Merge branch 'sched/urgent' into x86/mm, to pick up dependent fix

Andy will need the following scheduler fix for the PCID series: 252d2a4117bc: sched/core: Idle_task_exit() shouldn't use switch_mm_irqs_off() So do a cross-merge. Signed-off-by: Ingo Molnar <mingo@kernel.org>
author: Ingo Molnar <mingo@kernel.org> 2017-06-13 02:47:22 -0400
committer: Ingo Molnar <mingo@kernel.org> 2017-06-13 02:47:22 -0400
commit: 3f365cf304ba3d316b3df2474af8d7df6edd2455 (patch)
tree: bb52465b35606bec268e9c1b88c746f8caf0f919
parent: bbf79d21bd4627a01ca8721c9373752819f8e4cc (diff)
parent: 252d2a4117bc181b287eeddf848863788da733ae (diff)
318 files changed, 2705 insertions, 1551 deletions
diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 15f79c27748d..0f5c3b4347c6 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -866,6 +866,15 @@
        dscc4.setup=    [NET]
+        dt_cpu_ftrs=    [PPC]
+                        Format: {"off" | "known"}
+                        Control how the dt_cpu_ftrs device-tree binding is
+                        used for CPU feature discovery and setup (if it
+                        exists).
+                        off: Do not use it, fall back to legacy cpu table.
+                        known: Do not pass through unknown features to guests
+                        or userspace, only those that the kernel is aware of.
        dump_apple_properties   [X86]
                        Dump name and content of EFI device properties on
                        x86 Macs.  Useful for driver authors to determine
diff --git a/Documentation/devicetree/bindings/net/dsa/marvell.txt b/Documentation/devicetree/bindings/net/dsa/marvell.txt
index 7ef9dbb08957..1d4d0f49c9d0 100644
--- a/Documentation/devicetree/bindings/net/dsa/marvell.txt
+++ b/Documentation/devicetree/bindings/net/dsa/marvell.txt
@@ -26,6 +26,10 @@ Optional properties:
 - interrupt-controller  : Indicates the switch is itself an interrupt
                          controller. This is used for the PHY interrupts.
 #interrupt-cells = <2>  : Controller uses two cells, number and flag
+- eeprom-length         : Set to the length of an EEPROM connected to the
+                          switch. Must be set if the switch can not detect
+                          the presence and/or size of a connected EEPROM,
+                          otherwise optional.
 - mdio                  : Container of PHY and devices on the switches MDIO
                          bus.
 - mdio?         : Container of PHYs and devices on the external MDIO
diff --git a/Documentation/networking/dpaa.txt b/Documentation/networking/dpaa.txt
new file mode 100644
index 000000000000..76e016d4d344
--- /dev/null
+++ b/Documentation/networking/dpaa.txt
@@ -0,0 +1,194 @@
+The QorIQ DPAA Ethernet Driver
+==============================
+Authors:
+Madalin Bucur <madalin.bucur@nxp.com>
+Camelia Groza <camelia.groza@nxp.com>
+Contents
+========
+        - DPAA Ethernet Overview
+        - DPAA Ethernet Supported SoCs
+        - Configuring DPAA Ethernet in your kernel
+        - DPAA Ethernet Frame Processing
+        - DPAA Ethernet Features
+        - Debugging
+DPAA Ethernet Overview
+======================
+DPAA stands for Data Path Acceleration Architecture and it is a
+set of networking acceleration IPs that are available on several
+generations of SoCs, both on PowerPC and ARM64.
+The Freescale DPAA architecture consists of a series of hardware blocks
+that support Ethernet connectivity. The Ethernet driver depends upon the
+following drivers in the Linux kernel:
+ - Peripheral Access Memory Unit (PAMU) (* needed only for PPC platforms)
+    drivers/iommu/fsl_*
+ - Frame Manager (FMan)
+    drivers/net/ethernet/freescale/fman
+ - Queue Manager (QMan), Buffer Manager (BMan)
+    drivers/soc/fsl/qbman
+A simplified view of the dpaa_eth interfaces mapped to FMan MACs:
+  dpaa_eth       /eth0\     ...       /ethN\
+  driver        |      |             |      |
+  -------------   ----   -----------   ----   -------------
+       -Ports  / Tx  Rx \    ...    / Tx  Rx \
+  FMan        |          |         |          |
+       -MACs  |   MAC0   |         |   MACN   |
+             /   dtsec0   \  ...  /   dtsecN   \ (or tgec)
+            /              \     /              \(or memac)
+  ---------  --------------  ---  --------------  ---------
+      FMan, FMan Port, FMan SP, FMan MURAM drivers
+  ---------------------------------------------------------
+      FMan HW blocks: MURAM, MACs, Ports, SP
+  ---------------------------------------------------------
+The dpaa_eth relation to the QMan, BMan and FMan:
+              ________________________________
+  dpaa_eth   /            eth0                \
+  driver    /                                  \
+  ---------   -^-   -^-   -^-   ---    ---------
+  QMan driver / \   / \   / \  \   /  | BMan    |
+             |Rx | |Rx | |Tx | |Tx |  | driver  |
+  ---------  |Dfl| |Err| |Cnf| |FQs|  |         |
+  QMan HW    |FQ | |FQ | |FQs| |   |  |         |
+             /   \ /   \ /   \  \ /   |         |
+  ---------   ---   ---   ---   -v-    ---------
+            |        FMan QMI         |         |
+            | FMan HW       FMan BMI  | BMan HW |
+              -----------------------   --------
+where the acronyms used above (and in the code) are:
+DPAA = Data Path Acceleration Architecture
+FMan = DPAA Frame Manager
+QMan = DPAA Queue Manager
+BMan = DPAA Buffers Manager
+QMI = QMan interface in FMan
+BMI = BMan interface in FMan
+FMan SP = FMan Storage Profiles
+MURAM = Multi-user RAM in FMan
+FQ = QMan Frame Queue
+Rx Dfl FQ = default reception FQ
+Rx Err FQ = Rx error frames FQ
+Tx Cnf FQ = Tx confirmation FQs
+Tx FQs = transmission frame queues
+dtsec = datapath three speed Ethernet controller (10/100/1000 Mbps)
+tgec = ten gigabit Ethernet controller (10 Gbps)
+memac = multirate Ethernet MAC (10/100/1000/10000)
+DPAA Ethernet Supported SoCs
+============================
+The DPAA drivers enable the Ethernet controllers present on the following SoCs:
+# PPC
+P1023
+P2041
+P3041
+P4080
+P5020
+P5040
+T1023
+T1024
+T1040
+T1042
+T2080
+T4240
+B4860
+# ARM
+LS1043A
+LS1046A
+Configuring DPAA Ethernet in your kernel
+========================================
+To enable the DPAA Ethernet driver, the following Kconfig options are required:
+# common for arch/arm64 and arch/powerpc platforms
+CONFIG_FSL_DPAA=y
+CONFIG_FSL_FMAN=y
+CONFIG_FSL_DPAA_ETH=y
+CONFIG_FSL_XGMAC_MDIO=y
+# for arch/powerpc only
+CONFIG_FSL_PAMU=y
+# common options needed for the PHYs used on the RDBs
+CONFIG_VITESSE_PHY=y
+CONFIG_REALTEK_PHY=y
+CONFIG_AQUANTIA_PHY=y
+DPAA Ethernet Frame Processing
+==============================
+On Rx, buffers for the incoming frames are retrieved from one of the three
+existing buffers pools. The driver initializes and seeds these, each with
+buffers of different sizes: 1KB, 2KB and 4KB.
+On Tx, all transmitted frames are returned to the driver through Tx
+confirmation frame queues. The driver is then responsible for freeing the
+buffers. In order to do this properly, a backpointer is added to the buffer
+before transmission that points to the skb. When the buffer returns to the
+driver on a confirmation FQ, the skb can be correctly consumed.
+DPAA Ethernet Features
+======================
+Currently the DPAA Ethernet driver enables the basic features required for
+a Linux Ethernet driver. The support for advanced features will be added
+gradually.
+The driver has Rx and Tx checksum offloading for UDP and TCP. Currently the Rx
+checksum offload feature is enabled by default and cannot be controlled through
+ethtool.
+The driver has support for multiple prioritized Tx traffic classes. Priorities
+range from 0 (lowest) to 3 (highest). These are mapped to HW workqueues with
+strict priority levels. Each traffic class contains NR_CPU TX queues. By
+default, only one traffic class is enabled and the lowest priority Tx queues
+are used. Higher priority traffic classes can be enabled with the mqprio
+qdisc. For example, all four traffic classes are enabled on an interface with
+the following command. Furthermore, skb priority levels are mapped to traffic
+classes as follows:
+        * priorities 0 to 3 - traffic class 0 (low priority)
+        * priorities 4 to 7 - traffic class 1 (medium-low priority)
+        * priorities 8 to 11 - traffic class 2 (medium-high priority)
+        * priorities 12 to 15 - traffic class 3 (high priority)
+tc qdisc add dev <int> root handle 1: \
+         mqprio num_tc 4 map 0 0 0 0 1 1 1 1 2 2 2 2 3 3 3 3 hw 1
+Debugging
+=========
+The following statistics are exported for each interface through ethtool:
+        - interrupt count per CPU
+        - Rx packets count per CPU
+        - Tx packets count per CPU
+        - Tx confirmed packets count per CPU
+        - Tx S/G frames count per CPU
+        - Tx error count per CPU
+        - Rx error count per CPU
+        - Rx error count per type
+        - congestion related statistics:
+                - congestion status
+                - time spent in congestion
+                - number of time the device entered congestion
+                - dropped packets count per cause
+The driver also exports the following information in sysfs:
+        - the FQ IDs for each FQ type
+        /sys/devices/platform/dpaa-ethernet.0/net/<int>/fqids
+        - the IDs of the buffer pools in use
+        /sys/devices/platform/dpaa-ethernet.0/net/<int>/bpids
diff --git a/Documentation/networking/tcp.txt b/Documentation/networking/tcp.txt
index bdc4c0db51e1..9c7139d57e57 100644
--- a/Documentation/networking/tcp.txt
+++ b/Documentation/networking/tcp.txt
@@ -1,7 +1,7 @@
 TCP protocol
 ============
-Last updated: 9 February 2008
+Last updated: 3 June 2017
 Contents
 ========
@@ -29,18 +29,19 @@ As of 2.6.13, Linux supports pluggable congestion control algorithms.
 A congestion control mechanism can be registered through functions in
 tcp_cong.c. The functions used by the congestion control mechanism are
 registered via passing a tcp_congestion_ops struct to
-tcp_register_congestion_control. As a minimum name, ssthresh,
+tcp_register_congestion_control. As a minimum, the congestion control
-cong_avoid must be valid.
+mechanism must provide a valid name and must implement either ssthresh,
+cong_avoid and undo_cwnd hooks or the "omnipotent" cong_control hook.
 Private data for a congestion control mechanism is stored in tp->ca_priv.
 tcp_ca(tp) returns a pointer to this space.  This is preallocated space - it
 is important to check the size of your private data will fit this space, or
-alternatively space could be allocated elsewhere and a pointer to it could
+alternatively, space could be allocated elsewhere and a pointer to it could
 be stored here.
 There are three kinds of congestion control algorithms currently: The
 simplest ones are derived from TCP reno (highspeed, scalable) and just
-provide an alternative the congestion window calculation. More complex
+provide an alternative congestion window calculation. More complex
 ones like BIC try to look at other events to provide better
 heuristics.  There are also round trip time based algorithms like
 Vegas and Westwood+.
@@ -49,21 +50,15 @@ Good TCP congestion control is a complex problem because the algorithm
 needs to maintain fairness and performance. Please review current
 research and RFC's before developing new modules.
-The method that is used to determine which congestion control mechanism is
+The default congestion control mechanism is chosen based on the
-determined by the setting of the sysctl net.ipv4.tcp_congestion_control.
+DEFAULT_TCP_CONG Kconfig parameter. If you really want a particular default
-The default congestion control will be the last one registered (LIFO);
+value then you can set it using sysctl net.ipv4.tcp_congestion_control. The
-so if you built everything as modules, the default will be reno. If you
+module will be autoloaded if needed and you will get the expected protocol. If
-build with the defaults from Kconfig, then CUBIC will be builtin (not a
+you ask for an unknown congestion method, then the sysctl attempt will fail.
-module) and it will end up the default.
-If you really want a particular default value then you will need
+If you remove a TCP congestion control module, then you will get the next
-to set it with the sysctl.  If you use a sysctl, the module will be autoloaded
-if needed and you will get the expected protocol. If you ask for an
-unknown congestion method, then the sysctl attempt will fail.
-If you remove a tcp congestion control module, then you will get the next
 available one. Since reno cannot be built as a module, and cannot be
-deleted, it will always be available.
+removed, it will always be available.
 How the new TCP output machine [nyi] works.
 ===========================================
diff --git a/MAINTAINERS b/MAINTAINERS
index 7a28acd7f525..4d8e525b84ee 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1172,7 +1172,7 @@ N:	clps711x
 ARM/CIRRUS LOGIC EP93XX ARM ARCHITECTURE
 M:      Hartley Sweeten <hsweeten@visionengravers.com>
-M:      Ryan Mallon <rmallon@gmail.com>
+M:      Alexander Sverdlin <alexander.sverdlin@gmail.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
 F:      arch/arm/mach-ep93xx/
@@ -1489,13 +1489,15 @@ M:	Gregory Clement <gregory.clement@free-electrons.com>
 M:      Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
-F:      arch/arm/mach-mvebu/
-F:      drivers/rtc/rtc-armada38x.c
 F:      arch/arm/boot/dts/armada*
 F:      arch/arm/boot/dts/kirkwood*
+F:      arch/arm/configs/mvebu_*_defconfig
+F:      arch/arm/mach-mvebu/
 F:      arch/arm64/boot/dts/marvell/armada*
 F:      drivers/cpufreq/mvebu-cpufreq.c
-F:      arch/arm/configs/mvebu_*_defconfig
+F:      drivers/irqchip/irq-armada-370-xp.c
+F:      drivers/irqchip/irq-mvebu-*
+F:      drivers/rtc/rtc-armada38x.c
 ARM/Marvell Berlin SoC support
 M:      Jisheng Zhang <jszhang@marvell.com>
@@ -1721,7 +1723,6 @@ N:	rockchip
 ARM/SAMSUNG EXYNOS ARM ARCHITECTURES
 M:      Kukjin Kim <kgene@kernel.org>
 M:      Krzysztof Kozlowski <krzk@kernel.org>
-R:      Javier Martinez Canillas <javier@osg.samsung.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 L:      linux-samsung-soc@vger.kernel.org (moderated for non-subscribers)
 Q:      https://patchwork.kernel.org/project/linux-samsung-soc/list/
@@ -1829,7 +1830,6 @@ F:	drivers/edac/altera_edac.
 ARM/STI ARCHITECTURE
 M:      Patrice Chotard <patrice.chotard@st.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
-L:      kernel@stlinux.com
 W:      http://www.stlinux.com
 S:      Maintained
 F:      arch/arm/mach-sti/
@@ -7707,7 +7707,7 @@ F:	drivers/platform/x86/hp_accel.c
 LIVE PATCHING
 M:      Josh Poimboeuf <jpoimboe@redhat.com>
-M:      Jessica Yu <jeyu@redhat.com>
+M:      Jessica Yu <jeyu@kernel.org>
 M:      Jiri Kosina <jikos@kernel.org>
 M:      Miroslav Benes <mbenes@suse.cz>
 R:      Petr Mladek <pmladek@suse.com>
@@ -8508,7 +8508,7 @@ S:	Odd Fixes
 F:      drivers/media/radio/radio-miropcm20*
 MELLANOX MLX4 core VPI driver
-M:      Yishai Hadas <yishaih@mellanox.com>
+M:      Tariq Toukan <tariqt@mellanox.com>
 L:      netdev@vger.kernel.org
 L:      linux-rdma@vger.kernel.org
 W:      http://www.mellanox.com
@@ -8516,7 +8516,6 @@ Q:	http://patchwork.ozlabs.org/project/netdev/list/
 S:      Supported
 F:      drivers/net/ethernet/mellanox/mlx4/
 F:      include/linux/mlx4/
-F:      include/uapi/rdma/mlx4-abi.h
 MELLANOX MLX4 IB driver
 M:      Yishai Hadas <yishaih@mellanox.com>
@@ -8526,6 +8525,7 @@ Q:	http://patchwork.kernel.org/project/linux-rdma/list/
 S:      Supported
 F:      drivers/infiniband/hw/mlx4/
 F:      include/linux/mlx4/
+F:      include/uapi/rdma/mlx4-abi.h
 MELLANOX MLX5 core VPI driver
 M:      Saeed Mahameed <saeedm@mellanox.com>
@@ -8538,7 +8538,6 @@ Q:	http://patchwork.ozlabs.org/project/netdev/list/
 S:      Supported
 F:      drivers/net/ethernet/mellanox/mlx5/core/
 F:      include/linux/mlx5/
-F:      include/uapi/rdma/mlx5-abi.h
 MELLANOX MLX5 IB driver
 M:      Matan Barak <matanb@mellanox.com>
@@ -8549,6 +8548,7 @@ Q:	http://patchwork.kernel.org/project/linux-rdma/list/
 S:      Supported
 F:      drivers/infiniband/hw/mlx5/
 F:      include/linux/mlx5/
+F:      include/uapi/rdma/mlx5-abi.h
 MELEXIS MLX90614 DRIVER
 M:      Crt Mori <cmo@melexis.com>
@@ -8588,7 +8588,7 @@ S:	Maintained
 F:      drivers/media/dvb-frontends/mn88473*
 MODULE SUPPORT
-M:      Jessica Yu <jeyu@redhat.com>
+M:      Jessica Yu <jeyu@kernel.org>
 M:      Rusty Russell <rusty@rustcorp.com.au>
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux.git modules-next
 S:      Maintained
@@ -11268,7 +11268,6 @@ F:	drivers/media/rc/serial_ir.c
 STI CEC DRIVER
 M:      Benjamin Gaignard <benjamin.gaignard@linaro.org>
-L:      kernel@stlinux.com
 S:      Maintained
 F:      drivers/staging/media/st-cec/
 F:      Documentation/devicetree/bindings/media/stih-cec.txt
@@ -11778,6 +11777,7 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/nsekhar/linux-davinci.git
 S:      Supported
 F:      arch/arm/mach-davinci/
 F:      drivers/i2c/busses/i2c-davinci.c
+F:      arch/arm/boot/dts/da850*
 TI DAVINCI SERIES MEDIA DRIVER
 M:      "Lad, Prabhakar" <prabhakar.csengg@gmail.com>
@@ -13861,7 +13861,7 @@ S:	Odd fixes
 F:      drivers/net/wireless/wl3501*
 WOLFSON MICROELECTRONICS DRIVERS
-L:      patches@opensource.wolfsonmicro.com
+L:      patches@opensource.cirrus.com
 T:      git https://github.com/CirrusLogic/linux-drivers.git
 W:      https://github.com/CirrusLogic/linux-drivers/wiki
 S:      Supported
diff --git a/arch/arm/boot/compressed/efi-header.S b/arch/arm/boot/compressed/efi-header.S
index 9d5dc4fda3c1..3f7d1b74c5e0 100644
--- a/arch/arm/boot/compressed/efi-header.S
+++ b/arch/arm/boot/compressed/efi-header.S
@@ -17,14 +17,12 @@
                @ there.
                .inst   'M' | ('Z' << 8) | (0x1310 << 16)   @ tstne r0, #0x4d000
 #else
-                mov     r0, r0
+                W(mov)  r0, r0
 #endif
                .endm
                .macro  __EFI_HEADER
 #ifdef CONFIG_EFI_STUB
-                b       __efi_start
                .set    start_offset, __efi_start - start
                .org    start + 0x3c
                @
diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S
index 7c711ba61417..8a756870c238 100644
--- a/arch/arm/boot/compressed/head.S
+++ b/arch/arm/boot/compressed/head.S
@@ -130,19 +130,22 @@ start:
                .rept   7
                __nop
                .endr
-   ARM(         mov     r0, r0          )
+#ifndef CONFIG_THUMB2_KERNEL
-   ARM(         b       1f              )
+                mov     r0, r0
- THUMB(         badr    r12, 1f         )
+#else
- THUMB(         bx      r12             )
+ AR_CLASS(      sub     pc, pc, #3      )       @ A/R: switch to Thumb2 mode
+  M_CLASS(      nop.w                   )       @ M: already in Thumb2 mode
+                .thumb
+#endif
+                W(b)    1f
                .word   _magic_sig      @ Magic numbers to help the loader
                .word   _magic_start    @ absolute load/run zImage address
                .word   _magic_end      @ zImage end address
                .word   0x04030201      @ endianness flag
- THUMB(         .thumb                  )
+                __EFI_HEADER
-1:              __EFI_HEADER
+1:
 ARM_BE8(       setend  be              )       @ go BE8 if compiled for BE8
 AR_CLASS(      mrs     r9, cpsr        )
 #ifdef CONFIG_ARM_VIRT_EXT
diff --git a/arch/arm/boot/dts/bcm283x.dtsi b/arch/arm/boot/dts/bcm283x.dtsi
index 561f27d8d922..9444a9a9ba10 100644
--- a/arch/arm/boot/dts/bcm283x.dtsi
+++ b/arch/arm/boot/dts/bcm283x.dtsi
@@ -3,6 +3,11 @@
 #include <dt-bindings/clock/bcm2835-aux.h>
 #include <dt-bindings/gpio/gpio.h>
+/* firmware-provided startup stubs live here, where the secondary CPUs are
+ * spinning.
+ */
+/memreserve/ 0x00000000 0x00001000;
 /* This include file covers the common peripherals and configuration between
 * bcm2835 and bcm2836 implementations, leaving the CPU configuration to
 * bcm2835.dtsi and bcm2836.dtsi.
diff --git a/arch/arm/boot/dts/imx6ul-14x14-evk.dts b/arch/arm/boot/dts/imx6ul-14x14-evk.dts
index f18e1f1d0ce2..d2be8aa3370b 100644
--- a/arch/arm/boot/dts/imx6ul-14x14-evk.dts
+++ b/arch/arm/boot/dts/imx6ul-14x14-evk.dts
@@ -120,10 +120,16 @@
                ethphy0: ethernet-phy@2 {
                        reg = <2>;
+                        micrel,led-mode = <1>;
+                        clocks = <&clks IMX6UL_CLK_ENET_REF>;
+                        clock-names = "rmii-ref";
                };
                ethphy1: ethernet-phy@1 {
                        reg = <1>;
+                        micrel,led-mode = <1>;
+                        clocks = <&clks IMX6UL_CLK_ENET2_REF>;
+                        clock-names = "rmii-ref";
                };
        };
 };
diff --git a/arch/arm/boot/dts/keystone-k2l-netcp.dtsi b/arch/arm/boot/dts/keystone-k2l-netcp.dtsi
index b6f26824e83a..66f615a74118 100644
--- a/arch/arm/boot/dts/keystone-k2l-netcp.dtsi
+++ b/arch/arm/boot/dts/keystone-k2l-netcp.dtsi
@@ -137,8 +137,8 @@ netcp: netcp@26000000 {
        /* NetCP address range */
        ranges = <0 0x26000000 0x1000000>;
-        clocks = <&clkpa>, <&clkcpgmac>, <&chipclk12>, <&clkosr>;
+        clocks = <&clkpa>, <&clkcpgmac>, <&chipclk12>;
-        clock-names = "pa_clk", "ethss_clk", "cpts", "osr_clk";
+        clock-names = "pa_clk", "ethss_clk", "cpts";
        dma-coherent;
        ti,navigator-dmas = <&dma_gbe 0>,
diff --git a/arch/arm/boot/dts/keystone-k2l.dtsi b/arch/arm/boot/dts/keystone-k2l.dtsi
index b58e7ebc0919..148650406cf7 100644
--- a/arch/arm/boot/dts/keystone-k2l.dtsi
+++ b/arch/arm/boot/dts/keystone-k2l.dtsi
@@ -232,6 +232,14 @@
                        };
                };
+                osr: sram@70000000 {
+                        compatible = "mmio-sram";
+                        reg = <0x70000000 0x10000>;
+                        #address-cells = <1>;
+                        #size-cells = <1>;
+                        clocks = <&clkosr>;
+                };
                dspgpio0: keystone_dsp_gpio@02620240 {
                        compatible = "ti,keystone-dsp-gpio";
                        gpio-controller;
diff --git a/arch/arm/boot/dts/versatile-pb.dts b/arch/arm/boot/dts/versatile-pb.dts
index 33a8eb28374e..06e2331f666d 100644
--- a/arch/arm/boot/dts/versatile-pb.dts
+++ b/arch/arm/boot/dts/versatile-pb.dts
@@ -1,4 +1,4 @@
-#include <versatile-ab.dts>
+#include "versatile-ab.dts"
 / {
        model = "ARM Versatile PB";
diff --git a/arch/arm/common/mcpm_entry.c b/arch/arm/common/mcpm_entry.c
index cf062472e07b..2b913f17d50f 100644
--- a/arch/arm/common/mcpm_entry.c
+++ b/arch/arm/common/mcpm_entry.c
@@ -235,7 +235,7 @@ int mcpm_cpu_power_up(unsigned int cpu, unsigned int cluster)
        return ret;
 }
-typedef void (*phys_reset_t)(unsigned long);
+typedef typeof(cpu_reset) phys_reset_t;
 void mcpm_cpu_power_down(void)
 {
@@ -300,7 +300,7 @@ void mcpm_cpu_power_down(void)
         * on the CPU.
         */
        phys_reset = (phys_reset_t)(unsigned long)__pa_symbol(cpu_reset);
-        phys_reset(__pa_symbol(mcpm_entry_point));
+        phys_reset(__pa_symbol(mcpm_entry_point), false);
        /* should never get here */
        BUG();
@@ -389,7 +389,7 @@ static int __init nocache_trampoline(unsigned long _arg)
        __mcpm_cpu_down(cpu, cluster);
        phys_reset = (phys_reset_t)(unsigned long)__pa_symbol(cpu_reset);
-        phys_reset(__pa_symbol(mcpm_entry_point));
+        phys_reset(__pa_symbol(mcpm_entry_point), false);
        BUG();
 }
diff --git a/arch/arm/include/asm/device.h b/arch/arm/include/asm/device.h
index 36ec9c8f6e16..3234fe9bba6e 100644
--- a/arch/arm/include/asm/device.h
+++ b/arch/arm/include/asm/device.h
@@ -19,7 +19,8 @@ struct dev_archdata {
 #ifdef CONFIG_XEN
        const struct dma_map_ops *dev_dma_ops;
 #endif
-        bool dma_coherent;
+        unsigned int dma_coherent:1;
+        unsigned int dma_ops_setup:1;
 };
 struct omap_device;
diff --git a/arch/arm/include/asm/pgtable-nommu.h b/arch/arm/include/asm/pgtable-nommu.h
index 302240c19a5a..a0d726a47c8a 100644
--- a/arch/arm/include/asm/pgtable-nommu.h
+++ b/arch/arm/include/asm/pgtable-nommu.h
@@ -66,6 +66,7 @@ typedef pte_t *pte_addr_t;
 #define pgprot_noncached(prot)  (prot)
 #define pgprot_writecombine(prot) (prot)
 #define pgprot_dmacoherent(prot) (prot)
+#define pgprot_device(prot)     (prot)
 /*
diff --git a/arch/arm/mach-at91/Kconfig b/arch/arm/mach-at91/Kconfig
index 841e924143f9..cbd959b73654 100644
--- a/arch/arm/mach-at91/Kconfig
+++ b/arch/arm/mach-at91/Kconfig
@@ -1,6 +1,7 @@
 menuconfig ARCH_AT91
        bool "Atmel SoCs"
        depends on ARCH_MULTI_V4T || ARCH_MULTI_V5 || ARCH_MULTI_V7
+        select ARM_CPU_SUSPEND if PM
        select COMMON_CLK_AT91
        select GPIOLIB
        select PINCTRL
diff --git a/arch/arm/mach-davinci/pm.c b/arch/arm/mach-davinci/pm.c
index efb80354f303..b5cc05dc2cb2 100644
--- a/arch/arm/mach-davinci/pm.c
+++ b/arch/arm/mach-davinci/pm.c
@@ -153,7 +153,8 @@ int __init davinci_pm_init(void)
        davinci_sram_suspend = sram_alloc(davinci_cpu_suspend_sz, NULL);
        if (!davinci_sram_suspend) {
                pr_err("PM: cannot allocate SRAM memory\n");
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto no_sram_mem;
        }
        davinci_sram_push(davinci_sram_suspend, davinci_cpu_suspend,
@@ -161,6 +162,10 @@ int __init davinci_pm_init(void)
        suspend_set_ops(&davinci_pm_ops);
+        return 0;
+no_sram_mem:
+        iounmap(pm_config.ddrpsc_reg_base);
 no_ddrpsc_mem:
        iounmap(pm_config.ddrpll_reg_base);
 no_ddrpll_mem:
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index c742dfd2967b..bd83c531828a 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -2311,7 +2311,14 @@ int arm_iommu_attach_device(struct device *dev,
 }
 EXPORT_SYMBOL_GPL(arm_iommu_attach_device);
-static void __arm_iommu_detach_device(struct device *dev)
+/**
+ * arm_iommu_detach_device
+ * @dev: valid struct device pointer
+ *
+ * Detaches the provided device from a previously attached map.
+ * This voids the dma operations (dma_map_ops pointer)
+ */
+void arm_iommu_detach_device(struct device *dev)
 {
        struct dma_iommu_mapping *mapping;
@@ -2324,22 +2331,10 @@ static void __arm_iommu_detach_device(struct device *dev)
        iommu_detach_device(mapping->domain, dev);
        kref_put(&mapping->kref, release_iommu_mapping);
        to_dma_iommu_mapping(dev) = NULL;
+        set_dma_ops(dev, NULL);
        pr_debug("Detached IOMMU controller from %s device.\n", dev_name(dev));
 }
-/**
- * arm_iommu_detach_device
- * @dev: valid struct device pointer
- *
- * Detaches the provided device from a previously attached map.
- * This voids the dma operations (dma_map_ops pointer)
- */
-void arm_iommu_detach_device(struct device *dev)
-{
-        __arm_iommu_detach_device(dev);
-        set_dma_ops(dev, NULL);
-}
 EXPORT_SYMBOL_GPL(arm_iommu_detach_device);
 static const struct dma_map_ops *arm_get_iommu_dma_map_ops(bool coherent)
@@ -2379,7 +2374,7 @@ static void arm_teardown_iommu_dma_ops(struct device *dev)
        if (!mapping)
                return;
-        __arm_iommu_detach_device(dev);
+        arm_iommu_detach_device(dev);
        arm_iommu_release_mapping(mapping);
 }
@@ -2430,9 +2425,13 @@ void arch_setup_dma_ops(struct device *dev, u64 dma_base, u64 size,
                dev->dma_ops = xen_dma_ops;
        }
 #endif
+        dev->archdata.dma_ops_setup = true;
 }
 void arch_teardown_dma_ops(struct device *dev)
 {
+        if (!dev->archdata.dma_ops_setup)
+                return;
        arm_teardown_iommu_dma_ops(dev);
 }
diff --git a/arch/arm64/boot/dts/marvell/armada-cp110-master.dtsi b/arch/arm64/boot/dts/marvell/armada-cp110-master.dtsi
index ac8df5201cd6..b4bc42ece754 100644
--- a/arch/arm64/boot/dts/marvell/armada-cp110-master.dtsi
+++ b/arch/arm64/boot/dts/marvell/armada-cp110-master.dtsi
@@ -231,8 +231,7 @@
                        cpm_crypto: crypto@800000 {
                                compatible = "inside-secure,safexcel-eip197";
                                reg = <0x800000 0x200000>;
-                                interrupts = <GIC_SPI 34 (IRQ_TYPE_EDGE_RISING
+                                interrupts = <GIC_SPI 34 IRQ_TYPE_LEVEL_HIGH>,
-                                | IRQ_TYPE_LEVEL_HIGH)>,
                                             <GIC_SPI 54 IRQ_TYPE_LEVEL_HIGH>,
                                             <GIC_SPI 55 IRQ_TYPE_LEVEL_HIGH>,
                                             <GIC_SPI 56 IRQ_TYPE_LEVEL_HIGH>,
diff --git a/arch/arm64/boot/dts/marvell/armada-cp110-slave.dtsi b/arch/arm64/boot/dts/marvell/armada-cp110-slave.dtsi
index 7740a75a8230..6e2058847ddc 100644
--- a/arch/arm64/boot/dts/marvell/armada-cp110-slave.dtsi
+++ b/arch/arm64/boot/dts/marvell/armada-cp110-slave.dtsi
@@ -221,8 +221,7 @@
                        cps_crypto: crypto@800000 {
                                compatible = "inside-secure,safexcel-eip197";
                                reg = <0x800000 0x200000>;
-                                interrupts = <GIC_SPI 34 (IRQ_TYPE_EDGE_RISING
+                                interrupts = <GIC_SPI 34 IRQ_TYPE_LEVEL_HIGH>,
-                                | IRQ_TYPE_LEVEL_HIGH)>,
                                             <GIC_SPI 278 IRQ_TYPE_LEVEL_HIGH>,
                                             <GIC_SPI 279 IRQ_TYPE_LEVEL_HIGH>,
                                             <GIC_SPI 280 IRQ_TYPE_LEVEL_HIGH>,
diff --git a/arch/arm64/configs/defconfig b/arch/arm64/configs/defconfig
index 65cdd878cfbd..97c123e09e45 100644
--- a/arch/arm64/configs/defconfig
+++ b/arch/arm64/configs/defconfig
@@ -68,6 +68,7 @@ CONFIG_PCIE_QCOM=y
 CONFIG_PCIE_ARMADA_8K=y
 CONFIG_PCI_AARDVARK=y
 CONFIG_PCIE_RCAR=y
+CONFIG_PCIE_ROCKCHIP=m
 CONFIG_PCI_HOST_GENERIC=y
 CONFIG_PCI_XGENE=y
 CONFIG_ARM64_VA_BITS_48=y
@@ -208,6 +209,8 @@ CONFIG_BRCMFMAC=m
 CONFIG_WL18XX=m
 CONFIG_WLCORE_SDIO=m
 CONFIG_INPUT_EVDEV=y
+CONFIG_KEYBOARD_ADC=m
+CONFIG_KEYBOARD_CROS_EC=y
 CONFIG_KEYBOARD_GPIO=y
 CONFIG_INPUT_MISC=y
 CONFIG_INPUT_PM8941_PWRKEY=y
@@ -263,6 +266,7 @@ CONFIG_SPI_MESON_SPIFC=m
 CONFIG_SPI_ORION=y
 CONFIG_SPI_PL022=y
 CONFIG_SPI_QUP=y
+CONFIG_SPI_ROCKCHIP=y
 CONFIG_SPI_S3C64XX=y
 CONFIG_SPI_SPIDEV=m
 CONFIG_SPMI=y
@@ -292,6 +296,7 @@ CONFIG_THERMAL_GOV_POWER_ALLOCATOR=y
 CONFIG_CPU_THERMAL=y
 CONFIG_THERMAL_EMULATION=y
 CONFIG_EXYNOS_THERMAL=y
+CONFIG_ROCKCHIP_THERMAL=m
 CONFIG_WATCHDOG=y
 CONFIG_S3C2410_WATCHDOG=y
 CONFIG_MESON_GXBB_WATCHDOG=m
@@ -300,12 +305,14 @@ CONFIG_RENESAS_WDT=y
 CONFIG_BCM2835_WDT=y
 CONFIG_MFD_CROS_EC=y
 CONFIG_MFD_CROS_EC_I2C=y
+CONFIG_MFD_CROS_EC_SPI=y
 CONFIG_MFD_EXYNOS_LPASS=m
 CONFIG_MFD_HI655X_PMIC=y
 CONFIG_MFD_MAX77620=y
 CONFIG_MFD_SPMI_PMIC=y
 CONFIG_MFD_RK808=y
 CONFIG_MFD_SEC_CORE=y
+CONFIG_REGULATOR_FAN53555=y
 CONFIG_REGULATOR_FIXED_VOLTAGE=y
 CONFIG_REGULATOR_GPIO=y
 CONFIG_REGULATOR_HI655X=y
@@ -473,8 +480,10 @@ CONFIG_ARCH_TEGRA_186_SOC=y
 CONFIG_EXTCON_USB_GPIO=y
 CONFIG_IIO=y
 CONFIG_EXYNOS_ADC=y
+CONFIG_ROCKCHIP_SARADC=m
 CONFIG_PWM=y
 CONFIG_PWM_BCM2835=m
+CONFIG_PWM_CROS_EC=m
 CONFIG_PWM_MESON=m
 CONFIG_PWM_ROCKCHIP=y
 CONFIG_PWM_SAMSUNG=y
@@ -484,6 +493,7 @@ CONFIG_PHY_HI6220_USB=y
 CONFIG_PHY_SUN4I_USB=y
 CONFIG_PHY_ROCKCHIP_INNO_USB2=y
 CONFIG_PHY_ROCKCHIP_EMMC=y
+CONFIG_PHY_ROCKCHIP_PCIE=m
 CONFIG_PHY_XGENE=y
 CONFIG_PHY_TEGRA_XUSB=y
 CONFIG_ARM_SCPI_PROTOCOL=y
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index f7c8f9972f61..964da1891ea9 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -380,22 +380,6 @@ source "arch/powerpc/platforms/Kconfig"
 menu "Kernel options"
-config PPC_DT_CPU_FTRS
-        bool "Device-tree based CPU feature discovery & setup"
-        depends on PPC_BOOK3S_64
-        default n
-        help
-          This enables code to use a new device tree binding for describing CPU
-          compatibility and features. Saying Y here will attempt to use the new
-          binding if the firmware provides it. Currently only the skiboot
-          firmware provides this binding.
-          If you're not sure say Y.
-config PPC_CPUFEATURES_ENABLE_UNKNOWN
-        bool "cpufeatures pass through unknown features to guest/userspace"
-        depends on PPC_DT_CPU_FTRS
-        default y
 config HIGHMEM
        bool "High memory support"
        depends on PPC32
diff --git a/arch/powerpc/include/asm/book3s/64/hash-4k.h b/arch/powerpc/include/asm/book3s/64/hash-4k.h
index b4b5e6b671ca..0c4e470571ca 100644
--- a/arch/powerpc/include/asm/book3s/64/hash-4k.h
+++ b/arch/powerpc/include/asm/book3s/64/hash-4k.h
@@ -8,7 +8,7 @@
 #define H_PTE_INDEX_SIZE  9
 #define H_PMD_INDEX_SIZE  7
 #define H_PUD_INDEX_SIZE  9
-#define H_PGD_INDEX_SIZE  12
+#define H_PGD_INDEX_SIZE  9
 #ifndef __ASSEMBLY__
 #define H_PTE_TABLE_SIZE        (sizeof(pte_t) << H_PTE_INDEX_SIZE)
diff --git a/arch/powerpc/include/asm/cputable.h b/arch/powerpc/include/asm/cputable.h
index c2d509584a98..d02ad93bf708 100644
--- a/arch/powerpc/include/asm/cputable.h
+++ b/arch/powerpc/include/asm/cputable.h
@@ -214,7 +214,6 @@ enum {
 #define CPU_FTR_DAWR                    LONG_ASM_CONST(0x0400000000000000)
 #define CPU_FTR_DABRX                   LONG_ASM_CONST(0x0800000000000000)
 #define CPU_FTR_PMAO_BUG                LONG_ASM_CONST(0x1000000000000000)
-#define CPU_FTR_SUBCORE                 LONG_ASM_CONST(0x2000000000000000)
 #define CPU_FTR_POWER9_DD1              LONG_ASM_CONST(0x4000000000000000)
 #ifndef __ASSEMBLY__
@@ -463,7 +462,7 @@ enum {
            CPU_FTR_STCX_CHECKS_ADDRESS | CPU_FTR_POPCNTB | CPU_FTR_POPCNTD | \
            CPU_FTR_ICSWX | CPU_FTR_CFAR | CPU_FTR_HVMODE | CPU_FTR_VMX_COPY | \
            CPU_FTR_DBELL | CPU_FTR_HAS_PPR | CPU_FTR_DAWR | \
-            CPU_FTR_ARCH_207S | CPU_FTR_TM_COMP | CPU_FTR_SUBCORE)
+            CPU_FTR_ARCH_207S | CPU_FTR_TM_COMP)
 #define CPU_FTRS_POWER8E (CPU_FTRS_POWER8 | CPU_FTR_PMAO_BUG)
 #define CPU_FTRS_POWER8_DD1 (CPU_FTRS_POWER8 & ~CPU_FTR_DBELL)
 #define CPU_FTRS_POWER9 (CPU_FTR_USE_TB | CPU_FTR_LWSYNC | \
diff --git a/arch/powerpc/include/asm/processor.h b/arch/powerpc/include/asm/processor.h
index a2123f291ab0..bb99b651085a 100644
--- a/arch/powerpc/include/asm/processor.h
+++ b/arch/powerpc/include/asm/processor.h
@@ -110,13 +110,18 @@ void release_thread(struct task_struct *);
 #define TASK_SIZE_128TB (0x0000800000000000UL)
 #define TASK_SIZE_512TB (0x0002000000000000UL)
-#ifdef CONFIG_PPC_BOOK3S_64
+/*
+ * For now 512TB is only supported with book3s and 64K linux page size.
+ */
+#if defined(CONFIG_PPC_BOOK3S_64) && defined(CONFIG_PPC_64K_PAGES)
 /*
 * Max value currently used:
 */
-#define TASK_SIZE_USER64        TASK_SIZE_512TB
+#define TASK_SIZE_USER64                TASK_SIZE_512TB
+#define DEFAULT_MAP_WINDOW_USER64       TASK_SIZE_128TB
 #else
-#define TASK_SIZE_USER64        TASK_SIZE_64TB
+#define TASK_SIZE_USER64                TASK_SIZE_64TB
+#define DEFAULT_MAP_WINDOW_USER64       TASK_SIZE_64TB
 #endif
 /*
@@ -132,7 +137,7 @@ void release_thread(struct task_struct *);
 * space during mmap's.
 */
 #define TASK_UNMAPPED_BASE_USER32 (PAGE_ALIGN(TASK_SIZE_USER32 / 4))
-#define TASK_UNMAPPED_BASE_USER64 (PAGE_ALIGN(TASK_SIZE_128TB / 4))
+#define TASK_UNMAPPED_BASE_USER64 (PAGE_ALIGN(DEFAULT_MAP_WINDOW_USER64 / 4))
 #define TASK_UNMAPPED_BASE ((is_32bit_task()) ? \
                TASK_UNMAPPED_BASE_USER32 : TASK_UNMAPPED_BASE_USER64 )
@@ -143,21 +148,15 @@ void release_thread(struct task_struct *);
 * with 128TB and conditionally enable upto 512TB
 */
 #ifdef CONFIG_PPC_BOOK3S_64
-#define DEFAULT_MAP_WINDOW      ((is_32bit_task()) ? \
+#define DEFAULT_MAP_WINDOW      ((is_32bit_task()) ?                    \
-                                 TASK_SIZE_USER32 : TASK_SIZE_128TB)
+                                 TASK_SIZE_USER32 : DEFAULT_MAP_WINDOW_USER64)
 #else
 #define DEFAULT_MAP_WINDOW      TASK_SIZE
 #endif
 #ifdef __powerpc64__
-#ifdef CONFIG_PPC_BOOK3S_64
+#define STACK_TOP_USER64 DEFAULT_MAP_WINDOW_USER64
-/* Limit stack to 128TB */
-#define STACK_TOP_USER64 TASK_SIZE_128TB
-#else
-#define STACK_TOP_USER64 TASK_SIZE_USER64
-#endif
 #define STACK_TOP_USER32 TASK_SIZE_USER32
 #define STACK_TOP (is_32bit_task() ? \
diff --git a/arch/powerpc/include/asm/topology.h b/arch/powerpc/include/asm/topology.h
index 8b3b46b7b0f2..329771559cbb 100644
--- a/arch/powerpc/include/asm/topology.h
+++ b/arch/powerpc/include/asm/topology.h
@@ -44,8 +44,22 @@ extern void __init dump_numa_cpu_topology(void);
 extern int sysfs_add_device_to_node(struct device *dev, int nid);
 extern void sysfs_remove_device_from_node(struct device *dev, int nid);
+static inline int early_cpu_to_node(int cpu)
+{
+        int nid;
+        nid = numa_cpu_lookup_table[cpu];
+        /*
+         * Fall back to node 0 if nid is unset (it should be, except bugs).
+         * This allows callers to safely do NODE_DATA(early_cpu_to_node(cpu)).
+         */
+        return (nid < 0) ? 0 : nid;
+}
 #else
+static inline int early_cpu_to_node(int cpu) { return 0; }
 static inline void dump_numa_cpu_topology(void) {}
 static inline int sysfs_add_device_to_node(struct device *dev, int nid)
diff --git a/arch/powerpc/kernel/dt_cpu_ftrs.c b/arch/powerpc/kernel/dt_cpu_ftrs.c
index fcc7588a96d6..4c7656dc4e04 100644
--- a/arch/powerpc/kernel/dt_cpu_ftrs.c
+++ b/arch/powerpc/kernel/dt_cpu_ftrs.c
@@ -8,6 +8,7 @@
 #include <linux/export.h>
 #include <linux/init.h>
 #include <linux/jump_label.h>
+#include <linux/libfdt.h>
 #include <linux/memblock.h>
 #include <linux/printk.h>
 #include <linux/sched.h>
@@ -642,7 +643,6 @@ static struct dt_cpu_feature_match __initdata
        {"processor-control-facility", feat_enable_dbell, CPU_FTR_DBELL},
        {"processor-control-facility-v3", feat_enable_dbell, CPU_FTR_DBELL},
        {"processor-utilization-of-resources-register", feat_enable_purr, 0},
-        {"subcore", feat_enable, CPU_FTR_SUBCORE},
        {"no-execute", feat_enable, 0},
        {"strong-access-ordering", feat_enable, CPU_FTR_SAO},
        {"cache-inhibited-large-page", feat_enable_large_ci, 0},
@@ -671,12 +671,24 @@ static struct dt_cpu_feature_match __initdata
        {"wait-v3", feat_enable, 0},
 };
-/* XXX: how to configure this? Default + boot time? */
+static bool __initdata using_dt_cpu_ftrs;
-#ifdef CONFIG_PPC_CPUFEATURES_ENABLE_UNKNOWN
+static bool __initdata enable_unknown = true;
-#define CPU_FEATURE_ENABLE_UNKNOWN 1
-#else
+static int __init dt_cpu_ftrs_parse(char *str)
-#define CPU_FEATURE_ENABLE_UNKNOWN 0
+{
-#endif
+        if (!str)
+                return 0;
+        if (!strcmp(str, "off"))
+                using_dt_cpu_ftrs = false;
+        else if (!strcmp(str, "known"))
+                enable_unknown = false;
+        else
+                return 1;
+        return 0;
+}
+early_param("dt_cpu_ftrs", dt_cpu_ftrs_parse);
 static void __init cpufeatures_setup_start(u32 isa)
 {
@@ -707,7 +719,7 @@ static bool __init cpufeatures_process_feature(struct dt_cpu_feature *f)
                }
        }
-        if (!known && CPU_FEATURE_ENABLE_UNKNOWN) {
+        if (!known && enable_unknown) {
                if (!feat_try_enable_unknown(f)) {
                        pr_info("not enabling: %s (unknown and unsupported by kernel)\n",
                                f->name);
@@ -756,6 +768,26 @@ static void __init cpufeatures_setup_finished(void)
                cur_cpu_spec->cpu_features, cur_cpu_spec->mmu_features);
 }
+static int __init disabled_on_cmdline(void)
+{
+        unsigned long root, chosen;
+        const char *p;
+        root = of_get_flat_dt_root();
+        chosen = of_get_flat_dt_subnode_by_name(root, "chosen");
+        if (chosen == -FDT_ERR_NOTFOUND)
+                return false;
+        p = of_get_flat_dt_prop(chosen, "bootargs", NULL);
+        if (!p)
+                return false;
+        if (strstr(p, "dt_cpu_ftrs=off"))
+                return true;
+        return false;
+}
 static int __init fdt_find_cpu_features(unsigned long node, const char *uname,
                                        int depth, void *data)
 {
@@ -766,8 +798,6 @@ static int __init fdt_find_cpu_features(unsigned long node, const char *uname,
        return 0;
 }
-static bool __initdata using_dt_cpu_ftrs = false;
 bool __init dt_cpu_ftrs_in_use(void)
 {
        return using_dt_cpu_ftrs;
@@ -775,6 +805,8 @@ bool __init dt_cpu_ftrs_in_use(void)
 bool __init dt_cpu_ftrs_init(void *fdt)
 {
+        using_dt_cpu_ftrs = false;
        /* Setup and verify the FDT, if it fails we just bail */
        if (!early_init_dt_verify(fdt))
                return false;
@@ -782,6 +814,9 @@ bool __init dt_cpu_ftrs_init(void *fdt)
        if (!of_scan_flat_dt(fdt_find_cpu_features, NULL))
                return false;
+        if (disabled_on_cmdline())
+                return false;
        cpufeatures_setup_cpu();
        using_dt_cpu_ftrs = true;
@@ -1027,5 +1062,8 @@ static int __init dt_cpu_ftrs_scan_callback(unsigned long node, const char
 void __init dt_cpu_ftrs_scan(void)
 {
+        if (!using_dt_cpu_ftrs)
+                return;
        of_scan_flat_dt(dt_cpu_ftrs_scan_callback, NULL);
 }
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index baae104b16c7..2ad725ef4368 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -1666,6 +1666,7 @@ void start_thread(struct pt_regs *regs, unsigned long start, unsigned long sp)
 #ifdef CONFIG_VSX
        current->thread.used_vsr = 0;
 #endif
+        current->thread.load_fp = 0;
        memset(&current->thread.fp_state, 0, sizeof(current->thread.fp_state));
        current->thread.fp_save_area = NULL;
 #ifdef CONFIG_ALTIVEC
@@ -1674,6 +1675,7 @@ void start_thread(struct pt_regs *regs, unsigned long start, unsigned long sp)
        current->thread.vr_save_area = NULL;
        current->thread.vrsave = 0;
        current->thread.used_vr = 0;
+        current->thread.load_vec = 0;
 #endif /* CONFIG_ALTIVEC */
 #ifdef CONFIG_SPE
        memset(current->thread.evr, 0, sizeof(current->thread.evr));
@@ -1685,6 +1687,7 @@ void start_thread(struct pt_regs *regs, unsigned long start, unsigned long sp)
        current->thread.tm_tfhar = 0;
        current->thread.tm_texasr = 0;
        current->thread.tm_tfiar = 0;
+        current->thread.load_tm = 0;
 #endif /* CONFIG_PPC_TRANSACTIONAL_MEM */
 }
 EXPORT_SYMBOL(start_thread);
diff --git a/arch/powerpc/kernel/setup-common.c b/arch/powerpc/kernel/setup-common.c
index 71dcda91755d..857129acf960 100644
--- a/arch/powerpc/kernel/setup-common.c
+++ b/arch/powerpc/kernel/setup-common.c
@@ -928,7 +928,7 @@ void __init setup_arch(char **cmdline_p)
 #ifdef CONFIG_PPC_MM_SLICES
 #ifdef CONFIG_PPC64
-        init_mm.context.addr_limit = TASK_SIZE_128TB;
+        init_mm.context.addr_limit = DEFAULT_MAP_WINDOW_USER64;
 #else
 #error  "context.addr_limit not initialized."
 #endif
diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c
index f35ff9dea4fb..a8c1f99e9607 100644
--- a/arch/powerpc/kernel/setup_64.c
+++ b/arch/powerpc/kernel/setup_64.c
@@ -661,7 +661,7 @@ void __init emergency_stack_init(void)
 static void * __init pcpu_fc_alloc(unsigned int cpu, size_t size, size_t align)
 {
-        return __alloc_bootmem_node(NODE_DATA(cpu_to_node(cpu)), size, align,
+        return __alloc_bootmem_node(NODE_DATA(early_cpu_to_node(cpu)), size, align,
                                    __pa(MAX_DMA_ADDRESS));
 }
@@ -672,7 +672,7 @@ static void __init pcpu_fc_free(void *ptr, size_t size)
 static int pcpu_cpu_distance(unsigned int from, unsigned int to)
 {
-        if (cpu_to_node(from) == cpu_to_node(to))
+        if (early_cpu_to_node(from) == early_cpu_to_node(to))
                return LOCAL_DISTANCE;
        else
                return REMOTE_DISTANCE;
diff --git a/arch/powerpc/mm/mmu_context_book3s64.c b/arch/powerpc/mm/mmu_context_book3s64.c
index c6dca2ae78ef..a3edf813d455 100644
--- a/arch/powerpc/mm/mmu_context_book3s64.c
+++ b/arch/powerpc/mm/mmu_context_book3s64.c
@@ -99,7 +99,7 @@ static int hash__init_new_context(struct mm_struct *mm)
         * mm->context.addr_limit. Default to max task size so that we copy the
         * default values to paca which will help us to handle slb miss early.
         */
-        mm->context.addr_limit = TASK_SIZE_128TB;
+        mm->context.addr_limit = DEFAULT_MAP_WINDOW_USER64;
        /*
         * The old code would re-promote on fork, we don't do that when using
diff --git a/arch/powerpc/perf/power9-pmu.c b/arch/powerpc/perf/power9-pmu.c
index 018f8e90ac35..bb28e1a41257 100644
--- a/arch/powerpc/perf/power9-pmu.c
+++ b/arch/powerpc/perf/power9-pmu.c
@@ -402,7 +402,7 @@ static struct power_pmu power9_isa207_pmu = {
        .name                   = "POWER9",
        .n_counter              = MAX_PMU_COUNTERS,
        .add_fields             = ISA207_ADD_FIELDS,
-        .test_adder             = ISA207_TEST_ADDER,
+        .test_adder             = P9_DD1_TEST_ADDER,
        .compute_mmcr           = isa207_compute_mmcr,
        .config_bhrb            = power9_config_bhrb,
        .bhrb_filter_map        = power9_bhrb_filter_map,
@@ -421,7 +421,7 @@ static struct power_pmu power9_pmu = {
        .name                   = "POWER9",
        .n_counter              = MAX_PMU_COUNTERS,
        .add_fields             = ISA207_ADD_FIELDS,
-        .test_adder             = P9_DD1_TEST_ADDER,
+        .test_adder             = ISA207_TEST_ADDER,
        .compute_mmcr           = isa207_compute_mmcr,
        .config_bhrb            = power9_config_bhrb,
        .bhrb_filter_map        = power9_bhrb_filter_map,
diff --git a/arch/powerpc/platforms/Kconfig b/arch/powerpc/platforms/Kconfig
index 33244e3d9375..4fd64d3f5c44 100644
--- a/arch/powerpc/platforms/Kconfig
+++ b/arch/powerpc/platforms/Kconfig
@@ -59,6 +59,17 @@ config PPC_OF_BOOT_TRAMPOLINE
          In case of doubt, say Y
+config PPC_DT_CPU_FTRS
+        bool "Device-tree based CPU feature discovery & setup"
+        depends on PPC_BOOK3S_64
+        default y
+        help
+          This enables code to use a new device tree binding for describing CPU
+          compatibility and features. Saying Y here will attempt to use the new
+          binding if the firmware provides it. Currently only the skiboot
+          firmware provides this binding.
+          If you're not sure say Y.
 config UDBG_RTAS_CONSOLE
        bool "RTAS based debug console"
        depends on PPC_RTAS
diff --git a/arch/powerpc/platforms/cell/spufs/coredump.c b/arch/powerpc/platforms/cell/spufs/coredump.c
index e5a891ae80ee..84b7ac926ce6 100644
--- a/arch/powerpc/platforms/cell/spufs/coredump.c
+++ b/arch/powerpc/platforms/cell/spufs/coredump.c
@@ -175,6 +175,8 @@ static int spufs_arch_write_note(struct spu_context *ctx, int i,
        skip = roundup(cprm->pos - total + sz, 4) - cprm->pos;
        if (!dump_skip(cprm, skip))
                goto Eio;
+        rc = 0;
 out:
        free_page((unsigned long)buf);
        return rc;
diff --git a/arch/powerpc/platforms/powernv/subcore.c b/arch/powerpc/platforms/powernv/subcore.c
index 0babef11136f..8c6119280c13 100644
--- a/arch/powerpc/platforms/powernv/subcore.c
+++ b/arch/powerpc/platforms/powernv/subcore.c
@@ -407,7 +407,13 @@ static DEVICE_ATTR(subcores_per_core, 0644,
 static int subcore_init(void)
 {
-        if (!cpu_has_feature(CPU_FTR_SUBCORE))
+        unsigned pvr_ver;
+        pvr_ver = PVR_VER(mfspr(SPRN_PVR));
+        if (pvr_ver != PVR_POWER8 &&
+            pvr_ver != PVR_POWER8E &&
+            pvr_ver != PVR_POWER8NVL)
                return 0;
        /*
diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c
index e104c71ea44a..1fb162ba9d1c 100644
--- a/arch/powerpc/platforms/pseries/hotplug-memory.c
+++ b/arch/powerpc/platforms/pseries/hotplug-memory.c
@@ -124,6 +124,7 @@ static struct property *dlpar_clone_drconf_property(struct device_node *dn)
        for (i = 0; i < num_lmbs; i++) {
                lmbs[i].base_addr = be64_to_cpu(lmbs[i].base_addr);
                lmbs[i].drc_index = be32_to_cpu(lmbs[i].drc_index);
+                lmbs[i].aa_index = be32_to_cpu(lmbs[i].aa_index);
                lmbs[i].flags = be32_to_cpu(lmbs[i].flags);
        }
@@ -147,6 +148,7 @@ static void dlpar_update_drconf_property(struct device_node *dn,
        for (i = 0; i < num_lmbs; i++) {
                lmbs[i].base_addr = cpu_to_be64(lmbs[i].base_addr);
                lmbs[i].drc_index = cpu_to_be32(lmbs[i].drc_index);
+                lmbs[i].aa_index = cpu_to_be32(lmbs[i].aa_index);
                lmbs[i].flags = cpu_to_be32(lmbs[i].flags);
        }
diff --git a/arch/powerpc/sysdev/simple_gpio.c b/arch/powerpc/sysdev/simple_gpio.c
index ef470b470b04..6afddae2fb47 100644
--- a/arch/powerpc/sysdev/simple_gpio.c
+++ b/arch/powerpc/sysdev/simple_gpio.c
@@ -75,7 +75,8 @@ static int u8_gpio_dir_out(struct gpio_chip *gc, unsigned int gpio, int val)
 static void u8_gpio_save_regs(struct of_mm_gpio_chip *mm_gc)
 {
-        struct u8_gpio_chip *u8_gc = gpiochip_get_data(&mm_gc->gc);
+        struct u8_gpio_chip *u8_gc =
+                container_of(mm_gc, struct u8_gpio_chip, mm_gc);
        u8_gc->data = in_8(mm_gc->regs);
 }
diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
index 58243b0d21c0..b558c9e29de3 100644
--- a/arch/sparc/Kconfig
+++ b/arch/sparc/Kconfig
@@ -192,9 +192,9 @@ config NR_CPUS
        int "Maximum number of CPUs"
        depends on SMP
        range 2 32 if SPARC32
-        range 2 1024 if SPARC64
+        range 2 4096 if SPARC64
        default 32 if SPARC32
-        default 64 if SPARC64
+        default 4096 if SPARC64
 source kernel/Kconfig.hz
@@ -295,9 +295,13 @@ config NUMA
        depends on SPARC64 && SMP
 config NODES_SHIFT
-        int
+        int "Maximum NUMA Nodes (as a power of 2)"
-        default "4"
+        range 4 5 if SPARC64
+        default "5"
        depends on NEED_MULTIPLE_NODES
+        help
+          Specify the maximum number of NUMA Nodes available on the target
+          system.  Increases memory reserved to accommodate various tables.
 # Some NUMA nodes have memory ranges that span
 # other nodes.  Even though a pfn is valid and
diff --git a/arch/sparc/include/asm/mmu_64.h b/arch/sparc/include/asm/mmu_64.h
index f7de0dbc38af..83b36a5371ff 100644
--- a/arch/sparc/include/asm/mmu_64.h
+++ b/arch/sparc/include/asm/mmu_64.h
@@ -52,7 +52,7 @@
 #define CTX_NR_MASK             TAG_CONTEXT_BITS
 #define CTX_HW_MASK             (CTX_NR_MASK | CTX_PGSZ_MASK)
-#define CTX_FIRST_VERSION       ((_AC(1,UL) << CTX_VERSION_SHIFT) + _AC(1,UL))
+#define CTX_FIRST_VERSION       BIT(CTX_VERSION_SHIFT)
 #define CTX_VALID(__ctx)        \
         (!(((__ctx.sparc64_ctx_val) ^ tlb_context_cache) & CTX_VERSION_MASK))
 #define CTX_HWBITS(__ctx)       ((__ctx.sparc64_ctx_val) & CTX_HW_MASK)
diff --git a/arch/sparc/include/asm/mmu_context_64.h b/arch/sparc/include/asm/mmu_context_64.h
index 22fede6eba11..2cddcda4f85f 100644
--- a/arch/sparc/include/asm/mmu_context_64.h
+++ b/arch/sparc/include/asm/mmu_context_64.h
@@ -19,13 +19,8 @@ extern spinlock_t ctx_alloc_lock;
 extern unsigned long tlb_context_cache;
 extern unsigned long mmu_context_bmap[];
+DECLARE_PER_CPU(struct mm_struct *, per_cpu_secondary_mm);
 void get_new_mmu_context(struct mm_struct *mm);
-#ifdef CONFIG_SMP
-void smp_new_mmu_context_version(void);
-#else
-#define smp_new_mmu_context_version() do { } while (0)
-#endif
 int init_new_context(struct task_struct *tsk, struct mm_struct *mm);
 void destroy_context(struct mm_struct *mm);
@@ -76,8 +71,9 @@ void __flush_tlb_mm(unsigned long, unsigned long);
 static inline void switch_mm(struct mm_struct *old_mm, struct mm_struct *mm, struct task_struct *tsk)
 {
        unsigned long ctx_valid, flags;
-        int cpu;
+        int cpu = smp_processor_id();
+        per_cpu(per_cpu_secondary_mm, cpu) = mm;
        if (unlikely(mm == &init_mm))
                return;
@@ -123,7 +119,6 @@ static inline void switch_mm(struct mm_struct *old_mm, struct mm_struct *mm, str
         * for the first time, we must flush that context out of the
         * local TLB.
         */
-        cpu = smp_processor_id();
        if (!ctx_valid || !cpumask_test_cpu(cpu, mm_cpumask(mm))) {
                cpumask_set_cpu(cpu, mm_cpumask(mm));
                __flush_tlb_mm(CTX_HWBITS(mm->context),
@@ -133,26 +128,7 @@ static inline void switch_mm(struct mm_struct *old_mm, struct mm_struct *mm, str
 }
 #define deactivate_mm(tsk,mm)   do { } while (0)
+#define activate_mm(active_mm, mm) switch_mm(active_mm, mm, NULL)
-/* Activate a new MM instance for the current task. */
-static inline void activate_mm(struct mm_struct *active_mm, struct mm_struct *mm)
-{
-        unsigned long flags;
-        int cpu;
-        spin_lock_irqsave(&mm->context.lock, flags);
-        if (!CTX_VALID(mm->context))
-                get_new_mmu_context(mm);
-        cpu = smp_processor_id();
-        if (!cpumask_test_cpu(cpu, mm_cpumask(mm)))
-                cpumask_set_cpu(cpu, mm_cpumask(mm));
-        load_secondary_context(mm);
-        __flush_tlb_mm(CTX_HWBITS(mm->context), SECONDARY_CONTEXT);
-        tsb_context_switch(mm);
-        spin_unlock_irqrestore(&mm->context.lock, flags);
-}
 #endif /* !(__ASSEMBLY__) */
 #endif /* !(__SPARC64_MMU_CONTEXT_H) */
diff --git a/arch/sparc/include/asm/pil.h b/arch/sparc/include/asm/pil.h
index 266937030546..522b43db2ed3 100644
--- a/arch/sparc/include/asm/pil.h
+++ b/arch/sparc/include/asm/pil.h
@@ -20,7 +20,6 @@
 #define PIL_SMP_CALL_FUNC       1
 #define PIL_SMP_RECEIVE_SIGNAL  2
 #define PIL_SMP_CAPTURE         3
-#define PIL_SMP_CTX_NEW_VERSION 4
 #define PIL_DEVICE_IRQ          5
 #define PIL_SMP_CALL_FUNC_SNGL  6
 #define PIL_DEFERRED_PCR_WORK   7
diff --git a/arch/sparc/include/asm/vio.h b/arch/sparc/include/asm/vio.h
index 8174f6cdbbbb..9dca7a892978 100644
--- a/arch/sparc/include/asm/vio.h
+++ b/arch/sparc/include/asm/vio.h
@@ -327,6 +327,7 @@ struct vio_dev {
        int                     compat_len;
        u64                     dev_no;
+        u64                     id;
        unsigned long           channel_id;
diff --git a/arch/sparc/kernel/ds.c b/arch/sparc/kernel/ds.c
index b542cc7c8d94..f87265afb175 100644
--- a/arch/sparc/kernel/ds.c
+++ b/arch/sparc/kernel/ds.c
@@ -909,7 +909,7 @@ static int register_services(struct ds_info *dp)
                pbuf.req.handle = cp->handle;
                pbuf.req.major = 1;
                pbuf.req.minor = 0;
-                strcpy(pbuf.req.svc_id, cp->service_id);
+                strcpy(pbuf.id_buf, cp->service_id);
                err = __ds_send(lp, &pbuf, msg_len);
                if (err > 0)
diff --git a/arch/sparc/kernel/irq_64.c b/arch/sparc/kernel/irq_64.c
index 4d0248aa0928..99dd133a029f 100644
--- a/arch/sparc/kernel/irq_64.c
+++ b/arch/sparc/kernel/irq_64.c
@@ -1034,17 +1034,26 @@ static void __init init_cpu_send_mondo_info(struct trap_per_cpu *tb)
 {
 #ifdef CONFIG_SMP
        unsigned long page;
+        void *mondo, *p;
-        BUILD_BUG_ON((NR_CPUS * sizeof(u16)) > (PAGE_SIZE - 64));
+        BUILD_BUG_ON((NR_CPUS * sizeof(u16)) > PAGE_SIZE);
+        /* Make sure mondo block is 64byte aligned */
+        p = kzalloc(127, GFP_KERNEL);
+        if (!p) {
+                prom_printf("SUN4V: Error, cannot allocate mondo block.\n");
+                prom_halt();
+        }
+        mondo = (void *)(((unsigned long)p + 63) & ~0x3f);
+        tb->cpu_mondo_block_pa = __pa(mondo);
        page = get_zeroed_page(GFP_KERNEL);
        if (!page) {
-                prom_printf("SUN4V: Error, cannot allocate cpu mondo page.\n");
+                prom_printf("SUN4V: Error, cannot allocate cpu list page.\n");
                prom_halt();
        }
-        tb->cpu_mondo_block_pa = __pa(page);
+        tb->cpu_list_pa = __pa(page);
-        tb->cpu_list_pa = __pa(page + 64);
 #endif
 }
diff --git a/arch/sparc/kernel/kernel.h b/arch/sparc/kernel/kernel.h
index c9804551262c..6ae1e77be0bf 100644
--- a/arch/sparc/kernel/kernel.h
+++ b/arch/sparc/kernel/kernel.h
@@ -37,7 +37,6 @@ void handle_stdfmna(struct pt_regs *regs, unsigned long sfar, unsigned long sfsr
 /* smp_64.c */
 void __irq_entry smp_call_function_client(int irq, struct pt_regs *regs);
 void __irq_entry smp_call_function_single_client(int irq, struct pt_regs *regs);
-void __irq_entry smp_new_mmu_context_version_client(int irq, struct pt_regs *regs);
 void __irq_entry smp_penguin_jailcell(int irq, struct pt_regs *regs);
 void __irq_entry smp_receive_signal_client(int irq, struct pt_regs *regs);
diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c
index b3bc0ac757cc..fdf31040a7dc 100644
--- a/arch/sparc/kernel/smp_64.c
+++ b/arch/sparc/kernel/smp_64.c
@@ -964,37 +964,6 @@ void flush_dcache_page_all(struct mm_struct *mm, struct page *page)
        preempt_enable();
 }
-void __irq_entry smp_new_mmu_context_version_client(int irq, struct pt_regs *regs)
-{
-        struct mm_struct *mm;
-        unsigned long flags;
-        clear_softint(1 << irq);
-        /* See if we need to allocate a new TLB context because
-         * the version of the one we are using is now out of date.
-         */
-        mm = current->active_mm;
-        if (unlikely(!mm || (mm == &init_mm)))
-                return;
-        spin_lock_irqsave(&mm->context.lock, flags);
-        if (unlikely(!CTX_VALID(mm->context)))
-                get_new_mmu_context(mm);
-        spin_unlock_irqrestore(&mm->context.lock, flags);
-        load_secondary_context(mm);
-        __flush_tlb_mm(CTX_HWBITS(mm->context),
-                       SECONDARY_CONTEXT);
-}
-void smp_new_mmu_context_version(void)
-{
-        smp_cross_call(&xcall_new_mmu_context_version, 0, 0, 0);
-}
 #ifdef CONFIG_KGDB
 void kgdb_roundup_cpus(unsigned long flags)
 {
diff --git a/arch/sparc/kernel/tsb.S b/arch/sparc/kernel/tsb.S
index 10689cfd0ad4..07c0df924960 100644
--- a/arch/sparc/kernel/tsb.S
+++ b/arch/sparc/kernel/tsb.S
@@ -455,13 +455,16 @@ __tsb_context_switch:
        .type   copy_tsb,#function
 copy_tsb:               /* %o0=old_tsb_base, %o1=old_tsb_size
                         * %o2=new_tsb_base, %o3=new_tsb_size
+                         * %o4=page_size_shift
                         */
        sethi           %uhi(TSB_PASS_BITS), %g7
        srlx            %o3, 4, %o3
-        add             %o0, %o1, %g1   /* end of old tsb */
+        add             %o0, %o1, %o1   /* end of old tsb */
        sllx            %g7, 32, %g7
        sub             %o3, 1, %o3     /* %o3 == new tsb hash mask */
+        mov             %o4, %g1        /* page_size_shift */
 661:    prefetcha       [%o0] ASI_N, #one_read
        .section        .tsb_phys_patch, "ax"
        .word           661b
@@ -486,9 +489,9 @@ copy_tsb:		/* %o0=old_tsb_base, %o1=old_tsb_size
        /* This can definitely be computed faster... */
        srlx            %o0, 4, %o5     /* Build index */
        and             %o5, 511, %o5   /* Mask index */
-        sllx            %o5, PAGE_SHIFT, %o5 /* Put into vaddr position */
+        sllx            %o5, %g1, %o5   /* Put into vaddr position */
        or              %o4, %o5, %o4   /* Full VADDR. */
-        srlx            %o4, PAGE_SHIFT, %o4 /* Shift down to create index */
+        srlx            %o4, %g1, %o4   /* Shift down to create index */
        and             %o4, %o3, %o4   /* Mask with new_tsb_nents-1 */
        sllx            %o4, 4, %o4     /* Shift back up into tsb ent offset */
        TSB_STORE(%o2 + %o4, %g2)       /* Store TAG */
@@ -496,7 +499,7 @@ copy_tsb:		/* %o0=old_tsb_base, %o1=old_tsb_size
        TSB_STORE(%o2 + %o4, %g3)       /* Store TTE */
 80:     add             %o0, 16, %o0
-        cmp             %o0, %g1
+        cmp             %o0, %o1
        bne,pt          %xcc, 90b
         nop
diff --git a/arch/sparc/kernel/ttable_64.S b/arch/sparc/kernel/ttable_64.S
index 7bd8f6556352..efe93ab4a9c0 100644
--- a/arch/sparc/kernel/ttable_64.S
+++ b/arch/sparc/kernel/ttable_64.S
@@ -50,7 +50,7 @@ tl0_resv03e:	BTRAP(0x3e) BTRAP(0x3f) BTRAP(0x40)
 tl0_irq1:       TRAP_IRQ(smp_call_function_client, 1)
 tl0_irq2:       TRAP_IRQ(smp_receive_signal_client, 2)
 tl0_irq3:       TRAP_IRQ(smp_penguin_jailcell, 3)
-tl0_irq4:       TRAP_IRQ(smp_new_mmu_context_version_client, 4)
+tl0_irq4:       BTRAP(0x44)
 #else
 tl0_irq1:       BTRAP(0x41)
 tl0_irq2:       BTRAP(0x42)
diff --git a/arch/sparc/kernel/vio.c b/arch/sparc/kernel/vio.c
index f6bb857254fc..075d38980dee 100644
--- a/arch/sparc/kernel/vio.c
+++ b/arch/sparc/kernel/vio.c
@@ -302,13 +302,16 @@ static struct vio_dev *vio_create_one(struct mdesc_handle *hp, u64 mp,
        if (!id) {
                dev_set_name(&vdev->dev, "%s", bus_id_name);
                vdev->dev_no = ~(u64)0;
+                vdev->id = ~(u64)0;
        } else if (!cfg_handle) {
                dev_set_name(&vdev->dev, "%s-%llu", bus_id_name, *id);
                vdev->dev_no = *id;
+                vdev->id = ~(u64)0;
        } else {
                dev_set_name(&vdev->dev, "%s-%llu-%llu", bus_id_name,
                             *cfg_handle, *id);
                vdev->dev_no = *cfg_handle;
+                vdev->id = *id;
        }
        vdev->dev.parent = parent;
@@ -351,27 +354,84 @@ static void vio_add(struct mdesc_handle *hp, u64 node)
        (void) vio_create_one(hp, node, &root_vdev->dev);
 }
+struct vio_md_node_query {
+        const char *type;
+        u64 dev_no;
+        u64 id;
+};
 static int vio_md_node_match(struct device *dev, void *arg)
 {
+        struct vio_md_node_query *query = (struct vio_md_node_query *) arg;
        struct vio_dev *vdev = to_vio_dev(dev);
-        if (vdev->mp == (u64) arg)
+        if (vdev->dev_no != query->dev_no)
-                return 1;
+                return 0;
+        if (vdev->id != query->id)
+                return 0;
+        if (strcmp(vdev->type, query->type))
+                return 0;
-        return 0;
+        return 1;
 }
 static void vio_remove(struct mdesc_handle *hp, u64 node)
 {
+        const char *type;
+        const u64 *id, *cfg_handle;
+        u64 a;
+        struct vio_md_node_query query;
        struct device *dev;
-        dev = device_find_child(&root_vdev->dev, (void *) node,
+        type = mdesc_get_property(hp, node, "device-type", NULL);
+        if (!type) {
+                type = mdesc_get_property(hp, node, "name", NULL);
+                if (!type)
+                        type = mdesc_node_name(hp, node);
+        }
+        query.type = type;
+        id = mdesc_get_property(hp, node, "id", NULL);
+        cfg_handle = NULL;
+        mdesc_for_each_arc(a, hp, node, MDESC_ARC_TYPE_BACK) {
+                u64 target;
+                target = mdesc_arc_target(hp, a);
+                cfg_handle = mdesc_get_property(hp, target,
+                                                "cfg-handle", NULL);
+                if (cfg_handle)
+                        break;
+        }
+        if (!id) {
+                query.dev_no = ~(u64)0;
+                query.id = ~(u64)0;
+        } else if (!cfg_handle) {
+                query.dev_no = *id;
+                query.id = ~(u64)0;
+        } else {
+                query.dev_no = *cfg_handle;
+                query.id = *id;
+        }
+        dev = device_find_child(&root_vdev->dev, &query,
                                vio_md_node_match);
        if (dev) {
                printk(KERN_INFO "VIO: Removing device %s\n", dev_name(dev));
                device_unregister(dev);
                put_device(dev);
+        } else {
+                if (!id)
+                        printk(KERN_ERR "VIO: Removed unknown %s node.\n",
+                               type);
+                else if (!cfg_handle)
+                        printk(KERN_ERR "VIO: Removed unknown %s node %llu.\n",
+                               type, *id);
+                else
+                        printk(KERN_ERR "VIO: Removed unknown %s node %llu-%llu.\n",
+                               type, *cfg_handle, *id);
        }
 }
diff --git a/arch/sparc/lib/Makefile b/arch/sparc/lib/Makefile
index 69912d2f8b54..07c03e72d812 100644
--- a/arch/sparc/lib/Makefile
+++ b/arch/sparc/lib/Makefile
@@ -15,6 +15,7 @@ lib-$(CONFIG_SPARC32) += copy_user.o locks.o
 lib-$(CONFIG_SPARC64) += atomic_64.o
 lib-$(CONFIG_SPARC32) += lshrdi3.o ashldi3.o
 lib-$(CONFIG_SPARC32) += muldi3.o bitext.o cmpdi2.o
+lib-$(CONFIG_SPARC64) += multi3.o
 lib-$(CONFIG_SPARC64) += copy_page.o clear_page.o bzero.o
 lib-$(CONFIG_SPARC64) += csum_copy.o csum_copy_from_user.o csum_copy_to_user.o
diff --git a/arch/sparc/lib/multi3.S b/arch/sparc/lib/multi3.S
new file mode 100644
index 000000000000..d6b6c97fe3c7
--- /dev/null
+++ b/arch/sparc/lib/multi3.S
@@ -0,0 +1,35 @@
+#include <linux/linkage.h>
+#include <asm/export.h>
+        .text
+        .align  4
+ENTRY(__multi3) /* %o0 = u, %o1 = v */
+        mov     %o1, %g1
+        srl     %o3, 0, %g4
+        mulx    %g4, %g1, %o1
+        srlx    %g1, 0x20, %g3
+        mulx    %g3, %g4, %g5
+        sllx    %g5, 0x20, %o5
+        srl     %g1, 0, %g4
+        sub     %o1, %o5, %o5
+        srlx    %o5, 0x20, %o5
+        addcc   %g5, %o5, %g5
+        srlx    %o3, 0x20, %o5
+        mulx    %g4, %o5, %g4
+        mulx    %g3, %o5, %o5
+        sethi   %hi(0x80000000), %g3
+        addcc   %g5, %g4, %g5
+        srlx    %g5, 0x20, %g5
+        add     %g3, %g3, %g3
+        movcc   %xcc, %g0, %g3
+        addcc   %o5, %g5, %o5
+        sllx    %g4, 0x20, %g4
+        add     %o1, %g4, %o1
+        add     %o5, %g3, %g2
+        mulx    %g1, %o2, %g1
+        add     %g1, %g2, %g1
+        mulx    %o0, %o3, %o0
+        retl
+         add    %g1, %o0, %o0
+ENDPROC(__multi3)
+EXPORT_SYMBOL(__multi3)
diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
index 0cda653ae007..3c40ebd50f92 100644
--- a/arch/sparc/mm/init_64.c
+++ b/arch/sparc/mm/init_64.c
@@ -358,7 +358,8 @@ static int __init setup_hugepagesz(char *string)
        }
        if ((hv_pgsz_mask & cpu_pgsz_mask) == 0U) {
-                pr_warn("hugepagesz=%llu not supported by MMU.\n",
+                hugetlb_bad_size();
+                pr_err("hugepagesz=%llu not supported by MMU.\n",
                        hugepage_size);
                goto out;
        }
@@ -706,10 +707,58 @@ EXPORT_SYMBOL(__flush_dcache_range);
 /* get_new_mmu_context() uses "cache + 1".  */
 DEFINE_SPINLOCK(ctx_alloc_lock);
-unsigned long tlb_context_cache = CTX_FIRST_VERSION - 1;
+unsigned long tlb_context_cache = CTX_FIRST_VERSION;
 #define MAX_CTX_NR      (1UL << CTX_NR_BITS)
 #define CTX_BMAP_SLOTS  BITS_TO_LONGS(MAX_CTX_NR)
 DECLARE_BITMAP(mmu_context_bmap, MAX_CTX_NR);
+DEFINE_PER_CPU(struct mm_struct *, per_cpu_secondary_mm) = {0};
+static void mmu_context_wrap(void)
+{
+        unsigned long old_ver = tlb_context_cache & CTX_VERSION_MASK;
+        unsigned long new_ver, new_ctx, old_ctx;
+        struct mm_struct *mm;
+        int cpu;
+        bitmap_zero(mmu_context_bmap, 1 << CTX_NR_BITS);
+        /* Reserve kernel context */
+        set_bit(0, mmu_context_bmap);
+        new_ver = (tlb_context_cache & CTX_VERSION_MASK) + CTX_FIRST_VERSION;
+        if (unlikely(new_ver == 0))
+                new_ver = CTX_FIRST_VERSION;
+        tlb_context_cache = new_ver;
+        /*
+         * Make sure that any new mm that are added into per_cpu_secondary_mm,
+         * are going to go through get_new_mmu_context() path.
+         */
+        mb();
+        /*
+         * Updated versions to current on those CPUs that had valid secondary
+         * contexts
+         */
+        for_each_online_cpu(cpu) {
+                /*
+                 * If a new mm is stored after we took this mm from the array,
+                 * it will go into get_new_mmu_context() path, because we
+                 * already bumped the version in tlb_context_cache.
+                 */
+                mm = per_cpu(per_cpu_secondary_mm, cpu);
+                if (unlikely(!mm || mm == &init_mm))
+                        continue;
+                old_ctx = mm->context.sparc64_ctx_val;
+                if (likely((old_ctx & CTX_VERSION_MASK) == old_ver)) {
+                        new_ctx = (old_ctx & ~CTX_VERSION_MASK) | new_ver;
+                        set_bit(new_ctx & CTX_NR_MASK, mmu_context_bmap);
+                        mm->context.sparc64_ctx_val = new_ctx;
+                }
+        }
+}
 /* Caller does TLB context flushing on local CPU if necessary.
 * The caller also ensures that CTX_VALID(mm->context) is false.
@@ -725,48 +774,30 @@ void get_new_mmu_context(struct mm_struct *mm)
 {
        unsigned long ctx, new_ctx;
        unsigned long orig_pgsz_bits;
-        int new_version;
        spin_lock(&ctx_alloc_lock);
+retry:
+        /* wrap might have happened, test again if our context became valid */
+        if (unlikely(CTX_VALID(mm->context)))
+                goto out;
        orig_pgsz_bits = (mm->context.sparc64_ctx_val & CTX_PGSZ_MASK);
        ctx = (tlb_context_cache + 1) & CTX_NR_MASK;
        new_ctx = find_next_zero_bit(mmu_context_bmap, 1 << CTX_NR_BITS, ctx);
-        new_version = 0;
        if (new_ctx >= (1 << CTX_NR_BITS)) {
                new_ctx = find_next_zero_bit(mmu_context_bmap, ctx, 1);
                if (new_ctx >= ctx) {
-                        int i;
+                        mmu_context_wrap();
-                        new_ctx = (tlb_context_cache & CTX_VERSION_MASK) +
+                        goto retry;
-                                CTX_FIRST_VERSION;
-                        if (new_ctx == 1)
-                                new_ctx = CTX_FIRST_VERSION;
-                        /* Don't call memset, for 16 entries that's just
-                         * plain silly...
-                         */
-                        mmu_context_bmap[0] = 3;
-                        mmu_context_bmap[1] = 0;
-                        mmu_context_bmap[2] = 0;
-                        mmu_context_bmap[3] = 0;
-                        for (i = 4; i < CTX_BMAP_SLOTS; i += 4) {
-                                mmu_context_bmap[i + 0] = 0;
-                                mmu_context_bmap[i + 1] = 0;
-                                mmu_context_bmap[i + 2] = 0;
-                                mmu_context_bmap[i + 3] = 0;
-                        }
-                        new_version = 1;
-                        goto out;
                }
        }
+        if (mm->context.sparc64_ctx_val)
+                cpumask_clear(mm_cpumask(mm));
        mmu_context_bmap[new_ctx>>6] |= (1UL << (new_ctx & 63));
        new_ctx |= (tlb_context_cache & CTX_VERSION_MASK);
-out:
        tlb_context_cache = new_ctx;
        mm->context.sparc64_ctx_val = new_ctx | orig_pgsz_bits;
+out:
        spin_unlock(&ctx_alloc_lock);
-        if (unlikely(new_version))
-                smp_new_mmu_context_version();
 }
 static int numa_enabled = 1;
diff --git a/arch/sparc/mm/tsb.c b/arch/sparc/mm/tsb.c
index bedf08b22a47..0d4b998c7d7b 100644
--- a/arch/sparc/mm/tsb.c
+++ b/arch/sparc/mm/tsb.c
@@ -496,7 +496,8 @@ retry_tsb_alloc:
                extern void copy_tsb(unsigned long old_tsb_base,
                                     unsigned long old_tsb_size,
                                     unsigned long new_tsb_base,
-                                     unsigned long new_tsb_size);
+                                     unsigned long new_tsb_size,
+                                     unsigned long page_size_shift);
                unsigned long old_tsb_base = (unsigned long) old_tsb;
                unsigned long new_tsb_base = (unsigned long) new_tsb;
@@ -504,7 +505,9 @@ retry_tsb_alloc:
                        old_tsb_base = __pa(old_tsb_base);
                        new_tsb_base = __pa(new_tsb_base);
                }
-                copy_tsb(old_tsb_base, old_size, new_tsb_base, new_size);
+                copy_tsb(old_tsb_base, old_size, new_tsb_base, new_size,
+                        tsb_index == MM_TSB_BASE ?
+                        PAGE_SHIFT : REAL_HPAGE_SHIFT);
        }
        mm->context.tsb_block[tsb_index].tsb = new_tsb;
diff --git a/arch/sparc/mm/ultra.S b/arch/sparc/mm/ultra.S
index 5d2fd6cd3189..fcf4d27a38fb 100644
--- a/arch/sparc/mm/ultra.S
+++ b/arch/sparc/mm/ultra.S
@@ -971,11 +971,6 @@ xcall_capture:
        wr              %g0, (1 << PIL_SMP_CAPTURE), %set_softint
        retry
-        .globl          xcall_new_mmu_context_version
-xcall_new_mmu_context_version:
-        wr              %g0, (1 << PIL_SMP_CTX_NEW_VERSION), %set_softint
-        retry
 #ifdef CONFIG_KGDB
        .globl          xcall_kgdb_capture
 xcall_kgdb_capture:
diff --git a/arch/x86/kernel/cpu/cyrix.c b/arch/x86/kernel/cpu/cyrix.c
index a70fd61095f8..6f077445647a 100644
--- a/arch/x86/kernel/cpu/cyrix.c
+++ b/arch/x86/kernel/cpu/cyrix.c
@@ -255,6 +255,7 @@ static void init_cyrix(struct cpuinfo_x86 *c)
                break;
        case 4: /* MediaGX/GXm or Geode GXM/GXLV/GX1 */
+        case 11: /* GX1 with inverted Device ID */
 #ifdef CONFIG_PCI
        {
                u32 vendor, device;
diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c
index afdfd237b59f..f522415bf9e5 100644
--- a/arch/x86/kernel/cpu/microcode/intel.c
+++ b/arch/x86/kernel/cpu/microcode/intel.c
@@ -619,6 +619,9 @@ int __init save_microcode_in_initrd_intel(void)
        show_saved_mc();
+        /* initrd is going away, clear patch ptr. */
+        intel_ucode_patch = NULL;
        return 0;
 }
diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c
index c8a32fb345cf..78b2e0db4fb2 100644
--- a/block/bfq-cgroup.c
+++ b/block/bfq-cgroup.c
@@ -52,7 +52,7 @@ BFQG_FLAG_FNS(idling)
 BFQG_FLAG_FNS(empty)
 #undef BFQG_FLAG_FNS
-/* This should be called with the queue_lock held. */
+/* This should be called with the scheduler lock held. */
 static void bfqg_stats_update_group_wait_time(struct bfqg_stats *stats)
 {
        unsigned long long now;
@@ -67,7 +67,7 @@ static void bfqg_stats_update_group_wait_time(struct bfqg_stats *stats)
        bfqg_stats_clear_waiting(stats);
 }
-/* This should be called with the queue_lock held. */
+/* This should be called with the scheduler lock held. */
 static void bfqg_stats_set_start_group_wait_time(struct bfq_group *bfqg,
                                                 struct bfq_group *curr_bfqg)
 {
@@ -81,7 +81,7 @@ static void bfqg_stats_set_start_group_wait_time(struct bfq_group *bfqg,
        bfqg_stats_mark_waiting(stats);
 }
-/* This should be called with the queue_lock held. */
+/* This should be called with the scheduler lock held. */
 static void bfqg_stats_end_empty_time(struct bfqg_stats *stats)
 {
        unsigned long long now;
@@ -203,12 +203,30 @@ struct bfq_group *bfqq_group(struct bfq_queue *bfqq)
 static void bfqg_get(struct bfq_group *bfqg)
 {
-        return blkg_get(bfqg_to_blkg(bfqg));
+        bfqg->ref++;
 }
 void bfqg_put(struct bfq_group *bfqg)
 {
-        return blkg_put(bfqg_to_blkg(bfqg));
+        bfqg->ref--;
+        if (bfqg->ref == 0)
+                kfree(bfqg);
+}
+static void bfqg_and_blkg_get(struct bfq_group *bfqg)
+{
+        /* see comments in bfq_bic_update_cgroup for why refcounting bfqg */
+        bfqg_get(bfqg);
+        blkg_get(bfqg_to_blkg(bfqg));
+}
+void bfqg_and_blkg_put(struct bfq_group *bfqg)
+{
+        bfqg_put(bfqg);
+        blkg_put(bfqg_to_blkg(bfqg));
 }
 void bfqg_stats_update_io_add(struct bfq_group *bfqg, struct bfq_queue *bfqq,
@@ -312,7 +330,11 @@ void bfq_init_entity(struct bfq_entity *entity, struct bfq_group *bfqg)
        if (bfqq) {
                bfqq->ioprio = bfqq->new_ioprio;
                bfqq->ioprio_class = bfqq->new_ioprio_class;
-                bfqg_get(bfqg);
+                /*
+                 * Make sure that bfqg and its associated blkg do not
+                 * disappear before entity.
+                 */
+                bfqg_and_blkg_get(bfqg);
        }
        entity->parent = bfqg->my_entity; /* NULL for root group */
        entity->sched_data = &bfqg->sched_data;
@@ -399,6 +421,8 @@ struct blkg_policy_data *bfq_pd_alloc(gfp_t gfp, int node)
                return NULL;
        }
+        /* see comments in bfq_bic_update_cgroup for why refcounting */
+        bfqg_get(bfqg);
        return &bfqg->pd;
 }
@@ -426,7 +450,7 @@ void bfq_pd_free(struct blkg_policy_data *pd)
        struct bfq_group *bfqg = pd_to_bfqg(pd);
        bfqg_stats_exit(&bfqg->stats);
-        return kfree(bfqg);
+        bfqg_put(bfqg);
 }
 void bfq_pd_reset_stats(struct blkg_policy_data *pd)
@@ -496,9 +520,10 @@ struct bfq_group *bfq_find_set_group(struct bfq_data *bfqd,
 * Move @bfqq to @bfqg, deactivating it from its old group and reactivating
 * it on the new one.  Avoid putting the entity on the old group idle tree.
 *
- * Must be called under the queue lock; the cgroup owning @bfqg must
+ * Must be called under the scheduler lock, to make sure that the blkg
- * not disappear (by now this just means that we are called under
+ * owning @bfqg does not disappear (see comments in
- * rcu_read_lock()).
+ * bfq_bic_update_cgroup on guaranteeing the consistency of blkg
+ * objects).
 */
 void bfq_bfqq_move(struct bfq_data *bfqd, struct bfq_queue *bfqq,
                   struct bfq_group *bfqg)
@@ -519,16 +544,12 @@ void bfq_bfqq_move(struct bfq_data *bfqd, struct bfq_queue *bfqq,
                bfq_deactivate_bfqq(bfqd, bfqq, false, false);
        else if (entity->on_st)
                bfq_put_idle_entity(bfq_entity_service_tree(entity), entity);
-        bfqg_put(bfqq_group(bfqq));
+        bfqg_and_blkg_put(bfqq_group(bfqq));
-        /*
-         * Here we use a reference to bfqg.  We don't need a refcounter
-         * as the cgroup reference will not be dropped, so that its
-         * destroy() callback will not be invoked.
-         */
        entity->parent = bfqg->my_entity;
        entity->sched_data = &bfqg->sched_data;
-        bfqg_get(bfqg);
+        /* pin down bfqg and its associated blkg  */
+        bfqg_and_blkg_get(bfqg);
        if (bfq_bfqq_busy(bfqq)) {
                bfq_pos_tree_add_move(bfqd, bfqq);
@@ -545,8 +566,9 @@ void bfq_bfqq_move(struct bfq_data *bfqd, struct bfq_queue *bfqq,
 * @bic: the bic to move.
 * @blkcg: the blk-cgroup to move to.
 *
- * Move bic to blkcg, assuming that bfqd->queue is locked; the caller
+ * Move bic to blkcg, assuming that bfqd->lock is held; which makes
- * has to make sure that the reference to cgroup is valid across the call.
+ * sure that the reference to cgroup is valid across the call (see
+ * comments in bfq_bic_update_cgroup on this issue)
 *
 * NOTE: an alternative approach might have been to store the current
 * cgroup in bfqq and getting a reference to it, reducing the lookup
@@ -604,6 +626,57 @@ void bfq_bic_update_cgroup(struct bfq_io_cq *bic, struct bio *bio)
                goto out;
        bfqg = __bfq_bic_change_cgroup(bfqd, bic, bio_blkcg(bio));
+        /*
+         * Update blkg_path for bfq_log_* functions. We cache this
+         * path, and update it here, for the following
+         * reasons. Operations on blkg objects in blk-cgroup are
+         * protected with the request_queue lock, and not with the
+         * lock that protects the instances of this scheduler
+         * (bfqd->lock). This exposes BFQ to the following sort of
+         * race.
+         *
+         * The blkg_lookup performed in bfq_get_queue, protected
+         * through rcu, may happen to return the address of a copy of
+         * the original blkg. If this is the case, then the
+         * bfqg_and_blkg_get performed in bfq_get_queue, to pin down
+         * the blkg, is useless: it does not prevent blk-cgroup code
+         * from destroying both the original blkg and all objects
+         * directly or indirectly referred by the copy of the
+         * blkg.
+         *
+         * On the bright side, destroy operations on a blkg invoke, as
+         * a first step, hooks of the scheduler associated with the
+         * blkg. And these hooks are executed with bfqd->lock held for
+         * BFQ. As a consequence, for any blkg associated with the
+         * request queue this instance of the scheduler is attached
+         * to, we are guaranteed that such a blkg is not destroyed, and
+         * that all the pointers it contains are consistent, while we
+         * are holding bfqd->lock. A blkg_lookup performed with
+         * bfqd->lock held then returns a fully consistent blkg, which
+         * remains consistent until this lock is held.
+         *
+         * Thanks to the last fact, and to the fact that: (1) bfqg has
+         * been obtained through a blkg_lookup in the above
+         * assignment, and (2) bfqd->lock is being held, here we can
+         * safely use the policy data for the involved blkg (i.e., the
+         * field bfqg->pd) to get to the blkg associated with bfqg,
+         * and then we can safely use any field of blkg. After we
+         * release bfqd->lock, even just getting blkg through this
+         * bfqg may cause dangling references to be traversed, as
+         * bfqg->pd may not exist any more.
+         *
+         * In view of the above facts, here we cache, in the bfqg, any
+         * blkg data we may need for this bic, and for its associated
+         * bfq_queue. As of now, we need to cache only the path of the
+         * blkg, which is used in the bfq_log_* functions.
+         *
+         * Finally, note that bfqg itself needs to be protected from
+         * destruction on the blkg_free of the original blkg (which
+         * invokes bfq_pd_free). We use an additional private
+         * refcounter for bfqg, to let it disappear only after no
+         * bfq_queue refers to it any longer.
+         */
+        blkg_path(bfqg_to_blkg(bfqg), bfqg->blkg_path, sizeof(bfqg->blkg_path));
        bic->blkcg_serial_nr = serial_nr;
 out:
        rcu_read_unlock();
@@ -640,8 +713,6 @@ static void bfq_reparent_leaf_entity(struct bfq_data *bfqd,
 * @bfqd: the device data structure with the root group.
 * @bfqg: the group to move from.
 * @st: the service tree with the entities.
- *
- * Needs queue_lock to be taken and reference to be valid over the call.
 */
 static void bfq_reparent_active_entities(struct bfq_data *bfqd,
                                         struct bfq_group *bfqg,
@@ -692,8 +763,7 @@ void bfq_pd_offline(struct blkg_policy_data *pd)
                /*
                 * The idle tree may still contain bfq_queues belonging
                 * to exited task because they never migrated to a different
-                 * cgroup from the one being destroyed now.  No one else
+                 * cgroup from the one being destroyed now.
-                 * can access them so it's safe to act without any lock.
                 */
                bfq_flush_idle_tree(st);
diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
index 08ce45096350..ed93da2462ab 100644
--- a/block/bfq-iosched.c
+++ b/block/bfq-iosched.c
@@ -3665,7 +3665,7 @@ void bfq_put_queue(struct bfq_queue *bfqq)
        kmem_cache_free(bfq_pool, bfqq);
 #ifdef CONFIG_BFQ_GROUP_IOSCHED
-        bfqg_put(bfqg);
+        bfqg_and_blkg_put(bfqg);
 #endif
 }
diff --git a/block/bfq-iosched.h b/block/bfq-iosched.h
index ae783c06dfd9..5c3bf9861492 100644
--- a/block/bfq-iosched.h
+++ b/block/bfq-iosched.h
@@ -759,6 +759,12 @@ struct bfq_group {
        /* must be the first member */
        struct blkg_policy_data pd;
+        /* cached path for this blkg (see comments in bfq_bic_update_cgroup) */
+        char blkg_path[128];
+        /* reference counter (see comments in bfq_bic_update_cgroup) */
+        int ref;
        struct bfq_entity entity;
        struct bfq_sched_data sched_data;
@@ -838,7 +844,7 @@ struct bfq_group *bfq_find_set_group(struct bfq_data *bfqd,
 struct blkcg_gq *bfqg_to_blkg(struct bfq_group *bfqg);
 struct bfq_group *bfqq_group(struct bfq_queue *bfqq);
 struct bfq_group *bfq_create_group_hierarchy(struct bfq_data *bfqd, int node);
-void bfqg_put(struct bfq_group *bfqg);
+void bfqg_and_blkg_put(struct bfq_group *bfqg);
 #ifdef CONFIG_BFQ_GROUP_IOSCHED
 extern struct cftype bfq_blkcg_legacy_files[];
@@ -910,20 +916,13 @@ void bfq_add_bfqq_busy(struct bfq_data *bfqd, struct bfq_queue *bfqq);
 struct bfq_group *bfqq_group(struct bfq_queue *bfqq);
 #define bfq_log_bfqq(bfqd, bfqq, fmt, args...)  do {                    \
-        char __pbuf[128];                                               \
+        blk_add_trace_msg((bfqd)->queue, "bfq%d%c %s " fmt, (bfqq)->pid,\
-                                                                        \
-        blkg_path(bfqg_to_blkg(bfqq_group(bfqq)), __pbuf, sizeof(__pbuf)); \
-        blk_add_trace_msg((bfqd)->queue, "bfq%d%c %s " fmt, (bfqq)->pid, \
                        bfq_bfqq_sync((bfqq)) ? 'S' : 'A',              \
-                          __pbuf, ##args);                              \
+                        bfqq_group(bfqq)->blkg_path, ##args);           \
 } while (0)
-#define bfq_log_bfqg(bfqd, bfqg, fmt, args...)  do {                    \
+#define bfq_log_bfqg(bfqd, bfqg, fmt, args...)  \
-        char __pbuf[128];                                               \
+        blk_add_trace_msg((bfqd)->queue, "%s " fmt, (bfqg)->blkg_path, ##args)
-                                                                        \
-        blkg_path(bfqg_to_blkg(bfqg), __pbuf, sizeof(__pbuf));          \
-        blk_add_trace_msg((bfqd)->queue, "%s " fmt, __pbuf, ##args);    \
-} while (0)
 #else /* CONFIG_BFQ_GROUP_IOSCHED */
diff --git a/block/bio-integrity.c b/block/bio-integrity.c
index 5384713d48bc..b5009a896a7f 100644
--- a/block/bio-integrity.c
+++ b/block/bio-integrity.c
@@ -175,6 +175,9 @@ bool bio_integrity_enabled(struct bio *bio)
        if (bio_op(bio) != REQ_OP_READ && bio_op(bio) != REQ_OP_WRITE)
                return false;
+        if (!bio_sectors(bio))
+                return false;
        /* Already protected? */
        if (bio_integrity(bio))
                return false;
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 1bcccedcc74f..bb66c96850b1 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -1461,22 +1461,28 @@ static blk_qc_t request_to_qc_t(struct blk_mq_hw_ctx *hctx, struct request *rq)
        return blk_tag_to_qc_t(rq->internal_tag, hctx->queue_num, true);
 }
-static void __blk_mq_try_issue_directly(struct request *rq, blk_qc_t *cookie,
+static void __blk_mq_try_issue_directly(struct blk_mq_hw_ctx *hctx,
-                                      bool may_sleep)
+                                        struct request *rq,
+                                        blk_qc_t *cookie, bool may_sleep)
 {
        struct request_queue *q = rq->q;
        struct blk_mq_queue_data bd = {
                .rq = rq,
                .last = true,
        };
-        struct blk_mq_hw_ctx *hctx;
        blk_qc_t new_cookie;
        int ret;
+        bool run_queue = true;
+        if (blk_mq_hctx_stopped(hctx)) {
+                run_queue = false;
+                goto insert;
+        }
        if (q->elevator)
                goto insert;
-        if (!blk_mq_get_driver_tag(rq, &hctx, false))
+        if (!blk_mq_get_driver_tag(rq, NULL, false))
                goto insert;
        new_cookie = request_to_qc_t(hctx, rq);
@@ -1500,7 +1506,7 @@ static void __blk_mq_try_issue_directly(struct request *rq, blk_qc_t *cookie,
        __blk_mq_requeue_request(rq);
 insert:
-        blk_mq_sched_insert_request(rq, false, true, false, may_sleep);
+        blk_mq_sched_insert_request(rq, false, run_queue, false, may_sleep);
 }
 static void blk_mq_try_issue_directly(struct blk_mq_hw_ctx *hctx,
@@ -1508,7 +1514,7 @@ static void blk_mq_try_issue_directly(struct blk_mq_hw_ctx *hctx,
 {
        if (!(hctx->flags & BLK_MQ_F_BLOCKING)) {
                rcu_read_lock();
-                __blk_mq_try_issue_directly(rq, cookie, false);
+                __blk_mq_try_issue_directly(hctx, rq, cookie, false);
                rcu_read_unlock();
        } else {
                unsigned int srcu_idx;
@@ -1516,7 +1522,7 @@ static void blk_mq_try_issue_directly(struct blk_mq_hw_ctx *hctx,
                might_sleep();
                srcu_idx = srcu_read_lock(&hctx->queue_rq_srcu);
-                __blk_mq_try_issue_directly(rq, cookie, true);
+                __blk_mq_try_issue_directly(hctx, rq, cookie, true);
                srcu_read_unlock(&hctx->queue_rq_srcu, srcu_idx);
        }
 }
@@ -1619,9 +1625,12 @@ static blk_qc_t blk_mq_make_request(struct request_queue *q, struct bio *bio)
                blk_mq_put_ctx(data.ctx);
-                if (same_queue_rq)
+                if (same_queue_rq) {
+                        data.hctx = blk_mq_map_queue(q,
+                                        same_queue_rq->mq_ctx->cpu);
                        blk_mq_try_issue_directly(data.hctx, same_queue_rq,
                                        &cookie);
+                }
        } else if (q->nr_hw_queues > 1 && is_sync) {
                blk_mq_put_ctx(data.ctx);
                blk_mq_bio_to_request(rq, bio);
diff --git a/block/blk-throttle.c b/block/blk-throttle.c
index fc13dd0c6e39..a7285bf2831c 100644
--- a/block/blk-throttle.c
+++ b/block/blk-throttle.c
@@ -27,6 +27,13 @@ static int throtl_quantum = 32;
 #define MIN_THROTL_IOPS (10)
 #define DFL_LATENCY_TARGET (-1L)
 #define DFL_IDLE_THRESHOLD (0)
+#define DFL_HD_BASELINE_LATENCY (4000L) /* 4ms */
+#define LATENCY_FILTERED_SSD (0)
+/*
+ * For HD, very small latency comes from sequential IO. Such IO is helpless to
+ * help determine if its IO is impacted by others, hence we ignore the IO
+ */
+#define LATENCY_FILTERED_HD (1000L) /* 1ms */
 #define SKIP_LATENCY (((u64)1) << BLK_STAT_RES_SHIFT)
@@ -212,6 +219,7 @@ struct throtl_data
        struct avg_latency_bucket avg_buckets[LATENCY_BUCKET_SIZE];
        struct latency_bucket __percpu *latency_buckets;
        unsigned long last_calculate_time;
+        unsigned long filtered_latency;
        bool track_bio_latency;
 };
@@ -698,7 +706,7 @@ static void throtl_dequeue_tg(struct throtl_grp *tg)
 static void throtl_schedule_pending_timer(struct throtl_service_queue *sq,
                                          unsigned long expires)
 {
-        unsigned long max_expire = jiffies + 8 * sq_to_tg(sq)->td->throtl_slice;
+        unsigned long max_expire = jiffies + 8 * sq_to_td(sq)->throtl_slice;
        /*
         * Since we are adjusting the throttle limit dynamically, the sleep
@@ -2281,7 +2289,7 @@ void blk_throtl_bio_endio(struct bio *bio)
                throtl_track_latency(tg->td, blk_stat_size(&bio->bi_issue_stat),
                        bio_op(bio), lat);
-        if (tg->latency_target) {
+        if (tg->latency_target && lat >= tg->td->filtered_latency) {
                int bucket;
                unsigned int threshold;
@@ -2417,14 +2425,20 @@ void blk_throtl_exit(struct request_queue *q)
 void blk_throtl_register_queue(struct request_queue *q)
 {
        struct throtl_data *td;
+        int i;
        td = q->td;
        BUG_ON(!td);
-        if (blk_queue_nonrot(q))
+        if (blk_queue_nonrot(q)) {
                td->throtl_slice = DFL_THROTL_SLICE_SSD;
-        else
+                td->filtered_latency = LATENCY_FILTERED_SSD;
+        } else {
                td->throtl_slice = DFL_THROTL_SLICE_HD;
+                td->filtered_latency = LATENCY_FILTERED_HD;
+                for (i = 0; i < LATENCY_BUCKET_SIZE; i++)
+                        td->avg_buckets[i].latency = DFL_HD_BASELINE_LATENCY;
+        }
 #ifndef CONFIG_BLK_DEV_THROTTLING_LOW
        /* if no low limit, use previous default */
        td->throtl_slice = DFL_THROTL_SLICE_HD;
diff --git a/crypto/asymmetric_keys/public_key.c b/crypto/asymmetric_keys/public_key.c
index d3a989e718f5..3cd6e12cfc46 100644
--- a/crypto/asymmetric_keys/public_key.c
+++ b/crypto/asymmetric_keys/public_key.c
@@ -141,7 +141,7 @@ int public_key_verify_signature(const struct public_key *pkey,
         * signature and returns that to us.
         */
        ret = crypto_akcipher_verify(req);
-        if (ret == -EINPROGRESS) {
+        if ((ret == -EINPROGRESS) || (ret == -EBUSY)) {
                wait_for_completion(&compl.completion);
                ret = compl.err;
        }
diff --git a/crypto/drbg.c b/crypto/drbg.c
index fa749f470135..cdb27ac4b226 100644
--- a/crypto/drbg.c
+++ b/crypto/drbg.c
@@ -1767,9 +1767,8 @@ static int drbg_kcapi_sym_ctr(struct drbg_state *drbg,
                        break;
                case -EINPROGRESS:
                case -EBUSY:
-                        ret = wait_for_completion_interruptible(
+                        wait_for_completion(&drbg->ctr_completion);
-                                &drbg->ctr_completion);
+                        if (!drbg->ctr_async_err) {
-                        if (!ret && !drbg->ctr_async_err) {
                                reinit_completion(&drbg->ctr_completion);
                                break;
                        }
diff --git a/crypto/gcm.c b/crypto/gcm.c
index b7ad808be3d4..3841b5eafa7e 100644
--- a/crypto/gcm.c
+++ b/crypto/gcm.c
@@ -152,10 +152,8 @@ static int crypto_gcm_setkey(struct crypto_aead *aead, const u8 *key,
        err = crypto_skcipher_encrypt(&data->req);
        if (err == -EINPROGRESS || err == -EBUSY) {
-                err = wait_for_completion_interruptible(
+                wait_for_completion(&data->result.completion);
-                        &data->result.completion);
+                err = data->result.err;
-                if (!err)
-                        err = data->result.err;
        }
        if (err)
diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c
index c5fecf97ee2f..797b28dc7b34 100644
--- a/drivers/acpi/arm64/iort.c
+++ b/drivers/acpi/arm64/iort.c
@@ -666,14 +666,6 @@ static const struct iommu_ops *iort_iommu_xlate(struct device *dev,
        int ret = -ENODEV;
        struct fwnode_handle *iort_fwnode;
-        /*
-         * If we already translated the fwspec there
-         * is nothing left to do, return the iommu_ops.
-         */
-        ops = iort_fwspec_iommu_ops(dev->iommu_fwspec);
-        if (ops)
-                return ops;
        if (node) {
                iort_fwnode = iort_get_fwnode(node);
                if (!iort_fwnode)
@@ -735,6 +727,14 @@ const struct iommu_ops *iort_iommu_configure(struct device *dev)
        u32 streamid = 0;
        int err;
+        /*
+         * If we already translated the fwspec there
+         * is nothing left to do, return the iommu_ops.
+         */
+        ops = iort_fwspec_iommu_ops(dev->iommu_fwspec);
+        if (ops)
+                return ops;
        if (dev_is_pci(dev)) {
                struct pci_bus *bus = to_pci_dev(dev)->bus;
                u32 rid;
@@ -782,6 +782,12 @@ const struct iommu_ops *iort_iommu_configure(struct device *dev)
        if (err)
                ops = ERR_PTR(err);
+        /* Ignore all other errors apart from EPROBE_DEFER */
+        if (IS_ERR(ops) && (PTR_ERR(ops) != -EPROBE_DEFER)) {
+                dev_dbg(dev, "Adding to IOMMU failed: %ld\n", PTR_ERR(ops));
+                ops = NULL;
+        }
        return ops;
 }
diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index a9a9ab3399d4..d42eeef9d928 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -782,7 +782,7 @@ static int acpi_battery_update(struct acpi_battery *battery, bool resume)
        if ((battery->state & ACPI_BATTERY_STATE_CRITICAL) ||
            (test_bit(ACPI_BATTERY_ALARM_PRESENT, &battery->flags) &&
            (battery->capacity_now <= battery->alarm)))
-                pm_wakeup_hard_event(&battery->device->dev);
+                pm_wakeup_event(&battery->device->dev, 0);
        return result;
 }
diff --git a/drivers/acpi/button.c b/drivers/acpi/button.c
index 9ad8cdb58743..e19f530f1083 100644
--- a/drivers/acpi/button.c
+++ b/drivers/acpi/button.c
@@ -217,7 +217,7 @@ static int acpi_lid_notify_state(struct acpi_device *device, int state)
        }
        if (state)
-                pm_wakeup_hard_event(&device->dev);
+                pm_wakeup_event(&device->dev, 0);
        ret = blocking_notifier_call_chain(&acpi_lid_notifier, state, device);
        if (ret == NOTIFY_DONE)
@@ -402,7 +402,7 @@ static void acpi_button_notify(struct acpi_device *device, u32 event)
                } else {
                        int keycode;
-                        pm_wakeup_hard_event(&device->dev);
+                        pm_wakeup_event(&device->dev, 0);
                        if (button->suspended)
                                break;
@@ -534,7 +534,6 @@ static int acpi_button_add(struct acpi_device *device)
                lid_device = device;
        }
-        device_init_wakeup(&device->dev, true);
        printk(KERN_INFO PREFIX "%s [%s]\n", name, acpi_device_bid(device));
        return 0;
diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
index 798d5003a039..993fd31394c8 100644
--- a/drivers/acpi/device_pm.c
+++ b/drivers/acpi/device_pm.c
@@ -24,7 +24,6 @@
 #include <linux/pm_qos.h>
 #include <linux/pm_domain.h>
 #include <linux/pm_runtime.h>
-#include <linux/suspend.h>
 #include "internal.h"
@@ -400,7 +399,7 @@ static void acpi_pm_notify_handler(acpi_handle handle, u32 val, void *not_used)
        mutex_lock(&acpi_pm_notifier_lock);
        if (adev->wakeup.flags.notifier_present) {
-                pm_wakeup_ws_event(adev->wakeup.ws, 0, true);
+                __pm_wakeup_event(adev->wakeup.ws, 0);
                if (adev->wakeup.context.work.func)
                        queue_pm_work(&adev->wakeup.context.work);
        }
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index e39ec7b7cb67..3a10d7573477 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -1371,8 +1371,8 @@ int acpi_dma_configure(struct device *dev, enum dev_dma_attr attr)
        iort_set_dma_mask(dev);
        iommu = iort_iommu_configure(dev);
-        if (IS_ERR(iommu))
+        if (IS_ERR(iommu) && PTR_ERR(iommu) == -EPROBE_DEFER)
-                return PTR_ERR(iommu);
+                return -EPROBE_DEFER;
        size = max(dev->coherent_dma_mask, dev->coherent_dma_mask + 1);
        /*
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index a6574d626340..097d630ab886 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -663,40 +663,14 @@ static int acpi_freeze_prepare(void)
        acpi_os_wait_events_complete();
        if (acpi_sci_irq_valid())
                enable_irq_wake(acpi_sci_irq);
        return 0;
 }
-static void acpi_freeze_wake(void)
-{
-        /*
-         * If IRQD_WAKEUP_ARMED is not set for the SCI at this point, it means
-         * that the SCI has triggered while suspended, so cancel the wakeup in
-         * case it has not been a wakeup event (the GPEs will be checked later).
-         */
-        if (acpi_sci_irq_valid() &&
-            !irqd_is_wakeup_armed(irq_get_irq_data(acpi_sci_irq)))
-                pm_system_cancel_wakeup();
-}
-static void acpi_freeze_sync(void)
-{
-        /*
-         * Process all pending events in case there are any wakeup ones.
-         *
-         * The EC driver uses the system workqueue, so that one needs to be
-         * flushed too.
-         */
-        acpi_os_wait_events_complete();
-        flush_scheduled_work();
-}
 static void acpi_freeze_restore(void)
 {
        acpi_disable_wakeup_devices(ACPI_STATE_S0);
        if (acpi_sci_irq_valid())
                disable_irq_wake(acpi_sci_irq);
        acpi_enable_all_runtime_gpes();
 }
@@ -708,8 +682,6 @@ static void acpi_freeze_end(void)
 static const struct platform_freeze_ops acpi_freeze_ops = {
        .begin = acpi_freeze_begin,
        .prepare = acpi_freeze_prepare,
-        .wake = acpi_freeze_wake,
-        .sync = acpi_freeze_sync,
        .restore = acpi_freeze_restore,
        .end = acpi_freeze_end,
 };
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 2fc52407306c..c69954023c2e 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -1364,6 +1364,40 @@ static inline void ahci_gtf_filter_workaround(struct ata_host *host)
 {}
 #endif
+/*
+ * On the Acer Aspire Switch Alpha 12, sometimes all SATA ports are detected
+ * as DUMMY, or detected but eventually get a "link down" and never get up
+ * again. When this happens, CAP.NP may hold a value of 0x00 or 0x01, and the
+ * port_map may hold a value of 0x00.
+ *
+ * Overriding CAP.NP to 0x02 and the port_map to 0x7 will reveal all 3 ports
+ * and can significantly reduce the occurrence of the problem.
+ *
+ * https://bugzilla.kernel.org/show_bug.cgi?id=189471
+ */
+static void acer_sa5_271_workaround(struct ahci_host_priv *hpriv,
+                                    struct pci_dev *pdev)
+{
+        static const struct dmi_system_id sysids[] = {
+                {
+                        .ident = "Acer Switch Alpha 12",
+                        .matches = {
+                                DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+                                DMI_MATCH(DMI_PRODUCT_NAME, "Switch SA5-271")
+                        },
+                },
+                { }
+        };
+        if (dmi_check_system(sysids)) {
+                dev_info(&pdev->dev, "enabling Acer Switch Alpha 12 workaround\n");
+                if ((hpriv->saved_cap & 0xC734FF00) == 0xC734FF00) {
+                        hpriv->port_map = 0x7;
+                        hpriv->cap = 0xC734FF02;
+                }
+        }
+}
 #ifdef CONFIG_ARM64
 /*
 * Due to ERRATA#22536, ThunderX needs to handle HOST_IRQ_STAT differently.
@@ -1636,6 +1670,10 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                         "online status unreliable, applying workaround\n");
        }
+        /* Acer SA5-271 workaround modifies private_data */
+        acer_sa5_271_workaround(hpriv, pdev);
        /* CAP.NP sometimes indicate the index of the last enabled
         * port, at other times, that of the last possible port, so
         * determining the maximum port number requires looking at
diff --git a/drivers/ata/libahci_platform.c b/drivers/ata/libahci_platform.c
index aaa761b9081c..cd2eab6aa92e 100644
--- a/drivers/ata/libahci_platform.c
+++ b/drivers/ata/libahci_platform.c
@@ -514,8 +514,9 @@ int ahci_platform_init_host(struct platform_device *pdev,
        irq = platform_get_irq(pdev, 0);
        if (irq <= 0) {
-                dev_err(dev, "no irq\n");
+                if (irq != -EPROBE_DEFER)
-                return -EINVAL;
+                        dev_err(dev, "no irq\n");
+                return irq;
        }
        hpriv->irq = irq;
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 2d83b8c75965..e157a0e44419 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -6800,7 +6800,7 @@ static int __init ata_parse_force_one(char **cur,
        }
        force_ent->port = simple_strtoul(id, &endp, 10);
-        if (p == endp || *endp != '\0') {
+        if (id == endp || *endp != '\0') {
                *reason = "invalid port/link";
                return -EINVAL;
        }
diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
index b66bcda88320..3b2246dded74 100644
--- a/drivers/ata/sata_mv.c
+++ b/drivers/ata/sata_mv.c
@@ -4067,7 +4067,6 @@ static int mv_platform_probe(struct platform_device *pdev)
        struct ata_host *host;
        struct mv_host_priv *hpriv;
        struct resource *res;
-        void __iomem *mmio;
        int n_ports = 0, irq = 0;
        int rc;
        int port;
@@ -4086,9 +4085,8 @@ static int mv_platform_probe(struct platform_device *pdev)
         * Get the register base first
         */
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        mmio = devm_ioremap_resource(&pdev->dev, res);
+        if (res == NULL)
-        if (IS_ERR(mmio))
+                return -EINVAL;
-                return PTR_ERR(mmio);
        /* allocate host */
        if (pdev->dev.of_node) {
@@ -4132,7 +4130,12 @@ static int mv_platform_probe(struct platform_device *pdev)
        hpriv->board_idx = chip_soc;
        host->iomap = NULL;
-        hpriv->base = mmio - SATAHC0_REG_BASE;
+        hpriv->base = devm_ioremap(&pdev->dev, res->start,
+                                   resource_size(res));
+        if (!hpriv->base)
+                return -ENOMEM;
+        hpriv->base -= SATAHC0_REG_BASE;
        hpriv->clk = clk_get(&pdev->dev, NULL);
        if (IS_ERR(hpriv->clk))
diff --git a/drivers/ata/sata_rcar.c b/drivers/ata/sata_rcar.c
index 5d38245a7a73..b7939a2c1fab 100644
--- a/drivers/ata/sata_rcar.c
+++ b/drivers/ata/sata_rcar.c
@@ -890,7 +890,10 @@ static int sata_rcar_probe(struct platform_device *pdev)
                dev_err(&pdev->dev, "failed to get access to sata clock\n");
                return PTR_ERR(priv->clk);
        }
-        clk_prepare_enable(priv->clk);
+        ret = clk_prepare_enable(priv->clk);
+        if (ret)
+                return ret;
        host = ata_host_alloc(&pdev->dev, 1);
        if (!host) {
@@ -970,8 +973,11 @@ static int sata_rcar_resume(struct device *dev)
        struct ata_host *host = dev_get_drvdata(dev);
        struct sata_rcar_priv *priv = host->private_data;
        void __iomem *base = priv->base;
+        int ret;
-        clk_prepare_enable(priv->clk);
+        ret = clk_prepare_enable(priv->clk);
+        if (ret)
+                return ret;
        /* ack and mask */
        iowrite32(0, base + SATAINTSTAT_REG);
@@ -988,8 +994,11 @@ static int sata_rcar_restore(struct device *dev)
 {
        struct ata_host *host = dev_get_drvdata(dev);
        struct sata_rcar_priv *priv = host->private_data;
+        int ret;
-        clk_prepare_enable(priv->clk);
+        ret = clk_prepare_enable(priv->clk);
+        if (ret)
+                return ret;
        sata_rcar_setup_port(host);
diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
index e987a6f55d36..9faee1c893e5 100644
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -1091,6 +1091,11 @@ static int __device_suspend_noirq(struct device *dev, pm_message_t state, bool a
        if (async_error)
                goto Complete;
+        if (pm_wakeup_pending()) {
+                async_error = -EBUSY;
+                goto Complete;
+        }
        if (dev->power.syscore || dev->power.direct_complete)
                goto Complete;
diff --git a/drivers/base/power/wakeup.c b/drivers/base/power/wakeup.c
index 9c36b27996fc..c313b600d356 100644
--- a/drivers/base/power/wakeup.c
+++ b/drivers/base/power/wakeup.c
@@ -28,8 +28,8 @@ bool events_check_enabled __read_mostly;
 /* First wakeup IRQ seen by the kernel in the last cycle. */
 unsigned int pm_wakeup_irq __read_mostly;
-/* If greater than 0 and the system is suspending, terminate the suspend. */
+/* If set and the system is suspending, terminate the suspend. */
-static atomic_t pm_abort_suspend __read_mostly;
+static bool pm_abort_suspend __read_mostly;
 /*
 * Combined counters of registered wakeup events and wakeup events in progress.
@@ -855,26 +855,20 @@ bool pm_wakeup_pending(void)
                pm_print_active_wakeup_sources();
        }
-        return ret || atomic_read(&pm_abort_suspend) > 0;
+        return ret || pm_abort_suspend;
 }
 void pm_system_wakeup(void)
 {
-        atomic_inc(&pm_abort_suspend);
+        pm_abort_suspend = true;
        freeze_wake();
 }
 EXPORT_SYMBOL_GPL(pm_system_wakeup);
-void pm_system_cancel_wakeup(void)
+void pm_wakeup_clear(void)
-{
-        atomic_dec(&pm_abort_suspend);
-}
-void pm_wakeup_clear(bool reset)
 {
+        pm_abort_suspend = false;
        pm_wakeup_irq = 0;
-        if (reset)
-                atomic_set(&pm_abort_suspend, 0);
 }
 void pm_system_irq_wakeup(unsigned int irq_number)
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 28d932906f24..ebbd0c3fe0ed 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -608,6 +608,9 @@ static int loop_switch(struct loop_device *lo, struct file *file)
 */
 static int loop_flush(struct loop_device *lo)
 {
+        /* loop not yet configured, no running thread, nothing to flush */
+        if (lo->lo_state != Lo_bound)
+                return 0;
        return loop_switch(lo, NULL);
 }
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index b7de5bd76a31..eb1158532de3 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -571,9 +571,10 @@ static inline void update_turbo_state(void)
 static int min_perf_pct_min(void)
 {
        struct cpudata *cpu = all_cpu_data[0];
+        int turbo_pstate = cpu->pstate.turbo_pstate;
-        return DIV_ROUND_UP(cpu->pstate.min_pstate * 100,
+        return turbo_pstate ?
-                            cpu->pstate.turbo_pstate);
+                DIV_ROUND_UP(cpu->pstate.min_pstate * 100, turbo_pstate) : 0;
 }
 static s16 intel_pstate_get_epb(struct cpudata *cpu_data)
diff --git a/drivers/firmware/efi/efi-bgrt.c b/drivers/firmware/efi/efi-bgrt.c
index 8bf27323f7a3..b58233e4ed71 100644
--- a/drivers/firmware/efi/efi-bgrt.c
+++ b/drivers/firmware/efi/efi-bgrt.c
@@ -27,6 +27,26 @@ struct bmp_header {
        u32 size;
 } __packed;
+static bool efi_bgrt_addr_valid(u64 addr)
+{
+        efi_memory_desc_t *md;
+        for_each_efi_memory_desc(md) {
+                u64 size;
+                u64 end;
+                if (md->type != EFI_BOOT_SERVICES_DATA)
+                        continue;
+                size = md->num_pages << EFI_PAGE_SHIFT;
+                end = md->phys_addr + size;
+                if (addr >= md->phys_addr && addr < end)
+                        return true;
+        }
+        return false;
+}
 void __init efi_bgrt_init(struct acpi_table_header *table)
 {
        void *image;
@@ -36,7 +56,7 @@ void __init efi_bgrt_init(struct acpi_table_header *table)
        if (acpi_disabled)
                return;
-        if (!efi_enabled(EFI_BOOT))
+        if (!efi_enabled(EFI_MEMMAP))
                return;
        if (table->length < sizeof(bgrt_tab)) {
@@ -65,6 +85,10 @@ void __init efi_bgrt_init(struct acpi_table_header *table)
                goto out;
        }
+        if (!efi_bgrt_addr_valid(bgrt->image_address)) {
+                pr_notice("Ignoring BGRT: invalid image address\n");
+                goto out;
+        }
        image = early_memremap(bgrt->image_address, sizeof(bmp_header));
        if (!image) {
                pr_notice("Ignoring BGRT: failed to map image header memory\n");
diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
index 8be9719284b0..aa885a614e27 100644
--- a/drivers/gpu/drm/drm_atomic_helper.c
+++ b/drivers/gpu/drm/drm_atomic_helper.c
@@ -508,6 +508,8 @@ drm_atomic_helper_check_modeset(struct drm_device *dev,
                bool has_connectors =
                        !!new_crtc_state->connector_mask;
+                WARN_ON(!drm_modeset_is_locked(&crtc->mutex));
                if (!drm_mode_equal(&old_crtc_state->mode, &new_crtc_state->mode)) {
                        DRM_DEBUG_ATOMIC("[CRTC:%d:%s] mode changed\n",
                                         crtc->base.id, crtc->name);
@@ -551,6 +553,8 @@ drm_atomic_helper_check_modeset(struct drm_device *dev,
        for_each_oldnew_connector_in_state(state, connector, old_connector_state, new_connector_state, i) {
                const struct drm_connector_helper_funcs *funcs = connector->helper_private;
+                WARN_ON(!drm_modeset_is_locked(&dev->mode_config.connection_mutex));
                /*
                 * This only sets crtc->connectors_changed for routing changes,
                 * drivers must set crtc->connectors_changed themselves when
@@ -650,6 +654,8 @@ drm_atomic_helper_check_planes(struct drm_device *dev,
        for_each_oldnew_plane_in_state(state, plane, old_plane_state, new_plane_state, i) {
                const struct drm_plane_helper_funcs *funcs;
+                WARN_ON(!drm_modeset_is_locked(&plane->mutex));
                funcs = plane->helper_private;
                drm_atomic_helper_plane_changed(state, old_plane_state, new_plane_state, plane);
@@ -2663,7 +2669,12 @@ int drm_atomic_helper_resume(struct drm_device *dev,
        drm_modeset_acquire_init(&ctx, 0);
        while (1) {
+                err = drm_modeset_lock_all_ctx(dev, &ctx);
+                if (err)
+                        goto out;
                err = drm_atomic_helper_commit_duplicated_state(state, &ctx);
+out:
                if (err != -EDEADLK)
                        break;
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index b5c6bb46a425..37b8ad3e30d8 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -358,7 +358,12 @@ EXPORT_SYMBOL(drm_put_dev);
 void drm_unplug_dev(struct drm_device *dev)
 {
        /* for a USB device */
-        drm_dev_unregister(dev);
+        if (drm_core_check_feature(dev, DRIVER_MODESET))
+                drm_modeset_unregister_all(dev);
+        drm_minor_unregister(dev, DRM_MINOR_PRIMARY);
+        drm_minor_unregister(dev, DRM_MINOR_RENDER);
+        drm_minor_unregister(dev, DRM_MINOR_CONTROL);
        mutex_lock(&drm_global_mutex);
diff --git a/drivers/gpu/drm/hisilicon/kirin/dw_drm_dsi.c b/drivers/gpu/drm/hisilicon/kirin/dw_drm_dsi.c
index 5abc69c9630f..f77dcfaade6c 100644
--- a/drivers/gpu/drm/hisilicon/kirin/dw_drm_dsi.c
+++ b/drivers/gpu/drm/hisilicon/kirin/dw_drm_dsi.c
@@ -760,7 +760,7 @@ static int dsi_parse_dt(struct platform_device *pdev, struct dw_dsi *dsi)
         * Get the endpoint node. In our case, dsi has one output port1
         * to which the external HDMI bridge is connected.
         */
-        ret = drm_of_find_panel_or_bridge(np, 0, 0, NULL, &dsi->bridge);
+        ret = drm_of_find_panel_or_bridge(np, 1, 0, NULL, &dsi->bridge);
        if (ret)
                return ret;
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index c994fe6e65b2..48428672fc6e 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -1235,6 +1235,15 @@ int i915_driver_load(struct pci_dev *pdev, const struct pci_device_id *ent)
                goto out_fini;
        pci_set_drvdata(pdev, &dev_priv->drm);
+        /*
+         * Disable the system suspend direct complete optimization, which can
+         * leave the device suspended skipping the driver's suspend handlers
+         * if the device was already runtime suspended. This is needed due to
+         * the difference in our runtime and system suspend sequence and
+         * becaue the HDA driver may require us to enable the audio power
+         * domain during system suspend.
+         */
+        pdev->dev_flags |= PCI_DEV_FLAGS_NEEDS_RESUME;
        ret = i915_driver_init_early(dev_priv, ent);
        if (ret < 0)
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 963f6d4481f7..2c453a4e97d5 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -2991,6 +2991,16 @@ static inline bool intel_scanout_needs_vtd_wa(struct drm_i915_private *dev_priv)
        return false;
 }
+static inline bool
+intel_ggtt_update_needs_vtd_wa(struct drm_i915_private *dev_priv)
+{
+#ifdef CONFIG_INTEL_IOMMU
+        if (IS_BROXTON(dev_priv) && intel_iommu_gfx_mapped)
+                return true;
+#endif
+        return false;
+}
 int intel_sanitize_enable_ppgtt(struct drm_i915_private *dev_priv,
                                int enable_ppgtt);
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index b6ac3df18b58..462031cbd77f 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -3298,6 +3298,10 @@ int i915_gem_wait_for_idle(struct drm_i915_private *i915, unsigned int flags)
 {
        int ret;
+        /* If the device is asleep, we have no requests outstanding */
+        if (!READ_ONCE(i915->gt.awake))
+                return 0;
        if (flags & I915_WAIT_LOCKED) {
                struct i915_gem_timeline *tl;
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index 50b8f1139ff9..f1989b8792dd 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -2191,6 +2191,101 @@ static void gen8_ggtt_clear_range(struct i915_address_space *vm,
                gen8_set_pte(&gtt_base[i], scratch_pte);
 }
+static void bxt_vtd_ggtt_wa(struct i915_address_space *vm)
+{
+        struct drm_i915_private *dev_priv = vm->i915;
+        /*
+         * Make sure the internal GAM fifo has been cleared of all GTT
+         * writes before exiting stop_machine(). This guarantees that
+         * any aperture accesses waiting to start in another process
+         * cannot back up behind the GTT writes causing a hang.
+         * The register can be any arbitrary GAM register.
+         */
+        POSTING_READ(GFX_FLSH_CNTL_GEN6);
+}
+struct insert_page {
+        struct i915_address_space *vm;
+        dma_addr_t addr;
+        u64 offset;
+        enum i915_cache_level level;
+};
+static int bxt_vtd_ggtt_insert_page__cb(void *_arg)
+{
+        struct insert_page *arg = _arg;
+        gen8_ggtt_insert_page(arg->vm, arg->addr, arg->offset, arg->level, 0);
+        bxt_vtd_ggtt_wa(arg->vm);
+        return 0;
+}
+static void bxt_vtd_ggtt_insert_page__BKL(struct i915_address_space *vm,
+                                          dma_addr_t addr,
+                                          u64 offset,
+                                          enum i915_cache_level level,
+                                          u32 unused)
+{
+        struct insert_page arg = { vm, addr, offset, level };
+        stop_machine(bxt_vtd_ggtt_insert_page__cb, &arg, NULL);
+}
+struct insert_entries {
+        struct i915_address_space *vm;
+        struct sg_table *st;
+        u64 start;
+        enum i915_cache_level level;
+};
+static int bxt_vtd_ggtt_insert_entries__cb(void *_arg)
+{
+        struct insert_entries *arg = _arg;
+        gen8_ggtt_insert_entries(arg->vm, arg->st, arg->start, arg->level, 0);
+        bxt_vtd_ggtt_wa(arg->vm);
+        return 0;
+}
+static void bxt_vtd_ggtt_insert_entries__BKL(struct i915_address_space *vm,
+                                             struct sg_table *st,
+                                             u64 start,
+                                             enum i915_cache_level level,
+                                             u32 unused)
+{
+        struct insert_entries arg = { vm, st, start, level };
+        stop_machine(bxt_vtd_ggtt_insert_entries__cb, &arg, NULL);
+}
+struct clear_range {
+        struct i915_address_space *vm;
+        u64 start;
+        u64 length;
+};
+static int bxt_vtd_ggtt_clear_range__cb(void *_arg)
+{
+        struct clear_range *arg = _arg;
+        gen8_ggtt_clear_range(arg->vm, arg->start, arg->length);
+        bxt_vtd_ggtt_wa(arg->vm);
+        return 0;
+}
+static void bxt_vtd_ggtt_clear_range__BKL(struct i915_address_space *vm,
+                                          u64 start,
+                                          u64 length)
+{
+        struct clear_range arg = { vm, start, length };
+        stop_machine(bxt_vtd_ggtt_clear_range__cb, &arg, NULL);
+}
 static void gen6_ggtt_clear_range(struct i915_address_space *vm,
                                  u64 start, u64 length)
 {
@@ -2785,6 +2880,14 @@ static int gen8_gmch_probe(struct i915_ggtt *ggtt)
        ggtt->base.insert_entries = gen8_ggtt_insert_entries;
+        /* Serialize GTT updates with aperture access on BXT if VT-d is on. */
+        if (intel_ggtt_update_needs_vtd_wa(dev_priv)) {
+                ggtt->base.insert_entries = bxt_vtd_ggtt_insert_entries__BKL;
+                ggtt->base.insert_page    = bxt_vtd_ggtt_insert_page__BKL;
+                if (ggtt->base.clear_range != nop_clear_range)
+                        ggtt->base.clear_range = bxt_vtd_ggtt_clear_range__BKL;
+        }
        ggtt->invalidate = gen6_ggtt_invalidate;
        return ggtt_probe_common(ggtt, size);
@@ -2997,7 +3100,8 @@ void i915_ggtt_enable_guc(struct drm_i915_private *i915)
 void i915_ggtt_disable_guc(struct drm_i915_private *i915)
 {
-        i915->ggtt.invalidate = gen6_ggtt_invalidate;
+        if (i915->ggtt.invalidate == guc_ggtt_invalidate)
+                i915->ggtt.invalidate = gen6_ggtt_invalidate;
 }
 void i915_gem_restore_gtt_mappings(struct drm_i915_private *dev_priv)
diff --git a/drivers/gpu/drm/i915/i915_gem_tiling.c b/drivers/gpu/drm/i915/i915_gem_tiling.c
index a0d6d4317a49..fb5231f98c0d 100644
--- a/drivers/gpu/drm/i915/i915_gem_tiling.c
+++ b/drivers/gpu/drm/i915/i915_gem_tiling.c
@@ -278,7 +278,7 @@ i915_gem_object_set_tiling(struct drm_i915_gem_object *obj,
                        obj->mm.quirked = false;
                }
                if (!i915_gem_object_is_tiled(obj)) {
-                        GEM_BUG_ON(!obj->mm.quirked);
+                        GEM_BUG_ON(obj->mm.quirked);
                        __i915_gem_object_pin_pages(obj);
                        obj->mm.quirked = true;
                }
diff --git a/drivers/gpu/drm/i915/i915_pci.c b/drivers/gpu/drm/i915/i915_pci.c
index f87b0c4e564d..1a78363c7f4a 100644
--- a/drivers/gpu/drm/i915/i915_pci.c
+++ b/drivers/gpu/drm/i915/i915_pci.c
@@ -208,7 +208,7 @@ static const struct intel_device_info intel_ironlake_d_info = {
 static const struct intel_device_info intel_ironlake_m_info = {
        GEN5_FEATURES,
        .platform = INTEL_IRONLAKE,
-        .is_mobile = 1,
+        .is_mobile = 1, .has_fbc = 1,
 };
 #define GEN6_FEATURES \
@@ -390,7 +390,6 @@ static const struct intel_device_info intel_skylake_gt3_info = {
        .has_hw_contexts = 1, \
        .has_logical_ring_contexts = 1, \
        .has_guc = 1, \
-        .has_decoupled_mmio = 1, \
        .has_aliasing_ppgtt = 1, \
        .has_full_ppgtt = 1, \
        .has_full_48bit_ppgtt = 1, \
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 3cabe52a4e3b..569717a12723 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -12203,6 +12203,15 @@ static void update_scanline_offset(struct intel_crtc *crtc)
         * type. For DP ports it behaves like most other platforms, but on HDMI
         * there's an extra 1 line difference. So we need to add two instead of
         * one to the value.
+         *
+         * On VLV/CHV DSI the scanline counter would appear to increment
+         * approx. 1/3 of a scanline before start of vblank. Unfortunately
+         * that means we can't tell whether we're in vblank or not while
+         * we're on that particular line. We must still set scanline_offset
+         * to 1 so that the vblank timestamps come out correct when we query
+         * the scanline counter from within the vblank interrupt handler.
+         * However if queried just before the start of vblank we'll get an
+         * answer that's slightly in the future.
         */
        if (IS_GEN2(dev_priv)) {
                const struct drm_display_mode *adjusted_mode = &crtc->config->base.adjusted_mode;
diff --git a/drivers/gpu/drm/i915/intel_engine_cs.c b/drivers/gpu/drm/i915/intel_engine_cs.c
index 854e8e0c836b..f94eacff196c 100644
--- a/drivers/gpu/drm/i915/intel_engine_cs.c
+++ b/drivers/gpu/drm/i915/intel_engine_cs.c
@@ -1075,6 +1075,22 @@ int intel_ring_workarounds_emit(struct drm_i915_gem_request *req)
        return 0;
 }
+static bool ring_is_idle(struct intel_engine_cs *engine)
+{
+        struct drm_i915_private *dev_priv = engine->i915;
+        bool idle = true;
+        intel_runtime_pm_get(dev_priv);
+        /* No bit for gen2, so assume the CS parser is idle */
+        if (INTEL_GEN(dev_priv) > 2 && !(I915_READ_MODE(engine) & MODE_IDLE))
+                idle = false;
+        intel_runtime_pm_put(dev_priv);
+        return idle;
+}
 /**
 * intel_engine_is_idle() - Report if the engine has finished process all work
 * @engine: the intel_engine_cs
@@ -1084,8 +1100,6 @@ int intel_ring_workarounds_emit(struct drm_i915_gem_request *req)
 */
 bool intel_engine_is_idle(struct intel_engine_cs *engine)
 {
-        struct drm_i915_private *dev_priv = engine->i915;
        /* Any inflight/incomplete requests? */
        if (!i915_seqno_passed(intel_engine_get_seqno(engine),
                               intel_engine_last_submit(engine)))
@@ -1100,7 +1114,7 @@ bool intel_engine_is_idle(struct intel_engine_cs *engine)
                return false;
        /* Ring stopped? */
-        if (INTEL_GEN(dev_priv) > 2 && !(I915_READ_MODE(engine) & MODE_IDLE))
+        if (!ring_is_idle(engine))
                return false;
        return true;
diff --git a/drivers/gpu/drm/i915/intel_fbc.c b/drivers/gpu/drm/i915/intel_fbc.c
index ded2add18b26..d93c58410bff 100644
--- a/drivers/gpu/drm/i915/intel_fbc.c
+++ b/drivers/gpu/drm/i915/intel_fbc.c
@@ -82,20 +82,10 @@ static unsigned int get_crtc_fence_y_offset(struct intel_crtc *crtc)
 static void intel_fbc_get_plane_source_size(struct intel_fbc_state_cache *cache,
                                            int *width, int *height)
 {
-        int w, h;
-        if (drm_rotation_90_or_270(cache->plane.rotation)) {
-                w = cache->plane.src_h;
-                h = cache->plane.src_w;
-        } else {
-                w = cache->plane.src_w;
-                h = cache->plane.src_h;
-        }
        if (width)
-                *width = w;
+                *width = cache->plane.src_w;
        if (height)
-                *height = h;
+                *height = cache->plane.src_h;
 }
 static int intel_fbc_calculate_cfb_size(struct drm_i915_private *dev_priv,
@@ -746,6 +736,11 @@ static void intel_fbc_update_state_cache(struct intel_crtc *crtc,
                cache->crtc.hsw_bdw_pixel_rate = crtc_state->pixel_rate;
        cache->plane.rotation = plane_state->base.rotation;
+        /*
+         * Src coordinates are already rotated by 270 degrees for
+         * the 90/270 degree plane rotation cases (to match the
+         * GTT mapping), hence no need to account for rotation here.
+         */
        cache->plane.src_w = drm_rect_width(&plane_state->base.src) >> 16;
        cache->plane.src_h = drm_rect_height(&plane_state->base.src) >> 16;
        cache->plane.visible = plane_state->base.visible;
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 570bd603f401..2ca481b5aa69 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -4335,11 +4335,19 @@ skl_compute_wm(struct drm_atomic_state *state)
        struct drm_crtc_state *cstate;
        struct intel_atomic_state *intel_state = to_intel_atomic_state(state);
        struct skl_wm_values *results = &intel_state->wm_results;
+        struct drm_device *dev = state->dev;
        struct skl_pipe_wm *pipe_wm;
        bool changed = false;
        int ret, i;
        /*
+         * When we distrust bios wm we always need to recompute to set the
+         * expected DDB allocations for each CRTC.
+         */
+        if (to_i915(dev)->wm.distrust_bios_wm)
+                changed = true;
+        /*
         * If this transaction isn't actually touching any CRTC's, don't
         * bother with watermark calculation.  Note that if we pass this
         * test, we're guaranteed to hold at least one CRTC state mutex,
@@ -4349,6 +4357,7 @@ skl_compute_wm(struct drm_atomic_state *state)
         */
        for_each_new_crtc_in_state(state, crtc, cstate, i)
                changed = true;
        if (!changed)
                return 0;
diff --git a/drivers/gpu/drm/i915/intel_psr.c b/drivers/gpu/drm/i915/intel_psr.c
index c3780d0d2baf..559f1ab42bfc 100644
--- a/drivers/gpu/drm/i915/intel_psr.c
+++ b/drivers/gpu/drm/i915/intel_psr.c
@@ -435,8 +435,9 @@ static bool intel_psr_match_conditions(struct intel_dp *intel_dp)
        }
        /* PSR2 is restricted to work with panel resolutions upto 3200x2000 */
-        if (intel_crtc->config->pipe_src_w > 3200 ||
+        if (dev_priv->psr.psr2_support &&
-                                intel_crtc->config->pipe_src_h > 2000) {
+            (intel_crtc->config->pipe_src_w > 3200 ||
+             intel_crtc->config->pipe_src_h > 2000)) {
                dev_priv->psr.psr2_support = false;
                return false;
        }
diff --git a/drivers/gpu/drm/i915/intel_sprite.c b/drivers/gpu/drm/i915/intel_sprite.c
index 8c87c717c7cd..e6517edcd16b 100644
--- a/drivers/gpu/drm/i915/intel_sprite.c
+++ b/drivers/gpu/drm/i915/intel_sprite.c
@@ -83,10 +83,13 @@ int intel_usecs_to_scanlines(const struct drm_display_mode *adjusted_mode,
 */
 void intel_pipe_update_start(struct intel_crtc *crtc)
 {
+        struct drm_i915_private *dev_priv = to_i915(crtc->base.dev);
        const struct drm_display_mode *adjusted_mode = &crtc->config->base.adjusted_mode;
        long timeout = msecs_to_jiffies_timeout(1);
        int scanline, min, max, vblank_start;
        wait_queue_head_t *wq = drm_crtc_vblank_waitqueue(&crtc->base);
+        bool need_vlv_dsi_wa = (IS_VALLEYVIEW(dev_priv) || IS_CHERRYVIEW(dev_priv)) &&
+                intel_crtc_has_type(crtc->config, INTEL_OUTPUT_DSI);
        DEFINE_WAIT(wait);
        vblank_start = adjusted_mode->crtc_vblank_start;
@@ -139,6 +142,24 @@ void intel_pipe_update_start(struct intel_crtc *crtc)
        drm_crtc_vblank_put(&crtc->base);
+        /*
+         * On VLV/CHV DSI the scanline counter would appear to
+         * increment approx. 1/3 of a scanline before start of vblank.
+         * The registers still get latched at start of vblank however.
+         * This means we must not write any registers on the first
+         * line of vblank (since not the whole line is actually in
+         * vblank). And unfortunately we can't use the interrupt to
+         * wait here since it will fire too soon. We could use the
+         * frame start interrupt instead since it will fire after the
+         * critical scanline, but that would require more changes
+         * in the interrupt code. So for now we'll just do the nasty
+         * thing and poll for the bad scanline to pass us by.
+         *
+         * FIXME figure out if BXT+ DSI suffers from this as well
+         */
+        while (need_vlv_dsi_wa && scanline == vblank_start)
+                scanline = intel_get_crtc_scanline(crtc);
        crtc->debug.scanline_start = scanline;
        crtc->debug.start_vbl_time = ktime_get();
        crtc->debug.start_vbl_count = intel_crtc_get_vblank_counter(crtc);
diff --git a/drivers/gpu/drm/i915/intel_uc.h b/drivers/gpu/drm/i915/intel_uc.h
index 4b7f73aeddac..f84115261ae7 100644
--- a/drivers/gpu/drm/i915/intel_uc.h
+++ b/drivers/gpu/drm/i915/intel_uc.h
@@ -59,8 +59,6 @@ struct drm_i915_gem_request;
 *                available in the work queue (note, the queue is shared,
 *                not per-engine). It is OK for this to be nonzero, but
 *                it should not be huge!
- *   q_fail: failed to enqueue a work item. This should never happen,
- *           because we check for space beforehand.
 *   b_fail: failed to ring the doorbell. This should never happen, unless
 *           somehow the hardware misbehaves, or maybe if the GuC firmware
 *           crashes? We probably need to reset the GPU to recover.
diff --git a/drivers/gpu/drm/imx/imx-ldb.c b/drivers/gpu/drm/imx/imx-ldb.c
index 8fb801fab039..8b05ecb8fdef 100644
--- a/drivers/gpu/drm/imx/imx-ldb.c
+++ b/drivers/gpu/drm/imx/imx-ldb.c
@@ -673,7 +673,7 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data)
                ret = drm_of_find_panel_or_bridge(child,
                                                  imx_ldb->lvds_mux ? 4 : 2, 0,
                                                  &channel->panel, &channel->bridge);
-                if (ret)
+                if (ret && ret != -ENODEV)
                        return ret;
                /* panel ddc only if there is no bridge */
diff --git a/drivers/gpu/drm/mediatek/mtk_dsi.c b/drivers/gpu/drm/mediatek/mtk_dsi.c
index 808b995a990f..b5cc6e12334c 100644
--- a/drivers/gpu/drm/mediatek/mtk_dsi.c
+++ b/drivers/gpu/drm/mediatek/mtk_dsi.c
@@ -19,6 +19,7 @@
 #include <drm/drm_of.h>
 #include <linux/clk.h>
 #include <linux/component.h>
+#include <linux/iopoll.h>
 #include <linux/irq.h>
 #include <linux/of.h>
 #include <linux/of_platform.h>
@@ -900,16 +901,12 @@ static int mtk_dsi_host_detach(struct mipi_dsi_host *host,
 static void mtk_dsi_wait_for_idle(struct mtk_dsi *dsi)
 {
-        u32 timeout_ms = 500000; /* total 1s ~ 2s timeout */
+        int ret;
+        u32 val;
-        while (timeout_ms--) {
-                if (!(readl(dsi->regs + DSI_INTSTA) & DSI_BUSY))
-                        break;
-                usleep_range(2, 4);
-        }
-        if (timeout_ms == 0) {
+        ret = readl_poll_timeout(dsi->regs + DSI_INTSTA, val, !(val & DSI_BUSY),
+                                 4, 2000000);
+        if (ret) {
                DRM_WARN("polling dsi wait not busy timeout!\n");
                mtk_dsi_enable(dsi);
diff --git a/drivers/gpu/drm/mediatek/mtk_hdmi.c b/drivers/gpu/drm/mediatek/mtk_hdmi.c
index 41a1c03b0347..0a4ffd724146 100644
--- a/drivers/gpu/drm/mediatek/mtk_hdmi.c
+++ b/drivers/gpu/drm/mediatek/mtk_hdmi.c
@@ -1062,7 +1062,7 @@ static int mtk_hdmi_setup_vendor_specific_infoframe(struct mtk_hdmi *hdmi,
        }
        err = hdmi_vendor_infoframe_pack(&frame, buffer, sizeof(buffer));
-        if (err) {
+        if (err < 0) {
                dev_err(hdmi->dev, "Failed to pack vendor infoframe: %zd\n",
                        err);
                return err;
diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c
index 75382f5f0fce..10b227d83e9a 100644
--- a/drivers/gpu/drm/meson/meson_drv.c
+++ b/drivers/gpu/drm/meson/meson_drv.c
@@ -152,7 +152,7 @@ static struct regmap_config meson_regmap_config = {
        .max_register   = 0x1000,
 };
-static int meson_drv_bind(struct device *dev)
+static int meson_drv_bind_master(struct device *dev, bool has_components)
 {
        struct platform_device *pdev = to_platform_device(dev);
        struct meson_drm *priv;
@@ -233,10 +233,12 @@ static int meson_drv_bind(struct device *dev)
        if (ret)
                goto free_drm;
-        ret = component_bind_all(drm->dev, drm);
+        if (has_components) {
-        if (ret) {
+                ret = component_bind_all(drm->dev, drm);
-                dev_err(drm->dev, "Couldn't bind all components\n");
+                if (ret) {
-                goto free_drm;
+                        dev_err(drm->dev, "Couldn't bind all components\n");
+                        goto free_drm;
+                }
        }
        ret = meson_plane_create(priv);
@@ -276,6 +278,11 @@ free_drm:
        return ret;
 }
+static int meson_drv_bind(struct device *dev)
+{
+        return meson_drv_bind_master(dev, true);
+}
 static void meson_drv_unbind(struct device *dev)
 {
        struct drm_device *drm = dev_get_drvdata(dev);
@@ -357,6 +364,9 @@ static int meson_drv_probe(struct platform_device *pdev)
                count += meson_probe_remote(pdev, &match, np, remote);
        }
+        if (count && !match)
+                return meson_drv_bind_master(&pdev->dev, false);
        /* If some endpoints were found, initialize the nodes */
        if (count) {
                dev_info(&pdev->dev, "Queued %d outputs on vpu\n", count);
diff --git a/drivers/gpu/drm/nouveau/include/nvkm/subdev/timer.h b/drivers/gpu/drm/nouveau/include/nvkm/subdev/timer.h
index 6a567fe347b3..820a4805916f 100644
--- a/drivers/gpu/drm/nouveau/include/nvkm/subdev/timer.h
+++ b/drivers/gpu/drm/nouveau/include/nvkm/subdev/timer.h
@@ -4,6 +4,7 @@
 struct nvkm_alarm {
        struct list_head head;
+        struct list_head exec;
        u64 timestamp;
        void (*func)(struct nvkm_alarm *);
 };
diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index 36268e1802b5..15a13d09d431 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -80,7 +80,7 @@ int nouveau_modeset = -1;
 module_param_named(modeset, nouveau_modeset, int, 0400);
 MODULE_PARM_DESC(runpm, "disable (0), force enable (1), optimus only default (-1)");
-int nouveau_runtime_pm = -1;
+static int nouveau_runtime_pm = -1;
 module_param_named(runpm, nouveau_runtime_pm, int, 0400);
 static struct drm_driver driver_stub;
@@ -495,7 +495,7 @@ nouveau_drm_load(struct drm_device *dev, unsigned long flags)
        nouveau_fbcon_init(dev);
        nouveau_led_init(dev);
-        if (nouveau_runtime_pm != 0) {
+        if (nouveau_pmops_runtime()) {
                pm_runtime_use_autosuspend(dev->dev);
                pm_runtime_set_autosuspend_delay(dev->dev, 5000);
                pm_runtime_set_active(dev->dev);
@@ -527,7 +527,7 @@ nouveau_drm_unload(struct drm_device *dev)
 {
        struct nouveau_drm *drm = nouveau_drm(dev);
-        if (nouveau_runtime_pm != 0) {
+        if (nouveau_pmops_runtime()) {
                pm_runtime_get_sync(dev->dev);
                pm_runtime_forbid(dev->dev);
        }
@@ -726,6 +726,14 @@ nouveau_pmops_thaw(struct device *dev)
        return nouveau_do_resume(drm_dev, false);
 }
+bool
+nouveau_pmops_runtime()
+{
+        if (nouveau_runtime_pm == -1)
+                return nouveau_is_optimus() || nouveau_is_v1_dsm();
+        return nouveau_runtime_pm == 1;
+}
 static int
 nouveau_pmops_runtime_suspend(struct device *dev)
 {
@@ -733,14 +741,7 @@ nouveau_pmops_runtime_suspend(struct device *dev)
        struct drm_device *drm_dev = pci_get_drvdata(pdev);
        int ret;
-        if (nouveau_runtime_pm == 0) {
+        if (!nouveau_pmops_runtime()) {
-                pm_runtime_forbid(dev);
-                return -EBUSY;
-        }
-        /* are we optimus enabled? */
-        if (nouveau_runtime_pm == -1 && !nouveau_is_optimus() && !nouveau_is_v1_dsm()) {
-                DRM_DEBUG_DRIVER("failing to power off - not optimus\n");
                pm_runtime_forbid(dev);
                return -EBUSY;
        }
@@ -765,8 +766,10 @@ nouveau_pmops_runtime_resume(struct device *dev)
        struct nvif_device *device = &nouveau_drm(drm_dev)->client.device;
        int ret;
-        if (nouveau_runtime_pm == 0)
+        if (!nouveau_pmops_runtime()) {
-                return -EINVAL;
+                pm_runtime_forbid(dev);
+                return -EBUSY;
+        }
        pci_set_power_state(pdev, PCI_D0);
        pci_restore_state(pdev);
@@ -796,14 +799,7 @@ nouveau_pmops_runtime_idle(struct device *dev)
        struct nouveau_drm *drm = nouveau_drm(drm_dev);
        struct drm_crtc *crtc;
-        if (nouveau_runtime_pm == 0) {
+        if (!nouveau_pmops_runtime()) {
-                pm_runtime_forbid(dev);
-                return -EBUSY;
-        }
-        /* are we optimus enabled? */
-        if (nouveau_runtime_pm == -1 && !nouveau_is_optimus() && !nouveau_is_v1_dsm()) {
-                DRM_DEBUG_DRIVER("failing to power off - not optimus\n");
                pm_runtime_forbid(dev);
                return -EBUSY;
        }
diff --git a/drivers/gpu/drm/nouveau/nouveau_drv.h b/drivers/gpu/drm/nouveau/nouveau_drv.h
index eadec2f49ad3..a11b6aaed325 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drv.h
+++ b/drivers/gpu/drm/nouveau/nouveau_drv.h
@@ -108,8 +108,6 @@ nouveau_cli(struct drm_file *fpriv)
 #include <nvif/object.h>
 #include <nvif/device.h>
-extern int nouveau_runtime_pm;
 struct nouveau_drm {
        struct nouveau_cli client;
        struct drm_device *dev;
@@ -195,6 +193,7 @@ nouveau_drm(struct drm_device *dev)
 int nouveau_pmops_suspend(struct device *);
 int nouveau_pmops_resume(struct device *);
+bool nouveau_pmops_runtime(void);
 #include <nvkm/core/tegra.h>
diff --git a/drivers/gpu/drm/nouveau/nouveau_vga.c b/drivers/gpu/drm/nouveau/nouveau_vga.c
index a4aacbc0cec8..02fe0efb9e16 100644
--- a/drivers/gpu/drm/nouveau/nouveau_vga.c
+++ b/drivers/gpu/drm/nouveau/nouveau_vga.c
@@ -87,7 +87,7 @@ void
 nouveau_vga_init(struct nouveau_drm *drm)
 {
        struct drm_device *dev = drm->dev;
-        bool runtime = false;
+        bool runtime = nouveau_pmops_runtime();
        /* only relevant for PCI devices */
        if (!dev->pdev)
@@ -99,10 +99,6 @@ nouveau_vga_init(struct nouveau_drm *drm)
        if (pci_is_thunderbolt_attached(dev->pdev))
                return;
-        if (nouveau_runtime_pm == 1)
-                runtime = true;
-        if ((nouveau_runtime_pm == -1) && (nouveau_is_optimus() || nouveau_is_v1_dsm()))
-                runtime = true;
        vga_switcheroo_register_client(dev->pdev, &nouveau_switcheroo_ops, runtime);
        if (runtime && nouveau_is_v1_dsm() && !nouveau_is_optimus())
@@ -113,18 +109,13 @@ void
 nouveau_vga_fini(struct nouveau_drm *drm)
 {
        struct drm_device *dev = drm->dev;
-        bool runtime = false;
+        bool runtime = nouveau_pmops_runtime();
        vga_client_register(dev->pdev, NULL, NULL, NULL);
        if (pci_is_thunderbolt_attached(dev->pdev))
                return;
-        if (nouveau_runtime_pm == 1)
-                runtime = true;
-        if ((nouveau_runtime_pm == -1) && (nouveau_is_optimus() || nouveau_is_v1_dsm()))
-                runtime = true;
        vga_switcheroo_unregister_client(dev->pdev);
        if (runtime && nouveau_is_v1_dsm() && !nouveau_is_optimus())
                vga_switcheroo_fini_domain_pm_ops(drm->dev->dev);
diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c
index a7663249b3ba..06e564a9ccb2 100644
--- a/drivers/gpu/drm/nouveau/nv50_display.c
+++ b/drivers/gpu/drm/nouveau/nv50_display.c
@@ -2107,7 +2107,8 @@ nv50_head_atomic_check(struct drm_crtc *crtc, struct drm_crtc_state *state)
                                        asyc->set.dither = true;
                        }
                } else {
-                        asyc->set.mask = ~0;
+                        if (asyc)
+                                asyc->set.mask = ~0;
                        asyh->set.mask = ~0;
                }
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c
index f2a86eae0a0d..2437f7d41ca2 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c
@@ -50,7 +50,8 @@ nvkm_timer_alarm_trigger(struct nvkm_timer *tmr)
                /* Move to completed list.  We'll drop the lock before
                 * executing the callback so it can reschedule itself.
                 */
-                list_move_tail(&alarm->head, &exec);
+                list_del_init(&alarm->head);
+                list_add(&alarm->exec, &exec);
        }
        /* Shut down interrupt if no more pending alarms. */
@@ -59,8 +60,8 @@ nvkm_timer_alarm_trigger(struct nvkm_timer *tmr)
        spin_unlock_irqrestore(&tmr->lock, flags);
        /* Execute completed callbacks. */
-        list_for_each_entry_safe(alarm, atemp, &exec, head) {
+        list_for_each_entry_safe(alarm, atemp, &exec, exec) {
-                list_del_init(&alarm->head);
+                list_del(&alarm->exec);
                alarm->func(alarm);
        }
 }
diff --git a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
index d8fa7a9c9240..ce5f2d1f9994 100644
--- a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
+++ b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
@@ -245,8 +245,6 @@ rockchip_dp_drm_encoder_atomic_check(struct drm_encoder *encoder,
                                      struct drm_connector_state *conn_state)
 {
        struct rockchip_crtc_state *s = to_rockchip_crtc_state(crtc_state);
-        struct rockchip_dp_device *dp = to_dp(encoder);
-        int ret;
        /*
         * The hardware IC designed that VOP must output the RGB10 video
@@ -258,16 +256,6 @@ rockchip_dp_drm_encoder_atomic_check(struct drm_encoder *encoder,
        s->output_mode = ROCKCHIP_OUT_MODE_AAAA;
        s->output_type = DRM_MODE_CONNECTOR_eDP;
-        if (dp->data->chip_type == RK3399_EDP) {
-                /*
-                 * For RK3399, VOP Lit must code the out mode to RGB888,
-                 * VOP Big must code the out mode to RGB10.
-                 */
-                ret = drm_of_encoder_active_endpoint_id(dp->dev->of_node,
-                                                        encoder);
-                if (ret > 0)
-                        s->output_mode = ROCKCHIP_OUT_MODE_P888;
-        }
        return 0;
 }
diff --git a/drivers/gpu/drm/rockchip/cdn-dp-core.c b/drivers/gpu/drm/rockchip/cdn-dp-core.c
index a2169dd3d26b..14fa1f8351e8 100644
--- a/drivers/gpu/drm/rockchip/cdn-dp-core.c
+++ b/drivers/gpu/drm/rockchip/cdn-dp-core.c
@@ -615,7 +615,6 @@ static void cdn_dp_encoder_enable(struct drm_encoder *encoder)
 {
        struct cdn_dp_device *dp = encoder_to_dp(encoder);
        int ret, val;
-        struct rockchip_crtc_state *state;
        ret = drm_of_encoder_active_endpoint_id(dp->dev->of_node, encoder);
        if (ret < 0) {
@@ -625,14 +624,10 @@ static void cdn_dp_encoder_enable(struct drm_encoder *encoder)
        DRM_DEV_DEBUG_KMS(dp->dev, "vop %s output to cdn-dp\n",
                          (ret) ? "LIT" : "BIG");
-        state = to_rockchip_crtc_state(encoder->crtc->state);
+        if (ret)
-        if (ret) {
                val = DP_SEL_VOP_LIT | (DP_SEL_VOP_LIT << 16);
-                state->output_mode = ROCKCHIP_OUT_MODE_P888;
+        else
-        } else {
                val = DP_SEL_VOP_LIT << 16;
-                state->output_mode = ROCKCHIP_OUT_MODE_AAAA;
-        }
        ret = cdn_dp_grf_write(dp, GRF_SOC_CON9, val);
        if (ret)
diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
index 3f7a82d1e095..45589d6ce65e 100644
--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
@@ -875,6 +875,7 @@ static bool vop_crtc_mode_fixup(struct drm_crtc *crtc,
 static void vop_crtc_enable(struct drm_crtc *crtc)
 {
        struct vop *vop = to_vop(crtc);
+        const struct vop_data *vop_data = vop->data;
        struct rockchip_crtc_state *s = to_rockchip_crtc_state(crtc->state);
        struct drm_display_mode *adjusted_mode = &crtc->state->adjusted_mode;
        u16 hsync_len = adjusted_mode->hsync_end - adjusted_mode->hsync_start;
@@ -967,6 +968,13 @@ static void vop_crtc_enable(struct drm_crtc *crtc)
                DRM_DEV_ERROR(vop->dev, "unsupported connector_type [%d]\n",
                              s->output_type);
        }
+        /*
+         * if vop is not support RGB10 output, need force RGB10 to RGB888.
+         */
+        if (s->output_mode == ROCKCHIP_OUT_MODE_AAAA &&
+            !(vop_data->feature & VOP_FEATURE_OUTPUT_RGB10))
+                s->output_mode = ROCKCHIP_OUT_MODE_P888;
        VOP_CTRL_SET(vop, out_mode, s->output_mode);
        VOP_CTRL_SET(vop, htotal_pw, (htotal << 16) | hsync_len);
diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.h b/drivers/gpu/drm/rockchip/rockchip_drm_vop.h
index 5a4faa85dbd2..9979fd0c2282 100644
--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.h
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.h
@@ -142,6 +142,9 @@ struct vop_data {
        const struct vop_intr *intr;
        const struct vop_win_data *win;
        unsigned int win_size;
+#define VOP_FEATURE_OUTPUT_RGB10        BIT(0)
+        u64 feature;
 };
 /* interrupt define */
diff --git a/drivers/gpu/drm/rockchip/rockchip_vop_reg.c b/drivers/gpu/drm/rockchip/rockchip_vop_reg.c
index 0da44442aab0..bafd698a28b1 100644
--- a/drivers/gpu/drm/rockchip/rockchip_vop_reg.c
+++ b/drivers/gpu/drm/rockchip/rockchip_vop_reg.c
@@ -275,6 +275,7 @@ static const struct vop_intr rk3288_vop_intr = {
 static const struct vop_data rk3288_vop = {
        .init_table = rk3288_init_reg_table,
        .table_size = ARRAY_SIZE(rk3288_init_reg_table),
+        .feature = VOP_FEATURE_OUTPUT_RGB10,
        .intr = &rk3288_vop_intr,
        .ctrl = &rk3288_ctrl_data,
        .win = rk3288_vop_win_data,
@@ -343,6 +344,7 @@ static const struct vop_reg_data rk3399_init_reg_table[] = {
 static const struct vop_data rk3399_vop_big = {
        .init_table = rk3399_init_reg_table,
        .table_size = ARRAY_SIZE(rk3399_init_reg_table),
+        .feature = VOP_FEATURE_OUTPUT_RGB10,
        .intr = &rk3399_vop_intr,
        .ctrl = &rk3399_ctrl_data,
        /*
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
index 130d51c5ec6a..4b948fba9eec 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
@@ -41,9 +41,9 @@
 #include <drm/ttm/ttm_module.h>
 #include "vmwgfx_fence.h"
-#define VMWGFX_DRIVER_DATE "20170221"
+#define VMWGFX_DRIVER_DATE "20170607"
 #define VMWGFX_DRIVER_MAJOR 2
-#define VMWGFX_DRIVER_MINOR 12
+#define VMWGFX_DRIVER_MINOR 13
 #define VMWGFX_DRIVER_PATCHLEVEL 0
 #define VMWGFX_FILE_PAGE_OFFSET 0x00100000
 #define VMWGFX_FIFO_STATIC_SIZE (1024*1024)
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
index b6a0806b06bf..a1c68e6a689e 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
@@ -368,6 +368,8 @@ static void *vmw_local_fifo_reserve(struct vmw_private *dev_priv,
                                return fifo_state->static_buffer;
                        else {
                                fifo_state->dynamic_buffer = vmalloc(bytes);
+                                if (!fifo_state->dynamic_buffer)
+                                        goto out_err;
                                return fifo_state->dynamic_buffer;
                        }
                }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index ef9f3a2a4030..1d2db5d912b0 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -274,108 +274,6 @@ void vmw_kms_cursor_post_execbuf(struct vmw_private *dev_priv)
 }
-/**
- * vmw_du_cursor_plane_update() - Update cursor image and location
- *
- * @plane: plane object to update
- * @crtc: owning CRTC of @plane
- * @fb: framebuffer to flip onto plane
- * @crtc_x: x offset of plane on crtc
- * @crtc_y: y offset of plane on crtc
- * @crtc_w: width of plane rectangle on crtc
- * @crtc_h: height of plane rectangle on crtc
- * @src_x: Not used
- * @src_y: Not used
- * @src_w: Not used
- * @src_h: Not used
- *
- *
- * RETURNS:
- * Zero on success, error code on failure
- */
-int vmw_du_cursor_plane_update(struct drm_plane *plane,
-                               struct drm_crtc *crtc,
-                               struct drm_framebuffer *fb,
-                               int crtc_x, int crtc_y,
-                               unsigned int crtc_w,
-                               unsigned int crtc_h,
-                               uint32_t src_x, uint32_t src_y,
-                               uint32_t src_w, uint32_t src_h)
-{
-        struct vmw_private *dev_priv = vmw_priv(crtc->dev);
-        struct vmw_display_unit *du = vmw_crtc_to_du(crtc);
-        struct vmw_surface *surface = NULL;
-        struct vmw_dma_buffer *dmabuf = NULL;
-        s32 hotspot_x, hotspot_y;
-        int ret;
-        hotspot_x = du->hotspot_x + fb->hot_x;
-        hotspot_y = du->hotspot_y + fb->hot_y;
-        /* A lot of the code assumes this */
-        if (crtc_w != 64 || crtc_h != 64) {
-                ret = -EINVAL;
-                goto out;
-        }
-        if (vmw_framebuffer_to_vfb(fb)->dmabuf)
-                dmabuf = vmw_framebuffer_to_vfbd(fb)->buffer;
-        else
-                surface = vmw_framebuffer_to_vfbs(fb)->surface;
-        if (surface && !surface->snooper.image) {
-                DRM_ERROR("surface not suitable for cursor\n");
-                ret = -EINVAL;
-                goto out;
-        }
-        /* setup new image */
-        ret = 0;
-        if (surface) {
-                /* vmw_user_surface_lookup takes one reference */
-                du->cursor_surface = surface;
-                du->cursor_age = du->cursor_surface->snooper.age;
-                ret = vmw_cursor_update_image(dev_priv, surface->snooper.image,
-                                              64, 64, hotspot_x, hotspot_y);
-        } else if (dmabuf) {
-                /* vmw_user_surface_lookup takes one reference */
-                du->cursor_dmabuf = dmabuf;
-                ret = vmw_cursor_update_dmabuf(dev_priv, dmabuf, crtc_w, crtc_h,
-                                               hotspot_x, hotspot_y);
-        } else {
-                vmw_cursor_update_position(dev_priv, false, 0, 0);
-                goto out;
-        }
-        if (!ret) {
-                du->cursor_x = crtc_x + du->set_gui_x;
-                du->cursor_y = crtc_y + du->set_gui_y;
-                vmw_cursor_update_position(dev_priv, true,
-                                           du->cursor_x + hotspot_x,
-                                           du->cursor_y + hotspot_y);
-        }
-out:
-        return ret;
-}
-int vmw_du_cursor_plane_disable(struct drm_plane *plane)
-{
-        if (plane->fb) {
-                drm_framebuffer_unreference(plane->fb);
-                plane->fb = NULL;
-        }
-        return -EINVAL;
-}
 void vmw_du_cursor_plane_destroy(struct drm_plane *plane)
 {
        vmw_cursor_update_position(plane->dev->dev_private, false, 0, 0);
@@ -473,18 +371,6 @@ vmw_du_cursor_plane_prepare_fb(struct drm_plane *plane,
 void
-vmw_du_cursor_plane_atomic_disable(struct drm_plane *plane,
-                                   struct drm_plane_state *old_state)
-{
-        struct drm_crtc *crtc = plane->state->crtc ?: old_state->crtc;
-        struct vmw_private *dev_priv = vmw_priv(crtc->dev);
-        drm_atomic_set_fb_for_plane(plane->state, NULL);
-        vmw_cursor_update_position(dev_priv, false, 0, 0);
-}
-void
 vmw_du_cursor_plane_atomic_update(struct drm_plane *plane,
                                  struct drm_plane_state *old_state)
 {
@@ -1498,6 +1384,7 @@ vmw_kms_new_framebuffer(struct vmw_private *dev_priv,
         */
        if (vmw_kms_srf_ok(dev_priv, mode_cmd->width, mode_cmd->height)  &&
            dmabuf && only_2d &&
+            mode_cmd->width > 64 &&  /* Don't create a proxy for cursor */
            dev_priv->active_display_unit == vmw_du_screen_target) {
                ret = vmw_create_dmabuf_proxy(dev_priv->dev, mode_cmd,
                                              dmabuf, &surface);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h
index 13f2f1d2818a..5f8d678ae675 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h
@@ -256,10 +256,6 @@ int vmw_du_crtc_gamma_set(struct drm_crtc *crtc,
                           u16 *r, u16 *g, u16 *b,
                           uint32_t size,
                           struct drm_modeset_acquire_ctx *ctx);
-int vmw_du_crtc_cursor_set2(struct drm_crtc *crtc, struct drm_file *file_priv,
-                            uint32_t handle, uint32_t width, uint32_t height,
-                            int32_t hot_x, int32_t hot_y);
-int vmw_du_crtc_cursor_move(struct drm_crtc *crtc, int x, int y);
 int vmw_du_connector_set_property(struct drm_connector *connector,
                                  struct drm_property *property,
                                  uint64_t val);
@@ -339,15 +335,6 @@ void vmw_kms_create_implicit_placement_property(struct vmw_private *dev_priv,
 /* Universal Plane Helpers */
 void vmw_du_primary_plane_destroy(struct drm_plane *plane);
 void vmw_du_cursor_plane_destroy(struct drm_plane *plane);
-int vmw_du_cursor_plane_disable(struct drm_plane *plane);
-int vmw_du_cursor_plane_update(struct drm_plane *plane,
-                               struct drm_crtc *crtc,
-                               struct drm_framebuffer *fb,
-                               int crtc_x, int crtc_y,
-                               unsigned int crtc_w,
-                               unsigned int crtc_h,
-                               uint32_t src_x, uint32_t src_y,
-                               uint32_t src_w, uint32_t src_h);
 /* Atomic Helpers */
 int vmw_du_primary_plane_atomic_check(struct drm_plane *plane,
@@ -356,8 +343,6 @@ int vmw_du_cursor_plane_atomic_check(struct drm_plane *plane,
                                     struct drm_plane_state *state);
 void vmw_du_cursor_plane_atomic_update(struct drm_plane *plane,
                                       struct drm_plane_state *old_state);
-void vmw_du_cursor_plane_atomic_disable(struct drm_plane *plane,
-                                        struct drm_plane_state *old_state);
 int vmw_du_cursor_plane_prepare_fb(struct drm_plane *plane,
                                   struct drm_plane_state *new_state);
 void vmw_du_plane_cleanup_fb(struct drm_plane *plane,
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
index bad31bdf09b6..50be1f034f9e 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
@@ -56,6 +56,8 @@ enum stdu_content_type {
 * @right: Right side of bounding box.
 * @top: Top side of bounding box.
 * @bottom: Bottom side of bounding box.
+ * @fb_left: Left side of the framebuffer/content bounding box
+ * @fb_top: Top of the framebuffer/content bounding box
 * @buf: DMA buffer when DMA-ing between buffer and screen targets.
 * @sid: Surface ID when copying between surface and screen targets.
 */
@@ -63,6 +65,7 @@ struct vmw_stdu_dirty {
        struct vmw_kms_dirty base;
        SVGA3dTransferType  transfer;
        s32 left, right, top, bottom;
+        s32 fb_left, fb_top;
        u32 pitch;
        union {
                struct vmw_dma_buffer *buf;
@@ -647,7 +650,7 @@ static void vmw_stdu_dmabuf_fifo_commit(struct vmw_kms_dirty *dirty)
 *
 * @dirty: The closure structure.
 *
- * This function calculates the bounding box for all the incoming clips
+ * This function calculates the bounding box for all the incoming clips.
 */
 static void vmw_stdu_dmabuf_cpu_clip(struct vmw_kms_dirty *dirty)
 {
@@ -656,11 +659,19 @@ static void vmw_stdu_dmabuf_cpu_clip(struct vmw_kms_dirty *dirty)
        dirty->num_hits = 1;
-        /* Calculate bounding box */
+        /* Calculate destination bounding box */
        ddirty->left = min_t(s32, ddirty->left, dirty->unit_x1);
        ddirty->top = min_t(s32, ddirty->top, dirty->unit_y1);
        ddirty->right = max_t(s32, ddirty->right, dirty->unit_x2);
        ddirty->bottom = max_t(s32, ddirty->bottom, dirty->unit_y2);
+        /*
+         * Calculate content bounding box.  We only need the top-left
+         * coordinate because width and height will be the same as the
+         * destination bounding box above
+         */
+        ddirty->fb_left = min_t(s32, ddirty->fb_left, dirty->fb_x);
+        ddirty->fb_top  = min_t(s32, ddirty->fb_top, dirty->fb_y);
 }
@@ -697,11 +708,11 @@ static void vmw_stdu_dmabuf_cpu_commit(struct vmw_kms_dirty *dirty)
        /* Assume we are blitting from Host (display_srf) to Guest (dmabuf) */
        src_pitch = stdu->display_srf->base_size.width * stdu->cpp;
        src = ttm_kmap_obj_virtual(&stdu->host_map, &not_used);
-        src += dirty->unit_y1 * src_pitch + dirty->unit_x1 * stdu->cpp;
+        src += ddirty->top * src_pitch + ddirty->left * stdu->cpp;
        dst_pitch = ddirty->pitch;
        dst = ttm_kmap_obj_virtual(&stdu->guest_map, &not_used);
-        dst += dirty->fb_y * dst_pitch + dirty->fb_x * stdu->cpp;
+        dst += ddirty->fb_top * dst_pitch + ddirty->fb_left * stdu->cpp;
        /* Figure out the real direction */
@@ -760,7 +771,7 @@ static void vmw_stdu_dmabuf_cpu_commit(struct vmw_kms_dirty *dirty)
        }
 out_cleanup:
-        ddirty->left = ddirty->top = S32_MAX;
+        ddirty->left = ddirty->top = ddirty->fb_left = ddirty->fb_top = S32_MAX;
        ddirty->right = ddirty->bottom = S32_MIN;
 }
@@ -812,6 +823,7 @@ int vmw_kms_stdu_dma(struct vmw_private *dev_priv,
                SVGA3D_READ_HOST_VRAM;
        ddirty.left = ddirty.top = S32_MAX;
        ddirty.right = ddirty.bottom = S32_MIN;
+        ddirty.fb_left = ddirty.fb_top = S32_MAX;
        ddirty.pitch = vfb->base.pitches[0];
        ddirty.buf = buf;
        ddirty.base.fifo_commit = vmw_stdu_dmabuf_fifo_commit;
@@ -1355,6 +1367,11 @@ vmw_stdu_primary_plane_atomic_update(struct drm_plane *plane,
                DRM_ERROR("Failed to bind surface to STDU.\n");
        else
                crtc->primary->fb = plane->state->fb;
+        ret = vmw_stdu_update_st(dev_priv, stdu);
+        if (ret)
+                DRM_ERROR("Failed to update STDU.\n");
 }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
index 7681341fe32b..6b70bd259953 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
@@ -1274,11 +1274,14 @@ int vmw_gb_surface_define_ioctl(struct drm_device *dev, void *data,
        struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
        int ret;
        uint32_t size;
-        uint32_t backup_handle;
+        uint32_t backup_handle = 0;
        if (req->multisample_count != 0)
                return -EINVAL;
+        if (req->mip_levels > DRM_VMW_MAX_MIP_LEVELS)
+                return -EINVAL;
        if (unlikely(vmw_user_surface_size == 0))
                vmw_user_surface_size = ttm_round_pot(sizeof(*user_srf)) +
                        128;
@@ -1314,12 +1317,16 @@ int vmw_gb_surface_define_ioctl(struct drm_device *dev, void *data,
                ret = vmw_user_dmabuf_lookup(tfile, req->buffer_handle,
                                             &res->backup,
                                             &user_srf->backup_base);
-                if (ret == 0 && res->backup->base.num_pages * PAGE_SIZE <
+                if (ret == 0) {
-                    res->backup_size) {
+                        if (res->backup->base.num_pages * PAGE_SIZE <
-                        DRM_ERROR("Surface backup buffer is too small.\n");
+                            res->backup_size) {
-                        vmw_dmabuf_unreference(&res->backup);
+                                DRM_ERROR("Surface backup buffer is too small.\n");
-                        ret = -EINVAL;
+                                vmw_dmabuf_unreference(&res->backup);
-                        goto out_unlock;
+                                ret = -EINVAL;
+                                goto out_unlock;
+                        } else {
+                                backup_handle = req->buffer_handle;
+                        }
                }
        } else if (req->drm_surface_flags & drm_vmw_surface_flag_create_buffer)
                ret = vmw_user_dmabuf_alloc(dev_priv, tfile,
@@ -1491,7 +1498,7 @@ int vmw_surface_gb_priv_define(struct drm_device *dev,
                                 dev_priv->stdu_max_height);
                if (size.width > max_width || size.height > max_height) {
-                        DRM_ERROR("%ux%u\n, exeeds max surface size %ux%u",
+                        DRM_ERROR("%ux%u\n, exceeds max surface size %ux%u",
                                  size.width, size.height,
                                  max_width, max_height);
                        return -EINVAL;
diff --git a/drivers/gpu/ipu-v3/ipu-common.c b/drivers/gpu/ipu-v3/ipu-common.c
index 16d556816b5f..2fb5f432a54c 100644
--- a/drivers/gpu/ipu-v3/ipu-common.c
+++ b/drivers/gpu/ipu-v3/ipu-common.c
@@ -725,15 +725,16 @@ void ipu_set_ic_src_mux(struct ipu_soc *ipu, int csi_id, bool vdi)
        spin_lock_irqsave(&ipu->lock, flags);
        val = ipu_cm_read(ipu, IPU_CONF);
-        if (vdi) {
+        if (vdi)
                val |= IPU_CONF_IC_INPUT;
-        } else {
+        else
                val &= ~IPU_CONF_IC_INPUT;
-                if (csi_id == 1)
-                        val |= IPU_CONF_CSI_SEL;
+        if (csi_id == 1)
-                else
+                val |= IPU_CONF_CSI_SEL;
-                        val &= ~IPU_CONF_CSI_SEL;
+        else
-        }
+                val &= ~IPU_CONF_CSI_SEL;
        ipu_cm_write(ipu, val, IPU_CONF);
        spin_unlock_irqrestore(&ipu->lock, flags);
diff --git a/drivers/gpu/ipu-v3/ipu-pre.c b/drivers/gpu/ipu-v3/ipu-pre.c
index c55563379e2e..c35f74c83065 100644
--- a/drivers/gpu/ipu-v3/ipu-pre.c
+++ b/drivers/gpu/ipu-v3/ipu-pre.c
@@ -131,8 +131,6 @@ int ipu_pre_get(struct ipu_pre *pre)
        if (pre->in_use)
                return -EBUSY;
-        clk_prepare_enable(pre->clk_axi);
        /* first get the engine out of reset and remove clock gating */
        writel(0, pre->regs + IPU_PRE_CTRL);
@@ -149,12 +147,7 @@ int ipu_pre_get(struct ipu_pre *pre)
 void ipu_pre_put(struct ipu_pre *pre)
 {
-        u32 val;
+        writel(IPU_PRE_CTRL_SFTRST, pre->regs + IPU_PRE_CTRL);
-        val = IPU_PRE_CTRL_SFTRST | IPU_PRE_CTRL_CLKGATE;
-        writel(val, pre->regs + IPU_PRE_CTRL);
-        clk_disable_unprepare(pre->clk_axi);
        pre->in_use = false;
 }
@@ -249,6 +242,8 @@ static int ipu_pre_probe(struct platform_device *pdev)
        if (!pre->buffer_virt)
                return -ENOMEM;
+        clk_prepare_enable(pre->clk_axi);
        pre->dev = dev;
        platform_set_drvdata(pdev, pre);
        mutex_lock(&ipu_pre_list_mutex);
@@ -268,6 +263,8 @@ static int ipu_pre_remove(struct platform_device *pdev)
        available_pres--;
        mutex_unlock(&ipu_pre_list_mutex);
+        clk_disable_unprepare(pre->clk_axi);
        if (pre->buffer_virt)
                gen_pool_free(pre->iram, (unsigned long)pre->buffer_virt,
                              IPU_PRE_MAX_WIDTH * IPU_PRE_NUM_SCANLINES * 4);
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index e73d968023f7..f1fa1f172107 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -1118,8 +1118,10 @@ static int elantech_get_resolution_v4(struct psmouse *psmouse,
 * Asus UX32VD             0x361f02        00, 15, 0e      clickpad
 * Avatar AVIU-145A2       0x361f00        ?               clickpad
 * Fujitsu LIFEBOOK E544   0x470f00        d0, 12, 09      2 hw buttons
+ * Fujitsu LIFEBOOK E546   0x470f00        50, 12, 09      2 hw buttons
 * Fujitsu LIFEBOOK E547   0x470f00        50, 12, 09      2 hw buttons
 * Fujitsu LIFEBOOK E554   0x570f01        40, 14, 0c      2 hw buttons
+ * Fujitsu LIFEBOOK E557   0x570f01        40, 14, 0c      2 hw buttons
 * Fujitsu T725            0x470f01        05, 12, 09      2 hw buttons
 * Fujitsu H730            0x570f00        c0, 14, 0c      3 hw buttons (**)
 * Gigabyte U2442          0x450f01        58, 17, 0c      2 hw buttons
@@ -1525,6 +1527,13 @@ static const struct dmi_system_id elantech_dmi_force_crc_enabled[] = {
                },
        },
        {
+                /* Fujitsu LIFEBOOK E546  does not work with crc_enabled == 0 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E546"),
+                },
+        },
+        {
                /* Fujitsu LIFEBOOK E547 does not work with crc_enabled == 0 */
                .matches = {
                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
@@ -1546,6 +1555,13 @@ static const struct dmi_system_id elantech_dmi_force_crc_enabled[] = {
                },
        },
        {
+                /* Fujitsu LIFEBOOK E557 does not work with crc_enabled == 0 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E557"),
+                },
+        },
+        {
                /* Fujitsu LIFEBOOK U745 does not work with crc_enabled == 0 */
                .matches = {
                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
diff --git a/drivers/input/rmi4/rmi_f03.c b/drivers/input/rmi4/rmi_f03.c
index 77dad045a468..ad71a5e768dc 100644
--- a/drivers/input/rmi4/rmi_f03.c
+++ b/drivers/input/rmi4/rmi_f03.c
@@ -146,7 +146,7 @@ static int rmi_f03_register_pt(struct f03_data *f03)
        if (!serio)
                return -ENOMEM;
-        serio->id.type = SERIO_8042;
+        serio->id.type = SERIO_PS_PSTHRU;
        serio->write = rmi_f03_pt_write;
        serio->port_data = f03;
diff --git a/drivers/iommu/of_iommu.c b/drivers/iommu/of_iommu.c
index 9f44ee8ea1bc..19779b88a479 100644
--- a/drivers/iommu/of_iommu.c
+++ b/drivers/iommu/of_iommu.c
@@ -118,6 +118,7 @@ static const struct iommu_ops
        ops = iommu_ops_from_fwnode(fwnode);
        if ((ops && !ops->of_xlate) ||
+            !of_device_is_available(iommu_spec->np) ||
            (!ops && !of_iommu_driver_present(iommu_spec->np)))
                return NULL;
@@ -236,6 +237,12 @@ const struct iommu_ops *of_iommu_configure(struct device *dev,
                        ops = ERR_PTR(err);
        }
+        /* Ignore all other errors apart from EPROBE_DEFER */
+        if (IS_ERR(ops) && (PTR_ERR(ops) != -EPROBE_DEFER)) {
+                dev_dbg(dev, "Adding to IOMMU failed: %ld\n", PTR_ERR(ops));
+                ops = NULL;
+        }
        return ops;
 }
diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c
index d07dd5196ffc..8aa158a09180 100644
--- a/drivers/isdn/i4l/isdn_ppp.c
+++ b/drivers/isdn/i4l/isdn_ppp.c
@@ -2364,7 +2364,7 @@ static struct ippp_ccp_reset_state *isdn_ppp_ccp_reset_alloc_state(struct ippp_s
                       id);
                return NULL;
        } else {
-                rs = kzalloc(sizeof(struct ippp_ccp_reset_state), GFP_KERNEL);
+                rs = kzalloc(sizeof(struct ippp_ccp_reset_state), GFP_ATOMIC);
                if (!rs)
                        return NULL;
                rs->state = CCPResetIdle;
diff --git a/drivers/isdn/mISDN/stack.c b/drivers/isdn/mISDN/stack.c
index 8b7faea2ddf8..422dced7c90a 100644
--- a/drivers/isdn/mISDN/stack.c
+++ b/drivers/isdn/mISDN/stack.c
@@ -75,7 +75,7 @@ send_socklist(struct mISDN_sock_list *sl, struct sk_buff *skb)
                if (sk->sk_state != MISDN_BOUND)
                        continue;
                if (!cskb)
-                        cskb = skb_copy(skb, GFP_KERNEL);
+                        cskb = skb_copy(skb, GFP_ATOMIC);
                if (!cskb) {
                        printk(KERN_WARNING "%s no skb\n", __func__);
                        break;
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 212a6777ff31..87edc342ccb3 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -5174,6 +5174,18 @@ static void mddev_delayed_delete(struct work_struct *ws)
 static void no_op(struct percpu_ref *r) {}
+int mddev_init_writes_pending(struct mddev *mddev)
+{
+        if (mddev->writes_pending.percpu_count_ptr)
+                return 0;
+        if (percpu_ref_init(&mddev->writes_pending, no_op, 0, GFP_KERNEL) < 0)
+                return -ENOMEM;
+        /* We want to start with the refcount at zero */
+        percpu_ref_put(&mddev->writes_pending);
+        return 0;
+}
+EXPORT_SYMBOL_GPL(mddev_init_writes_pending);
 static int md_alloc(dev_t dev, char *name)
 {
        /*
@@ -5239,10 +5251,6 @@ static int md_alloc(dev_t dev, char *name)
        blk_queue_make_request(mddev->queue, md_make_request);
        blk_set_stacking_limits(&mddev->queue->limits);
-        if (percpu_ref_init(&mddev->writes_pending, no_op, 0, GFP_KERNEL) < 0)
-                goto abort;
-        /* We want to start with the refcount at zero */
-        percpu_ref_put(&mddev->writes_pending);
        disk = alloc_disk(1 << shift);
        if (!disk) {
                blk_cleanup_queue(mddev->queue);
diff --git a/drivers/md/md.h b/drivers/md/md.h
index 11f15146ce51..0fa1de42c42b 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -648,6 +648,7 @@ extern void md_unregister_thread(struct md_thread **threadp);
 extern void md_wakeup_thread(struct md_thread *thread);
 extern void md_check_recovery(struct mddev *mddev);
 extern void md_reap_sync_thread(struct mddev *mddev);
+extern int mddev_init_writes_pending(struct mddev *mddev);
 extern void md_write_start(struct mddev *mddev, struct bio *bi);
 extern void md_write_inc(struct mddev *mddev, struct bio *bi);
 extern void md_write_end(struct mddev *mddev);
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index af5056d56878..e1a7e3d4c5e4 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -3063,6 +3063,8 @@ static int raid1_run(struct mddev *mddev)
                        mdname(mddev));
                return -EIO;
        }
+        if (mddev_init_writes_pending(mddev) < 0)
+                return -ENOMEM;
        /*
         * copy the already verified devices into our private RAID1
         * bookkeeping area. [whatever we allocate in run(),
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 4343d7ff9916..797ed60abd5e 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -3611,6 +3611,9 @@ static int raid10_run(struct mddev *mddev)
        int first = 1;
        bool discard_supported = false;
+        if (mddev_init_writes_pending(mddev) < 0)
+                return -ENOMEM;
        if (mddev->private == NULL) {
                conf = setup_conf(mddev);
                if (IS_ERR(conf))
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 722064689e82..ec0f951ae19f 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -7118,6 +7118,9 @@ static int raid5_run(struct mddev *mddev)
        long long min_offset_diff = 0;
        int first = 1;
+        if (mddev_init_writes_pending(mddev) < 0)
+                return -ENOMEM;
        if (mddev->recovery_cp != MaxSector)
                pr_notice("md/raid:%s: not clean -- starting background reconstruction\n",
                          mdname(mddev));
diff --git a/drivers/media/Kconfig b/drivers/media/Kconfig
index b72edd27f880..55d9c2b82b7e 100644
--- a/drivers/media/Kconfig
+++ b/drivers/media/Kconfig
@@ -2,6 +2,12 @@
 # Multimedia device configuration
 #
+config CEC_CORE
+        tristate
+config CEC_NOTIFIER
+        bool
 menuconfig MEDIA_SUPPORT
        tristate "Multimedia support"
        depends on HAS_IOMEM
diff --git a/drivers/media/Makefile b/drivers/media/Makefile
index 523fea3648ad..044503aa8801 100644
--- a/drivers/media/Makefile
+++ b/drivers/media/Makefile
@@ -4,8 +4,6 @@
 media-objs      := media-device.o media-devnode.o media-entity.o
-obj-$(CONFIG_CEC_CORE) += cec/
 #
 # I2C drivers should come before other drivers, otherwise they'll fail
 # when compiled as builtin drivers
@@ -26,6 +24,8 @@ obj-$(CONFIG_DVB_CORE)  += dvb-core/
 # There are both core and drivers at RC subtree - merge before drivers
 obj-y += rc/
+obj-$(CONFIG_CEC_CORE) += cec/
 #
 # Finally, merge the drivers that require the core
 #
diff --git a/drivers/media/cec/Kconfig b/drivers/media/cec/Kconfig
index f944d93e3167..4e25a950ae6f 100644
--- a/drivers/media/cec/Kconfig
+++ b/drivers/media/cec/Kconfig
@@ -1,19 +1,5 @@
-config CEC_CORE
-        tristate
-        depends on MEDIA_CEC_SUPPORT
-        default y
-config MEDIA_CEC_NOTIFIER
-        bool
 config MEDIA_CEC_RC
        bool "HDMI CEC RC integration"
        depends on CEC_CORE && RC_CORE
        ---help---
          Pass on CEC remote control messages to the RC framework.
-config MEDIA_CEC_DEBUG
-        bool "HDMI CEC debugfs interface"
-        depends on CEC_CORE && DEBUG_FS
-        ---help---
-          Turns on the DebugFS interface for CEC devices.
diff --git a/drivers/media/cec/Makefile b/drivers/media/cec/Makefile
index 402a6c62a3e8..eaf408e64669 100644
--- a/drivers/media/cec/Makefile
+++ b/drivers/media/cec/Makefile
@@ -1,6 +1,6 @@
 cec-objs := cec-core.o cec-adap.o cec-api.o cec-edid.o
-ifeq ($(CONFIG_MEDIA_CEC_NOTIFIER),y)
+ifeq ($(CONFIG_CEC_NOTIFIER),y)
  cec-objs += cec-notifier.o
 endif
diff --git a/drivers/media/cec/cec-adap.c b/drivers/media/cec/cec-adap.c
index f5fe01c9da8a..9dfc79800c71 100644
--- a/drivers/media/cec/cec-adap.c
+++ b/drivers/media/cec/cec-adap.c
@@ -1864,7 +1864,7 @@ void cec_monitor_all_cnt_dec(struct cec_adapter *adap)
                WARN_ON(call_op(adap, adap_monitor_all_enable, 0));
 }
-#ifdef CONFIG_MEDIA_CEC_DEBUG
+#ifdef CONFIG_DEBUG_FS
 /*
 * Log the current state of the CEC adapter.
 * Very useful for debugging.
diff --git a/drivers/media/cec/cec-core.c b/drivers/media/cec/cec-core.c
index f9ebff90f8eb..2f87748ba4fc 100644
--- a/drivers/media/cec/cec-core.c
+++ b/drivers/media/cec/cec-core.c
@@ -187,7 +187,7 @@ static void cec_devnode_unregister(struct cec_devnode *devnode)
        put_device(&devnode->dev);
 }
-#ifdef CONFIG_MEDIA_CEC_NOTIFIER
+#ifdef CONFIG_CEC_NOTIFIER
 static void cec_cec_notify(struct cec_adapter *adap, u16 pa)
 {
        cec_s_phys_addr(adap, pa, false);
@@ -323,7 +323,7 @@ int cec_register_adapter(struct cec_adapter *adap,
        }
        dev_set_drvdata(&adap->devnode.dev, adap);
-#ifdef CONFIG_MEDIA_CEC_DEBUG
+#ifdef CONFIG_DEBUG_FS
        if (!top_cec_dir)
                return 0;
@@ -355,7 +355,7 @@ void cec_unregister_adapter(struct cec_adapter *adap)
        adap->rc = NULL;
 #endif
        debugfs_remove_recursive(adap->cec_dir);
-#ifdef CONFIG_MEDIA_CEC_NOTIFIER
+#ifdef CONFIG_CEC_NOTIFIER
        if (adap->notifier)
                cec_notifier_unregister(adap->notifier);
 #endif
@@ -395,7 +395,7 @@ static int __init cec_devnode_init(void)
                return ret;
        }
-#ifdef CONFIG_MEDIA_CEC_DEBUG
+#ifdef CONFIG_DEBUG_FS
        top_cec_dir = debugfs_create_dir("cec", NULL);
        if (IS_ERR_OR_NULL(top_cec_dir)) {
                pr_warn("cec: Failed to create debugfs cec dir\n");
diff --git a/drivers/media/i2c/Kconfig b/drivers/media/i2c/Kconfig
index fd181c99ce11..aaa9471c7d11 100644
--- a/drivers/media/i2c/Kconfig
+++ b/drivers/media/i2c/Kconfig
@@ -220,7 +220,8 @@ config VIDEO_ADV7604
 config VIDEO_ADV7604_CEC
        bool "Enable Analog Devices ADV7604 CEC support"
-        depends on VIDEO_ADV7604 && CEC_CORE
+        depends on VIDEO_ADV7604
+        select CEC_CORE
        ---help---
          When selected the adv7604 will support the optional
          HDMI CEC feature.
@@ -240,7 +241,8 @@ config VIDEO_ADV7842
 config VIDEO_ADV7842_CEC
        bool "Enable Analog Devices ADV7842 CEC support"
-        depends on VIDEO_ADV7842 && CEC_CORE
+        depends on VIDEO_ADV7842
+        select CEC_CORE
        ---help---
          When selected the adv7842 will support the optional
          HDMI CEC feature.
@@ -478,7 +480,8 @@ config VIDEO_ADV7511
 config VIDEO_ADV7511_CEC
        bool "Enable Analog Devices ADV7511 CEC support"
-        depends on VIDEO_ADV7511 && CEC_CORE
+        depends on VIDEO_ADV7511
+        select CEC_CORE
        ---help---
          When selected the adv7511 will support the optional
          HDMI CEC feature.
diff --git a/drivers/media/platform/Kconfig b/drivers/media/platform/Kconfig
index ac026ee1ca07..041cb80a26b1 100644
--- a/drivers/media/platform/Kconfig
+++ b/drivers/media/platform/Kconfig
@@ -501,8 +501,9 @@ if CEC_PLATFORM_DRIVERS
 config VIDEO_SAMSUNG_S5P_CEC
       tristate "Samsung S5P CEC driver"
-       depends on CEC_CORE && (PLAT_S5P || ARCH_EXYNOS || COMPILE_TEST)
+       depends on PLAT_S5P || ARCH_EXYNOS || COMPILE_TEST
-       select MEDIA_CEC_NOTIFIER
+       select CEC_CORE
+       select CEC_NOTIFIER
       ---help---
         This is a driver for Samsung S5P HDMI CEC interface. It uses the
         generic CEC framework interface.
@@ -511,8 +512,9 @@ config VIDEO_SAMSUNG_S5P_CEC
 config VIDEO_STI_HDMI_CEC
       tristate "STMicroelectronics STiH4xx HDMI CEC driver"
-       depends on CEC_CORE && (ARCH_STI || COMPILE_TEST)
+       depends on ARCH_STI || COMPILE_TEST
-       select MEDIA_CEC_NOTIFIER
+       select CEC_CORE
+       select CEC_NOTIFIER
       ---help---
         This is a driver for STIH4xx HDMI CEC interface. It uses the
         generic CEC framework interface.
diff --git a/drivers/media/platform/vivid/Kconfig b/drivers/media/platform/vivid/Kconfig
index b36ac19dc6e4..154de92dd809 100644
--- a/drivers/media/platform/vivid/Kconfig
+++ b/drivers/media/platform/vivid/Kconfig
@@ -26,7 +26,8 @@ config VIDEO_VIVID
 config VIDEO_VIVID_CEC
        bool "Enable CEC emulation support"
-        depends on VIDEO_VIVID && CEC_CORE
+        depends on VIDEO_VIVID
+        select CEC_CORE
        ---help---
          When selected the vivid module will emulate the optional
          HDMI CEC feature.
diff --git a/drivers/media/rc/rc-ir-raw.c b/drivers/media/rc/rc-ir-raw.c
index 90f66dc7c0d7..a2fc1a1d58b0 100644
--- a/drivers/media/rc/rc-ir-raw.c
+++ b/drivers/media/rc/rc-ir-raw.c
@@ -211,7 +211,7 @@ EXPORT_SYMBOL_GPL(ir_raw_event_set_idle);
 */
 void ir_raw_event_handle(struct rc_dev *dev)
 {
-        if (!dev->raw)
+        if (!dev->raw || !dev->raw->thread)
                return;
        wake_up_process(dev->raw->thread);
@@ -490,6 +490,7 @@ int ir_raw_event_register(struct rc_dev *dev)
 {
        int rc;
        struct ir_raw_handler *handler;
+        struct task_struct *thread;
        if (!dev)
                return -EINVAL;
@@ -507,13 +508,15 @@ int ir_raw_event_register(struct rc_dev *dev)
         * because the event is coming from userspace
         */
        if (dev->driver_type != RC_DRIVER_IR_RAW_TX) {
-                dev->raw->thread = kthread_run(ir_raw_event_thread, dev->raw,
+                thread = kthread_run(ir_raw_event_thread, dev->raw, "rc%u",
-                                               "rc%u", dev->minor);
+                                     dev->minor);
-                if (IS_ERR(dev->raw->thread)) {
+                if (IS_ERR(thread)) {
-                        rc = PTR_ERR(dev->raw->thread);
+                        rc = PTR_ERR(thread);
                        goto out;
                }
+                dev->raw->thread = thread;
        }
        mutex_lock(&ir_raw_handler_lock);
diff --git a/drivers/media/usb/pulse8-cec/Kconfig b/drivers/media/usb/pulse8-cec/Kconfig
index 8937f3986a01..18ead44824ba 100644
--- a/drivers/media/usb/pulse8-cec/Kconfig
+++ b/drivers/media/usb/pulse8-cec/Kconfig
@@ -1,6 +1,7 @@
 config USB_PULSE8_CEC
        tristate "Pulse Eight HDMI CEC"
-        depends on USB_ACM && CEC_CORE
+        depends on USB_ACM
+        select CEC_CORE
        select SERIO
        select SERIO_SERPORT
        ---help---
diff --git a/drivers/media/usb/rainshadow-cec/Kconfig b/drivers/media/usb/rainshadow-cec/Kconfig
index 3eb86607efb8..030ef01b1ff0 100644
--- a/drivers/media/usb/rainshadow-cec/Kconfig
+++ b/drivers/media/usb/rainshadow-cec/Kconfig
@@ -1,6 +1,7 @@
 config USB_RAINSHADOW_CEC
        tristate "RainShadow Tech HDMI CEC"
-        depends on USB_ACM && CEC_CORE
+        depends on USB_ACM
+        select CEC_CORE
        select SERIO
        select SERIO_SERPORT
        ---help---
diff --git a/drivers/media/usb/rainshadow-cec/rainshadow-cec.c b/drivers/media/usb/rainshadow-cec/rainshadow-cec.c
index 541ca543f71f..71bd68548c9c 100644
--- a/drivers/media/usb/rainshadow-cec/rainshadow-cec.c
+++ b/drivers/media/usb/rainshadow-cec/rainshadow-cec.c
@@ -119,7 +119,7 @@ static void rain_irq_work_handler(struct work_struct *work)
        while (true) {
                unsigned long flags;
-                bool exit_loop;
+                bool exit_loop = false;
                char data;
                spin_lock_irqsave(&rain->buf_lock, flags);
diff --git a/drivers/memory/atmel-ebi.c b/drivers/memory/atmel-ebi.c
index 35910f945bfa..99e644cda4d1 100644
--- a/drivers/memory/atmel-ebi.c
+++ b/drivers/memory/atmel-ebi.c
@@ -581,7 +581,7 @@ static int atmel_ebi_probe(struct platform_device *pdev)
        return of_platform_populate(np, NULL, NULL, dev);
 }
-static int atmel_ebi_resume(struct device *dev)
+static __maybe_unused int atmel_ebi_resume(struct device *dev)
 {
        struct atmel_ebi *ebi = dev_get_drvdata(dev);
        struct atmel_ebi_dev *ebid;
diff --git a/drivers/misc/cxl/file.c b/drivers/misc/cxl/file.c
index 17b433f1ce23..0761271d68c5 100644
--- a/drivers/misc/cxl/file.c
+++ b/drivers/misc/cxl/file.c
@@ -159,11 +159,8 @@ static long afu_ioctl_start_work(struct cxl_context *ctx,
        /* Do this outside the status_mutex to avoid a circular dependency with
         * the locking in cxl_mmap_fault() */
-        if (copy_from_user(&work, uwork,
+        if (copy_from_user(&work, uwork, sizeof(work)))
-                           sizeof(struct cxl_ioctl_start_work))) {
+                return -EFAULT;
-                rc = -EFAULT;
-                goto out;
-        }
        mutex_lock(&ctx->status_mutex);
        if (ctx->status != OPENED) {
diff --git a/drivers/misc/cxl/native.c b/drivers/misc/cxl/native.c
index 871a2f09c718..8d6ea9712dbd 100644
--- a/drivers/misc/cxl/native.c
+++ b/drivers/misc/cxl/native.c
@@ -1302,13 +1302,16 @@ int cxl_native_register_psl_err_irq(struct cxl *adapter)
 void cxl_native_release_psl_err_irq(struct cxl *adapter)
 {
-        if (adapter->native->err_virq != irq_find_mapping(NULL, adapter->native->err_hwirq))
+        if (adapter->native->err_virq == 0 ||
+            adapter->native->err_virq !=
+            irq_find_mapping(NULL, adapter->native->err_hwirq))
                return;
        cxl_p1_write(adapter, CXL_PSL_ErrIVTE, 0x0000000000000000);
        cxl_unmap_irq(adapter->native->err_virq, adapter);
        cxl_ops->release_one_irq(adapter, adapter->native->err_hwirq);
        kfree(adapter->irq_name);
+        adapter->native->err_virq = 0;
 }
 int cxl_native_register_serr_irq(struct cxl_afu *afu)
@@ -1346,13 +1349,15 @@ int cxl_native_register_serr_irq(struct cxl_afu *afu)
 void cxl_native_release_serr_irq(struct cxl_afu *afu)
 {
-        if (afu->serr_virq != irq_find_mapping(NULL, afu->serr_hwirq))
+        if (afu->serr_virq == 0 ||
+            afu->serr_virq != irq_find_mapping(NULL, afu->serr_hwirq))
                return;
        cxl_p1n_write(afu, CXL_PSL_SERR_An, 0x0000000000000000);
        cxl_unmap_irq(afu->serr_virq, afu);
        cxl_ops->release_one_irq(afu->adapter, afu->serr_hwirq);
        kfree(afu->err_irq_name);
+        afu->serr_virq = 0;
 }
 int cxl_native_register_psl_irq(struct cxl_afu *afu)
@@ -1375,12 +1380,15 @@ int cxl_native_register_psl_irq(struct cxl_afu *afu)
 void cxl_native_release_psl_irq(struct cxl_afu *afu)
 {
-        if (afu->native->psl_virq != irq_find_mapping(NULL, afu->native->psl_hwirq))
+        if (afu->native->psl_virq == 0 ||
+            afu->native->psl_virq !=
+            irq_find_mapping(NULL, afu->native->psl_hwirq))
                return;
        cxl_unmap_irq(afu->native->psl_virq, afu);
        cxl_ops->release_one_irq(afu->adapter, afu->native->psl_hwirq);
        kfree(afu->psl_irq_name);
+        afu->native->psl_virq = 0;
 }
 static void recover_psl_err(struct cxl_afu *afu, u64 errstat)
diff --git a/drivers/net/dsa/mv88e6xxx/global2.h b/drivers/net/dsa/mv88e6xxx/global2.h
index 96046bb12ca1..14c0be98e0a4 100644
--- a/drivers/net/dsa/mv88e6xxx/global2.h
+++ b/drivers/net/dsa/mv88e6xxx/global2.h
@@ -114,13 +114,13 @@ static inline int mv88e6xxx_g2_set_eeprom16(struct mv88e6xxx_chip *chip,
        return -EOPNOTSUPP;
 }
-int mv88e6xxx_g2_pvt_write(struct mv88e6xxx_chip *chip, int src_dev,
+static inline int mv88e6xxx_g2_pvt_write(struct mv88e6xxx_chip *chip,
-                           int src_port, u16 data)
+                                         int src_dev, int src_port, u16 data)
 {
        return -EOPNOTSUPP;
 }
-int mv88e6xxx_g2_misc_4_bit_port(struct mv88e6xxx_chip *chip)
+static inline int mv88e6xxx_g2_misc_4_bit_port(struct mv88e6xxx_chip *chip)
 {
        return -EOPNOTSUPP;
 }
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-desc.c b/drivers/net/ethernet/amd/xgbe/xgbe-desc.c
index b3bc87fe3764..0a98c369df20 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-desc.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-desc.c
@@ -324,7 +324,7 @@ static int xgbe_map_rx_buffer(struct xgbe_prv_data *pdata,
                              struct xgbe_ring *ring,
                              struct xgbe_ring_data *rdata)
 {
-        int order, ret;
+        int ret;
        if (!ring->rx_hdr_pa.pages) {
                ret = xgbe_alloc_pages(pdata, &ring->rx_hdr_pa, GFP_ATOMIC, 0);
@@ -333,9 +333,8 @@ static int xgbe_map_rx_buffer(struct xgbe_prv_data *pdata,
        }
        if (!ring->rx_buf_pa.pages) {
-                order = max_t(int, PAGE_ALLOC_COSTLY_ORDER - 1, 0);
                ret = xgbe_alloc_pages(pdata, &ring->rx_buf_pa, GFP_ATOMIC,
-                                       order);
+                                       PAGE_ALLOC_COSTLY_ORDER);
                if (ret)
                        return ret;
        }
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index 099b374c1b17..5274501428e4 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -2026,9 +2026,12 @@ static int bcm_sysport_probe(struct platform_device *pdev)
        priv->num_rx_desc_words = params->num_rx_desc_words;
        priv->irq0 = platform_get_irq(pdev, 0);
-        if (!priv->is_lite)
+        if (!priv->is_lite) {
                priv->irq1 = platform_get_irq(pdev, 1);
-        priv->wol_irq = platform_get_irq(pdev, 2);
+                priv->wol_irq = platform_get_irq(pdev, 2);
+        } else {
+                priv->wol_irq = platform_get_irq(pdev, 1);
+        }
        if (priv->irq0 <= 0 || (priv->irq1 <= 0 && !priv->is_lite)) {
                dev_err(&pdev->dev, "invalid interrupts\n");
                ret = -EINVAL;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index eccb3d1b6abb..5f49334dcad5 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -1926,7 +1926,7 @@ u16 bnx2x_select_queue(struct net_device *dev, struct sk_buff *skb,
        }
        /* select a non-FCoE queue */
-        return fallback(dev, skb) % BNX2X_NUM_ETH_QUEUES(bp);
+        return fallback(dev, skb) % (BNX2X_NUM_ETH_QUEUES(bp) * bp->max_cos);
 }
 void bnx2x_set_num_queues(struct bnx2x *bp)
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 38a5c6764bb5..77ed2f628f9c 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -2196,10 +2196,14 @@ static int cxgb_up(struct adapter *adap)
                if (err)
                        goto irq_err;
        }
+        mutex_lock(&uld_mutex);
        enable_rx(adap);
        t4_sge_start(adap);
        t4_intr_enable(adap);
        adap->flags |= FULL_INIT_DONE;
+        mutex_unlock(&uld_mutex);
        notify_ulds(adap, CXGB4_STATE_UP);
 #if IS_ENABLED(CONFIG_IPV6)
        update_clip(adap);
@@ -2771,6 +2775,9 @@ void t4_fatal_err(struct adapter *adap)
 {
        int port;
+        if (pci_channel_offline(adap->pdev))
+                return;
        /* Disable the SGE since ULDs are going to free resources that
         * could be exposed to the adapter.  RDMA MWs for example...
         */
@@ -3882,9 +3889,10 @@ static pci_ers_result_t eeh_err_detected(struct pci_dev *pdev,
        spin_lock(&adap->stats_lock);
        for_each_port(adap, i) {
                struct net_device *dev = adap->port[i];
+                if (dev) {
-                netif_device_detach(dev);
+                        netif_device_detach(dev);
-                netif_carrier_off(dev);
+                        netif_carrier_off(dev);
+                }
        }
        spin_unlock(&adap->stats_lock);
        disable_interrupts(adap);
@@ -3963,12 +3971,13 @@ static void eeh_resume(struct pci_dev *pdev)
        rtnl_lock();
        for_each_port(adap, i) {
                struct net_device *dev = adap->port[i];
+                if (dev) {
-                if (netif_running(dev)) {
+                        if (netif_running(dev)) {
-                        link_start(dev);
+                                link_start(dev);
-                        cxgb_set_rxmode(dev);
+                                cxgb_set_rxmode(dev);
+                        }
+                        netif_device_attach(dev);
                }
-                netif_device_attach(dev);
        }
        rtnl_unlock();
 }
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index aded42b96f6d..3a34aa629f7d 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -4557,8 +4557,13 @@ void t4_intr_enable(struct adapter *adapter)
 */
 void t4_intr_disable(struct adapter *adapter)
 {
-        u32 whoami = t4_read_reg(adapter, PL_WHOAMI_A);
+        u32 whoami, pf;
-        u32 pf = CHELSIO_CHIP_VERSION(adapter->params.chip) <= CHELSIO_T5 ?
+        if (pci_channel_offline(adapter->pdev))
+                return;
+        whoami = t4_read_reg(adapter, PL_WHOAMI_A);
+        pf = CHELSIO_CHIP_VERSION(adapter->params.chip) <= CHELSIO_T5 ?
                        SOURCEPF_G(whoami) : T6_SOURCEPF_G(whoami);
        t4_write_reg(adapter, MYPF_REG(PL_PF_INT_ENABLE_A), 0);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h b/drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h
index 3549d3876278..f2d623a7aee0 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h
@@ -37,7 +37,7 @@
 #define T4FW_VERSION_MAJOR 0x01
 #define T4FW_VERSION_MINOR 0x10
-#define T4FW_VERSION_MICRO 0x2B
+#define T4FW_VERSION_MICRO 0x2D
 #define T4FW_VERSION_BUILD 0x00
 #define T4FW_MIN_VERSION_MAJOR 0x01
@@ -46,7 +46,7 @@
 #define T5FW_VERSION_MAJOR 0x01
 #define T5FW_VERSION_MINOR 0x10
-#define T5FW_VERSION_MICRO 0x2B
+#define T5FW_VERSION_MICRO 0x2D
 #define T5FW_VERSION_BUILD 0x00
 #define T5FW_MIN_VERSION_MAJOR 0x00
@@ -55,7 +55,7 @@
 #define T6FW_VERSION_MAJOR 0x01
 #define T6FW_VERSION_MINOR 0x10
-#define T6FW_VERSION_MICRO 0x2B
+#define T6FW_VERSION_MICRO 0x2D
 #define T6FW_VERSION_BUILD 0x00
 #define T6FW_MIN_VERSION_MAJOR 0x00
diff --git a/drivers/net/ethernet/ethoc.c b/drivers/net/ethernet/ethoc.c
index e863ba74d005..8bb0db990c8f 100644
--- a/drivers/net/ethernet/ethoc.c
+++ b/drivers/net/ethernet/ethoc.c
@@ -739,6 +739,8 @@ static int ethoc_open(struct net_device *dev)
        if (ret)
                return ret;
+        napi_enable(&priv->napi);
        ethoc_init_ring(priv, dev->mem_start);
        ethoc_reset(priv);
@@ -754,7 +756,6 @@ static int ethoc_open(struct net_device *dev)
        priv->old_duplex = -1;
        phy_start(dev->phydev);
-        napi_enable(&priv->napi);
        if (netif_msg_ifup(priv)) {
                dev_info(&dev->dev, "I/O: %08lx Memory: %08lx-%08lx\n",
diff --git a/drivers/net/ethernet/freescale/fsl_pq_mdio.c b/drivers/net/ethernet/freescale/fsl_pq_mdio.c
index 446c7b374ff5..a10de1e9c157 100644
--- a/drivers/net/ethernet/freescale/fsl_pq_mdio.c
+++ b/drivers/net/ethernet/freescale/fsl_pq_mdio.c
@@ -381,7 +381,7 @@ static int fsl_pq_mdio_probe(struct platform_device *pdev)
 {
        const struct of_device_id *id =
                of_match_device(fsl_pq_mdio_match, &pdev->dev);
-        const struct fsl_pq_mdio_data *data = id->data;
+        const struct fsl_pq_mdio_data *data;
        struct device_node *np = pdev->dev.of_node;
        struct resource res;
        struct device_node *tbi;
@@ -389,6 +389,13 @@ static int fsl_pq_mdio_probe(struct platform_device *pdev)
        struct mii_bus *new_bus;
        int err;
+        if (!id) {
+                dev_err(&pdev->dev, "Failed to match device\n");
+                return -ENODEV;
+        }
+        data = id->data;
        dev_dbg(&pdev->dev, "found %s compatible node\n", id->compatible);
        new_bus = mdiobus_alloc_size(sizeof(*priv));
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index 4f2d329dba99..a93757c255f7 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -81,7 +81,7 @@
 static const char ibmvnic_driver_name[] = "ibmvnic";
 static const char ibmvnic_driver_string[] = "IBM System i/p Virtual NIC Driver";
-MODULE_AUTHOR("Santiago Leon <santi_leon@yahoo.com>");
+MODULE_AUTHOR("Santiago Leon");
 MODULE_DESCRIPTION("IBM System i/p Virtual NIC Driver");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(IBMVNIC_DRIVER_VERSION);
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index d5c9c9e06ff5..150caf6ca2b4 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -295,7 +295,7 @@ struct i40e_vsi *i40e_find_vsi_from_id(struct i40e_pf *pf, u16 id)
 **/
 void i40e_service_event_schedule(struct i40e_pf *pf)
 {
-        if (!test_bit(__I40E_VSI_DOWN, pf->state) &&
+        if (!test_bit(__I40E_DOWN, pf->state) &&
            !test_bit(__I40E_RESET_RECOVERY_PENDING, pf->state))
                queue_work(i40e_wq, &pf->service_task);
 }
@@ -3611,7 +3611,7 @@ static irqreturn_t i40e_intr(int irq, void *data)
                 * this is not a performance path and napi_schedule()
                 * can deal with rescheduling.
                 */
-                if (!test_bit(__I40E_VSI_DOWN, pf->state))
+                if (!test_bit(__I40E_DOWN, pf->state))
                        napi_schedule_irqoff(&q_vector->napi);
        }
@@ -3687,7 +3687,7 @@ static irqreturn_t i40e_intr(int irq, void *data)
 enable_intr:
        /* re-enable interrupt causes */
        wr32(hw, I40E_PFINT_ICR0_ENA, ena_mask);
-        if (!test_bit(__I40E_VSI_DOWN, pf->state)) {
+        if (!test_bit(__I40E_DOWN, pf->state)) {
                i40e_service_event_schedule(pf);
                i40e_irq_dynamic_enable_icr0(pf, false);
        }
@@ -6203,7 +6203,7 @@ static void i40e_fdir_reinit_subtask(struct i40e_pf *pf)
 {
        /* if interface is down do nothing */
-        if (test_bit(__I40E_VSI_DOWN, pf->state))
+        if (test_bit(__I40E_DOWN, pf->state))
                return;
        if (test_bit(__I40E_FD_FLUSH_REQUESTED, pf->state))
@@ -6344,7 +6344,7 @@ static void i40e_watchdog_subtask(struct i40e_pf *pf)
        int i;
        /* if interface is down do nothing */
-        if (test_bit(__I40E_VSI_DOWN, pf->state) ||
+        if (test_bit(__I40E_DOWN, pf->state) ||
            test_bit(__I40E_CONFIG_BUSY, pf->state))
                return;
@@ -6399,9 +6399,9 @@ static void i40e_reset_subtask(struct i40e_pf *pf)
                reset_flags |= BIT(__I40E_GLOBAL_RESET_REQUESTED);
                clear_bit(__I40E_GLOBAL_RESET_REQUESTED, pf->state);
        }
-        if (test_bit(__I40E_VSI_DOWN_REQUESTED, pf->state)) {
+        if (test_bit(__I40E_DOWN_REQUESTED, pf->state)) {
-                reset_flags |= BIT(__I40E_VSI_DOWN_REQUESTED);
+                reset_flags |= BIT(__I40E_DOWN_REQUESTED);
-                clear_bit(__I40E_VSI_DOWN_REQUESTED, pf->state);
+                clear_bit(__I40E_DOWN_REQUESTED, pf->state);
        }
        /* If there's a recovery already waiting, it takes
@@ -6415,7 +6415,7 @@ static void i40e_reset_subtask(struct i40e_pf *pf)
        /* If we're already down or resetting, just bail */
        if (reset_flags &&
-            !test_bit(__I40E_VSI_DOWN, pf->state) &&
+            !test_bit(__I40E_DOWN, pf->state) &&
            !test_bit(__I40E_CONFIG_BUSY, pf->state)) {
                rtnl_lock();
                i40e_do_reset(pf, reset_flags, true);
@@ -7002,7 +7002,7 @@ static void i40e_rebuild(struct i40e_pf *pf, bool reinit, bool lock_acquired)
        u32 val;
        int v;
-        if (test_bit(__I40E_VSI_DOWN, pf->state))
+        if (test_bit(__I40E_DOWN, pf->state))
                goto clear_recovery;
        dev_dbg(&pf->pdev->dev, "Rebuilding internal switch\n");
@@ -9767,7 +9767,7 @@ int i40e_vsi_release(struct i40e_vsi *vsi)
                return -ENODEV;
        }
        if (vsi == pf->vsi[pf->lan_vsi] &&
-            !test_bit(__I40E_VSI_DOWN, pf->state)) {
+            !test_bit(__I40E_DOWN, pf->state)) {
                dev_info(&pf->pdev->dev, "Can't remove PF VSI\n");
                return -ENODEV;
        }
@@ -11003,7 +11003,7 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        }
        pf->next_vsi = 0;
        pf->pdev = pdev;
-        set_bit(__I40E_VSI_DOWN, pf->state);
+        set_bit(__I40E_DOWN, pf->state);
        hw = &pf->hw;
        hw->back = pf;
@@ -11293,7 +11293,7 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         * before setting up the misc vector or we get a race and the vector
         * ends up disabled forever.
         */
-        clear_bit(__I40E_VSI_DOWN, pf->state);
+        clear_bit(__I40E_DOWN, pf->state);
        /* In case of MSIX we are going to setup the misc vector right here
         * to handle admin queue events etc. In case of legacy and MSI
@@ -11448,7 +11448,7 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        /* Unwind what we've done if something failed in the setup */
 err_vsis:
-        set_bit(__I40E_VSI_DOWN, pf->state);
+        set_bit(__I40E_DOWN, pf->state);
        i40e_clear_interrupt_scheme(pf);
        kfree(pf->vsi);
 err_switch_setup:
@@ -11500,7 +11500,7 @@ static void i40e_remove(struct pci_dev *pdev)
        /* no more scheduling of any task */
        set_bit(__I40E_SUSPENDED, pf->state);
-        set_bit(__I40E_VSI_DOWN, pf->state);
+        set_bit(__I40E_DOWN, pf->state);
        if (pf->service_timer.data)
                del_timer_sync(&pf->service_timer);
        if (pf->service_task.func)
@@ -11740,7 +11740,7 @@ static void i40e_shutdown(struct pci_dev *pdev)
        struct i40e_hw *hw = &pf->hw;
        set_bit(__I40E_SUSPENDED, pf->state);
-        set_bit(__I40E_VSI_DOWN, pf->state);
+        set_bit(__I40E_DOWN, pf->state);
        rtnl_lock();
        i40e_prep_for_reset(pf, true);
        rtnl_unlock();
@@ -11789,7 +11789,7 @@ static int i40e_suspend(struct pci_dev *pdev, pm_message_t state)
        int retval = 0;
        set_bit(__I40E_SUSPENDED, pf->state);
-        set_bit(__I40E_VSI_DOWN, pf->state);
+        set_bit(__I40E_DOWN, pf->state);
        if (pf->wol_en && (pf->flags & I40E_FLAG_WOL_MC_MAGIC_PKT_WAKE))
                i40e_enable_mc_magic_wake(pf);
@@ -11841,7 +11841,7 @@ static int i40e_resume(struct pci_dev *pdev)
        /* handling the reset will rebuild the device state */
        if (test_and_clear_bit(__I40E_SUSPENDED, pf->state)) {
-                clear_bit(__I40E_VSI_DOWN, pf->state);
+                clear_bit(__I40E_DOWN, pf->state);
                rtnl_lock();
                i40e_reset_and_rebuild(pf, false, true);
                rtnl_unlock();
diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
index 29321a6167a6..cd894f4023b1 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
@@ -1854,7 +1854,8 @@ static struct sk_buff *i40e_build_skb(struct i40e_ring *rx_ring,
 #if (PAGE_SIZE < 8192)
        unsigned int truesize = i40e_rx_pg_size(rx_ring) / 2;
 #else
-        unsigned int truesize = SKB_DATA_ALIGN(size);
+        unsigned int truesize = SKB_DATA_ALIGN(sizeof(struct skb_shared_info)) +
+                                SKB_DATA_ALIGN(I40E_SKB_PAD + size);
 #endif
        struct sk_buff *skb;
diff --git a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
index dfe241a12ad0..12b02e530503 100644
--- a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
@@ -1190,7 +1190,8 @@ static struct sk_buff *i40e_build_skb(struct i40e_ring *rx_ring,
 #if (PAGE_SIZE < 8192)
        unsigned int truesize = i40e_rx_pg_size(rx_ring) / 2;
 #else
-        unsigned int truesize = SKB_DATA_ALIGN(size);
+        unsigned int truesize = SKB_DATA_ALIGN(sizeof(struct skb_shared_info)) +
+                                SKB_DATA_ALIGN(I40E_SKB_PAD + size);
 #endif
        struct sk_buff *skb;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
index ae5fdc2df654..ffbcb27c05e5 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
@@ -1562,11 +1562,6 @@ static int mlx4_en_flow_replace(struct net_device *dev,
                qpn = priv->drop_qp.qpn;
        else if (cmd->fs.ring_cookie & EN_ETHTOOL_QP_ATTACH) {
                qpn = cmd->fs.ring_cookie & (EN_ETHTOOL_QP_ATTACH - 1);
-                if (qpn < priv->rss_map.base_qpn ||
-                    qpn >= priv->rss_map.base_qpn + priv->rx_ring_num) {
-                        en_warn(priv, "rxnfc: QP (0x%x) doesn't exist\n", qpn);
-                        return -EINVAL;
-                }
        } else {
                if (cmd->fs.ring_cookie >= priv->rx_ring_num) {
                        en_warn(priv, "rxnfc: RX ring (%llu) doesn't exist\n",
diff --git a/drivers/net/ethernet/mellanox/mlx4/mcg.c b/drivers/net/ethernet/mellanox/mlx4/mcg.c
index 1a670b681555..0710b3677464 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mcg.c
+++ b/drivers/net/ethernet/mellanox/mlx4/mcg.c
@@ -35,6 +35,7 @@
 #include <linux/etherdevice.h>
 #include <linux/mlx4/cmd.h>
+#include <linux/mlx4/qp.h>
 #include <linux/export.h>
 #include "mlx4.h"
@@ -985,16 +986,21 @@ int mlx4_flow_attach(struct mlx4_dev *dev,
        if (IS_ERR(mailbox))
                return PTR_ERR(mailbox);
+        if (!mlx4_qp_lookup(dev, rule->qpn)) {
+                mlx4_err_rule(dev, "QP doesn't exist\n", rule);
+                ret = -EINVAL;
+                goto out;
+        }
        trans_rule_ctrl_to_hw(rule, mailbox->buf);
        size += sizeof(struct mlx4_net_trans_rule_hw_ctrl);
        list_for_each_entry(cur, &rule->list, list) {
                ret = parse_trans_rule(dev, cur, mailbox->buf + size);
-                if (ret < 0) {
+                if (ret < 0)
-                        mlx4_free_cmd_mailbox(dev, mailbox);
+                        goto out;
-                        return ret;
-                }
                size += ret;
        }
@@ -1021,6 +1027,7 @@ int mlx4_flow_attach(struct mlx4_dev *dev,
                }
        }
+out:
        mlx4_free_cmd_mailbox(dev, mailbox);
        return ret;
diff --git a/drivers/net/ethernet/mellanox/mlx4/qp.c b/drivers/net/ethernet/mellanox/mlx4/qp.c
index 2d6abd4662b1..5a310d313e94 100644
--- a/drivers/net/ethernet/mellanox/mlx4/qp.c
+++ b/drivers/net/ethernet/mellanox/mlx4/qp.c
@@ -384,6 +384,19 @@ static void mlx4_qp_free_icm(struct mlx4_dev *dev, int qpn)
                __mlx4_qp_free_icm(dev, qpn);
 }
+struct mlx4_qp *mlx4_qp_lookup(struct mlx4_dev *dev, u32 qpn)
+{
+        struct mlx4_qp_table *qp_table = &mlx4_priv(dev)->qp_table;
+        struct mlx4_qp *qp;
+        spin_lock(&qp_table->lock);
+        qp = __mlx4_qp_lookup(dev, qpn);
+        spin_unlock(&qp_table->lock);
+        return qp;
+}
 int mlx4_qp_alloc(struct mlx4_dev *dev, int qpn, struct mlx4_qp *qp, gfp_t gfp)
 {
        struct mlx4_priv *priv = mlx4_priv(dev);
@@ -471,6 +484,12 @@ int mlx4_update_qp(struct mlx4_dev *dev, u32 qpn,
        }
        if (attr & MLX4_UPDATE_QP_QOS_VPORT) {
+                if (!(dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_QOS_VPP)) {
+                        mlx4_warn(dev, "Granular QoS per VF is not enabled\n");
+                        err = -EOPNOTSUPP;
+                        goto out;
+                }
                qp_mask |= 1ULL << MLX4_UPD_QP_MASK_QOS_VPP;
                cmd->qp_context.qos_vport = params->qos_vport;
        }
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index 07516545474f..812783865205 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -5255,6 +5255,13 @@ void mlx4_delete_all_resources_for_slave(struct mlx4_dev *dev, int slave)
        mutex_unlock(&priv->mfunc.master.res_tracker.slave_list[slave].mutex);
 }
+static void update_qos_vpp(struct mlx4_update_qp_context *ctx,
+                           struct mlx4_vf_immed_vlan_work *work)
+{
+        ctx->qp_mask |= cpu_to_be64(1ULL << MLX4_UPD_QP_MASK_QOS_VPP);
+        ctx->qp_context.qos_vport = work->qos_vport;
+}
 void mlx4_vf_immed_vlan_work_handler(struct work_struct *_work)
 {
        struct mlx4_vf_immed_vlan_work *work =
@@ -5369,11 +5376,10 @@ void mlx4_vf_immed_vlan_work_handler(struct work_struct *_work)
                                        qp->sched_queue & 0xC7;
                                upd_context->qp_context.pri_path.sched_queue |=
                                        ((work->qos & 0x7) << 3);
-                                upd_context->qp_mask |=
-                                        cpu_to_be64(1ULL <<
+                                if (dev->caps.flags2 &
-                                                    MLX4_UPD_QP_MASK_QOS_VPP);
+                                    MLX4_DEV_CAP_FLAG2_QOS_VPP)
-                                upd_context->qp_context.qos_vport =
+                                        update_qos_vpp(upd_context, work);
-                                        work->qos_vport;
                        }
                        err = mlx4_cmd(dev, mailbox->dma,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index fe5546bb4153..af945edfee19 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -621,10 +621,9 @@ static int mlx5_irq_set_affinity_hint(struct mlx5_core_dev *mdev, int i)
        cpumask_set_cpu(cpumask_local_spread(i, priv->numa_node),
                        priv->irq_info[i].mask);
-#ifdef CONFIG_SMP
+        if (IS_ENABLED(CONFIG_SMP) &&
-        if (irq_set_affinity_hint(irq, priv->irq_info[i].mask))
+            irq_set_affinity_hint(irq, priv->irq_info[i].mask))
                mlx5_core_warn(mdev, "irq_set_affinity_hint failed, irq 0x%.4x", irq);
-#endif
        return 0;
 }
diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c
index 537d1236a4fe..715b3aaf83ac 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
@@ -1730,7 +1730,8 @@ void qed_get_protocol_stats(struct qed_dev *cdev,
                qed_get_protocol_stats_iscsi(cdev, &stats->iscsi_stats);
                break;
        default:
-                DP_ERR(cdev, "Invalid protocol type = %d\n", type);
+                DP_VERBOSE(cdev, QED_MSG_SP,
+                           "Invalid protocol type = %d\n", type);
                return;
        }
 }
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
index 7245b1072518..81312924df14 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
@@ -1824,22 +1824,44 @@ struct qlcnic_hardware_ops {
        u32 (*get_cap_size)(void *, int);
        void (*set_sys_info)(void *, int, u32);
        void (*store_cap_mask)(void *, u32);
+        bool (*encap_rx_offload) (struct qlcnic_adapter *adapter);
+        bool (*encap_tx_offload) (struct qlcnic_adapter *adapter);
 };
 extern struct qlcnic_nic_template qlcnic_vf_ops;
-static inline bool qlcnic_encap_tx_offload(struct qlcnic_adapter *adapter)
+static inline bool qlcnic_83xx_encap_tx_offload(struct qlcnic_adapter *adapter)
 {
        return adapter->ahw->extra_capability[0] &
               QLCNIC_83XX_FW_CAPAB_ENCAP_TX_OFFLOAD;
 }
-static inline bool qlcnic_encap_rx_offload(struct qlcnic_adapter *adapter)
+static inline bool qlcnic_83xx_encap_rx_offload(struct qlcnic_adapter *adapter)
 {
        return adapter->ahw->extra_capability[0] &
               QLCNIC_83XX_FW_CAPAB_ENCAP_RX_OFFLOAD;
 }
+static inline bool qlcnic_82xx_encap_tx_offload(struct qlcnic_adapter *adapter)
+{
+        return false;
+}
+static inline bool qlcnic_82xx_encap_rx_offload(struct qlcnic_adapter *adapter)
+{
+        return false;
+}
+static inline bool qlcnic_encap_rx_offload(struct qlcnic_adapter *adapter)
+{
+        return adapter->ahw->hw_ops->encap_rx_offload(adapter);
+}
+static inline bool qlcnic_encap_tx_offload(struct qlcnic_adapter *adapter)
+{
+        return adapter->ahw->hw_ops->encap_tx_offload(adapter);
+}
 static inline int qlcnic_start_firmware(struct qlcnic_adapter *adapter)
 {
        return adapter->nic_ops->start_firmware(adapter);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
index 4fb68797630e..f7080d0ab874 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
@@ -242,6 +242,8 @@ static struct qlcnic_hardware_ops qlcnic_83xx_hw_ops = {
        .get_cap_size                   = qlcnic_83xx_get_cap_size,
        .set_sys_info                   = qlcnic_83xx_set_sys_info,
        .store_cap_mask                 = qlcnic_83xx_store_cap_mask,
+        .encap_rx_offload               = qlcnic_83xx_encap_rx_offload,
+        .encap_tx_offload               = qlcnic_83xx_encap_tx_offload,
 };
 static struct qlcnic_nic_template qlcnic_83xx_ops = {
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c
index 838cc0ceafd8..7848cf04b29a 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c
@@ -341,7 +341,7 @@ qlcnic_pcie_sem_lock(struct qlcnic_adapter *adapter, int sem, u32 id_reg)
                        }
                        return -EIO;
                }
-                usleep_range(1000, 1500);
+                udelay(1200);
        }
        if (id_reg)
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index b6628aaa6e4a..1b5f7d57b6f8 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -632,6 +632,8 @@ static struct qlcnic_hardware_ops qlcnic_hw_ops = {
        .get_cap_size                   = qlcnic_82xx_get_cap_size,
        .set_sys_info                   = qlcnic_82xx_set_sys_info,
        .store_cap_mask                 = qlcnic_82xx_store_cap_mask,
+        .encap_rx_offload               = qlcnic_82xx_encap_rx_offload,
+        .encap_tx_offload               = qlcnic_82xx_encap_tx_offload,
 };
 static int qlcnic_check_multi_tx_capability(struct qlcnic_adapter *adapter)
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
index 2f656f395f39..c58180f40844 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
@@ -77,6 +77,8 @@ static struct qlcnic_hardware_ops qlcnic_sriov_vf_hw_ops = {
        .free_mac_list                  = qlcnic_sriov_vf_free_mac_list,
        .enable_sds_intr                = qlcnic_83xx_enable_sds_intr,
        .disable_sds_intr               = qlcnic_83xx_disable_sds_intr,
+        .encap_rx_offload               = qlcnic_83xx_encap_rx_offload,
+        .encap_tx_offload               = qlcnic_83xx_encap_tx_offload,
 };
 static struct qlcnic_nic_template qlcnic_sriov_vf_ops = {
diff --git a/drivers/net/ethernet/qualcomm/emac/emac-mac.c b/drivers/net/ethernet/qualcomm/emac/emac-mac.c
index cc065ffbe4b5..bcd4708b3745 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac-mac.c
+++ b/drivers/net/ethernet/qualcomm/emac/emac-mac.c
@@ -931,7 +931,7 @@ int emac_mac_up(struct emac_adapter *adpt)
        emac_mac_config(adpt);
        emac_mac_rx_descs_refill(adpt, &adpt->rx_q);
-        adpt->phydev->irq = PHY_IGNORE_INTERRUPT;
+        adpt->phydev->irq = PHY_POLL;
        ret = phy_connect_direct(netdev, adpt->phydev, emac_adjust_link,
                                 PHY_INTERFACE_MODE_SGMII);
        if (ret) {
diff --git a/drivers/net/ethernet/qualcomm/emac/emac-phy.c b/drivers/net/ethernet/qualcomm/emac/emac-phy.c
index 441c19366489..18461fcb9815 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac-phy.c
+++ b/drivers/net/ethernet/qualcomm/emac/emac-phy.c
@@ -13,15 +13,11 @@
 /* Qualcomm Technologies, Inc. EMAC PHY Controller driver.
 */
-#include <linux/module.h>
-#include <linux/of.h>
-#include <linux/of_net.h>
 #include <linux/of_mdio.h>
 #include <linux/phy.h>
 #include <linux/iopoll.h>
 #include <linux/acpi.h>
 #include "emac.h"
-#include "emac-mac.h"
 /* EMAC base register offsets */
 #define EMAC_MDIO_CTRL                                        0x001414
@@ -52,62 +48,10 @@
 #define MDIO_WAIT_TIMES                                           1000
-#define EMAC_LINK_SPEED_DEFAULT (\
-                EMAC_LINK_SPEED_10_HALF  |\
-                EMAC_LINK_SPEED_10_FULL  |\
-                EMAC_LINK_SPEED_100_HALF |\
-                EMAC_LINK_SPEED_100_FULL |\
-                EMAC_LINK_SPEED_1GB_FULL)
-/**
- * emac_phy_mdio_autopoll_disable() - disable mdio autopoll
- * @adpt: the emac adapter
- *
- * The autopoll feature takes over the MDIO bus.  In order for
- * the PHY driver to be able to talk to the PHY over the MDIO
- * bus, we need to temporarily disable the autopoll feature.
- */
-static int emac_phy_mdio_autopoll_disable(struct emac_adapter *adpt)
-{
-        u32 val;
-        /* disable autopoll */
-        emac_reg_update32(adpt->base + EMAC_MDIO_CTRL, MDIO_AP_EN, 0);
-        /* wait for any mdio polling to complete */
-        if (!readl_poll_timeout(adpt->base + EMAC_MDIO_CTRL, val,
-                                !(val & MDIO_BUSY), 100, MDIO_WAIT_TIMES * 100))
-                return 0;
-        /* failed to disable; ensure it is enabled before returning */
-        emac_reg_update32(adpt->base + EMAC_MDIO_CTRL, 0, MDIO_AP_EN);
-        return -EBUSY;
-}
-/**
- * emac_phy_mdio_autopoll_disable() - disable mdio autopoll
- * @adpt: the emac adapter
- *
- * The EMAC has the ability to poll the external PHY on the MDIO
- * bus for link state changes.  This eliminates the need for the
- * driver to poll the phy.  If if the link state does change,
- * the EMAC issues an interrupt on behalf of the PHY.
- */
-static void emac_phy_mdio_autopoll_enable(struct emac_adapter *adpt)
-{
-        emac_reg_update32(adpt->base + EMAC_MDIO_CTRL, 0, MDIO_AP_EN);
-}
 static int emac_mdio_read(struct mii_bus *bus, int addr, int regnum)
 {
        struct emac_adapter *adpt = bus->priv;
        u32 reg;
-        int ret;
-        ret = emac_phy_mdio_autopoll_disable(adpt);
-        if (ret)
-                return ret;
        emac_reg_update32(adpt->base + EMAC_PHY_STS, PHY_ADDR_BMSK,
                          (addr << PHY_ADDR_SHFT));
@@ -122,24 +66,15 @@ static int emac_mdio_read(struct mii_bus *bus, int addr, int regnum)
        if (readl_poll_timeout(adpt->base + EMAC_MDIO_CTRL, reg,
                               !(reg & (MDIO_START | MDIO_BUSY)),
                               100, MDIO_WAIT_TIMES * 100))
-                ret = -EIO;
+                return -EIO;
-        else
-                ret = (reg >> MDIO_DATA_SHFT) & MDIO_DATA_BMSK;
-        emac_phy_mdio_autopoll_enable(adpt);
+        return (reg >> MDIO_DATA_SHFT) & MDIO_DATA_BMSK;
-        return ret;
 }
 static int emac_mdio_write(struct mii_bus *bus, int addr, int regnum, u16 val)
 {
        struct emac_adapter *adpt = bus->priv;
        u32 reg;
-        int ret;
-        ret = emac_phy_mdio_autopoll_disable(adpt);
-        if (ret)
-                return ret;
        emac_reg_update32(adpt->base + EMAC_PHY_STS, PHY_ADDR_BMSK,
                          (addr << PHY_ADDR_SHFT));
@@ -155,11 +90,9 @@ static int emac_mdio_write(struct mii_bus *bus, int addr, int regnum, u16 val)
        if (readl_poll_timeout(adpt->base + EMAC_MDIO_CTRL, reg,
                               !(reg & (MDIO_START | MDIO_BUSY)), 100,
                               MDIO_WAIT_TIMES * 100))
-                ret = -EIO;
+                return -EIO;
-        emac_phy_mdio_autopoll_enable(adpt);
+        return 0;
-        return ret;
 }
 /* Configure the MDIO bus and connect the external PHY */
diff --git a/drivers/net/ethernet/qualcomm/emac/emac.c b/drivers/net/ethernet/qualcomm/emac/emac.c
index 28a8cdc36485..98a326faea29 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac.c
+++ b/drivers/net/ethernet/qualcomm/emac/emac.c
@@ -50,19 +50,7 @@
 #define DMAR_DLY_CNT_DEF                                    15
 #define DMAW_DLY_CNT_DEF                                     4
-#define IMR_NORMAL_MASK         (\
+#define IMR_NORMAL_MASK         (ISR_ERROR | ISR_OVER | ISR_TX_PKT)
-                ISR_ERROR       |\
-                ISR_GPHY_LINK   |\
-                ISR_TX_PKT      |\
-                GPHY_WAKEUP_INT)
-#define IMR_EXTENDED_MASK       (\
-                SW_MAN_INT      |\
-                ISR_OVER        |\
-                ISR_ERROR       |\
-                ISR_GPHY_LINK   |\
-                ISR_TX_PKT      |\
-                GPHY_WAKEUP_INT)
 #define ISR_TX_PKT      (\
        TX_PKT_INT      |\
@@ -70,10 +58,6 @@
        TX_PKT_INT2     |\
        TX_PKT_INT3)
-#define ISR_GPHY_LINK        (\
-        GPHY_LINK_UP_INT     |\
-        GPHY_LINK_DOWN_INT)
 #define ISR_OVER        (\
        RFD0_UR_INT     |\
        RFD1_UR_INT     |\
@@ -187,10 +171,6 @@ irqreturn_t emac_isr(int _irq, void *data)
        if (status & ISR_OVER)
                net_warn_ratelimited("warning: TX/RX overflow\n");
-        /* link event */
-        if (status & ISR_GPHY_LINK)
-                phy_mac_interrupt(adpt->phydev, !!(status & GPHY_LINK_UP_INT));
 exit:
        /* enable the interrupt */
        writel(irq->mask, adpt->base + EMAC_INT_MASK);
diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index 3cd7989c007d..784782da3a85 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -230,18 +230,6 @@ static void ravb_ring_free(struct net_device *ndev, int q)
        int ring_size;
        int i;
-        /* Free RX skb ringbuffer */
-        if (priv->rx_skb[q]) {
-                for (i = 0; i < priv->num_rx_ring[q]; i++)
-                        dev_kfree_skb(priv->rx_skb[q][i]);
-        }
-        kfree(priv->rx_skb[q]);
-        priv->rx_skb[q] = NULL;
-        /* Free aligned TX buffers */
-        kfree(priv->tx_align[q]);
-        priv->tx_align[q] = NULL;
        if (priv->rx_ring[q]) {
                for (i = 0; i < priv->num_rx_ring[q]; i++) {
                        struct ravb_ex_rx_desc *desc = &priv->rx_ring[q][i];
@@ -270,6 +258,18 @@ static void ravb_ring_free(struct net_device *ndev, int q)
                priv->tx_ring[q] = NULL;
        }
+        /* Free RX skb ringbuffer */
+        if (priv->rx_skb[q]) {
+                for (i = 0; i < priv->num_rx_ring[q]; i++)
+                        dev_kfree_skb(priv->rx_skb[q][i]);
+        }
+        kfree(priv->rx_skb[q]);
+        priv->rx_skb[q] = NULL;
+        /* Free aligned TX buffers */
+        kfree(priv->tx_align[q]);
+        priv->tx_align[q] = NULL;
        /* Free TX skb ringbuffer.
         * SKBs are freed by ravb_tx_free() call above.
         */
diff --git a/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c b/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c
index 489ef146201e..6a9c954492f2 100644
--- a/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c
+++ b/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c
@@ -37,6 +37,7 @@
 #define TSE_PCS_CONTROL_AN_EN_MASK                      BIT(12)
 #define TSE_PCS_CONTROL_REG                             0x00
 #define TSE_PCS_CONTROL_RESTART_AN_MASK                 BIT(9)
+#define TSE_PCS_CTRL_AUTONEG_SGMII                      0x1140
 #define TSE_PCS_IF_MODE_REG                             0x28
 #define TSE_PCS_LINK_TIMER_0_REG                        0x24
 #define TSE_PCS_LINK_TIMER_1_REG                        0x26
@@ -65,6 +66,7 @@
 #define TSE_PCS_SW_RESET_TIMEOUT                        100
 #define TSE_PCS_USE_SGMII_AN_MASK                       BIT(1)
 #define TSE_PCS_USE_SGMII_ENA                           BIT(0)
+#define TSE_PCS_IF_USE_SGMII                            0x03
 #define SGMII_ADAPTER_CTRL_REG                          0x00
 #define SGMII_ADAPTER_DISABLE                           0x0001
@@ -101,7 +103,9 @@ int tse_pcs_init(void __iomem *base, struct tse_pcs *pcs)
 {
        int ret = 0;
-        writew(TSE_PCS_USE_SGMII_ENA, base + TSE_PCS_IF_MODE_REG);
+        writew(TSE_PCS_IF_USE_SGMII, base + TSE_PCS_IF_MODE_REG);
+        writew(TSE_PCS_CTRL_AUTONEG_SGMII, base + TSE_PCS_CONTROL_REG);
        writew(TSE_PCS_SGMII_LINK_TIMER_0, base + TSE_PCS_LINK_TIMER_0_REG);
        writew(TSE_PCS_SGMII_LINK_TIMER_1, base + TSE_PCS_LINK_TIMER_1_REG);
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index a74c481401c4..12236daf7bb6 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -1208,7 +1208,7 @@ static int init_dma_rx_desc_rings(struct net_device *dev, gfp_t flags)
        u32 rx_count = priv->plat->rx_queues_to_use;
        unsigned int bfsize = 0;
        int ret = -ENOMEM;
-        u32 queue;
+        int queue;
        int i;
        if (priv->hw->mode->set_16kib_bfsize)
@@ -2724,7 +2724,7 @@ static void stmmac_tso_allocator(struct stmmac_priv *priv, unsigned int des,
                priv->hw->desc->prepare_tso_tx_desc(desc, 0, buff_size,
                        0, 1,
-                        (last_segment) && (buff_size < TSO_MAX_BUFF_SIZE),
+                        (last_segment) && (tmp_len <= TSO_MAX_BUFF_SIZE),
                        0, 0);
                tmp_len -= TSO_MAX_BUFF_SIZE;
@@ -2947,7 +2947,8 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
        int i, csum_insertion = 0, is_jumbo = 0;
        u32 queue = skb_get_queue_mapping(skb);
        int nfrags = skb_shinfo(skb)->nr_frags;
-        unsigned int entry, first_entry;
+        int entry;
+        unsigned int first_entry;
        struct dma_desc *desc, *first;
        struct stmmac_tx_queue *tx_q;
        unsigned int enh_desc;
diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
index 959fd12d2e67..6ebb0f559a42 100644
--- a/drivers/net/geneve.c
+++ b/drivers/net/geneve.c
@@ -1133,7 +1133,7 @@ static int geneve_configure(struct net *net, struct net_device *dev,
        /* make enough headroom for basic scenario */
        encap_len = GENEVE_BASE_HLEN + ETH_HLEN;
-        if (ip_tunnel_info_af(info) == AF_INET) {
+        if (!metadata && ip_tunnel_info_af(info) == AF_INET) {
                encap_len += sizeof(struct iphdr);
                dev->max_mtu -= sizeof(struct iphdr);
        } else {
diff --git a/drivers/net/hamradio/hdlcdrv.c b/drivers/net/hamradio/hdlcdrv.c
index 8c3633c1d078..97e3bc60c3e7 100644
--- a/drivers/net/hamradio/hdlcdrv.c
+++ b/drivers/net/hamradio/hdlcdrv.c
@@ -576,6 +576,8 @@ static int hdlcdrv_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
        case HDLCDRVCTL_CALIBRATE:
                if(!capable(CAP_SYS_RAWIO))
                        return -EPERM;
+                if (s->par.bitrate <= 0)
+                        return -EINVAL;
                if (bi.data.calibrate > INT_MAX / s->par.bitrate)
                        return -EINVAL;
                s->hdlctx.calibrate = bi.data.calibrate * s->par.bitrate / 16;
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index 9097e42bec2e..57297ba23987 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -1127,8 +1127,6 @@ static int marvell_read_status_page(struct phy_device *phydev, int page)
                if (adv < 0)
                        return adv;
-                lpa &= adv;
                if (status & MII_M1011_PHY_STATUS_FULLDUPLEX)
                        phydev->duplex = DUPLEX_FULL;
                else
diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index 8e73f5f36e71..f99c21f78b63 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -658,6 +658,18 @@ static int mdio_bus_match(struct device *dev, struct device_driver *drv)
        return 0;
 }
+static int mdio_uevent(struct device *dev, struct kobj_uevent_env *env)
+{
+        int rc;
+        /* Some devices have extra OF data and an OF-style MODALIAS */
+        rc = of_device_uevent_modalias(dev, env);
+        if (rc != -ENODEV)
+                return rc;
+        return 0;
+}
 #ifdef CONFIG_PM
 static int mdio_bus_suspend(struct device *dev)
 {
@@ -708,6 +720,7 @@ static const struct dev_pm_ops mdio_bus_pm_ops = {
 struct bus_type mdio_bus_type = {
        .name           = "mdio_bus",
        .match          = mdio_bus_match,
+        .uevent         = mdio_uevent,
        .pm             = MDIO_BUS_PM_OPS,
 };
 EXPORT_SYMBOL(mdio_bus_type);
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index 6a5fd18f062c..b9252b8d81ff 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -268,23 +268,12 @@ out:
        return ret;
 }
-static int kszphy_config_init(struct phy_device *phydev)
+/* Some config bits need to be set again on resume, handle them here. */
+static int kszphy_config_reset(struct phy_device *phydev)
 {
        struct kszphy_priv *priv = phydev->priv;
-        const struct kszphy_type *type;
        int ret;
-        if (!priv)
-                return 0;
-        type = priv->type;
-        if (type->has_broadcast_disable)
-                kszphy_broadcast_disable(phydev);
-        if (type->has_nand_tree_disable)
-                kszphy_nand_tree_disable(phydev);
        if (priv->rmii_ref_clk_sel) {
                ret = kszphy_rmii_clk_sel(phydev, priv->rmii_ref_clk_sel_val);
                if (ret) {
@@ -295,11 +284,30 @@ static int kszphy_config_init(struct phy_device *phydev)
        }
        if (priv->led_mode >= 0)
-                kszphy_setup_led(phydev, type->led_mode_reg, priv->led_mode);
+                kszphy_setup_led(phydev, priv->type->led_mode_reg, priv->led_mode);
        return 0;
 }
+static int kszphy_config_init(struct phy_device *phydev)
+{
+        struct kszphy_priv *priv = phydev->priv;
+        const struct kszphy_type *type;
+        if (!priv)
+                return 0;
+        type = priv->type;
+        if (type->has_broadcast_disable)
+                kszphy_broadcast_disable(phydev);
+        if (type->has_nand_tree_disable)
+                kszphy_nand_tree_disable(phydev);
+        return kszphy_config_reset(phydev);
+}
 static int ksz8041_config_init(struct phy_device *phydev)
 {
        struct device_node *of_node = phydev->mdio.dev.of_node;
@@ -700,8 +708,14 @@ static int kszphy_suspend(struct phy_device *phydev)
 static int kszphy_resume(struct phy_device *phydev)
 {
+        int ret;
        genphy_resume(phydev);
+        ret = kszphy_config_reset(phydev);
+        if (ret)
+                return ret;
        /* Enable PHY Interrupts */
        if (phy_interrupt_is_valid(phydev)) {
                phydev->interrupts = PHY_INTERRUPT_ENABLED;
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 82ab8fb82587..7524caa0f29d 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -241,7 +241,7 @@ static const struct phy_setting settings[] = {
 * phy_lookup_setting - lookup a PHY setting
 * @speed: speed to match
 * @duplex: duplex to match
- * @feature: allowed link modes
+ * @features: allowed link modes
 * @exact: an exact match is required
 *
 * Search the settings array for a setting that matches the speed and
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 3e9246cc49c3..a871f45ecc79 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -869,7 +869,7 @@ static unsigned int get_mergeable_buf_len(struct receive_queue *rq,
        unsigned int len;
        len = hdr_len + clamp_t(unsigned int, ewma_pkt_len_read(avg_pkt_len),
-                                rq->min_buf_len - hdr_len, PAGE_SIZE - hdr_len);
+                                rq->min_buf_len, PAGE_SIZE - hdr_len);
        return ALIGN(len, L1_CACHE_BYTES);
 }
@@ -2144,7 +2144,8 @@ static unsigned int mergeable_min_buf_len(struct virtnet_info *vi, struct virtqu
        unsigned int buf_len = hdr_len + ETH_HLEN + VLAN_HLEN + packet_len;
        unsigned int min_buf_len = DIV_ROUND_UP(buf_len, rq_size);
-        return max(min_buf_len, hdr_len);
+        return max(max(min_buf_len, hdr_len) - hdr_len,
+                   (unsigned int)GOOD_PACKET_LEN);
 }
 static int virtnet_find_vqs(struct virtnet_info *vi)
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 328b4712683c..a6b5052c1d36 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -59,6 +59,8 @@ static const u8 all_zeros_mac[ETH_ALEN + 2];
 static int vxlan_sock_add(struct vxlan_dev *vxlan);
+static void vxlan_vs_del_dev(struct vxlan_dev *vxlan);
 /* per-network namespace private data for this module */
 struct vxlan_net {
        struct list_head  vxlan_list;
@@ -740,6 +742,22 @@ static void vxlan_fdb_destroy(struct vxlan_dev *vxlan, struct vxlan_fdb *f)
        call_rcu(&f->rcu, vxlan_fdb_free);
 }
+static void vxlan_dst_free(struct rcu_head *head)
+{
+        struct vxlan_rdst *rd = container_of(head, struct vxlan_rdst, rcu);
+        dst_cache_destroy(&rd->dst_cache);
+        kfree(rd);
+}
+static void vxlan_fdb_dst_destroy(struct vxlan_dev *vxlan, struct vxlan_fdb *f,
+                                  struct vxlan_rdst *rd)
+{
+        list_del_rcu(&rd->list);
+        vxlan_fdb_notify(vxlan, f, rd, RTM_DELNEIGH);
+        call_rcu(&rd->rcu, vxlan_dst_free);
+}
 static int vxlan_fdb_parse(struct nlattr *tb[], struct vxlan_dev *vxlan,
                           union vxlan_addr *ip, __be16 *port, __be32 *src_vni,
                           __be32 *vni, u32 *ifindex)
@@ -864,9 +882,7 @@ static int __vxlan_fdb_delete(struct vxlan_dev *vxlan,
         * otherwise destroy the fdb entry
         */
        if (rd && !list_is_singular(&f->remotes)) {
-                list_del_rcu(&rd->list);
+                vxlan_fdb_dst_destroy(vxlan, f, rd);
-                vxlan_fdb_notify(vxlan, f, rd, RTM_DELNEIGH);
-                kfree_rcu(rd, rcu);
                goto out;
        }
@@ -1067,6 +1083,8 @@ static void vxlan_sock_release(struct vxlan_dev *vxlan)
        rcu_assign_pointer(vxlan->vn4_sock, NULL);
        synchronize_net();
+        vxlan_vs_del_dev(vxlan);
        if (__vxlan_sock_release_prep(sock4)) {
                udp_tunnel_sock_release(sock4->sock);
                kfree(sock4);
@@ -2342,6 +2360,15 @@ static void vxlan_cleanup(unsigned long arg)
        mod_timer(&vxlan->age_timer, next_timer);
 }
+static void vxlan_vs_del_dev(struct vxlan_dev *vxlan)
+{
+        struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id);
+        spin_lock(&vn->sock_lock);
+        hlist_del_init_rcu(&vxlan->hlist);
+        spin_unlock(&vn->sock_lock);
+}
 static void vxlan_vs_add_dev(struct vxlan_sock *vs, struct vxlan_dev *vxlan)
 {
        struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id);
@@ -3286,15 +3313,9 @@ static int vxlan_changelink(struct net_device *dev, struct nlattr *tb[],
 static void vxlan_dellink(struct net_device *dev, struct list_head *head)
 {
        struct vxlan_dev *vxlan = netdev_priv(dev);
-        struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id);
        vxlan_flush(vxlan, true);
-        spin_lock(&vn->sock_lock);
-        if (!hlist_unhashed(&vxlan->hlist))
-                hlist_del_rcu(&vxlan->hlist);
-        spin_unlock(&vn->sock_lock);
        gro_cells_destroy(&vxlan->gro_cells);
        list_del(&vxlan->next);
        unregister_netdevice_queue(dev, head);
diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c
index d5e993dc9b23..517a315e259b 100644
--- a/drivers/net/wireless/ath/wcn36xx/main.c
+++ b/drivers/net/wireless/ath/wcn36xx/main.c
@@ -1271,6 +1271,8 @@ static int wcn36xx_remove(struct platform_device *pdev)
        qcom_smem_state_put(wcn->tx_enable_state);
        qcom_smem_state_put(wcn->tx_rings_empty_state);
+        rpmsg_destroy_ept(wcn->smd_channel);
        iounmap(wcn->dxe_base);
        iounmap(wcn->ccu_base);
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
index fc64b8913aa6..e03450059b06 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
@@ -3422,7 +3422,7 @@ static int brcmf_sdio_bus_preinit(struct device *dev)
                /* otherwise, set txglomalign */
                value = sdiodev->settings->bus.sdio.sd_sgentry_align;
                /* SDIO ADMA requires at least 32 bit alignment */
-                value = max_t(u32, value, 4);
+                value = max_t(u32, value, ALIGNMENT);
                err = brcmf_iovar_data_set(dev, "bus:txglomalign", &value,
                                           sizeof(u32));
        }
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-7000.c b/drivers/net/wireless/intel/iwlwifi/iwl-7000.c
index 3b3e076571d6..45e2efc70d19 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-7000.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-7000.c
@@ -79,8 +79,8 @@
 /* Lowest firmware API version supported */
 #define IWL7260_UCODE_API_MIN   17
 #define IWL7265_UCODE_API_MIN   17
-#define IWL7265D_UCODE_API_MIN  17
+#define IWL7265D_UCODE_API_MIN  22
-#define IWL3168_UCODE_API_MIN   20
+#define IWL3168_UCODE_API_MIN   22
 /* NVM versions */
 #define IWL7260_NVM_VERSION             0x0a1d
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-8000.c b/drivers/net/wireless/intel/iwlwifi/iwl-8000.c
index b9718c0cf174..89137717c1fc 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-8000.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-8000.c
@@ -74,8 +74,8 @@
 #define IWL8265_UCODE_API_MAX   30
 /* Lowest firmware API version supported */
-#define IWL8000_UCODE_API_MIN   17
+#define IWL8000_UCODE_API_MIN   22
-#define IWL8265_UCODE_API_MIN   20
+#define IWL8265_UCODE_API_MIN   22
 /* NVM versions */
 #define IWL8000_NVM_VERSION             0x0a1d
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-prph.h b/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
index 306bc967742e..77efbb78e867 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
@@ -370,6 +370,7 @@
 #define MON_DMARB_RD_DATA_ADDR          (0xa03c5c)
 #define DBGC_IN_SAMPLE                  (0xa03c00)
+#define DBGC_OUT_CTRL                   (0xa03c0c)
 /* enable the ID buf for read */
 #define WFPM_PS_CTL_CLR                 0xA0300C
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw-api-rs.h b/drivers/net/wireless/intel/iwlwifi/mvm/fw-api-rs.h
index 1b7d265ffb0a..a10c6aae9ab9 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw-api-rs.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw-api-rs.h
@@ -307,6 +307,11 @@ enum {
 /* Bit 1-3: LQ command color. Used to match responses to LQ commands */
 #define LQ_FLAG_COLOR_POS               1
 #define LQ_FLAG_COLOR_MSK               (7 << LQ_FLAG_COLOR_POS)
+#define LQ_FLAG_COLOR_GET(_f)           (((_f) & LQ_FLAG_COLOR_MSK) >>\
+                                         LQ_FLAG_COLOR_POS)
+#define LQ_FLAGS_COLOR_INC(_c)          ((((_c) + 1) << LQ_FLAG_COLOR_POS) &\
+                                         LQ_FLAG_COLOR_MSK)
+#define LQ_FLAG_COLOR_SET(_f, _c)       ((_c) | ((_f) & ~LQ_FLAG_COLOR_MSK))
 /* Bit 4-5: Tx RTS BW Signalling
 * (0) No RTS BW signalling
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw-api-tx.h b/drivers/net/wireless/intel/iwlwifi/mvm/fw-api-tx.h
index 81b98915b1a4..1360ebfdc51b 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw-api-tx.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw-api-tx.h
@@ -519,8 +519,11 @@ struct agg_tx_status {
 * bit-7 invalid rate indication
 */
 #define TX_RES_INIT_RATE_INDEX_MSK 0x0f
+#define TX_RES_RATE_TABLE_COLOR_POS 4
 #define TX_RES_RATE_TABLE_COLOR_MSK 0x70
 #define TX_RES_INV_RATE_INDEX_MSK 0x80
+#define TX_RES_RATE_TABLE_COL_GET(_f) (((_f) & TX_RES_RATE_TABLE_COLOR_MSK) >>\
+                                       TX_RES_RATE_TABLE_COLOR_POS)
 #define IWL_MVM_TX_RES_GET_TID(_ra_tid) ((_ra_tid) & 0x0f)
 #define IWL_MVM_TX_RES_GET_RA(_ra_tid) ((_ra_tid) >> 4)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c
index 7b86a4f1b574..c8712e6eea74 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c
@@ -1002,14 +1002,6 @@ int iwl_mvm_fw_dbg_collect_trig(struct iwl_mvm *mvm,
        return 0;
 }
-static inline void iwl_mvm_restart_early_start(struct iwl_mvm *mvm)
-{
-        if (mvm->cfg->device_family == IWL_DEVICE_FAMILY_7000)
-                iwl_clear_bits_prph(mvm->trans, MON_BUFF_SAMPLE_CTL, 0x100);
-        else
-                iwl_write_prph(mvm->trans, DBGC_IN_SAMPLE, 1);
-}
 int iwl_mvm_start_fw_dbg_conf(struct iwl_mvm *mvm, u8 conf_id)
 {
        u8 *ptr;
@@ -1023,10 +1015,8 @@ int iwl_mvm_start_fw_dbg_conf(struct iwl_mvm *mvm, u8 conf_id)
        /* EARLY START - firmware's configuration is hard coded */
        if ((!mvm->fw->dbg_conf_tlv[conf_id] ||
             !mvm->fw->dbg_conf_tlv[conf_id]->num_of_hcmds) &&
-            conf_id == FW_DBG_START_FROM_ALIVE) {
+            conf_id == FW_DBG_START_FROM_ALIVE)
-                iwl_mvm_restart_early_start(mvm);
                return 0;
-        }
        if (!mvm->fw->dbg_conf_tlv[conf_id])
                return -EINVAL;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
index 0f1831b41915..fd2fc46e2fe5 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
@@ -1040,7 +1040,7 @@ static int iwl_mvm_mac_ctxt_send_beacon(struct iwl_mvm *mvm,
                struct iwl_mac_beacon_cmd_v6 beacon_cmd_v6;
                struct iwl_mac_beacon_cmd_v7 beacon_cmd;
        } u = {};
-        struct iwl_mac_beacon_cmd beacon_cmd;
+        struct iwl_mac_beacon_cmd beacon_cmd = {};
        struct ieee80211_tx_info *info;
        u32 beacon_skb_len;
        u32 rate, tx_flags;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
index 4e74a6b90e70..52f8d7a6a7dc 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
@@ -1730,8 +1730,11 @@ int iwl_mvm_find_free_queue(struct iwl_mvm *mvm, u8 sta_id, u8 minq, u8 maxq);
 */
 static inline u32 iwl_mvm_flushable_queues(struct iwl_mvm *mvm)
 {
+        u32 cmd_queue = iwl_mvm_is_dqa_supported(mvm) ? IWL_MVM_DQA_CMD_QUEUE :
+                IWL_MVM_CMD_QUEUE;
        return ((BIT(mvm->cfg->base_params->num_of_queues) - 1) &
-                ~BIT(IWL_MVM_CMD_QUEUE));
+                ~BIT(cmd_queue));
 }
 static inline
@@ -1753,6 +1756,7 @@ static inline void iwl_mvm_stop_device(struct iwl_mvm *mvm)
        if (!iwl_mvm_has_new_tx_api(mvm))
                iwl_free_fw_paging(mvm);
        mvm->ucode_loaded = false;
+        mvm->fw_dbg_conf = FW_DBG_INVALID;
        iwl_trans_stop_device(mvm->trans);
 }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
index 9ffff6ed8133..3da5ec40aaea 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
@@ -1149,21 +1149,37 @@ static void iwl_mvm_fw_error_dump_wk(struct work_struct *work)
        mutex_lock(&mvm->mutex);
-        /* stop recording */
        if (mvm->cfg->device_family == IWL_DEVICE_FAMILY_7000) {
+                /* stop recording */
                iwl_set_bits_prph(mvm->trans, MON_BUFF_SAMPLE_CTL, 0x100);
+                iwl_mvm_fw_error_dump(mvm);
+                /* start recording again if the firmware is not crashed */
+                if (!test_bit(STATUS_FW_ERROR, &mvm->trans->status) &&
+                    mvm->fw->dbg_dest_tlv)
+                        iwl_clear_bits_prph(mvm->trans,
+                                            MON_BUFF_SAMPLE_CTL, 0x100);
        } else {
+                u32 in_sample = iwl_read_prph(mvm->trans, DBGC_IN_SAMPLE);
+                u32 out_ctrl = iwl_read_prph(mvm->trans, DBGC_OUT_CTRL);
+                /* stop recording */
                iwl_write_prph(mvm->trans, DBGC_IN_SAMPLE, 0);
-                /* wait before we collect the data till the DBGC stop */
                udelay(100);
-        }
+                iwl_write_prph(mvm->trans, DBGC_OUT_CTRL, 0);
+                /* wait before we collect the data till the DBGC stop */
+                udelay(500);
-        iwl_mvm_fw_error_dump(mvm);
+                iwl_mvm_fw_error_dump(mvm);
-        /* start recording again if the firmware is not crashed */
+                /* start recording again if the firmware is not crashed */
-        WARN_ON_ONCE((!test_bit(STATUS_FW_ERROR, &mvm->trans->status)) &&
+                if (!test_bit(STATUS_FW_ERROR, &mvm->trans->status) &&
-                     mvm->fw->dbg_dest_tlv &&
+                    mvm->fw->dbg_dest_tlv) {
-                     iwl_mvm_start_fw_dbg_conf(mvm, mvm->fw_dbg_conf));
+                        iwl_write_prph(mvm->trans, DBGC_IN_SAMPLE, in_sample);
+                        iwl_write_prph(mvm->trans, DBGC_OUT_CTRL, out_ctrl);
+                }
+        }
        mutex_unlock(&mvm->mutex);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
index 7788eefcd2bd..aa785cf3cf68 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
@@ -2,7 +2,7 @@
 *
 * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
- * Copyright(c) 2016 Intel Deutschland GmbH
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of version 2 of the GNU General Public License as
@@ -1083,34 +1083,6 @@ static void rs_get_lower_rate_down_column(struct iwl_lq_sta *lq_sta,
                rs_get_lower_rate_in_column(lq_sta, rate);
 }
-/* Check if both rates are identical
- * allow_ant_mismatch enables matching a SISO rate on ANT_A or ANT_B
- * with a rate indicating STBC/BFER and ANT_AB.
- */
-static inline bool rs_rate_equal(struct rs_rate *a,
-                                 struct rs_rate *b,
-                                 bool allow_ant_mismatch)
-{
-        bool ant_match = (a->ant == b->ant) && (a->stbc == b->stbc) &&
-                (a->bfer == b->bfer);
-        if (allow_ant_mismatch) {
-                if (a->stbc || a->bfer) {
-                        WARN_ONCE(a->ant != ANT_AB, "stbc %d bfer %d ant %d",
-                                  a->stbc, a->bfer, a->ant);
-                        ant_match |= (b->ant == ANT_A || b->ant == ANT_B);
-                } else if (b->stbc || b->bfer) {
-                        WARN_ONCE(b->ant != ANT_AB, "stbc %d bfer %d ant %d",
-                                  b->stbc, b->bfer, b->ant);
-                        ant_match |= (a->ant == ANT_A || a->ant == ANT_B);
-                }
-        }
-        return (a->type == b->type) && (a->bw == b->bw) && (a->sgi == b->sgi) &&
-                (a->ldpc == b->ldpc) && (a->index == b->index) && ant_match;
-}
 /* Check if both rates share the same column */
 static inline bool rs_rate_column_match(struct rs_rate *a,
                                        struct rs_rate *b)
@@ -1182,12 +1154,12 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
        u32 lq_hwrate;
        struct rs_rate lq_rate, tx_resp_rate;
        struct iwl_scale_tbl_info *curr_tbl, *other_tbl, *tmp_tbl;
-        u8 reduced_txp = (uintptr_t)info->status.status_driver_data[0];
+        u32 tlc_info = (uintptr_t)info->status.status_driver_data[0];
+        u8 reduced_txp = tlc_info & RS_DRV_DATA_TXP_MSK;
+        u8 lq_color = RS_DRV_DATA_LQ_COLOR_GET(tlc_info);
        u32 tx_resp_hwrate = (uintptr_t)info->status.status_driver_data[1];
        struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
        struct iwl_lq_sta *lq_sta = &mvmsta->lq_sta;
-        bool allow_ant_mismatch = fw_has_api(&mvm->fw->ucode_capa,
-                                             IWL_UCODE_TLV_API_LQ_SS_PARAMS);
        /* Treat uninitialized rate scaling data same as non-existing. */
        if (!lq_sta) {
@@ -1262,10 +1234,10 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
        rs_rate_from_ucode_rate(lq_hwrate, info->band, &lq_rate);
        /* Here we actually compare this rate to the latest LQ command */
-        if (!rs_rate_equal(&tx_resp_rate, &lq_rate, allow_ant_mismatch)) {
+        if (lq_color != LQ_FLAG_COLOR_GET(table->flags)) {
                IWL_DEBUG_RATE(mvm,
-                               "initial tx resp rate 0x%x does not match 0x%x\n",
+                               "tx resp color 0x%x does not match 0x%x\n",
-                               tx_resp_hwrate, lq_hwrate);
+                               lq_color, LQ_FLAG_COLOR_GET(table->flags));
                /*
                 * Since rates mis-match, the last LQ command may have failed.
@@ -3326,6 +3298,7 @@ static void rs_build_rates_table(struct iwl_mvm *mvm,
        u8 valid_tx_ant = 0;
        struct iwl_lq_cmd *lq_cmd = &lq_sta->lq;
        bool toggle_ant = false;
+        u32 color;
        memcpy(&rate, initial_rate, sizeof(rate));
@@ -3380,6 +3353,9 @@ static void rs_build_rates_table(struct iwl_mvm *mvm,
                                 num_rates, num_retries, valid_tx_ant,
                                 toggle_ant);
+        /* update the color of the LQ command (as a counter at bits 1-3) */
+        color = LQ_FLAGS_COLOR_INC(LQ_FLAG_COLOR_GET(lq_cmd->flags));
+        lq_cmd->flags = LQ_FLAG_COLOR_SET(lq_cmd->flags, color);
 }
 struct rs_bfer_active_iter_data {
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.h b/drivers/net/wireless/intel/iwlwifi/mvm/rs.h
index ee207f2c0a90..3abde1cb0303 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.h
@@ -2,6 +2,7 @@
 *
 * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2017 Intel Deutschland GmbH
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of version 2 of the GNU General Public License as
@@ -357,6 +358,20 @@ struct iwl_lq_sta {
        } pers;
 };
+/* ieee80211_tx_info's status_driver_data[0] is packed with lq color and txp
+ * Note, it's iwlmvm <-> mac80211 interface.
+ * bits 0-7: reduced tx power
+ * bits 8-10: LQ command's color
+ */
+#define RS_DRV_DATA_TXP_MSK 0xff
+#define RS_DRV_DATA_LQ_COLOR_POS 8
+#define RS_DRV_DATA_LQ_COLOR_MSK (7 << RS_DRV_DATA_LQ_COLOR_POS)
+#define RS_DRV_DATA_LQ_COLOR_GET(_f) (((_f) & RS_DRV_DATA_LQ_COLOR_MSK) >>\
+                                      RS_DRV_DATA_LQ_COLOR_POS)
+#define RS_DRV_DATA_PACK(_c, _p) ((void *)(uintptr_t)\
+                                  (((uintptr_t)_p) |\
+                                   ((_c) << RS_DRV_DATA_LQ_COLOR_POS)))
 /* Initialize station's rate scaling information after adding station */
 void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                          enum nl80211_band band, bool init);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
index f5c786ddc526..614d67810d05 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
@@ -2120,7 +2120,8 @@ int iwl_mvm_add_mcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
        if (!iwl_mvm_is_dqa_supported(mvm))
                return 0;
-        if (WARN_ON(vif->type != NL80211_IFTYPE_AP))
+        if (WARN_ON(vif->type != NL80211_IFTYPE_AP &&
+                    vif->type != NL80211_IFTYPE_ADHOC))
                return -ENOTSUPP;
        /*
@@ -2155,6 +2156,16 @@ int iwl_mvm_add_mcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
                mvmvif->cab_queue = queue;
        } else if (!fw_has_api(&mvm->fw->ucode_capa,
                               IWL_UCODE_TLV_API_STA_TYPE)) {
+                /*
+                 * In IBSS, ieee80211_check_queues() sets the cab_queue to be
+                 * invalid, so make sure we use the queue we want.
+                 * Note that this is done here as we want to avoid making DQA
+                 * changes in mac80211 layer.
+                 */
+                if (vif->type == NL80211_IFTYPE_ADHOC) {
+                        vif->cab_queue = IWL_MVM_DQA_GCAST_QUEUE;
+                        mvmvif->cab_queue = vif->cab_queue;
+                }
                iwl_mvm_enable_txq(mvm, vif->cab_queue, vif->cab_queue, 0,
                                   &cfg, timeout);
        }
@@ -3321,18 +3332,15 @@ int iwl_mvm_remove_sta_key(struct iwl_mvm *mvm,
        /* Get the station from the mvm local station table */
        mvm_sta = iwl_mvm_get_key_sta(mvm, vif, sta);
-        if (!mvm_sta) {
+        if (mvm_sta)
-                IWL_ERR(mvm, "Failed to find station\n");
+                sta_id = mvm_sta->sta_id;
-                return -EINVAL;
-        }
-        sta_id = mvm_sta->sta_id;
        IWL_DEBUG_WEP(mvm, "mvm remove dynamic key: idx=%d sta=%d\n",
                      keyconf->keyidx, sta_id);
-        if (keyconf->cipher == WLAN_CIPHER_SUITE_AES_CMAC ||
+        if (mvm_sta && (keyconf->cipher == WLAN_CIPHER_SUITE_AES_CMAC ||
-            keyconf->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_128 ||
+                        keyconf->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_128 ||
-            keyconf->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_256)
+                        keyconf->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_256))
                return iwl_mvm_send_sta_igtk(mvm, keyconf, sta_id, true);
        if (!__test_and_clear_bit(keyconf->hw_key_idx, mvm->fw_key_table)) {
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
index 2716cb5483bf..ad62b67dceb2 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
@@ -313,6 +313,7 @@ enum iwl_mvm_agg_state {
 *      This is basically (last acked packet++).
 * @rate_n_flags: Rate at which Tx was attempted. Holds the data between the
 *      Tx response (TX_CMD), and the block ack notification (COMPRESSED_BA).
+ * @lq_color: the color of the LQ command as it appears in tx response.
 * @amsdu_in_ampdu_allowed: true if A-MSDU in A-MPDU is allowed.
 * @state: state of the BA agreement establishment / tear down.
 * @txq_id: Tx queue used by the BA session / DQA
@@ -331,6 +332,7 @@ struct iwl_mvm_tid_data {
        u16 next_reclaimed;
        /* The rest is Tx AGG related */
        u32 rate_n_flags;
+        u8 lq_color;
        bool amsdu_in_ampdu_allowed;
        enum iwl_mvm_agg_state state;
        u16 txq_id;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tt.c b/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
index f9cbd197246f..506d58104e1c 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
@@ -790,11 +790,13 @@ static int iwl_mvm_tcool_set_cur_state(struct thermal_cooling_device *cdev,
        struct iwl_mvm *mvm = (struct iwl_mvm *)(cdev->devdata);
        int ret;
-        if (!mvm->ucode_loaded || !(mvm->cur_ucode == IWL_UCODE_REGULAR))
-                return -EIO;
        mutex_lock(&mvm->mutex);
+        if (!mvm->ucode_loaded || !(mvm->cur_ucode == IWL_UCODE_REGULAR)) {
+                ret = -EIO;
+                goto unlock;
+        }
        if (new_state >= ARRAY_SIZE(iwl_mvm_cdev_budgets)) {
                ret = -EINVAL;
                goto unlock;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
index bcaceb64a6e8..f21901cd4a4f 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
@@ -1323,6 +1323,7 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
        struct iwl_mvm_sta *mvmsta;
        struct sk_buff_head skbs;
        u8 skb_freed = 0;
+        u8 lq_color;
        u16 next_reclaimed, seq_ctl;
        bool is_ndp = false;
@@ -1405,8 +1406,9 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
                info->status.tx_time =
                        le16_to_cpu(tx_resp->wireless_media_time);
                BUILD_BUG_ON(ARRAY_SIZE(info->status.status_driver_data) < 1);
+                lq_color = TX_RES_RATE_TABLE_COL_GET(tx_resp->tlc_info);
                info->status.status_driver_data[0] =
-                                (void *)(uintptr_t)tx_resp->reduced_tpc;
+                        RS_DRV_DATA_PACK(lq_color, tx_resp->reduced_tpc);
                ieee80211_tx_status(mvm->hw, skb);
        }
@@ -1638,6 +1640,9 @@ static void iwl_mvm_rx_tx_cmd_agg(struct iwl_mvm *mvm,
                        le32_to_cpu(tx_resp->initial_rate);
                mvmsta->tid_data[tid].tx_time =
                        le16_to_cpu(tx_resp->wireless_media_time);
+                mvmsta->tid_data[tid].lq_color =
+                        (tx_resp->tlc_info & TX_RES_RATE_TABLE_COLOR_MSK) >>
+                        TX_RES_RATE_TABLE_COLOR_POS;
        }
        rcu_read_unlock();
@@ -1707,6 +1712,11 @@ static void iwl_mvm_tx_reclaim(struct iwl_mvm *mvm, int sta_id, int tid,
        iwl_mvm_check_ratid_empty(mvm, sta, tid);
        freed = 0;
+        /* pack lq color from tid_data along the reduced txp */
+        ba_info->status.status_driver_data[0] =
+                RS_DRV_DATA_PACK(tid_data->lq_color,
+                                 ba_info->status.status_driver_data[0]);
        ba_info->status.status_driver_data[1] = (void *)(uintptr_t)rate;
        skb_queue_walk(&reclaimed_skbs, skb) {
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
index 70acf850a9f1..93cbc7a69bcd 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
@@ -2803,7 +2803,8 @@ static struct iwl_trans_dump_data
 #ifdef CONFIG_PM_SLEEP
 static int iwl_trans_pcie_suspend(struct iwl_trans *trans)
 {
-        if (trans->runtime_pm_mode == IWL_PLAT_PM_MODE_D0I3)
+        if (trans->runtime_pm_mode == IWL_PLAT_PM_MODE_D0I3 &&
+            (trans->system_pm_mode == IWL_PLAT_PM_MODE_D0I3))
                return iwl_pci_fw_enter_d0i3(trans);
        return 0;
@@ -2811,7 +2812,8 @@ static int iwl_trans_pcie_suspend(struct iwl_trans *trans)
 static void iwl_trans_pcie_resume(struct iwl_trans *trans)
 {
-        if (trans->runtime_pm_mode == IWL_PLAT_PM_MODE_D0I3)
+        if (trans->runtime_pm_mode == IWL_PLAT_PM_MODE_D0I3 &&
+            (trans->system_pm_mode == IWL_PLAT_PM_MODE_D0I3))
                iwl_pci_fw_exit_d0i3(trans);
 }
 #endif /* CONFIG_PM_SLEEP */
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
index 9fb46a6f47cf..9c9bfbbabdf1 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
@@ -906,7 +906,7 @@ int iwl_trans_pcie_dyn_txq_alloc(struct iwl_trans *trans,
        if (WARN_ON(iwl_rx_packet_payload_len(hcmd.resp_pkt) != sizeof(*rsp))) {
                ret = -EINVAL;
-                goto error;
+                goto error_free_resp;
        }
        rsp = (void *)hcmd.resp_pkt->data;
@@ -915,13 +915,13 @@ int iwl_trans_pcie_dyn_txq_alloc(struct iwl_trans *trans,
        if (qid > ARRAY_SIZE(trans_pcie->txq)) {
                WARN_ONCE(1, "queue index %d unsupported", qid);
                ret = -EIO;
-                goto error;
+                goto error_free_resp;
        }
        if (test_and_set_bit(qid, trans_pcie->queue_used)) {
                WARN_ONCE(1, "queue %d already used", qid);
                ret = -EIO;
-                goto error;
+                goto error_free_resp;
        }
        txq->id = qid;
@@ -934,8 +934,11 @@ int iwl_trans_pcie_dyn_txq_alloc(struct iwl_trans *trans,
                           (txq->write_ptr) | (qid << 16));
        IWL_DEBUG_TX_QUEUES(trans, "Activate queue %d\n", qid);
+        iwl_free_resp(&hcmd);
        return qid;
+error_free_resp:
+        iwl_free_resp(&hcmd);
 error:
        iwl_pcie_gen2_txq_free_memory(trans, txq);
        return ret;
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index a60926410438..903d5813023a 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -56,7 +56,7 @@ MODULE_PARM_DESC(max_retries, "max number of retries a command may have");
 static int nvme_char_major;
 module_param(nvme_char_major, int, 0);
-static unsigned long default_ps_max_latency_us = 25000;
+static unsigned long default_ps_max_latency_us = 100000;
 module_param(default_ps_max_latency_us, ulong, 0644);
 MODULE_PARM_DESC(default_ps_max_latency_us,
                 "max power saving latency for new devices; use PM QOS to change per device");
@@ -1342,7 +1342,7 @@ static void nvme_configure_apst(struct nvme_ctrl *ctrl)
         * transitioning between power states.  Therefore, when running
         * in any given state, we will enter the next lower-power
         * non-operational state after waiting 50 * (enlat + exlat)
-         * microseconds, as long as that state's total latency is under
+         * microseconds, as long as that state's exit latency is under
         * the requested maximum latency.
         *
         * We will not autonomously enter any non-operational state for
@@ -1387,7 +1387,7 @@ static void nvme_configure_apst(struct nvme_ctrl *ctrl)
                 * lowest-power state, not the number of states.
                 */
                for (state = (int)ctrl->npss; state >= 0; state--) {
-                        u64 total_latency_us, transition_ms;
+                        u64 total_latency_us, exit_latency_us, transition_ms;
                        if (target)
                                table->entries[state] = target;
@@ -1408,12 +1408,15 @@ static void nvme_configure_apst(struct nvme_ctrl *ctrl)
                              NVME_PS_FLAGS_NON_OP_STATE))
                                continue;
-                        total_latency_us =
+                        exit_latency_us =
-                                (u64)le32_to_cpu(ctrl->psd[state].entry_lat) +
+                                (u64)le32_to_cpu(ctrl->psd[state].exit_lat);
-                                + le32_to_cpu(ctrl->psd[state].exit_lat);
+                        if (exit_latency_us > ctrl->ps_max_latency_us)
-                        if (total_latency_us > ctrl->ps_max_latency_us)
                                continue;
+                        total_latency_us =
+                                exit_latency_us +
+                                le32_to_cpu(ctrl->psd[state].entry_lat);
                        /*
                         * This state is good.  Use it as the APST idle
                         * target for higher power states.
@@ -2438,6 +2441,10 @@ void nvme_kill_queues(struct nvme_ctrl *ctrl)
        struct nvme_ns *ns;
        mutex_lock(&ctrl->namespaces_mutex);
+        /* Forcibly start all queues to avoid having stuck requests */
+        blk_mq_start_hw_queues(ctrl->admin_q);
        list_for_each_entry(ns, &ctrl->namespaces, list) {
                /*
                 * Revalidating a dead namespace sets capacity to 0. This will
diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index 5b14cbefb724..92964cef0f4b 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -1139,6 +1139,7 @@ nvme_fc_xmt_disconnect_assoc(struct nvme_fc_ctrl *ctrl)
 /* *********************** NVME Ctrl Routines **************************** */
 static void __nvme_fc_final_op_cleanup(struct request *rq);
+static void nvme_fc_error_recovery(struct nvme_fc_ctrl *ctrl, char *errmsg);
 static int
 nvme_fc_reinit_request(void *data, struct request *rq)
@@ -1265,7 +1266,7 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req)
        struct nvme_command *sqe = &op->cmd_iu.sqe;
        __le16 status = cpu_to_le16(NVME_SC_SUCCESS << 1);
        union nvme_result result;
-        bool complete_rq;
+        bool complete_rq, terminate_assoc = true;
        /*
         * WARNING:
@@ -1294,6 +1295,14 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req)
         * fabricate a CQE, the following fields will not be set as they
         * are not referenced:
         *      cqe.sqid,  cqe.sqhd,  cqe.command_id
+         *
+         * Failure or error of an individual i/o, in a transport
+         * detected fashion unrelated to the nvme completion status,
+         * potentially cause the initiator and target sides to get out
+         * of sync on SQ head/tail (aka outstanding io count allowed).
+         * Per FC-NVME spec, failure of an individual command requires
+         * the connection to be terminated, which in turn requires the
+         * association to be terminated.
         */
        fc_dma_sync_single_for_cpu(ctrl->lport->dev, op->fcp_req.rspdma,
@@ -1359,6 +1368,8 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req)
                goto done;
        }
+        terminate_assoc = false;
 done:
        if (op->flags & FCOP_FLAGS_AEN) {
                nvme_complete_async_event(&queue->ctrl->ctrl, status, &result);
@@ -1366,7 +1377,7 @@ done:
                atomic_set(&op->state, FCPOP_STATE_IDLE);
                op->flags = FCOP_FLAGS_AEN;     /* clear other flags */
                nvme_fc_ctrl_put(ctrl);
-                return;
+                goto check_error;
        }
        complete_rq = __nvme_fc_fcpop_chk_teardowns(ctrl, op);
@@ -1379,6 +1390,10 @@ done:
                nvme_end_request(rq, status, result);
        } else
                __nvme_fc_final_op_cleanup(rq);
+check_error:
+        if (terminate_assoc)
+                nvme_fc_error_recovery(ctrl, "transport detected io error");
 }
 static int
@@ -2791,6 +2806,7 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
                ctrl->ctrl.opts = NULL;
                /* initiate nvme ctrl ref counting teardown */
                nvme_uninit_ctrl(&ctrl->ctrl);
+                nvme_put_ctrl(&ctrl->ctrl);
                /* as we're past the point where we transition to the ref
                 * counting teardown path, if we return a bad pointer here,
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index d52701df7245..951042a375d6 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -1367,7 +1367,7 @@ static bool nvme_should_reset(struct nvme_dev *dev, u32 csts)
        bool nssro = dev->subsystem && (csts & NVME_CSTS_NSSRO);
        /* If there is a reset ongoing, we shouldn't reset again. */
-        if (work_busy(&dev->reset_work))
+        if (dev->ctrl.state == NVME_CTRL_RESETTING)
                return false;
        /* We shouldn't reset unless the controller is on fatal error state
@@ -1903,7 +1903,7 @@ static void nvme_reset_work(struct work_struct *work)
        bool was_suspend = !!(dev->ctrl.ctrl_config & NVME_CC_SHN_NORMAL);
        int result = -ENODEV;
-        if (WARN_ON(dev->ctrl.state == NVME_CTRL_RESETTING))
+        if (WARN_ON(dev->ctrl.state != NVME_CTRL_RESETTING))
                goto out;
        /*
@@ -1913,9 +1913,6 @@ static void nvme_reset_work(struct work_struct *work)
        if (dev->ctrl.ctrl_config & NVME_CC_ENABLE)
                nvme_dev_disable(dev, false);
-        if (!nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_RESETTING))
-                goto out;
        result = nvme_pci_enable(dev);
        if (result)
                goto out;
@@ -2009,8 +2006,8 @@ static int nvme_reset(struct nvme_dev *dev)
 {
        if (!dev->ctrl.admin_q || blk_queue_dying(dev->ctrl.admin_q))
                return -ENODEV;
-        if (work_busy(&dev->reset_work))
+        if (!nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_RESETTING))
-                return -ENODEV;
+                return -EBUSY;
        if (!queue_work(nvme_workq, &dev->reset_work))
                return -EBUSY;
        return 0;
@@ -2136,6 +2133,7 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id)
        if (result)
                goto release_pools;
+        nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_RESETTING);
        dev_info(dev->ctrl.device, "pci function %s\n", dev_name(&pdev->dev));
        queue_work(nvme_workq, &dev->reset_work);
@@ -2179,6 +2177,7 @@ static void nvme_remove(struct pci_dev *pdev)
        nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_DELETING);
+        cancel_work_sync(&dev->reset_work);
        pci_set_drvdata(pdev, NULL);
        if (!pci_device_is_present(pdev)) {
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index 28bd255c144d..24397d306d53 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -753,28 +753,26 @@ static void nvme_rdma_reconnect_ctrl_work(struct work_struct *work)
        if (ret)
                goto requeue;
-        blk_mq_start_stopped_hw_queues(ctrl->ctrl.admin_q, true);
        ret = nvmf_connect_admin_queue(&ctrl->ctrl);
        if (ret)
-                goto stop_admin_q;
+                goto requeue;
        set_bit(NVME_RDMA_Q_LIVE, &ctrl->queues[0].flags);
        ret = nvme_enable_ctrl(&ctrl->ctrl, ctrl->cap);
        if (ret)
-                goto stop_admin_q;
+                goto requeue;
        nvme_start_keep_alive(&ctrl->ctrl);
        if (ctrl->queue_count > 1) {
                ret = nvme_rdma_init_io_queues(ctrl);
                if (ret)
-                        goto stop_admin_q;
+                        goto requeue;
                ret = nvme_rdma_connect_io_queues(ctrl);
                if (ret)
-                        goto stop_admin_q;
+                        goto requeue;
        }
        changed = nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_LIVE);
@@ -782,7 +780,6 @@ static void nvme_rdma_reconnect_ctrl_work(struct work_struct *work)
        ctrl->ctrl.opts->nr_reconnects = 0;
        if (ctrl->queue_count > 1) {
-                nvme_start_queues(&ctrl->ctrl);
                nvme_queue_scan(&ctrl->ctrl);
                nvme_queue_async_events(&ctrl->ctrl);
        }
@@ -791,8 +788,6 @@ static void nvme_rdma_reconnect_ctrl_work(struct work_struct *work)
        return;
-stop_admin_q:
-        blk_mq_stop_hw_queues(ctrl->ctrl.admin_q);
 requeue:
        dev_info(ctrl->ctrl.device, "Failed reconnect attempt %d\n",
                        ctrl->ctrl.opts->nr_reconnects);
@@ -823,6 +818,13 @@ static void nvme_rdma_error_recovery_work(struct work_struct *work)
        blk_mq_tagset_busy_iter(&ctrl->admin_tag_set,
                                nvme_cancel_request, &ctrl->ctrl);
+        /*
+         * queues are not a live anymore, so restart the queues to fail fast
+         * new IO
+         */
+        blk_mq_start_stopped_hw_queues(ctrl->ctrl.admin_q, true);
+        nvme_start_queues(&ctrl->ctrl);
        nvme_rdma_reconnect_or_remove(ctrl);
 }
@@ -1433,7 +1435,7 @@ nvme_rdma_timeout(struct request *rq, bool reserved)
 /*
 * We cannot accept any other command until the Connect command has completed.
 */
-static inline bool nvme_rdma_queue_is_ready(struct nvme_rdma_queue *queue,
+static inline int nvme_rdma_queue_is_ready(struct nvme_rdma_queue *queue,
                struct request *rq)
 {
        if (unlikely(!test_bit(NVME_RDMA_Q_LIVE, &queue->flags))) {
@@ -1441,11 +1443,22 @@ static inline bool nvme_rdma_queue_is_ready(struct nvme_rdma_queue *queue,
                if (!blk_rq_is_passthrough(rq) ||
                    cmd->common.opcode != nvme_fabrics_command ||
-                    cmd->fabrics.fctype != nvme_fabrics_type_connect)
+                    cmd->fabrics.fctype != nvme_fabrics_type_connect) {
-                        return false;
+                        /*
+                         * reconnecting state means transport disruption, which
+                         * can take a long time and even might fail permanently,
+                         * so we can't let incoming I/O be requeued forever.
+                         * fail it fast to allow upper layers a chance to
+                         * failover.
+                         */
+                        if (queue->ctrl->ctrl.state == NVME_CTRL_RECONNECTING)
+                                return -EIO;
+                        else
+                                return -EAGAIN;
+                }
        }
-        return true;
+        return 0;
 }
 static int nvme_rdma_queue_rq(struct blk_mq_hw_ctx *hctx,
@@ -1463,8 +1476,9 @@ static int nvme_rdma_queue_rq(struct blk_mq_hw_ctx *hctx,
        WARN_ON_ONCE(rq->tag < 0);
-        if (!nvme_rdma_queue_is_ready(queue, rq))
+        ret = nvme_rdma_queue_is_ready(queue, rq);
-                return BLK_MQ_RQ_QUEUE_BUSY;
+        if (unlikely(ret))
+                goto err;
        dev = queue->device->dev;
        ib_dma_sync_single_for_cpu(dev, sqe->dma,
diff --git a/drivers/of/device.c b/drivers/of/device.c
index 9416d052cb89..28c38c756f92 100644
--- a/drivers/of/device.c
+++ b/drivers/of/device.c
@@ -144,8 +144,8 @@ int of_dma_configure(struct device *dev, struct device_node *np)
                coherent ? " " : " not ");
        iommu = of_iommu_configure(dev, np);
-        if (IS_ERR(iommu))
+        if (IS_ERR(iommu) && PTR_ERR(iommu) == -EPROBE_DEFER)
-                return PTR_ERR(iommu);
+                return -EPROBE_DEFER;
        dev_dbg(dev, "device is%sbehind an iommu\n",
                iommu ? " " : " not ");
diff --git a/drivers/reset/hisilicon/hi6220_reset.c b/drivers/reset/hisilicon/hi6220_reset.c
index 35ce53edabf9..d5e5229308f2 100644
--- a/drivers/reset/hisilicon/hi6220_reset.c
+++ b/drivers/reset/hisilicon/hi6220_reset.c
@@ -155,3 +155,5 @@ static int __init hi6220_reset_init(void)
 }
 postcore_initcall(hi6220_reset_init);
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/staging/media/atomisp/i2c/Makefile b/drivers/staging/media/atomisp/i2c/Makefile
index 8ea01904c0ea..466517c7c8e6 100644
--- a/drivers/staging/media/atomisp/i2c/Makefile
+++ b/drivers/staging/media/atomisp/i2c/Makefile
@@ -19,5 +19,3 @@ obj-$(CONFIG_VIDEO_AP1302)     += ap1302.o
 obj-$(CONFIG_VIDEO_LM3554) += lm3554.o
-ccflags-y += -Werror
diff --git a/drivers/staging/media/atomisp/i2c/imx/Makefile b/drivers/staging/media/atomisp/i2c/imx/Makefile
index 1d7f7ab94cac..6b13a3a66e49 100644
--- a/drivers/staging/media/atomisp/i2c/imx/Makefile
+++ b/drivers/staging/media/atomisp/i2c/imx/Makefile
@@ -4,5 +4,3 @@ imx1x5-objs := imx.o drv201.o ad5816g.o dw9714.o dw9719.o dw9718.o vcm.o otp.o o
 ov8858_driver-objs := ../ov8858.o dw9718.o vcm.o
 obj-$(CONFIG_VIDEO_OV8858)     += ov8858_driver.o
-ccflags-y += -Werror
diff --git a/drivers/staging/media/atomisp/i2c/ov5693/Makefile b/drivers/staging/media/atomisp/i2c/ov5693/Makefile
index fceb9e9b881b..c9c0e1245858 100644
--- a/drivers/staging/media/atomisp/i2c/ov5693/Makefile
+++ b/drivers/staging/media/atomisp/i2c/ov5693/Makefile
@@ -1,3 +1 @@
 obj-$(CONFIG_VIDEO_OV5693) += ov5693.o
-ccflags-y += -Werror
diff --git a/drivers/staging/media/atomisp/pci/atomisp2/Makefile b/drivers/staging/media/atomisp/pci/atomisp2/Makefile
index 3fa7c1c1479f..f126a89a08e9 100644
--- a/drivers/staging/media/atomisp/pci/atomisp2/Makefile
+++ b/drivers/staging/media/atomisp/pci/atomisp2/Makefile
@@ -351,5 +351,5 @@ DEFINES := -DHRT_HW -DHRT_ISP_CSS_CUSTOM_HOST -DHRT_USE_VIR_ADDRS -D__HOST__
 DEFINES += -DATOMISP_POSTFIX=\"css2400b0_v21\" -DISP2400B0
 DEFINES += -DSYSTEM_hive_isp_css_2400_system -DISP2400
-ccflags-y += $(INCLUDES) $(DEFINES) -fno-common -Werror
+ccflags-y += $(INCLUDES) $(DEFINES) -fno-common
diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c
index 7a92a5e1d40c..feca75b07fdd 100644
--- a/drivers/xen/privcmd.c
+++ b/drivers/xen/privcmd.c
@@ -362,8 +362,8 @@ static int mmap_batch_fn(void *data, int nr, void *state)
                                st->global_error = 1;
                }
        }
-        st->va += PAGE_SIZE * nr;
+        st->va += XEN_PAGE_SIZE * nr;
-        st->index += nr;
+        st->index += nr / XEN_PFN_PER_PAGE;
        return 0;
 }
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 643c70d2b2e6..4f8f75d9e839 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -2563,7 +2563,7 @@ u64 btrfs_csum_bytes_to_leaves(struct btrfs_fs_info *fs_info, u64 csum_bytes);
 static inline u64 btrfs_calc_trans_metadata_size(struct btrfs_fs_info *fs_info,
                                                 unsigned num_items)
 {
-        return fs_info->nodesize * BTRFS_MAX_LEVEL * 2 * num_items;
+        return (u64)fs_info->nodesize * BTRFS_MAX_LEVEL * 2 * num_items;
 }
 /*
@@ -2573,7 +2573,7 @@ static inline u64 btrfs_calc_trans_metadata_size(struct btrfs_fs_info *fs_info,
 static inline u64 btrfs_calc_trunc_metadata_size(struct btrfs_fs_info *fs_info,
                                                 unsigned num_items)
 {
-        return fs_info->nodesize * BTRFS_MAX_LEVEL * num_items;
+        return (u64)fs_info->nodesize * BTRFS_MAX_LEVEL * num_items;
 }
 int btrfs_should_throttle_delayed_refs(struct btrfs_trans_handle *trans,
diff --git a/fs/btrfs/dir-item.c b/fs/btrfs/dir-item.c
index 60a750678a82..c24d615e3d7f 100644
--- a/fs/btrfs/dir-item.c
+++ b/fs/btrfs/dir-item.c
@@ -468,7 +468,7 @@ int verify_dir_item(struct btrfs_fs_info *fs_info,
        if (btrfs_dir_name_len(leaf, dir_item) > namelen) {
                btrfs_crit(fs_info, "invalid dir item name len: %u",
-                       (unsigned)btrfs_dir_data_len(leaf, dir_item));
+                       (unsigned)btrfs_dir_name_len(leaf, dir_item));
                return 1;
        }
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 8685d67185d0..5f678dcb20e6 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -3467,10 +3467,12 @@ static int write_dev_supers(struct btrfs_device *device,
                 * we fua the first super.  The others we allow
                 * to go down lazy.
                 */
-                if (i == 0)
+                if (i == 0) {
-                        ret = btrfsic_submit_bh(REQ_OP_WRITE, REQ_FUA, bh);
+                        ret = btrfsic_submit_bh(REQ_OP_WRITE,
-                else
+                                                REQ_SYNC | REQ_FUA, bh);
+                } else {
                        ret = btrfsic_submit_bh(REQ_OP_WRITE, REQ_SYNC, bh);
+                }
                if (ret)
                        errors++;
        }
@@ -3535,7 +3537,7 @@ static int write_dev_flush(struct btrfs_device *device, int wait)
        bio->bi_end_io = btrfs_end_empty_barrier;
        bio->bi_bdev = device->bdev;
-        bio->bi_opf = REQ_OP_WRITE | REQ_PREFLUSH;
+        bio->bi_opf = REQ_OP_WRITE | REQ_SYNC | REQ_PREFLUSH;
        init_completion(&device->flush_wait);
        bio->bi_private = &device->flush_wait;
        device->flush_bio = bio;
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index e390451c72e6..33d979e9ea2a 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -3993,6 +3993,7 @@ static int update_space_info(struct btrfs_fs_info *info, u64 flags,
                                    info->space_info_kobj, "%s",
                                    alloc_name(found->flags));
        if (ret) {
+                percpu_counter_destroy(&found->total_bytes_pinned);
                kfree(found);
                return ret;
        }
@@ -4844,7 +4845,7 @@ static int may_commit_transaction(struct btrfs_fs_info *fs_info,
        spin_unlock(&delayed_rsv->lock);
 commit:
-        trans = btrfs_join_transaction(fs_info->fs_root);
+        trans = btrfs_join_transaction(fs_info->extent_root);
        if (IS_ERR(trans))
                return -ENOSPC;
@@ -4862,7 +4863,7 @@ static int flush_space(struct btrfs_fs_info *fs_info,
                       struct btrfs_space_info *space_info, u64 num_bytes,
                       u64 orig_bytes, int state)
 {
-        struct btrfs_root *root = fs_info->fs_root;
+        struct btrfs_root *root = fs_info->extent_root;
        struct btrfs_trans_handle *trans;
        int nr;
        int ret = 0;
@@ -5062,7 +5063,7 @@ static void priority_reclaim_metadata_space(struct btrfs_fs_info *fs_info,
        int flush_state = FLUSH_DELAYED_ITEMS_NR;
        spin_lock(&space_info->lock);
-        to_reclaim = btrfs_calc_reclaim_metadata_size(fs_info->fs_root,
+        to_reclaim = btrfs_calc_reclaim_metadata_size(fs_info->extent_root,
                                                      space_info);
        if (!to_reclaim) {
                spin_unlock(&space_info->lock);
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index d8da3edf2ac3..d3619e010005 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -2458,7 +2458,7 @@ void end_extent_writepage(struct page *page, int err, u64 start, u64 end)
        if (!uptodate) {
                ClearPageUptodate(page);
                SetPageError(page);
-                ret = ret < 0 ? ret : -EIO;
+                ret = err < 0 ? err : -EIO;
                mapping_set_error(page->mapping, ret);
        }
 }
@@ -4377,6 +4377,123 @@ static struct extent_map *get_extent_skip_holes(struct inode *inode,
        return NULL;
 }
+/*
+ * To cache previous fiemap extent
+ *
+ * Will be used for merging fiemap extent
+ */
+struct fiemap_cache {
+        u64 offset;
+        u64 phys;
+        u64 len;
+        u32 flags;
+        bool cached;
+};
+/*
+ * Helper to submit fiemap extent.
+ *
+ * Will try to merge current fiemap extent specified by @offset, @phys,
+ * @len and @flags with cached one.
+ * And only when we fails to merge, cached one will be submitted as
+ * fiemap extent.
+ *
+ * Return value is the same as fiemap_fill_next_extent().
+ */
+static int emit_fiemap_extent(struct fiemap_extent_info *fieinfo,
+                                struct fiemap_cache *cache,
+                                u64 offset, u64 phys, u64 len, u32 flags)
+{
+        int ret = 0;
+        if (!cache->cached)
+                goto assign;
+        /*
+         * Sanity check, extent_fiemap() should have ensured that new
+         * fiemap extent won't overlap with cahced one.
+         * Not recoverable.
+         *
+         * NOTE: Physical address can overlap, due to compression
+         */
+        if (cache->offset + cache->len > offset) {
+                WARN_ON(1);
+                return -EINVAL;
+        }
+        /*
+         * Only merges fiemap extents if
+         * 1) Their logical addresses are continuous
+         *
+         * 2) Their physical addresses are continuous
+         *    So truly compressed (physical size smaller than logical size)
+         *    extents won't get merged with each other
+         *
+         * 3) Share same flags except FIEMAP_EXTENT_LAST
+         *    So regular extent won't get merged with prealloc extent
+         */
+        if (cache->offset + cache->len  == offset &&
+            cache->phys + cache->len == phys  &&
+            (cache->flags & ~FIEMAP_EXTENT_LAST) ==
+                        (flags & ~FIEMAP_EXTENT_LAST)) {
+                cache->len += len;
+                cache->flags |= flags;
+                goto try_submit_last;
+        }
+        /* Not mergeable, need to submit cached one */
+        ret = fiemap_fill_next_extent(fieinfo, cache->offset, cache->phys,
+                                      cache->len, cache->flags);
+        cache->cached = false;
+        if (ret)
+                return ret;
+assign:
+        cache->cached = true;
+        cache->offset = offset;
+        cache->phys = phys;
+        cache->len = len;
+        cache->flags = flags;
+try_submit_last:
+        if (cache->flags & FIEMAP_EXTENT_LAST) {
+                ret = fiemap_fill_next_extent(fieinfo, cache->offset,
+                                cache->phys, cache->len, cache->flags);
+                cache->cached = false;
+        }
+        return ret;
+}
+/*
+ * Sanity check for fiemap cache
+ *
+ * All fiemap cache should be submitted by emit_fiemap_extent()
+ * Iteration should be terminated either by last fiemap extent or
+ * fieinfo->fi_extents_max.
+ * So no cached fiemap should exist.
+ */
+static int check_fiemap_cache(struct btrfs_fs_info *fs_info,
+                               struct fiemap_extent_info *fieinfo,
+                               struct fiemap_cache *cache)
+{
+        int ret;
+        if (!cache->cached)
+                return 0;
+        /* Small and recoverbale problem, only to info developer */
+#ifdef CONFIG_BTRFS_DEBUG
+        WARN_ON(1);
+#endif
+        btrfs_warn(fs_info,
+                   "unhandled fiemap cache detected: offset=%llu phys=%llu len=%llu flags=0x%x",
+                   cache->offset, cache->phys, cache->len, cache->flags);
+        ret = fiemap_fill_next_extent(fieinfo, cache->offset, cache->phys,
+                                      cache->len, cache->flags);
+        cache->cached = false;
+        if (ret > 0)
+                ret = 0;
+        return ret;
+}
 int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
                __u64 start, __u64 len, get_extent_t *get_extent)
 {
@@ -4394,6 +4511,7 @@ int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
        struct extent_state *cached_state = NULL;
        struct btrfs_path *path;
        struct btrfs_root *root = BTRFS_I(inode)->root;
+        struct fiemap_cache cache = { 0 };
        int end = 0;
        u64 em_start = 0;
        u64 em_len = 0;
@@ -4573,8 +4691,8 @@ int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
                        flags |= FIEMAP_EXTENT_LAST;
                        end = 1;
                }
-                ret = fiemap_fill_next_extent(fieinfo, em_start, disko,
+                ret = emit_fiemap_extent(fieinfo, &cache, em_start, disko,
-                                              em_len, flags);
+                                           em_len, flags);
                if (ret) {
                        if (ret == 1)
                                ret = 0;
@@ -4582,6 +4700,8 @@ int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
                }
        }
 out_free:
+        if (!ret)
+                ret = check_fiemap_cache(root->fs_info, fieinfo, &cache);
        free_extent_map(em);
 out:
        btrfs_free_path(path);
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 17cbe9306faf..ef3c98c527c1 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -2952,7 +2952,7 @@ static int btrfs_finish_ordered_io(struct btrfs_ordered_extent *ordered_extent)
        ret = test_range_bit(io_tree, ordered_extent->file_offset,
                        ordered_extent->file_offset + ordered_extent->len - 1,
-                        EXTENT_DEFRAG, 1, cached_state);
+                        EXTENT_DEFRAG, 0, cached_state);
        if (ret) {
                u64 last_snapshot = btrfs_root_last_snapshot(&root->root_item);
                if (0 && last_snapshot >= BTRFS_I(inode)->generation)
@@ -7483,8 +7483,8 @@ bool btrfs_page_exists_in_range(struct inode *inode, loff_t start, loff_t end)
        int found = false;
        void **pagep = NULL;
        struct page *page = NULL;
-        int start_idx;
+        unsigned long start_idx;
-        int end_idx;
+        unsigned long end_idx;
        start_idx = start >> PAGE_SHIFT;
diff --git a/fs/stat.c b/fs/stat.c
index f494b182c7c7..c35610845ab1 100644
--- a/fs/stat.c
+++ b/fs/stat.c
@@ -672,6 +672,7 @@ void __inode_add_bytes(struct inode *inode, loff_t bytes)
                inode->i_bytes -= 512;
        }
 }
+EXPORT_SYMBOL(__inode_add_bytes);
 void inode_add_bytes(struct inode *inode, loff_t bytes)
 {
diff --git a/fs/ufs/balloc.c b/fs/ufs/balloc.c
index a0376a2c1c29..d642cc0a8271 100644
--- a/fs/ufs/balloc.c
+++ b/fs/ufs/balloc.c
@@ -82,7 +82,8 @@ void ufs_free_fragments(struct inode *inode, u64 fragment, unsigned count)
                        ufs_error (sb, "ufs_free_fragments",
                                   "bit already cleared for fragment %u", i);
        }
-        
+        inode_sub_bytes(inode, count << uspi->s_fshift);
        fs32_add(sb, &ucg->cg_cs.cs_nffree, count);
        uspi->cs_total.cs_nffree += count;
        fs32_add(sb, &UFS_SB(sb)->fs_cs(cgno).cs_nffree, count);
@@ -184,6 +185,7 @@ do_more:
                        ufs_error(sb, "ufs_free_blocks", "freeing free fragment");
                }
                ubh_setblock(UCPI_UBH(ucpi), ucpi->c_freeoff, blkno);
+                inode_sub_bytes(inode, uspi->s_fpb << uspi->s_fshift);
                if ((UFS_SB(sb)->s_flags & UFS_CG_MASK) == UFS_CG_44BSD)
                        ufs_clusteracct (sb, ucpi, blkno, 1);
@@ -494,6 +496,20 @@ u64 ufs_new_fragments(struct inode *inode, void *p, u64 fragment,
        return 0;
 }               
+static bool try_add_frags(struct inode *inode, unsigned frags)
+{
+        unsigned size = frags * i_blocksize(inode);
+        spin_lock(&inode->i_lock);
+        __inode_add_bytes(inode, size);
+        if (unlikely((u32)inode->i_blocks != inode->i_blocks)) {
+                __inode_sub_bytes(inode, size);
+                spin_unlock(&inode->i_lock);
+                return false;
+        }
+        spin_unlock(&inode->i_lock);
+        return true;
+}
 static u64 ufs_add_fragments(struct inode *inode, u64 fragment,
                             unsigned oldcount, unsigned newcount)
 {
@@ -530,6 +546,9 @@ static u64 ufs_add_fragments(struct inode *inode, u64 fragment,
        for (i = oldcount; i < newcount; i++)
                if (ubh_isclr (UCPI_UBH(ucpi), ucpi->c_freeoff, fragno + i))
                        return 0;
+        if (!try_add_frags(inode, count))
+                return 0;
        /*
         * Block can be extended
         */
@@ -647,6 +666,7 @@ cg_found:
                        ubh_setbit (UCPI_UBH(ucpi), ucpi->c_freeoff, goal + i);
                i = uspi->s_fpb - count;
+                inode_sub_bytes(inode, i << uspi->s_fshift);
                fs32_add(sb, &ucg->cg_cs.cs_nffree, i);
                uspi->cs_total.cs_nffree += i;
                fs32_add(sb, &UFS_SB(sb)->fs_cs(cgno).cs_nffree, i);
@@ -657,6 +677,8 @@ cg_found:
        result = ufs_bitmap_search (sb, ucpi, goal, allocsize);
        if (result == INVBLOCK)
                return 0;
+        if (!try_add_frags(inode, count))
+                return 0;
        for (i = 0; i < count; i++)
                ubh_clrbit (UCPI_UBH(ucpi), ucpi->c_freeoff, result + i);
        
@@ -716,6 +738,8 @@ norot:
                return INVBLOCK;
        ucpi->c_rotor = result;
 gotit:
+        if (!try_add_frags(inode, uspi->s_fpb))
+                return 0;
        blkno = ufs_fragstoblks(result);
        ubh_clrblock (UCPI_UBH(ucpi), ucpi->c_freeoff, blkno);
        if ((UFS_SB(sb)->s_flags & UFS_CG_MASK) == UFS_CG_44BSD)
diff --git a/fs/ufs/inode.c b/fs/ufs/inode.c
index 7e41aee7b69a..da553ffec85b 100644
--- a/fs/ufs/inode.c
+++ b/fs/ufs/inode.c
@@ -235,7 +235,8 @@ ufs_extend_tail(struct inode *inode, u64 writes_to,
        p = ufs_get_direct_data_ptr(uspi, ufsi, block);
        tmp = ufs_new_fragments(inode, p, lastfrag, ufs_data_ptr_to_cpu(sb, p),
-                                new_size, err, locked_page);
+                                new_size - (lastfrag & uspi->s_fpbmask), err,
+                                locked_page);
        return tmp != 0;
 }
@@ -284,7 +285,7 @@ ufs_inode_getfrag(struct inode *inode, unsigned index,
                        goal += uspi->s_fpb;
        }
        tmp = ufs_new_fragments(inode, p, ufs_blknum(new_fragment),
-                                goal, uspi->s_fpb, err, locked_page);
+                                goal, nfrags, err, locked_page);
        if (!tmp) {
                *err = -ENOSPC;
@@ -402,7 +403,9 @@ static int ufs_getfrag_block(struct inode *inode, sector_t fragment, struct buff
        if (!create) {
                phys64 = ufs_frag_map(inode, offsets, depth);
-                goto out;
+                if (phys64)
+                        map_bh(bh_result, sb, phys64 + frag);
+                return 0;
        }
        /* This code entered only while writing ....? */
@@ -841,8 +844,11 @@ void ufs_evict_inode(struct inode * inode)
        truncate_inode_pages_final(&inode->i_data);
        if (want_delete) {
                inode->i_size = 0;
-                if (inode->i_blocks)
+                if (inode->i_blocks &&
+                    (S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode) ||
+                     S_ISLNK(inode->i_mode)))
                        ufs_truncate_blocks(inode);
+                ufs_update_inode(inode, inode_needs_sync(inode));
        }
        invalidate_inode_buffers(inode);
@@ -1100,7 +1106,7 @@ out:
       return err;
 }
-static void __ufs_truncate_blocks(struct inode *inode)
+static void ufs_truncate_blocks(struct inode *inode)
 {
        struct ufs_inode_info *ufsi = UFS_I(inode);
        struct super_block *sb = inode->i_sb;
@@ -1183,7 +1189,7 @@ static int ufs_truncate(struct inode *inode, loff_t size)
        truncate_setsize(inode, size);
-        __ufs_truncate_blocks(inode);
+        ufs_truncate_blocks(inode);
        inode->i_mtime = inode->i_ctime = current_time(inode);
        mark_inode_dirty(inode);
 out:
@@ -1191,16 +1197,6 @@ out:
        return err;
 }
-static void ufs_truncate_blocks(struct inode *inode)
-{
-        if (!(S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode) ||
-              S_ISLNK(inode->i_mode)))
-                return;
-        if (IS_APPEND(inode) || IS_IMMUTABLE(inode))
-                return;
-        __ufs_truncate_blocks(inode);
-}
 int ufs_setattr(struct dentry *dentry, struct iattr *attr)
 {
        struct inode *inode = d_inode(dentry);
diff --git a/fs/ufs/super.c b/fs/ufs/super.c
index 29ecaf739449..878cc6264f1a 100644
--- a/fs/ufs/super.c
+++ b/fs/ufs/super.c
@@ -746,6 +746,23 @@ static void ufs_put_super(struct super_block *sb)
        return;
 }
+static u64 ufs_max_bytes(struct super_block *sb)
+{
+        struct ufs_sb_private_info *uspi = UFS_SB(sb)->s_uspi;
+        int bits = uspi->s_apbshift;
+        u64 res;
+        if (bits > 21)
+                res = ~0ULL;
+        else
+                res = UFS_NDADDR + (1LL << bits) + (1LL << (2*bits)) +
+                        (1LL << (3*bits));
+        if (res >= (MAX_LFS_FILESIZE >> uspi->s_bshift))
+                return MAX_LFS_FILESIZE;
+        return res << uspi->s_bshift;
+}
 static int ufs_fill_super(struct super_block *sb, void *data, int silent)
 {
        struct ufs_sb_info * sbi;
@@ -1211,6 +1228,7 @@ magic_found:
                            "fast symlink size (%u)\n", uspi->s_maxsymlinklen);
                uspi->s_maxsymlinklen = maxsymlen;
        }
+        sb->s_maxbytes = ufs_max_bytes(sb);
        sb->s_max_links = UFS_LINK_MAX;
        inode = ufs_iget(sb, UFS_ROOTINO);
diff --git a/fs/ufs/util.h b/fs/ufs/util.h
index b7fbf53dbc81..398019fb1448 100644
--- a/fs/ufs/util.h
+++ b/fs/ufs/util.h
@@ -473,15 +473,19 @@ static inline unsigned _ubh_find_last_zero_bit_(
 static inline int _ubh_isblockset_(struct ufs_sb_private_info * uspi,
        struct ufs_buffer_head * ubh, unsigned begin, unsigned block)
 {
+        u8 mask;
        switch (uspi->s_fpb) {
        case 8:
                return (*ubh_get_addr (ubh, begin + block) == 0xff);
        case 4:
-                return (*ubh_get_addr (ubh, begin + (block >> 1)) == (0x0f << ((block & 0x01) << 2)));
+                mask = 0x0f << ((block & 0x01) << 2);
+                return (*ubh_get_addr (ubh, begin + (block >> 1)) & mask) == mask;
        case 2:
-                return (*ubh_get_addr (ubh, begin + (block >> 2)) == (0x03 << ((block & 0x03) << 1)));
+                mask = 0x03 << ((block & 0x03) << 1);
+                return (*ubh_get_addr (ubh, begin + (block >> 2)) & mask) == mask;
        case 1:
-                return (*ubh_get_addr (ubh, begin + (block >> 3)) == (0x01 << (block & 0x07)));
+                mask = 0x01 << (block & 0x07);
+                return (*ubh_get_addr (ubh, begin + (block >> 3)) & mask) == mask;
        }
        return 0;       
 }
diff --git a/include/linux/cgroup-defs.h b/include/linux/cgroup-defs.h
index 21745946cae1..ec47101cb1bf 100644
--- a/include/linux/cgroup-defs.h
+++ b/include/linux/cgroup-defs.h
@@ -48,6 +48,7 @@ enum {
        CSS_ONLINE      = (1 << 1), /* between ->css_online() and ->css_offline() */
        CSS_RELEASED    = (1 << 2), /* refcnt reached zero, released */
        CSS_VISIBLE     = (1 << 3), /* css is visible to userland */
+        CSS_DYING       = (1 << 4), /* css is dying */
 };
 /* bits in struct cgroup flags field */
diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
index ed2573e149fa..710a005c6b7a 100644
--- a/include/linux/cgroup.h
+++ b/include/linux/cgroup.h
@@ -344,6 +344,26 @@ static inline bool css_tryget_online(struct cgroup_subsys_state *css)
 }
 /**
+ * css_is_dying - test whether the specified css is dying
+ * @css: target css
+ *
+ * Test whether @css is in the process of offlining or already offline.  In
+ * most cases, ->css_online() and ->css_offline() callbacks should be
+ * enough; however, the actual offline operations are RCU delayed and this
+ * test returns %true also when @css is scheduled to be offlined.
+ *
+ * This is useful, for example, when the use case requires synchronous
+ * behavior with respect to cgroup removal.  cgroup removal schedules css
+ * offlining but the css can seem alive while the operation is being
+ * delayed.  If the delay affects user visible semantics, this test can be
+ * used to resolve the situation.
+ */
+static inline bool css_is_dying(struct cgroup_subsys_state *css)
+{
+        return !(css->flags & CSS_NO_REF) && percpu_ref_is_dying(&css->refcnt);
+}
+/**
 * css_put - put a css reference
 * @css: target css
 *
diff --git a/include/linux/compiler-clang.h b/include/linux/compiler-clang.h
index de179993e039..ea9126006a69 100644
--- a/include/linux/compiler-clang.h
+++ b/include/linux/compiler-clang.h
@@ -15,3 +15,10 @@
 * with any version that can compile the kernel
 */
 #define __UNIQUE_ID(prefix) __PASTE(__PASTE(__UNIQUE_ID_, prefix), __COUNTER__)
+/*
+ * GCC does not warn about unused static inline functions for
+ * -Wunused-function.  This turns out to avoid the need for complex #ifdef
+ * directives.  Suppress the warning in clang as well.
+ */
+#define inline inline __attribute__((unused))
diff --git a/include/linux/dma-iommu.h b/include/linux/dma-iommu.h
index 4eac2670bfa1..92f20832fd28 100644
--- a/include/linux/dma-iommu.h
+++ b/include/linux/dma-iommu.h
@@ -78,6 +78,7 @@ void iommu_dma_get_resv_regions(struct device *dev, struct list_head *list);
 struct iommu_domain;
 struct msi_msg;
+struct device;
 static inline int iommu_dma_init(void)
 {
diff --git a/include/linux/elevator.h b/include/linux/elevator.h
index 9ec5e22846e0..0e306c5a86d6 100644
--- a/include/linux/elevator.h
+++ b/include/linux/elevator.h
@@ -153,7 +153,7 @@ struct elevator_type
 #endif
        /* managed by elevator core */
-        char icq_cache_name[ELV_NAME_MAX + 5];  /* elvname + "_io_cq" */
+        char icq_cache_name[ELV_NAME_MAX + 6];  /* elvname + "_io_cq" */
        struct list_head list;
 };
diff --git a/include/linux/mlx4/qp.h b/include/linux/mlx4/qp.h
index b4ee8f62ce8d..8e2828d48d7f 100644
--- a/include/linux/mlx4/qp.h
+++ b/include/linux/mlx4/qp.h
@@ -470,6 +470,7 @@ struct mlx4_update_qp_params {
        u16     rate_val;
 };
+struct mlx4_qp *mlx4_qp_lookup(struct mlx4_dev *dev, u32 qpn);
 int mlx4_update_qp(struct mlx4_dev *dev, u32 qpn,
                   enum mlx4_update_qp_attr attr,
                   struct mlx4_update_qp_params *params);
diff --git a/include/linux/srcu.h b/include/linux/srcu.h
index 167ad8831aaf..4c1d5f7e62c4 100644
--- a/include/linux/srcu.h
+++ b/include/linux/srcu.h
@@ -172,9 +172,7 @@ static inline int srcu_read_lock(struct srcu_struct *sp) __acquires(sp)
 {
        int retval;
-        preempt_disable();
        retval = __srcu_read_lock(sp);
-        preempt_enable();
        rcu_lock_acquire(&(sp)->dep_map);
        return retval;
 }
diff --git a/include/linux/suspend.h b/include/linux/suspend.h
index 0b1cf32edfd7..d9718378a8be 100644
--- a/include/linux/suspend.h
+++ b/include/linux/suspend.h
@@ -189,8 +189,6 @@ struct platform_suspend_ops {
 struct platform_freeze_ops {
        int (*begin)(void);
        int (*prepare)(void);
-        void (*wake)(void);
-        void (*sync)(void);
        void (*restore)(void);
        void (*end)(void);
 };
@@ -430,8 +428,7 @@ extern unsigned int pm_wakeup_irq;
 extern bool pm_wakeup_pending(void);
 extern void pm_system_wakeup(void);
-extern void pm_system_cancel_wakeup(void);
+extern void pm_wakeup_clear(void);
-extern void pm_wakeup_clear(bool reset);
 extern void pm_system_irq_wakeup(unsigned int irq_number);
 extern bool pm_get_wakeup_count(unsigned int *count, bool block);
 extern bool pm_save_wakeup_count(unsigned int count);
@@ -481,7 +478,7 @@ static inline int unregister_pm_notifier(struct notifier_block *nb)
 static inline bool pm_wakeup_pending(void) { return false; }
 static inline void pm_system_wakeup(void) {}
-static inline void pm_wakeup_clear(bool reset) {}
+static inline void pm_wakeup_clear(void) {}
 static inline void pm_system_irq_wakeup(unsigned int irq_number) {}
 static inline void lock_system_sleep(void) {}
diff --git a/include/media/cec-notifier.h b/include/media/cec-notifier.h
index eb50ce54b759..413335c8cb52 100644
--- a/include/media/cec-notifier.h
+++ b/include/media/cec-notifier.h
@@ -29,7 +29,7 @@ struct edid;
 struct cec_adapter;
 struct cec_notifier;
-#ifdef CONFIG_MEDIA_CEC_NOTIFIER
+#if IS_REACHABLE(CONFIG_CEC_CORE) && IS_ENABLED(CONFIG_CEC_NOTIFIER)
 /**
 * cec_notifier_get - find or create a new cec_notifier for the given device.
diff --git a/include/media/cec.h b/include/media/cec.h
index b8eb895731d5..bfa88d4d67e1 100644
--- a/include/media/cec.h
+++ b/include/media/cec.h
@@ -173,7 +173,7 @@ struct cec_adapter {
        bool passthrough;
        struct cec_log_addrs log_addrs;
-#ifdef CONFIG_MEDIA_CEC_NOTIFIER
+#ifdef CONFIG_CEC_NOTIFIER
        struct cec_notifier *notifier;
 #endif
@@ -300,7 +300,7 @@ u16 cec_phys_addr_for_input(u16 phys_addr, u8 input);
 */
 int cec_phys_addr_validate(u16 phys_addr, u16 *parent, u16 *port);
-#ifdef CONFIG_MEDIA_CEC_NOTIFIER
+#ifdef CONFIG_CEC_NOTIFIER
 void cec_register_cec_notifier(struct cec_adapter *adap,
                               struct cec_notifier *notifier);
 #endif
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index dbf0abba33b8..3e505bbff8ca 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -1007,6 +1007,7 @@ int inet6_hash_connect(struct inet_timewait_death_row *death_row,
 */
 extern const struct proto_ops inet6_stream_ops;
 extern const struct proto_ops inet6_dgram_ops;
+extern const struct proto_ops inet6_sockraw_ops;
 struct group_source_req;
 struct group_filter;
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 38a7427ae902..be6223c586fa 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -924,7 +924,7 @@ struct tcp_congestion_ops {
        void (*cwnd_event)(struct sock *sk, enum tcp_ca_event ev);
        /* call when ack arrives (optional) */
        void (*in_ack_event)(struct sock *sk, u32 flags);
-        /* new value of cwnd after loss (optional) */
+        /* new value of cwnd after loss (required) */
        u32  (*undo_cwnd)(struct sock *sk);
        /* hook for packet ack accounting (optional) */
        void (*pkts_acked)(struct sock *sk, const struct ack_sample *sample);
diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index c3c9a0e1b3c9..8d4e85eae42c 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -4265,6 +4265,11 @@ static void kill_css(struct cgroup_subsys_state *css)
 {
        lockdep_assert_held(&cgroup_mutex);
+        if (css->flags & CSS_DYING)
+                return;
+        css->flags |= CSS_DYING;
        /*
         * This must happen before css is disassociated with its cgroup.
         * See seq_css() for details.
diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
index f6501f4f6040..ae643412948a 100644
--- a/kernel/cgroup/cpuset.c
+++ b/kernel/cgroup/cpuset.c
@@ -176,9 +176,9 @@ typedef enum {
 } cpuset_flagbits_t;
 /* convenient tests for these bits */
-static inline bool is_cpuset_online(const struct cpuset *cs)
+static inline bool is_cpuset_online(struct cpuset *cs)
 {
-        return test_bit(CS_ONLINE, &cs->flags);
+        return test_bit(CS_ONLINE, &cs->flags) && !css_is_dying(&cs->css);
 }
 static inline int is_cpu_exclusive(const struct cpuset *cs)
diff --git a/kernel/cpu.c b/kernel/cpu.c
index 9ae6fbe5b5cf..cb5103413bd8 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -1658,13 +1658,13 @@ static ssize_t write_cpuhp_target(struct device *dev,
        ret = !sp->name || sp->cant_stop ? -EINVAL : 0;
        mutex_unlock(&cpuhp_state_mutex);
        if (ret)
-                return ret;
+                goto out;
        if (st->state < target)
                ret = do_cpu_up(dev->id, target);
        else
                ret = do_cpu_down(dev->id, target);
+out:
        unlock_device_hotplug();
        return ret ? ret : count;
 }
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 6e75a5c9412d..6c4e523dc1e2 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -7316,6 +7316,21 @@ int perf_event_account_interrupt(struct perf_event *event)
        return __perf_event_account_interrupt(event, 1);
 }
+static bool sample_is_allowed(struct perf_event *event, struct pt_regs *regs)
+{
+        /*
+         * Due to interrupt latency (AKA "skid"), we may enter the
+         * kernel before taking an overflow, even if the PMU is only
+         * counting user events.
+         * To avoid leaking information to userspace, we must always
+         * reject kernel samples when exclude_kernel is set.
+         */
+        if (event->attr.exclude_kernel && !user_mode(regs))
+                return false;
+        return true;
+}
 /*
 * Generic event overflow handling, sampling.
 */
@@ -7337,6 +7352,12 @@ static int __perf_event_overflow(struct perf_event *event,
        ret = __perf_event_account_interrupt(event, throttle);
        /*
+         * For security, drop the skid kernel samples if necessary.
+         */
+        if (!sample_is_allowed(event, regs))
+                return ret;
+        /*
         * XXX event_limit might not quite work as expected on inherited
         * events
         */
diff --git a/kernel/power/process.c b/kernel/power/process.c
index 78672d324a6e..c7209f060eeb 100644
--- a/kernel/power/process.c
+++ b/kernel/power/process.c
@@ -132,7 +132,7 @@ int freeze_processes(void)
        if (!pm_freezing)
                atomic_inc(&system_freezing_cnt);
-        pm_wakeup_clear(true);
+        pm_wakeup_clear();
        pr_info("Freezing user space processes ... ");
        pm_freezing = true;
        error = try_to_freeze_tasks(true);
diff --git a/kernel/power/suspend.c b/kernel/power/suspend.c
index c0248c74d6d4..15e6baef5c73 100644
--- a/kernel/power/suspend.c
+++ b/kernel/power/suspend.c
@@ -72,8 +72,6 @@ static void freeze_begin(void)
 static void freeze_enter(void)
 {
-        trace_suspend_resume(TPS("machine_suspend"), PM_SUSPEND_FREEZE, true);
        spin_lock_irq(&suspend_freeze_lock);
        if (pm_wakeup_pending())
                goto out;
@@ -100,27 +98,6 @@ static void freeze_enter(void)
 out:
        suspend_freeze_state = FREEZE_STATE_NONE;
        spin_unlock_irq(&suspend_freeze_lock);
-        trace_suspend_resume(TPS("machine_suspend"), PM_SUSPEND_FREEZE, false);
-}
-static void s2idle_loop(void)
-{
-        do {
-                freeze_enter();
-                if (freeze_ops && freeze_ops->wake)
-                        freeze_ops->wake();
-                dpm_resume_noirq(PMSG_RESUME);
-                if (freeze_ops && freeze_ops->sync)
-                        freeze_ops->sync();
-                if (pm_wakeup_pending())
-                        break;
-                pm_wakeup_clear(false);
-        } while (!dpm_suspend_noirq(PMSG_SUSPEND));
 }
 void freeze_wake(void)
@@ -394,8 +371,10 @@ static int suspend_enter(suspend_state_t state, bool *wakeup)
         * all the devices are suspended.
         */
        if (state == PM_SUSPEND_FREEZE) {
-                s2idle_loop();
+                trace_suspend_resume(TPS("machine_suspend"), state, true);
-                goto Platform_early_resume;
+                freeze_enter();
+                trace_suspend_resume(TPS("machine_suspend"), state, false);
+                goto Platform_wake;
        }
        error = disable_nonboot_cpus();
diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index a1aecf44ab07..a1db38abac5b 100644
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -269,7 +269,6 @@ static struct console *exclusive_console;
 #define MAX_CMDLINECONSOLES 8
 static struct console_cmdline console_cmdline[MAX_CMDLINECONSOLES];
-static int console_cmdline_cnt;
 static int preferred_console = -1;
 int console_set_on_cmdline;
@@ -1906,25 +1905,12 @@ static int __add_preferred_console(char *name, int idx, char *options,
         *      See if this tty is not yet registered, and
         *      if we have a slot free.
         */
-        for (i = 0, c = console_cmdline; i < console_cmdline_cnt; i++, c++) {
+        for (i = 0, c = console_cmdline;
+             i < MAX_CMDLINECONSOLES && c->name[0];
+             i++, c++) {
                if (strcmp(c->name, name) == 0 && c->index == idx) {
-                        if (brl_options)
+                        if (!brl_options)
-                                return 0;
+                                preferred_console = i;
-                        /*
-                         * Maintain an invariant that will help to find if
-                         * the matching console is preferred, see
-                         * register_console():
-                         *
-                         * The last non-braille console is always
-                         * the preferred one.
-                         */
-                        if (i != console_cmdline_cnt - 1)
-                                swap(console_cmdline[i],
-                                     console_cmdline[console_cmdline_cnt - 1]);
-                        preferred_console = console_cmdline_cnt - 1;
                        return 0;
                }
        }
@@ -1937,7 +1923,6 @@ static int __add_preferred_console(char *name, int idx, char *options,
        braille_set_options(c, brl_options);
        c->index = idx;
-        console_cmdline_cnt++;
        return 0;
 }
 /*
@@ -2477,23 +2462,12 @@ void register_console(struct console *newcon)
        }
        /*
-         * See if this console matches one we selected on the command line.
+         *      See if this console matches one we selected on
-         *
+         *      the command line.
-         * There may be several entries in the console_cmdline array matching
-         * with the same console, one with newcon->match(), another by
-         * name/index:
-         *
-         *      pl011,mmio,0x87e024000000,115200 -- added from SPCR
-         *      ttyAMA0 -- added from command line
-         *
-         * Traverse the console_cmdline array in reverse order to be
-         * sure that if this console is preferred then it will be the first
-         * matching entry.  We use the invariant that is maintained in
-         * __add_preferred_console().
         */
-        for (i = console_cmdline_cnt - 1; i >= 0; i--) {
+        for (i = 0, c = console_cmdline;
-                c = console_cmdline + i;
+             i < MAX_CMDLINECONSOLES && c->name[0];
+             i++, c++) {
                if (!newcon->match ||
                    newcon->match(newcon, c->name, c->index, c->options) != 0) {
                        /* default matching */
diff --git a/kernel/rcu/srcu.c b/kernel/rcu/srcu.c
index 584d8a983883..dea03614263f 100644
--- a/kernel/rcu/srcu.c
+++ b/kernel/rcu/srcu.c
@@ -263,7 +263,7 @@ EXPORT_SYMBOL_GPL(cleanup_srcu_struct);
 /*
 * Counts the new reader in the appropriate per-CPU element of the
- * srcu_struct.  Must be called from process context.
+ * srcu_struct.
 * Returns an index that must be passed to the matching srcu_read_unlock().
 */
 int __srcu_read_lock(struct srcu_struct *sp)
@@ -271,7 +271,7 @@ int __srcu_read_lock(struct srcu_struct *sp)
        int idx;
        idx = READ_ONCE(sp->completed) & 0x1;
-        __this_cpu_inc(sp->per_cpu_ref->lock_count[idx]);
+        this_cpu_inc(sp->per_cpu_ref->lock_count[idx]);
        smp_mb(); /* B */  /* Avoid leaking the critical section. */
        return idx;
 }
@@ -281,7 +281,6 @@ EXPORT_SYMBOL_GPL(__srcu_read_lock);
 * Removes the count for the old reader from the appropriate per-CPU
 * element of the srcu_struct.  Note that this may well be a different
 * CPU than that which was incremented by the corresponding srcu_read_lock().
- * Must be called from process context.
 */
 void __srcu_read_unlock(struct srcu_struct *sp, int idx)
 {
diff --git a/kernel/rcu/srcutiny.c b/kernel/rcu/srcutiny.c
index 36e1f82faed1..32798eb14853 100644
--- a/kernel/rcu/srcutiny.c
+++ b/kernel/rcu/srcutiny.c
@@ -97,8 +97,9 @@ EXPORT_SYMBOL_GPL(cleanup_srcu_struct);
 /*
 * Counts the new reader in the appropriate per-CPU element of the
- * srcu_struct.  Must be called from process context.
+ * srcu_struct.  Can be invoked from irq/bh handlers, but the matching
- * Returns an index that must be passed to the matching srcu_read_unlock().
+ * __srcu_read_unlock() must be in the same handler instance.  Returns an
+ * index that must be passed to the matching srcu_read_unlock().
 */
 int __srcu_read_lock(struct srcu_struct *sp)
 {
@@ -112,7 +113,7 @@ EXPORT_SYMBOL_GPL(__srcu_read_lock);
 /*
 * Removes the count for the old reader from the appropriate element of
- * the srcu_struct.  Must be called from process context.
+ * the srcu_struct.
 */
 void __srcu_read_unlock(struct srcu_struct *sp, int idx)
 {
diff --git a/kernel/rcu/srcutree.c b/kernel/rcu/srcutree.c
index 3ae8474557df..157654fa436a 100644
--- a/kernel/rcu/srcutree.c
+++ b/kernel/rcu/srcutree.c
@@ -357,7 +357,7 @@ EXPORT_SYMBOL_GPL(cleanup_srcu_struct);
 /*
 * Counts the new reader in the appropriate per-CPU element of the
- * srcu_struct.  Must be called from process context.
+ * srcu_struct.
 * Returns an index that must be passed to the matching srcu_read_unlock().
 */
 int __srcu_read_lock(struct srcu_struct *sp)
@@ -365,7 +365,7 @@ int __srcu_read_lock(struct srcu_struct *sp)
        int idx;
        idx = READ_ONCE(sp->srcu_idx) & 0x1;
-        __this_cpu_inc(sp->sda->srcu_lock_count[idx]);
+        this_cpu_inc(sp->sda->srcu_lock_count[idx]);
        smp_mb(); /* B */  /* Avoid leaking the critical section. */
        return idx;
 }
@@ -375,7 +375,6 @@ EXPORT_SYMBOL_GPL(__srcu_read_lock);
 * Removes the count for the old reader from the appropriate per-CPU
 * element of the srcu_struct.  Note that this may well be a different
 * CPU than that which was incremented by the corresponding srcu_read_lock().
- * Must be called from process context.
 */
 void __srcu_read_unlock(struct srcu_struct *sp, int idx)
 {
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 803c3bc274c4..326d4f88e2b1 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -5605,7 +5605,7 @@ void idle_task_exit(void)
        BUG_ON(cpu_online(smp_processor_id()));
        if (mm != &init_mm) {
-                switch_mm_irqs_off(mm, &init_mm, current);
+                switch_mm(mm, &init_mm, current);
                finish_arch_post_lock_switch();
        }
        mmdrop(mm);
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index d71109321841..c77e4b1d51c0 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -3563,7 +3563,7 @@ static inline void check_schedstat_required(void)
                        trace_sched_stat_runtime_enabled())  {
                printk_deferred_once("Scheduler tracepoints stat_sleep, stat_iowait, "
                             "stat_blocked and stat_runtime require the "
-                             "kernel parameter schedstats=enabled or "
+                             "kernel parameter schedstats=enable or "
                             "kernel.sched_schedstats=1\n");
        }
 #endif
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index 574f78824d8a..32bd3ead9ba1 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -595,7 +595,7 @@ static int br_afspec(struct net_bridge *br,
                err = 0;
                switch (nla_type(attr)) {
                case IFLA_BRIDGE_VLAN_TUNNEL_INFO:
-                        if (!(p->flags & BR_VLAN_TUNNEL))
+                        if (!p || !(p->flags & BR_VLAN_TUNNEL))
                                return -EINVAL;
                        err = br_parse_vlan_tunnel_info(attr, &tinfo_curr);
                        if (err)
diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
index 0db8102995a5..6f12a5271219 100644
--- a/net/bridge/br_stp_if.c
+++ b/net/bridge/br_stp_if.c
@@ -179,7 +179,8 @@ static void br_stp_start(struct net_bridge *br)
                br_debug(br, "using kernel STP\n");
                /* To start timers on any ports left in blocking */
-                mod_timer(&br->hello_timer, jiffies + br->hello_time);
+                if (br->dev->flags & IFF_UP)
+                        mod_timer(&br->hello_timer, jiffies + br->hello_time);
                br_port_state_selection(br);
        }
diff --git a/net/core/devlink.c b/net/core/devlink.c
index b0b87a292e7c..a0adfc31a3fe 100644
--- a/net/core/devlink.c
+++ b/net/core/devlink.c
@@ -1680,8 +1680,10 @@ start_again:
        hdr = genlmsg_put(skb, info->snd_portid, info->snd_seq,
                          &devlink_nl_family, NLM_F_MULTI, cmd);
-        if (!hdr)
+        if (!hdr) {
+                nlmsg_free(skb);
                return -EMSGSIZE;
+        }
        if (devlink_nl_put_handle(skb, devlink))
                goto nla_put_failure;
@@ -2098,8 +2100,10 @@ start_again:
        hdr = genlmsg_put(skb, info->snd_portid, info->snd_seq,
                          &devlink_nl_family, NLM_F_MULTI, cmd);
-        if (!hdr)
+        if (!hdr) {
+                nlmsg_free(skb);
                return -EMSGSIZE;
+        }
        if (devlink_nl_put_handle(skb, devlink))
                goto nla_put_failure;
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 346d3e85dfbc..b1be7c01efe2 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3754,8 +3754,11 @@ struct sk_buff *sock_dequeue_err_skb(struct sock *sk)
        spin_lock_irqsave(&q->lock, flags);
        skb = __skb_dequeue(q);
-        if (skb && (skb_next = skb_peek(q)))
+        if (skb && (skb_next = skb_peek(q))) {
                icmp_next = is_icmp_err_skb(skb_next);
+                if (icmp_next)
+                        sk->sk_err = SKB_EXT_ERR(skb_next)->ee.ee_origin;
+        }
        spin_unlock_irqrestore(&q->lock, flags);
        if (is_icmp_err_skb(skb) && !icmp_next)
diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c
index 26130ae438da..90038d45a547 100644
--- a/net/dsa/dsa.c
+++ b/net/dsa/dsa.c
@@ -223,6 +223,53 @@ static int dsa_switch_rcv(struct sk_buff *skb, struct net_device *dev,
        return 0;
 }
+#ifdef CONFIG_PM_SLEEP
+int dsa_switch_suspend(struct dsa_switch *ds)
+{
+        int i, ret = 0;
+        /* Suspend slave network devices */
+        for (i = 0; i < ds->num_ports; i++) {
+                if (!dsa_is_port_initialized(ds, i))
+                        continue;
+                ret = dsa_slave_suspend(ds->ports[i].netdev);
+                if (ret)
+                        return ret;
+        }
+        if (ds->ops->suspend)
+                ret = ds->ops->suspend(ds);
+        return ret;
+}
+EXPORT_SYMBOL_GPL(dsa_switch_suspend);
+int dsa_switch_resume(struct dsa_switch *ds)
+{
+        int i, ret = 0;
+        if (ds->ops->resume)
+                ret = ds->ops->resume(ds);
+        if (ret)
+                return ret;
+        /* Resume slave network devices */
+        for (i = 0; i < ds->num_ports; i++) {
+                if (!dsa_is_port_initialized(ds, i))
+                        continue;
+                ret = dsa_slave_resume(ds->ports[i].netdev);
+                if (ret)
+                        return ret;
+        }
+        return 0;
+}
+EXPORT_SYMBOL_GPL(dsa_switch_resume);
+#endif
 static struct packet_type dsa_pack_type __read_mostly = {
        .type   = cpu_to_be16(ETH_P_XDSA),
        .func   = dsa_switch_rcv,
diff --git a/net/dsa/dsa2.c b/net/dsa/dsa2.c
index 033b3bfb63dc..7796580e99ee 100644
--- a/net/dsa/dsa2.c
+++ b/net/dsa/dsa2.c
@@ -484,8 +484,10 @@ static void dsa_dst_unapply(struct dsa_switch_tree *dst)
                dsa_ds_unapply(dst, ds);
        }
-        if (dst->cpu_switch)
+        if (dst->cpu_switch) {
                dsa_cpu_port_ethtool_restore(dst->cpu_switch);
+                dst->cpu_switch = NULL;
+        }
        pr_info("DSA: tree %d unapplied\n", dst->tree);
        dst->applied = false;
diff --git a/net/dsa/legacy.c b/net/dsa/legacy.c
index ad345c8b0b06..7281098df04e 100644
--- a/net/dsa/legacy.c
+++ b/net/dsa/legacy.c
@@ -289,53 +289,6 @@ static void dsa_switch_destroy(struct dsa_switch *ds)
        dsa_switch_unregister_notifier(ds);
 }
-#ifdef CONFIG_PM_SLEEP
-int dsa_switch_suspend(struct dsa_switch *ds)
-{
-        int i, ret = 0;
-        /* Suspend slave network devices */
-        for (i = 0; i < ds->num_ports; i++) {
-                if (!dsa_is_port_initialized(ds, i))
-                        continue;
-                ret = dsa_slave_suspend(ds->ports[i].netdev);
-                if (ret)
-                        return ret;
-        }
-        if (ds->ops->suspend)
-                ret = ds->ops->suspend(ds);
-        return ret;
-}
-EXPORT_SYMBOL_GPL(dsa_switch_suspend);
-int dsa_switch_resume(struct dsa_switch *ds)
-{
-        int i, ret = 0;
-        if (ds->ops->resume)
-                ret = ds->ops->resume(ds);
-        if (ret)
-                return ret;
-        /* Resume slave network devices */
-        for (i = 0; i < ds->num_ports; i++) {
-                if (!dsa_is_port_initialized(ds, i))
-                        continue;
-                ret = dsa_slave_resume(ds->ports[i].netdev);
-                if (ret)
-                        return ret;
-        }
-        return 0;
-}
-EXPORT_SYMBOL_GPL(dsa_switch_resume);
-#endif
 /* platform driver init and cleanup *****************************************/
 static int dev_is_class(struct device *dev, void *class)
 {
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index f3dad1661343..58925b6597de 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1043,7 +1043,7 @@ static struct inet_protosw inetsw_array[] =
                .type =       SOCK_DGRAM,
                .protocol =   IPPROTO_ICMP,
                .prot =       &ping_prot,
-                .ops =        &inet_dgram_ops,
+                .ops =        &inet_sockraw_ops,
                .flags =      INET_PROTOSW_REUSE,
       },
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 59792d283ff8..b5ea036ca781 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2381,9 +2381,10 @@ static int tcp_repair_set_window(struct tcp_sock *tp, char __user *optbuf, int l
        return 0;
 }
-static int tcp_repair_options_est(struct tcp_sock *tp,
+static int tcp_repair_options_est(struct sock *sk,
                struct tcp_repair_opt __user *optbuf, unsigned int len)
 {
+        struct tcp_sock *tp = tcp_sk(sk);
        struct tcp_repair_opt opt;
        while (len >= sizeof(opt)) {
@@ -2396,6 +2397,7 @@ static int tcp_repair_options_est(struct tcp_sock *tp,
                switch (opt.opt_code) {
                case TCPOPT_MSS:
                        tp->rx_opt.mss_clamp = opt.opt_val;
+                        tcp_mtup_init(sk);
                        break;
                case TCPOPT_WINDOW:
                        {
@@ -2555,7 +2557,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
                if (!tp->repair)
                        err = -EINVAL;
                else if (sk->sk_state == TCP_ESTABLISHED)
-                        err = tcp_repair_options_est(tp,
+                        err = tcp_repair_options_est(sk,
                                        (struct tcp_repair_opt __user *)optval,
                                        optlen);
                else
diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
index 6e3c512054a6..324c9bcc5456 100644
--- a/net/ipv4/tcp_cong.c
+++ b/net/ipv4/tcp_cong.c
@@ -180,6 +180,7 @@ void tcp_init_congestion_control(struct sock *sk)
 {
        const struct inet_connection_sock *icsk = inet_csk(sk);
+        tcp_sk(sk)->prior_ssthresh = 0;
        if (icsk->icsk_ca_ops->init)
                icsk->icsk_ca_ops->init(sk);
        if (tcp_ca_needs_ecn(sk))
diff --git a/net/ipv6/calipso.c b/net/ipv6/calipso.c
index 37ac9de713c6..8d772fea1dde 100644
--- a/net/ipv6/calipso.c
+++ b/net/ipv6/calipso.c
@@ -1319,7 +1319,7 @@ static int calipso_skbuff_setattr(struct sk_buff *skb,
        struct ipv6hdr *ip6_hdr;
        struct ipv6_opt_hdr *hop;
        unsigned char buf[CALIPSO_MAX_BUFFER];
-        int len_delta, new_end, pad;
+        int len_delta, new_end, pad, payload;
        unsigned int start, end;
        ip6_hdr = ipv6_hdr(skb);
@@ -1346,6 +1346,8 @@ static int calipso_skbuff_setattr(struct sk_buff *skb,
        if (ret_val < 0)
                return ret_val;
+        ip6_hdr = ipv6_hdr(skb); /* Reset as skb_cow() may have moved it */
        if (len_delta) {
                if (len_delta > 0)
                        skb_push(skb, len_delta);
@@ -1355,6 +1357,8 @@ static int calipso_skbuff_setattr(struct sk_buff *skb,
                        sizeof(*ip6_hdr) + start);
                skb_reset_network_header(skb);
                ip6_hdr = ipv6_hdr(skb);
+                payload = ntohs(ip6_hdr->payload_len);
+                ip6_hdr->payload_len = htons(payload + len_delta);
        }
        hop = (struct ipv6_opt_hdr *)(ip6_hdr + 1);
diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
index 280268f1dd7b..cdb3728faca7 100644
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c
@@ -116,8 +116,10 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
                if (udpfrag) {
                        int err = ip6_find_1stfragopt(skb, &prevhdr);
-                        if (err < 0)
+                        if (err < 0) {
+                                kfree_skb_list(segs);
                                return ERR_PTR(err);
+                        }
                        fptr = (struct frag_hdr *)((u8 *)ipv6h + err);
                        fptr->frag_off = htons(offset);
                        if (skb->next)
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 7ae6c503f1ca..9b37f9747fc6 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1095,6 +1095,9 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield,
        if (!dst) {
 route_lookup:
+                /* add dsfield to flowlabel for route lookup */
+                fl6->flowlabel = ip6_make_flowinfo(dsfield, fl6->flowlabel);
                dst = ip6_route_output(net, NULL, fl6);
                if (dst->error)
diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c
index 9b522fa90e6d..ac826dd338ff 100644
--- a/net/ipv6/ping.c
+++ b/net/ipv6/ping.c
@@ -192,7 +192,7 @@ static struct inet_protosw pingv6_protosw = {
        .type =      SOCK_DGRAM,
        .protocol =  IPPROTO_ICMPV6,
        .prot =      &pingv6_prot,
-        .ops =       &inet6_dgram_ops,
+        .ops =       &inet6_sockraw_ops,
        .flags =     INET_PROTOSW_REUSE,
 };
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 1f992d9e261d..60be012fe708 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -1338,7 +1338,7 @@ void raw6_proc_exit(void)
 #endif  /* CONFIG_PROC_FS */
 /* Same as inet6_dgram_ops, sans udp_poll.  */
-static const struct proto_ops inet6_sockraw_ops = {
+const struct proto_ops inet6_sockraw_ops = {
        .family            = PF_INET6,
        .owner             = THIS_MODULE,
        .release           = inet6_release,
diff --git a/net/ipv6/xfrm6_mode_ro.c b/net/ipv6/xfrm6_mode_ro.c
index 0e015906f9ca..07d36573f50b 100644
--- a/net/ipv6/xfrm6_mode_ro.c
+++ b/net/ipv6/xfrm6_mode_ro.c
@@ -47,6 +47,8 @@ static int xfrm6_ro_output(struct xfrm_state *x, struct sk_buff *skb)
        iph = ipv6_hdr(skb);
        hdr_len = x->type->hdr_offset(x, skb, &prevhdr);
+        if (hdr_len < 0)
+                return hdr_len;
        skb_set_mac_header(skb, (prevhdr - x->props.header_len) - skb->data);
        skb_set_network_header(skb, -x->props.header_len);
        skb->transport_header = skb->network_header + hdr_len;
diff --git a/net/ipv6/xfrm6_mode_transport.c b/net/ipv6/xfrm6_mode_transport.c
index 7a92c0f31912..9ad07a91708e 100644
--- a/net/ipv6/xfrm6_mode_transport.c
+++ b/net/ipv6/xfrm6_mode_transport.c
@@ -30,6 +30,8 @@ static int xfrm6_transport_output(struct xfrm_state *x, struct sk_buff *skb)
        skb_set_inner_transport_header(skb, skb_transport_offset(skb));
        hdr_len = x->type->hdr_offset(x, skb, &prevhdr);
+        if (hdr_len < 0)
+                return hdr_len;
        skb_set_mac_header(skb, (prevhdr - x->props.header_len) - skb->data);
        skb_set_network_header(skb, -x->props.header_len);
        skb->transport_header = skb->network_header + hdr_len;
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 60e2a62f7bef..cf2392b2ac71 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -7,7 +7,7 @@
 * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
 * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
 * Copyright 2007-2010, Intel Corporation
- * Copyright(c) 2015 Intel Deutschland GmbH
+ * Copyright(c) 2015-2017 Intel Deutschland GmbH
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
@@ -741,46 +741,43 @@ static void ieee80211_agg_tx_operational(struct ieee80211_local *local,
        ieee80211_agg_start_txq(sta, tid, true);
 }
-void ieee80211_start_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u16 tid)
+void ieee80211_start_tx_ba_cb(struct sta_info *sta, int tid,
+                              struct tid_ampdu_tx *tid_tx)
 {
-        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
        struct ieee80211_local *local = sdata->local;
-        struct sta_info *sta;
-        struct tid_ampdu_tx *tid_tx;
-        trace_api_start_tx_ba_cb(sdata, ra, tid);
+        if (WARN_ON(test_and_set_bit(HT_AGG_STATE_DRV_READY, &tid_tx->state)))
+                return;
+        if (test_bit(HT_AGG_STATE_RESPONSE_RECEIVED, &tid_tx->state))
+                ieee80211_agg_tx_operational(local, sta, tid);
+}
+static struct tid_ampdu_tx *
+ieee80211_lookup_tid_tx(struct ieee80211_sub_if_data *sdata,
+                        const u8 *ra, u16 tid, struct sta_info **sta)
+{
+        struct tid_ampdu_tx *tid_tx;
        if (tid >= IEEE80211_NUM_TIDS) {
                ht_dbg(sdata, "Bad TID value: tid = %d (>= %d)\n",
                       tid, IEEE80211_NUM_TIDS);
-                return;
+                return NULL;
        }
-        mutex_lock(&local->sta_mtx);
+        *sta = sta_info_get_bss(sdata, ra);
-        sta = sta_info_get_bss(sdata, ra);
+        if (!*sta) {
-        if (!sta) {
-                mutex_unlock(&local->sta_mtx);
                ht_dbg(sdata, "Could not find station: %pM\n", ra);
-                return;
+                return NULL;
        }
-        mutex_lock(&sta->ampdu_mlme.mtx);
+        tid_tx = rcu_dereference((*sta)->ampdu_mlme.tid_tx[tid]);
-        tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
-        if (WARN_ON(!tid_tx)) {
+        if (WARN_ON(!tid_tx))
                ht_dbg(sdata, "addBA was not requested!\n");
-                goto unlock;
-        }
-        if (WARN_ON(test_and_set_bit(HT_AGG_STATE_DRV_READY, &tid_tx->state)))
+        return tid_tx;
-                goto unlock;
-        if (test_bit(HT_AGG_STATE_RESPONSE_RECEIVED, &tid_tx->state))
-                ieee80211_agg_tx_operational(local, sta, tid);
- unlock:
-        mutex_unlock(&sta->ampdu_mlme.mtx);
-        mutex_unlock(&local->sta_mtx);
 }
 void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
@@ -788,19 +785,20 @@ void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
 {
        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_ra_tid *ra_tid;
+        struct sta_info *sta;
-        struct sk_buff *skb = dev_alloc_skb(0);
+        struct tid_ampdu_tx *tid_tx;
-        if (unlikely(!skb))
+        trace_api_start_tx_ba_cb(sdata, ra, tid);
-                return;
-        ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
+        rcu_read_lock();
-        memcpy(&ra_tid->ra, ra, ETH_ALEN);
+        tid_tx = ieee80211_lookup_tid_tx(sdata, ra, tid, &sta);
-        ra_tid->tid = tid;
+        if (!tid_tx)
+                goto out;
-        skb->pkt_type = IEEE80211_SDATA_QUEUE_AGG_START;
+        set_bit(HT_AGG_STATE_START_CB, &tid_tx->state);
-        skb_queue_tail(&sdata->skb_queue, skb);
+        ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work);
-        ieee80211_queue_work(&local->hw, &sdata->work);
+ out:
+        rcu_read_unlock();
 }
 EXPORT_SYMBOL(ieee80211_start_tx_ba_cb_irqsafe);
@@ -860,37 +858,18 @@ int ieee80211_stop_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid)
 }
 EXPORT_SYMBOL(ieee80211_stop_tx_ba_session);
-void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid)
+void ieee80211_stop_tx_ba_cb(struct sta_info *sta, int tid,
+                             struct tid_ampdu_tx *tid_tx)
 {
-        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
-        struct ieee80211_local *local = sdata->local;
-        struct sta_info *sta;
-        struct tid_ampdu_tx *tid_tx;
        bool send_delba = false;
-        trace_api_stop_tx_ba_cb(sdata, ra, tid);
+        ht_dbg(sdata, "Stopping Tx BA session for %pM tid %d\n",
+               sta->sta.addr, tid);
-        if (tid >= IEEE80211_NUM_TIDS) {
-                ht_dbg(sdata, "Bad TID value: tid = %d (>= %d)\n",
-                       tid, IEEE80211_NUM_TIDS);
-                return;
-        }
-        ht_dbg(sdata, "Stopping Tx BA session for %pM tid %d\n", ra, tid);
-        mutex_lock(&local->sta_mtx);
-        sta = sta_info_get_bss(sdata, ra);
-        if (!sta) {
-                ht_dbg(sdata, "Could not find station: %pM\n", ra);
-                goto unlock;
-        }
-        mutex_lock(&sta->ampdu_mlme.mtx);
        spin_lock_bh(&sta->lock);
-        tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
-        if (!tid_tx || !test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
+        if (!test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
                ht_dbg(sdata,
                       "unexpected callback to A-MPDU stop for %pM tid %d\n",
                       sta->sta.addr, tid);
@@ -906,12 +885,8 @@ void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid)
        spin_unlock_bh(&sta->lock);
        if (send_delba)
-                ieee80211_send_delba(sdata, ra, tid,
+                ieee80211_send_delba(sdata, sta->sta.addr, tid,
                        WLAN_BACK_INITIATOR, WLAN_REASON_QSTA_NOT_USE);
-        mutex_unlock(&sta->ampdu_mlme.mtx);
- unlock:
-        mutex_unlock(&local->sta_mtx);
 }
 void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
@@ -919,19 +894,20 @@ void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
 {
        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_ra_tid *ra_tid;
+        struct sta_info *sta;
-        struct sk_buff *skb = dev_alloc_skb(0);
+        struct tid_ampdu_tx *tid_tx;
-        if (unlikely(!skb))
+        trace_api_stop_tx_ba_cb(sdata, ra, tid);
-                return;
-        ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
+        rcu_read_lock();
-        memcpy(&ra_tid->ra, ra, ETH_ALEN);
+        tid_tx = ieee80211_lookup_tid_tx(sdata, ra, tid, &sta);
-        ra_tid->tid = tid;
+        if (!tid_tx)
+                goto out;
-        skb->pkt_type = IEEE80211_SDATA_QUEUE_AGG_STOP;
+        set_bit(HT_AGG_STATE_STOP_CB, &tid_tx->state);
-        skb_queue_tail(&sdata->skb_queue, skb);
+        ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work);
-        ieee80211_queue_work(&local->hw, &sdata->work);
+ out:
+        rcu_read_unlock();
 }
 EXPORT_SYMBOL(ieee80211_stop_tx_ba_cb_irqsafe);
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index f4a528773563..6ca5442b1e03 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -7,6 +7,7 @@
 * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
 * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
 * Copyright 2007-2010, Intel Corporation
+ * Copyright 2017       Intel Deutschland GmbH
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
@@ -289,8 +290,6 @@ void ieee80211_sta_tear_down_BA_sessions(struct sta_info *sta,
 {
        int i;
-        cancel_work_sync(&sta->ampdu_mlme.work);
        for (i = 0; i <  IEEE80211_NUM_TIDS; i++) {
                __ieee80211_stop_tx_ba_session(sta, i, reason);
                __ieee80211_stop_rx_ba_session(sta, i, WLAN_BACK_RECIPIENT,
@@ -298,6 +297,9 @@ void ieee80211_sta_tear_down_BA_sessions(struct sta_info *sta,
                                               reason != AGG_STOP_DESTROY_STA &&
                                               reason != AGG_STOP_PEER_REQUEST);
        }
+        /* stopping might queue the work again - so cancel only afterwards */
+        cancel_work_sync(&sta->ampdu_mlme.work);
 }
 void ieee80211_ba_session_work(struct work_struct *work)
@@ -352,10 +354,16 @@ void ieee80211_ba_session_work(struct work_struct *work)
                spin_unlock_bh(&sta->lock);
                tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
-                if (tid_tx && test_and_clear_bit(HT_AGG_STATE_WANT_STOP,
+                if (!tid_tx)
-                                                 &tid_tx->state))
+                        continue;
+                if (test_and_clear_bit(HT_AGG_STATE_START_CB, &tid_tx->state))
+                        ieee80211_start_tx_ba_cb(sta, tid, tid_tx);
+                if (test_and_clear_bit(HT_AGG_STATE_WANT_STOP, &tid_tx->state))
                        ___ieee80211_stop_tx_ba_session(sta, tid,
                                                        AGG_STOP_LOCAL_REQUEST);
+                if (test_and_clear_bit(HT_AGG_STATE_STOP_CB, &tid_tx->state))
+                        ieee80211_stop_tx_ba_cb(sta, tid, tid_tx);
        }
        mutex_unlock(&sta->ampdu_mlme.mtx);
 }
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index f8f6c148f554..665501ac358f 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1036,8 +1036,6 @@ struct ieee80211_rx_agg {
 enum sdata_queue_type {
        IEEE80211_SDATA_QUEUE_TYPE_FRAME        = 0,
-        IEEE80211_SDATA_QUEUE_AGG_START         = 1,
-        IEEE80211_SDATA_QUEUE_AGG_STOP          = 2,
        IEEE80211_SDATA_QUEUE_RX_AGG_START      = 3,
        IEEE80211_SDATA_QUEUE_RX_AGG_STOP       = 4,
 };
@@ -1427,12 +1425,6 @@ ieee80211_get_sband(struct ieee80211_sub_if_data *sdata)
        return local->hw.wiphy->bands[band];
 }
-/* this struct represents 802.11n's RA/TID combination */
-struct ieee80211_ra_tid {
-        u8 ra[ETH_ALEN];
-        u16 tid;
-};
 /* this struct holds the value parsing from channel switch IE  */
 struct ieee80211_csa_ie {
        struct cfg80211_chan_def chandef;
@@ -1794,8 +1786,10 @@ int __ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
                                   enum ieee80211_agg_stop_reason reason);
 int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
                                    enum ieee80211_agg_stop_reason reason);
-void ieee80211_start_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u16 tid);
+void ieee80211_start_tx_ba_cb(struct sta_info *sta, int tid,
-void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid);
+                              struct tid_ampdu_tx *tid_tx);
+void ieee80211_stop_tx_ba_cb(struct sta_info *sta, int tid,
+                             struct tid_ampdu_tx *tid_tx);
 void ieee80211_ba_session_work(struct work_struct *work);
 void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid);
 void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid);
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 3bd5b81f5d81..8fae1a72e6a7 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1237,7 +1237,6 @@ static void ieee80211_iface_work(struct work_struct *work)
        struct ieee80211_local *local = sdata->local;
        struct sk_buff *skb;
        struct sta_info *sta;
-        struct ieee80211_ra_tid *ra_tid;
        struct ieee80211_rx_agg *rx_agg;
        if (!ieee80211_sdata_running(sdata))
@@ -1253,15 +1252,7 @@ static void ieee80211_iface_work(struct work_struct *work)
        while ((skb = skb_dequeue(&sdata->skb_queue))) {
                struct ieee80211_mgmt *mgmt = (void *)skb->data;
-                if (skb->pkt_type == IEEE80211_SDATA_QUEUE_AGG_START) {
+                if (skb->pkt_type == IEEE80211_SDATA_QUEUE_RX_AGG_START) {
-                        ra_tid = (void *)&skb->cb;
-                        ieee80211_start_tx_ba_cb(&sdata->vif, ra_tid->ra,
-                                                 ra_tid->tid);
-                } else if (skb->pkt_type == IEEE80211_SDATA_QUEUE_AGG_STOP) {
-                        ra_tid = (void *)&skb->cb;
-                        ieee80211_stop_tx_ba_cb(&sdata->vif, ra_tid->ra,
-                                                ra_tid->tid);
-                } else if (skb->pkt_type == IEEE80211_SDATA_QUEUE_RX_AGG_START) {
                        rx_agg = (void *)&skb->cb;
                        mutex_lock(&local->sta_mtx);
                        sta = sta_info_get_bss(sdata, rx_agg->addr);
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 7cdf7a835bb0..403e3cc58b57 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -2155,7 +2155,7 @@ void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
                        struct ieee80211_sta_rx_stats *cpurxs;
                        cpurxs = per_cpu_ptr(sta->pcpu_rx_stats, cpu);
-                        sinfo->rx_packets += cpurxs->dropped;
+                        sinfo->rx_dropped_misc += cpurxs->dropped;
                }
        }
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 5609cacb20d5..ea0747d6a6da 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -116,6 +116,8 @@ enum ieee80211_sta_info_flags {
 #define HT_AGG_STATE_STOPPING           3
 #define HT_AGG_STATE_WANT_START         4
 #define HT_AGG_STATE_WANT_STOP          5
+#define HT_AGG_STATE_START_CB           6
+#define HT_AGG_STATE_STOP_CB            7
 enum ieee80211_agg_stop_reason {
        AGG_STOP_DECLINED,
diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c
index 257ec66009da..7b05fd1497ce 100644
--- a/net/mpls/af_mpls.c
+++ b/net/mpls/af_mpls.c
@@ -1418,7 +1418,7 @@ static void mpls_ifup(struct net_device *dev, unsigned int flags)
                                continue;
                        alive++;
                        nh_flags &= ~flags;
-                        WRITE_ONCE(nh->nh_flags, flags);
+                        WRITE_ONCE(nh->nh_flags, nh_flags);
                } endfor_nexthops(rt);
                WRITE_ONCE(rt->rt_nhn_alive, alive);
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 9799a50bc604..a8be9b72e6cd 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -890,8 +890,13 @@ restart:
        }
 out:
        local_bh_enable();
-        if (last)
+        if (last) {
+                /* nf ct hash resize happened, now clear the leftover. */
+                if ((struct nf_conn *)cb->args[1] == last)
+                        cb->args[1] = 0;
                nf_ct_put(last);
+        }
        while (i) {
                i--;
diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
index 13875d599a85..1c5b14a6cab3 100644
--- a/net/netfilter/nf_conntrack_proto_sctp.c
+++ b/net/netfilter/nf_conntrack_proto_sctp.c
@@ -512,16 +512,19 @@ static int sctp_error(struct net *net, struct nf_conn *tpl, struct sk_buff *skb,
                      u8 pf, unsigned int hooknum)
 {
        const struct sctphdr *sh;
-        struct sctphdr _sctph;
        const char *logmsg;
-        sh = skb_header_pointer(skb, dataoff, sizeof(_sctph), &_sctph);
+        if (skb->len < dataoff + sizeof(struct sctphdr)) {
-        if (!sh) {
                logmsg = "nf_ct_sctp: short packet ";
                goto out_invalid;
        }
        if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
            skb->ip_summed == CHECKSUM_NONE) {
+                if (!skb_make_writable(skb, dataoff + sizeof(struct sctphdr))) {
+                        logmsg = "nf_ct_sctp: failed to read header ";
+                        goto out_invalid;
+                }
+                sh = (const struct sctphdr *)(skb->data + dataoff);
                if (sh->checksum != sctp_compute_cksum(skb, dataoff)) {
                        logmsg = "nf_ct_sctp: bad CRC ";
                        goto out_invalid;
diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index ef0be325a0c6..6c72922d20ca 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -566,7 +566,7 @@ static int nf_nat_proto_clean(struct nf_conn *ct, void *data)
         * Else, when the conntrack is destoyed, nf_nat_cleanup_conntrack()
         * will delete entry from already-freed table.
         */
-        ct->status &= ~IPS_NAT_DONE_MASK;
+        clear_bit(IPS_SRC_NAT_DONE_BIT, &ct->status);
        rhltable_remove(&nf_nat_bysource_table, &ct->nat_bysource,
                        nf_nat_bysource_params);
diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c
index e97e2fb53f0a..fbdbaa00dd5f 100644
--- a/net/netfilter/nft_set_rbtree.c
+++ b/net/netfilter/nft_set_rbtree.c
@@ -116,17 +116,17 @@ static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set,
                else if (d > 0)
                        p = &parent->rb_right;
                else {
-                        if (nft_set_elem_active(&rbe->ext, genmask)) {
+                        if (nft_rbtree_interval_end(rbe) &&
-                                if (nft_rbtree_interval_end(rbe) &&
+                            !nft_rbtree_interval_end(new)) {
-                                    !nft_rbtree_interval_end(new))
+                                p = &parent->rb_left;
-                                        p = &parent->rb_left;
+                        } else if (!nft_rbtree_interval_end(rbe) &&
-                                else if (!nft_rbtree_interval_end(rbe) &&
+                                   nft_rbtree_interval_end(new)) {
-                                         nft_rbtree_interval_end(new))
+                                p = &parent->rb_right;
-                                        p = &parent->rb_right;
+                        } else if (nft_set_elem_active(&rbe->ext, genmask)) {
-                                else {
+                                *ext = &rbe->ext;
-                                        *ext = &rbe->ext;
+                                return -EEXIST;
-                                        return -EEXIST;
+                        } else {
-                                }
+                                p = &parent->rb_left;
                        }
                }
        }
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index ee841f00a6ec..7586d446d7dc 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -62,6 +62,7 @@
 #include <asm/cacheflush.h>
 #include <linux/hash.h>
 #include <linux/genetlink.h>
+#include <linux/net_namespace.h>
 #include <net/net_namespace.h>
 #include <net/sock.h>
@@ -1415,7 +1416,8 @@ static void do_one_broadcast(struct sock *sk,
                goto out;
        }
        NETLINK_CB(p->skb2).nsid = peernet2id(sock_net(sk), p->net);
-        NETLINK_CB(p->skb2).nsid_is_set = true;
+        if (NETLINK_CB(p->skb2).nsid != NETNSA_NSID_NOT_ASSIGNED)
+                NETLINK_CB(p->skb2).nsid_is_set = true;
        val = netlink_broadcast_deliver(sk, p->skb2);
        if (val < 0) {
                netlink_overrun(sk);
diff --git a/sound/core/timer.c b/sound/core/timer.c
index 2f836ca09860..cd67d1c12cf1 100644
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -1618,6 +1618,7 @@ static int snd_timer_user_tselect(struct file *file,
        if (err < 0)
                goto __err;
+        tu->qhead = tu->qtail = tu->qused = 0;
        kfree(tu->queue);
        tu->queue = NULL;
        kfree(tu->tqueue);
@@ -1959,6 +1960,7 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
        tu = file->private_data;
        unit = tu->tread ? sizeof(struct snd_timer_tread) : sizeof(struct snd_timer_read);
+        mutex_lock(&tu->ioctl_lock);
        spin_lock_irq(&tu->qlock);
        while ((long)count - result >= unit) {
                while (!tu->qused) {
@@ -1974,7 +1976,9 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
                        add_wait_queue(&tu->qchange_sleep, &wait);
                        spin_unlock_irq(&tu->qlock);
+                        mutex_unlock(&tu->ioctl_lock);
                        schedule();
+                        mutex_lock(&tu->ioctl_lock);
                        spin_lock_irq(&tu->qlock);
                        remove_wait_queue(&tu->qchange_sleep, &wait);
@@ -1994,7 +1998,6 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
                tu->qused--;
                spin_unlock_irq(&tu->qlock);
-                mutex_lock(&tu->ioctl_lock);
                if (tu->tread) {
                        if (copy_to_user(buffer, &tu->tqueue[qhead],
                                         sizeof(struct snd_timer_tread)))
@@ -2004,7 +2007,6 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
                                         sizeof(struct snd_timer_read)))
                                err = -EFAULT;
                }
-                mutex_unlock(&tu->ioctl_lock);
                spin_lock_irq(&tu->qlock);
                if (err < 0)
@@ -2014,6 +2016,7 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
        }
 _error:
        spin_unlock_irq(&tu->qlock);
+        mutex_unlock(&tu->ioctl_lock);
        return result > 0 ? result : err;
 }
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index a57988d617e9..cbeebc0a9711 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -5854,7 +5854,11 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
        SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300),
        SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
        SND_PCI_QUIRK(0x1043, 0x10c0, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),
+        SND_PCI_QUIRK(0x1043, 0x10d0, "ASUS X540LA/X540LJ", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x1043, 0x115d, "Asus 1015E", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+        SND_PCI_QUIRK(0x1043, 0x11c0, "ASUS X556UR", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1043, 0x1290, "ASUS X441SA", ALC233_FIXUP_EAPD_COEF_AND_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1043, 0x12a0, "ASUS X441UV", ALC233_FIXUP_EAPD_COEF_AND_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x1043, 0x12f0, "ASUS X541UV", ALC256_FIXUP_ASUS_MIC),
        SND_PCI_QUIRK(0x1043, 0x12e0, "ASUS X541SA", ALC256_FIXUP_ASUS_MIC),
        SND_PCI_QUIRK(0x1043, 0x13b0, "ASUS Z550SA", ALC256_FIXUP_ASUS_MIC),
@@ -5862,13 +5866,10 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
        SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A),
        SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_FIXUP_STEREO_DMIC),
        SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW),
+        SND_PCI_QUIRK(0x1043, 0x1a30, "ASUS X705UD", ALC256_FIXUP_ASUS_MIC),
        SND_PCI_QUIRK(0x1043, 0x1b13, "Asus U41SV", ALC269_FIXUP_INV_DMIC),
-        SND_PCI_QUIRK(0x1043, 0x1c23, "Asus X55U", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
        SND_PCI_QUIRK(0x1043, 0x1bbd, "ASUS Z550MA", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
-        SND_PCI_QUIRK(0x1043, 0x10d0, "ASUS X540LA/X540LJ", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1043, 0x1c23, "Asus X55U", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
-        SND_PCI_QUIRK(0x1043, 0x11c0, "ASUS X556UR", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
-        SND_PCI_QUIRK(0x1043, 0x1290, "ASUS X441SA", ALC233_FIXUP_EAPD_COEF_AND_MIC_NO_PRESENCE),
-        SND_PCI_QUIRK(0x1043, 0x12a0, "ASUS X441UV", ALC233_FIXUP_EAPD_COEF_AND_MIC_NO_PRESENCE),
        SND_PCI_QUIRK(0x1043, 0x1ccd, "ASUS X555UB", ALC256_FIXUP_ASUS_MIC),
        SND_PCI_QUIRK(0x1043, 0x3030, "ASUS ZN270IE", ALC256_FIXUP_ASUS_AIO_GPIO2),
        SND_PCI_QUIRK(0x1043, 0x831a, "ASUS P901", ALC269_FIXUP_STEREO_DMIC),
diff --git a/sound/soc/atmel/atmel-classd.c b/sound/soc/atmel/atmel-classd.c
index 7ae46c2647d4..b7ef8c59b49a 100644
--- a/sound/soc/atmel/atmel-classd.c
+++ b/sound/soc/atmel/atmel-classd.c
@@ -301,6 +301,14 @@ static int atmel_classd_codec_probe(struct snd_soc_codec *codec)
        return 0;
 }
+static int atmel_classd_codec_resume(struct snd_soc_codec *codec)
+{
+        struct snd_soc_card *card = snd_soc_codec_get_drvdata(codec);
+        struct atmel_classd *dd = snd_soc_card_get_drvdata(card);
+        return regcache_sync(dd->regmap);
+}
 static struct regmap *atmel_classd_codec_get_remap(struct device *dev)
 {
        return dev_get_regmap(dev, NULL);
@@ -308,6 +316,7 @@ static struct regmap *atmel_classd_codec_get_remap(struct device *dev)
 static struct snd_soc_codec_driver soc_codec_dev_classd = {
        .probe          = atmel_classd_codec_probe,
+        .resume         = atmel_classd_codec_resume,
        .get_regmap     = atmel_classd_codec_get_remap,
        .component_driver = {
                .controls               = atmel_classd_snd_controls,
diff --git a/sound/soc/codecs/da7213.c b/sound/soc/codecs/da7213.c
index 6dd7578f0bb8..024d83fa6a7f 100644
--- a/sound/soc/codecs/da7213.c
+++ b/sound/soc/codecs/da7213.c
@@ -772,7 +772,7 @@ static int da7213_dai_event(struct snd_soc_dapm_widget *w,
                                ++i;
                                msleep(50);
                        }
-                } while ((i < DA7213_SRM_CHECK_RETRIES) & (!srm_lock));
+                } while ((i < DA7213_SRM_CHECK_RETRIES) && (!srm_lock));
                if (!srm_lock)
                        dev_warn(codec->dev, "SRM failed to lock\n");
diff --git a/sound/soc/codecs/rt286.c b/sound/soc/codecs/rt286.c
index 9c365a7f758d..7899a2cdeb42 100644
--- a/sound/soc/codecs/rt286.c
+++ b/sound/soc/codecs/rt286.c
@@ -1108,6 +1108,13 @@ static const struct dmi_system_id force_combo_jack_table[] = {
                        DMI_MATCH(DMI_PRODUCT_NAME, "Kabylake Client platform")
                }
        },
+        {
+                .ident = "Thinkpad Helix 2nd",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad Helix 2nd")
+                }
+        },
        { }
 };
diff --git a/sound/soc/generic/simple-card.c b/sound/soc/generic/simple-card.c
index 2c9dedab5184..bc136d2bd7cd 100644
--- a/sound/soc/generic/simple-card.c
+++ b/sound/soc/generic/simple-card.c
@@ -202,7 +202,7 @@ static int asoc_simple_card_dai_init(struct snd_soc_pcm_runtime *rtd)
        if (ret < 0)
                return ret;
-        ret = asoc_simple_card_init_mic(rtd->card, &priv->hp_jack, PREFIX);
+        ret = asoc_simple_card_init_mic(rtd->card, &priv->mic_jack, PREFIX);
        if (ret < 0)
                return ret;
diff --git a/sound/soc/intel/skylake/skl-sst-ipc.c b/sound/soc/intel/skylake/skl-sst-ipc.c
index 58c525096a7c..498b15345b1a 100644
--- a/sound/soc/intel/skylake/skl-sst-ipc.c
+++ b/sound/soc/intel/skylake/skl-sst-ipc.c
@@ -413,8 +413,11 @@ static void skl_ipc_process_reply(struct sst_generic_ipc *ipc,
        u32 reply = header.primary & IPC_GLB_REPLY_STATUS_MASK;
        u64 *ipc_header = (u64 *)(&header);
        struct skl_sst *skl = container_of(ipc, struct skl_sst, ipc);
+        unsigned long flags;
+        spin_lock_irqsave(&ipc->dsp->spinlock, flags);
        msg = skl_ipc_reply_get_msg(ipc, *ipc_header);
+        spin_unlock_irqrestore(&ipc->dsp->spinlock, flags);
        if (msg == NULL) {
                dev_dbg(ipc->dev, "ipc: rx list is empty\n");
                return;
@@ -456,8 +459,10 @@ static void skl_ipc_process_reply(struct sst_generic_ipc *ipc,
                }
        }
+        spin_lock_irqsave(&ipc->dsp->spinlock, flags);
        list_del(&msg->list);
        sst_ipc_tx_msg_reply_complete(ipc, msg);
+        spin_unlock_irqrestore(&ipc->dsp->spinlock, flags);
 }
 irqreturn_t skl_dsp_irq_thread_handler(int irq, void *context)
diff --git a/sound/soc/intel/skylake/skl-topology.c b/sound/soc/intel/skylake/skl-topology.c
index 3a99712e44a8..64a0f8ed33e1 100644
--- a/sound/soc/intel/skylake/skl-topology.c
+++ b/sound/soc/intel/skylake/skl-topology.c
@@ -2502,7 +2502,7 @@ static int skl_tplg_get_manifest_tkn(struct device *dev,
                        if (ret < 0)
                                return ret;
-                        tkn_count += ret;
+                        tkn_count = ret;
                        tuple_size += tkn_count *
                                sizeof(struct snd_soc_tplg_vendor_string_elem);
diff --git a/sound/soc/intel/skylake/skl.c b/sound/soc/intel/skylake/skl.c
index 6df3b317a476..4c9b5781282b 100644
--- a/sound/soc/intel/skylake/skl.c
+++ b/sound/soc/intel/skylake/skl.c
@@ -410,7 +410,7 @@ static int skl_free(struct hdac_ext_bus *ebus)
        struct skl *skl  = ebus_to_skl(ebus);
        struct hdac_bus *bus = ebus_to_hbus(ebus);
-        skl->init_failed = 1; /* to be sure */
+        skl->init_done = 0; /* to be sure */
        snd_hdac_ext_stop_streams(ebus);
@@ -428,8 +428,10 @@ static int skl_free(struct hdac_ext_bus *ebus)
        snd_hdac_ext_bus_exit(ebus);
+        cancel_work_sync(&skl->probe_work);
        if (IS_ENABLED(CONFIG_SND_SOC_HDAC_HDMI))
                snd_hdac_i915_exit(&ebus->bus);
        return 0;
 }
@@ -566,6 +568,84 @@ static const struct hdac_bus_ops bus_core_ops = {
        .get_response = snd_hdac_bus_get_response,
 };
+static int skl_i915_init(struct hdac_bus *bus)
+{
+        int err;
+        /*
+         * The HDMI codec is in GPU so we need to ensure that it is powered
+         * up and ready for probe
+         */
+        err = snd_hdac_i915_init(bus);
+        if (err < 0)
+                return err;
+        err = snd_hdac_display_power(bus, true);
+        if (err < 0)
+                dev_err(bus->dev, "Cannot turn on display power on i915\n");
+        return err;
+}
+static void skl_probe_work(struct work_struct *work)
+{
+        struct skl *skl = container_of(work, struct skl, probe_work);
+        struct hdac_ext_bus *ebus = &skl->ebus;
+        struct hdac_bus *bus = ebus_to_hbus(ebus);
+        struct hdac_ext_link *hlink = NULL;
+        int err;
+        if (IS_ENABLED(CONFIG_SND_SOC_HDAC_HDMI)) {
+                err = skl_i915_init(bus);
+                if (err < 0)
+                        return;
+        }
+        err = skl_init_chip(bus, true);
+        if (err < 0) {
+                dev_err(bus->dev, "Init chip failed with err: %d\n", err);
+                goto out_err;
+        }
+        /* codec detection */
+        if (!bus->codec_mask)
+                dev_info(bus->dev, "no hda codecs found!\n");
+        /* create codec instances */
+        err = skl_codec_create(ebus);
+        if (err < 0)
+                goto out_err;
+        if (IS_ENABLED(CONFIG_SND_SOC_HDAC_HDMI)) {
+                err = snd_hdac_display_power(bus, false);
+                if (err < 0) {
+                        dev_err(bus->dev, "Cannot turn off display power on i915\n");
+                        return;
+                }
+        }
+        /* register platform dai and controls */
+        err = skl_platform_register(bus->dev);
+        if (err < 0)
+                return;
+        /*
+         * we are done probing so decrement link counts
+         */
+        list_for_each_entry(hlink, &ebus->hlink_list, list)
+                snd_hdac_ext_bus_link_put(ebus, hlink);
+        /* configure PM */
+        pm_runtime_put_noidle(bus->dev);
+        pm_runtime_allow(bus->dev);
+        skl->init_done = 1;
+        return;
+out_err:
+        if (IS_ENABLED(CONFIG_SND_SOC_HDAC_HDMI))
+                err = snd_hdac_display_power(bus, false);
+}
 /*
 * constructor
 */
@@ -593,6 +673,7 @@ static int skl_create(struct pci_dev *pci,
        snd_hdac_ext_bus_init(ebus, &pci->dev, &bus_core_ops, io_ops);
        ebus->bus.use_posbuf = 1;
        skl->pci = pci;
+        INIT_WORK(&skl->probe_work, skl_probe_work);
        ebus->bus.bdl_pos_adj = 0;
@@ -601,27 +682,6 @@ static int skl_create(struct pci_dev *pci,
        return 0;
 }
-static int skl_i915_init(struct hdac_bus *bus)
-{
-        int err;
-        /*
-         * The HDMI codec is in GPU so we need to ensure that it is powered
-         * up and ready for probe
-         */
-        err = snd_hdac_i915_init(bus);
-        if (err < 0)
-                return err;
-        err = snd_hdac_display_power(bus, true);
-        if (err < 0) {
-                dev_err(bus->dev, "Cannot turn on display power on i915\n");
-                return err;
-        }
-        return err;
-}
 static int skl_first_init(struct hdac_ext_bus *ebus)
 {
        struct skl *skl = ebus_to_skl(ebus);
@@ -684,20 +744,7 @@ static int skl_first_init(struct hdac_ext_bus *ebus)
        /* initialize chip */
        skl_init_pci(skl);
-        if (IS_ENABLED(CONFIG_SND_SOC_HDAC_HDMI)) {
+        return skl_init_chip(bus, true);
-                err = skl_i915_init(bus);
-                if (err < 0)
-                        return err;
-        }
-        skl_init_chip(bus, true);
-        /* codec detection */
-        if (!bus->codec_mask) {
-                dev_info(bus->dev, "no hda codecs found!\n");
-        }
-        return 0;
 }
 static int skl_probe(struct pci_dev *pci,
@@ -706,7 +753,6 @@ static int skl_probe(struct pci_dev *pci,
        struct skl *skl;
        struct hdac_ext_bus *ebus = NULL;
        struct hdac_bus *bus = NULL;
-        struct hdac_ext_link *hlink = NULL;
        int err;
        /* we use ext core ops, so provide NULL for ops here */
@@ -729,7 +775,7 @@ static int skl_probe(struct pci_dev *pci,
        if (skl->nhlt == NULL) {
                err = -ENODEV;
-                goto out_display_power_off;
+                goto out_free;
        }
        err = skl_nhlt_create_sysfs(skl);
@@ -760,56 +806,24 @@ static int skl_probe(struct pci_dev *pci,
        if (bus->mlcap)
                snd_hdac_ext_bus_get_ml_capabilities(ebus);
+        snd_hdac_bus_stop_chip(bus);
        /* create device for soc dmic */
        err = skl_dmic_device_register(skl);
        if (err < 0)
                goto out_dsp_free;
-        /* register platform dai and controls */
+        schedule_work(&skl->probe_work);
-        err = skl_platform_register(bus->dev);
-        if (err < 0)
-                goto out_dmic_free;
-        /* create codec instances */
-        err = skl_codec_create(ebus);
-        if (err < 0)
-                goto out_unregister;
-        if (IS_ENABLED(CONFIG_SND_SOC_HDAC_HDMI)) {
-                err = snd_hdac_display_power(bus, false);
-                if (err < 0) {
-                        dev_err(bus->dev, "Cannot turn off display power on i915\n");
-                        return err;
-                }
-        }
-        /*
-         * we are done probling so decrement link counts
-         */
-        list_for_each_entry(hlink, &ebus->hlink_list, list)
-                snd_hdac_ext_bus_link_put(ebus, hlink);
-        /* configure PM */
-        pm_runtime_put_noidle(bus->dev);
-        pm_runtime_allow(bus->dev);
        return 0;
-out_unregister:
-        skl_platform_unregister(bus->dev);
-out_dmic_free:
-        skl_dmic_device_unregister(skl);
 out_dsp_free:
        skl_free_dsp(skl);
 out_mach_free:
        skl_machine_device_unregister(skl);
 out_nhlt_free:
        skl_nhlt_free(skl->nhlt);
-out_display_power_off:
-        if (IS_ENABLED(CONFIG_SND_SOC_HDAC_HDMI))
-                snd_hdac_display_power(bus, false);
 out_free:
-        skl->init_failed = 1;
        skl_free(ebus);
        return err;
@@ -828,7 +842,7 @@ static void skl_shutdown(struct pci_dev *pci)
        skl = ebus_to_skl(ebus);
-        if (skl->init_failed)
+        if (!skl->init_done)
                return;
        snd_hdac_ext_stop_streams(ebus);
diff --git a/sound/soc/intel/skylake/skl.h b/sound/soc/intel/skylake/skl.h
index a454f6035f3e..2a630fcb7f08 100644
--- a/sound/soc/intel/skylake/skl.h
+++ b/sound/soc/intel/skylake/skl.h
@@ -46,7 +46,7 @@ struct skl {
        struct hdac_ext_bus ebus;
        struct pci_dev *pci;
-        unsigned int init_failed:1; /* delayed init failed */
+        unsigned int init_done:1; /* delayed init status */
        struct platform_device *dmic_dev;
        struct platform_device *i2s_dev;
        struct snd_soc_platform *platform;
@@ -64,6 +64,8 @@ struct skl {
        const struct firmware *tplg;
        int supend_active;
+        struct work_struct probe_work;
 };
 #define skl_to_ebus(s)  (&(s)->ebus)
diff --git a/sound/soc/sh/rcar/adg.c b/sound/soc/sh/rcar/adg.c
index 66203d107a11..d3b0dc145a56 100644
--- a/sound/soc/sh/rcar/adg.c
+++ b/sound/soc/sh/rcar/adg.c
@@ -507,7 +507,8 @@ static void rsnd_adg_get_clkout(struct rsnd_priv *priv,
                                rbga = rbgx;
                                adg->rbga_rate_for_441khz = rate / div;
                                ckr |= brg_table[i] << 20;
-                                if (req_441kHz_rate)
+                                if (req_441kHz_rate &&
+                                    !(adg_mode_flags(adg) & AUDIO_OUT_48))
                                        parent_clk_name = __clk_get_name(clk);
                        }
                }
@@ -522,7 +523,8 @@ static void rsnd_adg_get_clkout(struct rsnd_priv *priv,
                                rbgb = rbgx;
                                adg->rbgb_rate_for_48khz = rate / div;
                                ckr |= brg_table[i] << 16;
-                                if (req_48kHz_rate)
+                                if (req_48kHz_rate &&
+                                    (adg_mode_flags(adg) & AUDIO_OUT_48))
                                        parent_clk_name = __clk_get_name(clk);
                        }
                }
diff --git a/sound/soc/sh/rcar/cmd.c b/sound/soc/sh/rcar/cmd.c
index 7d92a24b7cfa..d879c010cf03 100644
--- a/sound/soc/sh/rcar/cmd.c
+++ b/sound/soc/sh/rcar/cmd.c
@@ -89,6 +89,7 @@ static int rsnd_cmd_init(struct rsnd_mod *mod,
        dev_dbg(dev, "ctu/mix path = 0x%08x", data);
        rsnd_mod_write(mod, CMD_ROUTE_SLCT, data);
+        rsnd_mod_write(mod, CMD_BUSIF_MODE, rsnd_get_busif_shift(io, mod) | 1);
        rsnd_mod_write(mod, CMD_BUSIF_DALIGN, rsnd_get_dalign(mod, io));
        rsnd_adg_set_cmd_timsel_gen2(mod, io);
diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c
index 1744015408c3..8c1f4e2e0c4f 100644
--- a/sound/soc/sh/rcar/core.c
+++ b/sound/soc/sh/rcar/core.c
@@ -343,6 +343,57 @@ u32 rsnd_get_dalign(struct rsnd_mod *mod, struct rsnd_dai_stream *io)
                return 0x76543210;
 }
+u32 rsnd_get_busif_shift(struct rsnd_dai_stream *io, struct rsnd_mod *mod)
+{
+        enum rsnd_mod_type playback_mods[] = {
+                RSND_MOD_SRC,
+                RSND_MOD_CMD,
+                RSND_MOD_SSIU,
+        };
+        enum rsnd_mod_type capture_mods[] = {
+                RSND_MOD_CMD,
+                RSND_MOD_SRC,
+                RSND_MOD_SSIU,
+        };
+        struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io);
+        struct rsnd_mod *tmod = NULL;
+        enum rsnd_mod_type *mods =
+                rsnd_io_is_play(io) ?
+                playback_mods : capture_mods;
+        int i;
+        /*
+         * This is needed for 24bit data
+         * We need to shift 8bit
+         *
+         * Linux 24bit data is located as 0x00******
+         * HW    24bit data is located as 0x******00
+         *
+         */
+        switch (runtime->sample_bits) {
+        case 16:
+                return 0;
+        case 32:
+                break;
+        }
+        for (i = 0; i < ARRAY_SIZE(playback_mods); i++) {
+                tmod = rsnd_io_to_mod(io, mods[i]);
+                if (tmod)
+                        break;
+        }
+        if (tmod != mod)
+                return 0;
+        if (rsnd_io_is_play(io))
+                return  (0 << 20) | /* shift to Left */
+                        (8 << 16);  /* 8bit */
+        else
+                return  (1 << 20) | /* shift to Right */
+                        (8 << 16);  /* 8bit */
+}
 /*
 *      rsnd_dai functions
 */
diff --git a/sound/soc/sh/rcar/gen.c b/sound/soc/sh/rcar/gen.c
index 63b6d3c28021..4b0980728e13 100644
--- a/sound/soc/sh/rcar/gen.c
+++ b/sound/soc/sh/rcar/gen.c
@@ -236,6 +236,7 @@ static int rsnd_gen2_probe(struct rsnd_priv *priv)
                RSND_GEN_M_REG(SRC_ROUTE_MODE0, 0xc,    0x20),
                RSND_GEN_M_REG(SRC_CTRL,        0x10,   0x20),
                RSND_GEN_M_REG(SRC_INT_ENABLE0, 0x18,   0x20),
+                RSND_GEN_M_REG(CMD_BUSIF_MODE,  0x184,  0x20),
                RSND_GEN_M_REG(CMD_BUSIF_DALIGN,0x188,  0x20),
                RSND_GEN_M_REG(CMD_ROUTE_SLCT,  0x18c,  0x20),
                RSND_GEN_M_REG(CMD_CTRL,        0x190,  0x20),
diff --git a/sound/soc/sh/rcar/rsnd.h b/sound/soc/sh/rcar/rsnd.h
index dbf4163427e8..323af41ecfcb 100644
--- a/sound/soc/sh/rcar/rsnd.h
+++ b/sound/soc/sh/rcar/rsnd.h
@@ -73,6 +73,7 @@ enum rsnd_reg {
        RSND_REG_SCU_SYS_INT_EN0,
        RSND_REG_SCU_SYS_INT_EN1,
        RSND_REG_CMD_CTRL,
+        RSND_REG_CMD_BUSIF_MODE,
        RSND_REG_CMD_BUSIF_DALIGN,
        RSND_REG_CMD_ROUTE_SLCT,
        RSND_REG_CMDOUT_TIMSEL,
@@ -204,6 +205,7 @@ void rsnd_bset(struct rsnd_priv *priv, struct rsnd_mod *mod, enum rsnd_reg reg,
                    u32 mask, u32 data);
 u32 rsnd_get_adinr_bit(struct rsnd_mod *mod, struct rsnd_dai_stream *io);
 u32 rsnd_get_dalign(struct rsnd_mod *mod, struct rsnd_dai_stream *io);
+u32 rsnd_get_busif_shift(struct rsnd_dai_stream *io, struct rsnd_mod *mod);
 /*
 *      R-Car DMA
diff --git a/sound/soc/sh/rcar/src.c b/sound/soc/sh/rcar/src.c
index 20b5b2ec625e..76a477a3ccb5 100644
--- a/sound/soc/sh/rcar/src.c
+++ b/sound/soc/sh/rcar/src.c
@@ -190,11 +190,13 @@ static void rsnd_src_set_convert_rate(struct rsnd_dai_stream *io,
        struct rsnd_priv *priv = rsnd_mod_to_priv(mod);
        struct device *dev = rsnd_priv_to_dev(priv);
        struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io);
+        int is_play = rsnd_io_is_play(io);
        int use_src = 0;
        u32 fin, fout;
        u32 ifscr, fsrate, adinr;
        u32 cr, route;
        u32 bsdsr, bsisr;
+        u32 i_busif, o_busif, tmp;
        uint ratio;
        if (!runtime)
@@ -270,6 +272,11 @@ static void rsnd_src_set_convert_rate(struct rsnd_dai_stream *io,
                break;
        }
+        /* BUSIF_MODE */
+        tmp = rsnd_get_busif_shift(io, mod);
+        i_busif = ( is_play ? tmp : 0) | 1;
+        o_busif = (!is_play ? tmp : 0) | 1;
        rsnd_mod_write(mod, SRC_ROUTE_MODE0, route);
        rsnd_mod_write(mod, SRC_SRCIR, 1);      /* initialize */
@@ -281,8 +288,9 @@ static void rsnd_src_set_convert_rate(struct rsnd_dai_stream *io,
        rsnd_mod_write(mod, SRC_BSISR, bsisr);
        rsnd_mod_write(mod, SRC_SRCIR, 0);      /* cancel initialize */
-        rsnd_mod_write(mod, SRC_I_BUSIF_MODE, 1);
+        rsnd_mod_write(mod, SRC_I_BUSIF_MODE, i_busif);
-        rsnd_mod_write(mod, SRC_O_BUSIF_MODE, 1);
+        rsnd_mod_write(mod, SRC_O_BUSIF_MODE, o_busif);
        rsnd_mod_write(mod, SRC_BUSIF_DALIGN, rsnd_get_dalign(mod, io));
        rsnd_adg_set_src_timesel_gen2(mod, io, fin, fout);
diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c
index 135c5669f796..91e5c07911b4 100644
--- a/sound/soc/sh/rcar/ssi.c
+++ b/sound/soc/sh/rcar/ssi.c
@@ -302,7 +302,7 @@ static void rsnd_ssi_config_init(struct rsnd_mod *mod,
         * always use 32bit system word.
         * see also rsnd_ssi_master_clk_enable()
         */
-        cr_own = FORCE | SWL_32 | PDTA;
+        cr_own = FORCE | SWL_32;
        if (rdai->bit_clk_inv)
                cr_own |= SCKP;
@@ -550,6 +550,13 @@ static void __rsnd_ssi_interrupt(struct rsnd_mod *mod,
                struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io);
                u32 *buf = (u32 *)(runtime->dma_area +
                                   rsnd_dai_pointer_offset(io, 0));
+                int shift = 0;
+                switch (runtime->sample_bits) {
+                case 32:
+                        shift = 8;
+                        break;
+                }
                /*
                 * 8/16/32 data can be assesse to TDR/RDR register
@@ -557,9 +564,9 @@ static void __rsnd_ssi_interrupt(struct rsnd_mod *mod,
                 * see rsnd_ssi_init()
                 */
                if (rsnd_io_is_play(io))
-                        rsnd_mod_write(mod, SSITDR, *buf);
+                        rsnd_mod_write(mod, SSITDR, (*buf) << shift);
                else
-                        *buf = rsnd_mod_read(mod, SSIRDR);
+                        *buf = (rsnd_mod_read(mod, SSIRDR) >> shift);
                elapsed = rsnd_dai_pointer_update(io, sizeof(*buf));
        }
@@ -709,6 +716,11 @@ static int rsnd_ssi_dma_remove(struct rsnd_mod *mod,
                               struct rsnd_priv *priv)
 {
        struct rsnd_ssi *ssi = rsnd_mod_to_ssi(mod);
+        struct rsnd_mod *ssi_parent_mod = rsnd_io_to_mod_ssip(io);
+        /* Do nothing for SSI parent mod */
+        if (ssi_parent_mod == mod)
+                return 0;
        /* PIO will request IRQ again */
        free_irq(ssi->irq, mod);
diff --git a/sound/soc/sh/rcar/ssiu.c b/sound/soc/sh/rcar/ssiu.c
index 14fafdaf1395..512d238b79e2 100644
--- a/sound/soc/sh/rcar/ssiu.c
+++ b/sound/soc/sh/rcar/ssiu.c
@@ -144,7 +144,8 @@ static int rsnd_ssiu_init_gen2(struct rsnd_mod *mod,
                               (rsnd_io_is_play(io) ?
                                rsnd_runtime_channel_after_ctu(io) :
                                rsnd_runtime_channel_original(io)));
-                rsnd_mod_write(mod, SSI_BUSIF_MODE,  1);
+                rsnd_mod_write(mod, SSI_BUSIF_MODE,
+                               rsnd_get_busif_shift(io, mod) | 1);
                rsnd_mod_write(mod, SSI_BUSIF_DALIGN,
                               rsnd_get_dalign(mod, io));
        }
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index aae099c0e502..754e3ef8d7ae 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -2286,6 +2286,9 @@ static int soc_cleanup_card_resources(struct snd_soc_card *card)
        list_for_each_entry(rtd, &card->rtd_list, list)
                flush_delayed_work(&rtd->delayed_work);
+        /* free the ALSA card at first; this syncs with pending operations */
+        snd_card_free(card->snd_card);
        /* remove and free each DAI */
        soc_remove_dai_links(card);
        soc_remove_pcm_runtimes(card);
@@ -2300,9 +2303,7 @@ static int soc_cleanup_card_resources(struct snd_soc_card *card)
        if (card->remove)
                card->remove(card);
-        snd_card_free(card->snd_card);
        return 0;
 }
 /* removes a socdev */
diff --git a/tools/perf/Documentation/perf-probe.txt b/tools/perf/Documentation/perf-probe.txt
index e6c9902c6d82..165c2b1d4317 100644
--- a/tools/perf/Documentation/perf-probe.txt
+++ b/tools/perf/Documentation/perf-probe.txt
@@ -240,9 +240,13 @@ Add a probe on schedule() function 12th line with recording cpu local variable:
 or
 ./perf probe --add='schedule:12 cpu'
- this will add one or more probes which has the name start with "schedule".
+Add one or more probes which has the name start with "schedule".
- Add probes on lines in schedule() function which calls update_rq_clock().
+ ./perf probe schedule*
+ or
+ ./perf probe --add='schedule*'
+Add probes on lines in schedule() function which calls update_rq_clock().
 ./perf probe 'schedule;update_rq_clock*'
 or
diff --git a/tools/perf/Documentation/perf-script-perl.txt b/tools/perf/Documentation/perf-script-perl.txt
index dfbb506d2c34..142606c0ec9c 100644
--- a/tools/perf/Documentation/perf-script-perl.txt
+++ b/tools/perf/Documentation/perf-script-perl.txt
@@ -39,7 +39,7 @@ EVENT HANDLERS
 When perf script is invoked using a trace script, a user-defined
 'handler function' is called for each event in the trace.  If there's
 no handler function defined for a given event type, the event is
-ignored (or passed to a 'trace_handled' function, see below) and the
+ignored (or passed to a 'trace_unhandled' function, see below) and the
 next event is processed.
 Most of the event's field values are passed as arguments to the
diff --git a/tools/perf/Documentation/perf-script-python.txt b/tools/perf/Documentation/perf-script-python.txt
index 54acba221558..51ec2d20068a 100644
--- a/tools/perf/Documentation/perf-script-python.txt
+++ b/tools/perf/Documentation/perf-script-python.txt
@@ -149,10 +149,8 @@ def raw_syscalls__sys_enter(event_name, context, common_cpu,
                print "id=%d, args=%s\n" % \
                (id, args),
-def trace_unhandled(event_name, context, common_cpu, common_secs, common_nsecs,
+def trace_unhandled(event_name, context, event_fields_dict):
-                common_pid, common_comm):
+                print ' '.join(['%s=%s'%(k,str(v))for k,v in sorted(event_fields_dict.items())])
-                print_header(event_name, common_cpu, common_secs, common_nsecs,
-                common_pid, common_comm)
 def print_header(event_name, cpu, secs, nsecs, pid, comm):
        print "%-20s %5u %05u.%09u %8u %-20s " % \
@@ -321,7 +319,7 @@ So those are the essential steps in writing and running a script.  The
 process can be generalized to any tracepoint or set of tracepoints
 you're interested in - basically find the tracepoint(s) you're
 interested in by looking at the list of available events shown by
-'perf list' and/or look in /sys/kernel/debug/tracing events for
+'perf list' and/or look in /sys/kernel/debug/tracing/events/ for
 detailed event and field info, record the corresponding trace data
 using 'perf record', passing it the list of interesting events,
 generate a skeleton script using 'perf script -g python' and modify the
@@ -334,7 +332,7 @@ right place, you can have your script listed alongside the other
 scripts listed by the 'perf script -l' command e.g.:
 ----
-root@tropicana:~# perf script -l
+# perf script -l
 List of available trace scripts:
  wakeup-latency                       system-wide min/max/avg wakeup latency
  rw-by-file <comm>                    r/w activity for a program, by file
@@ -383,8 +381,6 @@ source tree:
 ----
 # ls -al kernel-source/tools/perf/scripts/python
-root@tropicana:/home/trz/src/tip# ls -al tools/perf/scripts/python
 total 32
 drwxr-xr-x 4 trz trz 4096 2010-01-26 22:30 .
 drwxr-xr-x 4 trz trz 4096 2010-01-26 22:29 ..
@@ -399,7 +395,7 @@ otherwise your script won't show up at run-time), 'perf script -l'
 should show a new entry for your script:
 ----
-root@tropicana:~# perf script -l
+# perf script -l
 List of available trace scripts:
  wakeup-latency                       system-wide min/max/avg wakeup latency
  rw-by-file <comm>                    r/w activity for a program, by file
@@ -437,7 +433,7 @@ EVENT HANDLERS
 When perf script is invoked using a trace script, a user-defined
 'handler function' is called for each event in the trace.  If there's
 no handler function defined for a given event type, the event is
-ignored (or passed to a 'trace_handled' function, see below) and the
+ignored (or passed to a 'trace_unhandled' function, see below) and the
 next event is processed.
 Most of the event's field values are passed as arguments to the
@@ -532,7 +528,7 @@ can implement a set of optional functions:
 gives scripts a chance to do setup tasks:
 ----
-def trace_begin:
+def trace_begin():
    pass
 ----
@@ -541,7 +537,7 @@ def trace_begin:
 as display results:
 ----
-def trace_end:
+def trace_end():
    pass
 ----
@@ -550,8 +546,7 @@ def trace_end:
 of common arguments are passed into it:
 ----
-def trace_unhandled(event_name, context, common_cpu, common_secs,
+def trace_unhandled(event_name, context, event_fields_dict):
-        common_nsecs, common_pid, common_comm):
    pass
 ----
diff --git a/tools/perf/arch/common.c b/tools/perf/arch/common.c
index 837067f48a4c..6b40e9f01740 100644
--- a/tools/perf/arch/common.c
+++ b/tools/perf/arch/common.c
@@ -26,6 +26,7 @@ const char *const arm64_triplets[] = {
 const char *const powerpc_triplets[] = {
        "powerpc-unknown-linux-gnu-",
+        "powerpc-linux-gnu-",
        "powerpc64-unknown-linux-gnu-",
        "powerpc64-linux-gnu-",
        "powerpc64le-linux-gnu-",
diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
index a935b5023732..ad9324d1daf9 100644
--- a/tools/perf/builtin-stat.c
+++ b/tools/perf/builtin-stat.c
@@ -1578,6 +1578,7 @@ static void print_header(int argc, const char **argv)
 static void print_footer(void)
 {
        FILE *output = stat_config.output;
+        int n;
        if (!null_run)
                fprintf(output, "\n");
@@ -1590,7 +1591,9 @@ static void print_footer(void)
        }
        fprintf(output, "\n\n");
-        if (print_free_counters_hint)
+        if (print_free_counters_hint &&
+            sysctl__read_int("kernel/nmi_watchdog", &n) >= 0 &&
+            n > 0)
                fprintf(output,
 "Some events weren't counted. Try disabling the NMI watchdog:\n"
 "       echo 0 > /proc/sys/kernel/nmi_watchdog\n"
diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
index d014350adc52..4b2a5d298197 100644
--- a/tools/perf/builtin-trace.c
+++ b/tools/perf/builtin-trace.c
@@ -681,6 +681,10 @@ static struct syscall_fmt {
        { .name     = "mlockall",   .errmsg = true,
          .arg_scnprintf = { [0] = SCA_HEX, /* addr */ }, },
        { .name     = "mmap",       .hexret = true,
+/* The standard mmap maps to old_mmap on s390x */
+#if defined(__s390x__)
+        .alias = "old_mmap",
+#endif
          .arg_scnprintf = { [0] = SCA_HEX,       /* addr */
                             [2] = SCA_MMAP_PROT, /* prot */
                             [3] = SCA_MMAP_FLAGS, /* flags */ }, },
diff --git a/tools/perf/tests/bp_signal.c b/tools/perf/tests/bp_signal.c
index e7664fe3bd33..8ba2c4618fe9 100644
--- a/tools/perf/tests/bp_signal.c
+++ b/tools/perf/tests/bp_signal.c
@@ -288,3 +288,17 @@ int test__bp_signal(int subtest __maybe_unused)
        return count1 == 1 && overflows == 3 && count2 == 3 && overflows_2 == 3 && count3 == 2 ?
                TEST_OK : TEST_FAIL;
 }
+bool test__bp_signal_is_supported(void)
+{
+/*
+ * The powerpc so far does not have support to even create
+ * instruction breakpoint using the perf event interface.
+ * Once it's there we can release this.
+ */
+#ifdef __powerpc__
+        return false;
+#else
+        return true;
+#endif
+}
diff --git a/tools/perf/tests/builtin-test.c b/tools/perf/tests/builtin-test.c
index 9e08d297f1a9..3ccfd58a8c3c 100644
--- a/tools/perf/tests/builtin-test.c
+++ b/tools/perf/tests/builtin-test.c
@@ -97,10 +97,12 @@ static struct test generic_tests[] = {
        {
                .desc = "Breakpoint overflow signal handler",
                .func = test__bp_signal,
+                .is_supported = test__bp_signal_is_supported,
        },
        {
                .desc = "Breakpoint overflow sampling",
                .func = test__bp_signal_overflow,
+                .is_supported = test__bp_signal_is_supported,
        },
        {
                .desc = "Number of exit events of a simple workload",
@@ -401,6 +403,11 @@ static int __cmd_test(int argc, const char *argv[], struct intlist *skiplist)
                if (!perf_test__matches(t, curr, argc, argv))
                        continue;
+                if (t->is_supported && !t->is_supported()) {
+                        pr_debug("%2d: %-*s: Disabled\n", i, width, t->desc);
+                        continue;
+                }
                pr_info("%2d: %-*s:", i, width, t->desc);
                if (intlist__find(skiplist, i)) {
diff --git a/tools/perf/tests/code-reading.c b/tools/perf/tests/code-reading.c
index 1f14e7612cbb..94b7c7b02bde 100644
--- a/tools/perf/tests/code-reading.c
+++ b/tools/perf/tests/code-reading.c
@@ -229,6 +229,8 @@ static int read_object_code(u64 addr, size_t len, u8 cpumode,
        unsigned char buf2[BUFSZ];
        size_t ret_len;
        u64 objdump_addr;
+        const char *objdump_name;
+        char decomp_name[KMOD_DECOMP_LEN];
        int ret;
        pr_debug("Reading object code for memory address: %#"PRIx64"\n", addr);
@@ -289,9 +291,25 @@ static int read_object_code(u64 addr, size_t len, u8 cpumode,
                state->done[state->done_cnt++] = al.map->start;
        }
+        objdump_name = al.map->dso->long_name;
+        if (dso__needs_decompress(al.map->dso)) {
+                if (dso__decompress_kmodule_path(al.map->dso, objdump_name,
+                                                 decomp_name,
+                                                 sizeof(decomp_name)) < 0) {
+                        pr_debug("decompression failed\n");
+                        return -1;
+                }
+                objdump_name = decomp_name;
+        }
        /* Read the object code using objdump */
        objdump_addr = map__rip_2objdump(al.map, al.addr);
-        ret = read_via_objdump(al.map->dso->long_name, objdump_addr, buf2, len);
+        ret = read_via_objdump(objdump_name, objdump_addr, buf2, len);
+        if (dso__needs_decompress(al.map->dso))
+                unlink(objdump_name);
        if (ret > 0) {
                /*
                 * The kernel maps are inaccurate - assume objdump is right in
diff --git a/tools/perf/tests/tests.h b/tools/perf/tests/tests.h
index 631859629403..577363809c9b 100644
--- a/tools/perf/tests/tests.h
+++ b/tools/perf/tests/tests.h
@@ -34,6 +34,7 @@ struct test {
                int (*get_nr)(void);
                const char *(*get_desc)(int subtest);
        } subtest;
+        bool (*is_supported)(void);
 };
 /* Tests */
@@ -99,6 +100,8 @@ const char *test__clang_subtest_get_desc(int subtest);
 int test__clang_subtest_get_nr(void);
 int test__unit_number__scnprint(int subtest);
+bool test__bp_signal_is_supported(void);
 #if defined(__arm__) || defined(__aarch64__)
 #ifdef HAVE_DWARF_UNWIND_SUPPORT
 struct thread;
diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c
index 683f8340460c..ddbd56df9187 100644
--- a/tools/perf/util/annotate.c
+++ b/tools/perf/util/annotate.c
@@ -239,10 +239,20 @@ static int jump__parse(struct arch *arch __maybe_unused, struct ins_operands *op
        const char *s = strchr(ops->raw, '+');
        const char *c = strchr(ops->raw, ',');
-        if (c++ != NULL)
+        /*
+         * skip over possible up to 2 operands to get to address, e.g.:
+         * tbnz  w0, #26, ffff0000083cd190 <security_file_permission+0xd0>
+         */
+        if (c++ != NULL) {
                ops->target.addr = strtoull(c, NULL, 16);
-        else
+                if (!ops->target.addr) {
+                        c = strchr(c, ',');
+                        if (c++ != NULL)
+                                ops->target.addr = strtoull(c, NULL, 16);
+                }
+        } else {
                ops->target.addr = strtoull(ops->raw, NULL, 16);
+        }
        if (s++ != NULL) {
                ops->target.offset = strtoull(s, NULL, 16);
@@ -257,10 +267,27 @@ static int jump__parse(struct arch *arch __maybe_unused, struct ins_operands *op
 static int jump__scnprintf(struct ins *ins, char *bf, size_t size,
                           struct ins_operands *ops)
 {
+        const char *c = strchr(ops->raw, ',');
        if (!ops->target.addr || ops->target.offset < 0)
                return ins__raw_scnprintf(ins, bf, size, ops);
-        return scnprintf(bf, size, "%-6.6s %" PRIx64, ins->name, ops->target.offset);
+        if (c != NULL) {
+                const char *c2 = strchr(c + 1, ',');
+                /* check for 3-op insn */
+                if (c2 != NULL)
+                        c = c2;
+                c++;
+                /* mirror arch objdump's space-after-comma style */
+                if (*c == ' ')
+                        c++;
+        }
+        return scnprintf(bf, size, "%-6.6s %.*s%" PRIx64,
+                         ins->name, c ? c - ops->raw : 0, ops->raw,
+                         ops->target.offset);
 }
 static struct ins_ops jump_ops = {
@@ -1294,6 +1321,7 @@ static int dso__disassemble_filename(struct dso *dso, char *filename, size_t fil
        char linkname[PATH_MAX];
        char *build_id_filename;
        char *build_id_path = NULL;
+        char *pos;
        if (dso->symtab_type == DSO_BINARY_TYPE__KALLSYMS &&
            !dso__is_kcore(dso))
@@ -1313,7 +1341,14 @@ static int dso__disassemble_filename(struct dso *dso, char *filename, size_t fil
        if (!build_id_path)
                return -1;
-        dirname(build_id_path);
+        /*
+         * old style build-id cache has name of XX/XXXXXXX.. while
+         * new style has XX/XXXXXXX../{elf,kallsyms,vdso}.
+         * extract the build-id part of dirname in the new style only.
+         */
+        pos = strrchr(build_id_path, '/');
+        if (pos && strlen(pos) < SBUILD_ID_SIZE - 2)
+                dirname(build_id_path);
        if (dso__is_kcore(dso) ||
            readlink(build_id_path, linkname, sizeof(linkname)) < 0 ||
@@ -1396,31 +1431,10 @@ int symbol__disassemble(struct symbol *sym, struct map *map, const char *arch_na
                                sizeof(symfs_filename));
                }
        } else if (dso__needs_decompress(dso)) {
-                char tmp[PATH_MAX];
+                char tmp[KMOD_DECOMP_LEN];
-                struct kmod_path m;
-                int fd;
-                bool ret;
-                if (kmod_path__parse_ext(&m, symfs_filename))
-                        goto out;
-                snprintf(tmp, PATH_MAX, "/tmp/perf-kmod-XXXXXX");
-                fd = mkstemp(tmp);
-                if (fd < 0) {
-                        free(m.ext);
-                        goto out;
-                }
-                ret = decompress_to_file(m.ext, symfs_filename, fd);
-                if (ret)
-                        pr_err("Cannot decompress %s %s\n", m.ext, symfs_filename);
-                free(m.ext);
-                close(fd);
-                if (!ret)
+                if (dso__decompress_kmodule_path(dso, symfs_filename,
+                                                 tmp, sizeof(tmp)) < 0)
                        goto out;
                strcpy(symfs_filename, tmp);
@@ -1429,7 +1443,7 @@ int symbol__disassemble(struct symbol *sym, struct map *map, const char *arch_na
        snprintf(command, sizeof(command),
                 "%s %s%s --start-address=0x%016" PRIx64
                 " --stop-address=0x%016" PRIx64
-                 " -l -d %s %s -C %s 2>/dev/null|grep -v %s:|expand",
+                 " -l -d %s %s -C \"%s\" 2>/dev/null|grep -v \"%s:\"|expand",
                 objdump_path ? objdump_path : "objdump",
                 disassembler_style ? "-M " : "",
                 disassembler_style ? disassembler_style : "",
diff --git a/tools/perf/util/build-id.c b/tools/perf/util/build-id.c
index 168cc49654e7..e0148b081bdf 100644
--- a/tools/perf/util/build-id.c
+++ b/tools/perf/util/build-id.c
@@ -278,51 +278,6 @@ char *dso__build_id_filename(const struct dso *dso, char *bf, size_t size)
        return bf;
 }
-bool dso__build_id_is_kmod(const struct dso *dso, char *bf, size_t size)
-{
-        char *id_name = NULL, *ch;
-        struct stat sb;
-        char sbuild_id[SBUILD_ID_SIZE];
-        if (!dso->has_build_id)
-                goto err;
-        build_id__sprintf(dso->build_id, sizeof(dso->build_id), sbuild_id);
-        id_name = build_id_cache__linkname(sbuild_id, NULL, 0);
-        if (!id_name)
-                goto err;
-        if (access(id_name, F_OK))
-                goto err;
-        if (lstat(id_name, &sb) == -1)
-                goto err;
-        if ((size_t)sb.st_size > size - 1)
-                goto err;
-        if (readlink(id_name, bf, size - 1) < 0)
-                goto err;
-        bf[sb.st_size] = '\0';
-        /*
-         * link should be:
-         * ../../lib/modules/4.4.0-rc4/kernel/net/ipv4/netfilter/nf_nat_ipv4.ko/a09fe3eb3147dafa4e3b31dbd6257e4d696bdc92
-         */
-        ch = strrchr(bf, '/');
-        if (!ch)
-                goto err;
-        if (ch - 3 < bf)
-                goto err;
-        free(id_name);
-        return strncmp(".ko", ch - 3, 3) == 0;
-err:
-        pr_err("Invalid build id: %s\n", id_name ? :
-                                         dso->long_name ? :
-                                         dso->short_name ? :
-                                         "[unknown]");
-        free(id_name);
-        return false;
-}
 #define dsos__for_each_with_build_id(pos, head) \
        list_for_each_entry(pos, head, node)    \
                if (!pos->has_build_id)         \
diff --git a/tools/perf/util/build-id.h b/tools/perf/util/build-id.h
index 8a89b195c1fc..96690a55c62c 100644
--- a/tools/perf/util/build-id.h
+++ b/tools/perf/util/build-id.h
@@ -17,7 +17,6 @@ char *build_id_cache__kallsyms_path(const char *sbuild_id, char *bf,
                                    size_t size);
 char *dso__build_id_filename(const struct dso *dso, char *bf, size_t size);
-bool dso__build_id_is_kmod(const struct dso *dso, char *bf, size_t size);
 int build_id__mark_dso_hit(struct perf_tool *tool, union perf_event *event,
                           struct perf_sample *sample, struct perf_evsel *evsel,
diff --git a/tools/perf/util/dso.c b/tools/perf/util/dso.c
index a96a99d2369f..4e7ab611377a 100644
--- a/tools/perf/util/dso.c
+++ b/tools/perf/util/dso.c
@@ -248,6 +248,64 @@ bool dso__needs_decompress(struct dso *dso)
                dso->symtab_type == DSO_BINARY_TYPE__GUEST_KMODULE_COMP;
 }
+static int decompress_kmodule(struct dso *dso, const char *name, char *tmpbuf)
+{
+        int fd = -1;
+        struct kmod_path m;
+        if (!dso__needs_decompress(dso))
+                return -1;
+        if (kmod_path__parse_ext(&m, dso->long_name))
+                return -1;
+        if (!m.comp)
+                goto out;
+        fd = mkstemp(tmpbuf);
+        if (fd < 0) {
+                dso->load_errno = errno;
+                goto out;
+        }
+        if (!decompress_to_file(m.ext, name, fd)) {
+                dso->load_errno = DSO_LOAD_ERRNO__DECOMPRESSION_FAILURE;
+                close(fd);
+                fd = -1;
+        }
+out:
+        free(m.ext);
+        return fd;
+}
+int dso__decompress_kmodule_fd(struct dso *dso, const char *name)
+{
+        char tmpbuf[] = KMOD_DECOMP_NAME;
+        int fd;
+        fd = decompress_kmodule(dso, name, tmpbuf);
+        unlink(tmpbuf);
+        return fd;
+}
+int dso__decompress_kmodule_path(struct dso *dso, const char *name,
+                                 char *pathname, size_t len)
+{
+        char tmpbuf[] = KMOD_DECOMP_NAME;
+        int fd;
+        fd = decompress_kmodule(dso, name, tmpbuf);
+        if (fd < 0) {
+                unlink(tmpbuf);
+                return -1;
+        }
+        strncpy(pathname, tmpbuf, len);
+        close(fd);
+        return 0;
+}
 /*
 * Parses kernel module specified in @path and updates
 * @m argument like:
@@ -335,6 +393,21 @@ int __kmod_path__parse(struct kmod_path *m, const char *path,
        return 0;
 }
+void dso__set_module_info(struct dso *dso, struct kmod_path *m,
+                          struct machine *machine)
+{
+        if (machine__is_host(machine))
+                dso->symtab_type = DSO_BINARY_TYPE__SYSTEM_PATH_KMODULE;
+        else
+                dso->symtab_type = DSO_BINARY_TYPE__GUEST_KMODULE;
+        /* _KMODULE_COMP should be next to _KMODULE */
+        if (m->kmod && m->comp)
+                dso->symtab_type++;
+        dso__set_short_name(dso, strdup(m->name), true);
+}
 /*
 * Global list of open DSOs and the counter.
 */
@@ -381,7 +454,7 @@ static int do_open(char *name)
 static int __open_dso(struct dso *dso, struct machine *machine)
 {
-        int fd;
+        int fd = -EINVAL;
        char *root_dir = (char *)"";
        char *name = malloc(PATH_MAX);
@@ -392,15 +465,30 @@ static int __open_dso(struct dso *dso, struct machine *machine)
                root_dir = machine->root_dir;
        if (dso__read_binary_type_filename(dso, dso->binary_type,
-                                            root_dir, name, PATH_MAX)) {
+                                            root_dir, name, PATH_MAX))
-                free(name);
+                goto out;
-                return -EINVAL;
-        }
        if (!is_regular_file(name))
-                return -EINVAL;
+                goto out;
+        if (dso__needs_decompress(dso)) {
+                char newpath[KMOD_DECOMP_LEN];
+                size_t len = sizeof(newpath);
+                if (dso__decompress_kmodule_path(dso, name, newpath, len) < 0) {
+                        fd = -dso->load_errno;
+                        goto out;
+                }
+                strcpy(name, newpath);
+        }
        fd = do_open(name);
+        if (dso__needs_decompress(dso))
+                unlink(name);
+out:
        free(name);
        return fd;
 }
diff --git a/tools/perf/util/dso.h b/tools/perf/util/dso.h
index 12350b171727..bd061ba7b47c 100644
--- a/tools/perf/util/dso.h
+++ b/tools/perf/util/dso.h
@@ -244,6 +244,12 @@ bool is_supported_compression(const char *ext);
 bool is_kernel_module(const char *pathname, int cpumode);
 bool decompress_to_file(const char *ext, const char *filename, int output_fd);
 bool dso__needs_decompress(struct dso *dso);
+int dso__decompress_kmodule_fd(struct dso *dso, const char *name);
+int dso__decompress_kmodule_path(struct dso *dso, const char *name,
+                                 char *pathname, size_t len);
+#define KMOD_DECOMP_NAME  "/tmp/perf-kmod-XXXXXX"
+#define KMOD_DECOMP_LEN   sizeof(KMOD_DECOMP_NAME)
 struct kmod_path {
        char *name;
@@ -259,6 +265,9 @@ int __kmod_path__parse(struct kmod_path *m, const char *path,
 #define kmod_path__parse_name(__m, __p) __kmod_path__parse(__m, __p, true , false)
 #define kmod_path__parse_ext(__m, __p)  __kmod_path__parse(__m, __p, false, true)
+void dso__set_module_info(struct dso *dso, struct kmod_path *m,
+                          struct machine *machine);
 /*
 * The dso__data_* external interface provides following functions:
 *   dso__data_get_fd
diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
index 314a07151fb7..5cac8d5e009a 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -1469,8 +1469,16 @@ static int __event_process_build_id(struct build_id_event *bev,
                dso__set_build_id(dso, &bev->build_id);
-                if (!is_kernel_module(filename, cpumode))
+                if (dso_type != DSO_TYPE_USER) {
-                        dso->kernel = dso_type;
+                        struct kmod_path m = { .name = NULL, };
+                        if (!kmod_path__parse_name(&m, filename) && m.kmod)
+                                dso__set_module_info(dso, &m, machine);
+                        else
+                                dso->kernel = dso_type;
+                        free(m.name);
+                }
                build_id__sprintf(dso->build_id, sizeof(dso->build_id),
                                  sbuild_id);
diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
index d97e014c3df3..d7f31cb0a4cb 100644
--- a/tools/perf/util/machine.c
+++ b/tools/perf/util/machine.c
@@ -572,16 +572,7 @@ static struct dso *machine__findnew_module_dso(struct machine *machine,
                if (dso == NULL)
                        goto out_unlock;
-                if (machine__is_host(machine))
+                dso__set_module_info(dso, m, machine);
-                        dso->symtab_type = DSO_BINARY_TYPE__SYSTEM_PATH_KMODULE;
-                else
-                        dso->symtab_type = DSO_BINARY_TYPE__GUEST_KMODULE;
-                /* _KMODULE_COMP should be next to _KMODULE */
-                if (m->kmod && m->comp)
-                        dso->symtab_type++;
-                dso__set_short_name(dso, strdup(m->name), true);
                dso__set_long_name(dso, strdup(filename), true);
        }
diff --git a/tools/perf/util/scripting-engines/trace-event-python.c b/tools/perf/util/scripting-engines/trace-event-python.c
index 9d92af7d0718..40de3cb40d21 100644
--- a/tools/perf/util/scripting-engines/trace-event-python.c
+++ b/tools/perf/util/scripting-engines/trace-event-python.c
@@ -1219,7 +1219,7 @@ static int python_generate_script(struct pevent *pevent, const char *outfile)
        fprintf(ofp, "# be retrieved using Python functions of the form "
                "common_*(context).\n");
-        fprintf(ofp, "# See the perf-trace-python Documentation for the list "
+        fprintf(ofp, "# See the perf-script-python Documentation for the list "
                "of available functions.\n\n");
        fprintf(ofp, "import os\n");
diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
index e7ee47f7377a..502505cf236a 100644
--- a/tools/perf/util/symbol-elf.c
+++ b/tools/perf/util/symbol-elf.c
@@ -637,43 +637,6 @@ static int dso__swap_init(struct dso *dso, unsigned char eidata)
        return 0;
 }
-static int decompress_kmodule(struct dso *dso, const char *name,
-                              enum dso_binary_type type)
-{
-        int fd = -1;
-        char tmpbuf[] = "/tmp/perf-kmod-XXXXXX";
-        struct kmod_path m;
-        if (type != DSO_BINARY_TYPE__SYSTEM_PATH_KMODULE_COMP &&
-            type != DSO_BINARY_TYPE__GUEST_KMODULE_COMP &&
-            type != DSO_BINARY_TYPE__BUILD_ID_CACHE)
-                return -1;
-        if (type == DSO_BINARY_TYPE__BUILD_ID_CACHE)
-                name = dso->long_name;
-        if (kmod_path__parse_ext(&m, name) || !m.comp)
-                return -1;
-        fd = mkstemp(tmpbuf);
-        if (fd < 0) {
-                dso->load_errno = errno;
-                goto out;
-        }
-        if (!decompress_to_file(m.ext, name, fd)) {
-                dso->load_errno = DSO_LOAD_ERRNO__DECOMPRESSION_FAILURE;
-                close(fd);
-                fd = -1;
-        }
-        unlink(tmpbuf);
-out:
-        free(m.ext);
-        return fd;
-}
 bool symsrc__possibly_runtime(struct symsrc *ss)
 {
        return ss->dynsym || ss->opdsec;
@@ -705,9 +668,11 @@ int symsrc__init(struct symsrc *ss, struct dso *dso, const char *name,
        int fd;
        if (dso__needs_decompress(dso)) {
-                fd = decompress_kmodule(dso, name, type);
+                fd = dso__decompress_kmodule_fd(dso, name);
                if (fd < 0)
                        return -1;
+                type = dso->symtab_type;
        } else {
                fd = open(name, O_RDONLY);
                if (fd < 0) {
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index 8f2b068ff756..e7a98dbd2aed 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -1562,10 +1562,6 @@ int dso__load(struct dso *dso, struct map *map)
        if (!runtime_ss && syms_ss)
                runtime_ss = syms_ss;
-        if (syms_ss && syms_ss->type == DSO_BINARY_TYPE__BUILD_ID_CACHE)
-                if (dso__build_id_is_kmod(dso, name, PATH_MAX))
-                        kmod = true;
        if (syms_ss)
                ret = dso__load_sym(dso, map, syms_ss, runtime_ss, kmod);
        else
diff --git a/tools/perf/util/unwind-libdw.c b/tools/perf/util/unwind-libdw.c
index 943a06291587..da45c4be5fb3 100644
--- a/tools/perf/util/unwind-libdw.c
+++ b/tools/perf/util/unwind-libdw.c
@@ -39,6 +39,14 @@ static int __report_module(struct addr_location *al, u64 ip,
                return 0;
        mod = dwfl_addrmodule(ui->dwfl, ip);
+        if (mod) {
+                Dwarf_Addr s;
+                dwfl_module_info(mod, NULL, &s, NULL, NULL, NULL, NULL, NULL);
+                if (s != al->map->start)
+                        mod = 0;
+        }
        if (!mod)
                mod = dwfl_report_elf(ui->dwfl, dso->short_name,
                                      dso->long_name, -1, al->map->start,
@@ -224,7 +232,7 @@ int unwind__get_entries(unwind_entry_cb_t cb, void *arg,
        err = dwfl_getthread_frames(ui->dwfl, thread->tid, frame_callback, ui);
-        if (err && !ui->max_stack)
+        if (err && ui->max_stack != max_stack)
                err = 0;
        /*
author	Ingo Molnar <mingo@kernel.org>	2017-06-13 02:47:22 -0400
committer	Ingo Molnar <mingo@kernel.org>	2017-06-13 02:47:22 -0400
commit	3f365cf304ba3d316b3df2474af8d7df6edd2455 (patch)
tree	bb52465b35606bec268e9c1b88c746f8caf0f919
parent	bbf79d21bd4627a01ca8721c9373752819f8e4cc (diff)
parent	252d2a4117bc181b287eeddf848863788da733ae (diff)