirkwood*
-F:      arch/arm/configs/mvebu_*_defconfig
-F:      arch/arm/mach-mvebu/
-F:      arch/arm64/boot/dts/marvell/armada*
-F:      drivers/cpufreq/mvebu-cpufreq.c
-F:      drivers/irqchip/irq-armada-370-xp.c
-F:      drivers/irqchip/irq-mvebu-*
-F:      drivers/pinctrl/mvebu/
-F:      drivers/rtc/rtc-armada38x.c
 ARM/Marvell Berlin SoC support
 M:      Jisheng Zhang <jszhang@marvell.com>
 M:      Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com>
@@ -1539,7 +1512,6 @@ F:	arch/arm/mach-berlin/
 F:      arch/arm/boot/dts/berlin*
 F:      arch/arm64/boot/dts/marvell/berlin*
 ARM/Marvell Dove/MV78xx0/Orion SOC support
 M:      Jason Cooper <jason@lakedaemon.net>
 M:      Andrew Lunn <andrew@lunn.ch>
@@ -1555,24 +1527,23 @@ F:	arch/arm/plat-orion/
 F:      arch/arm/boot/dts/dove*
 F:      arch/arm/boot/dts/orion5x*
+ARM/Marvell Kirkwood and Armada 370, 375, 38x, 39x, XP, 3700, 7K/8K SOC support
-ARM/Orion SoC/Technologic Systems TS-78xx platform support
+M:      Jason Cooper <jason@lakedaemon.net>
-M:      Alexander Clouter <alex@digriz.org.uk>
+M:      Andrew Lunn <andrew@lunn.ch>
-L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+M:      Gregory Clement <gregory.clement@free-electrons.com>
-W:      http://www.digriz.org.uk/ts78xx/kernel
+M:      Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com>
-S:      Maintained
-F:      arch/arm/mach-orion5x/ts78xx-*
-ARM/OXNAS platform support
-M:      Neil Armstrong <narmstrong@baylibre.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
-L:      linux-oxnas@lists.tuxfamily.org (moderated for non-subscribers)
 S:      Maintained
-F:      arch/arm/mach-oxnas/
+F:      arch/arm/boot/dts/armada*
-F:      arch/arm/boot/dts/ox8*.dtsi
+F:      arch/arm/boot/dts/kirkwood*
-F:      arch/arm/boot/dts/wd-mbwe.dts
+F:      arch/arm/configs/mvebu_*_defconfig
-F:      arch/arm/boot/dts/cloudengines-pogoplug-series-3.dts
+F:      arch/arm/mach-mvebu/
-N:      oxnas
+F:      arch/arm64/boot/dts/marvell/armada*
+F:      drivers/cpufreq/mvebu-cpufreq.c
+F:      drivers/irqchip/irq-armada-370-xp.c
+F:      drivers/irqchip/irq-mvebu-*
+F:      drivers/pinctrl/mvebu/
+F:      drivers/rtc/rtc-armada38x.c
 ARM/Mediatek RTC DRIVER
 M:      Eddie Huang <eddie.huang@mediatek.com>
@@ -1627,16 +1598,53 @@ F:	drivers/pinctrl/nomadik/
 F:      drivers/i2c/busses/i2c-nomadik.c
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-nomadik.git
+ARM/NUVOTON W90X900 ARM ARCHITECTURE
+M:      Wan ZongShun <mcuos.com@gmail.com>
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+W:      http://www.mcuos.com
+S:      Maintained
+F:      arch/arm/mach-w90x900/
+F:      drivers/input/keyboard/w90p910_keypad.c
+F:      drivers/input/touchscreen/w90p910_ts.c
+F:      drivers/watchdog/nuc900_wdt.c
+F:      drivers/net/ethernet/nuvoton/w90p910_ether.c
+F:      drivers/mtd/nand/nuc900_nand.c
+F:      drivers/rtc/rtc-nuc900.c
+F:      drivers/spi/spi-nuc900.c
+F:      drivers/usb/host/ehci-w90x900.c
+F:      drivers/video/fbdev/nuc900fb.c
 ARM/OPENMOKO NEO FREERUNNER (GTA02) MACHINE SUPPORT
 M:      Nelson Castillo <arhuaco@freaks-unidos.net>
 L:      openmoko-kernel@lists.openmoko.org (subscribers-only)
 W:      http://wiki.openmoko.org/wiki/Neo_FreeRunner
 S:      Supported
-ARM/TOSA MACHINE SUPPORT
+ARM/Orion SoC/Technologic Systems TS-78xx platform support
-M:      Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+M:      Alexander Clouter <alex@digriz.org.uk>
-M:      Dirk Opfer <dirk@opfer-online.de>
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+W:      http://www.digriz.org.uk/ts78xx/kernel
+S:      Maintained
+F:      arch/arm/mach-orion5x/ts78xx-*
+ARM/OXNAS platform support
+M:      Neil Armstrong <narmstrong@baylibre.com>
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+L:      linux-oxnas@lists.tuxfamily.org (moderated for non-subscribers)
 S:      Maintained
+F:      arch/arm/mach-oxnas/
+F:      arch/arm/boot/dts/ox8*.dtsi
+F:      arch/arm/boot/dts/wd-mbwe.dts
+F:      arch/arm/boot/dts/cloudengines-pogoplug-series-3.dts
+N:      oxnas
+ARM/PALM TREO SUPPORT
+M:      Tomas Cech <sleep_walker@suse.com>
+L:      linux-arm-kernel@lists.infradead.org
+W:      http://hackndev.com
+S:      Maintained
+F:      arch/arm/mach-pxa/include/mach/palmtreo.h
+F:      arch/arm/mach-pxa/palmtreo.c
 ARM/PALMTX,PALMT5,PALMLD,PALMTE2,PALMTC SUPPORT
 M:      Marek Vasut <marek.vasut@gmail.com>
@@ -1654,14 +1662,6 @@ F:	arch/arm/mach-pxa/palmte2.c
 F:      arch/arm/mach-pxa/include/mach/palmtc.h
 F:      arch/arm/mach-pxa/palmtc.c
-ARM/PALM TREO SUPPORT
-M:      Tomas Cech <sleep_walker@suse.com>
-L:      linux-arm-kernel@lists.infradead.org
-W:      http://hackndev.com
-S:      Maintained
-F:      arch/arm/mach-pxa/include/mach/palmtreo.h
-F:      arch/arm/mach-pxa/palmtreo.c
 ARM/PALMZ72 SUPPORT
 M:      Sergey Lapin <slapin@ossfans.org>
 L:      linux-arm-kernel@lists.infradead.org
@@ -1802,17 +1802,6 @@ L:	linux-media@vger.kernel.org
 S:      Maintained
 F:      drivers/media/platform/s5p-g2d/
-ARM/SAMSUNG S5P SERIES Multi Format Codec (MFC) SUPPORT
-M:      Kyungmin Park <kyungmin.park@samsung.com>
-M:      Kamil Debski <kamil@wypas.org>
-M:      Jeongtae Park <jtp.park@samsung.com>
-M:      Andrzej Hajda <a.hajda@samsung.com>
-L:      linux-arm-kernel@lists.infradead.org
-L:      linux-media@vger.kernel.org
-S:      Maintained
-F:      arch/arm/plat-samsung/s5p-dev-mfc.c
-F:      drivers/media/platform/s5p-mfc/
 ARM/SAMSUNG S5P SERIES HDMI CEC SUBSYSTEM SUPPORT
 M:      Marek Szyprowski <m.szyprowski@samsung.com>
 L:      linux-samsung-soc@vger.kernel.org (moderated for non-subscribers)
@@ -1829,6 +1818,17 @@ L:	linux-media@vger.kernel.org
 S:      Maintained
 F:      drivers/media/platform/s5p-jpeg/
+ARM/SAMSUNG S5P SERIES Multi Format Codec (MFC) SUPPORT
+M:      Kyungmin Park <kyungmin.park@samsung.com>
+M:      Kamil Debski <kamil@wypas.org>
+M:      Jeongtae Park <jtp.park@samsung.com>
+M:      Andrzej Hajda <a.hajda@samsung.com>
+L:      linux-arm-kernel@lists.infradead.org
+L:      linux-media@vger.kernel.org
+S:      Maintained
+F:      arch/arm/plat-samsung/s5p-dev-mfc.c
+F:      drivers/media/platform/s5p-mfc/
 ARM/SHMOBILE ARM ARCHITECTURE
 M:      Simon Horman <horms@verge.net.au>
 M:      Magnus Damm <magnus.damm@gmail.com>
@@ -1922,26 +1922,48 @@ M:	"Mark F. Brown" <mark.brown314@gmail.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
+ARM/TEXAS INSTRUMENT AEMIF/EMIF DRIVERS
+M:      Santosh Shilimkar <ssantosh@kernel.org>
+L:      linux-kernel@vger.kernel.org
+S:      Maintained
+F:      drivers/memory/*emif*
+ARM/TEXAS INSTRUMENT KEYSTONE ARCHITECTURE
+M:      Santosh Shilimkar <ssantosh@kernel.org>
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+S:      Maintained
+F:      arch/arm/mach-keystone/
+F:      arch/arm/boot/dts/keystone-*
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/ssantosh/linux-keystone.git
+ARM/TEXAS INSTRUMENT KEYSTONE CLOCK FRAMEWORK
+M:      Santosh Shilimkar <ssantosh@kernel.org>
+L:      linux-kernel@vger.kernel.org
+S:      Maintained
+F:      drivers/clk/keystone/
+ARM/TEXAS INSTRUMENT KEYSTONE ClOCKSOURCE
+M:      Santosh Shilimkar <ssantosh@kernel.org>
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+L:      linux-kernel@vger.kernel.org
+S:      Maintained
+F:      drivers/clocksource/timer-keystone.c
+ARM/TEXAS INSTRUMENT KEYSTONE RESET DRIVER
+M:      Santosh Shilimkar <ssantosh@kernel.org>
+L:      linux-kernel@vger.kernel.org
+S:      Maintained
+F:      drivers/power/reset/keystone-reset.c
 ARM/THECUS N2100 MACHINE SUPPORT
 M:      Lennert Buytenhek <kernel@wantstofly.org>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
-ARM/NUVOTON W90X900 ARM ARCHITECTURE
+ARM/TOSA MACHINE SUPPORT
-M:      Wan ZongShun <mcuos.com@gmail.com>
+M:      Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
-L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+M:      Dirk Opfer <dirk@opfer-online.de>
-W:      http://www.mcuos.com
 S:      Maintained
-F:      arch/arm/mach-w90x900/
-F:      drivers/input/keyboard/w90p910_keypad.c
-F:      drivers/input/touchscreen/w90p910_ts.c
-F:      drivers/watchdog/nuc900_wdt.c
-F:      drivers/net/ethernet/nuvoton/w90p910_ether.c
-F:      drivers/mtd/nand/nuc900_nand.c
-F:      drivers/rtc/rtc-nuc900.c
-F:      drivers/spi/spi-nuc900.c
-F:      drivers/usb/host/ehci-w90x900.c
-F:      drivers/video/fbdev/nuc900fb.c
 ARM/U300 MACHINE SUPPORT
 M:      Linus Walleij <linus.walleij@linaro.org>
@@ -2086,16 +2108,6 @@ F:	drivers/i2c/busses/i2c-cadence.c
 F:      drivers/mmc/host/sdhci-of-arasan.c
 F:      drivers/edac/synopsys_edac.c
-ARM SMMU DRIVERS
-M:      Will Deacon <will.deacon@arm.com>
-R:      Robin Murphy <robin.murphy@arm.com>
-L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
-S:      Maintained
-F:      drivers/iommu/arm-smmu.c
-F:      drivers/iommu/arm-smmu-v3.c
-F:      drivers/iommu/io-pgtable-arm.c
-F:      drivers/iommu/io-pgtable-arm-v7s.c
 ARM64 PORT (AARCH64 ARCHITECTURE)
 M:      Catalin Marinas <catalin.marinas@arm.com>
 M:      Will Deacon <will.deacon@arm.com>
@@ -2207,21 +2219,10 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git
 S:      Supported
 F:      drivers/net/wireless/ath/ath6kl/
-WILOCITY WIL6210 WIRELESS DRIVER
+ATI_REMOTE2 DRIVER
-M:      Maya Erez <qca_merez@qca.qualcomm.com>
+M:      Ville Syrjala <syrjala@sci.fi>
-L:      linux-wireless@vger.kernel.org
-L:      wil6210@qca.qualcomm.com
-S:      Supported
-W:      http://wireless.kernel.org/en/users/Drivers/wil6210
-F:      drivers/net/wireless/ath/wil6210/
-F:      include/uapi/linux/wil6210_uapi.h
-CARL9170 LINUX COMMUNITY WIRELESS DRIVER
-M:      Christian Lamparter <chunkeey@googlemail.com>
-L:      linux-wireless@vger.kernel.org
-W:      http://wireless.kernel.org/en/users/Drivers/carl9170
 S:      Maintained
-F:      drivers/net/wireless/ath/carl9170/
+F:      drivers/input/misc/ati_remote2.c
 ATK0110 HWMON DRIVER
 M:      Luca Tettamanti <kronos.it@gmail.com>
@@ -2229,11 +2230,6 @@ L:	linux-hwmon@vger.kernel.org
 S:      Maintained
 F:      drivers/hwmon/asus_atk0110.c
-ATI_REMOTE2 DRIVER
-M:      Ville Syrjala <syrjala@sci.fi>
-S:      Maintained
-F:      drivers/input/misc/ati_remote2.c
 ATLX ETHERNET DRIVERS
 M:      Jay Cliburn <jcliburn@gmail.com>
 M:      Chris Snook <chris.snook@gmail.com>
@@ -2263,25 +2259,12 @@ M:	Nicolas Ferre <nicolas.ferre@microchip.com>
 S:      Supported
 F:      drivers/power/reset/at91-sama5d2_shdwc.c
-ATMEL SAMA5D2 ADC DRIVER
-M:      Ludovic Desroches <ludovic.desroches@microchip.com>
-L:      linux-iio@vger.kernel.org
-S:      Supported
-F:      drivers/iio/adc/at91-sama5d2_adc.c
 ATMEL Audio ALSA driver
 M:      Nicolas Ferre <nicolas.ferre@microchip.com>
 L:      alsa-devel@alsa-project.org (moderated for non-subscribers)
 S:      Supported
 F:      sound/soc/atmel
-ATMEL XDMA DRIVER
-M:      Ludovic Desroches <ludovic.desroches@microchip.com>
-L:      linux-arm-kernel@lists.infradead.org
-L:      dmaengine@vger.kernel.org
-S:      Supported
-F:      drivers/dma/at_xdmac.c
 ATMEL I2C DRIVER
 M:      Ludovic Desroches <ludovic.desroches@microchip.com>
 L:      linux-i2c@vger.kernel.org
@@ -2307,6 +2290,14 @@ M:	Nicolas Ferre <nicolas.ferre@microchip.com>
 S:      Supported
 F:      drivers/net/ethernet/cadence/
+ATMEL MAXTOUCH DRIVER
+M:      Nick Dyer <nick@shmanahar.org>
+T:      git git://github.com/ndyer/linux.git
+S:      Maintained
+F:      Documentation/devicetree/bindings/input/atmel,maxtouch.txt
+F:      drivers/input/touchscreen/atmel_mxt_ts.c
+F:      include/linux/platform_data/atmel_mxt_ts.h
 ATMEL NAND DRIVER
 M:      Wenyou Yang <wenyou.yang@atmel.com>
 M:      Josh Wu <rainyfeeling@outlook.com>
@@ -2314,6 +2305,12 @@ L:	linux-mtd@lists.infradead.org
 S:      Supported
 F:      drivers/mtd/nand/atmel/*
+ATMEL SAMA5D2 ADC DRIVER
+M:      Ludovic Desroches <ludovic.desroches@microchip.com>
+L:      linux-iio@vger.kernel.org
+S:      Supported
+F:      drivers/iio/adc/at91-sama5d2_adc.c
 ATMEL SDMMC DRIVER
 M:      Ludovic Desroches <ludovic.desroches@microchip.com>
 L:      linux-mmc@vger.kernel.org
@@ -2353,13 +2350,12 @@ W:	http://atmelwlandriver.sourceforge.net/
 S:      Maintained
 F:      drivers/net/wireless/atmel/atmel*
-ATMEL MAXTOUCH DRIVER
+ATMEL XDMA DRIVER
-M:      Nick Dyer <nick@shmanahar.org>
+M:      Ludovic Desroches <ludovic.desroches@microchip.com>
-T:      git git://github.com/ndyer/linux.git
+L:      linux-arm-kernel@lists.infradead.org
-S:      Maintained
+L:      dmaengine@vger.kernel.org
-F:      Documentation/devicetree/bindings/input/atmel,maxtouch.txt
+S:      Supported
-F:      drivers/input/touchscreen/atmel_mxt_ts.c
+F:      drivers/dma/at_xdmac.c
-F:      include/linux/platform_data/atmel_mxt_ts.h
 ATOMIC INFRASTRUCTURE
 M:      Will Deacon <will.deacon@arm.com>
@@ -2413,13 +2409,6 @@ F:	include/uapi/linux/ax25.h
 F:      include/net/ax25.h
 F:      net/ax25/
-AXENTIA ASOC DRIVERS
-M:      Peter Rosin <peda@axentia.se>
-L:      alsa-devel@alsa-project.org (moderated for non-subscribers)
-S:      Maintained
-F:      Documentation/devicetree/bindings/sound/axentia,*
-F:      sound/soc/atmel/tse850-pcm5142.c
 AXENTIA ARM DEVICES
 M:      Peter Rosin <peda@axentia.se>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
@@ -2428,6 +2417,13 @@ F:	Documentation/devicetree/bindings/arm/axentia.txt
 F:      arch/arm/boot/dts/at91-linea.dtsi
 F:      arch/arm/boot/dts/at91-tse850-3.dts
+AXENTIA ASOC DRIVERS
+M:      Peter Rosin <peda@axentia.se>
+L:      alsa-devel@alsa-project.org (moderated for non-subscribers)
+S:      Maintained
+F:      Documentation/devicetree/bindings/sound/axentia,*
+F:      sound/soc/atmel/tse850-pcm5142.c
 AZ6007 DVB DRIVER
 M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
 M:      Mauro Carvalho Chehab <mchehab@kernel.org>
@@ -2507,13 +2503,11 @@ W:	https://linuxtv.org
 S:      Supported
 F:      drivers/media/platform/sti/bdisp
-DELTA ST MEDIA DRIVER
+BECKHOFF CX5020 ETHERCAT MASTER DRIVER
-M:      Hugues Fruchet <hugues.fruchet@st.com>
+M:      Dariusz Marcinkiewicz <reksio@newterm.pl>
-L:      linux-media@vger.kernel.org
+L:      netdev@vger.kernel.org
-T:      git git://linuxtv.org/media_tree.git
+S:      Maintained
-W:      https://linuxtv.org
+F:      drivers/net/ethernet/ec_bhf.c
-S:      Supported
-F:      drivers/media/platform/sti/delta
 BEFS FILE SYSTEM
 M:      Luis de Bethencourt <luisbg@kernel.org>
@@ -2523,11 +2517,13 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/luisbg/linux-befs.git
 F:      Documentation/filesystems/befs.txt
 F:      fs/befs/
-BECKHOFF CX5020 ETHERCAT MASTER DRIVER
+BFQ I/O SCHEDULER
-M:      Dariusz Marcinkiewicz <reksio@newterm.pl>
+M:      Paolo Valente <paolo.valente@linaro.org>
-L:      netdev@vger.kernel.org
+M:      Jens Axboe <axboe@kernel.dk>
+L:      linux-block@vger.kernel.org
 S:      Maintained
-F:      drivers/net/ethernet/ec_bhf.c
+F:      block/bfq-*
+F:      Documentation/block/bfq-iosched.txt
 BFS FILE SYSTEM
 M:      "Tigran A. Aivazian" <aivazian.tigran@gmail.com>
@@ -2550,6 +2546,22 @@ W:	http://blackfin.uclinux.org
 S:      Supported
 F:      drivers/net/ethernet/adi/
+BLACKFIN I2C TWI DRIVER
+M:      Sonic Zhang <sonic.zhang@analog.com>
+L:      adi-buildroot-devel@lists.sourceforge.net (moderated for non-subscribers)
+W:      http://blackfin.uclinux.org/
+S:      Supported
+F:      drivers/i2c/busses/i2c-bfin-twi.c
+BLACKFIN MEDIA DRIVER
+M:      Scott Jiang <scott.jiang.linux@gmail.com>
+L:      adi-buildroot-devel@lists.sourceforge.net (moderated for non-subscribers)
+W:      http://blackfin.uclinux.org/
+S:      Supported
+F:      drivers/media/platform/blackfin/
+F:      drivers/media/i2c/adv7183*
+F:      drivers/media/i2c/vs6624*
 BLACKFIN RTC DRIVER
 L:      adi-buildroot-devel@lists.sourceforge.net (moderated for non-subscribers)
 W:      http://blackfin.uclinux.org
@@ -2576,22 +2588,6 @@ W:	http://blackfin.uclinux.org
 S:      Supported
 F:      drivers/watchdog/bfin_wdt.c
-BLACKFIN I2C TWI DRIVER
-M:      Sonic Zhang <sonic.zhang@analog.com>
-L:      adi-buildroot-devel@lists.sourceforge.net (moderated for non-subscribers)
-W:      http://blackfin.uclinux.org/
-S:      Supported
-F:      drivers/i2c/busses/i2c-bfin-twi.c
-BLACKFIN MEDIA DRIVER
-M:      Scott Jiang <scott.jiang.linux@gmail.com>
-L:      adi-buildroot-devel@lists.sourceforge.net (moderated for non-subscribers)
-W:      http://blackfin.uclinux.org/
-S:      Supported
-F:      drivers/media/platform/blackfin/
-F:      drivers/media/i2c/adv7183*
-F:      drivers/media/i2c/vs6624*
 BLINKM RGB LED DRIVER
 M:      Jan-Simon Moeller <jansimon.moeller@gmx.de>
 S:      Maintained
@@ -2606,14 +2602,6 @@ F:	block/
 F:      kernel/trace/blktrace.c
 F:      lib/sbitmap.c
-BFQ I/O SCHEDULER
-M:      Paolo Valente <paolo.valente@linaro.org>
-M:      Jens Axboe <axboe@kernel.dk>
-L:      linux-block@vger.kernel.org
-S:      Maintained
-F:      block/bfq-*
-F:      Documentation/block/bfq-iosched.txt
 BLOCK2MTD DRIVER
 M:      Joern Engel <joern@lazybastard.org>
 L:      linux-mtd@lists.infradead.org
@@ -2643,21 +2631,6 @@ S:	Maintained
 F:      net/bluetooth/
 F:      include/net/bluetooth/
-DMA MAPPING HELPERS
-M:      Christoph Hellwig <hch@lst.de>
-M:      Marek Szyprowski <m.szyprowski@samsung.com>
-R:      Robin Murphy <robin.murphy@arm.com>
-L:      linux-kernel@vger.kernel.org
-T:      git git://git.infradead.org/users/hch/dma-mapping.git
-W:      http://git.infradead.org/users/hch/dma-mapping.git
-S:      Supported
-F:      lib/dma-debug.c
-F:      lib/dma-noop.c
-F:      lib/dma-virt.c
-F:      drivers/base/dma-mapping.c
-F:      drivers/base/dma-coherent.c
-F:      include/linux/dma-mapping.h
 BONDING DRIVER
 M:      Jay Vosburgh <j.vosburgh@gmail.com>
 M:      Veaceslav Falico <vfalico@gmail.com>
@@ -2705,35 +2678,6 @@ S:	Supported
 F:      drivers/net/dsa/b53/*
 F:      include/linux/platform_data/b53.h
-BROADCOM GENET ETHERNET DRIVER
-M:      Florian Fainelli <f.fainelli@gmail.com>
-L:      netdev@vger.kernel.org
-S:      Supported
-F:      drivers/net/ethernet/broadcom/genet/
-BROADCOM BNX2 GIGABIT ETHERNET DRIVER
-M:      Rasesh Mody <rasesh.mody@cavium.com>
-M:      Harish Patil <harish.patil@cavium.com>
-M:      Dept-GELinuxNICDev@cavium.com
-L:      netdev@vger.kernel.org
-S:      Supported
-F:      drivers/net/ethernet/broadcom/bnx2.*
-F:      drivers/net/ethernet/broadcom/bnx2_*
-BROADCOM BNX2X 10 GIGABIT ETHERNET DRIVER
-M:      Yuval Mintz <Yuval.Mintz@cavium.com>
-M:      Ariel Elior <ariel.elior@cavium.com>
-M:      everest-linux-l2@cavium.com
-L:      netdev@vger.kernel.org
-S:      Supported
-F:      drivers/net/ethernet/broadcom/bnx2x/
-BROADCOM BNXT_EN 50 GIGABIT ETHERNET DRIVER
-M:      Michael Chan <michael.chan@broadcom.com>
-L:      netdev@vger.kernel.org
-S:      Supported
-F:      drivers/net/ethernet/broadcom/bnxt/
 BROADCOM BCM281XX/BCM11XXX/BCM216XX ARM ARCHITECTURE
 M:      Florian Fainelli <f.fainelli@gmail.com>
 M:      Ray Jui <rjui@broadcom.com>
@@ -2812,6 +2756,13 @@ F:	arch/arm/boot/dts/bcm7*.dts*
 F:      drivers/bus/brcmstb_gisb.c
 N:      brcmstb
+BROADCOM BMIPS CPUFREQ DRIVER
+M:      Markus Mayer <mmayer@broadcom.com>
+M:      bcm-kernel-feedback-list@broadcom.com
+L:      linux-pm@vger.kernel.org
+S:      Maintained
+F:      drivers/cpufreq/bmips-cpufreq.c
 BROADCOM BMIPS MIPS ARCHITECTURE
 M:      Kevin Cernekee <cernekee@gmail.com>
 M:      Florian Fainelli <f.fainelli@gmail.com>
@@ -2828,20 +2779,40 @@ F:	drivers/irqchip/irq-brcmstb*
 F:      include/linux/bcm963xx_nvram.h
 F:      include/linux/bcm963xx_tag.h
-BROADCOM BMIPS CPUFREQ DRIVER
+BROADCOM BNX2 GIGABIT ETHERNET DRIVER
-M:      Markus Mayer <mmayer@broadcom.com>
+M:      Rasesh Mody <rasesh.mody@cavium.com>
-M:      bcm-kernel-feedback-list@broadcom.com
+M:      Harish Patil <harish.patil@cavium.com>
-L:      linux-pm@vger.kernel.org
+M:      Dept-GELinuxNICDev@cavium.com
-S:      Maintained
+L:      netdev@vger.kernel.org
-F:      drivers/cpufreq/bmips-cpufreq.c
+S:      Supported
+F:      drivers/net/ethernet/broadcom/bnx2.*
+F:      drivers/net/ethernet/broadcom/bnx2_*
-BROADCOM TG3 GIGABIT ETHERNET DRIVER
+BROADCOM BNX2FC 10 GIGABIT FCOE DRIVER
-M:      Siva Reddy Kallam <siva.kallam@broadcom.com>
+M:      QLogic-Storage-Upstream@qlogic.com
-M:      Prashant Sreedharan <prashant@broadcom.com>
+L:      linux-scsi@vger.kernel.org
-M:      Michael Chan <mchan@broadcom.com>
+S:      Supported
+F:      drivers/scsi/bnx2fc/
+BROADCOM BNX2I 1/10 GIGABIT iSCSI DRIVER
+M:      QLogic-Storage-Upstream@qlogic.com
+L:      linux-scsi@vger.kernel.org
+S:      Supported
+F:      drivers/scsi/bnx2i/
+BROADCOM BNX2X 10 GIGABIT ETHERNET DRIVER
+M:      Yuval Mintz <Yuval.Mintz@cavium.com>
+M:      Ariel Elior <ariel.elior@cavium.com>
+M:      everest-linux-l2@cavium.com
 L:      netdev@vger.kernel.org
 S:      Supported
-F:      drivers/net/ethernet/broadcom/tg3.*
+F:      drivers/net/ethernet/broadcom/bnx2x/
+BROADCOM BNXT_EN 50 GIGABIT ETHERNET DRIVER
+M:      Michael Chan <michael.chan@broadcom.com>
+L:      netdev@vger.kernel.org
+S:      Supported
+F:      drivers/net/ethernet/broadcom/bnxt/
 BROADCOM BRCM80211 IEEE802.11n WIRELESS DRIVER
 M:      Arend van Spriel <arend.vanspriel@broadcom.com>
@@ -2855,17 +2826,18 @@ L:	brcm80211-dev-list@cypress.com
 S:      Supported
 F:      drivers/net/wireless/broadcom/brcm80211/
-BROADCOM BNX2FC 10 GIGABIT FCOE DRIVER
+BROADCOM BRCMSTB GPIO DRIVER
-M:      QLogic-Storage-Upstream@qlogic.com
+M:      Gregory Fong <gregory.0xf0@gmail.com>
-L:      linux-scsi@vger.kernel.org
+L:      bcm-kernel-feedback-list@broadcom.com
 S:      Supported
-F:      drivers/scsi/bnx2fc/
+F:      drivers/gpio/gpio-brcmstb.c
+F:      Documentation/devicetree/bindings/gpio/brcm,brcmstb-gpio.txt
-BROADCOM BNX2I 1/10 GIGABIT iSCSI DRIVER
+BROADCOM GENET ETHERNET DRIVER
-M:      QLogic-Storage-Upstream@qlogic.com
+M:      Florian Fainelli <f.fainelli@gmail.com>
-L:      linux-scsi@vger.kernel.org
+L:      netdev@vger.kernel.org
 S:      Supported
-F:      drivers/scsi/bnx2i/
+F:      drivers/net/ethernet/broadcom/genet/
 BROADCOM IPROC ARM ARCHITECTURE
 M:      Ray Jui <rjui@broadcom.com>
@@ -2892,13 +2864,6 @@ F:	arch/arm64/boot/dts/broadcom/ns2*
 F:      drivers/clk/bcm/clk-ns*
 F:      drivers/pinctrl/bcm/pinctrl-ns*
-BROADCOM BRCMSTB GPIO DRIVER
-M:      Gregory Fong <gregory.0xf0@gmail.com>
-L:      bcm-kernel-feedback-list@broadcom.com
-S:      Supported
-F:      drivers/gpio/gpio-brcmstb.c
-F:      Documentation/devicetree/bindings/gpio/brcm,brcmstb-gpio.txt
 BROADCOM KONA GPIO DRIVER
 M:      Ray Jui <rjui@broadcom.com>
 L:      bcm-kernel-feedback-list@broadcom.com
@@ -2906,19 +2871,29 @@ S:	Supported
 F:      drivers/gpio/gpio-bcm-kona.c
 F:      Documentation/devicetree/bindings/gpio/brcm,kona-gpio.txt
+BROADCOM NETXTREME-E ROCE DRIVER
+M:      Selvin Xavier <selvin.xavier@broadcom.com>
+M:      Devesh Sharma <devesh.sharma@broadcom.com>
+M:      Somnath Kotur <somnath.kotur@broadcom.com>
+M:      Sriharsha Basavapatna <sriharsha.basavapatna@broadcom.com>
+L:      linux-rdma@vger.kernel.org
+W:      http://www.broadcom.com
+S:      Supported
+F:      drivers/infiniband/hw/bnxt_re/
+F:      include/uapi/rdma/bnxt_re-abi.h
 BROADCOM NVRAM DRIVER
 M:      Rafał Miłecki <zajec5@gmail.com>
 L:      linux-mips@linux-mips.org
 S:      Maintained
 F:      drivers/firmware/broadcom/*
-BROADCOM STB NAND FLASH DRIVER
+BROADCOM SPECIFIC AMBA DRIVER (BCMA)
-M:      Brian Norris <computersforpeace@gmail.com>
+M:      Rafał Miłecki <zajec5@gmail.com>
-M:      Kamal Dasu <kdasu.kdev@gmail.com>
+L:      linux-wireless@vger.kernel.org
-L:      linux-mtd@lists.infradead.org
-L:      bcm-kernel-feedback-list@broadcom.com
 S:      Maintained
-F:      drivers/mtd/nand/brcmnand/
+F:      drivers/bcma/
+F:      include/linux/bcma/
 BROADCOM STB AVS CPUFREQ DRIVER
 M:      Markus Mayer <mmayer@broadcom.com>
@@ -2928,12 +2903,13 @@ S:	Maintained
 F:      Documentation/devicetree/bindings/cpufreq/brcm,stb-avs-cpu-freq.txt
 F:      drivers/cpufreq/brcmstb*
-BROADCOM SPECIFIC AMBA DRIVER (BCMA)
+BROADCOM STB NAND FLASH DRIVER
-M:      Rafał Miłecki <zajec5@gmail.com>
+M:      Brian Norris <computersforpeace@gmail.com>
-L:      linux-wireless@vger.kernel.org
+M:      Kamal Dasu <kdasu.kdev@gmail.com>
+L:      linux-mtd@lists.infradead.org
+L:      bcm-kernel-feedback-list@broadcom.com
 S:      Maintained
-F:      drivers/bcma/
+F:      drivers/mtd/nand/brcmnand/
-F:      include/linux/bcma/
 BROADCOM SYSTEMPORT ETHERNET DRIVER
 M:      Florian Fainelli <f.fainelli@gmail.com>
@@ -2941,16 +2917,13 @@ L:	netdev@vger.kernel.org
 S:      Supported
 F:      drivers/net/ethernet/broadcom/bcmsysport.*
-BROADCOM NETXTREME-E ROCE DRIVER
+BROADCOM TG3 GIGABIT ETHERNET DRIVER
-M:      Selvin Xavier <selvin.xavier@broadcom.com>
+M:      Siva Reddy Kallam <siva.kallam@broadcom.com>
-M:      Devesh Sharma <devesh.sharma@broadcom.com>
+M:      Prashant Sreedharan <prashant@broadcom.com>
-M:      Somnath Kotur <somnath.kotur@broadcom.com>
+M:      Michael Chan <mchan@broadcom.com>
-M:      Sriharsha Basavapatna <sriharsha.basavapatna@broadcom.com>
+L:      netdev@vger.kernel.org
-L:      linux-rdma@vger.kernel.org
-W:      http://www.broadcom.com
 S:      Supported
-F:      drivers/infiniband/hw/bnxt_re/
+F:      drivers/net/ethernet/broadcom/tg3.*
-F:      include/uapi/rdma/bnxt_re-abi.h
 BROCADE BFA FC SCSI DRIVER
 M:      Anil Gurumurthy <anil.gurumurthy@qlogic.com>
@@ -3013,6 +2986,15 @@ S:	Odd fixes
 F:      Documentation/media/v4l-drivers/bttv*
 F:      drivers/media/pci/bt8xx/bttv*
+BUS FREQUENCY DRIVER FOR SAMSUNG EXYNOS
+M:      Chanwoo Choi <cw00.choi@samsung.com>
+L:      linux-pm@vger.kernel.org
+L:      linux-samsung-soc@vger.kernel.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mzx/devfreq.git
+S:      Maintained
+F:      drivers/devfreq/exynos-bus.c
+F:      Documentation/devicetree/bindings/devfreq/exynos-bus.txt
 BUSLOGIC SCSI DRIVER
 M:      Khalid Aziz <khalid@gonehiking.org>
 L:      linux-scsi@vger.kernel.org
@@ -3087,6 +3069,21 @@ F:	arch/x86/kernel/tce_64.c
 F:      arch/x86/include/asm/calgary.h
 F:      arch/x86/include/asm/tce.h
+CAN NETWORK DRIVERS
+M:      Wolfgang Grandegger <wg@grandegger.com>
+M:      Marc Kleine-Budde <mkl@pengutronix.de>
+L:      linux-can@vger.kernel.org
+W:      https://github.com/linux-can
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next.git
+S:      Maintained
+F:      Documentation/devicetree/bindings/net/can/
+F:      drivers/net/can/
+F:      include/linux/can/dev.h
+F:      include/linux/can/platform/
+F:      include/uapi/linux/can/error.h
+F:      include/uapi/linux/can/netlink.h
 CAN NETWORK LAYER
 M:      Oliver Hartkopp <socketcan@hartkopp.net>
 M:      Marc Kleine-Budde <mkl@pengutronix.de>
@@ -3103,21 +3100,6 @@ F:	include/uapi/linux/can/bcm.h
 F:      include/uapi/linux/can/raw.h
 F:      include/uapi/linux/can/gw.h
-CAN NETWORK DRIVERS
-M:      Wolfgang Grandegger <wg@grandegger.com>
-M:      Marc Kleine-Budde <mkl@pengutronix.de>
-L:      linux-can@vger.kernel.org
-W:      https://github.com/linux-can
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can.git
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next.git
-S:      Maintained
-F:      Documentation/devicetree/bindings/net/can/
-F:      drivers/net/can/
-F:      include/linux/can/dev.h
-F:      include/linux/can/platform/
-F:      include/uapi/linux/can/error.h
-F:      include/uapi/linux/can/netlink.h
 CAPABILITIES
 M:      Serge Hallyn <serge@hallyn.com>
 L:      linux-security-module@vger.kernel.org
@@ -3132,12 +3114,12 @@ M:	Kevin Tsai <ktsai@capellamicro.com>
 S:      Maintained
 F:      drivers/iio/light/cm*
-CAVIUM THUNDERX2 ARM64 SOC
+CARL9170 LINUX COMMUNITY WIRELESS DRIVER
-M:      Jayachandran C <jnair@caviumnetworks.com>
+M:      Christian Lamparter <chunkeey@googlemail.com>
-L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+L:      linux-wireless@vger.kernel.org
+W:      http://wireless.kernel.org/en/users/Drivers/carl9170
 S:      Maintained
-F:      arch/arm64/boot/dts/cavium/thunder2-99xx*
+F:      drivers/net/wireless/ath/carl9170/
-F:      Documentation/devicetree/bindings/arm/cavium-thunder2.txt
 CAVIUM I2C DRIVER
 M:      Jan Glauber <jglauber@cavium.com>
@@ -3147,6 +3129,16 @@ S:	Supported
 F:      drivers/i2c/busses/i2c-octeon*
 F:      drivers/i2c/busses/i2c-thunderx*
+CAVIUM LIQUIDIO NETWORK DRIVER
+M:      Derek Chickles <derek.chickles@caviumnetworks.com>
+M:      Satanand Burla <satananda.burla@caviumnetworks.com>
+M:      Felix Manlunas <felix.manlunas@caviumnetworks.com>
+M:      Raghu Vatsavayi <raghu.vatsavayi@caviumnetworks.com>
+L:      netdev@vger.kernel.org
+W:      http://www.cavium.com
+S:      Supported
+F:      drivers/net/ethernet/cavium/liquidio/
 CAVIUM MMC DRIVER
 M:      Jan Glauber <jglauber@cavium.com>
 M:      David Daney <david.daney@cavium.com>
@@ -3155,16 +3147,6 @@ W:	http://www.cavium.com
 S:      Supported
 F:      drivers/mmc/host/cavium*
-CAVIUM LIQUIDIO NETWORK DRIVER
-M:     Derek Chickles <derek.chickles@caviumnetworks.com>
-M:     Satanand Burla <satananda.burla@caviumnetworks.com>
-M:     Felix Manlunas <felix.manlunas@caviumnetworks.com>
-M:     Raghu Vatsavayi <raghu.vatsavayi@caviumnetworks.com>
-L:     netdev@vger.kernel.org
-W:     http://www.cavium.com
-S:     Supported
-F:     drivers/net/ethernet/cavium/liquidio/
 CAVIUM OCTEON-TX CRYPTO DRIVER
 M:      George Cherian <george.cherian@cavium.com>
 L:      linux-crypto@vger.kernel.org
@@ -3172,6 +3154,13 @@ W:	http://www.cavium.com
 S:      Supported
 F:      drivers/crypto/cavium/cpt/
+CAVIUM THUNDERX2 ARM64 SOC
+M:      Jayachandran C <jnair@caviumnetworks.com>
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+S:      Maintained
+F:      arch/arm64/boot/dts/cavium/thunder2-99xx*
+F:      Documentation/devicetree/bindings/arm/cavium-thunder2.txt
 CC2520 IEEE-802.15.4 RADIO DRIVER
 M:      Varka Bhadram <varkabhadram@gmail.com>
 L:      linux-wpan@vger.kernel.org
@@ -3260,12 +3249,6 @@ F:	drivers/usb/host/whci/
 F:      drivers/usb/wusbcore/
 F:      include/linux/usb/wusb*
-HT16K33 LED CONTROLLER DRIVER
-M:      Robin van der Gracht <robin@protonic.nl>
-S:      Maintained
-F:      drivers/auxdisplay/ht16k33.c
-F:      Documentation/devicetree/bindings/display/ht16k33.txt
 CFAG12864B LCD DRIVER
 M:      Miguel Ojeda Sandonis <miguel.ojeda.sandonis@gmail.com>
 W:      http://miguelojeda.es/auxdisplay.htm
@@ -3337,6 +3320,34 @@ S:	Maintained
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/bleung/chrome-platform.git
 F:      drivers/platform/chrome/
+CIRRUS LOGIC AUDIO CODEC DRIVERS
+M:      Brian Austin <brian.austin@cirrus.com>
+M:      Paul Handrigan <Paul.Handrigan@cirrus.com>
+L:      alsa-devel@alsa-project.org (moderated for non-subscribers)
+S:      Maintained
+F:      sound/soc/codecs/cs*
+CIRRUS LOGIC EP93XX ETHERNET DRIVER
+M:      Hartley Sweeten <hsweeten@visionengravers.com>
+L:      netdev@vger.kernel.org
+S:      Maintained
+F:      drivers/net/ethernet/cirrus/ep93xx_eth.c
+CISCO FCOE HBA DRIVER
+M:      Satish Kharat <satishkh@cisco.com>
+M:      Sesidhar Baddela <sebaddel@cisco.com>
+M:      Karan Tilak Kumar <kartilak@cisco.com>
+L:      linux-scsi@vger.kernel.org
+S:      Supported
+F:      drivers/scsi/fnic/
+CISCO SCSI HBA DRIVER
+M:      Karan Tilak Kumar <kartilak@cisco.com>
+M:      Sesidhar Baddela <sebaddel@cisco.com>
+L:      linux-scsi@vger.kernel.org
+S:      Supported
+F:      drivers/scsi/snic/
 CISCO VIC ETHERNET NIC DRIVER
 M:      Christian Benvenuti <benve@cisco.com>
 M:      Govindarajulu Varadarajan <_govind@gmx.com>
@@ -3350,19 +3361,6 @@ M:	Dave Goodell <dgoodell@cisco.com>
 S:      Supported
 F:      drivers/infiniband/hw/usnic/
-CIRRUS LOGIC EP93XX ETHERNET DRIVER
-M:      Hartley Sweeten <hsweeten@visionengravers.com>
-L:      netdev@vger.kernel.org
-S:      Maintained
-F:      drivers/net/ethernet/cirrus/ep93xx_eth.c
-CIRRUS LOGIC AUDIO CODEC DRIVERS
-M:      Brian Austin <brian.austin@cirrus.com>
-M:      Paul Handrigan <Paul.Handrigan@cirrus.com>
-L:      alsa-devel@alsa-project.org (moderated for non-subscribers)
-S:      Maintained
-F:      sound/soc/codecs/cs*
 CLEANCACHE API
 M:      Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
 L:      linux-kernel@vger.kernel.org
@@ -3384,21 +3382,6 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git timers/core
 S:      Supported
 F:      drivers/clocksource
-CISCO FCOE HBA DRIVER
-M:      Satish Kharat <satishkh@cisco.com>
-M:      Sesidhar Baddela <sebaddel@cisco.com>
-M:      Karan Tilak Kumar <kartilak@cisco.com>
-L:      linux-scsi@vger.kernel.org
-S:      Supported
-F:      drivers/scsi/fnic/
-CISCO SCSI HBA DRIVER
-M:      Karan Tilak Kumar <kartilak@cisco.com>
-M:      Sesidhar Baddela <sebaddel@cisco.com>
-L:      linux-scsi@vger.kernel.org
-S:      Supported
-F:      drivers/scsi/snic/
 CMPC ACPI DRIVER
 M:      Thadeu Lima de Souza Cascardo <cascardo@holoscopio.com>
 M:      Daniel Oliveira Nascimento <don@syst.com.br>
@@ -3474,17 +3457,17 @@ L:	linux-pci@vger.kernel.org
 S:      Maintained
 F:      drivers/pci/hotplug/cpci_hotplug*
-COMPACTPCI HOTPLUG ZIATECH ZT5550 DRIVER
+COMPACTPCI HOTPLUG GENERIC DRIVER
 M:      Scott Murray <scott@spiteful.org>
 L:      linux-pci@vger.kernel.org
 S:      Maintained
-F:      drivers/pci/hotplug/cpcihp_zt5550.*
+F:      drivers/pci/hotplug/cpcihp_generic.c
-COMPACTPCI HOTPLUG GENERIC DRIVER
+COMPACTPCI HOTPLUG ZIATECH ZT5550 DRIVER
 M:      Scott Murray <scott@spiteful.org>
 L:      linux-pci@vger.kernel.org
 S:      Maintained
-F:      drivers/pci/hotplug/cpcihp_generic.c
+F:      drivers/pci/hotplug/cpcihp_zt5550.*
 COMPAL LAPTOP SUPPORT
 M:      Cezary Jackiewicz <cezary.jackiewicz@gmail.com>
@@ -3587,6 +3570,18 @@ F:	drivers/cpufreq/arm_big_little.h
 F:      drivers/cpufreq/arm_big_little.c
 F:      drivers/cpufreq/arm_big_little_dt.c
+CPU POWER MONITORING SUBSYSTEM
+M:      Thomas Renninger <trenn@suse.com>
+L:      linux-pm@vger.kernel.org
+S:      Maintained
+F:      tools/power/cpupower/
+CPUID/MSR DRIVER
+M:      "H. Peter Anvin" <hpa@zytor.com>
+S:      Maintained
+F:      arch/x86/kernel/cpuid.c
+F:      arch/x86/kernel/msr.c
 CPUIDLE DRIVER - ARM BIG LITTLE
 M:      Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
 M:      Daniel Lezcano <daniel.lezcano@linaro.org>
@@ -3616,18 +3611,6 @@ B:	https://bugzilla.kernel.org
 F:      drivers/cpuidle/*
 F:      include/linux/cpuidle.h
-CPUID/MSR DRIVER
-M:      "H. Peter Anvin" <hpa@zytor.com>
-S:      Maintained
-F:      arch/x86/kernel/cpuid.c
-F:      arch/x86/kernel/msr.c
-CPU POWER MONITORING SUBSYSTEM
-M:      Thomas Renninger <trenn@suse.com>
-L:      linux-pm@vger.kernel.org
-S:      Maintained
-F:      tools/power/cpupower/
 CRAMFS FILESYSTEM
 W:      http://sourceforge.net/projects/cramfs/
 S:      Orphan / Obsolete
@@ -3757,6 +3740,13 @@ S:	Supported
 F:      drivers/infiniband/hw/cxgb3/
 F:      include/uapi/rdma/cxgb3-abi.h
+CXGB4 CRYPTO DRIVER (chcr)
+M:      Harsh Jain <harsh@chelsio.com>
+L:      linux-crypto@vger.kernel.org
+W:      http://www.chelsio.com
+S:      Supported
+F:      drivers/crypto/chelsio
 CXGB4 ETHERNET DRIVER (CXGB4)
 M:      Ganesh Goudar <ganeshgr@chelsio.com>
 L:      netdev@vger.kernel.org
@@ -3779,13 +3769,6 @@ S:	Supported
 F:      drivers/infiniband/hw/cxgb4/
 F:      include/uapi/rdma/cxgb4-abi.h
-CXGB4 CRYPTO DRIVER (chcr)
-M:      Harsh Jain <harsh@chelsio.com>
-L:      linux-crypto@vger.kernel.org
-W:      http://www.chelsio.com
-S:      Supported
-F:      drivers/crypto/chelsio
 CXGB4VF ETHERNET DRIVER (CXGB4VF)
 M:      Casey Leedom <leedom@chelsio.com>
 L:      netdev@vger.kernel.org
@@ -3815,14 +3798,6 @@ F:	drivers/scsi/cxlflash/
 F:      include/uapi/scsi/cxlflash_ioctls.h
 F:      Documentation/powerpc/cxlflash.txt
-STMMAC ETHERNET DRIVER
-M:      Giuseppe Cavallaro <peppe.cavallaro@st.com>
-M:      Alexandre Torgue <alexandre.torgue@st.com>
-L:      netdev@vger.kernel.org
-W:      http://www.stlinux.com
-S:      Supported
-F:      drivers/net/ethernet/stmicro/stmmac/
 CYBERPRO FB DRIVER
 M:      Russell King <linux@armlinux.org.uk>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
@@ -3946,15 +3921,15 @@ L:	platform-driver-x86@vger.kernel.org
 S:      Maintained
 F:      drivers/platform/x86/dell-laptop.c
-DELL LAPTOP RBTN DRIVER
+DELL LAPTOP FREEFALL DRIVER
 M:      Pali Rohár <pali.rohar@gmail.com>
 S:      Maintained
-F:      drivers/platform/x86/dell-rbtn.*
+F:      drivers/platform/x86/dell-smo8800.c
-DELL LAPTOP FREEFALL DRIVER
+DELL LAPTOP RBTN DRIVER
 M:      Pali Rohár <pali.rohar@gmail.com>
 S:      Maintained
-F:      drivers/platform/x86/dell-smo8800.c
+F:      drivers/platform/x86/dell-rbtn.*
 DELL LAPTOP SMM DRIVER
 M:      Pali Rohár <pali.rohar@gmail.com>
@@ -3974,6 +3949,14 @@ M:	Pali Rohár <pali.rohar@gmail.com>
 S:      Maintained
 F:      drivers/platform/x86/dell-wmi.c
+DELTA ST MEDIA DRIVER
+M:      Hugues Fruchet <hugues.fruchet@st.com>
+L:      linux-media@vger.kernel.org
+T:      git git://linuxtv.org/media_tree.git
+W:      https://linuxtv.org
+S:      Supported
+F:      drivers/media/platform/sti/delta
 DENALI NAND DRIVER
 M:      Masahiro Yamada <yamada.masahiro@socionext.com>
 L:      linux-mtd@lists.infradead.org
@@ -4028,15 +4011,6 @@ F:	drivers/devfreq/devfreq-event.c
 F:      include/linux/devfreq-event.h
 F:      Documentation/devicetree/bindings/devfreq/event/
-BUS FREQUENCY DRIVER FOR SAMSUNG EXYNOS
-M:      Chanwoo Choi <cw00.choi@samsung.com>
-L:      linux-pm@vger.kernel.org
-L:      linux-samsung-soc@vger.kernel.org
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mzx/devfreq.git
-S:      Maintained
-F:      drivers/devfreq/exynos-bus.c
-F:      Documentation/devicetree/bindings/devfreq/exynos-bus.txt
 DEVICE NUMBER REGISTRY
 M:      Torben Mathiasen <device@lanana.org>
 W:      http://lanana.org/docs/device-list/index.html
@@ -4186,20 +4160,6 @@ F:	include/linux/*fence.h
 F:      Documentation/driver-api/dma-buf.rst
 T:      git git://anongit.freedesktop.org/drm/drm-misc
-SYNC FILE FRAMEWORK
-M:      Sumit Semwal <sumit.semwal@linaro.org>
-R:      Gustavo Padovan <gustavo@padovan.org>
-S:      Maintained
-L:      linux-media@vger.kernel.org
-L:      dri-devel@lists.freedesktop.org
-F:      drivers/dma-buf/sync_*
-F:      drivers/dma-buf/dma-fence*
-F:      drivers/dma-buf/sw_sync.c
-F:      include/linux/sync_file.h
-F:      include/uapi/linux/sync_file.h
-F:      Documentation/sync_file.txt
-T:      git git://anongit.freedesktop.org/drm/drm-misc
 DMA GENERIC OFFLOAD ENGINE SUBSYSTEM
 M:      Vinod Koul <vinod.koul@intel.com>
 L:      dmaengine@vger.kernel.org
@@ -4211,6 +4171,21 @@ F:	Documentation/devicetree/bindings/dma/
 F:      Documentation/dmaengine/
 T:      git git://git.infradead.org/users/vkoul/slave-dma.git
+DMA MAPPING HELPERS
+M:      Christoph Hellwig <hch@lst.de>
+M:      Marek Szyprowski <m.szyprowski@samsung.com>
+R:      Robin Murphy <robin.murphy@arm.com>
+L:      linux-kernel@vger.kernel.org
+T:      git git://git.infradead.org/users/hch/dma-mapping.git
+W:      http://git.infradead.org/users/hch/dma-mapping.git
+S:      Supported
+F:      lib/dma-debug.c
+F:      lib/dma-noop.c
+F:      lib/dma-virt.c
+F:      drivers/base/dma-mapping.c
+F:      drivers/base/dma-coherent.c
+F:      include/linux/dma-mapping.h
 DME1737 HARDWARE MONITOR DRIVER
 M:      Juerg Haefliger <juergh@gmail.com>
 L:      linux-hwmon@vger.kernel.org
@@ -4241,6 +4216,13 @@ X:	Documentation/spi
 X:      Documentation/media
 T:      git git://git.lwn.net/linux.git docs-next
+DONGWOON DW9714 LENS VOICE COIL DRIVER
+M:      Sakari Ailus <sakari.ailus@linux.intel.com>
+L:      linux-media@vger.kernel.org
+T:      git git://linuxtv.org/media_tree.git
+S:      Maintained
+F:      drivers/media/i2c/dw9714.c
 DOUBLETALK DRIVER
 M:      "James R. Van Zandt" <jrv@vanzandt.mv.com>
 L:      blinux-list@redhat.com
@@ -4292,36 +4274,13 @@ F:	include/linux/debugfs.h
 F:      include/linux/kobj*
 F:      lib/kobj*
-DRM DRIVERS
+DRIVERS FOR ADAPTIVE VOLTAGE SCALING (AVS)
-M:      David Airlie <airlied@linux.ie>
+M:      Kevin Hilman <khilman@kernel.org>
-L:      dri-devel@lists.freedesktop.org
+M:      Nishanth Menon <nm@ti.com>
-T:      git git://people.freedesktop.org/~airlied/linux
-B:      https://bugs.freedesktop.org/
-C:      irc://chat.freenode.net/dri-devel
-S:      Maintained
-F:      drivers/gpu/drm/
-F:      drivers/gpu/vga/
-F:      Documentation/devicetree/bindings/display/
-F:      Documentation/devicetree/bindings/gpu/
-F:      Documentation/devicetree/bindings/video/
-F:      Documentation/gpu/
-F:      include/drm/
-F:      include/uapi/drm/
-F:      include/linux/vga*
-DRM DRIVERS AND MISC GPU PATCHES
-M:      Daniel Vetter <daniel.vetter@intel.com>
-M:      Jani Nikula <jani.nikula@linux.intel.com>
-M:      Sean Paul <seanpaul@chromium.org>
-W:      https://01.org/linuxgraphics/gfx-docs/maintainer-tools/drm-misc.html
 S:      Maintained
-T:      git git://anongit.freedesktop.org/drm/drm-misc
+F:      drivers/power/avs/
-F:      Documentation/gpu/
+F:      include/linux/power/smartreflex.h
-F:      drivers/gpu/vga/
+L:      linux-pm@vger.kernel.org
-F:      drivers/gpu/drm/*
-F:      include/drm/drm*
-F:      include/uapi/drm/drm*
-F:      include/linux/vga*
 DRM DRIVER FOR ARM PL111 CLCD
 M:      Eric Anholt <eric@anholt.net>
@@ -4334,14 +4293,6 @@ M:	Dave Airlie <airlied@redhat.com>
 S:      Odd Fixes
 F:      drivers/gpu/drm/ast/
-DRM DRIVERS FOR BRIDGE CHIPS
-M:      Archit Taneja <architt@codeaurora.org>
-M:      Andrzej Hajda <a.hajda@samsung.com>
-R:      Laurent Pinchart <Laurent.pinchart@ideasonboard.com>
-S:      Maintained
-T:      git git://anongit.freedesktop.org/drm/drm-misc
-F:      drivers/gpu/drm/bridge/
 DRM DRIVER FOR BOCHS VIRTUAL GPU
 M:      Gerd Hoffmann <kraxel@redhat.com>
 L:      virtualization@lists.linux-foundation.org
@@ -4349,6 +4300,47 @@ T:	git git://anongit.freedesktop.org/drm/drm-misc
 S:      Maintained
 F:      drivers/gpu/drm/bochs/
+DRM DRIVER FOR INTEL I810 VIDEO CARDS
+S:      Orphan / Obsolete
+F:      drivers/gpu/drm/i810/
+F:      include/uapi/drm/i810_drm.h
+DRM DRIVER FOR MATROX G200/G400 GRAPHICS CARDS
+S:      Orphan / Obsolete
+F:      drivers/gpu/drm/mga/
+F:      include/uapi/drm/mga_drm.h
+DRM DRIVER FOR MGA G200 SERVER GRAPHICS CHIPS
+M:      Dave Airlie <airlied@redhat.com>
+S:      Odd Fixes
+F:      drivers/gpu/drm/mgag200/
+DRM DRIVER FOR MI0283QT
+M:      Noralf Trønnes <noralf@tronnes.org>
+S:      Maintained
+F:      drivers/gpu/drm/tinydrm/mi0283qt.c
+F:      Documentation/devicetree/bindings/display/multi-inno,mi0283qt.txt
+DRM DRIVER FOR MSM ADRENO GPU
+M:      Rob Clark <robdclark@gmail.com>
+L:      linux-arm-msm@vger.kernel.org
+L:      dri-devel@lists.freedesktop.org
+L:      freedreno@lists.freedesktop.org
+T:      git git://people.freedesktop.org/~robclark/linux
+S:      Maintained
+F:      drivers/gpu/drm/msm/
+F:      include/uapi/drm/msm_drm.h
+F:      Documentation/devicetree/bindings/display/msm/
+DRM DRIVER FOR NVIDIA GEFORCE/QUADRO GPUS
+M:      Ben Skeggs <bskeggs@redhat.com>
+L:      dri-devel@lists.freedesktop.org
+L:      nouveau@lists.freedesktop.org
+T:      git git://github.com/skeggsb/linux
+S:      Supported
+F:      drivers/gpu/drm/nouveau/
+F:      include/uapi/drm/nouveau_drm.h
 DRM DRIVER FOR QEMU'S CIRRUS DEVICE
 M:      Dave Airlie <airlied@redhat.com>
 M:      Gerd Hoffmann <kraxel@redhat.com>
@@ -4358,59 +4350,86 @@ S:	Obsolete
 W:      https://www.kraxel.org/blog/2014/10/qemu-using-cirrus-considered-harmful/
 F:      drivers/gpu/drm/cirrus/
-RADEON and AMDGPU DRM DRIVERS
+DRM DRIVER FOR QXL VIRTUAL GPU
-M:      Alex Deucher <alexander.deucher@amd.com>
+M:      Dave Airlie <airlied@redhat.com>
-M:      Christian König <christian.koenig@amd.com>
+M:      Gerd Hoffmann <kraxel@redhat.com>
-L:      amd-gfx@lists.freedesktop.org
+L:      virtualization@lists.linux-foundation.org
-T:      git git://people.freedesktop.org/~agd5f/linux
+T:      git git://anongit.freedesktop.org/drm/drm-misc
-S:      Supported
+S:      Maintained
-F:      drivers/gpu/drm/radeon/
+F:      drivers/gpu/drm/qxl/
-F:      include/uapi/drm/radeon_drm.h
+F:      include/uapi/drm/qxl_drm.h
-F:      drivers/gpu/drm/amd/
-F:      include/uapi/drm/amdgpu_drm.h
-DRM PANEL DRIVERS
+DRM DRIVER FOR PERVASIVE DISPLAYS REPAPER PANELS
-M:      Thierry Reding <thierry.reding@gmail.com>
+M:      Noralf Trønnes <noralf@tronnes.org>
-L:      dri-devel@lists.freedesktop.org
-T:      git git://anongit.freedesktop.org/tegra/linux.git
 S:      Maintained
-F:      drivers/gpu/drm/drm_panel.c
+F:      drivers/gpu/drm/tinydrm/repaper.c
-F:      drivers/gpu/drm/panel/
+F:      Documentation/devicetree/bindings/display/repaper.txt
-F:      include/drm/drm_panel.h
-F:      Documentation/devicetree/bindings/display/panel/
-INTEL DRM DRIVERS (excluding Poulsbo, Moorestown and derivative chipsets)
+DRM DRIVER FOR RAGE 128 VIDEO CARDS
-M:      Daniel Vetter <daniel.vetter@intel.com>
+S:      Orphan / Obsolete
-M:      Jani Nikula <jani.nikula@linux.intel.com>
+F:      drivers/gpu/drm/r128/
-L:      intel-gfx@lists.freedesktop.org
+F:      include/uapi/drm/r128_drm.h
-W:      https://01.org/linuxgraphics/
-B:      https://01.org/linuxgraphics/documentation/how-report-bugs
-C:      irc://chat.freenode.net/intel-gfx
-Q:      http://patchwork.freedesktop.org/project/intel-gfx/
-T:      git git://anongit.freedesktop.org/drm-intel
-S:      Supported
-F:      drivers/gpu/drm/i915/
-F:      include/drm/i915*
-F:      include/uapi/drm/i915_drm.h
-F:      Documentation/gpu/i915.rst
-INTEL GVT-g DRIVERS (Intel GPU Virtualization)
+DRM DRIVER FOR SAVAGE VIDEO CARDS
-M:      Zhenyu Wang <zhenyuw@linux.intel.com>
+S:      Orphan / Obsolete
-M:      Zhi Wang <zhi.a.wang@intel.com>
+F:      drivers/gpu/drm/savage/
-L:      intel-gvt-dev@lists.freedesktop.org
+F:      include/uapi/drm/savage_drm.h
-L:      intel-gfx@lists.freedesktop.org
-W:      https://01.org/igvt-g
-T:      git https://github.com/01org/gvt-linux.git
-S:      Supported
-F:      drivers/gpu/drm/i915/gvt/
-DRM DRIVERS FOR ATMEL HLCDC
+DRM DRIVER FOR SIS VIDEO CARDS
-M:      Boris Brezillon <boris.brezillon@free-electrons.com>
+S:      Orphan / Obsolete
+F:      drivers/gpu/drm/sis/
+F:      include/uapi/drm/sis_drm.h
+DRM DRIVER FOR TDFX VIDEO CARDS
+S:      Orphan / Obsolete
+F:      drivers/gpu/drm/tdfx/
+DRM DRIVER FOR USB DISPLAYLINK VIDEO ADAPTERS
+M:      Dave Airlie <airlied@redhat.com>
+S:      Odd Fixes
+F:      drivers/gpu/drm/udl/
+DRM DRIVER FOR VMWARE VIRTUAL GPU
+M:      "VMware Graphics" <linux-graphics-maintainer@vmware.com>
+M:      Sinclair Yeh <syeh@vmware.com>
+M:      Thomas Hellstrom <thellstrom@vmware.com>
 L:      dri-devel@lists.freedesktop.org
+T:      git git://people.freedesktop.org/~syeh/repos_linux
+T:      git git://people.freedesktop.org/~thomash/linux
 S:      Supported
-F:      drivers/gpu/drm/atmel-hlcdc/
+F:      drivers/gpu/drm/vmwgfx/
-F:      Documentation/devicetree/bindings/drm/atmel/
+F:      include/uapi/drm/vmwgfx_drm.h
+DRM DRIVERS
+M:      David Airlie <airlied@linux.ie>
+L:      dri-devel@lists.freedesktop.org
+T:      git git://people.freedesktop.org/~airlied/linux
+B:      https://bugs.freedesktop.org/
+C:      irc://chat.freenode.net/dri-devel
+S:      Maintained
+F:      drivers/gpu/drm/
+F:      drivers/gpu/vga/
+F:      Documentation/devicetree/bindings/display/
+F:      Documentation/devicetree/bindings/gpu/
+F:      Documentation/devicetree/bindings/video/
+F:      Documentation/gpu/
+F:      include/drm/
+F:      include/uapi/drm/
+F:      include/linux/vga*
+DRM DRIVERS AND MISC GPU PATCHES
+M:      Daniel Vetter <daniel.vetter@intel.com>
+M:      Jani Nikula <jani.nikula@linux.intel.com>
+M:      Sean Paul <seanpaul@chromium.org>
+W:      https://01.org/linuxgraphics/gfx-docs/maintainer-tools/drm-misc.html
+S:      Maintained
 T:      git git://anongit.freedesktop.org/drm/drm-misc
+F:      Documentation/gpu/
+F:      drivers/gpu/vga/
+F:      drivers/gpu/drm/*
+F:      include/drm/drm*
+F:      include/uapi/drm/drm*
+F:      include/linux/vga*
 DRM DRIVERS FOR ALLWINNER A10
 M:      Maxime Ripard  <maxime.ripard@free-electrons.com>
@@ -4432,6 +4451,22 @@ F:	Documentation/devicetree/bindings/display/amlogic,meson-dw-hdmi.txt
 F:      Documentation/gpu/meson.rst
 T:      git git://anongit.freedesktop.org/drm/drm-misc
+DRM DRIVERS FOR ATMEL HLCDC
+M:      Boris Brezillon <boris.brezillon@free-electrons.com>
+L:      dri-devel@lists.freedesktop.org
+S:      Supported
+F:      drivers/gpu/drm/atmel-hlcdc/
+F:      Documentation/devicetree/bindings/drm/atmel/
+T:      git git://anongit.freedesktop.org/drm/drm-misc
+DRM DRIVERS FOR BRIDGE CHIPS
+M:      Archit Taneja <architt@codeaurora.org>
+M:      Andrzej Hajda <a.hajda@samsung.com>
+R:      Laurent Pinchart <Laurent.pinchart@ideasonboard.com>
+S:      Maintained
+T:      git git://anongit.freedesktop.org/drm/drm-misc
+F:      drivers/gpu/drm/bridge/
 DRM DRIVERS FOR EXYNOS
 M:      Inki Dae <inki.dae@samsung.com>
 M:      Joonyoung Shim <jy0922.shim@samsung.com>
@@ -4480,11 +4515,6 @@ S:	Maintained
 F:      drivers/gpu/drm/hisilicon/
 F:      Documentation/devicetree/bindings/display/hisilicon/
-DRM DRIVER FOR INTEL I810 VIDEO CARDS
-S:      Orphan / Obsolete
-F:      drivers/gpu/drm/i810/
-F:      include/uapi/drm/i810_drm.h
 DRM DRIVERS FOR MEDIATEK
 M:      CK Hu <ck.hu@mediatek.com>
 M:      Philipp Zabel <p.zabel@pengutronix.de>
@@ -4493,32 +4523,6 @@ S:	Supported
 F:      drivers/gpu/drm/mediatek/
 F:      Documentation/devicetree/bindings/display/mediatek/
-DRM DRIVER FOR MI0283QT
-M:      Noralf Trønnes <noralf@tronnes.org>
-S:      Maintained
-F:      drivers/gpu/drm/tinydrm/mi0283qt.c
-F:      Documentation/devicetree/bindings/display/multi-inno,mi0283qt.txt
-DRM DRIVER FOR MSM ADRENO GPU
-M:      Rob Clark <robdclark@gmail.com>
-L:      linux-arm-msm@vger.kernel.org
-L:      dri-devel@lists.freedesktop.org
-L:      freedreno@lists.freedesktop.org
-T:      git git://people.freedesktop.org/~robclark/linux
-S:      Maintained
-F:      drivers/gpu/drm/msm/
-F:      include/uapi/drm/msm_drm.h
-F:      Documentation/devicetree/bindings/display/msm/
-DRM DRIVER FOR NVIDIA GEFORCE/QUADRO GPUS
-M:      Ben Skeggs <bskeggs@redhat.com>
-L:      dri-devel@lists.freedesktop.org
-L:      nouveau@lists.freedesktop.org
-T:      git git://github.com/skeggsb/linux
-S:      Supported
-F:      drivers/gpu/drm/nouveau/
-F:      include/uapi/drm/nouveau_drm.h
 DRM DRIVERS FOR NVIDIA TEGRA
 M:      Thierry Reding <thierry.reding@gmail.com>
 L:      dri-devel@lists.freedesktop.org
@@ -4531,27 +4535,6 @@ F:	include/linux/host1x.h
 F:      include/uapi/drm/tegra_drm.h
 F:      Documentation/devicetree/bindings/display/tegra/nvidia,tegra20-host1x.txt
-DRM DRIVER FOR MATROX G200/G400 GRAPHICS CARDS
-S:      Orphan / Obsolete
-F:      drivers/gpu/drm/mga/
-F:      include/uapi/drm/mga_drm.h
-DRM DRIVER FOR MGA G200 SERVER GRAPHICS CHIPS
-M:      Dave Airlie <airlied@redhat.com>
-S:      Odd Fixes
-F:      drivers/gpu/drm/mgag200/
-DRM DRIVER FOR PERVASIVE DISPLAYS REPAPER PANELS
-M:      Noralf Trønnes <noralf@tronnes.org>
-S:      Maintained
-F:      drivers/gpu/drm/tinydrm/repaper.c
-F:      Documentation/devicetree/bindings/display/repaper.txt
-DRM DRIVER FOR RAGE 128 VIDEO CARDS
-S:      Orphan / Obsolete
-F:      drivers/gpu/drm/r128/
-F:      include/uapi/drm/r128_drm.h
 DRM DRIVERS FOR RENESAS
 M:      Laurent Pinchart <laurent.pinchart@ideasonboard.com>
 L:      dri-devel@lists.freedesktop.org
@@ -4564,15 +4547,6 @@ F:	include/linux/platform_data/shmob_drm.h
 F:      Documentation/devicetree/bindings/display/bridge/renesas,dw-hdmi.txt
 F:      Documentation/devicetree/bindings/display/renesas,du.txt
-DRM DRIVER FOR QXL VIRTUAL GPU
-M:      Dave Airlie <airlied@redhat.com>
-M:      Gerd Hoffmann <kraxel@redhat.com>
-L:      virtualization@lists.linux-foundation.org
-T:      git git://anongit.freedesktop.org/drm/drm-misc
-S:      Maintained
-F:      drivers/gpu/drm/qxl/
-F:      include/uapi/drm/qxl_drm.h
 DRM DRIVERS FOR ROCKCHIP
 M:      Mark Yao <mark.yao@rock-chips.com>
 L:      dri-devel@lists.freedesktop.org
@@ -4581,16 +4555,6 @@ F:	drivers/gpu/drm/rockchip/
 F:      Documentation/devicetree/bindings/display/rockchip/
 T:      git git://anongit.freedesktop.org/drm/drm-misc
-DRM DRIVER FOR SAVAGE VIDEO CARDS
-S:      Orphan / Obsolete
-F:      drivers/gpu/drm/savage/
-F:      include/uapi/drm/savage_drm.h
-DRM DRIVER FOR SIS VIDEO CARDS
-S:      Orphan / Obsolete
-F:      drivers/gpu/drm/sis/
-F:      include/uapi/drm/sis_drm.h
 DRM DRIVERS FOR STI
 M:      Benjamin Gaignard <benjamin.gaignard@linaro.org>
 M:      Vincent Abriou <vincent.abriou@st.com>
@@ -4611,36 +4575,20 @@ S:	Maintained
 F:      drivers/gpu/drm/stm
 F:      Documentation/devicetree/bindings/display/st,stm32-ltdc.txt
-DRM DRIVER FOR TDFX VIDEO CARDS
+DRM DRIVERS FOR TI LCDC
-S:      Orphan / Obsolete
+M:      Jyri Sarha <jsarha@ti.com>
-F:      drivers/gpu/drm/tdfx/
+R:      Tomi Valkeinen <tomi.valkeinen@ti.com>
-DRM DRIVER FOR USB DISPLAYLINK VIDEO ADAPTERS
-M:      Dave Airlie <airlied@redhat.com>
-S:      Odd Fixes
-F:      drivers/gpu/drm/udl/
-DRM DRIVERS FOR VIVANTE GPU IP
-M:      Lucas Stach <l.stach@pengutronix.de>
-R:      Russell King <linux+etnaviv@armlinux.org.uk>
-R:      Christian Gmeiner <christian.gmeiner@gmail.com>
-L:      etnaviv@lists.freedesktop.org
 L:      dri-devel@lists.freedesktop.org
 S:      Maintained
-F:      drivers/gpu/drm/etnaviv/
+F:      drivers/gpu/drm/tilcdc/
-F:      include/uapi/drm/etnaviv_drm.h
+F:      Documentation/devicetree/bindings/display/tilcdc/
-F:      Documentation/devicetree/bindings/display/etnaviv/
-DRM DRIVER FOR VMWARE VIRTUAL GPU
+DRM DRIVERS FOR TI OMAP
-M:      "VMware Graphics" <linux-graphics-maintainer@vmware.com>
+M:      Tomi Valkeinen <tomi.valkeinen@ti.com>
-M:      Sinclair Yeh <syeh@vmware.com>
-M:      Thomas Hellstrom <thellstrom@vmware.com>
 L:      dri-devel@lists.freedesktop.org
-T:      git git://people.freedesktop.org/~syeh/repos_linux
+S:      Maintained
-T:      git git://people.freedesktop.org/~thomash/linux
+F:      drivers/gpu/drm/omapdrm/
-S:      Supported
+F:      Documentation/devicetree/bindings/display/ti/
-F:      drivers/gpu/drm/vmwgfx/
-F:      include/uapi/drm/vmwgfx_drm.h
 DRM DRIVERS FOR VC4
 M:      Eric Anholt <eric@anholt.net>
@@ -4651,20 +4599,16 @@ F:	include/uapi/drm/vc4_drm.h
 F:      Documentation/devicetree/bindings/display/brcm,bcm-vc4.txt
 T:      git git://anongit.freedesktop.org/drm/drm-misc
-DRM DRIVERS FOR TI OMAP
+DRM DRIVERS FOR VIVANTE GPU IP
-M:      Tomi Valkeinen <tomi.valkeinen@ti.com>
+M:      Lucas Stach <l.stach@pengutronix.de>
-L:      dri-devel@lists.freedesktop.org
+R:      Russell King <linux+etnaviv@armlinux.org.uk>
-S:      Maintained
+R:      Christian Gmeiner <christian.gmeiner@gmail.com>
-F:      drivers/gpu/drm/omapdrm/
+L:      etnaviv@lists.freedesktop.org
-F:      Documentation/devicetree/bindings/display/ti/
-DRM DRIVERS FOR TI LCDC
-M:      Jyri Sarha <jsarha@ti.com>
-R:      Tomi Valkeinen <tomi.valkeinen@ti.com>
 L:      dri-devel@lists.freedesktop.org
 S:      Maintained
-F:      drivers/gpu/drm/tilcdc/
+F:      drivers/gpu/drm/etnaviv/
-F:      Documentation/devicetree/bindings/display/tilcdc/
+F:      include/uapi/drm/etnaviv_drm.h
+F:      Documentation/devicetree/bindings/display/etnaviv/
 DRM DRIVERS FOR ZTE ZX
 M:      Shawn Guo <shawnguo@kernel.org>
@@ -4674,6 +4618,16 @@ F:	drivers/gpu/drm/zte/
 F:      Documentation/devicetree/bindings/display/zte,vou.txt
 T:      git git://anongit.freedesktop.org/drm/drm-misc
+DRM PANEL DRIVERS
+M:      Thierry Reding <thierry.reding@gmail.com>
+L:      dri-devel@lists.freedesktop.org
+T:      git git://anongit.freedesktop.org/tegra/linux.git
+S:      Maintained
+F:      drivers/gpu/drm/drm_panel.c
+F:      drivers/gpu/drm/panel/
+F:      include/drm/drm_panel.h
+F:      Documentation/devicetree/bindings/display/panel/
 DSBR100 USB FM RADIO DRIVER
 M:      Alexey Klimov <klimov.linux@gmail.com>
 L:      linux-media@vger.kernel.org
@@ -4805,13 +4759,6 @@ S:	Maintained
 F:      drivers/media/usb/dvb-usb-v2/dvb_usb*
 F:      drivers/media/usb/dvb-usb-v2/usb_urb.c
-DONGWOON DW9714 LENS VOICE COIL DRIVER
-M:      Sakari Ailus <sakari.ailus@linux.intel.com>
-L:      linux-media@vger.kernel.org
-T:      git git://linuxtv.org/media_tree.git
-S:      Maintained
-F:      drivers/media/i2c/dw9714.c
 DYNAMIC DEBUG
 M:      Jason Baron <jbaron@akamai.com>
 S:      Maintained
@@ -4867,19 +4814,6 @@ S:	Supported
 F:      Documentation/filesystems/ecryptfs.txt
 F:      fs/ecryptfs/
-EDAC-CORE
-M:      Borislav Petkov <bp@alien8.de>
-M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
-M:      Mauro Carvalho Chehab <mchehab@kernel.org>
-L:      linux-edac@vger.kernel.org
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp.git for-next
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-edac.git linux_next
-S:      Supported
-F:      Documentation/admin-guide/ras.rst
-F:      Documentation/driver-api/edac.rst
-F:      drivers/edac/
-F:      include/linux/edac.h
 EDAC-AMD64
 M:      Borislav Petkov <bp@alien8.de>
 L:      linux-edac@vger.kernel.org
@@ -4901,6 +4835,19 @@ S:	Supported
 F:      drivers/edac/octeon_edac*
 F:      drivers/edac/thunderx_edac*
+EDAC-CORE
+M:      Borislav Petkov <bp@alien8.de>
+M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
+M:      Mauro Carvalho Chehab <mchehab@kernel.org>
+L:      linux-edac@vger.kernel.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp.git for-next
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-edac.git linux_next
+S:      Supported
+F:      Documentation/admin-guide/ras.rst
+F:      Documentation/driver-api/edac.rst
+F:      drivers/edac/
+F:      include/linux/edac.h
 EDAC-E752X
 M:      Mark Gross <mark.gross@intel.com>
 L:      linux-edac@vger.kernel.org
@@ -4925,12 +4872,6 @@ L:	linux-edac@vger.kernel.org
 S:      Maintained
 F:      drivers/edac/ghes_edac.c
-EDAC-I82443BXGX
-M:      Tim Small <tim@buttersideup.com>
-L:      linux-edac@vger.kernel.org
-S:      Maintained
-F:      drivers/edac/i82443bxgx_edac.c
 EDAC-I3000
 L:      linux-edac@vger.kernel.org
 S:      Orphan
@@ -4962,6 +4903,12 @@ L:	linux-edac@vger.kernel.org
 S:      Maintained
 F:      drivers/edac/i7core_edac.c
+EDAC-I82443BXGX
+M:      Tim Small <tim@buttersideup.com>
+L:      linux-edac@vger.kernel.org
+S:      Maintained
+F:      drivers/edac/i82443bxgx_edac.c
 EDAC-I82975X
 M:      Ranganathan Desikan <ravi@jetztechnologies.com>
 M:      "Arvind R." <arvino55@gmail.com>
@@ -4981,18 +4928,18 @@ L:	linux-edac@vger.kernel.org
 S:      Maintained
 F:      drivers/edac/mpc85xx_edac.[ch]
-EDAC-PND2
-M:      Tony Luck <tony.luck@intel.com>
-L:      linux-edac@vger.kernel.org
-S:      Maintained
-F:      drivers/edac/pnd2_edac.[ch]
 EDAC-PASEMI
 M:      Egor Martovetsky <egor@pasemi.com>
 L:      linux-edac@vger.kernel.org
 S:      Maintained
 F:      drivers/edac/pasemi_edac.c
+EDAC-PND2
+M:      Tony Luck <tony.luck@intel.com>
+L:      linux-edac@vger.kernel.org
+S:      Maintained
+F:      drivers/edac/pnd2_edac.[ch]
 EDAC-R82600
 M:      Tim Small <tim@buttersideup.com>
 L:      linux-edac@vger.kernel.org
@@ -5012,13 +4959,6 @@ L:	linux-edac@vger.kernel.org
 S:      Maintained
 F:      drivers/edac/skx_edac.c
-EDAC-XGENE
-APPLIED MICRO (APM) X-GENE SOC EDAC
-M:     Loc Ho <lho@apm.com>
-S:     Supported
-F:     drivers/edac/xgene_edac.c
-F:     Documentation/devicetree/bindings/edac/apm-xgene-edac.txt
 EDIROL UA-101/UA-1000 DRIVER
 M:      Clemens Ladisch <clemens@ladisch.de>
 L:      alsa-devel@alsa-project.org (moderated for non-subscribers)
@@ -5026,21 +4966,12 @@ T:	git git://git.alsa-project.org/alsa-kernel.git
 S:      Maintained
 F:      sound/usb/misc/ua101.c
-EXTENSIBLE FIRMWARE INTERFACE (EFI)
+EFI TEST DRIVER
-M:      Matt Fleming <matt@codeblueprint.co.uk>
-M:      Ard Biesheuvel <ard.biesheuvel@linaro.org>
 L:      linux-efi@vger.kernel.org
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi.git
+M:      Ivan Hu <ivan.hu@canonical.com>
+M:      Matt Fleming <matt@codeblueprint.co.uk>
 S:      Maintained
-F:      Documentation/efi-stub.txt
+F:      drivers/firmware/efi/test/
-F:      arch/*/kernel/efi.c
-F:      arch/x86/boot/compressed/eboot.[ch]
-F:      arch/*/include/asm/efi.h
-F:      arch/x86/platform/efi/
-F:      drivers/firmware/efi/
-F:      include/linux/efi*.h
-F:      arch/arm/boot/compressed/efi-header.S
-F:      arch/arm64/kernel/efi-entry.S
 EFI VARIABLE FILESYSTEM
 M:      Matthew Garrett <matthew.garrett@nebula.com>
@@ -5057,13 +4988,6 @@ M:	Peter Jones <pjones@redhat.com>
 S:      Maintained
 F:      drivers/video/fbdev/efifb.c
-EFI TEST DRIVER
-L:      linux-efi@vger.kernel.org
-M:      Ivan Hu <ivan.hu@canonical.com>
-M:      Matt Fleming <matt@codeblueprint.co.uk>
-S:      Maintained
-F:      drivers/firmware/efi/test/
 EFS FILESYSTEM
 W:      http://aeschi.ch.eu.org/efs/
 S:      Orphan
@@ -5092,6 +5016,34 @@ M:	David Woodhouse <dwmw2@infradead.org>
 L:      linux-embedded@vger.kernel.org
 S:      Maintained
+Emulex 10Gbps iSCSI - OneConnect DRIVER
+M:      Subbu Seetharaman <subbu.seetharaman@broadcom.com>
+M:      Ketan Mukadam <ketan.mukadam@broadcom.com>
+M:      Jitendra Bhivare <jitendra.bhivare@broadcom.com>
+L:      linux-scsi@vger.kernel.org
+W:      http://www.broadcom.com
+S:      Supported
+F:      drivers/scsi/be2iscsi/
+Emulex 10Gbps NIC BE2, BE3-R, Lancer, Skyhawk-R DRIVER (be2net)
+M:      Sathya Perla <sathya.perla@broadcom.com>
+M:      Ajit Khaparde <ajit.khaparde@broadcom.com>
+M:      Sriharsha Basavapatna <sriharsha.basavapatna@broadcom.com>
+M:      Somnath Kotur <somnath.kotur@broadcom.com>
+L:      netdev@vger.kernel.org
+W:      http://www.emulex.com
+S:      Supported
+F:      drivers/net/ethernet/emulex/benet/
+EMULEX ONECONNECT ROCE DRIVER
+M:      Selvin Xavier <selvin.xavier@broadcom.com>
+M:      Devesh Sharma <devesh.sharma@broadcom.com>
+L:      linux-rdma@vger.kernel.org
+W:      http://www.broadcom.com
+S:      Odd Fixes
+F:      drivers/infiniband/hw/ocrdma/
+F:      include/uapi/rdma/ocrdma-abi.h
 EMULEX/BROADCOM LPFC FC/FCOE SCSI DRIVER
 M:      James Smart <james.smart@broadcom.com>
 M:      Dick Kennedy <dick.kennedy@broadcom.com>
@@ -5177,6 +5129,22 @@ L:	linux-security-module@vger.kernel.org
 S:      Supported
 F:      security/integrity/evm/
+EXTENSIBLE FIRMWARE INTERFACE (EFI)
+M:      Matt Fleming <matt@codeblueprint.co.uk>
+M:      Ard Biesheuvel <ard.biesheuvel@linaro.org>
+L:      linux-efi@vger.kernel.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi.git
+S:      Maintained
+F:      Documentation/efi-stub.txt
+F:      arch/*/kernel/efi.c
+F:      arch/x86/boot/compressed/eboot.[ch]
+F:      arch/*/include/asm/efi.h
+F:      arch/x86/platform/efi/
+F:      drivers/firmware/efi/
+F:      include/linux/efi*.h
+F:      arch/arm/boot/compressed/efi-header.S
+F:      arch/arm64/kernel/efi-entry.S
 EXTERNAL CONNECTOR SUBSYSTEM (EXTCON)
 M:      MyungJoo Ham <myungjoo.ham@samsung.com>
 M:      Chanwoo Choi <cw00.choi@samsung.com>
@@ -5207,6 +5175,19 @@ S:	Supported
 F:      arch/arc/plat-eznps
 F:      arch/arc/boot/dts/eznps.dts
+F2FS FILE SYSTEM
+M:      Jaegeuk Kim <jaegeuk@kernel.org>
+M:      Chao Yu <yuchao0@huawei.com>
+L:      linux-f2fs-devel@lists.sourceforge.net
+W:      https://f2fs.wiki.kernel.org/
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs.git
+S:      Maintained
+F:      Documentation/filesystems/f2fs.txt
+F:      Documentation/ABI/testing/sysfs-fs-f2fs
+F:      fs/f2fs/
+F:      include/linux/f2fs_fs.h
+F:      include/trace/events/f2fs.h
 F71805F HARDWARE MONITORING DRIVER
 M:      Jean Delvare <jdelvare@suse.com>
 L:      linux-hwmon@vger.kernel.org
@@ -5214,23 +5195,6 @@ S:	Maintained
 F:      Documentation/hwmon/f71805f
 F:      drivers/hwmon/f71805f.c
-FC0011 TUNER DRIVER
-M:      Michael Buesch <m@bues.ch>
-L:      linux-media@vger.kernel.org
-S:      Maintained
-F:      drivers/media/tuners/fc0011.h
-F:      drivers/media/tuners/fc0011.c
-FC2580 MEDIA DRIVER
-M:      Antti Palosaari <crope@iki.fi>
-L:      linux-media@vger.kernel.org
-W:      https://linuxtv.org
-W:      http://palosaari.fi/linux/
-Q:      http://patchwork.linuxtv.org/project/linux-media/list/
-T:      git git://linuxtv.org/anttip/media_tree.git
-S:      Maintained
-F:      drivers/media/tuners/fc2580*
 FANOTIFY
 M:      Eric Paris <eparis@redhat.com>
 S:      Maintained
@@ -5255,6 +5219,23 @@ M:	Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
 S:      Maintained
 F:      drivers/staging/fbtft/
+FC0011 TUNER DRIVER
+M:      Michael Buesch <m@bues.ch>
+L:      linux-media@vger.kernel.org
+S:      Maintained
+F:      drivers/media/tuners/fc0011.h
+F:      drivers/media/tuners/fc0011.c
+FC2580 MEDIA DRIVER
+M:      Antti Palosaari <crope@iki.fi>
+L:      linux-media@vger.kernel.org
+W:      https://linuxtv.org
+W:      http://palosaari.fi/linux/
+Q:      http://patchwork.linuxtv.org/project/linux-media/list/
+T:      git git://linuxtv.org/anttip/media_tree.git
+S:      Maintained
+F:      drivers/media/tuners/fc2580*
 FCOE SUBSYSTEM (libfc, libfcoe, fcoe)
 M:      Johannes Thumshirn <jth@kernel.org>
 L:      fcoe-devel@open-fcoe.org
@@ -5414,6 +5395,14 @@ L:	linuxppc-dev@lists.ozlabs.org
 S:      Maintained
 F:      drivers/dma/fsldma.*
+FREESCALE eTSEC ETHERNET DRIVER (GIANFAR)
+M:      Claudiu Manoil <claudiu.manoil@freescale.com>
+L:      netdev@vger.kernel.org
+S:      Maintained
+F:      drivers/net/ethernet/freescale/gianfar*
+X:      drivers/net/ethernet/freescale/gianfar_ptp.c
+F:      Documentation/devicetree/bindings/net/fsl-tsec-phy.txt
 FREESCALE GPMI NAND DRIVER
 M:      Han Xu <han.xu@nxp.com>
 L:      linux-mtd@lists.infradead.org
@@ -5427,6 +5416,15 @@ L:	linux-i2c@vger.kernel.org
 S:      Maintained
 F:      drivers/i2c/busses/i2c-cpm.c
+FREESCALE IMX / MXC FEC DRIVER
+M:      Fugang Duan <fugang.duan@nxp.com>
+L:      netdev@vger.kernel.org
+S:      Maintained
+F:      drivers/net/ethernet/freescale/fec_main.c
+F:      drivers/net/ethernet/freescale/fec_ptp.c
+F:      drivers/net/ethernet/freescale/fec.h
+F:      Documentation/devicetree/bindings/net/fsl-fec.txt
 FREESCALE IMX / MXC FRAMEBUFFER DRIVER
 M:      Sascha Hauer <kernel@pengutronix.de>
 L:      linux-fbdev@vger.kernel.org
@@ -5435,29 +5433,11 @@ S:	Maintained
 F:      include/linux/platform_data/video-imxfb.h
 F:      drivers/video/fbdev/imxfb.c
-FREESCALE QUAD SPI DRIVER
+FREESCALE QORIQ DPAA ETHERNET DRIVER
-M:      Han Xu <han.xu@nxp.com>
+M:      Madalin Bucur <madalin.bucur@nxp.com>
-L:      linux-mtd@lists.infradead.org
-S:      Maintained
-F:      drivers/mtd/spi-nor/fsl-quadspi.c
-FREESCALE SOC FS_ENET DRIVER
-M:      Pantelis Antoniou <pantelis.antoniou@gmail.com>
-M:      Vitaly Bordug <vbordug@ru.mvista.com>
-L:      linuxppc-dev@lists.ozlabs.org
-L:      netdev@vger.kernel.org
-S:      Maintained
-F:      drivers/net/ethernet/freescale/fs_enet/
-F:      include/linux/fs_enet_pd.h
-FREESCALE IMX / MXC FEC DRIVER
-M:      Fugang Duan <fugang.duan@nxp.com>
 L:      netdev@vger.kernel.org
 S:      Maintained
-F:      drivers/net/ethernet/freescale/fec_main.c
+F:      drivers/net/ethernet/freescale/dpaa
-F:      drivers/net/ethernet/freescale/fec_ptp.c
-F:      drivers/net/ethernet/freescale/fec.h
-F:      Documentation/devicetree/bindings/net/fsl-fec.txt
 FREESCALE QORIQ DPAA FMAN DRIVER
 M:      Madalin Bucur <madalin.bucur@nxp.com>
@@ -5466,20 +5446,11 @@ S:	Maintained
 F:      drivers/net/ethernet/freescale/fman
 F:      Documentation/devicetree/bindings/powerpc/fsl/fman.txt
-FREESCALE QORIQ DPAA ETHERNET DRIVER
+FREESCALE QUAD SPI DRIVER
-M:      Madalin Bucur <madalin.bucur@nxp.com>
+M:      Han Xu <han.xu@nxp.com>
-L:      netdev@vger.kernel.org
+L:      linux-mtd@lists.infradead.org
-S:      Maintained
-F:      drivers/net/ethernet/freescale/dpaa
-FREESCALE SOC DRIVERS
-M:      Li Yang <leoyang.li@nxp.com>
-L:      linuxppc-dev@lists.ozlabs.org
-L:      linux-arm-kernel@lists.infradead.org
 S:      Maintained
-F:      Documentation/devicetree/bindings/soc/fsl/
+F:      drivers/mtd/spi-nor/fsl-quadspi.c
-F:      drivers/soc/fsl/
-F:      include/linux/fsl/
 FREESCALE QUICC ENGINE LIBRARY
 M:      Qiang Zhao <qiang.zhao@nxp.com>
@@ -5489,13 +5460,6 @@ F:	drivers/soc/fsl/qe/
 F:      include/soc/fsl/*qe*.h
 F:      include/soc/fsl/*ucc*.h
-FREESCALE USB PERIPHERAL DRIVERS
-M:      Li Yang <leoyang.li@nxp.com>
-L:      linux-usb@vger.kernel.org
-L:      linuxppc-dev@lists.ozlabs.org
-S:      Maintained
-F:      drivers/usb/gadget/udc/fsl*
 FREESCALE QUICC ENGINE UCC ETHERNET DRIVER
 M:      Li Yang <leoyang.li@nxp.com>
 L:      netdev@vger.kernel.org
@@ -5503,14 +5467,6 @@ L:	linuxppc-dev@lists.ozlabs.org
 S:      Maintained
 F:      drivers/net/ethernet/freescale/ucc_geth*
-FREESCALE eTSEC ETHERNET DRIVER (GIANFAR)
-M:      Claudiu Manoil <claudiu.manoil@freescale.com>
-L:      netdev@vger.kernel.org
-S:      Maintained
-F:      drivers/net/ethernet/freescale/gianfar*
-X:      drivers/net/ethernet/freescale/gianfar_ptp.c
-F:      Documentation/devicetree/bindings/net/fsl-tsec-phy.txt
 FREESCALE QUICC ENGINE UCC HDLC DRIVER
 M:      Zhao Qiang <qiang.zhao@nxp.com>
 L:      netdev@vger.kernel.org
@@ -5524,6 +5480,24 @@ L:	linuxppc-dev@lists.ozlabs.org
 S:      Maintained
 F:      drivers/tty/serial/ucc_uart.c
+FREESCALE SOC DRIVERS
+M:      Li Yang <leoyang.li@nxp.com>
+L:      linuxppc-dev@lists.ozlabs.org
+L:      linux-arm-kernel@lists.infradead.org
+S:      Maintained
+F:      Documentation/devicetree/bindings/soc/fsl/
+F:      drivers/soc/fsl/
+F:      include/linux/fsl/
+FREESCALE SOC FS_ENET DRIVER
+M:      Pantelis Antoniou <pantelis.antoniou@gmail.com>
+M:      Vitaly Bordug <vbordug@ru.mvista.com>
+L:      linuxppc-dev@lists.ozlabs.org
+L:      netdev@vger.kernel.org
+S:      Maintained
+F:      drivers/net/ethernet/freescale/fs_enet/
+F:      include/linux/fs_enet_pd.h
 FREESCALE SOC SOUND DRIVERS
 M:      Timur Tabi <timur@tabi.org>
 M:      Nicolin Chen <nicoleotsuka@gmail.com>
@@ -5536,6 +5510,13 @@ F:	sound/soc/fsl/fsl*
 F:      sound/soc/fsl/imx*
 F:      sound/soc/fsl/mpc8610_hpcd.c
+FREESCALE USB PERIPHERAL DRIVERS
+M:      Li Yang <leoyang.li@nxp.com>
+L:      linux-usb@vger.kernel.org
+L:      linuxppc-dev@lists.ozlabs.org
+S:      Maintained
+F:      drivers/usb/gadget/udc/fsl*
 FREEVXFS FILESYSTEM
 M:      Christoph Hellwig <hch@infradead.org>
 W:      ftp://ftp.openlinux.org/pub/people/hch/vxfs
@@ -5576,19 +5557,6 @@ S:	Supported
 F:      fs/crypto/
 F:      include/linux/fscrypt*.h
-F2FS FILE SYSTEM
-M:      Jaegeuk Kim <jaegeuk@kernel.org>
-M:      Chao Yu <yuchao0@huawei.com>
-L:      linux-f2fs-devel@lists.sourceforge.net
-W:      https://f2fs.wiki.kernel.org/
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs.git
-S:      Maintained
-F:      Documentation/filesystems/f2fs.txt
-F:      Documentation/ABI/testing/sysfs-fs-f2fs
-F:      fs/f2fs/
-F:      include/linux/f2fs_fs.h
-F:      include/trace/events/f2fs.h
 FUJITSU FR-V (FRV) PORT
 S:      Orphan
 F:      arch/frv/
@@ -5662,6 +5630,12 @@ S:	Maintained
 F:      kernel/gcov/
 F:      Documentation/dev-tools/gcov.rst
+GDB KERNEL DEBUGGING HELPER SCRIPTS
+M:      Jan Kiszka <jan.kiszka@siemens.com>
+M:      Kieran Bingham <kieran@bingham.xyz>
+S:      Supported
+F:      scripts/gdb/
 GDT SCSI DISK ARRAY CONTROLLER DRIVER
 M:      Achim Leubner <achim_leubner@adaptec.com>
 L:      linux-scsi@vger.kernel.org
@@ -5669,12 +5643,6 @@ W:	http://www.icp-vortex.com/
 S:      Supported
 F:      drivers/scsi/gdt*
-GDB KERNEL DEBUGGING HELPER SCRIPTS
-M:      Jan Kiszka <jan.kiszka@siemens.com>
-M:      Kieran Bingham <kieran@bingham.xyz>
-S:      Supported
-F:      scripts/gdb/
 GEMTEK FM RADIO RECEIVER DRIVER
 M:      Hans Verkuil <hverkuil@xs4all.nl>
 L:      linux-media@vger.kernel.org
@@ -5741,17 +5709,17 @@ L:	kvm@vger.kernel.org
 S:      Supported
 F:      drivers/uio/uio_pci_generic.c
-GET_MAINTAINER SCRIPT
-M:      Joe Perches <joe@perches.com>
-S:      Maintained
-F:      scripts/get_maintainer.pl
 GENWQE (IBM Generic Workqueue Card)
 M:      Frank Haverkamp <haver@linux.vnet.ibm.com>
 M:      Guilherme G. Piccoli <gpiccoli@linux.vnet.ibm.com>
 S:      Supported
 F:      drivers/misc/genwqe/
+GET_MAINTAINER SCRIPT
+M:      Joe Perches <joe@perches.com>
+S:      Maintained
+F:      scripts/get_maintainer.pl
 GFS2 FILE SYSTEM
 M:      Steven Whitehouse <swhiteho@redhat.com>
 M:      Bob Peterson <rpeterso@redhat.com>
@@ -5784,6 +5752,15 @@ L:	linux-input@vger.kernel.org
 S:      Maintained
 F:      drivers/input/touchscreen/goodix.c
+GPIO ACPI SUPPORT
+M:      Mika Westerberg <mika.westerberg@linux.intel.com>
+M:      Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+L:      linux-gpio@vger.kernel.org
+L:      linux-acpi@vger.kernel.org
+S:      Maintained
+F:      Documentation/acpi/gpio-properties.txt
+F:      drivers/gpio/gpiolib-acpi.c
 GPIO MOCKUP DRIVER
 M:      Bamvor Jian Zhang <bamvor.zhangjian@linaro.org>
 L:      linux-gpio@vger.kernel.org
@@ -5807,15 +5784,6 @@ F:	include/asm-generic/gpio.h
 F:      include/uapi/linux/gpio.h
 F:      tools/gpio/
-GPIO ACPI SUPPORT
-M:      Mika Westerberg <mika.westerberg@linux.intel.com>
-M:      Andy Shevchenko <andriy.shevchenko@linux.intel.com>
-L:      linux-gpio@vger.kernel.org
-L:      linux-acpi@vger.kernel.org
-S:      Maintained
-F:      Documentation/acpi/gpio-properties.txt
-F:      drivers/gpio/gpiolib-acpi.c
 GRE DEMULTIPLEXER DRIVER
 M:      Dmitry Kozlov <xeb@mail.ru>
 L:      netdev@vger.kernel.org
@@ -5830,14 +5798,6 @@ L:	netdev@vger.kernel.org
 S:      Maintained
 F:      drivers/net/ethernet/aeroflex/
-GREYBUS SUBSYSTEM
-M:      Johan Hovold <johan@kernel.org>
-M:      Alex Elder <elder@kernel.org>
-M:      Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-S:      Maintained
-F:      drivers/staging/greybus/
-L:      greybus-dev@lists.linaro.org (moderated for non-subscribers)
 GREYBUS AUDIO PROTOCOLS DRIVERS
 M:      Vaibhav Agarwal <vaibhav.sr@gmail.com>
 M:      Mark Greer <mgreer@animalcreek.com>
@@ -5855,24 +5815,7 @@ F:	drivers/staging/greybus/audio_manager_sysfs.c
 F:      drivers/staging/greybus/audio_module.c
 F:      drivers/staging/greybus/audio_topology.c
-GREYBUS PROTOCOLS DRIVERS
+GREYBUS FW/HID/SPI PROTOCOLS DRIVERS
-M:      Rui Miguel Silva <rmfrfs@gmail.com>
-S:      Maintained
-F:      drivers/staging/greybus/sdio.c
-F:      drivers/staging/greybus/light.c
-F:      drivers/staging/greybus/gpio.c
-F:      drivers/staging/greybus/power_supply.c
-F:      drivers/staging/greybus/spi.c
-F:      drivers/staging/greybus/spilib.c
-GREYBUS PROTOCOLS DRIVERS
-M:      Bryan O'Donoghue <pure.logic@nexus-software.ie>
-S:      Maintained
-F:      drivers/staging/greybus/loopback.c
-F:      drivers/staging/greybus/timesync.c
-F:      drivers/staging/greybus/timesync_platform.c
-GREYBUS PROTOCOLS DRIVERS
 M:      Viresh Kumar <vireshk@kernel.org>
 S:      Maintained
 F:      drivers/staging/greybus/authentication.c
@@ -5889,11 +5832,12 @@ F:	drivers/staging/greybus/spi.c
 F:      drivers/staging/greybus/spilib.c
 F:      drivers/staging/greybus/spilib.h
-GREYBUS PROTOCOLS DRIVERS
+GREYBUS LOOBACK/TIME PROTOCOLS DRIVERS
-M:      David Lin <dtwlin@gmail.com>
+M:      Bryan O'Donoghue <pure.logic@nexus-software.ie>
 S:      Maintained
-F:      drivers/staging/greybus/uart.c
+F:      drivers/staging/greybus/loopback.c
-F:      drivers/staging/greybus/log.c
+F:      drivers/staging/greybus/timesync.c
+F:      drivers/staging/greybus/timesync_platform.c
 GREYBUS PLATFORM DRIVERS
 M:      Vaibhav Hiremath <hvaibhav.linux@gmail.com>
@@ -5902,6 +5846,30 @@ F:	drivers/staging/greybus/arche-platform.c
 F:      drivers/staging/greybus/arche-apb-ctrl.c
 F:      drivers/staging/greybus/arche_platform.h
+GREYBUS SDIO/GPIO/SPI PROTOCOLS DRIVERS
+M:      Rui Miguel Silva <rmfrfs@gmail.com>
+S:      Maintained
+F:      drivers/staging/greybus/sdio.c
+F:      drivers/staging/greybus/light.c
+F:      drivers/staging/greybus/gpio.c
+F:      drivers/staging/greybus/power_supply.c
+F:      drivers/staging/greybus/spi.c
+F:      drivers/staging/greybus/spilib.c
+GREYBUS SUBSYSTEM
+M:      Johan Hovold <johan@kernel.org>
+M:      Alex Elder <elder@kernel.org>
+M:      Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+S:      Maintained
+F:      drivers/staging/greybus/
+L:      greybus-dev@lists.linaro.org (moderated for non-subscribers)
+GREYBUS UART PROTOCOLS DRIVERS
+M:      David Lin <dtwlin@gmail.com>
+S:      Maintained
+F:      drivers/staging/greybus/uart.c
+F:      drivers/staging/greybus/log.c
 GS1662 VIDEO SERIALIZER
 M:      Charles-Antoine Couret <charles-antoine.couret@nexvision.fr>
 L:      linux-media@vger.kernel.org
@@ -5972,13 +5940,6 @@ L:	linux-efi@vger.kernel.org
 S:      Maintained
 F:      block/partitions/efi.*
-STK1160 USB VIDEO CAPTURE DRIVER
-M:      Ezequiel Garcia <ezequiel@vanguardiasur.com.ar>
-L:      linux-media@vger.kernel.org
-T:      git git://linuxtv.org/media_tree.git
-S:      Maintained
-F:      drivers/media/usb/stk1160/
 H8/300 ARCHITECTURE
 M:      Yoshinori Sato <ysato@users.sourceforge.jp>
 L:      uclinux-h8-devel@lists.sourceforge.jp (moderated for non-subscribers)
@@ -5990,33 +5951,6 @@ F:	drivers/clocksource/h8300_*.c
 F:      drivers/clk/h8300/
 F:      drivers/irqchip/irq-renesas-h8*.c
-HARD DRIVE ACTIVE PROTECTION SYSTEM (HDAPS) DRIVER
-M:      Frank Seidel <frank@f-seidel.de>
-L:      platform-driver-x86@vger.kernel.org
-W:      http://www.kernel.org/pub/linux/kernel/people/fseidel/hdaps/
-S:      Maintained
-F:      drivers/platform/x86/hdaps.c
-HDPVR USB VIDEO ENCODER DRIVER
-M:      Hans Verkuil <hverkuil@xs4all.nl>
-L:      linux-media@vger.kernel.org
-T:      git git://linuxtv.org/media_tree.git
-W:      https://linuxtv.org
-S:      Odd Fixes
-F:      drivers/media/usb/hdpvr/
-HWPOISON MEMORY FAILURE HANDLING
-M:      Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
-L:      linux-mm@kvack.org
-S:      Maintained
-F:      mm/memory-failure.c
-F:      mm/hwpoison-inject.c
-HYPERVISOR VIRTUAL CONSOLE DRIVER
-L:      linuxppc-dev@lists.ozlabs.org
-S:      Odd Fixes
-F:      drivers/tty/hvc/
 HACKRF MEDIA DRIVER
 M:      Antti Palosaari <crope@iki.fi>
 L:      linux-media@vger.kernel.org
@@ -6027,6 +5961,13 @@ T:	git git://linuxtv.org/anttip/media_tree.git
 S:      Maintained
 F:      drivers/media/usb/hackrf/
+HARD DRIVE ACTIVE PROTECTION SYSTEM (HDAPS) DRIVER
+M:      Frank Seidel <frank@f-seidel.de>
+L:      platform-driver-x86@vger.kernel.org
+W:      http://www.kernel.org/pub/linux/kernel/people/fseidel/hdaps/
+S:      Maintained
+F:      drivers/platform/x86/hdaps.c
 HARDWARE MONITORING
 M:      Jean Delvare <jdelvare@suse.com>
 M:      Guenter Roeck <linux@roeck-us.net>
@@ -6065,6 +6006,14 @@ L:	linux-parisc@vger.kernel.org
 S:      Maintained
 F:      sound/parisc/harmony.*
+HDPVR USB VIDEO ENCODER DRIVER
+M:      Hans Verkuil <hverkuil@xs4all.nl>
+L:      linux-media@vger.kernel.org
+T:      git git://linuxtv.org/media_tree.git
+W:      https://linuxtv.org
+S:      Odd Fixes
+F:      drivers/media/usb/hdpvr/
 HEWLETT PACKARD ENTERPRISE ILO NMI WATCHDOG DRIVER
 M:      Jimmy Vance <jimmy.vance@hpe.com>
 S:      Supported
@@ -6091,13 +6040,6 @@ F:	drivers/block/cciss*
 F:      include/linux/cciss_ioctl.h
 F:      include/uapi/linux/cciss_ioctl.h
-OPA-VNIC DRIVER
-M:      Dennis Dalessandro <dennis.dalessandro@intel.com>
-M:      Niranjana Vishwanathapura <niranjana.vishwanathapura@intel.com>
-L:      linux-rdma@vger.kernel.org
-S:      Supported
-F:      drivers/infiniband/ulp/opa_vnic
 HFI1 DRIVER
 M:      Mike Marciniszyn <mike.marciniszyn@intel.com>
 M:      Dennis Dalessandro <dennis.dalessandro@intel.com>
@@ -6275,6 +6217,12 @@ L:	netdev@vger.kernel.org
 S:      Maintained
 F:      net/hsr/
+HT16K33 LED CONTROLLER DRIVER
+M:      Robin van der Gracht <robin@protonic.nl>
+S:      Maintained
+F:      drivers/auxdisplay/ht16k33.c
+F:      Documentation/devicetree/bindings/display/ht16k33.txt
 HTCPEN TOUCHSCREEN DRIVER
 M:      Pau Oliva Fora <pof@eslack.org>
 L:      linux-input@vger.kernel.org
@@ -6294,6 +6242,13 @@ W:	https://linuxtv.org
 S:      Supported
 F:      drivers/media/platform/sti/hva
+HWPOISON MEMORY FAILURE HANDLING
+M:      Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
+L:      linux-mm@kvack.org
+S:      Maintained
+F:      mm/memory-failure.c
+F:      mm/hwpoison-inject.c
 Hyper-V CORE AND DRIVERS
 M:      "K. Y. Srinivasan" <kys@microsoft.com>
 M:      Haiyang Zhang <haiyangz@microsoft.com>
@@ -6316,6 +6271,18 @@ F:	include/linux/hyperv.h
 F:      tools/hv/
 F:      Documentation/ABI/stable/sysfs-bus-vmbus
+HYPERVISOR VIRTUAL CONSOLE DRIVER
+L:      linuxppc-dev@lists.ozlabs.org
+S:      Odd Fixes
+F:      drivers/tty/hvc/
+I2C ACPI SUPPORT
+M:      Mika Westerberg <mika.westerberg@linux.intel.com>
+L:      linux-i2c@vger.kernel.org
+L:      linux-acpi@vger.kernel.org
+S:      Maintained
+F:      drivers/i2c/i2c-core-acpi.c
 I2C MUXES
 M:      Peter Rosin <peda@axentia.se>
 L:      linux-i2c@vger.kernel.org
@@ -6338,6 +6305,36 @@ F:	Documentation/i2c/busses/i2c-parport-light
 F:      drivers/i2c/busses/i2c-parport.c
 F:      drivers/i2c/busses/i2c-parport-light.c
+I2C SUBSYSTEM
+M:      Wolfram Sang <wsa@the-dreams.de>
+L:      linux-i2c@vger.kernel.org
+W:      https://i2c.wiki.kernel.org/
+Q:      https://patchwork.ozlabs.org/project/linux-i2c/list/
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux.git
+S:      Maintained
+F:      Documentation/devicetree/bindings/i2c/
+F:      Documentation/i2c/
+F:      drivers/i2c/
+F:      drivers/i2c/*/
+F:      include/linux/i2c.h
+F:      include/linux/i2c-*.h
+F:      include/uapi/linux/i2c.h
+F:      include/uapi/linux/i2c-*.h
+I2C-TAOS-EVM DRIVER
+M:      Jean Delvare <jdelvare@suse.com>
+L:      linux-i2c@vger.kernel.org
+S:      Maintained
+F:      Documentation/i2c/busses/i2c-taos-evm
+F:      drivers/i2c/busses/i2c-taos-evm.c
+I2C-TINY-USB DRIVER
+M:      Till Harbaum <till@harbaum.org>
+L:      linux-i2c@vger.kernel.org
+W:      http://www.harbaum.org/till/i2c_tiny_usb
+S:      Maintained
+F:      drivers/i2c/busses/i2c-tiny-usb.c
 I2C/SMBUS CONTROLLER DRIVERS FOR PC
 M:      Jean Delvare <jdelvare@suse.com>
 L:      linux-i2c@vger.kernel.org
@@ -6385,43 +6382,6 @@ L:	linux-i2c@vger.kernel.org
 S:      Maintained
 F:      drivers/i2c/i2c-stub.c
-I2C SUBSYSTEM
-M:      Wolfram Sang <wsa@the-dreams.de>
-L:      linux-i2c@vger.kernel.org
-W:      https://i2c.wiki.kernel.org/
-Q:      https://patchwork.ozlabs.org/project/linux-i2c/list/
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux.git
-S:      Maintained
-F:      Documentation/devicetree/bindings/i2c/
-F:      Documentation/i2c/
-F:      drivers/i2c/
-F:      drivers/i2c/*/
-F:      include/linux/i2c.h
-F:      include/linux/i2c-*.h
-F:      include/uapi/linux/i2c.h
-F:      include/uapi/linux/i2c-*.h
-I2C ACPI SUPPORT
-M:      Mika Westerberg <mika.westerberg@linux.intel.com>
-L:      linux-i2c@vger.kernel.org
-L:      linux-acpi@vger.kernel.org
-S:      Maintained
-F:      drivers/i2c/i2c-core-acpi.c
-I2C-TAOS-EVM DRIVER
-M:      Jean Delvare <jdelvare@suse.com>
-L:      linux-i2c@vger.kernel.org
-S:      Maintained
-F:      Documentation/i2c/busses/i2c-taos-evm
-F:      drivers/i2c/busses/i2c-taos-evm.c
-I2C-TINY-USB DRIVER
-M:      Till Harbaum <till@harbaum.org>
-L:      linux-i2c@vger.kernel.org
-W:      http://www.harbaum.org/till/i2c_tiny_usb
-S:      Maintained
-F:      drivers/i2c/busses/i2c-tiny-usb.c
 i386 BOOT CODE
 M:      "H. Peter Anvin" <hpa@zytor.com>
 S:      Maintained
@@ -6440,17 +6400,15 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux.git
 S:      Maintained
 F:      arch/ia64/
-IBM Power VMX Cryptographic instructions
+IBM Power 842 compression accelerator
-M:      Leonidas S. Barbosa <leosilva@linux.vnet.ibm.com>
+M:      Haren Myneni <haren@us.ibm.com>
-M:      Paulo Flabiano Smorigo <pfsmorigo@linux.vnet.ibm.com>
-L:      linux-crypto@vger.kernel.org
 S:      Supported
-F:      drivers/crypto/vmx/Makefile
+F:      drivers/crypto/nx/Makefile
-F:      drivers/crypto/vmx/Kconfig
+F:      drivers/crypto/nx/Kconfig
-F:      drivers/crypto/vmx/vmx.c
+F:      drivers/crypto/nx/nx-842*
-F:      drivers/crypto/vmx/aes*
+F:      include/linux/sw842.h
-F:      drivers/crypto/vmx/ghash*
+F:      crypto/842.c
-F:      drivers/crypto/vmx/ppc-xlate.pl
+F:      lib/842/
 IBM Power in-Nest Crypto Acceleration
 M:      Leonidas S. Barbosa <leosilva@linux.vnet.ibm.com>
@@ -6465,33 +6423,29 @@ F:	drivers/crypto/nx/nx.*
 F:      drivers/crypto/nx/nx_csbcpb.h
 F:      drivers/crypto/nx/nx_debugfs.h
-IBM Power 842 compression accelerator
-M:      Haren Myneni <haren@us.ibm.com>
-S:      Supported
-F:      drivers/crypto/nx/Makefile
-F:      drivers/crypto/nx/Kconfig
-F:      drivers/crypto/nx/nx-842*
-F:      include/linux/sw842.h
-F:      crypto/842.c
-F:      lib/842/
 IBM Power Linux RAID adapter
 M:      Brian King <brking@us.ibm.com>
 S:      Supported
 F:      drivers/scsi/ipr.*
-IBM Power Virtual Ethernet Device Driver
+IBM Power SRIOV Virtual NIC Device Driver
 M:      Thomas Falcon <tlfalcon@linux.vnet.ibm.com>
+M:      John Allen <jallen@linux.vnet.ibm.com>
 L:      netdev@vger.kernel.org
 S:      Supported
-F:      drivers/net/ethernet/ibm/ibmveth.*
+F:      drivers/net/ethernet/ibm/ibmvnic.*
-IBM Power SRIOV Virtual NIC Device Driver
+IBM Power Virtual Ethernet Device Driver
 M:      Thomas Falcon <tlfalcon@linux.vnet.ibm.com>
-M:      John Allen <jallen@linux.vnet.ibm.com>
 L:      netdev@vger.kernel.org
 S:      Supported
-F:      drivers/net/ethernet/ibm/ibmvnic.*
+F:      drivers/net/ethernet/ibm/ibmveth.*
+IBM Power Virtual FC Device Drivers
+M:      Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
+L:      linux-scsi@vger.kernel.org
+S:      Supported
+F:      drivers/scsi/ibmvscsi/ibmvfc*
 IBM Power Virtual SCSI Device Drivers
 M:      Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
@@ -6508,11 +6462,17 @@ L:	target-devel@vger.kernel.org
 S:      Supported
 F:      drivers/scsi/ibmvscsi_tgt/
-IBM Power Virtual FC Device Drivers
+IBM Power VMX Cryptographic instructions
-M:      Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
+M:      Leonidas S. Barbosa <leosilva@linux.vnet.ibm.com>
-L:      linux-scsi@vger.kernel.org
+M:      Paulo Flabiano Smorigo <pfsmorigo@linux.vnet.ibm.com>
+L:      linux-crypto@vger.kernel.org
 S:      Supported
-F:      drivers/scsi/ibmvscsi/ibmvfc*
+F:      drivers/crypto/vmx/Makefile
+F:      drivers/crypto/vmx/Kconfig
+F:      drivers/crypto/vmx/vmx.c
+F:      drivers/crypto/vmx/aes*
+F:      drivers/crypto/vmx/ghash*
+F:      drivers/crypto/vmx/ppc-xlate.pl
 IBM ServeRAID RAID DRIVER
 S:      Orphan
@@ -6524,11 +6484,6 @@ S:	Maintained
 F:      drivers/mfd/lpc_ich.c
 F:      drivers/gpio/gpio-ich.c
-IDT VersaClock 5 CLOCK DRIVER
-M:      Marek Vasut <marek.vasut@gmail.com>
-S:      Maintained
-F:      drivers/clk/clk-versaclock5.c
 IDE SUBSYSTEM
 M:      "David S. Miller" <davem@davemloft.net>
 L:      linux-ide@vger.kernel.org
@@ -6539,6 +6494,13 @@ F:	Documentation/ide/
 F:      drivers/ide/
 F:      include/linux/ide.h
+IDE/ATAPI DRIVERS
+M:      Borislav Petkov <bp@alien8.de>
+L:      linux-ide@vger.kernel.org
+S:      Maintained
+F:      Documentation/cdrom/ide-cd
+F:      drivers/ide/ide-cd*
 IDEAPAD LAPTOP EXTRAS DRIVER
 M:      Ike Panhc <ike.pan@canonical.com>
 L:      platform-driver-x86@vger.kernel.org
@@ -6553,12 +6515,10 @@ W:	https://github.com/o2genum/ideapad-slidebar
 S:      Maintained
 F:      drivers/input/misc/ideapad_slidebar.c
-IDE/ATAPI DRIVERS
+IDT VersaClock 5 CLOCK DRIVER
-M:      Borislav Petkov <bp@alien8.de>
+M:      Marek Vasut <marek.vasut@gmail.com>
-L:      linux-ide@vger.kernel.org
 S:      Maintained
-F:      Documentation/cdrom/ide-cd
+F:      drivers/clk/clk-versaclock5.c
-F:      drivers/ide/ide-cd*
 IEEE 802.15.4 SUBSYSTEM
 M:      Alexander Aring <alex.aring@gmail.com>
@@ -6648,6 +6608,16 @@ S:	Maintained
 F:      Documentation/devicetree/bindings/auxdisplay/img-ascii-lcd.txt
 F:      drivers/auxdisplay/img-ascii-lcd.c
+IMGTEC IR DECODER DRIVER
+M:      James Hogan <james.hogan@imgtec.com>
+S:      Maintained
+F:      drivers/media/rc/img-ir/
+IMS TWINTURBO FRAMEBUFFER DRIVER
+L:      linux-fbdev@vger.kernel.org
+S:      Orphan
+F:      drivers/video/fbdev/imsttfb.c
 INA209 HARDWARE MONITOR DRIVER
 M:      Guenter Roeck <linux@roeck-us.net>
 L:      linux-hwmon@vger.kernel.org
@@ -6673,37 +6643,6 @@ W:	http://industrypack.sourceforge.net
 S:      Maintained
 F:      drivers/ipack/
-INGENIC JZ4780 DMA Driver
-M:      Zubair Lutfullah Kakakhel <Zubair.Kakakhel@imgtec.com>
-S:      Maintained
-F:      drivers/dma/dma-jz4780.c
-INGENIC JZ4780 NAND DRIVER
-M:      Harvey Hunt <harveyhuntnexus@gmail.com>
-L:      linux-mtd@lists.infradead.org
-S:      Maintained
-F:      drivers/mtd/nand/jz4780_*
-INTEGRITY MEASUREMENT ARCHITECTURE (IMA)
-M:      Mimi Zohar <zohar@linux.vnet.ibm.com>
-M:      Dmitry Kasatkin <dmitry.kasatkin@gmail.com>
-L:      linux-ima-devel@lists.sourceforge.net
-L:      linux-ima-user@lists.sourceforge.net
-L:      linux-security-module@vger.kernel.org
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git
-S:      Supported
-F:      security/integrity/ima/
-IMGTEC IR DECODER DRIVER
-M:      James Hogan <james.hogan@imgtec.com>
-S:      Maintained
-F:      drivers/media/rc/img-ir/
-IMS TWINTURBO FRAMEBUFFER DRIVER
-L:      linux-fbdev@vger.kernel.org
-S:      Orphan
-F:      drivers/video/fbdev/imsttfb.c
 INFINIBAND SUBSYSTEM
 M:      Doug Ledford <dledford@redhat.com>
 M:      Sean Hefty <sean.hefty@intel.com>
@@ -6720,6 +6659,17 @@ F:	include/uapi/linux/if_infiniband.h
 F:      include/uapi/rdma/
 F:      include/rdma/
+INGENIC JZ4780 DMA Driver
+M:      Zubair Lutfullah Kakakhel <Zubair.Kakakhel@imgtec.com>
+S:      Maintained
+F:      drivers/dma/dma-jz4780.c
+INGENIC JZ4780 NAND DRIVER
+M:      Harvey Hunt <harveyhuntnexus@gmail.com>
+L:      linux-mtd@lists.infradead.org
+S:      Maintained
+F:      drivers/mtd/nand/jz4780_*
 INOTIFY
 M:      John McCutchan <john@johnmccutchan.com>
 M:      Robert Love <rlove@rlove.org>
@@ -6758,6 +6708,22 @@ F:	drivers/crypto/inside-secure/
 S:      Maintained
 L:      linux-crypto@vger.kernel.org
+INTEGRITY MEASUREMENT ARCHITECTURE (IMA)
+M:      Mimi Zohar <zohar@linux.vnet.ibm.com>
+M:      Dmitry Kasatkin <dmitry.kasatkin@gmail.com>
+L:      linux-ima-devel@lists.sourceforge.net
+L:      linux-ima-user@lists.sourceforge.net
+L:      linux-security-module@vger.kernel.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git
+S:      Supported
+F:      security/integrity/ima/
+INTEL 810/815 FRAMEBUFFER DRIVER
+M:      Antonino Daplas <adaplas@gmail.com>
+L:      linux-fbdev@vger.kernel.org
+S:      Maintained
+F:      drivers/video/fbdev/i810/
 INTEL ASoC BDW/HSW DRIVERS
 M:      Jie Yang <yang.jie@linux.intel.com>
 L:      alsa-devel@alsa-project.org (moderated for non-subscribers)
@@ -6775,17 +6741,74 @@ T:	git git://git.code.sf.net/p/intel-sas/isci
 S:      Supported
 F:      drivers/scsi/isci/
+INTEL DRM DRIVERS (excluding Poulsbo, Moorestown and derivative chipsets)
+M:      Daniel Vetter <daniel.vetter@intel.com>
+M:      Jani Nikula <jani.nikula@linux.intel.com>
+L:      intel-gfx@lists.freedesktop.org
+W:      https://01.org/linuxgraphics/
+B:      https://01.org/linuxgraphics/documentation/how-report-bugs
+C:      irc://chat.freenode.net/intel-gfx
+Q:      http://patchwork.freedesktop.org/project/intel-gfx/
+T:      git git://anongit.freedesktop.org/drm-intel
+S:      Supported
+F:      drivers/gpu/drm/i915/
+F:      include/drm/i915*
+F:      include/uapi/drm/i915_drm.h
+F:      Documentation/gpu/i915.rst
+INTEL ETHERNET DRIVERS
+M:      Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+L:      intel-wired-lan@lists.osuosl.org (moderated for non-subscribers)
+W:      http://www.intel.com/support/feedback.htm
+W:      http://e1000.sourceforge.net/
+Q:      http://patchwork.ozlabs.org/project/intel-wired-lan/list/
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net-queue.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/next-queue.git
+S:      Supported
+F:      Documentation/networking/e100.txt
+F:      Documentation/networking/e1000.txt
+F:      Documentation/networking/e1000e.txt
+F:      Documentation/networking/igb.txt
+F:      Documentation/networking/igbvf.txt
+F:      Documentation/networking/ixgb.txt
+F:      Documentation/networking/ixgbe.txt
+F:      Documentation/networking/ixgbevf.txt
+F:      Documentation/networking/i40e.txt
+F:      Documentation/networking/i40evf.txt
+F:      drivers/net/ethernet/intel/
+F:      drivers/net/ethernet/intel/*/
+F:      include/linux/avf/virtchnl.h
+INTEL FRAMEBUFFER DRIVER (excluding 810 and 815)
+M:      Maik Broemme <mbroemme@libmpq.org>
+L:      linux-fbdev@vger.kernel.org
+S:      Maintained
+F:      Documentation/fb/intelfb.txt
+F:      drivers/video/fbdev/intelfb/
+INTEL GVT-g DRIVERS (Intel GPU Virtualization)
+M:      Zhenyu Wang <zhenyuw@linux.intel.com>
+M:      Zhi Wang <zhi.a.wang@intel.com>
+L:      intel-gvt-dev@lists.freedesktop.org
+L:      intel-gfx@lists.freedesktop.org
+W:      https://01.org/igvt-g
+T:      git https://github.com/01org/gvt-linux.git
+S:      Supported
+F:      drivers/gpu/drm/i915/gvt/
 INTEL HID EVENT DRIVER
 M:      Alex Hung <alex.hung@canonical.com>
 L:      platform-driver-x86@vger.kernel.org
 S:      Maintained
 F:      drivers/platform/x86/intel-hid.c
-INTEL VIRTUAL BUTTON DRIVER
+INTEL I/OAT DMA DRIVER
-M:      AceLan Kao <acelan.kao@canonical.com>
+M:      Dave Jiang <dave.jiang@intel.com>
-L:      platform-driver-x86@vger.kernel.org
+R:      Dan Williams <dan.j.williams@intel.com>
-S:      Maintained
+L:      dmaengine@vger.kernel.org
-F:      drivers/platform/x86/intel-vbtn.c
+Q:      https://patchwork.kernel.org/project/linux-dmaengine/list/
+S:      Supported
+F:      drivers/dma/ioat*
 INTEL IDLE DRIVER
 M:      Jacob Pan <jacob.jun.pan@linux.intel.com>
@@ -6803,41 +6826,6 @@ L:	linux-input@vger.kernel.org
 S:      Maintained
 F:      drivers/hid/intel-ish-hid/
-INTEL PSTATE DRIVER
-M:      Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
-M:      Len Brown <lenb@kernel.org>
-L:      linux-pm@vger.kernel.org
-S:      Supported
-F:      drivers/cpufreq/intel_pstate.c
-INTEL FRAMEBUFFER DRIVER (excluding 810 and 815)
-M:      Maik Broemme <mbroemme@libmpq.org>
-L:      linux-fbdev@vger.kernel.org
-S:      Maintained
-F:      Documentation/fb/intelfb.txt
-F:      drivers/video/fbdev/intelfb/
-INTEL 810/815 FRAMEBUFFER DRIVER
-M:      Antonino Daplas <adaplas@gmail.com>
-L:      linux-fbdev@vger.kernel.org
-S:      Maintained
-F:      drivers/video/fbdev/i810/
-INTEL MENLOW THERMAL DRIVER
-M:      Sujith Thomas <sujith.thomas@intel.com>
-L:      platform-driver-x86@vger.kernel.org
-W:      https://01.org/linux-acpi
-S:      Supported
-F:      drivers/platform/x86/intel_menlow.c
-INTEL I/OAT DMA DRIVER
-M:      Dave Jiang <dave.jiang@intel.com>
-R:      Dan Williams <dan.j.williams@intel.com>
-L:      dmaengine@vger.kernel.org
-Q:      https://patchwork.kernel.org/project/linux-dmaengine/list/
-S:      Supported
-F:      drivers/dma/ioat*
 INTEL IOMMU (VT-d)
 M:      David Woodhouse <dwmw2@infradead.org>
 L:      iommu@lists.linux-foundation.org
@@ -6866,35 +6854,23 @@ M:	Deepak Saxena <dsaxena@plexity.net>
 S:      Maintained
 F:      drivers/char/hw_random/ixp4xx-rng.c
-INTEL ETHERNET DRIVERS
+INTEL MANAGEMENT ENGINE (mei)
-M:      Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+M:      Tomas Winkler <tomas.winkler@intel.com>
-L:      intel-wired-lan@lists.osuosl.org (moderated for non-subscribers)
+L:      linux-kernel@vger.kernel.org
-W:      http://www.intel.com/support/feedback.htm
-W:      http://e1000.sourceforge.net/
-Q:      http://patchwork.ozlabs.org/project/intel-wired-lan/list/
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net-queue.git
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/next-queue.git
 S:      Supported
-F:      Documentation/networking/e100.txt
+F:      include/uapi/linux/mei.h
-F:      Documentation/networking/e1000.txt
+F:      include/linux/mei_cl_bus.h
-F:      Documentation/networking/e1000e.txt
+F:      drivers/misc/mei/*
-F:      Documentation/networking/igb.txt
+F:      drivers/watchdog/mei_wdt.c
-F:      Documentation/networking/igbvf.txt
+F:      Documentation/misc-devices/mei/*
-F:      Documentation/networking/ixgb.txt
+F:      samples/mei/*
-F:      Documentation/networking/ixgbe.txt
-F:      Documentation/networking/ixgbevf.txt
-F:      Documentation/networking/i40e.txt
-F:      Documentation/networking/i40evf.txt
-F:      drivers/net/ethernet/intel/
-F:      drivers/net/ethernet/intel/*/
-F:      include/linux/avf/virtchnl.h
-INTEL RDMA RNIC DRIVER
+INTEL MENLOW THERMAL DRIVER
-M:     Faisal Latif <faisal.latif@intel.com>
+M:      Sujith Thomas <sujith.thomas@intel.com>
-M:     Shiraz Saleem <shiraz.saleem@intel.com>
+L:      platform-driver-x86@vger.kernel.org
-L:     linux-rdma@vger.kernel.org
+W:      https://01.org/linux-acpi
-S:     Supported
+S:      Supported
-F:     drivers/infiniband/hw/i40iw/
+F:      drivers/platform/x86/intel_menlow.c
 INTEL MERRIFIELD GPIO DRIVER
 M:      Andy Shevchenko <andriy.shevchenko@linux.intel.com>
@@ -6902,11 +6878,38 @@ L:	linux-gpio@vger.kernel.org
 S:      Maintained
 F:      drivers/gpio/gpio-merrifield.c
-INTEL-MID GPIO DRIVER
+INTEL MIC DRIVERS (mic)
-M:      David Cohen <david.a.cohen@linux.intel.com>
+M:      Sudeep Dutt <sudeep.dutt@intel.com>
-L:      linux-gpio@vger.kernel.org
+M:      Ashutosh Dixit <ashutosh.dixit@intel.com>
+S:      Supported
+W:      https://github.com/sudeepdutt/mic
+W:      http://software.intel.com/en-us/mic-developer
+F:      include/linux/mic_bus.h
+F:      include/linux/scif.h
+F:      include/uapi/linux/mic_common.h
+F:      include/uapi/linux/mic_ioctl.h
+F:      include/uapi/linux/scif_ioctl.h
+F:      drivers/misc/mic/
+F:      drivers/dma/mic_x100_dma.c
+F:      drivers/dma/mic_x100_dma.h
+F:      Documentation/mic/
+INTEL PMC CORE DRIVER
+M:      Rajneesh Bhardwaj <rajneesh.bhardwaj@intel.com>
+M:      Vishwanath Somayaji <vishwanath.somayaji@intel.com>
+L:      platform-driver-x86@vger.kernel.org
 S:      Maintained
-F:      drivers/gpio/gpio-intel-mid.c
+F:      arch/x86/include/asm/pmc_core.h
+F:      drivers/platform/x86/intel_pmc_core*
+INTEL PMC/P-Unit IPC DRIVER
+M:      Zha Qipeng<qipeng.zha@intel.com>
+L:      platform-driver-x86@vger.kernel.org
+S:      Maintained
+F:      drivers/platform/x86/intel_pmc_ipc.c
+F:      drivers/platform/x86/intel_punit_ipc.c
+F:      arch/x86/include/asm/intel_pmc_ipc.h
+F:      arch/x86/include/asm/intel_punit_ipc.h
 INTEL PRO/WIRELESS 2100, 2200BG, 2915ABG NETWORK CONNECTION SUPPORT
 M:      Stanislav Yakovlev <stas.yakovlev@gmail.com>
@@ -6916,31 +6919,32 @@ F:	Documentation/networking/README.ipw2100
 F:      Documentation/networking/README.ipw2200
 F:      drivers/net/wireless/intel/ipw2x00/
-INTEL(R) TRACE HUB
+INTEL PSTATE DRIVER
-M:      Alexander Shishkin <alexander.shishkin@linux.intel.com>
+M:      Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+M:      Len Brown <lenb@kernel.org>
+L:      linux-pm@vger.kernel.org
 S:      Supported
-F:      Documentation/trace/intel_th.txt
+F:      drivers/cpufreq/intel_pstate.c
-F:      drivers/hwtracing/intel_th/
-INTEL(R) TRUSTED EXECUTION TECHNOLOGY (TXT)
+INTEL RDMA RNIC DRIVER
-M:      Ning Sun <ning.sun@intel.com>
+M:      Faisal Latif <faisal.latif@intel.com>
-L:      tboot-devel@lists.sourceforge.net
+M:      Shiraz Saleem <shiraz.saleem@intel.com>
-W:      http://tboot.sourceforge.net
+L:      linux-rdma@vger.kernel.org
-T:      hg http://tboot.hg.sourceforge.net:8000/hgroot/tboot/tboot
 S:      Supported
-F:      Documentation/intel_txt.txt
+F:      drivers/infiniband/hw/i40iw/
-F:      include/linux/tboot.h
-F:      arch/x86/kernel/tboot.c
-INTEL WIRELESS WIMAX CONNECTION 2400
+INTEL TELEMETRY DRIVER
-M:      Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
+M:      Souvik Kumar Chakravarty <souvik.k.chakravarty@intel.com>
-M:      linux-wimax@intel.com
+L:      platform-driver-x86@vger.kernel.org
-L:      wimax@linuxwimax.org (subscribers-only)
+S:      Maintained
-S:      Supported
+F:      arch/x86/include/asm/intel_telemetry.h
-W:      http://linuxwimax.org
+F:      drivers/platform/x86/intel_telemetry*
-F:      Documentation/wimax/README.i2400m
-F:      drivers/net/wimax/i2400m/
+INTEL VIRTUAL BUTTON DRIVER
-F:      include/uapi/linux/wimax/i2400m.h
+M:      AceLan Kao <acelan.kao@canonical.com>
+L:      platform-driver-x86@vger.kernel.org
+S:      Maintained
+F:      drivers/platform/x86/intel-vbtn.c
 INTEL WIRELESS 3945ABG/BG, 4965AGN (iwlegacy)
 M:      Stanislaw Gruszka <sgruszka@redhat.com>
@@ -6959,56 +6963,37 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi.git
 S:      Supported
 F:      drivers/net/wireless/intel/iwlwifi/
-INTEL MANAGEMENT ENGINE (mei)
+INTEL WIRELESS WIMAX CONNECTION 2400
-M:      Tomas Winkler <tomas.winkler@intel.com>
+M:      Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
-L:      linux-kernel@vger.kernel.org
+M:      linux-wimax@intel.com
+L:      wimax@linuxwimax.org (subscribers-only)
 S:      Supported
-F:      include/uapi/linux/mei.h
+W:      http://linuxwimax.org
-F:      include/linux/mei_cl_bus.h
+F:      Documentation/wimax/README.i2400m
-F:      drivers/misc/mei/*
+F:      drivers/net/wimax/i2400m/
-F:      drivers/watchdog/mei_wdt.c
+F:      include/uapi/linux/wimax/i2400m.h
-F:      Documentation/misc-devices/mei/*
-F:      samples/mei/*
-INTEL MIC DRIVERS (mic)
+INTEL(R) TRACE HUB
-M:      Sudeep Dutt <sudeep.dutt@intel.com>
+M:      Alexander Shishkin <alexander.shishkin@linux.intel.com>
-M:      Ashutosh Dixit <ashutosh.dixit@intel.com>
 S:      Supported
-W:      https://github.com/sudeepdutt/mic
+F:      Documentation/trace/intel_th.txt
-W:      http://software.intel.com/en-us/mic-developer
+F:      drivers/hwtracing/intel_th/
-F:      include/linux/mic_bus.h
-F:      include/linux/scif.h
-F:      include/uapi/linux/mic_common.h
-F:      include/uapi/linux/mic_ioctl.h
-F:      include/uapi/linux/scif_ioctl.h
-F:      drivers/misc/mic/
-F:      drivers/dma/mic_x100_dma.c
-F:      drivers/dma/mic_x100_dma.h
-F:      Documentation/mic/
-INTEL PMC/P-Unit IPC DRIVER
-M:      Zha Qipeng<qipeng.zha@intel.com>
-L:      platform-driver-x86@vger.kernel.org
-S:      Maintained
-F:      drivers/platform/x86/intel_pmc_ipc.c
-F:      drivers/platform/x86/intel_punit_ipc.c
-F:      arch/x86/include/asm/intel_pmc_ipc.h
-F:      arch/x86/include/asm/intel_punit_ipc.h
-INTEL TELEMETRY DRIVER
+INTEL(R) TRUSTED EXECUTION TECHNOLOGY (TXT)
-M:      Souvik Kumar Chakravarty <souvik.k.chakravarty@intel.com>
+M:      Ning Sun <ning.sun@intel.com>
-L:      platform-driver-x86@vger.kernel.org
+L:      tboot-devel@lists.sourceforge.net
-S:      Maintained
+W:      http://tboot.sourceforge.net
-F:      arch/x86/include/asm/intel_telemetry.h
+T:      hg http://tboot.hg.sourceforge.net:8000/hgroot/tboot/tboot
-F:      drivers/platform/x86/intel_telemetry*
+S:      Supported
+F:      Documentation/intel_txt.txt
+F:      include/linux/tboot.h
+F:      arch/x86/kernel/tboot.c
-INTEL PMC CORE DRIVER
+INTEL-MID GPIO DRIVER
-M:      Rajneesh Bhardwaj <rajneesh.bhardwaj@intel.com>
+M:      David Cohen <david.a.cohen@linux.intel.com>
-M:      Vishwanath Somayaji <vishwanath.somayaji@intel.com>
+L:      linux-gpio@vger.kernel.org
-L:      platform-driver-x86@vger.kernel.org
 S:      Maintained
-F:      arch/x86/include/asm/pmc_core.h
+F:      drivers/gpio/gpio-intel-mid.c
-F:      drivers/platform/x86/intel_pmc_core*
 INVENSENSE MPU-3050 GYROSCOPE DRIVER
 M:      Linus Walleij <linus.walleij@linaro.org>
@@ -7054,13 +7039,6 @@ F:	drivers/char/ipmi/
 F:      include/linux/ipmi*
 F:      include/uapi/linux/ipmi*
-QCOM AUDIO (ASoC) DRIVERS
-M:      Patrick Lai <plai@codeaurora.org>
-M:      Banajit Goswami <bgoswami@codeaurora.org>
-L:      alsa-devel@alsa-project.org (moderated for non-subscribers)
-S:      Supported
-F:      sound/soc/qcom/
 IPS SCSI RAID DRIVER
 M:      Adaptec OEM Raid Solutions <aacraid@adaptec.com>
 L:      linux-scsi@vger.kernel.org
@@ -7107,6 +7085,15 @@ F:	drivers/net/irda/
 F:      include/net/irda/
 F:      net/irda/
+IRQ DOMAINS (IRQ NUMBER MAPPING LIBRARY)
+M:      Marc Zyngier <marc.zyngier@arm.com>
+S:      Maintained
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git irq/core
+F:      Documentation/IRQ-domain.txt
+F:      include/linux/irqdomain.h
+F:      kernel/irq/irqdomain.c
+F:      kernel/irq/msi.c
 IRQ SUBSYSTEM
 M:      Thomas Gleixner <tglx@linutronix.de>
 L:      linux-kernel@vger.kernel.org
@@ -7125,15 +7112,6 @@ T:	git git://git.infradead.org/users/jcooper/linux.git irqchip/core
 F:      Documentation/devicetree/bindings/interrupt-controller/
 F:      drivers/irqchip/
-IRQ DOMAINS (IRQ NUMBER MAPPING LIBRARY)
-M:      Marc Zyngier <marc.zyngier@arm.com>
-S:      Maintained
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git irq/core
-F:      Documentation/IRQ-domain.txt
-F:      include/linux/irqdomain.h
-F:      kernel/irq/irqdomain.c
-F:      kernel/irq/msi.c
 ISA
 M:      William Breathitt Gray <vilhelm.gray@gmail.com>
 S:      Maintained
@@ -7141,13 +7119,6 @@ F:	Documentation/isa.txt
 F:      drivers/base/isa.c
 F:      include/linux/isa.h
-ISAPNP
-M:      Jaroslav Kysela <perex@perex.cz>
-S:      Maintained
-F:      Documentation/isapnp.txt
-F:      drivers/pnp/isapnp/
-F:      include/linux/isapnp.h
 ISA RADIO MODULE
 M:      Hans Verkuil <hverkuil@xs4all.nl>
 L:      linux-media@vger.kernel.org
@@ -7156,11 +7127,12 @@ W:	https://linuxtv.org
 S:      Maintained
 F:      drivers/media/radio/radio-isa*
-iSCSI BOOT FIRMWARE TABLE (iBFT) DRIVER
+ISAPNP
-M:      Peter Jones <pjones@redhat.com>
+M:      Jaroslav Kysela <perex@perex.cz>
-M:      Konrad Rzeszutek Wilk <konrad@kernel.org>
 S:      Maintained
-F:      drivers/firmware/iscsi_ibft*
+F:      Documentation/isapnp.txt
+F:      drivers/pnp/isapnp/
+F:      include/linux/isapnp.h
 ISCSI
 M:      Lee Duncan <lduncan@suse.com>
@@ -7171,6 +7143,12 @@ S:	Maintained
 F:      drivers/scsi/*iscsi*
 F:      include/scsi/*iscsi*
+iSCSI BOOT FIRMWARE TABLE (iBFT) DRIVER
+M:      Peter Jones <pjones@redhat.com>
+M:      Konrad Rzeszutek Wilk <konrad@kernel.org>
+S:      Maintained
+F:      drivers/firmware/iscsi_ibft*
 ISCSI EXTENSIONS FOR RDMA (ISER) INITIATOR
 M:      Or Gerlitz <ogerlitz@mellanox.com>
 M:      Sagi Grimberg <sagi@grimberg.me>
@@ -7426,27 +7404,6 @@ S:	Maintained
 F:      arch/x86/include/asm/svm.h
 F:      arch/x86/kvm/svm.c
-KERNEL VIRTUAL MACHINE (KVM) FOR POWERPC
-M:      Alexander Graf <agraf@suse.com>
-L:      kvm-ppc@vger.kernel.org
-W:      http://www.linux-kvm.org/
-T:      git git://github.com/agraf/linux-2.6.git
-S:      Supported
-F:      arch/powerpc/include/asm/kvm*
-F:      arch/powerpc/kvm/
-KERNEL VIRTUAL MACHINE for s390 (KVM/s390)
-M:      Christian Borntraeger <borntraeger@de.ibm.com>
-M:      Cornelia Huck <cohuck@redhat.com>
-L:      linux-s390@vger.kernel.org
-W:      http://www.ibm.com/developerworks/linux/linux390/
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux.git
-S:      Supported
-F:      Documentation/s390/kvm.txt
-F:      arch/s390/include/asm/kvm*
-F:      arch/s390/kvm/
-F:      arch/s390/mm/gmap.c
 KERNEL VIRTUAL MACHINE (KVM) FOR ARM
 M:      Christoffer Dall <christoffer.dall@linaro.org>
 M:      Marc Zyngier <marc.zyngier@arm.com>
@@ -7461,6 +7418,15 @@ F:	arch/arm/kvm/
 F:      virt/kvm/arm/
 F:      include/kvm/arm_*
+KERNEL VIRTUAL MACHINE (KVM) FOR POWERPC
+M:      Alexander Graf <agraf@suse.com>
+L:      kvm-ppc@vger.kernel.org
+W:      http://www.linux-kvm.org/
+T:      git git://github.com/agraf/linux-2.6.git
+S:      Supported
+F:      arch/powerpc/include/asm/kvm*
+F:      arch/powerpc/kvm/
 KERNEL VIRTUAL MACHINE FOR ARM64 (KVM/arm64)
 M:      Christoffer Dall <christoffer.dall@linaro.org>
 M:      Marc Zyngier <marc.zyngier@arm.com>
@@ -7479,6 +7445,18 @@ F:	arch/mips/include/uapi/asm/kvm*
 F:      arch/mips/include/asm/kvm*
 F:      arch/mips/kvm/
+KERNEL VIRTUAL MACHINE for s390 (KVM/s390)
+M:      Christian Borntraeger <borntraeger@de.ibm.com>
+M:      Cornelia Huck <cohuck@redhat.com>
+L:      linux-s390@vger.kernel.org
+W:      http://www.ibm.com/developerworks/linux/linux390/
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux.git
+S:      Supported
+F:      Documentation/s390/kvm.txt
+F:      arch/s390/include/asm/kvm*
+F:      arch/s390/kvm/
+F:      arch/s390/mm/gmap.c
 KERNFS
 M:      Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 M:      Tejun Heo <tj@kernel.org>
@@ -7496,17 +7474,15 @@ F:	include/linux/kexec.h
 F:      include/uapi/linux/kexec.h
 F:      kernel/kexec*
-KEYS/KEYRINGS:
+KEYS-ENCRYPTED
-M:      David Howells <dhowells@redhat.com>
+M:      Mimi Zohar <zohar@linux.vnet.ibm.com>
+M:      David Safford <safford@us.ibm.com>
+L:      linux-security-module@vger.kernel.org
 L:      keyrings@vger.kernel.org
-S:      Maintained
+S:      Supported
-F:      Documentation/security/keys/core.rst
+F:      Documentation/security/keys/trusted-encrypted.rst
-F:      include/linux/key.h
+F:      include/keys/encrypted-type.h
-F:      include/linux/key-type.h
+F:      security/keys/encrypted-keys/
-F:      include/linux/keyctl.h
-F:      include/uapi/linux/keyctl.h
-F:      include/keys/
-F:      security/keys/
 KEYS-TRUSTED
 M:      David Safford <safford@us.ibm.com>
@@ -7519,15 +7495,17 @@ F:	include/keys/trusted-type.h
 F:      security/keys/trusted.c
 F:      security/keys/trusted.h
-KEYS-ENCRYPTED
+KEYS/KEYRINGS:
-M:      Mimi Zohar <zohar@linux.vnet.ibm.com>
+M:      David Howells <dhowells@redhat.com>
-M:      David Safford <safford@us.ibm.com>
-L:      linux-security-module@vger.kernel.org
 L:      keyrings@vger.kernel.org
-S:      Supported
+S:      Maintained
-F:      Documentation/security/keys/trusted-encrypted.rst
+F:      Documentation/security/keys/core.rst
-F:      include/keys/encrypted-type.h
+F:      include/linux/key.h
-F:      security/keys/encrypted-keys/
+F:      include/linux/key-type.h
+F:      include/linux/keyctl.h
+F:      include/uapi/linux/keyctl.h
+F:      include/keys/
+F:      security/keys/
 KGDB / KDB /debug_core
 M:      Jason Wessel <jason.wessel@windriver.com>
@@ -7671,16 +7649,6 @@ F:	drivers/lguest/
 F:      include/linux/lguest*.h
 F:      tools/lguest/
-LIBATA SUBSYSTEM (Serial and Parallel ATA drivers)
-M:      Tejun Heo <tj@kernel.org>
-L:      linux-ide@vger.kernel.org
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata.git
-S:      Maintained
-F:      drivers/ata/
-F:      include/linux/ata.h
-F:      include/linux/libata.h
-F:      Documentation/devicetree/bindings/ata/
 LIBATA PATA ARASAN COMPACT FLASH CONTROLLER
 M:      Viresh Kumar <vireshk@kernel.org>
 L:      linux-ide@vger.kernel.org
@@ -7724,22 +7692,21 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata.git
 S:      Maintained
 F:      drivers/ata/sata_promise.*
+LIBATA SUBSYSTEM (Serial and Parallel ATA drivers)
+M:      Tejun Heo <tj@kernel.org>
+L:      linux-ide@vger.kernel.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata.git
+S:      Maintained
+F:      drivers/ata/
+F:      include/linux/ata.h
+F:      include/linux/libata.h
+F:      Documentation/devicetree/bindings/ata/
 LIBLOCKDEP
 M:      Sasha Levin <alexander.levin@verizon.com>
 S:      Maintained
 F:      tools/lib/lockdep/
-LIBNVDIMM: NON-VOLATILE MEMORY DEVICE SUBSYSTEM
-M:      Dan Williams <dan.j.williams@intel.com>
-L:      linux-nvdimm@lists.01.org
-Q:      https://patchwork.kernel.org/project/linux-nvdimm/list/
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm.git
-S:      Supported
-F:      drivers/nvdimm/*
-F:      include/linux/nd.h
-F:      include/linux/libnvdimm.h
-F:      include/uapi/linux/ndctl.h
 LIBNVDIMM BLK: MMIO-APERTURE DRIVER
 M:      Ross Zwisler <ross.zwisler@linux.intel.com>
 L:      linux-nvdimm@lists.01.org
@@ -7747,7 +7714,6 @@ Q:	https://patchwork.kernel.org/project/linux-nvdimm/list/
 S:      Supported
 F:      drivers/nvdimm/blk.c
 F:      drivers/nvdimm/region_devs.c
-F:      drivers/acpi/nfit*
 LIBNVDIMM BTT: BLOCK TRANSLATION TABLE
 M:      Vishal Verma <vishal.l.verma@intel.com>
@@ -7763,6 +7729,18 @@ Q:	https://patchwork.kernel.org/project/linux-nvdimm/list/
 S:      Supported
 F:      drivers/nvdimm/pmem*
+LIBNVDIMM: NON-VOLATILE MEMORY DEVICE SUBSYSTEM
+M:      Dan Williams <dan.j.williams@intel.com>
+L:      linux-nvdimm@lists.01.org
+Q:      https://patchwork.kernel.org/project/linux-nvdimm/list/
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm.git
+S:      Supported
+F:      drivers/nvdimm/*
+F:      drivers/acpi/nfit/*
+F:      include/linux/nd.h
+F:      include/linux/libnvdimm.h
+F:      include/uapi/linux/ndctl.h
 LIGHTNVM PLATFORM SUPPORT
 M:      Matias Bjorling <mb@lightnvm.io>
 W:      http://github/OpenChannelSSD
@@ -7772,6 +7750,14 @@ F:	drivers/lightnvm/
 F:      include/linux/lightnvm.h
 F:      include/uapi/linux/lightnvm.h
+LINUX FOR POWER MACINTOSH
+M:      Benjamin Herrenschmidt <benh@kernel.crashing.org>
+W:      http://www.penguinppc.org/
+L:      linuxppc-dev@lists.ozlabs.org
+S:      Maintained
+F:      arch/powerpc/platforms/powermac/
+F:      drivers/macintosh/
 LINUX FOR POWERPC (32-BIT AND 64-BIT)
 M:      Benjamin Herrenschmidt <benh@kernel.crashing.org>
 M:      Paul Mackerras <paulus@samba.org>
@@ -7805,14 +7791,6 @@ N:	powernv
 N:      [^a-z0-9]ps3
 N:      pseries
-LINUX FOR POWER MACINTOSH
-M:      Benjamin Herrenschmidt <benh@kernel.crashing.org>
-W:      http://www.penguinppc.org/
-L:      linuxppc-dev@lists.ozlabs.org
-S:      Maintained
-F:      arch/powerpc/platforms/powermac/
-F:      drivers/macintosh/
 LINUX FOR POWERPC EMBEDDED MPC5XXX
 M:      Anatolij Gustschin <agust@denx.de>
 L:      linuxppc-dev@lists.ozlabs.org
@@ -7830,19 +7808,6 @@ S:	Maintained
 F:      arch/powerpc/platforms/40x/
 F:      arch/powerpc/platforms/44x/
-LINUX FOR POWERPC EMBEDDED XILINX VIRTEX
-L:      linuxppc-dev@lists.ozlabs.org
-S:      Orphan
-F:      arch/powerpc/*/*virtex*
-F:      arch/powerpc/*/*/*virtex*
-LINUX FOR POWERPC EMBEDDED PPC8XX
-M:      Vitaly Bordug <vitb@kernel.crashing.org>
-W:      http://www.penguinppc.org/
-L:      linuxppc-dev@lists.ozlabs.org
-S:      Maintained
-F:      arch/powerpc/platforms/8xx/
 LINUX FOR POWERPC EMBEDDED PPC83XX AND PPC85XX
 M:      Scott Wood <oss@buserror.net>
 M:      Kumar Gala <galak@kernel.crashing.org>
@@ -7854,6 +7819,19 @@ F:	arch/powerpc/platforms/83xx/
 F:      arch/powerpc/platforms/85xx/
 F:      Documentation/devicetree/bindings/powerpc/fsl/
+LINUX FOR POWERPC EMBEDDED PPC8XX
+M:      Vitaly Bordug <vitb@kernel.crashing.org>
+W:      http://www.penguinppc.org/
+L:      linuxppc-dev@lists.ozlabs.org
+S:      Maintained
+F:      arch/powerpc/platforms/8xx/
+LINUX FOR POWERPC EMBEDDED XILINX VIRTEX
+L:      linuxppc-dev@lists.ozlabs.org
+S:      Orphan
+F:      arch/powerpc/*/*virtex*
+F:      arch/powerpc/*/*/*virtex*
 LINUX FOR POWERPC PA SEMI PWRFICIENT
 L:      linuxppc-dev@lists.ozlabs.org
 S:      Orphan
@@ -7861,6 +7839,11 @@ F:	arch/powerpc/platforms/pasemi/
 F:      drivers/*/*pasemi*
 F:      drivers/*/*/*pasemi*
+LINUX KERNEL DUMP TEST MODULE (LKDTM)
+M:      Kees Cook <keescook@chromium.org>
+S:      Maintained
+F:      drivers/misc/lkdtm*
 LINUX SECURITY MODULE (LSM) FRAMEWORK
 M:      Chris Wright <chrisw@sous-sol.org>
 L:      linux-security-module@vger.kernel.org
@@ -7890,11 +7873,6 @@ F:	samples/livepatch/
 L:      live-patching@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jikos/livepatching.git
-LINUX KERNEL DUMP TEST MODULE (LKDTM)
-M:      Kees Cook <keescook@chromium.org>
-S:      Maintained
-F:      drivers/misc/lkdtm*
 LLC (802.2)
 L:      netdev@vger.kernel.org
 S:      Odd fixes
@@ -7947,6 +7925,13 @@ Q:	http://patchwork.linuxtv.org/project/linux-media/list/
 S:      Maintained
 F:      drivers/media/usb/dvb-usb-v2/lmedm04*
+LOADPIN SECURITY MODULE
+M:      Kees Cook <keescook@chromium.org>
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git lsm/loadpin
+S:      Supported
+F:      security/loadpin/
+F:      Documentation/admin-guide/LSM/LoadPin.rst
 LOCKING PRIMITIVES
 M:      Peter Zijlstra <peterz@infradead.org>
 M:      Ingo Molnar <mingo@redhat.com>
@@ -8237,14 +8222,6 @@ S:	Maintained
 F:      Documentation/devicetree/bindings/sound/max9860.txt
 F:      sound/soc/codecs/max9860.*
-MAXIM MUIC CHARGER DRIVERS FOR EXYNOS BASED BOARDS
-M:      Krzysztof Kozlowski <krzk@kernel.org>
-M:      Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
-L:      linux-pm@vger.kernel.org
-S:      Supported
-F:      drivers/power/supply/max14577_charger.c
-F:      drivers/power/supply/max77693_charger.c
 MAXIM MAX77802 PMIC REGULATOR DEVICE DRIVER
 M:      Javier Martinez Canillas <javier@dowhile0.org>
 L:      linux-kernel@vger.kernel.org
@@ -8253,6 +8230,14 @@ F:	drivers/regulator/max77802-regulator.c
 F:      Documentation/devicetree/bindings/*/*max77802.txt
 F:      include/dt-bindings/*/*max77802.h
+MAXIM MUIC CHARGER DRIVERS FOR EXYNOS BASED BOARDS
+M:      Krzysztof Kozlowski <krzk@kernel.org>
+M:      Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+L:      linux-pm@vger.kernel.org
+S:      Supported
+F:      drivers/power/supply/max14577_charger.c
+F:      drivers/power/supply/max77693_charger.c
 MAXIM PMIC AND MUIC DRIVERS FOR EXYNOS BASED BOARDS
 M:      Chanwoo Choi <cw00.choi@samsung.com>
 M:      Krzysztof Kozlowski <krzk@kernel.org>
@@ -8295,14 +8280,25 @@ L:	linux-iio@vger.kernel.org
 S:      Maintained
 F:      drivers/iio/dac/cio-dac.c
-MEDIA DRIVERS FOR RENESAS - DRIF
+MEDIA DRIVERS FOR ASCOT2E
-M:      Ramesh Shanmugasundaram <ramesh.shanmugasundaram@bp.renesas.com>
+M:      Sergey Kozlov <serjk@netup.ru>
+M:      Abylay Ospan <aospan@netup.ru>
 L:      linux-media@vger.kernel.org
-L:      linux-renesas-soc@vger.kernel.org
+W:      https://linuxtv.org
+W:      http://netup.tv/
 T:      git git://linuxtv.org/media_tree.git
 S:      Supported
-F:      Documentation/devicetree/bindings/media/renesas,drif.txt
+F:      drivers/media/dvb-frontends/ascot2e*
-F:      drivers/media/platform/rcar_drif.c
+MEDIA DRIVERS FOR CXD2841ER
+M:      Sergey Kozlov <serjk@netup.ru>
+M:      Abylay Ospan <aospan@netup.ru>
+L:      linux-media@vger.kernel.org
+W:      https://linuxtv.org
+W:      http://netup.tv/
+T:      git git://linuxtv.org/media_tree.git
+S:      Supported
+F:      drivers/media/dvb-frontends/cxd2841er*
 MEDIA DRIVERS FOR FREESCALE IMX
 M:      Steve Longerbeam <slongerbeam@gmail.com>
@@ -8316,43 +8312,6 @@ F:	drivers/staging/media/imx/
 F:      include/linux/imx-media.h
 F:      include/media/imx.h
-MEDIA DRIVERS FOR RENESAS - FCP
-M:      Laurent Pinchart <laurent.pinchart@ideasonboard.com>
-L:      linux-media@vger.kernel.org
-L:      linux-renesas-soc@vger.kernel.org
-T:      git git://linuxtv.org/media_tree.git
-S:      Supported
-F:      Documentation/devicetree/bindings/media/renesas,fcp.txt
-F:      drivers/media/platform/rcar-fcp.c
-F:      include/media/rcar-fcp.h
-MEDIA DRIVERS FOR RENESAS - FDP1
-M:      Kieran Bingham <kieran@bingham.xyz>
-L:      linux-media@vger.kernel.org
-L:      linux-renesas-soc@vger.kernel.org
-T:      git git://linuxtv.org/media_tree.git
-S:      Supported
-F:      Documentation/devicetree/bindings/media/renesas,fdp1.txt
-F:      drivers/media/platform/rcar_fdp1.c
-MEDIA DRIVERS FOR RENESAS - VIN
-M:      Niklas Söderlund <niklas.soderlund@ragnatech.se>
-L:      linux-media@vger.kernel.org
-L:      linux-renesas-soc@vger.kernel.org
-T:      git git://linuxtv.org/media_tree.git
-S:      Supported
-F:      Documentation/devicetree/bindings/media/rcar_vin.txt
-F:      drivers/media/platform/rcar-vin/
-MEDIA DRIVERS FOR RENESAS - VSP1
-M:      Laurent Pinchart <laurent.pinchart@ideasonboard.com>
-L:      linux-media@vger.kernel.org
-L:      linux-renesas-soc@vger.kernel.org
-T:      git git://linuxtv.org/media_tree.git
-S:      Supported
-F:      Documentation/devicetree/bindings/media/renesas,vsp1.txt
-F:      drivers/media/platform/vsp1/
 MEDIA DRIVERS FOR HELENE
 M:      Abylay Ospan <aospan@netup.ru>
 L:      linux-media@vger.kernel.org
@@ -8362,7 +8321,7 @@ T:	git git://linuxtv.org/media_tree.git
 S:      Supported
 F:      drivers/media/dvb-frontends/helene*
-MEDIA DRIVERS FOR ASCOT2E
+MEDIA DRIVERS FOR HORUS3A
 M:      Sergey Kozlov <serjk@netup.ru>
 M:      Abylay Ospan <aospan@netup.ru>
 L:      linux-media@vger.kernel.org
@@ -8370,9 +8329,9 @@ W:	https://linuxtv.org
 W:      http://netup.tv/
 T:      git git://linuxtv.org/media_tree.git
 S:      Supported
-F:      drivers/media/dvb-frontends/ascot2e*
+F:      drivers/media/dvb-frontends/horus3a*
-MEDIA DRIVERS FOR CXD2841ER
+MEDIA DRIVERS FOR LNBH25
 M:      Sergey Kozlov <serjk@netup.ru>
 M:      Abylay Ospan <aospan@netup.ru>
 L:      linux-media@vger.kernel.org
@@ -8380,9 +8339,9 @@ W:	https://linuxtv.org
 W:      http://netup.tv/
 T:      git git://linuxtv.org/media_tree.git
 S:      Supported
-F:      drivers/media/dvb-frontends/cxd2841er*
+F:      drivers/media/dvb-frontends/lnbh25*
-MEDIA DRIVERS FOR HORUS3A
+MEDIA DRIVERS FOR NETUP PCI UNIVERSAL DVB devices
 M:      Sergey Kozlov <serjk@netup.ru>
 M:      Abylay Ospan <aospan@netup.ru>
 L:      linux-media@vger.kernel.org
@@ -8390,27 +8349,53 @@ W:	https://linuxtv.org
 W:      http://netup.tv/
 T:      git git://linuxtv.org/media_tree.git
 S:      Supported
-F:      drivers/media/dvb-frontends/horus3a*
+F:      drivers/media/pci/netup_unidvb/*
-MEDIA DRIVERS FOR LNBH25
+MEDIA DRIVERS FOR RENESAS - DRIF
-M:      Sergey Kozlov <serjk@netup.ru>
+M:      Ramesh Shanmugasundaram <ramesh.shanmugasundaram@bp.renesas.com>
-M:      Abylay Ospan <aospan@netup.ru>
 L:      linux-media@vger.kernel.org
-W:      https://linuxtv.org
+L:      linux-renesas-soc@vger.kernel.org
-W:      http://netup.tv/
 T:      git git://linuxtv.org/media_tree.git
 S:      Supported
-F:      drivers/media/dvb-frontends/lnbh25*
+F:      Documentation/devicetree/bindings/media/renesas,drif.txt
+F:      drivers/media/platform/rcar_drif.c
-MEDIA DRIVERS FOR NETUP PCI UNIVERSAL DVB devices
+MEDIA DRIVERS FOR RENESAS - FCP
-M:      Sergey Kozlov <serjk@netup.ru>
+M:      Laurent Pinchart <laurent.pinchart@ideasonboard.com>
-M:      Abylay Ospan <aospan@netup.ru>
 L:      linux-media@vger.kernel.org
-W:      https://linuxtv.org
+L:      linux-renesas-soc@vger.kernel.org
-W:      http://netup.tv/
 T:      git git://linuxtv.org/media_tree.git
 S:      Supported
-F:      drivers/media/pci/netup_unidvb/*
+F:      Documentation/devicetree/bindings/media/renesas,fcp.txt
+F:      drivers/media/platform/rcar-fcp.c
+F:      include/media/rcar-fcp.h
+MEDIA DRIVERS FOR RENESAS - FDP1
+M:      Kieran Bingham <kieran@bingham.xyz>
+L:      linux-media@vger.kernel.org
+L:      linux-renesas-soc@vger.kernel.org
+T:      git git://linuxtv.org/media_tree.git
+S:      Supported
+F:      Documentation/devicetree/bindings/media/renesas,fdp1.txt
+F:      drivers/media/platform/rcar_fdp1.c
+MEDIA DRIVERS FOR RENESAS - VIN
+M:      Niklas Söderlund <niklas.soderlund@ragnatech.se>
+L:      linux-media@vger.kernel.org
+L:      linux-renesas-soc@vger.kernel.org
+T:      git git://linuxtv.org/media_tree.git
+S:      Supported
+F:      Documentation/devicetree/bindings/media/rcar_vin.txt
+F:      drivers/media/platform/rcar-vin/
+MEDIA DRIVERS FOR RENESAS - VSP1
+M:      Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+L:      linux-media@vger.kernel.org
+L:      linux-renesas-soc@vger.kernel.org
+T:      git git://linuxtv.org/media_tree.git
+S:      Supported
+F:      Documentation/devicetree/bindings/media/renesas,vsp1.txt
+F:      drivers/media/platform/vsp1/
 MEDIA INPUT INFRASTRUCTURE (V4L/DVB)
 M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
@@ -8449,15 +8434,6 @@ S:	Supported
 F:      drivers/media/platform/mtk-jpeg/
 F:      Documentation/devicetree/bindings/media/mediatek-jpeg-decoder.txt
-MEDIATEK MEDIA DRIVER
-M:      Tiffany Lin <tiffany.lin@mediatek.com>
-M:      Andrew-CT Chen <andrew-ct.chen@mediatek.com>
-S:      Supported
-F:      drivers/media/platform/mtk-vcodec/
-F:      drivers/media/platform/mtk-vpu/
-F:      Documentation/devicetree/bindings/media/mediatek-vcodec.txt
-F:      Documentation/devicetree/bindings/media/mediatek-vpu.txt
 MEDIATEK MDP DRIVER
 M:      Minghsiu Tsai <minghsiu.tsai@mediatek.com>
 M:      Houlong Wei <houlong.wei@mediatek.com>
@@ -8467,6 +8443,15 @@ F:	drivers/media/platform/mtk-mdp/
 F:      drivers/media/platform/mtk-vpu/
 F:      Documentation/devicetree/bindings/media/mediatek-mdp.txt
+MEDIATEK MEDIA DRIVER
+M:      Tiffany Lin <tiffany.lin@mediatek.com>
+M:      Andrew-CT Chen <andrew-ct.chen@mediatek.com>
+S:      Supported
+F:      drivers/media/platform/mtk-vcodec/
+F:      drivers/media/platform/mtk-vpu/
+F:      Documentation/devicetree/bindings/media/mediatek-vcodec.txt
+F:      Documentation/devicetree/bindings/media/mediatek-vpu.txt
 MEDIATEK MT7601U WIRELESS LAN DRIVER
 M:      Jakub Kicinski <kubakici@wp.pl>
 L:      linux-wireless@vger.kernel.org
@@ -8474,9 +8459,9 @@ S:	Maintained
 F:      drivers/net/wireless/mediatek/mt7601u/
 MEDIATEK RANDOM NUMBER GENERATOR SUPPORT
-M:      Sean Wang <sean.wang@mediatek.com>
+M:      Sean Wang <sean.wang@mediatek.com>
-S:      Maintained
+S:      Maintained
-F:      drivers/char/hw_random/mtk-rng.c
+F:      drivers/char/hw_random/mtk-rng.c
 MEGACHIPS STDPXXXX-GE-B850V3-FW LVDS/DP++ BRIDGES
 M:      Peter Senna Tschudin <peter.senna@collabora.com>
@@ -8498,6 +8483,13 @@ F:	Documentation/scsi/megaraid.txt
 F:      drivers/scsi/megaraid.*
 F:      drivers/scsi/megaraid/
+MELEXIS MLX90614 DRIVER
+M:      Crt Mori <cmo@melexis.com>
+L:      linux-iio@vger.kernel.org
+W:      http://www.melexis.com
+S:      Supported
+F:      drivers/iio/temperature/mlx90614.c
 MELFAS MIP4 TOUCHSCREEN DRIVER
 M:      Sangwon Jee <jeesw@melfas.com>
 W:      http://www.melfas.com
@@ -8558,6 +8550,56 @@ W:	http://www.mellanox.com
 Q:      http://patchwork.ozlabs.org/project/netdev/list/
 F:      drivers/net/ethernet/mellanox/mlxfw/
+MELLANOX MLX CPLD HOTPLUG DRIVER
+M:      Vadim Pasternak <vadimp@mellanox.com>
+L:      platform-driver-x86@vger.kernel.org
+S:      Supported
+F:      drivers/platform/x86/mlxcpld-hotplug.c
+F:      include/linux/platform_data/mlxcpld-hotplug.h
+MELLANOX MLX4 core VPI driver
+M:      Tariq Toukan <tariqt@mellanox.com>
+L:      netdev@vger.kernel.org
+L:      linux-rdma@vger.kernel.org
+W:      http://www.mellanox.com
+Q:      http://patchwork.ozlabs.org/project/netdev/list/
+S:      Supported
+F:      drivers/net/ethernet/mellanox/mlx4/
+F:      include/linux/mlx4/
+MELLANOX MLX4 IB driver
+M:      Yishai Hadas <yishaih@mellanox.com>
+L:      linux-rdma@vger.kernel.org
+W:      http://www.mellanox.com
+Q:      http://patchwork.kernel.org/project/linux-rdma/list/
+S:      Supported
+F:      drivers/infiniband/hw/mlx4/
+F:      include/linux/mlx4/
+F:      include/uapi/rdma/mlx4-abi.h
+MELLANOX MLX5 core VPI driver
+M:      Saeed Mahameed <saeedm@mellanox.com>
+M:      Matan Barak <matanb@mellanox.com>
+M:      Leon Romanovsky <leonro@mellanox.com>
+L:      netdev@vger.kernel.org
+L:      linux-rdma@vger.kernel.org
+W:      http://www.mellanox.com
+Q:      http://patchwork.ozlabs.org/project/netdev/list/
+S:      Supported
+F:      drivers/net/ethernet/mellanox/mlx5/core/
+F:      include/linux/mlx5/
+MELLANOX MLX5 IB driver
+M:      Matan Barak <matanb@mellanox.com>
+M:      Leon Romanovsky <leonro@mellanox.com>
+L:      linux-rdma@vger.kernel.org
+W:      http://www.mellanox.com
+Q:      http://patchwork.kernel.org/project/linux-rdma/list/
+S:      Supported
+F:      drivers/infiniband/hw/mlx5/
+F:      include/linux/mlx5/
+F:      include/uapi/rdma/mlx5-abi.h
 MELLANOX MLXCPLD I2C AND MUX DRIVER
 M:      Vadim Pasternak <vadimp@mellanox.com>
 M:      Michael Shych <michaelsh@mellanox.com>
@@ -8575,26 +8617,10 @@ F:	drivers/leds/leds-mlxcpld.c
 F:      Documentation/leds/leds-mlxcpld.txt
 MELLANOX PLATFORM DRIVER
-M:      Vadim Pasternak <vadimp@mellanox.com>
-L:      platform-driver-x86@vger.kernel.org
-S:      Supported
-F:      drivers/platform/x86/mlx-platform.c
-MELLANOX MLX CPLD HOTPLUG DRIVER
 M:      Vadim Pasternak <vadimp@mellanox.com>
 L:      platform-driver-x86@vger.kernel.org
 S:      Supported
-F:      drivers/platform/x86/mlxcpld-hotplug.c
+F:      drivers/platform/x86/mlx-platform.c
-F:      include/linux/platform_data/mlxcpld-hotplug.h
-SOFT-ROCE DRIVER (rxe)
-M:      Moni Shoua <monis@mellanox.com>
-L:      linux-rdma@vger.kernel.org
-S:      Supported
-W:      https://github.com/SoftRoCE/rxe-dev/wiki/rxe-dev:-Home
-Q:      http://patchwork.kernel.org/project/linux-rdma/list/
-F:      drivers/infiniband/sw/rxe/
-F:      include/uapi/rdma/rdma_user_rxe.h
 MEMBARRIER SUPPORT
 M:      Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
@@ -8716,6 +8742,18 @@ S:	Maintained
 F:      drivers/usb/misc/usb251xb.c
 F:      Documentation/devicetree/bindings/usb/usb251xb.txt
+MICROSEMI SMART ARRAY SMARTPQI DRIVER (smartpqi)
+M:      Don Brace <don.brace@microsemi.com>
+L:      esc.storagedev@microsemi.com
+L:      linux-scsi@vger.kernel.org
+S:      Supported
+F:      drivers/scsi/smartpqi/smartpqi*.[ch]
+F:      drivers/scsi/smartpqi/Kconfig
+F:      drivers/scsi/smartpqi/Makefile
+F:      include/linux/cciss*.h
+F:      include/uapi/linux/cciss*.h
+F:      Documentation/scsi/smartpqi.txt
 MICROSOFT SURFACE PRO 3 BUTTON DRIVER
 M:      Chen Yu <yu.c.chen@intel.com>
 L:      platform-driver-x86@vger.kernel.org
@@ -8738,6 +8776,16 @@ F:	Documentation/devicetree/bindings/mips/
 F:      Documentation/mips/
 F:      arch/mips/
+MIPS BOSTON DEVELOPMENT BOARD
+M:      Paul Burton <paul.burton@imgtec.com>
+L:      linux-mips@linux-mips.org
+S:      Maintained
+F:      Documentation/devicetree/bindings/clock/img,boston-clock.txt
+F:      arch/mips/boot/dts/img/boston.dts
+F:      arch/mips/configs/generic/board-boston.config
+F:      drivers/clk/imgtec/clk-boston.c
+F:      include/dt-bindings/clock/boston-clock.h
 MIPS GENERIC PLATFORM
 M:      Paul Burton <paul.burton@imgtec.com>
 L:      linux-mips@linux-mips.org
@@ -8753,16 +8801,6 @@ F:	arch/mips/include/asm/mach-loongson32/
 F:      drivers/*/*loongson1*
 F:      drivers/*/*/*loongson1*
-MIPS BOSTON DEVELOPMENT BOARD
-M:      Paul Burton <paul.burton@imgtec.com>
-L:      linux-mips@linux-mips.org
-S:      Maintained
-F:      Documentation/devicetree/bindings/clock/img,boston-clock.txt
-F:      arch/mips/boot/dts/img/boston.dts
-F:      arch/mips/configs/generic/board-boston.config
-F:      drivers/clk/imgtec/clk-boston.c
-F:      include/dt-bindings/clock/boston-clock.h
 MIROSOUND PCM20 FM RADIO RECEIVER DRIVER
 M:      Hans Verkuil <hverkuil@xs4all.nl>
 L:      linux-media@vger.kernel.org
@@ -8771,67 +8809,15 @@ W:	https://linuxtv.org
 S:      Odd Fixes
 F:      drivers/media/radio/radio-miropcm20*
-MELLANOX MLX4 core VPI driver
+MMP SUPPORT
-M:      Tariq Toukan <tariqt@mellanox.com>
+M:      Eric Miao <eric.y.miao@gmail.com>
-L:      netdev@vger.kernel.org
+M:      Haojian Zhuang <haojian.zhuang@gmail.com>
-L:      linux-rdma@vger.kernel.org
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
-W:      http://www.mellanox.com
+T:      git git://github.com/hzhuang1/linux.git
-Q:      http://patchwork.ozlabs.org/project/netdev/list/
+T:      git git://git.linaro.org/people/ycmiao/pxa-linux.git
-S:      Supported
+S:      Maintained
-F:      drivers/net/ethernet/mellanox/mlx4/
+F:      arch/arm/boot/dts/mmp*
-F:      include/linux/mlx4/
+F:      arch/arm/mach-mmp/
-MELLANOX MLX4 IB driver
-M:      Yishai Hadas <yishaih@mellanox.com>
-L:      linux-rdma@vger.kernel.org
-W:      http://www.mellanox.com
-Q:      http://patchwork.kernel.org/project/linux-rdma/list/
-S:      Supported
-F:      drivers/infiniband/hw/mlx4/
-F:      include/linux/mlx4/
-F:      include/uapi/rdma/mlx4-abi.h
-MELLANOX MLX5 core VPI driver
-M:      Saeed Mahameed <saeedm@mellanox.com>
-M:      Matan Barak <matanb@mellanox.com>
-M:      Leon Romanovsky <leonro@mellanox.com>
-L:      netdev@vger.kernel.org
-L:      linux-rdma@vger.kernel.org
-W:      http://www.mellanox.com
-Q:      http://patchwork.ozlabs.org/project/netdev/list/
-S:      Supported
-F:      drivers/net/ethernet/mellanox/mlx5/core/
-F:      include/linux/mlx5/
-MELLANOX MLX5 IB driver
-M:      Matan Barak <matanb@mellanox.com>
-M:      Leon Romanovsky <leonro@mellanox.com>
-L:      linux-rdma@vger.kernel.org
-W:      http://www.mellanox.com
-Q:      http://patchwork.kernel.org/project/linux-rdma/list/
-S:      Supported
-F:      drivers/infiniband/hw/mlx5/
-F:      include/linux/mlx5/
-F:      include/uapi/rdma/mlx5-abi.h
-MELEXIS MLX90614 DRIVER
-M:      Crt Mori <cmo@melexis.com>
-L:      linux-iio@vger.kernel.org
-W:      http://www.melexis.com
-S:      Supported
-F:      drivers/iio/temperature/mlx90614.c
-MICROSEMI SMART ARRAY SMARTPQI DRIVER (smartpqi)
-M:      Don Brace <don.brace@microsemi.com>
-L:      esc.storagedev@microsemi.com
-L:      linux-scsi@vger.kernel.org
-S:      Supported
-F:      drivers/scsi/smartpqi/smartpqi*.[ch]
-F:      drivers/scsi/smartpqi/Kconfig
-F:      drivers/scsi/smartpqi/Makefile
-F:      include/linux/cciss*.h
-F:      include/uapi/linux/cciss*.h
-F:      Documentation/scsi/smartpqi.txt
 MN88472 MEDIA DRIVER
 M:      Antti Palosaari <crope@iki.fi>
@@ -8965,6 +8951,11 @@ F:	drivers/mfd/
 F:      include/linux/mfd/
 F:      include/dt-bindings/mfd/
+MULTIMEDIA CARD (MMC) ETC. OVER SPI
+S:      Orphan
+F:      drivers/mmc/host/mmc_spi.c
+F:      include/linux/spi/mmc_spi.h
 MULTIMEDIA CARD (MMC), SECURE DIGITAL (SD) AND SDIO SUBSYSTEM
 M:      Ulf Hansson <ulf.hansson@linaro.org>
 L:      linux-mmc@vger.kernel.org
@@ -8975,11 +8966,6 @@ F:	drivers/mmc/
 F:      include/linux/mmc/
 F:      include/uapi/linux/mmc/
-MULTIMEDIA CARD (MMC) ETC. OVER SPI
-S:      Orphan
-F:      drivers/mmc/host/mmc_spi.c
-F:      include/linux/spi/mmc_spi.h
 MULTIPLEXER SUBSYSTEM
 M:      Peter Rosin <peda@axentia.se>
 S:      Maintained
@@ -9042,10 +9028,6 @@ S:	Maintained
 F:      drivers/mtd/nand/
 F:      include/linux/mtd/nand*.h
-NATSEMI ETHERNET DRIVER (DP8381x)
-S:      Orphan
-F:      drivers/net/ethernet/natsemi/natsemi.c
 NATIVE INSTRUMENTS USB SOUND INTERFACE DRIVER
 M:      Daniel Mack <zonque@gmail.com>
 S:      Maintained
@@ -9053,6 +9035,10 @@ L:	alsa-devel@alsa-project.org (moderated for non-subscribers)
 W:      http://www.native-instruments.com
 F:      sound/usb/caiaq/
+NATSEMI ETHERNET DRIVER (DP8381x)
+S:      Orphan
+F:      drivers/net/ethernet/natsemi/natsemi.c
 NCP FILESYSTEM
 M:      Petr Vandrovec <petr@vandrovec.name>
 S:      Odd Fixes
@@ -9172,6 +9158,35 @@ S:	Maintained
 W:      https://fedorahosted.org/dropwatch/
 F:      net/core/drop_monitor.c
+NETWORKING DRIVERS
+L:      netdev@vger.kernel.org
+W:      http://www.linuxfoundation.org/en/Net
+Q:      http://patchwork.ozlabs.org/project/netdev/list/
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
+S:      Odd Fixes
+F:      Documentation/devicetree/bindings/net/
+F:      drivers/net/
+F:      include/linux/if_*
+F:      include/linux/netdevice.h
+F:      include/linux/etherdevice.h
+F:      include/linux/fcdevice.h
+F:      include/linux/fddidevice.h
+F:      include/linux/hippidevice.h
+F:      include/linux/inetdevice.h
+F:      include/uapi/linux/if_*
+F:      include/uapi/linux/netdevice.h
+NETWORKING DRIVERS (WIRELESS)
+M:      Kalle Valo <kvalo@codeaurora.org>
+L:      linux-wireless@vger.kernel.org
+Q:      http://patchwork.kernel.org/project/linux-wireless/list/
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next.git
+S:      Maintained
+F:      Documentation/devicetree/bindings/net/wireless/
+F:      drivers/net/wireless/
 NETWORKING [DSA]
 M:      Andrew Lunn <andrew@lunn.ch>
 M:      Vivien Didelot <vivien.didelot@savoirfairelinux.com>
@@ -9203,28 +9218,6 @@ F:	tools/net/
 F:      tools/testing/selftests/net/
 F:      lib/random32.c
-NETWORKING [IPv4/IPv6]
-M:      "David S. Miller" <davem@davemloft.net>
-M:      Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
-M:      Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>
-L:      netdev@vger.kernel.org
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git
-S:      Maintained
-F:      net/ipv4/
-F:      net/ipv6/
-F:      include/net/ip*
-F:      arch/x86/net/*
-NETWORKING [TLS]
-M:      Ilya Lesokhin <ilyal@mellanox.com>
-M:      Aviad Yehezkel <aviadye@mellanox.com>
-M:      Dave Watson <davejwatson@fb.com>
-L:      netdev@vger.kernel.org
-S:      Maintained
-F:      net/tls/*
-F:      include/uapi/linux/tls.h
-F:      include/net/tls.h
 NETWORKING [IPSEC]
 M:      Steffen Klassert <steffen.klassert@secunet.com>
 M:      Herbert Xu <herbert@gondor.apana.org.au>
@@ -9249,43 +9242,36 @@ F:	net/ipv6/ip6_vti.c
 F:      include/uapi/linux/xfrm.h
 F:      include/net/xfrm.h
+NETWORKING [IPv4/IPv6]
+M:      "David S. Miller" <davem@davemloft.net>
+M:      Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
+M:      Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>
+L:      netdev@vger.kernel.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git
+S:      Maintained
+F:      net/ipv4/
+F:      net/ipv6/
+F:      include/net/ip*
+F:      arch/x86/net/*
 NETWORKING [LABELED] (NetLabel, CIPSO, Labeled IPsec, SECMARK)
 M:      Paul Moore <paul@paul-moore.com>
 L:      netdev@vger.kernel.org
 S:      Maintained
-NETWORKING [WIRELESS]
+NETWORKING [TLS]
-L:      linux-wireless@vger.kernel.org
+M:      Ilya Lesokhin <ilyal@mellanox.com>
-Q:      http://patchwork.kernel.org/project/linux-wireless/list/
+M:      Aviad Yehezkel <aviadye@mellanox.com>
+M:      Dave Watson <davejwatson@fb.com>
-NETWORKING DRIVERS
 L:      netdev@vger.kernel.org
-W:      http://www.linuxfoundation.org/en/Net
+S:      Maintained
-Q:      http://patchwork.ozlabs.org/project/netdev/list/
+F:      net/tls/*
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git
+F:      include/uapi/linux/tls.h
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
+F:      include/net/tls.h
-S:      Odd Fixes
-F:      Documentation/devicetree/bindings/net/
-F:      drivers/net/
-F:      include/linux/if_*
-F:      include/linux/netdevice.h
-F:      include/linux/etherdevice.h
-F:      include/linux/fcdevice.h
-F:      include/linux/fddidevice.h
-F:      include/linux/hippidevice.h
-F:      include/linux/inetdevice.h
-F:      include/uapi/linux/if_*
-F:      include/uapi/linux/netdevice.h
-NETWORKING DRIVERS (WIRELESS)
+NETWORKING [WIRELESS]
-M:      Kalle Valo <kvalo@codeaurora.org>
 L:      linux-wireless@vger.kernel.org
 Q:      http://patchwork.kernel.org/project/linux-wireless/list/
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers.git
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next.git
-S:      Maintained
-F:      Documentation/devicetree/bindings/net/wireless/
-F:      drivers/net/wireless/
 NETXEN (1/10) GbE SUPPORT
 M:      Manish Chopra <manish.chopra@cavium.com>
@@ -9379,14 +9365,6 @@ S:	Maintained
 F:      drivers/media/i2c/et8ek8
 F:      drivers/media/i2c/ad5820.c
-NOKIA N900 CAMERA SUPPORT (ET8EK8 SENSOR, AD5820 FOCUS)
-M:      Pavel Machek <pavel@ucw.cz>
-M:      Sakari Ailus <sakari.ailus@iki.fi>
-L:      linux-media@vger.kernel.org
-S:      Maintained
-F:      drivers/media/i2c/et8ek8
-F:      drivers/media/i2c/ad5820.c
 NOKIA N900 POWER SUPPLY DRIVERS
 R:      Pali Rohár <pali.rohar@gmail.com>
 F:      include/linux/power/bq2415x_charger.h
@@ -9398,6 +9376,12 @@ F:	drivers/power/supply/bq27xxx_battery_i2c.c
 F:      drivers/power/supply/isp1704_charger.c
 F:      drivers/power/supply/rx51_battery.c
+NTB AMD DRIVER
+M:      Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+L:      linux-ntb@googlegroups.com
+S:      Supported
+F:      drivers/ntb/hw/amd/
 NTB DRIVER CORE
 M:      Jon Mason <jdmason@kudzu.us>
 M:      Dave Jiang <dave.jiang@intel.com>
@@ -9427,12 +9411,6 @@ W:	https://github.com/jonmason/ntb/wiki
 T:      git git://github.com/jonmason/ntb.git
 F:      drivers/ntb/hw/intel/
-NTB AMD DRIVER
-M:      Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
-L:      linux-ntb@googlegroups.com
-S:      Supported
-F:      drivers/ntb/hw/amd/
 NTFS FILESYSTEM
 M:      Anton Altaparmakov <anton@tuxera.com>
 L:      linux-ntfs-dev@lists.sourceforge.net
@@ -9462,15 +9440,6 @@ F:	drivers/nvme/host/
 F:      include/linux/nvme.h
 F:      include/uapi/linux/nvme_ioctl.h
-NVM EXPRESS TARGET DRIVER
-M:      Christoph Hellwig <hch@lst.de>
-M:      Sagi Grimberg <sagi@grimberg.me>
-L:      linux-nvme@lists.infradead.org
-T:      git://git.infradead.org/nvme.git
-W:      http://git.infradead.org/nvme.git
-S:      Supported
-F:      drivers/nvme/target/
 NVM EXPRESS FC TRANSPORT DRIVERS
 M:      James Smart <james.smart@broadcom.com>
 L:      linux-nvme@lists.infradead.org
@@ -9481,6 +9450,15 @@ F:	drivers/nvme/host/fc.c
 F:      drivers/nvme/target/fc.c
 F:      drivers/nvme/target/fcloop.c
+NVM EXPRESS TARGET DRIVER
+M:      Christoph Hellwig <hch@lst.de>
+M:      Sagi Grimberg <sagi@grimberg.me>
+L:      linux-nvme@lists.infradead.org
+T:      git://git.infradead.org/nvme.git
+W:      http://git.infradead.org/nvme.git
+S:      Supported
+F:      drivers/nvme/target/
 NVMEM FRAMEWORK
 M:      Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
 S:      Maintained
@@ -9489,13 +9467,6 @@ F:	Documentation/devicetree/bindings/nvmem/
 F:      include/linux/nvmem-consumer.h
 F:      include/linux/nvmem-provider.h
-NXP-NCI NFC DRIVER
-M:      Clément Perrochaud <clement.perrochaud@effinnov.com>
-R:      Charles Gorand <charles.gorand@effinnov.com>
-L:      linux-nfc@lists.01.org (moderated for non-subscribers)
-S:      Supported
-F:      drivers/nfc/nxp-nci
 NXP TDA998X DRM DRIVER
 M:      Russell King <linux@armlinux.org.uk>
 S:      Supported
@@ -9510,55 +9481,31 @@ L:	alsa-devel@alsa-project.org (moderated for non-subscribers)
 S:      Maintained
 F:      sound/soc/codecs/tfa9879*
+NXP-NCI NFC DRIVER
+M:      Clément Perrochaud <clement.perrochaud@effinnov.com>
+R:      Charles Gorand <charles.gorand@effinnov.com>
+L:      linux-nfc@lists.01.org (moderated for non-subscribers)
+S:      Supported
+F:      drivers/nfc/nxp-nci
 OBJTOOL
 M:      Josh Poimboeuf <jpoimboe@redhat.com>
 S:      Supported
 F:      tools/objtool/
-OMAP1 SUPPORT
+OMAP AUDIO SUPPORT
-M:      Aaro Koskinen <aaro.koskinen@iki.fi>
+M:      Peter Ujfalusi <peter.ujfalusi@ti.com>
-M:      Tony Lindgren <tony@atomide.com>
+M:      Jarkko Nikula <jarkko.nikula@bitmer.com>
+L:      alsa-devel@alsa-project.org (moderated for non-subscribers)
 L:      linux-omap@vger.kernel.org
-Q:      http://patchwork.kernel.org/project/linux-omap/list/
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap.git
 S:      Maintained
-F:      arch/arm/mach-omap1/
+F:      sound/soc/omap/
-F:      arch/arm/plat-omap/
-F:      arch/arm/configs/omap1_defconfig
-F:      drivers/i2c/busses/i2c-omap.c
-F:      include/linux/i2c-omap.h
-OMAP2+ SUPPORT
+OMAP CLOCK FRAMEWORK SUPPORT
-M:      Tony Lindgren <tony@atomide.com>
+M:      Paul Walmsley <paul@pwsan.com>
 L:      linux-omap@vger.kernel.org
-W:      http://www.muru.com/linux/omap/
-W:      http://linux.omap.com/
-Q:      http://patchwork.kernel.org/project/linux-omap/list/
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap.git
 S:      Maintained
-F:      arch/arm/mach-omap2/
+F:      arch/arm/*omap*/*clock*
-F:      arch/arm/plat-omap/
-F:      arch/arm/configs/omap2plus_defconfig
-F:      drivers/i2c/busses/i2c-omap.c
-F:      drivers/irqchip/irq-omap-intc.c
-F:      drivers/mfd/*omap*.c
-F:      drivers/mfd/menelaus.c
-F:      drivers/mfd/palmas.c
-F:      drivers/mfd/tps65217.c
-F:      drivers/mfd/tps65218.c
-F:      drivers/mfd/tps65910.c
-F:      drivers/mfd/twl-core.[ch]
-F:      drivers/mfd/twl4030*.c
-F:      drivers/mfd/twl6030*.c
-F:      drivers/mfd/twl6040*.c
-F:      drivers/regulator/palmas-regulator*.c
-F:      drivers/regulator/pbias-regulator.c
-F:      drivers/regulator/tps65217-regulator.c
-F:      drivers/regulator/tps65218-regulator.c
-F:      drivers/regulator/tps65910-regulator.c
-F:      drivers/regulator/twl-regulator.c
-F:      drivers/regulator/twl6030-regulator.c
-F:      include/linux/i2c-omap.h
 OMAP DEVICE TREE SUPPORT
 M:      Benoît Cousson <bcousson@baylibre.com>
@@ -9572,33 +9519,20 @@ F:	arch/arm/boot/dts/*am4*
 F:      arch/arm/boot/dts/*am5*
 F:      arch/arm/boot/dts/*dra7*
-OMAP CLOCK FRAMEWORK SUPPORT
+OMAP DISPLAY SUBSYSTEM and FRAMEBUFFER SUPPORT (DSS2)
-M:      Paul Walmsley <paul@pwsan.com>
+M:      Tomi Valkeinen <tomi.valkeinen@ti.com>
-L:      linux-omap@vger.kernel.org
-S:      Maintained
-F:      arch/arm/*omap*/*clock*
-OMAP POWER MANAGEMENT SUPPORT
-M:      Kevin Hilman <khilman@kernel.org>
-L:      linux-omap@vger.kernel.org
-S:      Maintained
-F:      arch/arm/*omap*/*pm*
-F:      drivers/cpufreq/omap-cpufreq.c
-OMAP POWERDOMAIN SOC ADAPTATION LAYER SUPPORT
-M:      Rajendra Nayak <rnayak@codeaurora.org>
-M:      Paul Walmsley <paul@pwsan.com>
 L:      linux-omap@vger.kernel.org
+L:      linux-fbdev@vger.kernel.org
 S:      Maintained
-F:      arch/arm/mach-omap2/prm*
+F:      drivers/video/fbdev/omap2/
+F:      Documentation/arm/OMAP/DSS
-OMAP AUDIO SUPPORT
+OMAP FRAMEBUFFER SUPPORT
-M:      Peter Ujfalusi <peter.ujfalusi@ti.com>
+M:      Tomi Valkeinen <tomi.valkeinen@ti.com>
-M:      Jarkko Nikula <jarkko.nikula@bitmer.com>
+L:      linux-fbdev@vger.kernel.org
-L:      alsa-devel@alsa-project.org (moderated for non-subscribers)
 L:      linux-omap@vger.kernel.org
 S:      Maintained
-F:      sound/soc/omap/
+F:      drivers/video/fbdev/omap/
 OMAP GENERAL PURPOSE MEMORY CONTROLLER SUPPORT
 M:      Roger Quadros <rogerq@ti.com>
@@ -9608,20 +9542,14 @@ S:	Maintained
 F:      drivers/memory/omap-gpmc.c
 F:      arch/arm/mach-omap2/*gpmc*
-OMAP FRAMEBUFFER SUPPORT
+OMAP GPIO DRIVER
-M:      Tomi Valkeinen <tomi.valkeinen@ti.com>
+M:      Grygorii Strashko <grygorii.strashko@ti.com>
-L:      linux-fbdev@vger.kernel.org
+M:      Santosh Shilimkar <ssantosh@kernel.org>
-L:      linux-omap@vger.kernel.org
+M:      Kevin Hilman <khilman@kernel.org>
-S:      Maintained
-F:      drivers/video/fbdev/omap/
-OMAP DISPLAY SUBSYSTEM and FRAMEBUFFER SUPPORT (DSS2)
-M:      Tomi Valkeinen <tomi.valkeinen@ti.com>
 L:      linux-omap@vger.kernel.org
-L:      linux-fbdev@vger.kernel.org
 S:      Maintained
-F:      drivers/video/fbdev/omap2/
+F:      Documentation/devicetree/bindings/gpio/gpio-omap.txt
-F:      Documentation/arm/OMAP/DSS
+F:      drivers/gpio/gpio-omap.c
 OMAP HARDWARE SPINLOCK SUPPORT
 M:      Ohad Ben-Cohen <ohad@wizery.com>
@@ -9629,30 +9557,12 @@ L:	linux-omap@vger.kernel.org
 S:      Maintained
 F:      drivers/hwspinlock/omap_hwspinlock.c
-OMAP MMC SUPPORT
-M:      Jarkko Lavinen <jarkko.lavinen@nokia.com>
-L:      linux-omap@vger.kernel.org
-S:      Maintained
-F:      drivers/mmc/host/omap.c
 OMAP HS MMC SUPPORT
 L:      linux-mmc@vger.kernel.org
 L:      linux-omap@vger.kernel.org
 S:      Orphan
 F:      drivers/mmc/host/omap_hsmmc.c
-OMAP RANDOM NUMBER GENERATOR SUPPORT
-M:      Deepak Saxena <dsaxena@plexity.net>
-S:      Maintained
-F:      drivers/char/hw_random/omap-rng.c
-OMAP HWMOD SUPPORT
-M:      Benoît Cousson <bcousson@baylibre.com>
-M:      Paul Walmsley <paul@pwsan.com>
-L:      linux-omap@vger.kernel.org
-S:      Maintained
-F:      arch/arm/mach-omap2/omap_hwmod.*
 OMAP HWMOD DATA
 M:      Paul Walmsley <paul@pwsan.com>
 L:      linux-omap@vger.kernel.org
@@ -9665,6 +9575,13 @@ L:	linux-omap@vger.kernel.org
 S:      Maintained
 F:      arch/arm/mach-omap2/omap_hwmod_44xx_data.c
+OMAP HWMOD SUPPORT
+M:      Benoît Cousson <bcousson@baylibre.com>
+M:      Paul Walmsley <paul@pwsan.com>
+L:      linux-omap@vger.kernel.org
+S:      Maintained
+F:      arch/arm/mach-omap2/omap_hwmod.*
 OMAP IMAGING SUBSYSTEM (OMAP3 ISP and OMAP4 ISS)
 M:      Laurent Pinchart <laurent.pinchart@ideasonboard.com>
 L:      linux-media@vger.kernel.org
@@ -9673,6 +9590,31 @@ F:	Documentation/devicetree/bindings/media/ti,omap3isp.txt
 F:      drivers/media/platform/omap3isp/
 F:      drivers/staging/media/omap4iss/
+OMAP MMC SUPPORT
+M:      Jarkko Lavinen <jarkko.lavinen@nokia.com>
+L:      linux-omap@vger.kernel.org
+S:      Maintained
+F:      drivers/mmc/host/omap.c
+OMAP POWER MANAGEMENT SUPPORT
+M:      Kevin Hilman <khilman@kernel.org>
+L:      linux-omap@vger.kernel.org
+S:      Maintained
+F:      arch/arm/*omap*/*pm*
+F:      drivers/cpufreq/omap-cpufreq.c
+OMAP POWERDOMAIN SOC ADAPTATION LAYER SUPPORT
+M:      Rajendra Nayak <rnayak@codeaurora.org>
+M:      Paul Walmsley <paul@pwsan.com>
+L:      linux-omap@vger.kernel.org
+S:      Maintained
+F:      arch/arm/mach-omap2/prm*
+OMAP RANDOM NUMBER GENERATOR SUPPORT
+M:      Deepak Saxena <dsaxena@plexity.net>
+S:      Maintained
+F:      drivers/char/hw_random/omap-rng.c
 OMAP USB SUPPORT
 L:      linux-usb@vger.kernel.org
 L:      linux-omap@vger.kernel.org
@@ -9680,21 +9622,57 @@ S:	Orphan
 F:      drivers/usb/*/*omap*
 F:      arch/arm/*omap*/usb*
-OMAP GPIO DRIVER
-M:      Grygorii Strashko <grygorii.strashko@ti.com>
-M:      Santosh Shilimkar <ssantosh@kernel.org>
-M:      Kevin Hilman <khilman@kernel.org>
-L:      linux-omap@vger.kernel.org
-S:      Maintained
-F:      Documentation/devicetree/bindings/gpio/gpio-omap.txt
-F:      drivers/gpio/gpio-omap.c
 OMAP/NEWFLOW NANOBONE MACHINE SUPPORT
 M:      Mark Jackson <mpfj@newflow.co.uk>
 L:      linux-omap@vger.kernel.org
 S:      Maintained
 F:      arch/arm/boot/dts/am335x-nano.dts
+OMAP1 SUPPORT
+M:      Aaro Koskinen <aaro.koskinen@iki.fi>
+M:      Tony Lindgren <tony@atomide.com>
+L:      linux-omap@vger.kernel.org
+Q:      http://patchwork.kernel.org/project/linux-omap/list/
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap.git
+S:      Maintained
+F:      arch/arm/mach-omap1/
+F:      arch/arm/plat-omap/
+F:      arch/arm/configs/omap1_defconfig
+F:      drivers/i2c/busses/i2c-omap.c
+F:      include/linux/i2c-omap.h
+OMAP2+ SUPPORT
+M:      Tony Lindgren <tony@atomide.com>
+L:      linux-omap@vger.kernel.org
+W:      http://www.muru.com/linux/omap/
+W:      http://linux.omap.com/
+Q:      http://patchwork.kernel.org/project/linux-omap/list/
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap.git
+S:      Maintained
+F:      arch/arm/mach-omap2/
+F:      arch/arm/plat-omap/
+F:      arch/arm/configs/omap2plus_defconfig
+F:      drivers/i2c/busses/i2c-omap.c
+F:      drivers/irqchip/irq-omap-intc.c
+F:      drivers/mfd/*omap*.c
+F:      drivers/mfd/menelaus.c
+F:      drivers/mfd/palmas.c
+F:      drivers/mfd/tps65217.c
+F:      drivers/mfd/tps65218.c
+F:      drivers/mfd/tps65910.c
+F:      drivers/mfd/twl-core.[ch]
+F:      drivers/mfd/twl4030*.c
+F:      drivers/mfd/twl6030*.c
+F:      drivers/mfd/twl6040*.c
+F:      drivers/regulator/palmas-regulator*.c
+F:      drivers/regulator/pbias-regulator.c
+F:      drivers/regulator/tps65217-regulator.c
+F:      drivers/regulator/tps65218-regulator.c
+F:      drivers/regulator/tps65910-regulator.c
+F:      drivers/regulator/twl-regulator.c
+F:      drivers/regulator/twl6030-regulator.c
+F:      include/linux/i2c-omap.h
 OMFS FILESYSTEM
 M:      Bob Copeland <me@bobcopeland.com>
 L:      linux-karma-devel@lists.sourceforge.net
@@ -9714,6 +9692,13 @@ M:	Harald Welte <laforge@gnumonks.org>
 S:      Maintained
 F:      drivers/char/pcmcia/cm4040_cs.*
+OMNIVISION OV13858 SENSOR DRIVER
+M:      Sakari Ailus <sakari.ailus@linux.intel.com>
+L:      linux-media@vger.kernel.org
+T:      git git://linuxtv.org/media_tree.git
+S:      Maintained
+F:      drivers/media/i2c/ov13858.c
 OMNIVISION OV5640 SENSOR DRIVER
 M:      Steve Longerbeam <slongerbeam@gmail.com>
 L:      linux-media@vger.kernel.org
@@ -9736,13 +9721,6 @@ S:	Maintained
 F:      drivers/media/i2c/ov7670.c
 F:      Documentation/devicetree/bindings/media/i2c/ov7670.txt
-OMNIVISION OV13858 SENSOR DRIVER
-M:      Sakari Ailus <sakari.ailus@linux.intel.com>
-L:      linux-media@vger.kernel.org
-T:      git git://linuxtv.org/media_tree.git
-S:      Maintained
-F:      drivers/media/i2c/ov13858.c
 ONENAND FLASH DRIVER
 M:      Kyungmin Park <kyungmin.park@samsung.com>
 L:      linux-mtd@lists.infradead.org
@@ -9760,12 +9738,26 @@ F:	drivers/scsi/osst.*
 F:      drivers/scsi/osst_*.h
 F:      drivers/scsi/st.h
-OPENCORES I2C BUS DRIVER
+OP-TEE DRIVER
-M:      Peter Korsgaard <jacmet@sunsite.dk>
+M:      Jens Wiklander <jens.wiklander@linaro.org>
-L:      linux-i2c@vger.kernel.org
 S:      Maintained
-F:      Documentation/i2c/busses/i2c-ocores
+F:      drivers/tee/optee/
-F:      drivers/i2c/busses/i2c-ocores.c
+OPA-VNIC DRIVER
+M:      Dennis Dalessandro <dennis.dalessandro@intel.com>
+M:      Niranjana Vishwanathapura <niranjana.vishwanathapura@intel.com>
+L:      linux-rdma@vger.kernel.org
+S:      Supported
+F:      drivers/infiniband/ulp/opa_vnic
+OPEN FIRMWARE AND DEVICE TREE OVERLAYS
+M:      Pantelis Antoniou <pantelis.antoniou@konsulko.com>
+L:      devicetree@vger.kernel.org
+S:      Maintained
+F:      Documentation/devicetree/dynamic-resolution-notes.txt
+F:      Documentation/devicetree/overlay-notes.txt
+F:      drivers/of/overlay.c
+F:      drivers/of/resolver.c
 OPEN FIRMWARE AND FLATTENED DEVICE TREE
 M:      Rob Herring <robh+dt@kernel.org>
@@ -9790,14 +9782,12 @@ F:	Documentation/devicetree/
 F:      arch/*/boot/dts/
 F:      include/dt-bindings/
-OPEN FIRMWARE AND DEVICE TREE OVERLAYS
+OPENCORES I2C BUS DRIVER
-M:      Pantelis Antoniou <pantelis.antoniou@konsulko.com>
+M:      Peter Korsgaard <jacmet@sunsite.dk>
-L:      devicetree@vger.kernel.org
+L:      linux-i2c@vger.kernel.org
 S:      Maintained
-F:      Documentation/devicetree/dynamic-resolution-notes.txt
+F:      Documentation/i2c/busses/i2c-ocores
-F:      Documentation/devicetree/overlay-notes.txt
+F:      drivers/i2c/busses/i2c-ocores.c
-F:      drivers/of/overlay.c
-F:      drivers/of/resolver.c
 OPENRISC ARCHITECTURE
 M:      Jonas Bonn <jonas@southpole.se>
@@ -9846,11 +9836,6 @@ F:	arch/*/oprofile/
 F:      drivers/oprofile/
 F:      include/linux/oprofile.h
-OP-TEE DRIVER
-M:      Jens Wiklander <jens.wiklander@linaro.org>
-S:      Maintained
-F:      drivers/tee/optee/
 ORACLE CLUSTER FILESYSTEM 2 (OCFS2)
 M:      Mark Fasheh <mfasheh@versity.com>
 M:      Joel Becker <jlbec@evilplan.org>
@@ -9861,6 +9846,14 @@ F:	Documentation/filesystems/ocfs2.txt
 F:      Documentation/filesystems/dlmfs.txt
 F:      fs/ocfs2/
+ORANGEFS FILESYSTEM
+M:      Mike Marshall <hubcap@omnibond.com>
+L:      pvfs2-developers@beowulf-underground.org (subscribers-only)
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux.git
+S:      Supported
+F:      fs/orangefs/
+F:      Documentation/filesystems/orangefs.txt
 ORINOCO DRIVER
 L:      linux-wireless@vger.kernel.org
 W:      http://wireless.kernel.org/en/users/Drivers/orinoco
@@ -9875,6 +9868,16 @@ F:	drivers/scsi/osd/
 F:      include/scsi/osd_*
 F:      fs/exofs/
+OV2659 OMNIVISION SENSOR DRIVER
+M:      "Lad, Prabhakar" <prabhakar.csengg@gmail.com>
+L:      linux-media@vger.kernel.org
+W:      https://linuxtv.org
+Q:      http://patchwork.linuxtv.org/project/linux-media/list/
+T:      git git://linuxtv.org/mhadli/v4l-dvb-davinci_devices.git
+S:      Maintained
+F:      drivers/media/i2c/ov2659.c
+F:      include/media/i2c/ov2659.h
 OVERLAY FILESYSTEM
 M:      Miklos Szeredi <miklos@szeredi.hu>
 L:      linux-unionfs@vger.kernel.org
@@ -9883,14 +9886,6 @@ S:	Supported
 F:      fs/overlayfs/
 F:      Documentation/filesystems/overlayfs.txt
-ORANGEFS FILESYSTEM
-M:      Mike Marshall <hubcap@omnibond.com>
-L:      pvfs2-developers@beowulf-underground.org (subscribers-only)
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux.git
-S:      Supported
-F:      fs/orangefs/
-F:      Documentation/filesystems/orangefs.txt
 P54 WIRELESS DRIVER
 M:      Christian Lamparter <chunkeey@googlemail.com>
 L:      linux-wireless@vger.kernel.org
@@ -9931,11 +9926,11 @@ F:	Documentation/mn10300/
 F:      arch/mn10300/
 PARALLEL LCD/KEYPAD PANEL DRIVER
-M:      Willy Tarreau <willy@haproxy.com>
+M:      Willy Tarreau <willy@haproxy.com>
-M:      Ksenija Stanojevic <ksenija.stanojevic@gmail.com>
+M:      Ksenija Stanojevic <ksenija.stanojevic@gmail.com>
-S:      Odd Fixes
+S:      Odd Fixes
-F:      Documentation/misc-devices/lcd-panel-cgram.txt
+F:      Documentation/misc-devices/lcd-panel-cgram.txt
-F:      drivers/misc/panel.c
+F:      drivers/misc/panel.c
 PARALLEL PORT SUBSYSTEM
 M:      Sudip Mukherjee <sudipm.mukherjee@gmail.com>
@@ -10031,42 +10026,13 @@ M:	Khalid Aziz <khalid@gonehiking.org>
 S:      Maintained
 F:      drivers/firmware/pcdp.*
-PCI ERROR RECOVERY
+PCI DRIVER FOR AARDVARK (Marvell Armada 3700)
-M:      Linas Vepstas <linasvepstas@gmail.com>
+M:      Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
-L:      linux-pci@vger.kernel.org
-S:      Supported
-F:      Documentation/PCI/pci-error-recovery.txt
-PCI ENHANCED ERROR HANDLING (EEH) FOR POWERPC
-M:      Russell Currey <ruscur@russell.cc>
-L:      linuxppc-dev@lists.ozlabs.org
-S:      Supported
-F:      Documentation/powerpc/eeh-pci-error-recovery.txt
-F:      arch/powerpc/kernel/eeh*.c
-F:      arch/powerpc/platforms/*/eeh*.c
-F:      arch/powerpc/include/*/eeh*.h
-PCI SUBSYSTEM
-M:      Bjorn Helgaas <bhelgaas@google.com>
-L:      linux-pci@vger.kernel.org
-Q:      http://patchwork.ozlabs.org/project/linux-pci/list/
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci.git
-S:      Supported
-F:      Documentation/devicetree/bindings/pci/
-F:      Documentation/PCI/
-F:      drivers/pci/
-F:      include/linux/pci*
-F:      arch/x86/pci/
-F:      arch/x86/kernel/quirks.c
-PCI ENDPOINT SUBSYSTEM
-M:      Kishon Vijay Abraham I <kishon@ti.com>
 L:      linux-pci@vger.kernel.org
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/kishon/pci-endpoint.git
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
-S:      Supported
+S:      Maintained
-F:      drivers/pci/endpoint/
+F:      Documentation/devicetree/bindings/pci/aardvark-pci.txt
-F:      drivers/misc/pci_endpoint_test.c
+F:      drivers/pci/host/pci-aardvark.c
-F:      tools/pci/
 PCI DRIVER FOR ALTERA PCIE IP
 M:      Ley Foon Tan <lftan@altera.com>
@@ -10076,6 +10042,14 @@ S:	Supported
 F:      Documentation/devicetree/bindings/pci/altera-pcie.txt
 F:      drivers/pci/host/pcie-altera.c
+PCI DRIVER FOR APPLIEDMICRO XGENE
+M:      Tanmay Inamdar <tinamdar@apm.com>
+L:      linux-pci@vger.kernel.org
+L:      linux-arm-kernel@lists.infradead.org
+S:      Maintained
+F:      Documentation/devicetree/bindings/pci/xgene-pci.txt
+F:      drivers/pci/host/pci-xgene.c
 PCI DRIVER FOR ARM VERSATILE PLATFORM
 M:      Rob Herring <robh@kernel.org>
 L:      linux-pci@vger.kernel.org
@@ -10092,14 +10066,6 @@ S:	Maintained
 F:      Documentation/devicetree/bindings/pci/pci-armada8k.txt
 F:      drivers/pci/dwc/pcie-armada8k.c
-PCI DRIVER FOR APPLIEDMICRO XGENE
-M:      Tanmay Inamdar <tinamdar@apm.com>
-L:      linux-pci@vger.kernel.org
-L:      linux-arm-kernel@lists.infradead.org
-S:      Maintained
-F:      Documentation/devicetree/bindings/pci/xgene-pci.txt
-F:      drivers/pci/host/pci-xgene.c
 PCI DRIVER FOR FREESCALE LAYERSCAPE
 M:      Minghuan Lian <minghuan.Lian@freescale.com>
 M:      Mingkai Hu <mingkai.hu@freescale.com>
@@ -10110,6 +10076,15 @@ L:	linux-arm-kernel@lists.infradead.org
 S:      Maintained
 F:      drivers/pci/dwc/*layerscape*
+PCI DRIVER FOR GENERIC OF HOSTS
+M:      Will Deacon <will.deacon@arm.com>
+L:      linux-pci@vger.kernel.org
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+S:      Maintained
+F:      Documentation/devicetree/bindings/pci/host-generic-pci.txt
+F:      drivers/pci/host/pci-host-common.c
+F:      drivers/pci/host/pci-host-generic.c
 PCI DRIVER FOR IMX6
 M:      Richard Zhu <hongxing.zhu@nxp.com>
 M:      Lucas Stach <l.stach@pengutronix.de>
@@ -10119,28 +10094,11 @@ S:	Maintained
 F:      Documentation/devicetree/bindings/pci/fsl,imx6q-pcie.txt
 F:      drivers/pci/dwc/*imx6*
-PCI DRIVER FOR TI KEYSTONE
+PCI DRIVER FOR INTEL VOLUME MANAGEMENT DEVICE (VMD)
-M:      Murali Karicheri <m-karicheri2@ti.com>
+M:      Keith Busch <keith.busch@intel.com>
-L:      linux-pci@vger.kernel.org
-L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
-S:      Maintained
-F:      drivers/pci/dwc/*keystone*
-PCI DRIVER FOR MVEBU (Marvell Armada 370 and Armada XP SOC support)
-M:      Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
-M:      Jason Cooper <jason@lakedaemon.net>
-L:      linux-pci@vger.kernel.org
-L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
-S:      Maintained
-F:      drivers/pci/host/*mvebu*
-PCI DRIVER FOR AARDVARK (Marvell Armada 3700)
-M:      Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
 L:      linux-pci@vger.kernel.org
-L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+S:      Supported
-S:      Maintained
+F:      drivers/pci/host/vmd.c
-F:      Documentation/devicetree/bindings/pci/aardvark-pci.txt
-F:      drivers/pci/host/pci-aardvark.c
 PCI DRIVER FOR MICROSEMI SWITCHTEC
 M:      Kurt Schwemmer <kurt.schwemmer@microsemi.com>
@@ -10153,6 +10111,14 @@ F:	Documentation/ABI/testing/sysfs-class-switchtec
 F:      drivers/pci/switch/switchtec*
 F:      include/uapi/linux/switchtec_ioctl.h
+PCI DRIVER FOR MVEBU (Marvell Armada 370 and Armada XP SOC support)
+M:      Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+M:      Jason Cooper <jason@lakedaemon.net>
+L:      linux-pci@vger.kernel.org
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+S:      Maintained
+F:      drivers/pci/host/*mvebu*
 PCI DRIVER FOR NVIDIA TEGRA
 M:      Thierry Reding <thierry.reding@gmail.com>
 L:      linux-tegra@vger.kernel.org
@@ -10161,14 +10127,6 @@ S:	Supported
 F:      Documentation/devicetree/bindings/pci/nvidia,tegra20-pcie.txt
 F:      drivers/pci/host/pci-tegra.c
-PCI DRIVER FOR TI DRA7XX
-M:      Kishon Vijay Abraham I <kishon@ti.com>
-L:      linux-omap@vger.kernel.org
-L:      linux-pci@vger.kernel.org
-S:      Supported
-F:      Documentation/devicetree/bindings/pci/ti-pci.txt
-F:      drivers/pci/dwc/pci-dra7xx.c
 PCI DRIVER FOR RENESAS R-CAR
 M:      Simon Horman <horms@verge.net.au>
 L:      linux-pci@vger.kernel.org
@@ -10192,26 +10150,44 @@ S:	Maintained
 F:      Documentation/devicetree/bindings/pci/designware-pcie.txt
 F:      drivers/pci/dwc/*designware*
-PCI DRIVER FOR GENERIC OF HOSTS
+PCI DRIVER FOR TI DRA7XX
-M:      Will Deacon <will.deacon@arm.com>
+M:      Kishon Vijay Abraham I <kishon@ti.com>
+L:      linux-omap@vger.kernel.org
+L:      linux-pci@vger.kernel.org
+S:      Supported
+F:      Documentation/devicetree/bindings/pci/ti-pci.txt
+F:      drivers/pci/dwc/pci-dra7xx.c
+PCI DRIVER FOR TI KEYSTONE
+M:      Murali Karicheri <m-karicheri2@ti.com>
 L:      linux-pci@vger.kernel.org
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
-F:      Documentation/devicetree/bindings/pci/host-generic-pci.txt
+F:      drivers/pci/dwc/*keystone*
-F:      drivers/pci/host/pci-host-common.c
-F:      drivers/pci/host/pci-host-generic.c
-PCI DRIVER FOR INTEL VOLUME MANAGEMENT DEVICE (VMD)
+PCI ENDPOINT SUBSYSTEM
-M:      Keith Busch <keith.busch@intel.com>
+M:      Kishon Vijay Abraham I <kishon@ti.com>
 L:      linux-pci@vger.kernel.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/kishon/pci-endpoint.git
 S:      Supported
-F:      drivers/pci/host/vmd.c
+F:      drivers/pci/endpoint/
+F:      drivers/misc/pci_endpoint_test.c
+F:      tools/pci/
-PCIE DRIVER FOR ST SPEAR13XX
+PCI ENHANCED ERROR HANDLING (EEH) FOR POWERPC
-M:      Pratyush Anand <pratyush.anand@gmail.com>
+M:      Russell Currey <ruscur@russell.cc>
+L:      linuxppc-dev@lists.ozlabs.org
+S:      Supported
+F:      Documentation/powerpc/eeh-pci-error-recovery.txt
+F:      arch/powerpc/kernel/eeh*.c
+F:      arch/powerpc/platforms/*/eeh*.c
+F:      arch/powerpc/include/*/eeh*.h
+PCI ERROR RECOVERY
+M:      Linas Vepstas <linasvepstas@gmail.com>
 L:      linux-pci@vger.kernel.org
-S:      Maintained
+S:      Supported
-F:      drivers/pci/dwc/*spear*
+F:      Documentation/PCI/pci-error-recovery.txt
 PCI MSI DRIVER FOR ALTERA MSI IP
 M:      Ley Foon Tan <lftan@altera.com>
@@ -10229,6 +10205,19 @@ S:	Maintained
 F:      Documentation/devicetree/bindings/pci/xgene-pci-msi.txt
 F:      drivers/pci/host/pci-xgene-msi.c
+PCI SUBSYSTEM
+M:      Bjorn Helgaas <bhelgaas@google.com>
+L:      linux-pci@vger.kernel.org
+Q:      http://patchwork.ozlabs.org/project/linux-pci/list/
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci.git
+S:      Supported
+F:      Documentation/devicetree/bindings/pci/
+F:      Documentation/PCI/
+F:      drivers/pci/
+F:      include/linux/pci*
+F:      arch/x86/pci/
+F:      arch/x86/kernel/quirks.c
 PCIE DRIVER FOR AXIS ARTPEC
 M:      Niklas Cassel <niklas.cassel@axis.com>
 M:      Jesper Nilsson <jesper.nilsson@axis.com>
@@ -10238,6 +10227,14 @@ S:	Maintained
 F:      Documentation/devicetree/bindings/pci/axis,artpec*
 F:      drivers/pci/dwc/*artpec*
+PCIE DRIVER FOR CAVIUM THUNDERX
+M:      David Daney <david.daney@cavium.com>
+L:      linux-pci@vger.kernel.org
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+S:      Supported
+F:      Documentation/devicetree/bindings/pci/pci-thunder-*
+F:      drivers/pci/host/pci-thunder-*
 PCIE DRIVER FOR HISILICON
 M:      Zhou Wang <wangzhou1@hisilicon.com>
 M:      Gabriele Paoloni <gabriele.paoloni@huawei.com>
@@ -10254,6 +10251,21 @@ S:	Maintained
 F:      Documentation/devicetree/bindings/pci/pcie-kirin.txt
 F:      drivers/pci/dwc/pcie-kirin.c
+PCIE DRIVER FOR MEDIATEK
+M:      Ryder Lee <ryder.lee@mediatek.com>
+L:      linux-pci@vger.kernel.org
+L:      linux-mediatek@lists.infradead.org
+S:      Supported
+F:      Documentation/devicetree/bindings/pci/mediatek*
+F:      drivers/pci/host/*mediatek*
+PCIE DRIVER FOR QUALCOMM MSM
+M:      Stanimir Varbanov <svarbanov@mm-sol.com>
+L:      linux-pci@vger.kernel.org
+L:      linux-arm-msm@vger.kernel.org
+S:      Maintained
+F:      drivers/pci/dwc/*qcom*
 PCIE DRIVER FOR ROCKCHIP
 M:      Shawn Lin <shawn.lin@rock-chips.com>
 L:      linux-pci@vger.kernel.org
@@ -10262,28 +10274,11 @@ S:	Maintained
 F:      Documentation/devicetree/bindings/pci/rockchip-pcie.txt
 F:      drivers/pci/host/pcie-rockchip.c
-PCIE DRIVER FOR QUALCOMM MSM
+PCIE DRIVER FOR ST SPEAR13XX
-M:     Stanimir Varbanov <svarbanov@mm-sol.com>
+M:      Pratyush Anand <pratyush.anand@gmail.com>
-L:     linux-pci@vger.kernel.org
-L:     linux-arm-msm@vger.kernel.org
-S:     Maintained
-F:     drivers/pci/dwc/*qcom*
-PCIE DRIVER FOR CAVIUM THUNDERX
-M:      David Daney <david.daney@cavium.com>
 L:      linux-pci@vger.kernel.org
-L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+S:      Maintained
-S:      Supported
+F:      drivers/pci/dwc/*spear*
-F:      Documentation/devicetree/bindings/pci/pci-thunder-*
-F:      drivers/pci/host/pci-thunder-*
-PCIE DRIVER FOR MEDIATEK
-M:      Ryder Lee <ryder.lee@mediatek.com>
-L:      linux-pci@vger.kernel.org
-L:      linux-mediatek@lists.infradead.org
-S:      Supported
-F:      Documentation/devicetree/bindings/pci/mediatek*
-F:      drivers/pci/host/*mediatek*
 PCMCIA SUBSYSTEM
 P:      Linux PCMCIA Team
@@ -10452,14 +10447,14 @@ S:	Maintained
 F:      drivers/pinctrl/spear/
 PISTACHIO SOC SUPPORT
-M:      James Hartley <james.hartley@imgtec.com>
+M:      James Hartley <james.hartley@imgtec.com>
-M:      Ionela Voinescu <ionela.voinescu@imgtec.com>
+M:      Ionela Voinescu <ionela.voinescu@imgtec.com>
-L:      linux-mips@linux-mips.org
+L:      linux-mips@linux-mips.org
-S:      Maintained
+S:      Maintained
-F:      arch/mips/pistachio/
+F:      arch/mips/pistachio/
-F:      arch/mips/include/asm/mach-pistachio/
+F:      arch/mips/include/asm/mach-pistachio/
-F:      arch/mips/boot/dts/img/pistachio*
+F:      arch/mips/boot/dts/img/pistachio*
-F:      arch/mips/configs/pistachio*_defconfig
+F:      arch/mips/configs/pistachio*_defconfig
 PKTCDVD DRIVER
 S:      Orphan
@@ -10502,6 +10497,11 @@ L:	linux-scsi@vger.kernel.org
 S:      Supported
 F:      drivers/scsi/pm8001/
+PNP SUPPORT
+M:      "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+S:      Maintained
+F:      drivers/pnp/
 POSIX CLOCKS and TIMERS
 M:      Thomas Gleixner <tglx@linutronix.de>
 L:      linux-kernel@vger.kernel.org
@@ -10523,15 +10523,6 @@ F:	include/linux/pm_*
 F:      include/linux/powercap.h
 F:      drivers/powercap/
-POWER SUPPLY CLASS/SUBSYSTEM and DRIVERS
-M:      Sebastian Reichel <sre@kernel.org>
-L:      linux-pm@vger.kernel.org
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply.git
-S:      Maintained
-F:      Documentation/devicetree/bindings/power/supply/
-F:      include/linux/power_supply.h
-F:      drivers/power/supply/
 POWER STATE COORDINATION INTERFACE (PSCI)
 M:      Mark Rutland <mark.rutland@arm.com>
 M:      Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
@@ -10541,23 +10532,21 @@ F:	drivers/firmware/psci*.c
 F:      include/linux/psci.h
 F:      include/uapi/linux/psci.h
+POWER SUPPLY CLASS/SUBSYSTEM and DRIVERS
+M:      Sebastian Reichel <sre@kernel.org>
+L:      linux-pm@vger.kernel.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply.git
+S:      Maintained
+F:      Documentation/devicetree/bindings/power/supply/
+F:      include/linux/power_supply.h
+F:      drivers/power/supply/
 POWERNV OPERATOR PANEL LCD DISPLAY DRIVER
 M:      Suraj Jitindar Singh <sjitindarsingh@gmail.com>
 L:      linuxppc-dev@lists.ozlabs.org
 S:      Maintained
 F:      drivers/char/powernv-op-panel.c
-PNP SUPPORT
-M:      "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
-S:      Maintained
-F:      drivers/pnp/
-PPP PROTOCOL DRIVERS AND COMPRESSORS
-M:      Paul Mackerras <paulus@samba.org>
-L:      linux-ppp@vger.kernel.org
-S:      Maintained
-F:      drivers/net/ppp/ppp_*
 PPP OVER ATM (RFC 2364)
 M:      Mitchell Blank Jr <mitch@sfgoth.com>
 S:      Maintained
@@ -10577,6 +10566,12 @@ F:	net/l2tp/l2tp_ppp.c
 F:      include/linux/if_pppol2tp.h
 F:      include/uapi/linux/if_pppol2tp.h
+PPP PROTOCOL DRIVERS AND COMPRESSORS
+M:      Paul Mackerras <paulus@samba.org>
+L:      linux-ppp@vger.kernel.org
+S:      Maintained
+F:      drivers/net/ppp/ppp_*
 PPS SUPPORT
 M:      Rodolfo Giometti <giometti@enneenne.com>
 W:      http://wiki.enneenne.com/index.php/LinuxPPS_support
@@ -10690,7 +10685,6 @@ F:	drivers/ptp/*
 F:      include/linux/ptp_cl*
 PTRACE SUPPORT
-M:      Roland McGrath <roland@hack.frob.com>
 M:      Oleg Nesterov <oleg@redhat.com>
 S:      Maintained
 F:      include/asm-generic/syscall.h
@@ -10698,7 +10692,12 @@ F:	include/linux/ptrace.h
 F:      include/linux/regset.h
 F:      include/linux/tracehook.h
 F:      include/uapi/linux/ptrace.h
+F:      include/uapi/linux/ptrace.h
+F:      include/asm-generic/ptrace.h
 F:      kernel/ptrace.c
+F:      arch/*/ptrace*.c
+F:      arch/*/*/ptrace*.c
+F:      arch/*/include/asm/ptrace*.h
 PULSE8-CEC DRIVER
 M:      Hans Verkuil <hverkuil@xs4all.nl>
@@ -10747,6 +10746,20 @@ F:	include/linux/pwm_backlight.h
 F:      drivers/gpio/gpio-mvebu.c
 F:      Documentation/devicetree/bindings/gpio/gpio-mvebu.txt
+PXA GPIO DRIVER
+M:      Robert Jarzmik <robert.jarzmik@free.fr>
+L:      linux-gpio@vger.kernel.org
+S:      Maintained
+F:      drivers/gpio/gpio-pxa.c
+PXA MMCI DRIVER
+S:      Orphan
+PXA RTC DRIVER
+M:      Robert Jarzmik <robert.jarzmik@free.fr>
+L:      linux-rtc@vger.kernel.org
+S:      Maintained
 PXA2xx/PXA3xx SUPPORT
 M:      Daniel Mack <daniel@zonque.org>
 M:      Haojian Zhuang <haojian.zhuang@gmail.com>
@@ -10766,36 +10779,12 @@ F:	include/sound/pxa2xx-lib.h
 F:      sound/arm/pxa*
 F:      sound/soc/pxa/
-PXA GPIO DRIVER
-M:      Robert Jarzmik <robert.jarzmik@free.fr>
-L:      linux-gpio@vger.kernel.org
-S:      Maintained
-F:      drivers/gpio/gpio-pxa.c
 PXA3xx NAND FLASH DRIVER
 M:      Ezequiel Garcia <ezequiel.garcia@free-electrons.com>
 L:      linux-mtd@lists.infradead.org
 S:      Maintained
 F:      drivers/mtd/nand/pxa3xx_nand.c
-MMP SUPPORT
-M:      Eric Miao <eric.y.miao@gmail.com>
-M:      Haojian Zhuang <haojian.zhuang@gmail.com>
-L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
-T:      git git://github.com/hzhuang1/linux.git
-T:      git git://git.linaro.org/people/ycmiao/pxa-linux.git
-S:      Maintained
-F:      arch/arm/boot/dts/mmp*
-F:      arch/arm/mach-mmp/
-PXA MMCI DRIVER
-S:      Orphan
-PXA RTC DRIVER
-M:      Robert Jarzmik <robert.jarzmik@free.fr>
-L:      linux-rtc@vger.kernel.org
-S:      Maintained
 QAT DRIVER
 M:      Giovanni Cabiddu <giovanni.cabiddu@intel.com>
 M:      Salvatore Benedetto <salvatore.benedetto@intel.com>
@@ -10803,12 +10792,56 @@ L:	qat-linux@intel.com
 S:      Supported
 F:      drivers/crypto/qat/
+QCOM AUDIO (ASoC) DRIVERS
+M:      Patrick Lai <plai@codeaurora.org>
+M:      Banajit Goswami <bgoswami@codeaurora.org>
+L:      alsa-devel@alsa-project.org (moderated for non-subscribers)
+S:      Supported
+F:      sound/soc/qcom/
+QEMU MACHINE EMULATOR AND VIRTUALIZER SUPPORT
+M:      Gabriel Somlo <somlo@cmu.edu>
+M:      "Michael S. Tsirkin" <mst@redhat.com>
+L:      qemu-devel@nongnu.org
+S:      Maintained
+F:      drivers/firmware/qemu_fw_cfg.c
 QIB DRIVER
 M:      Mike Marciniszyn <infinipath@intel.com>
 L:      linux-rdma@vger.kernel.org
 S:      Supported
 F:      drivers/infiniband/hw/qib/
+QLOGIC QL41xxx FCOE DRIVER
+M:      QLogic-Storage-Upstream@cavium.com
+L:      linux-scsi@vger.kernel.org
+S:      Supported
+F:      drivers/scsi/qedf/
+QLOGIC QL41xxx ISCSI DRIVER
+M:      QLogic-Storage-Upstream@cavium.com
+L:      linux-scsi@vger.kernel.org
+S:      Supported
+F:      drivers/scsi/qedi/
+QLOGIC QL4xxx ETHERNET DRIVER
+M:      Yuval Mintz <Yuval.Mintz@cavium.com>
+M:      Ariel Elior <Ariel.Elior@cavium.com>
+M:      everest-linux-l2@cavium.com
+L:      netdev@vger.kernel.org
+S:      Supported
+F:      drivers/net/ethernet/qlogic/qed/
+F:      include/linux/qed/
+F:      drivers/net/ethernet/qlogic/qede/
+QLOGIC QL4xxx RDMA DRIVER
+M:      Ram Amrani <Ram.Amrani@cavium.com>
+M:      Ariel Elior <Ariel.Elior@cavium.com>
+L:      linux-rdma@vger.kernel.org
+S:      Supported
+F:      drivers/infiniband/hw/qedr/
+F:      include/uapi/rdma/qedr-abi.h
 QLOGIC QLA1280 SCSI DRIVER
 M:      Michael Reed <mdr@sgi.com>
 L:      linux-scsi@vger.kernel.org
@@ -10822,13 +10855,6 @@ S:	Supported
 F:      Documentation/scsi/LICENSE.qla2xxx
 F:      drivers/scsi/qla2xxx/
-QLOGIC QLA4XXX iSCSI DRIVER
-M:      QLogic-Storage-Upstream@qlogic.com
-L:      linux-scsi@vger.kernel.org
-S:      Supported
-F:      Documentation/scsi/LICENSE.qla4xxx
-F:      drivers/scsi/qla4xxx/
 QLOGIC QLA3XXX NETWORK DRIVER
 M:      Dept-GELinuxNICDev@cavium.com
 L:      netdev@vger.kernel.org
@@ -10836,6 +10862,13 @@ S:	Supported
 F:      Documentation/networking/LICENSE.qla3xxx
 F:      drivers/net/ethernet/qlogic/qla3xxx.*
+QLOGIC QLA4XXX iSCSI DRIVER
+M:      QLogic-Storage-Upstream@qlogic.com
+L:      linux-scsi@vger.kernel.org
+S:      Supported
+F:      Documentation/scsi/LICENSE.qla4xxx
+F:      drivers/scsi/qla4xxx/
 QLOGIC QLCNIC (1/10)Gb ETHERNET DRIVER
 M:      Harish Patil <harish.patil@cavium.com>
 M:      Manish Chopra <manish.chopra@cavium.com>
@@ -10852,28 +10885,6 @@ L:	netdev@vger.kernel.org
 S:      Supported
 F:      drivers/net/ethernet/qlogic/qlge/
-QLOGIC QL4xxx ETHERNET DRIVER
-M:      Yuval Mintz <Yuval.Mintz@cavium.com>
-M:      Ariel Elior <Ariel.Elior@cavium.com>
-M:      everest-linux-l2@cavium.com
-L:      netdev@vger.kernel.org
-S:      Supported
-F:      drivers/net/ethernet/qlogic/qed/
-F:      include/linux/qed/
-F:      drivers/net/ethernet/qlogic/qede/
-QLOGIC QL41xxx ISCSI DRIVER
-M:      QLogic-Storage-Upstream@cavium.com
-L:      linux-scsi@vger.kernel.org
-S:      Supported
-F:      drivers/scsi/qedi/
-QLOGIC QL41xxx FCOE DRIVER
-M:      QLogic-Storage-Upstream@cavium.com
-L:      linux-scsi@vger.kernel.org
-S:      Supported
-F:      drivers/scsi/qedf/
 QNX4 FILESYSTEM
 M:      Anders Larsen <al@alarsen.net>
 W:      http://www.alarsen.net/linux/qnx4fs/
@@ -10900,13 +10911,6 @@ T:	git git://linuxtv.org/anttip/media_tree.git
 S:      Maintained
 F:      drivers/media/tuners/qt1010*
-QUALCOMM ATHEROS ATH9K WIRELESS DRIVER
-M:      QCA ath9k Development <ath9k-devel@qca.qualcomm.com>
-L:      linux-wireless@vger.kernel.org
-W:      http://wireless.kernel.org/en/users/Drivers/ath9k
-S:      Supported
-F:      drivers/net/wireless/ath/ath9k/
 QUALCOMM ATHEROS ATH10K WIRELESS DRIVER
 M:      Kalle Valo <kvalo@qca.qualcomm.com>
 L:      ath10k@lists.infradead.org
@@ -10915,6 +10919,13 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git
 S:      Supported
 F:      drivers/net/wireless/ath/ath10k/
+QUALCOMM ATHEROS ATH9K WIRELESS DRIVER
+M:      QCA ath9k Development <ath9k-devel@qca.qualcomm.com>
+L:      linux-wireless@vger.kernel.org
+W:      http://wireless.kernel.org/en/users/Drivers/ath9k
+S:      Supported
+F:      drivers/net/wireless/ath/ath9k/
 QUALCOMM EMAC GIGABIT ETHERNET DRIVER
 M:      Timur Tabi <timur@codeaurora.org>
 L:      netdev@vger.kernel.org
@@ -10944,33 +10955,24 @@ T:	git git://github.com/KrasnikovEugene/wcn36xx.git
 S:      Supported
 F:      drivers/net/wireless/ath/wcn36xx/
-QEMU MACHINE EMULATOR AND VIRTUALIZER SUPPORT
-M:      Gabriel Somlo <somlo@cmu.edu>
-M:      "Michael S. Tsirkin" <mst@redhat.com>
-L:      qemu-devel@nongnu.org
-S:      Maintained
-F:      drivers/firmware/qemu_fw_cfg.c
 QUANTENNA QTNFMAC WIRELESS DRIVER
-M:   Igor Mitsyanko <imitsyanko@quantenna.com>
+M:      Igor Mitsyanko <imitsyanko@quantenna.com>
-M:   Avinash Patil <avinashp@quantenna.com>
+M:      Avinash Patil <avinashp@quantenna.com>
-M:   Sergey Matyukevich <smatyukevich@quantenna.com>
+M:      Sergey Matyukevich <smatyukevich@quantenna.com>
-L:   linux-wireless@vger.kernel.org
+L:      linux-wireless@vger.kernel.org
-S:   Maintained
+S:      Maintained
-F:   drivers/net/wireless/quantenna
+F:      drivers/net/wireless/quantenna
-RADOS BLOCK DEVICE (RBD)
+RADEON and AMDGPU DRM DRIVERS
-M:      Ilya Dryomov <idryomov@gmail.com>
+M:      Alex Deucher <alexander.deucher@amd.com>
-M:      Sage Weil <sage@redhat.com>
+M:      Christian König <christian.koenig@amd.com>
-M:      Alex Elder <elder@kernel.org>
+L:      amd-gfx@lists.freedesktop.org
-L:      ceph-devel@vger.kernel.org
+T:      git git://people.freedesktop.org/~agd5f/linux
-W:      http://ceph.com/
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client.git
-T:      git git://github.com/ceph/ceph-client.git
 S:      Supported
-F:      Documentation/ABI/testing/sysfs-bus-rbd
+F:      drivers/gpu/drm/radeon/
-F:      drivers/block/rbd.c
+F:      include/uapi/drm/radeon_drm.h
-F:      drivers/block/rbd_types.h
+F:      drivers/gpu/drm/amd/
+F:      include/uapi/drm/amdgpu_drm.h
 RADEON FRAMEBUFFER DISPLAY DRIVER
 M:      Benjamin Herrenschmidt <benh@kernel.crashing.org>
@@ -10994,6 +10996,19 @@ S:	Maintained
 F:      drivers/media/radio/radio-shark2.c
 F:      drivers/media/radio/radio-tea5777.c
+RADOS BLOCK DEVICE (RBD)
+M:      Ilya Dryomov <idryomov@gmail.com>
+M:      Sage Weil <sage@redhat.com>
+M:      Alex Elder <elder@kernel.org>
+L:      ceph-devel@vger.kernel.org
+W:      http://ceph.com/
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client.git
+T:      git git://github.com/ceph/ceph-client.git
+S:      Supported
+F:      Documentation/ABI/testing/sysfs-bus-rbd
+F:      drivers/block/rbd.c
+F:      drivers/block/rbd_types.h
 RAGE128 FRAMEBUFFER DISPLAY DRIVER
 M:      Paul Mackerras <paulus@samba.org>
 L:      linux-fbdev@vger.kernel.org
@@ -11073,6 +11088,12 @@ L:	netdev@vger.kernel.org
 S:      Maintained
 F:      drivers/net/ethernet/rdc/r6040.c
+RDMAVT - RDMA verbs software
+M:      Dennis Dalessandro <dennis.dalessandro@intel.com>
+L:      linux-rdma@vger.kernel.org
+S:      Supported
+F:      drivers/infiniband/sw/rdmavt
 RDS - RELIABLE DATAGRAM SOCKETS
 M:      Santosh Shilimkar <santosh.shilimkar@oracle.com>
 L:      netdev@vger.kernel.org
@@ -11083,12 +11104,6 @@ S:	Supported
 F:      net/rds/
 F:      Documentation/networking/rds.txt
-RDMAVT - RDMA verbs software
-M:      Dennis Dalessandro <dennis.dalessandro@intel.com>
-L:      linux-rdma@vger.kernel.org
-S:      Supported
-F:      drivers/infiniband/sw/rdmavt
 RDT - RESOURCE ALLOCATION
 M:      Fenghua Yu <fenghua.yu@intel.com>
 L:      linux-kernel@vger.kernel.org
@@ -11137,11 +11152,6 @@ S:	Maintained
 F:      sound/soc/codecs/rt*
 F:      include/sound/rt*.h
-REISERFS FILE SYSTEM
-L:      reiserfs-devel@vger.kernel.org
-S:      Supported
-F:      fs/reiserfs/
 REGISTER MAP ABSTRACTION
 M:      Mark Brown <broonie@kernel.org>
 L:      linux-kernel@vger.kernel.org
@@ -11151,6 +11161,11 @@ F:	Documentation/devicetree/bindings/regmap/
 F:      drivers/base/regmap/
 F:      include/linux/regmap.h
+REISERFS FILE SYSTEM
+L:      reiserfs-devel@vger.kernel.org
+S:      Supported
+F:      fs/reiserfs/
 REMOTE PROCESSOR (REMOTEPROC) SUBSYSTEM
 M:      Ohad Ben-Cohen <ohad@wizery.com>
 M:      Bjorn Andersson <bjorn.andersson@linaro.org>
@@ -11226,16 +11241,16 @@ S:	Maintained
 F:      lib/rhashtable.c
 F:      include/linux/rhashtable.h
-RICOH SMARTMEDIA/XD DRIVER
+RICOH R5C592 MEMORYSTICK DRIVER
 M:      Maxim Levitsky <maximlevitsky@gmail.com>
 S:      Maintained
-F:      drivers/mtd/nand/r852.c
+F:      drivers/memstick/host/r592.*
-F:      drivers/mtd/nand/r852.h
-RICOH R5C592 MEMORYSTICK DRIVER
+RICOH SMARTMEDIA/XD DRIVER
 M:      Maxim Levitsky <maximlevitsky@gmail.com>
 S:      Maintained
-F:      drivers/memstick/host/r592.*
+F:      drivers/mtd/nand/r852.c
+F:      drivers/mtd/nand/r852.h
 ROCCAT DRIVERS
 M:      Stefan Achatz <erazor_de@users.sourceforge.net>
@@ -11372,6 +11387,23 @@ S:	Supported
 F:      drivers/s390/block/dasd*
 F:      block/partitions/ibm.c
+S390 IOMMU (PCI)
+M:      Gerald Schaefer <gerald.schaefer@de.ibm.com>
+L:      linux-s390@vger.kernel.org
+W:      http://www.ibm.com/developerworks/linux/linux390/
+S:      Supported
+F:      drivers/iommu/s390-iommu.c
+S390 IUCV NETWORK LAYER
+M:      Julian Wiedmann <jwi@linux.vnet.ibm.com>
+M:      Ursula Braun <ubraun@linux.vnet.ibm.com>
+L:      linux-s390@vger.kernel.org
+W:      http://www.ibm.com/developerworks/linux/linux390/
+S:      Supported
+F:      drivers/s390/net/*iucv*
+F:      include/net/iucv/
+F:      net/iucv/
 S390 NETWORK DRIVERS
 M:      Julian Wiedmann <jwi@linux.vnet.ibm.com>
 M:      Ursula Braun <ubraun@linux.vnet.ibm.com>
@@ -11389,6 +11421,16 @@ S:	Supported
 F:      arch/s390/pci/
 F:      drivers/pci/hotplug/s390_pci_hpc.c
+S390 VFIO-CCW DRIVER
+M:      Cornelia Huck <cohuck@redhat.com>
+M:      Dong Jia Shi <bjsdjshi@linux.vnet.ibm.com>
+L:      linux-s390@vger.kernel.org
+L:      kvm@vger.kernel.org
+S:      Supported
+F:      drivers/s390/cio/vfio_ccw*
+F:      Documentation/s390/vfio-ccw.txt
+F:      include/uapi/linux/vfio_ccw.h
 S390 ZCRYPT DRIVER
 M:      Harald Freudenberger <freude@de.ibm.com>
 L:      linux-s390@vger.kernel.org
@@ -11403,33 +11445,6 @@ W:	http://www.ibm.com/developerworks/linux/linux390/
 S:      Supported
 F:      drivers/s390/scsi/zfcp_*
-S390 IUCV NETWORK LAYER
-M:      Julian Wiedmann <jwi@linux.vnet.ibm.com>
-M:      Ursula Braun <ubraun@linux.vnet.ibm.com>
-L:      linux-s390@vger.kernel.org
-W:      http://www.ibm.com/developerworks/linux/linux390/
-S:      Supported
-F:      drivers/s390/net/*iucv*
-F:      include/net/iucv/
-F:      net/iucv/
-S390 IOMMU (PCI)
-M:      Gerald Schaefer <gerald.schaefer@de.ibm.com>
-L:      linux-s390@vger.kernel.org
-W:      http://www.ibm.com/developerworks/linux/linux390/
-S:      Supported
-F:      drivers/iommu/s390-iommu.c
-S390 VFIO-CCW DRIVER
-M:      Cornelia Huck <cohuck@redhat.com>
-M:      Dong Jia Shi <bjsdjshi@linux.vnet.ibm.com>
-L:      linux-s390@vger.kernel.org
-L:      kvm@vger.kernel.org
-S:      Supported
-F:      drivers/s390/cio/vfio_ccw*
-F:      Documentation/s390/vfio-ccw.txt
-F:      include/uapi/linux/vfio_ccw.h
 S3C24XX SD/MMC Driver
 M:      Ben Dooks <ben-linux@fluff.org>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
@@ -11463,12 +11478,6 @@ F:	drivers/media/common/saa7146/
 F:      drivers/media/pci/saa7146/
 F:      include/media/saa7146*
-SAMSUNG LAPTOP DRIVER
-M:      Corentin Chary <corentin.chary@gmail.com>
-L:      platform-driver-x86@vger.kernel.org
-S:      Maintained
-F:      drivers/platform/x86/samsung-laptop.c
 SAMSUNG AUDIO (ASoC) DRIVERS
 M:      Krzysztof Kozlowski <krzk@kernel.org>
 M:      Sangbeom Kim <sbkim73@samsung.com>
@@ -11491,6 +11500,12 @@ L:	linux-fbdev@vger.kernel.org
 S:      Maintained
 F:      drivers/video/fbdev/s3c-fb.c
+SAMSUNG LAPTOP DRIVER
+M:      Corentin Chary <corentin.chary@gmail.com>
+L:      platform-driver-x86@vger.kernel.org
+S:      Maintained
+F:      drivers/platform/x86/samsung-laptop.c
 SAMSUNG MULTIFUNCTION PMIC DEVICE DRIVERS
 M:      Sangbeom Kim <sbkim73@samsung.com>
 M:      Krzysztof Kozlowski <krzk@kernel.org>
@@ -11509,22 +11524,6 @@ F:	Documentation/devicetree/bindings/regulator/samsung,s2m*.txt
 F:      Documentation/devicetree/bindings/regulator/samsung,s5m*.txt
 F:      Documentation/devicetree/bindings/clock/samsung,s2mps11.txt
-SAMSUNG S5P Security SubSystem (SSS) DRIVER
-M:      Krzysztof Kozlowski <krzk@kernel.org>
-M:      Vladimir Zapolskiy <vz@mleia.com>
-L:      linux-crypto@vger.kernel.org
-L:      linux-samsung-soc@vger.kernel.org
-S:      Maintained
-F:      drivers/crypto/s5p-sss.c
-SAMSUNG S5P/EXYNOS4 SOC SERIES CAMERA SUBSYSTEM DRIVERS
-M:      Kyungmin Park <kyungmin.park@samsung.com>
-M:      Sylwester Nawrocki <s.nawrocki@samsung.com>
-L:      linux-media@vger.kernel.org
-Q:      https://patchwork.linuxtv.org/project/linux-media/list/
-S:      Supported
-F:      drivers/media/platform/exynos4-is/
 SAMSUNG S3C24XX/S3C64XX SOC SERIES CAMIF DRIVER
 M:      Sylwester Nawrocki <sylvester.nawrocki@gmail.com>
 L:      linux-media@vger.kernel.org
@@ -11533,6 +11532,13 @@ S:	Maintained
 F:      drivers/media/platform/s3c-camif/
 F:      include/media/drv-intf/s3c_camif.h
+SAMSUNG S3FWRN5 NFC DRIVER
+M:      Robert Baldyga <r.baldyga@samsung.com>
+M:      Krzysztof Opasiak <k.opasiak@samsung.com>
+L:      linux-nfc@lists.01.org (moderated for non-subscribers)
+S:      Supported
+F:      drivers/nfc/s3fwrn5
 SAMSUNG S5C73M3 CAMERA DRIVER
 M:      Kyungmin Park <kyungmin.park@samsung.com>
 M:      Andrzej Hajda <a.hajda@samsung.com>
@@ -11547,12 +11553,21 @@ L:	linux-media@vger.kernel.org
 S:      Supported
 F:      drivers/media/i2c/s5k5baf.c
-SAMSUNG S3FWRN5 NFC DRIVER
+SAMSUNG S5P Security SubSystem (SSS) DRIVER
-M:      Robert Baldyga <r.baldyga@samsung.com>
+M:      Krzysztof Kozlowski <krzk@kernel.org>
-M:      Krzysztof Opasiak <k.opasiak@samsung.com>
+M:      Vladimir Zapolskiy <vz@mleia.com>
-L:      linux-nfc@lists.01.org (moderated for non-subscribers)
+L:      linux-crypto@vger.kernel.org
+L:      linux-samsung-soc@vger.kernel.org
+S:      Maintained
+F:      drivers/crypto/s5p-sss.c
+SAMSUNG S5P/EXYNOS4 SOC SERIES CAMERA SUBSYSTEM DRIVERS
+M:      Kyungmin Park <kyungmin.park@samsung.com>
+M:      Sylwester Nawrocki <s.nawrocki@samsung.com>
+L:      linux-media@vger.kernel.org
+Q:      https://patchwork.linuxtv.org/project/linux-media/list/
 S:      Supported
-F:      drivers/nfc/s3fwrn5
+F:      drivers/media/platform/exynos4-is/
 SAMSUNG SOC CLOCK DRIVERS
 M:      Sylwester Nawrocki <s.nawrocki@samsung.com>
@@ -11605,126 +11620,6 @@ F:	drivers/phy/samsung/phy-s5pv210-usb2.c
 F:      drivers/phy/samsung/phy-samsung-usb2.c
 F:      drivers/phy/samsung/phy-samsung-usb2.h
-SERIAL DRIVERS
-M:      Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-L:      linux-serial@vger.kernel.org
-S:      Maintained
-F:      Documentation/devicetree/bindings/serial/
-F:      drivers/tty/serial/
-SERIAL DEVICE BUS
-M:      Rob Herring <robh@kernel.org>
-L:      linux-serial@vger.kernel.org
-S:      Maintained
-F:      Documentation/devicetree/bindings/serial/slave-device.txt
-F:      drivers/tty/serdev/
-F:      include/linux/serdev.h
-SERIAL IR RECEIVER
-M:      Sean Young <sean@mess.org>
-L:      linux-media@vger.kernel.org
-S:      Maintained
-F:      drivers/media/rc/serial_ir.c
-STI CEC DRIVER
-M:      Benjamin Gaignard <benjamin.gaignard@linaro.org>
-S:      Maintained
-F:      drivers/staging/media/st-cec/
-F:      Documentation/devicetree/bindings/media/stih-cec.txt
-SHARED MEMORY COMMUNICATIONS (SMC) SOCKETS
-M:      Ursula Braun <ubraun@linux.vnet.ibm.com>
-L:      linux-s390@vger.kernel.org
-W:      http://www.ibm.com/developerworks/linux/linux390/
-S:      Supported
-F:      net/smc/
-SYNOPSYS DESIGNWARE DMAC DRIVER
-M:      Viresh Kumar <vireshk@kernel.org>
-M:      Andy Shevchenko <andriy.shevchenko@linux.intel.com>
-S:      Maintained
-F:      include/linux/dma/dw.h
-F:      include/linux/platform_data/dma-dw.h
-F:      drivers/dma/dw/
-SYNOPSYS DESIGNWARE ENTERPRISE ETHERNET DRIVER
-M:      Jie Deng <jiedeng@synopsys.com>
-L:      netdev@vger.kernel.org
-S:      Supported
-F:      drivers/net/ethernet/synopsys/
-SYNOPSYS DESIGNWARE I2C DRIVER
-M:      Jarkko Nikula <jarkko.nikula@linux.intel.com>
-R:      Andy Shevchenko <andriy.shevchenko@linux.intel.com>
-R:      Mika Westerberg <mika.westerberg@linux.intel.com>
-L:      linux-i2c@vger.kernel.org
-S:      Maintained
-F:      drivers/i2c/busses/i2c-designware-*
-F:      include/linux/platform_data/i2c-designware.h
-SYNOPSYS DESIGNWARE MMC/SD/SDIO DRIVER
-M:      Jaehoon Chung <jh80.chung@samsung.com>
-L:      linux-mmc@vger.kernel.org
-S:      Maintained
-F:      drivers/mmc/host/dw_mmc*
-SYSTEM TRACE MODULE CLASS
-M:      Alexander Shishkin <alexander.shishkin@linux.intel.com>
-S:      Maintained
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/ash/stm.git
-F:      Documentation/trace/stm.txt
-F:      drivers/hwtracing/stm/
-F:      include/linux/stm.h
-F:      include/uapi/linux/stm.h
-TEE SUBSYSTEM
-M:      Jens Wiklander <jens.wiklander@linaro.org>
-S:      Maintained
-F:      include/linux/tee_drv.h
-F:      include/uapi/linux/tee.h
-F:      drivers/tee/
-F:      Documentation/tee.txt
-THUNDERBOLT DRIVER
-M:      Andreas Noever <andreas.noever@gmail.com>
-M:      Michael Jamet <michael.jamet@intel.com>
-M:      Mika Westerberg <mika.westerberg@linux.intel.com>
-M:      Yehezkel Bernat <yehezkel.bernat@intel.com>
-S:      Maintained
-F:      drivers/thunderbolt/
-TI BQ27XXX POWER SUPPLY DRIVER
-R:      Andrew F. Davis <afd@ti.com>
-F:      include/linux/power/bq27xxx_battery.h
-F:      drivers/power/supply/bq27xxx_battery.c
-F:      drivers/power/supply/bq27xxx_battery_i2c.c
-TIMEKEEPING, CLOCKSOURCE CORE, NTP, ALARMTIMER
-M:      John Stultz <john.stultz@linaro.org>
-M:      Thomas Gleixner <tglx@linutronix.de>
-R:      Stephen Boyd <sboyd@codeaurora.org>
-L:      linux-kernel@vger.kernel.org
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git timers/core
-S:      Supported
-F:      include/linux/clocksource.h
-F:      include/linux/time.h
-F:      include/linux/timex.h
-F:      include/uapi/linux/time.h
-F:      include/uapi/linux/timex.h
-F:      kernel/time/clocksource.c
-F:      kernel/time/time*.c
-F:      kernel/time/alarmtimer.c
-F:      kernel/time/ntp.c
-F:      tools/testing/selftests/timers/
-TI TRF7970A NFC DRIVER
-M:      Mark Greer <mgreer@animalcreek.com>
-L:      linux-wireless@vger.kernel.org
-L:      linux-nfc@lists.01.org (moderated for non-subscribers)
-S:      Supported
-F:      drivers/nfc/trf7970a.c
-F:      Documentation/devicetree/bindings/net/nfc/trf7970a.txt
 SC1200 WDT DRIVER
 M:      Zwane Mwaikambo <zwanem@gmail.com>
 S:      Maintained
@@ -11753,16 +11648,6 @@ M:	Lubomir Rintel <lkundrak@v3.sk>
 S:      Supported
 F:      drivers/char/pcmcia/scr24x_cs.c
-SYSTEM CONTROL & POWER INTERFACE (SCPI) Message Protocol drivers
-M:      Sudeep Holla <sudeep.holla@arm.com>
-L:      linux-arm-kernel@lists.infradead.org
-S:      Maintained
-F:      Documentation/devicetree/bindings/arm/arm,scpi.txt
-F:      drivers/clk/clk-scpi.c
-F:      drivers/cpufreq/scpi-cpufreq.c
-F:      drivers/firmware/arm_scpi.c
-F:      include/linux/scpi_protocol.h
 SCSI CDROM DRIVER
 M:      Jens Axboe <axboe@kernel.dk>
 L:      linux-scsi@vger.kernel.org
@@ -11847,14 +11732,6 @@ L:	sdricohcs-devel@lists.sourceforge.net (subscribers-only)
 S:      Maintained
 F:      drivers/mmc/host/sdricoh_cs.c
-SECURE DIGITAL HOST CONTROLLER INTERFACE (SDHCI) DRIVER
-M:      Adrian Hunter <adrian.hunter@intel.com>
-L:      linux-mmc@vger.kernel.org
-T:      git git://git.infradead.org/users/ahunter/linux-sdhci.git
-S:      Maintained
-F:      drivers/mmc/host/sdhci*
-F:      include/linux/mmc/sdhci*
 SECURE COMPUTING
 M:      Kees Cook <keescook@chromium.org>
 R:      Andy Lutomirski <luto@amacapital.net>
@@ -11877,6 +11754,14 @@ L:	bcm-kernel-feedback-list@broadcom.com
 S:      Maintained
 F:      drivers/mmc/host/sdhci-brcmstb*
+SECURE DIGITAL HOST CONTROLLER INTERFACE (SDHCI) DRIVER
+M:      Adrian Hunter <adrian.hunter@intel.com>
+L:      linux-mmc@vger.kernel.org
+T:      git git://git.infradead.org/users/ahunter/linux-sdhci.git
+S:      Maintained
+F:      drivers/mmc/host/sdhci*
+F:      include/linux/mmc/sdhci*
 SECURE DIGITAL HOST CONTROLLER INTERFACE (SDHCI) SAMSUNG DRIVER
 M:      Ben Dooks <ben-linux@fluff.org>
 M:      Jaehoon Chung <jh80.chung@samsung.com>
@@ -11901,6 +11786,10 @@ F:	block/opal_proto.h
 F:      include/linux/sed*
 F:      include/uapi/linux/sed*
+SECURITY CONTACT
+M:      Security Officers <security@kernel.org>
+S:      Supported
 SECURITY SUBSYSTEM
 M:      James Morris <james.l.morris@oracle.com>
 M:      "Serge E. Hallyn" <serge@hallyn.com>
@@ -11910,10 +11799,6 @@ W:	http://kernsec.org/
 S:      Supported
 F:      security/
-SECURITY CONTACT
-M:      Security Officers <security@kernel.org>
-S:      Supported
 SELINUX SECURITY MODULE
 M:      Paul Moore <paul@paul-moore.com>
 M:      Stephen Smalley <sds@tycho.nsa.gov>
@@ -11927,62 +11812,32 @@ F:	security/selinux/
 F:      scripts/selinux/
 F:      Documentation/admin-guide/LSM/SELinux.rst
-APPARMOR SECURITY MODULE
-M:      John Johansen <john.johansen@canonical.com>
-L:      apparmor@lists.ubuntu.com (subscribers-only, general discussion)
-W:      apparmor.wiki.kernel.org
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jj/apparmor-dev.git
-S:      Supported
-F:      security/apparmor/
-F:      Documentation/admin-guide/LSM/apparmor.rst
-LOADPIN SECURITY MODULE
-M:      Kees Cook <keescook@chromium.org>
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git lsm/loadpin
-S:      Supported
-F:      security/loadpin/
-F:      Documentation/admin-guide/LSM/LoadPin.rst
-YAMA SECURITY MODULE
-M:      Kees Cook <keescook@chromium.org>
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git yama/tip
-S:      Supported
-F:      security/yama/
-F:      Documentation/admin-guide/LSM/Yama.rst
 SENSABLE PHANTOM
 M:      Jiri Slaby <jirislaby@gmail.com>
 S:      Maintained
 F:      drivers/misc/phantom.c
 F:      include/uapi/linux/phantom.h
-Emulex 10Gbps iSCSI - OneConnect DRIVER
+SERIAL DEVICE BUS
-M:      Subbu Seetharaman <subbu.seetharaman@broadcom.com>
+M:      Rob Herring <robh@kernel.org>
-M:      Ketan Mukadam <ketan.mukadam@broadcom.com>
+L:      linux-serial@vger.kernel.org
-M:      Jitendra Bhivare <jitendra.bhivare@broadcom.com>
+S:      Maintained
-L:      linux-scsi@vger.kernel.org
+F:      Documentation/devicetree/bindings/serial/slave-device.txt
-W:      http://www.broadcom.com
+F:      drivers/tty/serdev/
-S:      Supported
+F:      include/linux/serdev.h
-F:      drivers/scsi/be2iscsi/
-Emulex 10Gbps NIC BE2, BE3-R, Lancer, Skyhawk-R DRIVER (be2net)
+SERIAL DRIVERS
-M:      Sathya Perla <sathya.perla@broadcom.com>
+M:      Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-M:      Ajit Khaparde <ajit.khaparde@broadcom.com>
+L:      linux-serial@vger.kernel.org
-M:      Sriharsha Basavapatna <sriharsha.basavapatna@broadcom.com>
+S:      Maintained
-M:      Somnath Kotur <somnath.kotur@broadcom.com>
+F:      Documentation/devicetree/bindings/serial/
-L:      netdev@vger.kernel.org
+F:      drivers/tty/serial/
-W:      http://www.emulex.com
-S:      Supported
-F:      drivers/net/ethernet/emulex/benet/
-EMULEX ONECONNECT ROCE DRIVER
+SERIAL IR RECEIVER
-M:      Selvin Xavier <selvin.xavier@broadcom.com>
+M:      Sean Young <sean@mess.org>
-M:      Devesh Sharma <devesh.sharma@broadcom.com>
+L:      linux-media@vger.kernel.org
-L:      linux-rdma@vger.kernel.org
+S:      Maintained
-W:      http://www.broadcom.com
+F:      drivers/media/rc/serial_ir.c
-S:      Odd Fixes
-F:      drivers/infiniband/hw/ocrdma/
-F:      include/uapi/rdma/ocrdma-abi.h
 SFC NETWORK DRIVER
 M:      Solarflare linux maintainers <linux-net-drivers@solarflare.com>
@@ -12011,6 +11866,24 @@ M:	Robin Holt <robinmholt@gmail.com>
 S:      Maintained
 F:      drivers/misc/sgi-xp/
+SHARED MEMORY COMMUNICATIONS (SMC) SOCKETS
+M:      Ursula Braun <ubraun@linux.vnet.ibm.com>
+L:      linux-s390@vger.kernel.org
+W:      http://www.ibm.com/developerworks/linux/linux390/
+S:      Supported
+F:      net/smc/
+SH_VEU V4L2 MEM2MEM DRIVER
+L:      linux-media@vger.kernel.org
+S:      Orphan
+F:      drivers/media/platform/sh_veu.c
+SH_VOU V4L2 OUTPUT DRIVER
+L:      linux-media@vger.kernel.org
+S:      Orphan
+F:      drivers/media/platform/sh_vou.c
+F:      include/media/drv-intf/sh_vou.h
 SI2157 MEDIA DRIVER
 M:      Antti Palosaari <crope@iki.fi>
 L:      linux-media@vger.kernel.org
@@ -12093,24 +11966,14 @@ S:	Maintained
 F:      drivers/input/touchscreen/silead.c
 F:      drivers/platform/x86/silead_dmi.c
-SIMPLEFB FB DRIVER
+SILICON MOTION SM712 FRAME BUFFER DRIVER
-M:      Hans de Goede <hdegoede@redhat.com>
+M:      Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+M:      Teddy Wang <teddy.wang@siliconmotion.com>
+M:      Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
 L:      linux-fbdev@vger.kernel.org
 S:      Maintained
-F:      Documentation/devicetree/bindings/display/simple-framebuffer.txt
+F:      drivers/video/fbdev/sm712*
-F:      drivers/video/fbdev/simplefb.c
+F:      Documentation/fb/sm712fb.txt
-F:      include/linux/platform_data/simplefb.h
-SH_VEU V4L2 MEM2MEM DRIVER
-L:      linux-media@vger.kernel.org
-S:      Orphan
-F:      drivers/media/platform/sh_veu.c
-SH_VOU V4L2 OUTPUT DRIVER
-L:      linux-media@vger.kernel.org
-S:      Orphan
-F:      drivers/media/platform/sh_vou.c
-F:      include/media/drv-intf/sh_vou.h
 SIMPLE FIRMWARE INTERFACE (SFI)
 M:      Len Brown <lenb@kernel.org>
@@ -12122,6 +11985,14 @@ F:	arch/x86/platform/sfi/
 F:      drivers/sfi/
 F:      include/linux/sfi*.h
+SIMPLEFB FB DRIVER
+M:      Hans de Goede <hdegoede@redhat.com>
+L:      linux-fbdev@vger.kernel.org
+S:      Maintained
+F:      Documentation/devicetree/bindings/display/simple-framebuffer.txt
+F:      drivers/video/fbdev/simplefb.c
+F:      include/linux/platform_data/simplefb.h
 SIMTEC EB110ATX (Chalice CATS)
 P:      Ben Dooks
 P:      Vincent Sanders <vince@simtec.co.uk>
@@ -12146,61 +12017,6 @@ F:	lib/siphash.c
 F:      lib/test_siphash.c
 F:      include/linux/siphash.h
-TI DAVINCI MACHINE SUPPORT
-M:      Sekhar Nori <nsekhar@ti.com>
-M:      Kevin Hilman <khilman@kernel.org>
-L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/nsekhar/linux-davinci.git
-S:      Supported
-F:      arch/arm/mach-davinci/
-F:      drivers/i2c/busses/i2c-davinci.c
-F:      arch/arm/boot/dts/da850*
-TI DAVINCI SERIES MEDIA DRIVER
-M:      "Lad, Prabhakar" <prabhakar.csengg@gmail.com>
-L:      linux-media@vger.kernel.org
-W:      https://linuxtv.org
-Q:      http://patchwork.linuxtv.org/project/linux-media/list/
-T:      git git://linuxtv.org/mhadli/v4l-dvb-davinci_devices.git
-S:      Maintained
-F:      drivers/media/platform/davinci/
-F:      include/media/davinci/
-TI DAVINCI SERIES GPIO DRIVER
-M:      Keerthy <j-keerthy@ti.com>
-L:      linux-gpio@vger.kernel.org
-S:      Maintained
-F:      Documentation/devicetree/bindings/gpio/gpio-davinci.txt
-F:      drivers/gpio/gpio-davinci.c
-TI AM437X VPFE DRIVER
-M:      "Lad, Prabhakar" <prabhakar.csengg@gmail.com>
-L:      linux-media@vger.kernel.org
-W:      https://linuxtv.org
-Q:      http://patchwork.linuxtv.org/project/linux-media/list/
-T:      git git://linuxtv.org/mhadli/v4l-dvb-davinci_devices.git
-S:      Maintained
-F:      drivers/media/platform/am437x/
-OV2659 OMNIVISION SENSOR DRIVER
-M:      "Lad, Prabhakar" <prabhakar.csengg@gmail.com>
-L:      linux-media@vger.kernel.org
-W:      https://linuxtv.org
-Q:      http://patchwork.linuxtv.org/project/linux-media/list/
-T:      git git://linuxtv.org/mhadli/v4l-dvb-davinci_devices.git
-S:      Maintained
-F:      drivers/media/i2c/ov2659.c
-F:      include/media/i2c/ov2659.h
-SILICON MOTION SM712 FRAME BUFFER DRIVER
-M:      Sudip Mukherjee <sudipm.mukherjee@gmail.com>
-M:      Teddy Wang <teddy.wang@siliconmotion.com>
-M:      Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
-L:      linux-fbdev@vger.kernel.org
-S:      Maintained
-F:      drivers/video/fbdev/sm712*
-F:      Documentation/fb/sm712fb.txt
 SIS 190 ETHERNET DRIVER
 M:      Francois Romieu <romieu@fr.zoreil.com>
 L:      netdev@vger.kernel.org
@@ -12261,14 +12077,6 @@ S:	Maintained
 F:      Documentation/admin-guide/LSM/Smack.rst
 F:      security/smack/
-DRIVERS FOR ADAPTIVE VOLTAGE SCALING (AVS)
-M:      Kevin Hilman <khilman@kernel.org>
-M:      Nishanth Menon <nm@ti.com>
-S:      Maintained
-F:      drivers/power/avs/
-F:      include/linux/power/smartreflex.h
-L:      linux-pm@vger.kernel.org
 SMC91x ETHERNET DRIVER
 M:      Nicolas Pitre <nico@fluxnic.net>
 S:      Odd Fixes
@@ -12306,6 +12114,12 @@ S:	Supported
 F:      Documentation/hwmon/sch5627
 F:      drivers/hwmon/sch5627.c
+SMSC UFX6000 and UFX7000 USB to VGA DRIVER
+M:      Steve Glendinning <steve.glendinning@shawell.net>
+L:      linux-fbdev@vger.kernel.org
+S:      Maintained
+F:      drivers/video/fbdev/smscufx.c
 SMSC47B397 HARDWARE MONITOR DRIVER
 M:      Jean Delvare <jdelvare@suse.com>
 L:      linux-hwmon@vger.kernel.org
@@ -12326,12 +12140,6 @@ L:	netdev@vger.kernel.org
 S:      Maintained
 F:      drivers/net/ethernet/smsc/smsc9420.*
-SMSC UFX6000 and UFX7000 USB to VGA DRIVER
-M:      Steve Glendinning <steve.glendinning@shawell.net>
-L:      linux-fbdev@vger.kernel.org
-S:      Maintained
-F:      drivers/video/fbdev/smscufx.c
 SOC-CAMERA V4L2 SUBSYSTEM
 M:      Guennadi Liakhovetski <g.liakhovetski@gmx.de>
 L:      linux-media@vger.kernel.org
@@ -12346,6 +12154,15 @@ M:	Chris Boot <bootc@bootc.net>
 S:      Maintained
 F:      drivers/leds/leds-net48xx.c
+SOFT-ROCE DRIVER (rxe)
+M:      Moni Shoua <monis@mellanox.com>
+L:      linux-rdma@vger.kernel.org
+S:      Supported
+W:      https://github.com/SoftRoCE/rxe-dev/wiki/rxe-dev:-Home
+Q:      http://patchwork.kernel.org/project/linux-rdma/list/
+F:      drivers/infiniband/sw/rxe/
+F:      include/uapi/rdma/rdma_user_rxe.h
 SOFTLOGIC 6x10 MPEG CODEC
 M:      Bluecherry Maintainers <maintainers@bluecherrydvr.com>
 M:      Anton Sviridenko <anton@corp.bluecherry.net>
@@ -12378,16 +12195,6 @@ S:	Maintained
 F:      drivers/ssb/
 F:      include/linux/ssb/
-SONY VAIO CONTROL DEVICE DRIVER
-M:      Mattia Dongili <malattia@linux.it>
-L:      platform-driver-x86@vger.kernel.org
-W:      http://www.linux.it/~malattia/wiki/index.php/Sony_drivers
-S:      Maintained
-F:      Documentation/laptops/sony-laptop.txt
-F:      drivers/char/sonypi.c
-F:      drivers/platform/x86/sony-laptop.c
-F:      include/linux/sony-laptop.h
 SONY MEMORYSTICK CARD SUPPORT
 M:      Alex Dubov <oakad@yahoo.com>
 W:      http://tifmxx.berlios.de/
@@ -12399,6 +12206,16 @@ M:	Maxim Levitsky <maximlevitsky@gmail.com>
 S:      Maintained
 F:      drivers/memstick/core/ms_block.*
+SONY VAIO CONTROL DEVICE DRIVER
+M:      Mattia Dongili <malattia@linux.it>
+L:      platform-driver-x86@vger.kernel.org
+W:      http://www.linux.it/~malattia/wiki/index.php/Sony_drivers
+S:      Maintained
+F:      Documentation/laptops/sony-laptop.txt
+F:      drivers/char/sonypi.c
+F:      drivers/platform/x86/sony-laptop.c
+F:      include/linux/sony-laptop.h
 SOUND
 M:      Jaroslav Kysela <perex@perex.cz>
 M:      Takashi Iwai <tiwai@suse.com>
@@ -12424,6 +12241,13 @@ F:	include/uapi/sound/compress_*
 F:      sound/core/compress_offload.c
 F:      sound/soc/soc-compress.c
+SOUND - DMAENGINE HELPERS
+M:      Lars-Peter Clausen <lars@metafoo.de>
+S:      Supported
+F:      include/sound/dmaengine_pcm.h
+F:      sound/core/pcm_dmaengine.c
+F:      sound/soc/soc-generic-dmaengine-pcm.c
 SOUND - SOC LAYER / DYNAMIC AUDIO POWER MANAGEMENT (ASoC)
 M:      Liam Girdwood <lgirdwood@gmail.com>
 M:      Mark Brown <broonie@kernel.org>
@@ -12436,13 +12260,6 @@ F:	Documentation/sound/alsa/soc/
 F:      sound/soc/
 F:      include/sound/soc*
-SOUND - DMAENGINE HELPERS
-M:      Lars-Peter Clausen <lars@metafoo.de>
-S:      Supported
-F:      include/sound/dmaengine_pcm.h
-F:      sound/core/pcm_dmaengine.c
-F:      sound/soc/soc-generic-dmaengine-pcm.c
 SP2 MEDIA DRIVER
 M:      Olli Salonen <olli.salonen@iki.fi>
 L:      linux-media@vger.kernel.org
@@ -12485,21 +12302,21 @@ T:	git git://git.kernel.org/pub/scm/devel/sparse/chrisl/sparse.git
 S:      Maintained
 F:      include/linux/compiler.h
-SPEAR PLATFORM SUPPORT
+SPEAR CLOCK FRAMEWORK SUPPORT
 M:      Viresh Kumar <vireshk@kernel.org>
-M:      Shiraz Hashim <shiraz.linux.kernel@gmail.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 W:      http://www.st.com/spear
 S:      Maintained
-F:      arch/arm/boot/dts/spear*
+F:      drivers/clk/spear/
-F:      arch/arm/mach-spear/
-SPEAR CLOCK FRAMEWORK SUPPORT
+SPEAR PLATFORM SUPPORT
 M:      Viresh Kumar <vireshk@kernel.org>
+M:      Shiraz Hashim <shiraz.linux.kernel@gmail.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 W:      http://www.st.com/spear
 S:      Maintained
-F:      drivers/clk/spear/
+F:      arch/arm/boot/dts/spear*
+F:      arch/arm/mach-spear/
 SPI NOR SUBSYSTEM
 M:      Cyrille Pitchen <cyrille.pitchen@wedev4u.fr>
@@ -12533,6 +12350,15 @@ S:	Supported
 F:      Documentation/networking/spider_net.txt
 F:      drivers/net/ethernet/toshiba/spider_net*
+SPMI SUBSYSTEM
+R:      Stephen Boyd <sboyd@codeaurora.org>
+L:      linux-arm-msm@vger.kernel.org
+F:      Documentation/devicetree/bindings/spmi/
+F:      drivers/spmi/
+F:      include/dt-bindings/spmi/spmi.h
+F:      include/linux/spmi.h
+F:      include/trace/events/spmi.h
 SPU FILE SYSTEM
 M:      Jeremy Kerr <jk@ozlabs.org>
 L:      linuxppc-dev@lists.ozlabs.org
@@ -12561,13 +12387,6 @@ L:	stable@vger.kernel.org
 S:      Supported
 F:      Documentation/process/stable-kernel-rules.rst
-STAGING SUBSYSTEM
-M:      Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
-L:      devel@driverdev.osuosl.org
-S:      Supported
-F:      drivers/staging/
 STAGING - COMEDI
 M:      Ian Abbott <abbotti@mev.co.uk>
 M:      H Hartley Sweeten <hsweeten@visionengravers.com>
@@ -12657,11 +12476,39 @@ M:	Arnaud Patard <arnaud.patard@rtp-net.org>
 S:      Odd Fixes
 F:      drivers/staging/xgifb/
+STAGING SUBSYSTEM
+M:      Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
+L:      devel@driverdev.osuosl.org
+S:      Supported
+F:      drivers/staging/
 STARFIRE/DURALAN NETWORK DRIVER
 M:      Ion Badulescu <ionut@badula.org>
 S:      Odd Fixes
 F:      drivers/net/ethernet/adaptec/starfire*
+STI CEC DRIVER
+M:      Benjamin Gaignard <benjamin.gaignard@linaro.org>
+S:      Maintained
+F:      drivers/staging/media/st-cec/
+F:      Documentation/devicetree/bindings/media/stih-cec.txt
+STK1160 USB VIDEO CAPTURE DRIVER
+M:      Ezequiel Garcia <ezequiel@vanguardiasur.com.ar>
+L:      linux-media@vger.kernel.org
+T:      git git://linuxtv.org/media_tree.git
+S:      Maintained
+F:      drivers/media/usb/stk1160/
+STMMAC ETHERNET DRIVER
+M:      Giuseppe Cavallaro <peppe.cavallaro@st.com>
+M:      Alexandre Torgue <alexandre.torgue@st.com>
+L:      netdev@vger.kernel.org
+W:      http://www.stlinux.com
+S:      Supported
+F:      drivers/net/ethernet/stmicro/stmmac/
 SUN3/3X
 M:      Sam Creasey <sammy@sammy.net>
 W:      http://sammy.net/sun3/
@@ -12733,6 +12580,20 @@ S:	Supported
 F:      net/switchdev/
 F:      include/net/switchdev.h
+SYNC FILE FRAMEWORK
+M:      Sumit Semwal <sumit.semwal@linaro.org>
+R:      Gustavo Padovan <gustavo@padovan.org>
+S:      Maintained
+L:      linux-media@vger.kernel.org
+L:      dri-devel@lists.freedesktop.org
+F:      drivers/dma-buf/sync_*
+F:      drivers/dma-buf/dma-fence*
+F:      drivers/dma-buf/sw_sync.c
+F:      include/linux/sync_file.h
+F:      include/uapi/linux/sync_file.h
+F:      Documentation/sync_file.txt
+T:      git git://anongit.freedesktop.org/drm/drm-misc
 SYNOPSYS ARC ARCHITECTURE
 M:      Vineet Gupta <vgupta@synopsys.com>
 L:      linux-snps-arc@lists.infradead.org
@@ -12751,6 +12612,35 @@ F:	arch/arc/plat-axs10x
 F:      arch/arc/boot/dts/ax*
 F:      Documentation/devicetree/bindings/arc/axs10*
+SYNOPSYS DESIGNWARE DMAC DRIVER
+M:      Viresh Kumar <vireshk@kernel.org>
+M:      Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+S:      Maintained
+F:      include/linux/dma/dw.h
+F:      include/linux/platform_data/dma-dw.h
+F:      drivers/dma/dw/
+SYNOPSYS DESIGNWARE ENTERPRISE ETHERNET DRIVER
+M:      Jie Deng <jiedeng@synopsys.com>
+L:      netdev@vger.kernel.org
+S:      Supported
+F:      drivers/net/ethernet/synopsys/
+SYNOPSYS DESIGNWARE I2C DRIVER
+M:      Jarkko Nikula <jarkko.nikula@linux.intel.com>
+R:      Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+R:      Mika Westerberg <mika.westerberg@linux.intel.com>
+L:      linux-i2c@vger.kernel.org
+S:      Maintained
+F:      drivers/i2c/busses/i2c-designware-*
+F:      include/linux/platform_data/i2c-designware.h
+SYNOPSYS DESIGNWARE MMC/SD/SDIO DRIVER
+M:      Jaehoon Chung <jh80.chung@samsung.com>
+L:      linux-mmc@vger.kernel.org
+S:      Maintained
+F:      drivers/mmc/host/dw_mmc*
 SYSTEM CONFIGURATION (SYSCON)
 M:      Lee Jones <lee.jones@linaro.org>
 M:      Arnd Bergmann <arnd@arndb.de>
@@ -12758,6 +12648,16 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd.git
 S:      Supported
 F:      drivers/mfd/syscon.c
+SYSTEM CONTROL & POWER INTERFACE (SCPI) Message Protocol drivers
+M:      Sudeep Holla <sudeep.holla@arm.com>
+L:      linux-arm-kernel@lists.infradead.org
+S:      Maintained
+F:      Documentation/devicetree/bindings/arm/arm,scpi.txt
+F:      drivers/clk/clk-scpi.c
+F:      drivers/cpufreq/scpi-cpufreq.c
+F:      drivers/firmware/arm_scpi.c
+F:      include/linux/scpi_protocol.h
 SYSTEM RESET/SHUTDOWN DRIVERS
 M:      Sebastian Reichel <sre@kernel.org>
 L:      linux-pm@vger.kernel.org
@@ -12766,6 +12666,15 @@ S:	Maintained
 F:      Documentation/devicetree/bindings/power/reset/
 F:      drivers/power/reset/
+SYSTEM TRACE MODULE CLASS
+M:      Alexander Shishkin <alexander.shishkin@linux.intel.com>
+S:      Maintained
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/ash/stm.git
+F:      Documentation/trace/stm.txt
+F:      drivers/hwtracing/stm/
+F:      include/linux/stm.h
+F:      include/uapi/linux/stm.h
 SYSV FILESYSTEM
 M:      Christoph Hellwig <hch@infradead.org>
 S:      Maintained
@@ -12935,6 +12844,14 @@ L:	linux-media@vger.kernel.org
 S:      Maintained
 F:      drivers/media/rc/ttusbir.c
+TEE SUBSYSTEM
+M:      Jens Wiklander <jens.wiklander@linaro.org>
+S:      Maintained
+F:      include/linux/tee_drv.h
+F:      include/uapi/linux/tee.h
+F:      drivers/tee/
+F:      Documentation/tee.txt
 TEGRA ARCHITECTURE SUPPORT
 M:      Thierry Reding <thierry.reding@gmail.com>
 M:      Jonathan Hunter <jonathanh@nvidia.com>
@@ -13066,6 +12983,23 @@ T:	git git://repo.or.cz/linux-2.6/linux-acpi-2.6/ibm-acpi-2.6.git
 S:      Maintained
 F:      drivers/platform/x86/thinkpad_acpi.c
+THUNDERBOLT DRIVER
+M:      Andreas Noever <andreas.noever@gmail.com>
+M:      Michael Jamet <michael.jamet@intel.com>
+M:      Mika Westerberg <mika.westerberg@linux.intel.com>
+M:      Yehezkel Bernat <yehezkel.bernat@intel.com>
+S:      Maintained
+F:      drivers/thunderbolt/
+TI AM437X VPFE DRIVER
+M:      "Lad, Prabhakar" <prabhakar.csengg@gmail.com>
+L:      linux-media@vger.kernel.org
+W:      https://linuxtv.org
+Q:      http://patchwork.linuxtv.org/project/linux-media/list/
+T:      git git://linuxtv.org/mhadli/v4l-dvb-davinci_devices.git
+S:      Maintained
+F:      drivers/media/platform/am437x/
 TI BANDGAP AND THERMAL DRIVER
 M:      Eduardo Valentin <edubezval@gmail.com>
 M:      Keerthy <j-keerthy@ti.com>
@@ -13074,13 +13008,11 @@ L:	linux-omap@vger.kernel.org
 S:      Maintained
 F:      drivers/thermal/ti-soc-thermal/
-TI VPE/CAL DRIVERS
+TI BQ27XXX POWER SUPPLY DRIVER
-M:      Benoit Parrot <bparrot@ti.com>
+R:      Andrew F. Davis <afd@ti.com>
-L:      linux-media@vger.kernel.org
+F:      include/linux/power/bq27xxx_battery.h
-W:      http://linuxtv.org/
+F:      drivers/power/supply/bq27xxx_battery.c
-Q:      http://patchwork.linuxtv.org/project/linux-media/list/
+F:      drivers/power/supply/bq27xxx_battery_i2c.c
-S:      Maintained
-F:      drivers/media/platform/ti-vpe/
 TI CDCE706 CLOCK DRIVER
 M:      Max Filippov <jcmvbkbc@gmail.com>
@@ -13094,6 +13026,33 @@ S:	Maintained
 F:      drivers/clk/ti/
 F:      include/linux/clk/ti.h
+TI DAVINCI MACHINE SUPPORT
+M:      Sekhar Nori <nsekhar@ti.com>
+M:      Kevin Hilman <khilman@kernel.org>
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/nsekhar/linux-davinci.git
+S:      Supported
+F:      arch/arm/mach-davinci/
+F:      drivers/i2c/busses/i2c-davinci.c
+F:      arch/arm/boot/dts/da850*
+TI DAVINCI SERIES GPIO DRIVER
+M:      Keerthy <j-keerthy@ti.com>
+L:      linux-gpio@vger.kernel.org
+S:      Maintained
+F:      Documentation/devicetree/bindings/gpio/gpio-davinci.txt
+F:      drivers/gpio/gpio-davinci.c
+TI DAVINCI SERIES MEDIA DRIVER
+M:      "Lad, Prabhakar" <prabhakar.csengg@gmail.com>
+L:      linux-media@vger.kernel.org
+W:      https://linuxtv.org
+Q:      http://patchwork.linuxtv.org/project/linux-media/list/
+T:      git git://linuxtv.org/mhadli/v4l-dvb-davinci_devices.git
+S:      Maintained
+F:      drivers/media/platform/davinci/
+F:      include/media/davinci/
 TI ETHERNET SWITCH DRIVER (CPSW)
 R:      Grygorii Strashko <grygorii.strashko@ti.com>
 L:      linux-omap@vger.kernel.org
@@ -13117,7 +13076,6 @@ S:	Maintained
 F:      drivers/soc/ti/*
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/ssantosh/linux-keystone.git
 TI LM49xxx FAMILY ASoC CODEC DRIVERS
 M:      M R Swami Reddy <mr.swami.reddy@ti.com>
 M:      Vishwas A Deshpande <vishwas.a.deshpande@ti.com>
@@ -13162,12 +13120,28 @@ L:	alsa-devel@alsa-project.org (moderated for non-subscribers)
 S:      Odd Fixes
 F:      sound/soc/codecs/tas571x*
+TI TRF7970A NFC DRIVER
+M:      Mark Greer <mgreer@animalcreek.com>
+L:      linux-wireless@vger.kernel.org
+L:      linux-nfc@lists.01.org (moderated for non-subscribers)
+S:      Supported
+F:      drivers/nfc/trf7970a.c
+F:      Documentation/devicetree/bindings/net/nfc/trf7970a.txt
 TI TWL4030 SERIES SOC CODEC DRIVER
 M:      Peter Ujfalusi <peter.ujfalusi@ti.com>
 L:      alsa-devel@alsa-project.org (moderated for non-subscribers)
 S:      Maintained
 F:      sound/soc/codecs/twl4030*
+TI VPE/CAL DRIVERS
+M:      Benoit Parrot <bparrot@ti.com>
+L:      linux-media@vger.kernel.org
+W:      http://linuxtv.org/
+Q:      http://patchwork.linuxtv.org/project/linux-media/list/
+S:      Maintained
+F:      drivers/media/platform/ti-vpe/
 TI WILINK WIRELESS DRIVERS
 L:      linux-wireless@vger.kernel.org
 W:      http://wireless.kernel.org/en/users/Drivers/wl12xx
@@ -13177,16 +13151,6 @@ S:	Orphan
 F:      drivers/net/wireless/ti/
 F:      include/linux/wl12xx.h
-TIPC NETWORK LAYER
-M:      Jon Maloy <jon.maloy@ericsson.com>
-M:      Ying Xue <ying.xue@windriver.com>
-L:      netdev@vger.kernel.org (core kernel code)
-L:      tipc-discussion@lists.sourceforge.net (user apps, general discussion)
-W:      http://tipc.sourceforge.net/
-S:      Maintained
-F:      include/uapi/linux/tipc*.h
-F:      net/tipc/
 TILE ARCHITECTURE
 M:      Chris Metcalf <cmetcalf@mellanox.com>
 W:      http://www.mellanox.com/repository/solutions/tile-scm/
@@ -13202,6 +13166,34 @@ F:	drivers/tty/serial/tilegx.c
 F:      drivers/usb/host/*-tilegx.c
 F:      include/linux/usb/tilegx.h
+TIMEKEEPING, CLOCKSOURCE CORE, NTP, ALARMTIMER
+M:      John Stultz <john.stultz@linaro.org>
+M:      Thomas Gleixner <tglx@linutronix.de>
+R:      Stephen Boyd <sboyd@codeaurora.org>
+L:      linux-kernel@vger.kernel.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git timers/core
+S:      Supported
+F:      include/linux/clocksource.h
+F:      include/linux/time.h
+F:      include/linux/timex.h
+F:      include/uapi/linux/time.h
+F:      include/uapi/linux/timex.h
+F:      kernel/time/clocksource.c
+F:      kernel/time/time*.c
+F:      kernel/time/alarmtimer.c
+F:      kernel/time/ntp.c
+F:      tools/testing/selftests/timers/
+TIPC NETWORK LAYER
+M:      Jon Maloy <jon.maloy@ericsson.com>
+M:      Ying Xue <ying.xue@windriver.com>
+L:      netdev@vger.kernel.org (core kernel code)
+L:      tipc-discussion@lists.sourceforge.net (user apps, general discussion)
+W:      http://tipc.sourceforge.net/
+S:      Maintained
+F:      include/uapi/linux/tipc*.h
+F:      net/tipc/
 TLAN NETWORK DRIVER
 M:      Samuel Chessman <chessman@tux.org>
 L:      tlan-devel@lists.sourceforge.net (subscribers-only)
@@ -13210,6 +13202,38 @@ S:	Maintained
 F:      Documentation/networking/tlan.txt
 F:      drivers/net/ethernet/ti/tlan.*
+TM6000 VIDEO4LINUX DRIVER
+M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
+M:      Mauro Carvalho Chehab <mchehab@kernel.org>
+L:      linux-media@vger.kernel.org
+W:      https://linuxtv.org
+T:      git git://linuxtv.org/media_tree.git
+S:      Odd fixes
+F:      drivers/media/usb/tm6000/
+F:      Documentation/media/v4l-drivers/tm6000*
+TMIO/SDHI MMC DRIVER
+M:      Wolfram Sang <wsa+renesas@sang-engineering.com>
+L:      linux-mmc@vger.kernel.org
+S:      Supported
+F:      drivers/mmc/host/tmio_mmc*
+F:      drivers/mmc/host/renesas_sdhi*
+F:      include/linux/mfd/tmio.h
+TMP401 HARDWARE MONITOR DRIVER
+M:      Guenter Roeck <linux@roeck-us.net>
+L:      linux-hwmon@vger.kernel.org
+S:      Maintained
+F:      Documentation/hwmon/tmp401
+F:      drivers/hwmon/tmp401.c
+TMPFS (SHMEM FILESYSTEM)
+M:      Hugh Dickins <hughd@google.com>
+L:      linux-mm@kvack.org
+S:      Maintained
+F:      include/linux/shmem_fs.h
+F:      mm/shmem.c
 TOMOYO SECURITY MODULE
 M:      Kentaro Takeda <takedakn@nttdata.co.jp>
 M:      Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
@@ -13246,12 +13270,6 @@ L:	platform-driver-x86@vger.kernel.org
 S:      Maintained
 F:      drivers/platform/x86/toshiba_haps.c
-TOSHIBA WMI HOTKEYS DRIVER
-M:      Azael Avalos <coproscefalo@gmail.com>
-L:      platform-driver-x86@vger.kernel.org
-S:      Maintained
-F:      drivers/platform/x86/toshiba-wmi.c
 TOSHIBA SMM DRIVER
 M:      Jonathan Buzzard <jonathan@buzzard.org.uk>
 W:      http://www.buzzard.org.uk/toshiba/
@@ -13267,62 +13285,11 @@ S:	Maintained
 F:      drivers/media/i2c/tc358743*
 F:      include/media/i2c/tc358743.h
-TMIO/SDHI MMC DRIVER
+TOSHIBA WMI HOTKEYS DRIVER
-M:      Wolfram Sang <wsa+renesas@sang-engineering.com>
+M:      Azael Avalos <coproscefalo@gmail.com>
-L:      linux-mmc@vger.kernel.org
+L:      platform-driver-x86@vger.kernel.org
-S:      Supported
-F:      drivers/mmc/host/tmio_mmc*
-F:      drivers/mmc/host/renesas_sdhi*
-F:      include/linux/mfd/tmio.h
-TMP401 HARDWARE MONITOR DRIVER
-M:      Guenter Roeck <linux@roeck-us.net>
-L:      linux-hwmon@vger.kernel.org
-S:      Maintained
-F:      Documentation/hwmon/tmp401
-F:      drivers/hwmon/tmp401.c
-TMPFS (SHMEM FILESYSTEM)
-M:      Hugh Dickins <hughd@google.com>
-L:      linux-mm@kvack.org
-S:      Maintained
-F:      include/linux/shmem_fs.h
-F:      mm/shmem.c
-TM6000 VIDEO4LINUX DRIVER
-M:      Mauro Carvalho Chehab <mchehab@s-opensource.com>
-M:      Mauro Carvalho Chehab <mchehab@kernel.org>
-L:      linux-media@vger.kernel.org
-W:      https://linuxtv.org
-T:      git git://linuxtv.org/media_tree.git
-S:      Odd fixes
-F:      drivers/media/usb/tm6000/
-F:      Documentation/media/v4l-drivers/tm6000*
-TW5864 VIDEO4LINUX DRIVER
-M:      Bluecherry Maintainers <maintainers@bluecherrydvr.com>
-M:      Anton Sviridenko <anton@corp.bluecherry.net>
-M:      Andrey Utkin <andrey.utkin@corp.bluecherry.net>
-M:      Andrey Utkin <andrey_utkin@fastmail.com>
-L:      linux-media@vger.kernel.org
-S:      Supported
-F:      drivers/media/pci/tw5864/
-TW68 VIDEO4LINUX DRIVER
-M:      Hans Verkuil <hverkuil@xs4all.nl>
-L:      linux-media@vger.kernel.org
-T:      git git://linuxtv.org/media_tree.git
-W:      https://linuxtv.org
-S:      Odd Fixes
-F:      drivers/media/pci/tw68/
-TW686X VIDEO4LINUX DRIVER
-M:      Ezequiel Garcia <ezequiel@vanguardiasur.com.ar>
-L:      linux-media@vger.kernel.org
-T:      git git://linuxtv.org/media_tree.git
-W:      http://linuxtv.org
 S:      Maintained
-F:      drivers/media/pci/tw686x/
+F:      drivers/platform/x86/toshiba-wmi.c
 TPM DEVICE DRIVER
 M:      Peter Huewe <peterhuewe@gmx.de>
@@ -13424,6 +13391,31 @@ S:	Maintained
 F:      drivers/tc/
 F:      include/linux/tc.h
+TW5864 VIDEO4LINUX DRIVER
+M:      Bluecherry Maintainers <maintainers@bluecherrydvr.com>
+M:      Anton Sviridenko <anton@corp.bluecherry.net>
+M:      Andrey Utkin <andrey.utkin@corp.bluecherry.net>
+M:      Andrey Utkin <andrey_utkin@fastmail.com>
+L:      linux-media@vger.kernel.org
+S:      Supported
+F:      drivers/media/pci/tw5864/
+TW68 VIDEO4LINUX DRIVER
+M:      Hans Verkuil <hverkuil@xs4all.nl>
+L:      linux-media@vger.kernel.org
+T:      git git://linuxtv.org/media_tree.git
+W:      https://linuxtv.org
+S:      Odd Fixes
+F:      drivers/media/pci/tw68/
+TW686X VIDEO4LINUX DRIVER
+M:      Ezequiel Garcia <ezequiel@vanguardiasur.com.ar>
+L:      linux-media@vger.kernel.org
+T:      git git://linuxtv.org/media_tree.git
+W:      http://linuxtv.org
+S:      Maintained
+F:      drivers/media/pci/tw686x/
 UBI FILE SYSTEM (UBIFS)
 M:      Richard Weinberger <richard@nod.at>
 M:      Artem Bityutskiy <dedekind1@gmail.com>
@@ -13473,6 +13465,13 @@ S:	Maintained
 F:      drivers/hid/uhid.c
 F:      include/uapi/linux/uhid.h
+ULPI BUS
+M:      Heikki Krogerus <heikki.krogerus@linux.intel.com>
+L:      linux-usb@vger.kernel.org
+S:      Maintained
+F:      drivers/usb/common/ulpi.c
+F:      include/linux/ulpi/
 ULTRA-WIDEBAND (UWB) SUBSYSTEM:
 L:      linux-usb@vger.kernel.org
 S:      Orphan
@@ -13533,6 +13532,14 @@ F:	drivers/mtd/ubi/
 F:      include/linux/mtd/ubi.h
 F:      include/uapi/mtd/ubi-user.h
+USB "USBNET" DRIVER FRAMEWORK
+M:      Oliver Neukum <oneukum@suse.com>
+L:      netdev@vger.kernel.org
+W:      http://www.linux-usb.org/usbnet
+S:      Maintained
+F:      drivers/net/usb/usbnet.c
+F:      include/linux/usb/usbnet.h
 USB ACM DRIVER
 M:      Oliver Neukum <oneukum@suse.com>
 L:      linux-usb@vger.kernel.org
@@ -13756,14 +13763,6 @@ L:	linux-usb@vger.kernel.org
 S:      Maintained
 F:      drivers/usb/host/uhci*
-USB "USBNET" DRIVER FRAMEWORK
-M:      Oliver Neukum <oneukum@suse.com>
-L:      netdev@vger.kernel.org
-W:      http://www.linux-usb.org/usbnet
-S:      Maintained
-F:      drivers/net/usb/usbnet.c
-F:      include/linux/usb/usbnet.h
 USB VIDEO CLASS
 M:      Laurent Pinchart <laurent.pinchart@ideasonboard.com>
 L:      linux-uvc-devel@lists.sourceforge.net (subscribers-only)
@@ -13818,13 +13817,6 @@ S:	Maintained
 F:      Documentation/media/v4l-drivers/zr364xx*
 F:      drivers/media/usb/zr364xx/
-ULPI BUS
-M:      Heikki Krogerus <heikki.krogerus@linux.intel.com>
-L:      linux-usb@vger.kernel.org
-S:      Maintained
-F:      drivers/usb/common/ulpi.c
-F:      include/linux/ulpi/
 USER-MODE LINUX (UML)
 M:      Jeff Dike <jdike@addtoit.com>
 M:      Richard Weinberger <richard@nod.at>
@@ -13918,6 +13910,37 @@ F:	drivers/gpu/vga/vga_switcheroo.c
 F:      include/linux/vga_switcheroo.h
 T:      git git://anongit.freedesktop.org/drm/drm-misc
+VIA RHINE NETWORK DRIVER
+S:      Orphan
+F:      drivers/net/ethernet/via/via-rhine.c
+VIA SD/MMC CARD CONTROLLER DRIVER
+M:      Bruce Chang <brucechang@via.com.tw>
+M:      Harald Welte <HaraldWelte@viatech.com>
+S:      Maintained
+F:      drivers/mmc/host/via-sdmmc.c
+VIA UNICHROME(PRO)/CHROME9 FRAMEBUFFER DRIVER
+M:      Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
+L:      linux-fbdev@vger.kernel.org
+S:      Maintained
+F:      include/linux/via-core.h
+F:      include/linux/via-gpio.h
+F:      include/linux/via_i2c.h
+F:      drivers/video/fbdev/via/
+VIA VELOCITY NETWORK DRIVER
+M:      Francois Romieu <romieu@fr.zoreil.com>
+L:      netdev@vger.kernel.org
+S:      Maintained
+F:      drivers/net/ethernet/via/via-velocity.*
+VIDEO MULTIPLEXER DRIVER
+M:      Philipp Zabel <p.zabel@pengutronix.de>
+L:      linux-media@vger.kernel.org
+S:      Maintained
+F:      drivers/media/platform/video-mux.c
 VIDEOBUF2 FRAMEWORK
 M:      Pawel Osciak <pawel@osciak.com>
 M:      Marek Szyprowski <m.szyprowski@samsung.com>
@@ -13927,11 +13950,20 @@ S:	Maintained
 F:      drivers/media/v4l2-core/videobuf2-*
 F:      include/media/videobuf2-*
-VIDEO MULTIPLEXER DRIVER
+VIMC VIRTUAL MEDIA CONTROLLER DRIVER
-M:      Philipp Zabel <p.zabel@pengutronix.de>
+M:      Helen Koike <helen.koike@collabora.com>
 L:      linux-media@vger.kernel.org
+T:      git git://linuxtv.org/media_tree.git
+W:      https://linuxtv.org
 S:      Maintained
-F:      drivers/media/platform/video-mux.c
+F:      drivers/media/platform/vimc/*
+VIRT LIB
+M:      Alex Williamson <alex.williamson@redhat.com>
+M:      Paolo Bonzini <pbonzini@redhat.com>
+L:      kvm@vger.kernel.org
+S:      Supported
+F:      virt/lib/
 VIRTIO AND VHOST VSOCK DRIVER
 M:      Stefan Hajnoczi <stefanha@redhat.com>
@@ -13949,12 +13981,6 @@ F:	drivers/net/vsockmon.c
 F:      drivers/vhost/vsock.c
 F:      drivers/vhost/vsock.h
-VIRTUAL SERIO DEVICE DRIVER
-M:      Stephen Chandler Paul <thatslyude@gmail.com>
-S:      Maintained
-F:      drivers/input/serio/userio.c
-F:      include/uapi/linux/userio.h
 VIRTIO CONSOLE DRIVER
 M:      Amit Shah <amit@kernel.org>
 L:      virtualization@lists.linux-foundation.org
@@ -13977,6 +14003,14 @@ F:	include/linux/virtio*.h
 F:      include/uapi/linux/virtio_*.h
 F:      drivers/crypto/virtio/
+VIRTIO CRYPTO DRIVER
+M:      Gonglei <arei.gonglei@huawei.com>
+L:      virtualization@lists.linux-foundation.org
+L:      linux-crypto@vger.kernel.org
+S:      Maintained
+F:      drivers/crypto/virtio/
+F:      include/uapi/linux/virtio_crypto.h
 VIRTIO DRIVERS FOR S390
 M:      Cornelia Huck <cohuck@redhat.com>
 M:      Halil Pasic <pasic@linux.vnet.ibm.com>
@@ -14013,45 +14047,11 @@ S:	Maintained
 F:      drivers/virtio/virtio_input.c
 F:      include/uapi/linux/virtio_input.h
-VIRTIO CRYPTO DRIVER
+VIRTUAL SERIO DEVICE DRIVER
-M:  Gonglei <arei.gonglei@huawei.com>
+M:      Stephen Chandler Paul <thatslyude@gmail.com>
-L:  virtualization@lists.linux-foundation.org
-L:  linux-crypto@vger.kernel.org
-S:  Maintained
-F:  drivers/crypto/virtio/
-F:  include/uapi/linux/virtio_crypto.h
-VIA RHINE NETWORK DRIVER
-S:      Orphan
-F:      drivers/net/ethernet/via/via-rhine.c
-VIA SD/MMC CARD CONTROLLER DRIVER
-M:      Bruce Chang <brucechang@via.com.tw>
-M:      Harald Welte <HaraldWelte@viatech.com>
-S:      Maintained
-F:      drivers/mmc/host/via-sdmmc.c
-VIA UNICHROME(PRO)/CHROME9 FRAMEBUFFER DRIVER
-M:      Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
-L:      linux-fbdev@vger.kernel.org
-S:      Maintained
-F:      include/linux/via-core.h
-F:      include/linux/via-gpio.h
-F:      include/linux/via_i2c.h
-F:      drivers/video/fbdev/via/
-VIA VELOCITY NETWORK DRIVER
-M:      Francois Romieu <romieu@fr.zoreil.com>
-L:      netdev@vger.kernel.org
 S:      Maintained
-F:      drivers/net/ethernet/via/via-velocity.*
+F:      drivers/input/serio/userio.c
+F:      include/uapi/linux/userio.h
-VIRT LIB
-M:      Alex Williamson <alex.williamson@redhat.com>
-M:      Paolo Bonzini <pbonzini@redhat.com>
-L:      kvm@vger.kernel.org
-S:      Supported
-F:      virt/lib/
 VIVID VIRTUAL VIDEO DRIVER
 M:      Hans Verkuil <hverkuil@xs4all.nl>
@@ -14061,14 +14061,6 @@ W:	https://linuxtv.org
 S:      Maintained
 F:      drivers/media/platform/vivid/*
-VIMC VIRTUAL MEDIA CONTROLLER DRIVER
-M:      Helen Koike <helen.koike@collabora.com>
-L:      linux-media@vger.kernel.org
-T:      git git://linuxtv.org/media_tree.git
-W:      https://linuxtv.org
-S:      Maintained
-F:      drivers/media/platform/vimc/*
 VLYNQ BUS
 M:      Florian Fainelli <f.fainelli@gmail.com>
 L:      openwrt-devel@lists.openwrt.org (subscribers-only)
@@ -14088,12 +14080,6 @@ F:	drivers/staging/vme/
 F:      drivers/vme/
 F:      include/linux/vme*
-VMWARE HYPERVISOR INTERFACE
-M:      Alok Kataria <akataria@vmware.com>
-L:      virtualization@lists.linux-foundation.org
-S:      Supported
-F:      arch/x86/kernel/cpu/vmware.c
 VMWARE BALLOON DRIVER
 M:      Xavier Deguillard <xdeguillard@vmware.com>
 M:      Philip Moltmann <moltmann@vmware.com>
@@ -14102,6 +14088,27 @@ L:	linux-kernel@vger.kernel.org
 S:      Maintained
 F:      drivers/misc/vmw_balloon.c
+VMWARE HYPERVISOR INTERFACE
+M:      Alok Kataria <akataria@vmware.com>
+L:      virtualization@lists.linux-foundation.org
+S:      Supported
+F:      arch/x86/kernel/cpu/vmware.c
+VMWARE PVRDMA DRIVER
+M:      Adit Ranadive <aditr@vmware.com>
+M:      VMware PV-Drivers <pv-drivers@vmware.com>
+L:      linux-rdma@vger.kernel.org
+S:      Maintained
+F:      drivers/infiniband/hw/vmw_pvrdma/
+VMware PVSCSI driver
+M:      Jim Gill <jgill@vmware.com>
+M:      VMware PV-Drivers <pv-drivers@vmware.com>
+L:      linux-scsi@vger.kernel.org
+S:      Maintained
+F:      drivers/scsi/vmw_pvscsi.c
+F:      drivers/scsi/vmw_pvscsi.h
 VMWARE VMMOUSE SUBDRIVER
 M:      "VMware Graphics" <linux-graphics-maintainer@vmware.com>
 M:      "VMware, Inc." <pv-drivers@vmware.com>
@@ -14117,21 +14124,6 @@ L:	netdev@vger.kernel.org
 S:      Maintained
 F:      drivers/net/vmxnet3/
-VMware PVSCSI driver
-M:      Jim Gill <jgill@vmware.com>
-M:      VMware PV-Drivers <pv-drivers@vmware.com>
-L:      linux-scsi@vger.kernel.org
-S:      Maintained
-F:      drivers/scsi/vmw_pvscsi.c
-F:      drivers/scsi/vmw_pvscsi.h
-VMWARE PVRDMA DRIVER
-M:      Adit Ranadive <aditr@vmware.com>
-M:      VMware PV-Drivers <pv-drivers@vmware.com>
-L:      linux-rdma@vger.kernel.org
-S:      Maintained
-F:      drivers/infiniband/hw/vmw_pvrdma/
 VOLTAGE AND CURRENT REGULATOR FRAMEWORK
 M:      Liam Girdwood <lgirdwood@gmail.com>
 M:      Mark Brown <broonie@kernel.org>
@@ -14230,6 +14222,27 @@ L:	linux-input@vger.kernel.org
 S:      Maintained
 F:      drivers/hid/hid-wiimote*
+WILOCITY WIL6210 WIRELESS DRIVER
+M:      Maya Erez <qca_merez@qca.qualcomm.com>
+L:      linux-wireless@vger.kernel.org
+L:      wil6210@qca.qualcomm.com
+S:      Supported
+W:      http://wireless.kernel.org/en/users/Drivers/wil6210
+F:      drivers/net/wireless/ath/wil6210/
+F:      include/uapi/linux/wil6210_uapi.h
+WIMAX STACK
+M:      Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
+M:      linux-wimax@intel.com
+L:      wimax@linuxwimax.org (subscribers-only)
+S:      Supported
+W:      http://linuxwimax.org
+F:      Documentation/wimax/README.wimax
+F:      include/linux/wimax/debug.h
+F:      include/net/wimax.h
+F:      include/uapi/linux/wimax.h
+F:      net/wimax/
 WINBOND CIR DRIVER
 M:      David Härdeman <david@hardeman.nu>
 S:      Maintained
@@ -14247,18 +14260,6 @@ L:	linux-gpio@vger.kernel.org
 S:      Maintained
 F:      drivers/gpio/gpio-ws16c48.c
-WIMAX STACK
-M:      Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
-M:      linux-wimax@intel.com
-L:      wimax@linuxwimax.org (subscribers-only)
-S:      Supported
-W:      http://linuxwimax.org
-F:      Documentation/wimax/README.wimax
-F:      include/linux/wimax/debug.h
-F:      include/net/wimax.h
-F:      include/uapi/linux/wimax.h
-F:      net/wimax/
 WISTRON LAPTOP BUTTON DRIVER
 M:      Miloslav Trmac <mitr@volny.cz>
 S:      Maintained
@@ -14343,15 +14344,6 @@ S:	Maintained
 F:      Documentation/x86/
 F:      arch/x86/
-X86 PLATFORM DRIVERS
-M:      Darren Hart <dvhart@infradead.org>
-M:      Andy Shevchenko <andy@infradead.org>
-L:      platform-driver-x86@vger.kernel.org
-T:      git git://git.infradead.org/users/dvhart/linux-platform-drivers-x86.git
-S:      Maintained
-F:      drivers/platform/x86/
-F:      drivers/platform/olpc/
 X86 MCE INFRASTRUCTURE
 M:      Tony Luck <tony.luck@intel.com>
 M:      Borislav Petkov <bp@alien8.de>
@@ -14364,6 +14356,15 @@ M:	Borislav Petkov <bp@alien8.de>
 S:      Maintained
 F:      arch/x86/kernel/cpu/microcode/*
+X86 PLATFORM DRIVERS
+M:      Darren Hart <dvhart@infradead.org>
+M:      Andy Shevchenko <andy@infradead.org>
+L:      platform-driver-x86@vger.kernel.org
+T:      git git://git.infradead.org/users/dvhart/linux-platform-drivers-x86.git
+S:      Maintained
+F:      drivers/platform/x86/
+F:      drivers/platform/olpc/
 X86 VDSO
 M:      Andy Lutomirski <luto@amacapital.net>
 L:      linux-kernel@vger.kernel.org
@@ -14380,20 +14381,13 @@ T:	git git://linuxtv.org/media_tree.git
 S:      Maintained
 F:      drivers/media/tuners/tuner-xc2028.*
-XEN HYPERVISOR INTERFACE
+XEN BLOCK SUBSYSTEM
-M:      Boris Ostrovsky <boris.ostrovsky@oracle.com>
+M:      Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
-M:      Juergen Gross <jgross@suse.com>
+M:      Roger Pau Monné <roger.pau@citrix.com>
 L:      xen-devel@lists.xenproject.org (moderated for non-subscribers)
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip.git
 S:      Supported
-F:      arch/x86/xen/
+F:      drivers/block/xen-blkback/*
-F:      drivers/*/xen-*front.c
+F:      drivers/block/xen*
-F:      drivers/xen/
-F:      arch/x86/include/asm/xen/
-F:      include/xen/
-F:      include/uapi/xen/
-F:      Documentation/ABI/stable/sysfs-hypervisor-xen
-F:      Documentation/ABI/testing/sysfs-hypervisor-xen
 XEN HYPERVISOR ARM
 M:      Stefano Stabellini <sstabellini@kernel.org>
@@ -14409,6 +14403,21 @@ S:	Maintained
 F:      arch/arm64/xen/
 F:      arch/arm64/include/asm/xen/
+XEN HYPERVISOR INTERFACE
+M:      Boris Ostrovsky <boris.ostrovsky@oracle.com>
+M:      Juergen Gross <jgross@suse.com>
+L:      xen-devel@lists.xenproject.org (moderated for non-subscribers)
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip.git
+S:      Supported
+F:      arch/x86/xen/
+F:      drivers/*/xen-*front.c
+F:      drivers/xen/
+F:      arch/x86/include/asm/xen/
+F:      include/xen/
+F:      include/uapi/xen/
+F:      Documentation/ABI/stable/sysfs-hypervisor-xen
+F:      Documentation/ABI/testing/sysfs-hypervisor-xen
 XEN NETWORK BACKEND DRIVER
 M:      Wei Liu <wei.liu2@citrix.com>
 M:      Paul Durrant <paul.durrant@citrix.com>
@@ -14424,14 +14433,6 @@ S:	Supported
 F:      arch/x86/pci/*xen*
 F:      drivers/pci/*xen*
-XEN BLOCK SUBSYSTEM
-M:      Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
-M:      Roger Pau Monné <roger.pau@citrix.com>
-L:      xen-devel@lists.xenproject.org (moderated for non-subscribers)
-S:      Supported
-F:      drivers/block/xen-blkback/*
-F:      drivers/block/xen*
 XEN PVSCSI DRIVERS
 M:      Juergen Gross <jgross@suse.com>
 L:      xen-devel@lists.xenproject.org (moderated for non-subscribers)
@@ -14508,6 +14509,13 @@ S:	Maintained
 F:      drivers/net/hamradio/yam*
 F:      include/linux/yam.h
+YAMA SECURITY MODULE
+M:      Kees Cook <keescook@chromium.org>
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git yama/tip
+S:      Supported
+F:      security/yama/
+F:      Documentation/admin-guide/LSM/Yama.rst
 YEALINK PHONE DRIVER
 M:      Henk Vergonet <Henk.Vergonet@gmail.com>
 L:      usbb2k-api-dev@nongnu.org
@@ -14542,23 +14550,23 @@ L:	zd1211-devs@lists.sourceforge.net (subscribers-only)
 S:      Maintained
 F:      drivers/net/wireless/zydas/zd1211rw/
-ZD1301_DEMOD MEDIA DRIVER
+ZD1301 MEDIA DRIVER
 M:      Antti Palosaari <crope@iki.fi>
 L:      linux-media@vger.kernel.org
 W:      https://linuxtv.org/
 W:      http://palosaari.fi/linux/
 Q:      https://patchwork.linuxtv.org/project/linux-media/list/
 S:      Maintained
-F:      drivers/media/dvb-frontends/zd1301_demod*
+F:      drivers/media/usb/dvb-usb-v2/zd1301*
-ZD1301 MEDIA DRIVER
+ZD1301_DEMOD MEDIA DRIVER
 M:      Antti Palosaari <crope@iki.fi>
 L:      linux-media@vger.kernel.org
 W:      https://linuxtv.org/
 W:      http://palosaari.fi/linux/
 Q:      https://patchwork.linuxtv.org/project/linux-media/list/
 S:      Maintained
-F:      drivers/media/usb/dvb-usb-v2/zd1301*
+F:      drivers/media/dvb-frontends/zd1301_demod*
 ZPOOL COMPRESSED PAGE STORAGE API
 M:      Dan Streetman <ddstreet@ieee.org>
diff --git a/Makefile b/Makefile
index b4fb9a1d1594..0662b5201d3e 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 4
 PATCHLEVEL = 13
 SUBLEVEL = 0
-EXTRAVERSION = -rc1
+EXTRAVERSION = -rc2
 NAME = Fearless Coyote
 # *DOCUMENTATION*
diff --git a/arch/alpha/include/uapi/asm/ioctls.h b/arch/alpha/include/uapi/asm/ioctls.h
index ff67b8373bf7..1cd7dc7d4870 100644
--- a/arch/alpha/include/uapi/asm/ioctls.h
+++ b/arch/alpha/include/uapi/asm/ioctls.h
@@ -100,7 +100,7 @@
 #define TIOCGPKT        _IOR('T', 0x38, int) /* Get packet mode state */
 #define TIOCGPTLCK      _IOR('T', 0x39, int) /* Get Pty lock state */
 #define TIOCGEXCL       _IOR('T', 0x40, int) /* Get exclusive mode state */
-#define TIOCGPTPEER     _IOR('T', 0x41, int) /* Safely open the slave */
+#define TIOCGPTPEER     _IO('T', 0x41) /* Safely open the slave */
 #define TIOCSERCONFIG   0x5453
 #define TIOCSERGWILD    0x5454
diff --git a/arch/arm/include/asm/bug.h b/arch/arm/include/asm/bug.h
index 4e6e88a6b2f4..2244a94ed9c9 100644
--- a/arch/arm/include/asm/bug.h
+++ b/arch/arm/include/asm/bug.h
@@ -37,7 +37,7 @@ do {								\
                ".pushsection .rodata.str, \"aMS\", %progbits, 1\n" \
                "2:\t.asciz " #__file "\n"                      \
                ".popsection\n"                                 \
-                ".pushsection __bug_table,\"a\"\n"              \
+                ".pushsection __bug_table,\"aw\"\n"             \
                ".align 2\n"                                    \
                "3:\t.word 1b, 2b\n"                            \
                "\t.hword " #__line ", 0\n"                     \
diff --git a/arch/arm/include/asm/cacheflush.h b/arch/arm/include/asm/cacheflush.h
index d69bebf697e7..74504b154256 100644
--- a/arch/arm/include/asm/cacheflush.h
+++ b/arch/arm/include/asm/cacheflush.h
@@ -116,7 +116,7 @@ struct cpu_cache_fns {
        void (*dma_unmap_area)(const void *, size_t, int);
        void (*dma_flush_range)(const void *, const void *);
-};
+} __no_randomize_layout;
 /*
 * Select the calling method
diff --git a/arch/arm64/include/asm/bug.h b/arch/arm64/include/asm/bug.h
index 366448eb0fb7..a02a57186f56 100644
--- a/arch/arm64/include/asm/bug.h
+++ b/arch/arm64/include/asm/bug.h
@@ -36,7 +36,7 @@
 #ifdef CONFIG_GENERIC_BUG
 #define __BUG_ENTRY(flags)                              \
-                ".pushsection __bug_table,\"a\"\n\t"    \
+                ".pushsection __bug_table,\"aw\"\n\t"   \
                ".align 2\n\t"                          \
        "0:     .long 1f - 0b\n\t"                      \
 _BUGVERBOSE_LOCATION(__FILE__, __LINE__)                \
diff --git a/arch/blackfin/include/asm/bug.h b/arch/blackfin/include/asm/bug.h
index 8d9b1eba89c4..76b2e82ee730 100644
--- a/arch/blackfin/include/asm/bug.h
+++ b/arch/blackfin/include/asm/bug.h
@@ -21,7 +21,7 @@
 #define _BUG_OR_WARN(flags)                                             \
        asm volatile(                                                   \
                "1:     .hword  %0\n"                                   \
-                "       .section __bug_table,\"a\",@progbits\n"         \
+                "       .section __bug_table,\"aw\",@progbits\n"        \
                "2:     .long   1b\n"                                   \
                "       .long   %1\n"                                   \
                "       .short  %2\n"                                   \
@@ -38,7 +38,7 @@
 #define _BUG_OR_WARN(flags)                                             \
        asm volatile(                                                   \
                "1:     .hword  %0\n"                                   \
-                "       .section __bug_table,\"a\",@progbits\n"         \
+                "       .section __bug_table,\"aw\",@progbits\n"        \
                "2:     .long   1b\n"                                   \
                "       .short  %1\n"                                   \
                "       .org    2b + %2\n"                              \
diff --git a/arch/blackfin/include/asm/flat.h b/arch/blackfin/include/asm/flat.h
index 296d7f56fbfd..f1d6ba7afbf2 100644
--- a/arch/blackfin/include/asm/flat.h
+++ b/arch/blackfin/include/asm/flat.h
@@ -44,8 +44,7 @@ flat_get_relocate_addr (unsigned long relval)
        return relval & 0x03ffffff; /* Mask out top 6 bits */
 }
-static inline int flat_set_persistent(unsigned long relval,
+static inline int flat_set_persistent(u32 relval, u32 *persistent)
-                                      unsigned long *persistent)
 {
        int type = (relval >> 26) & 7;
        if (type == 3) {
diff --git a/arch/blackfin/kernel/flat.c b/arch/blackfin/kernel/flat.c
index d29ab6a2e909..8ebc54daaa8e 100644
--- a/arch/blackfin/kernel/flat.c
+++ b/arch/blackfin/kernel/flat.c
@@ -32,7 +32,7 @@ unsigned long bfin_get_addr_from_rp(u32 *ptr,
                break;
        case FLAT_BFIN_RELOC_TYPE_32_BIT:
-                pr_debug("*ptr = %lx", get_unaligned(ptr));
+                pr_debug("*ptr = %x", get_unaligned(ptr));
                val = get_unaligned(ptr);
                break;
@@ -77,7 +77,7 @@ void bfin_put_addr_at_rp(u32 *ptr, u32 addr, u32 relval)
        case FLAT_BFIN_RELOC_TYPE_32_BIT:
                put_unaligned(addr, ptr);
-                pr_debug("new ptr =%lx", get_unaligned(ptr));
+                pr_debug("new ptr =%x", get_unaligned(ptr));
                break;
        }
 }
diff --git a/arch/h8300/include/asm/flat.h b/arch/h8300/include/asm/flat.h
index 18d024251738..7e0bd6fa1532 100644
--- a/arch/h8300/include/asm/flat.h
+++ b/arch/h8300/include/asm/flat.h
@@ -24,7 +24,7 @@ static inline int flat_get_addr_from_rp(u32 __user *rp, u32 relval, u32 flags,
                                        u32 *addr, u32 *persistent)
 {
        u32 val = get_unaligned((__force u32 *)rp);
-        if (!(flags & FLAT_FLAG_GOTPIC)
+        if (!(flags & FLAT_FLAG_GOTPIC))
                val &= 0x00ffffff;
        *addr = val;
        return 0;
diff --git a/arch/m68k/include/asm/flat.h b/arch/m68k/include/asm/flat.h
index 48b62790fe70..b2a41f5b3890 100644
--- a/arch/m68k/include/asm/flat.h
+++ b/arch/m68k/include/asm/flat.h
@@ -30,8 +30,7 @@ static inline int flat_put_addr_at_rp(u32 __user *rp, u32 addr, u32 rel)
 }
 #define flat_get_relocate_addr(rel)             (rel)
-static inline int flat_set_persistent(unsigned long relval,
+static inline int flat_set_persistent(u32 relval, u32 *persistent)
-                                      unsigned long *persistent)
 {
        return 0;
 }
diff --git a/arch/mips/include/uapi/asm/ioctls.h b/arch/mips/include/uapi/asm/ioctls.h
index 68e19b689a00..1609cb0907ac 100644
--- a/arch/mips/include/uapi/asm/ioctls.h
+++ b/arch/mips/include/uapi/asm/ioctls.h
@@ -91,7 +91,7 @@
 #define TIOCGPKT        _IOR('T', 0x38, int) /* Get packet mode state */
 #define TIOCGPTLCK      _IOR('T', 0x39, int) /* Get Pty lock state */
 #define TIOCGEXCL       _IOR('T', 0x40, int) /* Get exclusive mode state */
-#define TIOCGPTPEER     _IOR('T', 0x41, int) /* Safely open the slave */
+#define TIOCGPTPEER     _IO('T', 0x41) /* Safely open the slave */
 /* I hope the range from 0x5480 on is free ... */
 #define TIOCSCTTY       0x5480          /* become controlling tty */
diff --git a/arch/mn10300/include/asm/bug.h b/arch/mn10300/include/asm/bug.h
index aa6a38886391..811414fb002d 100644
--- a/arch/mn10300/include/asm/bug.h
+++ b/arch/mn10300/include/asm/bug.h
@@ -21,7 +21,7 @@ do {								\
        asm volatile(                                           \
                "       syscall 15                      \n"     \
                "0:                                     \n"     \
-                "       .section __bug_table,\"a\"      \n"     \
+                "       .section __bug_table,\"aw\"     \n"     \
                "       .long 0b,%0,%1                  \n"     \
                "       .previous                       \n"     \
                :                                               \
diff --git a/arch/parisc/include/asm/bug.h b/arch/parisc/include/asm/bug.h
index d2742273a685..07ea467f22fc 100644
--- a/arch/parisc/include/asm/bug.h
+++ b/arch/parisc/include/asm/bug.h
@@ -27,7 +27,7 @@
        do {                                                            \
                asm volatile("\n"                                       \
                             "1:\t" PARISC_BUG_BREAK_ASM "\n"           \
-                             "\t.pushsection __bug_table,\"a\"\n"       \
+                             "\t.pushsection __bug_table,\"aw\"\n"      \
                             "2:\t" ASM_WORD_INSN "1b, %c0\n"           \
                             "\t.short %c1, %c2\n"                      \
                             "\t.org 2b+%c3\n"                          \
@@ -50,7 +50,7 @@
        do {                                                            \
                asm volatile("\n"                                       \
                             "1:\t" PARISC_BUG_BREAK_ASM "\n"           \
-                             "\t.pushsection __bug_table,\"a\"\n"       \
+                             "\t.pushsection __bug_table,\"aw\"\n"      \
                             "2:\t" ASM_WORD_INSN "1b, %c0\n"           \
                             "\t.short %c1, %c2\n"                      \
                             "\t.org 2b+%c3\n"                          \
@@ -64,7 +64,7 @@
        do {                                                            \
                asm volatile("\n"                                       \
                             "1:\t" PARISC_BUG_BREAK_ASM "\n"           \
-                             "\t.pushsection __bug_table,\"a\"\n"       \
+                             "\t.pushsection __bug_table,\"aw\"\n"      \
                             "2:\t" ASM_WORD_INSN "1b\n"                \
                             "\t.short %c0\n"                           \
                             "\t.org 2b+%c1\n"                          \
diff --git a/arch/parisc/include/uapi/asm/ioctls.h b/arch/parisc/include/uapi/asm/ioctls.h
index 674c68a5bbd0..d0e3321403be 100644
--- a/arch/parisc/include/uapi/asm/ioctls.h
+++ b/arch/parisc/include/uapi/asm/ioctls.h
@@ -60,7 +60,7 @@
 #define TIOCGPKT        _IOR('T', 0x38, int) /* Get packet mode state */
 #define TIOCGPTLCK      _IOR('T', 0x39, int) /* Get Pty lock state */
 #define TIOCGEXCL       _IOR('T', 0x40, int) /* Get exclusive mode state */
-#define TIOCGPTPEER     _IOR('T', 0x41, int) /* Safely open the slave */
+#define TIOCGPTPEER     _IO('T', 0x41) /* Safely open the slave */
 #define FIONCLEX        0x5450  /* these numbers need to be adjusted. */
 #define FIOCLEX         0x5451
diff --git a/arch/powerpc/include/asm/book3s/64/hash.h b/arch/powerpc/include/asm/book3s/64/hash.h
index 0ce513f2926f..36fc7bfe9e11 100644
--- a/arch/powerpc/include/asm/book3s/64/hash.h
+++ b/arch/powerpc/include/asm/book3s/64/hash.h
@@ -91,6 +91,7 @@ static inline int hash__pgd_bad(pgd_t pgd)
 }
 #ifdef CONFIG_STRICT_KERNEL_RWX
 extern void hash__mark_rodata_ro(void);
+extern void hash__mark_initmem_nx(void);
 #endif
 extern void hpte_need_flush(struct mm_struct *mm, unsigned long addr,
diff --git a/arch/powerpc/include/asm/book3s/64/pgtable.h b/arch/powerpc/include/asm/book3s/64/pgtable.h
index c0737c86a362..d1da415e283c 100644
--- a/arch/powerpc/include/asm/book3s/64/pgtable.h
+++ b/arch/powerpc/include/asm/book3s/64/pgtable.h
@@ -1192,5 +1192,6 @@ static inline const int pud_pfn(pud_t pud)
        BUILD_BUG();
        return 0;
 }
 #endif /* __ASSEMBLY__ */
 #endif /* _ASM_POWERPC_BOOK3S_64_PGTABLE_H_ */
diff --git a/arch/powerpc/include/asm/book3s/64/radix.h b/arch/powerpc/include/asm/book3s/64/radix.h
index 487709ff6875..544440b5aff3 100644
--- a/arch/powerpc/include/asm/book3s/64/radix.h
+++ b/arch/powerpc/include/asm/book3s/64/radix.h
@@ -118,6 +118,7 @@
 #ifdef CONFIG_STRICT_KERNEL_RWX
 extern void radix__mark_rodata_ro(void);
+extern void radix__mark_initmem_nx(void);
 #endif
 static inline unsigned long __radix_pte_update(pte_t *ptep, unsigned long clr,
diff --git a/arch/powerpc/include/asm/bug.h b/arch/powerpc/include/asm/bug.h
index 0151af6c2a50..87fcc1948817 100644
--- a/arch/powerpc/include/asm/bug.h
+++ b/arch/powerpc/include/asm/bug.h
@@ -18,7 +18,7 @@
 #include <asm/asm-offsets.h>
 #ifdef CONFIG_DEBUG_BUGVERBOSE
 .macro EMIT_BUG_ENTRY addr,file,line,flags
-         .section __bug_table,"a"
+         .section __bug_table,"aw"
 5001:    PPC_LONG \addr, 5002f
         .short \line, \flags
         .org 5001b+BUG_ENTRY_SIZE
@@ -29,7 +29,7 @@
 .endm
 #else
 .macro EMIT_BUG_ENTRY addr,file,line,flags
-         .section __bug_table,"a"
+         .section __bug_table,"aw"
 5001:    PPC_LONG \addr
         .short \flags
         .org 5001b+BUG_ENTRY_SIZE
@@ -42,14 +42,14 @@
   sizeof(struct bug_entry), respectively */
 #ifdef CONFIG_DEBUG_BUGVERBOSE
 #define _EMIT_BUG_ENTRY                         \
-        ".section __bug_table,\"a\"\n"          \
+        ".section __bug_table,\"aw\"\n"         \
        "2:\t" PPC_LONG "1b, %0\n"              \
        "\t.short %1, %2\n"                     \
        ".org 2b+%3\n"                          \
        ".previous\n"
 #else
 #define _EMIT_BUG_ENTRY                         \
-        ".section __bug_table,\"a\"\n"          \
+        ".section __bug_table,\"aw\"\n"         \
        "2:\t" PPC_LONG "1b\n"                  \
        "\t.short %2\n"                         \
        ".org 2b+%3\n"                          \
diff --git a/arch/powerpc/include/asm/pgtable.h b/arch/powerpc/include/asm/pgtable.h
index dd01212935ac..afae9a336136 100644
--- a/arch/powerpc/include/asm/pgtable.h
+++ b/arch/powerpc/include/asm/pgtable.h
@@ -80,6 +80,13 @@ unsigned long vmalloc_to_phys(void *vmalloc_addr);
 void pgtable_cache_add(unsigned shift, void (*ctor)(void *));
 void pgtable_cache_init(void);
+#ifdef CONFIG_STRICT_KERNEL_RWX
+void mark_initmem_nx(void);
+#else
+static inline void mark_initmem_nx(void) { }
+#endif
 #endif /* __ASSEMBLY__ */
 #endif /* _ASM_POWERPC_PGTABLE_H */
diff --git a/arch/powerpc/include/uapi/asm/ioctls.h b/arch/powerpc/include/uapi/asm/ioctls.h
index bfd609a3e928..e3b10469f787 100644
--- a/arch/powerpc/include/uapi/asm/ioctls.h
+++ b/arch/powerpc/include/uapi/asm/ioctls.h
@@ -100,7 +100,7 @@
 #define TIOCGPKT        _IOR('T', 0x38, int) /* Get packet mode state */
 #define TIOCGPTLCK      _IOR('T', 0x39, int) /* Get Pty lock state */
 #define TIOCGEXCL       _IOR('T', 0x40, int) /* Get exclusive mode state */
-#define TIOCGPTPEER     _IOR('T', 0x41, int) /* Safely open the slave */
+#define TIOCGPTPEER     _IO('T', 0x41) /* Safely open the slave */
 #define TIOCSERCONFIG   0x5453
 #define TIOCSERGWILD    0x5454
diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index e6d8354d79ef..9029afd1fa2a 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -824,7 +824,7 @@ EXC_COMMON(trap_0b_common, 0xb00, unknown_exception)
 * r3 volatile parameter and return value for status
 * r4-r10 volatile input and output value
 * r11 volatile hypercall number and output value
- * r12 volatile
+ * r12 volatile input and output value
 * r13-r31 nonvolatile
 * LR nonvolatile
 * CTR volatile
@@ -834,25 +834,26 @@ EXC_COMMON(trap_0b_common, 0xb00, unknown_exception)
 * Other registers nonvolatile
 *
 * The intersection of volatile registers that don't contain possible
- * inputs is: r12, cr0, xer, ctr. We may use these as scratch regs
+ * inputs is: cr0, xer, ctr. We may use these as scratch regs upon entry
- * upon entry without saving.
+ * without saving, though xer is not a good idea to use, as hardware may
+ * interpret some bits so it may be costly to change them.
 */
 #ifdef CONFIG_KVM_BOOK3S_64_HANDLER
        /*
         * There is a little bit of juggling to get syscall and hcall
-         * working well. Save r10 in ctr to be restored in case it is a
+         * working well. Save r13 in ctr to avoid using SPRG scratch
-         * hcall.
+         * register.
         *
         * Userspace syscalls have already saved the PPR, hcalls must save
         * it before setting HMT_MEDIUM.
         */
 #define SYSCALL_KVMTEST                                                 \
-        mr      r12,r13;                                                \
+        mtctr   r13;                                                    \
        GET_PACA(r13);                                                  \
-        mtctr   r10;                                                    \
+        std     r10,PACA_EXGEN+EX_R10(r13);                             \
        KVMTEST_PR(0xc00); /* uses r10, branch to do_kvm_0xc00_system_call */ \
        HMT_MEDIUM;                                                     \
-        mr      r9,r12;                                                 \
+        mfctr   r9;
 #else
 #define SYSCALL_KVMTEST                                                 \
@@ -935,8 +936,8 @@ EXC_VIRT_END(system_call, 0x4c00, 0x100)
         * This is a hcall, so register convention is as above, with these
         * differences:
         * r13 = PACA
-         * r12 = orig r13
+         * ctr = orig r13
-         * ctr = orig r10
+         * orig r10 saved in PACA
         */
 TRAMP_KVM_BEGIN(do_kvm_0xc00)
         /*
@@ -944,14 +945,13 @@ TRAMP_KVM_BEGIN(do_kvm_0xc00)
          * HMT_MEDIUM. That allows the KVM code to save that value into the
          * guest state (it is the guest's PPR value).
          */
-        OPT_GET_SPR(r0, SPRN_PPR, CPU_FTR_HAS_PPR)
+        OPT_GET_SPR(r10, SPRN_PPR, CPU_FTR_HAS_PPR)
        HMT_MEDIUM
-        OPT_SAVE_REG_TO_PACA(PACA_EXGEN+EX_PPR, r0, CPU_FTR_HAS_PPR)
+        OPT_SAVE_REG_TO_PACA(PACA_EXGEN+EX_PPR, r10, CPU_FTR_HAS_PPR)
        mfctr   r10
-        SET_SCRATCH0(r12)
+        SET_SCRATCH0(r10)
        std     r9,PACA_EXGEN+EX_R9(r13)
        mfcr    r9
-        std     r10,PACA_EXGEN+EX_R10(r13)
        KVM_HANDLER(PACA_EXGEN, EXC_STD, 0xc00)
 #endif
diff --git a/arch/powerpc/kernel/idle_book3s.S b/arch/powerpc/kernel/idle_book3s.S
index 5adb390e773b..516ebef905c0 100644
--- a/arch/powerpc/kernel/idle_book3s.S
+++ b/arch/powerpc/kernel/idle_book3s.S
@@ -30,6 +30,7 @@
 * Use unused space in the interrupt stack to save and restore
 * registers for winkle support.
 */
+#define _MMCR0  GPR0
 #define _SDR1   GPR3
 #define _PTCR   GPR3
 #define _RPR    GPR4
@@ -272,6 +273,14 @@ power_enter_stop:
        b       pnv_wakeup_noloss
 .Lhandle_esl_ec_set:
+        /*
+         * POWER9 DD2 can incorrectly set PMAO when waking up after a
+         * state-loss idle. Saving and restoring MMCR0 over idle is a
+         * workaround.
+         */
+        mfspr   r4,SPRN_MMCR0
+        std     r4,_MMCR0(r1)
 /*
 * Check if the requested state is a deep idle state.
 */
@@ -450,10 +459,14 @@ ALT_FTR_SECTION_END_IFSET(CPU_FTR_ARCH_300)
 pnv_restore_hyp_resource_arch300:
        /*
         * Workaround for POWER9, if we lost resources, the ERAT
-         * might have been mixed up and needs flushing.
+         * might have been mixed up and needs flushing. We also need
+         * to reload MMCR0 (see comment above).
         */
        blt     cr3,1f
        PPC_INVALIDATE_ERAT
+        ld      r1,PACAR1(r13)
+        ld      r4,_MMCR0(r1)
+        mtspr   SPRN_MMCR0,r4
 1:
        /*
         * POWER ISA 3. Use PSSCR to determine if we
diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c
index 8541f18694a4..46b4e67d2372 100644
--- a/arch/powerpc/mm/mem.c
+++ b/arch/powerpc/mm/mem.c
@@ -402,6 +402,7 @@ void __init mem_init(void)
 void free_initmem(void)
 {
        ppc_md.progress = ppc_printk_progress;
+        mark_initmem_nx();
        free_initmem_default(POISON_FREE_INITMEM);
 }
diff --git a/arch/powerpc/mm/pgtable-hash64.c b/arch/powerpc/mm/pgtable-hash64.c
index 188b4107584d..443a2c66a304 100644
--- a/arch/powerpc/mm/pgtable-hash64.c
+++ b/arch/powerpc/mm/pgtable-hash64.c
@@ -425,33 +425,51 @@ int hash__has_transparent_hugepage(void)
 #endif /* CONFIG_TRANSPARENT_HUGEPAGE */
 #ifdef CONFIG_STRICT_KERNEL_RWX
-void hash__mark_rodata_ro(void)
+static bool hash__change_memory_range(unsigned long start, unsigned long end,
+                                      unsigned long newpp)
 {
-        unsigned long start = (unsigned long)_stext;
-        unsigned long end = (unsigned long)__init_begin;
        unsigned long idx;
        unsigned int step, shift;
-        unsigned long newpp = PP_RXXX;
        shift = mmu_psize_defs[mmu_linear_psize].shift;
        step = 1 << shift;
-        start = ((start + step - 1) >> shift) << shift;
+        start = ALIGN_DOWN(start, step);
-        end = (end >> shift) << shift;
+        end = ALIGN(end, step); // aligns up
-        pr_devel("marking ro start %lx, end %lx, step %x\n",
+        if (start >= end)
-                        start, end, step);
+                return false;
-        if (start == end) {
+        pr_debug("Changing page protection on range 0x%lx-0x%lx, to 0x%lx, step 0x%x\n",
-                pr_warn("could not set rodata ro, relocate the start"
+                 start, end, newpp, step);
-                        " of the kernel to a 0x%x boundary\n", step);
-                return;
-        }
        for (idx = start; idx < end; idx += step)
                /* Not sure if we can do much with the return value */
                mmu_hash_ops.hpte_updateboltedpp(newpp, idx, mmu_linear_psize,
                                                        mmu_kernel_ssize);
+        return true;
+}
+void hash__mark_rodata_ro(void)
+{
+        unsigned long start, end;
+        start = (unsigned long)_stext;
+        end = (unsigned long)__init_begin;
+        WARN_ON(!hash__change_memory_range(start, end, PP_RXXX));
+}
+void hash__mark_initmem_nx(void)
+{
+        unsigned long start, end, pp;
+        start = (unsigned long)__init_begin;
+        end = (unsigned long)__init_end;
+        pp = htab_convert_pte_flags(pgprot_val(PAGE_KERNEL));
+        WARN_ON(!hash__change_memory_range(start, end, pp));
 }
 #endif
diff --git a/arch/powerpc/mm/pgtable-radix.c b/arch/powerpc/mm/pgtable-radix.c
index 8c13e4282308..5cc50d47ce3f 100644
--- a/arch/powerpc/mm/pgtable-radix.c
+++ b/arch/powerpc/mm/pgtable-radix.c
@@ -112,10 +112,9 @@ set_the_pte:
 }
 #ifdef CONFIG_STRICT_KERNEL_RWX
-void radix__mark_rodata_ro(void)
+void radix__change_memory_range(unsigned long start, unsigned long end,
+                                unsigned long clear)
 {
-        unsigned long start = (unsigned long)_stext;
-        unsigned long end = (unsigned long)__init_begin;
        unsigned long idx;
        pgd_t *pgdp;
        pud_t *pudp;
@@ -125,7 +124,8 @@ void radix__mark_rodata_ro(void)
        start = ALIGN_DOWN(start, PAGE_SIZE);
        end = PAGE_ALIGN(end); // aligns up
-        pr_devel("marking ro start %lx, end %lx\n", start, end);
+        pr_debug("Changing flags on range %lx-%lx removing 0x%lx\n",
+                 start, end, clear);
        for (idx = start; idx < end; idx += PAGE_SIZE) {
                pgdp = pgd_offset_k(idx);
@@ -147,11 +147,29 @@ void radix__mark_rodata_ro(void)
                if (!ptep)
                        continue;
 update_the_pte:
-                radix__pte_update(&init_mm, idx, ptep, _PAGE_WRITE, 0, 0);
+                radix__pte_update(&init_mm, idx, ptep, clear, 0, 0);
        }
        radix__flush_tlb_kernel_range(start, end);
 }
+void radix__mark_rodata_ro(void)
+{
+        unsigned long start, end;
+        start = (unsigned long)_stext;
+        end = (unsigned long)__init_begin;
+        radix__change_memory_range(start, end, _PAGE_WRITE);
+}
+void radix__mark_initmem_nx(void)
+{
+        unsigned long start = (unsigned long)__init_begin;
+        unsigned long end = (unsigned long)__init_end;
+        radix__change_memory_range(start, end, _PAGE_EXEC);
+}
 #endif /* CONFIG_STRICT_KERNEL_RWX */
 static inline void __meminit print_mapping(unsigned long start,
diff --git a/arch/powerpc/mm/pgtable_64.c b/arch/powerpc/mm/pgtable_64.c
index 5c0b795d656c..0736e94c7615 100644
--- a/arch/powerpc/mm/pgtable_64.c
+++ b/arch/powerpc/mm/pgtable_64.c
@@ -505,4 +505,12 @@ void mark_rodata_ro(void)
        else
                hash__mark_rodata_ro();
 }
+void mark_initmem_nx(void)
+{
+        if (radix_enabled())
+                radix__mark_initmem_nx();
+        else
+                hash__mark_initmem_nx();
+}
 #endif
diff --git a/arch/powerpc/platforms/powernv/opal.c b/arch/powerpc/platforms/powernv/opal.c
index 9b87abb178f0..cad6b57ce494 100644
--- a/arch/powerpc/platforms/powernv/opal.c
+++ b/arch/powerpc/platforms/powernv/opal.c
@@ -78,7 +78,7 @@ void opal_configure_cores(void)
         *  ie. Host hash  supports  hash guests
         *      Host radix supports  hash/radix guests
         */
-        if (cpu_has_feature(CPU_FTR_ARCH_300)) {
+        if (early_cpu_has_feature(CPU_FTR_ARCH_300)) {
                reinit_flags |= OPAL_REINIT_CPUS_MMU_HASH;
                if (early_radix_enabled())
                        reinit_flags |= OPAL_REINIT_CPUS_MMU_RADIX;
diff --git a/arch/s390/include/asm/bug.h b/arch/s390/include/asm/bug.h
index 1bbd9dbfe4e0..ce9cc123988b 100644
--- a/arch/s390/include/asm/bug.h
+++ b/arch/s390/include/asm/bug.h
@@ -14,7 +14,7 @@
                ".section .rodata.str,\"aMS\",@progbits,1\n"    \
                "2:     .asciz  \""__FILE__"\"\n"               \
                ".previous\n"                                   \
-                ".section __bug_table,\"a\"\n"                  \
+                ".section __bug_table,\"aw\"\n"                 \
                "3:     .long   1b-3b,2b-3b\n"                  \
                "       .short  %0,%1\n"                        \
                "       .org    3b+%2\n"                        \
@@ -30,7 +30,7 @@
        asm volatile(                                   \
                "0:     j       0b+2\n"                 \
                "1:\n"                                  \
-                ".section __bug_table,\"a\"\n"          \
+                ".section __bug_table,\"aw\"\n"         \
                "2:     .long   1b-2b\n"                \
                "       .short  %0\n"                   \
                "       .org    2b+%1\n"                \
diff --git a/arch/sh/include/asm/bug.h b/arch/sh/include/asm/bug.h
index c9828f785ca0..5b5086367639 100644
--- a/arch/sh/include/asm/bug.h
+++ b/arch/sh/include/asm/bug.h
@@ -24,14 +24,14 @@
 */
 #ifdef CONFIG_DEBUG_BUGVERBOSE
 #define _EMIT_BUG_ENTRY                         \
-        "\t.pushsection __bug_table,\"a\"\n"    \
+        "\t.pushsection __bug_table,\"aw\"\n"   \
        "2:\t.long 1b, %O1\n"                   \
        "\t.short %O2, %O3\n"                   \
        "\t.org 2b+%O4\n"                       \
        "\t.popsection\n"
 #else
 #define _EMIT_BUG_ENTRY                         \
-        "\t.pushsection __bug_table,\"a\"\n"    \
+        "\t.pushsection __bug_table,\"aw\"\n"   \
        "2:\t.long 1b\n"                        \
        "\t.short %O3\n"                        \
        "\t.org 2b+%O4\n"                       \
diff --git a/arch/sh/include/uapi/asm/ioctls.h b/arch/sh/include/uapi/asm/ioctls.h
index eec7901e9e65..787bac9f67da 100644
--- a/arch/sh/include/uapi/asm/ioctls.h
+++ b/arch/sh/include/uapi/asm/ioctls.h
@@ -93,7 +93,7 @@
 #define TIOCGPKT        _IOR('T', 0x38, int) /* Get packet mode state */
 #define TIOCGPTLCK      _IOR('T', 0x39, int) /* Get Pty lock state */
 #define TIOCGEXCL       _IOR('T', 0x40, int) /* Get exclusive mode state */
-#define TIOCGPTPEER     _IOR('T', 0x41, int) /* Safely open the slave */
+#define TIOCGPTPEER     _IO('T', 0x41) /* Safely open the slave */
 #define TIOCSERCONFIG   _IO('T', 83) /* 0x5453 */
 #define TIOCSERGWILD    _IOR('T', 84,  int) /* 0x5454 */
diff --git a/arch/sparc/include/asm/trap_block.h b/arch/sparc/include/asm/trap_block.h
index ec9c04de3664..ff05992dae7a 100644
--- a/arch/sparc/include/asm/trap_block.h
+++ b/arch/sparc/include/asm/trap_block.h
@@ -54,6 +54,7 @@ extern struct trap_per_cpu trap_block[NR_CPUS];
 void init_cur_cpu_trap(struct thread_info *);
 void setup_tba(void);
 extern int ncpus_probed;
+extern u64 cpu_mondo_counter[NR_CPUS];
 unsigned long real_hard_smp_processor_id(void);
diff --git a/arch/sparc/include/uapi/asm/ioctls.h b/arch/sparc/include/uapi/asm/ioctls.h
index 6d27398632ea..f5df72b93bb2 100644
--- a/arch/sparc/include/uapi/asm/ioctls.h
+++ b/arch/sparc/include/uapi/asm/ioctls.h
@@ -88,7 +88,7 @@
 #define TIOCGPTN        _IOR('t', 134, unsigned int) /* Get Pty Number */
 #define TIOCSPTLCK      _IOW('t', 135, int) /* Lock/unlock PTY */
 #define TIOCSIG         _IOW('t', 136, int) /* Generate signal on Pty slave */
-#define TIOCGPTPEER     _IOR('t', 137, int) /* Safely open the slave */
+#define TIOCGPTPEER     _IO('t', 137) /* Safely open the slave */
 /* Little f */
 #define FIOCLEX         _IO('f', 1)
diff --git a/arch/sparc/kernel/pci_sun4v.c b/arch/sparc/kernel/pci_sun4v.c
index 24f21c726dfa..f10e2f712394 100644
--- a/arch/sparc/kernel/pci_sun4v.c
+++ b/arch/sparc/kernel/pci_sun4v.c
@@ -673,12 +673,14 @@ static void dma_4v_unmap_sg(struct device *dev, struct scatterlist *sglist,
 static int dma_4v_supported(struct device *dev, u64 device_mask)
 {
        struct iommu *iommu = dev->archdata.iommu;
-        u64 dma_addr_mask;
+        u64 dma_addr_mask = iommu->dma_addr_mask;
-        if (device_mask > DMA_BIT_MASK(32) && iommu->atu)
+        if (device_mask > DMA_BIT_MASK(32)) {
-                dma_addr_mask = iommu->atu->dma_addr_mask;
+                if (iommu->atu)
-        else
+                        dma_addr_mask = iommu->atu->dma_addr_mask;
-                dma_addr_mask = iommu->dma_addr_mask;
+                else
+                        return 0;
+        }
        if ((device_mask & dma_addr_mask) == dma_addr_mask)
                return 1;
diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c
index fdf31040a7dc..3218bc43302e 100644
--- a/arch/sparc/kernel/smp_64.c
+++ b/arch/sparc/kernel/smp_64.c
@@ -622,22 +622,48 @@ retry:
        }
 }
-/* Multi-cpu list version.  */
+#define CPU_MONDO_COUNTER(cpuid)        (cpu_mondo_counter[cpuid])
+#define MONDO_USEC_WAIT_MIN             2
+#define MONDO_USEC_WAIT_MAX             100
+#define MONDO_RETRY_LIMIT               500000
+/* Multi-cpu list version.
+ *
+ * Deliver xcalls to 'cnt' number of cpus in 'cpu_list'.
+ * Sometimes not all cpus receive the mondo, requiring us to re-send
+ * the mondo until all cpus have received, or cpus are truly stuck
+ * unable to receive mondo, and we timeout.
+ * Occasionally a target cpu strand is borrowed briefly by hypervisor to
+ * perform guest service, such as PCIe error handling. Consider the
+ * service time, 1 second overall wait is reasonable for 1 cpu.
+ * Here two in-between mondo check wait time are defined: 2 usec for
+ * single cpu quick turn around and up to 100usec for large cpu count.
+ * Deliver mondo to large number of cpus could take longer, we adjusts
+ * the retry count as long as target cpus are making forward progress.
+ */
 static void hypervisor_xcall_deliver(struct trap_per_cpu *tb, int cnt)
 {
-        int retries, this_cpu, prev_sent, i, saw_cpu_error;
+        int this_cpu, tot_cpus, prev_sent, i, rem;
+        int usec_wait, retries, tot_retries;
+        u16 first_cpu = 0xffff;
+        unsigned long xc_rcvd = 0;
        unsigned long status;
+        int ecpuerror_id = 0;
+        int enocpu_id = 0;
        u16 *cpu_list;
+        u16 cpu;
        this_cpu = smp_processor_id();
        cpu_list = __va(tb->cpu_list_pa);
+        usec_wait = cnt * MONDO_USEC_WAIT_MIN;
-        saw_cpu_error = 0;
+        if (usec_wait > MONDO_USEC_WAIT_MAX)
-        retries = 0;
+                usec_wait = MONDO_USEC_WAIT_MAX;
+        retries = tot_retries = 0;
+        tot_cpus = cnt;
        prev_sent = 0;
        do {
-                int forward_progress, n_sent;
+                int n_sent, mondo_delivered, target_cpu_busy;
                status = sun4v_cpu_mondo_send(cnt,
                                              tb->cpu_list_pa,
@@ -645,94 +671,113 @@ static void hypervisor_xcall_deliver(struct trap_per_cpu *tb, int cnt)
                /* HV_EOK means all cpus received the xcall, we're done.  */
                if (likely(status == HV_EOK))
-                        break;
+                        goto xcall_done;
+                /* If not these non-fatal errors, panic */
+                if (unlikely((status != HV_EWOULDBLOCK) &&
+                        (status != HV_ECPUERROR) &&
+                        (status != HV_ENOCPU)))
+                        goto fatal_errors;
                /* First, see if we made any forward progress.
                 *
+                 * Go through the cpu_list, count the target cpus that have
+                 * received our mondo (n_sent), and those that did not (rem).
+                 * Re-pack cpu_list with the cpus remain to be retried in the
+                 * front - this simplifies tracking the truly stalled cpus.
+                 *
                 * The hypervisor indicates successful sends by setting
                 * cpu list entries to the value 0xffff.
+                 *
+                 * EWOULDBLOCK means some target cpus did not receive the
+                 * mondo and retry usually helps.
+                 *
+                 * ECPUERROR means at least one target cpu is in error state,
+                 * it's usually safe to skip the faulty cpu and retry.
+                 *
+                 * ENOCPU means one of the target cpu doesn't belong to the
+                 * domain, perhaps offlined which is unexpected, but not
+                 * fatal and it's okay to skip the offlined cpu.
                 */
+                rem = 0;
                n_sent = 0;
                for (i = 0; i < cnt; i++) {
-                        if (likely(cpu_list[i] == 0xffff))
+                        cpu = cpu_list[i];
+                        if (likely(cpu == 0xffff)) {
                                n_sent++;
+                        } else if ((status == HV_ECPUERROR) &&
+                                (sun4v_cpu_state(cpu) == HV_CPU_STATE_ERROR)) {
+                                ecpuerror_id = cpu + 1;
+                        } else if (status == HV_ENOCPU && !cpu_online(cpu)) {
+                                enocpu_id = cpu + 1;
+                        } else {
+                                cpu_list[rem++] = cpu;
+                        }
                }
-                forward_progress = 0;
+                /* No cpu remained, we're done. */
-                if (n_sent > prev_sent)
+                if (rem == 0)
-                        forward_progress = 1;
+                        break;
-                prev_sent = n_sent;
+                /* Otherwise, update the cpu count for retry. */
+                cnt = rem;
-                /* If we get a HV_ECPUERROR, then one or more of the cpus
+                /* Record the overall number of mondos received by the
-                 * in the list are in error state.  Use the cpu_state()
+                 * first of the remaining cpus.
-                 * hypervisor call to find out which cpus are in error state.
                 */
-                if (unlikely(status == HV_ECPUERROR)) {
+                if (first_cpu != cpu_list[0]) {
-                        for (i = 0; i < cnt; i++) {
+                        first_cpu = cpu_list[0];
-                                long err;
+                        xc_rcvd = CPU_MONDO_COUNTER(first_cpu);
-                                u16 cpu;
+                }
-                                cpu = cpu_list[i];
+                /* Was any mondo delivered successfully? */
-                                if (cpu == 0xffff)
+                mondo_delivered = (n_sent > prev_sent);
-                                        continue;
+                prev_sent = n_sent;
-                                err = sun4v_cpu_state(cpu);
+                /* or, was any target cpu busy processing other mondos? */
-                                if (err == HV_CPU_STATE_ERROR) {
+                target_cpu_busy = (xc_rcvd < CPU_MONDO_COUNTER(first_cpu));
-                                        saw_cpu_error = (cpu + 1);
+                xc_rcvd = CPU_MONDO_COUNTER(first_cpu);
-                                        cpu_list[i] = 0xffff;
-                                }
-                        }
-                } else if (unlikely(status != HV_EWOULDBLOCK))
-                        goto fatal_mondo_error;
-                /* Don't bother rewriting the CPU list, just leave the
+                /* Retry count is for no progress. If we're making progress,
-                 * 0xffff and non-0xffff entries in there and the
+                 * reset the retry count.
-                 * hypervisor will do the right thing.
-                 *
-                 * Only advance timeout state if we didn't make any
-                 * forward progress.
                 */
-                if (unlikely(!forward_progress)) {
+                if (likely(mondo_delivered || target_cpu_busy)) {
-                        if (unlikely(++retries > 10000))
+                        tot_retries += retries;
-                                goto fatal_mondo_timeout;
+                        retries = 0;
+                } else if (unlikely(retries > MONDO_RETRY_LIMIT)) {
-                        /* Delay a little bit to let other cpus catch up
+                        goto fatal_mondo_timeout;
-                         * on their cpu mondo queue work.
-                         */
-                        udelay(2 * cnt);
                }
-        } while (1);
-        if (unlikely(saw_cpu_error))
+                /* Delay a little bit to let other cpus catch up on
-                goto fatal_mondo_cpu_error;
+                 * their cpu mondo queue work.
+                 */
+                if (!mondo_delivered)
+                        udelay(usec_wait);
-        return;
+                retries++;
+        } while (1);
-fatal_mondo_cpu_error:
+xcall_done:
-        printk(KERN_CRIT "CPU[%d]: SUN4V mondo cpu error, some target cpus "
+        if (unlikely(ecpuerror_id > 0)) {
-               "(including %d) were in error state\n",
+                pr_crit("CPU[%d]: SUN4V mondo cpu error, target cpu(%d) was in error state\n",
-               this_cpu, saw_cpu_error - 1);
+                       this_cpu, ecpuerror_id - 1);
+        } else if (unlikely(enocpu_id > 0)) {
+                pr_crit("CPU[%d]: SUN4V mondo cpu error, target cpu(%d) does not belong to the domain\n",
+                       this_cpu, enocpu_id - 1);
+        }
        return;
+fatal_errors:
+        /* fatal errors include bad alignment, etc */
+        pr_crit("CPU[%d]: Args were cnt(%d) cpulist_pa(%lx) mondo_block_pa(%lx)\n",
+               this_cpu, tot_cpus, tb->cpu_list_pa, tb->cpu_mondo_block_pa);
+        panic("Unexpected SUN4V mondo error %lu\n", status);
 fatal_mondo_timeout:
-        printk(KERN_CRIT "CPU[%d]: SUN4V mondo timeout, no forward "
+        /* some cpus being non-responsive to the cpu mondo */
-               " progress after %d retries.\n",
+        pr_crit("CPU[%d]: SUN4V mondo timeout, cpu(%d) made no forward progress after %d retries. Total target cpus(%d).\n",
-               this_cpu, retries);
+               this_cpu, first_cpu, (tot_retries + retries), tot_cpus);
-        goto dump_cpu_list_and_out;
+        panic("SUN4V mondo timeout panic\n");
-fatal_mondo_error:
-        printk(KERN_CRIT "CPU[%d]: Unexpected SUN4V mondo error %lu\n",
-               this_cpu, status);
-        printk(KERN_CRIT "CPU[%d]: Args were cnt(%d) cpulist_pa(%lx) "
-               "mondo_block_pa(%lx)\n",
-               this_cpu, cnt, tb->cpu_list_pa, tb->cpu_mondo_block_pa);
-dump_cpu_list_and_out:
-        printk(KERN_CRIT "CPU[%d]: CPU list [ ", this_cpu);
-        for (i = 0; i < cnt; i++)
-                printk("%u ", cpu_list[i]);
-        printk("]\n");
 }
 static void (*xcall_deliver_impl)(struct trap_per_cpu *, int);
diff --git a/arch/sparc/kernel/sun4v_ivec.S b/arch/sparc/kernel/sun4v_ivec.S
index 559bc5e9c199..34631995859a 100644
--- a/arch/sparc/kernel/sun4v_ivec.S
+++ b/arch/sparc/kernel/sun4v_ivec.S
@@ -26,6 +26,21 @@ sun4v_cpu_mondo:
        ldxa    [%g0] ASI_SCRATCHPAD, %g4
        sub     %g4, TRAP_PER_CPU_FAULT_INFO, %g4
+        /* Get smp_processor_id() into %g3 */
+        sethi   %hi(trap_block), %g5
+        or      %g5, %lo(trap_block), %g5
+        sub     %g4, %g5, %g3
+        srlx    %g3, TRAP_BLOCK_SZ_SHIFT, %g3
+        /* Increment cpu_mondo_counter[smp_processor_id()] */
+        sethi   %hi(cpu_mondo_counter), %g5
+        or      %g5, %lo(cpu_mondo_counter), %g5
+        sllx    %g3, 3, %g3
+        add     %g5, %g3, %g5
+        ldx     [%g5], %g3
+        add     %g3, 1, %g3
+        stx     %g3, [%g5]
        /* Get CPU mondo queue base phys address into %g7.  */
        ldx     [%g4 + TRAP_PER_CPU_CPU_MONDO_PA], %g7
diff --git a/arch/sparc/kernel/traps_64.c b/arch/sparc/kernel/traps_64.c
index 196ee5eb4d48..ad31af1dd726 100644
--- a/arch/sparc/kernel/traps_64.c
+++ b/arch/sparc/kernel/traps_64.c
@@ -2733,6 +2733,7 @@ void do_getpsr(struct pt_regs *regs)
        }
 }
+u64 cpu_mondo_counter[NR_CPUS] = {0};
 struct trap_per_cpu trap_block[NR_CPUS];
 EXPORT_SYMBOL(trap_block);
diff --git a/arch/x86/Kconfig.debug b/arch/x86/Kconfig.debug
index fcb7604172ce..cd20ca0b4043 100644
--- a/arch/x86/Kconfig.debug
+++ b/arch/x86/Kconfig.debug
@@ -348,6 +348,7 @@ config X86_DEBUG_FPU
 config PUNIT_ATOM_DEBUG
        tristate "ATOM Punit debug driver"
+        depends on PCI
        select DEBUG_FS
        select IOSF_MBI
        ---help---
diff --git a/arch/x86/boot/Makefile b/arch/x86/boot/Makefile
index 0d810fb15eac..d88a2fddba8c 100644
--- a/arch/x86/boot/Makefile
+++ b/arch/x86/boot/Makefile
@@ -73,12 +73,13 @@ UBSAN_SANITIZE := n
 $(obj)/bzImage: asflags-y  := $(SVGA_MODE)
 quiet_cmd_image = BUILD   $@
+silent_redirect_image = >/dev/null
 cmd_image = $(obj)/tools/build $(obj)/setup.bin $(obj)/vmlinux.bin \
-                               $(obj)/zoffset.h $@
+                               $(obj)/zoffset.h $@ $($(quiet)redirect_image)
 $(obj)/bzImage: $(obj)/setup.bin $(obj)/vmlinux.bin $(obj)/tools/build FORCE
        $(call if_changed,image)
-        @echo 'Kernel: $@ is ready' ' (#'`cat .version`')'
+        @$(kecho) 'Kernel: $@ is ready' ' (#'`cat .version`')'
 OBJCOPYFLAGS_vmlinux.bin := -O binary -R .note -R .comment -S
 $(obj)/vmlinux.bin: $(obj)/compressed/vmlinux FORCE
diff --git a/arch/x86/configs/i386_defconfig b/arch/x86/configs/i386_defconfig
index 6cf79e1a6830..0eb9f92f3717 100644
--- a/arch/x86/configs/i386_defconfig
+++ b/arch/x86/configs/i386_defconfig
@@ -1,5 +1,4 @@
 # CONFIG_64BIT is not set
-CONFIG_EXPERIMENTAL=y
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
@@ -125,7 +124,6 @@ CONFIG_NF_CONNTRACK_IPV4=y
 CONFIG_IP_NF_IPTABLES=y
 CONFIG_IP_NF_FILTER=y
 CONFIG_IP_NF_TARGET_REJECT=y
-CONFIG_IP_NF_TARGET_ULOG=y
 CONFIG_NF_NAT=y
 CONFIG_IP_NF_TARGET_MASQUERADE=y
 CONFIG_IP_NF_MANGLE=y
@@ -255,7 +253,6 @@ CONFIG_USB_OHCI_HCD=y
 CONFIG_USB_UHCI_HCD=y
 CONFIG_USB_PRINTER=y
 CONFIG_USB_STORAGE=y
-CONFIG_USB_LIBUSUAL=y
 CONFIG_EDAC=y
 CONFIG_RTC_CLASS=y
 # CONFIG_RTC_HCTOSYS is not set
diff --git a/arch/x86/configs/x86_64_defconfig b/arch/x86/configs/x86_64_defconfig
index de45f57b410d..4a4b16e56d35 100644
--- a/arch/x86/configs/x86_64_defconfig
+++ b/arch/x86/configs/x86_64_defconfig
@@ -1,4 +1,3 @@
-CONFIG_EXPERIMENTAL=y
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
@@ -124,7 +123,6 @@ CONFIG_NF_CONNTRACK_IPV4=y
 CONFIG_IP_NF_IPTABLES=y
 CONFIG_IP_NF_FILTER=y
 CONFIG_IP_NF_TARGET_REJECT=y
-CONFIG_IP_NF_TARGET_ULOG=y
 CONFIG_NF_NAT=y
 CONFIG_IP_NF_TARGET_MASQUERADE=y
 CONFIG_IP_NF_MANGLE=y
@@ -251,7 +249,6 @@ CONFIG_USB_OHCI_HCD=y
 CONFIG_USB_UHCI_HCD=y
 CONFIG_USB_PRINTER=y
 CONFIG_USB_STORAGE=y
-CONFIG_USB_LIBUSUAL=y
 CONFIG_EDAC=y
 CONFIG_RTC_CLASS=y
 # CONFIG_RTC_HCTOSYS is not set
diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
index ff1ea2fb9705..8e3db8f642a7 100644
--- a/arch/x86/events/core.c
+++ b/arch/x86/events/core.c
@@ -191,8 +191,8 @@ static void release_pmc_hardware(void) {}
 static bool check_hw_exists(void)
 {
-        u64 val, val_fail, val_new= ~0;
+        u64 val, val_fail = -1, val_new= ~0;
-        int i, reg, reg_fail, ret = 0;
+        int i, reg, reg_fail = -1, ret = 0;
        int bios_fail = 0;
        int reg_safe = -1;
diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index aa62437d1aa1..98b0f0729527 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -1708,6 +1708,120 @@ static __initconst const u64 glm_hw_cache_extra_regs
        },
 };
+static __initconst const u64 glp_hw_cache_event_ids
+                                [PERF_COUNT_HW_CACHE_MAX]
+                                [PERF_COUNT_HW_CACHE_OP_MAX]
+                                [PERF_COUNT_HW_CACHE_RESULT_MAX] = {
+        [C(L1D)] = {
+                [C(OP_READ)] = {
+                        [C(RESULT_ACCESS)]      = 0x81d0,       /* MEM_UOPS_RETIRED.ALL_LOADS */
+                        [C(RESULT_MISS)]        = 0x0,
+                },
+                [C(OP_WRITE)] = {
+                        [C(RESULT_ACCESS)]      = 0x82d0,       /* MEM_UOPS_RETIRED.ALL_STORES */
+                        [C(RESULT_MISS)]        = 0x0,
+                },
+                [C(OP_PREFETCH)] = {
+                        [C(RESULT_ACCESS)]      = 0x0,
+                        [C(RESULT_MISS)]        = 0x0,
+                },
+        },
+        [C(L1I)] = {
+                [C(OP_READ)] = {
+                        [C(RESULT_ACCESS)]      = 0x0380,       /* ICACHE.ACCESSES */
+                        [C(RESULT_MISS)]        = 0x0280,       /* ICACHE.MISSES */
+                },
+                [C(OP_WRITE)] = {
+                        [C(RESULT_ACCESS)]      = -1,
+                        [C(RESULT_MISS)]        = -1,
+                },
+                [C(OP_PREFETCH)] = {
+                        [C(RESULT_ACCESS)]      = 0x0,
+                        [C(RESULT_MISS)]        = 0x0,
+                },
+        },
+        [C(LL)] = {
+                [C(OP_READ)] = {
+                        [C(RESULT_ACCESS)]      = 0x1b7,        /* OFFCORE_RESPONSE */
+                        [C(RESULT_MISS)]        = 0x1b7,        /* OFFCORE_RESPONSE */
+                },
+                [C(OP_WRITE)] = {
+                        [C(RESULT_ACCESS)]      = 0x1b7,        /* OFFCORE_RESPONSE */
+                        [C(RESULT_MISS)]        = 0x1b7,        /* OFFCORE_RESPONSE */
+                },
+                [C(OP_PREFETCH)] = {
+                        [C(RESULT_ACCESS)]      = 0x0,
+                        [C(RESULT_MISS)]        = 0x0,
+                },
+        },
+        [C(DTLB)] = {
+                [C(OP_READ)] = {
+                        [C(RESULT_ACCESS)]      = 0x81d0,       /* MEM_UOPS_RETIRED.ALL_LOADS */
+                        [C(RESULT_MISS)]        = 0xe08,        /* DTLB_LOAD_MISSES.WALK_COMPLETED */
+                },
+                [C(OP_WRITE)] = {
+                        [C(RESULT_ACCESS)]      = 0x82d0,       /* MEM_UOPS_RETIRED.ALL_STORES */
+                        [C(RESULT_MISS)]        = 0xe49,        /* DTLB_STORE_MISSES.WALK_COMPLETED */
+                },
+                [C(OP_PREFETCH)] = {
+                        [C(RESULT_ACCESS)]      = 0x0,
+                        [C(RESULT_MISS)]        = 0x0,
+                },
+        },
+        [C(ITLB)] = {
+                [C(OP_READ)] = {
+                        [C(RESULT_ACCESS)]      = 0x00c0,       /* INST_RETIRED.ANY_P */
+                        [C(RESULT_MISS)]        = 0x0481,       /* ITLB.MISS */
+                },
+                [C(OP_WRITE)] = {
+                        [C(RESULT_ACCESS)]      = -1,
+                        [C(RESULT_MISS)]        = -1,
+                },
+                [C(OP_PREFETCH)] = {
+                        [C(RESULT_ACCESS)]      = -1,
+                        [C(RESULT_MISS)]        = -1,
+                },
+        },
+        [C(BPU)] = {
+                [C(OP_READ)] = {
+                        [C(RESULT_ACCESS)]      = 0x00c4,       /* BR_INST_RETIRED.ALL_BRANCHES */
+                        [C(RESULT_MISS)]        = 0x00c5,       /* BR_MISP_RETIRED.ALL_BRANCHES */
+                },
+                [C(OP_WRITE)] = {
+                        [C(RESULT_ACCESS)]      = -1,
+                        [C(RESULT_MISS)]        = -1,
+                },
+                [C(OP_PREFETCH)] = {
+                        [C(RESULT_ACCESS)]      = -1,
+                        [C(RESULT_MISS)]        = -1,
+                },
+        },
+};
+static __initconst const u64 glp_hw_cache_extra_regs
+                                [PERF_COUNT_HW_CACHE_MAX]
+                                [PERF_COUNT_HW_CACHE_OP_MAX]
+                                [PERF_COUNT_HW_CACHE_RESULT_MAX] = {
+        [C(LL)] = {
+                [C(OP_READ)] = {
+                        [C(RESULT_ACCESS)]      = GLM_DEMAND_READ|
+                                                  GLM_LLC_ACCESS,
+                        [C(RESULT_MISS)]        = GLM_DEMAND_READ|
+                                                  GLM_LLC_MISS,
+                },
+                [C(OP_WRITE)] = {
+                        [C(RESULT_ACCESS)]      = GLM_DEMAND_WRITE|
+                                                  GLM_LLC_ACCESS,
+                        [C(RESULT_MISS)]        = GLM_DEMAND_WRITE|
+                                                  GLM_LLC_MISS,
+                },
+                [C(OP_PREFETCH)] = {
+                        [C(RESULT_ACCESS)]      = 0x0,
+                        [C(RESULT_MISS)]        = 0x0,
+                },
+        },
+};
 #define KNL_OT_L2_HITE          BIT_ULL(19) /* Other Tile L2 Hit */
 #define KNL_OT_L2_HITF          BIT_ULL(20) /* Other Tile L2 Hit */
 #define KNL_MCDRAM_LOCAL        BIT_ULL(21)
@@ -3016,6 +3130,9 @@ static int hsw_hw_config(struct perf_event *event)
        return 0;
 }
+static struct event_constraint counter0_constraint =
+                        INTEL_ALL_EVENT_CONSTRAINT(0, 0x1);
 static struct event_constraint counter2_constraint =
                        EVENT_CONSTRAINT(0, 0x4, 0);
@@ -3037,6 +3154,21 @@ hsw_get_event_constraints(struct cpu_hw_events *cpuc, int idx,
        return c;
 }
+static struct event_constraint *
+glp_get_event_constraints(struct cpu_hw_events *cpuc, int idx,
+                          struct perf_event *event)
+{
+        struct event_constraint *c;
+        /* :ppp means to do reduced skid PEBS which is PMC0 only. */
+        if (event->attr.precise_ip == 3)
+                return &counter0_constraint;
+        c = intel_get_event_constraints(cpuc, idx, event);
+        return c;
+}
 /*
 * Broadwell:
 *
@@ -3265,10 +3397,8 @@ static void intel_pmu_cpu_dying(int cpu)
 static void intel_pmu_sched_task(struct perf_event_context *ctx,
                                 bool sched_in)
 {
-        if (x86_pmu.pebs_active)
+        intel_pmu_pebs_sched_task(ctx, sched_in);
-                intel_pmu_pebs_sched_task(ctx, sched_in);
+        intel_pmu_lbr_sched_task(ctx, sched_in);
-        if (x86_pmu.lbr_nr)
-                intel_pmu_lbr_sched_task(ctx, sched_in);
 }
 PMU_FORMAT_ATTR(offcore_rsp, "config1:0-63");
@@ -3838,6 +3968,32 @@ __init int intel_pmu_init(void)
                pr_cont("Goldmont events, ");
                break;
+        case INTEL_FAM6_ATOM_GEMINI_LAKE:
+                memcpy(hw_cache_event_ids, glp_hw_cache_event_ids,
+                       sizeof(hw_cache_event_ids));
+                memcpy(hw_cache_extra_regs, glp_hw_cache_extra_regs,
+                       sizeof(hw_cache_extra_regs));
+                intel_pmu_lbr_init_skl();
+                x86_pmu.event_constraints = intel_slm_event_constraints;
+                x86_pmu.pebs_constraints = intel_glp_pebs_event_constraints;
+                x86_pmu.extra_regs = intel_glm_extra_regs;
+                /*
+                 * It's recommended to use CPU_CLK_UNHALTED.CORE_P + NPEBS
+                 * for precise cycles.
+                 */
+                x86_pmu.pebs_aliases = NULL;
+                x86_pmu.pebs_prec_dist = true;
+                x86_pmu.lbr_pt_coexist = true;
+                x86_pmu.flags |= PMU_FL_HAS_RSP_1;
+                x86_pmu.get_event_constraints = glp_get_event_constraints;
+                x86_pmu.cpu_events = glm_events_attrs;
+                /* Goldmont Plus has 4-wide pipeline */
+                event_attr_td_total_slots_scale_glm.event_str = "4";
+                pr_cont("Goldmont plus events, ");
+                break;
        case INTEL_FAM6_WESTMERE:
        case INTEL_FAM6_WESTMERE_EP:
        case INTEL_FAM6_WESTMERE_EX:
diff --git a/arch/x86/events/intel/cstate.c b/arch/x86/events/intel/cstate.c
index 238ae3248ba5..4cf100ff2a37 100644
--- a/arch/x86/events/intel/cstate.c
+++ b/arch/x86/events/intel/cstate.c
@@ -40,16 +40,16 @@
 * Model specific counters:
 *      MSR_CORE_C1_RES: CORE C1 Residency Counter
 *                       perf code: 0x00
- *                       Available model: SLM,AMT
+ *                       Available model: SLM,AMT,GLM
 *                       Scope: Core (each processor core has a MSR)
 *      MSR_CORE_C3_RESIDENCY: CORE C3 Residency Counter
 *                             perf code: 0x01
- *                             Available model: NHM,WSM,SNB,IVB,HSW,BDW,SKL
+ *                             Available model: NHM,WSM,SNB,IVB,HSW,BDW,SKL,GLM
 *                             Scope: Core
 *      MSR_CORE_C6_RESIDENCY: CORE C6 Residency Counter
 *                             perf code: 0x02
 *                             Available model: SLM,AMT,NHM,WSM,SNB,IVB,HSW,BDW
- *                                              SKL,KNL
+ *                                              SKL,KNL,GLM
 *                             Scope: Core
 *      MSR_CORE_C7_RESIDENCY: CORE C7 Residency Counter
 *                             perf code: 0x03
@@ -57,16 +57,17 @@
 *                             Scope: Core
 *      MSR_PKG_C2_RESIDENCY:  Package C2 Residency Counter.
 *                             perf code: 0x00
- *                             Available model: SNB,IVB,HSW,BDW,SKL,KNL
+ *                             Available model: SNB,IVB,HSW,BDW,SKL,KNL,GLM
 *                             Scope: Package (physical package)
 *      MSR_PKG_C3_RESIDENCY:  Package C3 Residency Counter.
 *                             perf code: 0x01
 *                             Available model: NHM,WSM,SNB,IVB,HSW,BDW,SKL,KNL
+ *                                              GLM
 *                             Scope: Package (physical package)
 *      MSR_PKG_C6_RESIDENCY:  Package C6 Residency Counter.
 *                             perf code: 0x02
 *                             Available model: SLM,AMT,NHM,WSM,SNB,IVB,HSW,BDW
- *                                              SKL,KNL
+ *                                              SKL,KNL,GLM
 *                             Scope: Package (physical package)
 *      MSR_PKG_C7_RESIDENCY:  Package C7 Residency Counter.
 *                             perf code: 0x03
@@ -82,7 +83,7 @@
 *                             Scope: Package (physical package)
 *      MSR_PKG_C10_RESIDENCY: Package C10 Residency Counter.
 *                             perf code: 0x06
- *                             Available model: HSW ULT only
+ *                             Available model: HSW ULT, GLM
 *                             Scope: Package (physical package)
 *
 */
@@ -504,6 +505,17 @@ static const struct cstate_model knl_cstates __initconst = {
 };
+static const struct cstate_model glm_cstates __initconst = {
+        .core_events            = BIT(PERF_CSTATE_CORE_C1_RES) |
+                                  BIT(PERF_CSTATE_CORE_C3_RES) |
+                                  BIT(PERF_CSTATE_CORE_C6_RES),
+        .pkg_events             = BIT(PERF_CSTATE_PKG_C2_RES) |
+                                  BIT(PERF_CSTATE_PKG_C3_RES) |
+                                  BIT(PERF_CSTATE_PKG_C6_RES) |
+                                  BIT(PERF_CSTATE_PKG_C10_RES),
+};
 #define X86_CSTATES_MODEL(model, states)                                \
        { X86_VENDOR_INTEL, 6, model, X86_FEATURE_ANY, (unsigned long) &(states) }
@@ -546,6 +558,8 @@ static const struct x86_cpu_id intel_cstates_match[] __initconst = {
        X86_CSTATES_MODEL(INTEL_FAM6_XEON_PHI_KNL, knl_cstates),
        X86_CSTATES_MODEL(INTEL_FAM6_XEON_PHI_KNM, knl_cstates),
+        X86_CSTATES_MODEL(INTEL_FAM6_ATOM_GOLDMONT, glm_cstates),
        { },
 };
 MODULE_DEVICE_TABLE(x86cpu, intel_cstates_match);
diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c
index c6d23ffe422d..a322fed5f8ed 100644
--- a/arch/x86/events/intel/ds.c
+++ b/arch/x86/events/intel/ds.c
@@ -606,12 +606,6 @@ static inline void intel_pmu_drain_pebs_buffer(void)
        x86_pmu.drain_pebs(&regs);
 }
-void intel_pmu_pebs_sched_task(struct perf_event_context *ctx, bool sched_in)
-{
-        if (!sched_in)
-                intel_pmu_drain_pebs_buffer();
-}
 /*
 * PEBS
 */
@@ -651,6 +645,12 @@ struct event_constraint intel_glm_pebs_event_constraints[] = {
        EVENT_CONSTRAINT_END
 };
+struct event_constraint intel_glp_pebs_event_constraints[] = {
+        /* Allow all events as PEBS with no flags */
+        INTEL_ALL_EVENT_CONSTRAINT(0, 0xf),
+        EVENT_CONSTRAINT_END
+};
 struct event_constraint intel_nehalem_pebs_event_constraints[] = {
        INTEL_PLD_CONSTRAINT(0x100b, 0xf),      /* MEM_INST_RETIRED.* */
        INTEL_FLAGS_EVENT_CONSTRAINT(0x0f, 0xf),    /* MEM_UNCORE_RETIRED.* */
@@ -816,6 +816,14 @@ static inline bool pebs_needs_sched_cb(struct cpu_hw_events *cpuc)
        return cpuc->n_pebs && (cpuc->n_pebs == cpuc->n_large_pebs);
 }
+void intel_pmu_pebs_sched_task(struct perf_event_context *ctx, bool sched_in)
+{
+        struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events);
+        if (!sched_in && pebs_needs_sched_cb(cpuc))
+                intel_pmu_drain_pebs_buffer();
+}
 static inline void pebs_update_threshold(struct cpu_hw_events *cpuc)
 {
        struct debug_store *ds = cpuc->ds;
@@ -889,6 +897,8 @@ void intel_pmu_pebs_enable(struct perf_event *event)
        if (hwc->flags & PERF_X86_EVENT_AUTO_RELOAD) {
                ds->pebs_event_reset[hwc->idx] =
                        (u64)(-hwc->sample_period) & x86_pmu.cntval_mask;
+        } else {
+                ds->pebs_event_reset[hwc->idx] = 0;
        }
 }
diff --git a/arch/x86/events/intel/lbr.c b/arch/x86/events/intel/lbr.c
index eb261656a320..955457a30197 100644
--- a/arch/x86/events/intel/lbr.c
+++ b/arch/x86/events/intel/lbr.c
@@ -380,8 +380,12 @@ static void __intel_pmu_lbr_save(struct x86_perf_task_context *task_ctx)
 void intel_pmu_lbr_sched_task(struct perf_event_context *ctx, bool sched_in)
 {
+        struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events);
        struct x86_perf_task_context *task_ctx;
+        if (!cpuc->lbr_users)
+                return;
        /*
         * If LBR callstack feature is enabled and the stack was saved when
         * the task was scheduled out, restore the stack. Otherwise flush
diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h
index 53728eea1bed..476aec3a4cab 100644
--- a/arch/x86/events/perf_event.h
+++ b/arch/x86/events/perf_event.h
@@ -879,6 +879,8 @@ extern struct event_constraint intel_slm_pebs_event_constraints[];
 extern struct event_constraint intel_glm_pebs_event_constraints[];
+extern struct event_constraint intel_glp_pebs_event_constraints[];
 extern struct event_constraint intel_nehalem_pebs_event_constraints[];
 extern struct event_constraint intel_westmere_pebs_event_constraints[];
diff --git a/arch/x86/include/asm/bug.h b/arch/x86/include/asm/bug.h
index 39e702d90cdb..aa6b2023d8f8 100644
--- a/arch/x86/include/asm/bug.h
+++ b/arch/x86/include/asm/bug.h
@@ -35,7 +35,7 @@
 #define _BUG_FLAGS(ins, flags)                                          \
 do {                                                                    \
        asm volatile("1:\t" ins "\n"                                    \
-                     ".pushsection __bug_table,\"a\"\n"                 \
+                     ".pushsection __bug_table,\"aw\"\n"                \
                     "2:\t" __BUG_REL(1b) "\t# bug_entry::bug_addr\n"   \
                     "\t"  __BUG_REL(%c0) "\t# bug_entry::file\n"       \
                     "\t.word %c1"        "\t# bug_entry::line\n"       \
@@ -52,7 +52,7 @@ do {									\
 #define _BUG_FLAGS(ins, flags)                                          \
 do {                                                                    \
        asm volatile("1:\t" ins "\n"                                    \
-                     ".pushsection __bug_table,\"a\"\n"                 \
+                     ".pushsection __bug_table,\"aw\"\n"                \
                     "2:\t" __BUG_REL(1b) "\t# bug_entry::bug_addr\n"   \
                     "\t.word %c0"        "\t# bug_entry::flags\n"      \
                     "\t.org 2b+%c1\n"                                  \
diff --git a/arch/x86/include/asm/io.h b/arch/x86/include/asm/io.h
index 7afb0e2f07f4..48febf07e828 100644
--- a/arch/x86/include/asm/io.h
+++ b/arch/x86/include/asm/io.h
@@ -328,13 +328,13 @@ static inline unsigned type in##bwl##_p(int port)			\
 static inline void outs##bwl(int port, const void *addr, unsigned long count) \
 {                                                                       \
        asm volatile("rep; outs" #bwl                                   \
-                     : "+S"(addr), "+c"(count) : "d"(port));            \
+                     : "+S"(addr), "+c"(count) : "d"(port) : "memory"); \
 }                                                                       \
                                                                        \
 static inline void ins##bwl(int port, void *addr, unsigned long count)  \
 {                                                                       \
        asm volatile("rep; ins" #bwl                                    \
-                     : "+D"(addr), "+c"(count) : "d"(port));            \
+                     : "+D"(addr), "+c"(count) : "d"(port) : "memory"); \
 }
 BUILDIO(b, b, char)
diff --git a/arch/x86/include/asm/kprobes.h b/arch/x86/include/asm/kprobes.h
index 34b984c60790..6cf65437b5e5 100644
--- a/arch/x86/include/asm/kprobes.h
+++ b/arch/x86/include/asm/kprobes.h
@@ -52,10 +52,10 @@ typedef u8 kprobe_opcode_t;
 #define flush_insn_slot(p)      do { } while (0)
 /* optinsn template addresses */
-extern __visible kprobe_opcode_t optprobe_template_entry;
+extern __visible kprobe_opcode_t optprobe_template_entry[];
-extern __visible kprobe_opcode_t optprobe_template_val;
+extern __visible kprobe_opcode_t optprobe_template_val[];
-extern __visible kprobe_opcode_t optprobe_template_call;
+extern __visible kprobe_opcode_t optprobe_template_call[];
-extern __visible kprobe_opcode_t optprobe_template_end;
+extern __visible kprobe_opcode_t optprobe_template_end[];
 #define MAX_OPTIMIZED_LENGTH (MAX_INSN_SIZE + RELATIVE_ADDR_SIZE)
 #define MAX_OPTINSN_SIZE                                \
        (((unsigned long)&optprobe_template_end -       \
diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h
index ecfcb6643c9b..265c907d7d4c 100644
--- a/arch/x86/include/asm/mmu_context.h
+++ b/arch/x86/include/asm/mmu_context.h
@@ -293,7 +293,7 @@ static inline unsigned long __get_current_cr3_fast(void)
        unsigned long cr3 = __pa(this_cpu_read(cpu_tlbstate.loaded_mm)->pgd);
        /* For now, be very restrictive about when this can be called. */
-        VM_WARN_ON(in_nmi() || !in_atomic());
+        VM_WARN_ON(in_nmi() || preemptible());
        VM_BUG_ON(cr3 != __read_cr3());
        return cr3;
diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/paravirt_types.h
index cb976bab6299..9ffc36bfe4cd 100644
--- a/arch/x86/include/asm/paravirt_types.h
+++ b/arch/x86/include/asm/paravirt_types.h
@@ -84,7 +84,7 @@ struct pv_init_ops {
         */
        unsigned (*patch)(u8 type, u16 clobber, void *insnbuf,
                          unsigned long addr, unsigned len);
-};
+} __no_randomize_layout;
 struct pv_lazy_ops {
@@ -92,12 +92,12 @@ struct pv_lazy_ops {
        void (*enter)(void);
        void (*leave)(void);
        void (*flush)(void);
-};
+} __no_randomize_layout;
 struct pv_time_ops {
        unsigned long long (*sched_clock)(void);
        unsigned long long (*steal_clock)(int cpu);
-};
+} __no_randomize_layout;
 struct pv_cpu_ops {
        /* hooks for various privileged instructions */
@@ -176,7 +176,7 @@ struct pv_cpu_ops {
        void (*start_context_switch)(struct task_struct *prev);
        void (*end_context_switch)(struct task_struct *next);
-};
+} __no_randomize_layout;
 struct pv_irq_ops {
        /*
@@ -199,7 +199,7 @@ struct pv_irq_ops {
 #ifdef CONFIG_X86_64
        void (*adjust_exception_frame)(void);
 #endif
-};
+} __no_randomize_layout;
 struct pv_mmu_ops {
        unsigned long (*read_cr2)(void);
@@ -305,7 +305,7 @@ struct pv_mmu_ops {
           an mfn.  We can tell which is which from the index. */
        void (*set_fixmap)(unsigned /* enum fixed_addresses */ idx,
                           phys_addr_t phys, pgprot_t flags);
-};
+} __no_randomize_layout;
 struct arch_spinlock;
 #ifdef CONFIG_SMP
@@ -322,7 +322,7 @@ struct pv_lock_ops {
        void (*kick)(int cpu);
        struct paravirt_callee_save vcpu_is_preempted;
-};
+} __no_randomize_layout;
 /* This contains all the paravirt structures: we get a convenient
 * number for each function using the offset which we use to indicate
@@ -334,7 +334,7 @@ struct paravirt_patch_template {
        struct pv_irq_ops pv_irq_ops;
        struct pv_mmu_ops pv_mmu_ops;
        struct pv_lock_ops pv_lock_ops;
-};
+} __no_randomize_layout;
 extern struct pv_info pv_info;
 extern struct pv_init_ops pv_init_ops;
diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
index 6a79547e8ee0..028245e1c42b 100644
--- a/arch/x86/include/asm/processor.h
+++ b/arch/x86/include/asm/processor.h
@@ -129,7 +129,7 @@ struct cpuinfo_x86 {
        /* Index into per_cpu list: */
        u16                     cpu_index;
        u32                     microcode;
-};
+} __randomize_layout;
 struct cpuid_regs {
        u32 eax, ebx, ecx, edx;
diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
index 6bb680671088..7491e73d9253 100644
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
@@ -347,6 +347,14 @@ static void __init mp_override_legacy_irq(u8 bus_irq, u8 polarity, u8 trigger,
        struct mpc_intsrc mp_irq;
        /*
+         * Check bus_irq boundary.
+         */
+        if (bus_irq >= NR_IRQS_LEGACY) {
+                pr_warn("Invalid bus_irq %u for legacy override\n", bus_irq);
+                return;
+        }
+        /*
         * Convert 'gsi' to 'ioapic.pin'.
         */
        ioapic = mp_find_ioapic(gsi);
diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
index b4f5f73febdb..237e9c2341c7 100644
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -2093,7 +2093,7 @@ static inline void __init check_timer(void)
                        int idx;
                        idx = find_irq_entry(apic1, pin1, mp_INT);
                        if (idx != -1 && irq_trigger(idx))
-                                unmask_ioapic_irq(irq_get_chip_data(0));
+                                unmask_ioapic_irq(irq_get_irq_data(0));
                }
                irq_domain_deactivate_irq(irq_data);
                irq_domain_activate_irq(irq_data);
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index bb5abe8f5fd4..3b9e220621f8 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -134,6 +134,7 @@ static void init_amd_k6(struct cpuinfo_x86 *c)
                n = K6_BUG_LOOP;
                f_vide = vide;
+                OPTIMIZER_HIDE_VAR(f_vide);
                d = rdtsc();
                while (n--)
                        f_vide();
diff --git a/arch/x86/kernel/devicetree.c b/arch/x86/kernel/devicetree.c
index 3fe45f84ced4..cbf1f6ba39a8 100644
--- a/arch/x86/kernel/devicetree.c
+++ b/arch/x86/kernel/devicetree.c
@@ -235,8 +235,7 @@ static void __init dtb_add_ioapic(struct device_node *dn)
        ret = of_address_to_resource(dn, 0, &r);
        if (ret) {
-                printk(KERN_ERR "Can't obtain address from node %s.\n",
+                printk(KERN_ERR "Can't obtain address from device node %pOF.\n", dn);
-                                dn->full_name);
                return;
        }
        mp_register_ioapic(++ioapic_id, r.start, gsi_top, &cfg);
diff --git a/arch/x86/kvm/Kconfig b/arch/x86/kvm/Kconfig
index 760433b2574a..2688c7dc5323 100644
--- a/arch/x86/kvm/Kconfig
+++ b/arch/x86/kvm/Kconfig
@@ -22,7 +22,7 @@ config KVM
        depends on HAVE_KVM
        depends on HIGH_RES_TIMERS
        # for TASKSTATS/TASK_DELAY_ACCT:
-        depends on NET
+        depends on NET && MULTIUSER
        select PREEMPT_NOTIFIERS
        select MMU_NOTIFIER
        select ANON_INODES
diff --git a/arch/x86/kvm/hyperv.c b/arch/x86/kvm/hyperv.c
index 2695a34fa1c5..337b6d2730fa 100644
--- a/arch/x86/kvm/hyperv.c
+++ b/arch/x86/kvm/hyperv.c
@@ -649,9 +649,10 @@ void kvm_hv_process_stimers(struct kvm_vcpu *vcpu)
                                }
                                if ((stimer->config & HV_STIMER_ENABLE) &&
-                                    stimer->count)
+                                    stimer->count) {
-                                        stimer_start(stimer);
+                                        if (!stimer->msg_pending)
-                                else
+                                                stimer_start(stimer);
+                                } else
                                        stimer_cleanup(stimer);
                        }
                }
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 84e62acf2dd8..29fd8af5c347 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -198,7 +198,8 @@ struct loaded_vmcs {
        struct vmcs *vmcs;
        struct vmcs *shadow_vmcs;
        int cpu;
-        int launched;
+        bool launched;
+        bool nmi_known_unmasked;
        struct list_head loaded_vmcss_on_cpu_link;
 };
@@ -2326,6 +2327,11 @@ static void vmx_vcpu_put(struct kvm_vcpu *vcpu)
        __vmx_load_host_state(to_vmx(vcpu));
 }
+static bool emulation_required(struct kvm_vcpu *vcpu)
+{
+        return emulate_invalid_guest_state && !guest_state_valid(vcpu);
+}
 static void vmx_decache_cr0_guest_bits(struct kvm_vcpu *vcpu);
 /*
@@ -2363,6 +2369,8 @@ static unsigned long vmx_get_rflags(struct kvm_vcpu *vcpu)
 static void vmx_set_rflags(struct kvm_vcpu *vcpu, unsigned long rflags)
 {
+        unsigned long old_rflags = vmx_get_rflags(vcpu);
        __set_bit(VCPU_EXREG_RFLAGS, (ulong *)&vcpu->arch.regs_avail);
        to_vmx(vcpu)->rflags = rflags;
        if (to_vmx(vcpu)->rmode.vm86_active) {
@@ -2370,6 +2378,9 @@ static void vmx_set_rflags(struct kvm_vcpu *vcpu, unsigned long rflags)
                rflags |= X86_EFLAGS_IOPL | X86_EFLAGS_VM;
        }
        vmcs_writel(GUEST_RFLAGS, rflags);
+        if ((old_rflags ^ to_vmx(vcpu)->rflags) & X86_EFLAGS_VM)
+                to_vmx(vcpu)->emulation_required = emulation_required(vcpu);
 }
 static u32 vmx_get_pkru(struct kvm_vcpu *vcpu)
@@ -3857,11 +3868,6 @@ static __init int alloc_kvm_area(void)
        return 0;
 }
-static bool emulation_required(struct kvm_vcpu *vcpu)
-{
-        return emulate_invalid_guest_state && !guest_state_valid(vcpu);
-}
 static void fix_pmode_seg(struct kvm_vcpu *vcpu, int seg,
                struct kvm_segment *save)
 {
@@ -5510,10 +5516,8 @@ static void vmx_inject_nmi(struct kvm_vcpu *vcpu)
 {
        struct vcpu_vmx *vmx = to_vmx(vcpu);
-        if (!is_guest_mode(vcpu)) {
+        ++vcpu->stat.nmi_injections;
-                ++vcpu->stat.nmi_injections;
+        vmx->loaded_vmcs->nmi_known_unmasked = false;
-                vmx->nmi_known_unmasked = false;
-        }
        if (vmx->rmode.vm86_active) {
                if (kvm_inject_realmode_interrupt(vcpu, NMI_VECTOR, 0) != EMULATE_DONE)
@@ -5527,16 +5531,21 @@ static void vmx_inject_nmi(struct kvm_vcpu *vcpu)
 static bool vmx_get_nmi_mask(struct kvm_vcpu *vcpu)
 {
-        if (to_vmx(vcpu)->nmi_known_unmasked)
+        struct vcpu_vmx *vmx = to_vmx(vcpu);
+        bool masked;
+        if (vmx->loaded_vmcs->nmi_known_unmasked)
                return false;
-        return vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) & GUEST_INTR_STATE_NMI;
+        masked = vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) & GUEST_INTR_STATE_NMI;
+        vmx->loaded_vmcs->nmi_known_unmasked = !masked;
+        return masked;
 }
 static void vmx_set_nmi_mask(struct kvm_vcpu *vcpu, bool masked)
 {
        struct vcpu_vmx *vmx = to_vmx(vcpu);
-        vmx->nmi_known_unmasked = !masked;
+        vmx->loaded_vmcs->nmi_known_unmasked = !masked;
        if (masked)
                vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO,
                              GUEST_INTR_STATE_NMI);
@@ -8736,7 +8745,7 @@ static void vmx_recover_nmi_blocking(struct vcpu_vmx *vmx)
        idtv_info_valid = vmx->idt_vectoring_info & VECTORING_INFO_VALID_MASK;
-        if (vmx->nmi_known_unmasked)
+        if (vmx->loaded_vmcs->nmi_known_unmasked)
                return;
        /*
         * Can't use vmx->exit_intr_info since we're not sure what
@@ -8760,7 +8769,7 @@ static void vmx_recover_nmi_blocking(struct vcpu_vmx *vmx)
                vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO,
                              GUEST_INTR_STATE_NMI);
        else
-                vmx->nmi_known_unmasked =
+                vmx->loaded_vmcs->nmi_known_unmasked =
                        !(vmcs_read32(GUEST_INTERRUPTIBILITY_INFO)
                          & GUEST_INTR_STATE_NMI);
 }
@@ -10488,6 +10497,7 @@ static int nested_vmx_run(struct kvm_vcpu *vcpu, bool launch)
 {
        struct vmcs12 *vmcs12;
        struct vcpu_vmx *vmx = to_vmx(vcpu);
+        u32 interrupt_shadow = vmx_get_interrupt_shadow(vcpu);
        u32 exit_qual;
        int ret;
@@ -10512,6 +10522,12 @@ static int nested_vmx_run(struct kvm_vcpu *vcpu, bool launch)
         * for misconfigurations which will anyway be caught by the processor
         * when using the merged vmcs02.
         */
+        if (interrupt_shadow & KVM_X86_SHADOW_INT_MOV_SS) {
+                nested_vmx_failValid(vcpu,
+                                     VMXERR_ENTRY_EVENTS_BLOCKED_BY_MOV_SS);
+                goto out;
+        }
        if (vmcs12->launch_state == launch) {
                nested_vmx_failValid(vcpu,
                        launch ? VMXERR_VMLAUNCH_NONCLEAR_VMCS
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 5b8f07889f6a..82a63c59f77b 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -597,8 +597,8 @@ bool pdptrs_changed(struct kvm_vcpu *vcpu)
                      (unsigned long *)&vcpu->arch.regs_avail))
                return true;
-        gfn = (kvm_read_cr3(vcpu) & ~31u) >> PAGE_SHIFT;
+        gfn = (kvm_read_cr3(vcpu) & ~31ul) >> PAGE_SHIFT;
-        offset = (kvm_read_cr3(vcpu) & ~31u) & (PAGE_SIZE - 1);
+        offset = (kvm_read_cr3(vcpu) & ~31ul) & (PAGE_SIZE - 1);
        r = kvm_read_nested_guest_page(vcpu, gfn, pdpte, offset, sizeof(pdpte),
                                       PFERR_USER_MASK | PFERR_WRITE_MASK);
        if (r < 0)
diff --git a/arch/x86/math-emu/Makefile b/arch/x86/math-emu/Makefile
index 9b0c63b60302..1b2dac174321 100644
--- a/arch/x86/math-emu/Makefile
+++ b/arch/x86/math-emu/Makefile
@@ -5,8 +5,8 @@
 #DEBUG  = -DDEBUGGING
 DEBUG   =
 PARANOID = -DPARANOID
-EXTRA_CFLAGS    := $(PARANOID) $(DEBUG) -fno-builtin $(MATH_EMULATION)
+ccflags-y += $(PARANOID) $(DEBUG) -fno-builtin $(MATH_EMULATION)
-EXTRA_AFLAGS    := $(PARANOID)
+asflags-y += $(PARANOID)
 # From 'C' language sources:
 C_OBJS =fpu_entry.o errors.o \
diff --git a/arch/x86/math-emu/fpu_emu.h b/arch/x86/math-emu/fpu_emu.h
index afbc4d805d66..c9c320dccca1 100644
--- a/arch/x86/math-emu/fpu_emu.h
+++ b/arch/x86/math-emu/fpu_emu.h
@@ -157,7 +157,7 @@ extern u_char const data_sizes_16[32];
 #define signbyte(a) (((u_char *)(a))[9])
 #define getsign(a) (signbyte(a) & 0x80)
-#define setsign(a,b) { if (b) signbyte(a) |= 0x80; else signbyte(a) &= 0x7f; }
+#define setsign(a,b) { if ((b) != 0) signbyte(a) |= 0x80; else signbyte(a) &= 0x7f; }
 #define copysign(a,b) { if (getsign(a)) signbyte(b) |= 0x80; \
                        else signbyte(b) &= 0x7f; }
 #define changesign(a) { signbyte(a) ^= 0x80; }
diff --git a/arch/x86/math-emu/reg_compare.c b/arch/x86/math-emu/reg_compare.c
index b77360fdbf4a..19b33b50adfa 100644
--- a/arch/x86/math-emu/reg_compare.c
+++ b/arch/x86/math-emu/reg_compare.c
@@ -168,7 +168,7 @@ static int compare(FPU_REG const *b, int tagb)
 /* This function requires that st(0) is not empty */
 int FPU_compare_st_data(FPU_REG const *loaded_data, u_char loaded_tag)
 {
-        int f = 0, c;
+        int f, c;
        c = compare(loaded_data, loaded_tag);
@@ -189,12 +189,12 @@ int FPU_compare_st_data(FPU_REG const *loaded_data, u_char loaded_tag)
                case COMP_No_Comp:
                        f = SW_C3 | SW_C2 | SW_C0;
                        break;
-#ifdef PARANOID
                default:
+#ifdef PARANOID
                        EXCEPTION(EX_INTERNAL | 0x121);
+#endif /* PARANOID */
                        f = SW_C3 | SW_C2 | SW_C0;
                        break;
-#endif /* PARANOID */
                }
        setcc(f);
        if (c & COMP_Denormal) {
@@ -205,7 +205,7 @@ int FPU_compare_st_data(FPU_REG const *loaded_data, u_char loaded_tag)
 static int compare_st_st(int nr)
 {
-        int f = 0, c;
+        int f, c;
        FPU_REG *st_ptr;
        if (!NOT_EMPTY(0) || !NOT_EMPTY(nr)) {
@@ -235,12 +235,12 @@ static int compare_st_st(int nr)
                case COMP_No_Comp:
                        f = SW_C3 | SW_C2 | SW_C0;
                        break;
-#ifdef PARANOID
                default:
+#ifdef PARANOID
                        EXCEPTION(EX_INTERNAL | 0x122);
+#endif /* PARANOID */
                        f = SW_C3 | SW_C2 | SW_C0;
                        break;
-#endif /* PARANOID */
                }
        setcc(f);
        if (c & COMP_Denormal) {
@@ -283,12 +283,12 @@ static int compare_i_st_st(int nr)
        case COMP_No_Comp:
                f = X86_EFLAGS_ZF | X86_EFLAGS_PF | X86_EFLAGS_CF;
                break;
-#ifdef PARANOID
        default:
+#ifdef PARANOID
                EXCEPTION(EX_INTERNAL | 0x122);
+#endif /* PARANOID */
                f = 0;
                break;
-#endif /* PARANOID */
        }
        FPU_EFLAGS = (FPU_EFLAGS & ~(X86_EFLAGS_ZF | X86_EFLAGS_PF | X86_EFLAGS_CF)) | f;
        if (c & COMP_Denormal) {
diff --git a/arch/x86/platform/intel-mid/device_libs/platform_max7315.c b/arch/x86/platform/intel-mid/device_libs/platform_max7315.c
index 6e075afa7877..58337b2bc682 100644
--- a/arch/x86/platform/intel-mid/device_libs/platform_max7315.c
+++ b/arch/x86/platform/intel-mid/device_libs/platform_max7315.c
@@ -38,8 +38,10 @@ static void __init *max7315_platform_data(void *info)
         */
        strcpy(i2c_info->type, "max7315");
        if (nr++) {
-                sprintf(base_pin_name, "max7315_%d_base", nr);
+                snprintf(base_pin_name, sizeof(base_pin_name),
-                sprintf(intr_pin_name, "max7315_%d_int", nr);
+                         "max7315_%d_base", nr);
+                snprintf(intr_pin_name, sizeof(intr_pin_name),
+                         "max7315_%d_int", nr);
        } else {
                strcpy(base_pin_name, "max7315_base");
                strcpy(intr_pin_name, "max7315_int");
diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c
index d4a61ddf9e62..3e4bdb442fbc 100644
--- a/arch/x86/platform/uv/tlb_uv.c
+++ b/arch/x86/platform/uv/tlb_uv.c
@@ -40,7 +40,6 @@ static int timeout_base_ns[] = {
 static int timeout_us;
 static bool nobau = true;
 static int nobau_perm;
-static cycles_t congested_cycles;
 /* tunables: */
 static int max_concurr          = MAX_BAU_CONCURRENT;
@@ -829,10 +828,10 @@ static void record_send_stats(cycles_t time1, cycles_t time2,
                if ((completion_status == FLUSH_COMPLETE) && (try == 1)) {
                        bcp->period_requests++;
                        bcp->period_time += elapsed;
-                        if ((elapsed > congested_cycles) &&
+                        if ((elapsed > usec_2_cycles(bcp->cong_response_us)) &&
                            (bcp->period_requests > bcp->cong_reps) &&
                            ((bcp->period_time / bcp->period_requests) >
-                                                        congested_cycles)) {
+                                        usec_2_cycles(bcp->cong_response_us))) {
                                stat->s_congested++;
                                disable_for_period(bcp, stat);
                        }
@@ -2222,14 +2221,17 @@ static int __init uv_bau_init(void)
        else if (is_uv1_hub())
                ops = uv1_bau_ops;
+        nuvhubs = uv_num_possible_blades();
+        if (nuvhubs < 2) {
+                pr_crit("UV: BAU disabled - insufficient hub count\n");
+                goto err_bau_disable;
+        }
        for_each_possible_cpu(cur_cpu) {
                mask = &per_cpu(uv_flush_tlb_mask, cur_cpu);
                zalloc_cpumask_var_node(mask, GFP_KERNEL, cpu_to_node(cur_cpu));
        }
-        nuvhubs = uv_num_possible_blades();
-        congested_cycles = usec_2_cycles(congested_respns_us);
        uv_base_pnode = 0x7fffffff;
        for (uvhub = 0; uvhub < nuvhubs; uvhub++) {
                cpus = uv_blade_nr_possible_cpus(uvhub);
@@ -2242,9 +2244,8 @@ static int __init uv_bau_init(void)
                enable_timeouts();
        if (init_per_cpu(nuvhubs, uv_base_pnode)) {
-                set_bau_off();
+                pr_crit("UV: BAU disabled - per CPU init failed\n");
-                nobau_perm = 1;
+                goto err_bau_disable;
-                return 0;
        }
        vector = UV_BAU_MESSAGE;
@@ -2270,6 +2271,16 @@ static int __init uv_bau_init(void)
        }
        return 0;
+err_bau_disable:
+        for_each_possible_cpu(cur_cpu)
+                free_cpumask_var(per_cpu(uv_flush_tlb_mask, cur_cpu));
+        set_bau_off();
+        nobau_perm = 1;
+        return -EINVAL;
 }
 core_initcall(uv_bau_init);
 fs_initcall(uv_ptc_init);
diff --git a/arch/x86/xen/smp_pv.c b/arch/x86/xen/smp_pv.c
index 1ea598e5f030..51471408fdd1 100644
--- a/arch/x86/xen/smp_pv.c
+++ b/arch/x86/xen/smp_pv.c
@@ -19,6 +19,7 @@
 #include <linux/irq_work.h>
 #include <linux/tick.h>
 #include <linux/nmi.h>
+#include <linux/cpuhotplug.h>
 #include <asm/paravirt.h>
 #include <asm/desc.h>
@@ -413,7 +414,7 @@ static void xen_pv_play_dead(void) /* used only with HOTPLUG_CPU */
         */
        tick_nohz_idle_enter();
-        cpu_startup_entry(CPUHP_AP_ONLINE_IDLE);
+        cpuhp_online_idle(CPUHP_AP_ONLINE_IDLE);
 }
 #else /* !CONFIG_HOTPLUG_CPU */
diff --git a/arch/x86/xen/time.c b/arch/x86/xen/time.c
index a1895a8e85c1..1ecb05db3632 100644
--- a/arch/x86/xen/time.c
+++ b/arch/x86/xen/time.c
@@ -309,7 +309,6 @@ static irqreturn_t xen_timer_interrupt(int irq, void *dev_id)
 void xen_teardown_timer(int cpu)
 {
        struct clock_event_device *evt;
-        BUG_ON(cpu == 0);
        evt = &per_cpu(xen_clock_events, cpu).evt;
        if (evt->irq >= 0) {
diff --git a/arch/xtensa/include/uapi/asm/ioctls.h b/arch/xtensa/include/uapi/asm/ioctls.h
index 98b004e24e85..47d82c09be7b 100644
--- a/arch/xtensa/include/uapi/asm/ioctls.h
+++ b/arch/xtensa/include/uapi/asm/ioctls.h
@@ -105,7 +105,7 @@
 #define TIOCGPKT        _IOR('T', 0x38, int) /* Get packet mode state */
 #define TIOCGPTLCK      _IOR('T', 0x39, int) /* Get Pty lock state */
 #define TIOCGEXCL       _IOR('T', 0x40, int) /* Get exclusive mode state */
-#define TIOCGPTPEER     _IOR('T', 0x41, int) /* Safely open the slave */
+#define TIOCGPTPEER     _IO('T', 0x41) /* Safely open the slave */
 #define TIOCSERCONFIG   _IO('T', 83)
 #define TIOCSERGWILD    _IOR('T', 84,  int)
diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
index 60a6835265fc..436b6ca6b175 100644
--- a/block/bfq-iosched.c
+++ b/block/bfq-iosched.c
@@ -4299,6 +4299,9 @@ static void bfq_completed_request(struct bfq_queue *bfqq, struct bfq_data *bfqd)
                        bfq_bfqq_expire(bfqd, bfqq, false,
                                        BFQQE_NO_MORE_REQUESTS);
        }
+        if (!bfqd->rq_in_driver)
+                bfq_schedule_dispatch(bfqd);
 }
 static void bfq_put_rq_priv_body(struct bfq_queue *bfqq)
diff --git a/block/bfq-iosched.h b/block/bfq-iosched.h
index 8fd83b885774..63e771ab56d8 100644
--- a/block/bfq-iosched.h
+++ b/block/bfq-iosched.h
@@ -52,7 +52,7 @@ struct bfq_entity;
 struct bfq_service_tree {
        /* tree for active entities (i.e., those backlogged) */
        struct rb_root active;
-        /* tree for idle entities (i.e., not backlogged, with V <= F_i)*/
+        /* tree for idle entities (i.e., not backlogged, with V < F_i)*/
        struct rb_root idle;
        /* idle entity with minimum F_i */
diff --git a/block/bfq-wf2q.c b/block/bfq-wf2q.c
index 5ec05cd42b80..979f8f21b7e2 100644
--- a/block/bfq-wf2q.c
+++ b/block/bfq-wf2q.c
@@ -1297,7 +1297,7 @@ static void bfq_update_vtime(struct bfq_service_tree *st, u64 new_value)
 *
 * This function searches the first schedulable entity, starting from the
 * root of the tree and going on the left every time on this side there is
- * a subtree with at least one eligible (start >= vtime) entity. The path on
+ * a subtree with at least one eligible (start <= vtime) entity. The path on
 * the right is followed only if a) the left subtree contains no eligible
 * entities and b) no eligible entity has been found yet.
 */
diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
index b75b734ee73a..19182d091587 100644
--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -3160,6 +3160,8 @@ static struct acpi_driver acpi_nfit_driver = {
 static __init int nfit_init(void)
 {
+        int ret;
        BUILD_BUG_ON(sizeof(struct acpi_table_nfit) != 40);
        BUILD_BUG_ON(sizeof(struct acpi_nfit_system_address) != 56);
        BUILD_BUG_ON(sizeof(struct acpi_nfit_memory_map) != 48);
@@ -3187,8 +3189,14 @@ static __init int nfit_init(void)
                return -ENOMEM;
        nfit_mce_register();
+        ret = acpi_bus_register_driver(&acpi_nfit_driver);
+        if (ret) {
+                nfit_mce_unregister();
+                destroy_workqueue(nfit_wq);
+        }
+        return ret;
-        return acpi_bus_register_driver(&acpi_nfit_driver);
 }
 static __exit void nfit_exit(void)
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index aae4d8d4be36..f7665c31feca 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -2200,8 +2200,12 @@ static void binder_transaction(struct binder_proc *proc,
        list_add_tail(&t->work.entry, target_list);
        tcomplete->type = BINDER_WORK_TRANSACTION_COMPLETE;
        list_add_tail(&tcomplete->entry, &thread->todo);
-        if (target_wait)
+        if (target_wait) {
-                wake_up_interruptible(target_wait);
+                if (reply || !(t->flags & TF_ONE_WAY))
+                        wake_up_interruptible_sync(target_wait);
+                else
+                        wake_up_interruptible(target_wait);
+        }
        return;
 err_translate_failed:
@@ -3247,10 +3251,6 @@ static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
        /*pr_info("binder_ioctl: %d:%d %x %lx\n",
                        proc->pid, current->pid, cmd, arg);*/
-        if (unlikely(current->mm != proc->vma_vm_mm)) {
-                pr_err("current mm mismatch proc mm\n");
-                return -EINVAL;
-        }
        trace_binder_ioctl(cmd, arg);
        ret = wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2);
@@ -3464,9 +3464,8 @@ static int binder_open(struct inode *nodp, struct file *filp)
        proc = kzalloc(sizeof(*proc), GFP_KERNEL);
        if (proc == NULL)
                return -ENOMEM;
-        get_task_struct(current);
+        get_task_struct(current->group_leader);
-        proc->tsk = current;
+        proc->tsk = current->group_leader;
-        proc->vma_vm_mm = current->mm;
        INIT_LIST_HEAD(&proc->todo);
        init_waitqueue_head(&proc->wait);
        proc->default_priority = task_nice(current);
diff --git a/drivers/atm/zatm.c b/drivers/atm/zatm.c
index 292dec18ffb8..07bdd51b3b9a 100644
--- a/drivers/atm/zatm.c
+++ b/drivers/atm/zatm.c
@@ -1613,7 +1613,7 @@ static int zatm_init_one(struct pci_dev *pci_dev,
        ret = dma_set_mask_and_coherent(&pci_dev->dev, DMA_BIT_MASK(32));
        if (ret < 0)
-                goto out_disable;
+                goto out_release;
        zatm_dev->pci_dev = pci_dev;
        dev->dev_data = zatm_dev;
diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
index 3b8210ebb50e..60303aa28587 100644
--- a/drivers/base/power/domain.c
+++ b/drivers/base/power/domain.c
@@ -1222,8 +1222,6 @@ static struct generic_pm_domain_data *genpd_alloc_dev_data(struct device *dev,
        spin_unlock_irq(&dev->power.lock);
-        dev_pm_domain_set(dev, &genpd->domain);
        return gpd_data;
 err_free:
@@ -1237,8 +1235,6 @@ static struct generic_pm_domain_data *genpd_alloc_dev_data(struct device *dev,
 static void genpd_free_dev_data(struct device *dev,
                                struct generic_pm_domain_data *gpd_data)
 {
-        dev_pm_domain_set(dev, NULL);
        spin_lock_irq(&dev->power.lock);
        dev->power.subsys_data->domain_data = NULL;
@@ -1275,6 +1271,8 @@ static int genpd_add_device(struct generic_pm_domain *genpd, struct device *dev,
        if (ret)
                goto out;
+        dev_pm_domain_set(dev, &genpd->domain);
        genpd->device_count++;
        genpd->max_off_time_changed = true;
@@ -1336,6 +1334,8 @@ static int genpd_remove_device(struct generic_pm_domain *genpd,
        if (genpd->detach_dev)
                genpd->detach_dev(genpd, dev);
+        dev_pm_domain_set(dev, NULL);
        list_del_init(&pdd->list_node);
        genpd_unlock(genpd);
diff --git a/drivers/base/regmap/regmap-w1.c b/drivers/base/regmap/regmap-w1.c
index 5f04e7bf063e..e6c64b0be5b2 100644
--- a/drivers/base/regmap/regmap-w1.c
+++ b/drivers/base/regmap/regmap-w1.c
@@ -1,7 +1,7 @@
 /*
 * Register map access API - W1 (1-Wire) support
 *
- * Copyright (C) 2017 OAO Radioavionica
+ * Copyright (c) 2017 Radioavionica Corporation
 * Author: Alex A. Mihaylov <minimumlaw@rambler.ru>
 *
 * This program is free software; you can redistribute it and/or modify
@@ -11,7 +11,7 @@
 #include <linux/regmap.h>
 #include <linux/module.h>
-#include "../../w1/w1.h"
+#include <linux/w1.h>
 #include "internal.h"
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index dea7d85134ee..87a0a29f6e7e 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -626,7 +626,6 @@ static void recv_work(struct work_struct *work)
        struct nbd_device *nbd = args->nbd;
        struct nbd_config *config = nbd->config;
        struct nbd_cmd *cmd;
-        int ret = 0;
        while (1) {
                cmd = nbd_read_stat(nbd, args->index);
@@ -636,7 +635,6 @@ static void recv_work(struct work_struct *work)
                        mutex_lock(&nsock->tx_lock);
                        nbd_mark_nsock_dead(nbd, nsock, 1);
                        mutex_unlock(&nsock->tx_lock);
-                        ret = PTR_ERR(cmd);
                        break;
                }
diff --git a/drivers/clocksource/timer-of.c b/drivers/clocksource/timer-of.c
index f6e7491c873c..d509b500a7b5 100644
--- a/drivers/clocksource/timer-of.c
+++ b/drivers/clocksource/timer-of.c
@@ -41,8 +41,16 @@ static __init int timer_irq_init(struct device_node *np,
        struct timer_of *to = container_of(of_irq, struct timer_of, of_irq);
        struct clock_event_device *clkevt = &to->clkevt;
-        of_irq->irq = of_irq->name ? of_irq_get_byname(np, of_irq->name):
+        if (of_irq->name) {
-                irq_of_parse_and_map(np, of_irq->index);
+                of_irq->irq = ret = of_irq_get_byname(np, of_irq->name);
+                if (ret < 0) {
+                        pr_err("Failed to get interrupt %s for %s\n",
+                               of_irq->name, np->full_name);
+                        return ret;
+                }
+        } else  {
+                of_irq->irq = irq_of_parse_and_map(np, of_irq->index);
+        }
        if (!of_irq->irq) {
                pr_err("Failed to map interrupt for %s\n", np->full_name);
                return -EINVAL;
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index b7fb8b7c980d..6cd503525638 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -225,6 +225,9 @@ struct global_params {
 * @vid:                Stores VID limits for this CPU
 * @pid:                Stores PID parameters for this CPU
 * @last_sample_time:   Last Sample time
+ * @aperf_mperf_shift:  Number of clock cycles after aperf, merf is incremented
+ *                      This shift is a multiplier to mperf delta to
+ *                      calculate CPU busy.
 * @prev_aperf:         Last APERF value read from APERF MSR
 * @prev_mperf:         Last MPERF value read from MPERF MSR
 * @prev_tsc:           Last timestamp counter (TSC) value
@@ -259,6 +262,7 @@ struct cpudata {
        u64     last_update;
        u64     last_sample_time;
+        u64     aperf_mperf_shift;
        u64     prev_aperf;
        u64     prev_mperf;
        u64     prev_tsc;
@@ -321,6 +325,7 @@ struct pstate_funcs {
        int (*get_min)(void);
        int (*get_turbo)(void);
        int (*get_scaling)(void);
+        int (*get_aperf_mperf_shift)(void);
        u64 (*get_val)(struct cpudata*, int pstate);
        void (*get_vid)(struct cpudata *);
        void (*update_util)(struct update_util_data *data, u64 time,
@@ -1486,6 +1491,11 @@ static u64 core_get_val(struct cpudata *cpudata, int pstate)
        return val;
 }
+static int knl_get_aperf_mperf_shift(void)
+{
+        return 10;
+}
 static int knl_get_turbo_pstate(void)
 {
        u64 value;
@@ -1543,6 +1553,9 @@ static void intel_pstate_get_cpu_pstates(struct cpudata *cpu)
        cpu->pstate.max_freq = cpu->pstate.max_pstate * cpu->pstate.scaling;
        cpu->pstate.turbo_freq = cpu->pstate.turbo_pstate * cpu->pstate.scaling;
+        if (pstate_funcs.get_aperf_mperf_shift)
+                cpu->aperf_mperf_shift = pstate_funcs.get_aperf_mperf_shift();
        if (pstate_funcs.get_vid)
                pstate_funcs.get_vid(cpu);
@@ -1616,7 +1629,8 @@ static inline int32_t get_target_pstate_use_cpu_load(struct cpudata *cpu)
        int32_t busy_frac, boost;
        int target, avg_pstate;
-        busy_frac = div_fp(sample->mperf, sample->tsc);
+        busy_frac = div_fp(sample->mperf << cpu->aperf_mperf_shift,
+                           sample->tsc);
        boost = cpu->iowait_boost;
        cpu->iowait_boost >>= 1;
@@ -1675,7 +1689,8 @@ static inline int32_t get_target_pstate_use_performance(struct cpudata *cpu)
                sample_ratio = div_fp(pid_params.sample_rate_ns, duration_ns);
                perf_scaled = mul_fp(perf_scaled, sample_ratio);
        } else {
-                sample_ratio = div_fp(100 * cpu->sample.mperf, cpu->sample.tsc);
+                sample_ratio = div_fp(100 * (cpu->sample.mperf << cpu->aperf_mperf_shift),
+                                      cpu->sample.tsc);
                if (sample_ratio < int_tofp(1))
                        perf_scaled = 0;
        }
@@ -1807,6 +1822,7 @@ static const struct pstate_funcs knl_funcs = {
        .get_max_physical = core_get_max_pstate_physical,
        .get_min = core_get_min_pstate,
        .get_turbo = knl_get_turbo_pstate,
+        .get_aperf_mperf_shift = knl_get_aperf_mperf_shift,
        .get_scaling = core_get_scaling,
        .get_val = core_get_val,
        .update_util = intel_pstate_update_util_pid,
@@ -2403,6 +2419,7 @@ static void __init copy_cpu_funcs(struct pstate_funcs *funcs)
        pstate_funcs.get_val   = funcs->get_val;
        pstate_funcs.get_vid   = funcs->get_vid;
        pstate_funcs.update_util = funcs->update_util;
+        pstate_funcs.get_aperf_mperf_shift = funcs->get_aperf_mperf_shift;
        intel_pstate_use_acpi_profile();
 }
diff --git a/drivers/dax/device-dax.h b/drivers/dax/device-dax.h
index fdcd9769ffde..688b051750bd 100644
--- a/drivers/dax/device-dax.h
+++ b/drivers/dax/device-dax.h
@@ -21,5 +21,5 @@ struct dax_region *alloc_dax_region(struct device *parent,
                int region_id, struct resource *res, unsigned int align,
                void *addr, unsigned long flags);
 struct dev_dax *devm_create_dev_dax(struct dax_region *dax_region,
-                struct resource *res, int count);
+                int id, struct resource *res, int count);
 #endif /* __DEVICE_DAX_H__ */
diff --git a/drivers/dax/device.c b/drivers/dax/device.c
index 12943d19bfc4..e9f3b3e4bbf4 100644
--- a/drivers/dax/device.c
+++ b/drivers/dax/device.c
@@ -529,7 +529,8 @@ static void dev_dax_release(struct device *dev)
        struct dax_region *dax_region = dev_dax->region;
        struct dax_device *dax_dev = dev_dax->dax_dev;
-        ida_simple_remove(&dax_region->ida, dev_dax->id);
+        if (dev_dax->id >= 0)
+                ida_simple_remove(&dax_region->ida, dev_dax->id);
        dax_region_put(dax_region);
        put_dax(dax_dev);
        kfree(dev_dax);
@@ -559,7 +560,7 @@ static void unregister_dev_dax(void *dev)
 }
 struct dev_dax *devm_create_dev_dax(struct dax_region *dax_region,
-                struct resource *res, int count)
+                int id, struct resource *res, int count)
 {
        struct device *parent = dax_region->dev;
        struct dax_device *dax_dev;
@@ -567,7 +568,10 @@ struct dev_dax *devm_create_dev_dax(struct dax_region *dax_region,
        struct inode *inode;
        struct device *dev;
        struct cdev *cdev;
-        int rc = 0, i;
+        int rc, i;
+        if (!count)
+                return ERR_PTR(-EINVAL);
        dev_dax = kzalloc(sizeof(*dev_dax) + sizeof(*res) * count, GFP_KERNEL);
        if (!dev_dax)
@@ -587,10 +591,16 @@ struct dev_dax *devm_create_dev_dax(struct dax_region *dax_region,
        if (i < count)
                goto err_id;
-        dev_dax->id = ida_simple_get(&dax_region->ida, 0, 0, GFP_KERNEL);
+        if (id < 0) {
-        if (dev_dax->id < 0) {
+                id = ida_simple_get(&dax_region->ida, 0, 0, GFP_KERNEL);
-                rc = dev_dax->id;
+                dev_dax->id = id;
-                goto err_id;
+                if (id < 0) {
+                        rc = id;
+                        goto err_id;
+                }
+        } else {
+                /* region provider owns @id lifetime */
+                dev_dax->id = -1;
        }
        /*
@@ -598,8 +608,10 @@ struct dev_dax *devm_create_dev_dax(struct dax_region *dax_region,
         * device outside of mmap of the resulting character device.
         */
        dax_dev = alloc_dax(dev_dax, NULL, NULL);
-        if (!dax_dev)
+        if (!dax_dev) {
+                rc = -ENOMEM;
                goto err_dax;
+        }
        /* from here on we're committed to teardown via dax_dev_release() */
        dev = &dev_dax->dev;
@@ -620,7 +632,7 @@ struct dev_dax *devm_create_dev_dax(struct dax_region *dax_region,
        dev->parent = parent;
        dev->groups = dax_attribute_groups;
        dev->release = dev_dax_release;
-        dev_set_name(dev, "dax%d.%d", dax_region->id, dev_dax->id);
+        dev_set_name(dev, "dax%d.%d", dax_region->id, id);
        rc = cdev_device_add(cdev, dev);
        if (rc) {
@@ -636,7 +648,8 @@ struct dev_dax *devm_create_dev_dax(struct dax_region *dax_region,
        return dev_dax;
 err_dax:
-        ida_simple_remove(&dax_region->ida, dev_dax->id);
+        if (dev_dax->id >= 0)
+                ida_simple_remove(&dax_region->ida, dev_dax->id);
 err_id:
        kfree(dev_dax);
diff --git a/drivers/dax/pmem.c b/drivers/dax/pmem.c
index 9f2a0b4fd801..8d8c852ba8f2 100644
--- a/drivers/dax/pmem.c
+++ b/drivers/dax/pmem.c
@@ -58,13 +58,12 @@ static void dax_pmem_percpu_kill(void *data)
 static int dax_pmem_probe(struct device *dev)
 {
-        int rc;
        void *addr;
        struct resource res;
+        int rc, id, region_id;
        struct nd_pfn_sb *pfn_sb;
        struct dev_dax *dev_dax;
        struct dax_pmem *dax_pmem;
-        struct nd_region *nd_region;
        struct nd_namespace_io *nsio;
        struct dax_region *dax_region;
        struct nd_namespace_common *ndns;
@@ -123,14 +122,17 @@ static int dax_pmem_probe(struct device *dev)
        /* adjust the dax_region resource to the start of data */
        res.start += le64_to_cpu(pfn_sb->dataoff);
-        nd_region = to_nd_region(dev->parent);
+        rc = sscanf(dev_name(&ndns->dev), "namespace%d.%d", &region_id, &id);
-        dax_region = alloc_dax_region(dev, nd_region->id, &res,
+        if (rc != 2)
+                return -EINVAL;
+        dax_region = alloc_dax_region(dev, region_id, &res,
                        le32_to_cpu(pfn_sb->align), addr, PFN_DEV|PFN_MAP);
        if (!dax_region)
                return -ENOMEM;
        /* TODO: support for subdividing a dax region... */
-        dev_dax = devm_create_dev_dax(dax_region, &res, 1);
+        dev_dax = devm_create_dev_dax(dax_region, id, &res, 1);
        /* child dev_dax instances now own the lifetime of the dax_region */
        dax_region_put(dax_region);
diff --git a/drivers/dma-buf/dma-fence.c b/drivers/dma-buf/dma-fence.c
index eee8377b8b3a..9a302799040e 100644
--- a/drivers/dma-buf/dma-fence.c
+++ b/drivers/dma-buf/dma-fence.c
@@ -75,11 +75,6 @@ int dma_fence_signal_locked(struct dma_fence *fence)
        if (WARN_ON(!fence))
                return -EINVAL;
-        if (!ktime_to_ns(fence->timestamp)) {
-                fence->timestamp = ktime_get();
-                smp_mb__before_atomic();
-        }
        if (test_and_set_bit(DMA_FENCE_FLAG_SIGNALED_BIT, &fence->flags)) {
                ret = -EINVAL;
@@ -87,8 +82,11 @@ int dma_fence_signal_locked(struct dma_fence *fence)
                 * we might have raced with the unlocked dma_fence_signal,
                 * still run through all callbacks
                 */
-        } else
+        } else {
+                fence->timestamp = ktime_get();
+                set_bit(DMA_FENCE_FLAG_TIMESTAMP_BIT, &fence->flags);
                trace_dma_fence_signaled(fence);
+        }
        list_for_each_entry_safe(cur, tmp, &fence->cb_list, node) {
                list_del_init(&cur->node);
@@ -115,14 +113,11 @@ int dma_fence_signal(struct dma_fence *fence)
        if (!fence)
                return -EINVAL;
-        if (!ktime_to_ns(fence->timestamp)) {
-                fence->timestamp = ktime_get();
-                smp_mb__before_atomic();
-        }
        if (test_and_set_bit(DMA_FENCE_FLAG_SIGNALED_BIT, &fence->flags))
                return -EINVAL;
+        fence->timestamp = ktime_get();
+        set_bit(DMA_FENCE_FLAG_TIMESTAMP_BIT, &fence->flags);
        trace_dma_fence_signaled(fence);
        if (test_bit(DMA_FENCE_FLAG_ENABLE_SIGNAL_BIT, &fence->flags)) {
diff --git a/drivers/dma-buf/sync_debug.c b/drivers/dma-buf/sync_debug.c
index 2264a075f6a9..c4c8ecb24aa9 100644
--- a/drivers/dma-buf/sync_debug.c
+++ b/drivers/dma-buf/sync_debug.c
@@ -84,7 +84,7 @@ static void sync_print_fence(struct seq_file *s,
                   show ? "_" : "",
                   sync_status_str(status));
-        if (status) {
+        if (test_bit(DMA_FENCE_FLAG_TIMESTAMP_BIT, &fence->flags)) {
                struct timespec64 ts64 =
                        ktime_to_timespec64(fence->timestamp);
diff --git a/drivers/dma-buf/sync_file.c b/drivers/dma-buf/sync_file.c
index 545e2c5c4815..d7e219d2669d 100644
--- a/drivers/dma-buf/sync_file.c
+++ b/drivers/dma-buf/sync_file.c
@@ -391,7 +391,13 @@ static void sync_fill_fence_info(struct dma_fence *fence,
                sizeof(info->driver_name));
        info->status = dma_fence_get_status(fence);
-        info->timestamp_ns = ktime_to_ns(fence->timestamp);
+        while (test_bit(DMA_FENCE_FLAG_SIGNALED_BIT, &fence->flags) &&
+               !test_bit(DMA_FENCE_FLAG_TIMESTAMP_BIT, &fence->flags))
+                cpu_relax();
+        info->timestamp_ns =
+                test_bit(DMA_FENCE_FLAG_TIMESTAMP_BIT, &fence->flags) ?
+                ktime_to_ns(fence->timestamp) :
+                ktime_set(0, 0);
 }
 static long sync_file_ioctl_fence_info(struct sync_file *sync_file,
diff --git a/drivers/fsi/fsi-core.c b/drivers/fsi/fsi-core.c
index a485864cb512..06432d84cbf8 100644
--- a/drivers/fsi/fsi-core.c
+++ b/drivers/fsi/fsi-core.c
@@ -532,7 +532,7 @@ static inline uint32_t fsi_smode_sid(int x)
        return (x & FSI_SMODE_SID_MASK) << FSI_SMODE_SID_SHIFT;
 }
-static const uint32_t fsi_slave_smode(int id)
+static uint32_t fsi_slave_smode(int id)
 {
        return FSI_SMODE_WSC | FSI_SMODE_ECRC
                | fsi_smode_sid(id)
@@ -883,17 +883,16 @@ struct bus_type fsi_bus_type = {
 };
 EXPORT_SYMBOL_GPL(fsi_bus_type);
-static int fsi_init(void)
+static int __init fsi_init(void)
 {
        return bus_register(&fsi_bus_type);
 }
+postcore_initcall(fsi_init);
 static void fsi_exit(void)
 {
        bus_unregister(&fsi_bus_type);
 }
-module_init(fsi_init);
 module_exit(fsi_exit);
 module_param(discard_errors, int, 0664);
 MODULE_LICENSE("GPL");
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
index 5f8ada1d872b..37971d9402e3 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
@@ -101,7 +101,6 @@ void amdgpu_amdkfd_device_init(struct amdgpu_device *adev)
        if (adev->kfd) {
                struct kgd2kfd_shared_resources gpu_resources = {
                        .compute_vmid_bitmap = 0xFF00,
-                        .num_mec = adev->gfx.mec.num_mec,
                        .num_pipe_per_mec = adev->gfx.mec.num_pipe_per_mec,
                        .num_queue_per_pipe = adev->gfx.mec.num_queue_per_pipe
                };
@@ -122,7 +121,7 @@ void amdgpu_amdkfd_device_init(struct amdgpu_device *adev)
                /* According to linux/bitmap.h we shouldn't use bitmap_clear if
                 * nbits is not compile time constant */
-                last_valid_bit = adev->gfx.mec.num_mec
+                last_valid_bit = 1 /* only first MEC can have compute queues */
                                * adev->gfx.mec.num_pipe_per_mec
                                * adev->gfx.mec.num_queue_per_pipe;
                for (i = last_valid_bit; i < KGD_MAX_QUEUES; ++i)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device.c b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
index 88187bfc5ea3..3f95f7cb4019 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
@@ -226,10 +226,6 @@ bool kgd2kfd_device_init(struct kfd_dev *kfd,
        kfd->shared_resources = *gpu_resources;
-        /* We only use the first MEC */
-        if (kfd->shared_resources.num_mec > 1)
-                kfd->shared_resources.num_mec = 1;
        /* calculate max size of mqds needed for queues */
        size = max_num_of_queues_per_device *
                        kfd->device_info->mqd_size_aligned;
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
index 955aa304ff48..602769ced3bd 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
@@ -77,13 +77,6 @@ static bool is_pipe_enabled(struct device_queue_manager *dqm, int mec, int pipe)
        return false;
 }
-unsigned int get_mec_num(struct device_queue_manager *dqm)
-{
-        BUG_ON(!dqm || !dqm->dev);
-        return dqm->dev->shared_resources.num_mec;
-}
 unsigned int get_queues_num(struct device_queue_manager *dqm)
 {
        BUG_ON(!dqm || !dqm->dev);
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.h b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.h
index 66b9615bc3c1..faf820a06400 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.h
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.h
@@ -180,7 +180,6 @@ void device_queue_manager_init_cik(struct device_queue_manager_asic_ops *ops);
 void device_queue_manager_init_vi(struct device_queue_manager_asic_ops *ops);
 void program_sh_mem_settings(struct device_queue_manager *dqm,
                                        struct qcm_process_device *qpd);
-unsigned int get_mec_num(struct device_queue_manager *dqm);
 unsigned int get_queues_num(struct device_queue_manager *dqm);
 unsigned int get_queues_per_pipe(struct device_queue_manager *dqm);
 unsigned int get_pipes_per_mec(struct device_queue_manager *dqm);
diff --git a/drivers/gpu/drm/amd/include/kgd_kfd_interface.h b/drivers/gpu/drm/amd/include/kgd_kfd_interface.h
index 91ef1484b3bb..36f376677a53 100644
--- a/drivers/gpu/drm/amd/include/kgd_kfd_interface.h
+++ b/drivers/gpu/drm/amd/include/kgd_kfd_interface.h
@@ -63,9 +63,6 @@ struct kgd2kfd_shared_resources {
        /* Bit n == 1 means VMID n is available for KFD. */
        unsigned int compute_vmid_bitmap;
-        /* number of mec available from the hardware */
-        uint32_t num_mec;
        /* number of pipes per mec */
        uint32_t num_pipe_per_mec;
diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
index f7e292bf2baf..41b492f99955 100644
--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -332,6 +332,13 @@ static bool drm_dp_sideband_msg_build(struct drm_dp_sideband_msg_rx *msg,
                        return false;
                }
+                /*
+                 * ignore out-of-order messages or messages that are part of a
+                 * failed transaction
+                 */
+                if (!recv_hdr.somt && !msg->have_somt)
+                        return false;
                /* get length contained in this portion */
                msg->curchunk_len = recv_hdr.msg_len;
                msg->curchunk_hdrlen = hdrlen;
@@ -2168,7 +2175,7 @@ out_unlock:
 }
 EXPORT_SYMBOL(drm_dp_mst_topology_mgr_resume);
-static void drm_dp_get_one_sb_msg(struct drm_dp_mst_topology_mgr *mgr, bool up)
+static bool drm_dp_get_one_sb_msg(struct drm_dp_mst_topology_mgr *mgr, bool up)
 {
        int len;
        u8 replyblock[32];
@@ -2183,12 +2190,12 @@ static void drm_dp_get_one_sb_msg(struct drm_dp_mst_topology_mgr *mgr, bool up)
                               replyblock, len);
        if (ret != len) {
                DRM_DEBUG_KMS("failed to read DPCD down rep %d %d\n", len, ret);
-                return;
+                return false;
        }
        ret = drm_dp_sideband_msg_build(msg, replyblock, len, true);
        if (!ret) {
                DRM_DEBUG_KMS("sideband msg build failed %d\n", replyblock[0]);
-                return;
+                return false;
        }
        replylen = msg->curchunk_len + msg->curchunk_hdrlen;
@@ -2200,21 +2207,32 @@ static void drm_dp_get_one_sb_msg(struct drm_dp_mst_topology_mgr *mgr, bool up)
                ret = drm_dp_dpcd_read(mgr->aux, basereg + curreply,
                                    replyblock, len);
                if (ret != len) {
-                        DRM_DEBUG_KMS("failed to read a chunk\n");
+                        DRM_DEBUG_KMS("failed to read a chunk (len %d, ret %d)\n",
+                                      len, ret);
+                        return false;
                }
                ret = drm_dp_sideband_msg_build(msg, replyblock, len, false);
-                if (ret == false)
+                if (!ret) {
                        DRM_DEBUG_KMS("failed to build sideband msg\n");
+                        return false;
+                }
                curreply += len;
                replylen -= len;
        }
+        return true;
 }
 static int drm_dp_mst_handle_down_rep(struct drm_dp_mst_topology_mgr *mgr)
 {
        int ret = 0;
-        drm_dp_get_one_sb_msg(mgr, false);
+        if (!drm_dp_get_one_sb_msg(mgr, false)) {
+                memset(&mgr->down_rep_recv, 0,
+                       sizeof(struct drm_dp_sideband_msg_rx));
+                return 0;
+        }
        if (mgr->down_rep_recv.have_eomt) {
                struct drm_dp_sideband_msg_tx *txmsg;
@@ -2270,7 +2288,12 @@ static int drm_dp_mst_handle_down_rep(struct drm_dp_mst_topology_mgr *mgr)
 static int drm_dp_mst_handle_up_req(struct drm_dp_mst_topology_mgr *mgr)
 {
        int ret = 0;
-        drm_dp_get_one_sb_msg(mgr, true);
+        if (!drm_dp_get_one_sb_msg(mgr, true)) {
+                memset(&mgr->up_req_recv, 0,
+                       sizeof(struct drm_dp_sideband_msg_rx));
+                return 0;
+        }
        if (mgr->up_req_recv.have_eomt) {
                struct drm_dp_sideband_msg_req_body msg;
@@ -2322,7 +2345,9 @@ static int drm_dp_mst_handle_up_req(struct drm_dp_mst_topology_mgr *mgr)
                        DRM_DEBUG_KMS("Got RSN: pn: %d avail_pbn %d\n", msg.u.resource_stat.port_number, msg.u.resource_stat.available_pbn);
                }
-                drm_dp_put_mst_branch_device(mstb);
+                if (mstb)
+                        drm_dp_put_mst_branch_device(mstb);
                memset(&mgr->up_req_recv, 0, sizeof(struct drm_dp_sideband_msg_rx));
        }
        return ret;
diff --git a/drivers/gpu/drm/imx/ipuv3-plane.c b/drivers/gpu/drm/imx/ipuv3-plane.c
index ff53c8dec633..0847cc0d96a4 100644
--- a/drivers/gpu/drm/imx/ipuv3-plane.c
+++ b/drivers/gpu/drm/imx/ipuv3-plane.c
@@ -54,7 +54,7 @@ static const uint32_t ipu_plane_formats[] = {
        DRM_FORMAT_RGBA8888,
        DRM_FORMAT_RGBX8888,
        DRM_FORMAT_BGRA8888,
-        DRM_FORMAT_BGRA8888,
+        DRM_FORMAT_BGRX8888,
        DRM_FORMAT_UYVY,
        DRM_FORMAT_VYUY,
        DRM_FORMAT_YUYV,
diff --git a/drivers/gpu/drm/imx/parallel-display.c b/drivers/gpu/drm/imx/parallel-display.c
index 636031a30e17..8aca20209cb8 100644
--- a/drivers/gpu/drm/imx/parallel-display.c
+++ b/drivers/gpu/drm/imx/parallel-display.c
@@ -237,7 +237,7 @@ static int imx_pd_bind(struct device *dev, struct device *master, void *data)
        /* port@1 is the output port */
        ret = drm_of_find_panel_or_bridge(np, 1, 0, &imxpd->panel, &imxpd->bridge);
-        if (ret)
+        if (ret && ret != -ENODEV)
                return ret;
        imxpd->dev = dev;
diff --git a/drivers/gpu/drm/radeon/radeon_kfd.c b/drivers/gpu/drm/radeon/radeon_kfd.c
index 699fe7f9b8bf..a2ab6dcdf4a2 100644
--- a/drivers/gpu/drm/radeon/radeon_kfd.c
+++ b/drivers/gpu/drm/radeon/radeon_kfd.c
@@ -184,7 +184,6 @@ void radeon_kfd_device_init(struct radeon_device *rdev)
        if (rdev->kfd) {
                struct kgd2kfd_shared_resources gpu_resources = {
                        .compute_vmid_bitmap = 0xFF00,
-                        .num_mec = 1,
                        .num_pipe_per_mec = 4,
                        .num_queue_per_pipe = 8
                };
diff --git a/drivers/gpu/drm/vc4/vc4_crtc.c b/drivers/gpu/drm/vc4/vc4_crtc.c
index 9e0c1500375c..664a55b45af0 100644
--- a/drivers/gpu/drm/vc4/vc4_crtc.c
+++ b/drivers/gpu/drm/vc4/vc4_crtc.c
@@ -534,6 +534,34 @@ static void vc4_crtc_atomic_disable(struct drm_crtc *crtc,
        }
 }
+static void vc4_crtc_update_dlist(struct drm_crtc *crtc)
+{
+        struct drm_device *dev = crtc->dev;
+        struct vc4_dev *vc4 = to_vc4_dev(dev);
+        struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc);
+        struct vc4_crtc_state *vc4_state = to_vc4_crtc_state(crtc->state);
+        if (crtc->state->event) {
+                unsigned long flags;
+                crtc->state->event->pipe = drm_crtc_index(crtc);
+                WARN_ON(drm_crtc_vblank_get(crtc) != 0);
+                spin_lock_irqsave(&dev->event_lock, flags);
+                vc4_crtc->event = crtc->state->event;
+                crtc->state->event = NULL;
+                HVS_WRITE(SCALER_DISPLISTX(vc4_crtc->channel),
+                          vc4_state->mm.start);
+                spin_unlock_irqrestore(&dev->event_lock, flags);
+        } else {
+                HVS_WRITE(SCALER_DISPLISTX(vc4_crtc->channel),
+                          vc4_state->mm.start);
+        }
+}
 static void vc4_crtc_atomic_enable(struct drm_crtc *crtc,
                                   struct drm_crtc_state *old_state)
 {
@@ -545,6 +573,12 @@ static void vc4_crtc_atomic_enable(struct drm_crtc *crtc,
        require_hvs_enabled(dev);
+        /* Enable vblank irq handling before crtc is started otherwise
+         * drm_crtc_get_vblank() fails in vc4_crtc_update_dlist().
+         */
+        drm_crtc_vblank_on(crtc);
+        vc4_crtc_update_dlist(crtc);
        /* Turn on the scaler, which will wait for vstart to start
         * compositing.
         */
@@ -556,9 +590,6 @@ static void vc4_crtc_atomic_enable(struct drm_crtc *crtc,
        /* Turn on the pixel valve, which will emit the vstart signal. */
        CRTC_WRITE(PV_V_CONTROL,
                   CRTC_READ(PV_V_CONTROL) | PV_VCONTROL_VIDEN);
-        /* Enable vblank irq handling after crtc is started. */
-        drm_crtc_vblank_on(crtc);
 }
 static enum drm_mode_status vc4_crtc_mode_valid(struct drm_crtc *crtc,
@@ -612,7 +643,6 @@ static void vc4_crtc_atomic_flush(struct drm_crtc *crtc,
 {
        struct drm_device *dev = crtc->dev;
        struct vc4_dev *vc4 = to_vc4_dev(dev);
-        struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc);
        struct vc4_crtc_state *vc4_state = to_vc4_crtc_state(crtc->state);
        struct drm_plane *plane;
        bool debug_dump_regs = false;
@@ -634,25 +664,15 @@ static void vc4_crtc_atomic_flush(struct drm_crtc *crtc,
        WARN_ON_ONCE(dlist_next - dlist_start != vc4_state->mm.size);
-        if (crtc->state->event) {
+        /* Only update DISPLIST if the CRTC was already running and is not
-                unsigned long flags;
+         * being disabled.
+         * vc4_crtc_enable() takes care of updating the dlist just after
-                crtc->state->event->pipe = drm_crtc_index(crtc);
+         * re-enabling VBLANK interrupts and before enabling the engine.
+         * If the CRTC is being disabled, there's no point in updating this
-                WARN_ON(drm_crtc_vblank_get(crtc) != 0);
+         * information.
+         */
-                spin_lock_irqsave(&dev->event_lock, flags);
+        if (crtc->state->active && old_state->active)
-                vc4_crtc->event = crtc->state->event;
+                vc4_crtc_update_dlist(crtc);
-                crtc->state->event = NULL;
-                HVS_WRITE(SCALER_DISPLISTX(vc4_crtc->channel),
-                          vc4_state->mm.start);
-                spin_unlock_irqrestore(&dev->event_lock, flags);
-        } else {
-                HVS_WRITE(SCALER_DISPLISTX(vc4_crtc->channel),
-                          vc4_state->mm.start);
-        }
        if (debug_dump_regs) {
                DRM_INFO("CRTC %d HVS after:\n", drm_crtc_index(crtc));
diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
index 41b39464ded8..501e16a9227d 100644
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -2732,6 +2732,9 @@ static int hidpp_initialize_battery(struct hidpp_device *hidpp)
                                     hidpp_battery_props,
                                     sizeof(hidpp_battery_props),
                                     GFP_KERNEL);
+        if (!battery_props)
+                return -ENOMEM;
        num_battery_props = ARRAY_SIZE(hidpp_battery_props) - 2;
        if (hidpp->capabilities & HIDPP_CAPABILITY_BATTERY_MILEAGE)
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index f3e35e7a189d..aff20f4b6d97 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -620,16 +620,6 @@ static int mt_touch_input_mapping(struct hid_device *hdev, struct hid_input *hi,
        return 0;
 }
-static int mt_touch_input_mapped(struct hid_device *hdev, struct hid_input *hi,
-                struct hid_field *field, struct hid_usage *usage,
-                unsigned long **bit, int *max)
-{
-        if (usage->type == EV_KEY || usage->type == EV_ABS)
-                set_bit(usage->type, hi->input->evbit);
-        return -1;
-}
 static int mt_compute_slot(struct mt_device *td, struct input_dev *input)
 {
        __s32 quirks = td->mtclass.quirks;
@@ -969,8 +959,10 @@ static int mt_input_mapped(struct hid_device *hdev, struct hid_input *hi,
                return 0;
        if (field->application == HID_DG_TOUCHSCREEN ||
-            field->application == HID_DG_TOUCHPAD)
+            field->application == HID_DG_TOUCHPAD) {
-                return mt_touch_input_mapped(hdev, hi, field, usage, bit, max);
+                /* We own these mappings, tell hid-input to ignore them */
+                return -1;
+        }
        /* let hid-core decide for the others */
        return 0;
diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
index e9bf0bb87ac4..e57cc40cb768 100644
--- a/drivers/hv/channel.c
+++ b/drivers/hv/channel.c
@@ -606,6 +606,8 @@ static int vmbus_close_internal(struct vmbus_channel *channel)
                get_order(channel->ringbuffer_pagecount * PAGE_SIZE));
 out:
+        /* re-enable tasklet for use on re-open */
+        tasklet_enable(&channel->callback_event);
        return ret;
 }
diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c
index 0af7fd311979..76c34f4fde13 100644
--- a/drivers/hwmon/applesmc.c
+++ b/drivers/hwmon/applesmc.c
@@ -566,6 +566,8 @@ static int applesmc_init_smcreg_try(void)
        if (ret)
                return ret;
        s->fan_count = tmp[0];
+        if (s->fan_count > 10)
+                s->fan_count = 10;
        ret = applesmc_get_lower_bound(&s->temp_begin, "T");
        if (ret)
@@ -811,7 +813,8 @@ static ssize_t applesmc_show_fan_speed(struct device *dev,
        char newkey[5];
        u8 buffer[2];
-        sprintf(newkey, fan_speed_fmt[to_option(attr)], to_index(attr));
+        scnprintf(newkey, sizeof(newkey), fan_speed_fmt[to_option(attr)],
+                  to_index(attr));
        ret = applesmc_read_key(newkey, buffer, 2);
        speed = ((buffer[0] << 8 | buffer[1]) >> 2);
@@ -834,7 +837,8 @@ static ssize_t applesmc_store_fan_speed(struct device *dev,
        if (kstrtoul(sysfsbuf, 10, &speed) < 0 || speed >= 0x4000)
                return -EINVAL;         /* Bigger than a 14-bit value */
-        sprintf(newkey, fan_speed_fmt[to_option(attr)], to_index(attr));
+        scnprintf(newkey, sizeof(newkey), fan_speed_fmt[to_option(attr)],
+                  to_index(attr));
        buffer[0] = (speed >> 6) & 0xff;
        buffer[1] = (speed << 2) & 0xff;
@@ -903,7 +907,7 @@ static ssize_t applesmc_show_fan_position(struct device *dev,
        char newkey[5];
        u8 buffer[17];
-        sprintf(newkey, FAN_ID_FMT, to_index(attr));
+        scnprintf(newkey, sizeof(newkey), FAN_ID_FMT, to_index(attr));
        ret = applesmc_read_key(newkey, buffer, 16);
        buffer[16] = 0;
@@ -1116,7 +1120,8 @@ static int applesmc_create_nodes(struct applesmc_node_group *groups, int num)
                }
                for (i = 0; i < num; i++) {
                        node = &grp->nodes[i];
-                        sprintf(node->name, grp->format, i + 1);
+                        scnprintf(node->name, sizeof(node->name), grp->format,
+                                  i + 1);
                        node->sda.index = (grp->option << 16) | (i & 0xffff);
                        node->sda.dev_attr.show = grp->show;
                        node->sda.dev_attr.store = grp->store;
diff --git a/drivers/ide/ide-timings.c b/drivers/ide/ide-timings.c
index 0e05f75934c9..1858e3ce3993 100644
--- a/drivers/ide/ide-timings.c
+++ b/drivers/ide/ide-timings.c
@@ -104,19 +104,19 @@ u16 ide_pio_cycle_time(ide_drive_t *drive, u8 pio)
 EXPORT_SYMBOL_GPL(ide_pio_cycle_time);
 #define ENOUGH(v, unit)         (((v) - 1) / (unit) + 1)
-#define EZ(v, unit)             ((v) ? ENOUGH(v, unit) : 0)
+#define EZ(v, unit)             ((v) ? ENOUGH((v) * 1000, unit) : 0)
 static void ide_timing_quantize(struct ide_timing *t, struct ide_timing *q,
                                int T, int UT)
 {
-        q->setup   = EZ(t->setup   * 1000,  T);
+        q->setup   = EZ(t->setup,   T);
-        q->act8b   = EZ(t->act8b   * 1000,  T);
+        q->act8b   = EZ(t->act8b,   T);
-        q->rec8b   = EZ(t->rec8b   * 1000,  T);
+        q->rec8b   = EZ(t->rec8b,   T);
-        q->cyc8b   = EZ(t->cyc8b   * 1000,  T);
+        q->cyc8b   = EZ(t->cyc8b,   T);
-        q->active  = EZ(t->active  * 1000,  T);
+        q->active  = EZ(t->active,  T);
-        q->recover = EZ(t->recover * 1000,  T);
+        q->recover = EZ(t->recover, T);
-        q->cycle   = EZ(t->cycle   * 1000,  T);
+        q->cycle   = EZ(t->cycle,   T);
-        q->udma    = EZ(t->udma    * 1000, UT);
+        q->udma    = EZ(t->udma,    UT);
 }
 void ide_timing_merge(struct ide_timing *a, struct ide_timing *b,
diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
index a6cb379a4ebc..01236cef7bfb 100644
--- a/drivers/infiniband/core/addr.c
+++ b/drivers/infiniband/core/addr.c
@@ -268,6 +268,7 @@ int rdma_translate_ip(const struct sockaddr *addr,
                        return ret;
                ret = rdma_copy_addr(dev_addr, dev, NULL);
+                dev_addr->bound_dev_if = dev->ifindex;
                if (vlan_id)
                        *vlan_id = rdma_vlan_dev_vlan_id(dev);
                dev_put(dev);
@@ -280,6 +281,7 @@ int rdma_translate_ip(const struct sockaddr *addr,
                                          &((const struct sockaddr_in6 *)addr)->sin6_addr,
                                          dev, 1)) {
                                ret = rdma_copy_addr(dev_addr, dev, NULL);
+                                dev_addr->bound_dev_if = dev->ifindex;
                                if (vlan_id)
                                        *vlan_id = rdma_vlan_dev_vlan_id(dev);
                                break;
@@ -405,10 +407,10 @@ static int addr4_resolve(struct sockaddr_in *src_in,
        fl4.saddr = src_ip;
        fl4.flowi4_oif = addr->bound_dev_if;
        rt = ip_route_output_key(addr->net, &fl4);
-        if (IS_ERR(rt)) {
+        ret = PTR_ERR_OR_ZERO(rt);
-                ret = PTR_ERR(rt);
+        if (ret)
-                goto out;
+                return ret;
-        }
        src_in->sin_family = AF_INET;
        src_in->sin_addr.s_addr = fl4.saddr;
@@ -423,8 +425,6 @@ static int addr4_resolve(struct sockaddr_in *src_in,
        *prt = rt;
        return 0;
-out:
-        return ret;
 }
 #if IS_ENABLED(CONFIG_IPV6)
@@ -509,6 +509,11 @@ static int addr_resolve(struct sockaddr *src_in,
        struct dst_entry *dst;
        int ret;
+        if (!addr->net) {
+                pr_warn_ratelimited("%s: missing namespace\n", __func__);
+                return -EINVAL;
+        }
        if (src_in->sa_family == AF_INET) {
                struct rtable *rt = NULL;
                const struct sockaddr_in *dst_in4 =
@@ -522,8 +527,12 @@ static int addr_resolve(struct sockaddr *src_in,
                if (resolve_neigh)
                        ret = addr_resolve_neigh(&rt->dst, dst_in, addr, seq);
-                ndev = rt->dst.dev;
+                if (addr->bound_dev_if) {
-                dev_hold(ndev);
+                        ndev = dev_get_by_index(addr->net, addr->bound_dev_if);
+                } else {
+                        ndev = rt->dst.dev;
+                        dev_hold(ndev);
+                }
                ip_rt_put(rt);
        } else {
@@ -539,14 +548,27 @@ static int addr_resolve(struct sockaddr *src_in,
                if (resolve_neigh)
                        ret = addr_resolve_neigh(dst, dst_in, addr, seq);
-                ndev = dst->dev;
+                if (addr->bound_dev_if) {
-                dev_hold(ndev);
+                        ndev = dev_get_by_index(addr->net, addr->bound_dev_if);
+                } else {
+                        ndev = dst->dev;
+                        dev_hold(ndev);
+                }
                dst_release(dst);
        }
-        addr->bound_dev_if = ndev->ifindex;
+        if (ndev->flags & IFF_LOOPBACK) {
-        addr->net = dev_net(ndev);
+                ret = rdma_translate_ip(dst_in, addr, NULL);
+                /*
+                 * Put the loopback device and get the translated
+                 * device instead.
+                 */
+                dev_put(ndev);
+                ndev = dev_get_by_index(addr->net, addr->bound_dev_if);
+        } else {
+                addr->bound_dev_if = ndev->ifindex;
+        }
        dev_put(ndev);
        return ret;
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 31bb82d8ecd7..0eb393237ba2 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -623,22 +623,11 @@ static inline int cma_validate_port(struct ib_device *device, u8 port,
        if ((dev_type != ARPHRD_INFINIBAND) && rdma_protocol_ib(device, port))
                return ret;
-        if (dev_type == ARPHRD_ETHER && rdma_protocol_roce(device, port)) {
+        if (dev_type == ARPHRD_ETHER && rdma_protocol_roce(device, port))
                ndev = dev_get_by_index(&init_net, bound_if_index);
-                if (ndev && ndev->flags & IFF_LOOPBACK) {
+        else
-                        pr_info("detected loopback device\n");
-                        dev_put(ndev);
-                        if (!device->get_netdev)
-                                return -EOPNOTSUPP;
-                        ndev = device->get_netdev(device, port);
-                        if (!ndev)
-                                return -ENODEV;
-                }
-        } else {
                gid_type = IB_GID_TYPE_IB;
-        }
        ret = ib_find_cached_gid_by_port(device, gid, gid_type, port,
                                         ndev, NULL);
@@ -1044,6 +1033,8 @@ int rdma_init_qp_attr(struct rdma_cm_id *id, struct ib_qp_attr *qp_attr,
                } else
                        ret = iw_cm_init_qp_attr(id_priv->cm_id.iw, qp_attr,
                                                 qp_attr_mask);
+                qp_attr->port_num = id_priv->id.port_num;
+                *qp_attr_mask |= IB_QP_PORT;
        } else
                ret = -ENOSYS;
@@ -2569,21 +2560,6 @@ static int cma_resolve_iboe_route(struct rdma_id_private *id_priv)
                        goto err2;
                }
-                if (ndev->flags & IFF_LOOPBACK) {
-                        dev_put(ndev);
-                        if (!id_priv->id.device->get_netdev) {
-                                ret = -EOPNOTSUPP;
-                                goto err2;
-                        }
-                        ndev = id_priv->id.device->get_netdev(id_priv->id.device,
-                                                              id_priv->id.port_num);
-                        if (!ndev) {
-                                ret = -ENODEV;
-                                goto err2;
-                        }
-                }
                supported_gids = roce_gid_type_mask_support(id_priv->id.device,
                                                            id_priv->id.port_num);
                gid_type = cma_route_gid_type(addr->dev_addr.network,
diff --git a/drivers/infiniband/core/roce_gid_mgmt.c b/drivers/infiniband/core/roce_gid_mgmt.c
index db958d3207ef..94a9eefb3cfc 100644
--- a/drivers/infiniband/core/roce_gid_mgmt.c
+++ b/drivers/infiniband/core/roce_gid_mgmt.c
@@ -42,6 +42,8 @@
 #include <rdma/ib_cache.h>
 #include <rdma/ib_addr.h>
+static struct workqueue_struct *gid_cache_wq;
 enum gid_op_type {
        GID_DEL = 0,
        GID_ADD
@@ -560,7 +562,7 @@ static int netdevice_queue_work(struct netdev_event_work_cmd *cmds,
        }
        INIT_WORK(&ndev_work->work, netdevice_event_work_handler);
-        queue_work(ib_wq, &ndev_work->work);
+        queue_work(gid_cache_wq, &ndev_work->work);
        return NOTIFY_DONE;
 }
@@ -693,7 +695,7 @@ static int addr_event(struct notifier_block *this, unsigned long event,
        dev_hold(ndev);
        work->gid_attr.ndev   = ndev;
-        queue_work(ib_wq, &work->work);
+        queue_work(gid_cache_wq, &work->work);
        return NOTIFY_DONE;
 }
@@ -740,6 +742,10 @@ static struct notifier_block nb_inet6addr = {
 int __init roce_gid_mgmt_init(void)
 {
+        gid_cache_wq = alloc_ordered_workqueue("gid-cache-wq", 0);
+        if (!gid_cache_wq)
+                return -ENOMEM;
        register_inetaddr_notifier(&nb_inetaddr);
        if (IS_ENABLED(CONFIG_IPV6))
                register_inet6addr_notifier(&nb_inet6addr);
@@ -764,4 +770,5 @@ void __exit roce_gid_mgmt_cleanup(void)
         * ib-core is removed, all physical devices have been removed,
         * so no issue with remaining hardware contexts.
         */
+        destroy_workqueue(gid_cache_wq);
 }
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 8ba9bfb073d1..2c98533a0203 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -1296,7 +1296,6 @@ ssize_t ib_uverbs_destroy_cq(struct ib_uverbs_file *file,
        struct ib_uobject               *uobj;
        struct ib_cq                    *cq;
        struct ib_ucq_object            *obj;
-        struct ib_uverbs_event_queue    *ev_queue;
        int                              ret = -EINVAL;
        if (copy_from_user(&cmd, buf, sizeof cmd))
@@ -1313,7 +1312,6 @@ ssize_t ib_uverbs_destroy_cq(struct ib_uverbs_file *file,
         */
        uverbs_uobject_get(uobj);
        cq      = uobj->object;
-        ev_queue = cq->cq_context;
        obj     = container_of(cq->uobject, struct ib_ucq_object, uobject);
        memset(&resp, 0, sizeof(resp));
@@ -1935,7 +1933,8 @@ static int modify_qp(struct ib_uverbs_file *file,
                goto out;
        }
-        if (!rdma_is_port_valid(qp->device, cmd->base.port_num)) {
+        if ((cmd->base.attr_mask & IB_QP_PORT) &&
+            !rdma_is_port_valid(qp->device, cmd->base.port_num)) {
                ret = -EINVAL;
                goto release_qp;
        }
@@ -2005,28 +2004,13 @@ static int modify_qp(struct ib_uverbs_file *file,
        rdma_ah_set_port_num(&attr->alt_ah_attr,
                             cmd->base.alt_dest.port_num);
-        if (qp->real_qp == qp) {
+        ret = ib_modify_qp_with_udata(qp, attr,
-                if (cmd->base.attr_mask & IB_QP_AV) {
+                                      modify_qp_mask(qp->qp_type,
-                        ret = ib_resolve_eth_dmac(qp->device, &attr->ah_attr);
+                                                     cmd->base.attr_mask),
-                        if (ret)
+                                      udata);
-                                goto release_qp;
-                }
-                ret = ib_security_modify_qp(qp,
-                                            attr,
-                                            modify_qp_mask(qp->qp_type,
-                                                           cmd->base.attr_mask),
-                                            udata);
-        } else {
-                ret = ib_security_modify_qp(qp,
-                                            attr,
-                                            modify_qp_mask(qp->qp_type,
-                                                           cmd->base.attr_mask),
-                                            NULL);
-        }
 release_qp:
        uobj_put_obj_read(qp);
 out:
        kfree(attr);
@@ -2103,7 +2087,6 @@ ssize_t ib_uverbs_destroy_qp(struct ib_uverbs_file *file,
        struct ib_uverbs_destroy_qp      cmd;
        struct ib_uverbs_destroy_qp_resp resp;
        struct ib_uobject               *uobj;
-        struct ib_qp                    *qp;
        struct ib_uqp_object            *obj;
        int                              ret = -EINVAL;
@@ -2117,7 +2100,6 @@ ssize_t ib_uverbs_destroy_qp(struct ib_uverbs_file *file,
        if (IS_ERR(uobj))
                return PTR_ERR(uobj);
-        qp  = uobj->object;
        obj = container_of(uobj, struct ib_uqp_object, uevent.uobject);
        /*
         * Make sure we don't free the memory in remove_commit as we still
@@ -3019,7 +3001,6 @@ int ib_uverbs_ex_destroy_wq(struct ib_uverbs_file *file,
 {
        struct ib_uverbs_ex_destroy_wq  cmd = {};
        struct ib_uverbs_ex_destroy_wq_resp     resp = {};
-        struct ib_wq                    *wq;
        struct ib_uobject               *uobj;
        struct ib_uwq_object            *obj;
        size_t required_cmd_sz;
@@ -3053,7 +3034,6 @@ int ib_uverbs_ex_destroy_wq(struct ib_uverbs_file *file,
        if (IS_ERR(uobj))
                return PTR_ERR(uobj);
-        wq = uobj->object;
        obj = container_of(uobj, struct ib_uwq_object, uevent.uobject);
        /*
         * Make sure we don't free the memory in remove_commit as we still
@@ -3743,10 +3723,8 @@ ssize_t ib_uverbs_destroy_srq(struct ib_uverbs_file *file,
        struct ib_uverbs_destroy_srq      cmd;
        struct ib_uverbs_destroy_srq_resp resp;
        struct ib_uobject                *uobj;
-        struct ib_srq                    *srq;
        struct ib_uevent_object          *obj;
        int                               ret = -EINVAL;
-        enum ib_srq_type                  srq_type;
        if (copy_from_user(&cmd, buf, sizeof cmd))
                return -EFAULT;
@@ -3756,9 +3734,7 @@ ssize_t ib_uverbs_destroy_srq(struct ib_uverbs_file *file,
        if (IS_ERR(uobj))
                return PTR_ERR(uobj);
-        srq = uobj->object;
        obj = container_of(uobj, struct ib_uevent_object, uobject);
-        srq_type = srq->srq_type;
        /*
         * Make sure we don't free the memory in remove_commit as we still
         * needs the uobject memory to create the response.
diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
index c973a83c898b..fb98ed67d5bc 100644
--- a/drivers/infiniband/core/verbs.c
+++ b/drivers/infiniband/core/verbs.c
@@ -452,6 +452,19 @@ int ib_get_gids_from_rdma_hdr(const union rdma_network_hdr *hdr,
 }
 EXPORT_SYMBOL(ib_get_gids_from_rdma_hdr);
+/*
+ * This function creates ah from the incoming packet.
+ * Incoming packet has dgid of the receiver node on which this code is
+ * getting executed and, sgid contains the GID of the sender.
+ *
+ * When resolving mac address of destination, the arrived dgid is used
+ * as sgid and, sgid is used as dgid because sgid contains destinations
+ * GID whom to respond to.
+ *
+ * This is why when calling rdma_addr_find_l2_eth_by_grh() function, the
+ * position of arguments dgid and sgid do not match the order of the
+ * parameters.
+ */
 int ib_init_ah_from_wc(struct ib_device *device, u8 port_num,
                       const struct ib_wc *wc, const struct ib_grh *grh,
                       struct rdma_ah_attr *ah_attr)
@@ -507,11 +520,6 @@ int ib_init_ah_from_wc(struct ib_device *device, u8 port_num,
                }
                resolved_dev = dev_get_by_index(&init_net, if_index);
-                if (resolved_dev->flags & IFF_LOOPBACK) {
-                        dev_put(resolved_dev);
-                        resolved_dev = idev;
-                        dev_hold(resolved_dev);
-                }
                rcu_read_lock();
                if (resolved_dev != idev && !rdma_is_upper_dev_rcu(idev,
                                                                   resolved_dev))
@@ -887,6 +895,7 @@ static const struct {
 } qp_state_table[IB_QPS_ERR + 1][IB_QPS_ERR + 1] = {
        [IB_QPS_RESET] = {
                [IB_QPS_RESET] = { .valid = 1 },
+                [IB_QPS_ERR] =   { .valid = 1 },
                [IB_QPS_INIT]  = {
                        .valid = 1,
                        .req_param = {
@@ -1268,20 +1277,36 @@ out:
 }
 EXPORT_SYMBOL(ib_resolve_eth_dmac);
-int ib_modify_qp(struct ib_qp *qp,
+/**
-                 struct ib_qp_attr *qp_attr,
+ * ib_modify_qp_with_udata - Modifies the attributes for the specified QP.
-                 int qp_attr_mask)
+ * @qp: The QP to modify.
+ * @attr: On input, specifies the QP attributes to modify.  On output,
+ *   the current values of selected QP attributes are returned.
+ * @attr_mask: A bit-mask used to specify which attributes of the QP
+ *   are being modified.
+ * @udata: pointer to user's input output buffer information
+ *   are being modified.
+ * It returns 0 on success and returns appropriate error code on error.
+ */
+int ib_modify_qp_with_udata(struct ib_qp *qp, struct ib_qp_attr *attr,
+                            int attr_mask, struct ib_udata *udata)
 {
+        int ret;
-        if (qp_attr_mask & IB_QP_AV) {
+        if (attr_mask & IB_QP_AV) {
-                int ret;
+                ret = ib_resolve_eth_dmac(qp->device, &attr->ah_attr);
-                ret = ib_resolve_eth_dmac(qp->device, &qp_attr->ah_attr);
                if (ret)
                        return ret;
        }
+        return ib_security_modify_qp(qp, attr, attr_mask, udata);
+}
+EXPORT_SYMBOL(ib_modify_qp_with_udata);
-        return ib_security_modify_qp(qp->real_qp, qp_attr, qp_attr_mask, NULL);
+int ib_modify_qp(struct ib_qp *qp,
+                 struct ib_qp_attr *qp_attr,
+                 int qp_attr_mask)
+{
+        return ib_modify_qp_with_udata(qp, qp_attr, qp_attr_mask, NULL);
 }
 EXPORT_SYMBOL(ib_modify_qp);
diff --git a/drivers/infiniband/hw/bnxt_re/bnxt_re.h b/drivers/infiniband/hw/bnxt_re/bnxt_re.h
index 08772836fded..85527532c49d 100644
--- a/drivers/infiniband/hw/bnxt_re/bnxt_re.h
+++ b/drivers/infiniband/hw/bnxt_re/bnxt_re.h
@@ -51,6 +51,8 @@
 #define BNXT_RE_PAGE_SIZE_8M            BIT(23)
 #define BNXT_RE_PAGE_SIZE_1G            BIT(30)
+#define BNXT_RE_MAX_MR_SIZE             BIT(30)
 #define BNXT_RE_MAX_QPC_COUNT           (64 * 1024)
 #define BNXT_RE_MAX_MRW_COUNT           (64 * 1024)
 #define BNXT_RE_MAX_SRQC_COUNT          (64 * 1024)
@@ -60,6 +62,13 @@
 #define BNXT_RE_RQ_WQE_THRESHOLD        32
+/*
+ * Setting the default ack delay value to 16, which means
+ * the default timeout is approx. 260ms(4 usec * 2 ^(timeout))
+ */
+#define BNXT_RE_DEFAULT_ACK_DELAY       16
 struct bnxt_re_work {
        struct work_struct      work;
        unsigned long           event;
diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
index c7bd68311d0c..f0e01b3ac711 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
@@ -145,10 +145,8 @@ int bnxt_re_query_device(struct ib_device *ibdev,
        ib_attr->fw_ver = (u64)(unsigned long)(dev_attr->fw_ver);
        bnxt_qplib_get_guid(rdev->netdev->dev_addr,
                            (u8 *)&ib_attr->sys_image_guid);
-        ib_attr->max_mr_size = ~0ull;
+        ib_attr->max_mr_size = BNXT_RE_MAX_MR_SIZE;
-        ib_attr->page_size_cap = BNXT_RE_PAGE_SIZE_4K | BNXT_RE_PAGE_SIZE_8K |
+        ib_attr->page_size_cap = BNXT_RE_PAGE_SIZE_4K;
-                                 BNXT_RE_PAGE_SIZE_64K | BNXT_RE_PAGE_SIZE_2M |
-                                 BNXT_RE_PAGE_SIZE_8M | BNXT_RE_PAGE_SIZE_1G;
        ib_attr->vendor_id = rdev->en_dev->pdev->vendor;
        ib_attr->vendor_part_id = rdev->en_dev->pdev->device;
@@ -174,9 +172,11 @@ int bnxt_re_query_device(struct ib_device *ibdev,
        ib_attr->max_mr = dev_attr->max_mr;
        ib_attr->max_pd = dev_attr->max_pd;
        ib_attr->max_qp_rd_atom = dev_attr->max_qp_rd_atom;
-        ib_attr->max_qp_init_rd_atom = dev_attr->max_qp_rd_atom;
+        ib_attr->max_qp_init_rd_atom = dev_attr->max_qp_init_rd_atom;
-        ib_attr->atomic_cap = IB_ATOMIC_HCA;
+        if (dev_attr->is_atomic) {
-        ib_attr->masked_atomic_cap = IB_ATOMIC_HCA;
+                ib_attr->atomic_cap = IB_ATOMIC_HCA;
+                ib_attr->masked_atomic_cap = IB_ATOMIC_HCA;
+        }
        ib_attr->max_ee_rd_atom = 0;
        ib_attr->max_res_rd_atom = 0;
@@ -201,7 +201,7 @@ int bnxt_re_query_device(struct ib_device *ibdev,
        ib_attr->max_fast_reg_page_list_len = MAX_PBL_LVL_1_PGS;
        ib_attr->max_pkeys = 1;
-        ib_attr->local_ca_ack_delay = 0;
+        ib_attr->local_ca_ack_delay = BNXT_RE_DEFAULT_ACK_DELAY;
        return 0;
 }
@@ -390,15 +390,17 @@ int bnxt_re_del_gid(struct ib_device *ibdev, u8 port_num,
                        return -EINVAL;
                ctx->refcnt--;
                if (!ctx->refcnt) {
-                        rc = bnxt_qplib_del_sgid
+                        rc = bnxt_qplib_del_sgid(sgid_tbl,
-                                        (sgid_tbl,
+                                                 &sgid_tbl->tbl[ctx->idx],
-                                         &sgid_tbl->tbl[ctx->idx], true);
+                                                 true);
-                        if (rc)
+                        if (rc) {
                                dev_err(rdev_to_dev(rdev),
                                        "Failed to remove GID: %#x", rc);
-                        ctx_tbl = sgid_tbl->ctx;
+                        } else {
-                        ctx_tbl[ctx->idx] = NULL;
+                                ctx_tbl = sgid_tbl->ctx;
-                        kfree(ctx);
+                                ctx_tbl[ctx->idx] = NULL;
+                                kfree(ctx);
+                        }
                }
        } else {
                return -EINVAL;
@@ -588,10 +590,10 @@ static int bnxt_re_create_fence_mr(struct bnxt_re_pd *pd)
        /* Create a fence MW only for kernel consumers */
        mw = bnxt_re_alloc_mw(&pd->ib_pd, IB_MW_TYPE_1, NULL);
-        if (!mw) {
+        if (IS_ERR(mw)) {
                dev_err(rdev_to_dev(rdev),
                        "Failed to create fence-MW for PD: %p\n", pd);
-                rc = -EINVAL;
+                rc = PTR_ERR(mw);
                goto fail;
        }
        fence->mw = mw;
@@ -612,30 +614,13 @@ int bnxt_re_dealloc_pd(struct ib_pd *ib_pd)
        int rc;
        bnxt_re_destroy_fence_mr(pd);
-        if (ib_pd->uobject && pd->dpi.dbr) {
-                struct ib_ucontext *ib_uctx = ib_pd->uobject->context;
-                struct bnxt_re_ucontext *ucntx;
-                /* Free DPI only if this is the first PD allocated by the
+        if (pd->qplib_pd.id) {
-                 * application and mark the context dpi as NULL
+                rc = bnxt_qplib_dealloc_pd(&rdev->qplib_res,
-                 */
+                                           &rdev->qplib_res.pd_tbl,
-                ucntx = container_of(ib_uctx, struct bnxt_re_ucontext, ib_uctx);
+                                           &pd->qplib_pd);
-                rc = bnxt_qplib_dealloc_dpi(&rdev->qplib_res,
-                                            &rdev->qplib_res.dpi_tbl,
-                                            &pd->dpi);
                if (rc)
-                        dev_err(rdev_to_dev(rdev), "Failed to deallocate HW DPI");
+                        dev_err(rdev_to_dev(rdev), "Failed to deallocate HW PD");
-                        /* Don't fail, continue*/
-                ucntx->dpi = NULL;
-        }
-        rc = bnxt_qplib_dealloc_pd(&rdev->qplib_res,
-                                   &rdev->qplib_res.pd_tbl,
-                                   &pd->qplib_pd);
-        if (rc) {
-                dev_err(rdev_to_dev(rdev), "Failed to deallocate HW PD");
-                return rc;
        }
        kfree(pd);
@@ -667,23 +652,22 @@ struct ib_pd *bnxt_re_alloc_pd(struct ib_device *ibdev,
        if (udata) {
                struct bnxt_re_pd_resp resp;
-                if (!ucntx->dpi) {
+                if (!ucntx->dpi.dbr) {
                        /* Allocate DPI in alloc_pd to avoid failing of
                         * ibv_devinfo and family of application when DPIs
                         * are depleted.
                         */
                        if (bnxt_qplib_alloc_dpi(&rdev->qplib_res.dpi_tbl,
-                                                 &pd->dpi, ucntx)) {
+                                                 &ucntx->dpi, ucntx)) {
                                rc = -ENOMEM;
                                goto dbfail;
                        }
-                        ucntx->dpi = &pd->dpi;
                }
                resp.pdid = pd->qplib_pd.id;
                /* Still allow mapping this DBR to the new user PD. */
-                resp.dpi = ucntx->dpi->dpi;
+                resp.dpi = ucntx->dpi.dpi;
-                resp.dbr = (u64)ucntx->dpi->umdbr;
+                resp.dbr = (u64)ucntx->dpi.umdbr;
                rc = ib_copy_to_udata(udata, &resp, sizeof(resp));
                if (rc) {
@@ -960,7 +944,7 @@ static int bnxt_re_init_user_qp(struct bnxt_re_dev *rdev, struct bnxt_re_pd *pd,
                qplib_qp->rq.nmap = umem->nmap;
        }
-        qplib_qp->dpi = cntx->dpi;
+        qplib_qp->dpi = &cntx->dpi;
        return 0;
 rqfail:
        ib_umem_release(qp->sumem);
@@ -1530,13 +1514,24 @@ int bnxt_re_modify_qp(struct ib_qp *ib_qp, struct ib_qp_attr *qp_attr,
        if (qp_attr_mask & IB_QP_MAX_QP_RD_ATOMIC) {
                qp->qplib_qp.modify_flags |=
                                CMDQ_MODIFY_QP_MODIFY_MASK_MAX_RD_ATOMIC;
-                qp->qplib_qp.max_rd_atomic = qp_attr->max_rd_atomic;
+                /* Cap the max_rd_atomic to device max */
+                qp->qplib_qp.max_rd_atomic = min_t(u32, qp_attr->max_rd_atomic,
+                                                   dev_attr->max_qp_rd_atom);
        }
        if (qp_attr_mask & IB_QP_SQ_PSN) {
                qp->qplib_qp.modify_flags |= CMDQ_MODIFY_QP_MODIFY_MASK_SQ_PSN;
                qp->qplib_qp.sq.psn = qp_attr->sq_psn;
        }
        if (qp_attr_mask & IB_QP_MAX_DEST_RD_ATOMIC) {
+                if (qp_attr->max_dest_rd_atomic >
+                    dev_attr->max_qp_init_rd_atom) {
+                        dev_err(rdev_to_dev(rdev),
+                                "max_dest_rd_atomic requested%d is > dev_max%d",
+                                qp_attr->max_dest_rd_atomic,
+                                dev_attr->max_qp_init_rd_atom);
+                        return -EINVAL;
+                }
                qp->qplib_qp.modify_flags |=
                                CMDQ_MODIFY_QP_MODIFY_MASK_MAX_DEST_RD_ATOMIC;
                qp->qplib_qp.max_dest_rd_atomic = qp_attr->max_dest_rd_atomic;
@@ -2403,7 +2398,7 @@ struct ib_cq *bnxt_re_create_cq(struct ib_device *ibdev,
                }
                cq->qplib_cq.sghead = cq->umem->sg_head.sgl;
                cq->qplib_cq.nmap = cq->umem->nmap;
-                cq->qplib_cq.dpi = uctx->dpi;
+                cq->qplib_cq.dpi = &uctx->dpi;
        } else {
                cq->max_cql = min_t(u32, entries, MAX_CQL_PER_POLL);
                cq->cql = kcalloc(cq->max_cql, sizeof(struct bnxt_qplib_cqe),
@@ -2905,6 +2900,7 @@ int bnxt_re_poll_cq(struct ib_cq *ib_cq, int num_entries, struct ib_wc *wc)
        spin_lock_irqsave(&cq->cq_lock, flags);
        budget = min_t(u32, num_entries, cq->max_cql);
+        num_entries = budget;
        if (!cq->cql) {
                dev_err(rdev_to_dev(cq->rdev), "POLL CQ : no CQL to use");
                goto exit;
@@ -3031,6 +3027,11 @@ int bnxt_re_req_notify_cq(struct ib_cq *ib_cq,
        else if (ib_cqn_flags & IB_CQ_SOLICITED)
                type = DBR_DBR_TYPE_CQ_ARMSE;
+        /* Poll to see if there are missed events */
+        if ((ib_cqn_flags & IB_CQ_REPORT_MISSED_EVENTS) &&
+            !(bnxt_qplib_is_cq_empty(&cq->qplib_cq)))
+                return 1;
        bnxt_qplib_req_notify_cq(&cq->qplib_cq, type);
        return 0;
@@ -3245,6 +3246,12 @@ struct ib_mr *bnxt_re_reg_user_mr(struct ib_pd *ib_pd, u64 start, u64 length,
        struct scatterlist *sg;
        int entry;
+        if (length > BNXT_RE_MAX_MR_SIZE) {
+                dev_err(rdev_to_dev(rdev), "MR Size: %lld > Max supported:%ld\n",
+                        length, BNXT_RE_MAX_MR_SIZE);
+                return ERR_PTR(-ENOMEM);
+        }
        mr = kzalloc(sizeof(*mr), GFP_KERNEL);
        if (!mr)
                return ERR_PTR(-ENOMEM);
@@ -3388,8 +3395,26 @@ int bnxt_re_dealloc_ucontext(struct ib_ucontext *ib_uctx)
        struct bnxt_re_ucontext *uctx = container_of(ib_uctx,
                                                   struct bnxt_re_ucontext,
                                                   ib_uctx);
+        struct bnxt_re_dev *rdev = uctx->rdev;
+        int rc = 0;
        if (uctx->shpg)
                free_page((unsigned long)uctx->shpg);
+        if (uctx->dpi.dbr) {
+                /* Free DPI only if this is the first PD allocated by the
+                 * application and mark the context dpi as NULL
+                 */
+                rc = bnxt_qplib_dealloc_dpi(&rdev->qplib_res,
+                                            &rdev->qplib_res.dpi_tbl,
+                                            &uctx->dpi);
+                if (rc)
+                        dev_err(rdev_to_dev(rdev), "Deallocte HW DPI failed!");
+                        /* Don't fail, continue*/
+                uctx->dpi.dbr = NULL;
+        }
        kfree(uctx);
        return 0;
 }
diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.h b/drivers/infiniband/hw/bnxt_re/ib_verbs.h
index 6c160f6a5398..a0bb7e33d7ca 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.h
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.h
@@ -59,7 +59,6 @@ struct bnxt_re_pd {
        struct bnxt_re_dev      *rdev;
        struct ib_pd            ib_pd;
        struct bnxt_qplib_pd    qplib_pd;
-        struct bnxt_qplib_dpi   dpi;
        struct bnxt_re_fence_data fence;
 };
@@ -127,7 +126,7 @@ struct bnxt_re_mw {
 struct bnxt_re_ucontext {
        struct bnxt_re_dev      *rdev;
        struct ib_ucontext      ib_uctx;
-        struct bnxt_qplib_dpi   *dpi;
+        struct bnxt_qplib_dpi   dpi;
        void                    *shpg;
        spinlock_t              sh_lock;        /* protect shpg */
 };
diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c
index 1fce5e73216b..ceae2d92fb08 100644
--- a/drivers/infiniband/hw/bnxt_re/main.c
+++ b/drivers/infiniband/hw/bnxt_re/main.c
@@ -333,6 +333,7 @@ static int bnxt_re_net_stats_ctx_alloc(struct bnxt_re_dev *rdev,
        bnxt_re_init_hwrm_hdr(rdev, (void *)&req, HWRM_STAT_CTX_ALLOC, -1, -1);
        req.update_period_ms = cpu_to_le32(1000);
        req.stats_dma_addr = cpu_to_le64(dma_map);
+        req.stat_ctx_flags = STAT_CTX_ALLOC_REQ_STAT_CTX_FLAGS_ROCE;
        bnxt_re_fill_fw_msg(&fw_msg, (void *)&req, sizeof(req), (void *)&resp,
                            sizeof(resp), DFLT_HWRM_CMD_TIMEOUT);
        rc = en_dev->en_ops->bnxt_send_fw_msg(en_dev, BNXT_ROCE_ULP, &fw_msg);
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
index f05500bcdcf1..9af1514e5944 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
@@ -1128,6 +1128,11 @@ int bnxt_qplib_post_send(struct bnxt_qplib_qp *qp,
                }
                /* Each SGE entry = 1 WQE size16 */
                wqe_size16 = wqe->num_sge;
+                /* HW requires wqe size has room for atleast one SGE even if
+                 * none was supplied by ULP
+                 */
+                if (!wqe->num_sge)
+                        wqe_size16++;
        }
        /* Specifics */
@@ -1364,6 +1369,11 @@ int bnxt_qplib_post_recv(struct bnxt_qplib_qp *qp,
        rqe->flags = wqe->flags;
        rqe->wqe_size = wqe->num_sge +
                        ((offsetof(typeof(*rqe), data) + 15) >> 4);
+        /* HW requires wqe size has room for atleast one SGE even if none
+         * was supplied by ULP
+         */
+        if (!wqe->num_sge)
+                rqe->wqe_size++;
        /* Supply the rqe->wr_id index to the wr_id_tbl for now */
        rqe->wr_id[0] = cpu_to_le32(sw_prod);
@@ -1885,6 +1895,25 @@ flush_rq:
        return rc;
 }
+bool bnxt_qplib_is_cq_empty(struct bnxt_qplib_cq *cq)
+{
+        struct cq_base *hw_cqe, **hw_cqe_ptr;
+        unsigned long flags;
+        u32 sw_cons, raw_cons;
+        bool rc = true;
+        spin_lock_irqsave(&cq->hwq.lock, flags);
+        raw_cons = cq->hwq.cons;
+        sw_cons = HWQ_CMP(raw_cons, &cq->hwq);
+        hw_cqe_ptr = (struct cq_base **)cq->hwq.pbl_ptr;
+        hw_cqe = &hw_cqe_ptr[CQE_PG(sw_cons)][CQE_IDX(sw_cons)];
+         /* Check for Valid bit. If the CQE is valid, return false */
+        rc = !CQE_CMP_VALID(hw_cqe, raw_cons, cq->hwq.max_elements);
+        spin_unlock_irqrestore(&cq->hwq.lock, flags);
+        return rc;
+}
 static int bnxt_qplib_cq_process_res_raweth_qp1(struct bnxt_qplib_cq *cq,
                                                struct cq_res_raweth_qp1 *hwcqe,
                                                struct bnxt_qplib_cqe **pcqe,
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.h b/drivers/infiniband/hw/bnxt_re/qplib_fp.h
index 36b7b7db0e3f..19176e06c98a 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.h
+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.h
@@ -449,6 +449,7 @@ int bnxt_qplib_create_cq(struct bnxt_qplib_res *res, struct bnxt_qplib_cq *cq);
 int bnxt_qplib_destroy_cq(struct bnxt_qplib_res *res, struct bnxt_qplib_cq *cq);
 int bnxt_qplib_poll_cq(struct bnxt_qplib_cq *cq, struct bnxt_qplib_cqe *cqe,
                       int num, struct bnxt_qplib_qp **qp);
+bool bnxt_qplib_is_cq_empty(struct bnxt_qplib_cq *cq);
 void bnxt_qplib_req_notify_cq(struct bnxt_qplib_cq *cq, u32 arm_type);
 void bnxt_qplib_free_nq(struct bnxt_qplib_nq *nq);
 int bnxt_qplib_alloc_nq(struct pci_dev *pdev, struct bnxt_qplib_nq *nq);
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_sp.c b/drivers/infiniband/hw/bnxt_re/qplib_sp.c
index fde18cf0e406..ef91ab786dd4 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_sp.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_sp.c
@@ -51,6 +51,19 @@ const struct bnxt_qplib_gid bnxt_qplib_gid_zero = {{ 0, 0, 0, 0, 0, 0, 0, 0,
                                                     0, 0, 0, 0, 0, 0, 0, 0 } };
 /* Device */
+static bool bnxt_qplib_is_atomic_cap(struct bnxt_qplib_rcfw *rcfw)
+{
+        int rc;
+        u16 pcie_ctl2;
+        rc = pcie_capability_read_word(rcfw->pdev, PCI_EXP_DEVCTL2,
+                                       &pcie_ctl2);
+        if (rc)
+                return false;
+        return !!(pcie_ctl2 & PCI_EXP_DEVCTL2_ATOMIC_REQ);
+}
 int bnxt_qplib_get_dev_attr(struct bnxt_qplib_rcfw *rcfw,
                            struct bnxt_qplib_dev_attr *attr)
 {
@@ -81,6 +94,8 @@ int bnxt_qplib_get_dev_attr(struct bnxt_qplib_rcfw *rcfw,
        /* Extract the context from the side buffer */
        attr->max_qp = le32_to_cpu(sb->max_qp);
+        /* max_qp value reported by FW for PF doesn't include the QP1 for PF */
+        attr->max_qp += 1;
        attr->max_qp_rd_atom =
                sb->max_qp_rd_atom > BNXT_QPLIB_MAX_OUT_RD_ATOM ?
                BNXT_QPLIB_MAX_OUT_RD_ATOM : sb->max_qp_rd_atom;
@@ -129,6 +144,7 @@ int bnxt_qplib_get_dev_attr(struct bnxt_qplib_rcfw *rcfw,
                attr->tqm_alloc_reqs[i * 4 + 3] = *(++tqm_alloc);
        }
+        attr->is_atomic = bnxt_qplib_is_atomic_cap(rcfw);
 bail:
        bnxt_qplib_rcfw_free_sbuf(rcfw, sbuf);
        return rc;
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_sp.h b/drivers/infiniband/hw/bnxt_re/qplib_sp.h
index a543f959098b..2ce7e2a32cf0 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_sp.h
+++ b/drivers/infiniband/hw/bnxt_re/qplib_sp.h
@@ -42,6 +42,8 @@
 #define BNXT_QPLIB_RESERVED_QP_WRS      128
+#define PCI_EXP_DEVCTL2_ATOMIC_REQ      0x0040
 struct bnxt_qplib_dev_attr {
        char                            fw_ver[32];
        u16                             max_sgid;
@@ -70,6 +72,7 @@ struct bnxt_qplib_dev_attr {
        u32                             max_inline_data;
        u32                             l2_db_size;
        u8                              tqm_alloc_reqs[MAX_TQM_ALLOC_REQ];
+        bool                            is_atomic;
 };
 struct bnxt_qplib_pd {
diff --git a/drivers/infiniband/hw/cxgb3/iwch_provider.c b/drivers/infiniband/hw/cxgb3/iwch_provider.c
index 29d30744d6c9..0cd0c1fa27d4 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_provider.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_provider.c
@@ -718,7 +718,7 @@ static struct ib_mr *iwch_alloc_mr(struct ib_pd *pd,
        struct iwch_mr *mhp;
        u32 mmid;
        u32 stag = 0;
-        int ret = 0;
+        int ret = -ENOMEM;
        if (mr_type != IB_MR_TYPE_MEM_REG ||
            max_num_sg > T3_MAX_FASTREG_DEPTH)
@@ -731,10 +731,8 @@ static struct ib_mr *iwch_alloc_mr(struct ib_pd *pd,
                goto err;
        mhp->pages = kcalloc(max_num_sg, sizeof(u64), GFP_KERNEL);
-        if (!mhp->pages) {
+        if (!mhp->pages)
-                ret = -ENOMEM;
                goto pl_err;
-        }
        mhp->rhp = rhp;
        ret = iwch_alloc_pbl(mhp, max_num_sg);
@@ -751,7 +749,8 @@ static struct ib_mr *iwch_alloc_mr(struct ib_pd *pd,
        mhp->attr.state = 1;
        mmid = (stag) >> 8;
        mhp->ibmr.rkey = mhp->ibmr.lkey = stag;
-        if (insert_handle(rhp, &rhp->mmidr, mhp, mmid))
+        ret = insert_handle(rhp, &rhp->mmidr, mhp, mmid);
+        if (ret)
                goto err3;
        pr_debug("%s mmid 0x%x mhp %p stag 0x%x\n", __func__, mmid, mhp, stag);
diff --git a/drivers/infiniband/hw/cxgb4/cq.c b/drivers/infiniband/hw/cxgb4/cq.c
index e16fcaf6b5a3..be07da1997e6 100644
--- a/drivers/infiniband/hw/cxgb4/cq.c
+++ b/drivers/infiniband/hw/cxgb4/cq.c
@@ -963,6 +963,7 @@ struct ib_cq *c4iw_create_cq(struct ib_device *ibdev,
                goto err3;
        if (ucontext) {
+                ret = -ENOMEM;
                mm = kmalloc(sizeof *mm, GFP_KERNEL);
                if (!mm)
                        goto err4;
diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
index bfc77596acbe..cb7fc0d35d1d 100644
--- a/drivers/infiniband/hw/cxgb4/qp.c
+++ b/drivers/infiniband/hw/cxgb4/qp.c
@@ -569,7 +569,7 @@ static int build_rdma_read(union t4_wr *wqe, struct ib_send_wr *wr, u8 *len16)
 {
        if (wr->num_sge > 1)
                return -EINVAL;
-        if (wr->num_sge) {
+        if (wr->num_sge && wr->sg_list[0].length) {
                wqe->read.stag_src = cpu_to_be32(rdma_wr(wr)->rkey);
                wqe->read.to_src_hi = cpu_to_be32((u32)(rdma_wr(wr)->remote_addr
                                                        >> 32));
diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
index 2ba00b89df6a..94b54850ec75 100644
--- a/drivers/infiniband/hw/hfi1/chip.c
+++ b/drivers/infiniband/hw/hfi1/chip.c
@@ -12847,7 +12847,12 @@ static void remap_intr(struct hfi1_devdata *dd, int isrc, int msix_intr)
        /* clear from the handled mask of the general interrupt */
        m = isrc / 64;
        n = isrc % 64;
-        dd->gi_mask[m] &= ~((u64)1 << n);
+        if (likely(m < CCE_NUM_INT_CSRS)) {
+                dd->gi_mask[m] &= ~((u64)1 << n);
+        } else {
+                dd_dev_err(dd, "remap interrupt err\n");
+                return;
+        }
        /* direct the chip source to the given MSI-X interrupt */
        m = isrc / 8;
diff --git a/drivers/infiniband/hw/hfi1/qp.c b/drivers/infiniband/hw/hfi1/qp.c
index 650305cc0373..1a7af9f60c13 100644
--- a/drivers/infiniband/hw/hfi1/qp.c
+++ b/drivers/infiniband/hw/hfi1/qp.c
@@ -647,18 +647,17 @@ void qp_iter_print(struct seq_file *s, struct qp_iter *iter)
                   qp->pid);
 }
-void *qp_priv_alloc(struct rvt_dev_info *rdi, struct rvt_qp *qp,
+void *qp_priv_alloc(struct rvt_dev_info *rdi, struct rvt_qp *qp)
-                    gfp_t gfp)
 {
        struct hfi1_qp_priv *priv;
-        priv = kzalloc_node(sizeof(*priv), gfp, rdi->dparms.node);
+        priv = kzalloc_node(sizeof(*priv), GFP_KERNEL, rdi->dparms.node);
        if (!priv)
                return ERR_PTR(-ENOMEM);
        priv->owner = qp;
-        priv->s_ahg = kzalloc_node(sizeof(*priv->s_ahg), gfp,
+        priv->s_ahg = kzalloc_node(sizeof(*priv->s_ahg), GFP_KERNEL,
                                   rdi->dparms.node);
        if (!priv->s_ahg) {
                kfree(priv);
diff --git a/drivers/infiniband/hw/hfi1/qp.h b/drivers/infiniband/hw/hfi1/qp.h
index 1eb9cd7b8c19..6fe542b6a927 100644
--- a/drivers/infiniband/hw/hfi1/qp.h
+++ b/drivers/infiniband/hw/hfi1/qp.h
@@ -123,8 +123,7 @@ void hfi1_migrate_qp(struct rvt_qp *qp);
 /*
 * Functions provided by hfi1 driver for rdmavt to use
 */
-void *qp_priv_alloc(struct rvt_dev_info *rdi, struct rvt_qp *qp,
+void *qp_priv_alloc(struct rvt_dev_info *rdi, struct rvt_qp *qp);
-                    gfp_t gfp);
 void qp_priv_free(struct rvt_dev_info *rdi, struct rvt_qp *qp);
 unsigned free_all_qps(struct rvt_dev_info *rdi);
 void notify_qp_reset(struct rvt_qp *qp);
diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v1.c b/drivers/infiniband/hw/hns/hns_roce_hw_v1.c
index 37d5d29597a4..23fad6d96944 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hw_v1.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v1.c
@@ -228,14 +228,14 @@ int hns_roce_v1_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                        switch (wr->opcode) {
                        case IB_WR_RDMA_READ:
                                ps_opcode = HNS_ROCE_WQE_OPCODE_RDMA_READ;
-                                set_raddr_seg(wqe, atomic_wr(wr)->remote_addr,
+                                set_raddr_seg(wqe,  rdma_wr(wr)->remote_addr,
-                                              atomic_wr(wr)->rkey);
+                                               rdma_wr(wr)->rkey);
                                break;
                        case IB_WR_RDMA_WRITE:
                        case IB_WR_RDMA_WRITE_WITH_IMM:
                                ps_opcode = HNS_ROCE_WQE_OPCODE_RDMA_WRITE;
-                                set_raddr_seg(wqe, atomic_wr(wr)->remote_addr,
+                                set_raddr_seg(wqe,  rdma_wr(wr)->remote_addr,
-                                              atomic_wr(wr)->rkey);
+                                              rdma_wr(wr)->rkey);
                                break;
                        case IB_WR_SEND:
                        case IB_WR_SEND_WITH_INV:
@@ -661,9 +661,11 @@ static int hns_roce_v1_rsv_lp_qp(struct hns_roce_dev *hr_dev)
        union ib_gid dgid;
        u64 subnet_prefix;
        int attr_mask = 0;
-        int i;
+        int i, j;
        int ret;
+        u8 queue_en[HNS_ROCE_V1_RESV_QP] = { 0 };
        u8 phy_port;
+        u8 port = 0;
        u8 sl;
        priv = (struct hns_roce_v1_priv *)hr_dev->hw->priv;
@@ -709,11 +711,27 @@ static int hns_roce_v1_rsv_lp_qp(struct hns_roce_dev *hr_dev)
        attr.rnr_retry          = 7;
        attr.timeout            = 0x12;
        attr.path_mtu           = IB_MTU_256;
+        attr.ah_attr.type       = RDMA_AH_ATTR_TYPE_ROCE;
        rdma_ah_set_grh(&attr.ah_attr, NULL, 0, 0, 1, 0);
        rdma_ah_set_static_rate(&attr.ah_attr, 3);
        subnet_prefix = cpu_to_be64(0xfe80000000000000LL);
        for (i = 0; i < HNS_ROCE_V1_RESV_QP; i++) {
+                phy_port = (i >= HNS_ROCE_MAX_PORTS) ? (i - 2) :
+                                (i % HNS_ROCE_MAX_PORTS);
+                sl = i / HNS_ROCE_MAX_PORTS;
+                for (j = 0; j < caps->num_ports; j++) {
+                        if (hr_dev->iboe.phy_port[j] == phy_port) {
+                                queue_en[i] = 1;
+                                port = j;
+                                break;
+                        }
+                }
+                if (!queue_en[i])
+                        continue;
                free_mr->mr_free_qp[i] = hns_roce_v1_create_lp_qp(hr_dev, pd);
                if (IS_ERR(free_mr->mr_free_qp[i])) {
                        dev_err(dev, "Create loop qp failed!\n");
@@ -721,15 +739,7 @@ static int hns_roce_v1_rsv_lp_qp(struct hns_roce_dev *hr_dev)
                }
                hr_qp = free_mr->mr_free_qp[i];
-                sl = i / caps->num_ports;
+                hr_qp->port             = port;
-                if (caps->num_ports == HNS_ROCE_MAX_PORTS)
-                        phy_port = (i >= HNS_ROCE_MAX_PORTS) ? (i - 2) :
-                                (i % caps->num_ports);
-                else
-                        phy_port = i % caps->num_ports;
-                hr_qp->port             = phy_port + 1;
                hr_qp->phy_port         = phy_port;
                hr_qp->ibqp.qp_type     = IB_QPT_RC;
                hr_qp->ibqp.device      = &hr_dev->ib_dev;
@@ -739,23 +749,22 @@ static int hns_roce_v1_rsv_lp_qp(struct hns_roce_dev *hr_dev)
                hr_qp->ibqp.recv_cq     = cq;
                hr_qp->ibqp.send_cq     = cq;
-                rdma_ah_set_port_num(&attr.ah_attr, phy_port + 1);
+                rdma_ah_set_port_num(&attr.ah_attr, port + 1);
-                rdma_ah_set_sl(&attr.ah_attr, phy_port + 1);
+                rdma_ah_set_sl(&attr.ah_attr, sl);
-                attr.port_num           = phy_port + 1;
+                attr.port_num           = port + 1;
                attr.dest_qp_num        = hr_qp->qpn;
                memcpy(rdma_ah_retrieve_dmac(&attr.ah_attr),
-                       hr_dev->dev_addr[phy_port],
+                       hr_dev->dev_addr[port],
                       MAC_ADDR_OCTET_NUM);
                memcpy(&dgid.raw, &subnet_prefix, sizeof(u64));
-                memcpy(&dgid.raw[8], hr_dev->dev_addr[phy_port], 3);
+                memcpy(&dgid.raw[8], hr_dev->dev_addr[port], 3);
-                memcpy(&dgid.raw[13], hr_dev->dev_addr[phy_port] + 3, 3);
+                memcpy(&dgid.raw[13], hr_dev->dev_addr[port] + 3, 3);
                dgid.raw[11] = 0xff;
                dgid.raw[12] = 0xfe;
                dgid.raw[8] ^= 2;
                rdma_ah_set_dgid_raw(&attr.ah_attr, dgid.raw);
-                attr_mask |= IB_QP_PORT;
                ret = hr_dev->hw->modify_qp(&hr_qp->ibqp, &attr, attr_mask,
                                            IB_QPS_RESET, IB_QPS_INIT);
@@ -812,6 +821,9 @@ static void hns_roce_v1_release_lp_qp(struct hns_roce_dev *hr_dev)
        for (i = 0; i < HNS_ROCE_V1_RESV_QP; i++) {
                hr_qp = free_mr->mr_free_qp[i];
+                if (!hr_qp)
+                        continue;
                ret = hns_roce_v1_destroy_qp(&hr_qp->ibqp);
                if (ret)
                        dev_err(dev, "Destroy qp %d for mr free failed(%d)!\n",
@@ -963,7 +975,7 @@ static void hns_roce_v1_mr_free_work_fn(struct work_struct *work)
                msecs_to_jiffies(HNS_ROCE_V1_FREE_MR_TIMEOUT_MSECS) + jiffies;
        int i;
        int ret;
-        int ne;
+        int ne = 0;
        mr_work = container_of(work, struct hns_roce_mr_free_work, work);
        hr_mr = (struct hns_roce_mr *)mr_work->mr;
@@ -976,6 +988,10 @@ static void hns_roce_v1_mr_free_work_fn(struct work_struct *work)
        for (i = 0; i < HNS_ROCE_V1_RESV_QP; i++) {
                hr_qp = free_mr->mr_free_qp[i];
+                if (!hr_qp)
+                        continue;
+                ne++;
                ret = hns_roce_v1_send_lp_wqe(hr_qp);
                if (ret) {
                        dev_err(dev,
@@ -985,7 +1001,6 @@ static void hns_roce_v1_mr_free_work_fn(struct work_struct *work)
                }
        }
-        ne = HNS_ROCE_V1_RESV_QP;
        do {
                ret = hns_roce_v1_poll_cq(&mr_free_cq->ib_cq, ne, wc);
                if (ret < 0) {
@@ -995,7 +1010,8 @@ static void hns_roce_v1_mr_free_work_fn(struct work_struct *work)
                        goto free_work;
                }
                ne -= ret;
-                msleep(HNS_ROCE_V1_FREE_MR_WAIT_VALUE);
+                usleep_range(HNS_ROCE_V1_FREE_MR_WAIT_VALUE * 1000,
+                             (1 + HNS_ROCE_V1_FREE_MR_WAIT_VALUE) * 1000);
        } while (ne && time_before_eq(jiffies, end));
        if (ne != 0)
@@ -2181,7 +2197,7 @@ static int hns_roce_v1_poll_one(struct hns_roce_cq *hr_cq,
                }
                wc->wr_id = wq->wrid[wq->tail & (wq->wqe_cnt - 1)];
                ++wq->tail;
-                } else {
+        } else {
                /* RQ conrespond to CQE */
                wc->byte_len = le32_to_cpu(cqe->byte_cnt);
                opcode = roce_get_field(cqe->cqe_byte_4,
@@ -3533,10 +3549,12 @@ static int check_qp_db_process_status(struct hns_roce_dev *hr_dev,
                                        old_cnt = roce_get_field(old_send,
                                        ROCEE_SDB_SEND_PTR_SDB_SEND_PTR_M,
                                        ROCEE_SDB_SEND_PTR_SDB_SEND_PTR_S);
-                                        if (cur_cnt - old_cnt > SDB_ST_CMP_VAL)
+                                        if (cur_cnt - old_cnt >
+                                            SDB_ST_CMP_VAL) {
                                                success_flags = 1;
-                                        else {
+                                        } else {
-                                            send_ptr = roce_get_field(old_send,
+                                                send_ptr =
+                                                        roce_get_field(old_send,
                                            ROCEE_SDB_SEND_PTR_SDB_SEND_PTR_M,
                                            ROCEE_SDB_SEND_PTR_SDB_SEND_PTR_S) +
                                            roce_get_field(sdb_retry_cnt,
@@ -3641,6 +3659,7 @@ static void hns_roce_v1_destroy_qp_work_fn(struct work_struct *work)
        struct hns_roce_dev *hr_dev;
        struct hns_roce_qp *hr_qp;
        struct device *dev;
+        unsigned long qpn;
        int ret;
        qp_work_entry = container_of(work, struct hns_roce_qp_work, work);
@@ -3648,8 +3667,9 @@ static void hns_roce_v1_destroy_qp_work_fn(struct work_struct *work)
        dev = &hr_dev->pdev->dev;
        priv = (struct hns_roce_v1_priv *)hr_dev->hw->priv;
        hr_qp = qp_work_entry->qp;
+        qpn = hr_qp->qpn;
-        dev_dbg(dev, "Schedule destroy QP(0x%lx) work.\n", hr_qp->qpn);
+        dev_dbg(dev, "Schedule destroy QP(0x%lx) work.\n", qpn);
        qp_work_entry->sche_cnt++;
@@ -3660,7 +3680,7 @@ static void hns_roce_v1_destroy_qp_work_fn(struct work_struct *work)
                                         &qp_work_entry->db_wait_stage);
        if (ret) {
                dev_err(dev, "Check QP(0x%lx) db process status failed!\n",
-                        hr_qp->qpn);
+                        qpn);
                return;
        }
@@ -3674,7 +3694,7 @@ static void hns_roce_v1_destroy_qp_work_fn(struct work_struct *work)
        ret = hns_roce_v1_modify_qp(&hr_qp->ibqp, NULL, 0, hr_qp->state,
                                    IB_QPS_RESET);
        if (ret) {
-                dev_err(dev, "Modify QP(0x%lx) to RST failed!\n", hr_qp->qpn);
+                dev_err(dev, "Modify QP(0x%lx) to RST failed!\n", qpn);
                return;
        }
@@ -3683,14 +3703,14 @@ static void hns_roce_v1_destroy_qp_work_fn(struct work_struct *work)
        if (hr_qp->ibqp.qp_type == IB_QPT_RC) {
                /* RC QP, release QPN */
-                hns_roce_release_range_qp(hr_dev, hr_qp->qpn, 1);
+                hns_roce_release_range_qp(hr_dev, qpn, 1);
                kfree(hr_qp);
        } else
                kfree(hr_to_hr_sqp(hr_qp));
        kfree(qp_work_entry);
-        dev_dbg(dev, "Accomplished destroy QP(0x%lx) work.\n", hr_qp->qpn);
+        dev_dbg(dev, "Accomplished destroy QP(0x%lx) work.\n", qpn);
 }
 int hns_roce_v1_destroy_qp(struct ib_qp *ibqp)
diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c
index c3b41f95e70a..d9777b662eba 100644
--- a/drivers/infiniband/hw/hns/hns_roce_main.c
+++ b/drivers/infiniband/hw/hns/hns_roce_main.c
@@ -125,8 +125,6 @@ static int handle_en_event(struct hns_roce_dev *hr_dev, u8 port,
                return -ENODEV;
        }
-        spin_lock_bh(&hr_dev->iboe.lock);
        switch (event) {
        case NETDEV_UP:
        case NETDEV_CHANGE:
@@ -144,7 +142,6 @@ static int handle_en_event(struct hns_roce_dev *hr_dev, u8 port,
                break;
        }
-        spin_unlock_bh(&hr_dev->iboe.lock);
        return 0;
 }
diff --git a/drivers/infiniband/hw/i40iw/i40iw.h b/drivers/infiniband/hw/i40iw/i40iw.h
index da2eb5a281fa..9b1566468744 100644
--- a/drivers/infiniband/hw/i40iw/i40iw.h
+++ b/drivers/infiniband/hw/i40iw/i40iw.h
@@ -527,6 +527,7 @@ enum i40iw_status_code i40iw_add_mac_addr(struct i40iw_device *iwdev,
 int i40iw_modify_qp(struct ib_qp *, struct ib_qp_attr *, int, struct ib_udata *);
 void i40iw_cq_wq_destroy(struct i40iw_device *iwdev, struct i40iw_sc_cq *cq);
+void i40iw_cleanup_pending_cqp_op(struct i40iw_device *iwdev);
 void i40iw_rem_pdusecount(struct i40iw_pd *iwpd, struct i40iw_device *iwdev);
 void i40iw_add_pdusecount(struct i40iw_pd *iwpd);
 void i40iw_rem_devusecount(struct i40iw_device *iwdev);
diff --git a/drivers/infiniband/hw/i40iw/i40iw_cm.c b/drivers/infiniband/hw/i40iw/i40iw_cm.c
index 6ae98aa7f74e..5a2fa743676c 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_cm.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_cm.c
@@ -3487,7 +3487,8 @@ static void i40iw_cm_disconn_true(struct i40iw_qp *iwqp)
        if (((original_hw_tcp_state == I40IW_TCP_STATE_CLOSED) ||
             (original_hw_tcp_state == I40IW_TCP_STATE_TIME_WAIT) ||
             (last_ae == I40IW_AE_RDMAP_ROE_BAD_LLP_CLOSE) ||
-             (last_ae == I40IW_AE_LLP_CONNECTION_RESET))) {
+             (last_ae == I40IW_AE_LLP_CONNECTION_RESET) ||
+              iwdev->reset)) {
                issue_close = 1;
                iwqp->cm_id = NULL;
                if (!iwqp->flush_issued) {
@@ -4265,6 +4266,8 @@ void i40iw_cm_disconnect_all(struct i40iw_device *iwdev)
                cm_node = container_of(list_node, struct i40iw_cm_node, connected_entry);
                attr.qp_state = IB_QPS_ERR;
                i40iw_modify_qp(&cm_node->iwqp->ibqp, &attr, IB_QP_STATE, NULL);
+                if (iwdev->reset)
+                        i40iw_cm_disconn(cm_node->iwqp);
                i40iw_rem_ref_cm_node(cm_node);
        }
 }
diff --git a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
index a027e2072477..9ec1ae9a82c9 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
@@ -1970,6 +1970,8 @@ static enum i40iw_status_code i40iw_sc_ccq_destroy(struct i40iw_sc_cq *ccq,
                ret_code = i40iw_cqp_poll_registers(cqp, tail, 1000);
        }
+        cqp->process_cqp_sds = i40iw_update_sds_noccq;
        return ret_code;
 }
diff --git a/drivers/infiniband/hw/i40iw/i40iw_main.c b/drivers/infiniband/hw/i40iw/i40iw_main.c
index e0f47cc2effc..ae8463ff59a7 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_main.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_main.c
@@ -243,6 +243,8 @@ static void i40iw_destroy_cqp(struct i40iw_device *iwdev, bool free_hwcqp)
        if (free_hwcqp)
                dev->cqp_ops->cqp_destroy(dev->cqp);
+        i40iw_cleanup_pending_cqp_op(iwdev);
        i40iw_free_dma_mem(dev->hw, &cqp->sq);
        kfree(cqp->scratch_array);
        iwdev->cqp.scratch_array = NULL;
@@ -274,13 +276,12 @@ static void i40iw_disable_irq(struct i40iw_sc_dev *dev,
 /**
 * i40iw_destroy_aeq - destroy aeq
 * @iwdev: iwarp device
- * @reset: true if called before reset
 *
 * Issue a destroy aeq request and
 * free the resources associated with the aeq
 * The function is called during driver unload
 */
-static void i40iw_destroy_aeq(struct i40iw_device *iwdev, bool reset)
+static void i40iw_destroy_aeq(struct i40iw_device *iwdev)
 {
        enum i40iw_status_code status = I40IW_ERR_NOT_READY;
        struct i40iw_sc_dev *dev = &iwdev->sc_dev;
@@ -288,7 +289,7 @@ static void i40iw_destroy_aeq(struct i40iw_device *iwdev, bool reset)
        if (!iwdev->msix_shared)
                i40iw_disable_irq(dev, iwdev->iw_msixtbl, (void *)iwdev);
-        if (reset)
+        if (iwdev->reset)
                goto exit;
        if (!dev->aeq_ops->aeq_destroy(&aeq->sc_aeq, 0, 1))
@@ -304,19 +305,17 @@ exit:
 * i40iw_destroy_ceq - destroy ceq
 * @iwdev: iwarp device
 * @iwceq: ceq to be destroyed
- * @reset: true if called before reset
 *
 * Issue a destroy ceq request and
 * free the resources associated with the ceq
 */
 static void i40iw_destroy_ceq(struct i40iw_device *iwdev,
-                              struct i40iw_ceq *iwceq,
+                              struct i40iw_ceq *iwceq)
-                              bool reset)
 {
        enum i40iw_status_code status;
        struct i40iw_sc_dev *dev = &iwdev->sc_dev;
-        if (reset)
+        if (iwdev->reset)
                goto exit;
        status = dev->ceq_ops->ceq_destroy(&iwceq->sc_ceq, 0, 1);
@@ -335,12 +334,11 @@ exit:
 /**
 * i40iw_dele_ceqs - destroy all ceq's
 * @iwdev: iwarp device
- * @reset: true if called before reset
 *
 * Go through all of the device ceq's and for each ceq
 * disable the ceq interrupt and destroy the ceq
 */
-static void i40iw_dele_ceqs(struct i40iw_device *iwdev, bool reset)
+static void i40iw_dele_ceqs(struct i40iw_device *iwdev)
 {
        u32 i = 0;
        struct i40iw_sc_dev *dev = &iwdev->sc_dev;
@@ -349,32 +347,31 @@ static void i40iw_dele_ceqs(struct i40iw_device *iwdev, bool reset)
        if (iwdev->msix_shared) {
                i40iw_disable_irq(dev, msix_vec, (void *)iwdev);
-                i40iw_destroy_ceq(iwdev, iwceq, reset);
+                i40iw_destroy_ceq(iwdev, iwceq);
                iwceq++;
                i++;
        }
        for (msix_vec++; i < iwdev->ceqs_count; i++, msix_vec++, iwceq++) {
                i40iw_disable_irq(dev, msix_vec, (void *)iwceq);
-                i40iw_destroy_ceq(iwdev, iwceq, reset);
+                i40iw_destroy_ceq(iwdev, iwceq);
        }
 }
 /**
 * i40iw_destroy_ccq - destroy control cq
 * @iwdev: iwarp device
- * @reset: true if called before reset
 *
 * Issue destroy ccq request and
 * free the resources associated with the ccq
 */
-static void i40iw_destroy_ccq(struct i40iw_device *iwdev, bool reset)
+static void i40iw_destroy_ccq(struct i40iw_device *iwdev)
 {
        struct i40iw_sc_dev *dev = &iwdev->sc_dev;
        struct i40iw_ccq *ccq = &iwdev->ccq;
        enum i40iw_status_code status = 0;
-        if (!reset)
+        if (!iwdev->reset)
                status = dev->ccq_ops->ccq_destroy(dev->ccq, 0, true);
        if (status)
                i40iw_pr_err("ccq destroy failed %d\n", status);
@@ -810,7 +807,7 @@ static enum i40iw_status_code i40iw_setup_ceqs(struct i40iw_device *iwdev,
                iwceq->msix_idx = msix_vec->idx;
                status = i40iw_configure_ceq_vector(iwdev, iwceq, ceq_id, msix_vec);
                if (status) {
-                        i40iw_destroy_ceq(iwdev, iwceq, false);
+                        i40iw_destroy_ceq(iwdev, iwceq);
                        break;
                }
                i40iw_enable_intr(&iwdev->sc_dev, msix_vec->idx);
@@ -912,7 +909,7 @@ static enum i40iw_status_code i40iw_setup_aeq(struct i40iw_device *iwdev)
        status = i40iw_configure_aeq_vector(iwdev);
        if (status) {
-                i40iw_destroy_aeq(iwdev, false);
+                i40iw_destroy_aeq(iwdev);
                return status;
        }
@@ -1442,12 +1439,11 @@ static enum i40iw_status_code i40iw_save_msix_info(struct i40iw_device *iwdev,
 /**
 * i40iw_deinit_device - clean up the device resources
 * @iwdev: iwarp device
- * @reset: true if called before reset
 *
 * Destroy the ib device interface, remove the mac ip entry and ipv4/ipv6 addresses,
 * destroy the device queues and free the pble and the hmc objects
 */
-static void i40iw_deinit_device(struct i40iw_device *iwdev, bool reset)
+static void i40iw_deinit_device(struct i40iw_device *iwdev)
 {
        struct i40e_info *ldev = iwdev->ldev;
@@ -1464,7 +1460,7 @@ static void i40iw_deinit_device(struct i40iw_device *iwdev, bool reset)
                i40iw_destroy_rdma_device(iwdev->iwibdev);
                /* fallthrough */
        case IP_ADDR_REGISTERED:
-                if (!reset)
+                if (!iwdev->reset)
                        i40iw_del_macip_entry(iwdev, (u8)iwdev->mac_ip_table_idx);
                /* fallthrough */
        case INET_NOTIFIER:
@@ -1474,26 +1470,26 @@ static void i40iw_deinit_device(struct i40iw_device *iwdev, bool reset)
                        unregister_inet6addr_notifier(&i40iw_inetaddr6_notifier);
                }
                /* fallthrough */
+        case PBLE_CHUNK_MEM:
+                i40iw_destroy_pble_pool(dev, iwdev->pble_rsrc);
+                /* fallthrough */
        case CEQ_CREATED:
-                i40iw_dele_ceqs(iwdev, reset);
+                i40iw_dele_ceqs(iwdev);
                /* fallthrough */
        case AEQ_CREATED:
-                i40iw_destroy_aeq(iwdev, reset);
+                i40iw_destroy_aeq(iwdev);
                /* fallthrough */
        case IEQ_CREATED:
-                i40iw_puda_dele_resources(&iwdev->vsi, I40IW_PUDA_RSRC_TYPE_IEQ, reset);
+                i40iw_puda_dele_resources(&iwdev->vsi, I40IW_PUDA_RSRC_TYPE_IEQ, iwdev->reset);
                /* fallthrough */
        case ILQ_CREATED:
-                i40iw_puda_dele_resources(&iwdev->vsi, I40IW_PUDA_RSRC_TYPE_ILQ, reset);
+                i40iw_puda_dele_resources(&iwdev->vsi, I40IW_PUDA_RSRC_TYPE_ILQ, iwdev->reset);
                /* fallthrough */
        case CCQ_CREATED:
-                i40iw_destroy_ccq(iwdev, reset);
+                i40iw_destroy_ccq(iwdev);
-                /* fallthrough */
-        case PBLE_CHUNK_MEM:
-                i40iw_destroy_pble_pool(dev, iwdev->pble_rsrc);
                /* fallthrough */
        case HMC_OBJS_CREATED:
-                i40iw_del_hmc_objects(dev, dev->hmc_info, true, reset);
+                i40iw_del_hmc_objects(dev, dev->hmc_info, true, iwdev->reset);
                /* fallthrough */
        case CQP_CREATED:
                i40iw_destroy_cqp(iwdev, true);
@@ -1670,6 +1666,7 @@ static int i40iw_open(struct i40e_info *ldev, struct i40e_client *client)
                status = i40iw_hmc_init_pble(&iwdev->sc_dev, iwdev->pble_rsrc);
                if (status)
                        break;
+                iwdev->init_state = PBLE_CHUNK_MEM;
                iwdev->virtchnl_wq = alloc_ordered_workqueue("iwvch", WQ_MEM_RECLAIM);
                i40iw_register_notifiers();
                iwdev->init_state = INET_NOTIFIER;
@@ -1693,7 +1690,7 @@ static int i40iw_open(struct i40e_info *ldev, struct i40e_client *client)
        } while (0);
        i40iw_pr_err("status = %d last completion = %d\n", status, iwdev->init_state);
-        i40iw_deinit_device(iwdev, false);
+        i40iw_deinit_device(iwdev);
        return -ERESTART;
 }
@@ -1774,9 +1771,12 @@ static void i40iw_close(struct i40e_info *ldev, struct i40e_client *client, bool
        iwdev = &hdl->device;
        iwdev->closing = true;
+        if (reset)
+                iwdev->reset = true;
        i40iw_cm_disconnect_all(iwdev);
        destroy_workqueue(iwdev->virtchnl_wq);
-        i40iw_deinit_device(iwdev, reset);
+        i40iw_deinit_device(iwdev);
 }
 /**
diff --git a/drivers/infiniband/hw/i40iw/i40iw_puda.c b/drivers/infiniband/hw/i40iw/i40iw_puda.c
index db41ab40da9c..71050c5d29a0 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_puda.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_puda.c
@@ -408,6 +408,9 @@ enum i40iw_status_code i40iw_puda_send(struct i40iw_sc_qp *qp,
        set_64bit_val(wqe, 0, info->paddr);
        set_64bit_val(wqe, 8, LS_64(info->len, I40IWQPSQ_FRAG_LEN));
        set_64bit_val(wqe, 16, header[0]);
+        /* Ensure all data is written before writing valid bit */
+        wmb();
        set_64bit_val(wqe, 24, header[1]);
        i40iw_debug_buf(qp->dev, I40IW_DEBUG_PUDA, "PUDA SEND WQE", wqe, 32);
@@ -1411,10 +1414,10 @@ static void i40iw_ieq_handle_exception(struct i40iw_puda_rsrc *ieq,
        if (!list_empty(rxlist)) {
                tmpbuf = (struct i40iw_puda_buf *)rxlist->next;
-                plist = &tmpbuf->list;
                while ((struct list_head *)tmpbuf != rxlist) {
                        if ((int)(buf->seqnum - tmpbuf->seqnum) < 0)
                                break;
+                        plist = &tmpbuf->list;
                        tmpbuf = (struct i40iw_puda_buf *)plist->next;
                }
                /* Insert buf before tmpbuf */
diff --git a/drivers/infiniband/hw/i40iw/i40iw_utils.c b/drivers/infiniband/hw/i40iw/i40iw_utils.c
index 56d986924a4c..e311ec559f4e 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_utils.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_utils.c
@@ -337,6 +337,7 @@ struct i40iw_cqp_request *i40iw_get_cqp_request(struct i40iw_cqp *cqp, bool wait
 */
 void i40iw_free_cqp_request(struct i40iw_cqp *cqp, struct i40iw_cqp_request *cqp_request)
 {
+        struct i40iw_device *iwdev = container_of(cqp, struct i40iw_device, cqp);
        unsigned long flags;
        if (cqp_request->dynamic) {
@@ -350,6 +351,7 @@ void i40iw_free_cqp_request(struct i40iw_cqp *cqp, struct i40iw_cqp_request *cqp
                list_add_tail(&cqp_request->list, &cqp->cqp_avail_reqs);
                spin_unlock_irqrestore(&cqp->req_lock, flags);
        }
+        wake_up(&iwdev->close_wq);
 }
 /**
@@ -365,6 +367,56 @@ void i40iw_put_cqp_request(struct i40iw_cqp *cqp,
 }
 /**
+ * i40iw_free_pending_cqp_request -free pending cqp request objs
+ * @cqp: cqp ptr
+ * @cqp_request: to be put back in cqp list
+ */
+static void i40iw_free_pending_cqp_request(struct i40iw_cqp *cqp,
+                                           struct i40iw_cqp_request *cqp_request)
+{
+        struct i40iw_device *iwdev = container_of(cqp, struct i40iw_device, cqp);
+        if (cqp_request->waiting) {
+                cqp_request->compl_info.error = true;
+                cqp_request->request_done = true;
+                wake_up(&cqp_request->waitq);
+        }
+        i40iw_put_cqp_request(cqp, cqp_request);
+        wait_event_timeout(iwdev->close_wq,
+                           !atomic_read(&cqp_request->refcount),
+                           1000);
+}
+/**
+ * i40iw_cleanup_pending_cqp_op - clean-up cqp with no completions
+ * @iwdev: iwarp device
+ */
+void i40iw_cleanup_pending_cqp_op(struct i40iw_device *iwdev)
+{
+        struct i40iw_sc_dev *dev = &iwdev->sc_dev;
+        struct i40iw_cqp *cqp = &iwdev->cqp;
+        struct i40iw_cqp_request *cqp_request = NULL;
+        struct cqp_commands_info *pcmdinfo = NULL;
+        u32 i, pending_work, wqe_idx;
+        pending_work = I40IW_RING_WORK_AVAILABLE(cqp->sc_cqp.sq_ring);
+        wqe_idx = I40IW_RING_GETCURRENT_TAIL(cqp->sc_cqp.sq_ring);
+        for (i = 0; i < pending_work; i++) {
+                cqp_request = (struct i40iw_cqp_request *)(unsigned long)cqp->scratch_array[wqe_idx];
+                if (cqp_request)
+                        i40iw_free_pending_cqp_request(cqp, cqp_request);
+                wqe_idx = (wqe_idx + 1) % I40IW_RING_GETSIZE(cqp->sc_cqp.sq_ring);
+        }
+        while (!list_empty(&dev->cqp_cmd_head)) {
+                pcmdinfo = (struct cqp_commands_info *)i40iw_remove_head(&dev->cqp_cmd_head);
+                cqp_request = container_of(pcmdinfo, struct i40iw_cqp_request, info);
+                if (cqp_request)
+                        i40iw_free_pending_cqp_request(cqp, cqp_request);
+        }
+}
+/**
 * i40iw_free_qp - callback after destroy cqp completes
 * @cqp_request: cqp request for destroy qp
 * @num: not used
@@ -546,8 +598,12 @@ void i40iw_rem_ref(struct ib_qp *ibqp)
        cqp_info->in.u.qp_destroy.scratch = (uintptr_t)cqp_request;
        cqp_info->in.u.qp_destroy.remove_hash_idx = true;
        status = i40iw_handle_cqp_op(iwdev, cqp_request);
-        if (status)
+        if (!status)
-                i40iw_pr_err("CQP-OP Destroy QP fail");
+                return;
+        i40iw_rem_pdusecount(iwqp->iwpd, iwdev);
+        i40iw_free_qp_resources(iwdev, iwqp, qp_num);
+        i40iw_rem_devusecount(iwdev);
 }
 /**
diff --git a/drivers/infiniband/hw/i40iw/i40iw_verbs.c b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
index 4dbe61ec7a77..02d871db7ca5 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_verbs.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
@@ -426,9 +426,13 @@ void i40iw_free_qp_resources(struct i40iw_device *iwdev,
                             struct i40iw_qp *iwqp,
                             u32 qp_num)
 {
+        struct i40iw_pbl *iwpbl = &iwqp->iwpbl;
        i40iw_dealloc_push_page(iwdev, &iwqp->sc_qp);
        if (qp_num)
                i40iw_free_resource(iwdev, iwdev->allocated_qps, qp_num);
+        if (iwpbl->pbl_allocated)
+                i40iw_free_pble(iwdev->pble_rsrc, &iwpbl->pble_alloc);
        i40iw_free_dma_mem(iwdev->sc_dev.hw, &iwqp->q2_ctx_mem);
        i40iw_free_dma_mem(iwdev->sc_dev.hw, &iwqp->kqp.dma_mem);
        kfree(iwqp->kqp.wrid_mem);
@@ -483,7 +487,7 @@ static int i40iw_setup_virt_qp(struct i40iw_device *iwdev,
                               struct i40iw_qp *iwqp,
                               struct i40iw_qp_init_info *init_info)
 {
-        struct i40iw_pbl *iwpbl = iwqp->iwpbl;
+        struct i40iw_pbl *iwpbl = &iwqp->iwpbl;
        struct i40iw_qp_mr *qpmr = &iwpbl->qp_mr;
        iwqp->page = qpmr->sq_page;
@@ -688,19 +692,22 @@ static struct ib_qp *i40iw_create_qp(struct ib_pd *ibpd,
                        ucontext = to_ucontext(ibpd->uobject->context);
                        if (req.user_wqe_buffers) {
+                                struct i40iw_pbl *iwpbl;
                                spin_lock_irqsave(
                                    &ucontext->qp_reg_mem_list_lock, flags);
-                                iwqp->iwpbl = i40iw_get_pbl(
+                                iwpbl = i40iw_get_pbl(
                                    (unsigned long)req.user_wqe_buffers,
                                    &ucontext->qp_reg_mem_list);
                                spin_unlock_irqrestore(
                                    &ucontext->qp_reg_mem_list_lock, flags);
-                                if (!iwqp->iwpbl) {
+                                if (!iwpbl) {
                                        err_code = -ENODATA;
                                        i40iw_pr_err("no pbl info\n");
                                        goto error;
                                }
+                                memcpy(&iwqp->iwpbl, iwpbl, sizeof(iwqp->iwpbl));
                        }
                }
                err_code = i40iw_setup_virt_qp(iwdev, iwqp, &init_info);
@@ -1161,8 +1168,10 @@ static struct ib_cq *i40iw_create_cq(struct ib_device *ibdev,
                memset(&req, 0, sizeof(req));
                iwcq->user_mode = true;
                ucontext = to_ucontext(context);
-                if (ib_copy_from_udata(&req, udata, sizeof(struct i40iw_create_cq_req)))
+                if (ib_copy_from_udata(&req, udata, sizeof(struct i40iw_create_cq_req))) {
+                        err_code = -EFAULT;
                        goto cq_free_resources;
+                }
                spin_lock_irqsave(&ucontext->cq_reg_mem_list_lock, flags);
                iwpbl = i40iw_get_pbl((unsigned long)req.user_cq_buffer,
@@ -2063,7 +2072,7 @@ static int i40iw_dereg_mr(struct ib_mr *ib_mr)
                        ucontext = to_ucontext(ibpd->uobject->context);
                        i40iw_del_memlist(iwmr, ucontext);
                }
-                if (iwpbl->pbl_allocated)
+                if (iwpbl->pbl_allocated && iwmr->type != IW_MEMREG_TYPE_QP)
                        i40iw_free_pble(iwdev->pble_rsrc, palloc);
                kfree(iwmr);
                return 0;
diff --git a/drivers/infiniband/hw/i40iw/i40iw_verbs.h b/drivers/infiniband/hw/i40iw/i40iw_verbs.h
index 07c3fec77de6..9067443cd311 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_verbs.h
+++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.h
@@ -170,7 +170,7 @@ struct i40iw_qp {
        struct i40iw_qp_kmode kqp;
        struct i40iw_dma_mem host_ctx;
        struct timer_list terminate_timer;
-        struct i40iw_pbl *iwpbl;
+        struct i40iw_pbl iwpbl;
        struct i40iw_dma_mem q2_ctx_mem;
        struct i40iw_dma_mem ietf_mem;
        struct completion sq_drained;
diff --git a/drivers/infiniband/hw/mlx4/cm.c b/drivers/infiniband/hw/mlx4/cm.c
index 1e6c526450d9..fedaf8260105 100644
--- a/drivers/infiniband/hw/mlx4/cm.c
+++ b/drivers/infiniband/hw/mlx4/cm.c
@@ -323,6 +323,9 @@ int mlx4_ib_multiplex_cm_handler(struct ib_device *ibdev, int port, int slave_id
                        mad->mad_hdr.attr_id == CM_REP_ATTR_ID ||
                        mad->mad_hdr.attr_id == CM_SIDR_REQ_ATTR_ID) {
                sl_cm_id = get_local_comm_id(mad);
+                id = id_map_get(ibdev, &pv_cm_id, slave_id, sl_cm_id);
+                if (id)
+                        goto cont;
                id = id_map_alloc(ibdev, slave_id, sl_cm_id);
                if (IS_ERR(id)) {
                        mlx4_ib_warn(ibdev, "%s: id{slave: %d, sl_cm_id: 0x%x} Failed to id_map_alloc\n",
@@ -343,6 +346,7 @@ int mlx4_ib_multiplex_cm_handler(struct ib_device *ibdev, int port, int slave_id
                return -EINVAL;
        }
+cont:
        set_local_comm_id(mad, id->pv_cm_id);
        if (mad->mad_hdr.attr_id == CM_DREQ_ATTR_ID)
diff --git a/drivers/infiniband/hw/mlx4/cq.c b/drivers/infiniband/hw/mlx4/cq.c
index 4f5a143fc0a7..ff931c580557 100644
--- a/drivers/infiniband/hw/mlx4/cq.c
+++ b/drivers/infiniband/hw/mlx4/cq.c
@@ -102,7 +102,7 @@ static int mlx4_ib_alloc_cq_buf(struct mlx4_ib_dev *dev, struct mlx4_ib_cq_buf *
        int err;
        err = mlx4_buf_alloc(dev->dev, nent * dev->dev->caps.cqe_size,
-                             PAGE_SIZE * 2, &buf->buf, GFP_KERNEL);
+                             PAGE_SIZE * 2, &buf->buf);
        if (err)
                goto out;
@@ -113,7 +113,7 @@ static int mlx4_ib_alloc_cq_buf(struct mlx4_ib_dev *dev, struct mlx4_ib_cq_buf *
        if (err)
                goto err_buf;
-        err = mlx4_buf_write_mtt(dev->dev, &buf->mtt, &buf->buf, GFP_KERNEL);
+        err = mlx4_buf_write_mtt(dev->dev, &buf->mtt, &buf->buf);
        if (err)
                goto err_mtt;
@@ -219,7 +219,7 @@ struct ib_cq *mlx4_ib_create_cq(struct ib_device *ibdev,
                uar = &to_mucontext(context)->uar;
        } else {
-                err = mlx4_db_alloc(dev->dev, &cq->db, 1, GFP_KERNEL);
+                err = mlx4_db_alloc(dev->dev, &cq->db, 1);
                if (err)
                        goto err_cq;
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index 75b2f7d4cd95..d1b43cbbfea7 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -1155,7 +1155,7 @@ static void mlx4_ib_disassociate_ucontext(struct ib_ucontext *ibcontext)
                         * call to mlx4_ib_vma_close.
                         */
                        put_task_struct(owning_process);
-                        msleep(1);
+                        usleep_range(1000, 2000);
                        owning_process = get_pid_task(ibcontext->tgid,
                                                      PIDTYPE_PID);
                        if (!owning_process ||
diff --git a/drivers/infiniband/hw/mlx4/mcg.c b/drivers/infiniband/hw/mlx4/mcg.c
index 3405e947dc1e..b73f89700ef9 100644
--- a/drivers/infiniband/hw/mlx4/mcg.c
+++ b/drivers/infiniband/hw/mlx4/mcg.c
@@ -1091,7 +1091,7 @@ static void _mlx4_ib_mcg_port_cleanup(struct mlx4_ib_demux_ctx *ctx, int destroy
                if (!count)
                        break;
-                msleep(1);
+                usleep_range(1000, 2000);
        } while (time_after(end, jiffies));
        flush_workqueue(ctx->mcg_wq);
diff --git a/drivers/infiniband/hw/mlx4/mlx4_ib.h b/drivers/infiniband/hw/mlx4/mlx4_ib.h
index c2b9cbf4da05..9db82e67e959 100644
--- a/drivers/infiniband/hw/mlx4/mlx4_ib.h
+++ b/drivers/infiniband/hw/mlx4/mlx4_ib.h
@@ -185,7 +185,6 @@ enum mlx4_ib_qp_flags {
        MLX4_IB_QP_LSO = IB_QP_CREATE_IPOIB_UD_LSO,
        MLX4_IB_QP_BLOCK_MULTICAST_LOOPBACK = IB_QP_CREATE_BLOCK_MULTICAST_LOOPBACK,
        MLX4_IB_QP_NETIF = IB_QP_CREATE_NETIF_QP,
-        MLX4_IB_QP_CREATE_USE_GFP_NOIO = IB_QP_CREATE_USE_GFP_NOIO,
        /* Mellanox specific flags start from IB_QP_CREATE_RESERVED_START */
        MLX4_IB_ROCE_V2_GSI_QP = MLX4_IB_QP_CREATE_ROCE_V2_GSI,
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index 996e9058e515..75c0e6c5dd56 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -634,8 +634,8 @@ static void mlx4_ib_free_qp_counter(struct mlx4_ib_dev *dev,
 static int create_qp_common(struct mlx4_ib_dev *dev, struct ib_pd *pd,
                            struct ib_qp_init_attr *init_attr,
-                            struct ib_udata *udata, int sqpn, struct mlx4_ib_qp **caller_qp,
+                            struct ib_udata *udata, int sqpn,
-                            gfp_t gfp)
+                            struct mlx4_ib_qp **caller_qp)
 {
        int qpn;
        int err;
@@ -691,14 +691,14 @@ static int create_qp_common(struct mlx4_ib_dev *dev, struct ib_pd *pd,
                if (qp_type == MLX4_IB_QPT_SMI || qp_type == MLX4_IB_QPT_GSI ||
                    (qp_type & (MLX4_IB_QPT_PROXY_SMI | MLX4_IB_QPT_PROXY_SMI_OWNER |
                                MLX4_IB_QPT_PROXY_GSI | MLX4_IB_QPT_TUN_SMI_OWNER))) {
-                        sqp = kzalloc(sizeof (struct mlx4_ib_sqp), gfp);
+                        sqp = kzalloc(sizeof(struct mlx4_ib_sqp), GFP_KERNEL);
                        if (!sqp)
                                return -ENOMEM;
                        qp = &sqp->qp;
                        qp->pri.vid = 0xFFFF;
                        qp->alt.vid = 0xFFFF;
                } else {
-                        qp = kzalloc(sizeof (struct mlx4_ib_qp), gfp);
+                        qp = kzalloc(sizeof(struct mlx4_ib_qp), GFP_KERNEL);
                        if (!qp)
                                return -ENOMEM;
                        qp->pri.vid = 0xFFFF;
@@ -780,7 +780,7 @@ static int create_qp_common(struct mlx4_ib_dev *dev, struct ib_pd *pd,
                        goto err;
                if (qp_has_rq(init_attr)) {
-                        err = mlx4_db_alloc(dev->dev, &qp->db, 0, gfp);
+                        err = mlx4_db_alloc(dev->dev, &qp->db, 0);
                        if (err)
                                goto err;
@@ -788,7 +788,7 @@ static int create_qp_common(struct mlx4_ib_dev *dev, struct ib_pd *pd,
                }
                if (mlx4_buf_alloc(dev->dev, qp->buf_size, qp->buf_size,
-                                   &qp->buf, gfp)) {
+                                   &qp->buf)) {
                        memcpy(&init_attr->cap, &backup_cap,
                               sizeof(backup_cap));
                        err = set_kernel_sq_size(dev, &init_attr->cap, qp_type,
@@ -797,7 +797,7 @@ static int create_qp_common(struct mlx4_ib_dev *dev, struct ib_pd *pd,
                                goto err_db;
                        if (mlx4_buf_alloc(dev->dev, qp->buf_size,
-                                           PAGE_SIZE * 2, &qp->buf, gfp)) {
+                                           PAGE_SIZE * 2, &qp->buf)) {
                                err = -ENOMEM;
                                goto err_db;
                        }
@@ -808,20 +808,20 @@ static int create_qp_common(struct mlx4_ib_dev *dev, struct ib_pd *pd,
                if (err)
                        goto err_buf;
-                err = mlx4_buf_write_mtt(dev->dev, &qp->mtt, &qp->buf, gfp);
+                err = mlx4_buf_write_mtt(dev->dev, &qp->mtt, &qp->buf);
                if (err)
                        goto err_mtt;
                qp->sq.wrid = kmalloc_array(qp->sq.wqe_cnt, sizeof(u64),
-                                        gfp | __GFP_NOWARN);
+                                        GFP_KERNEL | __GFP_NOWARN);
                if (!qp->sq.wrid)
                        qp->sq.wrid = __vmalloc(qp->sq.wqe_cnt * sizeof(u64),
-                                                gfp, PAGE_KERNEL);
+                                                GFP_KERNEL, PAGE_KERNEL);
                qp->rq.wrid = kmalloc_array(qp->rq.wqe_cnt, sizeof(u64),
-                                        gfp | __GFP_NOWARN);
+                                        GFP_KERNEL | __GFP_NOWARN);
                if (!qp->rq.wrid)
                        qp->rq.wrid = __vmalloc(qp->rq.wqe_cnt * sizeof(u64),
-                                                gfp, PAGE_KERNEL);
+                                                GFP_KERNEL, PAGE_KERNEL);
                if (!qp->sq.wrid || !qp->rq.wrid) {
                        err = -ENOMEM;
                        goto err_wrid;
@@ -859,7 +859,7 @@ static int create_qp_common(struct mlx4_ib_dev *dev, struct ib_pd *pd,
        if (init_attr->create_flags & IB_QP_CREATE_BLOCK_MULTICAST_LOOPBACK)
                qp->flags |= MLX4_IB_QP_BLOCK_MULTICAST_LOOPBACK;
-        err = mlx4_qp_alloc(dev->dev, qpn, &qp->mqp, gfp);
+        err = mlx4_qp_alloc(dev->dev, qpn, &qp->mqp);
        if (err)
                goto err_qpn;
@@ -1127,10 +1127,7 @@ static struct ib_qp *_mlx4_ib_create_qp(struct ib_pd *pd,
        int err;
        int sup_u_create_flags = MLX4_IB_QP_BLOCK_MULTICAST_LOOPBACK;
        u16 xrcdn = 0;
-        gfp_t gfp;
-        gfp = (init_attr->create_flags & MLX4_IB_QP_CREATE_USE_GFP_NOIO) ?
-                GFP_NOIO : GFP_KERNEL;
        /*
         * We only support LSO, vendor flag1, and multicast loopback blocking,
         * and only for kernel UD QPs.
@@ -1140,8 +1137,7 @@ static struct ib_qp *_mlx4_ib_create_qp(struct ib_pd *pd,
                                        MLX4_IB_SRIOV_TUNNEL_QP |
                                        MLX4_IB_SRIOV_SQP |
                                        MLX4_IB_QP_NETIF |
-                                        MLX4_IB_QP_CREATE_ROCE_V2_GSI |
+                                        MLX4_IB_QP_CREATE_ROCE_V2_GSI))
-                                        MLX4_IB_QP_CREATE_USE_GFP_NOIO))
                return ERR_PTR(-EINVAL);
        if (init_attr->create_flags & IB_QP_CREATE_NETIF_QP) {
@@ -1154,7 +1150,6 @@ static struct ib_qp *_mlx4_ib_create_qp(struct ib_pd *pd,
                        return ERR_PTR(-EINVAL);
                if ((init_attr->create_flags & ~(MLX4_IB_SRIOV_SQP |
-                                                 MLX4_IB_QP_CREATE_USE_GFP_NOIO |
                                                 MLX4_IB_QP_CREATE_ROCE_V2_GSI  |
                                                 MLX4_IB_QP_BLOCK_MULTICAST_LOOPBACK) &&
                     init_attr->qp_type != IB_QPT_UD) ||
@@ -1179,7 +1174,7 @@ static struct ib_qp *_mlx4_ib_create_qp(struct ib_pd *pd,
        case IB_QPT_RC:
        case IB_QPT_UC:
        case IB_QPT_RAW_PACKET:
-                qp = kzalloc(sizeof *qp, gfp);
+                qp = kzalloc(sizeof(*qp), GFP_KERNEL);
                if (!qp)
                        return ERR_PTR(-ENOMEM);
                qp->pri.vid = 0xFFFF;
@@ -1188,7 +1183,7 @@ static struct ib_qp *_mlx4_ib_create_qp(struct ib_pd *pd,
        case IB_QPT_UD:
        {
                err = create_qp_common(to_mdev(pd->device), pd, init_attr,
-                                       udata, 0, &qp, gfp);
+                                       udata, 0, &qp);
                if (err) {
                        kfree(qp);
                        return ERR_PTR(err);
@@ -1217,8 +1212,7 @@ static struct ib_qp *_mlx4_ib_create_qp(struct ib_pd *pd,
                }
                err = create_qp_common(to_mdev(pd->device), pd, init_attr, udata,
-                                       sqpn,
+                                       sqpn, &qp);
-                                       &qp, gfp);
                if (err)
                        return ERR_PTR(err);
diff --git a/drivers/infiniband/hw/mlx4/srq.c b/drivers/infiniband/hw/mlx4/srq.c
index e32dd58937a8..0facaf5f6d23 100644
--- a/drivers/infiniband/hw/mlx4/srq.c
+++ b/drivers/infiniband/hw/mlx4/srq.c
@@ -135,14 +135,14 @@ struct ib_srq *mlx4_ib_create_srq(struct ib_pd *pd,
                if (err)
                        goto err_mtt;
        } else {
-                err = mlx4_db_alloc(dev->dev, &srq->db, 0, GFP_KERNEL);
+                err = mlx4_db_alloc(dev->dev, &srq->db, 0);
                if (err)
                        goto err_srq;
                *srq->db.db = 0;
-                if (mlx4_buf_alloc(dev->dev, buf_size, PAGE_SIZE * 2, &srq->buf,
+                if (mlx4_buf_alloc(dev->dev, buf_size, PAGE_SIZE * 2,
-                                   GFP_KERNEL)) {
+                                   &srq->buf)) {
                        err = -ENOMEM;
                        goto err_db;
                }
@@ -167,7 +167,7 @@ struct ib_srq *mlx4_ib_create_srq(struct ib_pd *pd,
                if (err)
                        goto err_buf;
-                err = mlx4_buf_write_mtt(dev->dev, &srq->mtt, &srq->buf, GFP_KERNEL);
+                err = mlx4_buf_write_mtt(dev->dev, &srq->mtt, &srq->buf);
                if (err)
                        goto err_mtt;
diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
index 763bb5b36144..2c40a2e989d2 100644
--- a/drivers/infiniband/hw/mlx5/mr.c
+++ b/drivers/infiniband/hw/mlx5/mr.c
@@ -582,6 +582,15 @@ static void clean_keys(struct mlx5_ib_dev *dev, int c)
        }
 }
+static void mlx5_mr_cache_debugfs_cleanup(struct mlx5_ib_dev *dev)
+{
+        if (!mlx5_debugfs_root)
+                return;
+        debugfs_remove_recursive(dev->cache.root);
+        dev->cache.root = NULL;
+}
 static int mlx5_mr_cache_debugfs_init(struct mlx5_ib_dev *dev)
 {
        struct mlx5_mr_cache *cache = &dev->cache;
@@ -600,38 +609,34 @@ static int mlx5_mr_cache_debugfs_init(struct mlx5_ib_dev *dev)
                sprintf(ent->name, "%d", ent->order);
                ent->dir = debugfs_create_dir(ent->name,  cache->root);
                if (!ent->dir)
-                        return -ENOMEM;
+                        goto err;
                ent->fsize = debugfs_create_file("size", 0600, ent->dir, ent,
                                                 &size_fops);
                if (!ent->fsize)
-                        return -ENOMEM;
+                        goto err;
                ent->flimit = debugfs_create_file("limit", 0600, ent->dir, ent,
                                                  &limit_fops);
                if (!ent->flimit)
-                        return -ENOMEM;
+                        goto err;
                ent->fcur = debugfs_create_u32("cur", 0400, ent->dir,
                                               &ent->cur);
                if (!ent->fcur)
-                        return -ENOMEM;
+                        goto err;
                ent->fmiss = debugfs_create_u32("miss", 0600, ent->dir,
                                                &ent->miss);
                if (!ent->fmiss)
-                        return -ENOMEM;
+                        goto err;
        }
        return 0;
-}
+err:
+        mlx5_mr_cache_debugfs_cleanup(dev);
-static void mlx5_mr_cache_debugfs_cleanup(struct mlx5_ib_dev *dev)
-{
-        if (!mlx5_debugfs_root)
-                return;
-        debugfs_remove_recursive(dev->cache.root);
+        return -ENOMEM;
 }
 static void delay_time_func(unsigned long ctx)
@@ -692,6 +697,11 @@ int mlx5_mr_cache_init(struct mlx5_ib_dev *dev)
        if (err)
                mlx5_ib_warn(dev, "cache debugfs failure\n");
+        /*
+         * We don't want to fail driver if debugfs failed to initialize,
+         * so we are not forwarding error to the user.
+         */
        return 0;
 }
@@ -825,7 +835,7 @@ static int mr_umem_get(struct ib_pd *pd, u64 start, u64 length,
                            access_flags, 0);
        err = PTR_ERR_OR_ZERO(*umem);
        if (err < 0) {
-                mlx5_ib_err(dev, "umem get failed (%ld)\n", PTR_ERR(umem));
+                mlx5_ib_err(dev, "umem get failed (%d)\n", err);
                return err;
        }
@@ -1779,7 +1789,7 @@ mlx5_ib_sg_to_klms(struct mlx5_ib_mr *mr,
        mr->ndescs = sg_nents;
        for_each_sg(sgl, sg, sg_nents, i) {
-                if (unlikely(i > mr->max_descs))
+                if (unlikely(i >= mr->max_descs))
                        break;
                klms[i].va = cpu_to_be64(sg_dma_address(sg) + sg_offset);
                klms[i].bcount = cpu_to_be32(sg_dma_len(sg) - sg_offset);
diff --git a/drivers/infiniband/hw/nes/nes_hw.c b/drivers/infiniband/hw/nes/nes_hw.c
index 8f9d8b4ad583..b0adf65e4bdb 100644
--- a/drivers/infiniband/hw/nes/nes_hw.c
+++ b/drivers/infiniband/hw/nes/nes_hw.c
@@ -551,7 +551,7 @@ struct nes_adapter *nes_init_adapter(struct nes_device *nesdev, u8 hw_rev) {
                        if ((0x0F000100 == (pcs_control_status0 & 0x0F000100))
                            || (0x0F000100 == (pcs_control_status1 & 0x0F000100)))
                                int_cnt++;
-                        msleep(1);
+                        usleep_range(1000, 2000);
                }
                if (int_cnt > 1) {
                        spin_lock_irqsave(&nesadapter->phy_lock, flags);
@@ -592,7 +592,7 @@ struct nes_adapter *nes_init_adapter(struct nes_device *nesdev, u8 hw_rev) {
                                                break;
                                        }
                                }
-                                msleep(1);
+                                usleep_range(1000, 2000);
                        }
                }
        }
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
index 2f30bda8457a..27d5e8d9f08d 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
@@ -744,7 +744,8 @@ err:
        if (is_uctx_pd) {
                ocrdma_release_ucontext_pd(uctx);
        } else {
-                status = _ocrdma_dealloc_pd(dev, pd);
+                if (_ocrdma_dealloc_pd(dev, pd))
+                        pr_err("%s: _ocrdma_dealloc_pd() failed\n", __func__);
        }
 exit:
        return ERR_PTR(status);
@@ -1901,6 +1902,7 @@ struct ib_srq *ocrdma_create_srq(struct ib_pd *ibpd,
                goto err;
        if (udata == NULL) {
+                status = -ENOMEM;
                srq->rqe_wr_id_tbl = kzalloc(sizeof(u64) * srq->rq.max_cnt,
                            GFP_KERNEL);
                if (srq->rqe_wr_id_tbl == NULL)
diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
index 548e4d1e998f..2ae71b8f1ba8 100644
--- a/drivers/infiniband/hw/qedr/verbs.c
+++ b/drivers/infiniband/hw/qedr/verbs.c
@@ -53,6 +53,14 @@
 #define DB_ADDR_SHIFT(addr)             ((addr) << DB_PWM_ADDR_OFFSET_SHIFT)
+static inline int qedr_ib_copy_to_udata(struct ib_udata *udata, void *src,
+                                        size_t len)
+{
+        size_t min_len = min_t(size_t, len, udata->outlen);
+        return ib_copy_to_udata(udata, src, min_len);
+}
 int qedr_query_pkey(struct ib_device *ibdev, u8 port, u16 index, u16 *pkey)
 {
        if (index > QEDR_ROCE_PKEY_TABLE_LEN)
@@ -378,7 +386,7 @@ struct ib_ucontext *qedr_alloc_ucontext(struct ib_device *ibdev,
        uresp.sges_per_srq_wr = dev->attr.max_srq_sge;
        uresp.max_cqes = QEDR_MAX_CQES;
-        rc = ib_copy_to_udata(udata, &uresp, sizeof(uresp));
+        rc = qedr_ib_copy_to_udata(udata, &uresp, sizeof(uresp));
        if (rc)
                goto err;
@@ -499,7 +507,7 @@ struct ib_pd *qedr_alloc_pd(struct ib_device *ibdev,
                uresp.pd_id = pd_id;
-                rc = ib_copy_to_udata(udata, &uresp, sizeof(uresp));
+                rc = qedr_ib_copy_to_udata(udata, &uresp, sizeof(uresp));
                if (rc) {
                        DP_ERR(dev, "copy error pd_id=0x%x.\n", pd_id);
                        dev->ops->rdma_dealloc_pd(dev->rdma_ctx, pd_id);
@@ -729,7 +737,7 @@ static int qedr_copy_cq_uresp(struct qedr_dev *dev,
        uresp.db_offset = DB_ADDR_SHIFT(DQ_PWM_OFFSET_UCM_RDMA_CQ_CONS_32BIT);
        uresp.icid = cq->icid;
-        rc = ib_copy_to_udata(udata, &uresp, sizeof(uresp));
+        rc = qedr_ib_copy_to_udata(udata, &uresp, sizeof(uresp));
        if (rc)
                DP_ERR(dev, "copy error cqid=0x%x.\n", cq->icid);
@@ -1238,7 +1246,7 @@ static int qedr_copy_qp_uresp(struct qedr_dev *dev,
        uresp.atomic_supported = dev->atomic_cap != IB_ATOMIC_NONE;
        uresp.qp_id = qp->qp_id;
-        rc = ib_copy_to_udata(udata, &uresp, sizeof(uresp));
+        rc = qedr_ib_copy_to_udata(udata, &uresp, sizeof(uresp));
        if (rc)
                DP_ERR(dev,
                       "create qp: failed a copy to user space with qp icid=0x%x.\n",
diff --git a/drivers/infiniband/hw/qib/qib_qp.c b/drivers/infiniband/hw/qib/qib_qp.c
index 5984981e7dd4..a343e3b5d4cb 100644
--- a/drivers/infiniband/hw/qib/qib_qp.c
+++ b/drivers/infiniband/hw/qib/qib_qp.c
@@ -104,10 +104,9 @@ const struct rvt_operation_params qib_post_parms[RVT_OPERATION_MAX] = {
 };
-static void get_map_page(struct rvt_qpn_table *qpt, struct rvt_qpn_map *map,
+static void get_map_page(struct rvt_qpn_table *qpt, struct rvt_qpn_map *map)
-                         gfp_t gfp)
 {
-        unsigned long page = get_zeroed_page(gfp);
+        unsigned long page = get_zeroed_page(GFP_KERNEL);
        /*
         * Free the page if someone raced with us installing it.
@@ -126,7 +125,7 @@ static void get_map_page(struct rvt_qpn_table *qpt, struct rvt_qpn_map *map,
 * zero/one for QP type IB_QPT_SMI/IB_QPT_GSI.
 */
 int qib_alloc_qpn(struct rvt_dev_info *rdi, struct rvt_qpn_table *qpt,
-                  enum ib_qp_type type, u8 port, gfp_t gfp)
+                  enum ib_qp_type type, u8 port)
 {
        u32 i, offset, max_scan, qpn;
        struct rvt_qpn_map *map;
@@ -160,7 +159,7 @@ int qib_alloc_qpn(struct rvt_dev_info *rdi, struct rvt_qpn_table *qpt,
        max_scan = qpt->nmaps - !offset;
        for (i = 0;;) {
                if (unlikely(!map->page)) {
-                        get_map_page(qpt, map, gfp);
+                        get_map_page(qpt, map);
                        if (unlikely(!map->page))
                                break;
                }
@@ -317,16 +316,16 @@ u32 qib_mtu_from_qp(struct rvt_dev_info *rdi, struct rvt_qp *qp, u32 pmtu)
        return ib_mtu_enum_to_int(pmtu);
 }
-void *qib_qp_priv_alloc(struct rvt_dev_info *rdi, struct rvt_qp *qp, gfp_t gfp)
+void *qib_qp_priv_alloc(struct rvt_dev_info *rdi, struct rvt_qp *qp)
 {
        struct qib_qp_priv *priv;
-        priv = kzalloc(sizeof(*priv), gfp);
+        priv = kzalloc(sizeof(*priv), GFP_KERNEL);
        if (!priv)
                return ERR_PTR(-ENOMEM);
        priv->owner = qp;
-        priv->s_hdr = kzalloc(sizeof(*priv->s_hdr), gfp);
+        priv->s_hdr = kzalloc(sizeof(*priv->s_hdr), GFP_KERNEL);
        if (!priv->s_hdr) {
                kfree(priv);
                return ERR_PTR(-ENOMEM);
diff --git a/drivers/infiniband/hw/qib/qib_verbs.h b/drivers/infiniband/hw/qib/qib_verbs.h
index da0db5485ddc..a52fc67b40d7 100644
--- a/drivers/infiniband/hw/qib/qib_verbs.h
+++ b/drivers/infiniband/hw/qib/qib_verbs.h
@@ -274,11 +274,11 @@ int qib_get_counters(struct qib_pportdata *ppd,
 * Functions provided by qib driver for rdmavt to use
 */
 unsigned qib_free_all_qps(struct rvt_dev_info *rdi);
-void *qib_qp_priv_alloc(struct rvt_dev_info *rdi, struct rvt_qp *qp, gfp_t gfp);
+void *qib_qp_priv_alloc(struct rvt_dev_info *rdi, struct rvt_qp *qp);
 void qib_qp_priv_free(struct rvt_dev_info *rdi, struct rvt_qp *qp);
 void qib_notify_qp_reset(struct rvt_qp *qp);
 int qib_alloc_qpn(struct rvt_dev_info *rdi, struct rvt_qpn_table *qpt,
-                  enum ib_qp_type type, u8 port, gfp_t gfp);
+                  enum ib_qp_type type, u8 port);
 void qib_restart_rc(struct rvt_qp *qp, u32 psn, int wait);
 #ifdef CONFIG_DEBUG_FS
diff --git a/drivers/infiniband/sw/rdmavt/qp.c b/drivers/infiniband/sw/rdmavt/qp.c
index 727e81cc2c8f..8876ee7bc326 100644
--- a/drivers/infiniband/sw/rdmavt/qp.c
+++ b/drivers/infiniband/sw/rdmavt/qp.c
@@ -118,10 +118,9 @@ const int ib_rvt_state_ops[IB_QPS_ERR + 1] = {
 EXPORT_SYMBOL(ib_rvt_state_ops);
 static void get_map_page(struct rvt_qpn_table *qpt,
-                         struct rvt_qpn_map *map,
+                         struct rvt_qpn_map *map)
-                         gfp_t gfp)
 {
-        unsigned long page = get_zeroed_page(gfp);
+        unsigned long page = get_zeroed_page(GFP_KERNEL);
        /*
         * Free the page if someone raced with us installing it.
@@ -173,7 +172,7 @@ static int init_qpn_table(struct rvt_dev_info *rdi, struct rvt_qpn_table *qpt)
                    rdi->dparms.qpn_res_start, rdi->dparms.qpn_res_end);
        for (i = rdi->dparms.qpn_res_start; i <= rdi->dparms.qpn_res_end; i++) {
                if (!map->page) {
-                        get_map_page(qpt, map, GFP_KERNEL);
+                        get_map_page(qpt, map);
                        if (!map->page) {
                                ret = -ENOMEM;
                                break;
@@ -342,14 +341,14 @@ static inline unsigned mk_qpn(struct rvt_qpn_table *qpt,
 * Return: The queue pair number
 */
 static int alloc_qpn(struct rvt_dev_info *rdi, struct rvt_qpn_table *qpt,
-                     enum ib_qp_type type, u8 port_num, gfp_t gfp)
+                     enum ib_qp_type type, u8 port_num)
 {
        u32 i, offset, max_scan, qpn;
        struct rvt_qpn_map *map;
        u32 ret;
        if (rdi->driver_f.alloc_qpn)
-                return rdi->driver_f.alloc_qpn(rdi, qpt, type, port_num, gfp);
+                return rdi->driver_f.alloc_qpn(rdi, qpt, type, port_num);
        if (type == IB_QPT_SMI || type == IB_QPT_GSI) {
                unsigned n;
@@ -374,7 +373,7 @@ static int alloc_qpn(struct rvt_dev_info *rdi, struct rvt_qpn_table *qpt,
        max_scan = qpt->nmaps - !offset;
        for (i = 0;;) {
                if (unlikely(!map->page)) {
-                        get_map_page(qpt, map, gfp);
+                        get_map_page(qpt, map);
                        if (unlikely(!map->page))
                                break;
                }
@@ -672,7 +671,6 @@ struct ib_qp *rvt_create_qp(struct ib_pd *ibpd,
        struct ib_qp *ret = ERR_PTR(-ENOMEM);
        struct rvt_dev_info *rdi = ib_to_rvt(ibpd->device);
        void *priv = NULL;
-        gfp_t gfp;
        size_t sqsize;
        if (!rdi)
@@ -680,18 +678,9 @@ struct ib_qp *rvt_create_qp(struct ib_pd *ibpd,
        if (init_attr->cap.max_send_sge > rdi->dparms.props.max_sge ||
            init_attr->cap.max_send_wr > rdi->dparms.props.max_qp_wr ||
-            init_attr->create_flags & ~(IB_QP_CREATE_USE_GFP_NOIO))
+            init_attr->create_flags)
                return ERR_PTR(-EINVAL);
-        /* GFP_NOIO is applicable to RC QP's only */
-        if (init_attr->create_flags & IB_QP_CREATE_USE_GFP_NOIO &&
-            init_attr->qp_type != IB_QPT_RC)
-                return ERR_PTR(-EINVAL);
-        gfp = init_attr->create_flags & IB_QP_CREATE_USE_GFP_NOIO ?
-                                                GFP_NOIO : GFP_KERNEL;
        /* Check receive queue parameters if no SRQ is specified. */
        if (!init_attr->srq) {
                if (init_attr->cap.max_recv_sge > rdi->dparms.props.max_sge ||
@@ -719,14 +708,7 @@ struct ib_qp *rvt_create_qp(struct ib_pd *ibpd,
                sz = sizeof(struct rvt_sge) *
                        init_attr->cap.max_send_sge +
                        sizeof(struct rvt_swqe);
-                if (gfp == GFP_NOIO)
+                swq = vzalloc_node(sqsize * sz, rdi->dparms.node);
-                        swq = __vmalloc(
-                                sqsize * sz,
-                                gfp | __GFP_ZERO, PAGE_KERNEL);
-                else
-                        swq = vzalloc_node(
-                                sqsize * sz,
-                                rdi->dparms.node);
                if (!swq)
                        return ERR_PTR(-ENOMEM);
@@ -741,7 +723,8 @@ struct ib_qp *rvt_create_qp(struct ib_pd *ibpd,
                } else if (init_attr->cap.max_recv_sge > 1)
                        sg_list_sz = sizeof(*qp->r_sg_list) *
                                (init_attr->cap.max_recv_sge - 1);
-                qp = kzalloc_node(sz + sg_list_sz, gfp, rdi->dparms.node);
+                qp = kzalloc_node(sz + sg_list_sz, GFP_KERNEL,
+                                  rdi->dparms.node);
                if (!qp)
                        goto bail_swq;
@@ -751,7 +734,7 @@ struct ib_qp *rvt_create_qp(struct ib_pd *ibpd,
                                kzalloc_node(
                                        sizeof(*qp->s_ack_queue) *
                                         rvt_max_atomic(rdi),
-                                        gfp,
+                                        GFP_KERNEL,
                                        rdi->dparms.node);
                        if (!qp->s_ack_queue)
                                goto bail_qp;
@@ -766,7 +749,7 @@ struct ib_qp *rvt_create_qp(struct ib_pd *ibpd,
                 * Driver needs to set up it's private QP structure and do any
                 * initialization that is needed.
                 */
-                priv = rdi->driver_f.qp_priv_alloc(rdi, qp, gfp);
+                priv = rdi->driver_f.qp_priv_alloc(rdi, qp);
                if (IS_ERR(priv)) {
                        ret = priv;
                        goto bail_qp;
@@ -786,11 +769,6 @@ struct ib_qp *rvt_create_qp(struct ib_pd *ibpd,
                                qp->r_rq.wq = vmalloc_user(
                                                sizeof(struct rvt_rwq) +
                                                qp->r_rq.size * sz);
-                        else if (gfp == GFP_NOIO)
-                                qp->r_rq.wq = __vmalloc(
-                                                sizeof(struct rvt_rwq) +
-                                                qp->r_rq.size * sz,
-                                                gfp | __GFP_ZERO, PAGE_KERNEL);
                        else
                                qp->r_rq.wq = vzalloc_node(
                                                sizeof(struct rvt_rwq) +
@@ -824,7 +802,7 @@ struct ib_qp *rvt_create_qp(struct ib_pd *ibpd,
                err = alloc_qpn(rdi, &rdi->qp_dev->qpn_table,
                                init_attr->qp_type,
-                                init_attr->port_num, gfp);
+                                init_attr->port_num);
                if (err < 0) {
                        ret = ERR_PTR(err);
                        goto bail_rq_wq;
@@ -1280,9 +1258,7 @@ int rvt_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
        if (attr_mask & IB_QP_TIMEOUT) {
                qp->timeout = attr->timeout;
-                qp->timeout_jiffies =
+                qp->timeout_jiffies = rvt_timeout_to_jiffies(qp->timeout);
-                        usecs_to_jiffies((4096UL * (1UL << qp->timeout)) /
-                                1000UL);
        }
        if (attr_mask & IB_QP_QKEY)
diff --git a/drivers/infiniband/sw/rxe/rxe_net.c b/drivers/infiniband/sw/rxe/rxe_net.c
index c3a140ed4df2..08f3f90d2912 100644
--- a/drivers/infiniband/sw/rxe/rxe_net.c
+++ b/drivers/infiniband/sw/rxe/rxe_net.c
@@ -441,6 +441,8 @@ static void rxe_skb_tx_dtor(struct sk_buff *skb)
        if (unlikely(qp->need_req_skb &&
                     skb_out < RXE_INFLIGHT_SKBS_PER_QP_LOW))
                rxe_run_task(&qp->req.task, 1);
+        rxe_drop_ref(qp);
 }
 int rxe_send(struct rxe_dev *rxe, struct rxe_pkt_info *pkt, struct sk_buff *skb)
@@ -473,6 +475,7 @@ int rxe_send(struct rxe_dev *rxe, struct rxe_pkt_info *pkt, struct sk_buff *skb)
                return -EAGAIN;
        }
+        rxe_add_ref(pkt->qp);
        atomic_inc(&pkt->qp->skb_out);
        kfree_skb(skb);
diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c
index be944d5aa9af..a958ee918a49 100644
--- a/drivers/infiniband/sw/rxe/rxe_resp.c
+++ b/drivers/infiniband/sw/rxe/rxe_resp.c
@@ -1219,6 +1219,9 @@ void rxe_drain_req_pkts(struct rxe_qp *qp, bool notify)
                kfree_skb(skb);
        }
+        if (notify)
+                return;
        while (!qp->srq && qp->rq.queue && queue_head(qp->rq.queue))
                advance_consumer(qp->rq.queue);
 }
diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c
index 073e66783f1d..af90a7d42b96 100644
--- a/drivers/infiniband/sw/rxe/rxe_verbs.c
+++ b/drivers/infiniband/sw/rxe/rxe_verbs.c
@@ -914,6 +914,9 @@ static int rxe_post_recv(struct ib_qp *ibqp, struct ib_recv_wr *wr,
        spin_unlock_irqrestore(&rq->producer_lock, flags);
+        if (qp->resp.state == QP_STATE_ERROR)
+                rxe_run_task(&qp->resp.task, 1);
 err1:
        return err;
 }
@@ -1240,6 +1243,8 @@ int rxe_register_device(struct rxe_dev *rxe)
        addrconf_addr_eui48((unsigned char *)&dev->node_guid,
                            rxe->ndev->dev_addr);
        dev->dev.dma_ops = &dma_virt_ops;
+        dma_coerce_mask_and_coherent(&dev->dev,
+                                     dma_get_required_mask(dev->dev.parent));
        dev->uverbs_abi_ver = RXE_UVERBS_ABI_VERSION;
        dev->uverbs_cmd_mask = BIT_ULL(IB_USER_VERBS_CMD_GET_CONTEXT)
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index 7cbcfdac6529..f87d104837dc 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -39,6 +39,7 @@
 #include <linux/vmalloc.h>
 #include <linux/moduleparam.h>
 #include <linux/sched/signal.h>
+#include <linux/sched/mm.h>
 #include "ipoib.h"
@@ -954,7 +955,7 @@ void ipoib_cm_dev_stop(struct net_device *dev)
                        break;
                }
                spin_unlock_irq(&priv->lock);
-                msleep(1);
+                usleep_range(1000, 2000);
                ipoib_drain_cq(dev);
                spin_lock_irq(&priv->lock);
        }
@@ -1047,9 +1048,8 @@ static struct ib_qp *ipoib_cm_create_tx_qp(struct net_device *dev, struct ipoib_
                .sq_sig_type            = IB_SIGNAL_ALL_WR,
                .qp_type                = IB_QPT_RC,
                .qp_context             = tx,
-                .create_flags           = IB_QP_CREATE_USE_GFP_NOIO
+                .create_flags           = 0
        };
        struct ib_qp *tx_qp;
        if (dev->features & NETIF_F_SG)
@@ -1057,10 +1057,6 @@ static struct ib_qp *ipoib_cm_create_tx_qp(struct net_device *dev, struct ipoib_
                        min_t(u32, priv->ca->attrs.max_sge, MAX_SKB_FRAGS + 1);
        tx_qp = ib_create_qp(priv->pd, &attr);
-        if (PTR_ERR(tx_qp) == -EINVAL) {
-                attr.create_flags &= ~IB_QP_CREATE_USE_GFP_NOIO;
-                tx_qp = ib_create_qp(priv->pd, &attr);
-        }
        tx->max_send_sge = attr.cap.max_send_sge;
        return tx_qp;
 }
@@ -1131,10 +1127,11 @@ static int ipoib_cm_tx_init(struct ipoib_cm_tx *p, u32 qpn,
                            struct sa_path_rec *pathrec)
 {
        struct ipoib_dev_priv *priv = ipoib_priv(p->dev);
+        unsigned int noio_flag;
        int ret;
-        p->tx_ring = __vmalloc(ipoib_sendq_size * sizeof *p->tx_ring,
+        noio_flag = memalloc_noio_save();
-                               GFP_NOIO, PAGE_KERNEL);
+        p->tx_ring = vzalloc(ipoib_sendq_size * sizeof(*p->tx_ring));
        if (!p->tx_ring) {
                ret = -ENOMEM;
                goto err_tx;
@@ -1142,9 +1139,10 @@ static int ipoib_cm_tx_init(struct ipoib_cm_tx *p, u32 qpn,
        memset(p->tx_ring, 0, ipoib_sendq_size * sizeof *p->tx_ring);
        p->qp = ipoib_cm_create_tx_qp(p->dev, p);
+        memalloc_noio_restore(noio_flag);
        if (IS_ERR(p->qp)) {
                ret = PTR_ERR(p->qp);
-                ipoib_warn(priv, "failed to allocate tx qp: %d\n", ret);
+                ipoib_warn(priv, "failed to create tx qp: %d\n", ret);
                goto err_qp;
        }
@@ -1206,7 +1204,7 @@ static void ipoib_cm_tx_destroy(struct ipoib_cm_tx *p)
                                goto timeout;
                        }
-                        msleep(1);
+                        usleep_range(1000, 2000);
                }
        }
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index efe7402f4885..57a9655e844d 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -770,7 +770,7 @@ int ipoib_ib_dev_stop_default(struct net_device *dev)
                ipoib_drain_cq(dev);
-                msleep(1);
+                usleep_range(1000, 2000);
        }
        ipoib_dbg(priv, "All sends and receives done.\n");
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 6e86eeee370e..4ce315c92b48 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -233,6 +233,7 @@ static netdev_features_t ipoib_fix_features(struct net_device *dev, netdev_featu
 static int ipoib_change_mtu(struct net_device *dev, int new_mtu)
 {
        struct ipoib_dev_priv *priv = ipoib_priv(dev);
+        int ret = 0;
        /* dev->mtu > 2K ==> connected mode */
        if (ipoib_cm_admin_enabled(dev)) {
@@ -256,9 +257,34 @@ static int ipoib_change_mtu(struct net_device *dev, int new_mtu)
                ipoib_dbg(priv, "MTU must be smaller than the underlying "
                                "link layer MTU - 4 (%u)\n", priv->mcast_mtu);
-        dev->mtu = min(priv->mcast_mtu, priv->admin_mtu);
+        new_mtu = min(priv->mcast_mtu, priv->admin_mtu);
-        return 0;
+        if (priv->rn_ops->ndo_change_mtu) {
+                bool carrier_status = netif_carrier_ok(dev);
+                netif_carrier_off(dev);
+                /* notify lower level on the real mtu */
+                ret = priv->rn_ops->ndo_change_mtu(dev, new_mtu);
+                if (carrier_status)
+                        netif_carrier_on(dev);
+        } else {
+                dev->mtu = new_mtu;
+        }
+        return ret;
+}
+static void ipoib_get_stats(struct net_device *dev,
+                            struct rtnl_link_stats64 *stats)
+{
+        struct ipoib_dev_priv *priv = ipoib_priv(dev);
+        if (priv->rn_ops->ndo_get_stats64)
+                priv->rn_ops->ndo_get_stats64(dev, stats);
+        else
+                netdev_stats_to_stats64(stats, &dev->stats);
 }
 /* Called with an RCU read lock taken */
@@ -1808,6 +1834,7 @@ static const struct net_device_ops ipoib_netdev_ops_pf = {
        .ndo_get_vf_stats        = ipoib_get_vf_stats,
        .ndo_set_vf_guid         = ipoib_set_vf_guid,
        .ndo_set_mac_address     = ipoib_set_mac,
+        .ndo_get_stats64         = ipoib_get_stats,
 };
 static const struct net_device_ops ipoib_netdev_ops_vf = {
@@ -2212,6 +2239,7 @@ static struct net_device *ipoib_add_port(const char *format,
                goto register_failed;
        }
+        result = -ENOMEM;
        if (ipoib_cm_add_mode_attr(priv->dev))
                goto sysfs_failed;
        if (ipoib_add_pkey_attr(priv->dev))
diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.c b/drivers/infiniband/ulp/iser/iscsi_iser.c
index 5a887efb4bdf..37b33d708c2d 100644
--- a/drivers/infiniband/ulp/iser/iscsi_iser.c
+++ b/drivers/infiniband/ulp/iser/iscsi_iser.c
@@ -83,6 +83,7 @@ static struct scsi_host_template iscsi_iser_sht;
 static struct iscsi_transport iscsi_iser_transport;
 static struct scsi_transport_template *iscsi_iser_scsi_transport;
 static struct workqueue_struct *release_wq;
+static DEFINE_MUTEX(unbind_iser_conn_mutex);
 struct iser_global ig;
 int iser_debug_level = 0;
@@ -550,12 +551,14 @@ iscsi_iser_conn_stop(struct iscsi_cls_conn *cls_conn, int flag)
         */
        if (iser_conn) {
                mutex_lock(&iser_conn->state_mutex);
+                mutex_lock(&unbind_iser_conn_mutex);
                iser_conn_terminate(iser_conn);
                iscsi_conn_stop(cls_conn, flag);
                /* unbind */
                iser_conn->iscsi_conn = NULL;
                conn->dd_data = NULL;
+                mutex_unlock(&unbind_iser_conn_mutex);
                complete(&iser_conn->stop_completion);
                mutex_unlock(&iser_conn->state_mutex);
@@ -977,13 +980,21 @@ static int iscsi_iser_slave_alloc(struct scsi_device *sdev)
        struct iser_conn *iser_conn;
        struct ib_device *ib_dev;
+        mutex_lock(&unbind_iser_conn_mutex);
        session = starget_to_session(scsi_target(sdev))->dd_data;
        iser_conn = session->leadconn->dd_data;
+        if (!iser_conn) {
+                mutex_unlock(&unbind_iser_conn_mutex);
+                return -ENOTCONN;
+        }
        ib_dev = iser_conn->ib_conn.device->ib_device;
        if (!(ib_dev->attrs.device_cap_flags & IB_DEVICE_SG_GAPS_REG))
                blk_queue_virt_boundary(sdev->request_queue, ~MASK_4K);
+        mutex_unlock(&unbind_iser_conn_mutex);
        return 0;
 }
diff --git a/drivers/infiniband/ulp/iser/iser_initiator.c b/drivers/infiniband/ulp/iser/iser_initiator.c
index 12ed62ce9ff7..2a07692007bd 100644
--- a/drivers/infiniband/ulp/iser/iser_initiator.c
+++ b/drivers/infiniband/ulp/iser/iser_initiator.c
@@ -137,8 +137,10 @@ iser_prepare_write_cmd(struct iscsi_task *task,
        if (unsol_sz < edtl) {
                hdr->flags     |= ISER_WSV;
-                hdr->write_stag = cpu_to_be32(mem_reg->rkey);
+                if (buf_out->data_len > imm_sz) {
-                hdr->write_va   = cpu_to_be64(mem_reg->sge.addr + unsol_sz);
+                        hdr->write_stag = cpu_to_be32(mem_reg->rkey);
+                        hdr->write_va = cpu_to_be64(mem_reg->sge.addr + unsol_sz);
+                }
                iser_dbg("Cmd itt:%d, WRITE tags, RKEY:%#.4X "
                         "VA:%#llX + unsol:%d\n",
diff --git a/drivers/infiniband/ulp/iser/iser_verbs.c b/drivers/infiniband/ulp/iser/iser_verbs.c
index c538a38c91ce..26a004e97ae0 100644
--- a/drivers/infiniband/ulp/iser/iser_verbs.c
+++ b/drivers/infiniband/ulp/iser/iser_verbs.c
@@ -708,8 +708,14 @@ iser_calc_scsi_params(struct iser_conn *iser_conn,
        unsigned short sg_tablesize, sup_sg_tablesize;
        sg_tablesize = DIV_ROUND_UP(max_sectors * 512, SIZE_4K);
-        sup_sg_tablesize = min_t(unsigned, ISCSI_ISER_MAX_SG_TABLESIZE,
+        if (device->ib_device->attrs.device_cap_flags &
-                                 device->ib_device->attrs.max_fast_reg_page_list_len);
+                        IB_DEVICE_MEM_MGT_EXTENSIONS)
+                sup_sg_tablesize =
+                        min_t(
+                         uint, ISCSI_ISER_MAX_SG_TABLESIZE,
+                         device->ib_device->attrs.max_fast_reg_page_list_len);
+        else
+                sup_sg_tablesize = ISCSI_ISER_MAX_SG_TABLESIZE;
        iser_conn->scsi_sg_tablesize = min(sg_tablesize, sup_sg_tablesize);
 }
diff --git a/drivers/irqchip/irq-digicolor.c b/drivers/irqchip/irq-digicolor.c
index dad85e74c37c..3aae015469a5 100644
--- a/drivers/irqchip/irq-digicolor.c
+++ b/drivers/irqchip/irq-digicolor.c
@@ -71,7 +71,7 @@ static void __init digicolor_set_gc(void __iomem *reg_base, unsigned irq_base,
 static int __init digicolor_of_init(struct device_node *node,
                                struct device_node *parent)
 {
-        static void __iomem *reg_base;
+        void __iomem *reg_base;
        unsigned int clr = IRQ_NOREQUEST | IRQ_NOPROBE | IRQ_NOAUTOEN;
        struct regmap *ucregs;
        int ret;
diff --git a/drivers/irqchip/irq-gic-realview.c b/drivers/irqchip/irq-gic-realview.c
index 54c296401525..18d58d2b4ffe 100644
--- a/drivers/irqchip/irq-gic-realview.c
+++ b/drivers/irqchip/irq-gic-realview.c
@@ -43,7 +43,7 @@ static const struct of_device_id syscon_pldset_of_match[] = {
 static int __init
 realview_gic_of_init(struct device_node *node, struct device_node *parent)
 {
-        static struct regmap *map;
+        struct regmap *map;
        struct device_node *np;
        const struct of_device_id *gic_id;
        u32 pld1_ctrl;
diff --git a/drivers/irqchip/irq-mips-cpu.c b/drivers/irqchip/irq-mips-cpu.c
index 0a8ed1c05518..14461cbfab2f 100644
--- a/drivers/irqchip/irq-mips-cpu.c
+++ b/drivers/irqchip/irq-mips-cpu.c
@@ -154,7 +154,7 @@ asmlinkage void __weak plat_irq_dispatch(void)
 static int mips_cpu_intc_map(struct irq_domain *d, unsigned int irq,
                             irq_hw_number_t hw)
 {
-        static struct irq_chip *chip;
+        struct irq_chip *chip;
        if (hw < 2 && cpu_has_mipsmt) {
                /* Software interrupts are used for MT/CMT IPI */
diff --git a/drivers/irqchip/irq-mips-gic.c b/drivers/irqchip/irq-mips-gic.c
index 832ebf4062f7..6ab1d3afec02 100644
--- a/drivers/irqchip/irq-mips-gic.c
+++ b/drivers/irqchip/irq-mips-gic.c
@@ -950,7 +950,6 @@ static void __init __gic_init(unsigned long gic_base_addr,
                                               &gic_irq_domain_ops, NULL);
        if (!gic_irq_domain)
                panic("Failed to add GIC IRQ domain");
-        gic_irq_domain->name = "mips-gic-irq";
        gic_ipi_domain = irq_domain_add_hierarchy(gic_irq_domain,
                                                  IRQ_DOMAIN_FLAG_IPI_PER_CPU,
@@ -959,7 +958,6 @@ static void __init __gic_init(unsigned long gic_base_addr,
        if (!gic_ipi_domain)
                panic("Failed to add GIC IPI domain");
-        gic_ipi_domain->name = "mips-gic-ipi";
        irq_domain_update_bus_token(gic_ipi_domain, DOMAIN_BUS_IPI);
        if (node &&
diff --git a/drivers/isdn/divert/isdn_divert.c b/drivers/isdn/divert/isdn_divert.c
index 060d357f107f..6f423bc49d0d 100644
--- a/drivers/isdn/divert/isdn_divert.c
+++ b/drivers/isdn/divert/isdn_divert.c
@@ -485,18 +485,19 @@ static int isdn_divert_icall(isdn_ctrl *ic)
                                cs->deflect_dest[0] = '\0';
                                retval = 4; /* only proceed */
                        }
-                        sprintf(cs->info, "%d 0x%lx %s %s %s %s 0x%x 0x%x %d %d %s\n",
+                        snprintf(cs->info, sizeof(cs->info),
-                                cs->akt_state,
+                                 "%d 0x%lx %s %s %s %s 0x%x 0x%x %d %d %s\n",
-                                cs->divert_id,
+                                 cs->akt_state,
-                                divert_if.drv_to_name(cs->ics.driver),
+                                 cs->divert_id,
-                                (ic->command == ISDN_STAT_ICALLW) ? "1" : "0",
+                                 divert_if.drv_to_name(cs->ics.driver),
-                                cs->ics.parm.setup.phone,
+                                 (ic->command == ISDN_STAT_ICALLW) ? "1" : "0",
-                                cs->ics.parm.setup.eazmsn,
+                                 cs->ics.parm.setup.phone,
-                                cs->ics.parm.setup.si1,
+                                 cs->ics.parm.setup.eazmsn,
-                                cs->ics.parm.setup.si2,
+                                 cs->ics.parm.setup.si1,
-                                cs->ics.parm.setup.screen,
+                                 cs->ics.parm.setup.si2,
-                                dv->rule.waittime,
+                                 cs->ics.parm.setup.screen,
-                                cs->deflect_dest);
+                                 dv->rule.waittime,
+                                 cs->deflect_dest);
                        if ((dv->rule.action == DEFLECT_REPORT) ||
                            (dv->rule.action == DEFLECT_REJECT)) {
                                put_info_buffer(cs->info);
diff --git a/drivers/isdn/hardware/avm/c4.c b/drivers/isdn/hardware/avm/c4.c
index 40c7e2cf423b..034cabac699d 100644
--- a/drivers/isdn/hardware/avm/c4.c
+++ b/drivers/isdn/hardware/avm/c4.c
@@ -42,7 +42,7 @@ static char *revision = "$Revision: 1.1.2.2 $";
 static bool suppress_pollack;
-static struct pci_device_id c4_pci_tbl[] = {
+static const struct pci_device_id c4_pci_tbl[] = {
        { PCI_VENDOR_ID_DEC, PCI_DEVICE_ID_DEC_21285, PCI_VENDOR_ID_AVM, PCI_DEVICE_ID_AVM_C4, 0, 0, (unsigned long)4 },
        { PCI_VENDOR_ID_DEC, PCI_DEVICE_ID_DEC_21285, PCI_VENDOR_ID_AVM, PCI_DEVICE_ID_AVM_C2, 0, 0, (unsigned long)2 },
        { }                     /* Terminating entry */
diff --git a/drivers/isdn/hardware/eicon/divasmain.c b/drivers/isdn/hardware/eicon/divasmain.c
index 8b7ad4f1ab01..b2023e08dcd2 100644
--- a/drivers/isdn/hardware/eicon/divasmain.c
+++ b/drivers/isdn/hardware/eicon/divasmain.c
@@ -110,7 +110,7 @@ typedef struct _diva_os_thread_dpc {
 /*
  This table should be sorted by PCI device ID
 */
-static struct pci_device_id divas_pci_tbl[] = {
+static const struct pci_device_id divas_pci_tbl[] = {
        /* Diva Server BRI-2M PCI 0xE010 */
        { PCI_VDEVICE(EICON, PCI_DEVICE_ID_EICON_MAESTRA),
          CARDTYPE_MAESTRA_PCI },
diff --git a/drivers/isdn/hardware/mISDN/avmfritz.c b/drivers/isdn/hardware/mISDN/avmfritz.c
index e3fa1cd64470..dce6632daae1 100644
--- a/drivers/isdn/hardware/mISDN/avmfritz.c
+++ b/drivers/isdn/hardware/mISDN/avmfritz.c
@@ -1142,7 +1142,7 @@ fritz_remove_pci(struct pci_dev *pdev)
                        pr_info("%s: drvdata already removed\n", __func__);
 }
-static struct pci_device_id fcpci_ids[] = {
+static const struct pci_device_id fcpci_ids[] = {
        { PCI_VENDOR_ID_AVM, PCI_DEVICE_ID_AVM_A1, PCI_ANY_ID, PCI_ANY_ID,
          0, 0, (unsigned long) "Fritz!Card PCI"},
        { PCI_VENDOR_ID_AVM, PCI_DEVICE_ID_AVM_A1_V2, PCI_ANY_ID, PCI_ANY_ID,
diff --git a/drivers/isdn/hardware/mISDN/hfcmulti.c b/drivers/isdn/hardware/mISDN/hfcmulti.c
index aea0c9616ea5..3cf07b8ced1c 100644
--- a/drivers/isdn/hardware/mISDN/hfcmulti.c
+++ b/drivers/isdn/hardware/mISDN/hfcmulti.c
@@ -5348,7 +5348,7 @@ static const struct hm_map hfcm_map[] = {
 #undef H
 #define H(x)    ((unsigned long)&hfcm_map[x])
-static struct pci_device_id hfmultipci_ids[] = {
+static const struct pci_device_id hfmultipci_ids[] = {
        /* Cards with HFC-4S Chip */
        { PCI_VENDOR_ID_CCD, PCI_DEVICE_ID_CCD_HFC4S, PCI_VENDOR_ID_CCD,
diff --git a/drivers/isdn/hardware/mISDN/hfcpci.c b/drivers/isdn/hardware/mISDN/hfcpci.c
index 5dc246d71c16..d2e401a8090e 100644
--- a/drivers/isdn/hardware/mISDN/hfcpci.c
+++ b/drivers/isdn/hardware/mISDN/hfcpci.c
@@ -2161,7 +2161,7 @@ static const struct _hfc_map hfc_map[] =
        {},
 };
-static struct pci_device_id hfc_ids[] =
+static const struct pci_device_id hfc_ids[] =
 {
        { PCI_VDEVICE(CCD, PCI_DEVICE_ID_CCD_2BD0),
          (unsigned long) &hfc_map[0] },
diff --git a/drivers/isdn/hardware/mISDN/netjet.c b/drivers/isdn/hardware/mISDN/netjet.c
index afde4edef9ae..6a6d848bd18e 100644
--- a/drivers/isdn/hardware/mISDN/netjet.c
+++ b/drivers/isdn/hardware/mISDN/netjet.c
@@ -1137,7 +1137,7 @@ static void nj_remove(struct pci_dev *pdev)
 /* We cannot select cards with PCI_SUB... IDs, since here are cards with
 * SUB IDs set to PCI_ANY_ID, so we need to match all and reject
 * known other cards which not work with this driver - see probe function */
-static struct pci_device_id nj_pci_ids[] = {
+static const struct pci_device_id nj_pci_ids[] = {
        { PCI_VENDOR_ID_TIGERJET, PCI_DEVICE_ID_TIGERJET_300,
          PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
        { }
diff --git a/drivers/isdn/hardware/mISDN/w6692.c b/drivers/isdn/hardware/mISDN/w6692.c
index 3052c836b89f..d80072fef434 100644
--- a/drivers/isdn/hardware/mISDN/w6692.c
+++ b/drivers/isdn/hardware/mISDN/w6692.c
@@ -1398,7 +1398,7 @@ w6692_remove_pci(struct pci_dev *pdev)
                        pr_notice("%s: drvdata already removed\n", __func__);
 }
-static struct pci_device_id w6692_ids[] = {
+static const struct pci_device_id w6692_ids[] = {
        { PCI_VENDOR_ID_DYNALINK, PCI_DEVICE_ID_DYNALINK_IS64PH,
          PCI_ANY_ID, PCI_ANY_ID, 0, 0, (ulong)&w6692_map[0]},
        { PCI_VENDOR_ID_WINBOND2, PCI_DEVICE_ID_WINBOND2_6692,
diff --git a/drivers/isdn/hisax/config.c b/drivers/isdn/hisax/config.c
index c7d68675b028..7108bdb8742e 100644
--- a/drivers/isdn/hisax/config.c
+++ b/drivers/isdn/hisax/config.c
@@ -1909,7 +1909,7 @@ static void EChannel_proc_rcv(struct hisax_d_if *d_if)
 #ifdef CONFIG_PCI
 #include <linux/pci.h>
-static struct pci_device_id hisax_pci_tbl[] __used = {
+static const struct pci_device_id hisax_pci_tbl[] __used = {
 #ifdef CONFIG_HISAX_FRITZPCI
        {PCI_VDEVICE(AVM,      PCI_DEVICE_ID_AVM_A1)                    },
 #endif
diff --git a/drivers/isdn/hisax/hfc4s8s_l1.c b/drivers/isdn/hisax/hfc4s8s_l1.c
index 90f051ce0259..9090cc1e1f29 100644
--- a/drivers/isdn/hisax/hfc4s8s_l1.c
+++ b/drivers/isdn/hisax/hfc4s8s_l1.c
@@ -86,7 +86,7 @@ typedef struct {
        char *device_name;
 } hfc4s8s_param;
-static struct pci_device_id hfc4s8s_ids[] = {
+static const struct pci_device_id hfc4s8s_ids[] = {
        {.vendor = PCI_VENDOR_ID_CCD,
         .device = PCI_DEVICE_ID_4S,
         .subvendor = 0x1397,
diff --git a/drivers/isdn/hisax/hisax_fcpcipnp.c b/drivers/isdn/hisax/hisax_fcpcipnp.c
index 5a9f39ed1d5d..e4f7573ba9bf 100644
--- a/drivers/isdn/hisax/hisax_fcpcipnp.c
+++ b/drivers/isdn/hisax/hisax_fcpcipnp.c
@@ -52,7 +52,7 @@ module_param(debug, int, 0);
 MODULE_AUTHOR("Kai Germaschewski <kai.germaschewski@gmx.de>/Karsten Keil <kkeil@suse.de>");
 MODULE_DESCRIPTION("AVM Fritz!PCI/PnP ISDN driver");
-static struct pci_device_id fcpci_ids[] = {
+static const struct pci_device_id fcpci_ids[] = {
        { .vendor      = PCI_VENDOR_ID_AVM,
          .device      = PCI_DEVICE_ID_AVM_A1,
          .subvendor   = PCI_ANY_ID,
diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
index f4eace5ea184..40f3cd7eab0f 100644
--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -156,7 +156,8 @@ static int read_sb_page(struct mddev *mddev, loff_t offset,
        rdev_for_each(rdev, mddev) {
                if (! test_bit(In_sync, &rdev->flags)
-                    || test_bit(Faulty, &rdev->flags))
+                    || test_bit(Faulty, &rdev->flags)
+                    || test_bit(Bitmap_sync, &rdev->flags))
                        continue;
                target = offset + index * (PAGE_SIZE/512);
diff --git a/drivers/md/md.h b/drivers/md/md.h
index 991f0fe2dcc6..b50eb4ac1b82 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -134,7 +134,9 @@ enum flag_bits {
        Faulty,                 /* device is known to have a fault */
        In_sync,                /* device is in_sync with rest of array */
        Bitmap_sync,            /* ..actually, not quite In_sync.  Need a
-                                 * bitmap-based recovery to get fully in sync
+                                 * bitmap-based recovery to get fully in sync.
+                                 * The bit is only meaningful before device
+                                 * has been passed to pers->hot_add_disk.
                                 */
        WriteMostly,            /* Avoid reading if at all possible */
        AutoDetected,           /* added by auto-detect */
diff --git a/drivers/md/raid5-ppl.c b/drivers/md/raid5-ppl.c
index 77cce3573aa8..44ad5baf3206 100644
--- a/drivers/md/raid5-ppl.c
+++ b/drivers/md/raid5-ppl.c
@@ -1150,7 +1150,7 @@ int ppl_init_log(struct r5conf *conf)
                goto err;
        }
-        ppl_conf->bs = bioset_create(conf->raid_disks, 0, 0);
+        ppl_conf->bs = bioset_create(conf->raid_disks, 0, BIOSET_NEED_BVECS);
        if (!ppl_conf->bs) {
                ret = -ENOMEM;
                goto err;
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 2ceb338b094b..aeeb8d6854e2 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -7951,12 +7951,10 @@ static void end_reshape(struct r5conf *conf)
 {
        if (!test_bit(MD_RECOVERY_INTR, &conf->mddev->recovery)) {
-                struct md_rdev *rdev;
                spin_lock_irq(&conf->device_lock);
                conf->previous_raid_disks = conf->raid_disks;
-                rdev_for_each(rdev, conf->mddev)
+                md_finish_reshape(conf->mddev);
-                        rdev->data_offset = rdev->new_data_offset;
                smp_wmb();
                conf->reshape_progress = MaxSector;
                conf->mddev->reshape_position = MaxSector;
diff --git a/drivers/mux/Kconfig b/drivers/mux/Kconfig
index 7c754a0f14bb..19e4e904c9bf 100644
--- a/drivers/mux/Kconfig
+++ b/drivers/mux/Kconfig
@@ -2,20 +2,11 @@
 # Multiplexer devices
 #
-menuconfig MULTIPLEXER
+config MULTIPLEXER
-        tristate "Multiplexer subsystem"
+        tristate
-        help
-          Multiplexer controller subsystem. Multiplexers are used in a
-          variety of settings, and this subsystem abstracts their use
-          so that the rest of the kernel sees a common interface. When
-          multiple parallel multiplexers are controlled by one single
-          multiplexer controller, this subsystem also coordinates the
-          multiplexer accesses.
-          To compile the subsystem as a module, choose M here: the module will
-          be called mux-core.
-if MULTIPLEXER
+menu "Multiplexer drivers"
+        depends on MULTIPLEXER
 config MUX_ADG792A
        tristate "Analog Devices ADG792A/ADG792G Multiplexers"
@@ -56,4 +47,4 @@ config MUX_MMIO
          To compile the driver as a module, choose M here: the module will
          be called mux-mmio.
-endif
+endmenu
diff --git a/drivers/mux/mux-core.c b/drivers/mux/mux-core.c
index 90b8995f07cb..2fe96c470112 100644
--- a/drivers/mux/mux-core.c
+++ b/drivers/mux/mux-core.c
@@ -46,7 +46,7 @@ static int __init mux_init(void)
 static void __exit mux_exit(void)
 {
-        class_register(&mux_class);
+        class_unregister(&mux_class);
        ida_destroy(&mux_ida);
 }
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 14ff622190a5..181839d6fbea 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -4596,7 +4596,7 @@ static int bond_check_params(struct bond_params *params)
        }
        ad_user_port_key = valptr->value;
-        if (bond_mode == BOND_MODE_TLB) {
+        if ((bond_mode == BOND_MODE_TLB) || (bond_mode == BOND_MODE_ALB)) {
                bond_opt_initstr(&newval, "default");
                valptr = bond_opt_parse(bond_opt_get(BOND_OPT_TLB_DYNAMIC_LB),
                                        &newval);
diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
index e68d368e20ac..7f36d3e3c98b 100644
--- a/drivers/net/dsa/b53/b53_common.c
+++ b/drivers/net/dsa/b53/b53_common.c
@@ -1665,6 +1665,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
                .dev_name = "BCM53125",
                .vlans = 4096,
                .enabled_ports = 0xff,
+                .arl_entries = 4,
                .cpu_port = B53_CPU_PORT,
                .vta_regs = B53_VTA_REGS,
                .duplex_reg = B53_DUPLEX_STAT_GE,
diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
index 53b088166c28..5bcdd33101b0 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
+++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -3178,6 +3178,7 @@ static const struct mv88e6xxx_ops mv88e6390x_ops = {
        .port_set_jumbo_size = mv88e6165_port_set_jumbo_size,
        .port_egress_rate_limiting = mv88e6097_port_egress_rate_limiting,
        .port_pause_limit = mv88e6390_port_pause_limit,
+        .port_set_cmode = mv88e6390x_port_set_cmode,
        .port_disable_learn_limit = mv88e6xxx_port_disable_learn_limit,
        .port_disable_pri_override = mv88e6xxx_port_disable_pri_override,
        .stats_snapshot = mv88e6390_g1_stats_snapshot,
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
index d3906f6b01bd..86058a9f3417 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
@@ -1785,16 +1785,18 @@ static int xgene_enet_get_resources(struct xgene_enet_pdata *pdata)
        xgene_enet_gpiod_get(pdata);
-        pdata->clk = devm_clk_get(&pdev->dev, NULL);
+        if (pdata->phy_mode != PHY_INTERFACE_MODE_SGMII) {
-        if (IS_ERR(pdata->clk)) {
+                pdata->clk = devm_clk_get(&pdev->dev, NULL);
-                /* Abort if the clock is defined but couldn't be retrived.
+                if (IS_ERR(pdata->clk)) {
-                 * Always abort if the clock is missing on DT system as
+                        /* Abort if the clock is defined but couldn't be
-                 * the driver can't cope with this case.
+                         * retrived. Always abort if the clock is missing on
-                 */
+                         * DT system as the driver can't cope with this case.
-                if (PTR_ERR(pdata->clk) != -ENOENT || dev->of_node)
+                         */
-                        return PTR_ERR(pdata->clk);
+                        if (PTR_ERR(pdata->clk) != -ENOENT || dev->of_node)
-                /* Firmware may have set up the clock already. */
+                                return PTR_ERR(pdata->clk);
-                dev_info(dev, "clocks have been setup already\n");
+                        /* Firmware may have set up the clock already. */
+                        dev_info(dev, "clocks have been setup already\n");
+                }
        }
        if (pdata->phy_mode != PHY_INTERFACE_MODE_XGMII)
diff --git a/drivers/net/ethernet/broadcom/bgmac-platform.c b/drivers/net/ethernet/broadcom/bgmac-platform.c
index 73aca97a96bc..d937083db9a4 100644
--- a/drivers/net/ethernet/broadcom/bgmac-platform.c
+++ b/drivers/net/ethernet/broadcom/bgmac-platform.c
@@ -50,11 +50,14 @@ static u32 platform_bgmac_idm_read(struct bgmac *bgmac, u16 offset)
 static void platform_bgmac_idm_write(struct bgmac *bgmac, u16 offset, u32 value)
 {
-        return writel(value, bgmac->plat.idm_base + offset);
+        writel(value, bgmac->plat.idm_base + offset);
 }
 static bool platform_bgmac_clk_enabled(struct bgmac *bgmac)
 {
+        if (!bgmac->plat.idm_base)
+                return true;
        if ((bgmac_idm_read(bgmac, BCMA_IOCTL) & BGMAC_CLK_EN) != BGMAC_CLK_EN)
                return false;
        if (bgmac_idm_read(bgmac, BCMA_RESET_CTL) & BCMA_RESET_CTL_RESET)
@@ -66,6 +69,9 @@ static void platform_bgmac_clk_enable(struct bgmac *bgmac, u32 flags)
 {
        u32 val;
+        if (!bgmac->plat.idm_base)
+                return;
        /* The Reset Control register only contains a single bit to show if the
         * controller is currently in reset.  Do a sanity check here, just in
         * case the bootloader happened to leave the device in reset.
@@ -180,6 +186,7 @@ static int bgmac_probe(struct platform_device *pdev)
        bgmac->feature_flags |= BGMAC_FEAT_CMDCFG_SR_REV4;
        bgmac->feature_flags |= BGMAC_FEAT_TX_MASK_SETUP;
        bgmac->feature_flags |= BGMAC_FEAT_RX_MASK_SETUP;
+        bgmac->feature_flags |= BGMAC_FEAT_IDM_MASK;
        bgmac->dev = &pdev->dev;
        bgmac->dma_dev = &pdev->dev;
@@ -207,15 +214,13 @@ static int bgmac_probe(struct platform_device *pdev)
                return PTR_ERR(bgmac->plat.base);
        regs = platform_get_resource_byname(pdev, IORESOURCE_MEM, "idm_base");
-        if (!regs) {
+        if (regs) {
-                dev_err(&pdev->dev, "Unable to obtain idm resource\n");
+                bgmac->plat.idm_base = devm_ioremap_resource(&pdev->dev, regs);
-                return -EINVAL;
+                if (IS_ERR(bgmac->plat.idm_base))
+                        return PTR_ERR(bgmac->plat.idm_base);
+                bgmac->feature_flags &= ~BGMAC_FEAT_IDM_MASK;
        }
-        bgmac->plat.idm_base = devm_ioremap_resource(&pdev->dev, regs);
-        if (IS_ERR(bgmac->plat.idm_base))
-                return PTR_ERR(bgmac->plat.idm_base);
        regs = platform_get_resource_byname(pdev, IORESOURCE_MEM, "nicpm_base");
        if (regs) {
                bgmac->plat.nicpm_base = devm_ioremap_resource(&pdev->dev,
diff --git a/drivers/net/ethernet/broadcom/bgmac.c b/drivers/net/ethernet/broadcom/bgmac.c
index ba4d2e145bb9..48d672b204a4 100644
--- a/drivers/net/ethernet/broadcom/bgmac.c
+++ b/drivers/net/ethernet/broadcom/bgmac.c
@@ -622,9 +622,11 @@ static int bgmac_dma_alloc(struct bgmac *bgmac)
        BUILD_BUG_ON(BGMAC_MAX_TX_RINGS > ARRAY_SIZE(ring_base));
        BUILD_BUG_ON(BGMAC_MAX_RX_RINGS > ARRAY_SIZE(ring_base));
-        if (!(bgmac_idm_read(bgmac, BCMA_IOST) & BCMA_IOST_DMA64)) {
+        if (!(bgmac->feature_flags & BGMAC_FEAT_IDM_MASK)) {
-                dev_err(bgmac->dev, "Core does not report 64-bit DMA\n");
+                if (!(bgmac_idm_read(bgmac, BCMA_IOST) & BCMA_IOST_DMA64)) {
-                return -ENOTSUPP;
+                        dev_err(bgmac->dev, "Core does not report 64-bit DMA\n");
+                        return -ENOTSUPP;
+                }
        }
        for (i = 0; i < BGMAC_MAX_TX_RINGS; i++) {
@@ -855,9 +857,11 @@ static void bgmac_mac_speed(struct bgmac *bgmac)
 static void bgmac_miiconfig(struct bgmac *bgmac)
 {
        if (bgmac->feature_flags & BGMAC_FEAT_FORCE_SPEED_2500) {
-                bgmac_idm_write(bgmac, BCMA_IOCTL,
+                if (!(bgmac->feature_flags & BGMAC_FEAT_IDM_MASK)) {
-                                bgmac_idm_read(bgmac, BCMA_IOCTL) | 0x40 |
+                        bgmac_idm_write(bgmac, BCMA_IOCTL,
-                                BGMAC_BCMA_IOCTL_SW_CLKEN);
+                                        bgmac_idm_read(bgmac, BCMA_IOCTL) |
+                                        0x40 | BGMAC_BCMA_IOCTL_SW_CLKEN);
+                }
                bgmac->mac_speed = SPEED_2500;
                bgmac->mac_duplex = DUPLEX_FULL;
                bgmac_mac_speed(bgmac);
@@ -874,11 +878,36 @@ static void bgmac_miiconfig(struct bgmac *bgmac)
        }
 }
+static void bgmac_chip_reset_idm_config(struct bgmac *bgmac)
+{
+        u32 iost;
+        iost = bgmac_idm_read(bgmac, BCMA_IOST);
+        if (bgmac->feature_flags & BGMAC_FEAT_IOST_ATTACHED)
+                iost &= ~BGMAC_BCMA_IOST_ATTACHED;
+        /* 3GMAC: for BCM4707 & BCM47094, only do core reset at bgmac_probe() */
+        if (!(bgmac->feature_flags & BGMAC_FEAT_NO_RESET)) {
+                u32 flags = 0;
+                if (iost & BGMAC_BCMA_IOST_ATTACHED) {
+                        flags = BGMAC_BCMA_IOCTL_SW_CLKEN;
+                        if (!bgmac->has_robosw)
+                                flags |= BGMAC_BCMA_IOCTL_SW_RESET;
+                }
+                bgmac_clk_enable(bgmac, flags);
+        }
+        if (iost & BGMAC_BCMA_IOST_ATTACHED && !bgmac->has_robosw)
+                bgmac_idm_write(bgmac, BCMA_IOCTL,
+                                bgmac_idm_read(bgmac, BCMA_IOCTL) &
+                                ~BGMAC_BCMA_IOCTL_SW_RESET);
+}
 /* http://bcm-v4.sipsolutions.net/mac-gbit/gmac/chipreset */
 static void bgmac_chip_reset(struct bgmac *bgmac)
 {
        u32 cmdcfg_sr;
-        u32 iost;
        int i;
        if (bgmac_clk_enabled(bgmac)) {
@@ -899,20 +928,8 @@ static void bgmac_chip_reset(struct bgmac *bgmac)
                /* TODO: Clear software multicast filter list */
        }
-        iost = bgmac_idm_read(bgmac, BCMA_IOST);
+        if (!(bgmac->feature_flags & BGMAC_FEAT_IDM_MASK))
-        if (bgmac->feature_flags & BGMAC_FEAT_IOST_ATTACHED)
+                bgmac_chip_reset_idm_config(bgmac);
-                iost &= ~BGMAC_BCMA_IOST_ATTACHED;
-        /* 3GMAC: for BCM4707 & BCM47094, only do core reset at bgmac_probe() */
-        if (!(bgmac->feature_flags & BGMAC_FEAT_NO_RESET)) {
-                u32 flags = 0;
-                if (iost & BGMAC_BCMA_IOST_ATTACHED) {
-                        flags = BGMAC_BCMA_IOCTL_SW_CLKEN;
-                        if (!bgmac->has_robosw)
-                                flags |= BGMAC_BCMA_IOCTL_SW_RESET;
-                }
-                bgmac_clk_enable(bgmac, flags);
-        }
        /* Request Misc PLL for corerev > 2 */
        if (bgmac->feature_flags & BGMAC_FEAT_MISC_PLL_REQ) {
@@ -970,11 +987,6 @@ static void bgmac_chip_reset(struct bgmac *bgmac)
                                      BGMAC_CHIPCTL_7_IF_TYPE_RGMII);
        }
-        if (iost & BGMAC_BCMA_IOST_ATTACHED && !bgmac->has_robosw)
-                bgmac_idm_write(bgmac, BCMA_IOCTL,
-                                bgmac_idm_read(bgmac, BCMA_IOCTL) &
-                                ~BGMAC_BCMA_IOCTL_SW_RESET);
        /* http://bcm-v4.sipsolutions.net/mac-gbit/gmac/gmac_reset
         * Specs don't say about using BGMAC_CMDCFG_SR, but in this routine
         * BGMAC_CMDCFG is read _after_ putting chip in a reset. So it has to
@@ -1497,8 +1509,10 @@ int bgmac_enet_probe(struct bgmac *bgmac)
        bgmac_clk_enable(bgmac, 0);
        /* This seems to be fixing IRQ by assigning OOB #6 to the core */
-        if (bgmac->feature_flags & BGMAC_FEAT_IRQ_ID_OOB_6)
+        if (!(bgmac->feature_flags & BGMAC_FEAT_IDM_MASK)) {
-                bgmac_idm_write(bgmac, BCMA_OOB_SEL_OUT_A30, 0x86);
+                if (bgmac->feature_flags & BGMAC_FEAT_IRQ_ID_OOB_6)
+                        bgmac_idm_write(bgmac, BCMA_OOB_SEL_OUT_A30, 0x86);
+        }
        bgmac_chip_reset(bgmac);
diff --git a/drivers/net/ethernet/broadcom/bgmac.h b/drivers/net/ethernet/broadcom/bgmac.h
index c1818766c501..443d57b10264 100644
--- a/drivers/net/ethernet/broadcom/bgmac.h
+++ b/drivers/net/ethernet/broadcom/bgmac.h
@@ -425,6 +425,7 @@
 #define BGMAC_FEAT_CC4_IF_SW_TYPE       BIT(17)
 #define BGMAC_FEAT_CC4_IF_SW_TYPE_RGMII BIT(18)
 #define BGMAC_FEAT_CC7_IF_TYPE_RGMII    BIT(19)
+#define BGMAC_FEAT_IDM_MASK             BIT(20)
 struct bgmac_slot_info {
        union {
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
index 43423744fdfa..1e33abde4a3e 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
@@ -2886,7 +2886,7 @@ static int bnx2x_test_nvram_tbl(struct bnx2x *bp,
 static int bnx2x_test_nvram(struct bnx2x *bp)
 {
-        const struct crc_pair nvram_tbl[] = {
+        static const struct crc_pair nvram_tbl[] = {
                {     0,  0x14 }, /* bootstrap */
                {  0x14,  0xec }, /* dir */
                { 0x100, 0x350 }, /* manuf_info */
@@ -2895,7 +2895,7 @@ static int bnx2x_test_nvram(struct bnx2x *bp)
                { 0x708,  0x70 }, /* manuf_key_info */
                {     0,     0 }
        };
-        const struct crc_pair nvram_tbl2[] = {
+        static const struct crc_pair nvram_tbl2[] = {
                { 0x7e8, 0x350 }, /* manuf_info2 */
                { 0xb38,  0xf0 }, /* feature_info */
                {     0,     0 }
@@ -3162,7 +3162,8 @@ static void bnx2x_get_strings(struct net_device *dev, u32 stringset, u8 *buf)
                if (is_multi(bp)) {
                        for_each_eth_queue(bp, i) {
                                memset(queue_name, 0, sizeof(queue_name));
-                                sprintf(queue_name, "%d", i);
+                                snprintf(queue_name, sizeof(queue_name),
+                                         "%d", i);
                                for (j = 0; j < BNX2X_NUM_Q_STATS; j++)
                                        snprintf(buf + (k + j)*ETH_GSTRING_LEN,
                                                ETH_GSTRING_LEN,
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
index daca1c9d254b..7b0b399aaedd 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -1202,12 +1202,21 @@ static struct enet_cb *bcmgenet_get_txcb(struct bcmgenet_priv *priv,
        return tx_cb_ptr;
 }
-/* Simple helper to free a control block's resources */
+static struct enet_cb *bcmgenet_put_txcb(struct bcmgenet_priv *priv,
-static void bcmgenet_free_cb(struct enet_cb *cb)
+                                         struct bcmgenet_tx_ring *ring)
 {
-        dev_kfree_skb_any(cb->skb);
+        struct enet_cb *tx_cb_ptr;
-        cb->skb = NULL;
-        dma_unmap_addr_set(cb, dma_addr, 0);
+        tx_cb_ptr = ring->cbs;
+        tx_cb_ptr += ring->write_ptr - ring->cb_ptr;
+        /* Rewinding local write pointer */
+        if (ring->write_ptr == ring->cb_ptr)
+                ring->write_ptr = ring->end_ptr;
+        else
+                ring->write_ptr--;
+        return tx_cb_ptr;
 }
 static inline void bcmgenet_rx_ring16_int_disable(struct bcmgenet_rx_ring *ring)
@@ -1260,18 +1269,72 @@ static inline void bcmgenet_tx_ring_int_disable(struct bcmgenet_tx_ring *ring)
                                 INTRL2_CPU_MASK_SET);
 }
+/* Simple helper to free a transmit control block's resources
+ * Returns an skb when the last transmit control block associated with the
+ * skb is freed.  The skb should be freed by the caller if necessary.
+ */
+static struct sk_buff *bcmgenet_free_tx_cb(struct device *dev,
+                                           struct enet_cb *cb)
+{
+        struct sk_buff *skb;
+        skb = cb->skb;
+        if (skb) {
+                cb->skb = NULL;
+                if (cb == GENET_CB(skb)->first_cb)
+                        dma_unmap_single(dev, dma_unmap_addr(cb, dma_addr),
+                                         dma_unmap_len(cb, dma_len),
+                                         DMA_TO_DEVICE);
+                else
+                        dma_unmap_page(dev, dma_unmap_addr(cb, dma_addr),
+                                       dma_unmap_len(cb, dma_len),
+                                       DMA_TO_DEVICE);
+                dma_unmap_addr_set(cb, dma_addr, 0);
+                if (cb == GENET_CB(skb)->last_cb)
+                        return skb;
+        } else if (dma_unmap_addr(cb, dma_addr)) {
+                dma_unmap_page(dev,
+                               dma_unmap_addr(cb, dma_addr),
+                               dma_unmap_len(cb, dma_len),
+                               DMA_TO_DEVICE);
+                dma_unmap_addr_set(cb, dma_addr, 0);
+        }
+        return 0;
+}
+/* Simple helper to free a receive control block's resources */
+static struct sk_buff *bcmgenet_free_rx_cb(struct device *dev,
+                                           struct enet_cb *cb)
+{
+        struct sk_buff *skb;
+        skb = cb->skb;
+        cb->skb = NULL;
+        if (dma_unmap_addr(cb, dma_addr)) {
+                dma_unmap_single(dev, dma_unmap_addr(cb, dma_addr),
+                                 dma_unmap_len(cb, dma_len), DMA_FROM_DEVICE);
+                dma_unmap_addr_set(cb, dma_addr, 0);
+        }
+        return skb;
+}
 /* Unlocked version of the reclaim routine */
 static unsigned int __bcmgenet_tx_reclaim(struct net_device *dev,
                                          struct bcmgenet_tx_ring *ring)
 {
        struct bcmgenet_priv *priv = netdev_priv(dev);
-        struct device *kdev = &priv->pdev->dev;
+        unsigned int txbds_processed = 0;
-        struct enet_cb *tx_cb_ptr;
-        unsigned int pkts_compl = 0;
        unsigned int bytes_compl = 0;
-        unsigned int c_index;
+        unsigned int pkts_compl = 0;
        unsigned int txbds_ready;
-        unsigned int txbds_processed = 0;
+        unsigned int c_index;
+        struct sk_buff *skb;
        /* Clear status before servicing to reduce spurious interrupts */
        if (ring->index == DESC_INDEX)
@@ -1292,21 +1355,12 @@ static unsigned int __bcmgenet_tx_reclaim(struct net_device *dev,
        /* Reclaim transmitted buffers */
        while (txbds_processed < txbds_ready) {
-                tx_cb_ptr = &priv->tx_cbs[ring->clean_ptr];
+                skb = bcmgenet_free_tx_cb(&priv->pdev->dev,
-                if (tx_cb_ptr->skb) {
+                                          &priv->tx_cbs[ring->clean_ptr]);
+                if (skb) {
                        pkts_compl++;
-                        bytes_compl += GENET_CB(tx_cb_ptr->skb)->bytes_sent;
+                        bytes_compl += GENET_CB(skb)->bytes_sent;
-                        dma_unmap_single(kdev,
+                        dev_kfree_skb_any(skb);
-                                         dma_unmap_addr(tx_cb_ptr, dma_addr),
-                                         dma_unmap_len(tx_cb_ptr, dma_len),
-                                         DMA_TO_DEVICE);
-                        bcmgenet_free_cb(tx_cb_ptr);
-                } else if (dma_unmap_addr(tx_cb_ptr, dma_addr)) {
-                        dma_unmap_page(kdev,
-                                       dma_unmap_addr(tx_cb_ptr, dma_addr),
-                                       dma_unmap_len(tx_cb_ptr, dma_len),
-                                       DMA_TO_DEVICE);
-                        dma_unmap_addr_set(tx_cb_ptr, dma_addr, 0);
                }
                txbds_processed++;
@@ -1380,95 +1434,6 @@ static void bcmgenet_tx_reclaim_all(struct net_device *dev)
        bcmgenet_tx_reclaim(dev, &priv->tx_rings[DESC_INDEX]);
 }
-/* Transmits a single SKB (either head of a fragment or a single SKB)
- * caller must hold priv->lock
- */
-static int bcmgenet_xmit_single(struct net_device *dev,
-                                struct sk_buff *skb,
-                                u16 dma_desc_flags,
-                                struct bcmgenet_tx_ring *ring)
-{
-        struct bcmgenet_priv *priv = netdev_priv(dev);
-        struct device *kdev = &priv->pdev->dev;
-        struct enet_cb *tx_cb_ptr;
-        unsigned int skb_len;
-        dma_addr_t mapping;
-        u32 length_status;
-        int ret;
-        tx_cb_ptr = bcmgenet_get_txcb(priv, ring);
-        if (unlikely(!tx_cb_ptr))
-                BUG();
-        tx_cb_ptr->skb = skb;
-        skb_len = skb_headlen(skb);
-        mapping = dma_map_single(kdev, skb->data, skb_len, DMA_TO_DEVICE);
-        ret = dma_mapping_error(kdev, mapping);
-        if (ret) {
-                priv->mib.tx_dma_failed++;
-                netif_err(priv, tx_err, dev, "Tx DMA map failed\n");
-                dev_kfree_skb(skb);
-                return ret;
-        }
-        dma_unmap_addr_set(tx_cb_ptr, dma_addr, mapping);
-        dma_unmap_len_set(tx_cb_ptr, dma_len, skb_len);
-        length_status = (skb_len << DMA_BUFLENGTH_SHIFT) | dma_desc_flags |
-                        (priv->hw_params->qtag_mask << DMA_TX_QTAG_SHIFT) |
-                        DMA_TX_APPEND_CRC;
-        if (skb->ip_summed == CHECKSUM_PARTIAL)
-                length_status |= DMA_TX_DO_CSUM;
-        dmadesc_set(priv, tx_cb_ptr->bd_addr, mapping, length_status);
-        return 0;
-}
-/* Transmit a SKB fragment */
-static int bcmgenet_xmit_frag(struct net_device *dev,
-                              skb_frag_t *frag,
-                              u16 dma_desc_flags,
-                              struct bcmgenet_tx_ring *ring)
-{
-        struct bcmgenet_priv *priv = netdev_priv(dev);
-        struct device *kdev = &priv->pdev->dev;
-        struct enet_cb *tx_cb_ptr;
-        unsigned int frag_size;
-        dma_addr_t mapping;
-        int ret;
-        tx_cb_ptr = bcmgenet_get_txcb(priv, ring);
-        if (unlikely(!tx_cb_ptr))
-                BUG();
-        tx_cb_ptr->skb = NULL;
-        frag_size = skb_frag_size(frag);
-        mapping = skb_frag_dma_map(kdev, frag, 0, frag_size, DMA_TO_DEVICE);
-        ret = dma_mapping_error(kdev, mapping);
-        if (ret) {
-                priv->mib.tx_dma_failed++;
-                netif_err(priv, tx_err, dev, "%s: Tx DMA map failed\n",
-                          __func__);
-                return ret;
-        }
-        dma_unmap_addr_set(tx_cb_ptr, dma_addr, mapping);
-        dma_unmap_len_set(tx_cb_ptr, dma_len, frag_size);
-        dmadesc_set(priv, tx_cb_ptr->bd_addr, mapping,
-                    (frag_size << DMA_BUFLENGTH_SHIFT) | dma_desc_flags |
-                    (priv->hw_params->qtag_mask << DMA_TX_QTAG_SHIFT));
-        return 0;
-}
 /* Reallocate the SKB to put enough headroom in front of it and insert
 * the transmit checksum offsets in the descriptors
 */
@@ -1535,11 +1500,16 @@ static struct sk_buff *bcmgenet_put_tx_csum(struct net_device *dev,
 static netdev_tx_t bcmgenet_xmit(struct sk_buff *skb, struct net_device *dev)
 {
        struct bcmgenet_priv *priv = netdev_priv(dev);
+        struct device *kdev = &priv->pdev->dev;
        struct bcmgenet_tx_ring *ring = NULL;
+        struct enet_cb *tx_cb_ptr;
        struct netdev_queue *txq;
        unsigned long flags = 0;
        int nr_frags, index;
-        u16 dma_desc_flags;
+        dma_addr_t mapping;
+        unsigned int size;
+        skb_frag_t *frag;
+        u32 len_stat;
        int ret;
        int i;
@@ -1592,29 +1562,53 @@ static netdev_tx_t bcmgenet_xmit(struct sk_buff *skb, struct net_device *dev)
                }
        }
-        dma_desc_flags = DMA_SOP;
+        for (i = 0; i <= nr_frags; i++) {
-        if (nr_frags == 0)
+                tx_cb_ptr = bcmgenet_get_txcb(priv, ring);
-                dma_desc_flags |= DMA_EOP;
-        /* Transmit single SKB or head of fragment list */
+                if (unlikely(!tx_cb_ptr))
-        ret = bcmgenet_xmit_single(dev, skb, dma_desc_flags, ring);
+                        BUG();
-        if (ret) {
-                ret = NETDEV_TX_OK;
+                if (!i) {
-                goto out;
+                        /* Transmit single SKB or head of fragment list */
-        }
+                        GENET_CB(skb)->first_cb = tx_cb_ptr;
+                        size = skb_headlen(skb);
+                        mapping = dma_map_single(kdev, skb->data, size,
+                                                 DMA_TO_DEVICE);
+                } else {
+                        /* xmit fragment */
+                        frag = &skb_shinfo(skb)->frags[i - 1];
+                        size = skb_frag_size(frag);
+                        mapping = skb_frag_dma_map(kdev, frag, 0, size,
+                                                   DMA_TO_DEVICE);
+                }
-        /* xmit fragment */
+                ret = dma_mapping_error(kdev, mapping);
-        for (i = 0; i < nr_frags; i++) {
-                ret = bcmgenet_xmit_frag(dev,
-                                         &skb_shinfo(skb)->frags[i],
-                                         (i == nr_frags - 1) ? DMA_EOP : 0,
-                                         ring);
                if (ret) {
+                        priv->mib.tx_dma_failed++;
+                        netif_err(priv, tx_err, dev, "Tx DMA map failed\n");
                        ret = NETDEV_TX_OK;
-                        goto out;
+                        goto out_unmap_frags;
+                }
+                dma_unmap_addr_set(tx_cb_ptr, dma_addr, mapping);
+                dma_unmap_len_set(tx_cb_ptr, dma_len, size);
+                tx_cb_ptr->skb = skb;
+                len_stat = (size << DMA_BUFLENGTH_SHIFT) |
+                           (priv->hw_params->qtag_mask << DMA_TX_QTAG_SHIFT);
+                if (!i) {
+                        len_stat |= DMA_TX_APPEND_CRC | DMA_SOP;
+                        if (skb->ip_summed == CHECKSUM_PARTIAL)
+                                len_stat |= DMA_TX_DO_CSUM;
                }
+                if (i == nr_frags)
+                        len_stat |= DMA_EOP;
+                dmadesc_set(priv, tx_cb_ptr->bd_addr, mapping, len_stat);
        }
+        GENET_CB(skb)->last_cb = tx_cb_ptr;
        skb_tx_timestamp(skb);
        /* Decrement total BD count and advance our write pointer */
@@ -1635,6 +1629,19 @@ out:
        spin_unlock_irqrestore(&ring->lock, flags);
        return ret;
+out_unmap_frags:
+        /* Back up for failed control block mapping */
+        bcmgenet_put_txcb(priv, ring);
+        /* Unmap successfully mapped control blocks */
+        while (i-- > 0) {
+                tx_cb_ptr = bcmgenet_put_txcb(priv, ring);
+                bcmgenet_free_tx_cb(kdev, tx_cb_ptr);
+        }
+        dev_kfree_skb(skb);
+        goto out;
 }
 static struct sk_buff *bcmgenet_rx_refill(struct bcmgenet_priv *priv,
@@ -1666,14 +1673,12 @@ static struct sk_buff *bcmgenet_rx_refill(struct bcmgenet_priv *priv,
        }
        /* Grab the current Rx skb from the ring and DMA-unmap it */
-        rx_skb = cb->skb;
+        rx_skb = bcmgenet_free_rx_cb(kdev, cb);
-        if (likely(rx_skb))
-                dma_unmap_single(kdev, dma_unmap_addr(cb, dma_addr),
-                                 priv->rx_buf_len, DMA_FROM_DEVICE);
        /* Put the new Rx skb on the ring */
        cb->skb = skb;
        dma_unmap_addr_set(cb, dma_addr, mapping);
+        dma_unmap_len_set(cb, dma_len, priv->rx_buf_len);
        dmadesc_set_addr(priv, cb->bd_addr, mapping);
        /* Return the current Rx skb to caller */
@@ -1880,22 +1885,16 @@ static int bcmgenet_alloc_rx_buffers(struct bcmgenet_priv *priv,
 static void bcmgenet_free_rx_buffers(struct bcmgenet_priv *priv)
 {
-        struct device *kdev = &priv->pdev->dev;
+        struct sk_buff *skb;
        struct enet_cb *cb;
        int i;
        for (i = 0; i < priv->num_rx_bds; i++) {
                cb = &priv->rx_cbs[i];
-                if (dma_unmap_addr(cb, dma_addr)) {
+                skb = bcmgenet_free_rx_cb(&priv->pdev->dev, cb);
-                        dma_unmap_single(kdev,
+                if (skb)
-                                         dma_unmap_addr(cb, dma_addr),
+                        dev_kfree_skb_any(skb);
-                                         priv->rx_buf_len, DMA_FROM_DEVICE);
-                        dma_unmap_addr_set(cb, dma_addr, 0);
-                }
-                if (cb->skb)
-                        bcmgenet_free_cb(cb);
        }
 }
@@ -2479,8 +2478,10 @@ static int bcmgenet_dma_teardown(struct bcmgenet_priv *priv)
 static void bcmgenet_fini_dma(struct bcmgenet_priv *priv)
 {
-        int i;
        struct netdev_queue *txq;
+        struct sk_buff *skb;
+        struct enet_cb *cb;
+        int i;
        bcmgenet_fini_rx_napi(priv);
        bcmgenet_fini_tx_napi(priv);
@@ -2489,10 +2490,10 @@ static void bcmgenet_fini_dma(struct bcmgenet_priv *priv)
        bcmgenet_dma_teardown(priv);
        for (i = 0; i < priv->num_tx_bds; i++) {
-                if (priv->tx_cbs[i].skb != NULL) {
+                cb = priv->tx_cbs + i;
-                        dev_kfree_skb(priv->tx_cbs[i].skb);
+                skb = bcmgenet_free_tx_cb(&priv->pdev->dev, cb);
-                        priv->tx_cbs[i].skb = NULL;
+                if (skb)
-                }
+                        dev_kfree_skb(skb);
        }
        for (i = 0; i < priv->hw_params->tx_queues; i++) {
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.h b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
index efd07020b89f..b9344de669f8 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.h
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
@@ -544,6 +544,8 @@ struct bcmgenet_hw_params {
 };
 struct bcmgenet_skb_cb {
+        struct enet_cb *first_cb;       /* First control block of SKB */
+        struct enet_cb *last_cb;        /* Last control block of SKB */
        unsigned int bytes_sent;        /* bytes on the wire (no TSB) */
 };
diff --git a/drivers/net/ethernet/cavium/liquidio/lio_ethtool.c b/drivers/net/ethernet/cavium/liquidio/lio_ethtool.c
index 28ecda3d3404..ebd353bc78ff 100644
--- a/drivers/net/ethernet/cavium/liquidio/lio_ethtool.c
+++ b/drivers/net/ethernet/cavium/liquidio/lio_ethtool.c
@@ -335,7 +335,7 @@ lio_ethtool_get_channels(struct net_device *dev,
 static int lio_get_eeprom_len(struct net_device *netdev)
 {
-        u8 buf[128];
+        u8 buf[192];
        struct lio *lio = GET_LIO(netdev);
        struct octeon_device *oct_dev = lio->oct_dev;
        struct octeon_board_info *board_info;
diff --git a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
index a0ca68ce3fbb..79112563a25a 100644
--- a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
+++ b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
@@ -1008,7 +1008,7 @@ static void bgx_print_qlm_mode(struct bgx *bgx, u8 lmacid)
 {
        struct device *dev = &bgx->pdev->dev;
        struct lmac *lmac;
-        char str[20];
+        char str[27];
        if (!bgx->is_dlm && lmacid)
                return;
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.c
index 50517cfd9671..9f9d6cae39d5 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.c
@@ -441,7 +441,8 @@ void cxgb4_ptp_init(struct adapter *adapter)
        adapter->ptp_clock = ptp_clock_register(&adapter->ptp_clock_info,
                                                &adapter->pdev->dev);
-        if (!adapter->ptp_clock) {
+        if (IS_ERR_OR_NULL(adapter->ptp_clock)) {
+                adapter->ptp_clock = NULL;
                dev_err(adapter->pdev_dev,
                        "PTP %s Clock registration has failed\n", __func__);
                return;
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_pci_id_tbl.h b/drivers/net/ethernet/chelsio/cxgb4/t4_pci_id_tbl.h
index 99987d8e437e..aa28299aef5f 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_pci_id_tbl.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_pci_id_tbl.h
@@ -174,6 +174,8 @@ CH_PCI_DEVICE_ID_TABLE_DEFINE_BEGIN
        CH_PCI_ID_TABLE_FENTRY(0x50a0), /* Custom T540-CR */
        CH_PCI_ID_TABLE_FENTRY(0x50a1), /* Custom T540-CR */
        CH_PCI_ID_TABLE_FENTRY(0x50a2), /* Custom T540-KR4 */
+        CH_PCI_ID_TABLE_FENTRY(0x50a3), /* Custom T580-KR4 */
+        CH_PCI_ID_TABLE_FENTRY(0x50a4), /* Custom 2x T540-CR */
        /* T6 adapters:
         */
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c b/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
index ff864a187d5a..a37166ee577b 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
@@ -776,8 +776,9 @@ void hns_ae_update_led_status(struct hnae_handle *handle)
        assert(handle);
        mac_cb = hns_get_mac_cb(handle);
-        if (!mac_cb->cpld_ctrl)
+        if (mac_cb->media_type != HNAE_MEDIA_TYPE_FIBER)
                return;
        hns_set_led_opt(mac_cb);
 }
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_misc.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_misc.c
index 7a8addda726e..408b63faf9a8 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_misc.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_misc.c
@@ -53,6 +53,34 @@ static u32 dsaf_read_sub(struct dsaf_device *dsaf_dev, u32 reg)
        return ret;
 }
+static void hns_dsaf_acpi_ledctrl_by_port(struct hns_mac_cb *mac_cb, u8 op_type,
+                                      u32 link, u32 port, u32 act)
+{
+       union acpi_object *obj;
+       union acpi_object obj_args[3], argv4;
+       obj_args[0].integer.type = ACPI_TYPE_INTEGER;
+       obj_args[0].integer.value = link;
+       obj_args[1].integer.type = ACPI_TYPE_INTEGER;
+       obj_args[1].integer.value = port;
+       obj_args[2].integer.type = ACPI_TYPE_INTEGER;
+       obj_args[2].integer.value = act;
+       argv4.type = ACPI_TYPE_PACKAGE;
+       argv4.package.count = 3;
+       argv4.package.elements = obj_args;
+       obj = acpi_evaluate_dsm(ACPI_HANDLE(mac_cb->dev),
+                               &hns_dsaf_acpi_dsm_guid, 0, op_type, &argv4);
+       if (!obj) {
+               dev_warn(mac_cb->dev, "ledctrl fail, link:%d port:%d act:%d!\n",
+                        link, port, act);
+               return;
+       }
+       ACPI_FREE(obj);
+}
 static void hns_cpld_set_led(struct hns_mac_cb *mac_cb, int link_status,
                             u16 speed, int data)
 {
@@ -93,6 +121,18 @@ static void hns_cpld_set_led(struct hns_mac_cb *mac_cb, int link_status,
        }
 }
+static void hns_cpld_set_led_acpi(struct hns_mac_cb *mac_cb, int link_status,
+                            u16 speed, int data)
+{
+       if (!mac_cb) {
+               pr_err("cpld_led_set mac_cb is null!\n");
+               return;
+       }
+       hns_dsaf_acpi_ledctrl_by_port(mac_cb, HNS_OP_LED_SET_FUNC,
+               link_status, mac_cb->mac_id, data);
+}
 static void cpld_led_reset(struct hns_mac_cb *mac_cb)
 {
        if (!mac_cb || !mac_cb->cpld_ctrl)
@@ -103,6 +143,20 @@ static void cpld_led_reset(struct hns_mac_cb *mac_cb)
        mac_cb->cpld_led_value = CPLD_LED_DEFAULT_VALUE;
 }
+static void cpld_led_reset_acpi(struct hns_mac_cb *mac_cb)
+{
+       if (!mac_cb) {
+               pr_err("cpld_led_reset mac_cb is null!\n");
+               return;
+       }
+       if (mac_cb->media_type != HNAE_MEDIA_TYPE_FIBER)
+                return;
+       hns_dsaf_acpi_ledctrl_by_port(mac_cb, HNS_OP_LED_SET_FUNC,
+               0, mac_cb->mac_id, 0);
+}
 static int cpld_set_led_id(struct hns_mac_cb *mac_cb,
                           enum hnae_led_state status)
 {
@@ -604,8 +658,8 @@ struct dsaf_misc_op *hns_misc_op_get(struct dsaf_device *dsaf_dev)
                misc_op->cfg_serdes_loopback = hns_mac_config_sds_loopback;
        } else if (is_acpi_node(dsaf_dev->dev->fwnode)) {
-                misc_op->cpld_set_led = hns_cpld_set_led;
+                misc_op->cpld_set_led = hns_cpld_set_led_acpi;
-                misc_op->cpld_reset_led = cpld_led_reset;
+                misc_op->cpld_reset_led = cpld_led_reset_acpi;
                misc_op->cpld_set_led_id = cpld_set_led_id;
                misc_op->dsaf_reset = hns_dsaf_rst_acpi;
diff --git a/drivers/net/ethernet/mellanox/mlx4/alloc.c b/drivers/net/ethernet/mellanox/mlx4/alloc.c
index 249a4584401a..b651c1210555 100644
--- a/drivers/net/ethernet/mellanox/mlx4/alloc.c
+++ b/drivers/net/ethernet/mellanox/mlx4/alloc.c
@@ -283,7 +283,7 @@ int mlx4_zone_add_one(struct mlx4_zone_allocator *zone_alloc,
 }
 /* Should be called under a lock */
-static int __mlx4_zone_remove_one_entry(struct mlx4_zone_entry *entry)
+static void __mlx4_zone_remove_one_entry(struct mlx4_zone_entry *entry)
 {
        struct mlx4_zone_allocator *zone_alloc = entry->allocator;
@@ -315,8 +315,6 @@ static int __mlx4_zone_remove_one_entry(struct mlx4_zone_entry *entry)
                }
                zone_alloc->mask = mask;
        }
-        return 0;
 }
 void mlx4_zone_allocator_destroy(struct mlx4_zone_allocator *zone_alloc)
@@ -457,7 +455,7 @@ struct mlx4_bitmap *mlx4_zone_get_bitmap(struct mlx4_zone_allocator *zones, u32
 int mlx4_zone_remove_one(struct mlx4_zone_allocator *zones, u32 uid)
 {
        struct mlx4_zone_entry *zone;
-        int res;
+        int res = 0;
        spin_lock(&zones->lock);
@@ -468,7 +466,7 @@ int mlx4_zone_remove_one(struct mlx4_zone_allocator *zones, u32 uid)
                goto out;
        }
-        res = __mlx4_zone_remove_one_entry(zone);
+        __mlx4_zone_remove_one_entry(zone);
 out:
        spin_unlock(&zones->lock);
@@ -578,7 +576,7 @@ out:
 }
 static int mlx4_buf_direct_alloc(struct mlx4_dev *dev, int size,
-                                 struct mlx4_buf *buf, gfp_t gfp)
+                                 struct mlx4_buf *buf)
 {
        dma_addr_t t;
@@ -587,7 +585,7 @@ static int mlx4_buf_direct_alloc(struct mlx4_dev *dev, int size,
        buf->page_shift   = get_order(size) + PAGE_SHIFT;
        buf->direct.buf   =
                dma_zalloc_coherent(&dev->persist->pdev->dev,
-                                    size, &t, gfp);
+                                    size, &t, GFP_KERNEL);
        if (!buf->direct.buf)
                return -ENOMEM;
@@ -607,10 +605,10 @@ static int mlx4_buf_direct_alloc(struct mlx4_dev *dev, int size,
 *  multiple pages, so we don't require too much contiguous memory.
 */
 int mlx4_buf_alloc(struct mlx4_dev *dev, int size, int max_direct,
-                   struct mlx4_buf *buf, gfp_t gfp)
+                   struct mlx4_buf *buf)
 {
        if (size <= max_direct) {
-                return mlx4_buf_direct_alloc(dev, size, buf, gfp);
+                return mlx4_buf_direct_alloc(dev, size, buf);
        } else {
                dma_addr_t t;
                int i;
@@ -620,14 +618,14 @@ int mlx4_buf_alloc(struct mlx4_dev *dev, int size, int max_direct,
                buf->npages     = buf->nbufs;
                buf->page_shift  = PAGE_SHIFT;
                buf->page_list   = kcalloc(buf->nbufs, sizeof(*buf->page_list),
-                                           gfp);
+                                           GFP_KERNEL);
                if (!buf->page_list)
                        return -ENOMEM;
                for (i = 0; i < buf->nbufs; ++i) {
                        buf->page_list[i].buf =
                                dma_zalloc_coherent(&dev->persist->pdev->dev,
-                                                    PAGE_SIZE, &t, gfp);
+                                                    PAGE_SIZE, &t, GFP_KERNEL);
                        if (!buf->page_list[i].buf)
                                goto err_free;
@@ -663,12 +661,11 @@ void mlx4_buf_free(struct mlx4_dev *dev, int size, struct mlx4_buf *buf)
 }
 EXPORT_SYMBOL_GPL(mlx4_buf_free);
-static struct mlx4_db_pgdir *mlx4_alloc_db_pgdir(struct device *dma_device,
+static struct mlx4_db_pgdir *mlx4_alloc_db_pgdir(struct device *dma_device)
-                                                 gfp_t gfp)
 {
        struct mlx4_db_pgdir *pgdir;
-        pgdir = kzalloc(sizeof *pgdir, gfp);
+        pgdir = kzalloc(sizeof(*pgdir), GFP_KERNEL);
        if (!pgdir)
                return NULL;
@@ -676,7 +673,7 @@ static struct mlx4_db_pgdir *mlx4_alloc_db_pgdir(struct device *dma_device,
        pgdir->bits[0] = pgdir->order0;
        pgdir->bits[1] = pgdir->order1;
        pgdir->db_page = dma_alloc_coherent(dma_device, PAGE_SIZE,
-                                            &pgdir->db_dma, gfp);
+                                            &pgdir->db_dma, GFP_KERNEL);
        if (!pgdir->db_page) {
                kfree(pgdir);
                return NULL;
@@ -716,7 +713,7 @@ found:
        return 0;
 }
-int mlx4_db_alloc(struct mlx4_dev *dev, struct mlx4_db *db, int order, gfp_t gfp)
+int mlx4_db_alloc(struct mlx4_dev *dev, struct mlx4_db *db, int order)
 {
        struct mlx4_priv *priv = mlx4_priv(dev);
        struct mlx4_db_pgdir *pgdir;
@@ -728,7 +725,7 @@ int mlx4_db_alloc(struct mlx4_dev *dev, struct mlx4_db *db, int order, gfp_t gfp
                if (!mlx4_alloc_db_from_pgdir(pgdir, db, order))
                        goto out;
-        pgdir = mlx4_alloc_db_pgdir(&dev->persist->pdev->dev, gfp);
+        pgdir = mlx4_alloc_db_pgdir(&dev->persist->pdev->dev);
        if (!pgdir) {
                ret = -ENOMEM;
                goto out;
@@ -780,13 +777,13 @@ int mlx4_alloc_hwq_res(struct mlx4_dev *dev, struct mlx4_hwq_resources *wqres,
 {
        int err;
-        err = mlx4_db_alloc(dev, &wqres->db, 1, GFP_KERNEL);
+        err = mlx4_db_alloc(dev, &wqres->db, 1);
        if (err)
                return err;
        *wqres->db.db = 0;
-        err = mlx4_buf_direct_alloc(dev, size, &wqres->buf, GFP_KERNEL);
+        err = mlx4_buf_direct_alloc(dev, size, &wqres->buf);
        if (err)
                goto err_db;
@@ -795,7 +792,7 @@ int mlx4_alloc_hwq_res(struct mlx4_dev *dev, struct mlx4_hwq_resources *wqres,
        if (err)
                goto err_buf;
-        err = mlx4_buf_write_mtt(dev, &wqres->mtt, &wqres->buf, GFP_KERNEL);
+        err = mlx4_buf_write_mtt(dev, &wqres->mtt, &wqres->buf);
        if (err)
                goto err_mtt;
diff --git a/drivers/net/ethernet/mellanox/mlx4/cq.c b/drivers/net/ethernet/mellanox/mlx4/cq.c
index fa6d2354a0e9..c56a511b918e 100644
--- a/drivers/net/ethernet/mellanox/mlx4/cq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/cq.c
@@ -224,11 +224,11 @@ int __mlx4_cq_alloc_icm(struct mlx4_dev *dev, int *cqn)
        if (*cqn == -1)
                return -ENOMEM;
-        err = mlx4_table_get(dev, &cq_table->table, *cqn, GFP_KERNEL);
+        err = mlx4_table_get(dev, &cq_table->table, *cqn);
        if (err)
                goto err_out;
-        err = mlx4_table_get(dev, &cq_table->cmpt_table, *cqn, GFP_KERNEL);
+        err = mlx4_table_get(dev, &cq_table->cmpt_table, *cqn);
        if (err)
                goto err_put;
        return 0;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
index e5fb89505a13..436f7689a032 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
@@ -1042,7 +1042,7 @@ static int mlx4_en_config_rss_qp(struct mlx4_en_priv *priv, int qpn,
        if (!context)
                return -ENOMEM;
-        err = mlx4_qp_alloc(mdev->dev, qpn, qp, GFP_KERNEL);
+        err = mlx4_qp_alloc(mdev->dev, qpn, qp);
        if (err) {
                en_err(priv, "Failed to allocate qp #%x\n", qpn);
                goto out;
@@ -1086,7 +1086,7 @@ int mlx4_en_create_drop_qp(struct mlx4_en_priv *priv)
                en_err(priv, "Failed reserving drop qpn\n");
                return err;
        }
-        err = mlx4_qp_alloc(priv->mdev->dev, qpn, &priv->drop_qp, GFP_KERNEL);
+        err = mlx4_qp_alloc(priv->mdev->dev, qpn, &priv->drop_qp);
        if (err) {
                en_err(priv, "Failed allocating drop qp\n");
                mlx4_qp_release_range(priv->mdev->dev, qpn, 1);
@@ -1158,8 +1158,7 @@ int mlx4_en_config_rss_steer(struct mlx4_en_priv *priv)
        }
        /* Configure RSS indirection qp */
-        err = mlx4_qp_alloc(mdev->dev, priv->base_qpn, rss_map->indir_qp,
+        err = mlx4_qp_alloc(mdev->dev, priv->base_qpn, rss_map->indir_qp);
-                            GFP_KERNEL);
        if (err) {
                en_err(priv, "Failed to allocate RSS indirection QP\n");
                goto rss_err;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
index 4f3a9b27ce4a..73faa3d77921 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
@@ -111,7 +111,7 @@ int mlx4_en_create_tx_ring(struct mlx4_en_priv *priv,
                goto err_hwq_res;
        }
-        err = mlx4_qp_alloc(mdev->dev, ring->qpn, &ring->sp_qp, GFP_KERNEL);
+        err = mlx4_qp_alloc(mdev->dev, ring->qpn, &ring->sp_qp);
        if (err) {
                en_err(priv, "Failed allocating qp %d\n", ring->qpn);
                goto err_reserve;
diff --git a/drivers/net/ethernet/mellanox/mlx4/icm.c b/drivers/net/ethernet/mellanox/mlx4/icm.c
index e1f9e7cebf8f..5a7816e7c7b4 100644
--- a/drivers/net/ethernet/mellanox/mlx4/icm.c
+++ b/drivers/net/ethernet/mellanox/mlx4/icm.c
@@ -251,8 +251,7 @@ int mlx4_UNMAP_ICM_AUX(struct mlx4_dev *dev)
                        MLX4_CMD_TIME_CLASS_B, MLX4_CMD_NATIVE);
 }
-int mlx4_table_get(struct mlx4_dev *dev, struct mlx4_icm_table *table, u32 obj,
+int mlx4_table_get(struct mlx4_dev *dev, struct mlx4_icm_table *table, u32 obj)
-                   gfp_t gfp)
 {
        u32 i = (obj & (table->num_obj - 1)) /
                        (MLX4_TABLE_CHUNK_SIZE / table->obj_size);
@@ -266,7 +265,7 @@ int mlx4_table_get(struct mlx4_dev *dev, struct mlx4_icm_table *table, u32 obj,
        }
        table->icm[i] = mlx4_alloc_icm(dev, MLX4_TABLE_CHUNK_SIZE >> PAGE_SHIFT,
-                                       (table->lowmem ? gfp : GFP_HIGHUSER) |
+                                       (table->lowmem ? GFP_KERNEL : GFP_HIGHUSER) |
                                       __GFP_NOWARN, table->coherent);
        if (!table->icm[i]) {
                ret = -ENOMEM;
@@ -363,7 +362,7 @@ int mlx4_table_get_range(struct mlx4_dev *dev, struct mlx4_icm_table *table,
        u32 i;
        for (i = start; i <= end; i += inc) {
-                err = mlx4_table_get(dev, table, i, GFP_KERNEL);
+                err = mlx4_table_get(dev, table, i);
                if (err)
                        goto fail;
        }
diff --git a/drivers/net/ethernet/mellanox/mlx4/icm.h b/drivers/net/ethernet/mellanox/mlx4/icm.h
index 0c7364550150..dee67fa39107 100644
--- a/drivers/net/ethernet/mellanox/mlx4/icm.h
+++ b/drivers/net/ethernet/mellanox/mlx4/icm.h
@@ -71,8 +71,7 @@ struct mlx4_icm *mlx4_alloc_icm(struct mlx4_dev *dev, int npages,
                                gfp_t gfp_mask, int coherent);
 void mlx4_free_icm(struct mlx4_dev *dev, struct mlx4_icm *icm, int coherent);
-int mlx4_table_get(struct mlx4_dev *dev, struct mlx4_icm_table *table, u32 obj,
+int mlx4_table_get(struct mlx4_dev *dev, struct mlx4_icm_table *table, u32 obj);
-                   gfp_t gfp);
 void mlx4_table_put(struct mlx4_dev *dev, struct mlx4_icm_table *table, u32 obj);
 int mlx4_table_get_range(struct mlx4_dev *dev, struct mlx4_icm_table *table,
                         u32 start, u32 end);
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4.h b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
index 30616cd0140d..706d7f21ac5c 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
@@ -969,7 +969,7 @@ void mlx4_cleanup_cq_table(struct mlx4_dev *dev);
 void mlx4_cleanup_qp_table(struct mlx4_dev *dev);
 void mlx4_cleanup_srq_table(struct mlx4_dev *dev);
 void mlx4_cleanup_mcg_table(struct mlx4_dev *dev);
-int __mlx4_qp_alloc_icm(struct mlx4_dev *dev, int qpn, gfp_t gfp);
+int __mlx4_qp_alloc_icm(struct mlx4_dev *dev, int qpn);
 void __mlx4_qp_free_icm(struct mlx4_dev *dev, int qpn);
 int __mlx4_cq_alloc_icm(struct mlx4_dev *dev, int *cqn);
 void __mlx4_cq_free_icm(struct mlx4_dev *dev, int cqn);
@@ -977,7 +977,7 @@ int __mlx4_srq_alloc_icm(struct mlx4_dev *dev, int *srqn);
 void __mlx4_srq_free_icm(struct mlx4_dev *dev, int srqn);
 int __mlx4_mpt_reserve(struct mlx4_dev *dev);
 void __mlx4_mpt_release(struct mlx4_dev *dev, u32 index);
-int __mlx4_mpt_alloc_icm(struct mlx4_dev *dev, u32 index, gfp_t gfp);
+int __mlx4_mpt_alloc_icm(struct mlx4_dev *dev, u32 index);
 void __mlx4_mpt_free_icm(struct mlx4_dev *dev, u32 index);
 u32 __mlx4_alloc_mtt_range(struct mlx4_dev *dev, int order);
 void __mlx4_free_mtt_range(struct mlx4_dev *dev, u32 first_seg, int order);
diff --git a/drivers/net/ethernet/mellanox/mlx4/mr.c b/drivers/net/ethernet/mellanox/mlx4/mr.c
index ce852ca22a96..24282cd017d3 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mr.c
+++ b/drivers/net/ethernet/mellanox/mlx4/mr.c
@@ -479,14 +479,14 @@ static void mlx4_mpt_release(struct mlx4_dev *dev, u32 index)
        __mlx4_mpt_release(dev, index);
 }
-int __mlx4_mpt_alloc_icm(struct mlx4_dev *dev, u32 index, gfp_t gfp)
+int __mlx4_mpt_alloc_icm(struct mlx4_dev *dev, u32 index)
 {
        struct mlx4_mr_table *mr_table = &mlx4_priv(dev)->mr_table;
-        return mlx4_table_get(dev, &mr_table->dmpt_table, index, gfp);
+        return mlx4_table_get(dev, &mr_table->dmpt_table, index);
 }
-static int mlx4_mpt_alloc_icm(struct mlx4_dev *dev, u32 index, gfp_t gfp)
+static int mlx4_mpt_alloc_icm(struct mlx4_dev *dev, u32 index)
 {
        u64 param = 0;
@@ -497,7 +497,7 @@ static int mlx4_mpt_alloc_icm(struct mlx4_dev *dev, u32 index, gfp_t gfp)
                                                        MLX4_CMD_TIME_CLASS_A,
                                                        MLX4_CMD_WRAPPED);
        }
-        return __mlx4_mpt_alloc_icm(dev, index, gfp);
+        return __mlx4_mpt_alloc_icm(dev, index);
 }
 void __mlx4_mpt_free_icm(struct mlx4_dev *dev, u32 index)
@@ -629,7 +629,7 @@ int mlx4_mr_enable(struct mlx4_dev *dev, struct mlx4_mr *mr)
        struct mlx4_mpt_entry *mpt_entry;
        int err;
-        err = mlx4_mpt_alloc_icm(dev, key_to_hw_index(mr->key), GFP_KERNEL);
+        err = mlx4_mpt_alloc_icm(dev, key_to_hw_index(mr->key));
        if (err)
                return err;
@@ -787,14 +787,13 @@ int mlx4_write_mtt(struct mlx4_dev *dev, struct mlx4_mtt *mtt,
 EXPORT_SYMBOL_GPL(mlx4_write_mtt);
 int mlx4_buf_write_mtt(struct mlx4_dev *dev, struct mlx4_mtt *mtt,
-                       struct mlx4_buf *buf, gfp_t gfp)
+                       struct mlx4_buf *buf)
 {
        u64 *page_list;
        int err;
        int i;
-        page_list = kmalloc(buf->npages * sizeof *page_list,
+        page_list = kcalloc(buf->npages, sizeof(*page_list), GFP_KERNEL);
-                            gfp);
        if (!page_list)
                return -ENOMEM;
@@ -841,7 +840,7 @@ int mlx4_mw_enable(struct mlx4_dev *dev, struct mlx4_mw *mw)
        struct mlx4_mpt_entry *mpt_entry;
        int err;
-        err = mlx4_mpt_alloc_icm(dev, key_to_hw_index(mw->key), GFP_KERNEL);
+        err = mlx4_mpt_alloc_icm(dev, key_to_hw_index(mw->key));
        if (err)
                return err;
diff --git a/drivers/net/ethernet/mellanox/mlx4/qp.c b/drivers/net/ethernet/mellanox/mlx4/qp.c
index 5a310d313e94..26747212526b 100644
--- a/drivers/net/ethernet/mellanox/mlx4/qp.c
+++ b/drivers/net/ethernet/mellanox/mlx4/qp.c
@@ -301,29 +301,29 @@ void mlx4_qp_release_range(struct mlx4_dev *dev, int base_qpn, int cnt)
 }
 EXPORT_SYMBOL_GPL(mlx4_qp_release_range);
-int __mlx4_qp_alloc_icm(struct mlx4_dev *dev, int qpn, gfp_t gfp)
+int __mlx4_qp_alloc_icm(struct mlx4_dev *dev, int qpn)
 {
        struct mlx4_priv *priv = mlx4_priv(dev);
        struct mlx4_qp_table *qp_table = &priv->qp_table;
        int err;
-        err = mlx4_table_get(dev, &qp_table->qp_table, qpn, gfp);
+        err = mlx4_table_get(dev, &qp_table->qp_table, qpn);
        if (err)
                goto err_out;
-        err = mlx4_table_get(dev, &qp_table->auxc_table, qpn, gfp);
+        err = mlx4_table_get(dev, &qp_table->auxc_table, qpn);
        if (err)
                goto err_put_qp;
-        err = mlx4_table_get(dev, &qp_table->altc_table, qpn, gfp);
+        err = mlx4_table_get(dev, &qp_table->altc_table, qpn);
        if (err)
                goto err_put_auxc;
-        err = mlx4_table_get(dev, &qp_table->rdmarc_table, qpn, gfp);
+        err = mlx4_table_get(dev, &qp_table->rdmarc_table, qpn);
        if (err)
                goto err_put_altc;
-        err = mlx4_table_get(dev, &qp_table->cmpt_table, qpn, gfp);
+        err = mlx4_table_get(dev, &qp_table->cmpt_table, qpn);
        if (err)
                goto err_put_rdmarc;
@@ -345,7 +345,7 @@ err_out:
        return err;
 }
-static int mlx4_qp_alloc_icm(struct mlx4_dev *dev, int qpn, gfp_t gfp)
+static int mlx4_qp_alloc_icm(struct mlx4_dev *dev, int qpn)
 {
        u64 param = 0;
@@ -355,7 +355,7 @@ static int mlx4_qp_alloc_icm(struct mlx4_dev *dev, int qpn, gfp_t gfp)
                                    MLX4_CMD_ALLOC_RES, MLX4_CMD_TIME_CLASS_A,
                                    MLX4_CMD_WRAPPED);
        }
-        return __mlx4_qp_alloc_icm(dev, qpn, gfp);
+        return __mlx4_qp_alloc_icm(dev, qpn);
 }
 void __mlx4_qp_free_icm(struct mlx4_dev *dev, int qpn)
@@ -397,7 +397,7 @@ struct mlx4_qp *mlx4_qp_lookup(struct mlx4_dev *dev, u32 qpn)
        return qp;
 }
-int mlx4_qp_alloc(struct mlx4_dev *dev, int qpn, struct mlx4_qp *qp, gfp_t gfp)
+int mlx4_qp_alloc(struct mlx4_dev *dev, int qpn, struct mlx4_qp *qp)
 {
        struct mlx4_priv *priv = mlx4_priv(dev);
        struct mlx4_qp_table *qp_table = &priv->qp_table;
@@ -408,7 +408,7 @@ int mlx4_qp_alloc(struct mlx4_dev *dev, int qpn, struct mlx4_qp *qp, gfp_t gfp)
        qp->qpn = qpn;
-        err = mlx4_qp_alloc_icm(dev, qpn, gfp);
+        err = mlx4_qp_alloc_icm(dev, qpn);
        if (err)
                return err;
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index 812783865205..215e21c3dc8a 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -1822,7 +1822,7 @@ static int qp_alloc_res(struct mlx4_dev *dev, int slave, int op, int cmd,
                        return err;
                if (!fw_reserved(dev, qpn)) {
-                        err = __mlx4_qp_alloc_icm(dev, qpn, GFP_KERNEL);
+                        err = __mlx4_qp_alloc_icm(dev, qpn);
                        if (err) {
                                res_abort_move(dev, slave, RES_QP, qpn);
                                return err;
@@ -1909,7 +1909,7 @@ static int mpt_alloc_res(struct mlx4_dev *dev, int slave, int op, int cmd,
                if (err)
                        return err;
-                err = __mlx4_mpt_alloc_icm(dev, mpt->key, GFP_KERNEL);
+                err = __mlx4_mpt_alloc_icm(dev, mpt->key);
                if (err) {
                        res_abort_move(dev, slave, RES_MPT, id);
                        return err;
diff --git a/drivers/net/ethernet/mellanox/mlx4/srq.c b/drivers/net/ethernet/mellanox/mlx4/srq.c
index f44d089e2ca6..bedf52126824 100644
--- a/drivers/net/ethernet/mellanox/mlx4/srq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/srq.c
@@ -100,11 +100,11 @@ int __mlx4_srq_alloc_icm(struct mlx4_dev *dev, int *srqn)
        if (*srqn == -1)
                return -ENOMEM;
-        err = mlx4_table_get(dev, &srq_table->table, *srqn, GFP_KERNEL);
+        err = mlx4_table_get(dev, &srq_table->table, *srqn);
        if (err)
                goto err_out;
-        err = mlx4_table_get(dev, &srq_table->cmpt_table, *srqn, GFP_KERNEL);
+        err = mlx4_table_get(dev, &srq_table->cmpt_table, *srqn);
        if (err)
                goto err_put;
        return 0;
diff --git a/drivers/net/ethernet/qualcomm/emac/emac.c b/drivers/net/ethernet/qualcomm/emac/emac.c
index 746d94e28470..60850bfa3d32 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac.c
+++ b/drivers/net/ethernet/qualcomm/emac/emac.c
@@ -766,11 +766,13 @@ static void emac_shutdown(struct platform_device *pdev)
        struct emac_adapter *adpt = netdev_priv(netdev);
        struct emac_sgmii *sgmii = &adpt->phy;
-        /* Closing the SGMII turns off its interrupts */
+        if (netdev->flags & IFF_UP) {
-        sgmii->close(adpt);
+                /* Closing the SGMII turns off its interrupts */
+                sgmii->close(adpt);
-        /* Resetting the MAC turns off all DMA and its interrupts */
+                /* Resetting the MAC turns off all DMA and its interrupts */
-        emac_mac_reset(adpt);
+                emac_mac_reset(adpt);
+        }
 }
 static struct platform_driver emac_platform_driver = {
diff --git a/drivers/net/ethernet/sgi/ioc3-eth.c b/drivers/net/ethernet/sgi/ioc3-eth.c
index b607936e1b3e..9c0488e0f08e 100644
--- a/drivers/net/ethernet/sgi/ioc3-eth.c
+++ b/drivers/net/ethernet/sgi/ioc3-eth.c
@@ -90,17 +90,13 @@ struct ioc3_private {
        spinlock_t ioc3_lock;
        struct mii_if_info mii;
+        struct net_device *dev;
        struct pci_dev *pdev;
        /* Members used by autonegotiation  */
        struct timer_list ioc3_timer;
 };
-static inline struct net_device *priv_netdev(struct ioc3_private *dev)
-{
-        return (void *)dev - ((sizeof(struct net_device) + 31) & ~31);
-}
 static int ioc3_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
 static void ioc3_set_multicast_list(struct net_device *dev);
 static int ioc3_start_xmit(struct sk_buff *skb, struct net_device *dev);
@@ -427,7 +423,7 @@ static void ioc3_get_eaddr_nic(struct ioc3_private *ip)
                nic[i] = nic_read_byte(ioc3);
        for (i = 2; i < 8; i++)
-                priv_netdev(ip)->dev_addr[i - 2] = nic[i];
+                ip->dev->dev_addr[i - 2] = nic[i];
 }
 /*
@@ -439,7 +435,7 @@ static void ioc3_get_eaddr(struct ioc3_private *ip)
 {
        ioc3_get_eaddr_nic(ip);
-        printk("Ethernet address is %pM.\n", priv_netdev(ip)->dev_addr);
+        printk("Ethernet address is %pM.\n", ip->dev->dev_addr);
 }
 static void __ioc3_set_mac_address(struct net_device *dev)
@@ -790,13 +786,12 @@ static void ioc3_timer(unsigned long data)
 */
 static int ioc3_mii_init(struct ioc3_private *ip)
 {
-        struct net_device *dev = priv_netdev(ip);
        int i, found = 0, res = 0;
        int ioc3_phy_workaround = 1;
        u16 word;
        for (i = 0; i < 32; i++) {
-                word = ioc3_mdio_read(dev, i, MII_PHYSID1);
+                word = ioc3_mdio_read(ip->dev, i, MII_PHYSID1);
                if (word != 0xffff && word != 0x0000) {
                        found = 1;
@@ -1276,6 +1271,7 @@ static int ioc3_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        SET_NETDEV_DEV(dev, &pdev->dev);
        ip = netdev_priv(dev);
+        ip->dev = dev;
        dev->irq = pdev->irq;
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
index f233bf8b4ebb..c4407e8e39a3 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
@@ -117,7 +117,7 @@ static void dwmac4_tx_queue_routing(struct mac_device_info *hw,
        void __iomem *ioaddr = hw->pcsr;
        u32 value;
-        const struct stmmac_rx_routing route_possibilities[] = {
+        static const struct stmmac_rx_routing route_possibilities[] = {
                { GMAC_RXQCTRL_AVCPQ_MASK, GMAC_RXQCTRL_AVCPQ_SHIFT },
                { GMAC_RXQCTRL_PTPQ_MASK, GMAC_RXQCTRL_PTPQ_SHIFT },
                { GMAC_RXQCTRL_DCBCPQ_MASK, GMAC_RXQCTRL_DCBCPQ_SHIFT },
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 1853f7ff6657..1763e48c84e2 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -4120,8 +4120,15 @@ int stmmac_dvr_probe(struct device *device,
        if ((phyaddr >= 0) && (phyaddr <= 31))
                priv->plat->phy_addr = phyaddr;
-        if (priv->plat->stmmac_rst)
+        if (priv->plat->stmmac_rst) {
+                ret = reset_control_assert(priv->plat->stmmac_rst);
                reset_control_deassert(priv->plat->stmmac_rst);
+                /* Some reset controllers have only reset callback instead of
+                 * assert + deassert callbacks pair.
+                 */
+                if (ret == -ENOTSUPP)
+                        reset_control_reset(priv->plat->stmmac_rst);
+        }
        /* Init MAC and get the capabilities */
        ret = stmmac_hw_init(priv);
diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c
index 46cb7f8955a2..4bb04aaf9650 100644
--- a/drivers/net/ethernet/sun/niu.c
+++ b/drivers/net/ethernet/sun/niu.c
@@ -9532,7 +9532,7 @@ static struct niu_parent *niu_get_parent(struct niu *np,
                p = niu_new_parent(np, id, ptype);
        if (p) {
-                char port_name[6];
+                char port_name[8];
                int err;
                sprintf(port_name, "port%d", port);
@@ -9553,7 +9553,7 @@ static void niu_put_parent(struct niu *np)
 {
        struct niu_parent *p = np->parent;
        u8 port = np->port;
-        char port_name[6];
+        char port_name[8];
        BUG_ON(!p || p->ports[port] != np);
diff --git a/drivers/net/ethernet/tehuti/tehuti.c b/drivers/net/ethernet/tehuti/tehuti.c
index 711fbbbc4b1f..163d8d16bc24 100644
--- a/drivers/net/ethernet/tehuti/tehuti.c
+++ b/drivers/net/ethernet/tehuti/tehuti.c
@@ -654,6 +654,8 @@ static int bdx_ioctl_priv(struct net_device *ndev, struct ifreq *ifr, int cmd)
                        RET(-EFAULT);
                }
                DBG("%d 0x%x 0x%x\n", data[0], data[1], data[2]);
+        } else {
+                return -EOPNOTSUPP;
        }
        if (!capable(CAP_SYS_RAWIO))
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 1850e348f555..badd0a8caeb9 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -3089,6 +3089,31 @@ static int cpsw_probe(struct platform_device *pdev)
                        cpsw->quirk_irq = true;
        }
+        ndev->features |= NETIF_F_HW_VLAN_CTAG_FILTER;
+        ndev->netdev_ops = &cpsw_netdev_ops;
+        ndev->ethtool_ops = &cpsw_ethtool_ops;
+        netif_napi_add(ndev, &cpsw->napi_rx, cpsw_rx_poll, CPSW_POLL_WEIGHT);
+        netif_tx_napi_add(ndev, &cpsw->napi_tx, cpsw_tx_poll, CPSW_POLL_WEIGHT);
+        cpsw_split_res(ndev);
+        /* register the network device */
+        SET_NETDEV_DEV(ndev, &pdev->dev);
+        ret = register_netdev(ndev);
+        if (ret) {
+                dev_err(priv->dev, "error registering net device\n");
+                ret = -ENODEV;
+                goto clean_ale_ret;
+        }
+        if (cpsw->data.dual_emac) {
+                ret = cpsw_probe_dual_emac(priv);
+                if (ret) {
+                        cpsw_err(priv, probe, "error probe slave 2 emac interface\n");
+                        goto clean_unregister_netdev_ret;
+                }
+        }
        /* Grab RX and TX IRQs. Note that we also have RX_THRESHOLD and
         * MISC IRQs which are always kept disabled with this driver so
         * we will not request them.
@@ -3127,33 +3152,9 @@ static int cpsw_probe(struct platform_device *pdev)
                goto clean_ale_ret;
        }
-        ndev->features |= NETIF_F_HW_VLAN_CTAG_FILTER;
-        ndev->netdev_ops = &cpsw_netdev_ops;
-        ndev->ethtool_ops = &cpsw_ethtool_ops;
-        netif_napi_add(ndev, &cpsw->napi_rx, cpsw_rx_poll, CPSW_POLL_WEIGHT);
-        netif_tx_napi_add(ndev, &cpsw->napi_tx, cpsw_tx_poll, CPSW_POLL_WEIGHT);
-        cpsw_split_res(ndev);
-        /* register the network device */
-        SET_NETDEV_DEV(ndev, &pdev->dev);
-        ret = register_netdev(ndev);
-        if (ret) {
-                dev_err(priv->dev, "error registering net device\n");
-                ret = -ENODEV;
-                goto clean_ale_ret;
-        }
        cpsw_notice(priv, probe,
                    "initialized device (regs %pa, irq %d, pool size %d)\n",
                    &ss_res->start, ndev->irq, dma_params.descs_pool_size);
-        if (cpsw->data.dual_emac) {
-                ret = cpsw_probe_dual_emac(priv);
-                if (ret) {
-                        cpsw_err(priv, probe, "error probe slave 2 emac interface\n");
-                        goto clean_unregister_netdev_ret;
-                }
-        }
        pm_runtime_put(&pdev->dev);
diff --git a/drivers/net/phy/mdio-mux.c b/drivers/net/phy/mdio-mux.c
index 00755b6a42cf..c608e1dfaf09 100644
--- a/drivers/net/phy/mdio-mux.c
+++ b/drivers/net/phy/mdio-mux.c
@@ -135,8 +135,8 @@ int mdio_mux_init(struct device *dev,
        for_each_available_child_of_node(dev->of_node, child_bus_node) {
                int v;
-                v = of_mdio_parse_addr(dev, child_bus_node);
+                r = of_property_read_u32(child_bus_node, "reg", &v);
-                if (v < 0) {
+                if (r) {
                        dev_err(dev,
                                "Error: Failed to find reg for child %s\n",
                                of_node_full_name(child_bus_node));
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index 13028833bee3..bd4303944e44 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -120,6 +120,7 @@ struct ppp {
        int             n_channels;     /* how many channels are attached 54 */
        spinlock_t      rlock;          /* lock for receive side 58 */
        spinlock_t      wlock;          /* lock for transmit side 5c */
+        int             *xmit_recursion __percpu; /* xmit recursion detect */
        int             mru;            /* max receive unit 60 */
        unsigned int    flags;          /* control bits 64 */
        unsigned int    xstate;         /* transmit state bits 68 */
@@ -1025,6 +1026,7 @@ static int ppp_dev_configure(struct net *src_net, struct net_device *dev,
        struct ppp *ppp = netdev_priv(dev);
        int indx;
        int err;
+        int cpu;
        ppp->dev = dev;
        ppp->ppp_net = src_net;
@@ -1039,6 +1041,15 @@ static int ppp_dev_configure(struct net *src_net, struct net_device *dev,
        INIT_LIST_HEAD(&ppp->channels);
        spin_lock_init(&ppp->rlock);
        spin_lock_init(&ppp->wlock);
+        ppp->xmit_recursion = alloc_percpu(int);
+        if (!ppp->xmit_recursion) {
+                err = -ENOMEM;
+                goto err1;
+        }
+        for_each_possible_cpu(cpu)
+                (*per_cpu_ptr(ppp->xmit_recursion, cpu)) = 0;
 #ifdef CONFIG_PPP_MULTILINK
        ppp->minseq = -1;
        skb_queue_head_init(&ppp->mrq);
@@ -1050,11 +1061,15 @@ static int ppp_dev_configure(struct net *src_net, struct net_device *dev,
        err = ppp_unit_register(ppp, conf->unit, conf->ifname_is_set);
        if (err < 0)
-                return err;
+                goto err2;
        conf->file->private_data = &ppp->file;
        return 0;
+err2:
+        free_percpu(ppp->xmit_recursion);
+err1:
+        return err;
 }
 static const struct nla_policy ppp_nl_policy[IFLA_PPP_MAX + 1] = {
@@ -1400,18 +1415,16 @@ static void __ppp_xmit_process(struct ppp *ppp)
        ppp_xmit_unlock(ppp);
 }
-static DEFINE_PER_CPU(int, ppp_xmit_recursion);
 static void ppp_xmit_process(struct ppp *ppp)
 {
        local_bh_disable();
-        if (unlikely(__this_cpu_read(ppp_xmit_recursion)))
+        if (unlikely(*this_cpu_ptr(ppp->xmit_recursion)))
                goto err;
-        __this_cpu_inc(ppp_xmit_recursion);
+        (*this_cpu_ptr(ppp->xmit_recursion))++;
        __ppp_xmit_process(ppp);
-        __this_cpu_dec(ppp_xmit_recursion);
+        (*this_cpu_ptr(ppp->xmit_recursion))--;
        local_bh_enable();
@@ -1905,7 +1918,7 @@ static void __ppp_channel_push(struct channel *pch)
                read_lock(&pch->upl);
                ppp = pch->ppp;
                if (ppp)
-                        __ppp_xmit_process(ppp);
+                        ppp_xmit_process(ppp);
                read_unlock(&pch->upl);
        }
 }
@@ -1914,9 +1927,7 @@ static void ppp_channel_push(struct channel *pch)
 {
        local_bh_disable();
-        __this_cpu_inc(ppp_xmit_recursion);
        __ppp_channel_push(pch);
-        __this_cpu_dec(ppp_xmit_recursion);
        local_bh_enable();
 }
@@ -3057,6 +3068,7 @@ static void ppp_destroy_interface(struct ppp *ppp)
 #endif /* CONFIG_PPP_FILTER */
        kfree_skb(ppp->xmit_pending);
+        free_percpu(ppp->xmit_recursion);
        free_netdev(ppp->dev);
 }
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index d103a1d4fb36..8f572b9f3625 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -768,8 +768,10 @@ int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_
        u8 *buf;
        int len;
        int temp;
+        int err;
        u8 iface_no;
        struct usb_cdc_parsed_header hdr;
+        u16 curr_ntb_format;
        ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
        if (!ctx)
@@ -874,6 +876,32 @@ int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_
                goto error2;
        }
+        /*
+         * Some Huawei devices have been observed to come out of reset in NDP32 mode.
+         * Let's check if this is the case, and set the device to NDP16 mode again if
+         * needed.
+        */
+        if (ctx->drvflags & CDC_NCM_FLAG_RESET_NTB16) {
+                err = usbnet_read_cmd(dev, USB_CDC_GET_NTB_FORMAT,
+                                      USB_TYPE_CLASS | USB_DIR_IN | USB_RECIP_INTERFACE,
+                                      0, iface_no, &curr_ntb_format, 2);
+                if (err < 0) {
+                        goto error2;
+                }
+                if (curr_ntb_format == USB_CDC_NCM_NTB32_FORMAT) {
+                        dev_info(&intf->dev, "resetting NTB format to 16-bit");
+                        err = usbnet_write_cmd(dev, USB_CDC_SET_NTB_FORMAT,
+                                               USB_TYPE_CLASS | USB_DIR_OUT
+                                               | USB_RECIP_INTERFACE,
+                                               USB_CDC_NCM_NTB16_FORMAT,
+                                               iface_no, NULL, 0);
+                        if (err < 0)
+                                goto error2;
+                }
+        }
        cdc_ncm_find_endpoints(dev, ctx->data);
        cdc_ncm_find_endpoints(dev, ctx->control);
        if (!dev->in || !dev->out || !dev->status) {
diff --git a/drivers/net/usb/huawei_cdc_ncm.c b/drivers/net/usb/huawei_cdc_ncm.c
index 2680a65cd5e4..63f28908afda 100644
--- a/drivers/net/usb/huawei_cdc_ncm.c
+++ b/drivers/net/usb/huawei_cdc_ncm.c
@@ -80,6 +80,12 @@ static int huawei_cdc_ncm_bind(struct usbnet *usbnet_dev,
         * be at the end of the frame.
         */
        drvflags |= CDC_NCM_FLAG_NDP_TO_END;
+        /* Additionally, it has been reported that some Huawei E3372H devices, with
+         * firmware version 21.318.01.00.541, come out of reset in NTB32 format mode, hence
+         * needing to be set to the NTB16 one again.
+         */
+        drvflags |= CDC_NCM_FLAG_RESET_NTB16;
        ret = cdc_ncm_bind_common(usbnet_dev, intf, 1, drvflags);
        if (ret)
                goto err;
diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index 2dfca96a63b6..340c13484e5c 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -898,6 +898,7 @@ static const struct ethtool_ops smsc95xx_ethtool_ops = {
        .set_wol        = smsc95xx_ethtool_set_wol,
        .get_link_ksettings     = smsc95xx_get_link_ksettings,
        .set_link_ksettings     = smsc95xx_set_link_ksettings,
+        .get_ts_info    = ethtool_op_get_ts_info,
 };
 static int smsc95xx_ioctl(struct net_device *netdev, struct ifreq *rq, int cmd)
diff --git a/drivers/net/vmxnet3/vmxnet3_int.h b/drivers/net/vmxnet3/vmxnet3_int.h
index ba1c9f93592b..9c51b8be0038 100644
--- a/drivers/net/vmxnet3/vmxnet3_int.h
+++ b/drivers/net/vmxnet3/vmxnet3_int.h
@@ -311,7 +311,7 @@ struct vmxnet3_intr {
        u8  num_intrs;                  /* # of intr vectors */
        u8  event_intr_idx;             /* idx of the intr vector for event */
        u8  mod_levels[VMXNET3_LINUX_MAX_MSIX_VECT]; /* moderation level */
-        char    event_msi_vector_name[IFNAMSIZ+11];
+        char    event_msi_vector_name[IFNAMSIZ+17];
 #ifdef CONFIG_PCI_MSI
        struct msix_entry msix_entries[VMXNET3_LINUX_MAX_MSIX_VECT];
 #endif
diff --git a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
index 6e2e760d98b1..0b75def39c6c 100644
--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
@@ -5704,7 +5704,7 @@ static void rt2800_init_freq_calibration(struct rt2x00_dev *rt2x00dev)
 static void rt2800_init_bbp_5592_glrt(struct rt2x00_dev *rt2x00dev)
 {
-        const u8 glrt_table[] = {
+        static const u8 glrt_table[] = {
                0xE0, 0x1F, 0X38, 0x32, 0x08, 0x28, 0x19, 0x0A, 0xFF, 0x00, /* 128 ~ 137 */
                0x16, 0x10, 0x10, 0x0B, 0x36, 0x2C, 0x26, 0x24, 0x42, 0x36, /* 138 ~ 147 */
                0x30, 0x2D, 0x4C, 0x46, 0x3D, 0x40, 0x3E, 0x42, 0x3D, 0x40, /* 148 ~ 157 */
diff --git a/drivers/nvdimm/core.c b/drivers/nvdimm/core.c
index 7cd99b1f8596..75bc08c6838c 100644
--- a/drivers/nvdimm/core.c
+++ b/drivers/nvdimm/core.c
@@ -421,14 +421,15 @@ static void set_badblock(struct badblocks *bb, sector_t s, int num)
 static void __add_badblock_range(struct badblocks *bb, u64 ns_offset, u64 len)
 {
        const unsigned int sector_size = 512;
-        sector_t start_sector;
+        sector_t start_sector, end_sector;
        u64 num_sectors;
        u32 rem;
        start_sector = div_u64(ns_offset, sector_size);
-        num_sectors = div_u64_rem(len, sector_size, &rem);
+        end_sector = div_u64_rem(ns_offset + len, sector_size, &rem);
        if (rem)
-                num_sectors++;
+                end_sector++;
+        num_sectors = end_sector - start_sector;
        if (unlikely(num_sectors > (u64)INT_MAX)) {
                u64 remaining = num_sectors;
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index cb96f4a7ae3a..3b77cfe5aa1e 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -336,7 +336,7 @@ static int nvme_get_stream_params(struct nvme_ctrl *ctrl,
        c.directive.opcode = nvme_admin_directive_recv;
        c.directive.nsid = cpu_to_le32(nsid);
-        c.directive.numd = sizeof(*s);
+        c.directive.numd = cpu_to_le32(sizeof(*s));
        c.directive.doper = NVME_DIR_RCV_ST_OP_PARAM;
        c.directive.dtype = NVME_DIR_STREAMS;
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index d10d2f279d19..8569ee771269 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -539,7 +539,7 @@ static void nvme_dif_complete(u32 p, u32 v, struct t10_pi_tuple *pi)
 }
 #endif
-static bool nvme_setup_prps(struct nvme_dev *dev, struct request *req)
+static blk_status_t nvme_setup_prps(struct nvme_dev *dev, struct request *req)
 {
        struct nvme_iod *iod = blk_mq_rq_to_pdu(req);
        struct dma_pool *pool;
@@ -556,7 +556,7 @@ static bool nvme_setup_prps(struct nvme_dev *dev, struct request *req)
        length -= (page_size - offset);
        if (length <= 0)
-                return true;
+                return BLK_STS_OK;
        dma_len -= (page_size - offset);
        if (dma_len) {
@@ -569,7 +569,7 @@ static bool nvme_setup_prps(struct nvme_dev *dev, struct request *req)
        if (length <= page_size) {
                iod->first_dma = dma_addr;
-                return true;
+                return BLK_STS_OK;
        }
        nprps = DIV_ROUND_UP(length, page_size);
@@ -585,7 +585,7 @@ static bool nvme_setup_prps(struct nvme_dev *dev, struct request *req)
        if (!prp_list) {
                iod->first_dma = dma_addr;
                iod->npages = -1;
-                return false;
+                return BLK_STS_RESOURCE;
        }
        list[0] = prp_list;
        iod->first_dma = prp_dma;
@@ -595,7 +595,7 @@ static bool nvme_setup_prps(struct nvme_dev *dev, struct request *req)
                        __le64 *old_prp_list = prp_list;
                        prp_list = dma_pool_alloc(pool, GFP_ATOMIC, &prp_dma);
                        if (!prp_list)
-                                return false;
+                                return BLK_STS_RESOURCE;
                        list[iod->npages++] = prp_list;
                        prp_list[0] = old_prp_list[i - 1];
                        old_prp_list[i - 1] = cpu_to_le64(prp_dma);
@@ -609,13 +609,29 @@ static bool nvme_setup_prps(struct nvme_dev *dev, struct request *req)
                        break;
                if (dma_len > 0)
                        continue;
-                BUG_ON(dma_len < 0);
+                if (unlikely(dma_len < 0))
+                        goto bad_sgl;
                sg = sg_next(sg);
                dma_addr = sg_dma_address(sg);
                dma_len = sg_dma_len(sg);
        }
-        return true;
+        return BLK_STS_OK;
+ bad_sgl:
+        if (WARN_ONCE(1, "Invalid SGL for payload:%d nents:%d\n",
+                                blk_rq_payload_bytes(req), iod->nents)) {
+                for_each_sg(iod->sg, sg, iod->nents, i) {
+                        dma_addr_t phys = sg_phys(sg);
+                        pr_warn("sg[%d] phys_addr:%pad offset:%d length:%d "
+                               "dma_address:%pad dma_length:%d\n", i, &phys,
+                                        sg->offset, sg->length,
+                                        &sg_dma_address(sg),
+                                        sg_dma_len(sg));
+                }
+        }
+        return BLK_STS_IOERR;
 }
 static blk_status_t nvme_map_data(struct nvme_dev *dev, struct request *req,
@@ -637,7 +653,8 @@ static blk_status_t nvme_map_data(struct nvme_dev *dev, struct request *req,
                                DMA_ATTR_NO_WARN))
                goto out;
-        if (!nvme_setup_prps(dev, req))
+        ret = nvme_setup_prps(dev, req);
+        if (ret != BLK_STS_OK)
                goto out_unmap;
        ret = BLK_STS_IOERR;
@@ -2282,7 +2299,7 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id)
        result = nvme_dev_map(dev);
        if (result)
-                goto free;
+                goto put_pci;
        INIT_WORK(&dev->ctrl.reset_work, nvme_reset_work);
        INIT_WORK(&dev->remove_work, nvme_remove_dead_ctrl_work);
@@ -2291,7 +2308,7 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id)
        result = nvme_setup_prp_pools(dev);
        if (result)
-                goto put_pci;
+                goto unmap;
        quirks |= check_dell_samsung_bug(pdev);
@@ -2308,9 +2325,10 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 release_pools:
        nvme_release_prp_pools(dev);
+ unmap:
+        nvme_dev_unmap(dev);
 put_pci:
        put_device(dev->dev);
-        nvme_dev_unmap(dev);
 free:
        kfree(dev->queues);
        kfree(dev);
@@ -2466,6 +2484,9 @@ static const struct pci_device_id nvme_id_table[] = {
        { PCI_VDEVICE(INTEL, 0x0a54),
                .driver_data = NVME_QUIRK_STRIPE_SIZE |
                                NVME_QUIRK_DEALLOCATE_ZEROES, },
+        { PCI_VDEVICE(INTEL, 0x0a55),
+                .driver_data = NVME_QUIRK_STRIPE_SIZE |
+                                NVME_QUIRK_DEALLOCATE_ZEROES, },
        { PCI_VDEVICE(INTEL, 0xf1a5),   /* Intel 600P/P3100 */
                .driver_data = NVME_QUIRK_NO_DEEPEST_PS },
        { PCI_VDEVICE(INTEL, 0x5845),   /* Qemu emulated controller */
diff --git a/drivers/nvme/target/admin-cmd.c b/drivers/nvme/target/admin-cmd.c
index 35f930db3c02..2d7a98ab53fb 100644
--- a/drivers/nvme/target/admin-cmd.c
+++ b/drivers/nvme/target/admin-cmd.c
@@ -168,11 +168,21 @@ out:
        nvmet_req_complete(req, status);
 }
+static void copy_and_pad(char *dst, int dst_len, const char *src, int src_len)
+{
+        int len = min(src_len, dst_len);
+        memcpy(dst, src, len);
+        if (dst_len > len)
+                memset(dst + len, ' ', dst_len - len);
+}
 static void nvmet_execute_identify_ctrl(struct nvmet_req *req)
 {
        struct nvmet_ctrl *ctrl = req->sq->ctrl;
        struct nvme_id_ctrl *id;
        u16 status = 0;
+        const char model[] = "Linux";
        id = kzalloc(sizeof(*id), GFP_KERNEL);
        if (!id) {
@@ -184,8 +194,10 @@ static void nvmet_execute_identify_ctrl(struct nvmet_req *req)
        id->vid = 0;
        id->ssvid = 0;
-        memset(id->sn, ' ', sizeof(id->sn));
+        bin2hex(id->sn, &ctrl->subsys->serial,
-        snprintf(id->sn, sizeof(id->sn), "%llx", ctrl->serial);
+                min(sizeof(ctrl->subsys->serial), sizeof(id->sn) / 2));
+        copy_and_pad(id->mn, sizeof(id->mn), model, sizeof(model) - 1);
+        copy_and_pad(id->fr, sizeof(id->fr), UTS_RELEASE, strlen(UTS_RELEASE));
        memset(id->mn, ' ', sizeof(id->mn));
        strncpy((char *)id->mn, "Linux", sizeof(id->mn));
diff --git a/drivers/nvme/target/configfs.c b/drivers/nvme/target/configfs.c
index a358ecd93e11..0a0067e771f5 100644
--- a/drivers/nvme/target/configfs.c
+++ b/drivers/nvme/target/configfs.c
@@ -650,7 +650,7 @@ out_unlock:
 CONFIGFS_ATTR(nvmet_subsys_, attr_allow_any_host);
-static ssize_t nvmet_subsys_version_show(struct config_item *item,
+static ssize_t nvmet_subsys_attr_version_show(struct config_item *item,
                                              char *page)
 {
        struct nvmet_subsys *subsys = to_subsys(item);
@@ -666,7 +666,7 @@ static ssize_t nvmet_subsys_version_show(struct config_item *item,
                                (int)NVME_MINOR(subsys->ver));
 }
-static ssize_t nvmet_subsys_version_store(struct config_item *item,
+static ssize_t nvmet_subsys_attr_version_store(struct config_item *item,
                                               const char *page, size_t count)
 {
        struct nvmet_subsys *subsys = to_subsys(item);
@@ -684,11 +684,33 @@ static ssize_t nvmet_subsys_version_store(struct config_item *item,
        return count;
 }
-CONFIGFS_ATTR(nvmet_subsys_, version);
+CONFIGFS_ATTR(nvmet_subsys_, attr_version);
+static ssize_t nvmet_subsys_attr_serial_show(struct config_item *item,
+                                             char *page)
+{
+        struct nvmet_subsys *subsys = to_subsys(item);
+        return snprintf(page, PAGE_SIZE, "%llx\n", subsys->serial);
+}
+static ssize_t nvmet_subsys_attr_serial_store(struct config_item *item,
+                                              const char *page, size_t count)
+{
+        struct nvmet_subsys *subsys = to_subsys(item);
+        down_write(&nvmet_config_sem);
+        sscanf(page, "%llx\n", &subsys->serial);
+        up_write(&nvmet_config_sem);
+        return count;
+}
+CONFIGFS_ATTR(nvmet_subsys_, attr_serial);
 static struct configfs_attribute *nvmet_subsys_attrs[] = {
        &nvmet_subsys_attr_attr_allow_any_host,
-        &nvmet_subsys_attr_version,
+        &nvmet_subsys_attr_attr_version,
+        &nvmet_subsys_attr_attr_serial,
        NULL,
 };
diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
index b5b4ac103748..f4b02bb4a1a8 100644
--- a/drivers/nvme/target/core.c
+++ b/drivers/nvme/target/core.c
@@ -767,9 +767,6 @@ u16 nvmet_alloc_ctrl(const char *subsysnqn, const char *hostnqn,
        memcpy(ctrl->subsysnqn, subsysnqn, NVMF_NQN_SIZE);
        memcpy(ctrl->hostnqn, hostnqn, NVMF_NQN_SIZE);
-        /* generate a random serial number as our controllers are ephemeral: */
-        get_random_bytes(&ctrl->serial, sizeof(ctrl->serial));
        kref_init(&ctrl->ref);
        ctrl->subsys = subsys;
@@ -928,6 +925,8 @@ struct nvmet_subsys *nvmet_subsys_alloc(const char *subsysnqn,
                return NULL;
        subsys->ver = NVME_VS(1, 3, 0); /* NVMe 1.3.0 */
+        /* generate a random serial number as our controllers are ephemeral: */
+        get_random_bytes(&subsys->serial, sizeof(subsys->serial));
        switch (type) {
        case NVME_NQN_NVME:
diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
index 1e6dcc241b3c..d5801c150b1c 100644
--- a/drivers/nvme/target/fc.c
+++ b/drivers/nvme/target/fc.c
@@ -1174,14 +1174,14 @@ nvmet_fc_ls_create_association(struct nvmet_fc_tgtport *tgtport,
         */
        if (iod->rqstdatalen < FCNVME_LSDESC_CRA_RQST_MINLEN)
                ret = VERR_CR_ASSOC_LEN;
-        else if (rqst->desc_list_len <
+        else if (be32_to_cpu(rqst->desc_list_len) <
-                        cpu_to_be32(FCNVME_LSDESC_CRA_RQST_MIN_LISTLEN))
+                        FCNVME_LSDESC_CRA_RQST_MIN_LISTLEN)
                ret = VERR_CR_ASSOC_RQST_LEN;
        else if (rqst->assoc_cmd.desc_tag !=
                        cpu_to_be32(FCNVME_LSDESC_CREATE_ASSOC_CMD))
                ret = VERR_CR_ASSOC_CMD;
-        else if (rqst->assoc_cmd.desc_len <
+        else if (be32_to_cpu(rqst->assoc_cmd.desc_len) <
-                        cpu_to_be32(FCNVME_LSDESC_CRA_CMD_DESC_MIN_DESCLEN))
+                        FCNVME_LSDESC_CRA_CMD_DESC_MIN_DESCLEN)
                ret = VERR_CR_ASSOC_CMD_LEN;
        else if (!rqst->assoc_cmd.ersp_ratio ||
                 (be16_to_cpu(rqst->assoc_cmd.ersp_ratio) >=
diff --git a/drivers/nvme/target/nvmet.h b/drivers/nvme/target/nvmet.h
index 747bbdb4f9c6..e3b244c7e443 100644
--- a/drivers/nvme/target/nvmet.h
+++ b/drivers/nvme/target/nvmet.h
@@ -112,7 +112,6 @@ struct nvmet_ctrl {
        struct mutex            lock;
        u64                     cap;
-        u64                     serial;
        u32                     cc;
        u32                     csts;
@@ -152,6 +151,7 @@ struct nvmet_subsys {
        u16                     max_qid;
        u64                     ver;
+        u64                     serial;
        char                    *subsysnqn;
        struct config_group     group;
diff --git a/drivers/nvmem/rockchip-efuse.c b/drivers/nvmem/rockchip-efuse.c
index a0d4ede9b8fc..63e3eb55f3ac 100644
--- a/drivers/nvmem/rockchip-efuse.c
+++ b/drivers/nvmem/rockchip-efuse.c
@@ -170,7 +170,7 @@ static const struct of_device_id rockchip_efuse_match[] = {
                .data = (void *)&rockchip_rk3288_efuse_read,
        },
        {
-                .compatible = "rockchip,rk322x-efuse",
+                .compatible = "rockchip,rk3228-efuse",
                .data = (void *)&rockchip_rk3288_efuse_read,
        },
        {
diff --git a/drivers/scsi/cxlflash/main.c b/drivers/scsi/cxlflash/main.c
index 077f62e208aa..6a4367cc9caa 100644
--- a/drivers/scsi/cxlflash/main.c
+++ b/drivers/scsi/cxlflash/main.c
@@ -3401,9 +3401,10 @@ static int cxlflash_afu_debug(struct cxlflash_cfg *cfg,
                if (is_write) {
                        req_flags |= SISL_REQ_FLAGS_HOST_WRITE;
-                        rc = copy_from_user(kbuf, ubuf, ulen);
+                        if (copy_from_user(kbuf, ubuf, ulen)) {
-                        if (unlikely(rc))
+                                rc = -EFAULT;
                                goto out;
+                        }
                }
        }
@@ -3431,8 +3432,10 @@ static int cxlflash_afu_debug(struct cxlflash_cfg *cfg,
                goto out;
        }
-        if (ulen && !is_write)
+        if (ulen && !is_write) {
-                rc = copy_to_user(ubuf, kbuf, ulen);
+                if (copy_to_user(ubuf, kbuf, ulen))
+                        rc = -EFAULT;
+        }
 out:
        kfree(buf);
        dev_dbg(dev, "%s: returning rc=%d\n", __func__, rc);
diff --git a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c
index 551d103c27f1..2bfea7082e3a 100644
--- a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c
+++ b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c
@@ -1693,7 +1693,7 @@ static int prep_ssp_v2_hw(struct hisi_hba *hisi_hba,
 static int parse_trans_tx_err_code_v2_hw(u32 err_msk)
 {
-        const u8 trans_tx_err_code_prio[] = {
+        static const u8 trans_tx_err_code_prio[] = {
                TRANS_TX_OPEN_FAIL_WITH_IT_NEXUS_LOSS,
                TRANS_TX_ERR_PHY_NOT_ENABLE,
                TRANS_TX_OPEN_CNX_ERR_WRONG_DESTINATION,
@@ -1738,7 +1738,7 @@ static int parse_trans_tx_err_code_v2_hw(u32 err_msk)
 static int parse_trans_rx_err_code_v2_hw(u32 err_msk)
 {
-        const u8 trans_rx_err_code_prio[] = {
+        static const u8 trans_rx_err_code_prio[] = {
                TRANS_RX_ERR_WITH_RXFRAME_CRC_ERR,
                TRANS_RX_ERR_WITH_RXFIS_8B10B_DISP_ERR,
                TRANS_RX_ERR_WITH_RXFRAME_HAVE_ERRPRM,
@@ -1784,7 +1784,7 @@ static int parse_trans_rx_err_code_v2_hw(u32 err_msk)
 static int parse_dma_tx_err_code_v2_hw(u32 err_msk)
 {
-        const u8 dma_tx_err_code_prio[] = {
+        static const u8 dma_tx_err_code_prio[] = {
                DMA_TX_UNEXP_XFER_ERR,
                DMA_TX_UNEXP_RETRANS_ERR,
                DMA_TX_XFER_LEN_OVERFLOW,
@@ -1810,7 +1810,7 @@ static int parse_dma_tx_err_code_v2_hw(u32 err_msk)
 static int parse_sipc_rx_err_code_v2_hw(u32 err_msk)
 {
-        const u8 sipc_rx_err_code_prio[] = {
+        static const u8 sipc_rx_err_code_prio[] = {
                SIPC_RX_FIS_STATUS_ERR_BIT_VLD,
                SIPC_RX_PIO_WRSETUP_STATUS_DRQ_ERR,
                SIPC_RX_FIS_STATUS_BSY_BIT_ERR,
@@ -1836,7 +1836,7 @@ static int parse_sipc_rx_err_code_v2_hw(u32 err_msk)
 static int parse_dma_rx_err_code_v2_hw(u32 err_msk)
 {
-        const u8 dma_rx_err_code_prio[] = {
+        static const u8 dma_rx_err_code_prio[] = {
                DMA_RX_UNKNOWN_FRM_ERR,
                DMA_RX_DATA_LEN_OVERFLOW,
                DMA_RX_DATA_LEN_UNDERFLOW,
diff --git a/drivers/scsi/isci/request.c b/drivers/scsi/isci/request.c
index 47f66e949745..ed197bc8e801 100644
--- a/drivers/scsi/isci/request.c
+++ b/drivers/scsi/isci/request.c
@@ -213,7 +213,7 @@ static void sci_task_request_build_ssp_task_iu(struct isci_request *ireq)
 * @task_context:
 *
 */
-static void scu_ssp_reqeust_construct_task_context(
+static void scu_ssp_request_construct_task_context(
        struct isci_request *ireq,
        struct scu_task_context *task_context)
 {
@@ -425,7 +425,7 @@ static void scu_ssp_io_request_construct_task_context(struct isci_request *ireq,
        u8 prot_type = scsi_get_prot_type(scmd);
        u8 prot_op = scsi_get_prot_op(scmd);
-        scu_ssp_reqeust_construct_task_context(ireq, task_context);
+        scu_ssp_request_construct_task_context(ireq, task_context);
        task_context->ssp_command_iu_length =
                sizeof(struct ssp_cmd_iu) / sizeof(u32);
@@ -472,7 +472,7 @@ static void scu_ssp_task_request_construct_task_context(struct isci_request *ire
 {
        struct scu_task_context *task_context = ireq->tc;
-        scu_ssp_reqeust_construct_task_context(ireq, task_context);
+        scu_ssp_request_construct_task_context(ireq, task_context);
        task_context->control_frame                = 1;
        task_context->priority                     = SCU_TASK_PRIORITY_HIGH;
@@ -495,7 +495,7 @@ static void scu_ssp_task_request_construct_task_context(struct isci_request *ire
 * the command buffer is complete. none Revisit task context construction to
 * determine what is common for SSP/SMP/STP task context structures.
 */
-static void scu_sata_reqeust_construct_task_context(
+static void scu_sata_request_construct_task_context(
        struct isci_request *ireq,
        struct scu_task_context *task_context)
 {
@@ -562,7 +562,7 @@ static void scu_stp_raw_request_construct_task_context(struct isci_request *ireq
 {
        struct scu_task_context *task_context = ireq->tc;
-        scu_sata_reqeust_construct_task_context(ireq, task_context);
+        scu_sata_request_construct_task_context(ireq, task_context);
        task_context->control_frame         = 0;
        task_context->priority              = SCU_TASK_PRIORITY_NORMAL;
@@ -613,7 +613,7 @@ static void sci_stp_optimized_request_construct(struct isci_request *ireq,
        struct scu_task_context *task_context = ireq->tc;
        /* Build the STP task context structure */
-        scu_sata_reqeust_construct_task_context(ireq, task_context);
+        scu_sata_request_construct_task_context(ireq, task_context);
        /* Copy over the SGL elements */
        sci_request_build_sgl(ireq);
@@ -1401,7 +1401,7 @@ static enum sci_status sci_stp_request_pio_data_out_transmit_data(struct isci_re
 * @data_buffer: The buffer of data to be copied.
 * @length: The length of the data transfer.
 *
- * Copy the data from the buffer for the length specified to the IO reqeust SGL
+ * Copy the data from the buffer for the length specified to the IO request SGL
 * specified data region. enum sci_status
 */
 static enum sci_status
diff --git a/drivers/scsi/libfc/fc_disc.c b/drivers/scsi/libfc/fc_disc.c
index fd501f8dbb11..8660f923ace0 100644
--- a/drivers/scsi/libfc/fc_disc.c
+++ b/drivers/scsi/libfc/fc_disc.c
@@ -573,7 +573,7 @@ static void fc_disc_gpn_ft_resp(struct fc_seq *sp, struct fc_frame *fp,
                event = DISC_EV_FAILED;
        }
        if (error)
-                fc_disc_error(disc, fp);
+                fc_disc_error(disc, ERR_PTR(error));
        else if (event != DISC_EV_NONE)
                fc_disc_done(disc, event);
        fc_frame_free(fp);
diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c
index b58bba4604e8..7786c97e033f 100644
--- a/drivers/scsi/qedf/qedf_main.c
+++ b/drivers/scsi/qedf/qedf_main.c
@@ -1227,7 +1227,7 @@ static void qedf_rport_event_handler(struct fc_lport *lport,
                if (rdata->spp_type != FC_TYPE_FCP) {
                        QEDF_INFO(&(qedf->dbg_ctx), QEDF_LOG_DISC,
-                            "Not offlading since since spp type isn't FCP\n");
+                            "Not offloading since spp type isn't FCP\n");
                        break;
                }
                if (!(rdata->ids.roles & FC_RPORT_ROLE_FCP_TARGET)) {
diff --git a/drivers/scsi/qedi/qedi.h b/drivers/scsi/qedi/qedi.h
index 32632c9b2276..91d2f51c351b 100644
--- a/drivers/scsi/qedi/qedi.h
+++ b/drivers/scsi/qedi/qedi.h
@@ -23,11 +23,17 @@
 #include <linux/qed/qed_iscsi_if.h>
 #include <linux/qed/qed_ll2_if.h>
 #include "qedi_version.h"
+#include "qedi_nvm_iscsi_cfg.h"
 #define QEDI_MODULE_NAME                "qedi"
 struct qedi_endpoint;
+#ifndef GET_FIELD2
+#define GET_FIELD2(value, name) \
+        (((value) & (name ## _MASK)) >> (name ## _OFFSET))
+#endif
 /*
 * PCI function probe defines
 */
@@ -66,6 +72,11 @@ struct qedi_endpoint;
 #define QEDI_HW_DMA_BOUNDARY    0xfff
 #define QEDI_PATH_HANDLE        0xFE0000000UL
+enum qedi_nvm_tgts {
+        QEDI_NVM_TGT_PRI,
+        QEDI_NVM_TGT_SEC,
+};
 struct qedi_uio_ctrl {
        /* meta data */
        u32 uio_hsi_version;
@@ -283,6 +294,8 @@ struct qedi_ctx {
        void *bdq_pbl_list;
        dma_addr_t bdq_pbl_list_dma;
        u8 bdq_pbl_list_num_entries;
+        struct nvm_iscsi_cfg *iscsi_cfg;
+        dma_addr_t nvm_buf_dma;
        void __iomem *bdq_primary_prod;
        void __iomem *bdq_secondary_prod;
        u16 bdq_prod_idx;
@@ -337,6 +350,10 @@ struct qedi_ctx {
        bool use_fast_sge;
        atomic_t num_offloads;
+#define SYSFS_FLAG_FW_SEL_BOOT 2
+#define IPV6_LEN        41
+#define IPV4_LEN        17
+        struct iscsi_boot_kset *boot_kset;
 };
 struct qedi_work {
diff --git a/drivers/scsi/qedi/qedi_fw.c b/drivers/scsi/qedi/qedi_fw.c
index 19254bd739d9..93d54acd4a22 100644
--- a/drivers/scsi/qedi/qedi_fw.c
+++ b/drivers/scsi/qedi/qedi_fw.c
@@ -1411,7 +1411,7 @@ static void qedi_tmf_work(struct work_struct *work)
        list_work = kzalloc(sizeof(*list_work), GFP_ATOMIC);
        if (!list_work) {
-                QEDI_ERR(&qedi->dbg_ctx, "Memory alloction failed\n");
+                QEDI_ERR(&qedi->dbg_ctx, "Memory allocation failed\n");
                goto abort_ret;
        }
diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
index 5f5a4ef2e529..2c3783684815 100644
--- a/drivers/scsi/qedi/qedi_main.c
+++ b/drivers/scsi/qedi/qedi_main.c
@@ -19,6 +19,7 @@
 #include <linux/mm.h>
 #include <linux/if_vlan.h>
 #include <linux/cpu.h>
+#include <linux/iscsi_boot_sysfs.h>
 #include <scsi/scsi_cmnd.h>
 #include <scsi/scsi_device.h>
@@ -1143,6 +1144,30 @@ exit_setup_int:
        return rc;
 }
+static void qedi_free_nvm_iscsi_cfg(struct qedi_ctx *qedi)
+{
+        if (qedi->iscsi_cfg)
+                dma_free_coherent(&qedi->pdev->dev,
+                                  sizeof(struct nvm_iscsi_cfg),
+                                  qedi->iscsi_cfg, qedi->nvm_buf_dma);
+}
+static int qedi_alloc_nvm_iscsi_cfg(struct qedi_ctx *qedi)
+{
+        qedi->iscsi_cfg = dma_zalloc_coherent(&qedi->pdev->dev,
+                                             sizeof(struct nvm_iscsi_cfg),
+                                             &qedi->nvm_buf_dma, GFP_KERNEL);
+        if (!qedi->iscsi_cfg) {
+                QEDI_ERR(&qedi->dbg_ctx, "Could not allocate NVM BUF.\n");
+                return -ENOMEM;
+        }
+        QEDI_INFO(&qedi->dbg_ctx, QEDI_LOG_INFO,
+                  "NVM BUF addr=0x%p dma=0x%llx.\n", qedi->iscsi_cfg,
+                  qedi->nvm_buf_dma);
+        return 0;
+}
 static void qedi_free_bdq(struct qedi_ctx *qedi)
 {
        int i;
@@ -1183,6 +1208,7 @@ static void qedi_free_global_queues(struct qedi_ctx *qedi)
                kfree(gl[i]);
        }
        qedi_free_bdq(qedi);
+        qedi_free_nvm_iscsi_cfg(qedi);
 }
 static int qedi_alloc_bdq(struct qedi_ctx *qedi)
@@ -1309,6 +1335,11 @@ static int qedi_alloc_global_queues(struct qedi_ctx *qedi)
        if (rc)
                goto mem_alloc_failure;
+        /* Allocate DMA coherent buffers for NVM_ISCSI_CFG */
+        rc = qedi_alloc_nvm_iscsi_cfg(qedi);
+        if (rc)
+                goto mem_alloc_failure;
        /* Allocate a CQ and an associated PBL for each MSI-X
         * vector.
         */
@@ -1671,6 +1702,387 @@ void qedi_reset_host_mtu(struct qedi_ctx *qedi, u16 mtu)
        qedi_ops->ll2->start(qedi->cdev, &params);
 }
+/**
+ * qedi_get_nvram_block: - Scan through the iSCSI NVRAM block (while accounting
+ * for gaps) for the matching absolute-pf-id of the QEDI device.
+ */
+static struct nvm_iscsi_block *
+qedi_get_nvram_block(struct qedi_ctx *qedi)
+{
+        int i;
+        u8 pf;
+        u32 flags;
+        struct nvm_iscsi_block *block;
+        pf = qedi->dev_info.common.abs_pf_id;
+        block = &qedi->iscsi_cfg->block[0];
+        for (i = 0; i < NUM_OF_ISCSI_PF_SUPPORTED; i++, block++) {
+                flags = ((block->id) & NVM_ISCSI_CFG_BLK_CTRL_FLAG_MASK) >>
+                        NVM_ISCSI_CFG_BLK_CTRL_FLAG_OFFSET;
+                if (flags & (NVM_ISCSI_CFG_BLK_CTRL_FLAG_IS_NOT_EMPTY |
+                                NVM_ISCSI_CFG_BLK_CTRL_FLAG_PF_MAPPED) &&
+                        (pf == (block->id & NVM_ISCSI_CFG_BLK_MAPPED_PF_ID_MASK)
+                                >> NVM_ISCSI_CFG_BLK_MAPPED_PF_ID_OFFSET))
+                        return block;
+        }
+        return NULL;
+}
+static ssize_t qedi_show_boot_eth_info(void *data, int type, char *buf)
+{
+        struct qedi_ctx *qedi = data;
+        struct nvm_iscsi_initiator *initiator;
+        char *str = buf;
+        int rc = 1;
+        u32 ipv6_en, dhcp_en, ip_len;
+        struct nvm_iscsi_block *block;
+        char *fmt, *ip, *sub, *gw;
+        block = qedi_get_nvram_block(qedi);
+        if (!block)
+                return 0;
+        initiator = &block->initiator;
+        ipv6_en = block->generic.ctrl_flags &
+                  NVM_ISCSI_CFG_GEN_IPV6_ENABLED;
+        dhcp_en = block->generic.ctrl_flags &
+                  NVM_ISCSI_CFG_GEN_DHCP_TCPIP_CONFIG_ENABLED;
+        /* Static IP assignments. */
+        fmt = ipv6_en ? "%pI6\n" : "%pI4\n";
+        ip = ipv6_en ? initiator->ipv6.addr.byte : initiator->ipv4.addr.byte;
+        ip_len = ipv6_en ? IPV6_LEN : IPV4_LEN;
+        sub = ipv6_en ? initiator->ipv6.subnet_mask.byte :
+              initiator->ipv4.subnet_mask.byte;
+        gw = ipv6_en ? initiator->ipv6.gateway.byte :
+             initiator->ipv4.gateway.byte;
+        /* DHCP IP adjustments. */
+        fmt = dhcp_en ? "%s\n" : fmt;
+        if (dhcp_en) {
+                ip = ipv6_en ? "0::0" : "0.0.0.0";
+                sub = ip;
+                gw = ip;
+                ip_len = ipv6_en ? 5 : 8;
+        }
+        switch (type) {
+        case ISCSI_BOOT_ETH_IP_ADDR:
+                rc = snprintf(str, ip_len, fmt, ip);
+                break;
+        case ISCSI_BOOT_ETH_SUBNET_MASK:
+                rc = snprintf(str, ip_len, fmt, sub);
+                break;
+        case ISCSI_BOOT_ETH_GATEWAY:
+                rc = snprintf(str, ip_len, fmt, gw);
+                break;
+        case ISCSI_BOOT_ETH_FLAGS:
+                rc = snprintf(str, 3, "%hhd\n",
+                              SYSFS_FLAG_FW_SEL_BOOT);
+                break;
+        case ISCSI_BOOT_ETH_INDEX:
+                rc = snprintf(str, 3, "0\n");
+                break;
+        case ISCSI_BOOT_ETH_MAC:
+                rc = sysfs_format_mac(str, qedi->mac, ETH_ALEN);
+                break;
+        case ISCSI_BOOT_ETH_VLAN:
+                rc = snprintf(str, 12, "%d\n",
+                              GET_FIELD2(initiator->generic_cont0,
+                                         NVM_ISCSI_CFG_INITIATOR_VLAN));
+                break;
+        case ISCSI_BOOT_ETH_ORIGIN:
+                if (dhcp_en)
+                        rc = snprintf(str, 3, "3\n");
+                break;
+        default:
+                rc = 0;
+                break;
+        }
+        return rc;
+}
+static umode_t qedi_eth_get_attr_visibility(void *data, int type)
+{
+        int rc = 1;
+        switch (type) {
+        case ISCSI_BOOT_ETH_FLAGS:
+        case ISCSI_BOOT_ETH_MAC:
+        case ISCSI_BOOT_ETH_INDEX:
+        case ISCSI_BOOT_ETH_IP_ADDR:
+        case ISCSI_BOOT_ETH_SUBNET_MASK:
+        case ISCSI_BOOT_ETH_GATEWAY:
+        case ISCSI_BOOT_ETH_ORIGIN:
+        case ISCSI_BOOT_ETH_VLAN:
+                rc = 0444;
+                break;
+        default:
+                rc = 0;
+                break;
+        }
+        return rc;
+}
+static ssize_t qedi_show_boot_ini_info(void *data, int type, char *buf)
+{
+        struct qedi_ctx *qedi = data;
+        struct nvm_iscsi_initiator *initiator;
+        char *str = buf;
+        int rc;
+        struct nvm_iscsi_block *block;
+        block = qedi_get_nvram_block(qedi);
+        if (!block)
+                return 0;
+        initiator = &block->initiator;
+        switch (type) {
+        case ISCSI_BOOT_INI_INITIATOR_NAME:
+                rc = snprintf(str, NVM_ISCSI_CFG_ISCSI_NAME_MAX_LEN, "%s\n",
+                              initiator->initiator_name.byte);
+                break;
+        default:
+                rc = 0;
+                break;
+        }
+        return rc;
+}
+static umode_t qedi_ini_get_attr_visibility(void *data, int type)
+{
+        int rc;
+        switch (type) {
+        case ISCSI_BOOT_INI_INITIATOR_NAME:
+                rc = 0444;
+                break;
+        default:
+                rc = 0;
+                break;
+        }
+        return rc;
+}
+static ssize_t
+qedi_show_boot_tgt_info(struct qedi_ctx *qedi, int type,
+                        char *buf, enum qedi_nvm_tgts idx)
+{
+        char *str = buf;
+        int rc = 1;
+        u32 ctrl_flags, ipv6_en, chap_en, mchap_en, ip_len;
+        struct nvm_iscsi_block *block;
+        char *chap_name, *chap_secret;
+        char *mchap_name, *mchap_secret;
+        block = qedi_get_nvram_block(qedi);
+        if (!block)
+                goto exit_show_tgt_info;
+        QEDI_INFO(&qedi->dbg_ctx, QEDI_LOG_EVT,
+                  "Port:%d, tgt_idx:%d\n",
+                  GET_FIELD2(block->id, NVM_ISCSI_CFG_BLK_MAPPED_PF_ID), idx);
+        ctrl_flags = block->target[idx].ctrl_flags &
+                     NVM_ISCSI_CFG_TARGET_ENABLED;
+        if (!ctrl_flags) {
+                QEDI_INFO(&qedi->dbg_ctx, QEDI_LOG_EVT,
+                          "Target disabled\n");
+                goto exit_show_tgt_info;
+        }
+        ipv6_en = block->generic.ctrl_flags &
+                  NVM_ISCSI_CFG_GEN_IPV6_ENABLED;
+        ip_len = ipv6_en ? IPV6_LEN : IPV4_LEN;
+        chap_en = block->generic.ctrl_flags &
+                  NVM_ISCSI_CFG_GEN_CHAP_ENABLED;
+        chap_name = chap_en ? block->initiator.chap_name.byte : NULL;
+        chap_secret = chap_en ? block->initiator.chap_password.byte : NULL;
+        mchap_en = block->generic.ctrl_flags &
+                  NVM_ISCSI_CFG_GEN_CHAP_MUTUAL_ENABLED;
+        mchap_name = mchap_en ? block->target[idx].chap_name.byte : NULL;
+        mchap_secret = mchap_en ? block->target[idx].chap_password.byte : NULL;
+        switch (type) {
+        case ISCSI_BOOT_TGT_NAME:
+                rc = snprintf(str, NVM_ISCSI_CFG_ISCSI_NAME_MAX_LEN, "%s\n",
+                              block->target[idx].target_name.byte);
+                break;
+        case ISCSI_BOOT_TGT_IP_ADDR:
+                if (ipv6_en)
+                        rc = snprintf(str, ip_len, "%pI6\n",
+                                      block->target[idx].ipv6_addr.byte);
+                else
+                        rc = snprintf(str, ip_len, "%pI4\n",
+                                      block->target[idx].ipv4_addr.byte);
+                break;
+        case ISCSI_BOOT_TGT_PORT:
+                rc = snprintf(str, 12, "%d\n",
+                              GET_FIELD2(block->target[idx].generic_cont0,
+                                         NVM_ISCSI_CFG_TARGET_TCP_PORT));
+                break;
+        case ISCSI_BOOT_TGT_LUN:
+                rc = snprintf(str, 22, "%.*d\n",
+                              block->target[idx].lun.value[1],
+                              block->target[idx].lun.value[0]);
+                break;
+        case ISCSI_BOOT_TGT_CHAP_NAME:
+                rc = snprintf(str, NVM_ISCSI_CFG_CHAP_NAME_MAX_LEN, "%s\n",
+                              chap_name);
+                break;
+        case ISCSI_BOOT_TGT_CHAP_SECRET:
+                rc = snprintf(str, NVM_ISCSI_CFG_CHAP_PWD_MAX_LEN, "%s\n",
+                              chap_secret);
+                break;
+        case ISCSI_BOOT_TGT_REV_CHAP_NAME:
+                rc = snprintf(str, NVM_ISCSI_CFG_CHAP_NAME_MAX_LEN, "%s\n",
+                              mchap_name);
+                break;
+        case ISCSI_BOOT_TGT_REV_CHAP_SECRET:
+                rc = snprintf(str, NVM_ISCSI_CFG_CHAP_PWD_MAX_LEN, "%s\n",
+                              mchap_secret);
+                break;
+        case ISCSI_BOOT_TGT_FLAGS:
+                rc = snprintf(str, 3, "%hhd\n", SYSFS_FLAG_FW_SEL_BOOT);
+                break;
+        case ISCSI_BOOT_TGT_NIC_ASSOC:
+                rc = snprintf(str, 3, "0\n");
+                break;
+        default:
+                rc = 0;
+                break;
+        }
+exit_show_tgt_info:
+        return rc;
+}
+static ssize_t qedi_show_boot_tgt_pri_info(void *data, int type, char *buf)
+{
+        struct qedi_ctx *qedi = data;
+        return qedi_show_boot_tgt_info(qedi, type, buf, QEDI_NVM_TGT_PRI);
+}
+static ssize_t qedi_show_boot_tgt_sec_info(void *data, int type, char *buf)
+{
+        struct qedi_ctx *qedi = data;
+        return qedi_show_boot_tgt_info(qedi, type, buf, QEDI_NVM_TGT_SEC);
+}
+static umode_t qedi_tgt_get_attr_visibility(void *data, int type)
+{
+        int rc;
+        switch (type) {
+        case ISCSI_BOOT_TGT_NAME:
+        case ISCSI_BOOT_TGT_IP_ADDR:
+        case ISCSI_BOOT_TGT_PORT:
+        case ISCSI_BOOT_TGT_LUN:
+        case ISCSI_BOOT_TGT_CHAP_NAME:
+        case ISCSI_BOOT_TGT_CHAP_SECRET:
+        case ISCSI_BOOT_TGT_REV_CHAP_NAME:
+        case ISCSI_BOOT_TGT_REV_CHAP_SECRET:
+        case ISCSI_BOOT_TGT_NIC_ASSOC:
+        case ISCSI_BOOT_TGT_FLAGS:
+                rc = 0444;
+                break;
+        default:
+                rc = 0;
+                break;
+        }
+        return rc;
+}
+static void qedi_boot_release(void *data)
+{
+        struct qedi_ctx *qedi = data;
+        scsi_host_put(qedi->shost);
+}
+static int qedi_get_boot_info(struct qedi_ctx *qedi)
+{
+        int ret = 1;
+        u16 len;
+        len = sizeof(struct nvm_iscsi_cfg);
+        QEDI_INFO(&qedi->dbg_ctx, QEDI_LOG_INFO,
+                  "Get NVM iSCSI CFG image\n");
+        ret = qedi_ops->common->nvm_get_image(qedi->cdev,
+                                              QED_NVM_IMAGE_ISCSI_CFG,
+                                              (char *)qedi->iscsi_cfg, len);
+        if (ret)
+                QEDI_ERR(&qedi->dbg_ctx,
+                         "Could not get NVM image. ret = %d\n", ret);
+        return ret;
+}
+static int qedi_setup_boot_info(struct qedi_ctx *qedi)
+{
+        struct iscsi_boot_kobj *boot_kobj;
+        if (qedi_get_boot_info(qedi))
+                return -EPERM;
+        qedi->boot_kset = iscsi_boot_create_host_kset(qedi->shost->host_no);
+        if (!qedi->boot_kset)
+                goto kset_free;
+        if (!scsi_host_get(qedi->shost))
+                goto kset_free;
+        boot_kobj = iscsi_boot_create_target(qedi->boot_kset, 0, qedi,
+                                             qedi_show_boot_tgt_pri_info,
+                                             qedi_tgt_get_attr_visibility,
+                                             qedi_boot_release);
+        if (!boot_kobj)
+                goto put_host;
+        if (!scsi_host_get(qedi->shost))
+                goto kset_free;
+        boot_kobj = iscsi_boot_create_target(qedi->boot_kset, 1, qedi,
+                                             qedi_show_boot_tgt_sec_info,
+                                             qedi_tgt_get_attr_visibility,
+                                             qedi_boot_release);
+        if (!boot_kobj)
+                goto put_host;
+        if (!scsi_host_get(qedi->shost))
+                goto kset_free;
+        boot_kobj = iscsi_boot_create_initiator(qedi->boot_kset, 0, qedi,
+                                                qedi_show_boot_ini_info,
+                                                qedi_ini_get_attr_visibility,
+                                                qedi_boot_release);
+        if (!boot_kobj)
+                goto put_host;
+        if (!scsi_host_get(qedi->shost))
+                goto kset_free;
+        boot_kobj = iscsi_boot_create_ethernet(qedi->boot_kset, 0, qedi,
+                                               qedi_show_boot_eth_info,
+                                               qedi_eth_get_attr_visibility,
+                                               qedi_boot_release);
+        if (!boot_kobj)
+                goto put_host;
+        return 0;
+put_host:
+        scsi_host_put(qedi->shost);
+kset_free:
+        iscsi_boot_destroy_kset(qedi->boot_kset);
+        return -ENOMEM;
+}
 static void __qedi_remove(struct pci_dev *pdev, int mode)
 {
        struct qedi_ctx *qedi = pci_get_drvdata(pdev);
@@ -1724,6 +2136,9 @@ static void __qedi_remove(struct pci_dev *pdev, int mode)
                        qedi->ll2_recv_thread = NULL;
                }
                qedi_ll2_free_skbs(qedi);
+                if (qedi->boot_kset)
+                        iscsi_boot_destroy_kset(qedi->boot_kset);
        }
 }
@@ -1967,6 +2382,10 @@ static int __qedi_probe(struct pci_dev *pdev, int mode)
                /* F/w needs 1st task context memory entry for performance */
                set_bit(QEDI_RESERVE_TASK_ID, qedi->task_idx_map);
                atomic_set(&qedi->num_offloads, 0);
+                if (qedi_setup_boot_info(qedi))
+                        QEDI_ERR(&qedi->dbg_ctx,
+                                 "No iSCSI boot target configured\n");
        }
        return 0;
diff --git a/drivers/scsi/qedi/qedi_nvm_iscsi_cfg.h b/drivers/scsi/qedi/qedi_nvm_iscsi_cfg.h
new file mode 100644
index 000000000000..df39b69b366d
--- /dev/null
+++ b/drivers/scsi/qedi/qedi_nvm_iscsi_cfg.h
@@ -0,0 +1,210 @@
+/*
+ * QLogic iSCSI Offload Driver
+ * Copyright (c) 2016 Cavium Inc.
+ *
+ * This software is available under the terms of the GNU General Public License
+ * (GPL) Version 2, available from the file COPYING in the main directory of
+ * this source tree.
+ */
+#ifndef NVM_ISCSI_CFG_H
+#define NVM_ISCSI_CFG_H
+#define NUM_OF_ISCSI_TARGET_PER_PF    4   /* Defined as per the
+                                           * ISCSI IBFT constraint
+                                           */
+#define NUM_OF_ISCSI_PF_SUPPORTED     4   /* One PF per Port -
+                                           * assuming 4 port card
+                                           */
+#define NVM_ISCSI_CFG_DHCP_NAME_MAX_LEN  256
+union nvm_iscsi_dhcp_vendor_id {
+        u32 value[NVM_ISCSI_CFG_DHCP_NAME_MAX_LEN / 4];
+        u8  byte[NVM_ISCSI_CFG_DHCP_NAME_MAX_LEN];
+};
+#define NVM_ISCSI_IPV4_ADDR_BYTE_LEN 4
+union nvm_iscsi_ipv4_addr {
+        u32 addr;
+        u8  byte[NVM_ISCSI_IPV4_ADDR_BYTE_LEN];
+};
+#define NVM_ISCSI_IPV6_ADDR_BYTE_LEN 16
+union nvm_iscsi_ipv6_addr {
+        u32 addr[4];
+        u8  byte[NVM_ISCSI_IPV6_ADDR_BYTE_LEN];
+};
+struct nvm_iscsi_initiator_ipv4 {
+        union nvm_iscsi_ipv4_addr addr;                         /* 0x0 */
+        union nvm_iscsi_ipv4_addr subnet_mask;                  /* 0x4 */
+        union nvm_iscsi_ipv4_addr gateway;                      /* 0x8 */
+        union nvm_iscsi_ipv4_addr primary_dns;                  /* 0xC */
+        union nvm_iscsi_ipv4_addr secondary_dns;                /* 0x10 */
+        union nvm_iscsi_ipv4_addr dhcp_addr;                    /* 0x14 */
+        union nvm_iscsi_ipv4_addr isns_server;                  /* 0x18 */
+        union nvm_iscsi_ipv4_addr slp_server;                   /* 0x1C */
+        union nvm_iscsi_ipv4_addr primay_radius_server;         /* 0x20 */
+        union nvm_iscsi_ipv4_addr secondary_radius_server;      /* 0x24 */
+        union nvm_iscsi_ipv4_addr rsvd[4];                      /* 0x28 */
+};
+struct nvm_iscsi_initiator_ipv6 {
+        union nvm_iscsi_ipv6_addr addr;                         /* 0x0 */
+        union nvm_iscsi_ipv6_addr subnet_mask;                  /* 0x10 */
+        union nvm_iscsi_ipv6_addr gateway;                      /* 0x20 */
+        union nvm_iscsi_ipv6_addr primary_dns;                  /* 0x30 */
+        union nvm_iscsi_ipv6_addr secondary_dns;                /* 0x40 */
+        union nvm_iscsi_ipv6_addr dhcp_addr;                    /* 0x50 */
+        union nvm_iscsi_ipv6_addr isns_server;                  /* 0x60 */
+        union nvm_iscsi_ipv6_addr slp_server;                   /* 0x70 */
+        union nvm_iscsi_ipv6_addr primay_radius_server;         /* 0x80 */
+        union nvm_iscsi_ipv6_addr secondary_radius_server;      /* 0x90 */
+        union nvm_iscsi_ipv6_addr rsvd[3];                      /* 0xA0 */
+        u32   config;                                           /* 0xD0 */
+#define NVM_ISCSI_CFG_INITIATOR_IPV6_SUBNET_MASK_PREFIX_MASK      0x000000FF
+#define NVM_ISCSI_CFG_INITIATOR_IPV6_SUBNET_MASK_PREFIX_OFFSET    0
+        u32   rsvd_1[3];
+};
+#define NVM_ISCSI_CFG_ISCSI_NAME_MAX_LEN  256
+union nvm_iscsi_name {
+        u32 value[NVM_ISCSI_CFG_ISCSI_NAME_MAX_LEN / 4];
+        u8  byte[NVM_ISCSI_CFG_ISCSI_NAME_MAX_LEN];
+};
+#define NVM_ISCSI_CFG_CHAP_NAME_MAX_LEN  256
+union nvm_iscsi_chap_name {
+        u32 value[NVM_ISCSI_CFG_CHAP_NAME_MAX_LEN / 4];
+        u8  byte[NVM_ISCSI_CFG_CHAP_NAME_MAX_LEN];
+};
+#define NVM_ISCSI_CFG_CHAP_PWD_MAX_LEN  16 /* md5 need per RFC1996
+                                            * is 16 octets
+                                            */
+union nvm_iscsi_chap_password {
+        u32 value[NVM_ISCSI_CFG_CHAP_PWD_MAX_LEN / 4];
+        u8 byte[NVM_ISCSI_CFG_CHAP_PWD_MAX_LEN];
+};
+union nvm_iscsi_lun {
+        u8  byte[8];
+        u32 value[2];
+};
+struct nvm_iscsi_generic {
+        u32 ctrl_flags;                                         /* 0x0 */
+#define NVM_ISCSI_CFG_GEN_CHAP_ENABLED                 BIT(0)
+#define NVM_ISCSI_CFG_GEN_DHCP_TCPIP_CONFIG_ENABLED    BIT(1)
+#define NVM_ISCSI_CFG_GEN_DHCP_ISCSI_CONFIG_ENABLED    BIT(2)
+#define NVM_ISCSI_CFG_GEN_IPV6_ENABLED                 BIT(3)
+#define NVM_ISCSI_CFG_GEN_IPV4_FALLBACK_ENABLED        BIT(4)
+#define NVM_ISCSI_CFG_GEN_ISNS_WORLD_LOGIN             BIT(5)
+#define NVM_ISCSI_CFG_GEN_ISNS_SELECTIVE_LOGIN         BIT(6)
+#define NVM_ISCSI_CFG_GEN_ADDR_REDIRECT_ENABLED        BIT(7)
+#define NVM_ISCSI_CFG_GEN_CHAP_MUTUAL_ENABLED          BIT(8)
+        u32 timeout;                                            /* 0x4 */
+#define NVM_ISCSI_CFG_GEN_DHCP_REQUEST_TIMEOUT_MASK       0x0000FFFF
+#define NVM_ISCSI_CFG_GEN_DHCP_REQUEST_TIMEOUT_OFFSET     0
+#define NVM_ISCSI_CFG_GEN_PORT_LOGIN_TIMEOUT_MASK         0xFFFF0000
+#define NVM_ISCSI_CFG_GEN_PORT_LOGIN_TIMEOUT_OFFSET       16
+        union nvm_iscsi_dhcp_vendor_id  dhcp_vendor_id;         /* 0x8  */
+        u32 rsvd[62];                                           /* 0x108 */
+};
+struct nvm_iscsi_initiator {
+        struct nvm_iscsi_initiator_ipv4 ipv4;                   /* 0x0 */
+        struct nvm_iscsi_initiator_ipv6 ipv6;                   /* 0x38 */
+        union nvm_iscsi_name           initiator_name;          /* 0x118 */
+        union nvm_iscsi_chap_name      chap_name;               /* 0x218 */
+        union nvm_iscsi_chap_password  chap_password;           /* 0x318 */
+        u32 generic_cont0;                                      /* 0x398 */
+#define NVM_ISCSI_CFG_INITIATOR_VLAN_MASK               0x0000FFFF
+#define NVM_ISCSI_CFG_INITIATOR_VLAN_OFFSET             0
+#define NVM_ISCSI_CFG_INITIATOR_IP_VERSION_MASK         0x00030000
+#define NVM_ISCSI_CFG_INITIATOR_IP_VERSION_OFFSET       16
+#define NVM_ISCSI_CFG_INITIATOR_IP_VERSION_4            1
+#define NVM_ISCSI_CFG_INITIATOR_IP_VERSION_6            2
+#define NVM_ISCSI_CFG_INITIATOR_IP_VERSION_4_AND_6      3
+        u32 ctrl_flags;
+#define NVM_ISCSI_CFG_INITIATOR_IP_VERSION_PRIORITY_V6     BIT(0)
+#define NVM_ISCSI_CFG_INITIATOR_VLAN_ENABLED               BIT(1)
+        u32 rsvd[116];                                          /* 0x32C */
+};
+struct nvm_iscsi_target {
+        u32 ctrl_flags;                                         /* 0x0 */
+#define NVM_ISCSI_CFG_TARGET_ENABLED            BIT(0)
+#define NVM_ISCSI_CFG_BOOT_TIME_LOGIN_STATUS    BIT(1)
+        u32 generic_cont0;                                      /* 0x4 */
+#define NVM_ISCSI_CFG_TARGET_TCP_PORT_MASK      0x0000FFFF
+#define NVM_ISCSI_CFG_TARGET_TCP_PORT_OFFSET    0
+        u32 ip_ver;
+#define NVM_ISCSI_CFG_IPv4       4
+#define NVM_ISCSI_CFG_IPv6       6
+        u32 rsvd_1[7];                                          /* 0x24 */
+        union nvm_iscsi_ipv4_addr ipv4_addr;                    /* 0x28 */
+        union nvm_iscsi_ipv6_addr ipv6_addr;                    /* 0x2C */
+        union nvm_iscsi_lun lun;                                /* 0x3C */
+        union nvm_iscsi_name           target_name;             /* 0x44 */
+        union nvm_iscsi_chap_name      chap_name;               /* 0x144 */
+        union nvm_iscsi_chap_password  chap_password;           /* 0x244 */
+        u32 rsvd_2[107];                                        /* 0x2C4 */
+};
+struct nvm_iscsi_block {
+        u32 id;                                                 /* 0x0 */
+#define NVM_ISCSI_CFG_BLK_MAPPED_PF_ID_MASK         0x0000000F
+#define NVM_ISCSI_CFG_BLK_MAPPED_PF_ID_OFFSET       0
+#define NVM_ISCSI_CFG_BLK_CTRL_FLAG_MASK            0x00000FF0
+#define NVM_ISCSI_CFG_BLK_CTRL_FLAG_OFFSET          4
+#define NVM_ISCSI_CFG_BLK_CTRL_FLAG_IS_NOT_EMPTY    BIT(0)
+#define NVM_ISCSI_CFG_BLK_CTRL_FLAG_PF_MAPPED       BIT(1)
+        u32 rsvd_1[5];                                          /* 0x4 */
+        struct nvm_iscsi_generic     generic;                   /* 0x18 */
+        struct nvm_iscsi_initiator   initiator;                 /* 0x218 */
+        struct nvm_iscsi_target      target[NUM_OF_ISCSI_TARGET_PER_PF];
+                                                                /* 0x718 */
+        u32 rsvd_2[58];                                         /* 0x1718 */
+        /* total size - 0x1800 - 6K block */
+};
+struct nvm_iscsi_cfg {
+        u32 id;                                                 /* 0x0 */
+#define NVM_ISCSI_CFG_BLK_VERSION_MINOR_MASK     0x000000FF
+#define NVM_ISCSI_CFG_BLK_VERSION_MAJOR_MASK     0x0000FF00
+#define NVM_ISCSI_CFG_BLK_SIGNATURE_MASK         0xFFFF0000
+#define NVM_ISCSI_CFG_BLK_SIGNATURE              0x49430000 /* IC - Iscsi
+                                                             * Config
+                                                             */
+#define NVM_ISCSI_CFG_BLK_VERSION_MAJOR          0
+#define NVM_ISCSI_CFG_BLK_VERSION_MINOR          10
+#define NVM_ISCSI_CFG_BLK_VERSION ((NVM_ISCSI_CFG_BLK_VERSION_MAJOR << 8) | \
+                                   NVM_ISCSI_CFG_BLK_VERSION_MINOR)
+        struct nvm_iscsi_block  block[NUM_OF_ISCSI_PF_SUPPORTED]; /* 0x4 */
+};
+#endif
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index c2dc836dc484..e101cd3043b9 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -3727,7 +3727,7 @@ static struct qla_tgt_cmd *qlt_ctio_to_cmd(struct scsi_qla_host *vha,
        h &= QLA_CMD_HANDLE_MASK;
        if (h != QLA_TGT_NULL_HANDLE) {
-                if (unlikely(h > req->num_outstanding_cmds)) {
+                if (unlikely(h >= req->num_outstanding_cmds)) {
                        ql_dbg(ql_dbg_tgt, vha, 0xe052,
                            "qla_target(%d): Wrong handle %x received\n",
                            vha->vp_idx, handle);
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 21225d62b0c1..1e82d4128a84 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -758,8 +758,11 @@ static bool sg_is_valid_dxfer(sg_io_hdr_t *hp)
                if (hp->dxferp || hp->dxfer_len > 0)
                        return false;
                return true;
-        case SG_DXFER_TO_DEV:
        case SG_DXFER_FROM_DEV:
+                if (hp->dxfer_len < 0)
+                        return false;
+                return true;
+        case SG_DXFER_TO_DEV:
        case SG_DXFER_TO_FROM_DEV:
                if (!hp->dxferp || hp->dxfer_len == 0)
                        return false;
diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c
index 8b93197daefe..9be211d68b15 100644
--- a/drivers/scsi/virtio_scsi.c
+++ b/drivers/scsi/virtio_scsi.c
@@ -837,6 +837,7 @@ static struct scsi_host_template virtscsi_host_template_multi = {
        .eh_abort_handler = virtscsi_abort,
        .eh_device_reset_handler = virtscsi_device_reset,
        .eh_timed_out = virtscsi_eh_timed_out,
+        .slave_alloc = virtscsi_device_alloc,
        .can_queue = 1024,
        .dma_boundary = UINT_MAX,
diff --git a/drivers/spmi/spmi-pmic-arb.c b/drivers/spmi/spmi-pmic-arb.c
index 2afe3597982e..f4b7a98a7913 100644
--- a/drivers/spmi/spmi-pmic-arb.c
+++ b/drivers/spmi/spmi-pmic-arb.c
@@ -134,7 +134,6 @@ struct apid_data {
 * @spmic:              SPMI controller object
 * @ver_ops:            version dependent operations.
 * @ppid_to_apid        in-memory copy of PPID -> channel (APID) mapping table.
- *                      v2 only.
 */
 struct spmi_pmic_arb {
        void __iomem            *rd_base;
@@ -1016,6 +1015,13 @@ static int spmi_pmic_arb_probe(struct platform_device *pdev)
                goto err_put_ctrl;
        }
+        pa->ppid_to_apid = devm_kcalloc(&ctrl->dev, PMIC_ARB_MAX_PPID,
+                                        sizeof(*pa->ppid_to_apid), GFP_KERNEL);
+        if (!pa->ppid_to_apid) {
+                err = -ENOMEM;
+                goto err_put_ctrl;
+        }
        hw_ver = readl_relaxed(core + PMIC_ARB_VERSION);
        if (hw_ver < PMIC_ARB_VERSION_V2_MIN) {
@@ -1048,15 +1054,6 @@ static int spmi_pmic_arb_probe(struct platform_device *pdev)
                        err = PTR_ERR(pa->wr_base);
                        goto err_put_ctrl;
                }
-                pa->ppid_to_apid = devm_kcalloc(&ctrl->dev,
-                                                PMIC_ARB_MAX_PPID,
-                                                sizeof(*pa->ppid_to_apid),
-                                                GFP_KERNEL);
-                if (!pa->ppid_to_apid) {
-                        err = -ENOMEM;
-                        goto err_put_ctrl;
-                }
        }
        dev_info(&ctrl->dev, "PMIC arbiter version %s (0x%x)\n",
diff --git a/drivers/spmi/spmi.c b/drivers/spmi/spmi.c
index 2b9b0941d9eb..6d23226e5f69 100644
--- a/drivers/spmi/spmi.c
+++ b/drivers/spmi/spmi.c
@@ -365,11 +365,23 @@ static int spmi_drv_remove(struct device *dev)
        return 0;
 }
+static int spmi_drv_uevent(struct device *dev, struct kobj_uevent_env *env)
+{
+        int ret;
+        ret = of_device_uevent_modalias(dev, env);
+        if (ret != -ENODEV)
+                return ret;
+        return 0;
+}
 static struct bus_type spmi_bus_type = {
        .name           = "spmi",
        .match          = spmi_device_match,
        .probe          = spmi_drv_probe,
        .remove         = spmi_drv_remove,
+        .uevent         = spmi_drv_uevent,
 };
 /**
diff --git a/drivers/staging/Kconfig b/drivers/staging/Kconfig
index 268d4e6ef48a..ef28a1cb64ae 100644
--- a/drivers/staging/Kconfig
+++ b/drivers/staging/Kconfig
@@ -110,4 +110,6 @@ source "drivers/staging/ccree/Kconfig"
 source "drivers/staging/typec/Kconfig"
+source "drivers/staging/vboxvideo/Kconfig"
 endif # STAGING
diff --git a/drivers/staging/Makefile b/drivers/staging/Makefile
index b93e6f5f0f6e..2918580bdb9e 100644
--- a/drivers/staging/Makefile
+++ b/drivers/staging/Makefile
@@ -44,3 +44,4 @@ obj-$(CONFIG_KS7010)		+= ks7010/
 obj-$(CONFIG_GREYBUS)           += greybus/
 obj-$(CONFIG_BCM2835_VCHIQ)     += vc04_services/
 obj-$(CONFIG_CRYPTO_DEV_CCREE)  += ccree/
+obj-$(CONFIG_DRM_VBOXVIDEO)     += vboxvideo/
diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c
index b2e382888981..2f7bfc1c59e5 100644
--- a/drivers/staging/comedi/drivers/ni_mio_common.c
+++ b/drivers/staging/comedi/drivers/ni_mio_common.c
@@ -3116,8 +3116,7 @@ static void ni_ao_cmd_set_update(struct comedi_device *dev,
                /* following line: 2-1 per STC */
                ni_stc_writel(dev, 1, NISTC_AO_UI_LOADA_REG);
                ni_stc_writew(dev, NISTC_AO_CMD1_UI_LOAD, NISTC_AO_CMD1_REG);
-                /* following line: N-1 per STC */
+                ni_stc_writel(dev, trigvar, NISTC_AO_UI_LOADA_REG);
-                ni_stc_writel(dev, trigvar - 1, NISTC_AO_UI_LOADA_REG);
        } else { /* TRIG_EXT */
                /* FIXME:  assert scan_begin_arg != 0, ret failure otherwise */
                devpriv->ao_cmd2  |= NISTC_AO_CMD2_BC_GATE_ENA;
diff --git a/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c b/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c
index 85b242ec5f9b..8fc191d99927 100644
--- a/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c
+++ b/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c
@@ -1640,8 +1640,13 @@ kiblnd_send(struct lnet_ni *ni, void *private, struct lnet_msg *lntmsg)
        ibmsg = tx->tx_msg;
        ibmsg->ibm_u.immediate.ibim_hdr = *hdr;
-        copy_from_iter(&ibmsg->ibm_u.immediate.ibim_payload, IBLND_MSG_SIZE,
+        rc = copy_from_iter(&ibmsg->ibm_u.immediate.ibim_payload, payload_nob,
-                       &from);
+                            &from);
+        if (rc != payload_nob) {
+                kiblnd_pool_free_node(&tx->tx_pool->tpo_pool, &tx->tx_list);
+                return -EFAULT;
+        }
        nob = offsetof(struct kib_immediate_msg, ibim_payload[payload_nob]);
        kiblnd_init_tx_msg(ni, tx, IBLND_MSG_IMMEDIATE, nob);
@@ -1741,8 +1746,14 @@ kiblnd_recv(struct lnet_ni *ni, void *private, struct lnet_msg *lntmsg,
                        break;
                }
-                copy_to_iter(&rxmsg->ibm_u.immediate.ibim_payload,
+                rc = copy_to_iter(&rxmsg->ibm_u.immediate.ibim_payload, rlen,
-                             IBLND_MSG_SIZE, to);
+                                  to);
+                if (rc != rlen) {
+                        rc = -EFAULT;
+                        break;
+                }
+                rc = 0;
                lnet_finalize(ni, lntmsg, 0);
                break;
diff --git a/drivers/staging/rtl8188eu/core/rtw_cmd.c b/drivers/staging/rtl8188eu/core/rtw_cmd.c
index 002d09159896..a69007ef77bf 100644
--- a/drivers/staging/rtl8188eu/core/rtw_cmd.c
+++ b/drivers/staging/rtl8188eu/core/rtw_cmd.c
@@ -132,7 +132,7 @@ void rtw_free_cmd_obj(struct cmd_obj *pcmd)
                kfree(pcmd->parmbuf);
        }
-        if (!pcmd->rsp) {
+        if (pcmd->rsp) {
                if (pcmd->rspsz != 0) {
                        /* free rsp in cmd_obj */
                        kfree(pcmd->rsp);
diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
index 963235fd7292..d283341cfe43 100644
--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
@@ -43,6 +43,7 @@ static struct usb_device_id rtw_usb_id_tbl[] = {
        {USB_DEVICE(0x2001, 0x330F)}, /* DLink DWA-125 REV D1 */
        {USB_DEVICE(0x2001, 0x3310)}, /* Dlink DWA-123 REV D1 */
        {USB_DEVICE(0x2001, 0x3311)}, /* DLink GO-USB-N150 REV B1 */
+        {USB_DEVICE(0x2357, 0x010c)}, /* TP-Link TL-WN722N v2 */
        {USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */
        {}      /* Terminating entry */
 };
diff --git a/drivers/staging/sm750fb/ddk750_chip.c b/drivers/staging/sm750fb/ddk750_chip.c
index 944dd25924be..4754f7a20684 100644
--- a/drivers/staging/sm750fb/ddk750_chip.c
+++ b/drivers/staging/sm750fb/ddk750_chip.c
@@ -40,7 +40,7 @@ static unsigned int get_mxclk_freq(void)
        pll_reg = peek32(MXCLK_PLL_CTRL);
        M = (pll_reg & PLL_CTRL_M_MASK) >> PLL_CTRL_M_SHIFT;
-        N = (pll_reg & PLL_CTRL_N_MASK) >> PLL_CTRL_M_SHIFT;
+        N = (pll_reg & PLL_CTRL_N_MASK) >> PLL_CTRL_N_SHIFT;
        OD = (pll_reg & PLL_CTRL_OD_MASK) >> PLL_CTRL_OD_SHIFT;
        POD = (pll_reg & PLL_CTRL_POD_MASK) >> PLL_CTRL_POD_SHIFT;
diff --git a/drivers/staging/sm750fb/sm750.c b/drivers/staging/sm750fb/sm750.c
index 3aa4128703d5..67207b0554cd 100644
--- a/drivers/staging/sm750fb/sm750.c
+++ b/drivers/staging/sm750fb/sm750.c
@@ -1053,6 +1053,26 @@ release_fb:
        return err;
 }
+static int lynxfb_kick_out_firmware_fb(struct pci_dev *pdev)
+{
+        struct apertures_struct *ap;
+        bool primary = false;
+        ap = alloc_apertures(1);
+        if (!ap)
+                return -ENOMEM;
+        ap->ranges[0].base = pci_resource_start(pdev, 0);
+        ap->ranges[0].size = pci_resource_len(pdev, 0);
+#ifdef CONFIG_X86
+        primary = pdev->resource[PCI_ROM_RESOURCE].flags &
+                                        IORESOURCE_ROM_SHADOW;
+#endif
+        remove_conflicting_framebuffers(ap, "sm750_fb1", primary);
+        kfree(ap);
+        return 0;
+}
 static int lynxfb_pci_probe(struct pci_dev *pdev,
                            const struct pci_device_id *ent)
 {
@@ -1061,6 +1081,10 @@ static int lynxfb_pci_probe(struct pci_dev *pdev,
        int fbidx;
        int err;
+        err = lynxfb_kick_out_firmware_fb(pdev);
+        if (err)
+                return err;
        /* enable device */
        err = pcim_enable_device(pdev);
        if (err)
diff --git a/drivers/staging/speakup/main.c b/drivers/staging/speakup/main.c
index 82e5de248947..67956e24779c 100644
--- a/drivers/staging/speakup/main.c
+++ b/drivers/staging/speakup/main.c
@@ -2314,6 +2314,7 @@ static void __exit speakup_exit(void)
        mutex_lock(&spk_mutex);
        synth_release();
        mutex_unlock(&spk_mutex);
+        spk_ttyio_unregister_ldisc();
        speakup_kobj_exit();
@@ -2376,6 +2377,7 @@ static int __init speakup_init(void)
        if (err)
                goto error_kobjects;
+        spk_ttyio_register_ldisc();
        synth_init(synth_name);
        speakup_register_devsynth();
        /*
diff --git a/drivers/staging/speakup/spk_priv.h b/drivers/staging/speakup/spk_priv.h
index 87b6a0a4c54d..046040ac074c 100644
--- a/drivers/staging/speakup/spk_priv.h
+++ b/drivers/staging/speakup/spk_priv.h
@@ -48,6 +48,8 @@ void spk_stop_serial_interrupt(void);
 int spk_wait_for_xmitr(struct spk_synth *in_synth);
 void spk_serial_release(void);
 void spk_ttyio_release(void);
+void spk_ttyio_register_ldisc(void);
+void spk_ttyio_unregister_ldisc(void);
 void synth_buffer_skip_nonlatin1(void);
 u16 synth_buffer_getc(void);
diff --git a/drivers/staging/speakup/spk_ttyio.c b/drivers/staging/speakup/spk_ttyio.c
index ed8e96b06ead..fe340b07c482 100644
--- a/drivers/staging/speakup/spk_ttyio.c
+++ b/drivers/staging/speakup/spk_ttyio.c
@@ -154,12 +154,6 @@ static int spk_ttyio_initialise_ldisc(struct spk_synth *synth)
        struct ktermios tmp_termios;
        dev_t dev;
-        ret = tty_register_ldisc(N_SPEAKUP, &spk_ttyio_ldisc_ops);
-        if (ret) {
-                pr_err("Error registering line discipline.\n");
-                return ret;
-        }
        ret = get_dev_to_use(synth, &dev);
        if (ret)
                return ret;
@@ -196,10 +190,24 @@ static int spk_ttyio_initialise_ldisc(struct spk_synth *synth)
        tty_unlock(tty);
        ret = tty_set_ldisc(tty, N_SPEAKUP);
+        if (ret)
+                pr_err("speakup: Failed to set N_SPEAKUP on tty\n");
        return ret;
 }
+void spk_ttyio_register_ldisc(void)
+{
+        if (tty_register_ldisc(N_SPEAKUP, &spk_ttyio_ldisc_ops))
+                pr_warn("speakup: Error registering line discipline. Most synths won't work.\n");
+}
+void spk_ttyio_unregister_ldisc(void)
+{
+        if (tty_unregister_ldisc(N_SPEAKUP))
+                pr_warn("speakup: Couldn't unregister ldisc\n");
+}
 static int spk_ttyio_out(struct spk_synth *in_synth, const char ch)
 {
        if (in_synth->alive && speakup_tty && speakup_tty->ops->write) {
@@ -300,7 +308,7 @@ void spk_ttyio_release(void)
        tty_ldisc_flush(speakup_tty);
        tty_unlock(speakup_tty);
-        tty_ldisc_release(speakup_tty);
+        tty_release_struct(speakup_tty, speakup_tty->index);
 }
 EXPORT_SYMBOL_GPL(spk_ttyio_release);
diff --git a/drivers/staging/vboxvideo/Kconfig b/drivers/staging/vboxvideo/Kconfig
new file mode 100644
index 000000000000..a52746f9a670
--- /dev/null
+++ b/drivers/staging/vboxvideo/Kconfig
@@ -0,0 +1,12 @@
+config DRM_VBOXVIDEO
+        tristate "Virtual Box Graphics Card"
+        depends on DRM && X86 && PCI
+        select DRM_KMS_HELPER
+        help
+          This is a KMS driver for the virtual Graphics Card used in
+          Virtual Box virtual machines.
+          Although it is possible to builtin this module, it is advised
+          to build this driver as a module, so that it can be updated
+          independently of the kernel. Select M to built this driver as a
+          module and add support for these devices via drm/kms interfaces.
diff --git a/drivers/staging/vboxvideo/Makefile b/drivers/staging/vboxvideo/Makefile
new file mode 100644
index 000000000000..2d0b3bc7ad73
--- /dev/null
+++ b/drivers/staging/vboxvideo/Makefile
@@ -0,0 +1,7 @@
+ccflags-y := -Iinclude/drm
+vboxvideo-y :=  hgsmi_base.o modesetting.o vbva_base.o \
+                vbox_drv.o vbox_fb.o vbox_hgsmi.o vbox_irq.o vbox_main.o \
+                vbox_mode.o vbox_prime.o vbox_ttm.o
+obj-$(CONFIG_DRM_VBOXVIDEO) += vboxvideo.o
diff --git a/drivers/staging/vboxvideo/TODO b/drivers/staging/vboxvideo/TODO
new file mode 100644
index 000000000000..ce764309b079
--- /dev/null
+++ b/drivers/staging/vboxvideo/TODO
@@ -0,0 +1,9 @@
+TODO:
+-Move the driver over to the atomic API
+-Stop using old load / unload drm_driver hooks
+-Get a full review from the drm-maintainers on dri-devel done on this driver
+-Extend this TODO with the results of that review
+Please send any patches to Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
+Hans de Goede <hdegoede@redhat.com> and
+Michael Thayer <michael.thayer@oracle.com>.
diff --git a/drivers/staging/vboxvideo/hgsmi_base.c b/drivers/staging/vboxvideo/hgsmi_base.c
new file mode 100644
index 000000000000..15ff5f42e2cd
--- /dev/null
+++ b/drivers/staging/vboxvideo/hgsmi_base.c
@@ -0,0 +1,246 @@
+/*
+ * Copyright (C) 2006-2017 Oracle Corporation
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ */
+#include "vbox_drv.h"
+#include "vbox_err.h"
+#include "vboxvideo_guest.h"
+#include "vboxvideo_vbe.h"
+#include "hgsmi_channels.h"
+#include "hgsmi_ch_setup.h"
+/**
+ * Inform the host of the location of the host flags in VRAM via an HGSMI cmd.
+ * @param    ctx          the context of the guest heap to use.
+ * @param    location     the offset chosen for the flags within guest VRAM.
+ * @returns 0 on success, -errno on failure
+ */
+int hgsmi_report_flags_location(struct gen_pool *ctx, u32 location)
+{
+        struct hgsmi_buffer_location *p;
+        p = hgsmi_buffer_alloc(ctx, sizeof(*p), HGSMI_CH_HGSMI,
+                               HGSMI_CC_HOST_FLAGS_LOCATION);
+        if (!p)
+                return -ENOMEM;
+        p->buf_location = location;
+        p->buf_len = sizeof(struct hgsmi_host_flags);
+        hgsmi_buffer_submit(ctx, p);
+        hgsmi_buffer_free(ctx, p);
+        return 0;
+}
+/**
+ * Notify the host of HGSMI-related guest capabilities via an HGSMI command.
+ * @param    ctx                 the context of the guest heap to use.
+ * @param    caps                the capabilities to report, see vbva_caps.
+ * @returns 0 on success, -errno on failure
+ */
+int hgsmi_send_caps_info(struct gen_pool *ctx, u32 caps)
+{
+        struct vbva_caps *p;
+        p = hgsmi_buffer_alloc(ctx, sizeof(*p), HGSMI_CH_VBVA, VBVA_INFO_CAPS);
+        if (!p)
+                return -ENOMEM;
+        p->rc = VERR_NOT_IMPLEMENTED;
+        p->caps = caps;
+        hgsmi_buffer_submit(ctx, p);
+        WARN_ON_ONCE(RT_FAILURE(p->rc));
+        hgsmi_buffer_free(ctx, p);
+        return 0;
+}
+int hgsmi_test_query_conf(struct gen_pool *ctx)
+{
+        u32 value = 0;
+        int ret;
+        ret = hgsmi_query_conf(ctx, U32_MAX, &value);
+        if (ret)
+                return ret;
+        return value == U32_MAX ? 0 : -EIO;
+}
+/**
+ * Query the host for an HGSMI configuration parameter via an HGSMI command.
+ * @param  ctx        the context containing the heap used
+ * @param  index      the index of the parameter to query,
+ *                    @see vbva_conf32::index
+ * @param  value_ret  where to store the value of the parameter on success
+ * @returns 0 on success, -errno on failure
+ */
+int hgsmi_query_conf(struct gen_pool *ctx, u32 index, u32 *value_ret)
+{
+        struct vbva_conf32 *p;
+        p = hgsmi_buffer_alloc(ctx, sizeof(*p), HGSMI_CH_VBVA,
+                               VBVA_QUERY_CONF32);
+        if (!p)
+                return -ENOMEM;
+        p->index = index;
+        p->value = U32_MAX;
+        hgsmi_buffer_submit(ctx, p);
+        *value_ret = p->value;
+        hgsmi_buffer_free(ctx, p);
+        return 0;
+}
+/**
+ * Pass the host a new mouse pointer shape via an HGSMI command.
+ *
+ * @param  ctx      the context containing the heap to be used
+ * @param  flags    cursor flags, @see VMMDevReqMousePointer::flags
+ * @param  hot_x    horizontal position of the hot spot
+ * @param  hot_y    vertical position of the hot spot
+ * @param  width    width in pixels of the cursor
+ * @param  height   height in pixels of the cursor
+ * @param  pixels   pixel data, @see VMMDevReqMousePointer for the format
+ * @param  len      size in bytes of the pixel data
+ * @returns 0 on success, -errno on failure
+ */
+int hgsmi_update_pointer_shape(struct gen_pool *ctx, u32 flags,
+                               u32 hot_x, u32 hot_y, u32 width, u32 height,
+                               u8 *pixels, u32 len)
+{
+        struct vbva_mouse_pointer_shape *p;
+        u32 pixel_len = 0;
+        int rc;
+        if (flags & VBOX_MOUSE_POINTER_SHAPE) {
+                /*
+                 * Size of the pointer data:
+                 * sizeof (AND mask) + sizeof (XOR_MASK)
+                 */
+                pixel_len = ((((width + 7) / 8) * height + 3) & ~3) +
+                         width * 4 * height;
+                if (pixel_len > len)
+                        return -EINVAL;
+                /*
+                 * If shape is supplied, then always create the pointer visible.
+                 * See comments in 'vboxUpdatePointerShape'
+                 */
+                flags |= VBOX_MOUSE_POINTER_VISIBLE;
+        }
+        p = hgsmi_buffer_alloc(ctx, sizeof(*p) + pixel_len, HGSMI_CH_VBVA,
+                               VBVA_MOUSE_POINTER_SHAPE);
+        if (!p)
+                return -ENOMEM;
+        p->result = VINF_SUCCESS;
+        p->flags = flags;
+        p->hot_X = hot_x;
+        p->hot_y = hot_y;
+        p->width = width;
+        p->height = height;
+        if (pixel_len)
+                memcpy(p->data, pixels, pixel_len);
+        hgsmi_buffer_submit(ctx, p);
+        switch (p->result) {
+        case VINF_SUCCESS:
+                rc = 0;
+                break;
+        case VERR_NO_MEMORY:
+                rc = -ENOMEM;
+                break;
+        case VERR_NOT_SUPPORTED:
+                rc = -EBUSY;
+                break;
+        default:
+                rc = -EINVAL;
+        }
+        hgsmi_buffer_free(ctx, p);
+        return rc;
+}
+/**
+ * Report the guest cursor position.  The host may wish to use this information
+ * to re-position its own cursor (though this is currently unlikely).  The
+ * current host cursor position is returned.
+ * @param  ctx              The context containing the heap used.
+ * @param  report_position  Are we reporting a position?
+ * @param  x                Guest cursor X position.
+ * @param  y                Guest cursor Y position.
+ * @param  x_host           Host cursor X position is stored here.  Optional.
+ * @param  y_host           Host cursor Y position is stored here.  Optional.
+ * @returns 0 on success, -errno on failure
+ */
+int hgsmi_cursor_position(struct gen_pool *ctx, bool report_position,
+                          u32 x, u32 y, u32 *x_host, u32 *y_host)
+{
+        struct vbva_cursor_position *p;
+        p = hgsmi_buffer_alloc(ctx, sizeof(*p), HGSMI_CH_VBVA,
+                               VBVA_CURSOR_POSITION);
+        if (!p)
+                return -ENOMEM;
+        p->report_position = report_position;
+        p->x = x;
+        p->y = y;
+        hgsmi_buffer_submit(ctx, p);
+        *x_host = p->x;
+        *y_host = p->y;
+        hgsmi_buffer_free(ctx, p);
+        return 0;
+}
+/**
+ * @todo Mouse pointer position to be read from VMMDev memory, address of the
+ * memory region can be queried from VMMDev via an IOCTL. This VMMDev memory
+ * region will contain host information which is needed by the guest.
+ *
+ * Reading will not cause a switch to the host.
+ *
+ * Have to take into account:
+ *  * synchronization: host must write to the memory only from EMT,
+ *    large structures must be read under flag, which tells the host
+ *    that the guest is currently reading the memory (OWNER flag?).
+ *  * guest writes: may be allocate a page for the host info and make
+ *    the page readonly for the guest.
+ *  * the information should be available only for additions drivers.
+ *  * VMMDev additions driver will inform the host which version of the info
+ *    it expects, host must support all versions.
+ */
diff --git a/drivers/staging/vboxvideo/hgsmi_ch_setup.h b/drivers/staging/vboxvideo/hgsmi_ch_setup.h
new file mode 100644
index 000000000000..8e6d9e11a69c
--- /dev/null
+++ b/drivers/staging/vboxvideo/hgsmi_ch_setup.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2006-2017 Oracle Corporation
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ */
+#ifndef __HGSMI_CH_SETUP_H__
+#define __HGSMI_CH_SETUP_H__
+/*
+ * Tell the host the location of hgsmi_host_flags structure, where the host
+ * can write information about pending buffers, etc, and which can be quickly
+ * polled by the guest without a need to port IO.
+ */
+#define HGSMI_CC_HOST_FLAGS_LOCATION 0
+struct hgsmi_buffer_location {
+        u32 buf_location;
+        u32 buf_len;
+} __packed;
+/* HGSMI setup and configuration data structures. */
+/* host->guest commands pending, should be accessed under FIFO lock only */
+#define HGSMIHOSTFLAGS_COMMANDS_PENDING    0x01u
+/* IRQ is fired, should be accessed under VGAState::lock only  */
+#define HGSMIHOSTFLAGS_IRQ                 0x02u
+/* vsync interrupt flag, should be accessed under VGAState::lock only */
+#define HGSMIHOSTFLAGS_VSYNC               0x10u
+/** monitor hotplug flag, should be accessed under VGAState::lock only */
+#define HGSMIHOSTFLAGS_HOTPLUG             0x20u
+/**
+ * Cursor capability state change flag, should be accessed under
+ * VGAState::lock only. @see vbva_conf32.
+ */
+#define HGSMIHOSTFLAGS_CURSOR_CAPABILITIES 0x40u
+struct hgsmi_host_flags {
+        /*
+         * Host flags can be accessed and modified in multiple threads
+         * concurrently, e.g. CrOpenGL HGCM and GUI threads when completing
+         * HGSMI 3D and Video Accel respectively, EMT thread when dealing with
+         * HGSMI command processing, etc.
+         * Besides settings/cleaning flags atomically, some flags have their
+         * own special sync restrictions, see comments for flags above.
+         */
+        u32 host_flags;
+        u32 reserved[3];
+} __packed;
+#endif
diff --git a/drivers/staging/vboxvideo/hgsmi_channels.h b/drivers/staging/vboxvideo/hgsmi_channels.h
new file mode 100644
index 000000000000..a2a34b2167b4
--- /dev/null
+++ b/drivers/staging/vboxvideo/hgsmi_channels.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2006-2017 Oracle Corporation
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ */
+#ifndef __HGSMI_CHANNELS_H__
+#define __HGSMI_CHANNELS_H__
+/*
+ * Each channel has an 8 bit identifier. There are a number of predefined
+ * (hardcoded) channels.
+ *
+ * HGSMI_CH_HGSMI channel can be used to map a string channel identifier
+ * to a free 16 bit numerical value. values are allocated in range
+ * [HGSMI_CH_STRING_FIRST;HGSMI_CH_STRING_LAST].
+ */
+/* A reserved channel value */
+#define HGSMI_CH_RESERVED                               0x00
+/* HGCMI: setup and configuration */
+#define HGSMI_CH_HGSMI                                  0x01
+/* Graphics: VBVA */
+#define HGSMI_CH_VBVA                                   0x02
+/* Graphics: Seamless with a single guest region */
+#define HGSMI_CH_SEAMLESS                               0x03
+/* Graphics: Seamless with separate host windows */
+#define HGSMI_CH_SEAMLESS2                              0x04
+/* Graphics: OpenGL HW acceleration */
+#define HGSMI_CH_OPENGL                                 0x05
+/* The first channel index to be used for string mappings (inclusive) */
+#define HGSMI_CH_STRING_FIRST                           0x20
+/* The last channel index for string mappings (inclusive) */
+#define HGSMI_CH_STRING_LAST                            0xff
+#endif
diff --git a/drivers/staging/vboxvideo/hgsmi_defs.h b/drivers/staging/vboxvideo/hgsmi_defs.h
new file mode 100644
index 000000000000..5b21fb974d20
--- /dev/null
+++ b/drivers/staging/vboxvideo/hgsmi_defs.h
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2006-2017 Oracle Corporation
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ */
+#ifndef __HGSMI_DEFS_H__
+#define __HGSMI_DEFS_H__
+/* Buffer sequence type mask. */
+#define HGSMI_BUFFER_HEADER_F_SEQ_MASK     0x03
+/* Single buffer, not a part of a sequence. */
+#define HGSMI_BUFFER_HEADER_F_SEQ_SINGLE   0x00
+/* The first buffer in a sequence. */
+#define HGSMI_BUFFER_HEADER_F_SEQ_START    0x01
+/* A middle buffer in a sequence. */
+#define HGSMI_BUFFER_HEADER_F_SEQ_CONTINUE 0x02
+/* The last buffer in a sequence. */
+#define HGSMI_BUFFER_HEADER_F_SEQ_END      0x03
+/* 16 bytes buffer header. */
+struct hgsmi_buffer_header {
+        u32 data_size;          /* Size of data that follows the header. */
+        u8 flags;               /* HGSMI_BUFFER_HEADER_F_* */
+        u8 channel;             /* The channel the data must be routed to. */
+        u16 channel_info;       /* Opaque to the HGSMI, used by the channel. */
+        union {
+                /* Opaque placeholder to make the union 8 bytes. */
+                u8 header_data[8];
+                /* HGSMI_BUFFER_HEADER_F_SEQ_SINGLE */
+                struct {
+                        u32 reserved1;  /* A reserved field, initialize to 0. */
+                        u32 reserved2;  /* A reserved field, initialize to 0. */
+                } buffer;
+                /* HGSMI_BUFFER_HEADER_F_SEQ_START */
+                struct {
+                        /* Must be the same for all buffers in the sequence. */
+                        u32 sequence_number;
+                        /* The total size of the sequence. */
+                        u32 sequence_size;
+                } sequence_start;
+                /*
+                 * HGSMI_BUFFER_HEADER_F_SEQ_CONTINUE and
+                 * HGSMI_BUFFER_HEADER_F_SEQ_END
+                 */
+                struct {
+                        /* Must be the same for all buffers in the sequence. */
+                        u32 sequence_number;
+                        /* Data offset in the entire sequence. */
+                        u32 sequence_offset;
+                } sequence_continue;
+        } u;
+} __packed;
+/* 8 bytes buffer tail. */
+struct hgsmi_buffer_tail {
+        /* Reserved, must be initialized to 0. */
+        u32 reserved;
+        /*
+         * One-at-a-Time Hash: http://www.burtleburtle.net/bob/hash/doobs.html
+         * Over the header, offset and for first 4 bytes of the tail.
+         */
+        u32 checksum;
+} __packed;
+/*
+ * The size of the array of channels. Array indexes are u8.
+ * Note: the value must not be changed.
+ */
+#define HGSMI_NUMBER_OF_CHANNELS 0x100
+#endif
diff --git a/drivers/staging/vboxvideo/modesetting.c b/drivers/staging/vboxvideo/modesetting.c
new file mode 100644
index 000000000000..7616b8aab23a
--- /dev/null
+++ b/drivers/staging/vboxvideo/modesetting.c
@@ -0,0 +1,142 @@
+/*
+ * Copyright (C) 2006-2017 Oracle Corporation
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ */
+#include "vbox_drv.h"
+#include "vbox_err.h"
+#include "vboxvideo_guest.h"
+#include "vboxvideo_vbe.h"
+#include "hgsmi_channels.h"
+/**
+ * Set a video mode via an HGSMI request.  The views must have been
+ * initialised first using @a VBoxHGSMISendViewInfo and if the mode is being
+ * set on the first display then it must be set first using registers.
+ * @param  ctx           The context containing the heap to use
+ * @param  display       The screen number
+ * @param  origin_x      The horizontal displacement relative to the first scrn
+ * @param  origin_y      The vertical displacement relative to the first screen
+ * @param  start_offset  The offset of the visible area of the framebuffer
+ *                       relative to the framebuffer start
+ * @param  pitch         The offset in bytes between the starts of two adjecent
+ *                       scan lines in video RAM
+ * @param  width         The mode width
+ * @param  height        The mode height
+ * @param  bpp           The colour depth of the mode
+ * @param  flags         Flags
+ */
+void hgsmi_process_display_info(struct gen_pool *ctx, u32 display,
+                                s32 origin_x, s32 origin_y, u32 start_offset,
+                                u32 pitch, u32 width, u32 height,
+                                u16 bpp, u16 flags)
+{
+        struct vbva_infoscreen *p;
+        p = hgsmi_buffer_alloc(ctx, sizeof(*p), HGSMI_CH_VBVA,
+                               VBVA_INFO_SCREEN);
+        if (!p)
+                return;
+        p->view_index = display;
+        p->origin_x = origin_x;
+        p->origin_y = origin_y;
+        p->start_offset = start_offset;
+        p->line_size = pitch;
+        p->width = width;
+        p->height = height;
+        p->bits_per_pixel = bpp;
+        p->flags = flags;
+        hgsmi_buffer_submit(ctx, p);
+        hgsmi_buffer_free(ctx, p);
+}
+/**
+ * Report the rectangle relative to which absolute pointer events should be
+ * expressed.  This information remains valid until the next VBVA resize event
+ * for any screen, at which time it is reset to the bounding rectangle of all
+ * virtual screens.
+ * @param  ctx       The context containing the heap to use.
+ * @param  origin_x  Upper left X co-ordinate relative to the first screen.
+ * @param  origin_y  Upper left Y co-ordinate relative to the first screen.
+ * @param  width     Rectangle width.
+ * @param  height    Rectangle height.
+ * @returns 0 on success, -errno on failure
+ */
+int hgsmi_update_input_mapping(struct gen_pool *ctx, s32 origin_x, s32 origin_y,
+                               u32 width, u32 height)
+{
+        struct vbva_report_input_mapping *p;
+        p = hgsmi_buffer_alloc(ctx, sizeof(*p), HGSMI_CH_VBVA,
+                               VBVA_REPORT_INPUT_MAPPING);
+        if (!p)
+                return -ENOMEM;
+        p->x = origin_x;
+        p->y = origin_y;
+        p->cx = width;
+        p->cy = height;
+        hgsmi_buffer_submit(ctx, p);
+        hgsmi_buffer_free(ctx, p);
+        return 0;
+}
+/**
+ * Get most recent video mode hints.
+ * @param  ctx      The context containing the heap to use.
+ * @param  screens  The number of screens to query hints for, starting at 0.
+ * @param  hints    Array of vbva_modehint structures for receiving the hints.
+ * @returns 0 on success, -errno on failure
+ */
+int hgsmi_get_mode_hints(struct gen_pool *ctx, unsigned int screens,
+                         struct vbva_modehint *hints)
+{
+        struct vbva_query_mode_hints *p;
+        size_t size;
+        if (WARN_ON(!hints))
+                return -EINVAL;
+        size = screens * sizeof(struct vbva_modehint);
+        p = hgsmi_buffer_alloc(ctx, sizeof(*p) + size, HGSMI_CH_VBVA,
+                               VBVA_QUERY_MODE_HINTS);
+        if (!p)
+                return -ENOMEM;
+        p->hints_queried_count = screens;
+        p->hint_structure_guest_size = sizeof(struct vbva_modehint);
+        p->rc = VERR_NOT_SUPPORTED;
+        hgsmi_buffer_submit(ctx, p);
+        if (RT_FAILURE(p->rc)) {
+                hgsmi_buffer_free(ctx, p);
+                return -EIO;
+        }
+        memcpy(hints, ((u8 *)p) + sizeof(struct vbva_query_mode_hints), size);
+        hgsmi_buffer_free(ctx, p);
+        return 0;
+}
diff --git a/drivers/staging/vboxvideo/vbox_drv.c b/drivers/staging/vboxvideo/vbox_drv.c
new file mode 100644
index 000000000000..92ae1560a16d
--- /dev/null
+++ b/drivers/staging/vboxvideo/vbox_drv.c
@@ -0,0 +1,286 @@
+/*
+ * Copyright (C) 2013-2017 Oracle Corporation
+ * This file is based on ast_drv.c
+ * Copyright 2012 Red Hat Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * Authors: Dave Airlie <airlied@redhat.com>
+ *          Michael Thayer <michael.thayer@oracle.com,
+ *          Hans de Goede <hdegoede@redhat.com>
+ */
+#include <linux/module.h>
+#include <linux/console.h>
+#include <linux/vt_kern.h>
+#include <drm/drmP.h>
+#include <drm/drm_crtc_helper.h>
+#include "vbox_drv.h"
+int vbox_modeset = -1;
+MODULE_PARM_DESC(modeset, "Disable/Enable modesetting");
+module_param_named(modeset, vbox_modeset, int, 0400);
+static struct drm_driver driver;
+static const struct pci_device_id pciidlist[] = {
+        { 0x80ee, 0xbeef, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
+        { 0, 0, 0},
+};
+MODULE_DEVICE_TABLE(pci, pciidlist);
+static int vbox_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+{
+        return drm_get_pci_dev(pdev, ent, &driver);
+}
+static void vbox_pci_remove(struct pci_dev *pdev)
+{
+        struct drm_device *dev = pci_get_drvdata(pdev);
+        drm_put_dev(dev);
+}
+static int vbox_drm_freeze(struct drm_device *dev)
+{
+        struct vbox_private *vbox = dev->dev_private;
+        drm_kms_helper_poll_disable(dev);
+        pci_save_state(dev->pdev);
+        drm_fb_helper_set_suspend_unlocked(&vbox->fbdev->helper, true);
+        return 0;
+}
+static int vbox_drm_thaw(struct drm_device *dev)
+{
+        struct vbox_private *vbox = dev->dev_private;
+        drm_mode_config_reset(dev);
+        drm_helper_resume_force_mode(dev);
+        drm_fb_helper_set_suspend_unlocked(&vbox->fbdev->helper, false);
+        return 0;
+}
+static int vbox_drm_resume(struct drm_device *dev)
+{
+        int ret;
+        if (pci_enable_device(dev->pdev))
+                return -EIO;
+        ret = vbox_drm_thaw(dev);
+        if (ret)
+                return ret;
+        drm_kms_helper_poll_enable(dev);
+        return 0;
+}
+static int vbox_pm_suspend(struct device *dev)
+{
+        struct pci_dev *pdev = to_pci_dev(dev);
+        struct drm_device *ddev = pci_get_drvdata(pdev);
+        int error;
+        error = vbox_drm_freeze(ddev);
+        if (error)
+                return error;
+        pci_disable_device(pdev);
+        pci_set_power_state(pdev, PCI_D3hot);
+        return 0;
+}
+static int vbox_pm_resume(struct device *dev)
+{
+        struct drm_device *ddev = pci_get_drvdata(to_pci_dev(dev));
+        return vbox_drm_resume(ddev);
+}
+static int vbox_pm_freeze(struct device *dev)
+{
+        struct pci_dev *pdev = to_pci_dev(dev);
+        struct drm_device *ddev = pci_get_drvdata(pdev);
+        if (!ddev || !ddev->dev_private)
+                return -ENODEV;
+        return vbox_drm_freeze(ddev);
+}
+static int vbox_pm_thaw(struct device *dev)
+{
+        struct drm_device *ddev = pci_get_drvdata(to_pci_dev(dev));
+        return vbox_drm_thaw(ddev);
+}
+static int vbox_pm_poweroff(struct device *dev)
+{
+        struct drm_device *ddev = pci_get_drvdata(to_pci_dev(dev));
+        return vbox_drm_freeze(ddev);
+}
+static const struct dev_pm_ops vbox_pm_ops = {
+        .suspend = vbox_pm_suspend,
+        .resume = vbox_pm_resume,
+        .freeze = vbox_pm_freeze,
+        .thaw = vbox_pm_thaw,
+        .poweroff = vbox_pm_poweroff,
+        .restore = vbox_pm_resume,
+};
+static struct pci_driver vbox_pci_driver = {
+        .name = DRIVER_NAME,
+        .id_table = pciidlist,
+        .probe = vbox_pci_probe,
+        .remove = vbox_pci_remove,
+        .driver.pm = &vbox_pm_ops,
+};
+static const struct file_operations vbox_fops = {
+        .owner = THIS_MODULE,
+        .open = drm_open,
+        .release = drm_release,
+        .unlocked_ioctl = drm_ioctl,
+        .mmap = vbox_mmap,
+        .poll = drm_poll,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl = drm_compat_ioctl,
+#endif
+        .read = drm_read,
+};
+static int vbox_master_set(struct drm_device *dev,
+                           struct drm_file *file_priv, bool from_open)
+{
+        struct vbox_private *vbox = dev->dev_private;
+        /*
+         * We do not yet know whether the new owner can handle hotplug, so we
+         * do not advertise dynamic modes on the first query and send a
+         * tentative hotplug notification after that to see if they query again.
+         */
+        vbox->initial_mode_queried = false;
+        mutex_lock(&vbox->hw_mutex);
+        /*
+         * Disable VBVA when someone releases master in case the next person
+         * tries tries to do VESA.
+         */
+        /** @todo work out if anyone is likely to and whether it will work. */
+        /*
+         * Update: we also disable it because if the new master does not do
+         * dirty rectangle reporting (e.g. old versions of Plymouth) then at
+         * least the first screen will still be updated. We enable it as soon
+         * as we receive a dirty rectangle report.
+         */
+        vbox_disable_accel(vbox);
+        mutex_unlock(&vbox->hw_mutex);
+        return 0;
+}
+static void vbox_master_drop(struct drm_device *dev, struct drm_file *file_priv)
+{
+        struct vbox_private *vbox = dev->dev_private;
+        /* See vbox_master_set() */
+        vbox->initial_mode_queried = false;
+        mutex_lock(&vbox->hw_mutex);
+        vbox_disable_accel(vbox);
+        mutex_unlock(&vbox->hw_mutex);
+}
+static struct drm_driver driver = {
+        .driver_features =
+            DRIVER_MODESET | DRIVER_GEM | DRIVER_HAVE_IRQ | DRIVER_IRQ_SHARED |
+            DRIVER_PRIME,
+        .dev_priv_size = 0,
+        .load = vbox_driver_load,
+        .unload = vbox_driver_unload,
+        .lastclose = vbox_driver_lastclose,
+        .master_set = vbox_master_set,
+        .master_drop = vbox_master_drop,
+        .set_busid = drm_pci_set_busid,
+        .fops = &vbox_fops,
+        .irq_handler = vbox_irq_handler,
+        .name = DRIVER_NAME,
+        .desc = DRIVER_DESC,
+        .date = DRIVER_DATE,
+        .major = DRIVER_MAJOR,
+        .minor = DRIVER_MINOR,
+        .patchlevel = DRIVER_PATCHLEVEL,
+        .gem_free_object = vbox_gem_free_object,
+        .dumb_create = vbox_dumb_create,
+        .dumb_map_offset = vbox_dumb_mmap_offset,
+        .dumb_destroy = drm_gem_dumb_destroy,
+        .prime_handle_to_fd = drm_gem_prime_handle_to_fd,
+        .prime_fd_to_handle = drm_gem_prime_fd_to_handle,
+        .gem_prime_export = drm_gem_prime_export,
+        .gem_prime_import = drm_gem_prime_import,
+        .gem_prime_pin = vbox_gem_prime_pin,
+        .gem_prime_unpin = vbox_gem_prime_unpin,
+        .gem_prime_get_sg_table = vbox_gem_prime_get_sg_table,
+        .gem_prime_import_sg_table = vbox_gem_prime_import_sg_table,
+        .gem_prime_vmap = vbox_gem_prime_vmap,
+        .gem_prime_vunmap = vbox_gem_prime_vunmap,
+        .gem_prime_mmap = vbox_gem_prime_mmap,
+};
+static int __init vbox_init(void)
+{
+#ifdef CONFIG_VGA_CONSOLE
+        if (vgacon_text_force() && vbox_modeset == -1)
+                return -EINVAL;
+#endif
+        if (vbox_modeset == 0)
+                return -EINVAL;
+        return drm_pci_init(&driver, &vbox_pci_driver);
+}
+static void __exit vbox_exit(void)
+{
+        drm_pci_exit(&driver, &vbox_pci_driver);
+}
+module_init(vbox_init);
+module_exit(vbox_exit);
+MODULE_AUTHOR("Oracle Corporation");
+MODULE_DESCRIPTION(DRIVER_DESC);
+MODULE_LICENSE("GPL and additional rights");
diff --git a/drivers/staging/vboxvideo/vbox_drv.h b/drivers/staging/vboxvideo/vbox_drv.h
new file mode 100644
index 000000000000..4b9302703b36
--- /dev/null
+++ b/drivers/staging/vboxvideo/vbox_drv.h
@@ -0,0 +1,296 @@
+/*
+ * Copyright (C) 2013-2017 Oracle Corporation
+ * This file is based on ast_drv.h
+ * Copyright 2012 Red Hat Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * Authors: Dave Airlie <airlied@redhat.com>
+ *          Michael Thayer <michael.thayer@oracle.com,
+ *          Hans de Goede <hdegoede@redhat.com>
+ */
+#ifndef __VBOX_DRV_H__
+#define __VBOX_DRV_H__
+#include <linux/genalloc.h>
+#include <linux/io.h>
+#include <linux/string.h>
+#include <linux/version.h>
+#include <drm/drmP.h>
+#include <drm/drm_encoder.h>
+#include <drm/drm_fb_helper.h>
+#include <drm/drm_gem.h>
+#include <drm/ttm/ttm_bo_api.h>
+#include <drm/ttm/ttm_bo_driver.h>
+#include <drm/ttm/ttm_placement.h>
+#include <drm/ttm/ttm_memory.h>
+#include <drm/ttm/ttm_module.h>
+#include "vboxvideo_guest.h"
+#include "vboxvideo_vbe.h"
+#include "hgsmi_ch_setup.h"
+#define DRIVER_NAME         "vboxvideo"
+#define DRIVER_DESC         "Oracle VM VirtualBox Graphics Card"
+#define DRIVER_DATE         "20130823"
+#define DRIVER_MAJOR        1
+#define DRIVER_MINOR        0
+#define DRIVER_PATCHLEVEL   0
+#define VBOX_MAX_CURSOR_WIDTH  64
+#define VBOX_MAX_CURSOR_HEIGHT 64
+#define CURSOR_PIXEL_COUNT (VBOX_MAX_CURSOR_WIDTH * VBOX_MAX_CURSOR_HEIGHT)
+#define CURSOR_DATA_SIZE (CURSOR_PIXEL_COUNT * 4 + CURSOR_PIXEL_COUNT / 8)
+#define VBOX_MAX_SCREENS  32
+#define GUEST_HEAP_OFFSET(vbox) ((vbox)->full_vram_size - \
+                                 VBVA_ADAPTER_INFORMATION_SIZE)
+#define GUEST_HEAP_SIZE   VBVA_ADAPTER_INFORMATION_SIZE
+#define GUEST_HEAP_USABLE_SIZE (VBVA_ADAPTER_INFORMATION_SIZE - \
+                                sizeof(struct hgsmi_host_flags))
+#define HOST_FLAGS_OFFSET GUEST_HEAP_USABLE_SIZE
+struct vbox_fbdev;
+struct vbox_private {
+        struct drm_device *dev;
+        u8 __iomem *guest_heap;
+        u8 __iomem *vbva_buffers;
+        struct gen_pool *guest_pool;
+        struct vbva_buf_ctx *vbva_info;
+        bool any_pitch;
+        u32 num_crtcs;
+        /** Amount of available VRAM, including space used for buffers. */
+        u32 full_vram_size;
+        /** Amount of available VRAM, not including space used for buffers. */
+        u32 available_vram_size;
+        /** Array of structures for receiving mode hints. */
+        struct vbva_modehint *last_mode_hints;
+        struct vbox_fbdev *fbdev;
+        int fb_mtrr;
+        struct {
+                struct drm_global_reference mem_global_ref;
+                struct ttm_bo_global_ref bo_global_ref;
+                struct ttm_bo_device bdev;
+        } ttm;
+        struct mutex hw_mutex; /* protects modeset and accel/vbva accesses */
+        /**
+         * We decide whether or not user-space supports display hot-plug
+         * depending on whether they react to a hot-plug event after the initial
+         * mode query.
+         */
+        bool initial_mode_queried;
+        struct work_struct hotplug_work;
+        u32 input_mapping_width;
+        u32 input_mapping_height;
+        /**
+         * Is user-space using an X.Org-style layout of one large frame-buffer
+         * encompassing all screen ones or is the fbdev console active?
+         */
+        bool single_framebuffer;
+        u32 cursor_width;
+        u32 cursor_height;
+        u32 cursor_hot_x;
+        u32 cursor_hot_y;
+        size_t cursor_data_size;
+        u8 cursor_data[CURSOR_DATA_SIZE];
+};
+#undef CURSOR_PIXEL_COUNT
+#undef CURSOR_DATA_SIZE
+int vbox_driver_load(struct drm_device *dev, unsigned long flags);
+void vbox_driver_unload(struct drm_device *dev);
+void vbox_driver_lastclose(struct drm_device *dev);
+struct vbox_gem_object;
+struct vbox_connector {
+        struct drm_connector base;
+        char name[32];
+        struct vbox_crtc *vbox_crtc;
+        struct {
+                u16 width;
+                u16 height;
+                bool disconnected;
+        } mode_hint;
+};
+struct vbox_crtc {
+        struct drm_crtc base;
+        bool blanked;
+        bool disconnected;
+        unsigned int crtc_id;
+        u32 fb_offset;
+        bool cursor_enabled;
+        u16 x_hint;
+        u16 y_hint;
+};
+struct vbox_encoder {
+        struct drm_encoder base;
+};
+struct vbox_framebuffer {
+        struct drm_framebuffer base;
+        struct drm_gem_object *obj;
+};
+struct vbox_fbdev {
+        struct drm_fb_helper helper;
+        struct vbox_framebuffer afb;
+        int size;
+        struct ttm_bo_kmap_obj mapping;
+        int x1, y1, x2, y2;     /* dirty rect */
+        spinlock_t dirty_lock;
+};
+#define to_vbox_crtc(x) container_of(x, struct vbox_crtc, base)
+#define to_vbox_connector(x) container_of(x, struct vbox_connector, base)
+#define to_vbox_encoder(x) container_of(x, struct vbox_encoder, base)
+#define to_vbox_framebuffer(x) container_of(x, struct vbox_framebuffer, base)
+int vbox_mode_init(struct drm_device *dev);
+void vbox_mode_fini(struct drm_device *dev);
+#define DRM_MODE_FB_CMD drm_mode_fb_cmd2
+#define CRTC_FB(crtc) ((crtc)->primary->fb)
+void vbox_enable_accel(struct vbox_private *vbox);
+void vbox_disable_accel(struct vbox_private *vbox);
+void vbox_report_caps(struct vbox_private *vbox);
+void vbox_framebuffer_dirty_rectangles(struct drm_framebuffer *fb,
+                                       struct drm_clip_rect *rects,
+                                       unsigned int num_rects);
+int vbox_framebuffer_init(struct drm_device *dev,
+                          struct vbox_framebuffer *vbox_fb,
+                          const struct DRM_MODE_FB_CMD *mode_cmd,
+                          struct drm_gem_object *obj);
+int vbox_fbdev_init(struct drm_device *dev);
+void vbox_fbdev_fini(struct drm_device *dev);
+void vbox_fbdev_set_base(struct vbox_private *vbox, unsigned long gpu_addr);
+struct vbox_bo {
+        struct ttm_buffer_object bo;
+        struct ttm_placement placement;
+        struct ttm_bo_kmap_obj kmap;
+        struct drm_gem_object gem;
+        struct ttm_place placements[3];
+        int pin_count;
+};
+#define gem_to_vbox_bo(gobj) container_of((gobj), struct vbox_bo, gem)
+static inline struct vbox_bo *vbox_bo(struct ttm_buffer_object *bo)
+{
+        return container_of(bo, struct vbox_bo, bo);
+}
+#define to_vbox_obj(x) container_of(x, struct vbox_gem_object, base)
+int vbox_dumb_create(struct drm_file *file,
+                     struct drm_device *dev,
+                     struct drm_mode_create_dumb *args);
+void vbox_gem_free_object(struct drm_gem_object *obj);
+int vbox_dumb_mmap_offset(struct drm_file *file,
+                          struct drm_device *dev,
+                          u32 handle, u64 *offset);
+#define DRM_FILE_PAGE_OFFSET (0x10000000ULL >> PAGE_SHIFT)
+int vbox_mm_init(struct vbox_private *vbox);
+void vbox_mm_fini(struct vbox_private *vbox);
+int vbox_bo_create(struct drm_device *dev, int size, int align,
+                   u32 flags, struct vbox_bo **pvboxbo);
+int vbox_gem_create(struct drm_device *dev,
+                    u32 size, bool iskernel, struct drm_gem_object **obj);
+int vbox_bo_pin(struct vbox_bo *bo, u32 pl_flag, u64 *gpu_addr);
+int vbox_bo_unpin(struct vbox_bo *bo);
+static inline int vbox_bo_reserve(struct vbox_bo *bo, bool no_wait)
+{
+        int ret;
+        ret = ttm_bo_reserve(&bo->bo, true, no_wait, NULL);
+        if (ret) {
+                if (ret != -ERESTARTSYS && ret != -EBUSY)
+                        DRM_ERROR("reserve failed %p\n", bo);
+                return ret;
+        }
+        return 0;
+}
+static inline void vbox_bo_unreserve(struct vbox_bo *bo)
+{
+        ttm_bo_unreserve(&bo->bo);
+}
+void vbox_ttm_placement(struct vbox_bo *bo, int domain);
+int vbox_bo_push_sysram(struct vbox_bo *bo);
+int vbox_mmap(struct file *filp, struct vm_area_struct *vma);
+/* vbox_prime.c */
+int vbox_gem_prime_pin(struct drm_gem_object *obj);
+void vbox_gem_prime_unpin(struct drm_gem_object *obj);
+struct sg_table *vbox_gem_prime_get_sg_table(struct drm_gem_object *obj);
+struct drm_gem_object *vbox_gem_prime_import_sg_table(
+        struct drm_device *dev, struct dma_buf_attachment *attach,
+        struct sg_table *table);
+void *vbox_gem_prime_vmap(struct drm_gem_object *obj);
+void vbox_gem_prime_vunmap(struct drm_gem_object *obj, void *vaddr);
+int vbox_gem_prime_mmap(struct drm_gem_object *obj,
+                        struct vm_area_struct *area);
+/* vbox_irq.c */
+int vbox_irq_init(struct vbox_private *vbox);
+void vbox_irq_fini(struct vbox_private *vbox);
+void vbox_report_hotplug(struct vbox_private *vbox);
+irqreturn_t vbox_irq_handler(int irq, void *arg);
+/* vbox_hgsmi.c */
+void *hgsmi_buffer_alloc(struct gen_pool *guest_pool, size_t size,
+                         u8 channel, u16 channel_info);
+void hgsmi_buffer_free(struct gen_pool *guest_pool, void *buf);
+int hgsmi_buffer_submit(struct gen_pool *guest_pool, void *buf);
+static inline void vbox_write_ioport(u16 index, u16 data)
+{
+        outw(index, VBE_DISPI_IOPORT_INDEX);
+        outw(data, VBE_DISPI_IOPORT_DATA);
+}
+#endif
diff --git a/drivers/staging/vboxvideo/vbox_err.h b/drivers/staging/vboxvideo/vbox_err.h
new file mode 100644
index 000000000000..562db8630eb0
--- /dev/null
+++ b/drivers/staging/vboxvideo/vbox_err.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2017 Oracle Corporation
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ */
+#ifndef __VBOX_ERR_H__
+#define __VBOX_ERR_H__
+/**
+ * @name VirtualBox virtual-hardware error macros
+ * @{
+ */
+#define VINF_SUCCESS                        0
+#define VERR_INVALID_PARAMETER              (-2)
+#define VERR_INVALID_POINTER                (-6)
+#define VERR_NO_MEMORY                      (-8)
+#define VERR_NOT_IMPLEMENTED                (-12)
+#define VERR_INVALID_FUNCTION               (-36)
+#define VERR_NOT_SUPPORTED                  (-37)
+#define VERR_TOO_MUCH_DATA                  (-42)
+#define VERR_INVALID_STATE                  (-79)
+#define VERR_OUT_OF_RESOURCES               (-80)
+#define VERR_ALREADY_EXISTS                 (-105)
+#define VERR_INTERNAL_ERROR                 (-225)
+#define RT_SUCCESS_NP(rc)   ((int)(rc) >= VINF_SUCCESS)
+#define RT_SUCCESS(rc)      (likely(RT_SUCCESS_NP(rc)))
+#define RT_FAILURE(rc)      (unlikely(!RT_SUCCESS_NP(rc)))
+/** @}  */
+#endif
diff --git a/drivers/staging/vboxvideo/vbox_fb.c b/drivers/staging/vboxvideo/vbox_fb.c
new file mode 100644
index 000000000000..35f6d9f8c203
--- /dev/null
+++ b/drivers/staging/vboxvideo/vbox_fb.c
@@ -0,0 +1,412 @@
+/*
+ * Copyright (C) 2013-2017 Oracle Corporation
+ * This file is based on ast_fb.c
+ * Copyright 2012 Red Hat Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * Authors: Dave Airlie <airlied@redhat.com>
+ *          Michael Thayer <michael.thayer@oracle.com,
+ */
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/string.h>
+#include <linux/mm.h>
+#include <linux/tty.h>
+#include <linux/sysrq.h>
+#include <linux/delay.h>
+#include <linux/fb.h>
+#include <linux/init.h>
+#include <drm/drmP.h>
+#include <drm/drm_crtc.h>
+#include <drm/drm_fb_helper.h>
+#include <drm/drm_crtc_helper.h>
+#include "vbox_drv.h"
+#include "vboxvideo.h"
+#define VBOX_DIRTY_DELAY (HZ / 30)
+/**
+ * Tell the host about dirty rectangles to update.
+ */
+static void vbox_dirty_update(struct vbox_fbdev *fbdev,
+                              int x, int y, int width, int height)
+{
+        struct drm_gem_object *obj;
+        struct vbox_bo *bo;
+        int ret = -EBUSY;
+        bool store_for_later = false;
+        int x2, y2;
+        unsigned long flags;
+        struct drm_clip_rect rect;
+        obj = fbdev->afb.obj;
+        bo = gem_to_vbox_bo(obj);
+        /*
+         * try and reserve the BO, if we fail with busy
+         * then the BO is being moved and we should
+         * store up the damage until later.
+         */
+        if (drm_can_sleep())
+                ret = vbox_bo_reserve(bo, true);
+        if (ret) {
+                if (ret != -EBUSY)
+                        return;
+                store_for_later = true;
+        }
+        x2 = x + width - 1;
+        y2 = y + height - 1;
+        spin_lock_irqsave(&fbdev->dirty_lock, flags);
+        if (fbdev->y1 < y)
+                y = fbdev->y1;
+        if (fbdev->y2 > y2)
+                y2 = fbdev->y2;
+        if (fbdev->x1 < x)
+                x = fbdev->x1;
+        if (fbdev->x2 > x2)
+                x2 = fbdev->x2;
+        if (store_for_later) {
+                fbdev->x1 = x;
+                fbdev->x2 = x2;
+                fbdev->y1 = y;
+                fbdev->y2 = y2;
+                spin_unlock_irqrestore(&fbdev->dirty_lock, flags);
+                return;
+        }
+        fbdev->x1 = INT_MAX;
+        fbdev->y1 = INT_MAX;
+        fbdev->x2 = 0;
+        fbdev->y2 = 0;
+        spin_unlock_irqrestore(&fbdev->dirty_lock, flags);
+        /*
+         * Not sure why the original code subtracted 1 here, but I will keep
+         * it that way to avoid unnecessary differences.
+         */
+        rect.x1 = x;
+        rect.x2 = x2 + 1;
+        rect.y1 = y;
+        rect.y2 = y2 + 1;
+        vbox_framebuffer_dirty_rectangles(&fbdev->afb.base, &rect, 1);
+        vbox_bo_unreserve(bo);
+}
+#ifdef CONFIG_FB_DEFERRED_IO
+static void vbox_deferred_io(struct fb_info *info, struct list_head *pagelist)
+{
+        struct vbox_fbdev *fbdev = info->par;
+        unsigned long start, end, min, max;
+        struct page *page;
+        int y1, y2;
+        min = ULONG_MAX;
+        max = 0;
+        list_for_each_entry(page, pagelist, lru) {
+                start = page->index << PAGE_SHIFT;
+                end = start + PAGE_SIZE - 1;
+                min = min(min, start);
+                max = max(max, end);
+        }
+        if (min < max) {
+                y1 = min / info->fix.line_length;
+                y2 = (max / info->fix.line_length) + 1;
+                DRM_INFO("%s: Calling dirty update: 0, %d, %d, %d\n",
+                         __func__, y1, info->var.xres, y2 - y1 - 1);
+                vbox_dirty_update(fbdev, 0, y1, info->var.xres, y2 - y1 - 1);
+        }
+}
+static struct fb_deferred_io vbox_defio = {
+        .delay = VBOX_DIRTY_DELAY,
+        .deferred_io = vbox_deferred_io,
+};
+#endif
+static void vbox_fillrect(struct fb_info *info, const struct fb_fillrect *rect)
+{
+        struct vbox_fbdev *fbdev = info->par;
+        sys_fillrect(info, rect);
+        vbox_dirty_update(fbdev, rect->dx, rect->dy, rect->width, rect->height);
+}
+static void vbox_copyarea(struct fb_info *info, const struct fb_copyarea *area)
+{
+        struct vbox_fbdev *fbdev = info->par;
+        sys_copyarea(info, area);
+        vbox_dirty_update(fbdev, area->dx, area->dy, area->width, area->height);
+}
+static void vbox_imageblit(struct fb_info *info, const struct fb_image *image)
+{
+        struct vbox_fbdev *fbdev = info->par;
+        sys_imageblit(info, image);
+        vbox_dirty_update(fbdev, image->dx, image->dy, image->width,
+                          image->height);
+}
+static struct fb_ops vboxfb_ops = {
+        .owner = THIS_MODULE,
+        .fb_check_var = drm_fb_helper_check_var,
+        .fb_set_par = drm_fb_helper_set_par,
+        .fb_fillrect = vbox_fillrect,
+        .fb_copyarea = vbox_copyarea,
+        .fb_imageblit = vbox_imageblit,
+        .fb_pan_display = drm_fb_helper_pan_display,
+        .fb_blank = drm_fb_helper_blank,
+        .fb_setcmap = drm_fb_helper_setcmap,
+        .fb_debug_enter = drm_fb_helper_debug_enter,
+        .fb_debug_leave = drm_fb_helper_debug_leave,
+};
+static int vboxfb_create_object(struct vbox_fbdev *fbdev,
+                                struct DRM_MODE_FB_CMD *mode_cmd,
+                                struct drm_gem_object **gobj_p)
+{
+        struct drm_device *dev = fbdev->helper.dev;
+        u32 size;
+        struct drm_gem_object *gobj;
+        u32 pitch = mode_cmd->pitches[0];
+        int ret;
+        size = pitch * mode_cmd->height;
+        ret = vbox_gem_create(dev, size, true, &gobj);
+        if (ret)
+                return ret;
+        *gobj_p = gobj;
+        return 0;
+}
+static int vboxfb_create(struct drm_fb_helper *helper,
+                         struct drm_fb_helper_surface_size *sizes)
+{
+        struct vbox_fbdev *fbdev =
+            container_of(helper, struct vbox_fbdev, helper);
+        struct drm_device *dev = fbdev->helper.dev;
+        struct DRM_MODE_FB_CMD mode_cmd;
+        struct drm_framebuffer *fb;
+        struct fb_info *info;
+        struct device *device = &dev->pdev->dev;
+        struct drm_gem_object *gobj;
+        struct vbox_bo *bo;
+        int size, ret;
+        u32 pitch;
+        mode_cmd.width = sizes->surface_width;
+        mode_cmd.height = sizes->surface_height;
+        pitch = mode_cmd.width * ((sizes->surface_bpp + 7) / 8);
+        mode_cmd.pixel_format = drm_mode_legacy_fb_format(sizes->surface_bpp,
+                                                          sizes->surface_depth);
+        mode_cmd.pitches[0] = pitch;
+        size = pitch * mode_cmd.height;
+        ret = vboxfb_create_object(fbdev, &mode_cmd, &gobj);
+        if (ret) {
+                DRM_ERROR("failed to create fbcon backing object %d\n", ret);
+                return ret;
+        }
+        ret = vbox_framebuffer_init(dev, &fbdev->afb, &mode_cmd, gobj);
+        if (ret)
+                return ret;
+        bo = gem_to_vbox_bo(gobj);
+        ret = vbox_bo_reserve(bo, false);
+        if (ret)
+                return ret;
+        ret = vbox_bo_pin(bo, TTM_PL_FLAG_VRAM, NULL);
+        if (ret) {
+                vbox_bo_unreserve(bo);
+                return ret;
+        }
+        ret = ttm_bo_kmap(&bo->bo, 0, bo->bo.num_pages, &bo->kmap);
+        vbox_bo_unreserve(bo);
+        if (ret) {
+                DRM_ERROR("failed to kmap fbcon\n");
+                return ret;
+        }
+        info = framebuffer_alloc(0, device);
+        if (!info)
+                return -ENOMEM;
+        info->par = fbdev;
+        fbdev->size = size;
+        fb = &fbdev->afb.base;
+        fbdev->helper.fb = fb;
+        fbdev->helper.fbdev = info;
+        strcpy(info->fix.id, "vboxdrmfb");
+        /*
+         * The last flag forces a mode set on VT switches even if the kernel
+         * does not think it is needed.
+         */
+        info->flags = FBINFO_DEFAULT | FBINFO_CAN_FORCE_OUTPUT |
+                      FBINFO_MISC_ALWAYS_SETPAR;
+        info->fbops = &vboxfb_ops;
+        ret = fb_alloc_cmap(&info->cmap, 256, 0);
+        if (ret)
+                return -ENOMEM;
+        /*
+         * This seems to be done for safety checking that the framebuffer
+         * is not registered twice by different drivers.
+         */
+        info->apertures = alloc_apertures(1);
+        if (!info->apertures)
+                return -ENOMEM;
+        info->apertures->ranges[0].base = pci_resource_start(dev->pdev, 0);
+        info->apertures->ranges[0].size = pci_resource_len(dev->pdev, 0);
+        drm_fb_helper_fill_fix(info, fb->pitches[0], fb->format->depth);
+        drm_fb_helper_fill_var(info, &fbdev->helper, sizes->fb_width,
+                               sizes->fb_height);
+        info->screen_base = bo->kmap.virtual;
+        info->screen_size = size;
+#ifdef CONFIG_FB_DEFERRED_IO
+        info->fbdefio = &vbox_defio;
+        fb_deferred_io_init(info);
+#endif
+        info->pixmap.flags = FB_PIXMAP_SYSTEM;
+        DRM_DEBUG_KMS("allocated %dx%d\n", fb->width, fb->height);
+        return 0;
+}
+static void vbox_fb_gamma_set(struct drm_crtc *crtc, u16 red, u16 green,
+                              u16 blue, int regno)
+{
+}
+static void vbox_fb_gamma_get(struct drm_crtc *crtc, u16 *red, u16 *green,
+                              u16 *blue, int regno)
+{
+        *red = regno;
+        *green = regno;
+        *blue = regno;
+}
+static struct drm_fb_helper_funcs vbox_fb_helper_funcs = {
+        .gamma_set = vbox_fb_gamma_set,
+        .gamma_get = vbox_fb_gamma_get,
+        .fb_probe = vboxfb_create,
+};
+void vbox_fbdev_fini(struct drm_device *dev)
+{
+        struct vbox_private *vbox = dev->dev_private;
+        struct vbox_fbdev *fbdev = vbox->fbdev;
+        struct vbox_framebuffer *afb = &fbdev->afb;
+        drm_fb_helper_unregister_fbi(&fbdev->helper);
+        if (afb->obj) {
+                struct vbox_bo *bo = gem_to_vbox_bo(afb->obj);
+                if (!vbox_bo_reserve(bo, false)) {
+                        if (bo->kmap.virtual)
+                                ttm_bo_kunmap(&bo->kmap);
+                        /*
+                         * QXL does this, but is it really needed before
+                         * freeing?
+                         */
+                        if (bo->pin_count)
+                                vbox_bo_unpin(bo);
+                        vbox_bo_unreserve(bo);
+                }
+                drm_gem_object_unreference_unlocked(afb->obj);
+                afb->obj = NULL;
+        }
+        drm_fb_helper_fini(&fbdev->helper);
+        drm_framebuffer_unregister_private(&afb->base);
+        drm_framebuffer_cleanup(&afb->base);
+}
+int vbox_fbdev_init(struct drm_device *dev)
+{
+        struct vbox_private *vbox = dev->dev_private;
+        struct vbox_fbdev *fbdev;
+        int ret;
+        fbdev = devm_kzalloc(dev->dev, sizeof(*fbdev), GFP_KERNEL);
+        if (!fbdev)
+                return -ENOMEM;
+        vbox->fbdev = fbdev;
+        spin_lock_init(&fbdev->dirty_lock);
+        drm_fb_helper_prepare(dev, &fbdev->helper, &vbox_fb_helper_funcs);
+        ret = drm_fb_helper_init(dev, &fbdev->helper, vbox->num_crtcs);
+        if (ret)
+                return ret;
+        ret = drm_fb_helper_single_add_all_connectors(&fbdev->helper);
+        if (ret)
+                goto err_fini;
+        /* disable all the possible outputs/crtcs before entering KMS mode */
+        drm_helper_disable_unused_functions(dev);
+        ret = drm_fb_helper_initial_config(&fbdev->helper, 32);
+        if (ret)
+                goto err_fini;
+        return 0;
+err_fini:
+        drm_fb_helper_fini(&fbdev->helper);
+        return ret;
+}
+void vbox_fbdev_set_base(struct vbox_private *vbox, unsigned long gpu_addr)
+{
+        struct fb_info *fbdev = vbox->fbdev->helper.fbdev;
+        fbdev->fix.smem_start = fbdev->apertures->ranges[0].base + gpu_addr;
+        fbdev->fix.smem_len = vbox->available_vram_size - gpu_addr;
+}
diff --git a/drivers/staging/vboxvideo/vbox_hgsmi.c b/drivers/staging/vboxvideo/vbox_hgsmi.c
new file mode 100644
index 000000000000..822fd31121cb
--- /dev/null
+++ b/drivers/staging/vboxvideo/vbox_hgsmi.c
@@ -0,0 +1,115 @@
+/*
+ * Copyright (C) 2017 Oracle Corporation
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * Authors: Hans de Goede <hdegoede@redhat.com>
+ */
+#include "vbox_drv.h"
+#include "vboxvideo_vbe.h"
+#include "hgsmi_defs.h"
+/* One-at-a-Time Hash from http://www.burtleburtle.net/bob/hash/doobs.html */
+static u32 hgsmi_hash_process(u32 hash, const u8 *data, int size)
+{
+        while (size--) {
+                hash += *data++;
+                hash += (hash << 10);
+                hash ^= (hash >> 6);
+        }
+        return hash;
+}
+static u32 hgsmi_hash_end(u32 hash)
+{
+        hash += (hash << 3);
+        hash ^= (hash >> 11);
+        hash += (hash << 15);
+        return hash;
+}
+/* Not really a checksum but that is the naming used in all vbox code */
+static u32 hgsmi_checksum(u32 offset,
+                          const struct hgsmi_buffer_header *header,
+                          const struct hgsmi_buffer_tail *tail)
+{
+        u32 checksum;
+        checksum = hgsmi_hash_process(0, (u8 *)&offset, sizeof(offset));
+        checksum = hgsmi_hash_process(checksum, (u8 *)header, sizeof(*header));
+        /* 4 -> Do not checksum the checksum itself */
+        checksum = hgsmi_hash_process(checksum, (u8 *)tail, 4);
+        return hgsmi_hash_end(checksum);
+}
+void *hgsmi_buffer_alloc(struct gen_pool *guest_pool, size_t size,
+                         u8 channel, u16 channel_info)
+{
+        struct hgsmi_buffer_header *h;
+        struct hgsmi_buffer_tail *t;
+        size_t total_size;
+        dma_addr_t offset;
+        total_size = size + sizeof(*h) + sizeof(*t);
+        h = gen_pool_dma_alloc(guest_pool, total_size, &offset);
+        if (!h)
+                return NULL;
+        t = (struct hgsmi_buffer_tail *)((u8 *)h + sizeof(*h) + size);
+        h->flags = HGSMI_BUFFER_HEADER_F_SEQ_SINGLE;
+        h->data_size = size;
+        h->channel = channel;
+        h->channel_info = channel_info;
+        memset(&h->u.header_data, 0, sizeof(h->u.header_data));
+        t->reserved = 0;
+        t->checksum = hgsmi_checksum(offset, h, t);
+        return (u8 *)h + sizeof(*h);
+}
+void hgsmi_buffer_free(struct gen_pool *guest_pool, void *buf)
+{
+        struct hgsmi_buffer_header *h =
+                (struct hgsmi_buffer_header *)((u8 *)buf - sizeof(*h));
+        size_t total_size = h->data_size + sizeof(*h) +
+                                             sizeof(struct hgsmi_buffer_tail);
+        gen_pool_free(guest_pool, (unsigned long)h, total_size);
+}
+int hgsmi_buffer_submit(struct gen_pool *guest_pool, void *buf)
+{
+        phys_addr_t offset;
+        offset = gen_pool_virt_to_phys(guest_pool, (unsigned long)buf -
+                                       sizeof(struct hgsmi_buffer_header));
+        outl(offset, VGA_PORT_HGSMI_GUEST);
+        /* Make the compiler aware that the host has changed memory. */
+        mb();
+        return 0;
+}
diff --git a/drivers/staging/vboxvideo/vbox_irq.c b/drivers/staging/vboxvideo/vbox_irq.c
new file mode 100644
index 000000000000..3ca8bec62ac4
--- /dev/null
+++ b/drivers/staging/vboxvideo/vbox_irq.c
@@ -0,0 +1,197 @@
+/*
+ * Copyright (C) 2016-2017 Oracle Corporation
+ * This file is based on qxl_irq.c
+ * Copyright 2013 Red Hat Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * Authors: Dave Airlie
+ *          Alon Levy
+ *          Michael Thayer <michael.thayer@oracle.com,
+ *          Hans de Goede <hdegoede@redhat.com>
+ */
+#include <drm/drm_crtc_helper.h>
+#include "vbox_drv.h"
+#include "vboxvideo.h"
+static void vbox_clear_irq(void)
+{
+        outl((u32)~0, VGA_PORT_HGSMI_HOST);
+}
+static u32 vbox_get_flags(struct vbox_private *vbox)
+{
+        return readl(vbox->guest_heap + HOST_FLAGS_OFFSET);
+}
+void vbox_report_hotplug(struct vbox_private *vbox)
+{
+        schedule_work(&vbox->hotplug_work);
+}
+irqreturn_t vbox_irq_handler(int irq, void *arg)
+{
+        struct drm_device *dev = (struct drm_device *)arg;
+        struct vbox_private *vbox = (struct vbox_private *)dev->dev_private;
+        u32 host_flags = vbox_get_flags(vbox);
+        if (!(host_flags & HGSMIHOSTFLAGS_IRQ))
+                return IRQ_NONE;
+        /*
+         * Due to a bug in the initial host implementation of hot-plug irqs,
+         * the hot-plug and cursor capability flags were never cleared.
+         * Fortunately we can tell when they would have been set by checking
+         * that the VSYNC flag is not set.
+         */
+        if (host_flags &
+            (HGSMIHOSTFLAGS_HOTPLUG | HGSMIHOSTFLAGS_CURSOR_CAPABILITIES) &&
+            !(host_flags & HGSMIHOSTFLAGS_VSYNC))
+                vbox_report_hotplug(vbox);
+        vbox_clear_irq();
+        return IRQ_HANDLED;
+}
+/**
+ * Check that the position hints provided by the host are suitable for GNOME
+ * shell (i.e. all screens disjoint and hints for all enabled screens) and if
+ * not replace them with default ones.  Providing valid hints improves the
+ * chances that we will get a known screen layout for pointer mapping.
+ */
+static void validate_or_set_position_hints(struct vbox_private *vbox)
+{
+        struct vbva_modehint *hintsi, *hintsj;
+        bool valid = true;
+        u16 currentx = 0;
+        int i, j;
+        for (i = 0; i < vbox->num_crtcs; ++i) {
+                for (j = 0; j < i; ++j) {
+                        hintsi = &vbox->last_mode_hints[i];
+                        hintsj = &vbox->last_mode_hints[j];
+                        if (hintsi->enabled && hintsj->enabled) {
+                                if (hintsi->dx >= 0xffff ||
+                                    hintsi->dy >= 0xffff ||
+                                    hintsj->dx >= 0xffff ||
+                                    hintsj->dy >= 0xffff ||
+                                    (hintsi->dx <
+                                        hintsj->dx + (hintsj->cx & 0x8fff) &&
+                                     hintsi->dx + (hintsi->cx & 0x8fff) >
+                                        hintsj->dx) ||
+                                    (hintsi->dy <
+                                        hintsj->dy + (hintsj->cy & 0x8fff) &&
+                                     hintsi->dy + (hintsi->cy & 0x8fff) >
+                                        hintsj->dy))
+                                        valid = false;
+                        }
+                }
+        }
+        if (!valid)
+                for (i = 0; i < vbox->num_crtcs; ++i) {
+                        if (vbox->last_mode_hints[i].enabled) {
+                                vbox->last_mode_hints[i].dx = currentx;
+                                vbox->last_mode_hints[i].dy = 0;
+                                currentx +=
+                                    vbox->last_mode_hints[i].cx & 0x8fff;
+                        }
+                }
+}
+/**
+ * Query the host for the most recent video mode hints.
+ */
+static void vbox_update_mode_hints(struct vbox_private *vbox)
+{
+        struct drm_device *dev = vbox->dev;
+        struct drm_connector *connector;
+        struct vbox_connector *vbox_conn;
+        struct vbva_modehint *hints;
+        u16 flags;
+        bool disconnected;
+        unsigned int crtc_id;
+        int ret;
+        ret = hgsmi_get_mode_hints(vbox->guest_pool, vbox->num_crtcs,
+                                   vbox->last_mode_hints);
+        if (ret) {
+                DRM_ERROR("vboxvideo: hgsmi_get_mode_hints failed: %d\n", ret);
+                return;
+        }
+        validate_or_set_position_hints(vbox);
+        drm_modeset_lock_all(dev);
+        list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+                vbox_conn = to_vbox_connector(connector);
+                hints = &vbox->last_mode_hints[vbox_conn->vbox_crtc->crtc_id];
+                if (hints->magic != VBVAMODEHINT_MAGIC)
+                        continue;
+                disconnected = !(hints->enabled);
+                crtc_id = vbox_conn->vbox_crtc->crtc_id;
+                vbox_conn->mode_hint.width = hints->cx & 0x8fff;
+                vbox_conn->mode_hint.height = hints->cy & 0x8fff;
+                vbox_conn->vbox_crtc->x_hint = hints->dx;
+                vbox_conn->vbox_crtc->y_hint = hints->dy;
+                vbox_conn->mode_hint.disconnected = disconnected;
+                if (vbox_conn->vbox_crtc->disconnected == disconnected)
+                        continue;
+                if (disconnected)
+                        flags = VBVA_SCREEN_F_ACTIVE | VBVA_SCREEN_F_DISABLED;
+                else
+                        flags = VBVA_SCREEN_F_ACTIVE | VBVA_SCREEN_F_BLANK;
+                hgsmi_process_display_info(vbox->guest_pool, crtc_id, 0, 0, 0,
+                                           hints->cx * 4, hints->cx,
+                                           hints->cy, 0, flags);
+                vbox_conn->vbox_crtc->disconnected = disconnected;
+        }
+        drm_modeset_unlock_all(dev);
+}
+static void vbox_hotplug_worker(struct work_struct *work)
+{
+        struct vbox_private *vbox = container_of(work, struct vbox_private,
+                                                 hotplug_work);
+        vbox_update_mode_hints(vbox);
+        drm_kms_helper_hotplug_event(vbox->dev);
+}
+int vbox_irq_init(struct vbox_private *vbox)
+{
+        INIT_WORK(&vbox->hotplug_work, vbox_hotplug_worker);
+        vbox_update_mode_hints(vbox);
+        return drm_irq_install(vbox->dev, vbox->dev->pdev->irq);
+}
+void vbox_irq_fini(struct vbox_private *vbox)
+{
+        drm_irq_uninstall(vbox->dev);
+        flush_work(&vbox->hotplug_work);
+}
diff --git a/drivers/staging/vboxvideo/vbox_main.c b/drivers/staging/vboxvideo/vbox_main.c
new file mode 100644
index 000000000000..d0c6ec75a3c7
--- /dev/null
+++ b/drivers/staging/vboxvideo/vbox_main.c
@@ -0,0 +1,534 @@
+/*
+ * Copyright (C) 2013-2017 Oracle Corporation
+ * This file is based on ast_main.c
+ * Copyright 2012 Red Hat Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * Authors: Dave Airlie <airlied@redhat.com>,
+ *          Michael Thayer <michael.thayer@oracle.com,
+ *          Hans de Goede <hdegoede@redhat.com>
+ */
+#include <drm/drm_fb_helper.h>
+#include <drm/drm_crtc_helper.h>
+#include "vbox_drv.h"
+#include "vbox_err.h"
+#include "vboxvideo_guest.h"
+#include "vboxvideo_vbe.h"
+static void vbox_user_framebuffer_destroy(struct drm_framebuffer *fb)
+{
+        struct vbox_framebuffer *vbox_fb = to_vbox_framebuffer(fb);
+        if (vbox_fb->obj)
+                drm_gem_object_unreference_unlocked(vbox_fb->obj);
+        drm_framebuffer_cleanup(fb);
+        kfree(fb);
+}
+void vbox_enable_accel(struct vbox_private *vbox)
+{
+        unsigned int i;
+        struct vbva_buffer *vbva;
+        if (!vbox->vbva_info || !vbox->vbva_buffers) {
+                /* Should never happen... */
+                DRM_ERROR("vboxvideo: failed to set up VBVA.\n");
+                return;
+        }
+        for (i = 0; i < vbox->num_crtcs; ++i) {
+                if (vbox->vbva_info[i].vbva)
+                        continue;
+                vbva = (void *)vbox->vbva_buffers + i * VBVA_MIN_BUFFER_SIZE;
+                if (!vbva_enable(&vbox->vbva_info[i],
+                                 vbox->guest_pool, vbva, i)) {
+                        /* very old host or driver error. */
+                        DRM_ERROR("vboxvideo: vbva_enable failed\n");
+                        return;
+                }
+        }
+}
+void vbox_disable_accel(struct vbox_private *vbox)
+{
+        unsigned int i;
+        for (i = 0; i < vbox->num_crtcs; ++i)
+                vbva_disable(&vbox->vbva_info[i], vbox->guest_pool, i);
+}
+void vbox_report_caps(struct vbox_private *vbox)
+{
+        u32 caps = VBVACAPS_DISABLE_CURSOR_INTEGRATION |
+                   VBVACAPS_IRQ | VBVACAPS_USE_VBVA_ONLY;
+        if (vbox->initial_mode_queried)
+                caps |= VBVACAPS_VIDEO_MODE_HINTS;
+        hgsmi_send_caps_info(vbox->guest_pool, caps);
+}
+/**
+ * Send information about dirty rectangles to VBVA.  If necessary we enable
+ * VBVA first, as this is normally disabled after a change of master in case
+ * the new master does not send dirty rectangle information (is this even
+ * allowed?)
+ */
+void vbox_framebuffer_dirty_rectangles(struct drm_framebuffer *fb,
+                                       struct drm_clip_rect *rects,
+                                       unsigned int num_rects)
+{
+        struct vbox_private *vbox = fb->dev->dev_private;
+        struct drm_crtc *crtc;
+        unsigned int i;
+        mutex_lock(&vbox->hw_mutex);
+        list_for_each_entry(crtc, &fb->dev->mode_config.crtc_list, head) {
+                if (CRTC_FB(crtc) != fb)
+                        continue;
+                vbox_enable_accel(vbox);
+                for (i = 0; i < num_rects; ++i) {
+                        struct vbva_cmd_hdr cmd_hdr;
+                        unsigned int crtc_id = to_vbox_crtc(crtc)->crtc_id;
+                        if ((rects[i].x1 > crtc->x + crtc->hwmode.hdisplay) ||
+                            (rects[i].y1 > crtc->y + crtc->hwmode.vdisplay) ||
+                            (rects[i].x2 < crtc->x) ||
+                            (rects[i].y2 < crtc->y))
+                                continue;
+                        cmd_hdr.x = (s16)rects[i].x1;
+                        cmd_hdr.y = (s16)rects[i].y1;
+                        cmd_hdr.w = (u16)rects[i].x2 - rects[i].x1;
+                        cmd_hdr.h = (u16)rects[i].y2 - rects[i].y1;
+                        if (!vbva_buffer_begin_update(&vbox->vbva_info[crtc_id],
+                                                      vbox->guest_pool))
+                                continue;
+                        vbva_write(&vbox->vbva_info[crtc_id], vbox->guest_pool,
+                                   &cmd_hdr, sizeof(cmd_hdr));
+                        vbva_buffer_end_update(&vbox->vbva_info[crtc_id]);
+                }
+        }
+        mutex_unlock(&vbox->hw_mutex);
+}
+static int vbox_user_framebuffer_dirty(struct drm_framebuffer *fb,
+                                       struct drm_file *file_priv,
+                                       unsigned int flags, unsigned int color,
+                                       struct drm_clip_rect *rects,
+                                       unsigned int num_rects)
+{
+        vbox_framebuffer_dirty_rectangles(fb, rects, num_rects);
+        return 0;
+}
+static const struct drm_framebuffer_funcs vbox_fb_funcs = {
+        .destroy = vbox_user_framebuffer_destroy,
+        .dirty = vbox_user_framebuffer_dirty,
+};
+int vbox_framebuffer_init(struct drm_device *dev,
+                          struct vbox_framebuffer *vbox_fb,
+                          const struct DRM_MODE_FB_CMD *mode_cmd,
+                          struct drm_gem_object *obj)
+{
+        int ret;
+        drm_helper_mode_fill_fb_struct(dev, &vbox_fb->base, mode_cmd);
+        vbox_fb->obj = obj;
+        ret = drm_framebuffer_init(dev, &vbox_fb->base, &vbox_fb_funcs);
+        if (ret) {
+                DRM_ERROR("framebuffer init failed %d\n", ret);
+                return ret;
+        }
+        return 0;
+}
+static struct drm_framebuffer *vbox_user_framebuffer_create(
+                struct drm_device *dev,
+                struct drm_file *filp,
+                const struct drm_mode_fb_cmd2 *mode_cmd)
+{
+        struct drm_gem_object *obj;
+        struct vbox_framebuffer *vbox_fb;
+        int ret = -ENOMEM;
+        obj = drm_gem_object_lookup(filp, mode_cmd->handles[0]);
+        if (!obj)
+                return ERR_PTR(-ENOENT);
+        vbox_fb = kzalloc(sizeof(*vbox_fb), GFP_KERNEL);
+        if (!vbox_fb)
+                goto err_unref_obj;
+        ret = vbox_framebuffer_init(dev, vbox_fb, mode_cmd, obj);
+        if (ret)
+                goto err_free_vbox_fb;
+        return &vbox_fb->base;
+err_free_vbox_fb:
+        kfree(vbox_fb);
+err_unref_obj:
+        drm_gem_object_unreference_unlocked(obj);
+        return ERR_PTR(ret);
+}
+static const struct drm_mode_config_funcs vbox_mode_funcs = {
+        .fb_create = vbox_user_framebuffer_create,
+};
+static int vbox_accel_init(struct vbox_private *vbox)
+{
+        unsigned int i;
+        vbox->vbva_info = devm_kcalloc(vbox->dev->dev, vbox->num_crtcs,
+                                       sizeof(*vbox->vbva_info), GFP_KERNEL);
+        if (!vbox->vbva_info)
+                return -ENOMEM;
+        /* Take a command buffer for each screen from the end of usable VRAM. */
+        vbox->available_vram_size -= vbox->num_crtcs * VBVA_MIN_BUFFER_SIZE;
+        vbox->vbva_buffers = pci_iomap_range(vbox->dev->pdev, 0,
+                                             vbox->available_vram_size,
+                                             vbox->num_crtcs *
+                                             VBVA_MIN_BUFFER_SIZE);
+        if (!vbox->vbva_buffers)
+                return -ENOMEM;
+        for (i = 0; i < vbox->num_crtcs; ++i)
+                vbva_setup_buffer_context(&vbox->vbva_info[i],
+                                          vbox->available_vram_size +
+                                          i * VBVA_MIN_BUFFER_SIZE,
+                                          VBVA_MIN_BUFFER_SIZE);
+        return 0;
+}
+static void vbox_accel_fini(struct vbox_private *vbox)
+{
+        vbox_disable_accel(vbox);
+        pci_iounmap(vbox->dev->pdev, vbox->vbva_buffers);
+}
+/** Do we support the 4.3 plus mode hint reporting interface? */
+static bool have_hgsmi_mode_hints(struct vbox_private *vbox)
+{
+        u32 have_hints, have_cursor;
+        int ret;
+        ret = hgsmi_query_conf(vbox->guest_pool,
+                               VBOX_VBVA_CONF32_MODE_HINT_REPORTING,
+                               &have_hints);
+        if (ret)
+                return false;
+        ret = hgsmi_query_conf(vbox->guest_pool,
+                               VBOX_VBVA_CONF32_GUEST_CURSOR_REPORTING,
+                               &have_cursor);
+        if (ret)
+                return false;
+        return have_hints == VINF_SUCCESS && have_cursor == VINF_SUCCESS;
+}
+static bool vbox_check_supported(u16 id)
+{
+        u16 dispi_id;
+        vbox_write_ioport(VBE_DISPI_INDEX_ID, id);
+        dispi_id = inw(VBE_DISPI_IOPORT_DATA);
+        return dispi_id == id;
+}
+/**
+ * Set up our heaps and data exchange buffers in VRAM before handing the rest
+ * to the memory manager.
+ */
+static int vbox_hw_init(struct vbox_private *vbox)
+{
+        int ret = -ENOMEM;
+        vbox->full_vram_size = inl(VBE_DISPI_IOPORT_DATA);
+        vbox->any_pitch = vbox_check_supported(VBE_DISPI_ID_ANYX);
+        DRM_INFO("VRAM %08x\n", vbox->full_vram_size);
+        /* Map guest-heap at end of vram */
+        vbox->guest_heap =
+            pci_iomap_range(vbox->dev->pdev, 0, GUEST_HEAP_OFFSET(vbox),
+                            GUEST_HEAP_SIZE);
+        if (!vbox->guest_heap)
+                return -ENOMEM;
+        /* Create guest-heap mem-pool use 2^4 = 16 byte chunks */
+        vbox->guest_pool = gen_pool_create(4, -1);
+        if (!vbox->guest_pool)
+                goto err_unmap_guest_heap;
+        ret = gen_pool_add_virt(vbox->guest_pool,
+                                (unsigned long)vbox->guest_heap,
+                                GUEST_HEAP_OFFSET(vbox),
+                                GUEST_HEAP_USABLE_SIZE, -1);
+        if (ret)
+                goto err_destroy_guest_pool;
+        ret = hgsmi_test_query_conf(vbox->guest_pool);
+        if (ret) {
+                DRM_ERROR("vboxvideo: hgsmi_test_query_conf failed\n");
+                goto err_destroy_guest_pool;
+        }
+        /* Reduce available VRAM size to reflect the guest heap. */
+        vbox->available_vram_size = GUEST_HEAP_OFFSET(vbox);
+        /* Linux drm represents monitors as a 32-bit array. */
+        hgsmi_query_conf(vbox->guest_pool, VBOX_VBVA_CONF32_MONITOR_COUNT,
+                         &vbox->num_crtcs);
+        vbox->num_crtcs = clamp_t(u32, vbox->num_crtcs, 1, VBOX_MAX_SCREENS);
+        if (!have_hgsmi_mode_hints(vbox)) {
+                ret = -ENOTSUPP;
+                goto err_destroy_guest_pool;
+        }
+        vbox->last_mode_hints = devm_kcalloc(vbox->dev->dev, vbox->num_crtcs,
+                                             sizeof(struct vbva_modehint),
+                                             GFP_KERNEL);
+        if (!vbox->last_mode_hints) {
+                ret = -ENOMEM;
+                goto err_destroy_guest_pool;
+        }
+        ret = vbox_accel_init(vbox);
+        if (ret)
+                goto err_destroy_guest_pool;
+        return 0;
+err_destroy_guest_pool:
+        gen_pool_destroy(vbox->guest_pool);
+err_unmap_guest_heap:
+        pci_iounmap(vbox->dev->pdev, vbox->guest_heap);
+        return ret;
+}
+static void vbox_hw_fini(struct vbox_private *vbox)
+{
+        vbox_accel_fini(vbox);
+        gen_pool_destroy(vbox->guest_pool);
+        pci_iounmap(vbox->dev->pdev, vbox->guest_heap);
+}
+int vbox_driver_load(struct drm_device *dev, unsigned long flags)
+{
+        struct vbox_private *vbox;
+        int ret = 0;
+        if (!vbox_check_supported(VBE_DISPI_ID_HGSMI))
+                return -ENODEV;
+        vbox = devm_kzalloc(dev->dev, sizeof(*vbox), GFP_KERNEL);
+        if (!vbox)
+                return -ENOMEM;
+        dev->dev_private = vbox;
+        vbox->dev = dev;
+        mutex_init(&vbox->hw_mutex);
+        ret = vbox_hw_init(vbox);
+        if (ret)
+                return ret;
+        ret = vbox_mm_init(vbox);
+        if (ret)
+                goto err_hw_fini;
+        drm_mode_config_init(dev);
+        dev->mode_config.funcs = (void *)&vbox_mode_funcs;
+        dev->mode_config.min_width = 64;
+        dev->mode_config.min_height = 64;
+        dev->mode_config.preferred_depth = 24;
+        dev->mode_config.max_width = VBE_DISPI_MAX_XRES;
+        dev->mode_config.max_height = VBE_DISPI_MAX_YRES;
+        ret = vbox_mode_init(dev);
+        if (ret)
+                goto err_drm_mode_cleanup;
+        ret = vbox_irq_init(vbox);
+        if (ret)
+                goto err_mode_fini;
+        ret = vbox_fbdev_init(dev);
+        if (ret)
+                goto err_irq_fini;
+        return 0;
+err_irq_fini:
+        vbox_irq_fini(vbox);
+err_mode_fini:
+        vbox_mode_fini(dev);
+err_drm_mode_cleanup:
+        drm_mode_config_cleanup(dev);
+        vbox_mm_fini(vbox);
+err_hw_fini:
+        vbox_hw_fini(vbox);
+        return ret;
+}
+void vbox_driver_unload(struct drm_device *dev)
+{
+        struct vbox_private *vbox = dev->dev_private;
+        vbox_fbdev_fini(dev);
+        vbox_irq_fini(vbox);
+        vbox_mode_fini(dev);
+        drm_mode_config_cleanup(dev);
+        vbox_mm_fini(vbox);
+        vbox_hw_fini(vbox);
+}
+/**
+ * @note this is described in the DRM framework documentation.  AST does not
+ * have it, but we get an oops on driver unload if it is not present.
+ */
+void vbox_driver_lastclose(struct drm_device *dev)
+{
+        struct vbox_private *vbox = dev->dev_private;
+        if (vbox->fbdev)
+                drm_fb_helper_restore_fbdev_mode_unlocked(&vbox->fbdev->helper);
+}
+int vbox_gem_create(struct drm_device *dev,
+                    u32 size, bool iskernel, struct drm_gem_object **obj)
+{
+        struct vbox_bo *vboxbo;
+        int ret;
+        *obj = NULL;
+        size = roundup(size, PAGE_SIZE);
+        if (size == 0)
+                return -EINVAL;
+        ret = vbox_bo_create(dev, size, 0, 0, &vboxbo);
+        if (ret) {
+                if (ret != -ERESTARTSYS)
+                        DRM_ERROR("failed to allocate GEM object\n");
+                return ret;
+        }
+        *obj = &vboxbo->gem;
+        return 0;
+}
+int vbox_dumb_create(struct drm_file *file,
+                     struct drm_device *dev, struct drm_mode_create_dumb *args)
+{
+        int ret;
+        struct drm_gem_object *gobj;
+        u32 handle;
+        args->pitch = args->width * ((args->bpp + 7) / 8);
+        args->size = args->pitch * args->height;
+        ret = vbox_gem_create(dev, args->size, false, &gobj);
+        if (ret)
+                return ret;
+        ret = drm_gem_handle_create(file, gobj, &handle);
+        drm_gem_object_unreference_unlocked(gobj);
+        if (ret)
+                return ret;
+        args->handle = handle;
+        return 0;
+}
+static void vbox_bo_unref(struct vbox_bo **bo)
+{
+        struct ttm_buffer_object *tbo;
+        if ((*bo) == NULL)
+                return;
+        tbo = &((*bo)->bo);
+        ttm_bo_unref(&tbo);
+        if (!tbo)
+                *bo = NULL;
+}
+void vbox_gem_free_object(struct drm_gem_object *obj)
+{
+        struct vbox_bo *vbox_bo = gem_to_vbox_bo(obj);
+        vbox_bo_unref(&vbox_bo);
+}
+static inline u64 vbox_bo_mmap_offset(struct vbox_bo *bo)
+{
+        return drm_vma_node_offset_addr(&bo->bo.vma_node);
+}
+int
+vbox_dumb_mmap_offset(struct drm_file *file,
+                      struct drm_device *dev,
+                      u32 handle, u64 *offset)
+{
+        struct drm_gem_object *obj;
+        int ret;
+        struct vbox_bo *bo;
+        mutex_lock(&dev->struct_mutex);
+        obj = drm_gem_object_lookup(file, handle);
+        if (!obj) {
+                ret = -ENOENT;
+                goto out_unlock;
+        }
+        bo = gem_to_vbox_bo(obj);
+        *offset = vbox_bo_mmap_offset(bo);
+        drm_gem_object_unreference(obj);
+        ret = 0;
+out_unlock:
+        mutex_unlock(&dev->struct_mutex);
+        return ret;
+}
diff --git a/drivers/staging/vboxvideo/vbox_mode.c b/drivers/staging/vboxvideo/vbox_mode.c
new file mode 100644
index 000000000000..f2b85f3256fa
--- /dev/null
+++ b/drivers/staging/vboxvideo/vbox_mode.c
@@ -0,0 +1,877 @@
+/*
+ * Copyright (C) 2013-2017 Oracle Corporation
+ * This file is based on ast_mode.c
+ * Copyright 2012 Red Hat Inc.
+ * Parts based on xf86-video-ast
+ * Copyright (c) 2005 ASPEED Technology Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ */
+/*
+ * Authors: Dave Airlie <airlied@redhat.com>
+ *          Michael Thayer <michael.thayer@oracle.com,
+ *          Hans de Goede <hdegoede@redhat.com>
+ */
+#include <linux/export.h>
+#include <drm/drm_crtc_helper.h>
+#include <drm/drm_plane_helper.h>
+#include "vbox_drv.h"
+#include "vboxvideo.h"
+#include "hgsmi_channels.h"
+static int vbox_cursor_set2(struct drm_crtc *crtc, struct drm_file *file_priv,
+                            u32 handle, u32 width, u32 height,
+                            s32 hot_x, s32 hot_y);
+static int vbox_cursor_move(struct drm_crtc *crtc, int x, int y);
+/**
+ * Set a graphics mode.  Poke any required values into registers, do an HGSMI
+ * mode set and tell the host we support advanced graphics functions.
+ */
+static void vbox_do_modeset(struct drm_crtc *crtc,
+                            const struct drm_display_mode *mode)
+{
+        struct vbox_crtc *vbox_crtc = to_vbox_crtc(crtc);
+        struct vbox_private *vbox;
+        int width, height, bpp, pitch;
+        unsigned int crtc_id;
+        u16 flags;
+        s32 x_offset, y_offset;
+        vbox = crtc->dev->dev_private;
+        width = mode->hdisplay ? mode->hdisplay : 640;
+        height = mode->vdisplay ? mode->vdisplay : 480;
+        crtc_id = vbox_crtc->crtc_id;
+        bpp = crtc->enabled ? CRTC_FB(crtc)->format->cpp[0] * 8 : 32;
+        pitch = crtc->enabled ? CRTC_FB(crtc)->pitches[0] : width * bpp / 8;
+        x_offset = vbox->single_framebuffer ? crtc->x : vbox_crtc->x_hint;
+        y_offset = vbox->single_framebuffer ? crtc->y : vbox_crtc->y_hint;
+        /*
+         * This is the old way of setting graphics modes.  It assumed one screen
+         * and a frame-buffer at the start of video RAM.  On older versions of
+         * VirtualBox, certain parts of the code still assume that the first
+         * screen is programmed this way, so try to fake it.
+         */
+        if (vbox_crtc->crtc_id == 0 && crtc->enabled &&
+            vbox_crtc->fb_offset / pitch < 0xffff - crtc->y &&
+            vbox_crtc->fb_offset % (bpp / 8) == 0) {
+                vbox_write_ioport(VBE_DISPI_INDEX_XRES, width);
+                vbox_write_ioport(VBE_DISPI_INDEX_YRES, height);
+                vbox_write_ioport(VBE_DISPI_INDEX_VIRT_WIDTH, pitch * 8 / bpp);
+                vbox_write_ioport(VBE_DISPI_INDEX_BPP,
+                                  CRTC_FB(crtc)->format->cpp[0] * 8);
+                vbox_write_ioport(VBE_DISPI_INDEX_ENABLE, VBE_DISPI_ENABLED);
+                vbox_write_ioport(
+                        VBE_DISPI_INDEX_X_OFFSET,
+                        vbox_crtc->fb_offset % pitch / bpp * 8 + crtc->x);
+                vbox_write_ioport(VBE_DISPI_INDEX_Y_OFFSET,
+                                  vbox_crtc->fb_offset / pitch + crtc->y);
+        }
+        flags = VBVA_SCREEN_F_ACTIVE;
+        flags |= (crtc->enabled && !vbox_crtc->blanked) ?
+                 0 : VBVA_SCREEN_F_BLANK;
+        flags |= vbox_crtc->disconnected ? VBVA_SCREEN_F_DISABLED : 0;
+        hgsmi_process_display_info(vbox->guest_pool, vbox_crtc->crtc_id,
+                                   x_offset, y_offset,
+                                   crtc->x * bpp / 8 + crtc->y * pitch,
+                                   pitch, width, height,
+                                   vbox_crtc->blanked ? 0 : bpp, flags);
+}
+static int vbox_set_view(struct drm_crtc *crtc)
+{
+        struct vbox_crtc *vbox_crtc = to_vbox_crtc(crtc);
+        struct vbox_private *vbox = crtc->dev->dev_private;
+        struct vbva_infoview *p;
+        /*
+         * Tell the host about the view.  This design originally targeted the
+         * Windows XP driver architecture and assumed that each screen would
+         * have a dedicated frame buffer with the command buffer following it,
+         * the whole being a "view".  The host works out which screen a command
+         * buffer belongs to by checking whether it is in the first view, then
+         * whether it is in the second and so on.  The first match wins.  We
+         * cheat around this by making the first view be the managed memory
+         * plus the first command buffer, the second the same plus the second
+         * buffer and so on.
+         */
+        p = hgsmi_buffer_alloc(vbox->guest_pool, sizeof(*p),
+                               HGSMI_CH_VBVA, VBVA_INFO_VIEW);
+        if (!p)
+                return -ENOMEM;
+        p->view_index = vbox_crtc->crtc_id;
+        p->view_offset = vbox_crtc->fb_offset;
+        p->view_size = vbox->available_vram_size - vbox_crtc->fb_offset +
+                       vbox_crtc->crtc_id * VBVA_MIN_BUFFER_SIZE;
+        p->max_screen_size = vbox->available_vram_size - vbox_crtc->fb_offset;
+        hgsmi_buffer_submit(vbox->guest_pool, p);
+        hgsmi_buffer_free(vbox->guest_pool, p);
+        return 0;
+}
+static void vbox_crtc_load_lut(struct drm_crtc *crtc)
+{
+}
+static void vbox_crtc_dpms(struct drm_crtc *crtc, int mode)
+{
+        struct vbox_crtc *vbox_crtc = to_vbox_crtc(crtc);
+        struct vbox_private *vbox = crtc->dev->dev_private;
+        switch (mode) {
+        case DRM_MODE_DPMS_ON:
+                vbox_crtc->blanked = false;
+                break;
+        case DRM_MODE_DPMS_STANDBY:
+        case DRM_MODE_DPMS_SUSPEND:
+        case DRM_MODE_DPMS_OFF:
+                vbox_crtc->blanked = true;
+                break;
+        }
+        mutex_lock(&vbox->hw_mutex);
+        vbox_do_modeset(crtc, &crtc->hwmode);
+        mutex_unlock(&vbox->hw_mutex);
+}
+static bool vbox_crtc_mode_fixup(struct drm_crtc *crtc,
+                                 const struct drm_display_mode *mode,
+                                 struct drm_display_mode *adjusted_mode)
+{
+        return true;
+}
+/*
+ * Try to map the layout of virtual screens to the range of the input device.
+ * Return true if we need to re-set the crtc modes due to screen offset
+ * changes.
+ */
+static bool vbox_set_up_input_mapping(struct vbox_private *vbox)
+{
+        struct drm_crtc *crtci;
+        struct drm_connector *connectori;
+        struct drm_framebuffer *fb1 = NULL;
+        bool single_framebuffer = true;
+        bool old_single_framebuffer = vbox->single_framebuffer;
+        u16 width = 0, height = 0;
+        /*
+         * Are we using an X.Org-style single large frame-buffer for all crtcs?
+         * If so then screen layout can be deduced from the crtc offsets.
+         * Same fall-back if this is the fbdev frame-buffer.
+         */
+        list_for_each_entry(crtci, &vbox->dev->mode_config.crtc_list, head) {
+                if (!fb1) {
+                        fb1 = CRTC_FB(crtci);
+                        if (to_vbox_framebuffer(fb1) == &vbox->fbdev->afb)
+                                break;
+                } else if (CRTC_FB(crtci) && fb1 != CRTC_FB(crtci)) {
+                        single_framebuffer = false;
+                }
+        }
+        if (single_framebuffer) {
+                list_for_each_entry(crtci, &vbox->dev->mode_config.crtc_list,
+                                    head) {
+                        if (to_vbox_crtc(crtci)->crtc_id != 0)
+                                continue;
+                        vbox->single_framebuffer = true;
+                        vbox->input_mapping_width = CRTC_FB(crtci)->width;
+                        vbox->input_mapping_height = CRTC_FB(crtci)->height;
+                        return old_single_framebuffer !=
+                               vbox->single_framebuffer;
+                }
+        }
+        /* Otherwise calculate the total span of all screens. */
+        list_for_each_entry(connectori, &vbox->dev->mode_config.connector_list,
+                            head) {
+                struct vbox_connector *vbox_connector =
+                    to_vbox_connector(connectori);
+                struct vbox_crtc *vbox_crtc = vbox_connector->vbox_crtc;
+                width = max_t(u16, width, vbox_crtc->x_hint +
+                                          vbox_connector->mode_hint.width);
+                height = max_t(u16, height, vbox_crtc->y_hint +
+                                            vbox_connector->mode_hint.height);
+        }
+        vbox->single_framebuffer = false;
+        vbox->input_mapping_width = width;
+        vbox->input_mapping_height = height;
+        return old_single_framebuffer != vbox->single_framebuffer;
+}
+static int vbox_crtc_do_set_base(struct drm_crtc *crtc,
+                                 struct drm_framebuffer *old_fb, int x, int y)
+{
+        struct vbox_private *vbox = crtc->dev->dev_private;
+        struct vbox_crtc *vbox_crtc = to_vbox_crtc(crtc);
+        struct drm_gem_object *obj;
+        struct vbox_framebuffer *vbox_fb;
+        struct vbox_bo *bo;
+        int ret;
+        u64 gpu_addr;
+        /* Unpin the previous fb. */
+        if (old_fb) {
+                vbox_fb = to_vbox_framebuffer(old_fb);
+                obj = vbox_fb->obj;
+                bo = gem_to_vbox_bo(obj);
+                ret = vbox_bo_reserve(bo, false);
+                if (ret)
+                        return ret;
+                vbox_bo_unpin(bo);
+                vbox_bo_unreserve(bo);
+        }
+        vbox_fb = to_vbox_framebuffer(CRTC_FB(crtc));
+        obj = vbox_fb->obj;
+        bo = gem_to_vbox_bo(obj);
+        ret = vbox_bo_reserve(bo, false);
+        if (ret)
+                return ret;
+        ret = vbox_bo_pin(bo, TTM_PL_FLAG_VRAM, &gpu_addr);
+        if (ret) {
+                vbox_bo_unreserve(bo);
+                return ret;
+        }
+        if (&vbox->fbdev->afb == vbox_fb)
+                vbox_fbdev_set_base(vbox, gpu_addr);
+        vbox_bo_unreserve(bo);
+        /* vbox_set_start_address_crt1(crtc, (u32)gpu_addr); */
+        vbox_crtc->fb_offset = gpu_addr;
+        if (vbox_set_up_input_mapping(vbox)) {
+                struct drm_crtc *crtci;
+                list_for_each_entry(crtci, &vbox->dev->mode_config.crtc_list,
+                                    head) {
+                        vbox_set_view(crtc);
+                        vbox_do_modeset(crtci, &crtci->mode);
+                }
+        }
+        return 0;
+}
+static int vbox_crtc_mode_set_base(struct drm_crtc *crtc, int x, int y,
+                                   struct drm_framebuffer *old_fb)
+{
+        return vbox_crtc_do_set_base(crtc, old_fb, x, y);
+}
+static int vbox_crtc_mode_set(struct drm_crtc *crtc,
+                              struct drm_display_mode *mode,
+                              struct drm_display_mode *adjusted_mode,
+                              int x, int y, struct drm_framebuffer *old_fb)
+{
+        struct vbox_private *vbox = crtc->dev->dev_private;
+        int ret;
+        vbox_crtc_mode_set_base(crtc, x, y, old_fb);
+        mutex_lock(&vbox->hw_mutex);
+        ret = vbox_set_view(crtc);
+        if (!ret)
+                vbox_do_modeset(crtc, mode);
+        hgsmi_update_input_mapping(vbox->guest_pool, 0, 0,
+                                   vbox->input_mapping_width,
+                                   vbox->input_mapping_height);
+        mutex_unlock(&vbox->hw_mutex);
+        return ret;
+}
+static void vbox_crtc_disable(struct drm_crtc *crtc)
+{
+}
+static void vbox_crtc_prepare(struct drm_crtc *crtc)
+{
+}
+static void vbox_crtc_commit(struct drm_crtc *crtc)
+{
+}
+static const struct drm_crtc_helper_funcs vbox_crtc_helper_funcs = {
+        .dpms = vbox_crtc_dpms,
+        .mode_fixup = vbox_crtc_mode_fixup,
+        .mode_set = vbox_crtc_mode_set,
+        /* .mode_set_base = vbox_crtc_mode_set_base, */
+        .disable = vbox_crtc_disable,
+        .load_lut = vbox_crtc_load_lut,
+        .prepare = vbox_crtc_prepare,
+        .commit = vbox_crtc_commit,
+};
+static void vbox_crtc_reset(struct drm_crtc *crtc)
+{
+}
+static void vbox_crtc_destroy(struct drm_crtc *crtc)
+{
+        drm_crtc_cleanup(crtc);
+        kfree(crtc);
+}
+static const struct drm_crtc_funcs vbox_crtc_funcs = {
+        .cursor_move = vbox_cursor_move,
+        .cursor_set2 = vbox_cursor_set2,
+        .reset = vbox_crtc_reset,
+        .set_config = drm_crtc_helper_set_config,
+        /* .gamma_set = vbox_crtc_gamma_set, */
+        .destroy = vbox_crtc_destroy,
+};
+static struct vbox_crtc *vbox_crtc_init(struct drm_device *dev, unsigned int i)
+{
+        struct vbox_crtc *vbox_crtc;
+        vbox_crtc = kzalloc(sizeof(*vbox_crtc), GFP_KERNEL);
+        if (!vbox_crtc)
+                return NULL;
+        vbox_crtc->crtc_id = i;
+        drm_crtc_init(dev, &vbox_crtc->base, &vbox_crtc_funcs);
+        drm_mode_crtc_set_gamma_size(&vbox_crtc->base, 256);
+        drm_crtc_helper_add(&vbox_crtc->base, &vbox_crtc_helper_funcs);
+        return vbox_crtc;
+}
+static void vbox_encoder_destroy(struct drm_encoder *encoder)
+{
+        drm_encoder_cleanup(encoder);
+        kfree(encoder);
+}
+static struct drm_encoder *vbox_best_single_encoder(struct drm_connector
+                                                    *connector)
+{
+        int enc_id = connector->encoder_ids[0];
+        /* pick the encoder ids */
+        if (enc_id)
+                return drm_encoder_find(connector->dev, enc_id);
+        return NULL;
+}
+static const struct drm_encoder_funcs vbox_enc_funcs = {
+        .destroy = vbox_encoder_destroy,
+};
+static void vbox_encoder_dpms(struct drm_encoder *encoder, int mode)
+{
+}
+static bool vbox_mode_fixup(struct drm_encoder *encoder,
+                            const struct drm_display_mode *mode,
+                            struct drm_display_mode *adjusted_mode)
+{
+        return true;
+}
+static void vbox_encoder_mode_set(struct drm_encoder *encoder,
+                                  struct drm_display_mode *mode,
+                                  struct drm_display_mode *adjusted_mode)
+{
+}
+static void vbox_encoder_prepare(struct drm_encoder *encoder)
+{
+}
+static void vbox_encoder_commit(struct drm_encoder *encoder)
+{
+}
+static const struct drm_encoder_helper_funcs vbox_enc_helper_funcs = {
+        .dpms = vbox_encoder_dpms,
+        .mode_fixup = vbox_mode_fixup,
+        .prepare = vbox_encoder_prepare,
+        .commit = vbox_encoder_commit,
+        .mode_set = vbox_encoder_mode_set,
+};
+static struct drm_encoder *vbox_encoder_init(struct drm_device *dev,
+                                             unsigned int i)
+{
+        struct vbox_encoder *vbox_encoder;
+        vbox_encoder = kzalloc(sizeof(*vbox_encoder), GFP_KERNEL);
+        if (!vbox_encoder)
+                return NULL;
+        drm_encoder_init(dev, &vbox_encoder->base, &vbox_enc_funcs,
+                         DRM_MODE_ENCODER_DAC, NULL);
+        drm_encoder_helper_add(&vbox_encoder->base, &vbox_enc_helper_funcs);
+        vbox_encoder->base.possible_crtcs = 1 << i;
+        return &vbox_encoder->base;
+}
+/**
+ * Generate EDID data with a mode-unique serial number for the virtual
+ *  monitor to try to persuade Unity that different modes correspond to
+ *  different monitors and it should not try to force the same resolution on
+ *  them.
+ */
+static void vbox_set_edid(struct drm_connector *connector, int width,
+                          int height)
+{
+        enum { EDID_SIZE = 128 };
+        unsigned char edid[EDID_SIZE] = {
+                0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x00, /* header */
+                0x58, 0x58,     /* manufacturer (VBX) */
+                0x00, 0x00,     /* product code */
+                0x00, 0x00, 0x00, 0x00, /* serial number goes here */
+                0x01,           /* week of manufacture */
+                0x00,           /* year of manufacture */
+                0x01, 0x03,     /* EDID version */
+                0x80,           /* capabilities - digital */
+                0x00,           /* horiz. res in cm, zero for projectors */
+                0x00,           /* vert. res in cm */
+                0x78,           /* display gamma (120 == 2.2). */
+                0xEE,           /* features (standby, suspend, off, RGB, std */
+                                /* colour space, preferred timing mode) */
+                0xEE, 0x91, 0xA3, 0x54, 0x4C, 0x99, 0x26, 0x0F, 0x50, 0x54,
+                /* chromaticity for standard colour space. */
+                0x00, 0x00, 0x00,       /* no default timings */
+                0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
+                    0x01, 0x01,
+                0x01, 0x01, 0x01, 0x01, /* no standard timings */
+                0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x06, 0x00, 0x02, 0x02,
+                    0x02, 0x02,
+                /* descriptor block 1 goes below */
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                /* descriptor block 2, monitor ranges */
+                0x00, 0x00, 0x00, 0xFD, 0x00,
+                0x00, 0xC8, 0x00, 0xC8, 0x64, 0x00, 0x0A, 0x20, 0x20, 0x20,
+                    0x20, 0x20,
+                /* 0-200Hz vertical, 0-200KHz horizontal, 1000MHz pixel clock */
+                0x20,
+                /* descriptor block 3, monitor name */
+                0x00, 0x00, 0x00, 0xFC, 0x00,
+                'V', 'B', 'O', 'X', ' ', 'm', 'o', 'n', 'i', 't', 'o', 'r',
+                '\n',
+                /* descriptor block 4: dummy data */
+                0x00, 0x00, 0x00, 0x10, 0x00,
+                0x0A, 0x20, 0x20, 0x20, 0x20, 0x20,
+                0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+                0x20,
+                0x00,           /* number of extensions */
+                0x00            /* checksum goes here */
+        };
+        int clock = (width + 6) * (height + 6) * 60 / 10000;
+        unsigned int i, sum = 0;
+        edid[12] = width & 0xff;
+        edid[13] = width >> 8;
+        edid[14] = height & 0xff;
+        edid[15] = height >> 8;
+        edid[54] = clock & 0xff;
+        edid[55] = clock >> 8;
+        edid[56] = width & 0xff;
+        edid[58] = (width >> 4) & 0xf0;
+        edid[59] = height & 0xff;
+        edid[61] = (height >> 4) & 0xf0;
+        for (i = 0; i < EDID_SIZE - 1; ++i)
+                sum += edid[i];
+        edid[EDID_SIZE - 1] = (0x100 - (sum & 0xFF)) & 0xFF;
+        drm_mode_connector_update_edid_property(connector, (struct edid *)edid);
+}
+static int vbox_get_modes(struct drm_connector *connector)
+{
+        struct vbox_connector *vbox_connector = NULL;
+        struct drm_display_mode *mode = NULL;
+        struct vbox_private *vbox = NULL;
+        unsigned int num_modes = 0;
+        int preferred_width, preferred_height;
+        vbox_connector = to_vbox_connector(connector);
+        vbox = connector->dev->dev_private;
+        /*
+         * Heuristic: we do not want to tell the host that we support dynamic
+         * resizing unless we feel confident that the user space client using
+         * the video driver can handle hot-plug events.  So the first time modes
+         * are queried after a "master" switch we tell the host that we do not,
+         * and immediately after we send the client a hot-plug notification as
+         * a test to see if they will respond and query again.
+         * That is also the reason why capabilities are reported to the host at
+         * this place in the code rather than elsewhere.
+         * We need to report the flags location before reporting the IRQ
+         * capability.
+         */
+        hgsmi_report_flags_location(vbox->guest_pool, GUEST_HEAP_OFFSET(vbox) +
+                                    HOST_FLAGS_OFFSET);
+        if (vbox_connector->vbox_crtc->crtc_id == 0)
+                vbox_report_caps(vbox);
+        if (!vbox->initial_mode_queried) {
+                if (vbox_connector->vbox_crtc->crtc_id == 0) {
+                        vbox->initial_mode_queried = true;
+                        vbox_report_hotplug(vbox);
+                }
+                return drm_add_modes_noedid(connector, 800, 600);
+        }
+        num_modes = drm_add_modes_noedid(connector, 2560, 1600);
+        preferred_width = vbox_connector->mode_hint.width ?
+                          vbox_connector->mode_hint.width : 1024;
+        preferred_height = vbox_connector->mode_hint.height ?
+                           vbox_connector->mode_hint.height : 768;
+        mode = drm_cvt_mode(connector->dev, preferred_width, preferred_height,
+                            60, false, false, false);
+        if (mode) {
+                mode->type |= DRM_MODE_TYPE_PREFERRED;
+                drm_mode_probed_add(connector, mode);
+                ++num_modes;
+        }
+        vbox_set_edid(connector, preferred_width, preferred_height);
+        drm_object_property_set_value(
+                &connector->base, vbox->dev->mode_config.suggested_x_property,
+                vbox_connector->vbox_crtc->x_hint);
+        drm_object_property_set_value(
+                &connector->base, vbox->dev->mode_config.suggested_y_property,
+                vbox_connector->vbox_crtc->y_hint);
+        return num_modes;
+}
+static int vbox_mode_valid(struct drm_connector *connector,
+                           struct drm_display_mode *mode)
+{
+        return MODE_OK;
+}
+static void vbox_connector_destroy(struct drm_connector *connector)
+{
+        struct vbox_connector *vbox_connector;
+        vbox_connector = to_vbox_connector(connector);
+        drm_connector_unregister(connector);
+        drm_connector_cleanup(connector);
+        kfree(connector);
+}
+static enum drm_connector_status
+vbox_connector_detect(struct drm_connector *connector, bool force)
+{
+        struct vbox_connector *vbox_connector;
+        vbox_connector = to_vbox_connector(connector);
+        return vbox_connector->mode_hint.disconnected ?
+            connector_status_disconnected : connector_status_connected;
+}
+static int vbox_fill_modes(struct drm_connector *connector, u32 max_x,
+                           u32 max_y)
+{
+        struct vbox_connector *vbox_connector;
+        struct drm_device *dev;
+        struct drm_display_mode *mode, *iterator;
+        vbox_connector = to_vbox_connector(connector);
+        dev = vbox_connector->base.dev;
+        list_for_each_entry_safe(mode, iterator, &connector->modes, head) {
+                list_del(&mode->head);
+                drm_mode_destroy(dev, mode);
+        }
+        return drm_helper_probe_single_connector_modes(connector, max_x, max_y);
+}
+static const struct drm_connector_helper_funcs vbox_connector_helper_funcs = {
+        .mode_valid = vbox_mode_valid,
+        .get_modes = vbox_get_modes,
+        .best_encoder = vbox_best_single_encoder,
+};
+static const struct drm_connector_funcs vbox_connector_funcs = {
+        .dpms = drm_helper_connector_dpms,
+        .detect = vbox_connector_detect,
+        .fill_modes = vbox_fill_modes,
+        .destroy = vbox_connector_destroy,
+};
+static int vbox_connector_init(struct drm_device *dev,
+                               struct vbox_crtc *vbox_crtc,
+                               struct drm_encoder *encoder)
+{
+        struct vbox_connector *vbox_connector;
+        struct drm_connector *connector;
+        vbox_connector = kzalloc(sizeof(*vbox_connector), GFP_KERNEL);
+        if (!vbox_connector)
+                return -ENOMEM;
+        connector = &vbox_connector->base;
+        vbox_connector->vbox_crtc = vbox_crtc;
+        drm_connector_init(dev, connector, &vbox_connector_funcs,
+                           DRM_MODE_CONNECTOR_VGA);
+        drm_connector_helper_add(connector, &vbox_connector_helper_funcs);
+        connector->interlace_allowed = 0;
+        connector->doublescan_allowed = 0;
+        drm_mode_create_suggested_offset_properties(dev);
+        drm_object_attach_property(&connector->base,
+                                   dev->mode_config.suggested_x_property, -1);
+        drm_object_attach_property(&connector->base,
+                                   dev->mode_config.suggested_y_property, -1);
+        drm_connector_register(connector);
+        drm_mode_connector_attach_encoder(connector, encoder);
+        return 0;
+}
+int vbox_mode_init(struct drm_device *dev)
+{
+        struct vbox_private *vbox = dev->dev_private;
+        struct drm_encoder *encoder;
+        struct vbox_crtc *vbox_crtc;
+        unsigned int i;
+        int ret;
+        /* vbox_cursor_init(dev); */
+        for (i = 0; i < vbox->num_crtcs; ++i) {
+                vbox_crtc = vbox_crtc_init(dev, i);
+                if (!vbox_crtc)
+                        return -ENOMEM;
+                encoder = vbox_encoder_init(dev, i);
+                if (!encoder)
+                        return -ENOMEM;
+                ret = vbox_connector_init(dev, vbox_crtc, encoder);
+                if (ret)
+                        return ret;
+        }
+        return 0;
+}
+void vbox_mode_fini(struct drm_device *dev)
+{
+        /* vbox_cursor_fini(dev); */
+}
+/**
+ * Copy the ARGB image and generate the mask, which is needed in case the host
+ * does not support ARGB cursors.  The mask is a 1BPP bitmap with the bit set
+ * if the corresponding alpha value in the ARGB image is greater than 0xF0.
+ */
+static void copy_cursor_image(u8 *src, u8 *dst, u32 width, u32 height,
+                              size_t mask_size)
+{
+        size_t line_size = (width + 7) / 8;
+        u32 i, j;
+        memcpy(dst + mask_size, src, width * height * 4);
+        for (i = 0; i < height; ++i)
+                for (j = 0; j < width; ++j)
+                        if (((u32 *)src)[i * width + j] > 0xf0000000)
+                                dst[i * line_size + j / 8] |= (0x80 >> (j % 8));
+}
+static int vbox_cursor_set2(struct drm_crtc *crtc, struct drm_file *file_priv,
+                            u32 handle, u32 width, u32 height,
+                            s32 hot_x, s32 hot_y)
+{
+        struct vbox_private *vbox = crtc->dev->dev_private;
+        struct vbox_crtc *vbox_crtc = to_vbox_crtc(crtc);
+        struct ttm_bo_kmap_obj uobj_map;
+        size_t data_size, mask_size;
+        struct drm_gem_object *obj;
+        u32 flags, caps = 0;
+        struct vbox_bo *bo;
+        bool src_isiomem;
+        u8 *dst = NULL;
+        u8 *src;
+        int ret;
+        /*
+         * Re-set this regularly as in 5.0.20 and earlier the information was
+         * lost on save and restore.
+         */
+        hgsmi_update_input_mapping(vbox->guest_pool, 0, 0,
+                                   vbox->input_mapping_width,
+                                   vbox->input_mapping_height);
+        if (!handle) {
+                bool cursor_enabled = false;
+                struct drm_crtc *crtci;
+                /* Hide cursor. */
+                vbox_crtc->cursor_enabled = false;
+                list_for_each_entry(crtci, &vbox->dev->mode_config.crtc_list,
+                                    head) {
+                        if (to_vbox_crtc(crtci)->cursor_enabled)
+                                cursor_enabled = true;
+                }
+                if (!cursor_enabled)
+                        hgsmi_update_pointer_shape(vbox->guest_pool, 0, 0, 0,
+                                                   0, 0, NULL, 0);
+                return 0;
+        }
+        vbox_crtc->cursor_enabled = true;
+        if (width > VBOX_MAX_CURSOR_WIDTH || height > VBOX_MAX_CURSOR_HEIGHT ||
+            width == 0 || height == 0)
+                return -EINVAL;
+        ret = hgsmi_query_conf(vbox->guest_pool,
+                               VBOX_VBVA_CONF32_CURSOR_CAPABILITIES, &caps);
+        if (ret)
+                return ret;
+        if (!(caps & VBOX_VBVA_CURSOR_CAPABILITY_HARDWARE)) {
+                /*
+                 * -EINVAL means cursor_set2() not supported, -EAGAIN means
+                 * retry at once.
+                 */
+                return -EBUSY;
+        }
+        obj = drm_gem_object_lookup(file_priv, handle);
+        if (!obj) {
+                DRM_ERROR("Cannot find cursor object %x for crtc\n", handle);
+                return -ENOENT;
+        }
+        bo = gem_to_vbox_bo(obj);
+        ret = vbox_bo_reserve(bo, false);
+        if (ret)
+                goto out_unref_obj;
+        /*
+         * The mask must be calculated based on the alpha
+         * channel, one bit per ARGB word, and must be 32-bit
+         * padded.
+         */
+        mask_size = ((width + 7) / 8 * height + 3) & ~3;
+        data_size = width * height * 4 + mask_size;
+        vbox->cursor_hot_x = min_t(u32, max(hot_x, 0), width);
+        vbox->cursor_hot_y = min_t(u32, max(hot_y, 0), height);
+        vbox->cursor_width = width;
+        vbox->cursor_height = height;
+        vbox->cursor_data_size = data_size;
+        dst = vbox->cursor_data;
+        ret = ttm_bo_kmap(&bo->bo, 0, bo->bo.num_pages, &uobj_map);
+        if (ret) {
+                vbox->cursor_data_size = 0;
+                goto out_unreserve_bo;
+        }
+        src = ttm_kmap_obj_virtual(&uobj_map, &src_isiomem);
+        if (src_isiomem) {
+                DRM_ERROR("src cursor bo not in main memory\n");
+                ret = -EIO;
+                goto out_unmap_bo;
+        }
+        copy_cursor_image(src, dst, width, height, mask_size);
+        flags = VBOX_MOUSE_POINTER_VISIBLE | VBOX_MOUSE_POINTER_SHAPE |
+                VBOX_MOUSE_POINTER_ALPHA;
+        ret = hgsmi_update_pointer_shape(vbox->guest_pool, flags,
+                                         vbox->cursor_hot_x, vbox->cursor_hot_y,
+                                         width, height, dst, data_size);
+out_unmap_bo:
+        ttm_bo_kunmap(&uobj_map);
+out_unreserve_bo:
+        vbox_bo_unreserve(bo);
+out_unref_obj:
+        drm_gem_object_unreference_unlocked(obj);
+        return ret;
+}
+static int vbox_cursor_move(struct drm_crtc *crtc, int x, int y)
+{
+        struct vbox_private *vbox = crtc->dev->dev_private;
+        u32 flags = VBOX_MOUSE_POINTER_VISIBLE |
+            VBOX_MOUSE_POINTER_SHAPE | VBOX_MOUSE_POINTER_ALPHA;
+        s32 crtc_x =
+            vbox->single_framebuffer ? crtc->x : to_vbox_crtc(crtc)->x_hint;
+        s32 crtc_y =
+            vbox->single_framebuffer ? crtc->y : to_vbox_crtc(crtc)->y_hint;
+        u32 host_x, host_y;
+        u32 hot_x = 0;
+        u32 hot_y = 0;
+        int ret;
+        /*
+         * We compare these to unsigned later and don't
+         * need to handle negative.
+         */
+        if (x + crtc_x < 0 || y + crtc_y < 0 || vbox->cursor_data_size == 0)
+                return 0;
+        ret = hgsmi_cursor_position(vbox->guest_pool, true, x + crtc_x,
+                                    y + crtc_y, &host_x, &host_y);
+        /*
+         * The only reason we have vbox_cursor_move() is that some older clients
+         * might use DRM_IOCTL_MODE_CURSOR instead of DRM_IOCTL_MODE_CURSOR2 and
+         * use DRM_MODE_CURSOR_MOVE to set the hot-spot.
+         *
+         * However VirtualBox 5.0.20 and earlier has a bug causing it to return
+         * 0,0 as host cursor location after a save and restore.
+         *
+         * To work around this we ignore a 0, 0 return, since missing the odd
+         * time when it legitimately happens is not going to hurt much.
+         */
+        if (ret || (host_x == 0 && host_y == 0))
+                return ret;
+        if (x + crtc_x < host_x)
+                hot_x = min(host_x - x - crtc_x, vbox->cursor_width);
+        if (y + crtc_y < host_y)
+                hot_y = min(host_y - y - crtc_y, vbox->cursor_height);
+        if (hot_x == vbox->cursor_hot_x && hot_y == vbox->cursor_hot_y)
+                return 0;
+        vbox->cursor_hot_x = hot_x;
+        vbox->cursor_hot_y = hot_y;
+        return hgsmi_update_pointer_shape(vbox->guest_pool, flags,
+                        hot_x, hot_y, vbox->cursor_width, vbox->cursor_height,
+                        vbox->cursor_data, vbox->cursor_data_size);
+}
diff --git a/drivers/staging/vboxvideo/vbox_prime.c b/drivers/staging/vboxvideo/vbox_prime.c
new file mode 100644
index 000000000000..b7453e427a1d
--- /dev/null
+++ b/drivers/staging/vboxvideo/vbox_prime.c
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2017 Oracle Corporation
+ * Copyright 2017 Canonical
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * Authors: Andreas Pokorny
+ */
+#include "vbox_drv.h"
+/*
+ * Based on qxl_prime.c:
+ * Empty Implementations as there should not be any other driver for a virtual
+ * device that might share buffers with vboxvideo
+ */
+int vbox_gem_prime_pin(struct drm_gem_object *obj)
+{
+        WARN_ONCE(1, "not implemented");
+        return -ENOSYS;
+}
+void vbox_gem_prime_unpin(struct drm_gem_object *obj)
+{
+        WARN_ONCE(1, "not implemented");
+}
+struct sg_table *vbox_gem_prime_get_sg_table(struct drm_gem_object *obj)
+{
+        WARN_ONCE(1, "not implemented");
+        return ERR_PTR(-ENOSYS);
+}
+struct drm_gem_object *vbox_gem_prime_import_sg_table(
+        struct drm_device *dev, struct dma_buf_attachment *attach,
+        struct sg_table *table)
+{
+        WARN_ONCE(1, "not implemented");
+        return ERR_PTR(-ENOSYS);
+}
+void *vbox_gem_prime_vmap(struct drm_gem_object *obj)
+{
+        WARN_ONCE(1, "not implemented");
+        return ERR_PTR(-ENOSYS);
+}
+void vbox_gem_prime_vunmap(struct drm_gem_object *obj, void *vaddr)
+{
+        WARN_ONCE(1, "not implemented");
+}
+int vbox_gem_prime_mmap(struct drm_gem_object *obj, struct vm_area_struct *area)
+{
+        WARN_ONCE(1, "not implemented");
+        return -ENOSYS;
+}
diff --git a/drivers/staging/vboxvideo/vbox_ttm.c b/drivers/staging/vboxvideo/vbox_ttm.c
new file mode 100644
index 000000000000..34a905d40735
--- /dev/null
+++ b/drivers/staging/vboxvideo/vbox_ttm.c
@@ -0,0 +1,472 @@
+/*
+ * Copyright (C) 2013-2017 Oracle Corporation
+ * This file is based on ast_ttm.c
+ * Copyright 2012 Red Hat Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ *
+ * Authors: Dave Airlie <airlied@redhat.com>
+ *          Michael Thayer <michael.thayer@oracle.com>
+ */
+#include "vbox_drv.h"
+#include <ttm/ttm_page_alloc.h>
+static inline struct vbox_private *vbox_bdev(struct ttm_bo_device *bd)
+{
+        return container_of(bd, struct vbox_private, ttm.bdev);
+}
+static int vbox_ttm_mem_global_init(struct drm_global_reference *ref)
+{
+        return ttm_mem_global_init(ref->object);
+}
+static void vbox_ttm_mem_global_release(struct drm_global_reference *ref)
+{
+        ttm_mem_global_release(ref->object);
+}
+/**
+ * Adds the vbox memory manager object/structures to the global memory manager.
+ */
+static int vbox_ttm_global_init(struct vbox_private *vbox)
+{
+        struct drm_global_reference *global_ref;
+        int ret;
+        global_ref = &vbox->ttm.mem_global_ref;
+        global_ref->global_type = DRM_GLOBAL_TTM_MEM;
+        global_ref->size = sizeof(struct ttm_mem_global);
+        global_ref->init = &vbox_ttm_mem_global_init;
+        global_ref->release = &vbox_ttm_mem_global_release;
+        ret = drm_global_item_ref(global_ref);
+        if (ret) {
+                DRM_ERROR("Failed setting up TTM memory subsystem.\n");
+                return ret;
+        }
+        vbox->ttm.bo_global_ref.mem_glob = vbox->ttm.mem_global_ref.object;
+        global_ref = &vbox->ttm.bo_global_ref.ref;
+        global_ref->global_type = DRM_GLOBAL_TTM_BO;
+        global_ref->size = sizeof(struct ttm_bo_global);
+        global_ref->init = &ttm_bo_global_init;
+        global_ref->release = &ttm_bo_global_release;
+        ret = drm_global_item_ref(global_ref);
+        if (ret) {
+                DRM_ERROR("Failed setting up TTM BO subsystem.\n");
+                drm_global_item_unref(&vbox->ttm.mem_global_ref);
+                return ret;
+        }
+        return 0;
+}
+/**
+ * Removes the vbox memory manager object from the global memory manager.
+ */
+static void vbox_ttm_global_release(struct vbox_private *vbox)
+{
+        drm_global_item_unref(&vbox->ttm.bo_global_ref.ref);
+        drm_global_item_unref(&vbox->ttm.mem_global_ref);
+}
+static void vbox_bo_ttm_destroy(struct ttm_buffer_object *tbo)
+{
+        struct vbox_bo *bo;
+        bo = container_of(tbo, struct vbox_bo, bo);
+        drm_gem_object_release(&bo->gem);
+        kfree(bo);
+}
+static bool vbox_ttm_bo_is_vbox_bo(struct ttm_buffer_object *bo)
+{
+        if (bo->destroy == &vbox_bo_ttm_destroy)
+                return true;
+        return false;
+}
+static int
+vbox_bo_init_mem_type(struct ttm_bo_device *bdev, u32 type,
+                      struct ttm_mem_type_manager *man)
+{
+        switch (type) {
+        case TTM_PL_SYSTEM:
+                man->flags = TTM_MEMTYPE_FLAG_MAPPABLE;
+                man->available_caching = TTM_PL_MASK_CACHING;
+                man->default_caching = TTM_PL_FLAG_CACHED;
+                break;
+        case TTM_PL_VRAM:
+                man->func = &ttm_bo_manager_func;
+                man->flags = TTM_MEMTYPE_FLAG_FIXED | TTM_MEMTYPE_FLAG_MAPPABLE;
+                man->available_caching = TTM_PL_FLAG_UNCACHED | TTM_PL_FLAG_WC;
+                man->default_caching = TTM_PL_FLAG_WC;
+                break;
+        default:
+                DRM_ERROR("Unsupported memory type %u\n", (unsigned int)type);
+                return -EINVAL;
+        }
+        return 0;
+}
+static void
+vbox_bo_evict_flags(struct ttm_buffer_object *bo, struct ttm_placement *pl)
+{
+        struct vbox_bo *vboxbo = vbox_bo(bo);
+        if (!vbox_ttm_bo_is_vbox_bo(bo))
+                return;
+        vbox_ttm_placement(vboxbo, TTM_PL_FLAG_SYSTEM);
+        *pl = vboxbo->placement;
+}
+static int vbox_bo_verify_access(struct ttm_buffer_object *bo,
+                                 struct file *filp)
+{
+        return 0;
+}
+static int vbox_ttm_io_mem_reserve(struct ttm_bo_device *bdev,
+                                   struct ttm_mem_reg *mem)
+{
+        struct ttm_mem_type_manager *man = &bdev->man[mem->mem_type];
+        struct vbox_private *vbox = vbox_bdev(bdev);
+        mem->bus.addr = NULL;
+        mem->bus.offset = 0;
+        mem->bus.size = mem->num_pages << PAGE_SHIFT;
+        mem->bus.base = 0;
+        mem->bus.is_iomem = false;
+        if (!(man->flags & TTM_MEMTYPE_FLAG_MAPPABLE))
+                return -EINVAL;
+        switch (mem->mem_type) {
+        case TTM_PL_SYSTEM:
+                /* system memory */
+                return 0;
+        case TTM_PL_VRAM:
+                mem->bus.offset = mem->start << PAGE_SHIFT;
+                mem->bus.base = pci_resource_start(vbox->dev->pdev, 0);
+                mem->bus.is_iomem = true;
+                break;
+        default:
+                return -EINVAL;
+        }
+        return 0;
+}
+static void vbox_ttm_io_mem_free(struct ttm_bo_device *bdev,
+                                 struct ttm_mem_reg *mem)
+{
+}
+static int vbox_bo_move(struct ttm_buffer_object *bo,
+                        bool evict, bool interruptible,
+                        bool no_wait_gpu, struct ttm_mem_reg *new_mem)
+{
+        return ttm_bo_move_memcpy(bo, interruptible, no_wait_gpu, new_mem);
+}
+static void vbox_ttm_backend_destroy(struct ttm_tt *tt)
+{
+        ttm_tt_fini(tt);
+        kfree(tt);
+}
+static struct ttm_backend_func vbox_tt_backend_func = {
+        .destroy = &vbox_ttm_backend_destroy,
+};
+static struct ttm_tt *vbox_ttm_tt_create(struct ttm_bo_device *bdev,
+                                         unsigned long size,
+                                         u32 page_flags,
+                                         struct page *dummy_read_page)
+{
+        struct ttm_tt *tt;
+        tt = kzalloc(sizeof(*tt), GFP_KERNEL);
+        if (!tt)
+                return NULL;
+        tt->func = &vbox_tt_backend_func;
+        if (ttm_tt_init(tt, bdev, size, page_flags, dummy_read_page)) {
+                kfree(tt);
+                return NULL;
+        }
+        return tt;
+}
+static int vbox_ttm_tt_populate(struct ttm_tt *ttm)
+{
+        return ttm_pool_populate(ttm);
+}
+static void vbox_ttm_tt_unpopulate(struct ttm_tt *ttm)
+{
+        ttm_pool_unpopulate(ttm);
+}
+struct ttm_bo_driver vbox_bo_driver = {
+        .ttm_tt_create = vbox_ttm_tt_create,
+        .ttm_tt_populate = vbox_ttm_tt_populate,
+        .ttm_tt_unpopulate = vbox_ttm_tt_unpopulate,
+        .init_mem_type = vbox_bo_init_mem_type,
+        .eviction_valuable = ttm_bo_eviction_valuable,
+        .evict_flags = vbox_bo_evict_flags,
+        .move = vbox_bo_move,
+        .verify_access = vbox_bo_verify_access,
+        .io_mem_reserve = &vbox_ttm_io_mem_reserve,
+        .io_mem_free = &vbox_ttm_io_mem_free,
+        .io_mem_pfn = ttm_bo_default_io_mem_pfn,
+};
+int vbox_mm_init(struct vbox_private *vbox)
+{
+        int ret;
+        struct drm_device *dev = vbox->dev;
+        struct ttm_bo_device *bdev = &vbox->ttm.bdev;
+        ret = vbox_ttm_global_init(vbox);
+        if (ret)
+                return ret;
+        ret = ttm_bo_device_init(&vbox->ttm.bdev,
+                                 vbox->ttm.bo_global_ref.ref.object,
+                                 &vbox_bo_driver,
+                                 dev->anon_inode->i_mapping,
+                                 DRM_FILE_PAGE_OFFSET, true);
+        if (ret) {
+                DRM_ERROR("Error initialising bo driver; %d\n", ret);
+                goto err_ttm_global_release;
+        }
+        ret = ttm_bo_init_mm(bdev, TTM_PL_VRAM,
+                             vbox->available_vram_size >> PAGE_SHIFT);
+        if (ret) {
+                DRM_ERROR("Failed ttm VRAM init: %d\n", ret);
+                goto err_device_release;
+        }
+#ifdef DRM_MTRR_WC
+        vbox->fb_mtrr = drm_mtrr_add(pci_resource_start(dev->pdev, 0),
+                                     pci_resource_len(dev->pdev, 0),
+                                     DRM_MTRR_WC);
+#else
+        vbox->fb_mtrr = arch_phys_wc_add(pci_resource_start(dev->pdev, 0),
+                                         pci_resource_len(dev->pdev, 0));
+#endif
+        return 0;
+err_device_release:
+        ttm_bo_device_release(&vbox->ttm.bdev);
+err_ttm_global_release:
+        vbox_ttm_global_release(vbox);
+        return ret;
+}
+void vbox_mm_fini(struct vbox_private *vbox)
+{
+#ifdef DRM_MTRR_WC
+        drm_mtrr_del(vbox->fb_mtrr,
+                     pci_resource_start(vbox->dev->pdev, 0),
+                     pci_resource_len(vbox->dev->pdev, 0), DRM_MTRR_WC);
+#else
+        arch_phys_wc_del(vbox->fb_mtrr);
+#endif
+        ttm_bo_device_release(&vbox->ttm.bdev);
+        vbox_ttm_global_release(vbox);
+}
+void vbox_ttm_placement(struct vbox_bo *bo, int domain)
+{
+        unsigned int i;
+        u32 c = 0;
+        bo->placement.placement = bo->placements;
+        bo->placement.busy_placement = bo->placements;
+        if (domain & TTM_PL_FLAG_VRAM)
+                bo->placements[c++].flags =
+                    TTM_PL_FLAG_WC | TTM_PL_FLAG_UNCACHED | TTM_PL_FLAG_VRAM;
+        if (domain & TTM_PL_FLAG_SYSTEM)
+                bo->placements[c++].flags =
+                    TTM_PL_MASK_CACHING | TTM_PL_FLAG_SYSTEM;
+        if (!c)
+                bo->placements[c++].flags =
+                    TTM_PL_MASK_CACHING | TTM_PL_FLAG_SYSTEM;
+        bo->placement.num_placement = c;
+        bo->placement.num_busy_placement = c;
+        for (i = 0; i < c; ++i) {
+                bo->placements[i].fpfn = 0;
+                bo->placements[i].lpfn = 0;
+        }
+}
+int vbox_bo_create(struct drm_device *dev, int size, int align,
+                   u32 flags, struct vbox_bo **pvboxbo)
+{
+        struct vbox_private *vbox = dev->dev_private;
+        struct vbox_bo *vboxbo;
+        size_t acc_size;
+        int ret;
+        vboxbo = kzalloc(sizeof(*vboxbo), GFP_KERNEL);
+        if (!vboxbo)
+                return -ENOMEM;
+        ret = drm_gem_object_init(dev, &vboxbo->gem, size);
+        if (ret)
+                goto err_free_vboxbo;
+        vboxbo->bo.bdev = &vbox->ttm.bdev;
+        vbox_ttm_placement(vboxbo, TTM_PL_FLAG_VRAM | TTM_PL_FLAG_SYSTEM);
+        acc_size = ttm_bo_dma_acc_size(&vbox->ttm.bdev, size,
+                                       sizeof(struct vbox_bo));
+        ret = ttm_bo_init(&vbox->ttm.bdev, &vboxbo->bo, size,
+                          ttm_bo_type_device, &vboxbo->placement,
+                          align >> PAGE_SHIFT, false, NULL, acc_size,
+                          NULL, NULL, vbox_bo_ttm_destroy);
+        if (ret)
+                goto err_free_vboxbo;
+        *pvboxbo = vboxbo;
+        return 0;
+err_free_vboxbo:
+        kfree(vboxbo);
+        return ret;
+}
+static inline u64 vbox_bo_gpu_offset(struct vbox_bo *bo)
+{
+        return bo->bo.offset;
+}
+int vbox_bo_pin(struct vbox_bo *bo, u32 pl_flag, u64 *gpu_addr)
+{
+        int i, ret;
+        if (bo->pin_count) {
+                bo->pin_count++;
+                if (gpu_addr)
+                        *gpu_addr = vbox_bo_gpu_offset(bo);
+                return 0;
+        }
+        vbox_ttm_placement(bo, pl_flag);
+        for (i = 0; i < bo->placement.num_placement; i++)
+                bo->placements[i].flags |= TTM_PL_FLAG_NO_EVICT;
+        ret = ttm_bo_validate(&bo->bo, &bo->placement, false, false);
+        if (ret)
+                return ret;
+        bo->pin_count = 1;
+        if (gpu_addr)
+                *gpu_addr = vbox_bo_gpu_offset(bo);
+        return 0;
+}
+int vbox_bo_unpin(struct vbox_bo *bo)
+{
+        int i, ret;
+        if (!bo->pin_count) {
+                DRM_ERROR("unpin bad %p\n", bo);
+                return 0;
+        }
+        bo->pin_count--;
+        if (bo->pin_count)
+                return 0;
+        for (i = 0; i < bo->placement.num_placement; i++)
+                bo->placements[i].flags &= ~TTM_PL_FLAG_NO_EVICT;
+        ret = ttm_bo_validate(&bo->bo, &bo->placement, false, false);
+        if (ret)
+                return ret;
+        return 0;
+}
+/*
+ * Move a vbox-owned buffer object to system memory if no one else has it
+ * pinned.  The caller must have pinned it previously, and this call will
+ * release the caller's pin.
+ */
+int vbox_bo_push_sysram(struct vbox_bo *bo)
+{
+        int i, ret;
+        if (!bo->pin_count) {
+                DRM_ERROR("unpin bad %p\n", bo);
+                return 0;
+        }
+        bo->pin_count--;
+        if (bo->pin_count)
+                return 0;
+        if (bo->kmap.virtual)
+                ttm_bo_kunmap(&bo->kmap);
+        vbox_ttm_placement(bo, TTM_PL_FLAG_SYSTEM);
+        for (i = 0; i < bo->placement.num_placement; i++)
+                bo->placements[i].flags |= TTM_PL_FLAG_NO_EVICT;
+        ret = ttm_bo_validate(&bo->bo, &bo->placement, false, false);
+        if (ret) {
+                DRM_ERROR("pushing to VRAM failed\n");
+                return ret;
+        }
+        return 0;
+}
+int vbox_mmap(struct file *filp, struct vm_area_struct *vma)
+{
+        struct drm_file *file_priv;
+        struct vbox_private *vbox;
+        if (unlikely(vma->vm_pgoff < DRM_FILE_PAGE_OFFSET))
+                return -EINVAL;
+        file_priv = filp->private_data;
+        vbox = file_priv->minor->dev->dev_private;
+        return ttm_bo_mmap(filp, vma, &vbox->ttm.bdev);
+}
diff --git a/drivers/staging/vboxvideo/vboxvideo.h b/drivers/staging/vboxvideo/vboxvideo.h
new file mode 100644
index 000000000000..d835d75d761c
--- /dev/null
+++ b/drivers/staging/vboxvideo/vboxvideo.h
@@ -0,0 +1,491 @@
+/*
+ * Copyright (C) 2006-2016 Oracle Corporation
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ */
+#ifndef __VBOXVIDEO_H__
+#define __VBOXVIDEO_H__
+/*
+ * This should be in sync with monitorCount <xsd:maxInclusive value="64"/> in
+ * src/VBox/Main/xml/VirtualBox-settings-common.xsd
+ */
+#define VBOX_VIDEO_MAX_SCREENS 64
+/*
+ * The last 4096 bytes of the guest VRAM contains the generic info for all
+ * DualView chunks: sizes and offsets of chunks. This is filled by miniport.
+ *
+ * Last 4096 bytes of each chunk contain chunk specific data: framebuffer info,
+ * etc. This is used exclusively by the corresponding instance of a display
+ * driver.
+ *
+ * The VRAM layout:
+ *   Last 4096 bytes - Adapter information area.
+ *   4096 bytes aligned miniport heap (value specified in the config rouded up).
+ *   Slack - what left after dividing the VRAM.
+ *   4096 bytes aligned framebuffers:
+ *     last 4096 bytes of each framebuffer is the display information area.
+ *
+ * The Virtual Graphics Adapter information in the guest VRAM is stored by the
+ * guest video driver using structures prepended by VBOXVIDEOINFOHDR.
+ *
+ * When the guest driver writes dword 0 to the VBE_DISPI_INDEX_VBOX_VIDEO
+ * the host starts to process the info. The first element at the start of
+ * the 4096 bytes region should be normally be a LINK that points to
+ * actual information chain. That way the guest driver can have some
+ * fixed layout of the information memory block and just rewrite
+ * the link to point to relevant memory chain.
+ *
+ * The processing stops at the END element.
+ *
+ * The host can access the memory only when the port IO is processed.
+ * All data that will be needed later must be copied from these 4096 bytes.
+ * But other VRAM can be used by host until the mode is disabled.
+ *
+ * The guest driver writes dword 0xffffffff to the VBE_DISPI_INDEX_VBOX_VIDEO
+ * to disable the mode.
+ *
+ * VBE_DISPI_INDEX_VBOX_VIDEO is used to read the configuration information
+ * from the host and issue commands to the host.
+ *
+ * The guest writes the VBE_DISPI_INDEX_VBOX_VIDEO index register, the the
+ * following operations with the VBE data register can be performed:
+ *
+ * Operation            Result
+ * write 16 bit value   NOP
+ * read 16 bit value    count of monitors
+ * write 32 bit value   set the vbox cmd value and the cmd processed by the host
+ * read 32 bit value    result of the last vbox command is returned
+ */
+/**
+ * VBVA command header.
+ *
+ * @todo Where does this fit in?
+ */
+struct vbva_cmd_hdr {
+   /** Coordinates of affected rectangle. */
+        s16 x;
+        s16 y;
+        u16 w;
+        u16 h;
+} __packed;
+/** @name VBVA ring defines.
+ *
+ * The VBVA ring buffer is suitable for transferring large (< 2GB) amount of
+ * data. For example big bitmaps which do not fit to the buffer.
+ *
+ * Guest starts writing to the buffer by initializing a record entry in the
+ * records queue. VBVA_F_RECORD_PARTIAL indicates that the record is being
+ * written. As data is written to the ring buffer, the guest increases
+ * free_offset.
+ *
+ * The host reads the records on flushes and processes all completed records.
+ * When host encounters situation when only a partial record presents and
+ * len_and_flags & ~VBVA_F_RECORD_PARTIAL >= VBVA_RING_BUFFER_SIZE -
+ * VBVA_RING_BUFFER_THRESHOLD, the host fetched all record data and updates
+ * data_offset. After that on each flush the host continues fetching the data
+ * until the record is completed.
+ *
+ */
+#define VBVA_RING_BUFFER_SIZE        (4194304 - 1024)
+#define VBVA_RING_BUFFER_THRESHOLD   (4096)
+#define VBVA_MAX_RECORDS (64)
+#define VBVA_F_MODE_ENABLED         0x00000001u
+#define VBVA_F_MODE_VRDP            0x00000002u
+#define VBVA_F_MODE_VRDP_RESET      0x00000004u
+#define VBVA_F_MODE_VRDP_ORDER_MASK 0x00000008u
+#define VBVA_F_STATE_PROCESSING     0x00010000u
+#define VBVA_F_RECORD_PARTIAL       0x80000000u
+/**
+ * VBVA record.
+ */
+struct vbva_record {
+        /** The length of the record. Changed by guest. */
+        u32 len_and_flags;
+} __packed;
+/*
+ * The minimum HGSMI heap size is PAGE_SIZE (4096 bytes) and is a restriction of
+ * the runtime heapsimple API. Use minimum 2 pages here, because the info area
+ * also may contain other data (for example hgsmi_host_flags structure).
+ */
+#define VBVA_ADAPTER_INFORMATION_SIZE 65536
+#define VBVA_MIN_BUFFER_SIZE          65536
+/* The value for port IO to let the adapter to interpret the adapter memory. */
+#define VBOX_VIDEO_DISABLE_ADAPTER_MEMORY        0xFFFFFFFF
+/* The value for port IO to let the adapter to interpret the adapter memory. */
+#define VBOX_VIDEO_INTERPRET_ADAPTER_MEMORY      0x00000000
+/* The value for port IO to let the adapter to interpret the display memory.
+ * The display number is encoded in low 16 bits.
+ */
+#define VBOX_VIDEO_INTERPRET_DISPLAY_MEMORY_BASE 0x00010000
+struct vbva_host_flags {
+        u32 host_events;
+        u32 supported_orders;
+} __packed;
+struct vbva_buffer {
+        struct vbva_host_flags host_flags;
+        /* The offset where the data start in the buffer. */
+        u32 data_offset;
+        /* The offset where next data must be placed in the buffer. */
+        u32 free_offset;
+        /* The queue of record descriptions. */
+        struct vbva_record records[VBVA_MAX_RECORDS];
+        u32 record_first_index;
+        u32 record_free_index;
+        /* Space to leave free when large partial records are transferred. */
+        u32 partial_write_tresh;
+        u32 data_len;
+        /* variable size for the rest of the vbva_buffer area in VRAM. */
+        u8 data[0];
+} __packed;
+#define VBVA_MAX_RECORD_SIZE (128 * 1024 * 1024)
+/* guest->host commands */
+#define VBVA_QUERY_CONF32                        1
+#define VBVA_SET_CONF32                          2
+#define VBVA_INFO_VIEW                           3
+#define VBVA_INFO_HEAP                           4
+#define VBVA_FLUSH                               5
+#define VBVA_INFO_SCREEN                         6
+#define VBVA_ENABLE                              7
+#define VBVA_MOUSE_POINTER_SHAPE                 8
+/* informs host about HGSMI caps. see vbva_caps below */
+#define VBVA_INFO_CAPS                          12
+/* configures scanline, see VBVASCANLINECFG below */
+#define VBVA_SCANLINE_CFG                       13
+/* requests scanline info, see VBVASCANLINEINFO below */
+#define VBVA_SCANLINE_INFO                      14
+/* inform host about VBVA Command submission */
+#define VBVA_CMDVBVA_SUBMIT                     16
+/* inform host about VBVA Command submission */
+#define VBVA_CMDVBVA_FLUSH                      17
+/* G->H DMA command */
+#define VBVA_CMDVBVA_CTL                        18
+/* Query most recent mode hints sent */
+#define VBVA_QUERY_MODE_HINTS                   19
+/**
+ * Report the guest virtual desktop position and size for mapping host and
+ * guest pointer positions.
+ */
+#define VBVA_REPORT_INPUT_MAPPING               20
+/** Report the guest cursor position and query the host position. */
+#define VBVA_CURSOR_POSITION                    21
+/* host->guest commands */
+#define VBVAHG_EVENT                            1
+#define VBVAHG_DISPLAY_CUSTOM                   2
+/* vbva_conf32::index */
+#define VBOX_VBVA_CONF32_MONITOR_COUNT          0
+#define VBOX_VBVA_CONF32_HOST_HEAP_SIZE         1
+/**
+ * Returns VINF_SUCCESS if the host can report mode hints via VBVA.
+ * Set value to VERR_NOT_SUPPORTED before calling.
+ */
+#define VBOX_VBVA_CONF32_MODE_HINT_REPORTING    2
+/**
+ * Returns VINF_SUCCESS if the host can report guest cursor enabled status via
+ * VBVA.  Set value to VERR_NOT_SUPPORTED before calling.
+ */
+#define VBOX_VBVA_CONF32_GUEST_CURSOR_REPORTING 3
+/**
+ * Returns the currently available host cursor capabilities.  Available if
+ * vbva_conf32::VBOX_VBVA_CONF32_GUEST_CURSOR_REPORTING returns success.
+ * @see VMMDevReqMouseStatus::mouseFeatures.
+ */
+#define VBOX_VBVA_CONF32_CURSOR_CAPABILITIES    4
+/** Returns the supported flags in vbva_infoscreen::flags. */
+#define VBOX_VBVA_CONF32_SCREEN_FLAGS           5
+/** Returns the max size of VBVA record. */
+#define VBOX_VBVA_CONF32_MAX_RECORD_SIZE        6
+struct vbva_conf32 {
+        u32 index;
+        u32 value;
+} __packed;
+/** Reserved for historical reasons. */
+#define VBOX_VBVA_CURSOR_CAPABILITY_RESERVED0   BIT(0)
+/**
+ * Guest cursor capability: can the host show a hardware cursor at the host
+ * pointer location?
+ */
+#define VBOX_VBVA_CURSOR_CAPABILITY_HARDWARE    BIT(1)
+/** Reserved for historical reasons. */
+#define VBOX_VBVA_CURSOR_CAPABILITY_RESERVED2   BIT(2)
+/** Reserved for historical reasons.  Must always be unset. */
+#define VBOX_VBVA_CURSOR_CAPABILITY_RESERVED3   BIT(3)
+/** Reserved for historical reasons. */
+#define VBOX_VBVA_CURSOR_CAPABILITY_RESERVED4   BIT(4)
+/** Reserved for historical reasons. */
+#define VBOX_VBVA_CURSOR_CAPABILITY_RESERVED5   BIT(5)
+struct vbva_infoview {
+        /* Index of the screen, assigned by the guest. */
+        u32 view_index;
+        /* The screen offset in VRAM, the framebuffer starts here. */
+        u32 view_offset;
+        /* The size of the VRAM memory that can be used for the view. */
+        u32 view_size;
+        /* The recommended maximum size of the VRAM memory for the screen. */
+        u32 max_screen_size;
+} __packed;
+struct vbva_flush {
+        u32 reserved;
+} __packed;
+/* vbva_infoscreen::flags */
+#define VBVA_SCREEN_F_NONE                      0x0000
+#define VBVA_SCREEN_F_ACTIVE                    0x0001
+/**
+ * The virtual monitor has been disabled by the guest and should be removed
+ * by the host and ignored for purposes of pointer position calculation.
+ */
+#define VBVA_SCREEN_F_DISABLED                  0x0002
+/**
+ * The virtual monitor has been blanked by the guest and should be blacked
+ * out by the host using width, height, etc values from the vbva_infoscreen
+ * request.
+ */
+#define VBVA_SCREEN_F_BLANK                     0x0004
+/**
+ * The virtual monitor has been blanked by the guest and should be blacked
+ * out by the host using the previous mode values for width. height, etc.
+ */
+#define VBVA_SCREEN_F_BLANK2                    0x0008
+struct vbva_infoscreen {
+        /* Which view contains the screen. */
+        u32 view_index;
+        /* Physical X origin relative to the primary screen. */
+        s32 origin_x;
+        /* Physical Y origin relative to the primary screen. */
+        s32 origin_y;
+        /* Offset of visible framebuffer relative to the framebuffer start. */
+        u32 start_offset;
+        /* The scan line size in bytes. */
+        u32 line_size;
+        /* Width of the screen. */
+        u32 width;
+        /* Height of the screen. */
+        u32 height;
+        /* Color depth. */
+        u16 bits_per_pixel;
+        /* VBVA_SCREEN_F_* */
+        u16 flags;
+} __packed;
+/* vbva_enable::flags */
+#define VBVA_F_NONE                             0x00000000
+#define VBVA_F_ENABLE                           0x00000001
+#define VBVA_F_DISABLE                          0x00000002
+/* extended VBVA to be used with WDDM */
+#define VBVA_F_EXTENDED                         0x00000004
+/* vbva offset is absolute VRAM offset */
+#define VBVA_F_ABSOFFSET                        0x00000008
+struct vbva_enable {
+        u32 flags;
+        u32 offset;
+        s32 result;
+} __packed;
+struct vbva_enable_ex {
+        struct vbva_enable base;
+        u32 screen_id;
+} __packed;
+struct vbva_mouse_pointer_shape {
+        /* The host result. */
+        s32 result;
+        /* VBOX_MOUSE_POINTER_* bit flags. */
+        u32 flags;
+        /* X coordinate of the hot spot. */
+        u32 hot_X;
+        /* Y coordinate of the hot spot. */
+        u32 hot_y;
+        /* Width of the pointer in pixels. */
+        u32 width;
+        /* Height of the pointer in scanlines. */
+        u32 height;
+        /* Pointer data.
+         *
+         ****
+         * The data consists of 1 bpp AND mask followed by 32 bpp XOR (color)
+         * mask.
+         *
+         * For pointers without alpha channel the XOR mask pixels are 32 bit
+         * values: (lsb)BGR0(msb). For pointers with alpha channel the XOR mask
+         * consists of (lsb)BGRA(msb) 32 bit values.
+         *
+         * Guest driver must create the AND mask for pointers with alpha chan.,
+         * so if host does not support alpha, the pointer could be displayed as
+         * a normal color pointer. The AND mask can be constructed from alpha
+         * values. For example alpha value >= 0xf0 means bit 0 in the AND mask.
+         *
+         * The AND mask is 1 bpp bitmap with byte aligned scanlines. Size of AND
+         * mask, therefore, is and_len = (width + 7) / 8 * height. The padding
+         * bits at the end of any scanline are undefined.
+         *
+         * The XOR mask follows the AND mask on the next 4 bytes aligned offset:
+         * u8 *xor = and + (and_len + 3) & ~3
+         * Bytes in the gap between the AND and the XOR mask are undefined.
+         * XOR mask scanlines have no gap between them and size of XOR mask is:
+         * xor_len = width * 4 * height.
+         ****
+         *
+         * Preallocate 4 bytes for accessing actual data as p->data.
+         */
+        u8 data[4];
+} __packed;
+/**
+ * @name vbva_mouse_pointer_shape::flags
+ * @note The VBOX_MOUSE_POINTER_* flags are used in the guest video driver,
+ *       values must be <= 0x8000 and must not be changed. (try make more sense
+ *       of this, please).
+ * @{
+ */
+/** pointer is visible */
+#define VBOX_MOUSE_POINTER_VISIBLE              0x0001
+/** pointer has alpha channel */
+#define VBOX_MOUSE_POINTER_ALPHA                0x0002
+/** pointerData contains new pointer shape */
+#define VBOX_MOUSE_POINTER_SHAPE                0x0004
+/** @} */
+/*
+ * The guest driver can handle asynch guest cmd completion by reading the
+ * command offset from io port.
+ */
+#define VBVACAPS_COMPLETEGCMD_BY_IOREAD         0x00000001
+/* the guest driver can handle video adapter IRQs */
+#define VBVACAPS_IRQ                            0x00000002
+/** The guest can read video mode hints sent via VBVA. */
+#define VBVACAPS_VIDEO_MODE_HINTS               0x00000004
+/** The guest can switch to a software cursor on demand. */
+#define VBVACAPS_DISABLE_CURSOR_INTEGRATION     0x00000008
+/** The guest does not depend on host handling the VBE registers. */
+#define VBVACAPS_USE_VBVA_ONLY                  0x00000010
+struct vbva_caps {
+        s32 rc;
+        u32 caps;
+} __packed;
+/** Query the most recent mode hints received from the host. */
+struct vbva_query_mode_hints {
+        /** The maximum number of screens to return hints for. */
+        u16 hints_queried_count;
+        /** The size of the mode hint structures directly following this one. */
+        u16 hint_structure_guest_size;
+        /** Return code for the operation. Initialise to VERR_NOT_SUPPORTED. */
+        s32 rc;
+} __packed;
+/**
+ * Structure in which a mode hint is returned. The guest allocates an array
+ * of these immediately after the vbva_query_mode_hints structure.
+ * To accommodate future extensions, the vbva_query_mode_hints structure
+ * specifies the size of the vbva_modehint structures allocated by the guest,
+ * and the host only fills out structure elements which fit into that size. The
+ * host should fill any unused members (e.g. dx, dy) or structure space on the
+ * end with ~0. The whole structure can legally be set to ~0 to skip a screen.
+ */
+struct vbva_modehint {
+        u32 magic;
+        u32 cx;
+        u32 cy;
+        u32 bpp;                /* Which has never been used... */
+        u32 display;
+        u32 dx;                 /**< X offset into the virtual frame-buffer. */
+        u32 dy;                 /**< Y offset into the virtual frame-buffer. */
+        u32 enabled;            /* Not flags. Add new members for new flags. */
+} __packed;
+#define VBVAMODEHINT_MAGIC 0x0801add9u
+/**
+ * Report the rectangle relative to which absolute pointer events should be
+ * expressed. This information remains valid until the next VBVA resize event
+ * for any screen, at which time it is reset to the bounding rectangle of all
+ * virtual screens and must be re-set.
+ * @see VBVA_REPORT_INPUT_MAPPING.
+ */
+struct vbva_report_input_mapping {
+        s32 x;  /**< Upper left X co-ordinate relative to the first screen. */
+        s32 y;  /**< Upper left Y co-ordinate relative to the first screen. */
+        u32 cx; /**< Rectangle width. */
+        u32 cy; /**< Rectangle height. */
+} __packed;
+/**
+ * Report the guest cursor position and query the host one. The host may wish
+ * to use the guest information to re-position its own cursor (though this is
+ * currently unlikely).
+ * @see VBVA_CURSOR_POSITION
+ */
+struct vbva_cursor_position {
+        u32 report_position;    /**< Are we reporting a position? */
+        u32 x;                  /**< Guest cursor X position */
+        u32 y;                  /**< Guest cursor Y position */
+} __packed;
+#endif
diff --git a/drivers/staging/vboxvideo/vboxvideo_guest.h b/drivers/staging/vboxvideo/vboxvideo_guest.h
new file mode 100644
index 000000000000..d09da841711a
--- /dev/null
+++ b/drivers/staging/vboxvideo/vboxvideo_guest.h
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2006-2017 Oracle Corporation
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ */
+#ifndef __VBOXVIDEO_GUEST_H__
+#define __VBOXVIDEO_GUEST_H__
+#include <linux/genalloc.h>
+#include "vboxvideo.h"
+/**
+ * Structure grouping the context needed for sending graphics acceleration
+ * information to the host via VBVA.  Each screen has its own VBVA buffer.
+ */
+struct vbva_buf_ctx {
+        /** Offset of the buffer in the VRAM section for the screen */
+        u32 buffer_offset;
+        /** Length of the buffer in bytes */
+        u32 buffer_length;
+        /** Set if we wrote to the buffer faster than the host could read it */
+        bool buffer_overflow;
+        /** VBVA record that we are currently preparing for the host, or NULL */
+        struct vbva_record *record;
+        /**
+         * Pointer to the VBVA buffer mapped into the current address space.
+         * Will be NULL if VBVA is not enabled.
+         */
+        struct vbva_buffer *vbva;
+};
+/**
+ * @name Base HGSMI APIs
+ * @{
+ */
+int hgsmi_report_flags_location(struct gen_pool *ctx, u32 location);
+int hgsmi_send_caps_info(struct gen_pool *ctx, u32 caps);
+int hgsmi_test_query_conf(struct gen_pool *ctx);
+int hgsmi_query_conf(struct gen_pool *ctx, u32 index, u32 *value_ret);
+int hgsmi_update_pointer_shape(struct gen_pool *ctx, u32 flags,
+                               u32 hot_x, u32 hot_y, u32 width, u32 height,
+                               u8 *pixels, u32 len);
+int hgsmi_cursor_position(struct gen_pool *ctx, bool report_position,
+                          u32 x, u32 y, u32 *x_host, u32 *y_host);
+/** @}  */
+/**
+ * @name VBVA APIs
+ * @{
+ */
+bool vbva_enable(struct vbva_buf_ctx *vbva_ctx, struct gen_pool *ctx,
+                 struct vbva_buffer *vbva, s32 screen);
+void vbva_disable(struct vbva_buf_ctx *vbva_ctx, struct gen_pool *ctx,
+                  s32 screen);
+bool vbva_buffer_begin_update(struct vbva_buf_ctx *vbva_ctx,
+                              struct gen_pool *ctx);
+void vbva_buffer_end_update(struct vbva_buf_ctx *vbva_ctx);
+bool vbva_write(struct vbva_buf_ctx *vbva_ctx, struct gen_pool *ctx,
+                const void *p, u32 len);
+void vbva_setup_buffer_context(struct vbva_buf_ctx *vbva_ctx,
+                               u32 buffer_offset, u32 buffer_length);
+/** @}  */
+/**
+ * @name Modesetting APIs
+ * @{
+ */
+void hgsmi_process_display_info(struct gen_pool *ctx, u32 display,
+                                s32 origin_x, s32 origin_y, u32 start_offset,
+                                u32 pitch, u32 width, u32 height,
+                                u16 bpp, u16 flags);
+int hgsmi_update_input_mapping(struct gen_pool *ctx, s32 origin_x, s32 origin_y,
+                               u32 width, u32 height);
+int hgsmi_get_mode_hints(struct gen_pool *ctx, unsigned int screens,
+                         struct vbva_modehint *hints);
+/** @}  */
+#endif
diff --git a/drivers/staging/vboxvideo/vboxvideo_vbe.h b/drivers/staging/vboxvideo/vboxvideo_vbe.h
new file mode 100644
index 000000000000..f842f4d9c80a
--- /dev/null
+++ b/drivers/staging/vboxvideo/vboxvideo_vbe.h
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2006-2017 Oracle Corporation
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ */
+#ifndef __VBOXVIDEO_VBE_H__
+#define __VBOXVIDEO_VBE_H__
+/* GUEST <-> HOST Communication API */
+/**
+ * @todo FIXME: Either dynamicly ask host for this or put somewhere high in
+ *              physical memory like 0xE0000000.
+ */
+#define VBE_DISPI_BANK_ADDRESS          0xA0000
+#define VBE_DISPI_BANK_SIZE_KB          64
+#define VBE_DISPI_MAX_XRES              16384
+#define VBE_DISPI_MAX_YRES              16384
+#define VBE_DISPI_MAX_BPP               32
+#define VBE_DISPI_IOPORT_INDEX          0x01CE
+#define VBE_DISPI_IOPORT_DATA           0x01CF
+#define VBE_DISPI_IOPORT_DAC_WRITE_INDEX  0x03C8
+#define VBE_DISPI_IOPORT_DAC_DATA         0x03C9
+#define VBE_DISPI_INDEX_ID              0x0
+#define VBE_DISPI_INDEX_XRES            0x1
+#define VBE_DISPI_INDEX_YRES            0x2
+#define VBE_DISPI_INDEX_BPP             0x3
+#define VBE_DISPI_INDEX_ENABLE          0x4
+#define VBE_DISPI_INDEX_BANK            0x5
+#define VBE_DISPI_INDEX_VIRT_WIDTH      0x6
+#define VBE_DISPI_INDEX_VIRT_HEIGHT     0x7
+#define VBE_DISPI_INDEX_X_OFFSET        0x8
+#define VBE_DISPI_INDEX_Y_OFFSET        0x9
+#define VBE_DISPI_INDEX_VBOX_VIDEO      0xa
+#define VBE_DISPI_INDEX_FB_BASE_HI      0xb
+#define VBE_DISPI_ID0                   0xB0C0
+#define VBE_DISPI_ID1                   0xB0C1
+#define VBE_DISPI_ID2                   0xB0C2
+#define VBE_DISPI_ID3                   0xB0C3
+#define VBE_DISPI_ID4                   0xB0C4
+#define VBE_DISPI_ID_VBOX_VIDEO         0xBE00
+/* The VBOX interface id. Indicates support for VBVA shared memory interface. */
+#define VBE_DISPI_ID_HGSMI              0xBE01
+#define VBE_DISPI_ID_ANYX               0xBE02
+#define VBE_DISPI_DISABLED              0x00
+#define VBE_DISPI_ENABLED               0x01
+#define VBE_DISPI_GETCAPS               0x02
+#define VBE_DISPI_8BIT_DAC              0x20
+/**
+ * @note this definition is a BOCHS legacy, used only in the video BIOS
+ * code and ignored by the emulated hardware.
+ */
+#define VBE_DISPI_LFB_ENABLED           0x40
+#define VBE_DISPI_NOCLEARMEM            0x80
+#define VGA_PORT_HGSMI_HOST             0x3b0
+#define VGA_PORT_HGSMI_GUEST            0x3d0
+#endif
diff --git a/drivers/staging/vboxvideo/vbva_base.c b/drivers/staging/vboxvideo/vbva_base.c
new file mode 100644
index 000000000000..c10c782f94e1
--- /dev/null
+++ b/drivers/staging/vboxvideo/vbva_base.c
@@ -0,0 +1,233 @@
+/*
+ * Copyright (C) 2006-2017 Oracle Corporation
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ */
+#include "vbox_drv.h"
+#include "vbox_err.h"
+#include "vboxvideo_guest.h"
+#include "hgsmi_channels.h"
+/*
+ * There is a hardware ring buffer in the graphics device video RAM, formerly
+ * in the VBox VMMDev PCI memory space.
+ * All graphics commands go there serialized by vbva_buffer_begin_update.
+ * and vbva_buffer_end_update.
+ *
+ * free_offset is writing position. data_offset is reading position.
+ * free_offset == data_offset means buffer is empty.
+ * There must be always gap between data_offset and free_offset when data
+ * are in the buffer.
+ * Guest only changes free_offset, host changes data_offset.
+ */
+static u32 vbva_buffer_available(const struct vbva_buffer *vbva)
+{
+        s32 diff = vbva->data_offset - vbva->free_offset;
+        return diff > 0 ? diff : vbva->data_len + diff;
+}
+static void vbva_buffer_place_data_at(struct vbva_buf_ctx *vbva_ctx,
+                                      const void *p, u32 len, u32 offset)
+{
+        struct vbva_buffer *vbva = vbva_ctx->vbva;
+        u32 bytes_till_boundary = vbva->data_len - offset;
+        u8 *dst = &vbva->data[offset];
+        s32 diff = len - bytes_till_boundary;
+        if (diff <= 0) {
+                /* Chunk will not cross buffer boundary. */
+                memcpy(dst, p, len);
+        } else {
+                /* Chunk crosses buffer boundary. */
+                memcpy(dst, p, bytes_till_boundary);
+                memcpy(&vbva->data[0], (u8 *)p + bytes_till_boundary, diff);
+        }
+}
+static void vbva_buffer_flush(struct gen_pool *ctx)
+{
+        struct vbva_flush *p;
+        p = hgsmi_buffer_alloc(ctx, sizeof(*p), HGSMI_CH_VBVA, VBVA_FLUSH);
+        if (!p)
+                return;
+        p->reserved = 0;
+        hgsmi_buffer_submit(ctx, p);
+        hgsmi_buffer_free(ctx, p);
+}
+bool vbva_write(struct vbva_buf_ctx *vbva_ctx, struct gen_pool *ctx,
+                const void *p, u32 len)
+{
+        struct vbva_record *record;
+        struct vbva_buffer *vbva;
+        u32 available;
+        vbva = vbva_ctx->vbva;
+        record = vbva_ctx->record;
+        if (!vbva || vbva_ctx->buffer_overflow ||
+            !record || !(record->len_and_flags & VBVA_F_RECORD_PARTIAL))
+                return false;
+        available = vbva_buffer_available(vbva);
+        while (len > 0) {
+                u32 chunk = len;
+                if (chunk >= available) {
+                        vbva_buffer_flush(ctx);
+                        available = vbva_buffer_available(vbva);
+                }
+                if (chunk >= available) {
+                        if (WARN_ON(available <= vbva->partial_write_tresh)) {
+                                vbva_ctx->buffer_overflow = true;
+                                return false;
+                        }
+                        chunk = available - vbva->partial_write_tresh;
+                }
+                vbva_buffer_place_data_at(vbva_ctx, p, chunk,
+                                          vbva->free_offset);
+                vbva->free_offset = (vbva->free_offset + chunk) %
+                                    vbva->data_len;
+                record->len_and_flags += chunk;
+                available -= chunk;
+                len -= chunk;
+                p += chunk;
+        }
+        return true;
+}
+static bool vbva_inform_host(struct vbva_buf_ctx *vbva_ctx,
+                             struct gen_pool *ctx, s32 screen, bool enable)
+{
+        struct vbva_enable_ex *p;
+        bool ret;
+        p = hgsmi_buffer_alloc(ctx, sizeof(*p), HGSMI_CH_VBVA, VBVA_ENABLE);
+        if (!p)
+                return false;
+        p->base.flags = enable ? VBVA_F_ENABLE : VBVA_F_DISABLE;
+        p->base.offset = vbva_ctx->buffer_offset;
+        p->base.result = VERR_NOT_SUPPORTED;
+        if (screen >= 0) {
+                p->base.flags |= VBVA_F_EXTENDED | VBVA_F_ABSOFFSET;
+                p->screen_id = screen;
+        }
+        hgsmi_buffer_submit(ctx, p);
+        if (enable)
+                ret = RT_SUCCESS(p->base.result);
+        else
+                ret = true;
+        hgsmi_buffer_free(ctx, p);
+        return ret;
+}
+bool vbva_enable(struct vbva_buf_ctx *vbva_ctx, struct gen_pool *ctx,
+                 struct vbva_buffer *vbva, s32 screen)
+{
+        bool ret = false;
+        memset(vbva, 0, sizeof(*vbva));
+        vbva->partial_write_tresh = 256;
+        vbva->data_len = vbva_ctx->buffer_length - sizeof(struct vbva_buffer);
+        vbva_ctx->vbva = vbva;
+        ret = vbva_inform_host(vbva_ctx, ctx, screen, true);
+        if (!ret)
+                vbva_disable(vbva_ctx, ctx, screen);
+        return ret;
+}
+void vbva_disable(struct vbva_buf_ctx *vbva_ctx, struct gen_pool *ctx,
+                  s32 screen)
+{
+        vbva_ctx->buffer_overflow = false;
+        vbva_ctx->record = NULL;
+        vbva_ctx->vbva = NULL;
+        vbva_inform_host(vbva_ctx, ctx, screen, false);
+}
+bool vbva_buffer_begin_update(struct vbva_buf_ctx *vbva_ctx,
+                              struct gen_pool *ctx)
+{
+        struct vbva_record *record;
+        u32 next;
+        if (!vbva_ctx->vbva ||
+            !(vbva_ctx->vbva->host_flags.host_events & VBVA_F_MODE_ENABLED))
+                return false;
+        WARN_ON(vbva_ctx->buffer_overflow || vbva_ctx->record);
+        next = (vbva_ctx->vbva->record_free_index + 1) % VBVA_MAX_RECORDS;
+        /* Flush if all slots in the records queue are used */
+        if (next == vbva_ctx->vbva->record_first_index)
+                vbva_buffer_flush(ctx);
+        /* If even after flush there is no place then fail the request */
+        if (next == vbva_ctx->vbva->record_first_index)
+                return false;
+        record = &vbva_ctx->vbva->records[vbva_ctx->vbva->record_free_index];
+        record->len_and_flags = VBVA_F_RECORD_PARTIAL;
+        vbva_ctx->vbva->record_free_index = next;
+        /* Remember which record we are using. */
+        vbva_ctx->record = record;
+        return true;
+}
+void vbva_buffer_end_update(struct vbva_buf_ctx *vbva_ctx)
+{
+        struct vbva_record *record = vbva_ctx->record;
+        WARN_ON(!vbva_ctx->vbva || !record ||
+                !(record->len_and_flags & VBVA_F_RECORD_PARTIAL));
+        /* Mark the record completed. */
+        record->len_and_flags &= ~VBVA_F_RECORD_PARTIAL;
+        vbva_ctx->buffer_overflow = false;
+        vbva_ctx->record = NULL;
+}
+void vbva_setup_buffer_context(struct vbva_buf_ctx *vbva_ctx,
+                               u32 buffer_offset, u32 buffer_length)
+{
+        vbva_ctx->buffer_offset = buffer_offset;
+        vbva_ctx->buffer_length = buffer_length;
+}
diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
index 030bec855d86..314ffac50bb8 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
@@ -3391,7 +3391,6 @@ static int vchiq_probe(struct platform_device *pdev)
        struct device_node *fw_node;
        struct rpi_firmware *fw;
        int err;
-        void *ptr_err;
        fw_node = of_parse_phandle(pdev->dev.of_node, "firmware", 0);
        if (!fw_node) {
@@ -3427,14 +3426,14 @@ static int vchiq_probe(struct platform_device *pdev)
        /* create sysfs entries */
        vchiq_class = class_create(THIS_MODULE, DEVICE_NAME);
-        ptr_err = vchiq_class;
+        err = PTR_ERR(vchiq_class);
-        if (IS_ERR(ptr_err))
+        if (IS_ERR(vchiq_class))
                goto failed_class_create;
        vchiq_dev = device_create(vchiq_class, NULL,
                vchiq_devid, NULL, "vchiq");
-        ptr_err = vchiq_dev;
+        err = PTR_ERR(vchiq_dev);
-        if (IS_ERR(ptr_err))
+        if (IS_ERR(vchiq_dev))
                goto failed_device_create;
        /* create debugfs entries */
@@ -3455,7 +3454,6 @@ failed_device_create:
        class_destroy(vchiq_class);
 failed_class_create:
        cdev_del(&vchiq_cdev);
-        err = PTR_ERR(ptr_err);
 failed_cdev_add:
        unregister_chrdev_region(vchiq_devid, 1);
 failed_platform_init:
diff --git a/drivers/thunderbolt/switch.c b/drivers/thunderbolt/switch.c
index ab3e8f410444..40219a706309 100644
--- a/drivers/thunderbolt/switch.c
+++ b/drivers/thunderbolt/switch.c
@@ -281,9 +281,11 @@ static struct nvmem_device *register_nvmem(struct tb_switch *sw, int id,
        if (active) {
                config.name = "nvm_active";
                config.reg_read = tb_switch_nvm_read;
+                config.read_only = true;
        } else {
                config.name = "nvm_non_active";
                config.reg_write = tb_switch_nvm_write;
+                config.root_only = true;
        }
        config.id = id;
@@ -292,7 +294,6 @@ static struct nvmem_device *register_nvmem(struct tb_switch *sw, int id,
        config.size = size;
        config.dev = &sw->dev;
        config.owner = THIS_MODULE;
-        config.root_only = true;
        config.priv = sw;
        return nvmem_register(&config);
diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
index d1399aac05a1..284749fb0f6b 100644
--- a/drivers/tty/pty.c
+++ b/drivers/tty/pty.c
@@ -448,48 +448,6 @@ err:
        return retval;
 }
-/**
- *      pty_open_peer - open the peer of a pty
- *      @tty: the peer of the pty being opened
- *
- *      Open the cached dentry in tty->link, providing a safe way for userspace
- *      to get the slave end of a pty (where they have the master fd and cannot
- *      access or trust the mount namespace /dev/pts was mounted inside).
- */
-static struct file *pty_open_peer(struct tty_struct *tty, int flags)
-{
-        if (tty->driver->subtype != PTY_TYPE_MASTER)
-                return ERR_PTR(-EIO);
-        return dentry_open(tty->link->driver_data, flags, current_cred());
-}
-static int pty_get_peer(struct tty_struct *tty, int flags)
-{
-        int fd = -1;
-        struct file *filp = NULL;
-        int retval = -EINVAL;
-        fd = get_unused_fd_flags(0);
-        if (fd < 0) {
-                retval = fd;
-                goto err;
-        }
-        filp = pty_open_peer(tty, flags);
-        if (IS_ERR(filp)) {
-                retval = PTR_ERR(filp);
-                goto err_put;
-        }
-        fd_install(fd, filp);
-        return fd;
-err_put:
-        put_unused_fd(fd);
-err:
-        return retval;
-}
 static void pty_cleanup(struct tty_struct *tty)
 {
        tty_port_put(tty->port);
@@ -646,9 +604,50 @@ static inline void legacy_pty_init(void) { }
 /* Unix98 devices */
 #ifdef CONFIG_UNIX98_PTYS
 static struct cdev ptmx_cdev;
+/**
+ *      pty_open_peer - open the peer of a pty
+ *      @tty: the peer of the pty being opened
+ *
+ *      Open the cached dentry in tty->link, providing a safe way for userspace
+ *      to get the slave end of a pty (where they have the master fd and cannot
+ *      access or trust the mount namespace /dev/pts was mounted inside).
+ */
+static struct file *pty_open_peer(struct tty_struct *tty, int flags)
+{
+        if (tty->driver->subtype != PTY_TYPE_MASTER)
+                return ERR_PTR(-EIO);
+        return dentry_open(tty->link->driver_data, flags, current_cred());
+}
+static int pty_get_peer(struct tty_struct *tty, int flags)
+{
+        int fd = -1;
+        struct file *filp = NULL;
+        int retval = -EINVAL;
+        fd = get_unused_fd_flags(0);
+        if (fd < 0) {
+                retval = fd;
+                goto err;
+        }
+        filp = pty_open_peer(tty, flags);
+        if (IS_ERR(filp)) {
+                retval = PTR_ERR(filp);
+                goto err_put;
+        }
+        fd_install(fd, filp);
+        return fd;
+err_put:
+        put_unused_fd(fd);
+err:
+        return retval;
+}
 static int pty_unix98_ioctl(struct tty_struct *tty,
                            unsigned int cmd, unsigned long arg)
 {
diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
index 343de8c384b0..898dcb091a27 100644
--- a/drivers/tty/serial/fsl_lpuart.c
+++ b/drivers/tty/serial/fsl_lpuart.c
@@ -619,6 +619,12 @@ static unsigned int lpuart32_tx_empty(struct uart_port *port)
                TIOCSER_TEMT : 0;
 }
+static bool lpuart_is_32(struct lpuart_port *sport)
+{
+        return sport->port.iotype == UPIO_MEM32 ||
+               sport->port.iotype ==  UPIO_MEM32BE;
+}
 static irqreturn_t lpuart_txint(int irq, void *dev_id)
 {
        struct lpuart_port *sport = dev_id;
@@ -627,7 +633,7 @@ static irqreturn_t lpuart_txint(int irq, void *dev_id)
        spin_lock_irqsave(&sport->port.lock, flags);
        if (sport->port.x_char) {
-                if (sport->port.iotype & (UPIO_MEM32 | UPIO_MEM32BE))
+                if (lpuart_is_32(sport))
                        lpuart32_write(&sport->port, sport->port.x_char, UARTDATA);
                else
                        writeb(sport->port.x_char, sport->port.membase + UARTDR);
@@ -635,14 +641,14 @@ static irqreturn_t lpuart_txint(int irq, void *dev_id)
        }
        if (uart_circ_empty(xmit) || uart_tx_stopped(&sport->port)) {
-                if (sport->port.iotype & (UPIO_MEM32 | UPIO_MEM32BE))
+                if (lpuart_is_32(sport))
                        lpuart32_stop_tx(&sport->port);
                else
                        lpuart_stop_tx(&sport->port);
                goto out;
        }
-        if (sport->port.iotype & (UPIO_MEM32 | UPIO_MEM32BE))
+        if (lpuart_is_32(sport))
                lpuart32_transmit_buffer(sport);
        else
                lpuart_transmit_buffer(sport);
@@ -1978,12 +1984,12 @@ static int __init lpuart_console_setup(struct console *co, char *options)
        if (options)
                uart_parse_options(options, &baud, &parity, &bits, &flow);
        else
-                if (sport->port.iotype & (UPIO_MEM32 | UPIO_MEM32BE))
+                if (lpuart_is_32(sport))
                        lpuart32_console_get_options(sport, &baud, &parity, &bits);
                else
                        lpuart_console_get_options(sport, &baud, &parity, &bits);
-        if (sport->port.iotype & (UPIO_MEM32 | UPIO_MEM32BE))
+        if (lpuart_is_32(sport))
                lpuart32_setup_watermark(sport);
        else
                lpuart_setup_watermark(sport);
@@ -2118,7 +2124,7 @@ static int lpuart_probe(struct platform_device *pdev)
        }
        sport->port.irq = ret;
        sport->port.iotype = sdata->iotype;
-        if (sport->port.iotype & (UPIO_MEM32 | UPIO_MEM32BE))
+        if (lpuart_is_32(sport))
                sport->port.ops = &lpuart32_pops;
        else
                sport->port.ops = &lpuart_pops;
@@ -2145,7 +2151,7 @@ static int lpuart_probe(struct platform_device *pdev)
        platform_set_drvdata(pdev, &sport->port);
-        if (sport->port.iotype & (UPIO_MEM32 | UPIO_MEM32BE))
+        if (lpuart_is_32(sport))
                lpuart_reg.cons = LPUART32_CONSOLE;
        else
                lpuart_reg.cons = LPUART_CONSOLE;
@@ -2198,7 +2204,7 @@ static int lpuart_suspend(struct device *dev)
        struct lpuart_port *sport = dev_get_drvdata(dev);
        unsigned long temp;
-        if (sport->port.iotype & (UPIO_MEM32 | UPIO_MEM32BE)) {
+        if (lpuart_is_32(sport)) {
                /* disable Rx/Tx and interrupts */
                temp = lpuart32_read(&sport->port, UARTCTRL);
                temp &= ~(UARTCTRL_TE | UARTCTRL_TIE | UARTCTRL_TCIE);
@@ -2249,7 +2255,7 @@ static int lpuart_resume(struct device *dev)
        if (sport->port.suspended && !sport->port.irq_wake)
                clk_prepare_enable(sport->clk);
-        if (sport->port.iotype & (UPIO_MEM32 | UPIO_MEM32BE)) {
+        if (lpuart_is_32(sport)) {
                lpuart32_setup_watermark(sport);
                temp = lpuart32_read(&sport->port, UARTCTRL);
                temp |= (UARTCTRL_RIE | UARTCTRL_TIE | UARTCTRL_RE |
diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
index 9e3162bf3bd1..80934e7bd67f 100644
--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -186,11 +186,6 @@
 #define UART_NR 8
-/* RX DMA buffer periods */
-#define RX_DMA_PERIODS 4
-#define RX_BUF_SIZE     (PAGE_SIZE)
 /* i.MX21 type uart runs on all i.mx except i.MX1 and i.MX6q */
 enum imx_uart_type {
        IMX1_UART,
@@ -226,7 +221,6 @@ struct imx_port {
        struct dma_chan         *dma_chan_rx, *dma_chan_tx;
        struct scatterlist      rx_sgl, tx_sgl[2];
        void                    *rx_buf;
-        unsigned int            rx_buf_size;
        struct circ_buf         rx_ring;
        unsigned int            rx_periods;
        dma_cookie_t            rx_cookie;
@@ -464,7 +458,7 @@ static inline void imx_transmit_buffer(struct imx_port *sport)
                }
        }
-        while (!uart_circ_empty(xmit) &&
+        while (!uart_circ_empty(xmit) && !sport->dma_is_txing &&
               !(readl(sport->port.membase + uts_reg(sport)) & UTS_TXFULL)) {
                /* send xmit->buf[xmit->tail]
                 * out the port here */
@@ -967,6 +961,8 @@ static void imx_timeout(unsigned long data)
        }
 }
+#define RX_BUF_SIZE     (PAGE_SIZE)
 /*
 * There are two kinds of RX DMA interrupts(such as in the MX6Q):
 *   [1] the RX DMA buffer is full.
@@ -1049,6 +1045,9 @@ static void dma_rx_callback(void *data)
        }
 }
+/* RX DMA buffer periods */
+#define RX_DMA_PERIODS 4
 static int start_rx_dma(struct imx_port *sport)
 {
        struct scatterlist *sgl = &sport->rx_sgl;
@@ -1059,8 +1058,9 @@ static int start_rx_dma(struct imx_port *sport)
        sport->rx_ring.head = 0;
        sport->rx_ring.tail = 0;
+        sport->rx_periods = RX_DMA_PERIODS;
-        sg_init_one(sgl, sport->rx_buf, sport->rx_buf_size);
+        sg_init_one(sgl, sport->rx_buf, RX_BUF_SIZE);
        ret = dma_map_sg(dev, sgl, 1, DMA_FROM_DEVICE);
        if (ret == 0) {
                dev_err(dev, "DMA mapping error for RX.\n");
@@ -1171,7 +1171,7 @@ static int imx_uart_dma_init(struct imx_port *sport)
                goto err;
        }
-        sport->rx_buf = kzalloc(sport->rx_buf_size, GFP_KERNEL);
+        sport->rx_buf = kzalloc(PAGE_SIZE, GFP_KERNEL);
        if (!sport->rx_buf) {
                ret = -ENOMEM;
                goto err;
@@ -2036,7 +2036,6 @@ static int serial_imx_probe_dt(struct imx_port *sport,
 {
        struct device_node *np = pdev->dev.of_node;
        int ret;
-        u32 dma_buf_size[2];
        sport->devdata = of_device_get_match_data(&pdev->dev);
        if (!sport->devdata)
@@ -2060,14 +2059,6 @@ static int serial_imx_probe_dt(struct imx_port *sport,
        if (of_get_property(np, "rts-gpios", NULL))
                sport->have_rtsgpio = 1;
-        if (!of_property_read_u32_array(np, "fsl,dma-size", dma_buf_size, 2)) {
-                sport->rx_buf_size = dma_buf_size[0] * dma_buf_size[1];
-                sport->rx_periods = dma_buf_size[1];
-        } else {
-                sport->rx_buf_size = RX_BUF_SIZE;
-                sport->rx_periods = RX_DMA_PERIODS;
-        }
        return 0;
 }
 #else
diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
index da5ddfc14778..e08b16b070c0 100644
--- a/drivers/tty/serial/sh-sci.c
+++ b/drivers/tty/serial/sh-sci.c
@@ -1085,10 +1085,12 @@ static ssize_t rx_trigger_store(struct device *dev,
 {
        struct uart_port *port = dev_get_drvdata(dev);
        struct sci_port *sci = to_sci_port(port);
+        int ret;
        long r;
-        if (kstrtol(buf, 0, &r) == -EINVAL)
+        ret = kstrtol(buf, 0, &r);
-                return -EINVAL;
+        if (ret)
+                return ret;
        sci->rx_trigger = scif_set_rtrg(port, r);
        if (port->type == PORT_SCIFA || port->type == PORT_SCIFB)
@@ -1116,10 +1118,12 @@ static ssize_t rx_fifo_timeout_store(struct device *dev,
 {
        struct uart_port *port = dev_get_drvdata(dev);
        struct sci_port *sci = to_sci_port(port);
+        int ret;
        long r;
-        if (kstrtol(buf, 0, &r) == -EINVAL)
+        ret = kstrtol(buf, 0, &r);
-                return -EINVAL;
+        if (ret)
+                return ret;
        sci->rx_fifo_timeout = r;
        scif_set_rtrg(port, 1);
        if (r > 0)
diff --git a/drivers/tty/serial/st-asc.c b/drivers/tty/serial/st-asc.c
index f5335be344f6..6b0ca65027d0 100644
--- a/drivers/tty/serial/st-asc.c
+++ b/drivers/tty/serial/st-asc.c
@@ -758,6 +758,7 @@ static int asc_init_port(struct asc_port *ascport,
        if (IS_ERR(ascport->pinctrl)) {
                ret = PTR_ERR(ascport->pinctrl);
                dev_err(&pdev->dev, "Failed to get Pinctrl: %d\n", ret);
+                return ret;
        }
        ascport->states[DEFAULT] =
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 5357d83bbda2..5e056064259c 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1829,6 +1829,9 @@ static const struct usb_device_id acm_ids[] = {
        { USB_DEVICE(0x1576, 0x03b1), /* Maretron USB100 */
        .driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */
        },
+        { USB_DEVICE(0xfff0, 0x0100), /* DATECS FP-2000 */
+        .driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */
+        },
        { USB_DEVICE(0x2912, 0x0001), /* ATOL FPrint */
        .driver_info = CLEAR_HALT_CONDITIONS,
diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index bc3b3fda5000..c4066cd77e47 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -3573,6 +3573,9 @@ irq_retry:
                /* Report disconnection if it is not already done. */
                dwc2_hsotg_disconnect(hsotg);
+                /* Reset device address to zero */
+                __bic32(hsotg->regs + DCFG, DCFG_DEVADDR_MASK);
                if (usb_status & GOTGCTL_BSESVLD && connected)
                        dwc2_hsotg_core_init_disconnected(hsotg, true);
        }
diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index 326b302fc440..03474d3575ab 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -766,15 +766,15 @@ static int dwc3_core_init(struct dwc3 *dwc)
                        dwc->maximum_speed = USB_SPEED_HIGH;
        }
-        ret = dwc3_core_soft_reset(dwc);
+        ret = dwc3_core_get_phy(dwc);
        if (ret)
                goto err0;
-        ret = dwc3_phy_setup(dwc);
+        ret = dwc3_core_soft_reset(dwc);
        if (ret)
                goto err0;
-        ret = dwc3_core_get_phy(dwc);
+        ret = dwc3_phy_setup(dwc);
        if (ret)
                goto err0;
diff --git a/drivers/usb/dwc3/dwc3-omap.c b/drivers/usb/dwc3/dwc3-omap.c
index 98926504b55b..f5aaa0cf3873 100644
--- a/drivers/usb/dwc3/dwc3-omap.c
+++ b/drivers/usb/dwc3/dwc3-omap.c
@@ -512,15 +512,6 @@ static int dwc3_omap_probe(struct platform_device *pdev)
        /* check the DMA Status */
        reg = dwc3_omap_readl(omap->base, USBOTGSS_SYSCONFIG);
-        irq_set_status_flags(omap->irq, IRQ_NOAUTOEN);
-        ret = devm_request_threaded_irq(dev, omap->irq, dwc3_omap_interrupt,
-                                        dwc3_omap_interrupt_thread, IRQF_SHARED,
-                                        "dwc3-omap", omap);
-        if (ret) {
-                dev_err(dev, "failed to request IRQ #%d --> %d\n",
-                                omap->irq, ret);
-                goto err1;
-        }
        ret = dwc3_omap_extcon_register(omap);
        if (ret < 0)
@@ -532,8 +523,15 @@ static int dwc3_omap_probe(struct platform_device *pdev)
                goto err1;
        }
+        ret = devm_request_threaded_irq(dev, omap->irq, dwc3_omap_interrupt,
+                                        dwc3_omap_interrupt_thread, IRQF_SHARED,
+                                        "dwc3-omap", omap);
+        if (ret) {
+                dev_err(dev, "failed to request IRQ #%d --> %d\n",
+                        omap->irq, ret);
+                goto err1;
+        }
        dwc3_omap_enable_irqs(omap);
-        enable_irq(omap->irq);
        return 0;
 err1:
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 9e41605a276b..6b299c7b7656 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -191,14 +191,16 @@ void dwc3_gadget_giveback(struct dwc3_ep *dep, struct dwc3_request *req,
        req->started = false;
        list_del(&req->list);
-        req->trb = NULL;
        req->remaining = 0;
        if (req->request.status == -EINPROGRESS)
                req->request.status = status;
-        usb_gadget_unmap_request_by_dev(dwc->sysdev,
+        if (req->trb)
-                                        &req->request, req->direction);
+                usb_gadget_unmap_request_by_dev(dwc->sysdev,
+                                                &req->request, req->direction);
+        req->trb = NULL;
        trace_dwc3_gadget_giveback(req);
diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c
index e80b9c123a9d..f95bddd6513f 100644
--- a/drivers/usb/gadget/function/f_mass_storage.c
+++ b/drivers/usb/gadget/function/f_mass_storage.c
@@ -2490,7 +2490,7 @@ static int fsg_main_thread(void *common_)
                int i;
                down_write(&common->filesem);
-                for (i = 0; i < ARRAY_SIZE(common->luns); --i) {
+                for (i = 0; i < ARRAY_SIZE(common->luns); i++) {
                        struct fsg_lun *curlun = common->luns[i];
                        if (!curlun || !fsg_lun_is_open(curlun))
                                continue;
diff --git a/drivers/usb/gadget/function/f_uac1.c b/drivers/usb/gadget/function/f_uac1.c
index 8656f84e17d9..29efbedc91f9 100644
--- a/drivers/usb/gadget/function/f_uac1.c
+++ b/drivers/usb/gadget/function/f_uac1.c
@@ -92,9 +92,9 @@ static struct uac_input_terminal_descriptor usb_out_it_desc = {
        .bDescriptorType =      USB_DT_CS_INTERFACE,
        .bDescriptorSubtype =   UAC_INPUT_TERMINAL,
        .bTerminalID =          USB_OUT_IT_ID,
-        .wTerminalType =        UAC_TERMINAL_STREAMING,
+        .wTerminalType =        cpu_to_le16(UAC_TERMINAL_STREAMING),
        .bAssocTerminal =       0,
-        .wChannelConfig =       0x3,
+        .wChannelConfig =       cpu_to_le16(0x3),
 };
 #define IO_OUT_OT_ID    2
@@ -103,7 +103,7 @@ static struct uac1_output_terminal_descriptor io_out_ot_desc = {
        .bDescriptorType        = USB_DT_CS_INTERFACE,
        .bDescriptorSubtype     = UAC_OUTPUT_TERMINAL,
        .bTerminalID            = IO_OUT_OT_ID,
-        .wTerminalType          = UAC_OUTPUT_TERMINAL_SPEAKER,
+        .wTerminalType          = cpu_to_le16(UAC_OUTPUT_TERMINAL_SPEAKER),
        .bAssocTerminal         = 0,
        .bSourceID              = USB_OUT_IT_ID,
 };
@@ -114,9 +114,9 @@ static struct uac_input_terminal_descriptor io_in_it_desc = {
        .bDescriptorType        = USB_DT_CS_INTERFACE,
        .bDescriptorSubtype     = UAC_INPUT_TERMINAL,
        .bTerminalID            = IO_IN_IT_ID,
-        .wTerminalType          = UAC_INPUT_TERMINAL_MICROPHONE,
+        .wTerminalType          = cpu_to_le16(UAC_INPUT_TERMINAL_MICROPHONE),
        .bAssocTerminal         = 0,
-        .wChannelConfig         = 0x3,
+        .wChannelConfig         = cpu_to_le16(0x3),
 };
 #define USB_IN_OT_ID    4
@@ -125,7 +125,7 @@ static struct uac1_output_terminal_descriptor usb_in_ot_desc = {
        .bDescriptorType =      USB_DT_CS_INTERFACE,
        .bDescriptorSubtype =   UAC_OUTPUT_TERMINAL,
        .bTerminalID =          USB_IN_OT_ID,
-        .wTerminalType =        UAC_TERMINAL_STREAMING,
+        .wTerminalType =        cpu_to_le16(UAC_TERMINAL_STREAMING),
        .bAssocTerminal =       0,
        .bSourceID =            IO_IN_IT_ID,
 };
@@ -174,7 +174,7 @@ static struct uac1_as_header_descriptor as_out_header_desc = {
        .bDescriptorSubtype =   UAC_AS_GENERAL,
        .bTerminalLink =        USB_OUT_IT_ID,
        .bDelay =               1,
-        .wFormatTag =           UAC_FORMAT_TYPE_I_PCM,
+        .wFormatTag =           cpu_to_le16(UAC_FORMAT_TYPE_I_PCM),
 };
 static struct uac1_as_header_descriptor as_in_header_desc = {
@@ -183,7 +183,7 @@ static struct uac1_as_header_descriptor as_in_header_desc = {
        .bDescriptorSubtype =   UAC_AS_GENERAL,
        .bTerminalLink =        USB_IN_OT_ID,
        .bDelay =               1,
-        .wFormatTag =           UAC_FORMAT_TYPE_I_PCM,
+        .wFormatTag =           cpu_to_le16(UAC_FORMAT_TYPE_I_PCM),
 };
 DECLARE_UAC_FORMAT_TYPE_I_DISCRETE_DESC(1);
@@ -606,8 +606,8 @@ static int f_audio_bind(struct usb_configuration *c, struct usb_function *f)
        if (status)
                goto fail;
-        audio->out_ep_maxpsize = as_out_ep_desc.wMaxPacketSize;
+        audio->out_ep_maxpsize = le16_to_cpu(as_out_ep_desc.wMaxPacketSize);
-        audio->in_ep_maxpsize = as_in_ep_desc.wMaxPacketSize;
+        audio->in_ep_maxpsize = le16_to_cpu(as_in_ep_desc.wMaxPacketSize);
        audio->params.c_chmask = audio_opts->c_chmask;
        audio->params.c_srate = audio_opts->c_srate;
        audio->params.c_ssize = audio_opts->c_ssize;
diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c
index 9082ce261e70..f05c3f3e6103 100644
--- a/drivers/usb/gadget/function/f_uac2.c
+++ b/drivers/usb/gadget/function/f_uac2.c
@@ -168,7 +168,7 @@ static struct uac2_input_terminal_descriptor usb_out_it_desc = {
        .bAssocTerminal = 0,
        .bCSourceID = USB_OUT_CLK_ID,
        .iChannelNames = 0,
-        .bmControls = (CONTROL_RDWR << COPY_CTRL),
+        .bmControls = cpu_to_le16(CONTROL_RDWR << COPY_CTRL),
 };
 /* Input Terminal for I/O-In */
@@ -182,7 +182,7 @@ static struct uac2_input_terminal_descriptor io_in_it_desc = {
        .bAssocTerminal = 0,
        .bCSourceID = USB_IN_CLK_ID,
        .iChannelNames = 0,
-        .bmControls = (CONTROL_RDWR << COPY_CTRL),
+        .bmControls = cpu_to_le16(CONTROL_RDWR << COPY_CTRL),
 };
 /* Ouput Terminal for USB_IN */
@@ -196,7 +196,7 @@ static struct uac2_output_terminal_descriptor usb_in_ot_desc = {
        .bAssocTerminal = 0,
        .bSourceID = IO_IN_IT_ID,
        .bCSourceID = USB_IN_CLK_ID,
-        .bmControls = (CONTROL_RDWR << COPY_CTRL),
+        .bmControls = cpu_to_le16(CONTROL_RDWR << COPY_CTRL),
 };
 /* Ouput Terminal for I/O-Out */
@@ -210,7 +210,7 @@ static struct uac2_output_terminal_descriptor io_out_ot_desc = {
        .bAssocTerminal = 0,
        .bSourceID = USB_OUT_IT_ID,
        .bCSourceID = USB_OUT_CLK_ID,
-        .bmControls = (CONTROL_RDWR << COPY_CTRL),
+        .bmControls = cpu_to_le16(CONTROL_RDWR << COPY_CTRL),
 };
 static struct uac2_ac_header_descriptor ac_hdr_desc = {
@@ -220,9 +220,10 @@ static struct uac2_ac_header_descriptor ac_hdr_desc = {
        .bDescriptorSubtype = UAC_MS_HEADER,
        .bcdADC = cpu_to_le16(0x200),
        .bCategory = UAC2_FUNCTION_IO_BOX,
-        .wTotalLength = sizeof in_clk_src_desc + sizeof out_clk_src_desc
+        .wTotalLength = cpu_to_le16(sizeof in_clk_src_desc
-                         + sizeof usb_out_it_desc + sizeof io_in_it_desc
+                        + sizeof out_clk_src_desc + sizeof usb_out_it_desc
-                        + sizeof usb_in_ot_desc + sizeof io_out_ot_desc,
+                        + sizeof io_in_it_desc + sizeof usb_in_ot_desc
+                        + sizeof io_out_ot_desc),
        .bmControls = 0,
 };
@@ -569,10 +570,12 @@ afunc_bind(struct usb_configuration *cfg, struct usb_function *fn)
                return ret;
        }
-        agdev->in_ep_maxpsize = max(fs_epin_desc.wMaxPacketSize,
+        agdev->in_ep_maxpsize = max_t(u16,
-                                        hs_epin_desc.wMaxPacketSize);
+                                le16_to_cpu(fs_epin_desc.wMaxPacketSize),
-        agdev->out_ep_maxpsize = max(fs_epout_desc.wMaxPacketSize,
+                                le16_to_cpu(hs_epin_desc.wMaxPacketSize));
-                                        hs_epout_desc.wMaxPacketSize);
+        agdev->out_ep_maxpsize = max_t(u16,
+                                le16_to_cpu(fs_epout_desc.wMaxPacketSize),
+                                le16_to_cpu(hs_epout_desc.wMaxPacketSize));
        hs_epout_desc.bEndpointAddress = fs_epout_desc.bEndpointAddress;
        hs_epin_desc.bEndpointAddress = fs_epin_desc.bEndpointAddress;
diff --git a/drivers/usb/gadget/udc/Kconfig b/drivers/usb/gadget/udc/Kconfig
index 9ffb11ec9ed9..7cd5c969fcbe 100644
--- a/drivers/usb/gadget/udc/Kconfig
+++ b/drivers/usb/gadget/udc/Kconfig
@@ -192,7 +192,7 @@ config USB_RENESAS_USBHS_UDC
 config USB_RENESAS_USB3
        tristate 'Renesas USB3.0 Peripheral controller'
        depends on ARCH_RENESAS || COMPILE_TEST
-        depends on EXTCON
+        depends on EXTCON && HAS_DMA
        help
           Renesas USB3.0 Peripheral controller is a USB peripheral controller
           that supports super, high, and full speed USB 3.0 data transfers.
@@ -257,6 +257,7 @@ config USB_MV_U3D
 config USB_SNP_CORE
        depends on (USB_AMD5536UDC || USB_SNP_UDC_PLAT)
+        depends on HAS_DMA
        tristate
        help
          This enables core driver support for Synopsys USB 2.0 Device
@@ -271,7 +272,7 @@ config USB_SNP_CORE
 config USB_SNP_UDC_PLAT
        tristate "Synopsys USB 2.0 Device controller"
-        depends on (USB_GADGET && OF)
+        depends on USB_GADGET && OF && HAS_DMA
        select USB_GADGET_DUALSPEED
        select USB_SNP_CORE
        default ARCH_BCM_IPROC
diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
index d8278322d5ac..62dc9c7798e7 100644
--- a/drivers/usb/gadget/udc/renesas_usb3.c
+++ b/drivers/usb/gadget/udc/renesas_usb3.c
@@ -89,6 +89,9 @@
 /* USB_COM_CON */
 #define USB_COM_CON_CONF                BIT(24)
+#define USB_COM_CON_PN_WDATAIF_NL       BIT(23)
+#define USB_COM_CON_PN_RDATAIF_NL       BIT(22)
+#define USB_COM_CON_PN_LSTTR_PP         BIT(21)
 #define USB_COM_CON_SPD_MODE            BIT(17)
 #define USB_COM_CON_EP0_EN              BIT(16)
 #define USB_COM_CON_DEV_ADDR_SHIFT      8
@@ -686,6 +689,9 @@ static void renesas_usb3_init_controller(struct renesas_usb3 *usb3)
 {
        usb3_init_axi_bridge(usb3);
        usb3_init_epc_registers(usb3);
+        usb3_set_bit(usb3, USB_COM_CON_PN_WDATAIF_NL |
+                     USB_COM_CON_PN_RDATAIF_NL | USB_COM_CON_PN_LSTTR_PP,
+                     USB3_USB_COM_CON);
        usb3_write(usb3, USB_OTG_IDMON, USB3_USB_OTG_INT_STA);
        usb3_write(usb3, USB_OTG_IDMON, USB3_USB_OTG_INT_ENA);
@@ -1369,7 +1375,7 @@ static int renesas_usb3_dma_free_prd(struct renesas_usb3 *usb3,
        usb3_for_each_dma(usb3, dma, i) {
                if (dma->prd) {
-                        dma_free_coherent(dev, USB3_DMA_MAX_XFER_SIZE,
+                        dma_free_coherent(dev, USB3_DMA_PRD_SIZE,
                                          dma->prd, dma->prd_dma);
                        dma->prd = NULL;
                }
@@ -1409,12 +1415,12 @@ static void usb3_start_pipen(struct renesas_usb3_ep *usb3_ep,
        int ret = -EAGAIN;
        u32 enable_bits = 0;
+        spin_lock_irqsave(&usb3->lock, flags);
        if (usb3_ep->halt || usb3_ep->started)
-                return;
+                goto out;
        if (usb3_req != usb3_req_first)
-                return;
+                goto out;
-        spin_lock_irqsave(&usb3->lock, flags);
        if (usb3_pn_change(usb3, usb3_ep->num) < 0)
                goto out;
diff --git a/drivers/usb/gadget/udc/snps_udc_plat.c b/drivers/usb/gadget/udc/snps_udc_plat.c
index 2e11f19e07ae..f7b4d0f159e4 100644
--- a/drivers/usb/gadget/udc/snps_udc_plat.c
+++ b/drivers/usb/gadget/udc/snps_udc_plat.c
@@ -28,7 +28,7 @@
 /* description */
 #define UDC_MOD_DESCRIPTION     "Synopsys UDC platform driver"
-void start_udc(struct udc *udc)
+static void start_udc(struct udc *udc)
 {
        if (udc->driver) {
                dev_info(udc->dev, "Connecting...\n");
@@ -38,7 +38,7 @@ void start_udc(struct udc *udc)
        }
 }
-void stop_udc(struct udc *udc)
+static void stop_udc(struct udc *udc)
 {
        int tmp;
        u32 reg;
@@ -76,7 +76,7 @@ void stop_udc(struct udc *udc)
        dev_info(udc->dev, "Device disconnected\n");
 }
-void udc_drd_work(struct work_struct *work)
+static void udc_drd_work(struct work_struct *work)
 {
        struct udc *udc;
diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
index a9a1e4c40480..c8989c62a262 100644
--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -77,6 +77,16 @@
 #define USB_INTEL_USB3_PSSEN   0xD8
 #define USB_INTEL_USB3PRM      0xDC
+/* ASMEDIA quirk use */
+#define ASMT_DATA_WRITE0_REG    0xF8
+#define ASMT_DATA_WRITE1_REG    0xFC
+#define ASMT_CONTROL_REG        0xE0
+#define ASMT_CONTROL_WRITE_BIT  0x02
+#define ASMT_WRITEREG_CMD       0x10423
+#define ASMT_FLOWCTL_ADDR       0xFA30
+#define ASMT_FLOWCTL_DATA       0xBA
+#define ASMT_PSEUDO_DATA        0
 /*
 * amd_chipset_gen values represent AMD different chipset generations
 */
@@ -412,6 +422,50 @@ void usb_amd_quirk_pll_disable(void)
 }
 EXPORT_SYMBOL_GPL(usb_amd_quirk_pll_disable);
+static int usb_asmedia_wait_write(struct pci_dev *pdev)
+{
+        unsigned long retry_count;
+        unsigned char value;
+        for (retry_count = 1000; retry_count > 0; --retry_count) {
+                pci_read_config_byte(pdev, ASMT_CONTROL_REG, &value);
+                if (value == 0xff) {
+                        dev_err(&pdev->dev, "%s: check_ready ERROR", __func__);
+                        return -EIO;
+                }
+                if ((value & ASMT_CONTROL_WRITE_BIT) == 0)
+                        return 0;
+                usleep_range(40, 60);
+        }
+        dev_warn(&pdev->dev, "%s: check_write_ready timeout", __func__);
+        return -ETIMEDOUT;
+}
+void usb_asmedia_modifyflowcontrol(struct pci_dev *pdev)
+{
+        if (usb_asmedia_wait_write(pdev) != 0)
+                return;
+        /* send command and address to device */
+        pci_write_config_dword(pdev, ASMT_DATA_WRITE0_REG, ASMT_WRITEREG_CMD);
+        pci_write_config_dword(pdev, ASMT_DATA_WRITE1_REG, ASMT_FLOWCTL_ADDR);
+        pci_write_config_byte(pdev, ASMT_CONTROL_REG, ASMT_CONTROL_WRITE_BIT);
+        if (usb_asmedia_wait_write(pdev) != 0)
+                return;
+        /* send data to device */
+        pci_write_config_dword(pdev, ASMT_DATA_WRITE0_REG, ASMT_FLOWCTL_DATA);
+        pci_write_config_dword(pdev, ASMT_DATA_WRITE1_REG, ASMT_PSEUDO_DATA);
+        pci_write_config_byte(pdev, ASMT_CONTROL_REG, ASMT_CONTROL_WRITE_BIT);
+}
+EXPORT_SYMBOL_GPL(usb_asmedia_modifyflowcontrol);
 void usb_amd_quirk_pll_enable(void)
 {
        usb_amd_quirk_pll(0);
diff --git a/drivers/usb/host/pci-quirks.h b/drivers/usb/host/pci-quirks.h
index 0222195bd5b0..655994480198 100644
--- a/drivers/usb/host/pci-quirks.h
+++ b/drivers/usb/host/pci-quirks.h
@@ -11,6 +11,7 @@ bool usb_amd_prefetch_quirk(void);
 void usb_amd_dev_put(void);
 void usb_amd_quirk_pll_disable(void);
 void usb_amd_quirk_pll_enable(void);
+void usb_asmedia_modifyflowcontrol(struct pci_dev *pdev);
 void usb_enable_intel_xhci_ports(struct pci_dev *xhci_pdev);
 void usb_disable_xhci_ports(struct pci_dev *xhci_pdev);
 void sb800_prefetch(struct device *dev, int on);
@@ -18,6 +19,7 @@ void sb800_prefetch(struct device *dev, int on);
 struct pci_dev;
 static inline void usb_amd_quirk_pll_disable(void) {}
 static inline void usb_amd_quirk_pll_enable(void) {}
+static inline void usb_asmedia_modifyflowcontrol(struct pci_dev *pdev) {}
 static inline void usb_amd_dev_put(void) {}
 static inline void usb_disable_xhci_ports(struct pci_dev *xhci_pdev) {}
 static inline void sb800_prefetch(struct device *dev, int on) {}
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 1adae9eab831..00721e8807ab 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -398,14 +398,21 @@ static int xhci_stop_device(struct xhci_hcd *xhci, int slot_id, int suspend)
        spin_lock_irqsave(&xhci->lock, flags);
        for (i = LAST_EP_INDEX; i > 0; i--) {
                if (virt_dev->eps[i].ring && virt_dev->eps[i].ring->dequeue) {
+                        struct xhci_ep_ctx *ep_ctx;
                        struct xhci_command *command;
+                        ep_ctx = xhci_get_ep_ctx(xhci, virt_dev->out_ctx, i);
+                        /* Check ep is running, required by AMD SNPS 3.1 xHC */
+                        if (GET_EP_CTX_STATE(ep_ctx) != EP_STATE_RUNNING)
+                                continue;
                        command = xhci_alloc_command(xhci, false, false,
                                                     GFP_NOWAIT);
                        if (!command) {
                                spin_unlock_irqrestore(&xhci->lock, flags);
                                xhci_free_command(xhci, cmd);
                                return -ENOMEM;
                        }
                        xhci_queue_stop_endpoint(xhci, command, slot_id, i,
                                                 suspend);
@@ -603,12 +610,14 @@ static int xhci_enter_test_mode(struct xhci_hcd *xhci,
        /* Disable all Device Slots */
        xhci_dbg(xhci, "Disable all slots\n");
+        spin_unlock_irqrestore(&xhci->lock, *flags);
        for (i = 1; i <= HCS_MAX_SLOTS(xhci->hcs_params1); i++) {
                retval = xhci_disable_slot(xhci, NULL, i);
                if (retval)
                        xhci_err(xhci, "Failed to disable slot %d, %d. Enter test mode anyway\n",
                                 i, retval);
        }
+        spin_lock_irqsave(&xhci->lock, *flags);
        /* Put all ports to the Disable state by clear PP */
        xhci_dbg(xhci, "Disable all port (PP = 0)\n");
        /* Power off USB3 ports*/
@@ -897,6 +906,9 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
                        clear_bit(wIndex, &bus_state->resuming_ports);
                        set_bit(wIndex, &bus_state->rexit_ports);
+                        xhci_test_and_clear_bit(xhci, port_array, wIndex,
+                                                PORT_PLC);
                        xhci_set_link_state(xhci, port_array, wIndex,
                                        XDEV_U0);
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 53882e2babbb..5b0fa553c8bc 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -59,6 +59,8 @@
 #define PCI_DEVICE_ID_AMD_PROMONTORYA_2                 0x43bb
 #define PCI_DEVICE_ID_AMD_PROMONTORYA_1                 0x43bc
+#define PCI_DEVICE_ID_ASMEDIA_1042A_XHCI                0x1142
 static const char hcd_name[] = "xhci_hcd";
 static struct hc_driver __read_mostly xhci_pci_hc_driver;
@@ -217,6 +219,10 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
                        pdev->device == 0x1142)
                xhci->quirks |= XHCI_TRUST_TX_LENGTH;
+        if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
+                pdev->device == PCI_DEVICE_ID_ASMEDIA_1042A_XHCI)
+                xhci->quirks |= XHCI_ASMEDIA_MODIFY_FLOWCONTROL;
        if (pdev->vendor == PCI_VENDOR_ID_TI && pdev->device == 0x8241)
                xhci->quirks |= XHCI_LIMIT_ENDPOINT_INTERVAL_7;
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index c50c902d009e..cc368ad2b51e 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -864,13 +864,16 @@ static void xhci_kill_endpoint_urbs(struct xhci_hcd *xhci,
                        (ep->ep_state & EP_GETTING_NO_STREAMS)) {
                int stream_id;
-                for (stream_id = 0; stream_id < ep->stream_info->num_streams;
+                for (stream_id = 1; stream_id < ep->stream_info->num_streams;
                                stream_id++) {
+                        ring = ep->stream_info->stream_rings[stream_id];
+                        if (!ring)
+                                continue;
                        xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
                                        "Killing URBs for slot ID %u, ep index %u, stream %u",
-                                        slot_id, ep_index, stream_id + 1);
+                                        slot_id, ep_index, stream_id);
-                        xhci_kill_ring_urbs(xhci,
+                        xhci_kill_ring_urbs(xhci, ring);
-                                        ep->stream_info->stream_rings[stream_id]);
                }
        } else {
                ring = ep->ring;
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 56f85df013db..b2ff1ff1a02f 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -198,6 +198,9 @@ int xhci_reset(struct xhci_hcd *xhci)
        if (ret)
                return ret;
+        if (xhci->quirks & XHCI_ASMEDIA_MODIFY_FLOWCONTROL)
+                usb_asmedia_modifyflowcontrol(to_pci_dev(xhci_to_hcd(xhci)->self.controller));
        xhci_dbg_trace(xhci, trace_xhci_dbg_init,
                         "Wait for controller to be ready for doorbell rings");
        /*
@@ -622,8 +625,10 @@ int xhci_run(struct usb_hcd *hcd)
                if (!command)
                        return -ENOMEM;
-                xhci_queue_vendor_command(xhci, command, 0, 0, 0,
+                ret = xhci_queue_vendor_command(xhci, command, 0, 0, 0,
                                TRB_TYPE(TRB_NEC_GET_FW));
+                if (ret)
+                        xhci_free_command(xhci, command);
        }
        xhci_dbg_trace(xhci, trace_xhci_dbg_init,
                        "Finished xhci_run for USB2 roothub");
@@ -1085,6 +1090,9 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
        if ((xhci->quirks & XHCI_COMP_MODE_QUIRK) && !comp_timer_running)
                compliance_mode_recovery_timer_init(xhci);
+        if (xhci->quirks & XHCI_ASMEDIA_MODIFY_FLOWCONTROL)
+                usb_asmedia_modifyflowcontrol(to_pci_dev(hcd->self.controller));
        /* Re-enable port polling. */
        xhci_dbg(xhci, "%s: starting port polling.\n", __func__);
        set_bit(HCD_FLAG_POLL_RH, &xhci->shared_hcd->flags);
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 3c6da1f93c84..e3e935291ed6 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -1820,6 +1820,7 @@ struct xhci_hcd {
 #define XHCI_BROKEN_PORT_PED    (1 << 25)
 #define XHCI_LIMIT_ENDPOINT_INTERVAL_7  (1 << 26)
 #define XHCI_U2_DISABLE_WAKE    (1 << 27)
+#define XHCI_ASMEDIA_MODIFY_FLOWCONTROL (1 << 28)
        unsigned int            num_active_eps;
        unsigned int            limit_active_eps;
diff --git a/drivers/usb/renesas_usbhs/common.c b/drivers/usb/renesas_usbhs/common.c
index 623c51300393..f0ce304c5aaf 100644
--- a/drivers/usb/renesas_usbhs/common.c
+++ b/drivers/usb/renesas_usbhs/common.c
@@ -752,8 +752,10 @@ static int usbhsc_resume(struct device *dev)
        struct usbhs_priv *priv = dev_get_drvdata(dev);
        struct platform_device *pdev = usbhs_priv_to_pdev(priv);
-        if (!usbhsc_flags_has(priv, USBHSF_RUNTIME_PWCTRL))
+        if (!usbhsc_flags_has(priv, USBHSF_RUNTIME_PWCTRL)) {
                usbhsc_power_ctrl(priv, 1);
+                usbhs_mod_autonomy_mode(priv);
+        }
        usbhs_platform_call(priv, phy_reset, pdev);
diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c
index 5bc7a6138855..93fba9033b00 100644
--- a/drivers/usb/renesas_usbhs/mod_gadget.c
+++ b/drivers/usb/renesas_usbhs/mod_gadget.c
@@ -37,6 +37,7 @@ struct usbhsg_gpriv;
 struct usbhsg_uep {
        struct usb_ep            ep;
        struct usbhs_pipe       *pipe;
+        spinlock_t              lock;   /* protect the pipe */
        char ep_name[EP_NAME_SIZE];
@@ -636,10 +637,16 @@ usbhsg_ep_enable_end:
 static int usbhsg_ep_disable(struct usb_ep *ep)
 {
        struct usbhsg_uep *uep = usbhsg_ep_to_uep(ep);
-        struct usbhs_pipe *pipe = usbhsg_uep_to_pipe(uep);
+        struct usbhs_pipe *pipe;
+        unsigned long flags;
+        int ret = 0;
-        if (!pipe)
+        spin_lock_irqsave(&uep->lock, flags);
-                return -EINVAL;
+        pipe = usbhsg_uep_to_pipe(uep);
+        if (!pipe) {
+                ret = -EINVAL;
+                goto out;
+        }
        usbhsg_pipe_disable(uep);
        usbhs_pipe_free(pipe);
@@ -647,6 +654,9 @@ static int usbhsg_ep_disable(struct usb_ep *ep)
        uep->pipe->mod_private  = NULL;
        uep->pipe               = NULL;
+out:
+        spin_unlock_irqrestore(&uep->lock, flags);
        return 0;
 }
@@ -696,8 +706,11 @@ static int usbhsg_ep_dequeue(struct usb_ep *ep, struct usb_request *req)
 {
        struct usbhsg_uep *uep = usbhsg_ep_to_uep(ep);
        struct usbhsg_request *ureq = usbhsg_req_to_ureq(req);
-        struct usbhs_pipe *pipe = usbhsg_uep_to_pipe(uep);
+        struct usbhs_pipe *pipe;
+        unsigned long flags;
+        spin_lock_irqsave(&uep->lock, flags);
+        pipe = usbhsg_uep_to_pipe(uep);
        if (pipe)
                usbhs_pkt_pop(pipe, usbhsg_ureq_to_pkt(ureq));
@@ -706,6 +719,7 @@ static int usbhsg_ep_dequeue(struct usb_ep *ep, struct usb_request *req)
         * even if the pipe is NULL.
         */
        usbhsg_queue_pop(uep, ureq, -ECONNRESET);
+        spin_unlock_irqrestore(&uep->lock, flags);
        return 0;
 }
@@ -852,10 +866,10 @@ static int usbhsg_try_stop(struct usbhs_priv *priv, u32 status)
 {
        struct usbhsg_gpriv *gpriv = usbhsg_priv_to_gpriv(priv);
        struct usbhs_mod *mod = usbhs_mod_get_current(priv);
-        struct usbhsg_uep *dcp = usbhsg_gpriv_to_dcp(gpriv);
+        struct usbhsg_uep *uep;
        struct device *dev = usbhs_priv_to_dev(priv);
        unsigned long flags;
-        int ret = 0;
+        int ret = 0, i;
        /********************  spin lock ********************/
        usbhs_lock(priv, flags);
@@ -887,7 +901,9 @@ static int usbhsg_try_stop(struct usbhs_priv *priv, u32 status)
        usbhs_sys_set_test_mode(priv, 0);
        usbhs_sys_function_ctrl(priv, 0);
-        usbhsg_ep_disable(&dcp->ep);
+        /* disable all eps */
+        usbhsg_for_each_uep_with_dcp(uep, gpriv, i)
+                usbhsg_ep_disable(&uep->ep);
        dev_dbg(dev, "stop gadget\n");
@@ -1069,6 +1085,7 @@ int usbhs_mod_gadget_probe(struct usbhs_priv *priv)
                ret = -ENOMEM;
                goto usbhs_mod_gadget_probe_err_gpriv;
        }
+        spin_lock_init(&uep->lock);
        gpriv->transceiver = usb_get_phy(USB_PHY_TYPE_UNDEFINED);
        dev_info(dev, "%stransceiver found\n",
diff --git a/drivers/usb/storage/isd200.c b/drivers/usb/storage/isd200.c
index fba4005dd737..6a7720e66595 100644
--- a/drivers/usb/storage/isd200.c
+++ b/drivers/usb/storage/isd200.c
@@ -1529,8 +1529,11 @@ static void isd200_ata_command(struct scsi_cmnd *srb, struct us_data *us)
        /* Make sure driver was initialized */
-        if (us->extra == NULL)
+        if (us->extra == NULL) {
                usb_stor_dbg(us, "ERROR Driver not initialized\n");
+                srb->result = DID_ERROR << 16;
+                return;
+        }
        scsi_set_resid(srb, 0);
        /* scsi_bufflen might change in protocol translation to ata */
diff --git a/drivers/usb/typec/ucsi/ucsi.h b/drivers/usb/typec/ucsi/ucsi.h
index 6b0d2f0918c6..8a88f45822e3 100644
--- a/drivers/usb/typec/ucsi/ucsi.h
+++ b/drivers/usb/typec/ucsi/ucsi.h
@@ -3,6 +3,7 @@
 #define __DRIVER_USB_TYPEC_UCSI_H
 #include <linux/bitops.h>
+#include <linux/device.h>
 #include <linux/types.h>
 /* -------------------------------------------------------------------------- */
diff --git a/drivers/w1/masters/omap_hdq.c b/drivers/w1/masters/omap_hdq.c
index 3612542b6044..83fc9aab34e8 100644
--- a/drivers/w1/masters/omap_hdq.c
+++ b/drivers/w1/masters/omap_hdq.c
@@ -704,7 +704,8 @@ static int omap_hdq_probe(struct platform_device *pdev)
        irq = platform_get_irq(pdev, 0);
        if (irq < 0) {
-                ret = -ENXIO;
+                dev_dbg(&pdev->dev, "Failed to get IRQ: %d\n", irq);
+                ret = irq;
                goto err_irq;
        }
diff --git a/drivers/w1/w1.c b/drivers/w1/w1.c
index 95ea7e6b1d99..74471e7aa5cc 100644
--- a/drivers/w1/w1.c
+++ b/drivers/w1/w1.c
@@ -728,6 +728,7 @@ int w1_attach_slave_device(struct w1_master *dev, struct w1_reg_num *rn)
        memcpy(&sl->reg_num, rn, sizeof(sl->reg_num));
        atomic_set(&sl->refcnt, 1);
        atomic_inc(&sl->master->refcnt);
+        dev->slave_count++;
        /* slave modules need to be loaded in a context with unlocked mutex */
        mutex_unlock(&dev->mutex);
@@ -747,11 +748,11 @@ int w1_attach_slave_device(struct w1_master *dev, struct w1_reg_num *rn)
        sl->family = f;
        err = __w1_attach_slave_device(sl);
        if (err < 0) {
                dev_err(&dev->dev, "%s: Attaching %s failed.\n", __func__,
                         sl->name);
+                dev->slave_count--;
                w1_family_put(sl->family);
                atomic_dec(&sl->master->refcnt);
                kfree(sl);
@@ -759,7 +760,6 @@ int w1_attach_slave_device(struct w1_master *dev, struct w1_reg_num *rn)
        }
        sl->ttl = dev->slave_ttl;
-        dev->slave_count++;
        memcpy(msg.id.id, rn, sizeof(msg.id));
        msg.type = W1_SLAVE_ADD;
diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index 50dcb68d8070..ab609255a0f3 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -780,6 +780,9 @@ static int __init balloon_init(void)
        }
 #endif
+        /* Init the xen-balloon driver. */
+        xen_balloon_init();
        return 0;
 }
 subsys_initcall(balloon_init);
diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
index d6786b87e13b..2c6a9114d332 100644
--- a/drivers/xen/grant-table.c
+++ b/drivers/xen/grant-table.c
@@ -42,6 +42,7 @@
 #include <linux/delay.h>
 #include <linux/hardirq.h>
 #include <linux/workqueue.h>
+#include <linux/ratelimit.h>
 #include <xen/xen.h>
 #include <xen/interface/xen.h>
@@ -1072,8 +1073,14 @@ static int gnttab_expand(unsigned int req_entries)
        cur = nr_grant_frames;
        extra = ((req_entries + (grefs_per_grant_frame-1)) /
                 grefs_per_grant_frame);
-        if (cur + extra > gnttab_max_grant_frames())
+        if (cur + extra > gnttab_max_grant_frames()) {
+                pr_warn_ratelimited("xen/grant-table: max_grant_frames reached"
+                                    " cur=%u extra=%u limit=%u"
+                                    " gnttab_free_count=%u req_entries=%u\n",
+                                    cur, extra, gnttab_max_grant_frames(),
+                                    gnttab_free_count, req_entries);
                return -ENOSPC;
+        }
        rc = gnttab_map(cur, cur + extra - 1);
        if (rc == 0)
diff --git a/drivers/xen/xen-balloon.c b/drivers/xen/xen-balloon.c
index e7715cb62eef..e89136ab851e 100644
--- a/drivers/xen/xen-balloon.c
+++ b/drivers/xen/xen-balloon.c
@@ -59,6 +59,8 @@ static void watch_target(struct xenbus_watch *watch,
 {
        unsigned long long new_target;
        int err;
+        static bool watch_fired;
+        static long target_diff;
        err = xenbus_scanf(XBT_NIL, "memory", "target", "%llu", &new_target);
        if (err != 1) {
@@ -69,7 +71,14 @@ static void watch_target(struct xenbus_watch *watch,
        /* The given memory/target value is in KiB, so it needs converting to
         * pages. PAGE_SHIFT converts bytes to pages, hence PAGE_SHIFT - 10.
         */
-        balloon_set_new_target(new_target >> (PAGE_SHIFT - 10));
+        new_target >>= PAGE_SHIFT - 10;
+        if (watch_fired) {
+                balloon_set_new_target(new_target - target_diff);
+                return;
+        }
+        watch_fired = true;
+        target_diff = new_target - balloon_stats.target_pages;
 }
 static struct xenbus_watch target_watch = {
        .node = "memory/target",
@@ -94,22 +103,15 @@ static struct notifier_block xenstore_notifier = {
        .notifier_call = balloon_init_watcher,
 };
-static int __init balloon_init(void)
+void xen_balloon_init(void)
 {
-        if (!xen_domain())
-                return -ENODEV;
-        pr_info("Initialising balloon driver\n");
        register_balloon(&balloon_dev);
        register_xen_selfballooning(&balloon_dev);
        register_xenstore_notifier(&xenstore_notifier);
-        return 0;
 }
-subsys_initcall(balloon_init);
+EXPORT_SYMBOL_GPL(xen_balloon_init);
 #define BALLOON_SHOW(name, format, args...)                             \
        static ssize_t show_##name(struct device *dev,                  \
diff --git a/fs/binfmt_flat.c b/fs/binfmt_flat.c
index 69ec23daa25e..a1e6860b6f46 100644
--- a/fs/binfmt_flat.c
+++ b/fs/binfmt_flat.c
@@ -574,7 +574,7 @@ static int load_flat_file(struct linux_binprm *bprm,
                                MAX_SHARED_LIBS * sizeof(unsigned long),
                                FLAT_DATA_ALIGN);
-                pr_debug("Allocated data+bss+stack (%ld bytes): %lx\n",
+                pr_debug("Allocated data+bss+stack (%u bytes): %lx\n",
                         data_len + bss_len + stack_len, datapos);
                fpos = ntohl(hdr->data_start);
diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
index e071d23f6148..ef7240ace576 100644
--- a/fs/ceph/dir.c
+++ b/fs/ceph/dir.c
@@ -271,6 +271,11 @@ out:
                if (ret < 0)
                        err = ret;
                dput(last);
+                /* last_name no longer match cache index */
+                if (fi->readdir_cache_idx >= 0) {
+                        fi->readdir_cache_idx = -1;
+                        fi->dir_release_count = 0;
+                }
        }
        return err;
 }
diff --git a/fs/ext2/acl.c b/fs/ext2/acl.c
index 79dafa71effd..51f0aea70cb4 100644
--- a/fs/ext2/acl.c
+++ b/fs/ext2/acl.c
@@ -175,11 +175,8 @@ ext2_get_acl(struct inode *inode, int type)
        return acl;
 }
-/*
+static int
- * inode->i_mutex: down
+__ext2_set_acl(struct inode *inode, struct posix_acl *acl, int type)
- */
-int
-ext2_set_acl(struct inode *inode, struct posix_acl *acl, int type)
 {
        int name_index;
        void *value = NULL;
@@ -189,13 +186,6 @@ ext2_set_acl(struct inode *inode, struct posix_acl *acl, int type)
        switch(type) {
                case ACL_TYPE_ACCESS:
                        name_index = EXT2_XATTR_INDEX_POSIX_ACL_ACCESS;
-                        if (acl) {
-                                error = posix_acl_update_mode(inode, &inode->i_mode, &acl);
-                                if (error)
-                                        return error;
-                                inode->i_ctime = current_time(inode);
-                                mark_inode_dirty(inode);
-                        }
                        break;
                case ACL_TYPE_DEFAULT:
@@ -222,6 +212,31 @@ ext2_set_acl(struct inode *inode, struct posix_acl *acl, int type)
 }
 /*
+ * inode->i_mutex: down
+ */
+int
+ext2_set_acl(struct inode *inode, struct posix_acl *acl, int type)
+{
+        int error;
+        int update_mode = 0;
+        umode_t mode = inode->i_mode;
+        if (type == ACL_TYPE_ACCESS && acl) {
+                error = posix_acl_update_mode(inode, &mode, &acl);
+                if (error)
+                        return error;
+                update_mode = 1;
+        }
+        error = __ext2_set_acl(inode, acl, type);
+        if (!error && update_mode) {
+                inode->i_mode = mode;
+                inode->i_ctime = current_time(inode);
+                mark_inode_dirty(inode);
+        }
+        return error;
+}
+/*
 * Initialize the ACLs of a new inode. Called from ext2_new_inode.
 *
 * dir->i_mutex: down
@@ -238,12 +253,12 @@ ext2_init_acl(struct inode *inode, struct inode *dir)
                return error;
        if (default_acl) {
-                error = ext2_set_acl(inode, default_acl, ACL_TYPE_DEFAULT);
+                error = __ext2_set_acl(inode, default_acl, ACL_TYPE_DEFAULT);
                posix_acl_release(default_acl);
        }
        if (acl) {
                if (!error)
-                        error = ext2_set_acl(inode, acl, ACL_TYPE_ACCESS);
+                        error = __ext2_set_acl(inode, acl, ACL_TYPE_ACCESS);
                posix_acl_release(acl);
        }
        return error;
diff --git a/fs/f2fs/acl.c b/fs/f2fs/acl.c
index a140c5e3dc54..b4b8438c42ef 100644
--- a/fs/f2fs/acl.c
+++ b/fs/f2fs/acl.c
@@ -211,7 +211,7 @@ static int __f2fs_set_acl(struct inode *inode, int type,
        switch (type) {
        case ACL_TYPE_ACCESS:
                name_index = F2FS_XATTR_INDEX_POSIX_ACL_ACCESS;
-                if (acl) {
+                if (acl && !ipage) {
                        error = posix_acl_update_mode(inode, &inode->i_mode, &acl);
                        if (error)
                                return error;
diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c
index 56bbf592e487..5b876f6d3f6b 100644
--- a/fs/f2fs/checkpoint.c
+++ b/fs/f2fs/checkpoint.c
@@ -879,6 +879,7 @@ int sync_dirty_inodes(struct f2fs_sb_info *sbi, enum inode_type type)
        struct inode *inode;
        struct f2fs_inode_info *fi;
        bool is_dir = (type == DIR_INODE);
+        unsigned long ino = 0;
        trace_f2fs_sync_dirty_inodes_enter(sbi->sb, is_dir,
                                get_pages(sbi, is_dir ?
@@ -901,8 +902,17 @@ retry:
        inode = igrab(&fi->vfs_inode);
        spin_unlock(&sbi->inode_lock[type]);
        if (inode) {
+                unsigned long cur_ino = inode->i_ino;
                filemap_fdatawrite(inode->i_mapping);
                iput(inode);
+                /* We need to give cpu to another writers. */
+                if (ino == cur_ino) {
+                        congestion_wait(BLK_RW_ASYNC, HZ/50);
+                        cond_resched();
+                } else {
+                        ino = cur_ino;
+                }
        } else {
                /*
                 * We should submit bio, since it exists several
diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index a0e6d2c65a9e..2706130c261b 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -1538,7 +1538,6 @@ static int f2fs_ioc_setflags(struct file *filp, unsigned long arg)
        /* Is it quota file? Do not allow user to mess with it */
        if (IS_NOQUOTA(inode)) {
-                inode_unlock(inode);
                ret = -EPERM;
                goto unlock_out;
        }
@@ -1549,9 +1548,8 @@ static int f2fs_ioc_setflags(struct file *filp, unsigned long arg)
        if ((flags ^ oldflags) & (FS_APPEND_FL | FS_IMMUTABLE_FL)) {
                if (!capable(CAP_LINUX_IMMUTABLE)) {
-                        inode_unlock(inode);
                        ret = -EPERM;
-                        goto out;
+                        goto unlock_out;
                }
        }
@@ -1564,7 +1562,6 @@ static int f2fs_ioc_setflags(struct file *filp, unsigned long arg)
        f2fs_mark_inode_dirty_sync(inode, false);
 unlock_out:
        inode_unlock(inode);
-out:
        mnt_drop_write_file(filp);
        return ret;
 }
diff --git a/fs/f2fs/sysfs.c b/fs/f2fs/sysfs.c
index 9adc202fcd6f..71191d89917d 100644
--- a/fs/f2fs/sysfs.c
+++ b/fs/f2fs/sysfs.c
@@ -11,6 +11,7 @@
 */
 #include <linux/proc_fs.h>
 #include <linux/f2fs_fs.h>
+#include <linux/seq_file.h>
 #include "f2fs.h"
 #include "segment.h"
diff --git a/fs/hfsplus/posix_acl.c b/fs/hfsplus/posix_acl.c
index 9b92058a1240..6bb5d7c42888 100644
--- a/fs/hfsplus/posix_acl.c
+++ b/fs/hfsplus/posix_acl.c
@@ -51,8 +51,8 @@ struct posix_acl *hfsplus_get_posix_acl(struct inode *inode, int type)
        return acl;
 }
-int hfsplus_set_posix_acl(struct inode *inode, struct posix_acl *acl,
+static int __hfsplus_set_posix_acl(struct inode *inode, struct posix_acl *acl,
-                int type)
+                                   int type)
 {
        int err;
        char *xattr_name;
@@ -64,12 +64,6 @@ int hfsplus_set_posix_acl(struct inode *inode, struct posix_acl *acl,
        switch (type) {
        case ACL_TYPE_ACCESS:
                xattr_name = XATTR_NAME_POSIX_ACL_ACCESS;
-                if (acl) {
-                        err = posix_acl_update_mode(inode, &inode->i_mode, &acl);
-                        if (err)
-                                return err;
-                }
-                err = 0;
                break;
        case ACL_TYPE_DEFAULT:
@@ -105,6 +99,18 @@ end_set_acl:
        return err;
 }
+int hfsplus_set_posix_acl(struct inode *inode, struct posix_acl *acl, int type)
+{
+        int err;
+        if (type == ACL_TYPE_ACCESS && acl) {
+                err = posix_acl_update_mode(inode, &inode->i_mode, &acl);
+                if (err)
+                        return err;
+        }
+        return __hfsplus_set_posix_acl(inode, acl, type);
+}
 int hfsplus_init_posix_acl(struct inode *inode, struct inode *dir)
 {
        int err = 0;
@@ -122,15 +128,15 @@ int hfsplus_init_posix_acl(struct inode *inode, struct inode *dir)
                return err;
        if (default_acl) {
-                err = hfsplus_set_posix_acl(inode, default_acl,
+                err = __hfsplus_set_posix_acl(inode, default_acl,
-                                            ACL_TYPE_DEFAULT);
+                                              ACL_TYPE_DEFAULT);
                posix_acl_release(default_acl);
        }
        if (acl) {
                if (!err)
-                        err = hfsplus_set_posix_acl(inode, acl,
+                        err = __hfsplus_set_posix_acl(inode, acl,
-                                                    ACL_TYPE_ACCESS);
+                                                      ACL_TYPE_ACCESS);
                posix_acl_release(acl);
        }
        return err;
diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
index 8cf898a59730..217a5e7815da 100644
--- a/fs/isofs/inode.c
+++ b/fs/isofs/inode.c
@@ -410,7 +410,11 @@ static int parse_options(char *options, struct iso9660_options *popt)
                        if (match_int(&args[0], &option))
                                return 0;
                        n = option;
-                        if (n > 99)
+                        /*
+                         * Track numbers are supposed to be in range 1-99, the
+                         * mount option starts indexing at 0.
+                         */
+                        if (n >= 99)
                                return 0;
                        popt->session = n + 1;
                        break;
@@ -543,7 +547,7 @@ static unsigned int isofs_get_last_session(struct super_block *sb, s32 session)
        vol_desc_start=0;
        ms_info.addr_format=CDROM_LBA;
-        if(session >= 0 && session <= 99) {
+        if (session > 0) {
                struct cdrom_tocentry Te;
                Te.cdte_track=session;
                Te.cdte_format=CDROM_LBA;
diff --git a/fs/mount.h b/fs/mount.h
index de45d9e76748..6790767d1883 100644
--- a/fs/mount.h
+++ b/fs/mount.h
@@ -16,7 +16,7 @@ struct mnt_namespace {
        u64 event;
        unsigned int            mounts; /* # of mounts in the namespace */
        unsigned int            pending_mounts;
-};
+} __randomize_layout;
 struct mnt_pcp {
        int mnt_count;
@@ -69,7 +69,7 @@ struct mount {
        struct hlist_head mnt_pins;
        struct fs_pin mnt_umount;
        struct dentry *mnt_ex_mountpoint;
-};
+} __randomize_layout;
 #define MNT_NS_INTERNAL ERR_PTR(-EINVAL) /* distinct from any mnt_namespace */
diff --git a/fs/namei.c b/fs/namei.c
index 88fd38d1e3e7..ddb6a7c2b3d4 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -524,7 +524,7 @@ struct nameidata {
        struct inode    *link_inode;
        unsigned        root_seq;
        int             dfd;
-};
+} __randomize_layout;
 static void set_nameidata(struct nameidata *p, int dfd, struct filename *name)
 {
diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index ee5ddbd36088..efebe6cf4378 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -820,6 +820,7 @@ void nfs_server_copy_userdata(struct nfs_server *target, struct nfs_server *sour
        target->caps = source->caps;
        target->options = source->options;
        target->auth_info = source->auth_info;
+        target->port = source->port;
 }
 EXPORT_SYMBOL_GPL(nfs_server_copy_userdata);
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index 5ac484fe0dee..3522b1249019 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -2372,16 +2372,40 @@ void nfs_access_add_cache(struct inode *inode, struct nfs_access_entry *set)
 }
 EXPORT_SYMBOL_GPL(nfs_access_add_cache);
+#define NFS_MAY_READ (NFS4_ACCESS_READ)
+#define NFS_MAY_WRITE (NFS4_ACCESS_MODIFY | \
+                NFS4_ACCESS_EXTEND | \
+                NFS4_ACCESS_DELETE)
+#define NFS_FILE_MAY_WRITE (NFS4_ACCESS_MODIFY | \
+                NFS4_ACCESS_EXTEND)
+#define NFS_DIR_MAY_WRITE NFS_MAY_WRITE
+#define NFS_MAY_LOOKUP (NFS4_ACCESS_LOOKUP)
+#define NFS_MAY_EXECUTE (NFS4_ACCESS_EXECUTE)
+static int
+nfs_access_calc_mask(u32 access_result, umode_t umode)
+{
+        int mask = 0;
+        if (access_result & NFS_MAY_READ)
+                mask |= MAY_READ;
+        if (S_ISDIR(umode)) {
+                if ((access_result & NFS_DIR_MAY_WRITE) == NFS_DIR_MAY_WRITE)
+                        mask |= MAY_WRITE;
+                if ((access_result & NFS_MAY_LOOKUP) == NFS_MAY_LOOKUP)
+                        mask |= MAY_EXEC;
+        } else if (S_ISREG(umode)) {
+                if ((access_result & NFS_FILE_MAY_WRITE) == NFS_FILE_MAY_WRITE)
+                        mask |= MAY_WRITE;
+                if ((access_result & NFS_MAY_EXECUTE) == NFS_MAY_EXECUTE)
+                        mask |= MAY_EXEC;
+        } else if (access_result & NFS_MAY_WRITE)
+                        mask |= MAY_WRITE;
+        return mask;
+}
 void nfs_access_set_mask(struct nfs_access_entry *entry, u32 access_result)
 {
-        entry->mask = 0;
+        entry->mask = access_result;
-        if (access_result & NFS4_ACCESS_READ)
-                entry->mask |= MAY_READ;
-        if (access_result &
-            (NFS4_ACCESS_MODIFY | NFS4_ACCESS_EXTEND | NFS4_ACCESS_DELETE))
-                entry->mask |= MAY_WRITE;
-        if (access_result & (NFS4_ACCESS_LOOKUP|NFS4_ACCESS_EXECUTE))
-                entry->mask |= MAY_EXEC;
 }
 EXPORT_SYMBOL_GPL(nfs_access_set_mask);
@@ -2389,6 +2413,7 @@ static int nfs_do_access(struct inode *inode, struct rpc_cred *cred, int mask)
 {
        struct nfs_access_entry cache;
        bool may_block = (mask & MAY_NOT_BLOCK) == 0;
+        int cache_mask;
        int status;
        trace_nfs_access_enter(inode);
@@ -2404,7 +2429,8 @@ static int nfs_do_access(struct inode *inode, struct rpc_cred *cred, int mask)
                goto out;
        /* Be clever: ask server to check for all possible rights */
-        cache.mask = MAY_EXEC | MAY_WRITE | MAY_READ;
+        cache.mask = NFS_MAY_LOOKUP | NFS_MAY_EXECUTE
+                     | NFS_MAY_WRITE | NFS_MAY_READ;
        cache.cred = cred;
        cache.jiffies = jiffies;
        status = NFS_PROTO(inode)->access(inode, &cache);
@@ -2418,7 +2444,8 @@ static int nfs_do_access(struct inode *inode, struct rpc_cred *cred, int mask)
        }
        nfs_access_add_cache(inode, &cache);
 out_cached:
-        if ((mask & ~cache.mask & (MAY_READ | MAY_WRITE | MAY_EXEC)) != 0)
+        cache_mask = nfs_access_calc_mask(cache.mask, inode->i_mode);
+        if ((mask & ~cache_mask & (MAY_READ | MAY_WRITE | MAY_EXEC)) != 0)
                status = -EACCES;
 out:
        trace_nfs_access_exit(inode, status);
diff --git a/fs/nfs/filelayout/filelayout.c b/fs/nfs/filelayout/filelayout.c
index 080fc6b278bd..44c638b7876c 100644
--- a/fs/nfs/filelayout/filelayout.c
+++ b/fs/nfs/filelayout/filelayout.c
@@ -542,6 +542,10 @@ filelayout_check_deviceid(struct pnfs_layout_hdr *lo,
        struct nfs4_file_layout_dsaddr *dsaddr;
        int status = -EINVAL;
+        /* Is the deviceid already set? If so, we're good. */
+        if (fl->dsaddr != NULL)
+                return 0;
        /* find and reference the deviceid */
        d = nfs4_find_get_deviceid(NFS_SERVER(lo->plh_inode), &fl->deviceid,
                        lo->plh_lc_cred, gfp_flags);
@@ -553,8 +557,6 @@ filelayout_check_deviceid(struct pnfs_layout_hdr *lo,
        if (filelayout_test_devid_unavailable(&dsaddr->id_node))
                goto out_put;
-        fl->dsaddr = dsaddr;
        if (fl->first_stripe_index >= dsaddr->stripe_count) {
                dprintk("%s Bad first_stripe_index %u\n",
                                __func__, fl->first_stripe_index);
@@ -570,6 +572,13 @@ filelayout_check_deviceid(struct pnfs_layout_hdr *lo,
                goto out_put;
        }
        status = 0;
+        /*
+         * Atomic compare and xchange to ensure we don't scribble
+         * over a non-NULL pointer.
+         */
+        if (cmpxchg(&fl->dsaddr, NULL, dsaddr) != NULL)
+                goto out_put;
 out:
        return status;
 out_put:
diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
index 1f2ac3dd0fe5..b0fa83a60754 100644
--- a/fs/nfs/flexfilelayout/flexfilelayout.c
+++ b/fs/nfs/flexfilelayout/flexfilelayout.c
@@ -1842,6 +1842,10 @@ static int ff_layout_initiate_commit(struct nfs_commit_data *data, int how)
        int vers, ret;
        struct nfs_fh *fh;
+        if (!lseg || !(pnfs_is_valid_lseg(lseg) ||
+            test_bit(NFS_LSEG_LAYOUTRETURN, &lseg->pls_flags)))
+                goto out_err;
        idx = calc_ds_index_from_commit(lseg, data->ds_commit_index);
        ds = nfs4_ff_layout_prepare_ds(lseg, idx, true);
        if (!ds)
diff --git a/fs/nfs/mount_clnt.c b/fs/nfs/mount_clnt.c
index 3efe946672be..60bad882c123 100644
--- a/fs/nfs/mount_clnt.c
+++ b/fs/nfs/mount_clnt.c
@@ -512,7 +512,7 @@ static const struct rpc_version mnt_version1 = {
        .counts         = mnt_counts,
 };
-static unsigned int mnt3_counts[ARRAY_SIZE(mnt_procedures)];
+static unsigned int mnt3_counts[ARRAY_SIZE(mnt3_procedures)];
 static const struct rpc_version mnt_version3 = {
        .number         = 3,
        .nrprocs        = ARRAY_SIZE(mnt3_procedures),
diff --git a/fs/nfs/nfs3proc.c b/fs/nfs/nfs3proc.c
index df4a7d3ab915..d1e87ec0df84 100644
--- a/fs/nfs/nfs3proc.c
+++ b/fs/nfs/nfs3proc.c
@@ -220,15 +220,8 @@ static int nfs3_proc_access(struct inode *inode, struct nfs_access_entry *entry)
        status = rpc_call_sync(NFS_CLIENT(inode), &msg, 0);
        nfs_refresh_inode(inode, res.fattr);
-        if (status == 0) {
+        if (status == 0)
-                entry->mask = 0;
+                nfs_access_set_mask(entry, res.access);
-                if (res.access & NFS3_ACCESS_READ)
-                        entry->mask |= MAY_READ;
-                if (res.access & (NFS3_ACCESS_MODIFY | NFS3_ACCESS_EXTEND | NFS3_ACCESS_DELETE))
-                        entry->mask |= MAY_WRITE;
-                if (res.access & (NFS3_ACCESS_LOOKUP|NFS3_ACCESS_EXECUTE))
-                        entry->mask |= MAY_EXEC;
-        }
        nfs_free_fattr(res.fattr);
 out:
        dprintk("NFS reply access: %d\n", status);
diff --git a/fs/nfs/pnfs_nfs.c b/fs/nfs/pnfs_nfs.c
index d40755a0984b..25f28fa64c57 100644
--- a/fs/nfs/pnfs_nfs.c
+++ b/fs/nfs/pnfs_nfs.c
@@ -159,13 +159,18 @@ void pnfs_generic_recover_commit_reqs(struct list_head *dst,
 {
        struct pnfs_commit_bucket *b;
        struct pnfs_layout_segment *freeme;
+        int nwritten;
        int i;
        lockdep_assert_held(&cinfo->inode->i_lock);
 restart:
        for (i = 0, b = cinfo->ds->buckets; i < cinfo->ds->nbuckets; i++, b++) {
-                if (pnfs_generic_transfer_commit_list(&b->written, dst,
+                nwritten = pnfs_generic_transfer_commit_list(&b->written,
-                                                      cinfo, 0)) {
+                                dst, cinfo, 0);
+                if (!nwritten)
+                        continue;
+                cinfo->ds->nwritten -= nwritten;
+                if (list_empty(&b->written)) {
                        freeme = b->wlseg;
                        b->wlseg = NULL;
                        spin_unlock(&cinfo->inode->i_lock);
@@ -174,7 +179,6 @@ restart:
                        goto restart;
                }
        }
-        cinfo->ds->nwritten = 0;
 }
 EXPORT_SYMBOL_GPL(pnfs_generic_recover_commit_reqs);
@@ -183,6 +187,7 @@ static void pnfs_generic_retry_commit(struct nfs_commit_info *cinfo, int idx)
        struct pnfs_ds_commit_info *fl_cinfo = cinfo->ds;
        struct pnfs_commit_bucket *bucket;
        struct pnfs_layout_segment *freeme;
+        struct list_head *pos;
        LIST_HEAD(pages);
        int i;
@@ -193,6 +198,8 @@ static void pnfs_generic_retry_commit(struct nfs_commit_info *cinfo, int idx)
                        continue;
                freeme = bucket->clseg;
                bucket->clseg = NULL;
+                list_for_each(pos, &bucket->committing)
+                        cinfo->ds->ncommitting--;
                list_splice_init(&bucket->committing, &pages);
                spin_unlock(&cinfo->inode->i_lock);
                nfs_retry_commit(&pages, freeme, cinfo, i);
@@ -217,13 +224,6 @@ pnfs_generic_alloc_ds_commits(struct nfs_commit_info *cinfo,
        for (i = 0; i < fl_cinfo->nbuckets; i++, bucket++) {
                if (list_empty(&bucket->committing))
                        continue;
-                /*
-                 * If the layout segment is invalid, then let
-                 * pnfs_generic_retry_commit() clean up the bucket.
-                 */
-                if (bucket->clseg && !pnfs_is_valid_lseg(bucket->clseg) &&
-                    !test_bit(NFS_LSEG_LAYOUTRETURN, &bucket->clseg->pls_flags))
-                        break;
                data = nfs_commitdata_alloc(false);
                if (!data)
                        break;
@@ -243,9 +243,12 @@ void pnfs_fetch_commit_bucket_list(struct list_head *pages,
                struct nfs_commit_info *cinfo)
 {
        struct pnfs_commit_bucket *bucket;
+        struct list_head *pos;
        bucket = &cinfo->ds->buckets[data->ds_commit_index];
        spin_lock(&cinfo->inode->i_lock);
+        list_for_each(pos, &bucket->committing)
+                cinfo->ds->ncommitting--;
        list_splice_init(&bucket->committing, pages);
        data->lseg = bucket->clseg;
        bucket->clseg = NULL;
@@ -330,7 +333,6 @@ pnfs_generic_commit_pagelist(struct inode *inode, struct list_head *mds_pages,
                }
        }
 out:
-        cinfo->ds->ncommitting = 0;
        return PNFS_ATTEMPTED;
 }
 EXPORT_SYMBOL_GPL(pnfs_generic_commit_pagelist);
diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c
index b45083c0f9ae..49b0a9e7ff18 100644
--- a/fs/nfsd/nfs4callback.c
+++ b/fs/nfsd/nfs4callback.c
@@ -720,8 +720,8 @@ static const struct rpc_version nfs_cb_version4 = {
        .counts                 = nfs4_cb_counts,
 };
-static const struct rpc_version *nfs_cb_version[] = {
+static const struct rpc_version *nfs_cb_version[2] = {
-        &nfs_cb_version4,
+        [1] = &nfs_cb_version4,
 };
 static const struct rpc_program cb_program;
@@ -795,7 +795,7 @@ static int setup_callback_client(struct nfs4_client *clp, struct nfs4_cb_conn *c
                .saddress       = (struct sockaddr *) &conn->cb_saddr,
                .timeout        = &timeparms,
                .program        = &cb_program,
-                .version        = 0,
+                .version        = 1,
                .flags          = (RPC_CLNT_CREATE_NOPING | RPC_CLNT_CREATE_QUIET),
        };
        struct rpc_clnt *client;
diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
index 641d9ee97f91..48b70e6490f3 100644
--- a/fs/overlayfs/dir.c
+++ b/fs/overlayfs/dir.c
@@ -481,17 +481,30 @@ out_cleanup:
 }
 static int ovl_create_or_link(struct dentry *dentry, struct inode *inode,
-                              struct cattr *attr, struct dentry *hardlink)
+                              struct cattr *attr, struct dentry *hardlink,
+                              bool origin)
 {
        int err;
        const struct cred *old_cred;
        struct cred *override_cred;
+        struct dentry *parent = dentry->d_parent;
-        err = ovl_copy_up(dentry->d_parent);
+        err = ovl_copy_up(parent);
        if (err)
                return err;
        old_cred = ovl_override_creds(dentry->d_sb);
+        /*
+         * When linking a file with copy up origin into a new parent, mark the
+         * new parent dir "impure".
+         */
+        if (origin) {
+                err = ovl_set_impure(parent, ovl_dentry_upper(parent));
+                if (err)
+                        goto out_revert_creds;
+        }
        err = -ENOMEM;
        override_cred = prepare_creds();
        if (override_cred) {
@@ -550,7 +563,7 @@ static int ovl_create_object(struct dentry *dentry, int mode, dev_t rdev,
        inode_init_owner(inode, dentry->d_parent->d_inode, mode);
        attr.mode = inode->i_mode;
-        err = ovl_create_or_link(dentry, inode, &attr, NULL);
+        err = ovl_create_or_link(dentry, inode, &attr, NULL, false);
        if (err)
                iput(inode);
@@ -609,7 +622,8 @@ static int ovl_link(struct dentry *old, struct inode *newdir,
        inode = d_inode(old);
        ihold(inode);
-        err = ovl_create_or_link(new, inode, NULL, ovl_dentry_upper(old));
+        err = ovl_create_or_link(new, inode, NULL, ovl_dentry_upper(old),
+                                 ovl_type_origin(old));
        if (err)
                iput(inode);
diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
index 69f4fc26ee39..5bc71642b226 100644
--- a/fs/overlayfs/inode.c
+++ b/fs/overlayfs/inode.c
@@ -202,37 +202,38 @@ bool ovl_is_private_xattr(const char *name)
                       sizeof(OVL_XATTR_PREFIX) - 1) == 0;
 }
-int ovl_xattr_set(struct dentry *dentry, const char *name, const void *value,
+int ovl_xattr_set(struct dentry *dentry, struct inode *inode, const char *name,
-                  size_t size, int flags)
+                  const void *value, size_t size, int flags)
 {
        int err;
-        struct path realpath;
+        struct dentry *upperdentry = ovl_i_dentry_upper(inode);
-        enum ovl_path_type type = ovl_path_real(dentry, &realpath);
+        struct dentry *realdentry = upperdentry ?: ovl_dentry_lower(dentry);
        const struct cred *old_cred;
        err = ovl_want_write(dentry);
        if (err)
                goto out;
-        if (!value && !OVL_TYPE_UPPER(type)) {
+        if (!value && !upperdentry) {
-                err = vfs_getxattr(realpath.dentry, name, NULL, 0);
+                err = vfs_getxattr(realdentry, name, NULL, 0);
                if (err < 0)
                        goto out_drop_write;
        }
-        err = ovl_copy_up(dentry);
+        if (!upperdentry) {
-        if (err)
+                err = ovl_copy_up(dentry);
-                goto out_drop_write;
+                if (err)
+                        goto out_drop_write;
-        if (!OVL_TYPE_UPPER(type))
+                realdentry = ovl_dentry_upper(dentry);
-                ovl_path_upper(dentry, &realpath);
+        }
        old_cred = ovl_override_creds(dentry->d_sb);
        if (value)
-                err = vfs_setxattr(realpath.dentry, name, value, size, flags);
+                err = vfs_setxattr(realdentry, name, value, size, flags);
        else {
                WARN_ON(flags != XATTR_REPLACE);
-                err = vfs_removexattr(realpath.dentry, name);
+                err = vfs_removexattr(realdentry, name);
        }
        revert_creds(old_cred);
@@ -242,12 +243,13 @@ out:
        return err;
 }
-int ovl_xattr_get(struct dentry *dentry, const char *name,
+int ovl_xattr_get(struct dentry *dentry, struct inode *inode, const char *name,
                  void *value, size_t size)
 {
-        struct dentry *realdentry = ovl_dentry_real(dentry);
        ssize_t res;
        const struct cred *old_cred;
+        struct dentry *realdentry =
+                ovl_i_dentry_upper(inode) ?: ovl_dentry_lower(dentry);
        old_cred = ovl_override_creds(dentry->d_sb);
        res = vfs_getxattr(realdentry, name, value, size);
diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c
index 9bc0e580a5b3..8aef2b304b2d 100644
--- a/fs/overlayfs/namei.c
+++ b/fs/overlayfs/namei.c
@@ -397,8 +397,19 @@ int ovl_verify_index(struct dentry *index, struct path *lowerstack,
        if (!d_inode(index))
                return 0;
-        err = -EISDIR;
+        /*
-        if (d_is_dir(index))
+         * Directory index entries are going to be used for looking up
+         * redirected upper dirs by lower dir fh when decoding an overlay
+         * file handle of a merge dir. Whiteout index entries are going to be
+         * used as an indication that an exported overlay file handle should
+         * be treated as stale (i.e. after unlink of the overlay inode).
+         * We don't know the verification rules for directory and whiteout
+         * index entries, because they have not been implemented yet, so return
+         * EROFS if those entries are found to avoid corrupting an index that
+         * was created by a newer kernel.
+         */
+        err = -EROFS;
+        if (d_is_dir(index) || ovl_is_whiteout(index))
                goto fail;
        err = -EINVAL;
@@ -436,8 +447,8 @@ out:
        return err;
 fail:
-        pr_warn_ratelimited("overlayfs: failed to verify index (%pd2, err=%i)\n",
+        pr_warn_ratelimited("overlayfs: failed to verify index (%pd2, ftype=%x, err=%i)\n",
-                            index, err);
+                            index, d_inode(index)->i_mode & S_IFMT, err);
        goto out;
 }
@@ -502,6 +513,7 @@ static struct dentry *ovl_lookup_index(struct dentry *dentry,
                goto out;
        }
+        inode = d_inode(index);
        if (d_is_negative(index)) {
                if (upper && d_inode(origin)->i_nlink > 1) {
                        pr_warn_ratelimited("overlayfs: hard link with origin but no index (ino=%lu).\n",
@@ -511,11 +523,22 @@ static struct dentry *ovl_lookup_index(struct dentry *dentry,
                dput(index);
                index = NULL;
-        } else if (upper && d_inode(index) != d_inode(upper)) {
+        } else if (upper && d_inode(upper) != inode) {
-                inode = d_inode(index);
+                pr_warn_ratelimited("overlayfs: wrong index found (index=%pd2, ino=%lu, upper ino=%lu).\n",
-                pr_warn_ratelimited("overlayfs: wrong index found (index ino: %lu, upper ino: %lu).\n",
+                                    index, inode->i_ino, d_inode(upper)->i_ino);
-                                    d_inode(index)->i_ino,
+                goto fail;
-                                    d_inode(upper)->i_ino);
+        } else if (ovl_dentry_weird(index) || ovl_is_whiteout(index) ||
+                   ((inode->i_mode ^ d_inode(origin)->i_mode) & S_IFMT)) {
+                /*
+                 * Index should always be of the same file type as origin
+                 * except for the case of a whiteout index. A whiteout
+                 * index should only exist if all lower aliases have been
+                 * unlinked, which means that finding a lower origin on lookup
+                 * whose index is a whiteout should be treated as an error.
+                 */
+                pr_warn_ratelimited("overlayfs: bad index found (index=%pd2, ftype=%x, origin ftype=%x).\n",
+                                    index, d_inode(index)->i_mode & S_IFMT,
+                                    d_inode(origin)->i_mode & S_IFMT);
                goto fail;
        }
diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
index 60d26605e039..e927a62c97ae 100644
--- a/fs/overlayfs/overlayfs.h
+++ b/fs/overlayfs/overlayfs.h
@@ -47,7 +47,8 @@ enum ovl_flag {
 /* Is the real inode encoded in fid an upper inode? */
 #define OVL_FH_FLAG_PATH_UPPER  (1 << 2)
-#define OVL_FH_FLAG_ALL (OVL_FH_FLAG_BIG_ENDIAN | OVL_FH_FLAG_ANY_ENDIAN)
+#define OVL_FH_FLAG_ALL (OVL_FH_FLAG_BIG_ENDIAN | OVL_FH_FLAG_ANY_ENDIAN | \
+                         OVL_FH_FLAG_PATH_UPPER)
 #if defined(__LITTLE_ENDIAN)
 #define OVL_FH_FLAG_CPU_ENDIAN 0
@@ -199,6 +200,7 @@ enum ovl_path_type ovl_path_real(struct dentry *dentry, struct path *path);
 struct dentry *ovl_dentry_upper(struct dentry *dentry);
 struct dentry *ovl_dentry_lower(struct dentry *dentry);
 struct dentry *ovl_dentry_real(struct dentry *dentry);
+struct dentry *ovl_i_dentry_upper(struct inode *inode);
 struct inode *ovl_inode_upper(struct inode *inode);
 struct inode *ovl_inode_lower(struct inode *inode);
 struct inode *ovl_inode_real(struct inode *inode);
@@ -270,9 +272,9 @@ int ovl_setattr(struct dentry *dentry, struct iattr *attr);
 int ovl_getattr(const struct path *path, struct kstat *stat,
                u32 request_mask, unsigned int flags);
 int ovl_permission(struct inode *inode, int mask);
-int ovl_xattr_set(struct dentry *dentry, const char *name, const void *value,
+int ovl_xattr_set(struct dentry *dentry, struct inode *inode, const char *name,
-                  size_t size, int flags);
+                  const void *value, size_t size, int flags);
-int ovl_xattr_get(struct dentry *dentry, const char *name,
+int ovl_xattr_get(struct dentry *dentry, struct inode *inode, const char *name,
                  void *value, size_t size);
 ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size);
 struct posix_acl *ovl_get_acl(struct inode *inode, int type);
diff --git a/fs/overlayfs/readdir.c b/fs/overlayfs/readdir.c
index 0298463cf9c3..3d424a51cabb 100644
--- a/fs/overlayfs/readdir.c
+++ b/fs/overlayfs/readdir.c
@@ -703,7 +703,10 @@ int ovl_indexdir_cleanup(struct dentry *dentry, struct vfsmount *mnt,
                        err = PTR_ERR(index);
                        break;
                }
-                if (ovl_verify_index(index, lowerstack, numlower)) {
+                err = ovl_verify_index(index, lowerstack, numlower);
+                if (err) {
+                        if (err == -EROFS)
+                                break;
                        err = ovl_cleanup(dir, index);
                        if (err)
                                break;
diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
index 44dc2d6ffe0f..d86e89f97201 100644
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -692,7 +692,7 @@ ovl_posix_acl_xattr_get(const struct xattr_handler *handler,
                        struct dentry *dentry, struct inode *inode,
                        const char *name, void *buffer, size_t size)
 {
-        return ovl_xattr_get(dentry, handler->name, buffer, size);
+        return ovl_xattr_get(dentry, inode, handler->name, buffer, size);
 }
 static int __maybe_unused
@@ -742,7 +742,7 @@ ovl_posix_acl_xattr_set(const struct xattr_handler *handler,
                        return err;
        }
-        err = ovl_xattr_set(dentry, handler->name, value, size, flags);
+        err = ovl_xattr_set(dentry, inode, handler->name, value, size, flags);
        if (!err)
                ovl_copyattr(ovl_inode_real(inode), inode);
@@ -772,7 +772,7 @@ static int ovl_other_xattr_get(const struct xattr_handler *handler,
                               struct dentry *dentry, struct inode *inode,
                               const char *name, void *buffer, size_t size)
 {
-        return ovl_xattr_get(dentry, name, buffer, size);
+        return ovl_xattr_get(dentry, inode, name, buffer, size);
 }
 static int ovl_other_xattr_set(const struct xattr_handler *handler,
@@ -780,7 +780,7 @@ static int ovl_other_xattr_set(const struct xattr_handler *handler,
                               const char *name, const void *value,
                               size_t size, int flags)
 {
-        return ovl_xattr_set(dentry, name, value, size, flags);
+        return ovl_xattr_set(dentry, inode, name, value, size, flags);
 }
 static const struct xattr_handler __maybe_unused
@@ -1058,10 +1058,6 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
                ufs->indexdir = ovl_workdir_create(sb, ufs, workpath.dentry,
                                                   OVL_INDEXDIR_NAME, true);
-                err = PTR_ERR(ufs->indexdir);
-                if (IS_ERR(ufs->indexdir))
-                        goto out_put_lower_mnt;
                if (ufs->indexdir) {
                        /* Verify upper root is index dir origin */
                        err = ovl_verify_origin(ufs->indexdir, ufs->upper_mnt,
@@ -1090,6 +1086,7 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
        else
                sb->s_d_op = &ovl_dentry_operations;
+        err = -ENOMEM;
        ufs->creator_cred = cred = prepare_creds();
        if (!cred)
                goto out_put_indexdir;
diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c
index c492ba75c659..f46ad75dc96a 100644
--- a/fs/overlayfs/util.c
+++ b/fs/overlayfs/util.c
@@ -157,9 +157,14 @@ struct dentry *ovl_dentry_real(struct dentry *dentry)
        return ovl_dentry_upper(dentry) ?: ovl_dentry_lower(dentry);
 }
+struct dentry *ovl_i_dentry_upper(struct inode *inode)
+{
+        return ovl_upperdentry_dereference(OVL_I(inode));
+}
 struct inode *ovl_inode_upper(struct inode *inode)
 {
-        struct dentry *upperdentry = ovl_upperdentry_dereference(OVL_I(inode));
+        struct dentry *upperdentry = ovl_i_dentry_upper(inode);
        return upperdentry ? d_inode(upperdentry) : NULL;
 }
diff --git a/fs/proc/internal.h b/fs/proc/internal.h
index 18694598bebf..aa2b89071630 100644
--- a/fs/proc/internal.h
+++ b/fs/proc/internal.h
@@ -51,7 +51,7 @@ struct proc_dir_entry {
        spinlock_t pde_unload_lock; /* proc_fops checks and pde_users bumps */
        u8 namelen;
        char name[];
-};
+} __randomize_layout;
 union proc_op {
        int (*proc_get_link)(struct dentry *, struct path *);
@@ -70,7 +70,7 @@ struct proc_inode {
        struct hlist_node sysctl_inodes;
        const struct proc_ns_operations *ns_ops;
        struct inode vfs_inode;
-};
+} __randomize_layout;
 /*
 * General functions
@@ -279,7 +279,7 @@ struct proc_maps_private {
 #ifdef CONFIG_NUMA
        struct mempolicy *task_mempolicy;
 #endif
-};
+} __randomize_layout;
 struct mm_struct *proc_mem_open(struct inode *inode, unsigned int mode);
diff --git a/fs/reiserfs/xattr_acl.c b/fs/reiserfs/xattr_acl.c
index 3d2256a425ee..54415f0e3d18 100644
--- a/fs/reiserfs/xattr_acl.c
+++ b/fs/reiserfs/xattr_acl.c
@@ -23,7 +23,8 @@ reiserfs_set_acl(struct inode *inode, struct posix_acl *acl, int type)
        struct reiserfs_transaction_handle th;
        size_t jcreate_blocks;
        int size = acl ? posix_acl_xattr_size(acl->a_count) : 0;
+        int update_mode = 0;
+        umode_t mode = inode->i_mode;
        /*
         * Pessimism: We can't assume that anything from the xattr root up
@@ -37,7 +38,16 @@ reiserfs_set_acl(struct inode *inode, struct posix_acl *acl, int type)
        error = journal_begin(&th, inode->i_sb, jcreate_blocks);
        reiserfs_write_unlock(inode->i_sb);
        if (error == 0) {
+                if (type == ACL_TYPE_ACCESS && acl) {
+                        error = posix_acl_update_mode(inode, &mode, &acl);
+                        if (error)
+                                goto unlock;
+                        update_mode = 1;
+                }
                error = __reiserfs_set_acl(&th, inode, type, acl);
+                if (!error && update_mode)
+                        inode->i_mode = mode;
+unlock:
                reiserfs_write_lock(inode->i_sb);
                error2 = journal_end(&th);
                reiserfs_write_unlock(inode->i_sb);
@@ -241,11 +251,6 @@ __reiserfs_set_acl(struct reiserfs_transaction_handle *th, struct inode *inode,
        switch (type) {
        case ACL_TYPE_ACCESS:
                name = XATTR_NAME_POSIX_ACL_ACCESS;
-                if (acl) {
-                        error = posix_acl_update_mode(inode, &inode->i_mode, &acl);
-                        if (error)
-                                return error;
-                }
                break;
        case ACL_TYPE_DEFAULT:
                name = XATTR_NAME_POSIX_ACL_DEFAULT;
diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
index 05488da3aee9..3ae9013eeaaa 100644
--- a/include/linux/binfmts.h
+++ b/include/linux/binfmts.h
@@ -46,7 +46,7 @@ struct linux_binprm {
        unsigned interp_flags;
        unsigned interp_data;
        unsigned long loader, exec;
-};
+} __randomize_layout;
 #define BINPRM_FLAGS_ENFORCE_NONDUMP_BIT 0
 #define BINPRM_FLAGS_ENFORCE_NONDUMP (1 << BINPRM_FLAGS_ENFORCE_NONDUMP_BIT)
@@ -81,7 +81,7 @@ struct linux_binfmt {
        int (*load_shlib)(struct file *);
        int (*core_dump)(struct coredump_params *cprm);
        unsigned long min_coredump;     /* minimal dump size */
-};
+} __randomize_layout;
 extern void __register_binfmt(struct linux_binfmt *fmt, int insert);
diff --git a/include/linux/bpf-cgroup.h b/include/linux/bpf-cgroup.h
index 360c082e885c..d41d40ac3efd 100644
--- a/include/linux/bpf-cgroup.h
+++ b/include/linux/bpf-cgroup.h
@@ -85,7 +85,7 @@ int __cgroup_bpf_run_filter_sock_ops(struct sock *sk,
        int __ret = 0;                                                         \
        if (cgroup_bpf_enabled && (sock_ops)->sk) {            \
                typeof(sk) __sk = sk_to_full_sk((sock_ops)->sk);               \
-                if (sk_fullsock(__sk))                                         \
+                if (__sk && sk_fullsock(__sk))                                 \
                        __ret = __cgroup_bpf_run_filter_sock_ops(__sk,         \
                                                                 sock_ops,     \
                                                         BPF_CGROUP_SOCK_OPS); \
diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h
index 621076f56251..8e5d31f6faef 100644
--- a/include/linux/bpf_verifier.h
+++ b/include/linux/bpf_verifier.h
@@ -43,6 +43,7 @@ struct bpf_reg_state {
        u32 min_align;
        u32 aux_off;
        u32 aux_off_align;
+        bool value_from_signed;
 };
 enum bpf_stack_slot_type {
diff --git a/include/linux/cdev.h b/include/linux/cdev.h
index 408bc09ce497..cb28eb21e3ca 100644
--- a/include/linux/cdev.h
+++ b/include/linux/cdev.h
@@ -17,7 +17,7 @@ struct cdev {
        struct list_head list;
        dev_t dev;
        unsigned int count;
-};
+} __randomize_layout;
 void cdev_init(struct cdev *, const struct file_operations *);
diff --git a/include/linux/ceph/ceph_features.h b/include/linux/ceph/ceph_features.h
index f0f6c537b64c..040dd105c3e7 100644
--- a/include/linux/ceph/ceph_features.h
+++ b/include/linux/ceph/ceph_features.h
@@ -10,14 +10,14 @@
 #define CEPH_FEATURE_INCARNATION_2 (1ull<<57) // CEPH_FEATURE_SERVER_JEWEL
 #define DEFINE_CEPH_FEATURE(bit, incarnation, name)                     \
-        const static uint64_t CEPH_FEATURE_##name = (1ULL<<bit);                \
+        static const uint64_t CEPH_FEATURE_##name = (1ULL<<bit);                \
-        const static uint64_t CEPH_FEATUREMASK_##name =                 \
+        static const uint64_t CEPH_FEATUREMASK_##name =                 \
                (1ULL<<bit | CEPH_FEATURE_INCARNATION_##incarnation);
 /* this bit is ignored but still advertised by release *when* */
 #define DEFINE_CEPH_FEATURE_DEPRECATED(bit, incarnation, name, when) \
-        const static uint64_t DEPRECATED_CEPH_FEATURE_##name = (1ULL<<bit); \
+        static const uint64_t DEPRECATED_CEPH_FEATURE_##name = (1ULL<<bit); \
-        const static uint64_t DEPRECATED_CEPH_FEATUREMASK_##name =              \
+        static const uint64_t DEPRECATED_CEPH_FEATUREMASK_##name =              \
                (1ULL<<bit | CEPH_FEATURE_INCARNATION_##incarnation);
 /*
diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
index cd4bbe8242bd..bdb80c4aef6e 100644
--- a/include/linux/compiler-gcc.h
+++ b/include/linux/compiler-gcc.h
@@ -235,6 +235,7 @@
 #endif /* GCC_VERSION >= 40500 */
 #if GCC_VERSION >= 40600
 /*
 * When used with Link Time Optimization, gcc can optimize away C functions or
 * variables which are referenced only from assembly code.  __visible tells the
@@ -242,7 +243,17 @@
 * this.
 */
 #define __visible       __attribute__((externally_visible))
-#endif
+/*
+ * RANDSTRUCT_PLUGIN wants to use an anonymous struct, but it is only
+ * possible since GCC 4.6. To provide as much build testing coverage
+ * as possible, this is used for all GCC 4.6+ builds, and not just on
+ * RANDSTRUCT_PLUGIN builds.
+ */
+#define randomized_struct_fields_start  struct {
+#define randomized_struct_fields_end    } __randomize_layout;
+#endif /* GCC_VERSION >= 40600 */
 #if GCC_VERSION >= 40900 && !defined(__CHECKER__)
diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index 219f82f3ec1a..eca8ad75e28b 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -452,6 +452,11 @@ static __always_inline void __write_once_size(volatile void *p, void *res, int s
 # define __no_randomize_layout
 #endif
+#ifndef randomized_struct_fields_start
+# define randomized_struct_fields_start
+# define randomized_struct_fields_end
+#endif
 /*
 * Tell gcc if a function is cold. The compiler will assume any path
 * directly leading to the call is unlikely.
diff --git a/include/linux/cred.h b/include/linux/cred.h
index c728d515e5e2..099058e1178b 100644
--- a/include/linux/cred.h
+++ b/include/linux/cred.h
@@ -31,7 +31,7 @@ struct group_info {
        atomic_t        usage;
        int             ngroups;
        kgid_t          gid[0];
-};
+} __randomize_layout;
 /**
 * get_group_info - Get a reference to a group info structure
@@ -145,7 +145,7 @@ struct cred {
        struct user_namespace *user_ns; /* user_ns the caps and keyrings are relative to. */
        struct group_info *group_info;  /* supplementary groups for euid/fsgid */
        struct rcu_head rcu;            /* RCU deletion hook */
-};
+} __randomize_layout;
 extern void __put_cred(struct cred *);
 extern void exit_creds(struct task_struct *);
diff --git a/include/linux/dcache.h b/include/linux/dcache.h
index 3f3ff4ccdc3f..aae1cdb76851 100644
--- a/include/linux/dcache.h
+++ b/include/linux/dcache.h
@@ -118,7 +118,7 @@ struct dentry {
                struct hlist_bl_node d_in_lookup_hash;  /* only for in-lookup ones */
                struct rcu_head d_rcu;
        } d_u;
-};
+} __randomize_layout;
 /*
 * dentry->d_lock spinlock nesting subclasses:
diff --git a/include/linux/dma-fence.h b/include/linux/dma-fence.h
index c01506e8609e..171895072435 100644
--- a/include/linux/dma-fence.h
+++ b/include/linux/dma-fence.h
@@ -55,6 +55,7 @@ struct dma_fence_cb;
 * of the time.
 *
 * DMA_FENCE_FLAG_SIGNALED_BIT - fence is already signaled
+ * DMA_FENCE_FLAG_TIMESTAMP_BIT - timestamp recorded for fence signaling
 * DMA_FENCE_FLAG_ENABLE_SIGNAL_BIT - enable_signaling might have been called
 * DMA_FENCE_FLAG_USER_BITS - start of the unused bits, can be used by the
 * implementer of the fence for its own purposes. Can be used in different
@@ -84,6 +85,7 @@ struct dma_fence {
 enum dma_fence_flag_bits {
        DMA_FENCE_FLAG_SIGNALED_BIT,
+        DMA_FENCE_FLAG_TIMESTAMP_BIT,
        DMA_FENCE_FLAG_ENABLE_SIGNAL_BIT,
        DMA_FENCE_FLAG_USER_BITS, /* must always be last member */
 };
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 7b5d6816542b..6e1fd5d21248 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -296,7 +296,7 @@ struct kiocb {
        void                    *private;
        int                     ki_flags;
        enum rw_hint            ki_hint;
-};
+} __randomize_layout;
 static inline bool is_sync_kiocb(struct kiocb *kiocb)
 {
@@ -404,7 +404,7 @@ struct address_space {
        struct list_head        private_list;   /* ditto */
        void                    *private_data;  /* ditto */
        errseq_t                wb_err;
-} __attribute__((aligned(sizeof(long))));
+} __attribute__((aligned(sizeof(long)))) __randomize_layout;
        /*
         * On most architectures that alignment is already the case; but
         * must be enforced here for CRIS, to let the least significant bit
@@ -447,7 +447,7 @@ struct block_device {
        int                     bd_fsfreeze_count;
        /* Mutex for freeze */
        struct mutex            bd_fsfreeze_mutex;
-};
+} __randomize_layout;
 /*
 * Radix-tree tags, for tagging dirty and writeback pages within the pagecache
@@ -666,7 +666,7 @@ struct inode {
 #endif
        void                    *i_private; /* fs or device private pointer */
-};
+} __randomize_layout;
 static inline unsigned int i_blocksize(const struct inode *node)
 {
@@ -883,7 +883,8 @@ struct file {
 #endif /* #ifdef CONFIG_EPOLL */
        struct address_space    *f_mapping;
        errseq_t                f_wb_err;
-} __attribute__((aligned(4)));  /* lest something weird decides that 2 is OK */
+} __randomize_layout
+  __attribute__((aligned(4)));  /* lest something weird decides that 2 is OK */
 struct file_handle {
        __u32 handle_bytes;
@@ -1020,7 +1021,7 @@ struct file_lock {
                        int state;              /* state of grant or error if -ve */
                } afs;
        } fl_u;
-};
+} __randomize_layout;
 struct file_lock_context {
        spinlock_t              flc_lock;
@@ -1412,7 +1413,7 @@ struct super_block {
        spinlock_t              s_inode_wblist_lock;
        struct list_head        s_inodes_wb;    /* writeback inodes */
-};
+} __randomize_layout;
 /* Helper functions so that in most cases filesystems will
 * not need to deal directly with kuid_t and kgid_t and can
@@ -1698,7 +1699,7 @@ struct file_operations {
                        u64);
        ssize_t (*dedupe_file_range)(struct file *, u64, u64, struct file *,
                        u64);
-};
+} __randomize_layout;
 struct inode_operations {
        struct dentry * (*lookup) (struct inode *,struct dentry *, unsigned int);
diff --git a/include/linux/fs_struct.h b/include/linux/fs_struct.h
index 0efc3e62843a..7a026240cbb1 100644
--- a/include/linux/fs_struct.h
+++ b/include/linux/fs_struct.h
@@ -12,7 +12,7 @@ struct fs_struct {
        int umask;
        int in_exec;
        struct path root, pwd;
-};
+} __randomize_layout;
 extern struct kmem_cache *fs_cachep;
diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h
index 5857390ac35a..6383115e9d2c 100644
--- a/include/linux/ftrace.h
+++ b/include/linux/ftrace.h
@@ -145,8 +145,8 @@ enum {
 #ifdef CONFIG_DYNAMIC_FTRACE
 /* The hash used to know what functions callbacks trace */
 struct ftrace_ops_hash {
-        struct ftrace_hash              *notrace_hash;
+        struct ftrace_hash __rcu        *notrace_hash;
-        struct ftrace_hash              *filter_hash;
+        struct ftrace_hash __rcu        *filter_hash;
        struct mutex                    regex_lock;
 };
@@ -168,7 +168,7 @@ static inline void ftrace_free_init_mem(void) { }
 */
 struct ftrace_ops {
        ftrace_func_t                   func;
-        struct ftrace_ops               *next;
+        struct ftrace_ops __rcu         *next;
        unsigned long                   flags;
        void                            *private;
        ftrace_func_t                   saved_func;
diff --git a/include/linux/ipc.h b/include/linux/ipc.h
index 5591f055e13f..fadd579d577d 100644
--- a/include/linux/ipc.h
+++ b/include/linux/ipc.h
@@ -23,6 +23,6 @@ struct kern_ipc_perm {
        struct rcu_head rcu;
        atomic_t refcount;
-} ____cacheline_aligned_in_smp;
+} ____cacheline_aligned_in_smp __randomize_layout;
 #endif /* _LINUX_IPC_H */
diff --git a/include/linux/ipc_namespace.h b/include/linux/ipc_namespace.h
index 848e5796400e..65327ee0936b 100644
--- a/include/linux/ipc_namespace.h
+++ b/include/linux/ipc_namespace.h
@@ -61,7 +61,7 @@ struct ipc_namespace {
        struct ucounts *ucounts;
        struct ns_common ns;
-};
+} __randomize_layout;
 extern struct ipc_namespace init_ipc_ns;
 extern spinlock_t mq_lock;
diff --git a/include/linux/jhash.h b/include/linux/jhash.h
index 348c6f47e4cc..8037850f3104 100644
--- a/include/linux/jhash.h
+++ b/include/linux/jhash.h
@@ -85,19 +85,18 @@ static inline u32 jhash(const void *key, u32 length, u32 initval)
                k += 12;
        }
        /* Last block: affect all 32 bits of (c) */
-        /* All the case statements fall through */
        switch (length) {
-        case 12: c += (u32)k[11]<<24;
+        case 12: c += (u32)k[11]<<24;   /* fall through */
-        case 11: c += (u32)k[10]<<16;
+        case 11: c += (u32)k[10]<<16;   /* fall through */
-        case 10: c += (u32)k[9]<<8;
+        case 10: c += (u32)k[9]<<8;     /* fall through */
-        case 9:  c += k[8];
+        case 9:  c += k[8];             /* fall through */
-        case 8:  b += (u32)k[7]<<24;
+        case 8:  b += (u32)k[7]<<24;    /* fall through */
-        case 7:  b += (u32)k[6]<<16;
+        case 7:  b += (u32)k[6]<<16;    /* fall through */
-        case 6:  b += (u32)k[5]<<8;
+        case 6:  b += (u32)k[5]<<8;     /* fall through */
-        case 5:  b += k[4];
+        case 5:  b += k[4];             /* fall through */
-        case 4:  a += (u32)k[3]<<24;
+        case 4:  a += (u32)k[3]<<24;    /* fall through */
-        case 3:  a += (u32)k[2]<<16;
+        case 3:  a += (u32)k[2]<<16;    /* fall through */
-        case 2:  a += (u32)k[1]<<8;
+        case 2:  a += (u32)k[1]<<8;     /* fall through */
        case 1:  a += k[0];
                 __jhash_final(a, b, c);
        case 0: /* Nothing left to add */
@@ -131,10 +130,10 @@ static inline u32 jhash2(const u32 *k, u32 length, u32 initval)
                k += 3;
        }
-        /* Handle the last 3 u32's: all the case statements fall through */
+        /* Handle the last 3 u32's */
        switch (length) {
-        case 3: c += k[2];
+        case 3: c += k[2];      /* fall through */
-        case 2: b += k[1];
+        case 2: b += k[1];      /* fall through */
        case 1: a += k[0];
                __jhash_final(a, b, c);
        case 0: /* Nothing left to add */
diff --git a/include/linux/key-type.h b/include/linux/key-type.h
index 8496cf64575c..9520fc3c3b9a 100644
--- a/include/linux/key-type.h
+++ b/include/linux/key-type.h
@@ -45,7 +45,7 @@ struct key_preparsed_payload {
        size_t          datalen;        /* Raw datalen */
        size_t          quotalen;       /* Quota length for proposed payload */
        time_t          expiry;         /* Expiry time of key */
-};
+} __randomize_layout;
 typedef int (*request_key_actor_t)(struct key_construction *key,
                                   const char *op, void *aux);
@@ -158,7 +158,7 @@ struct key_type {
        /* internal fields */
        struct list_head        link;           /* link in types list */
        struct lock_class_key   lock_class;     /* key->sem lock class */
-};
+} __randomize_layout;
 extern struct key_type key_type_keyring;
diff --git a/include/linux/kmod.h b/include/linux/kmod.h
index c4e441e00db5..655082c88fd9 100644
--- a/include/linux/kmod.h
+++ b/include/linux/kmod.h
@@ -64,7 +64,7 @@ struct subprocess_info {
        int (*init)(struct subprocess_info *info, struct cred *new);
        void (*cleanup)(struct subprocess_info *info);
        void *data;
-};
+} __randomize_layout;
 extern int
 call_usermodehelper(const char *path, char **argv, char **envp, int wait);
diff --git a/include/linux/kobject.h b/include/linux/kobject.h
index eeab34b0f589..4d800c79475a 100644
--- a/include/linux/kobject.h
+++ b/include/linux/kobject.h
@@ -172,7 +172,7 @@ struct kset {
        spinlock_t list_lock;
        struct kobject kobj;
        const struct kset_uevent_ops *uevent_ops;
-};
+} __randomize_layout;
 extern void kset_init(struct kset *kset);
 extern int __must_check kset_register(struct kset *kset);
diff --git a/include/linux/llist.h b/include/linux/llist.h
index d11738110a7a..1957635e6d5f 100644
--- a/include/linux/llist.h
+++ b/include/linux/llist.h
@@ -93,6 +93,23 @@ static inline void init_llist_head(struct llist_head *list)
        container_of(ptr, type, member)
 /**
+ * member_address_is_nonnull - check whether the member address is not NULL
+ * @ptr:        the object pointer (struct type * that contains the llist_node)
+ * @member:     the name of the llist_node within the struct.
+ *
+ * This macro is conceptually the same as
+ *      &ptr->member != NULL
+ * but it works around the fact that compilers can decide that taking a member
+ * address is never a NULL pointer.
+ *
+ * Real objects that start at a high address and have a member at NULL are
+ * unlikely to exist, but such pointers may be returned e.g. by the
+ * container_of() macro.
+ */
+#define member_address_is_nonnull(ptr, member)  \
+        ((uintptr_t)(ptr) + offsetof(typeof(*(ptr)), member) != 0)
+/**
 * llist_for_each - iterate over some deleted entries of a lock-less list
 * @pos:        the &struct llist_node to use as a loop cursor
 * @node:       the first entry of deleted list entries
@@ -145,7 +162,7 @@ static inline void init_llist_head(struct llist_head *list)
 */
 #define llist_for_each_entry(pos, node, member)                         \
        for ((pos) = llist_entry((node), typeof(*(pos)), member);       \
-             &(pos)->member != NULL;                                    \
+             member_address_is_nonnull(pos, member);                    \
             (pos) = llist_entry((pos)->member.next, typeof(*(pos)), member))
 /**
@@ -167,7 +184,7 @@ static inline void init_llist_head(struct llist_head *list)
 */
 #define llist_for_each_entry_safe(pos, n, node, member)                        \
        for (pos = llist_entry((node), typeof(*pos), member);                  \
-             &pos->member != NULL &&                                           \
+             member_address_is_nonnull(pos, member) &&                         \
                (n = llist_entry(pos->member.next, typeof(*n), member), true); \
             pos = n)
diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
index 7a86925ba8f3..3a90febadbe2 100644
--- a/include/linux/lsm_hooks.h
+++ b/include/linux/lsm_hooks.h
@@ -1912,7 +1912,7 @@ struct security_hook_heads {
        struct list_head audit_rule_match;
        struct list_head audit_rule_free;
 #endif /* CONFIG_AUDIT */
-};
+} __randomize_layout;
 /*
 * Security module hook list structure.
@@ -1923,7 +1923,7 @@ struct security_hook_list {
        struct list_head                *head;
        union security_list_options     hook;
        char                            *lsm;
-};
+} __randomize_layout;
 /*
 * Initializing a security_hook_list structure takes
diff --git a/include/linux/mlx4/device.h b/include/linux/mlx4/device.h
index d5bed0875d30..aad5d81dfb44 100644
--- a/include/linux/mlx4/device.h
+++ b/include/linux/mlx4/device.h
@@ -1068,7 +1068,7 @@ static inline int mlx4_is_eth(struct mlx4_dev *dev, int port)
 }
 int mlx4_buf_alloc(struct mlx4_dev *dev, int size, int max_direct,
-                   struct mlx4_buf *buf, gfp_t gfp);
+                   struct mlx4_buf *buf);
 void mlx4_buf_free(struct mlx4_dev *dev, int size, struct mlx4_buf *buf);
 static inline void *mlx4_buf_offset(struct mlx4_buf *buf, int offset)
 {
@@ -1105,10 +1105,9 @@ int mlx4_mw_enable(struct mlx4_dev *dev, struct mlx4_mw *mw);
 int mlx4_write_mtt(struct mlx4_dev *dev, struct mlx4_mtt *mtt,
                   int start_index, int npages, u64 *page_list);
 int mlx4_buf_write_mtt(struct mlx4_dev *dev, struct mlx4_mtt *mtt,
-                       struct mlx4_buf *buf, gfp_t gfp);
+                       struct mlx4_buf *buf);
-int mlx4_db_alloc(struct mlx4_dev *dev, struct mlx4_db *db, int order,
+int mlx4_db_alloc(struct mlx4_dev *dev, struct mlx4_db *db, int order);
-                  gfp_t gfp);
 void mlx4_db_free(struct mlx4_dev *dev, struct mlx4_db *db);
 int mlx4_alloc_hwq_res(struct mlx4_dev *dev, struct mlx4_hwq_resources *wqres,
@@ -1124,8 +1123,7 @@ int mlx4_qp_reserve_range(struct mlx4_dev *dev, int cnt, int align,
                          int *base, u8 flags);
 void mlx4_qp_release_range(struct mlx4_dev *dev, int base_qpn, int cnt);
-int mlx4_qp_alloc(struct mlx4_dev *dev, int qpn, struct mlx4_qp *qp,
+int mlx4_qp_alloc(struct mlx4_dev *dev, int qpn, struct mlx4_qp *qp);
-                  gfp_t gfp);
 void mlx4_qp_free(struct mlx4_dev *dev, struct mlx4_qp *qp);
 int mlx4_srq_alloc(struct mlx4_dev *dev, u32 pdn, u32 cqn, u16 xrcdn,
diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
index 45cdb27791a3..ff151814a02d 100644
--- a/include/linux/mm_types.h
+++ b/include/linux/mm_types.h
@@ -342,7 +342,7 @@ struct vm_area_struct {
        struct mempolicy *vm_policy;    /* NUMA policy for the VMA */
 #endif
        struct vm_userfaultfd_ctx vm_userfaultfd_ctx;
-};
+} __randomize_layout;
 struct core_thread {
        struct task_struct *task;
@@ -500,7 +500,7 @@ struct mm_struct {
        atomic_long_t hugetlb_usage;
 #endif
        struct work_struct async_put_work;
-};
+} __randomize_layout;
 extern struct mm_struct init_mm;
diff --git a/include/linux/module.h b/include/linux/module.h
index 8eb9a1e693e5..e7bdd549e527 100644
--- a/include/linux/module.h
+++ b/include/linux/module.h
@@ -45,7 +45,7 @@ struct module_kobject {
        struct kobject *drivers_dir;
        struct module_param_attrs *mp;
        struct completion *kobj_completion;
-};
+} __randomize_layout;
 struct module_attribute {
        struct attribute attr;
@@ -475,7 +475,7 @@ struct module {
        ctor_fn_t *ctors;
        unsigned int num_ctors;
 #endif
-} ____cacheline_aligned;
+} ____cacheline_aligned __randomize_layout;
 #ifndef MODULE_ARCH_INIT
 #define MODULE_ARCH_INIT {}
 #endif
diff --git a/include/linux/mount.h b/include/linux/mount.h
index 8e0352af06b7..1ce85e6fd95f 100644
--- a/include/linux/mount.h
+++ b/include/linux/mount.h
@@ -67,7 +67,7 @@ struct vfsmount {
        struct dentry *mnt_root;        /* root of the mounted tree */
        struct super_block *mnt_sb;     /* pointer to superblock */
        int mnt_flags;
-};
+} __randomize_layout;
 struct file; /* forward dec */
 struct path;
diff --git a/include/linux/msg.h b/include/linux/msg.h
index f3f302f9c197..a001305f5a79 100644
--- a/include/linux/msg.h
+++ b/include/linux/msg.h
@@ -29,7 +29,7 @@ struct msg_queue {
        struct list_head q_messages;
        struct list_head q_receivers;
        struct list_head q_senders;
-};
+} __randomize_layout;
 /* Helper routines for sys_msgsnd and sys_msgrcv */
 extern long do_msgsnd(int msqid, long mtype, void __user *mtext,
diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h
index a4b97be30b28..22f081065d49 100644
--- a/include/linux/netfilter.h
+++ b/include/linux/netfilter.h
@@ -61,8 +61,6 @@ typedef unsigned int nf_hookfn(void *priv,
                               struct sk_buff *skb,
                               const struct nf_hook_state *state);
 struct nf_hook_ops {
-        struct list_head        list;
        /* User fills in from here down. */
        nf_hookfn               *hook;
        struct net_device       *dev;
@@ -160,13 +158,6 @@ int nf_register_net_hooks(struct net *net, const struct nf_hook_ops *reg,
 void nf_unregister_net_hooks(struct net *net, const struct nf_hook_ops *reg,
                             unsigned int n);
-int nf_register_hook(struct nf_hook_ops *reg);
-void nf_unregister_hook(struct nf_hook_ops *reg);
-int nf_register_hooks(struct nf_hook_ops *reg, unsigned int n);
-void nf_unregister_hooks(struct nf_hook_ops *reg, unsigned int n);
-int _nf_register_hooks(struct nf_hook_ops *reg, unsigned int n);
-void _nf_unregister_hooks(struct nf_hook_ops *reg, unsigned int n);
 /* Functions to register get/setsockopt ranges (non-inclusive).  You
   need to check permissions yourself! */
 int nf_register_sockopt(struct nf_sockopt_ops *reg);
diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h
index e52cc55ac300..5cc91d6381a3 100644
--- a/include/linux/nfs_fs.h
+++ b/include/linux/nfs_fs.h
@@ -51,7 +51,7 @@ struct nfs_access_entry {
        struct list_head        lru;
        unsigned long           jiffies;
        struct rpc_cred *       cred;
-        int                     mask;
+        __u32                   mask;
        struct rcu_head         rcu_head;
 };
diff --git a/include/linux/nvme.h b/include/linux/nvme.h
index 6b8ee9e628e1..bc74da018bdc 100644
--- a/include/linux/nvme.h
+++ b/include/linux/nvme.h
@@ -963,14 +963,14 @@ struct nvme_dbbuf {
 };
 struct streams_directive_params {
-        __u16   msl;
+        __le16  msl;
-        __u16   nssa;
+        __le16  nssa;
-        __u16   nsso;
+        __le16  nsso;
        __u8    rsvd[10];
-        __u32   sws;
+        __le32  sws;
-        __u16   sgs;
+        __le16  sgs;
-        __u16   nsa;
+        __le16  nsa;
-        __u16   nso;
+        __le16  nso;
        __u8    rsvd2[6];
 };
diff --git a/include/linux/path.h b/include/linux/path.h
index d1372186f431..cde895cc4af4 100644
--- a/include/linux/path.h
+++ b/include/linux/path.h
@@ -7,7 +7,7 @@ struct vfsmount;
 struct path {
        struct vfsmount *mnt;
        struct dentry *dentry;
-};
+} __randomize_layout;
 extern void path_get(const struct path *);
 extern void path_put(const struct path *);
diff --git a/include/linux/pid_namespace.h b/include/linux/pid_namespace.h
index c2a989dee876..b09136f88cf4 100644
--- a/include/linux/pid_namespace.h
+++ b/include/linux/pid_namespace.h
@@ -52,7 +52,7 @@ struct pid_namespace {
        int hide_pid;
        int reboot;     /* group exit code if this pidns was rebooted */
        struct ns_common ns;
-};
+} __randomize_layout;
 extern struct pid_namespace init_pid_ns;
diff --git a/include/linux/proc_ns.h b/include/linux/proc_ns.h
index 58ab28d81fc2..06844b54dfc1 100644
--- a/include/linux/proc_ns.h
+++ b/include/linux/proc_ns.h
@@ -21,7 +21,7 @@ struct proc_ns_operations {
        int (*install)(struct nsproxy *nsproxy, struct ns_common *ns);
        struct user_namespace *(*owner)(struct ns_common *ns);
        struct ns_common *(*get_parent)(struct ns_common *ns);
-};
+} __randomize_layout;
 extern const struct proc_ns_operations netns_operations;
 extern const struct proc_ns_operations utsns_operations;
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 2ba9ec93423f..8337e2db0bb2 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -426,7 +426,7 @@ struct sched_rt_entity {
        /* rq "owned" by this entity/group: */
        struct rt_rq                    *my_q;
 #endif
-};
+} __randomize_layout;
 struct sched_dl_entity {
        struct rb_node                  rb_node;
@@ -526,6 +526,13 @@ struct task_struct {
 #endif
        /* -1 unrunnable, 0 runnable, >0 stopped: */
        volatile long                   state;
+        /*
+         * This begins the randomizable portion of task_struct. Only
+         * scheduling-critical items should be added above here.
+         */
+        randomized_struct_fields_start
        void                            *stack;
        atomic_t                        usage;
        /* Per task flags (PF_*), defined further below: */
@@ -1079,6 +1086,13 @@ struct task_struct {
        /* Used by LSM modules for access restriction: */
        void                            *security;
 #endif
+        /*
+         * New fields for task_struct should be added above here, so that
+         * they are included in the randomized portion of task_struct.
+         */
+        randomized_struct_fields_end
        /* CPU-specific state of this task: */
        struct thread_struct            thread;
diff --git a/include/linux/sched/signal.h b/include/linux/sched/signal.h
index c06d63b3a583..2a0dd40b15db 100644
--- a/include/linux/sched/signal.h
+++ b/include/linux/sched/signal.h
@@ -222,7 +222,7 @@ struct signal_struct {
        struct mutex cred_guard_mutex;  /* guard against foreign influences on
                                         * credential calculations
                                         * (notably. ptrace) */
-};
+} __randomize_layout;
 /*
 * Bits in flags field of signal_struct.
diff --git a/include/linux/sem.h b/include/linux/sem.h
index be5cf2ea14ad..de2deb8676bd 100644
--- a/include/linux/sem.h
+++ b/include/linux/sem.h
@@ -41,7 +41,7 @@ struct sem_array {
        unsigned int            use_global_lock;/* >0: global lock required */
        struct sem              sems[];
-};
+} __randomize_layout;
 #ifdef CONFIG_SYSVIPC
diff --git a/include/linux/shm.h b/include/linux/shm.h
index 04e881829625..0fb7061ec54c 100644
--- a/include/linux/shm.h
+++ b/include/linux/shm.h
@@ -22,7 +22,7 @@ struct shmid_kernel /* private to the kernel */
        /* The task created the shm object.  NULL if the task is dead. */
        struct task_struct      *shm_creator;
        struct list_head        shm_clist;      /* list by creator */
-};
+} __randomize_layout;
 /* shm_mode upper byte flags */
 #define SHM_DEST        01000   /* segment will be destroyed on last detach */
diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
index 3a89b9ff4cdc..1d4dba490fb6 100644
--- a/include/linux/sysctl.h
+++ b/include/linux/sysctl.h
@@ -120,7 +120,7 @@ struct ctl_table
        struct ctl_table_poll *poll;
        void *extra1;
        void *extra2;
-};
+} __randomize_layout;
 struct ctl_node {
        struct rb_node node;
diff --git a/include/linux/trace_events.h b/include/linux/trace_events.h
index f73cedfa2e0b..536c80ff7ad9 100644
--- a/include/linux/trace_events.h
+++ b/include/linux/trace_events.h
@@ -338,7 +338,7 @@ enum {
 struct trace_event_file {
        struct list_head                list;
        struct trace_event_call         *event_call;
-        struct event_filter             *filter;
+        struct event_filter __rcu       *filter;
        struct dentry                   *dir;
        struct trace_array              *tr;
        struct trace_subsystem_dir      *system;
diff --git a/include/linux/tty.h b/include/linux/tty.h
index 69464c0d8068..79c30daf46a9 100644
--- a/include/linux/tty.h
+++ b/include/linux/tty.h
@@ -332,7 +332,7 @@ struct tty_struct {
        /* If the tty has a pending do_SAK, queue it here - akpm */
        struct work_struct SAK_work;
        struct tty_port *port;
-};
+} __randomize_layout;
 /* Each of a tty's open files has private_data pointing to tty_file_private */
 struct tty_file_private {
diff --git a/include/linux/tty_driver.h b/include/linux/tty_driver.h
index b742b5e47cc2..00b2213f6a35 100644
--- a/include/linux/tty_driver.h
+++ b/include/linux/tty_driver.h
@@ -291,7 +291,7 @@ struct tty_operations {
        void (*poll_put_char)(struct tty_driver *driver, int line, char ch);
 #endif
        const struct file_operations *proc_fops;
-};
+} __randomize_layout;
 struct tty_driver {
        int     magic;          /* magic number for this structure */
@@ -325,7 +325,7 @@ struct tty_driver {
        const struct tty_operations *ops;
        struct list_head tty_drivers;
-};
+} __randomize_layout;
 extern struct list_head tty_drivers;
diff --git a/include/linux/usb/audio-v2.h b/include/linux/usb/audio-v2.h
index c5f2158ab00e..fd73bc0e9027 100644
--- a/include/linux/usb/audio-v2.h
+++ b/include/linux/usb/audio-v2.h
@@ -115,13 +115,13 @@ struct uac2_input_terminal_descriptor {
        __u8 bDescriptorType;
        __u8 bDescriptorSubtype;
        __u8 bTerminalID;
-        __u16 wTerminalType;
+        __le16 wTerminalType;
        __u8 bAssocTerminal;
        __u8 bCSourceID;
        __u8 bNrChannels;
-        __u32 bmChannelConfig;
+        __le32 bmChannelConfig;
        __u8 iChannelNames;
-        __u16 bmControls;
+        __le16 bmControls;
        __u8 iTerminal;
 } __attribute__((packed));
@@ -132,11 +132,11 @@ struct uac2_output_terminal_descriptor {
        __u8 bDescriptorType;
        __u8 bDescriptorSubtype;
        __u8 bTerminalID;
-        __u16 wTerminalType;
+        __le16 wTerminalType;
        __u8 bAssocTerminal;
        __u8 bSourceID;
        __u8 bCSourceID;
-        __u16 bmControls;
+        __le16 bmControls;
        __u8 iTerminal;
 } __attribute__((packed));
@@ -164,9 +164,9 @@ struct uac2_as_header_descriptor {
        __u8 bTerminalLink;
        __u8 bmControls;
        __u8 bFormatType;
-        __u32 bmFormats;
+        __le32 bmFormats;
        __u8 bNrChannels;
-        __u32 bmChannelConfig;
+        __le32 bmChannelConfig;
        __u8 iChannelNames;
 } __attribute__((packed));
diff --git a/include/linux/usb/cdc_ncm.h b/include/linux/usb/cdc_ncm.h
index 021f7a88f52c..1a59699cf82a 100644
--- a/include/linux/usb/cdc_ncm.h
+++ b/include/linux/usb/cdc_ncm.h
@@ -83,6 +83,7 @@
 /* Driver flags */
 #define CDC_NCM_FLAG_NDP_TO_END                 0x02    /* NDP is placed at end of frame */
 #define CDC_MBIM_FLAG_AVOID_ALTSETTING_TOGGLE   0x04    /* Avoid altsetting toggle during init */
+#define CDC_NCM_FLAG_RESET_NTB16 0x08   /* set NDP16 one more time after altsetting switch */
 #define cdc_ncm_comm_intf_is_mbim(x)  ((x)->desc.bInterfaceSubClass == USB_CDC_SUBCLASS_MBIM && \
                                       (x)->desc.bInterfaceProtocol == USB_CDC_PROTO_NONE)
diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h
index 32354b4b4b2b..b3575ce29148 100644
--- a/include/linux/user_namespace.h
+++ b/include/linux/user_namespace.h
@@ -66,7 +66,7 @@ struct user_namespace {
 #endif
        struct ucounts          *ucounts;
        int ucount_max[UCOUNT_COUNTS];
-};
+} __randomize_layout;
 struct ucounts {
        struct hlist_node node;
diff --git a/include/linux/utsname.h b/include/linux/utsname.h
index 60f0bb83b313..da826ed059cf 100644
--- a/include/linux/utsname.h
+++ b/include/linux/utsname.h
@@ -26,7 +26,7 @@ struct uts_namespace {
        struct user_namespace *user_ns;
        struct ucounts *ucounts;
        struct ns_common ns;
-};
+} __randomize_layout;
 extern struct uts_namespace init_uts_ns;
 #ifdef CONFIG_UTS_NS
diff --git a/include/net/af_unix.h b/include/net/af_unix.h
index 678e4d6fa317..53b1a2cca421 100644
--- a/include/net/af_unix.h
+++ b/include/net/af_unix.h
@@ -37,7 +37,7 @@ struct unix_skb_parms {
        u32                     secid;          /* Security ID          */
 #endif
        u32                     consumed;
-};
+} __randomize_layout;
 #define UNIXCB(skb)     (*(struct unix_skb_parms *)&((skb)->cb))
diff --git a/include/net/neighbour.h b/include/net/neighbour.h
index afc39e3a3f7c..9816df225af3 100644
--- a/include/net/neighbour.h
+++ b/include/net/neighbour.h
@@ -156,7 +156,7 @@ struct neighbour {
        struct rcu_head         rcu;
        struct net_device       *dev;
        u8                      primary_key[0];
-};
+} __randomize_layout;
 struct neigh_ops {
        int                     family;
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index 31a2b51bef2c..1c401bd4c2e0 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -148,7 +148,7 @@ struct net {
 #endif
        struct sock             *diag_nlsk;
        atomic_t                fnhe_genid;
-};
+} __randomize_layout;
 #include <linux/seq_file_net.h>
diff --git a/include/net/netlink.h b/include/net/netlink.h
index 01709172b3d3..ef8e6c3a80a6 100644
--- a/include/net/netlink.h
+++ b/include/net/netlink.h
@@ -98,8 +98,8 @@
 *   nla_put_u8(skb, type, value)       add u8 attribute to skb
 *   nla_put_u16(skb, type, value)      add u16 attribute to skb
 *   nla_put_u32(skb, type, value)      add u32 attribute to skb
- *   nla_put_u64_64bits(skb, type,
+ *   nla_put_u64_64bit(skb, type,
- *                      value, padattr) add u64 attribute to skb
+ *                     value, padattr)  add u64 attribute to skb
 *   nla_put_s8(skb, type, value)       add s8 attribute to skb
 *   nla_put_s16(skb, type, value)      add s16 attribute to skb
 *   nla_put_s32(skb, type, value)      add s32 attribute to skb
diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
index a9519a06a23b..980807d7506f 100644
--- a/include/net/sctp/sctp.h
+++ b/include/net/sctp/sctp.h
@@ -469,6 +469,8 @@ _sctp_walk_params((pos), (chunk), ntohs((chunk)->chunk_hdr.length), member)
 #define _sctp_walk_params(pos, chunk, end, member)\
 for (pos.v = chunk->member;\
+     (pos.v + offsetof(struct sctp_paramhdr, length) + sizeof(pos.p->length) <\
+      (void *)chunk + end) &&\
     pos.v <= (void *)chunk + end - ntohs(pos.p->length) &&\
     ntohs(pos.p->length) >= sizeof(struct sctp_paramhdr);\
     pos.v += SCTP_PAD4(ntohs(pos.p->length)))
@@ -479,6 +481,8 @@ _sctp_walk_errors((err), (chunk_hdr), ntohs((chunk_hdr)->length))
 #define _sctp_walk_errors(err, chunk_hdr, end)\
 for (err = (sctp_errhdr_t *)((void *)chunk_hdr + \
            sizeof(struct sctp_chunkhdr));\
+     ((void *)err + offsetof(sctp_errhdr_t, length) + sizeof(err->length) <\
+      (void *)chunk_hdr + end) &&\
     (void *)err <= (void *)chunk_hdr + end - ntohs(err->length) &&\
     ntohs(err->length) >= sizeof(sctp_errhdr_t); \
     err = (sctp_errhdr_t *)((void *)err + SCTP_PAD4(ntohs(err->length))))
diff --git a/include/net/sock.h b/include/net/sock.h
index f69c8c2782df..7c0632c7e870 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1128,7 +1128,7 @@ struct proto {
        atomic_t                socks;
 #endif
        int                     (*diag_destroy)(struct sock *sk, int err);
-};
+} __randomize_layout;
 int proto_register(struct proto *prot, int alloc_slab);
 void proto_unregister(struct proto *prot);
diff --git a/include/rdma/ib_addr.h b/include/rdma/ib_addr.h
index 4b34c51f859e..b73a14edc85e 100644
--- a/include/rdma/ib_addr.h
+++ b/include/rdma/ib_addr.h
@@ -205,11 +205,13 @@ static inline void iboe_addr_get_sgid(struct rdma_dev_addr *dev_addr,
        dev = dev_get_by_index(&init_net, dev_addr->bound_dev_if);
        if (dev) {
                ip4 = in_dev_get(dev);
-                if (ip4 && ip4->ifa_list && ip4->ifa_list->ifa_address) {
+                if (ip4 && ip4->ifa_list && ip4->ifa_list->ifa_address)
                        ipv6_addr_set_v4mapped(ip4->ifa_list->ifa_address,
                                               (struct in6_addr *)gid);
+                if (ip4)
                        in_dev_put(ip4);
-                }
                dev_put(dev);
        }
 }
diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index 356953d3dbd1..b5732432bb29 100644
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -1056,7 +1056,7 @@ enum ib_qp_create_flags {
        IB_QP_CREATE_MANAGED_RECV               = 1 << 4,
        IB_QP_CREATE_NETIF_QP                   = 1 << 5,
        IB_QP_CREATE_SIGNATURE_EN               = 1 << 6,
-        IB_QP_CREATE_USE_GFP_NOIO               = 1 << 7,
+        /* FREE                                 = 1 << 7, */
        IB_QP_CREATE_SCATTER_FCS                = 1 << 8,
        IB_QP_CREATE_CVLAN_STRIPPING            = 1 << 9,
        /* reserve bits 26-31 for low level drivers' internal use */
@@ -2948,6 +2948,22 @@ struct ib_qp *ib_create_qp(struct ib_pd *pd,
                           struct ib_qp_init_attr *qp_init_attr);
 /**
+ * ib_modify_qp_with_udata - Modifies the attributes for the specified QP.
+ * @qp: The QP to modify.
+ * @attr: On input, specifies the QP attributes to modify.  On output,
+ *   the current values of selected QP attributes are returned.
+ * @attr_mask: A bit-mask used to specify which attributes of the QP
+ *   are being modified.
+ * @udata: pointer to user's input output buffer information
+ *   are being modified.
+ * It returns 0 on success and returns appropriate error code on error.
+ */
+int ib_modify_qp_with_udata(struct ib_qp *qp,
+                            struct ib_qp_attr *attr,
+                            int attr_mask,
+                            struct ib_udata *udata);
+/**
 * ib_modify_qp - Modifies the attributes for the specified QP and then
 *   transitions the QP to the given state.
 * @qp: The QP to modify.
diff --git a/include/rdma/rdma_vt.h b/include/rdma/rdma_vt.h
index 4878aaf7bdff..55af69271053 100644
--- a/include/rdma/rdma_vt.h
+++ b/include/rdma/rdma_vt.h
@@ -229,8 +229,7 @@ struct rvt_driver_provided {
         * ERR_PTR(err).  The driver is free to return NULL or a valid
         * pointer.
         */
-        void * (*qp_priv_alloc)(struct rvt_dev_info *rdi, struct rvt_qp *qp,
+        void * (*qp_priv_alloc)(struct rvt_dev_info *rdi, struct rvt_qp *qp);
-                                gfp_t gfp);
        /*
         * Free the driver's private qp structure.
@@ -319,7 +318,7 @@ struct rvt_driver_provided {
        /* Let the driver pick the next queue pair number*/
        int (*alloc_qpn)(struct rvt_dev_info *rdi, struct rvt_qpn_table *qpt,
-                         enum ib_qp_type type, u8 port_num, gfp_t gfp);
+                         enum ib_qp_type type, u8 port_num);
        /* Determine if its safe or allowed to modify the qp */
        int (*check_modify_qp)(struct rvt_qp *qp, struct ib_qp_attr *attr,
diff --git a/include/rdma/rdmavt_qp.h b/include/rdma/rdmavt_qp.h
index be6472e5b06b..d664d2e76280 100644
--- a/include/rdma/rdmavt_qp.h
+++ b/include/rdma/rdmavt_qp.h
@@ -647,6 +647,20 @@ static inline u32 rvt_div_mtu(struct rvt_qp *qp, u32 len)
        return len >> qp->log_pmtu;
 }
+/**
+ * rvt_timeout_to_jiffies - Convert a ULP timeout input into jiffies
+ * @timeout - timeout input(0 - 31).
+ *
+ * Return a timeout value in jiffies.
+ */
+static inline unsigned long rvt_timeout_to_jiffies(u8 timeout)
+{
+        if (timeout > 31)
+                timeout = 31;
+        return usecs_to_jiffies(1U << timeout) * 4096UL / 1000UL;
+}
 extern const int  ib_rvt_state_ops[];
 struct rvt_dev_info;
diff --git a/include/uapi/asm-generic/ioctls.h b/include/uapi/asm-generic/ioctls.h
index 06d5f7ddf84e..14baf9f23a14 100644
--- a/include/uapi/asm-generic/ioctls.h
+++ b/include/uapi/asm-generic/ioctls.h
@@ -77,7 +77,7 @@
 #define TIOCGPKT        _IOR('T', 0x38, int) /* Get packet mode state */
 #define TIOCGPTLCK      _IOR('T', 0x39, int) /* Get Pty lock state */
 #define TIOCGEXCL       _IOR('T', 0x40, int) /* Get exclusive mode state */
-#define TIOCGPTPEER     _IOR('T', 0x41, int) /* Safely open the slave */
+#define TIOCGPTPEER     _IO('T', 0x41) /* Safely open the slave */
 #define FIONCLEX        0x5450
 #define FIOCLEX         0x5451
diff --git a/include/uapi/linux/usb/audio.h b/include/uapi/linux/usb/audio.h
index d2314be4f0c0..a4680a5bf5dd 100644
--- a/include/uapi/linux/usb/audio.h
+++ b/include/uapi/linux/usb/audio.h
@@ -333,7 +333,7 @@ struct uac_processing_unit_descriptor {
        __u8 bDescriptorType;
        __u8 bDescriptorSubtype;
        __u8 bUnitID;
-        __u16 wProcessType;
+        __le16 wProcessType;
        __u8 bNrInPins;
        __u8 baSourceID[];
 } __attribute__ ((packed));
@@ -491,8 +491,8 @@ struct uac_format_type_ii_ext_descriptor {
        __u8 bDescriptorType;
        __u8 bDescriptorSubtype;
        __u8 bFormatType;
-        __u16 wMaxBitRate;
+        __le16 wMaxBitRate;
-        __u16 wSamplesPerFrame;
+        __le16 wSamplesPerFrame;
        __u8 bHeaderLength;
        __u8 bSideBandProtocol;
 } __attribute__((packed));
diff --git a/include/xen/balloon.h b/include/xen/balloon.h
index d1767dfb0d95..8906361bb50c 100644
--- a/include/xen/balloon.h
+++ b/include/xen/balloon.h
@@ -35,3 +35,11 @@ static inline int register_xen_selfballooning(struct device *dev)
        return -ENOSYS;
 }
 #endif
+#ifdef CONFIG_XEN_BALLOON
+void xen_balloon_init(void);
+#else
+static inline void xen_balloon_init(void)
+{
+}
+#endif
diff --git a/kernel/audit.c b/kernel/audit.c
index 833267bbd80b..6dd556931739 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -641,6 +641,7 @@ static int auditd_send_unicast_skb(struct sk_buff *skb)
        ac = rcu_dereference(auditd_conn);
        if (!ac) {
                rcu_read_unlock();
+                kfree_skb(skb);
                rc = -ECONNREFUSED;
                goto err;
        }
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 6a86723c5b64..af9e84a4944e 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -504,6 +504,7 @@ static void reset_reg_range_values(struct bpf_reg_state *regs, u32 regno)
 {
        regs[regno].min_value = BPF_REGISTER_MIN_RANGE;
        regs[regno].max_value = BPF_REGISTER_MAX_RANGE;
+        regs[regno].value_from_signed = false;
        regs[regno].min_align = 0;
 }
@@ -777,12 +778,13 @@ static int check_ctx_access(struct bpf_verifier_env *env, int insn_idx, int off,
        return -EACCES;
 }
-static bool is_pointer_value(struct bpf_verifier_env *env, int regno)
+static bool __is_pointer_value(bool allow_ptr_leaks,
+                               const struct bpf_reg_state *reg)
 {
-        if (env->allow_ptr_leaks)
+        if (allow_ptr_leaks)
                return false;
-        switch (env->cur_state.regs[regno].type) {
+        switch (reg->type) {
        case UNKNOWN_VALUE:
        case CONST_IMM:
                return false;
@@ -791,6 +793,11 @@ static bool is_pointer_value(struct bpf_verifier_env *env, int regno)
        }
 }
+static bool is_pointer_value(struct bpf_verifier_env *env, int regno)
+{
+        return __is_pointer_value(env->allow_ptr_leaks, &env->cur_state.regs[regno]);
+}
 static int check_pkt_ptr_alignment(const struct bpf_reg_state *reg,
                                   int off, int size, bool strict)
 {
@@ -1832,10 +1839,24 @@ static void adjust_reg_min_max_vals(struct bpf_verifier_env *env,
        dst_align = dst_reg->min_align;
        /* We don't know anything about what was done to this register, mark it
-         * as unknown.
+         * as unknown. Also, if both derived bounds came from signed/unsigned
+         * mixed compares and one side is unbounded, we cannot really do anything
+         * with them as boundaries cannot be trusted. Thus, arithmetic of two
+         * regs of such kind will get invalidated bounds on the dst side.
         */
-        if (min_val == BPF_REGISTER_MIN_RANGE &&
+        if ((min_val == BPF_REGISTER_MIN_RANGE &&
-            max_val == BPF_REGISTER_MAX_RANGE) {
+             max_val == BPF_REGISTER_MAX_RANGE) ||
+            (BPF_SRC(insn->code) == BPF_X &&
+             ((min_val != BPF_REGISTER_MIN_RANGE &&
+               max_val == BPF_REGISTER_MAX_RANGE) ||
+              (min_val == BPF_REGISTER_MIN_RANGE &&
+               max_val != BPF_REGISTER_MAX_RANGE) ||
+              (dst_reg->min_value != BPF_REGISTER_MIN_RANGE &&
+               dst_reg->max_value == BPF_REGISTER_MAX_RANGE) ||
+              (dst_reg->min_value == BPF_REGISTER_MIN_RANGE &&
+               dst_reg->max_value != BPF_REGISTER_MAX_RANGE)) &&
+             regs[insn->dst_reg].value_from_signed !=
+             regs[insn->src_reg].value_from_signed)) {
                reset_reg_range_values(regs, insn->dst_reg);
                return;
        }
@@ -2023,6 +2044,7 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn)
                        regs[insn->dst_reg].max_value = insn->imm;
                        regs[insn->dst_reg].min_value = insn->imm;
                        regs[insn->dst_reg].min_align = calc_align(insn->imm);
+                        regs[insn->dst_reg].value_from_signed = false;
                }
        } else if (opcode > BPF_END) {
@@ -2198,40 +2220,63 @@ static void reg_set_min_max(struct bpf_reg_state *true_reg,
                            struct bpf_reg_state *false_reg, u64 val,
                            u8 opcode)
 {
+        bool value_from_signed = true;
+        bool is_range = true;
        switch (opcode) {
        case BPF_JEQ:
                /* If this is false then we know nothing Jon Snow, but if it is
                 * true then we know for sure.
                 */
                true_reg->max_value = true_reg->min_value = val;
+                is_range = false;
                break;
        case BPF_JNE:
                /* If this is true we know nothing Jon Snow, but if it is false
                 * we know the value for sure;
                 */
                false_reg->max_value = false_reg->min_value = val;
+                is_range = false;
                break;
        case BPF_JGT:
-                /* Unsigned comparison, the minimum value is 0. */
+                value_from_signed = false;
-                false_reg->min_value = 0;
                /* fallthrough */
        case BPF_JSGT:
+                if (true_reg->value_from_signed != value_from_signed)
+                        reset_reg_range_values(true_reg, 0);
+                if (false_reg->value_from_signed != value_from_signed)
+                        reset_reg_range_values(false_reg, 0);
+                if (opcode == BPF_JGT) {
+                        /* Unsigned comparison, the minimum value is 0. */
+                        false_reg->min_value = 0;
+                }
                /* If this is false then we know the maximum val is val,
                 * otherwise we know the min val is val+1.
                 */
                false_reg->max_value = val;
+                false_reg->value_from_signed = value_from_signed;
                true_reg->min_value = val + 1;
+                true_reg->value_from_signed = value_from_signed;
                break;
        case BPF_JGE:
-                /* Unsigned comparison, the minimum value is 0. */
+                value_from_signed = false;
-                false_reg->min_value = 0;
                /* fallthrough */
        case BPF_JSGE:
+                if (true_reg->value_from_signed != value_from_signed)
+                        reset_reg_range_values(true_reg, 0);
+                if (false_reg->value_from_signed != value_from_signed)
+                        reset_reg_range_values(false_reg, 0);
+                if (opcode == BPF_JGE) {
+                        /* Unsigned comparison, the minimum value is 0. */
+                        false_reg->min_value = 0;
+                }
                /* If this is false then we know the maximum value is val - 1,
                 * otherwise we know the mimimum value is val.
                 */
                false_reg->max_value = val - 1;
+                false_reg->value_from_signed = value_from_signed;
                true_reg->min_value = val;
+                true_reg->value_from_signed = value_from_signed;
                break;
        default:
                break;
@@ -2239,6 +2284,12 @@ static void reg_set_min_max(struct bpf_reg_state *true_reg,
        check_reg_overflow(false_reg);
        check_reg_overflow(true_reg);
+        if (is_range) {
+                if (__is_pointer_value(false, false_reg))
+                        reset_reg_range_values(false_reg, 0);
+                if (__is_pointer_value(false, true_reg))
+                        reset_reg_range_values(true_reg, 0);
+        }
 }
 /* Same as above, but for the case that dst_reg is a CONST_IMM reg and src_reg
@@ -2248,41 +2299,64 @@ static void reg_set_min_max_inv(struct bpf_reg_state *true_reg,
                                struct bpf_reg_state *false_reg, u64 val,
                                u8 opcode)
 {
+        bool value_from_signed = true;
+        bool is_range = true;
        switch (opcode) {
        case BPF_JEQ:
                /* If this is false then we know nothing Jon Snow, but if it is
                 * true then we know for sure.
                 */
                true_reg->max_value = true_reg->min_value = val;
+                is_range = false;
                break;
        case BPF_JNE:
                /* If this is true we know nothing Jon Snow, but if it is false
                 * we know the value for sure;
                 */
                false_reg->max_value = false_reg->min_value = val;
+                is_range = false;
                break;
        case BPF_JGT:
-                /* Unsigned comparison, the minimum value is 0. */
+                value_from_signed = false;
-                true_reg->min_value = 0;
                /* fallthrough */
        case BPF_JSGT:
+                if (true_reg->value_from_signed != value_from_signed)
+                        reset_reg_range_values(true_reg, 0);
+                if (false_reg->value_from_signed != value_from_signed)
+                        reset_reg_range_values(false_reg, 0);
+                if (opcode == BPF_JGT) {
+                        /* Unsigned comparison, the minimum value is 0. */
+                        true_reg->min_value = 0;
+                }
                /*
                 * If this is false, then the val is <= the register, if it is
                 * true the register <= to the val.
                 */
                false_reg->min_value = val;
+                false_reg->value_from_signed = value_from_signed;
                true_reg->max_value = val - 1;
+                true_reg->value_from_signed = value_from_signed;
                break;
        case BPF_JGE:
-                /* Unsigned comparison, the minimum value is 0. */
+                value_from_signed = false;
-                true_reg->min_value = 0;
                /* fallthrough */
        case BPF_JSGE:
+                if (true_reg->value_from_signed != value_from_signed)
+                        reset_reg_range_values(true_reg, 0);
+                if (false_reg->value_from_signed != value_from_signed)
+                        reset_reg_range_values(false_reg, 0);
+                if (opcode == BPF_JGE) {
+                        /* Unsigned comparison, the minimum value is 0. */
+                        true_reg->min_value = 0;
+                }
                /* If this is false then constant < register, if it is true then
                 * the register < constant.
                 */
                false_reg->min_value = val + 1;
+                false_reg->value_from_signed = value_from_signed;
                true_reg->max_value = val;
+                true_reg->value_from_signed = value_from_signed;
                break;
        default:
                break;
@@ -2290,6 +2364,12 @@ static void reg_set_min_max_inv(struct bpf_reg_state *true_reg,
        check_reg_overflow(false_reg);
        check_reg_overflow(true_reg);
+        if (is_range) {
+                if (__is_pointer_value(false, false_reg))
+                        reset_reg_range_values(false_reg, 0);
+                if (__is_pointer_value(false, true_reg))
+                        reset_reg_range_values(true_reg, 0);
+        }
 }
 static void mark_map_reg(struct bpf_reg_state *regs, u32 regno, u32 id,
diff --git a/kernel/cpu.c b/kernel/cpu.c
index ab860453841d..eee033134262 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -279,7 +279,8 @@ static int bringup_wait_for_ap(unsigned int cpu)
        /* Wait for the CPU to reach CPUHP_AP_ONLINE_IDLE */
        wait_for_completion(&st->done);
-        BUG_ON(!cpu_online(cpu));
+        if (WARN_ON_ONCE((!cpu_online(cpu))))
+                return -ECANCELED;
        /* Unpark the stopper thread and the hotplug thread of the target cpu */
        stop_machine_unpark(cpu);
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 1538df9b2b65..426c2ffba16d 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -1452,6 +1452,13 @@ static enum event_type_t get_event_type(struct perf_event *event)
        lockdep_assert_held(&ctx->lock);
+        /*
+         * It's 'group type', really, because if our group leader is
+         * pinned, so are we.
+         */
+        if (event->group_leader != event)
+                event = event->group_leader;
        event_type = event->attr.pinned ? EVENT_PINNED : EVENT_FLEXIBLE;
        if (!ctx->task)
                event_type |= EVENT_CPU;
@@ -4378,7 +4385,9 @@ EXPORT_SYMBOL_GPL(perf_event_read_value);
 static int __perf_read_group_add(struct perf_event *leader,
                                        u64 read_format, u64 *values)
 {
+        struct perf_event_context *ctx = leader->ctx;
        struct perf_event *sub;
+        unsigned long flags;
        int n = 1; /* skip @nr */
        int ret;
@@ -4408,12 +4417,15 @@ static int __perf_read_group_add(struct perf_event *leader,
        if (read_format & PERF_FORMAT_ID)
                values[n++] = primary_event_id(leader);
+        raw_spin_lock_irqsave(&ctx->lock, flags);
        list_for_each_entry(sub, &leader->sibling_list, group_entry) {
                values[n++] += perf_event_count(sub);
                if (read_format & PERF_FORMAT_ID)
                        values[n++] = primary_event_id(sub);
        }
+        raw_spin_unlock_irqrestore(&ctx->lock, flags);
        return 0;
 }
@@ -7321,21 +7333,6 @@ int perf_event_account_interrupt(struct perf_event *event)
        return __perf_event_account_interrupt(event, 1);
 }
-static bool sample_is_allowed(struct perf_event *event, struct pt_regs *regs)
-{
-        /*
-         * Due to interrupt latency (AKA "skid"), we may enter the
-         * kernel before taking an overflow, even if the PMU is only
-         * counting user events.
-         * To avoid leaking information to userspace, we must always
-         * reject kernel samples when exclude_kernel is set.
-         */
-        if (event->attr.exclude_kernel && !user_mode(regs))
-                return false;
-        return true;
-}
 /*
 * Generic event overflow handling, sampling.
 */
@@ -7357,12 +7354,6 @@ static int __perf_event_overflow(struct perf_event *event,
        ret = __perf_event_account_interrupt(event, throttle);
        /*
-         * For security, drop the skid kernel samples if necessary.
-         */
-        if (!sample_is_allowed(event, regs))
-                return ret;
-        /*
         * XXX event_limit might not quite work as expected on inherited
         * events
         */
diff --git a/kernel/futex.c b/kernel/futex.c
index c934689043b2..16dbe4c93895 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -212,7 +212,7 @@ struct futex_pi_state {
        atomic_t refcount;
        union futex_key key;
-};
+} __randomize_layout;
 /**
 * struct futex_q - The hashed futex queue entry, one per waiting task
@@ -246,7 +246,7 @@ struct futex_q {
        struct rt_mutex_waiter *rt_waiter;
        union futex_key *requeue_pi_key;
        u32 bitset;
-};
+} __randomize_layout;
 static const struct futex_q futex_q_init = {
        /* list gets initialized in queue_me()*/
diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
index d171bc57e1e0..a3cc37c0c85e 100644
--- a/kernel/irq/chip.c
+++ b/kernel/irq/chip.c
@@ -170,21 +170,11 @@ static void irq_state_clr_disabled(struct irq_desc *desc)
        irqd_clear(&desc->irq_data, IRQD_IRQ_DISABLED);
 }
-static void irq_state_set_disabled(struct irq_desc *desc)
-{
-        irqd_set(&desc->irq_data, IRQD_IRQ_DISABLED);
-}
 static void irq_state_clr_masked(struct irq_desc *desc)
 {
        irqd_clear(&desc->irq_data, IRQD_IRQ_MASKED);
 }
-static void irq_state_set_masked(struct irq_desc *desc)
-{
-        irqd_set(&desc->irq_data, IRQD_IRQ_MASKED);
-}
 static void irq_state_clr_started(struct irq_desc *desc)
 {
        irqd_clear(&desc->irq_data, IRQD_IRQ_STARTED);
diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h
index dbfba9933ed2..a2c48058354c 100644
--- a/kernel/irq/internals.h
+++ b/kernel/irq/internals.h
@@ -227,6 +227,16 @@ static inline bool irqd_has_set(struct irq_data *d, unsigned int mask)
        return __irqd_to_state(d) & mask;
 }
+static inline void irq_state_set_disabled(struct irq_desc *desc)
+{
+        irqd_set(&desc->irq_data, IRQD_IRQ_DISABLED);
+}
+static inline void irq_state_set_masked(struct irq_desc *desc)
+{
+        irqd_set(&desc->irq_data, IRQD_IRQ_MASKED);
+}
 #undef __irqd_to_state
 static inline void kstat_incr_irqs_this_cpu(struct irq_desc *desc)
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 5624b2dd6b58..1d1a5b945ab4 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -1090,6 +1090,16 @@ setup_irq_thread(struct irqaction *new, unsigned int irq, bool secondary)
 /*
 * Internal function to register an irqaction - typically used to
 * allocate special interrupts that are part of the architecture.
+ *
+ * Locking rules:
+ *
+ * desc->request_mutex  Provides serialization against a concurrent free_irq()
+ *   chip_bus_lock      Provides serialization for slow bus operations
+ *     desc->lock       Provides serialization against hard interrupts
+ *
+ * chip_bus_lock and desc->lock are sufficient for all other management and
+ * interrupt related functions. desc->request_mutex solely serializes
+ * request/free_irq().
 */
 static int
 __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
@@ -1167,20 +1177,35 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
        if (desc->irq_data.chip->flags & IRQCHIP_ONESHOT_SAFE)
                new->flags &= ~IRQF_ONESHOT;
+        /*
+         * Protects against a concurrent __free_irq() call which might wait
+         * for synchronize_irq() to complete without holding the optional
+         * chip bus lock and desc->lock.
+         */
        mutex_lock(&desc->request_mutex);
+        /*
+         * Acquire bus lock as the irq_request_resources() callback below
+         * might rely on the serialization or the magic power management
+         * functions which are abusing the irq_bus_lock() callback,
+         */
+        chip_bus_lock(desc);
+        /* First installed action requests resources. */
        if (!desc->action) {
                ret = irq_request_resources(desc);
                if (ret) {
                        pr_err("Failed to request resources for %s (irq %d) on irqchip %s\n",
                               new->name, irq, desc->irq_data.chip->name);
-                        goto out_mutex;
+                        goto out_bus_unlock;
                }
        }
-        chip_bus_lock(desc);
        /*
         * The following block of code has to be executed atomically
+         * protected against a concurrent interrupt and any of the other
+         * management calls which are not serialized via
+         * desc->request_mutex or the optional bus lock.
         */
        raw_spin_lock_irqsave(&desc->lock, flags);
        old_ptr = &desc->action;
@@ -1286,10 +1311,8 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
                        ret = __irq_set_trigger(desc,
                                                new->flags & IRQF_TRIGGER_MASK);
-                        if (ret) {
+                        if (ret)
-                                irq_release_resources(desc);
                                goto out_unlock;
-                        }
                }
                desc->istate &= ~(IRQS_AUTODETECT | IRQS_SPURIOUS_DISABLED | \
@@ -1385,12 +1408,10 @@ mismatch:
 out_unlock:
        raw_spin_unlock_irqrestore(&desc->lock, flags);
-        chip_bus_sync_unlock(desc);
        if (!desc->action)
                irq_release_resources(desc);
+out_bus_unlock:
-out_mutex:
+        chip_bus_sync_unlock(desc);
        mutex_unlock(&desc->request_mutex);
 out_thread:
@@ -1472,6 +1493,7 @@ static struct irqaction *__free_irq(unsigned int irq, void *dev_id)
                        WARN(1, "Trying to free already-free IRQ %d\n", irq);
                        raw_spin_unlock_irqrestore(&desc->lock, flags);
                        chip_bus_sync_unlock(desc);
+                        mutex_unlock(&desc->request_mutex);
                        return NULL;
                }
@@ -1498,6 +1520,20 @@ static struct irqaction *__free_irq(unsigned int irq, void *dev_id)
 #endif
        raw_spin_unlock_irqrestore(&desc->lock, flags);
+        /*
+         * Drop bus_lock here so the changes which were done in the chip
+         * callbacks above are synced out to the irq chips which hang
+         * behind a slow bus (I2C, SPI) before calling synchronize_irq().
+         *
+         * Aside of that the bus_lock can also be taken from the threaded
+         * handler in irq_finalize_oneshot() which results in a deadlock
+         * because synchronize_irq() would wait forever for the thread to
+         * complete, which is blocked on the bus lock.
+         *
+         * The still held desc->request_mutex() protects against a
+         * concurrent request_irq() of this irq so the release of resources
+         * and timing data is properly serialized.
+         */
        chip_bus_sync_unlock(desc);
        unregister_handler_proc(irq, action);
@@ -1530,8 +1566,15 @@ static struct irqaction *__free_irq(unsigned int irq, void *dev_id)
                }
        }
+        /* Last action releases resources */
        if (!desc->action) {
+                /*
+                 * Reaquire bus lock as irq_release_resources() might
+                 * require it to deallocate resources over the slow bus.
+                 */
+                chip_bus_lock(desc);
                irq_release_resources(desc);
+                chip_bus_sync_unlock(desc);
                irq_remove_timings(desc);
        }
diff --git a/kernel/irq/pm.c b/kernel/irq/pm.c
index cea1de0161f1..6bd9b58429cc 100644
--- a/kernel/irq/pm.c
+++ b/kernel/irq/pm.c
@@ -149,6 +149,8 @@ static void resume_irq(struct irq_desc *desc)
        /* Pretend that it got disabled ! */
        desc->depth++;
+        irq_state_set_disabled(desc);
+        irq_state_set_masked(desc);
 resume:
        desc->istate &= ~IRQS_SUSPENDED;
        __enable_irq(desc);
diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c
index 78069895032a..649dc9d3951a 100644
--- a/kernel/locking/rtmutex.c
+++ b/kernel/locking/rtmutex.c
@@ -963,7 +963,6 @@ static int task_blocks_on_rt_mutex(struct rt_mutex *lock,
                return -EDEADLK;
        raw_spin_lock(&task->pi_lock);
-        rt_mutex_adjust_prio(task);
        waiter->task = task;
        waiter->lock = lock;
        waiter->prio = task->prio;
diff --git a/kernel/sched/cputime.c b/kernel/sched/cputime.c
index 6e3ea4ac1bda..14d2dbf97c53 100644
--- a/kernel/sched/cputime.c
+++ b/kernel/sched/cputime.c
@@ -683,7 +683,7 @@ static u64 vtime_delta(struct vtime *vtime)
 {
        unsigned long long clock;
-        clock = sched_clock_cpu(smp_processor_id());
+        clock = sched_clock();
        if (clock < vtime->starttime)
                return 0;
@@ -814,7 +814,7 @@ void arch_vtime_task_switch(struct task_struct *prev)
        write_seqcount_begin(&vtime->seqcount);
        vtime->state = VTIME_SYS;
-        vtime->starttime = sched_clock_cpu(smp_processor_id());
+        vtime->starttime = sched_clock();
        write_seqcount_end(&vtime->seqcount);
 }
@@ -826,7 +826,7 @@ void vtime_init_idle(struct task_struct *t, int cpu)
        local_irq_save(flags);
        write_seqcount_begin(&vtime->seqcount);
        vtime->state = VTIME_SYS;
-        vtime->starttime = sched_clock_cpu(cpu);
+        vtime->starttime = sched_clock();
        write_seqcount_end(&vtime->seqcount);
        local_irq_restore(flags);
 }
diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
index a84299f44b5d..755bd3f1a1a9 100644
--- a/kernel/sched/deadline.c
+++ b/kernel/sched/deadline.c
@@ -1392,17 +1392,19 @@ static void enqueue_task_dl(struct rq *rq, struct task_struct *p, int flags)
        struct sched_dl_entity *pi_se = &p->dl;
        /*
-         * Use the scheduling parameters of the top pi-waiter
+         * Use the scheduling parameters of the top pi-waiter task if:
-         * task if we have one and its (absolute) deadline is
+         * - we have a top pi-waiter which is a SCHED_DEADLINE task AND
-         * smaller than our one... OTW we keep our runtime and
+         * - our dl_boosted is set (i.e. the pi-waiter's (absolute) deadline is
-         * deadline.
+         *   smaller than our deadline OR we are a !SCHED_DEADLINE task getting
+         *   boosted due to a SCHED_DEADLINE pi-waiter).
+         * Otherwise we keep our runtime and deadline.
         */
-        if (pi_task && p->dl.dl_boosted && dl_prio(pi_task->normal_prio)) {
+        if (pi_task && dl_prio(pi_task->normal_prio) && p->dl.dl_boosted) {
                pi_se = &pi_task->dl;
        } else if (!dl_prio(p->normal_prio)) {
                /*
                 * Special case in which we have a !SCHED_DEADLINE task
-                 * that is going to be deboosted, but exceedes its
+                 * that is going to be deboosted, but exceeds its
                 * runtime while doing so. No point in replenishing
                 * it, as it's going to return back to its original
                 * scheduling class after this.
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 53f6b6401cf0..02004ae91860 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -113,7 +113,7 @@ static int ftrace_disabled __read_mostly;
 static DEFINE_MUTEX(ftrace_lock);
-static struct ftrace_ops *ftrace_ops_list __read_mostly = &ftrace_list_end;
+static struct ftrace_ops __rcu *ftrace_ops_list __read_mostly = &ftrace_list_end;
 ftrace_func_t ftrace_trace_function __read_mostly = ftrace_stub;
 static struct ftrace_ops global_ops;
@@ -169,8 +169,11 @@ int ftrace_nr_registered_ops(void)
        mutex_lock(&ftrace_lock);
-        for (ops = ftrace_ops_list;
+        for (ops = rcu_dereference_protected(ftrace_ops_list,
-             ops != &ftrace_list_end; ops = ops->next)
+                                             lockdep_is_held(&ftrace_lock));
+             ops != &ftrace_list_end;
+             ops = rcu_dereference_protected(ops->next,
+                                             lockdep_is_held(&ftrace_lock)))
                cnt++;
        mutex_unlock(&ftrace_lock);
@@ -275,10 +278,11 @@ static void update_ftrace_function(void)
         * If there's only one ftrace_ops registered, the ftrace_ops_list
         * will point to the ops we want.
         */
-        set_function_trace_op = ftrace_ops_list;
+        set_function_trace_op = rcu_dereference_protected(ftrace_ops_list,
+                                                lockdep_is_held(&ftrace_lock));
        /* If there's no ftrace_ops registered, just call the stub function */
-        if (ftrace_ops_list == &ftrace_list_end) {
+        if (set_function_trace_op == &ftrace_list_end) {
                func = ftrace_stub;
        /*
@@ -286,7 +290,8 @@ static void update_ftrace_function(void)
         * recursion safe and not dynamic and the arch supports passing ops,
         * then have the mcount trampoline call the function directly.
         */
-        } else if (ftrace_ops_list->next == &ftrace_list_end) {
+        } else if (rcu_dereference_protected(ftrace_ops_list->next,
+                        lockdep_is_held(&ftrace_lock)) == &ftrace_list_end) {
                func = ftrace_ops_get_list_func(ftrace_ops_list);
        } else {
@@ -348,9 +353,11 @@ int using_ftrace_ops_list_func(void)
        return ftrace_trace_function == ftrace_ops_list_func;
 }
-static void add_ftrace_ops(struct ftrace_ops **list, struct ftrace_ops *ops)
+static void add_ftrace_ops(struct ftrace_ops __rcu **list,
+                           struct ftrace_ops *ops)
 {
-        ops->next = *list;
+        rcu_assign_pointer(ops->next, *list);
        /*
         * We are entering ops into the list but another
         * CPU might be walking that list. We need to make sure
@@ -360,7 +367,8 @@ static void add_ftrace_ops(struct ftrace_ops **list, struct ftrace_ops *ops)
        rcu_assign_pointer(*list, ops);
 }
-static int remove_ftrace_ops(struct ftrace_ops **list, struct ftrace_ops *ops)
+static int remove_ftrace_ops(struct ftrace_ops __rcu **list,
+                             struct ftrace_ops *ops)
 {
        struct ftrace_ops **p;
@@ -368,7 +376,10 @@ static int remove_ftrace_ops(struct ftrace_ops **list, struct ftrace_ops *ops)
         * If we are removing the last function, then simply point
         * to the ftrace_stub.
         */
-        if (*list == ops && ops->next == &ftrace_list_end) {
+        if (rcu_dereference_protected(*list,
+                        lockdep_is_held(&ftrace_lock)) == ops &&
+            rcu_dereference_protected(ops->next,
+                        lockdep_is_held(&ftrace_lock)) == &ftrace_list_end) {
                *list = &ftrace_list_end;
                return 0;
        }
@@ -1569,8 +1580,8 @@ ftrace_ops_test(struct ftrace_ops *ops, unsigned long ip, void *regs)
                return 0;
 #endif
-        hash.filter_hash = rcu_dereference_raw_notrace(ops->func_hash->filter_hash);
+        rcu_assign_pointer(hash.filter_hash, ops->func_hash->filter_hash);
-        hash.notrace_hash = rcu_dereference_raw_notrace(ops->func_hash->notrace_hash);
+        rcu_assign_pointer(hash.notrace_hash, ops->func_hash->notrace_hash);
        if (hash_contains_ip(ip, &hash))
                ret = 1;
@@ -2840,7 +2851,8 @@ static int ftrace_shutdown(struct ftrace_ops *ops, int command)
         * If there's no more ops registered with ftrace, run a
         * sanity check to make sure all rec flags are cleared.
         */
-        if (ftrace_ops_list == &ftrace_list_end) {
+        if (rcu_dereference_protected(ftrace_ops_list,
+                        lockdep_is_held(&ftrace_lock)) == &ftrace_list_end) {
                struct ftrace_page *pg;
                struct dyn_ftrace *rec;
@@ -6453,7 +6465,8 @@ ftrace_enable_sysctl(struct ctl_table *table, int write,
        if (ftrace_enabled) {
                /* we are starting ftrace again */
-                if (ftrace_ops_list != &ftrace_list_end)
+                if (rcu_dereference_protected(ftrace_ops_list,
+                        lockdep_is_held(&ftrace_lock)) != &ftrace_list_end)
                        update_ftrace_function();
                ftrace_startup_sysctl();
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 4ae268e687fe..529cc50d7243 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -1136,12 +1136,12 @@ static int __rb_allocate_pages(long nr_pages, struct list_head *pages, int cpu)
        for (i = 0; i < nr_pages; i++) {
                struct page *page;
                /*
-                 * __GFP_NORETRY flag makes sure that the allocation fails
+                 * __GFP_RETRY_MAYFAIL flag makes sure that the allocation fails
-                 * gracefully without invoking oom-killer and the system is
+                 * gracefully without invoking oom-killer and the system is not
-                 * not destabilized.
+                 * destabilized.
                 */
                bpage = kzalloc_node(ALIGN(sizeof(*bpage), cache_line_size()),
-                                    GFP_KERNEL | __GFP_NORETRY,
+                                    GFP_KERNEL | __GFP_RETRY_MAYFAIL,
                                    cpu_to_node(cpu));
                if (!bpage)
                        goto free_pages;
@@ -1149,7 +1149,7 @@ static int __rb_allocate_pages(long nr_pages, struct list_head *pages, int cpu)
                list_add(&bpage->list, pages);
                page = alloc_pages_node(cpu_to_node(cpu),
-                                        GFP_KERNEL | __GFP_NORETRY, 0);
+                                        GFP_KERNEL | __GFP_RETRY_MAYFAIL, 0);
                if (!page)
                        goto free_pages;
                bpage->page = page_address(page);
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 2d0ffcc49dba..42b9355033d4 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -7774,6 +7774,7 @@ static int instance_rmdir(const char *name)
        }
        kfree(tr->topts);
+        free_cpumask_var(tr->tracing_cpumask);
        kfree(tr->name);
        kfree(tr);
diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
index 6ade1c55cc3a..490ba229931d 100644
--- a/kernel/trace/trace.h
+++ b/kernel/trace/trace.h
@@ -1210,9 +1210,9 @@ struct ftrace_event_field {
 struct event_filter {
        int                     n_preds;        /* Number assigned */
        int                     a_preds;        /* allocated */
-        struct filter_pred      *preds;
+        struct filter_pred __rcu        *preds;
-        struct filter_pred      *root;
+        struct filter_pred __rcu        *root;
-        char                    *filter_string;
+        char                            *filter_string;
 };
 struct event_subsystem {
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index f0f3447e8aa4..861ae2a165f4 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -34,11 +34,11 @@ static struct lock_class_key bridge_netdev_addr_lock_key;
 netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
 {
        struct net_bridge *br = netdev_priv(dev);
-        const unsigned char *dest = skb->data;
        struct net_bridge_fdb_entry *dst;
        struct net_bridge_mdb_entry *mdst;
        struct pcpu_sw_netstats *brstats = this_cpu_ptr(br->stats);
        const struct nf_br_ops *nf_ops;
+        const unsigned char *dest;
        u16 vid = 0;
        rcu_read_lock();
@@ -61,6 +61,7 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
        if (!br_allowed_ingress(br, br_vlan_group_rcu(br), skb, &vid))
                goto out;
+        dest = eth_hdr(skb)->h_dest;
        if (is_broadcast_ether_addr(dest)) {
                br_flood(br, skb, BR_PKT_BROADCAST, false, true);
        } else if (is_multicast_ether_addr(dest)) {
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index 013f2290bfa5..7637f58c1226 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -131,11 +131,11 @@ static void br_do_proxy_arp(struct sk_buff *skb, struct net_bridge *br,
 int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
 {
        struct net_bridge_port *p = br_port_get_rcu(skb->dev);
-        const unsigned char *dest = eth_hdr(skb)->h_dest;
        enum br_pkt_type pkt_type = BR_PKT_UNICAST;
        struct net_bridge_fdb_entry *dst = NULL;
        struct net_bridge_mdb_entry *mdst;
        bool local_rcv, mcast_hit = false;
+        const unsigned char *dest;
        struct net_bridge *br;
        u16 vid = 0;
@@ -153,6 +153,7 @@ int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb
                br_fdb_update(br, p, eth_hdr(skb)->h_source, vid, false);
        local_rcv = !!(br->dev->flags & IFF_PROMISC);
+        dest = eth_hdr(skb)->h_dest;
        if (is_multicast_ether_addr(dest)) {
                /* by definition the broadcast is also a multicast address */
                if (is_broadcast_ether_addr(dest)) {
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index 0c31035bbfee..b7cc615d42ef 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -3203,8 +3203,10 @@ static struct ceph_msg_data *ceph_msg_data_create(enum ceph_msg_data_type type)
                return NULL;
        data = kmem_cache_zalloc(ceph_msg_data_cache, GFP_NOFS);
-        if (data)
+        if (!data)
-                data->type = type;
+                return NULL;
+        data->type = type;
        INIT_LIST_HEAD(&data->links);
        return data;
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index 86a9737d8e3f..901bb8221366 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -5310,7 +5310,10 @@ static int invalidate_authorizer(struct ceph_connection *con)
 static void osd_reencode_message(struct ceph_msg *msg)
 {
-        encode_request_finish(msg);
+        int type = le16_to_cpu(msg->hdr.type);
+        if (type == CEPH_MSG_OSD_OP)
+                encode_request_finish(msg);
 }
 static int osd_sign_message(struct ceph_msg *msg)
diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
index 864789c5974e..64ae9f89773a 100644
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -338,7 +338,7 @@ static void crush_finalize(struct crush_map *c)
 static struct crush_map *crush_decode(void *pbyval, void *end)
 {
        struct crush_map *c;
-        int err = -EINVAL;
+        int err;
        int i, j;
        void **p = &pbyval;
        void *start = pbyval;
@@ -407,7 +407,6 @@ static struct crush_map *crush_decode(void *pbyval, void *end)
                        size = sizeof(struct crush_bucket_straw2);
                        break;
                default:
-                        err = -EINVAL;
                        goto bad;
                }
                BUG_ON(size == 0);
@@ -439,31 +438,31 @@ static struct crush_map *crush_decode(void *pbyval, void *end)
                        err = crush_decode_uniform_bucket(p, end,
                                  (struct crush_bucket_uniform *)b);
                        if (err < 0)
-                                goto bad;
+                                goto fail;
                        break;
                case CRUSH_BUCKET_LIST:
                        err = crush_decode_list_bucket(p, end,
                               (struct crush_bucket_list *)b);
                        if (err < 0)
-                                goto bad;
+                                goto fail;
                        break;
                case CRUSH_BUCKET_TREE:
                        err = crush_decode_tree_bucket(p, end,
                                (struct crush_bucket_tree *)b);
                        if (err < 0)
-                                goto bad;
+                                goto fail;
                        break;
                case CRUSH_BUCKET_STRAW:
                        err = crush_decode_straw_bucket(p, end,
                                (struct crush_bucket_straw *)b);
                        if (err < 0)
-                                goto bad;
+                                goto fail;
                        break;
                case CRUSH_BUCKET_STRAW2:
                        err = crush_decode_straw2_bucket(p, end,
                                (struct crush_bucket_straw2 *)b);
                        if (err < 0)
-                                goto bad;
+                                goto fail;
                        break;
                }
        }
@@ -474,7 +473,6 @@ static struct crush_map *crush_decode(void *pbyval, void *end)
                u32 yes;
                struct crush_rule *r;
-                err = -EINVAL;
                ceph_decode_32_safe(p, end, yes, bad);
                if (!yes) {
                        dout("crush_decode NO rule %d off %x %p to %p\n",
@@ -489,7 +487,6 @@ static struct crush_map *crush_decode(void *pbyval, void *end)
                /* len */
                ceph_decode_32_safe(p, end, yes, bad);
 #if BITS_PER_LONG == 32
-                err = -EINVAL;
                if (yes > (ULONG_MAX - sizeof(*r))
                          / sizeof(struct crush_rule_step))
                        goto bad;
@@ -557,7 +554,7 @@ static struct crush_map *crush_decode(void *pbyval, void *end)
        if (*p != end) {
                err = decode_choose_args(p, end, c);
                if (err)
-                        goto bad;
+                        goto fail;
        }
 done:
@@ -567,10 +564,14 @@ done:
 badmem:
        err = -ENOMEM;
-bad:
+fail:
        dout("crush_decode fail %d\n", err);
        crush_destroy(c);
        return ERR_PTR(err);
+bad:
+        err = -EINVAL;
+        goto fail;
 }
 int ceph_pg_compare(const struct ceph_pg *lhs, const struct ceph_pg *rhs)
@@ -1399,7 +1400,7 @@ static struct ceph_pg_mapping *__decode_pg_upmap_items(void **p, void *end,
                return ERR_PTR(-EINVAL);
        ceph_decode_need(p, end, 2 * len * sizeof(u32), e_inval);
-        pg = kzalloc(sizeof(*pg) + 2 * len * sizeof(u32), GFP_NOIO);
+        pg = alloc_pg_mapping(2 * len * sizeof(u32));
        if (!pg)
                return ERR_PTR(-ENOMEM);
@@ -1544,7 +1545,7 @@ static int osdmap_decode(void **p, void *end, struct ceph_osdmap *map)
        if (struct_v >= 3) {
                /* erasure_code_profiles */
                ceph_decode_skip_map_of_map(p, end, string, string, string,
-                                            bad);
+                                            e_inval);
        }
        if (struct_v >= 4) {
@@ -1825,9 +1826,9 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
        if (struct_v >= 3) {
                /* new_erasure_code_profiles */
                ceph_decode_skip_map_of_map(p, end, string, string, string,
-                                            bad);
+                                            e_inval);
                /* old_erasure_code_profiles */
-                ceph_decode_skip_set(p, end, string, bad);
+                ceph_decode_skip_set(p, end, string, e_inval);
        }
        if (struct_v >= 4) {
diff --git a/net/core/dev_ioctl.c b/net/core/dev_ioctl.c
index 82fd4c9c4a1b..06b147d7d9e2 100644
--- a/net/core/dev_ioctl.c
+++ b/net/core/dev_ioctl.c
@@ -28,6 +28,7 @@ static int dev_ifname(struct net *net, struct ifreq __user *arg)
        if (copy_from_user(&ifr, arg, sizeof(struct ifreq)))
                return -EFAULT;
+        ifr.ifr_name[IFNAMSIZ-1] = 0;
        error = netdev_get_name(net, ifr.ifr_name, ifr.ifr_ifindex);
        if (error)
@@ -424,6 +425,8 @@ int dev_ioctl(struct net *net, unsigned int cmd, void __user *arg)
                if (copy_from_user(&iwr, arg, sizeof(iwr)))
                        return -EFAULT;
+                iwr.ifr_name[sizeof(iwr.ifr_name) - 1] = 0;
                return wext_handle_ioctl(net, &iwr, cmd, arg);
        }
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index a0093e1b0235..fdcb1bcd2afa 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -400,6 +400,7 @@ int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr *nlh,
                err = -ENOMEM;
                goto errout;
        }
+        refcount_set(&rule->refcnt, 1);
        rule->fr_net = net;
        rule->pref = tb[FRA_PRIORITY] ? nla_get_u32(tb[FRA_PRIORITY])
@@ -517,8 +518,6 @@ int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr *nlh,
                last = r;
        }
-        refcount_set(&rule->refcnt, 1);
        if (last)
                list_add_rcu(&rule->list, &last->list);
        else
diff --git a/net/core/filter.c b/net/core/filter.c
index c7f737058d89..f44fc22fd45a 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2248,7 +2248,7 @@ static int bpf_skb_adjust_net(struct sk_buff *skb, s32 len_diff)
                       bpf_skb_net_grow(skb, len_diff_abs);
        bpf_compute_data_end(skb);
-        return 0;
+        return ret;
 }
 BPF_CALL_4(bpf_skb_adjust_room, struct sk_buff *, skb, s32, len_diff,
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index d3408a693166..8357f164c660 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -277,7 +277,7 @@ static void zap_completion_queue(void)
                        struct sk_buff *skb = clist;
                        clist = clist->next;
                        if (!skb_irq_freeable(skb)) {
-                                refcount_inc(&skb->users);
+                                refcount_set(&skb->users, 1);
                                dev_kfree_skb_any(skb); /* put this one back */
                        } else {
                                __kfree_skb(skb);
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index d1ba90980be1..9201e3621351 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -2031,7 +2031,8 @@ static int do_setlink(const struct sk_buff *skb,
                struct sockaddr *sa;
                int len;
-                len = sizeof(sa_family_t) + dev->addr_len;
+                len = sizeof(sa_family_t) + max_t(size_t, dev->addr_len,
+                                                  sizeof(*sa));
                sa = kmalloc(len, GFP_KERNEL);
                if (!sa) {
                        err = -ENOMEM;
@@ -4241,6 +4242,7 @@ static int rtnetlink_event(struct notifier_block *this, unsigned long event, voi
        switch (event) {
        case NETDEV_REBOOT:
+        case NETDEV_CHANGEADDR:
        case NETDEV_CHANGENAME:
        case NETDEV_FEAT_CHANGE:
        case NETDEV_BONDING_FAILOVER:
diff --git a/net/dccp/input.c b/net/dccp/input.c
index 4a05d7876850..fa6be9750bb4 100644
--- a/net/dccp/input.c
+++ b/net/dccp/input.c
@@ -126,7 +126,7 @@ static int dccp_rcv_closereq(struct sock *sk, struct sk_buff *skb)
 static u16 dccp_reset_code_convert(const u8 code)
 {
-        const u16 error_code[] = {
+        static const u16 error_code[] = {
        [DCCP_RESET_CODE_CLOSED]             = 0,       /* normal termination */
        [DCCP_RESET_CODE_UNSPECIFIED]        = 0,       /* nothing known */
        [DCCP_RESET_CODE_ABORTED]            = ECONNRESET,
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 4e678fa892dd..044d2a159a3c 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -1334,13 +1334,14 @@ static struct pernet_operations fib_net_ops = {
 void __init ip_fib_init(void)
 {
-        rtnl_register(PF_INET, RTM_NEWROUTE, inet_rtm_newroute, NULL, NULL);
+        fib_trie_init();
-        rtnl_register(PF_INET, RTM_DELROUTE, inet_rtm_delroute, NULL, NULL);
-        rtnl_register(PF_INET, RTM_GETROUTE, NULL, inet_dump_fib, NULL);
        register_pernet_subsys(&fib_net_ops);
        register_netdevice_notifier(&fib_netdev_notifier);
        register_inetaddr_notifier(&fib_inetaddr_notifier);
-        fib_trie_init();
+        rtnl_register(PF_INET, RTM_NEWROUTE, inet_rtm_newroute, NULL, NULL);
+        rtnl_register(PF_INET, RTM_DELROUTE, inet_rtm_delroute, NULL, NULL);
+        rtnl_register(PF_INET, RTM_GETROUTE, NULL, inet_dump_fib, NULL);
 }
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 7eb252dcecee..50c74cd890bc 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -599,6 +599,7 @@ int ip_do_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
        hlen = iph->ihl * 4;
        mtu = mtu - hlen;       /* Size of data space */
        IPCB(skb)->flags |= IPSKB_FRAG_COMPLETE;
+        ll_rs = LL_RESERVED_SPACE(rt->dst.dev);
        /* When frag_list is given, use it. First, check its validity:
         * some transformers could create wrong frag_list or break existing
@@ -614,14 +615,15 @@ int ip_do_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
                if (first_len - hlen > mtu ||
                    ((first_len - hlen) & 7) ||
                    ip_is_fragment(iph) ||
-                    skb_cloned(skb))
+                    skb_cloned(skb) ||
+                    skb_headroom(skb) < ll_rs)
                        goto slow_path;
                skb_walk_frags(skb, frag) {
                        /* Correct geometry. */
                        if (frag->len > mtu ||
                            ((frag->len & 7) && frag->next) ||
-                            skb_headroom(frag) < hlen)
+                            skb_headroom(frag) < hlen + ll_rs)
                                goto slow_path_clean;
                        /* Partially cloned skb? */
@@ -711,8 +713,6 @@ slow_path:
        left = skb->len - hlen;         /* Space per frame */
        ptr = hlen;             /* Where to start from */
-        ll_rs = LL_RESERVED_SPACE(rt->dst.dev);
        /*
         *      Fragment the datagram.
         */
diff --git a/net/ipv4/netfilter/nf_tables_arp.c b/net/ipv4/netfilter/nf_tables_arp.c
index 805c8ddfe860..4bbc273b45e8 100644
--- a/net/ipv4/netfilter/nf_tables_arp.c
+++ b/net/ipv4/netfilter/nf_tables_arp.c
@@ -72,8 +72,7 @@ static const struct nf_chain_type filter_arp = {
        .family         = NFPROTO_ARP,
        .owner          = THIS_MODULE,
        .hook_mask      = (1 << NF_ARP_IN) |
-                          (1 << NF_ARP_OUT) |
+                          (1 << NF_ARP_OUT),
-                          (1 << NF_ARP_FORWARD),
 };
 static int __init nf_tables_arp_init(void)
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index 0905cf04c2a4..03ad8778c395 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -335,6 +335,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb)
        treq->rcv_isn           = ntohl(th->seq) - 1;
        treq->snt_isn           = cookie;
        treq->ts_off            = 0;
+        treq->txhash            = net_tx_rndhash();
        req->mss                = mss;
        ireq->ir_num            = ntohs(th->dest);
        ireq->ir_rmt_port       = th->source;
diff --git a/net/ipv4/tcp_bbr.c b/net/ipv4/tcp_bbr.c
index dbcc9352a48f..69ee877574d0 100644
--- a/net/ipv4/tcp_bbr.c
+++ b/net/ipv4/tcp_bbr.c
@@ -112,7 +112,8 @@ struct bbr {
                cwnd_gain:10,   /* current gain for setting cwnd */
                full_bw_cnt:3,  /* number of rounds without large bw gains */
                cycle_idx:3,    /* current index in pacing_gain cycle array */
-                unused_b:6;
+                has_seen_rtt:1, /* have we seen an RTT sample yet? */
+                unused_b:5;
        u32     prior_cwnd;     /* prior cwnd upon entering loss recovery */
        u32     full_bw;        /* recent bw, to estimate if pipe is full */
 };
@@ -211,6 +212,35 @@ static u64 bbr_rate_bytes_per_sec(struct sock *sk, u64 rate, int gain)
        return rate >> BW_SCALE;
 }
+/* Convert a BBR bw and gain factor to a pacing rate in bytes per second. */
+static u32 bbr_bw_to_pacing_rate(struct sock *sk, u32 bw, int gain)
+{
+        u64 rate = bw;
+        rate = bbr_rate_bytes_per_sec(sk, rate, gain);
+        rate = min_t(u64, rate, sk->sk_max_pacing_rate);
+        return rate;
+}
+/* Initialize pacing rate to: high_gain * init_cwnd / RTT. */
+static void bbr_init_pacing_rate_from_rtt(struct sock *sk)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+        struct bbr *bbr = inet_csk_ca(sk);
+        u64 bw;
+        u32 rtt_us;
+        if (tp->srtt_us) {              /* any RTT sample yet? */
+                rtt_us = max(tp->srtt_us >> 3, 1U);
+                bbr->has_seen_rtt = 1;
+        } else {                         /* no RTT sample yet */
+                rtt_us = USEC_PER_MSEC;  /* use nominal default RTT */
+        }
+        bw = (u64)tp->snd_cwnd * BW_UNIT;
+        do_div(bw, rtt_us);
+        sk->sk_pacing_rate = bbr_bw_to_pacing_rate(sk, bw, bbr_high_gain);
+}
 /* Pace using current bw estimate and a gain factor. In order to help drive the
 * network toward lower queues while maintaining high utilization and low
 * latency, the average pacing rate aims to be slightly (~1%) lower than the
@@ -220,12 +250,13 @@ static u64 bbr_rate_bytes_per_sec(struct sock *sk, u64 rate, int gain)
 */
 static void bbr_set_pacing_rate(struct sock *sk, u32 bw, int gain)
 {
+        struct tcp_sock *tp = tcp_sk(sk);
        struct bbr *bbr = inet_csk_ca(sk);
-        u64 rate = bw;
+        u32 rate = bbr_bw_to_pacing_rate(sk, bw, gain);
-        rate = bbr_rate_bytes_per_sec(sk, rate, gain);
+        if (unlikely(!bbr->has_seen_rtt && tp->srtt_us))
-        rate = min_t(u64, rate, sk->sk_max_pacing_rate);
+                bbr_init_pacing_rate_from_rtt(sk);
-        if (bbr->mode != BBR_STARTUP || rate > sk->sk_pacing_rate)
+        if (bbr_full_bw_reached(sk) || rate > sk->sk_pacing_rate)
                sk->sk_pacing_rate = rate;
 }
@@ -798,7 +829,6 @@ static void bbr_init(struct sock *sk)
 {
        struct tcp_sock *tp = tcp_sk(sk);
        struct bbr *bbr = inet_csk_ca(sk);
-        u64 bw;
        bbr->prior_cwnd = 0;
        bbr->tso_segs_goal = 0;  /* default segs per skb until first ACK */
@@ -814,11 +844,8 @@ static void bbr_init(struct sock *sk)
        minmax_reset(&bbr->bw, bbr->rtt_cnt, 0);  /* init max bw to 0 */
-        /* Initialize pacing rate to: high_gain * init_cwnd / RTT. */
+        bbr->has_seen_rtt = 0;
-        bw = (u64)tp->snd_cwnd * BW_UNIT;
+        bbr_init_pacing_rate_from_rtt(sk);
-        do_div(bw, (tp->srtt_us >> 3) ? : USEC_PER_MSEC);
-        sk->sk_pacing_rate = 0;         /* force an update of sk_pacing_rate */
-        bbr_set_pacing_rate(sk, bw, bbr_high_gain);
        bbr->restore_cwnd = 0;
        bbr->round_start = 0;
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 25294d43e147..b057653ceca9 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1388,6 +1388,11 @@ void skb_consume_udp(struct sock *sk, struct sk_buff *skb, int len)
                unlock_sock_fast(sk, slow);
        }
+        /* we cleared the head states previously only if the skb lacks any IP
+         * options, see __udp_queue_rcv_skb().
+         */
+        if (unlikely(IPCB(skb)->opt.optlen > 0))
+                skb_release_head_state(skb);
        consume_stateless_skb(skb);
 }
 EXPORT_SYMBOL_GPL(skb_consume_udp);
@@ -1779,8 +1784,12 @@ static int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
                sk_mark_napi_id_once(sk, skb);
        }
-        /* clear all pending head states while they are hot in the cache */
+        /* At recvmsg() time we need skb->dst to process IP options-related
-        skb_release_head_state(skb);
+         * cmsg, elsewhere can we clear all pending head states while they are
+         * hot in the cache
+         */
+        if (likely(IPCB(skb)->opt.optlen == 0))
+                skb_release_head_state(skb);
        rc = __udp_enqueue_schedule_skb(sk, skb);
        if (rc < 0) {
diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c
index e9065b8d3af8..abb2c307fbe8 100644
--- a/net/ipv6/output_core.c
+++ b/net/ipv6/output_core.c
@@ -78,7 +78,7 @@ EXPORT_SYMBOL(ipv6_select_ident);
 int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
 {
-        u16 offset = sizeof(struct ipv6hdr);
+        unsigned int offset = sizeof(struct ipv6hdr);
        unsigned int packet_len = skb_tail_pointer(skb) -
                skb_network_header(skb);
        int found_rhdr = 0;
@@ -86,6 +86,7 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
        while (offset <= packet_len) {
                struct ipv6_opt_hdr *exthdr;
+                unsigned int len;
                switch (**nexthdr) {
@@ -111,7 +112,10 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
                exthdr = (struct ipv6_opt_hdr *)(skb_network_header(skb) +
                                                 offset);
-                offset += ipv6_optlen(exthdr);
+                len = ipv6_optlen(exthdr);
+                if (len + offset >= IPV6_MAXPLEN)
+                        return -EINVAL;
+                offset += len;
                *nexthdr = &exthdr->nexthdr;
        }
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index 7b75b0620730..4e7817abc0b9 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -216,6 +216,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
        treq->rcv_isn = ntohl(th->seq) - 1;
        treq->snt_isn = cookie;
        treq->ts_off = 0;
+        treq->txhash = net_tx_rndhash();
        /*
         * We need to lookup the dst_entry to get the correct window size.
diff --git a/net/netfilter/core.c b/net/netfilter/core.c
index 552d606e57ca..974cf2a3795a 100644
--- a/net/netfilter/core.c
+++ b/net/netfilter/core.c
@@ -227,114 +227,6 @@ void nf_unregister_net_hooks(struct net *net, const struct nf_hook_ops *reg,
 }
 EXPORT_SYMBOL(nf_unregister_net_hooks);
-static LIST_HEAD(nf_hook_list);
-static int _nf_register_hook(struct nf_hook_ops *reg)
-{
-        struct net *net, *last;
-        int ret;
-        for_each_net(net) {
-                ret = nf_register_net_hook(net, reg);
-                if (ret && ret != -ENOENT)
-                        goto rollback;
-        }
-        list_add_tail(&reg->list, &nf_hook_list);
-        return 0;
-rollback:
-        last = net;
-        for_each_net(net) {
-                if (net == last)
-                        break;
-                nf_unregister_net_hook(net, reg);
-        }
-        return ret;
-}
-int nf_register_hook(struct nf_hook_ops *reg)
-{
-        int ret;
-        rtnl_lock();
-        ret = _nf_register_hook(reg);
-        rtnl_unlock();
-        return ret;
-}
-EXPORT_SYMBOL(nf_register_hook);
-static void _nf_unregister_hook(struct nf_hook_ops *reg)
-{
-        struct net *net;
-        list_del(&reg->list);
-        for_each_net(net)
-                nf_unregister_net_hook(net, reg);
-}
-void nf_unregister_hook(struct nf_hook_ops *reg)
-{
-        rtnl_lock();
-        _nf_unregister_hook(reg);
-        rtnl_unlock();
-}
-EXPORT_SYMBOL(nf_unregister_hook);
-int nf_register_hooks(struct nf_hook_ops *reg, unsigned int n)
-{
-        unsigned int i;
-        int err = 0;
-        for (i = 0; i < n; i++) {
-                err = nf_register_hook(&reg[i]);
-                if (err)
-                        goto err;
-        }
-        return err;
-err:
-        if (i > 0)
-                nf_unregister_hooks(reg, i);
-        return err;
-}
-EXPORT_SYMBOL(nf_register_hooks);
-/* Caller MUST take rtnl_lock() */
-int _nf_register_hooks(struct nf_hook_ops *reg, unsigned int n)
-{
-        unsigned int i;
-        int err = 0;
-        for (i = 0; i < n; i++) {
-                err = _nf_register_hook(&reg[i]);
-                if (err)
-                        goto err;
-        }
-        return err;
-err:
-        if (i > 0)
-                _nf_unregister_hooks(reg, i);
-        return err;
-}
-EXPORT_SYMBOL(_nf_register_hooks);
-void nf_unregister_hooks(struct nf_hook_ops *reg, unsigned int n)
-{
-        while (n-- > 0)
-                nf_unregister_hook(&reg[n]);
-}
-EXPORT_SYMBOL(nf_unregister_hooks);
-/* Caller MUST take rtnl_lock */
-void _nf_unregister_hooks(struct nf_hook_ops *reg, unsigned int n)
-{
-        while (n-- > 0)
-                _nf_unregister_hook(&reg[n]);
-}
-EXPORT_SYMBOL(_nf_unregister_hooks);
 /* Returns 1 if okfn() needs to be executed by the caller,
 * -EPERM for NF_DROP, 0 otherwise.  Caller must hold rcu_read_lock. */
 int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state,
@@ -450,40 +342,9 @@ void (*nf_nat_decode_session_hook)(struct sk_buff *, struct flowi *);
 EXPORT_SYMBOL(nf_nat_decode_session_hook);
 #endif
-static int nf_register_hook_list(struct net *net)
-{
-        struct nf_hook_ops *elem;
-        int ret;
-        rtnl_lock();
-        list_for_each_entry(elem, &nf_hook_list, list) {
-                ret = nf_register_net_hook(net, elem);
-                if (ret && ret != -ENOENT)
-                        goto out_undo;
-        }
-        rtnl_unlock();
-        return 0;
-out_undo:
-        list_for_each_entry_continue_reverse(elem, &nf_hook_list, list)
-                nf_unregister_net_hook(net, elem);
-        rtnl_unlock();
-        return ret;
-}
-static void nf_unregister_hook_list(struct net *net)
-{
-        struct nf_hook_ops *elem;
-        rtnl_lock();
-        list_for_each_entry(elem, &nf_hook_list, list)
-                nf_unregister_net_hook(net, elem);
-        rtnl_unlock();
-}
 static int __net_init netfilter_net_init(struct net *net)
 {
-        int i, h, ret;
+        int i, h;
        for (i = 0; i < ARRAY_SIZE(net->nf.hooks); i++) {
                for (h = 0; h < NF_MAX_HOOKS; h++)
@@ -500,16 +361,12 @@ static int __net_init netfilter_net_init(struct net *net)
                return -ENOMEM;
        }
 #endif
-        ret = nf_register_hook_list(net);
-        if (ret)
-                remove_proc_entry("netfilter", net->proc_net);
-        return ret;
+        return 0;
 }
 static void __net_exit netfilter_net_exit(struct net *net)
 {
-        nf_unregister_hook_list(net);
        remove_proc_entry("netfilter", net->proc_net);
 }
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index e03d16ed550d..899c2c36da13 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -422,7 +422,7 @@ static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect)
        h = nf_ct_expect_dst_hash(net, &expect->tuple);
        hlist_for_each_entry_safe(i, next, &nf_ct_expect_hash[h], hnode) {
                if (expect_matches(i, expect)) {
-                        if (nf_ct_remove_expect(expect))
+                        if (nf_ct_remove_expect(i))
                                break;
                } else if (expect_clash(i, expect)) {
                        ret = -EBUSY;
diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index 832c5a08d9a5..eb541786ccb7 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -222,20 +222,21 @@ find_appropriate_src(struct net *net,
                .tuple = tuple,
                .zone = zone
        };
-        struct rhlist_head *hl;
+        struct rhlist_head *hl, *h;
        hl = rhltable_lookup(&nf_nat_bysource_table, &key,
                             nf_nat_bysource_params);
-        if (!hl)
-                return 0;
-        ct = container_of(hl, typeof(*ct), nat_bysource);
+        rhl_for_each_entry_rcu(ct, h, hl, nat_bysource) {
+                nf_ct_invert_tuplepr(result,
+                                     &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
+                result->dst = tuple->dst;
-        nf_ct_invert_tuplepr(result,
+                if (in_range(l3proto, l4proto, result, range))
-                             &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
+                        return 1;
-        result->dst = tuple->dst;
+        }
-        return in_range(l3proto, l4proto, result, range);
+        return 0;
 }
 /* For [FUTURE] fragmentation handling, we want the least-used
diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
index 92b05e188fd1..733d3e4a30d8 100644
--- a/net/netfilter/nfnetlink.c
+++ b/net/netfilter/nfnetlink.c
@@ -472,8 +472,7 @@ static void nfnetlink_rcv_skb_batch(struct sk_buff *skb, struct nlmsghdr *nlh)
        if (msglen > skb->len)
                msglen = skb->len;
-        if (nlh->nlmsg_len < NLMSG_HDRLEN ||
+        if (skb->len < NLMSG_HDRLEN + sizeof(struct nfgenmsg))
-            skb->len < NLMSG_HDRLEN + sizeof(struct nfgenmsg))
                return;
        err = nla_parse(cda, NFNL_BATCH_MAX, attr, attrlen, nfnl_batch_policy,
@@ -500,7 +499,8 @@ static void nfnetlink_rcv(struct sk_buff *skb)
 {
        struct nlmsghdr *nlh = nlmsg_hdr(skb);
-        if (nlh->nlmsg_len < NLMSG_HDRLEN ||
+        if (skb->len < NLMSG_HDRLEN ||
+            nlh->nlmsg_len < NLMSG_HDRLEN ||
            skb->len < nlh->nlmsg_len)
                return;
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index 08679ebb3068..e3c4c6c3fef7 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -629,6 +629,34 @@ ovs_ct_find_existing(struct net *net, const struct nf_conntrack_zone *zone,
        return ct;
 }
+static
+struct nf_conn *ovs_ct_executed(struct net *net,
+                                const struct sw_flow_key *key,
+                                const struct ovs_conntrack_info *info,
+                                struct sk_buff *skb,
+                                bool *ct_executed)
+{
+        struct nf_conn *ct = NULL;
+        /* If no ct, check if we have evidence that an existing conntrack entry
+         * might be found for this skb.  This happens when we lose a skb->_nfct
+         * due to an upcall, or if the direction is being forced.  If the
+         * connection was not confirmed, it is not cached and needs to be run
+         * through conntrack again.
+         */
+        *ct_executed = (key->ct_state & OVS_CS_F_TRACKED) &&
+                       !(key->ct_state & OVS_CS_F_INVALID) &&
+                       (key->ct_zone == info->zone.id);
+        if (*ct_executed || (!key->ct_state && info->force)) {
+                ct = ovs_ct_find_existing(net, &info->zone, info->family, skb,
+                                          !!(key->ct_state &
+                                          OVS_CS_F_NAT_MASK));
+        }
+        return ct;
+}
 /* Determine whether skb->_nfct is equal to the result of conntrack lookup. */
 static bool skb_nfct_cached(struct net *net,
                            const struct sw_flow_key *key,
@@ -637,24 +665,17 @@ static bool skb_nfct_cached(struct net *net,
 {
        enum ip_conntrack_info ctinfo;
        struct nf_conn *ct;
+        bool ct_executed = true;
        ct = nf_ct_get(skb, &ctinfo);
-        /* If no ct, check if we have evidence that an existing conntrack entry
-         * might be found for this skb.  This happens when we lose a skb->_nfct
-         * due to an upcall.  If the connection was not confirmed, it is not
-         * cached and needs to be run through conntrack again.
-         */
-        if (!ct && key->ct_state & OVS_CS_F_TRACKED &&
-            !(key->ct_state & OVS_CS_F_INVALID) &&
-            key->ct_zone == info->zone.id) {
-                ct = ovs_ct_find_existing(net, &info->zone, info->family, skb,
-                                          !!(key->ct_state
-                                             & OVS_CS_F_NAT_MASK));
-                if (ct)
-                        nf_ct_get(skb, &ctinfo);
-        }
        if (!ct)
+                ct = ovs_ct_executed(net, key, info, skb, &ct_executed);
+        if (ct)
+                nf_ct_get(skb, &ctinfo);
+        else
                return false;
        if (!net_eq(net, read_pnet(&ct->ct_net)))
                return false;
        if (!nf_ct_zone_equal_any(info->ct, nf_ct_zone(ct)))
@@ -679,7 +700,7 @@ static bool skb_nfct_cached(struct net *net,
                return false;
        }
-        return true;
+        return ct_executed;
 }
 #ifdef CONFIG_NF_NAT_NEEDED
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index e3beb28203eb..008bb34ee324 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -214,6 +214,7 @@ static void prb_clear_rxhash(struct tpacket_kbdq_core *,
 static void prb_fill_vlan_info(struct tpacket_kbdq_core *,
                struct tpacket3_hdr *);
 static void packet_flush_mclist(struct sock *sk);
+static void packet_pick_tx_queue(struct net_device *dev, struct sk_buff *skb);
 struct packet_skb_cb {
        union {
@@ -260,6 +261,7 @@ static int packet_direct_xmit(struct sk_buff *skb)
        if (skb != orig_skb)
                goto drop;
+        packet_pick_tx_queue(dev, skb);
        txq = skb_get_tx_queue(dev, skb);
        local_bh_disable();
@@ -2747,8 +2749,6 @@ tpacket_error:
                        goto tpacket_error;
                }
-                packet_pick_tx_queue(dev, skb);
                skb->destructor = tpacket_destruct_skb;
                __packet_set_status(po, ph, TP_STATUS_SENDING);
                packet_inc_pending(&po->tx_ring);
@@ -2931,8 +2931,6 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
        skb->priority = sk->sk_priority;
        skb->mark = sockc.mark;
-        packet_pick_tx_queue(dev, skb);
        if (po->has_vnet_hdr) {
                err = virtio_net_hdr_to_skb(skb, &vnet_hdr, vio_le());
                if (err)
diff --git a/net/rds/send.c b/net/rds/send.c
index e81aa176f4e2..41b9f0f5bb9c 100644
--- a/net/rds/send.c
+++ b/net/rds/send.c
@@ -170,8 +170,8 @@ restart:
         * The acquire_in_xmit() check above ensures that only one
         * caller can increment c_send_gen at any time.
         */
-        cp->cp_send_gen++;
+        send_gen = READ_ONCE(cp->cp_send_gen) + 1;
-        send_gen = cp->cp_send_gen;
+        WRITE_ONCE(cp->cp_send_gen, send_gen);
        /*
         * rds_conn_shutdown() sets the conn state and then tests RDS_IN_XMIT,
@@ -431,7 +431,7 @@ over_batch:
                smp_mb();
                if ((test_bit(0, &conn->c_map_queued) ||
                     !list_empty(&cp->cp_send_queue)) &&
-                    send_gen == cp->cp_send_gen) {
+                        send_gen == READ_ONCE(cp->cp_send_gen)) {
                        rds_stats_inc(s_send_lock_queue_raced);
                        if (batch_count < send_batch_count)
                                goto restart;
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index aed6cf2e9fd8..f2e9ed34a963 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -835,7 +835,7 @@ out_nlmsg_trim:
 }
 static int
-act_get_notify(struct net *net, u32 portid, struct nlmsghdr *n,
+tcf_get_notify(struct net *net, u32 portid, struct nlmsghdr *n,
               struct list_head *actions, int event)
 {
        struct sk_buff *skb;
@@ -1018,7 +1018,7 @@ tca_action_gd(struct net *net, struct nlattr *nla, struct nlmsghdr *n,
        }
        if (event == RTM_GETACTION)
-                ret = act_get_notify(net, portid, n, &actions, event);
+                ret = tcf_get_notify(net, portid, n, &actions, event);
        else { /* delete */
                ret = tcf_del_notify(net, n, &actions, portid);
                if (ret)
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 4e16b02ed832..6110447fe51d 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -228,7 +228,7 @@ struct sctp_chunk *sctp_make_init(const struct sctp_association *asoc,
        sctp_adaptation_ind_param_t aiparam;
        sctp_supported_ext_param_t ext_param;
        int num_ext = 0;
-        __u8 extensions[3];
+        __u8 extensions[4];
        struct sctp_paramhdr *auth_chunks = NULL,
                        *auth_hmacs = NULL;
@@ -396,7 +396,7 @@ struct sctp_chunk *sctp_make_init_ack(const struct sctp_association *asoc,
        sctp_adaptation_ind_param_t aiparam;
        sctp_supported_ext_param_t ext_param;
        int num_ext = 0;
-        __u8 extensions[3];
+        __u8 extensions[4];
        struct sctp_paramhdr *auth_chunks = NULL,
                        *auth_hmacs = NULL,
                        *auth_random = NULL;
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index d5b54c020dec..4f154d388748 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -1624,6 +1624,8 @@ static void xs_tcp_state_change(struct sock *sk)
                if (test_and_clear_bit(XPRT_SOCK_CONNECTING,
                                        &transport->sock_state))
                        xprt_clear_connecting(xprt);
+                if (sk->sk_err)
+                        xprt_wake_pending_tasks(xprt, -sk->sk_err);
                xs_sock_mark_closed(xprt);
        }
 out:
diff --git a/scripts/parse-maintainers.pl b/scripts/parse-maintainers.pl
new file mode 100644
index 000000000000..a0fe34349b24
--- /dev/null
+++ b/scripts/parse-maintainers.pl
@@ -0,0 +1,77 @@
+#!/usr/bin/perl -w
+use strict;
+my %map;
+# sort comparison function
+sub by_category($$) {
+    my ($a, $b) = @_;
+    $a = uc $a;
+    $b = uc $b;
+    # This always sorts last
+    $a =~ s/THE REST/ZZZZZZ/g;
+    $b =~ s/THE REST/ZZZZZZ/g;
+    $a cmp $b;
+}
+sub alpha_output {
+    my $key;
+    my $sort_method = \&by_category;
+    my $sep = "";
+    foreach $key (sort $sort_method keys %map) {
+        if ($key ne " ") {
+            print $sep . $key . "\n";
+            $sep = "\n";
+        }
+        print $map{$key};
+    }
+}
+sub trim {
+    my $s = shift;
+    $s =~ s/\s+$//;
+    $s =~ s/^\s+//;
+    return $s;
+}
+sub file_input {
+    my $lastline = "";
+    my $case = " ";
+    $map{$case} = "";
+    while (<>) {
+        my $line = $_;
+        # Pattern line?
+        if ($line =~ m/^([A-Z]):\s*(.*)/) {
+            $line = $1 . ":\t" . trim($2) . "\n";
+            if ($lastline eq "") {
+                $map{$case} = $map{$case} . $line;
+                next;
+            }
+            $case = trim($lastline);
+            exists $map{$case} and die "Header '$case' already exists";
+            $map{$case} = $line;
+            $lastline = "";
+            next;
+        }
+        if ($case eq " ") {
+            $map{$case} = $map{$case} . $lastline;
+            $lastline = $line;
+            next;
+        }
+        trim($lastline) eq "" or die ("Odd non-pattern line '$lastline' for '$case'");
+        $lastline = $line;
+    }
+    $map{$case} = $map{$case} . $lastline;
+}
+&file_input;
+&alpha_output;
+exit(0);
diff --git a/security/keys/internal.h b/security/keys/internal.h
index 91bc6214ae57..1c02c6547038 100644
--- a/security/keys/internal.h
+++ b/security/keys/internal.h
@@ -198,7 +198,7 @@ struct request_key_auth {
        void                    *callout_info;
        size_t                  callout_len;
        pid_t                   pid;
-};
+} __randomize_layout;
 extern struct key_type key_type_request_key_auth;
 extern struct key *request_key_auth_new(struct key *target,
diff --git a/tools/lib/bpf/bpf.c b/tools/lib/bpf/bpf.c
index 7e0405e1651d..412a7c82995a 100644
--- a/tools/lib/bpf/bpf.c
+++ b/tools/lib/bpf/bpf.c
@@ -120,7 +120,7 @@ int bpf_load_program(enum bpf_prog_type type, const struct bpf_insn *insns,
 int bpf_verify_program(enum bpf_prog_type type, const struct bpf_insn *insns,
                       size_t insns_cnt, int strict_alignment,
                       const char *license, __u32 kern_version,
-                       char *log_buf, size_t log_buf_sz)
+                       char *log_buf, size_t log_buf_sz, int log_level)
 {
        union bpf_attr attr;
@@ -131,7 +131,7 @@ int bpf_verify_program(enum bpf_prog_type type, const struct bpf_insn *insns,
        attr.license = ptr_to_u64(license);
        attr.log_buf = ptr_to_u64(log_buf);
        attr.log_size = log_buf_sz;
-        attr.log_level = 2;
+        attr.log_level = log_level;
        log_buf[0] = 0;
        attr.kern_version = kern_version;
        attr.prog_flags = strict_alignment ? BPF_F_STRICT_ALIGNMENT : 0;
diff --git a/tools/lib/bpf/bpf.h b/tools/lib/bpf/bpf.h
index 16de44a14b48..418c86e69bcb 100644
--- a/tools/lib/bpf/bpf.h
+++ b/tools/lib/bpf/bpf.h
@@ -38,7 +38,7 @@ int bpf_load_program(enum bpf_prog_type type, const struct bpf_insn *insns,
 int bpf_verify_program(enum bpf_prog_type type, const struct bpf_insn *insns,
                       size_t insns_cnt, int strict_alignment,
                       const char *license, __u32 kern_version,
-                       char *log_buf, size_t log_buf_sz);
+                       char *log_buf, size_t log_buf_sz, int log_level);
 int bpf_map_update_elem(int fd, const void *key, const void *value,
                        __u64 flags);
diff --git a/tools/perf/ui/browser.c b/tools/perf/ui/browser.c
index a4d3762cd825..83874b0e266c 100644
--- a/tools/perf/ui/browser.c
+++ b/tools/perf/ui/browser.c
@@ -704,7 +704,7 @@ static void __ui_browser__line_arrow_down(struct ui_browser *browser,
                ui_browser__gotorc(browser, row, column + 1);
                SLsmg_draw_hline(2);
-                if (row++ == 0)
+                if (++row == 0)
                        goto out;
        } else
                row = 0;
diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
index 87b431886670..413f74df08de 100644
--- a/tools/perf/util/evsel.c
+++ b/tools/perf/util/evsel.c
@@ -273,7 +273,7 @@ struct perf_evsel *perf_evsel__new_cycles(void)
        struct perf_event_attr attr = {
                .type   = PERF_TYPE_HARDWARE,
                .config = PERF_COUNT_HW_CPU_CYCLES,
-                .exclude_kernel = 1,
+                .exclude_kernel = geteuid() != 0,
        };
        struct perf_evsel *evsel;
@@ -298,8 +298,10 @@ struct perf_evsel *perf_evsel__new_cycles(void)
                goto out;
        /* use asprintf() because free(evsel) assumes name is allocated */
-        if (asprintf(&evsel->name, "cycles%.*s",
+        if (asprintf(&evsel->name, "cycles%s%s%.*s",
-                     attr.precise_ip ? attr.precise_ip + 1 : 0, ":ppp") < 0)
+                     (attr.precise_ip || attr.exclude_kernel) ? ":" : "",
+                     attr.exclude_kernel ? "u" : "",
+                     attr.precise_ip ? attr.precise_ip + 1 : 0, "ppp") < 0)
                goto error_free;
 out:
        return evsel;
diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
index 5de2b86b9880..2e9eb6aa3ce2 100644
--- a/tools/perf/util/machine.c
+++ b/tools/perf/util/machine.c
@@ -2209,7 +2209,7 @@ int machine__get_kernel_start(struct machine *machine)
        machine->kernel_start = 1ULL << 63;
        if (map) {
                err = map__load(map);
-                if (map->start)
+                if (!err)
                        machine->kernel_start = map->start;
        }
        return err;
diff --git a/tools/testing/selftests/bpf/test_align.c b/tools/testing/selftests/bpf/test_align.c
index bccebd935907..29793694cbc7 100644
--- a/tools/testing/selftests/bpf/test_align.c
+++ b/tools/testing/selftests/bpf/test_align.c
@@ -380,7 +380,7 @@ static int do_test_single(struct bpf_align_test *test)
        prog_len = probe_filter_length(prog);
        fd_prog = bpf_verify_program(prog_type ? : BPF_PROG_TYPE_SOCKET_FILTER,
                                     prog, prog_len, 1, "GPL", 0,
-                                     bpf_vlog, sizeof(bpf_vlog));
+                                     bpf_vlog, sizeof(bpf_vlog), 2);
        if (fd_prog < 0) {
                printf("Failed to load program.\n");
                printf("%s", bpf_vlog);
diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
index 404aec520812..af7d173910f4 100644
--- a/tools/testing/selftests/bpf/test_verifier.c
+++ b/tools/testing/selftests/bpf/test_verifier.c
@@ -4969,7 +4969,7 @@ static struct bpf_test tests[] = {
                        BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
                                sizeof(struct test_val), 4),
                        BPF_MOV64_IMM(BPF_REG_4, 0),
-                        BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
+                        BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
                        BPF_MOV64_IMM(BPF_REG_3, 0),
                        BPF_EMIT_CALL(BPF_FUNC_probe_read),
                        BPF_MOV64_IMM(BPF_REG_0, 0),
@@ -4995,7 +4995,7 @@ static struct bpf_test tests[] = {
                        BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
                                sizeof(struct test_val) + 1, 4),
                        BPF_MOV64_IMM(BPF_REG_4, 0),
-                        BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
+                        BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
                        BPF_MOV64_IMM(BPF_REG_3, 0),
                        BPF_EMIT_CALL(BPF_FUNC_probe_read),
                        BPF_MOV64_IMM(BPF_REG_0, 0),
@@ -5023,7 +5023,7 @@ static struct bpf_test tests[] = {
                        BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
                                sizeof(struct test_val) - 20, 4),
                        BPF_MOV64_IMM(BPF_REG_4, 0),
-                        BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
+                        BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
                        BPF_MOV64_IMM(BPF_REG_3, 0),
                        BPF_EMIT_CALL(BPF_FUNC_probe_read),
                        BPF_MOV64_IMM(BPF_REG_0, 0),
@@ -5050,7 +5050,7 @@ static struct bpf_test tests[] = {
                        BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
                                sizeof(struct test_val) - 19, 4),
                        BPF_MOV64_IMM(BPF_REG_4, 0),
-                        BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
+                        BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
                        BPF_MOV64_IMM(BPF_REG_3, 0),
                        BPF_EMIT_CALL(BPF_FUNC_probe_read),
                        BPF_MOV64_IMM(BPF_REG_0, 0),
@@ -5510,6 +5510,476 @@ static struct bpf_test tests[] = {
                .errstr = "invalid bpf_context access",
                .prog_type = BPF_PROG_TYPE_LWT_IN,
        },
+        {
+                "bounds checks mixing signed and unsigned, positive bounds",
+                .insns = {
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
+                        BPF_MOV64_IMM(BPF_REG_2, 2),
+                        BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 3),
+                        BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 4, 2),
+                        BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+                        BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 3 },
+                .errstr_unpriv = "R0 pointer arithmetic prohibited",
+                .errstr = "R0 min value is negative",
+                .result = REJECT,
+                .result_unpriv = REJECT,
+        },
+        {
+                "bounds checks mixing signed and unsigned",
+                .insns = {
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
+                        BPF_MOV64_IMM(BPF_REG_2, -1),
+                        BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 3),
+                        BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
+                        BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+                        BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 3 },
+                .errstr_unpriv = "R0 pointer arithmetic prohibited",
+                .errstr = "R0 min value is negative",
+                .result = REJECT,
+                .result_unpriv = REJECT,
+        },
+        {
+                "bounds checks mixing signed and unsigned, variant 2",
+                .insns = {
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
+                        BPF_MOV64_IMM(BPF_REG_2, -1),
+                        BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 5),
+                        BPF_MOV64_IMM(BPF_REG_8, 0),
+                        BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_1),
+                        BPF_JMP_IMM(BPF_JSGT, BPF_REG_8, 1, 2),
+                        BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),
+                        BPF_ST_MEM(BPF_B, BPF_REG_8, 0, 0),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 3 },
+                .errstr_unpriv = "R0 pointer arithmetic prohibited",
+                .errstr = "R8 invalid mem access 'inv'",
+                .result = REJECT,
+                .result_unpriv = REJECT,
+        },
+        {
+                "bounds checks mixing signed and unsigned, variant 3",
+                .insns = {
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
+                        BPF_MOV64_IMM(BPF_REG_2, -1),
+                        BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 4),
+                        BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
+                        BPF_JMP_IMM(BPF_JSGT, BPF_REG_8, 1, 2),
+                        BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),
+                        BPF_ST_MEM(BPF_B, BPF_REG_8, 0, 0),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 3 },
+                .errstr_unpriv = "R0 pointer arithmetic prohibited",
+                .errstr = "R8 invalid mem access 'inv'",
+                .result = REJECT,
+                .result_unpriv = REJECT,
+        },
+        {
+                "bounds checks mixing signed and unsigned, variant 4",
+                .insns = {
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
+                        BPF_MOV64_IMM(BPF_REG_2, 1),
+                        BPF_ALU64_REG(BPF_AND, BPF_REG_1, BPF_REG_2),
+                        BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
+                        BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+                        BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 3 },
+                .errstr_unpriv = "R0 pointer arithmetic prohibited",
+                .errstr = "R0 min value is negative",
+                .result = REJECT,
+                .result_unpriv = REJECT,
+        },
+        {
+                "bounds checks mixing signed and unsigned, variant 5",
+                .insns = {
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
+                        BPF_MOV64_IMM(BPF_REG_2, -1),
+                        BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 5),
+                        BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 4),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 4),
+                        BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
+                        BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 3 },
+                .errstr_unpriv = "R0 pointer arithmetic prohibited",
+                .errstr = "R0 invalid mem access",
+                .result = REJECT,
+                .result_unpriv = REJECT,
+        },
+        {
+                "bounds checks mixing signed and unsigned, variant 6",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_2, 0),
+                        BPF_MOV64_REG(BPF_REG_3, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, -512),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -16),
+                        BPF_MOV64_IMM(BPF_REG_6, -1),
+                        BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_6, 5),
+                        BPF_JMP_IMM(BPF_JSGT, BPF_REG_4, 1, 4),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 1),
+                        BPF_MOV64_IMM(BPF_REG_5, 0),
+                        BPF_ST_MEM(BPF_H, BPF_REG_10, -512, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_skb_load_bytes),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr_unpriv = "R4 min value is negative, either use unsigned",
+                .errstr = "R4 min value is negative, either use unsigned",
+                .result = REJECT,
+                .result_unpriv = REJECT,
+        },
+        {
+                "bounds checks mixing signed and unsigned, variant 7",
+                .insns = {
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
+                        BPF_MOV64_IMM(BPF_REG_2, 1024 * 1024 * 1024),
+                        BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 3),
+                        BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
+                        BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+                        BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 3 },
+                .errstr_unpriv = "R0 pointer arithmetic prohibited",
+                .errstr = "R0 min value is negative",
+                .result = REJECT,
+                .result_unpriv = REJECT,
+        },
+        {
+                "bounds checks mixing signed and unsigned, variant 8",
+                .insns = {
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
+                        BPF_MOV64_IMM(BPF_REG_2, 1024 * 1024 * 1024 + 1),
+                        BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 3),
+                        BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
+                        BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+                        BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 3 },
+                .errstr_unpriv = "R0 pointer arithmetic prohibited",
+                .errstr = "R0 min value is negative",
+                .result = REJECT,
+                .result_unpriv = REJECT,
+        },
+        {
+                "bounds checks mixing signed and unsigned, variant 9",
+                .insns = {
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
+                        BPF_MOV64_IMM(BPF_REG_2, -1),
+                        BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                        BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
+                        BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+                        BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 3 },
+                .errstr_unpriv = "R0 pointer arithmetic prohibited",
+                .errstr = "R0 min value is negative",
+                .result = REJECT,
+                .result_unpriv = REJECT,
+        },
+        {
+                "bounds checks mixing signed and unsigned, variant 10",
+                .insns = {
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
+                        BPF_LD_IMM64(BPF_REG_2, -9223372036854775808ULL),
+                        BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                        BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
+                        BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+                        BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 3 },
+                .errstr_unpriv = "R0 pointer arithmetic prohibited",
+                .errstr = "R0 min value is negative",
+                .result = REJECT,
+                .result_unpriv = REJECT,
+        },
+        {
+                "bounds checks mixing signed and unsigned, variant 11",
+                .insns = {
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
+                        BPF_MOV64_IMM(BPF_REG_2, 0),
+                        BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                        BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
+                        BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+                        BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 3 },
+                .errstr_unpriv = "R0 pointer arithmetic prohibited",
+                .errstr = "R0 min value is negative",
+                .result = REJECT,
+                .result_unpriv = REJECT,
+        },
+        {
+                "bounds checks mixing signed and unsigned, variant 12",
+                .insns = {
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
+                        BPF_MOV64_IMM(BPF_REG_2, -1),
+                        BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
+                        /* Dead branch. */
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                        BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
+                        BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+                        BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 3 },
+                .errstr_unpriv = "R0 pointer arithmetic prohibited",
+                .errstr = "R0 min value is negative",
+                .result = REJECT,
+                .result_unpriv = REJECT,
+        },
+        {
+                "bounds checks mixing signed and unsigned, variant 13",
+                .insns = {
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
+                        BPF_MOV64_IMM(BPF_REG_2, -6),
+                        BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                        BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
+                        BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+                        BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 3 },
+                .errstr_unpriv = "R0 pointer arithmetic prohibited",
+                .errstr = "R0 min value is negative",
+                .result = REJECT,
+                .result_unpriv = REJECT,
+        },
+        {
+                "bounds checks mixing signed and unsigned, variant 14",
+                .insns = {
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
+                        BPF_MOV64_IMM(BPF_REG_2, 2),
+                        BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
+                        BPF_MOV64_IMM(BPF_REG_7, 1),
+                        BPF_JMP_IMM(BPF_JSGT, BPF_REG_7, 0, 2),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                        BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_1),
+                        BPF_JMP_IMM(BPF_JSGT, BPF_REG_7, 4, 2),
+                        BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_7),
+                        BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 3 },
+                .errstr_unpriv = "R0 pointer arithmetic prohibited",
+                .errstr = "R0 min value is negative",
+                .result = REJECT,
+                .result_unpriv = REJECT,
+        },
+        {
+                "bounds checks mixing signed and unsigned, variant 15",
+                .insns = {
+                        BPF_LDX_MEM(BPF_W, BPF_REG_9, BPF_REG_1,
+                                    offsetof(struct __sk_buff, mark)),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
+                        BPF_MOV64_IMM(BPF_REG_2, -1),
+                        BPF_MOV64_IMM(BPF_REG_8, 2),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_9, 42, 6),
+                        BPF_JMP_REG(BPF_JSGT, BPF_REG_8, BPF_REG_1, 3),
+                        BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
+                        BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+                        BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                        BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, -3),
+                        BPF_JMP_IMM(BPF_JA, 0, 0, -7),
+                },
+                .fixup_map1 = { 4 },
+                .errstr_unpriv = "R0 pointer arithmetic prohibited",
+                .errstr = "R0 min value is negative",
+                .result = REJECT,
+                .result_unpriv = REJECT,
+        },
+        {
+                "bounds checks mixing signed and unsigned, variant 16",
+                .insns = {
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
+                        BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
+                        BPF_MOV64_IMM(BPF_REG_2, -6),
+                        BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                        BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+                        BPF_JMP_IMM(BPF_JGT, BPF_REG_0, 1, 2),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                        BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 3 },
+                .errstr_unpriv = "R0 pointer arithmetic prohibited",
+                .errstr = "R0 min value is negative",
+                .result = REJECT,
+                .result_unpriv = REJECT,
+        },
 };
 static int probe_filter_length(const struct bpf_insn *fp)
@@ -5633,7 +6103,7 @@ static void do_test_single(struct bpf_test *test, bool unpriv,
        fd_prog = bpf_verify_program(prog_type ? : BPF_PROG_TYPE_SOCKET_FILTER,
                                     prog, prog_len, test->flags & F_LOAD_WITH_STRICT_ALIGNMENT,
-                                     "GPL", 0, bpf_vlog, sizeof(bpf_vlog));
+                                     "GPL", 0, bpf_vlog, sizeof(bpf_vlog), 1);
        expected_ret = unpriv && test->result_unpriv != UNDEF ?
                       test->result_unpriv : test->result;
author	Dave Airlie <airlied@redhat.com>	2017-07-26 18:15:43 -0400
committer	Dave Airlie <airlied@redhat.com>	2017-07-26 18:15:43 -0400
commit	0eb2c0ae578ba00f97c7541e01abbce022d14909 (patch)
tree	172db28b9232906ddac61b4bf20c4b0c60c85139
parent	542aefb5a2da8f67b8fb74a24f60ecb3ec479a06 (diff)
parent	520eccdfe187591a51ea9ab4c1a024ae4d0f68d9 (diff)