Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Conflicts:
	net/ipv4/arp.c

The net/ipv4/arp.c conflict was one commit adding a new
local variable while another commit was deleting one.

Signed-off-by: David S. Miller <davem@davemloft.net>

1105 files changed, 12640 insertions, 7316 deletions

diff --git a/Documentation/devicetree/bindings/arm/gic-v3.txt b/Documentation/devicetree/bindings/arm/gic-v3.txt
index ddfade40ac59..7803e77d85cb 100644
--- a/Documentation/devicetree/bindings/arm/gic-v3.txt
+++ b/Documentation/devicetree/bindings/arm/gic-v3.txt
@@ -57,6 +57,8 @@ used to route Message Signalled Interrupts (MSI) to the CPUs.
 These nodes must have the following properties:
 - compatible : Should at least contain  "arm,gic-v3-its".
 - msi-controller : Boolean property. Identifies the node as an MSI controller
+- #msi-cells: Must be <1>. The single msi-cell is the DeviceID of the device
+  which will generate the MSI.
 - reg: Specifies the base physical address and size of the ITS
   registers.
 
@@ -83,6 +85,7 @@ Examples:
                 gic-its@2c200000 {
                         compatible = "arm,gic-v3-its";
                         msi-controller;
+                        #msi-cells = <1>;
                         reg = <0x0 0x2c200000 0 0x200000>;
                 };
         };
@@ -107,12 +110,14 @@ Examples:
                 gic-its@2c200000 {
                         compatible = "arm,gic-v3-its";
                         msi-controller;
+                        #msi-cells = <1>;
                         reg = <0x0 0x2c200000 0 0x200000>;
                 };
 
                 gic-its@2c400000 {
                         compatible = "arm,gic-v3-its";
                         msi-controller;
+                        #msi-cells = <1>;
                         reg = <0x0 0x2c400000 0 0x200000>;
                 };
         };
diff --git a/Documentation/devicetree/bindings/arm/idle-states.txt b/Documentation/devicetree/bindings/arm/idle-states.txt
index a8274eabae2e..b8e41c148a3c 100644
--- a/Documentation/devicetree/bindings/arm/idle-states.txt
+++ b/Documentation/devicetree/bindings/arm/idle-states.txt
@@ -497,7 +497,7 @@ cpus {
         };
 
         idle-states {
-                entry-method = "arm,psci";
+                entry-method = "psci";
 
                 CPU_RETENTION_0_0: cpu-retention-0-0 {
                         compatible = "arm,idle-state";
diff --git a/Documentation/devicetree/bindings/gpio/gpio.txt b/Documentation/devicetree/bindings/gpio/gpio.txt
index 5788d5cf1252..82d40e2505f6 100644
--- a/Documentation/devicetree/bindings/gpio/gpio.txt
+++ b/Documentation/devicetree/bindings/gpio/gpio.txt
@@ -16,7 +16,9 @@ properties, each containing a 'gpio-list':
 GPIO properties should be named "[<name>-]gpios", with <name> being the purpose
 of this GPIO for the device. While a non-existent <name> is considered valid
 for compatibility reasons (resolving to the "gpios" property), it is not allowed
-for new bindings.
+for new bindings. Also, GPIO properties named "[<name>-]gpio" are valid and old
+bindings use it, but are only supported for compatibility reasons and should not
+be used for newer bindings since it has been deprecated.
 
 GPIO properties can contain one or more GPIO phandles, but only in exceptional
 cases should they contain more than one. If your device uses several GPIOs with
diff --git a/Documentation/devicetree/bindings/iio/accel/bma180.txt b/Documentation/devicetree/bindings/iio/accel/bma180.txt
index c5933573e0f6..4a3679d54457 100644
--- a/Documentation/devicetree/bindings/iio/accel/bma180.txt
+++ b/Documentation/devicetree/bindings/iio/accel/bma180.txt
@@ -1,10 +1,11 @@
-* Bosch BMA180 triaxial acceleration sensor
+* Bosch BMA180 / BMA250 triaxial acceleration sensor
 
 http://omapworld.com/BMA180_111_1002839.pdf
+http://ae-bst.resource.bosch.com/media/products/dokumente/bma250/bst-bma250-ds002-05.pdf
 
 Required properties:
 
-  - compatible : should be "bosch,bma180"
+  - compatible : should be "bosch,bma180" or "bosch,bma250"
   - reg : the I2C address of the sensor
 
 Optional properties:
@@ -13,6 +14,9 @@ Optional properties:
 
   - interrupts : interrupt mapping for GPIO IRQ, it should by configured with
                 flags IRQ_TYPE_LEVEL_HIGH | IRQ_TYPE_EDGE_RISING
+                For the bma250 the first interrupt listed must be the one
+                connected to the INT1 pin, the second (optional) interrupt
+                listed must be the one connected to the INT2 pin.
 
 Example:
 
diff --git a/Documentation/devicetree/bindings/input/touchscreen/colibri-vf50-ts.txt b/Documentation/devicetree/bindings/input/touchscreen/colibri-vf50-ts.txt
new file mode 100644
index 000000000000..9d9e930f3251
--- /dev/null
+++ b/Documentation/devicetree/bindings/input/touchscreen/colibri-vf50-ts.txt
@@ -0,0 +1,36 @@
+* Toradex Colibri VF50 Touchscreen driver
+
+Required Properties:
+- compatible must be toradex,vf50-touchscreen
+- io-channels: adc channels being used by the Colibri VF50 module
+- xp-gpios: FET gate driver for input of X+
+- xm-gpios: FET gate driver for input of X-
+- yp-gpios: FET gate driver for input of Y+
+- ym-gpios: FET gate driver for input of Y-
+- interrupt-parent: phandle for the interrupt controller
+- interrupts: pen irq interrupt for touch detection
+- pinctrl-names: "idle", "default", "gpios"
+- pinctrl-0: pinctrl node for pen/touch detection state pinmux
+- pinctrl-1: pinctrl node for X/Y and pressure measurement (ADC) state pinmux
+- pinctrl-2: pinctrl node for gpios functioning as FET gate drivers
+- vf50-ts-min-pressure: pressure level at which to stop measuring X/Y values
+
+Example:
+
+        touchctrl: vf50_touchctrl {
+                compatible = "toradex,vf50-touchscreen";
+                io-channels = <&adc1 0>,<&adc0 0>,
+                                <&adc0 1>,<&adc1 2>;
+                xp-gpios = <&gpio0 13 GPIO_ACTIVE_LOW>;
+                xm-gpios = <&gpio2 29 GPIO_ACTIVE_HIGH>;
+                yp-gpios = <&gpio0 12 GPIO_ACTIVE_LOW>;
+                ym-gpios = <&gpio0 4 GPIO_ACTIVE_HIGH>;
+                interrupt-parent = <&gpio0>;
+                interrupts = <8 IRQ_TYPE_LEVEL_LOW>;
+                pinctrl-names = "idle","default","gpios";
+                pinctrl-0 = <&pinctrl_touchctrl_idle>;
+                pinctrl-1 = <&pinctrl_touchctrl_default>;
+                pinctrl-2 = <&pinctrl_touchctrl_gpios>;
+                vf50-ts-min-pressure = <200>;
+                status = "disabled";
+        };
diff --git a/Documentation/devicetree/bindings/input/touchscreen/imx6ul_tsc.txt b/Documentation/devicetree/bindings/input/touchscreen/imx6ul_tsc.txt
new file mode 100644
index 000000000000..853dff96dd9f
--- /dev/null
+++ b/Documentation/devicetree/bindings/input/touchscreen/imx6ul_tsc.txt
@@ -0,0 +1,36 @@
+* Freescale i.MX6UL Touch Controller
+
+Required properties:
+- compatible: must be "fsl,imx6ul-tsc".
+- reg: this touch controller address and the ADC2 address.
+- interrupts: the interrupt of this touch controller and ADC2.
+- clocks: the root clock of touch controller and ADC2.
+- clock-names; must be "tsc" and "adc".
+- xnur-gpio: the X- gpio this controller connect to.
+  This xnur-gpio returns to low once the finger leave the touch screen (The
+  last touch event the touch controller capture).
+
+Optional properties:
+- measure-delay-time: the value of measure delay time.
+  Before X-axis or Y-axis measurement, the screen need some time before
+  even potential distribution ready.
+  This value depends on the touch screen.
+- pre-charge-time: the touch screen need some time to precharge.
+  This value depends on the touch screen.
+
+Example:
+        tsc: tsc@02040000 {
+                compatible = "fsl,imx6ul-tsc";
+                reg = <0x02040000 0x4000>, <0x0219c000 0x4000>;
+                interrupts = <GIC_SPI 3 IRQ_TYPE_LEVEL_HIGH>,
+                             <GIC_SPI 101 IRQ_TYPE_LEVEL_HIGH>;
+                clocks = <&clks IMX6UL_CLK_IPG>,
+                         <&clks IMX6UL_CLK_ADC2>;
+                clock-names = "tsc", "adc";
+                pinctrl-names = "default";
+                pinctrl-0 = <&pinctrl_tsc>;
+                xnur-gpio = <&gpio1 3 GPIO_ACTIVE_LOW>;
+                measure-delay-time = <0xfff>;
+                pre-charge-time = <0xffff>;
+                status = "okay";
+        };
diff --git a/Documentation/devicetree/bindings/pci/pci-rcar-gen2.txt b/Documentation/devicetree/bindings/pci/pci-rcar-gen2.txt
index d8ef5bf50f11..7fab84b33531 100644
--- a/Documentation/devicetree/bindings/pci/pci-rcar-gen2.txt
+++ b/Documentation/devicetree/bindings/pci/pci-rcar-gen2.txt
@@ -7,7 +7,8 @@ OHCI and EHCI controllers.
 
 Required properties:
 - compatible: "renesas,pci-r8a7790" for the R8A7790 SoC;
-              "renesas,pci-r8a7791" for the R8A7791 SoC.
+              "renesas,pci-r8a7791" for the R8A7791 SoC;
+              "renesas,pci-r8a7794" for the R8A7794 SoC.
 - reg:  A list of physical regions to access the device: the first is
         the operational registers for the OHCI/EHCI controllers and the
         second is for the bridge configuration and control registers.
diff --git a/Documentation/devicetree/bindings/regulator/pbias-regulator.txt b/Documentation/devicetree/bindings/regulator/pbias-regulator.txt
index 32aa26f1e434..acbcb452a69a 100644
--- a/Documentation/devicetree/bindings/regulator/pbias-regulator.txt
+++ b/Documentation/devicetree/bindings/regulator/pbias-regulator.txt
@@ -2,7 +2,12 @@ PBIAS internal regulator for SD card dual voltage i/o pads on OMAP SoCs.
 
 Required properties:
 - compatible:
-  - "ti,pbias-omap" for OMAP2, OMAP3, OMAP4, OMAP5, DRA7.
+  - should be "ti,pbias-dra7" for DRA7
+  - should be "ti,pbias-omap2" for OMAP2
+  - should be "ti,pbias-omap3" for OMAP3
+  - should be "ti,pbias-omap4" for OMAP4
+  - should be "ti,pbias-omap5" for OMAP5
+  - "ti,pbias-omap" is deprecated
 - reg: pbias register offset from syscon base and size of pbias register.
 - syscon : phandle of the system control module
 - regulator-name : should be
diff --git a/Documentation/devicetree/bindings/spi/spi-mt65xx.txt b/Documentation/devicetree/bindings/spi/spi-mt65xx.txt
index dcefc438272f..6160ffbcb3d3 100644
--- a/Documentation/devicetree/bindings/spi/spi-mt65xx.txt
+++ b/Documentation/devicetree/bindings/spi/spi-mt65xx.txt
@@ -15,17 +15,18 @@ Required properties:
 - interrupts: Should contain spi interrupt
 
 - clocks: phandles to input clocks.
-  The first should be <&topckgen CLK_TOP_SPI_SEL>.
-  The second should be one of the following.
+  The first should be one of the following. It's PLL.
    -  <&clk26m>: specify parent clock 26MHZ.
    -  <&topckgen CLK_TOP_SYSPLL3_D2>: specify parent clock 109MHZ.
                                       It's the default one.
    -  <&topckgen CLK_TOP_SYSPLL4_D2>: specify parent clock 78MHZ.
    -  <&topckgen CLK_TOP_UNIVPLL2_D4>: specify parent clock 104MHZ.
    -  <&topckgen CLK_TOP_UNIVPLL1_D8>: specify parent clock 78MHZ.
+  The second should be <&topckgen CLK_TOP_SPI_SEL>. It's clock mux.
+  The third is <&pericfg CLK_PERI_SPI0>. It's clock gate.
 
-- clock-names: shall be "spi-clk" for the controller clock, and
-  "parent-clk" for the parent clock.
+- clock-names: shall be "parent-clk" for the parent clock, "sel-clk" for the
+  muxes clock, and "spi-clk" for the clock gate.
 
 Optional properties:
 - mediatek,pad-select: specify which pins group(ck/mi/mo/cs) spi
@@ -44,8 +45,11 @@ spi: spi@1100a000 {
         #size-cells = <0>;
         reg = <0 0x1100a000 0 0x1000>;
         interrupts = <GIC_SPI 110 IRQ_TYPE_LEVEL_LOW>;
-        clocks = <&topckgen CLK_TOP_SPI_SEL>, <&topckgen CLK_TOP_SYSPLL3_D2>;
-        clock-names = "spi-clk", "parent-clk";
+        clocks = <&topckgen CLK_TOP_SYSPLL3_D2>,
+                 <&topckgen CLK_TOP_SPI_SEL>,
+                 <&pericfg CLK_PERI_SPI0>;
+        clock-names = "parent-clk", "sel-clk", "spi-clk";
+
         mediatek,pad-select = <0>;
         status = "disabled";
 };
diff --git a/Documentation/devicetree/bindings/thermal/thermal.txt b/Documentation/devicetree/bindings/thermal/thermal.txt
index 8a49362dea6e..41b817f7b670 100644
--- a/Documentation/devicetree/bindings/thermal/thermal.txt
+++ b/Documentation/devicetree/bindings/thermal/thermal.txt
@@ -55,19 +55,11 @@ of heat dissipation). For example a fan's cooling states correspond to
 the different fan speeds possible. Cooling states are referred to by
 single unsigned integers, where larger numbers mean greater heat
 dissipation. The precise set of cooling states associated with a device
-(as referred to be the cooling-min-state and cooling-max-state
+(as referred to by the cooling-min-level and cooling-max-level
 properties) should be defined in a particular device's binding.
 For more examples of cooling devices, refer to the example sections below.
 
 Required properties:
-- cooling-min-state:    An integer indicating the smallest
-  Type: unsigned        cooling state accepted. Typically 0.
-  Size: one cell
-
-- cooling-max-state:    An integer indicating the largest
-  Type: unsigned        cooling state accepted.
-  Size: one cell
-
 - #cooling-cells:       Used to provide cooling device specific information
   Type: unsigned        while referring to it. Must be at least 2, in order
   Size: one cell        to specify minimum and maximum cooling state used
@@ -77,6 +69,15 @@ Required properties:
                         See Cooling device maps section below for more details
                         on how consumers refer to cooling devices.
 
+Optional properties:
+- cooling-min-level:    An integer indicating the smallest
+  Type: unsigned        cooling state accepted. Typically 0.
+  Size: one cell
+
+- cooling-max-level:    An integer indicating the largest
+  Type: unsigned        cooling state accepted.
+  Size: one cell
+
 * Trip points
 
 The trip node is a node to describe a point in the temperature domain
@@ -225,8 +226,8 @@ cpus {
                         396000  950000
                         198000  850000
                 >;
-                cooling-min-state = <0>;
-                cooling-max-state = <3>;
+                cooling-min-level = <0>;
+                cooling-max-level = <3>;
                 #cooling-cells = <2>; /* min followed by max */
         };
         ...
@@ -240,8 +241,8 @@ cpus {
          */
         fan0: fan@0x48 {
                 ...
-                cooling-min-state = <0>;
-                cooling-max-state = <9>;
+                cooling-min-level = <0>;
+                cooling-max-level = <9>;
                 #cooling-cells = <2>; /* min followed by max */
         };
 };
diff --git a/Documentation/devicetree/bindings/vendor-prefixes.txt b/Documentation/devicetree/bindings/vendor-prefixes.txt
index ac5f0c34ae00..82d2ac97af74 100644
--- a/Documentation/devicetree/bindings/vendor-prefixes.txt
+++ b/Documentation/devicetree/bindings/vendor-prefixes.txt
@@ -203,6 +203,7 @@ sitronix	Sitronix Technology Corporation
 skyworks        Skyworks Solutions, Inc.
 smsc    Standard Microsystems Corporation
 snps    Synopsys, Inc.
+socionext       Socionext Inc.
 solidrun        SolidRun
 solomon        Solomon Systech Limited
 sony    Sony Corporation
diff --git a/Documentation/devicetree/bindings/watchdog/atmel-sama5d4-wdt.txt b/Documentation/devicetree/bindings/watchdog/atmel-sama5d4-wdt.txt
new file mode 100644
index 000000000000..f7cc7c060910
--- /dev/null
+++ b/Documentation/devicetree/bindings/watchdog/atmel-sama5d4-wdt.txt
@@ -0,0 +1,35 @@
+* Atmel SAMA5D4 Watchdog Timer (WDT) Controller
+
+Required properties:
+- compatible: "atmel,sama5d4-wdt"
+- reg: base physical address and length of memory mapped region.
+
+Optional properties:
+- timeout-sec: watchdog timeout value (in seconds).
+- interrupts: interrupt number to the CPU.
+- atmel,watchdog-type: should be "hardware" or "software".
+        "hardware": enable watchdog fault reset. A watchdog fault triggers
+                    watchdog reset.
+        "software": enable watchdog fault interrupt. A watchdog fault asserts
+                    watchdog interrupt.
+- atmel,idle-halt: present if you want to stop the watchdog when the CPU is
+                   in idle state.
+        CAUTION: This property should be used with care, it actually makes the
+        watchdog not counting when the CPU is in idle state, therefore the
+        watchdog reset time depends on mean CPU usage and will not reset at all
+        if the CPU stop working while it is in idle state, which is probably
+        not what you want.
+- atmel,dbg-halt: present if you want to stop the watchdog when the CPU is
+                  in debug state.
+
+Example:
+        watchdog@fc068640 {
+                compatible = "atmel,sama5d4-wdt";
+                reg = <0xfc068640 0x10>;
+                interrupts = <4 IRQ_TYPE_LEVEL_HIGH 5>;
+                timeout-sec = <10>;
+                atmel,watchdog-type = "hardware";
+                atmel,dbg-halt;
+                atmel,idle-halt;
+                status = "okay";
+        };
diff --git a/Documentation/devicetree/bindings/watchdog/lpc18xx-wdt.txt b/Documentation/devicetree/bindings/watchdog/lpc18xx-wdt.txt
new file mode 100644
index 000000000000..09f6b24969e0
--- /dev/null
+++ b/Documentation/devicetree/bindings/watchdog/lpc18xx-wdt.txt
@@ -0,0 +1,19 @@
+* NXP LPC18xx Watchdog Timer (WDT)
+
+Required properties:
+- compatible: Should be "nxp,lpc1850-wwdt"
+- reg: Should contain WDT registers location and length
+- clocks: Must contain an entry for each entry in clock-names.
+- clock-names: Should contain "wdtclk" and "reg"; the watchdog counter
+               clock and register interface clock respectively.
+- interrupts: Should contain WDT interrupt
+
+Examples:
+
+watchdog@40080000 {
+        compatible = "nxp,lpc1850-wwdt";
+        reg = <0x40080000 0x24>;
+        clocks = <&cgu BASE_SAFE_CLK>, <&ccu1 CLK_CPU_WWDT>;
+        clock-names = "wdtclk", "reg";
+        interrupts = <49>;
+};
diff --git a/Documentation/gpio/board.txt b/Documentation/gpio/board.txt
index b80606de545a..f59c43b6411b 100644
--- a/Documentation/gpio/board.txt
+++ b/Documentation/gpio/board.txt
@@ -21,8 +21,8 @@ exact way to do it depends on the GPIO controller providing the GPIOs, see the
 device tree bindings for your controller.
 
 GPIOs mappings are defined in the consumer device's node, in a property named
-<function>-gpios, where <function> is the function the driver will request
-through gpiod_get(). For example:
+either <function>-gpios or <function>-gpio, where <function> is the function
+the driver will request through gpiod_get(). For example:
 
         foo_device {
                 compatible = "acme,foo";
@@ -31,7 +31,7 @@ through gpiod_get(). For example:
                             <&gpio 16 GPIO_ACTIVE_HIGH>, /* green */
                             <&gpio 17 GPIO_ACTIVE_HIGH>; /* blue */
 
-                power-gpios = <&gpio 1 GPIO_ACTIVE_LOW>;
+                power-gpio = <&gpio 1 GPIO_ACTIVE_LOW>;
         };
 
 This property will make GPIOs 15, 16 and 17 available to the driver under the
@@ -39,15 +39,24 @@ This property will make GPIOs 15, 16 and 17 available to the driver under the
 
         struct gpio_desc *red, *green, *blue, *power;
 
-        red = gpiod_get_index(dev, "led", 0);
-        green = gpiod_get_index(dev, "led", 1);
-        blue = gpiod_get_index(dev, "led", 2);
+        red = gpiod_get_index(dev, "led", 0, GPIOD_OUT_HIGH);
+        green = gpiod_get_index(dev, "led", 1, GPIOD_OUT_HIGH);
+        blue = gpiod_get_index(dev, "led", 2, GPIOD_OUT_HIGH);
 
-        power = gpiod_get(dev, "power");
+        power = gpiod_get(dev, "power", GPIOD_OUT_HIGH);
 
 The led GPIOs will be active-high, while the power GPIO will be active-low (i.e.
 gpiod_is_active_low(power) will be true).
 
+The second parameter of the gpiod_get() functions, the con_id string, has to be
+the <function>-prefix of the GPIO suffixes ("gpios" or "gpio", automatically
+looked up by the gpiod functions internally) used in the device tree. With above
+"led-gpios" example, use the prefix without the "-" as con_id parameter: "led".
+
+Internally, the GPIO subsystem prefixes the GPIO suffix ("gpios" or "gpio")
+with the string passed in con_id to get the resulting string
+(snprintf(... "%s-%s", con_id, gpio_suffixes[]).
+
 ACPI
 ----
 ACPI also supports function names for GPIOs in a similar fashion to DT.
@@ -142,13 +151,14 @@ The driver controlling "foo.0" will then be able to obtain its GPIOs as follows:
 
         struct gpio_desc *red, *green, *blue, *power;
 
-        red = gpiod_get_index(dev, "led", 0);
-        green = gpiod_get_index(dev, "led", 1);
-        blue = gpiod_get_index(dev, "led", 2);
+        red = gpiod_get_index(dev, "led", 0, GPIOD_OUT_HIGH);
+        green = gpiod_get_index(dev, "led", 1, GPIOD_OUT_HIGH);
+        blue = gpiod_get_index(dev, "led", 2, GPIOD_OUT_HIGH);
 
-        power = gpiod_get(dev, "power");
-        gpiod_direction_output(power, 1);
+        power = gpiod_get(dev, "power", GPIOD_OUT_HIGH);
 
-Since the "power" GPIO is mapped as active-low, its actual signal will be 0
-after this code. Contrary to the legacy integer GPIO interface, the active-low
-property is handled during mapping and is thus transparent to GPIO consumers.
+Since the "led" GPIOs are mapped as active-high, this example will switch their
+signals to 1, i.e. enabling the LEDs. And for the "power" GPIO, which is mapped
+as active-low, its actual signal will be 0 after this code. Contrary to the legacy
+integer GPIO interface, the active-low property is handled during mapping and is
+thus transparent to GPIO consumers.
diff --git a/Documentation/gpio/consumer.txt b/Documentation/gpio/consumer.txt
index a206639454ab..e000502fde20 100644
--- a/Documentation/gpio/consumer.txt
+++ b/Documentation/gpio/consumer.txt
@@ -39,6 +39,9 @@ device that displays digits), an additional index argument can be specified:
                                           const char *con_id, unsigned int idx,
                                           enum gpiod_flags flags)
 
+For a more detailed description of the con_id parameter in the DeviceTree case
+see Documentation/gpio/board.txt
+
 The flags parameter is used to optionally specify a direction and initial value
 for the GPIO. Values can be:
 
diff --git a/Documentation/hwmon/nct6775 b/Documentation/hwmon/nct6775
index f0dd3d2fec96..76add4c9cd68 100644
--- a/Documentation/hwmon/nct6775
+++ b/Documentation/hwmon/nct6775
@@ -32,6 +32,10 @@ Supported chips:
     Prefix: 'nct6792'
     Addresses scanned: ISA address retrieved from Super I/O registers
     Datasheet: Available from Nuvoton upon request
+  * Nuvoton NCT6793D
+    Prefix: 'nct6793'
+    Addresses scanned: ISA address retrieved from Super I/O registers
+    Datasheet: Available from Nuvoton upon request
 
 Authors:
         Guenter Roeck <linux@roeck-us.net>
diff --git a/Documentation/networking/vrf.txt b/Documentation/networking/vrf.txt
new file mode 100644
index 000000000000..031ef4a63485
--- /dev/null
+++ b/Documentation/networking/vrf.txt
@@ -0,0 +1,96 @@
+Virtual Routing and Forwarding (VRF)
+====================================
+The VRF device combined with ip rules provides the ability to create virtual
+routing and forwarding domains (aka VRFs, VRF-lite to be specific) in the
+Linux network stack. One use case is the multi-tenancy problem where each
+tenant has their own unique routing tables and in the very least need
+different default gateways.
+
+Processes can be "VRF aware" by binding a socket to the VRF device. Packets
+through the socket then use the routing table associated with the VRF
+device. An important feature of the VRF device implementation is that it
+impacts only Layer 3 and above so L2 tools (e.g., LLDP) are not affected
+(ie., they do not need to be run in each VRF). The design also allows
+the use of higher priority ip rules (Policy Based Routing, PBR) to take
+precedence over the VRF device rules directing specific traffic as desired.
+
+In addition, VRF devices allow VRFs to be nested within namespaces. For
+example network namespaces provide separation of network interfaces at L1
+(Layer 1 separation), VLANs on the interfaces within a namespace provide
+L2 separation and then VRF devices provide L3 separation.
+
+Design
+------
+A VRF device is created with an associated route table. Network interfaces
+are then enslaved to a VRF device:
+
+         +-----------------------------+
+         |           vrf-blue          |  ===> route table 10
+         +-----------------------------+
+            |        |            |
+         +------+ +------+     +-------------+
+         | eth1 | | eth2 | ... |    bond1    |
+         +------+ +------+     +-------------+
+                                  |       |
+                              +------+ +------+
+                              | eth8 | | eth9 |
+                              +------+ +------+
+
+Packets received on an enslaved device and are switched to the VRF device
+using an rx_handler which gives the impression that packets flow through
+the VRF device. Similarly on egress routing rules are used to send packets
+to the VRF device driver before getting sent out the actual interface. This
+allows tcpdump on a VRF device to capture all packets into and out of the
+VRF as a whole.[1] Similiarly, netfilter [2] and tc rules can be applied
+using the VRF device to specify rules that apply to the VRF domain as a whole.
+
+[1] Packets in the forwarded state do not flow through the device, so those
+    packets are not seen by tcpdump. Will revisit this limitation in a
+    future release.
+
+[2] Iptables on ingress is limited to NF_INET_PRE_ROUTING only with skb->dev
+    set to real ingress device and egress is limited to NF_INET_POST_ROUTING.
+    Will revisit this limitation in a future release.
+
+
+Setup
+-----
+1. VRF device is created with an association to a FIB table.
+   e.g, ip link add vrf-blue type vrf table 10
+        ip link set dev vrf-blue up
+
+2. Rules are added that send lookups to the associated FIB table when the
+   iif or oif is the VRF device. e.g.,
+       ip ru add oif vrf-blue table 10
+       ip ru add iif vrf-blue table 10
+
+   Set the default route for the table (and hence default route for the VRF).
+   e.g, ip route add table 10 prohibit default
+
+3. Enslave L3 interfaces to a VRF device.
+   e.g,  ip link set dev eth1 master vrf-blue
+
+   Local and connected routes for enslaved devices are automatically moved to
+   the table associated with VRF device. Any additional routes depending on
+   the enslaved device will need to be reinserted following the enslavement.
+
+4. Additional VRF routes are added to associated table.
+   e.g., ip route add table 10 ...
+
+
+Applications
+------------
+Applications that are to work within a VRF need to bind their socket to the
+VRF device:
+
+    setsockopt(sd, SOL_SOCKET, SO_BINDTODEVICE, dev, strlen(dev)+1);
+
+or to specify the output device using cmsg and IP_PKTINFO.
+
+
+Limitations
+-----------
+VRF device currently only works for IPv4. Support for IPv6 is under development.
+
+Index of original ingress interface is not available via cmsg. Will address
+soon.
diff --git a/Documentation/static-keys.txt b/Documentation/static-keys.txt
index f4cb0b2d5cd7..477927becacb 100644
--- a/Documentation/static-keys.txt
+++ b/Documentation/static-keys.txt
@@ -15,8 +15,8 @@ The updated API replacements are:
 
 DEFINE_STATIC_KEY_TRUE(key);
 DEFINE_STATIC_KEY_FALSE(key);
-static_key_likely()
-statick_key_unlikely()
+static_branch_likely()
+static_branch_unlikely()
 
 0) Abstract
 
diff --git a/Documentation/sysctl/net.txt b/Documentation/sysctl/net.txt
index 6294b5186ae5..809ab6efcc74 100644
--- a/Documentation/sysctl/net.txt
+++ b/Documentation/sysctl/net.txt
@@ -54,13 +54,15 @@ default_qdisc
 --------------
 
 The default queuing discipline to use for network devices. This allows
-overriding the default queue discipline of pfifo_fast with an
-alternative. Since the default queuing discipline is created with the
-no additional parameters so is best suited to queuing disciplines that
-work well without configuration like stochastic fair queue (sfq),
-CoDel (codel) or fair queue CoDel (fq_codel). Don't use queuing disciplines
-like Hierarchical Token Bucket or Deficit Round Robin which require setting
-up classes and bandwidths.
+overriding the default of pfifo_fast with an alternative. Since the default
+queuing discipline is created without additional parameters so is best suited
+to queuing disciplines that work well without configuration like stochastic
+fair queue (sfq), CoDel (codel) or fair queue CoDel (fq_codel). Don't use
+queuing disciplines like Hierarchical Token Bucket or Deficit Round Robin
+which require setting up classes and bandwidths. Note that physical multiqueue
+interfaces still use mq as root qdisc, which in turn uses this default for its
+leaves. Virtual devices (like e.g. lo or veth) ignore this setting and instead
+default to noqueue.
 Default: pfifo_fast
 
 busy_read
diff --git a/Documentation/thermal/power_allocator.txt b/Documentation/thermal/power_allocator.txt
index c3797b529991..a1ce2235f121 100644
--- a/Documentation/thermal/power_allocator.txt
+++ b/Documentation/thermal/power_allocator.txt
@@ -4,7 +4,7 @@ Power allocator governor tunables
 Trip points
 -----------
 
-The governor requires the following two passive trip points:
+The governor works optimally with the following two passive trip points:
 
 1.  "switch on" trip point: temperature above which the governor
     control loop starts operating.  This is the first passive trip
diff --git a/Documentation/thermal/sysfs-api.txt b/Documentation/thermal/sysfs-api.txt
index c1f6864a8c5d..10f062ea6bc2 100644
--- a/Documentation/thermal/sysfs-api.txt
+++ b/Documentation/thermal/sysfs-api.txt
@@ -180,6 +180,7 @@ Thermal zone device sys I/F, created once it's registered:
     |---temp:                   Current temperature
     |---mode:                   Working mode of the thermal zone
     |---policy:                 Thermal governor used for this zone
+    |---available_policies:     Available thermal governors for this zone
     |---trip_point_[0-*]_temp:  Trip point temperature
     |---trip_point_[0-*]_type:  Trip point type
     |---trip_point_[0-*]_hyst:  Hysteresis value for this trip point
@@ -256,6 +257,10 @@ policy
         One of the various thermal governors used for a particular zone.
         RW, Required
 
+available_policies
+        Available thermal governors which can be used for a particular zone.
+        RO, Required
+
 trip_point_[0-*]_temp
         The temperature above which trip point will be fired.
         Unit: millidegree Celsius
@@ -417,6 +422,7 @@ method, the sys I/F structure will be built like this:
     |---temp:                   37000
     |---mode:                   enabled
     |---policy:                 step_wise
+    |---available_policies:     step_wise fair_share
     |---trip_point_0_temp:      100000
     |---trip_point_0_type:      critical
     |---trip_point_1_temp:      80000
diff --git a/Documentation/watchdog/src/watchdog-test.c b/Documentation/watchdog/src/watchdog-test.c
index 3da822967ee0..fcdde8fc98be 100644
--- a/Documentation/watchdog/src/watchdog-test.c
+++ b/Documentation/watchdog/src/watchdog-test.c
@@ -41,6 +41,7 @@ static void term(int sig)
 int main(int argc, char *argv[])
 {
     int flags;
+    unsigned int ping_rate = 1;
 
     fd = open("/dev/watchdog", O_WRONLY);
 
@@ -63,22 +64,33 @@ int main(int argc, char *argv[])
             fprintf(stderr, "Watchdog card enabled.\n");
             fflush(stderr);
             goto end;
+        } else if (!strncasecmp(argv[1], "-t", 2) && argv[2]) {
+            flags = atoi(argv[2]);
+            ioctl(fd, WDIOC_SETTIMEOUT, &flags);
+            fprintf(stderr, "Watchdog timeout set to %u seconds.\n", flags);
+            fflush(stderr);
+            goto end;
+        } else if (!strncasecmp(argv[1], "-p", 2) && argv[2]) {
+            ping_rate = strtoul(argv[2], NULL, 0);
+            fprintf(stderr, "Watchdog ping rate set to %u seconds.\n", ping_rate);
+            fflush(stderr);
         } else {
-            fprintf(stderr, "-d to disable, -e to enable.\n");
+            fprintf(stderr, "-d to disable, -e to enable, -t <n> to set " \
+                "the timeout,\n-p <n> to set the ping rate, and \n");
             fprintf(stderr, "run by itself to tick the card.\n");
             fflush(stderr);
             goto end;
         }
-    } else {
-        fprintf(stderr, "Watchdog Ticking Away!\n");
-        fflush(stderr);
     }
 
+    fprintf(stderr, "Watchdog Ticking Away!\n");
+    fflush(stderr);
+
     signal(SIGINT, term);
 
     while(1) {
         keep_alive();
-        sleep(1);
+        sleep(ping_rate);
     }
 end:
     close(fd);
diff --git a/MAINTAINERS b/MAINTAINERS
index c978a257f4aa..bcd263de4827 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -808,6 +808,13 @@ S:	Maintained
 F:      drivers/video/fbdev/arcfb.c
 F:      drivers/video/fbdev/core/fb_defio.c
 
+ARCNET NETWORK LAYER
+M:      Michael Grzeschik <m.grzeschik@pengutronix.de>
+L:      netdev@vger.kernel.org
+S:      Maintained
+F:      drivers/net/arcnet/
+F:      include/uapi/linux/if_arcnet.h
+
 ARM MFM AND FLOPPY DRIVERS
 M:      Ian Molton <spyro@f2s.com>
 S:      Maintained
@@ -6452,11 +6459,11 @@ F:	drivers/hwmon/ltc4261.c
 LTP (Linux Test Project)
 M:      Mike Frysinger <vapier@gentoo.org>
 M:      Cyril Hrubis <chrubis@suse.cz>
-M:      Wanlong Gao <gaowanlong@cn.fujitsu.com>
+M:      Wanlong Gao <wanlong.gao@gmail.com>
 M:      Jan Stancek <jstancek@redhat.com>
 M:      Stanislav Kholmanskikh <stanislav.kholmanskikh@oracle.com>
 M:      Alexey Kodanev <alexey.kodanev@oracle.com>
-L:      ltp-list@lists.sourceforge.net (subscribers-only)
+L:      ltp@lists.linux.it (subscribers-only)
 W:      http://linux-test-project.github.io/
 T:      git git://github.com/linux-test-project/ltp.git
 S:      Maintained
@@ -6789,6 +6796,14 @@ W:	http://www.mellanox.com
 Q:      http://patchwork.ozlabs.org/project/netdev/list/
 F:      drivers/net/ethernet/mellanox/mlxsw/
 
+MEMBARRIER SUPPORT
+M:      Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+M:      "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
+L:      linux-kernel@vger.kernel.org
+S:      Supported
+F:      kernel/membarrier.c
+F:      include/uapi/linux/membarrier.h
+
 MEMORY MANAGEMENT
 L:      linux-mm@kvack.org
 W:      http://www.linux-mm.org
@@ -7395,6 +7410,7 @@ NTB DRIVER CORE
 M:      Jon Mason <jdmason@kudzu.us>
 M:      Dave Jiang <dave.jiang@intel.com>
 M:      Allen Hubbe <Allen.Hubbe@emc.com>
+L:      linux-ntb@googlegroups.com
 S:      Supported
 W:      https://github.com/jonmason/ntb/wiki
 T:      git git://github.com/jonmason/ntb.git
@@ -7406,6 +7422,7 @@ F:	include/linux/ntb_transport.h
 NTB INTEL DRIVER
 M:      Jon Mason <jdmason@kudzu.us>
 M:      Dave Jiang <dave.jiang@intel.com>
+L:      linux-ntb@googlegroups.com
 S:      Supported
 W:      https://github.com/jonmason/ntb/wiki
 T:      git git://github.com/jonmason/ntb.git
@@ -8489,7 +8506,6 @@ F:	Documentation/networking/LICENSE.qla3xxx
 F:      drivers/net/ethernet/qlogic/qla3xxx.*
 
 QLOGIC QLCNIC (1/10)Gb ETHERNET DRIVER
-M:      Shahed Shaikh <shahed.shaikh@qlogic.com>
 M:      Dept-GELinuxNICDev@qlogic.com
 L:      netdev@vger.kernel.org
 S:      Supported
@@ -10327,6 +10343,16 @@ F:	include/uapi/linux/thermal.h
 F:      include/linux/cpu_cooling.h
 F:      Documentation/devicetree/bindings/thermal/
 
+THERMAL/CPU_COOLING
+M:      Amit Daniel Kachhap <amit.kachhap@gmail.com>
+M:      Viresh Kumar <viresh.kumar@linaro.org>
+M:      Javi Merino <javi.merino@arm.com>
+L:      linux-pm@vger.kernel.org
+S:      Supported
+F:      Documentation/thermal/cpu-cooling-api.txt
+F:      drivers/thermal/cpu_cooling.c
+F:      include/linux/cpu_cooling.h
+
 THINGM BLINK(1) USB RGB LED DRIVER
 M:      Vivien Didelot <vivien.didelot@savoirfairelinux.com>
 S:      Maintained
@@ -11228,7 +11254,6 @@ VOLTAGE AND CURRENT REGULATOR FRAMEWORK
 M:      Liam Girdwood <lgirdwood@gmail.com>
 M:      Mark Brown <broonie@kernel.org>
 L:      linux-kernel@vger.kernel.org
-W:      http://opensource.wolfsonmicro.com/node/15
 W:      http://www.slimlogic.co.uk/?p=48
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator.git
 S:      Supported
@@ -11242,6 +11267,7 @@ L:	netdev@vger.kernel.org
 S:      Maintained
 F:      drivers/net/vrf.c
 F:      include/net/vrf.h
+F:      Documentation/networking/vrf.txt
 
 VT1211 HARDWARE MONITOR DRIVER
 M:      Juerg Haefliger <juergh@gmail.com>
@@ -11357,17 +11383,15 @@ WM97XX TOUCHSCREEN DRIVERS
 M:      Mark Brown <broonie@kernel.org>
 M:      Liam Girdwood <lrg@slimlogic.co.uk>
 L:      linux-input@vger.kernel.org
-T:      git git://opensource.wolfsonmicro.com/linux-2.6-touch
-W:      http://opensource.wolfsonmicro.com/node/7
+W:      https://github.com/CirrusLogic/linux-drivers/wiki
 S:      Supported
 F:      drivers/input/touchscreen/*wm97*
 F:      include/linux/wm97xx.h
 
 WOLFSON MICROELECTRONICS DRIVERS
 L:      patches@opensource.wolfsonmicro.com
-T:      git git://opensource.wolfsonmicro.com/linux-2.6-asoc
-T:      git git://opensource.wolfsonmicro.com/linux-2.6-audioplus
-W:      http://opensource.wolfsonmicro.com/content/linux-drivers-wolfson-devices
+T:      git https://github.com/CirrusLogic/linux-drivers.git
+W:      https://github.com/CirrusLogic/linux-drivers/wiki
 S:      Supported
 F:      Documentation/hwmon/wm83??
 F:      arch/arm/mach-s3c64xx/mach-crag6410*
diff --git a/Makefile b/Makefile
index f2d27061e5f7..84f4b31e3c6e 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 4
-PATCHLEVEL = 2
+PATCHLEVEL = 3
 SUBLEVEL = 0
-EXTRAVERSION =
+EXTRAVERSION = -rc2
 NAME = Hurr durr I'ma sheep
 
 # *DOCUMENTATION*
diff --git a/arch/alpha/include/asm/io.h b/arch/alpha/include/asm/io.h
index f05bdb4b1cb9..ff4049155c84 100644
--- a/arch/alpha/include/asm/io.h
+++ b/arch/alpha/include/asm/io.h
@@ -297,7 +297,9 @@ static inline void __iomem * ioremap_nocache(unsigned long offset,
                                              unsigned long size)
 {
         return ioremap(offset, size);
-} 
+}
+
+#define ioremap_uc ioremap_nocache
 
 static inline void iounmap(volatile void __iomem *addr)
 {
diff --git a/arch/alpha/kernel/irq.c b/arch/alpha/kernel/irq.c
index 2804648c8ff4..2d6efcff3bf3 100644
--- a/arch/alpha/kernel/irq.c
+++ b/arch/alpha/kernel/irq.c
@@ -117,6 +117,6 @@ handle_irq(int irq)
         }
 
         irq_enter();
-        generic_handle_irq_desc(irq, desc);
+        generic_handle_irq_desc(desc);
         irq_exit();
 }
diff --git a/arch/alpha/kernel/pci.c b/arch/alpha/kernel/pci.c
index cded02c890aa..5f387ee5b5c5 100644
--- a/arch/alpha/kernel/pci.c
+++ b/arch/alpha/kernel/pci.c
@@ -242,7 +242,12 @@ pci_restore_srm_config(void)
 
 void pcibios_fixup_bus(struct pci_bus *bus)
 {
-        struct pci_dev *dev;
+        struct pci_dev *dev = bus->self;
+
+        if (pci_has_flag(PCI_PROBE_ONLY) && dev &&
+            (dev->class >> 8) == PCI_CLASS_BRIDGE_PCI) {
+                pci_read_bridge_bases(bus);
+        }
 
         list_for_each_entry(dev, &bus->devices, bus_list) {
                 pdev_save_srm_config(dev);
diff --git a/arch/alpha/lib/udelay.c b/arch/alpha/lib/udelay.c
index 69d52aa37bae..f2d81ff38aa6 100644
--- a/arch/alpha/lib/udelay.c
+++ b/arch/alpha/lib/udelay.c
@@ -30,6 +30,7 @@ __delay(int loops)
                 "       bgt %0,1b"
                 : "=&r" (tmp), "=r" (loops) : "1"(loops));
 }
+EXPORT_SYMBOL(__delay);
 
 #ifdef CONFIG_SMP
 #define LPJ      cpu_data[smp_processor_id()].loops_per_jiffy
diff --git a/arch/arc/kernel/mcip.c b/arch/arc/kernel/mcip.c
index d9e44b62df05..4ffd1855f1bd 100644
--- a/arch/arc/kernel/mcip.c
+++ b/arch/arc/kernel/mcip.c
@@ -252,7 +252,7 @@ static struct irq_chip idu_irq_chip = {
 
 static int idu_first_irq;
 
-static void idu_cascade_isr(unsigned int __core_irq, struct irq_desc *desc)
+static void idu_cascade_isr(struct irq_desc *desc)
 {
         struct irq_domain *domain = irq_desc_get_handler_data(desc);
         unsigned int core_irq = irq_desc_get_irq(desc);
diff --git a/arch/arc/plat-axs10x/axs10x.c b/arch/arc/plat-axs10x/axs10x.c
index ad9825d4026a..0a77b19e1df8 100644
--- a/arch/arc/plat-axs10x/axs10x.c
+++ b/arch/arc/plat-axs10x/axs10x.c
@@ -402,6 +402,8 @@ static void __init axs103_early_init(void)
         unsigned int num_cores = (read_aux_reg(ARC_REG_MCIP_BCR) >> 16) & 0x3F;
         if (num_cores > 2)
                 arc_set_core_freq(50 * 1000000);
+        else if (num_cores == 2)
+                arc_set_core_freq(75 * 1000000);
 #endif
 
         switch (arc_get_core_freq()/1000000) {
diff --git a/arch/arm/Makefile b/arch/arm/Makefile
index 7451b447cc2d..2c2b28ee4811 100644
--- a/arch/arm/Makefile
+++ b/arch/arm/Makefile
@@ -54,6 +54,14 @@ AS		+= -EL
 LD              += -EL
 endif
 
+#
+# The Scalar Replacement of Aggregates (SRA) optimization pass in GCC 4.9 and
+# later may result in code being generated that handles signed short and signed
+# char struct members incorrectly. So disable it.
+# (https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65932)
+#
+KBUILD_CFLAGS   += $(call cc-option,-fno-ipa-sra)
+
 # This selects which instruction set is used.
 # Note that GCC does not numerically define an architecture version
 # macro, but instead defines a whole series of macros which makes
diff --git a/arch/arm/common/it8152.c b/arch/arm/common/it8152.c
index 96dabcb6c621..996aed3b4eee 100644
--- a/arch/arm/common/it8152.c
+++ b/arch/arm/common/it8152.c
@@ -95,7 +95,7 @@ void it8152_init_irq(void)
         }
 }
 
-void it8152_irq_demux(unsigned int irq, struct irq_desc *desc)
+void it8152_irq_demux(struct irq_desc *desc)
 {
        int bits_pd, bits_lp, bits_ld;
        int i;
diff --git a/arch/arm/common/locomo.c b/arch/arm/common/locomo.c
index 304adea4bc52..0e97b4b871f9 100644
--- a/arch/arm/common/locomo.c
+++ b/arch/arm/common/locomo.c
@@ -138,7 +138,7 @@ static struct locomo_dev_info locomo_devices[] = {
         },
 };
 
-static void locomo_handler(unsigned int __irq, struct irq_desc *desc)
+static void locomo_handler(struct irq_desc *desc)
 {
         struct locomo *lchip = irq_desc_get_chip_data(desc);
         int req, i;
diff --git a/arch/arm/common/sa1111.c b/arch/arm/common/sa1111.c
index 4f290250fa93..3d224941b541 100644
--- a/arch/arm/common/sa1111.c
+++ b/arch/arm/common/sa1111.c
@@ -196,10 +196,8 @@ static struct sa1111_dev_info sa1111_devices[] = {
  * active IRQs causes the interrupt output to pulse, the upper levels
  * will call us again if there are more interrupts to process.
  */
-static void
-sa1111_irq_handler(unsigned int __irq, struct irq_desc *desc)
+static void sa1111_irq_handler(struct irq_desc *desc)
 {
-        unsigned int irq = irq_desc_get_irq(desc);
         unsigned int stat0, stat1, i;
         struct sa1111 *sachip = irq_desc_get_handler_data(desc);
         void __iomem *mapbase = sachip->base + SA1111_INTC;
@@ -214,7 +212,7 @@ sa1111_irq_handler(unsigned int __irq, struct irq_desc *desc)
         sa1111_writel(stat1, mapbase + SA1111_INTSTATCLR1);
 
         if (stat0 == 0 && stat1 == 0) {
-                do_bad_IRQ(irq, desc);
+                do_bad_IRQ(desc);
                 return;
         }
 
diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h
index 7bbf325a4f31..b2bc8e11471d 100644
--- a/arch/arm/include/asm/assembler.h
+++ b/arch/arm/include/asm/assembler.h
@@ -491,11 +491,6 @@ THUMB(	orr	\reg , \reg , #PSR_T_BIT	)
 #endif
         .endm
 
-        .macro  uaccess_save_and_disable, tmp
-        uaccess_save \tmp
-        uaccess_disable \tmp
-        .endm
-
         .irp    c,,eq,ne,cs,cc,mi,pl,vs,vc,hi,ls,ge,lt,gt,le,hs,lo
         .macro  ret\c, reg
 #if __LINUX_ARM_ARCH__ < 6
diff --git a/arch/arm/include/asm/bug.h b/arch/arm/include/asm/bug.h
index b274bde24905..e7335a92144e 100644
--- a/arch/arm/include/asm/bug.h
+++ b/arch/arm/include/asm/bug.h
@@ -40,6 +40,7 @@ do {								\
                 "2:\t.asciz " #__file "\n"                      \
                 ".popsection\n"                                 \
                 ".pushsection __bug_table,\"a\"\n"              \
+                ".align 2\n"                                    \
                 "3:\t.word 1b, 2b\n"                            \
                 "\t.hword " #__line ", 0\n"                     \
                 ".popsection");                                 \
diff --git a/arch/arm/include/asm/domain.h b/arch/arm/include/asm/domain.h
index e878129f2fee..fc8ba1663601 100644
--- a/arch/arm/include/asm/domain.h
+++ b/arch/arm/include/asm/domain.h
@@ -12,6 +12,7 @@
 
 #ifndef __ASSEMBLY__
 #include <asm/barrier.h>
+#include <asm/thread_info.h>
 #endif
 
 /*
@@ -89,7 +90,8 @@ static inline unsigned int get_domain(void)
 
         asm(
         "mrc    p15, 0, %0, c3, c0      @ get domain"
-         : "=r" (domain));
+         : "=r" (domain)
+         : "m" (current_thread_info()->cpu_domain));
 
         return domain;
 }
@@ -98,7 +100,7 @@ static inline void set_domain(unsigned val)
 {
         asm volatile(
         "mcr    p15, 0, %0, c3, c0      @ set domain"
-          : : "r" (val));
+          : : "r" (val) : "memory");
         isb();
 }
 
diff --git a/arch/arm/include/asm/hardware/it8152.h b/arch/arm/include/asm/hardware/it8152.h
index d36a73d7c0e8..076777ff3daa 100644
--- a/arch/arm/include/asm/hardware/it8152.h
+++ b/arch/arm/include/asm/hardware/it8152.h
@@ -106,7 +106,7 @@ extern void __iomem *it8152_base_address;
 struct pci_dev;
 struct pci_sys_data;
 
-extern void it8152_irq_demux(unsigned int irq, struct irq_desc *desc);
+extern void it8152_irq_demux(struct irq_desc *desc);
 extern void it8152_init_irq(void);
 extern int it8152_pci_map_irq(const struct pci_dev *dev, u8 slot, u8 pin);
 extern int it8152_pci_setup(int nr, struct pci_sys_data *sys);
diff --git a/arch/arm/include/asm/hw_irq.h b/arch/arm/include/asm/hw_irq.h
index af79da40af2a..9beb92914f4d 100644
--- a/arch/arm/include/asm/hw_irq.h
+++ b/arch/arm/include/asm/hw_irq.h
@@ -11,12 +11,6 @@ static inline void ack_bad_irq(int irq)
         pr_crit("unexpected IRQ trap at vector %02x\n", irq);
 }
 
-void set_irq_flags(unsigned int irq, unsigned int flags);
-
-#define IRQF_VALID      (1 << 0)
-#define IRQF_PROBE      (1 << 1)
-#define IRQF_NOAUTOEN   (1 << 2)
-
 #define ARCH_IRQ_INIT_FLAGS     (IRQ_NOREQUEST | IRQ_NOPROBE)
 
 #endif
diff --git a/arch/arm/include/asm/kvm_host.h b/arch/arm/include/asm/kvm_host.h
index dcba0fa5176e..c4072d9f32c7 100644
--- a/arch/arm/include/asm/kvm_host.h
+++ b/arch/arm/include/asm/kvm_host.h
@@ -29,21 +29,18 @@
 
 #define __KVM_HAVE_ARCH_INTC_INITIALIZED
 
-#if defined(CONFIG_KVM_ARM_MAX_VCPUS)
-#define KVM_MAX_VCPUS CONFIG_KVM_ARM_MAX_VCPUS
-#else
-#define KVM_MAX_VCPUS 0
-#endif
-
 #define KVM_USER_MEM_SLOTS 32
 #define KVM_PRIVATE_MEM_SLOTS 4
 #define KVM_COALESCED_MMIO_PAGE_OFFSET 1
 #define KVM_HAVE_ONE_REG
+#define KVM_HALT_POLL_NS_DEFAULT 500000
 
 #define KVM_VCPU_MAX_FEATURES 2
 
 #include <kvm/arm_vgic.h>
 
+#define KVM_MAX_VCPUS VGIC_V2_MAX_CPUS
+
 u32 *kvm_vcpu_reg(struct kvm_vcpu *vcpu, u8 reg_num, u32 mode);
 int __attribute_const__ kvm_target_cpu(void);
 int kvm_reset_vcpu(struct kvm_vcpu *vcpu);
@@ -148,6 +145,7 @@ struct kvm_vm_stat {
 
 struct kvm_vcpu_stat {
         u32 halt_successful_poll;
+        u32 halt_attempted_poll;
         u32 halt_wakeup;
 };
 
diff --git a/arch/arm/include/asm/mach/irq.h b/arch/arm/include/asm/mach/irq.h
index 2092ee1e1300..de4634b51456 100644
--- a/arch/arm/include/asm/mach/irq.h
+++ b/arch/arm/include/asm/mach/irq.h
@@ -23,10 +23,10 @@ extern int show_fiq_list(struct seq_file *, int);
 /*
  * This is for easy migration, but should be changed in the source
  */
-#define do_bad_IRQ(irq,desc)                            \
+#define do_bad_IRQ(desc)                                \
 do {                                                    \
         raw_spin_lock(&desc->lock);                     \
-        handle_bad_irq(irq, desc);                      \
+        handle_bad_irq(desc);                           \
         raw_spin_unlock(&desc->lock);                   \
 } while(0)
 
diff --git a/arch/arm/include/asm/thread_info.h b/arch/arm/include/asm/thread_info.h
index d0a1119dcaf3..776757d1604a 100644
--- a/arch/arm/include/asm/thread_info.h
+++ b/arch/arm/include/asm/thread_info.h
@@ -25,7 +25,6 @@
 struct task_struct;
 
 #include <asm/types.h>
-#include <asm/domain.h>
 
 typedef unsigned long mm_segment_t;
 
diff --git a/arch/arm/kernel/irq.c b/arch/arm/kernel/irq.c
index 5ff4826cb154..2766183e69df 100644
--- a/arch/arm/kernel/irq.c
+++ b/arch/arm/kernel/irq.c
@@ -79,26 +79,6 @@ asm_do_IRQ(unsigned int irq, struct pt_regs *regs)
         handle_IRQ(irq, regs);
 }
 
-void set_irq_flags(unsigned int irq, unsigned int iflags)
-{
-        unsigned long clr = 0, set = IRQ_NOREQUEST | IRQ_NOPROBE | IRQ_NOAUTOEN;
-
-        if (irq >= nr_irqs) {
-                pr_err("Trying to set irq flags for IRQ%d\n", irq);
-                return;
-        }
-
-        if (iflags & IRQF_VALID)
-                clr |= IRQ_NOREQUEST;
-        if (iflags & IRQF_PROBE)
-                clr |= IRQ_NOPROBE;
-        if (!(iflags & IRQF_NOAUTOEN))
-                clr |= IRQ_NOAUTOEN;
-        /* Order is clear bits in "clr" then set bits in "set" */
-        irq_modify_status(irq, clr, set & ~clr);
-}
-EXPORT_SYMBOL_GPL(set_irq_flags);
-
 void __init init_IRQ(void)
 {
         int ret;
diff --git a/arch/arm/kernel/kgdb.c b/arch/arm/kernel/kgdb.c
index a6ad93c9bce3..fd9eefce0a7b 100644
--- a/arch/arm/kernel/kgdb.c
+++ b/arch/arm/kernel/kgdb.c
@@ -259,15 +259,17 @@ int kgdb_arch_set_breakpoint(struct kgdb_bkpt *bpt)
         if (err)
                 return err;
 
-        patch_text((void *)bpt->bpt_addr,
-                   *(unsigned int *)arch_kgdb_ops.gdb_bpt_instr);
+        /* Machine is already stopped, so we can use __patch_text() directly */
+        __patch_text((void *)bpt->bpt_addr,
+                     *(unsigned int *)arch_kgdb_ops.gdb_bpt_instr);
 
         return err;
 }
 
 int kgdb_arch_remove_breakpoint(struct kgdb_bkpt *bpt)
 {
-        patch_text((void *)bpt->bpt_addr, *(unsigned int *)bpt->saved_instr);
+        /* Machine is already stopped, so we can use __patch_text() directly */
+        __patch_text((void *)bpt->bpt_addr, *(unsigned int *)bpt->saved_instr);
 
         return 0;
 }
diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
index a3089bacb8d8..7a7c4cea5523 100644
--- a/arch/arm/kernel/process.c
+++ b/arch/arm/kernel/process.c
@@ -226,6 +226,7 @@ copy_thread(unsigned long clone_flags, unsigned long stack_start,
 
         memset(&thread->cpu_context, 0, sizeof(struct cpu_context_save));
 
+#ifdef CONFIG_CPU_USE_DOMAINS
         /*
          * Copy the initial value of the domain access control register
          * from the current thread: thread->addr_limit will have been
@@ -233,6 +234,7 @@ copy_thread(unsigned long clone_flags, unsigned long stack_start,
          * kernel/fork.c
          */
         thread->cpu_domain = get_domain();
+#endif
 
         if (likely(!(p->flags & PF_KTHREAD))) {
                 *childregs = *current_pt_regs();
diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c
index b6cda06b455f..7b8f2141427b 100644
--- a/arch/arm/kernel/signal.c
+++ b/arch/arm/kernel/signal.c
@@ -343,15 +343,18 @@ setup_return(struct pt_regs *regs, struct ksignal *ksig,
                  */
                 thumb = handler & 1;
 
-#if __LINUX_ARM_ARCH__ >= 7
                 /*
-                 * Clear the If-Then Thumb-2 execution state
-                 * ARM spec requires this to be all 000s in ARM mode
-                 * Snapdragon S4/Krait misbehaves on a Thumb=>ARM
-                 * signal transition without this.
+                 * Clear the If-Then Thumb-2 execution state.  ARM spec
+                 * requires this to be all 000s in ARM mode.  Snapdragon
+                 * S4/Krait misbehaves on a Thumb=>ARM signal transition
+                 * without this.
+                 *
+                 * We must do this whenever we are running on a Thumb-2
+                 * capable CPU, which includes ARMv6T2.  However, we elect
+                 * to always do this to simplify the code; this field is
+                 * marked UNK/SBZP for older architectures.
                  */
                 cpsr &= ~PSR_IT_MASK;
-#endif
 
                 if (thumb) {
                         cpsr |= PSR_T_BIT;
diff --git a/arch/arm/kvm/Kconfig b/arch/arm/kvm/Kconfig
index bfb915d05665..210eccadb69a 100644
--- a/arch/arm/kvm/Kconfig
+++ b/arch/arm/kvm/Kconfig
@@ -45,15 +45,4 @@ config KVM_ARM_HOST
         ---help---
           Provides host support for ARM processors.
 
-config KVM_ARM_MAX_VCPUS
-        int "Number maximum supported virtual CPUs per VM"
-        depends on KVM_ARM_HOST
-        default 4
-        help
-          Static number of max supported virtual CPUs per VM.
-
-          If you choose a high number, the vcpu structures will be quite
-          large, so only choose a reasonable number that you expect to
-          actually use.
-
 endif # VIRTUALIZATION
diff --git a/arch/arm/kvm/arm.c b/arch/arm/kvm/arm.c
index ce404a5c3062..dc017adfddc8 100644
--- a/arch/arm/kvm/arm.c
+++ b/arch/arm/kvm/arm.c
@@ -446,7 +446,7 @@ static int kvm_vcpu_first_run_init(struct kvm_vcpu *vcpu)
          * Map the VGIC hardware resources before running a vcpu the first
          * time on this VM.
          */
-        if (unlikely(!vgic_ready(kvm))) {
+        if (unlikely(irqchip_in_kernel(kvm) && !vgic_ready(kvm))) {
                 ret = kvm_vgic_map_resources(kvm);
                 if (ret)
                         return ret;
diff --git a/arch/arm/kvm/interrupts_head.S b/arch/arm/kvm/interrupts_head.S
index 702740d37465..51a59504bef4 100644
--- a/arch/arm/kvm/interrupts_head.S
+++ b/arch/arm/kvm/interrupts_head.S
@@ -515,8 +515,7 @@ ARM_BE8(rev	r6, r6  )
 
         mrc     p15, 0, r2, c14, c3, 1  @ CNTV_CTL
         str     r2, [vcpu, #VCPU_TIMER_CNTV_CTL]
-        bic     r2, #1                  @ Clear ENABLE
-        mcr     p15, 0, r2, c14, c3, 1  @ CNTV_CTL
+
         isb
 
         mrrc    p15, 3, rr_lo_hi(r2, r3), c14   @ CNTV_CVAL
@@ -529,6 +528,9 @@ ARM_BE8(rev	r6, r6  )
         mcrr    p15, 4, r2, r2, c14     @ CNTVOFF
 
 1:
+        mov     r2, #0                  @ Clear ENABLE
+        mcr     p15, 0, r2, c14, c3, 1  @ CNTV_CTL
+
         @ Allow physical timer/counter access for the host
         mrc     p15, 4, r2, c14, c1, 0  @ CNTHCTL
         orr     r2, r2, #(CNTHCTL_PL1PCEN | CNTHCTL_PL1PCTEN)
diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c
index 7b4201294187..6984342da13d 100644
--- a/arch/arm/kvm/mmu.c
+++ b/arch/arm/kvm/mmu.c
@@ -1792,8 +1792,10 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm,
                 if (vma->vm_flags & VM_PFNMAP) {
                         gpa_t gpa = mem->guest_phys_addr +
                                     (vm_start - mem->userspace_addr);
-                        phys_addr_t pa = (vma->vm_pgoff << PAGE_SHIFT) +
-                                         vm_start - vma->vm_start;
+                        phys_addr_t pa;
+
+                        pa = (phys_addr_t)vma->vm_pgoff << PAGE_SHIFT;
+                        pa += vm_start - vma->vm_start;
 
                         /* IO region dirty page logging not allowed */
                         if (memslot->flags & KVM_MEM_LOG_DIRTY_PAGES)
diff --git a/arch/arm/kvm/psci.c b/arch/arm/kvm/psci.c
index 4b94b513168d..ad6f6424f1d1 100644
--- a/arch/arm/kvm/psci.c
+++ b/arch/arm/kvm/psci.c
@@ -126,7 +126,7 @@ static unsigned long kvm_psci_vcpu_on(struct kvm_vcpu *source_vcpu)
 
 static unsigned long kvm_psci_vcpu_affinity_info(struct kvm_vcpu *vcpu)
 {
-        int i;
+        int i, matching_cpus = 0;
         unsigned long mpidr;
         unsigned long target_affinity;
         unsigned long target_affinity_mask;
@@ -151,12 +151,16 @@ static unsigned long kvm_psci_vcpu_affinity_info(struct kvm_vcpu *vcpu)
          */
         kvm_for_each_vcpu(i, tmp, kvm) {
                 mpidr = kvm_vcpu_get_mpidr_aff(tmp);
-                if (((mpidr & target_affinity_mask) == target_affinity) &&
-                    !tmp->arch.pause) {
-                        return PSCI_0_2_AFFINITY_LEVEL_ON;
+                if ((mpidr & target_affinity_mask) == target_affinity) {
+                        matching_cpus++;
+                        if (!tmp->arch.pause)
+                                return PSCI_0_2_AFFINITY_LEVEL_ON;
                 }
         }
 
+        if (!matching_cpus)
+                return PSCI_RET_INVALID_PARAMS;
+
         return PSCI_0_2_AFFINITY_LEVEL_OFF;
 }
 
diff --git a/arch/arm/mach-dove/irq.c b/arch/arm/mach-dove/irq.c
index 305d7c6242bb..bfb3703357c5 100644
--- a/arch/arm/mach-dove/irq.c
+++ b/arch/arm/mach-dove/irq.c
@@ -69,14 +69,14 @@ static struct irq_chip pmu_irq_chip = {
         .irq_ack        = pmu_irq_ack,
 };
 
-static void pmu_irq_handler(unsigned int __irq, struct irq_desc *desc)
+static void pmu_irq_handler(struct irq_desc *desc)
 {
-        unsigned int irq = irq_desc_get_irq(desc);
         unsigned long cause = readl(PMU_INTERRUPT_CAUSE);
+        unsigned int irq;
 
         cause &= readl(PMU_INTERRUPT_MASK);
         if (cause == 0) {
-                do_bad_IRQ(irq, desc);
+                do_bad_IRQ(desc);
                 return;
         }
 
diff --git a/arch/arm/mach-footbridge/isa-irq.c b/arch/arm/mach-footbridge/isa-irq.c
index fcd79bc3a3e1..c01fca11b224 100644
--- a/arch/arm/mach-footbridge/isa-irq.c
+++ b/arch/arm/mach-footbridge/isa-irq.c
@@ -87,13 +87,12 @@ static struct irq_chip isa_hi_chip = {
         .irq_unmask     = isa_unmask_pic_hi_irq,
 };
 
-static void
-isa_irq_handler(unsigned int irq, struct irq_desc *desc)
+static void isa_irq_handler(struct irq_desc *desc)
 {
         unsigned int isa_irq = *(unsigned char *)PCIIACK_BASE;
 
         if (isa_irq < _ISA_IRQ(0) || isa_irq >= _ISA_IRQ(16)) {
-                do_bad_IRQ(isa_irq, desc);
+                do_bad_IRQ(desc);
                 return;
         }
 
diff --git a/arch/arm/mach-gemini/gpio.c b/arch/arm/mach-gemini/gpio.c
index 220333ed741d..2478d9f4d92d 100644
--- a/arch/arm/mach-gemini/gpio.c
+++ b/arch/arm/mach-gemini/gpio.c
@@ -126,7 +126,7 @@ static int gpio_set_irq_type(struct irq_data *d, unsigned int type)
         return 0;
 }
 
-static void gpio_irq_handler(unsigned int irq, struct irq_desc *desc)
+static void gpio_irq_handler(struct irq_desc *desc)
 {
         unsigned int port = (unsigned int)irq_desc_get_handler_data(desc);
         unsigned int gpio_irq_no, irq_stat;
diff --git a/arch/arm/mach-imx/3ds_debugboard.c b/arch/arm/mach-imx/3ds_debugboard.c
index 45903be6e7b3..16496a071ecb 100644
--- a/arch/arm/mach-imx/3ds_debugboard.c
+++ b/arch/arm/mach-imx/3ds_debugboard.c
@@ -85,7 +85,7 @@ static struct platform_device smsc_lan9217_device = {
         .resource = smsc911x_resources,
 };
 
-static void mxc_expio_irq_handler(u32 irq, struct irq_desc *desc)
+static void mxc_expio_irq_handler(struct irq_desc *desc)
 {
         u32 imr_val;
         u32 int_valid;
diff --git a/arch/arm/mach-imx/mach-mx31ads.c b/arch/arm/mach-imx/mach-mx31ads.c
index 2c0853560bd2..2b147e4bf9c9 100644
--- a/arch/arm/mach-imx/mach-mx31ads.c
+++ b/arch/arm/mach-imx/mach-mx31ads.c
@@ -154,7 +154,7 @@ static inline void mxc_init_imx_uart(void)
         imx31_add_imx_uart0(&uart_pdata);
 }
 
-static void mx31ads_expio_irq_handler(u32 irq, struct irq_desc *desc)
+static void mx31ads_expio_irq_handler(struct irq_desc *desc)
 {
         u32 imr_val;
         u32 int_valid;
diff --git a/arch/arm/mach-iop13xx/msi.c b/arch/arm/mach-iop13xx/msi.c
index 9f89e76dfbb9..f6235b28578c 100644
--- a/arch/arm/mach-iop13xx/msi.c
+++ b/arch/arm/mach-iop13xx/msi.c
@@ -91,7 +91,7 @@ static void (*write_imipr[])(u32) = {
         write_imipr_3,
 };
 
-static void iop13xx_msi_handler(unsigned int irq, struct irq_desc *desc)
+static void iop13xx_msi_handler(struct irq_desc *desc)
 {
         int i, j;
         unsigned long status;
diff --git a/arch/arm/mach-lpc32xx/irq.c b/arch/arm/mach-lpc32xx/irq.c
index cce4cef12b6e..2ae431e8bc1b 100644
--- a/arch/arm/mach-lpc32xx/irq.c
+++ b/arch/arm/mach-lpc32xx/irq.c
@@ -370,7 +370,7 @@ static struct irq_chip lpc32xx_irq_chip = {
         .irq_set_wake = lpc32xx_irq_wake
 };
 
-static void lpc32xx_sic1_handler(unsigned int irq, struct irq_desc *desc)
+static void lpc32xx_sic1_handler(struct irq_desc *desc)
 {
         unsigned long ints = __raw_readl(LPC32XX_INTC_STAT(LPC32XX_SIC1_BASE));
 
@@ -383,7 +383,7 @@ static void lpc32xx_sic1_handler(unsigned int irq, struct irq_desc *desc)
         }
 }
 
-static void lpc32xx_sic2_handler(unsigned int irq, struct irq_desc *desc)
+static void lpc32xx_sic2_handler(struct irq_desc *desc)
 {
         unsigned long ints = __raw_readl(LPC32XX_INTC_STAT(LPC32XX_SIC2_BASE));
 
diff --git a/arch/arm/mach-netx/generic.c b/arch/arm/mach-netx/generic.c
index 6373e2bff203..842302df99c1 100644
--- a/arch/arm/mach-netx/generic.c
+++ b/arch/arm/mach-netx/generic.c
@@ -69,8 +69,7 @@ static struct platform_device *devices[] __initdata = {
 #define DEBUG_IRQ(fmt...)       while (0) {}
 #endif
 
-static void
-netx_hif_demux_handler(unsigned int irq_unused, struct irq_desc *desc)
+static void netx_hif_demux_handler(struct irq_desc *desc)
 {
         unsigned int irq = NETX_IRQ_HIF_CHAINED(0);
         unsigned int stat;
diff --git a/arch/arm/mach-omap1/fpga.c b/arch/arm/mach-omap1/fpga.c
index dfec671b1639..39e20d0ead08 100644
--- a/arch/arm/mach-omap1/fpga.c
+++ b/arch/arm/mach-omap1/fpga.c
@@ -87,7 +87,7 @@ static void fpga_mask_ack_irq(struct irq_data *d)
         fpga_ack_irq(d);
 }
 
-static void innovator_fpga_IRQ_demux(unsigned int irq, struct irq_desc *desc)
+static void innovator_fpga_IRQ_demux(struct irq_desc *desc)
 {
         u32 stat;
         int fpga_irq;
diff --git a/arch/arm/mach-omap2/prm_common.c b/arch/arm/mach-omap2/prm_common.c
index 257e98c26618..3fc2cbe52113 100644
--- a/arch/arm/mach-omap2/prm_common.c
+++ b/arch/arm/mach-omap2/prm_common.c
@@ -102,7 +102,7 @@ static void omap_prcm_events_filter_priority(unsigned long *events,
  * dispatched accordingly. Clearing of the wakeup events should be
  * done by the SoC specific individual handlers.
  */
-static void omap_prcm_irq_handler(unsigned int irq, struct irq_desc *desc)
+static void omap_prcm_irq_handler(struct irq_desc *desc)
 {
         unsigned long pending[OMAP_PRCM_MAX_NR_PENDING_REG];
         unsigned long priority_pending[OMAP_PRCM_MAX_NR_PENDING_REG];
diff --git a/arch/arm/mach-pxa/balloon3.c b/arch/arm/mach-pxa/balloon3.c
index 70366b35d299..a3ebb517cca1 100644
--- a/arch/arm/mach-pxa/balloon3.c
+++ b/arch/arm/mach-pxa/balloon3.c
@@ -496,7 +496,7 @@ static struct irq_chip balloon3_irq_chip = {
         .irq_unmask     = balloon3_unmask_irq,
 };
 
-static void balloon3_irq_handler(unsigned int __irq, struct irq_desc *desc)
+static void balloon3_irq_handler(struct irq_desc *desc)
 {
         unsigned long pending = __raw_readl(BALLOON3_INT_CONTROL_REG) &
                                         balloon3_irq_enabled;
diff --git a/arch/arm/mach-pxa/cm-x2xx-pci.c b/arch/arm/mach-pxa/cm-x2xx-pci.c
index 1fa79f1f832d..3221ae15bef7 100644
--- a/arch/arm/mach-pxa/cm-x2xx-pci.c
+++ b/arch/arm/mach-pxa/cm-x2xx-pci.c
@@ -29,13 +29,12 @@
 void __iomem *it8152_base_address;
 static int cmx2xx_it8152_irq_gpio;
 
-static void cmx2xx_it8152_irq_demux(unsigned int __irq, struct irq_desc *desc)
+static void cmx2xx_it8152_irq_demux(struct irq_desc *desc)
 {
-        unsigned int irq = irq_desc_get_irq(desc);
         /* clear our parent irq */
         desc->irq_data.chip->irq_ack(&desc->irq_data);
 
-        it8152_irq_demux(irq, desc);
+        it8152_irq_demux(desc);
 }
 
 void __cmx2xx_pci_init_irq(int irq_gpio)
diff --git a/arch/arm/mach-pxa/lpd270.c b/arch/arm/mach-pxa/lpd270.c
index b070167deef2..4823d972e647 100644
--- a/arch/arm/mach-pxa/lpd270.c
+++ b/arch/arm/mach-pxa/lpd270.c
@@ -120,7 +120,7 @@ static struct irq_chip lpd270_irq_chip = {
         .irq_unmask     = lpd270_unmask_irq,
 };
 
-static void lpd270_irq_handler(unsigned int __irq, struct irq_desc *desc)
+static void lpd270_irq_handler(struct irq_desc *desc)
 {
         unsigned int irq;
         unsigned long pending;
diff --git a/arch/arm/mach-pxa/pcm990-baseboard.c b/arch/arm/mach-pxa/pcm990-baseboard.c
index 9a0c8affdadb..d8319b54299a 100644
--- a/arch/arm/mach-pxa/pcm990-baseboard.c
+++ b/arch/arm/mach-pxa/pcm990-baseboard.c
@@ -284,7 +284,7 @@ static struct irq_chip pcm990_irq_chip = {
         .irq_unmask     = pcm990_unmask_irq,
 };
 
-static void pcm990_irq_handler(unsigned int __irq, struct irq_desc *desc)
+static void pcm990_irq_handler(struct irq_desc *desc)
 {
         unsigned int irq;
         unsigned long pending;
diff --git a/arch/arm/mach-pxa/viper.c b/arch/arm/mach-pxa/viper.c
index 4841d6cefe76..8ab26370107e 100644
--- a/arch/arm/mach-pxa/viper.c
+++ b/arch/arm/mach-pxa/viper.c
@@ -276,7 +276,7 @@ static inline unsigned long viper_irq_pending(void)
                         viper_irq_enabled_mask;
 }
 
-static void viper_irq_handler(unsigned int __irq, struct irq_desc *desc)
+static void viper_irq_handler(struct irq_desc *desc)
 {
         unsigned int irq;
         unsigned long pending;
diff --git a/arch/arm/mach-pxa/zeus.c b/arch/arm/mach-pxa/zeus.c
index 6f94dd7b4dee..30e62a3f0701 100644
--- a/arch/arm/mach-pxa/zeus.c
+++ b/arch/arm/mach-pxa/zeus.c
@@ -105,7 +105,7 @@ static inline unsigned long zeus_irq_pending(void)
         return __raw_readw(ZEUS_CPLD_ISA_IRQ) & zeus_irq_enabled_mask;
 }
 
-static void zeus_irq_handler(unsigned int __irq, struct irq_desc *desc)
+static void zeus_irq_handler(struct irq_desc *desc)
 {
         unsigned int irq;
         unsigned long pending;
diff --git a/arch/arm/mach-rpc/ecard.c b/arch/arm/mach-rpc/ecard.c
index f726d4c4e6dd..dc67a7fb3831 100644
--- a/arch/arm/mach-rpc/ecard.c
+++ b/arch/arm/mach-rpc/ecard.c
@@ -551,8 +551,7 @@ static void ecard_check_lockup(struct irq_desc *desc)
         }
 }
 
-static void
-ecard_irq_handler(unsigned int irq, struct irq_desc *desc)
+static void ecard_irq_handler(struct irq_desc *desc)
 {
         ecard_t *ec;
         int called = 0;
diff --git a/arch/arm/mach-s3c24xx/bast-irq.c b/arch/arm/mach-s3c24xx/bast-irq.c
index ced1ab86ac83..2bb08961e934 100644
--- a/arch/arm/mach-s3c24xx/bast-irq.c
+++ b/arch/arm/mach-s3c24xx/bast-irq.c
@@ -100,9 +100,7 @@ static struct irq_chip  bast_pc104_chip = {
         .irq_ack        = bast_pc104_maskack
 };
 
-static void
-bast_irq_pc104_demux(unsigned int irq,
-                     struct irq_desc *desc)
+static void bast_irq_pc104_demux(struct irq_desc *desc)
 {
         unsigned int stat;
         unsigned int irqno;
diff --git a/arch/arm/mach-s3c64xx/common.c b/arch/arm/mach-s3c64xx/common.c
index fd63ecfb2f81..ddb30b8434c5 100644
--- a/arch/arm/mach-s3c64xx/common.c
+++ b/arch/arm/mach-s3c64xx/common.c
@@ -388,22 +388,22 @@ static inline void s3c_irq_demux_eint(unsigned int start, unsigned int end)
         }
 }
 
-static void s3c_irq_demux_eint0_3(unsigned int irq, struct irq_desc *desc)
+static void s3c_irq_demux_eint0_3(struct irq_desc *desc)
 {
         s3c_irq_demux_eint(0, 3);
 }
 
-static void s3c_irq_demux_eint4_11(unsigned int irq, struct irq_desc *desc)
+static void s3c_irq_demux_eint4_11(struct irq_desc *desc)
 {
         s3c_irq_demux_eint(4, 11);
 }
 
-static void s3c_irq_demux_eint12_19(unsigned int irq, struct irq_desc *desc)
+static void s3c_irq_demux_eint12_19(struct irq_desc *desc)
 {
         s3c_irq_demux_eint(12, 19);
 }
 
-static void s3c_irq_demux_eint20_27(unsigned int irq, struct irq_desc *desc)
+static void s3c_irq_demux_eint20_27(struct irq_desc *desc)
 {
         s3c_irq_demux_eint(20, 27);
 }
diff --git a/arch/arm/mach-sa1100/neponset.c b/arch/arm/mach-sa1100/neponset.c
index 6d237b4f7a8e..8411985af9ff 100644
--- a/arch/arm/mach-sa1100/neponset.c
+++ b/arch/arm/mach-sa1100/neponset.c
@@ -166,7 +166,7 @@ static struct sa1100_port_fns neponset_port_fns = {
  * ensure that the IRQ signal is deasserted before returning.  This
  * is rather unfortunate.
  */
-static void neponset_irq_handler(unsigned int irq, struct irq_desc *desc)
+static void neponset_irq_handler(struct irq_desc *desc)
 {
         struct neponset_drvdata *d = irq_desc_get_handler_data(desc);
         unsigned int irr;
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index e62604384945..1a7815e5421b 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -1249,7 +1249,7 @@ __iommu_create_mapping(struct device *dev, struct page **pages, size_t size)
         struct dma_iommu_mapping *mapping = to_dma_iommu_mapping(dev);
         unsigned int count = PAGE_ALIGN(size) >> PAGE_SHIFT;
         dma_addr_t dma_addr, iova;
-        int i, ret = DMA_ERROR_CODE;
+        int i;
 
         dma_addr = __alloc_iova(mapping, size);
         if (dma_addr == DMA_ERROR_CODE)
@@ -1257,6 +1257,8 @@ __iommu_create_mapping(struct device *dev, struct page **pages, size_t size)
 
         iova = dma_addr;
         for (i = 0; i < count; ) {
+                int ret;
+
                 unsigned int next_pfn = page_to_pfn(pages[i]) + 1;
                 phys_addr_t phys = page_to_phys(pages[i]);
                 unsigned int len, j;
diff --git a/arch/arm/nwfpe/entry.S b/arch/arm/nwfpe/entry.S
index 71df43547659..39c20afad7ed 100644
--- a/arch/arm/nwfpe/entry.S
+++ b/arch/arm/nwfpe/entry.S
@@ -95,9 +95,10 @@ emulate:
         reteq   r4                      @ no, return failure
 
 next:
+        uaccess_enable r3
 .Lx1:   ldrt    r6, [r5], #4            @ get the next instruction and
                                         @ increment PC
-
+        uaccess_disable r3
         and     r2, r6, #0x0F000000     @ test for FP insns
         teq     r2, #0x0C000000
         teqne   r2, #0x0D000000
diff --git a/arch/arm/plat-orion/gpio.c b/arch/arm/plat-orion/gpio.c
index 79c33eca09a3..7bd22d8e5b11 100644
--- a/arch/arm/plat-orion/gpio.c
+++ b/arch/arm/plat-orion/gpio.c
@@ -407,7 +407,7 @@ static int gpio_irq_set_type(struct irq_data *d, u32 type)
         return 0;
 }
 
-static void gpio_irq_handler(unsigned __irq, struct irq_desc *desc)
+static void gpio_irq_handler(struct irq_desc *desc)
 {
         struct orion_gpio_chip *ochip = irq_desc_get_handler_data(desc);
         u32 cause, type;
diff --git a/arch/arm/xen/hypercall.S b/arch/arm/xen/hypercall.S
index f00e08075938..10fd99c568c6 100644
--- a/arch/arm/xen/hypercall.S
+++ b/arch/arm/xen/hypercall.S
@@ -98,8 +98,23 @@ ENTRY(privcmd_call)
         mov r1, r2
         mov r2, r3
         ldr r3, [sp, #8]
+        /*
+         * Privcmd calls are issued by the userspace. We need to allow the
+         * kernel to access the userspace memory before issuing the hypercall.
+         */
+        uaccess_enable r4
+
+        /* r4 is loaded now as we use it as scratch register before */
         ldr r4, [sp, #4]
         __HVC(XEN_IMM)
+
+        /*
+         * Disable userspace access from kernel. This is fine to do it
+         * unconditionally as no set_fs(KERNEL_DS)/set_fs(get_ds()) is
+         * called before.
+         */
+        uaccess_disable r4
+
         ldm sp!, {r4}
         ret lr
 ENDPROC(privcmd_call);
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index 7d95663c0160..07d1811aa03f 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -32,6 +32,7 @@ config ARM64
         select GENERIC_CLOCKEVENTS_BROADCAST
         select GENERIC_CPU_AUTOPROBE
         select GENERIC_EARLY_IOREMAP
+        select GENERIC_IDLE_POLL_SETUP
         select GENERIC_IRQ_PROBE
         select GENERIC_IRQ_SHOW
         select GENERIC_IRQ_SHOW_LEVEL
@@ -331,6 +332,22 @@ config ARM64_ERRATUM_845719
 
           If unsure, say Y.
 
+config ARM64_ERRATUM_843419
+        bool "Cortex-A53: 843419: A load or store might access an incorrect address"
+        depends on MODULES
+        default y
+        help
+          This option builds kernel modules using the large memory model in
+          order to avoid the use of the ADRP instruction, which can cause
+          a subsequent memory access to use an incorrect address on Cortex-A53
+          parts up to r0p4.
+
+          Note that the kernel itself must be linked with a version of ld
+          which fixes potentially affected ADRP instructions through the
+          use of veneers.
+
+          If unsure, say Y.
+
 endmenu
 
 
diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile
index 15ff5b4156fd..f9914d7c1bb0 100644
--- a/arch/arm64/Makefile
+++ b/arch/arm64/Makefile
@@ -41,6 +41,10 @@ endif
 
 CHECKFLAGS      += -D__aarch64__
 
+ifeq ($(CONFIG_ARM64_ERRATUM_843419), y)
+CFLAGS_MODULE   += -mcmodel=large
+endif
+
 # Default value
 head-y          := arch/arm64/kernel/head.o
 
diff --git a/arch/arm64/boot/dts/mediatek/mt8173.dtsi b/arch/arm64/boot/dts/mediatek/mt8173.dtsi
index d18ee4259ee5..06a15644be38 100644
--- a/arch/arm64/boot/dts/mediatek/mt8173.dtsi
+++ b/arch/arm64/boot/dts/mediatek/mt8173.dtsi
@@ -81,7 +81,7 @@
                 };
 
                 idle-states {
-                        entry-method = "arm,psci";
+                        entry-method = "psci";
 
                         CPU_SLEEP_0: cpu-sleep-0 {
                                 compatible = "arm,idle-state";
diff --git a/arch/arm64/boot/dts/rockchip/rk3368.dtsi b/arch/arm64/boot/dts/rockchip/rk3368.dtsi
index a712bea3bf2c..cc093a482aa4 100644
--- a/arch/arm64/boot/dts/rockchip/rk3368.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3368.dtsi
@@ -106,7 +106,7 @@
                 };
 
                 idle-states {
-                        entry-method = "arm,psci";
+                        entry-method = "psci";
 
                         cpu_sleep: cpu-sleep-0 {
                                 compatible = "arm,idle-state";
diff --git a/arch/arm64/include/asm/hardirq.h b/arch/arm64/include/asm/hardirq.h
index 2bb7009bdac7..a57601f9d17c 100644
--- a/arch/arm64/include/asm/hardirq.h
+++ b/arch/arm64/include/asm/hardirq.h
@@ -43,9 +43,4 @@ static inline void ack_bad_irq(unsigned int irq)
         irq_err_count++;
 }
 
-/*
- * No arch-specific IRQ flags.
- */
-#define set_irq_flags(irq, flags)
-
 #endif /* __ASM_HARDIRQ_H */
diff --git a/arch/arm64/include/asm/kvm_arm.h b/arch/arm64/include/asm/kvm_arm.h
index 7605e095217f..9694f2654593 100644
--- a/arch/arm64/include/asm/kvm_arm.h
+++ b/arch/arm64/include/asm/kvm_arm.h
@@ -95,6 +95,7 @@
                          SCTLR_EL2_SA | SCTLR_EL2_I)
 
 /* TCR_EL2 Registers bits */
+#define TCR_EL2_RES1    ((1 << 31) | (1 << 23))
 #define TCR_EL2_TBI     (1 << 20)
 #define TCR_EL2_PS      (7 << 16)
 #define TCR_EL2_PS_40B  (2 << 16)
@@ -106,9 +107,10 @@
 #define TCR_EL2_MASK    (TCR_EL2_TG0 | TCR_EL2_SH0 | \
                          TCR_EL2_ORGN0 | TCR_EL2_IRGN0 | TCR_EL2_T0SZ)
 
-#define TCR_EL2_FLAGS   (TCR_EL2_PS_40B)
+#define TCR_EL2_FLAGS   (TCR_EL2_RES1 | TCR_EL2_PS_40B)
 
 /* VTCR_EL2 Registers bits */
+#define VTCR_EL2_RES1           (1 << 31)
 #define VTCR_EL2_PS_MASK        (7 << 16)
 #define VTCR_EL2_TG0_MASK       (1 << 14)
 #define VTCR_EL2_TG0_4K         (0 << 14)
@@ -147,7 +149,8 @@
  */
 #define VTCR_EL2_FLAGS          (VTCR_EL2_TG0_64K | VTCR_EL2_SH0_INNER | \
                                  VTCR_EL2_ORGN0_WBWA | VTCR_EL2_IRGN0_WBWA | \
-                                 VTCR_EL2_SL0_LVL1 | VTCR_EL2_T0SZ_40B)
+                                 VTCR_EL2_SL0_LVL1 | VTCR_EL2_T0SZ_40B | \
+                                 VTCR_EL2_RES1)
 #define VTTBR_X         (38 - VTCR_EL2_T0SZ_40B)
 #else
 /*
@@ -158,7 +161,8 @@
  */
 #define VTCR_EL2_FLAGS          (VTCR_EL2_TG0_4K | VTCR_EL2_SH0_INNER | \
                                  VTCR_EL2_ORGN0_WBWA | VTCR_EL2_IRGN0_WBWA | \
-                                 VTCR_EL2_SL0_LVL1 | VTCR_EL2_T0SZ_40B)
+                                 VTCR_EL2_SL0_LVL1 | VTCR_EL2_T0SZ_40B | \
+                                 VTCR_EL2_RES1)
 #define VTTBR_X         (37 - VTCR_EL2_T0SZ_40B)
 #endif
 
@@ -168,7 +172,6 @@
 #define VTTBR_VMID_MASK   (UL(0xFF) << VTTBR_VMID_SHIFT)
 
 /* Hyp System Trap Register */
-#define HSTR_EL2_TTEE   (1 << 16)
 #define HSTR_EL2_T(x)   (1 << x)
 
 /* Hyp Coproccessor Trap Register Shifts */
diff --git a/arch/arm64/include/asm/kvm_asm.h b/arch/arm64/include/asm/kvm_asm.h
index 67fa0de3d483..5e377101f919 100644
--- a/arch/arm64/include/asm/kvm_asm.h
+++ b/arch/arm64/include/asm/kvm_asm.h
@@ -53,9 +53,7 @@
 #define IFSR32_EL2      25      /* Instruction Fault Status Register */
 #define FPEXC32_EL2     26      /* Floating-Point Exception Control Register */
 #define DBGVCR32_EL2    27      /* Debug Vector Catch Register */
-#define TEECR32_EL1     28      /* ThumbEE Configuration Register */
-#define TEEHBR32_EL1    29      /* ThumbEE Handler Base Register */
-#define NR_SYS_REGS     30
+#define NR_SYS_REGS     28
 
 /* 32bit mapping */
 #define c0_MPIDR        (MPIDR_EL1 * 2) /* MultiProcessor ID Register */
diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
index 415938dc45cf..ed039688c221 100644
--- a/arch/arm64/include/asm/kvm_host.h
+++ b/arch/arm64/include/asm/kvm_host.h
@@ -30,19 +30,16 @@
 
 #define __KVM_HAVE_ARCH_INTC_INITIALIZED
 
-#if defined(CONFIG_KVM_ARM_MAX_VCPUS)
-#define KVM_MAX_VCPUS CONFIG_KVM_ARM_MAX_VCPUS
-#else
-#define KVM_MAX_VCPUS 0
-#endif
-
 #define KVM_USER_MEM_SLOTS 32
 #define KVM_PRIVATE_MEM_SLOTS 4
 #define KVM_COALESCED_MMIO_PAGE_OFFSET 1
+#define KVM_HALT_POLL_NS_DEFAULT 500000
 
 #include <kvm/arm_vgic.h>
 #include <kvm/arm_arch_timer.h>
 
+#define KVM_MAX_VCPUS VGIC_V3_MAX_CPUS
+
 #define KVM_VCPU_MAX_FEATURES 3
 
 int __attribute_const__ kvm_target_cpu(void);
@@ -195,6 +192,7 @@ struct kvm_vm_stat {
 
 struct kvm_vcpu_stat {
         u32 halt_successful_poll;
+        u32 halt_attempted_poll;
         u32 halt_wakeup;
 };
 
diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index 6900b2d95371..b0329be95cb1 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -26,13 +26,9 @@
  * Software defined PTE bits definition.
  */
 #define PTE_VALID               (_AT(pteval_t, 1) << 0)
+#define PTE_WRITE               (PTE_DBM)                /* same as DBM (51) */
 #define PTE_DIRTY               (_AT(pteval_t, 1) << 55)
 #define PTE_SPECIAL             (_AT(pteval_t, 1) << 56)
-#ifdef CONFIG_ARM64_HW_AFDBM
-#define PTE_WRITE               (PTE_DBM)                /* same as DBM */
-#else
-#define PTE_WRITE               (_AT(pteval_t, 1) << 57)
-#endif
 #define PTE_PROT_NONE           (_AT(pteval_t, 1) << 58) /* only when !PTE_VALID */
 
 /*
@@ -146,7 +142,7 @@ extern struct page *empty_zero_page;
 #define pte_exec(pte)           (!(pte_val(pte) & PTE_UXN))
 
 #ifdef CONFIG_ARM64_HW_AFDBM
-#define pte_hw_dirty(pte)       (!(pte_val(pte) & PTE_RDONLY))
+#define pte_hw_dirty(pte)       (pte_write(pte) && !(pte_val(pte) & PTE_RDONLY))
 #else
 #define pte_hw_dirty(pte)       (0)
 #endif
@@ -238,7 +234,7 @@ extern void __sync_icache_dcache(pte_t pteval, unsigned long addr);
  * When hardware DBM is not present, the sofware PTE_DIRTY bit is updated via
  * the page fault mechanism. Checking the dirty status of a pte becomes:
  *
- *   PTE_DIRTY || !PTE_RDONLY
+ *   PTE_DIRTY || (PTE_WRITE && !PTE_RDONLY)
  */
 static inline void set_pte_at(struct mm_struct *mm, unsigned long addr,
                               pte_t *ptep, pte_t pte)
@@ -503,7 +499,7 @@ static inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
                               PTE_PROT_NONE | PTE_WRITE | PTE_TYPE_MASK;
         /* preserve the hardware dirty information */
         if (pte_hw_dirty(pte))
-                newprot |= PTE_DIRTY;
+                pte = pte_mkdirty(pte);
         pte_val(pte) = (pte_val(pte) & ~mask) | (pgprot_val(newprot) & mask);
         return pte;
 }
diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c
index 9b3b62ac9c24..cebf78661a55 100644
--- a/arch/arm64/kernel/debug-monitors.c
+++ b/arch/arm64/kernel/debug-monitors.c
@@ -134,7 +134,7 @@ static int os_lock_notify(struct notifier_block *self,
                                     unsigned long action, void *data)
 {
         int cpu = (unsigned long)data;
-        if (action == CPU_ONLINE)
+        if ((action & ~CPU_TASKS_FROZEN) == CPU_ONLINE)
                 smp_call_function_single(cpu, clear_os_lock, NULL, 1);
         return NOTIFY_OK;
 }
diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
index a055be6125cf..90d09eddd5b2 100644
--- a/arch/arm64/kernel/head.S
+++ b/arch/arm64/kernel/head.S
@@ -523,6 +523,11 @@ CPU_LE(	movk	x0, #0x30d0, lsl #16	)	// Clear EE and E0E on LE systems
         msr     hstr_el2, xzr                   // Disable CP15 traps to EL2
 #endif
 
+        /* EL2 debug */
+        mrs     x0, pmcr_el0                    // Disable debug access traps
+        ubfx    x0, x0, #11, #5                 // to EL2 and allow access to
+        msr     mdcr_el2, x0                    // all PMU counters from EL1
+
         /* Stage-2 translation */
         msr     vttbr_el2, xzr
 
diff --git a/arch/arm64/kernel/hw_breakpoint.c b/arch/arm64/kernel/hw_breakpoint.c
index c97040ecf838..bba85c8f8037 100644
--- a/arch/arm64/kernel/hw_breakpoint.c
+++ b/arch/arm64/kernel/hw_breakpoint.c
@@ -872,7 +872,7 @@ static int hw_breakpoint_reset_notify(struct notifier_block *self,
                                                 void *hcpu)
 {
         int cpu = (long)hcpu;
-        if (action == CPU_ONLINE)
+        if ((action & ~CPU_TASKS_FROZEN) == CPU_ONLINE)
                 smp_call_function_single(cpu, hw_breakpoint_reset, NULL, 1);
         return NOTIFY_OK;
 }
diff --git a/arch/arm64/kernel/module.c b/arch/arm64/kernel/module.c
index 67bf4107f6ef..876eb8df50bf 100644
--- a/arch/arm64/kernel/module.c
+++ b/arch/arm64/kernel/module.c
@@ -332,12 +332,14 @@ int apply_relocate_add(Elf64_Shdr *sechdrs,
                         ovf = reloc_insn_imm(RELOC_OP_PREL, loc, val, 0, 21,
                                              AARCH64_INSN_IMM_ADR);
                         break;
+#ifndef CONFIG_ARM64_ERRATUM_843419
                 case R_AARCH64_ADR_PREL_PG_HI21_NC:
                         overflow_check = false;
                 case R_AARCH64_ADR_PREL_PG_HI21:
                         ovf = reloc_insn_imm(RELOC_OP_PAGE, loc, val, 12, 21,
                                              AARCH64_INSN_IMM_ADR);
                         break;
+#endif
                 case R_AARCH64_ADD_ABS_LO12_NC:
                 case R_AARCH64_LDST8_ABS_LO12_NC:
                         overflow_check = false;
diff --git a/arch/arm64/kernel/signal32.c b/arch/arm64/kernel/signal32.c
index 948f0ad2de23..71ef6dc89ae5 100644
--- a/arch/arm64/kernel/signal32.c
+++ b/arch/arm64/kernel/signal32.c
@@ -212,14 +212,32 @@ int copy_siginfo_from_user32(siginfo_t *to, compat_siginfo_t __user *from)
 
 /*
  * VFP save/restore code.
+ *
+ * We have to be careful with endianness, since the fpsimd context-switch
+ * code operates on 128-bit (Q) register values whereas the compat ABI
+ * uses an array of 64-bit (D) registers. Consequently, we need to swap
+ * the two halves of each Q register when running on a big-endian CPU.
  */
+union __fpsimd_vreg {
+        __uint128_t     raw;
+        struct {
+#ifdef __AARCH64EB__
+                u64     hi;
+                u64     lo;
+#else
+                u64     lo;
+                u64     hi;
+#endif
+        };
+};
+
 static int compat_preserve_vfp_context(struct compat_vfp_sigframe __user *frame)
 {
         struct fpsimd_state *fpsimd = &current->thread.fpsimd_state;
         compat_ulong_t magic = VFP_MAGIC;
         compat_ulong_t size = VFP_STORAGE_SIZE;
         compat_ulong_t fpscr, fpexc;
-        int err = 0;
+        int i, err = 0;
 
         /*
          * Save the hardware registers to the fpsimd_state structure.
@@ -235,10 +253,15 @@ static int compat_preserve_vfp_context(struct compat_vfp_sigframe __user *frame)
         /*
          * Now copy the FP registers. Since the registers are packed,
          * we can copy the prefix we want (V0-V15) as it is.
-         * FIXME: Won't work if big endian.
          */
-        err |= __copy_to_user(&frame->ufp.fpregs, fpsimd->vregs,
-                              sizeof(frame->ufp.fpregs));
+        for (i = 0; i < ARRAY_SIZE(frame->ufp.fpregs); i += 2) {
+                union __fpsimd_vreg vreg = {
+                        .raw = fpsimd->vregs[i >> 1],
+                };
+
+                __put_user_error(vreg.lo, &frame->ufp.fpregs[i], err);
+                __put_user_error(vreg.hi, &frame->ufp.fpregs[i + 1], err);
+        }
 
         /* Create an AArch32 fpscr from the fpsr and the fpcr. */
         fpscr = (fpsimd->fpsr & VFP_FPSCR_STAT_MASK) |
@@ -263,7 +286,7 @@ static int compat_restore_vfp_context(struct compat_vfp_sigframe __user *frame)
         compat_ulong_t magic = VFP_MAGIC;
         compat_ulong_t size = VFP_STORAGE_SIZE;
         compat_ulong_t fpscr;
-        int err = 0;
+        int i, err = 0;
 
         __get_user_error(magic, &frame->magic, err);
         __get_user_error(size, &frame->size, err);
@@ -273,12 +296,14 @@ static int compat_restore_vfp_context(struct compat_vfp_sigframe __user *frame)
         if (magic != VFP_MAGIC || size != VFP_STORAGE_SIZE)
                 return -EINVAL;
 
-        /*
-         * Copy the FP registers into the start of the fpsimd_state.
-         * FIXME: Won't work if big endian.
-         */
-        err |= __copy_from_user(fpsimd.vregs, frame->ufp.fpregs,
-                                sizeof(frame->ufp.fpregs));
+        /* Copy the FP registers into the start of the fpsimd_state. */
+        for (i = 0; i < ARRAY_SIZE(frame->ufp.fpregs); i += 2) {
+                union __fpsimd_vreg vreg;
+
+                __get_user_error(vreg.lo, &frame->ufp.fpregs[i], err);
+                __get_user_error(vreg.hi, &frame->ufp.fpregs[i + 1], err);
+                fpsimd.vregs[i >> 1] = vreg.raw;
+        }
 
         /* Extract the fpsr and the fpcr from the fpscr */
         __get_user_error(fpscr, &frame->ufp.fpscr, err);
diff --git a/arch/arm64/kvm/Kconfig b/arch/arm64/kvm/Kconfig
index bfffe8f4bd53..5c7e920e4861 100644
--- a/arch/arm64/kvm/Kconfig
+++ b/arch/arm64/kvm/Kconfig
@@ -41,15 +41,4 @@ config KVM_ARM_HOST
         ---help---
           Provides host support for ARM processors.
 
-config KVM_ARM_MAX_VCPUS
-        int "Number maximum supported virtual CPUs per VM"
-        depends on KVM_ARM_HOST
-        default 4
-        help
-          Static number of max supported virtual CPUs per VM.
-
-          If you choose a high number, the vcpu structures will be quite
-          large, so only choose a reasonable number that you expect to
-          actually use.
-
 endif # VIRTUALIZATION
diff --git a/arch/arm64/kvm/hyp.S b/arch/arm64/kvm/hyp.S
index 37c89ea2c572..e5836138ec42 100644
--- a/arch/arm64/kvm/hyp.S
+++ b/arch/arm64/kvm/hyp.S
@@ -433,20 +433,13 @@
         mrs     x5, ifsr32_el2
         stp     x4, x5, [x3]
 
-        skip_fpsimd_state x8, 3f
+        skip_fpsimd_state x8, 2f
         mrs     x6, fpexc32_el2
         str     x6, [x3, #16]
-3:
-        skip_debug_state x8, 2f
+2:
+        skip_debug_state x8, 1f
         mrs     x7, dbgvcr32_el2
         str     x7, [x3, #24]
-2:
-        skip_tee_state x8, 1f
-
-        add     x3, x2, #CPU_SYSREG_OFFSET(TEECR32_EL1)
-        mrs     x4, teecr32_el1
-        mrs     x5, teehbr32_el1
-        stp     x4, x5, [x3]
 1:
 .endm
 
@@ -466,16 +459,9 @@
         msr     dacr32_el2, x4
         msr     ifsr32_el2, x5
 
-        skip_debug_state x8, 2f
+        skip_debug_state x8, 1f
         ldr     x7, [x3, #24]
         msr     dbgvcr32_el2, x7
-2:
-        skip_tee_state x8, 1f
-
-        add     x3, x2, #CPU_SYSREG_OFFSET(TEECR32_EL1)
-        ldp     x4, x5, [x3]
-        msr     teecr32_el1, x4
-        msr     teehbr32_el1, x5
 1:
 .endm
 
@@ -570,8 +556,6 @@ alternative_endif
         mrs     x3, cntv_ctl_el0
         and     x3, x3, #3
         str     w3, [x0, #VCPU_TIMER_CNTV_CTL]
-        bic     x3, x3, #1              // Clear Enable
-        msr     cntv_ctl_el0, x3
 
         isb
 
@@ -579,6 +563,9 @@ alternative_endif
         str     x3, [x0, #VCPU_TIMER_CNTV_CVAL]
 
 1:
+        // Disable the virtual timer
+        msr     cntv_ctl_el0, xzr
+
         // Allow physical timer/counter access for the host
         mrs     x2, cnthctl_el2
         orr     x2, x2, #3
@@ -753,6 +740,9 @@ ENTRY(__kvm_vcpu_run)
         // Guest context
         add     x2, x0, #VCPU_CONTEXT
 
+        // We must restore the 32-bit state before the sysregs, thanks
+        // to Cortex-A57 erratum #852523.
+        restore_guest_32bit_state
         bl __restore_sysregs
 
         skip_debug_state x3, 1f
@@ -760,7 +750,6 @@ ENTRY(__kvm_vcpu_run)
         kern_hyp_va x3
         bl      __restore_debug
 1:
-        restore_guest_32bit_state
         restore_guest_regs
 
         // That's it, no more messing around.
diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
index b41607d270ac..d03d3af17e7e 100644
--- a/arch/arm64/kvm/sys_regs.c
+++ b/arch/arm64/kvm/sys_regs.c
@@ -272,7 +272,7 @@ static int set_bvr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
 {
         __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_bvr[rd->reg];
 
-        if (copy_from_user(uaddr, r, KVM_REG_SIZE(reg->id)) != 0)
+        if (copy_from_user(r, uaddr, KVM_REG_SIZE(reg->id)) != 0)
                 return -EFAULT;
         return 0;
 }
@@ -314,7 +314,7 @@ static int set_bcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
 {
         __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_bcr[rd->reg];
 
-        if (copy_from_user(uaddr, r, KVM_REG_SIZE(reg->id)) != 0)
+        if (copy_from_user(r, uaddr, KVM_REG_SIZE(reg->id)) != 0)
                 return -EFAULT;
 
         return 0;
@@ -358,7 +358,7 @@ static int set_wvr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
 {
         __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_wvr[rd->reg];
 
-        if (copy_from_user(uaddr, r, KVM_REG_SIZE(reg->id)) != 0)
+        if (copy_from_user(r, uaddr, KVM_REG_SIZE(reg->id)) != 0)
                 return -EFAULT;
         return 0;
 }
@@ -400,7 +400,7 @@ static int set_wcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd,
 {
         __u64 *r = &vcpu->arch.vcpu_debug_state.dbg_wcr[rd->reg];
 
-        if (copy_from_user(uaddr, r, KVM_REG_SIZE(reg->id)) != 0)
+        if (copy_from_user(r, uaddr, KVM_REG_SIZE(reg->id)) != 0)
                 return -EFAULT;
         return 0;
 }
@@ -539,13 +539,6 @@ static const struct sys_reg_desc sys_reg_descs[] = {
         { Op0(0b10), Op1(0b000), CRn(0b0111), CRm(0b1110), Op2(0b110),
           trap_dbgauthstatus_el1 },
 
-        /* TEECR32_EL1 */
-        { Op0(0b10), Op1(0b010), CRn(0b0000), CRm(0b0000), Op2(0b000),
-          NULL, reset_val, TEECR32_EL1, 0 },
-        /* TEEHBR32_EL1 */
-        { Op0(0b10), Op1(0b010), CRn(0b0001), CRm(0b0000), Op2(0b000),
-          NULL, reset_val, TEEHBR32_EL1, 0 },
-
         /* MDCCSR_EL1 */
         { Op0(0b10), Op1(0b011), CRn(0b0000), CRm(0b0001), Op2(0b000),
           trap_raz_wi },
diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c
index 0bcc4bc94b4a..99224dcebdc5 100644
--- a/arch/arm64/mm/dma-mapping.c
+++ b/arch/arm64/mm/dma-mapping.c
@@ -100,7 +100,7 @@ static void *__dma_alloc_coherent(struct device *dev, size_t size,
         if (IS_ENABLED(CONFIG_ZONE_DMA) &&
             dev->coherent_dma_mask <= DMA_BIT_MASK(32))
                 flags |= GFP_DMA;
-        if (IS_ENABLED(CONFIG_DMA_CMA) && (flags & __GFP_WAIT)) {
+        if (dev_get_cma_area(dev) && (flags & __GFP_WAIT)) {
                 struct page *page;
                 void *addr;
 
diff --git a/arch/avr32/mach-at32ap/extint.c b/arch/avr32/mach-at32ap/extint.c
index d51ff8f1c541..96cabad68489 100644
--- a/arch/avr32/mach-at32ap/extint.c
+++ b/arch/avr32/mach-at32ap/extint.c
@@ -144,7 +144,7 @@ static struct irq_chip eic_chip = {
         .irq_set_type   = eic_set_irq_type,
 };
 
-static void demux_eic_irq(unsigned int irq, struct irq_desc *desc)
+static void demux_eic_irq(struct irq_desc *desc)
 {
         struct eic *eic = irq_desc_get_handler_data(desc);
         unsigned long status, pending;
diff --git a/arch/avr32/mach-at32ap/pio.c b/arch/avr32/mach-at32ap/pio.c
index 157a5e0e789f..4f61378c3453 100644
--- a/arch/avr32/mach-at32ap/pio.c
+++ b/arch/avr32/mach-at32ap/pio.c
@@ -281,7 +281,7 @@ static struct irq_chip gpio_irqchip = {
         .irq_set_type   = gpio_irq_type,
 };
 
-static void gpio_irq_handler(unsigned irq, struct irq_desc *desc)
+static void gpio_irq_handler(struct irq_desc *desc)
 {
         struct pio_device       *pio = irq_desc_get_chip_data(desc);
         unsigned                gpio_irq;
diff --git a/arch/blackfin/include/asm/irq_handler.h b/arch/blackfin/include/asm/irq_handler.h
index 4b2a992794d7..d2f90c72378e 100644
--- a/arch/blackfin/include/asm/irq_handler.h
+++ b/arch/blackfin/include/asm/irq_handler.h
@@ -60,7 +60,7 @@ extern void bfin_internal_mask_irq(unsigned int irq);
 extern void bfin_internal_unmask_irq(unsigned int irq);
 
 struct irq_desc;
-extern void bfin_demux_mac_status_irq(unsigned int, struct irq_desc *);
-extern void bfin_demux_gpio_irq(unsigned int, struct irq_desc *);
+extern void bfin_demux_mac_status_irq(struct irq_desc *);
+extern void bfin_demux_gpio_irq(struct irq_desc *);
 
 #endif
diff --git a/arch/blackfin/kernel/irqchip.c b/arch/blackfin/kernel/irqchip.c
index 0ba25764b8c0..052cde5ed2e4 100644
--- a/arch/blackfin/kernel/irqchip.c
+++ b/arch/blackfin/kernel/irqchip.c
@@ -107,7 +107,7 @@ asmlinkage void asm_do_IRQ(unsigned int irq, struct pt_regs *regs)
          * than crashing, do something sensible.
          */
         if (irq >= NR_IRQS)
-                handle_bad_irq(irq, &bad_irq_desc);
+                handle_bad_irq(&bad_irq_desc);
         else
                 generic_handle_irq(irq);
 
diff --git a/arch/blackfin/mach-bf537/ints-priority.c b/arch/blackfin/mach-bf537/ints-priority.c
index 14b2f74554dc..a48baae4384d 100644
--- a/arch/blackfin/mach-bf537/ints-priority.c
+++ b/arch/blackfin/mach-bf537/ints-priority.c
@@ -89,8 +89,7 @@ static struct irq_chip bf537_generic_error_irqchip = {
         .irq_unmask = bf537_generic_error_unmask_irq,
 };
 
-static void bf537_demux_error_irq(unsigned int int_err_irq,
-                                  struct irq_desc *inta_desc)
+static void bf537_demux_error_irq(struct irq_desc *inta_desc)
 {
         int irq = 0;
 
@@ -182,15 +181,12 @@ static struct irq_chip bf537_mac_rx_irqchip = {
         .irq_unmask = bf537_mac_rx_unmask_irq,
 };
 
-static void bf537_demux_mac_rx_irq(unsigned int __int_irq,
-                                   struct irq_desc *desc)
+static void bf537_demux_mac_rx_irq(struct irq_desc *desc)
 {
-        unsigned int int_irq = irq_desc_get_irq(desc);
-
         if (bfin_read_DMA1_IRQ_STATUS() & (DMA_DONE | DMA_ERR))
                 bfin_handle_irq(IRQ_MAC_RX);
         else
-                bfin_demux_gpio_irq(int_irq, desc);
+                bfin_demux_gpio_irq(desc);
 }
 #endif
 
diff --git a/arch/blackfin/mach-common/ints-priority.c b/arch/blackfin/mach-common/ints-priority.c
index a6d1b03cdf36..e8d4d748d0fd 100644
--- a/arch/blackfin/mach-common/ints-priority.c
+++ b/arch/blackfin/mach-common/ints-priority.c
@@ -656,8 +656,7 @@ static struct irq_chip bfin_mac_status_irqchip = {
         .irq_set_wake = bfin_mac_status_set_wake,
 };
 
-void bfin_demux_mac_status_irq(unsigned int int_err_irq,
-                               struct irq_desc *inta_desc)
+void bfin_demux_mac_status_irq(struct irq_desc *inta_desc)
 {
         int i, irq = 0;
         u32 status = bfin_read_EMAC_SYSTAT();
@@ -825,7 +824,7 @@ static void bfin_demux_gpio_block(unsigned int irq)
         }
 }
 
-void bfin_demux_gpio_irq(unsigned int __inta_irq, struct irq_desc *desc)
+void bfin_demux_gpio_irq(struct irq_desc *desc)
 {
         unsigned int inta_irq = irq_desc_get_irq(desc);
         unsigned int irq;
diff --git a/arch/c6x/platforms/megamod-pic.c b/arch/c6x/platforms/megamod-pic.c
index d487698e978a..ddcb45d7dfa7 100644
--- a/arch/c6x/platforms/megamod-pic.c
+++ b/arch/c6x/platforms/megamod-pic.c
@@ -93,7 +93,7 @@ static struct irq_chip megamod_chip = {
         .irq_unmask     = unmask_megamod,
 };
 
-static void megamod_irq_cascade(unsigned int __irq, struct irq_desc *desc)
+static void megamod_irq_cascade(struct irq_desc *desc)
 {
         struct megamod_cascade_data *cascade;
         struct megamod_pic *pic;
diff --git a/arch/cris/Kconfig b/arch/cris/Kconfig
index 0314e325a669..8da5653bd895 100644
--- a/arch/cris/Kconfig
+++ b/arch/cris/Kconfig
@@ -36,6 +36,17 @@ config FORCE_MAX_ZONEORDER
         int
         default 6
 
+config TRACE_IRQFLAGS_SUPPORT
+        depends on ETRAX_ARCH_V32
+        def_bool y
+
+config STACKTRACE_SUPPORT
+        def_bool y
+
+config LOCKDEP_SUPPORT
+        depends on ETRAX_ARCH_V32
+        def_bool y
+
 config CRIS
         bool
         default y
@@ -58,6 +69,7 @@ config CRIS
         select CLKSRC_MMIO if ETRAX_ARCH_V32
         select GENERIC_CLOCKEVENTS if ETRAX_ARCH_V32
         select GENERIC_SCHED_CLOCK if ETRAX_ARCH_V32
+        select HAVE_DEBUG_BUGVERBOSE if ETRAX_ARCH_V32
 
 config HZ
         int
diff --git a/arch/cris/arch-v10/kernel/entry.S b/arch/cris/arch-v10/kernel/entry.S
index 81570fcd0412..b5622521dad5 100644
--- a/arch/cris/arch-v10/kernel/entry.S
+++ b/arch/cris/arch-v10/kernel/entry.S
@@ -955,6 +955,14 @@ sys_call_table:
         .long sys_process_vm_writev
         .long sys_kcmp                  /* 350 */
         .long sys_finit_module
+        .long sys_sched_setattr
+        .long sys_sched_getattr
+        .long sys_renameat2
+        .long sys_seccomp               /* 355 */
+        .long sys_getrandom
+        .long sys_memfd_create
+        .long sys_bpf
+        .long sys_execveat
 
         /*
          * NOTE!! This doesn't have to be exact - we just have
diff --git a/arch/cris/arch-v10/lib/dmacopy.c b/arch/cris/arch-v10/lib/dmacopy.c
deleted file mode 100644
index 49f5b8ca5b47..000000000000
--- a/arch/cris/arch-v10/lib/dmacopy.c
+++ /dev/null
@@ -1,42 +0,0 @@
-/*
- * memcpy for large blocks, using memory-memory DMA channels 6 and 7 in Etrax
- */
-
-#include <asm/svinto.h>
-#include <asm/io.h>
-
-#define D(x)
-
-void *dma_memcpy(void *pdst,
-                 const void *psrc,
-                 unsigned int pn)
-{
-        static etrax_dma_descr indma, outdma;
-
-        D(printk(KERN_DEBUG "dma_memcpy %d bytes... ", pn));
-
-#if 0
-        *R_GEN_CONFIG = genconfig_shadow =
-                (genconfig_shadow & ~0x3c0000) |
-                IO_STATE(R_GEN_CONFIG, dma6, intdma7) |
-                IO_STATE(R_GEN_CONFIG, dma7, intdma6);
-#endif
-        indma.sw_len = outdma.sw_len = pn;
-        indma.ctrl = d_eol | d_eop;
-        outdma.ctrl = d_eol;
-        indma.buf = psrc;
-        outdma.buf = pdst;
-
-        *R_DMA_CH6_FIRST = &indma;
-        *R_DMA_CH7_FIRST = &outdma;
-        *R_DMA_CH6_CMD = IO_STATE(R_DMA_CH6_CMD, cmd, start);
-        *R_DMA_CH7_CMD = IO_STATE(R_DMA_CH7_CMD, cmd, start);
-
-        while (*R_DMA_CH7_CMD == 1)
-                /* wait for completion */;
-
-        D(printk(KERN_DEBUG "done\n"));
-}
-
-
-
diff --git a/arch/cris/arch-v10/lib/old_checksum.c b/arch/cris/arch-v10/lib/old_checksum.c
deleted file mode 100644
index 8f79163f1394..000000000000
--- a/arch/cris/arch-v10/lib/old_checksum.c
+++ /dev/null
@@ -1,86 +0,0 @@
-/*
- * INET         An implementation of the TCP/IP protocol suite for the LINUX
- *              operating system.  INET is implemented using the  BSD Socket
- *              interface as the means of communication with the user level.
- *
- *              IP/TCP/UDP checksumming routines
- *
- * Authors:     Jorge Cwik, <jorge@laser.satlink.net>
- *              Arnt Gulbrandsen, <agulbra@nvg.unit.no>
- *              Tom May, <ftom@netcom.com>
- *              Lots of code moved from tcp.c and ip.c; see those files
- *              for more names.
- *
- *              This program is free software; you can redistribute it and/or
- *              modify it under the terms of the GNU General Public License
- *              as published by the Free Software Foundation; either version
- *              2 of the License, or (at your option) any later version.
- */
-
-#include <net/checksum.h>
-#include <net/module.h>
-
-#undef PROFILE_CHECKSUM
-
-#ifdef PROFILE_CHECKSUM
-/* these are just for profiling the checksum code with an oscillioscope.. uh */
-#if 0
-#define BITOFF *((unsigned char *)0xb0000030) = 0xff
-#define BITON *((unsigned char *)0xb0000030) = 0x0
-#endif
-#include <asm/io.h>
-#define CBITON LED_ACTIVE_SET(1)
-#define CBITOFF LED_ACTIVE_SET(0)
-#define BITOFF
-#define BITON
-#else
-#define BITOFF
-#define BITON
-#define CBITOFF
-#define CBITON
-#endif
-
-/*
- * computes a partial checksum, e.g. for TCP/UDP fragments
- */
-
-#include <asm/delay.h>
-
-__wsum csum_partial(const void *p, int len, __wsum __sum)
-{
-        u32 sum = (__force u32)__sum;
-        const u16 *buff = p;
-        /*
-        * Experiments with ethernet and slip connections show that buff
-        * is aligned on either a 2-byte or 4-byte boundary.
-        */
-        const void *endMarker = p + len;
-        const void *marker = endMarker - (len % 16);
-#if 0
-        if((int)buff & 0x3)
-                printk("unaligned buff %p\n", buff);
-        __delay(900); /* extra delay of 90 us to test performance hit */
-#endif
-        BITON;
-        while (buff < marker) {
-                sum += *buff++;
-                sum += *buff++;
-                sum += *buff++;
-                sum += *buff++;
-                sum += *buff++;
-                sum += *buff++;
-                sum += *buff++;
-                sum += *buff++;
-        }
-        marker = endMarker - (len % 2);
-        while (buff < marker)
-                sum += *buff++;
-
-        if (endMarker > buff)
-                sum += *(const u8 *)buff;       /* add extra byte separately */
-
-        BITOFF;
-        return (__force __wsum)sum;
-}
-
-EXPORT_SYMBOL(csum_partial);
diff --git a/arch/cris/arch-v32/drivers/Kconfig b/arch/cris/arch-v32/drivers/Kconfig
index 4fc16b44fff2..e6c523cc40bc 100644
--- a/arch/cris/arch-v32/drivers/Kconfig
+++ b/arch/cris/arch-v32/drivers/Kconfig
@@ -202,7 +202,7 @@ config ETRAX_PA_CHANGEABLE_DIR
         default "0x00" if ETRAXFS
         default "0x00000000" if !ETRAXFS
         help
-          This is a bitmask (8 bits) with information of what bits in PA that a
+          This is a bitmask with information of what bits in PA that a
           user can change direction on using ioctl's.
           Bit set = changeable.
           You probably want 0 here, but it depends on your hardware.
@@ -213,7 +213,7 @@ config ETRAX_PA_CHANGEABLE_BITS
         default "0x00" if ETRAXFS
         default "0x00000000" if !ETRAXFS
         help
-          This is a bitmask (8 bits) with information of what bits in PA
+          This is a bitmask with information of what bits in PA
           that a user can change the value on using ioctl's.
           Bit set = changeable.
 
@@ -223,7 +223,7 @@ config ETRAX_PB_CHANGEABLE_DIR
         default "0x00000" if ETRAXFS
         default "0x00000000" if !ETRAXFS
         help
-          This is a bitmask (18 bits) with information of what bits in PB
+          This is a bitmask with information of what bits in PB
           that a user can change direction on using ioctl's.
           Bit set = changeable.
           You probably want 0 here, but it depends on your hardware.
@@ -234,7 +234,7 @@ config ETRAX_PB_CHANGEABLE_BITS
         default "0x00000" if ETRAXFS
         default "0x00000000" if !ETRAXFS
         help
-          This is a bitmask (18 bits) with information of what bits in PB
+          This is a bitmask with information of what bits in PB
           that a user can change the value on using ioctl's.
           Bit set = changeable.
 
@@ -244,7 +244,7 @@ config ETRAX_PC_CHANGEABLE_DIR
         default "0x00000" if ETRAXFS
         default "0x00000000" if !ETRAXFS
         help
-          This is a bitmask (18 bits) with information of what bits in PC
+          This is a bitmask with information of what bits in PC
           that a user can change direction on using ioctl's.
           Bit set = changeable.
           You probably want 0 here, but it depends on your hardware.
@@ -253,9 +253,9 @@ config ETRAX_PC_CHANGEABLE_BITS
         hex "PC user changeable bits mask"
         depends on ETRAX_GPIO
         default "0x00000" if ETRAXFS
-        default "0x00000000" if ETRAXFS
+        default "0x00000000" if !ETRAXFS
         help
-          This is a bitmask (18 bits) with information of what bits in PC
+          This is a bitmask with information of what bits in PC
           that a user can change the value on using ioctl's.
           Bit set = changeable.
 
@@ -264,7 +264,7 @@ config ETRAX_PD_CHANGEABLE_DIR
         depends on ETRAX_GPIO && ETRAXFS
         default "0x00000"
         help
-          This is a bitmask (18 bits) with information of what bits in PD
+          This is a bitmask with information of what bits in PD
           that a user can change direction on using ioctl's.
           Bit set = changeable.
           You probably want 0x00000 here, but it depends on your hardware.
diff --git a/arch/cris/arch-v32/drivers/axisflashmap.c b/arch/cris/arch-v32/drivers/axisflashmap.c
index 28dd77144e8f..5387424683cc 100644
--- a/arch/cris/arch-v32/drivers/axisflashmap.c
+++ b/arch/cris/arch-v32/drivers/axisflashmap.c
@@ -313,6 +313,7 @@ static int __init init_axis_flash(void)
         size_t len;
         int ram_rootfs_partition = -1; /* -1 => no RAM rootfs partition */
         int part;
+        struct mtd_partition *partition;
 
         /* We need a root fs. If it resides in RAM, we need to use an
          * MTDRAM device, so it must be enabled in the kernel config,
@@ -329,7 +330,7 @@ static int __init init_axis_flash(void)
 
         main_mtd = flash_probe();
         if (main_mtd)
-                printk(KERN_INFO "%s: 0x%08x bytes of NOR flash memory.\n",
+                printk(KERN_INFO "%s: 0x%08llx bytes of NOR flash memory.\n",
                        main_mtd->name, main_mtd->size);
 
 #ifdef CONFIG_ETRAX_NANDFLASH
@@ -388,10 +389,10 @@ static int __init init_axis_flash(void)
 #endif
 
         if (main_mtd) {
+                loff_t ptable_sector = CONFIG_ETRAX_PTABLE_SECTOR;
                 main_mtd->owner = THIS_MODULE;
                 axisflash_mtd = main_mtd;
 
-                loff_t ptable_sector = CONFIG_ETRAX_PTABLE_SECTOR;
 
                 /* First partition (rescue) is always set to the default. */
                 pidx++;
@@ -517,7 +518,7 @@ static int __init init_axis_flash(void)
         /* Decide whether to use default partition table. */
         /* Only use default table if we actually have a device (main_mtd) */
 
-        struct mtd_partition *partition = &axis_partitions[0];
+        partition = &axis_partitions[0];
         if (main_mtd && !ptable_ok) {
                 memcpy(axis_partitions, axis_default_partitions,
                        sizeof(axis_default_partitions));
@@ -580,7 +581,7 @@ static int __init init_axis_flash(void)
                         printk(KERN_INFO "axisflashmap: Adding RAM partition "
                                "for rootfs image.\n");
                         err = mtdram_init_device(mtd_ram,
-                                                 (void *)partition[part].offset,
+                                                 (void *)(u_int32_t)partition[part].offset,
                                                  partition[part].size,
                                                  partition[part].name);
                         if (err)
diff --git a/arch/cris/arch-v32/drivers/mach-a3/gpio.c b/arch/cris/arch-v32/drivers/mach-a3/gpio.c
index 74f9fe80940c..c92e1da3684d 100644
--- a/arch/cris/arch-v32/drivers/mach-a3/gpio.c
+++ b/arch/cris/arch-v32/drivers/mach-a3/gpio.c
@@ -957,7 +957,7 @@ static void __init virtual_gpio_init(void)
 
 static int __init gpio_init(void)
 {
-        int res;
+        int res, res2;
 
         printk(KERN_INFO "ETRAX FS GPIO driver v2.7, (c) 2003-2008 "
                 "Axis Communications AB\n");
@@ -977,7 +977,7 @@ static int __init gpio_init(void)
         CRIS_LED_DISK_READ(0);
         CRIS_LED_DISK_WRITE(0);
 
-        int res2 = request_irq(GIO_INTR_VECT, gpio_interrupt,
+        res2 = request_irq(GIO_INTR_VECT, gpio_interrupt,
                 IRQF_SHARED, "gpio", &alarmlist);
         if (res2) {
                 printk(KERN_ERR "err: irq for gpio\n");
diff --git a/arch/cris/arch-v32/drivers/mach-fs/gpio.c b/arch/cris/arch-v32/drivers/mach-fs/gpio.c
index 009f4ee1bd09..72968fbf814b 100644
--- a/arch/cris/arch-v32/drivers/mach-fs/gpio.c
+++ b/arch/cris/arch-v32/drivers/mach-fs/gpio.c
@@ -425,12 +425,11 @@ gpio_open(struct inode *inode, struct file *filp)
         if (p > GPIO_MINOR_LAST)
                 return -EINVAL;
 
-        priv = kmalloc(sizeof(struct gpio_private), GFP_KERNEL);
+        priv = kzalloc(sizeof(struct gpio_private), GFP_KERNEL);
         if (!priv)
                 return -ENOMEM;
 
         mutex_lock(&gpio_mutex);
-        memset(priv, 0, sizeof(*priv));
 
         priv->minor = p;
 
diff --git a/arch/cris/arch-v32/kernel/entry.S b/arch/cris/arch-v32/kernel/entry.S
index 026a0b21b8f0..b17a20999f87 100644
--- a/arch/cris/arch-v32/kernel/entry.S
+++ b/arch/cris/arch-v32/kernel/entry.S
@@ -240,6 +240,17 @@ ret_from_sys_call:
 
         .type   _Rexit,@function
 _Rexit:
+#if defined(CONFIG_TRACE_IRQFLAGS)
+        addoq   +PT_ccs, $sp, $acr
+        move.d  [$acr], $r0
+        btstq   15, $r0         ; I1
+        bpl     1f
+        nop
+        jsr     trace_hardirqs_on
+        nop
+1:
+#endif
+
         ;; This epilogue MUST match the prologues in multiple_interrupt, irq.h
         ;; and ptregs.h.
         addq    4, $sp          ; Skip orig_r10.
@@ -875,6 +886,14 @@ sys_call_table:
         .long sys_process_vm_writev
         .long sys_kcmp                  /* 350 */
         .long sys_finit_module
+        .long sys_sched_setattr
+        .long sys_sched_getattr
+        .long sys_renameat2
+        .long sys_seccomp               /* 355 */
+        .long sys_getrandom
+        .long sys_memfd_create
+        .long sys_bpf
+        .long sys_execveat
 
         /*
          * NOTE!! This doesn't have to be exact - we just have
diff --git a/arch/cris/arch-v32/kernel/process.c b/arch/cris/arch-v32/kernel/process.c
index cebd32e2a8fb..c7ce784a393c 100644
--- a/arch/cris/arch-v32/kernel/process.c
+++ b/arch/cris/arch-v32/kernel/process.c
@@ -23,9 +23,9 @@ extern void stop_watchdog(void);
 /* We use this if we don't have any better idle routine. */
 void default_idle(void)
 {
+        local_irq_enable();
         /* Halt until exception. */
-        __asm__ volatile("ei    \n\t"
-                         "halt      ");
+        __asm__ volatile("halt");
 }
 
 /*
diff --git a/arch/cris/arch-v32/kernel/signal.c b/arch/cris/arch-v32/kernel/signal.c
index 3a36ae6b79d5..150d1d76c29d 100644
--- a/arch/cris/arch-v32/kernel/signal.c
+++ b/arch/cris/arch-v32/kernel/signal.c
@@ -19,7 +19,6 @@
 #include <asm/processor.h>
 #include <asm/ucontext.h>
 #include <asm/uaccess.h>
-#include <arch/ptrace.h>
 #include <arch/hwregs/cpu_vect.h>
 
 extern unsigned long cris_signal_return_page;
diff --git a/arch/cris/arch-v32/mach-fs/pinmux.c b/arch/cris/arch-v32/mach-fs/pinmux.c
index 05a04708b8eb..d8a3a3c439dd 100644
--- a/arch/cris/arch-v32/mach-fs/pinmux.c
+++ b/arch/cris/arch-v32/mach-fs/pinmux.c
@@ -46,6 +46,8 @@ static int __crisv32_pinmux_alloc(int port, int first_pin, int last_pin,
                 pins[port][i] = mode;
 
         crisv32_pinmux_set(port);
+
+        return 0;
 }
 
 static int crisv32_pinmux_init(void)
@@ -93,6 +95,7 @@ int crisv32_pinmux_alloc_fixed(enum fixed_function function)
         int ret = -EINVAL;
         char saved[sizeof pins];
         unsigned long flags;
+        reg_pinmux_rw_hwprot hwprot;
 
         spin_lock_irqsave(&pinmux_lock, flags);
 
@@ -101,7 +104,7 @@ int crisv32_pinmux_alloc_fixed(enum fixed_function function)
 
         crisv32_pinmux_init();  /* Must be done before we read rw_hwprot */
 
-        reg_pinmux_rw_hwprot hwprot = REG_RD(pinmux, regi_pinmux, rw_hwprot);
+        hwprot = REG_RD(pinmux, regi_pinmux, rw_hwprot);
 
         switch (function) {
         case pinmux_ser1:
@@ -227,6 +230,7 @@ int crisv32_pinmux_dealloc_fixed(enum fixed_function function)
         int ret = -EINVAL;
         char saved[sizeof pins];
         unsigned long flags;
+        reg_pinmux_rw_hwprot hwprot;
 
         spin_lock_irqsave(&pinmux_lock, flags);
 
@@ -235,7 +239,7 @@ int crisv32_pinmux_dealloc_fixed(enum fixed_function function)
 
         crisv32_pinmux_init();  /* Must be done before we read rw_hwprot */
 
-        reg_pinmux_rw_hwprot hwprot = REG_RD(pinmux, regi_pinmux, rw_hwprot);
+        hwprot = REG_RD(pinmux, regi_pinmux, rw_hwprot);
 
         switch (function) {
         case pinmux_ser1:
diff --git a/arch/cris/configs/artpec_3_defconfig b/arch/cris/configs/artpec_3_defconfig
index 71854d41c5a0..70e497e0b03e 100644
--- a/arch/cris/configs/artpec_3_defconfig
+++ b/arch/cris/configs/artpec_3_defconfig
@@ -12,10 +12,6 @@ CONFIG_ETRAX_FAST_TIMER=y
 CONFIG_CRIS_MACH_ARTPEC3=y
 CONFIG_ETRAX_DRAM_SIZE=32
 CONFIG_ETRAX_FLASH1_SIZE=4
-CONFIG_ETRAX_DEF_GIO_PA_OE=1c
-CONFIG_ETRAX_DEF_GIO_PA_OUT=00
-CONFIG_ETRAX_DEF_GIO_PB_OE=00000
-CONFIG_ETRAX_DEF_GIO_PB_OUT=00000
 CONFIG_NET=y
 CONFIG_PACKET=y
 CONFIG_UNIX=y
@@ -42,3 +38,4 @@ CONFIG_JFFS2_FS=y
 CONFIG_CRAMFS=y
 CONFIG_NFS_FS=y
 CONFIG_NFS_V3=y
+CONFIG_ETRAX_GPIO=y
diff --git a/arch/cris/configs/etraxfs_defconfig b/arch/cris/configs/etraxfs_defconfig
index 87c7227fecb2..91232680d6c8 100644
--- a/arch/cris/configs/etraxfs_defconfig
+++ b/arch/cris/configs/etraxfs_defconfig
@@ -38,3 +38,4 @@ CONFIG_JFFS2_FS=y
 CONFIG_CRAMFS=y
 CONFIG_NFS_FS=y
 CONFIG_NFS_V3=y
+CONFIG_ETRAX_GPIO=y
diff --git a/arch/cris/include/arch-v32/arch/bug.h b/arch/cris/include/arch-v32/arch/bug.h
index 0f211e135248..fb59faaaae0a 100644
--- a/arch/cris/include/arch-v32/arch/bug.h
+++ b/arch/cris/include/arch-v32/arch/bug.h
@@ -10,6 +10,7 @@
  * All other stuff is done out-of-band with exception handlers.
  */
 #define BUG()                                                           \
+do {                                                                    \
         __asm__ __volatile__ ("0: break 14\n\t"                         \
                               ".section .fixup,\"ax\"\n"                \
                               "1:\n\t"                                  \
@@ -21,9 +22,15 @@
                               ".section __ex_table,\"a\"\n\t"           \
                               ".dword 0b, 1b\n\t"                       \
                               ".previous\n\t"                           \
-                              : : "ri" (__FILE__), "i" (__LINE__))
+                              : : "ri" (__FILE__), "i" (__LINE__));     \
+        unreachable();                          \
+} while (0)
 #else
-#define BUG() __asm__ __volatile__ ("break 14\n\t")
+#define BUG()                                   \
+do {                                            \
+        __asm__ __volatile__ ("break 14\n\t");  \
+        unreachable();                          \
+} while (0)
 #endif
 
 #define HAVE_ARCH_BUG
diff --git a/arch/cris/include/arch-v32/arch/irqflags.h b/arch/cris/include/arch-v32/arch/irqflags.h
index 041851f8ec6f..5f6fddf99509 100644
--- a/arch/cris/include/arch-v32/arch/irqflags.h
+++ b/arch/cris/include/arch-v32/arch/irqflags.h
@@ -2,7 +2,7 @@
 #define __ASM_CRIS_ARCH_IRQFLAGS_H
 
 #include <linux/types.h>
-#include <arch/ptrace.h>
+#include <asm/ptrace.h>
 
 static inline unsigned long arch_local_save_flags(void)
 {
diff --git a/arch/cris/include/asm/Kbuild b/arch/cris/include/asm/Kbuild
index ad2244f35bca..b7f68192d15b 100644
--- a/arch/cris/include/asm/Kbuild
+++ b/arch/cris/include/asm/Kbuild
@@ -1,14 +1,20 @@
 generic-y += atomic.h
+generic-y += auxvec.h
 generic-y += barrier.h
+generic-y += bitsperlong.h
 generic-y += clkdev.h
 generic-y += cmpxchg.h
 generic-y += cputime.h
 generic-y += device.h
 generic-y += div64.h
+generic-y += errno.h
 generic-y += exec.h
 generic-y += emergency-restart.h
+generic-y += fcntl.h
 generic-y += futex.h
 generic-y += hardirq.h
+generic-y += ioctl.h
+generic-y += ipcbuf.h
 generic-y += irq_regs.h
 generic-y += irq_work.h
 generic-y += kdebug.h
@@ -19,11 +25,22 @@ generic-y += local.h
 generic-y += local64.h
 generic-y += mcs_spinlock.h
 generic-y += mm-arch-hooks.h
+generic-y += mman.h
 generic-y += module.h
+generic-y += msgbuf.h
 generic-y += percpu.h
+generic-y += poll.h
 generic-y += preempt.h
+generic-y += resource.h
 generic-y += sections.h
+generic-y += sembuf.h
+generic-y += shmbuf.h
+generic-y += siginfo.h
+generic-y += socket.h
+generic-y += sockios.h
+generic-y += statfs.h
 generic-y += topology.h
 generic-y += trace_clock.h
+generic-y += types.h
 generic-y += vga.h
 generic-y += xor.h
diff --git a/arch/cris/include/asm/mmu_context.h b/arch/cris/include/asm/mmu_context.h
index 1d45fd6365b7..349acfd25d2f 100644
--- a/arch/cris/include/asm/mmu_context.h
+++ b/arch/cris/include/asm/mmu_context.h
@@ -11,7 +11,14 @@ extern void switch_mm(struct mm_struct *prev, struct mm_struct *next,
 
 #define deactivate_mm(tsk,mm)   do { } while (0)
 
-#define activate_mm(prev,next) switch_mm((prev),(next),NULL)
+static inline void activate_mm(struct mm_struct *prev, struct mm_struct *next)
+{
+        unsigned long flags;
+
+        local_irq_save(flags);
+        switch_mm(prev, next, NULL);
+        local_irq_restore(flags);
+}
 
 /* current active pgd - this is similar to other processors pgd 
  * registers like cr3 on the i386
diff --git a/arch/cris/include/asm/stacktrace.h b/arch/cris/include/asm/stacktrace.h
new file mode 100644
index 000000000000..2d90856943ad
--- /dev/null
+++ b/arch/cris/include/asm/stacktrace.h
@@ -0,0 +1,8 @@
+#ifndef __CRIS_STACKTRACE_H
+#define __CRIS_STACKTRACE_H
+
+void walk_stackframe(unsigned long sp,
+                     int (*fn)(unsigned long addr, void *data),
+                     void *data);
+
+#endif
diff --git a/arch/cris/include/asm/types.h b/arch/cris/include/asm/types.h
deleted file mode 100644
index a3cac7757c7f..000000000000
--- a/arch/cris/include/asm/types.h
+++ /dev/null
@@ -1,12 +0,0 @@
-#ifndef _ETRAX_TYPES_H
-#define _ETRAX_TYPES_H
-
-#include <uapi/asm/types.h>
-
-/*
- * These aren't exported outside the kernel to avoid name space clashes
- */
-
-#define BITS_PER_LONG 32
-
-#endif
diff --git a/arch/cris/include/asm/unistd.h b/arch/cris/include/asm/unistd.h
index 0f40fed1ba25..9c23535821c0 100644
--- a/arch/cris/include/asm/unistd.h
+++ b/arch/cris/include/asm/unistd.h
@@ -4,7 +4,7 @@
 #include <uapi/asm/unistd.h>
 
 
-#define NR_syscalls 360
+#define NR_syscalls 365
 
 #include <arch/unistd.h>
 
diff --git a/arch/cris/include/uapi/asm/Kbuild b/arch/cris/include/uapi/asm/Kbuild
index 01f66b8f15e5..d5564a0ae66a 100644
--- a/arch/cris/include/uapi/asm/Kbuild
+++ b/arch/cris/include/uapi/asm/Kbuild
@@ -6,6 +6,9 @@ header-y += ../arch-v32/arch/
 header-y += auxvec.h
 header-y += bitsperlong.h
 header-y += byteorder.h
+header-y += elf.h
+header-y += elf_v10.h
+header-y += elf_v32.h
 header-y += errno.h
 header-y += ethernet.h
 header-y += etraxgpio.h
@@ -19,6 +22,8 @@ header-y += param.h
 header-y += poll.h
 header-y += posix_types.h
 header-y += ptrace.h
+header-y += ptrace_v10.h
+header-y += ptrace_v32.h
 header-y += resource.h
 header-y += rs485.h
 header-y += sembuf.h
diff --git a/arch/cris/include/uapi/asm/auxvec.h b/arch/cris/include/uapi/asm/auxvec.h
deleted file mode 100644
index cb30b01bf19f..000000000000
--- a/arch/cris/include/uapi/asm/auxvec.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef __ASMCRIS_AUXVEC_H
-#define __ASMCRIS_AUXVEC_H
-
-#endif
diff --git a/arch/cris/include/uapi/asm/bitsperlong.h b/arch/cris/include/uapi/asm/bitsperlong.h
deleted file mode 100644
index 6dc0bb0c13b2..000000000000
--- a/arch/cris/include/uapi/asm/bitsperlong.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/bitsperlong.h>
diff --git a/arch/cris/include/asm/elf.h b/arch/cris/include/uapi/asm/elf.h
index c2a394ff55ff..a5df05bfee66 100644
--- a/arch/cris/include/asm/elf.h
+++ b/arch/cris/include/uapi/asm/elf.h
@@ -5,7 +5,11 @@
  * ELF register definitions..
  */
 
-#include <asm/user.h>
+#ifdef __arch_v32
+#include <asm/elf_v32.h>
+#else
+#include <asm/elf_v10.h>
+#endif
 
 #define R_CRIS_NONE             0
 #define R_CRIS_8                1
@@ -32,7 +36,6 @@ typedef unsigned long elf_greg_t;
 
 /* Note that NGREG is defined to ELF_NGREG in include/linux/elfcore.h, and is
    thus exposed to user-space. */
-#define ELF_NGREG (sizeof (struct user_regs_struct) / sizeof(elf_greg_t))
 typedef elf_greg_t elf_gregset_t[ELF_NGREG];
 
 /* A placeholder; CRIS does not have any fp regs.  */
@@ -45,8 +48,6 @@ typedef unsigned long elf_fpregset_t;
 #define ELF_DATA        ELFDATA2LSB
 #define ELF_ARCH        EM_CRIS
 
-#include <arch/elf.h>
-
 /* The master for these definitions is {binutils}/include/elf/cris.h:  */
 /* User symbols in this file have a leading underscore.  */
 #define EF_CRIS_UNDERSCORE              0x00000001
diff --git a/arch/cris/include/arch-v10/arch/elf.h b/arch/cris/include/uapi/asm/elf_v10.h
index 1eb638aeddb4..3ea65cef529d 100644
--- a/arch/cris/include/arch-v10/arch/elf.h
+++ b/arch/cris/include/uapi/asm/elf_v10.h
@@ -1,10 +1,11 @@
 #ifndef __ASMCRIS_ARCH_ELF_H
 #define __ASMCRIS_ARCH_ELF_H
 
-#include <arch/system.h>
-
 #define ELF_MACH EF_CRIS_VARIANT_ANY_V0_V10
 
+/* Matches struct user_regs_struct */
+#define ELF_NGREG 35
+
 /*
  * This is used to ensure we don't load something for the wrong architecture.
  */
diff --git a/arch/cris/include/arch-v32/arch/elf.h b/arch/cris/include/uapi/asm/elf_v32.h
index c46d58291166..f09fe49005c0 100644
--- a/arch/cris/include/arch-v32/arch/elf.h
+++ b/arch/cris/include/uapi/asm/elf_v32.h
@@ -1,10 +1,11 @@
 #ifndef _ASM_CRIS_ELF_H
 #define _ASM_CRIS_ELF_H
 
-#include <arch/system.h>
-
 #define ELF_CORE_EFLAGS EF_CRIS_VARIANT_V32
 
+/* Matches struct user_regs_struct */
+#define ELF_NGREG 32
+
 /*
  * This is used to ensure we don't load something for the wrong architecture.
  */
diff --git a/arch/cris/include/uapi/asm/errno.h b/arch/cris/include/uapi/asm/errno.h
deleted file mode 100644
index 2bf5eb5fa773..000000000000
--- a/arch/cris/include/uapi/asm/errno.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef _CRIS_ERRNO_H
-#define _CRIS_ERRNO_H
-
-#include <asm-generic/errno.h>
-
-#endif
diff --git a/arch/cris/include/uapi/asm/fcntl.h b/arch/cris/include/uapi/asm/fcntl.h
deleted file mode 100644
index 46ab12db5739..000000000000
--- a/arch/cris/include/uapi/asm/fcntl.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/fcntl.h>
diff --git a/arch/cris/include/uapi/asm/ioctl.h b/arch/cris/include/uapi/asm/ioctl.h
deleted file mode 100644
index b279fe06dfe5..000000000000
--- a/arch/cris/include/uapi/asm/ioctl.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/ioctl.h>
diff --git a/arch/cris/include/uapi/asm/ipcbuf.h b/arch/cris/include/uapi/asm/ipcbuf.h
deleted file mode 100644
index 84c7e51cb6d0..000000000000
--- a/arch/cris/include/uapi/asm/ipcbuf.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/ipcbuf.h>
diff --git a/arch/cris/include/uapi/asm/kvm_para.h b/arch/cris/include/uapi/asm/kvm_para.h
deleted file mode 100644
index 14fab8f0b957..000000000000
--- a/arch/cris/include/uapi/asm/kvm_para.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/kvm_para.h>
diff --git a/arch/cris/include/uapi/asm/mman.h b/arch/cris/include/uapi/asm/mman.h
deleted file mode 100644
index 8eebf89f5ab1..000000000000
--- a/arch/cris/include/uapi/asm/mman.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/mman.h>
diff --git a/arch/cris/include/uapi/asm/msgbuf.h b/arch/cris/include/uapi/asm/msgbuf.h
deleted file mode 100644
index ada63df1d574..000000000000
--- a/arch/cris/include/uapi/asm/msgbuf.h
+++ /dev/null
@@ -1,33 +0,0 @@
-#ifndef _CRIS_MSGBUF_H
-#define _CRIS_MSGBUF_H
-
-/* verbatim copy of asm-i386 version */
-
-/* 
- * The msqid64_ds structure for CRIS architecture.
- * Note extra padding because this structure is passed back and forth
- * between kernel and user space.
- *
- * Pad space is left for:
- * - 64-bit time_t to solve y2038 problem
- * - 2 miscellaneous 32-bit values
- */
-
-struct msqid64_ds {
-        struct ipc64_perm msg_perm;
-        __kernel_time_t msg_stime;      /* last msgsnd time */
-        unsigned long   __unused1;
-        __kernel_time_t msg_rtime;      /* last msgrcv time */
-        unsigned long   __unused2;
-        __kernel_time_t msg_ctime;      /* last change time */
-        unsigned long   __unused3;
-        unsigned long  msg_cbytes;      /* current number of bytes on queue */
-        unsigned long  msg_qnum;        /* number of messages in queue */
-        unsigned long  msg_qbytes;      /* max number of bytes on queue */
-        __kernel_pid_t msg_lspid;       /* pid of last msgsnd */
-        __kernel_pid_t msg_lrpid;       /* last receive pid */
-        unsigned long  __unused4;
-        unsigned long  __unused5;
-};
-
-#endif /* _CRIS_MSGBUF_H */
diff --git a/arch/cris/include/uapi/asm/poll.h b/arch/cris/include/uapi/asm/poll.h
deleted file mode 100644
index c98509d3149e..000000000000
--- a/arch/cris/include/uapi/asm/poll.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/poll.h>
diff --git a/arch/cris/include/uapi/asm/ptrace.h b/arch/cris/include/uapi/asm/ptrace.h
index c689c9bbbe50..bd8946f83ed3 100644
--- a/arch/cris/include/uapi/asm/ptrace.h
+++ b/arch/cris/include/uapi/asm/ptrace.h
@@ -1 +1,5 @@
-#include <arch/ptrace.h>
+#ifdef __arch_v32
+#include <asm/ptrace_v32.h>
+#else
+#include <asm/ptrace_v10.h>
+#endif
diff --git a/arch/cris/include/arch-v10/arch/ptrace.h b/arch/cris/include/uapi/asm/ptrace_v10.h
index 1a232739565e..1a232739565e 100644
--- a/arch/cris/include/arch-v10/arch/ptrace.h
+++ b/arch/cris/include/uapi/asm/ptrace_v10.h
diff --git a/arch/cris/include/arch-v32/arch/ptrace.h b/arch/cris/include/uapi/asm/ptrace_v32.h
index 19773d3bd4c4..19773d3bd4c4 100644
--- a/arch/cris/include/arch-v32/arch/ptrace.h
+++ b/arch/cris/include/uapi/asm/ptrace_v32.h
diff --git a/arch/cris/include/uapi/asm/resource.h b/arch/cris/include/uapi/asm/resource.h
deleted file mode 100644
index b5d29448de4e..000000000000
--- a/arch/cris/include/uapi/asm/resource.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef _CRIS_RESOURCE_H
-#define _CRIS_RESOURCE_H
-
-#include <asm-generic/resource.h>
-
-#endif
diff --git a/arch/cris/include/uapi/asm/sembuf.h b/arch/cris/include/uapi/asm/sembuf.h
deleted file mode 100644
index 7fed9843796d..000000000000
--- a/arch/cris/include/uapi/asm/sembuf.h
+++ /dev/null
@@ -1,25 +0,0 @@
-#ifndef _CRIS_SEMBUF_H
-#define _CRIS_SEMBUF_H
-
-/* 
- * The semid64_ds structure for CRIS architecture.
- * Note extra padding because this structure is passed back and forth
- * between kernel and user space.
- *
- * Pad space is left for:
- * - 64-bit time_t to solve y2038 problem
- * - 2 miscellaneous 32-bit values
- */
-
-struct semid64_ds {
-        struct ipc64_perm sem_perm;             /* permissions .. see ipc.h */
-        __kernel_time_t sem_otime;              /* last semop time */
-        unsigned long   __unused1;
-        __kernel_time_t sem_ctime;              /* last change time */
-        unsigned long   __unused2;
-        unsigned long   sem_nsems;              /* no. of semaphores in array */
-        unsigned long   __unused3;
-        unsigned long   __unused4;
-};
-
-#endif /* _CRIS_SEMBUF_H */
diff --git a/arch/cris/include/uapi/asm/shmbuf.h b/arch/cris/include/uapi/asm/shmbuf.h
deleted file mode 100644
index 3239e3f000e8..000000000000
--- a/arch/cris/include/uapi/asm/shmbuf.h
+++ /dev/null
@@ -1,42 +0,0 @@
-#ifndef _CRIS_SHMBUF_H
-#define _CRIS_SHMBUF_H
-
-/* 
- * The shmid64_ds structure for CRIS architecture (same as for i386)
- * Note extra padding because this structure is passed back and forth
- * between kernel and user space.
- *
- * Pad space is left for:
- * - 64-bit time_t to solve y2038 problem
- * - 2 miscellaneous 32-bit values
- */
-
-struct shmid64_ds {
-        struct ipc64_perm       shm_perm;       /* operation perms */
-        size_t                  shm_segsz;      /* size of segment (bytes) */
-        __kernel_time_t         shm_atime;      /* last attach time */
-        unsigned long           __unused1;
-        __kernel_time_t         shm_dtime;      /* last detach time */
-        unsigned long           __unused2;
-        __kernel_time_t         shm_ctime;      /* last change time */
-        unsigned long           __unused3;
-        __kernel_pid_t          shm_cpid;       /* pid of creator */
-        __kernel_pid_t          shm_lpid;       /* pid of last operator */
-        unsigned long           shm_nattch;     /* no. of current attaches */
-        unsigned long           __unused4;
-        unsigned long           __unused5;
-};
-
-struct shminfo64 {
-        unsigned long   shmmax;
-        unsigned long   shmmin;
-        unsigned long   shmmni;
-        unsigned long   shmseg;
-        unsigned long   shmall;
-        unsigned long   __unused1;
-        unsigned long   __unused2;
-        unsigned long   __unused3;
-        unsigned long   __unused4;
-};
-
-#endif /* _CRIS_SHMBUF_H */
diff --git a/arch/cris/include/uapi/asm/siginfo.h b/arch/cris/include/uapi/asm/siginfo.h
deleted file mode 100644
index c1cd6d16928b..000000000000
--- a/arch/cris/include/uapi/asm/siginfo.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef _CRIS_SIGINFO_H
-#define _CRIS_SIGINFO_H
-
-#include <asm-generic/siginfo.h>
-
-#endif
diff --git a/arch/cris/include/uapi/asm/socket.h b/arch/cris/include/uapi/asm/socket.h
deleted file mode 100644
index e2503d9f1869..000000000000
--- a/arch/cris/include/uapi/asm/socket.h
+++ /dev/null
@@ -1,92 +0,0 @@
-#ifndef _ASM_SOCKET_H
-#define _ASM_SOCKET_H
-
-/* almost the same as asm-i386/socket.h */
-
-#include <asm/sockios.h>
-
-/* For setsockoptions(2) */
-#define SOL_SOCKET      1
-
-#define SO_DEBUG        1
-#define SO_REUSEADDR    2
-#define SO_TYPE         3
-#define SO_ERROR        4
-#define SO_DONTROUTE    5
-#define SO_BROADCAST    6
-#define SO_SNDBUF       7
-#define SO_RCVBUF       8
-#define SO_SNDBUFFORCE  32
-#define SO_RCVBUFFORCE  33
-#define SO_KEEPALIVE    9
-#define SO_OOBINLINE    10
-#define SO_NO_CHECK     11
-#define SO_PRIORITY     12
-#define SO_LINGER       13
-#define SO_BSDCOMPAT    14
-#define SO_REUSEPORT    15
-#define SO_PASSCRED     16
-#define SO_PEERCRED     17
-#define SO_RCVLOWAT     18
-#define SO_SNDLOWAT     19
-#define SO_RCVTIMEO     20
-#define SO_SNDTIMEO     21
-
-/* Security levels - as per NRL IPv6 - don't actually do anything */
-#define SO_SECURITY_AUTHENTICATION              22
-#define SO_SECURITY_ENCRYPTION_TRANSPORT        23
-#define SO_SECURITY_ENCRYPTION_NETWORK          24
-
-#define SO_BINDTODEVICE 25
-
-/* Socket filtering */
-#define SO_ATTACH_FILTER        26
-#define SO_DETACH_FILTER        27
-#define SO_GET_FILTER           SO_ATTACH_FILTER
-
-#define SO_PEERNAME             28
-#define SO_TIMESTAMP           29
-#define SCM_TIMESTAMP          SO_TIMESTAMP
-
-#define SO_ACCEPTCONN          30
-
-#define SO_PEERSEC             31
-#define SO_PASSSEC              34
-#define SO_TIMESTAMPNS          35
-#define SCM_TIMESTAMPNS         SO_TIMESTAMPNS
-
-#define SO_MARK                 36
-
-#define SO_TIMESTAMPING         37
-#define SCM_TIMESTAMPING        SO_TIMESTAMPING
-
-#define SO_PROTOCOL             38
-#define SO_DOMAIN               39
-
-#define SO_RXQ_OVFL             40
-
-#define SO_WIFI_STATUS          41
-#define SCM_WIFI_STATUS         SO_WIFI_STATUS
-#define SO_PEEK_OFF             42
-
-/* Instruct lower device to use last 4-bytes of skb data as FCS */
-#define SO_NOFCS                43
-
-#define SO_LOCK_FILTER          44
-
-#define SO_SELECT_ERR_QUEUE     45
-
-#define SO_BUSY_POLL            46
-
-#define SO_MAX_PACING_RATE      47
-
-#define SO_BPF_EXTENSIONS       48
-
-#define SO_INCOMING_CPU         49
-
-#define SO_ATTACH_BPF           50
-#define SO_DETACH_BPF           SO_DETACH_FILTER
-
-#endif /* _ASM_SOCKET_H */
-
-
diff --git a/arch/cris/include/uapi/asm/sockios.h b/arch/cris/include/uapi/asm/sockios.h
deleted file mode 100644
index cfe7bfecf599..000000000000
--- a/arch/cris/include/uapi/asm/sockios.h
+++ /dev/null
@@ -1,13 +0,0 @@
-#ifndef __ARCH_CRIS_SOCKIOS__
-#define __ARCH_CRIS_SOCKIOS__
-
-/* Socket-level I/O control calls. */
-#define FIOSETOWN       0x8901
-#define SIOCSPGRP       0x8902
-#define FIOGETOWN       0x8903
-#define SIOCGPGRP       0x8904
-#define SIOCATMARK      0x8905
-#define SIOCGSTAMP      0x8906          /* Get stamp (timeval) */
-#define SIOCGSTAMPNS    0x8907          /* Get stamp (timespec) */
-
-#endif
diff --git a/arch/cris/include/uapi/asm/statfs.h b/arch/cris/include/uapi/asm/statfs.h
deleted file mode 100644
index fdaf921844bc..000000000000
--- a/arch/cris/include/uapi/asm/statfs.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef _CRIS_STATFS_H
-#define _CRIS_STATFS_H
-
-#include <asm-generic/statfs.h>
-
-#endif
diff --git a/arch/cris/include/uapi/asm/types.h b/arch/cris/include/uapi/asm/types.h
deleted file mode 100644
index 9ec9d4c5ac4d..000000000000
--- a/arch/cris/include/uapi/asm/types.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/int-ll64.h>
diff --git a/arch/cris/include/uapi/asm/unistd.h b/arch/cris/include/uapi/asm/unistd.h
index f3287face443..062b648b27e1 100644
--- a/arch/cris/include/uapi/asm/unistd.h
+++ b/arch/cris/include/uapi/asm/unistd.h
@@ -356,5 +356,13 @@
 #define __NR_process_vm_writev  349
 #define __NR_kcmp               350
 #define __NR_finit_module       351
+#define __NR_sched_setattr      352
+#define __NR_sched_getattr      353
+#define __NR_renameat2          354
+#define __NR_seccomp            355
+#define __NR_getrandom          356
+#define __NR_memfd_create       357
+#define __NR_bpf                358
+#define __NR_execveat           359
 
 #endif /* _UAPI_ASM_CRIS_UNISTD_H_ */
diff --git a/arch/cris/kernel/Makefile b/arch/cris/kernel/Makefile
index edef71f12bb8..5fae398ca915 100644
--- a/arch/cris/kernel/Makefile
+++ b/arch/cris/kernel/Makefile
@@ -8,6 +8,7 @@ extra-y	:= vmlinux.lds
 
 obj-y   := process.o traps.o irq.o ptrace.o setup.o time.o sys_cris.o
 obj-y += devicetree.o
+obj-y += stacktrace.o
 
 obj-$(CONFIG_MODULES)    += crisksyms.o
 obj-$(CONFIG_MODULES)    += module.o
diff --git a/arch/cris/kernel/irq.c b/arch/cris/kernel/irq.c
index dd0be5de55d5..694850e8f077 100644
--- a/arch/cris/kernel/irq.c
+++ b/arch/cris/kernel/irq.c
@@ -45,7 +45,11 @@
 asmlinkage void do_IRQ(int irq, struct pt_regs * regs)
 {
         unsigned long sp;
-        struct pt_regs *old_regs = set_irq_regs(regs);
+        struct pt_regs *old_regs;
+
+        trace_hardirqs_off();
+
+        old_regs = set_irq_regs(regs);
         irq_enter();
         sp = rdsp();
         if (unlikely((sp & (PAGE_SIZE - 1)) < (PAGE_SIZE/8))) {
diff --git a/arch/cris/kernel/stacktrace.c b/arch/cris/kernel/stacktrace.c
new file mode 100644
index 000000000000..99838c74456d
--- /dev/null
+++ b/arch/cris/kernel/stacktrace.c
@@ -0,0 +1,76 @@
+#include <linux/sched.h>
+#include <linux/stacktrace.h>
+#include <linux/stacktrace.h>
+#include <asm/stacktrace.h>
+
+void walk_stackframe(unsigned long sp,
+                     int (*fn)(unsigned long addr, void *data),
+                     void *data)
+{
+        unsigned long high = ALIGN(sp, THREAD_SIZE);
+
+        for (; sp <= high - 4; sp += 4) {
+                unsigned long addr = *(unsigned long *) sp;
+
+                if (!kernel_text_address(addr))
+                        continue;
+
+                if (fn(addr, data))
+                        break;
+        }
+}
+
+struct stack_trace_data {
+        struct stack_trace *trace;
+        unsigned int no_sched_functions;
+        unsigned int skip;
+};
+
+#ifdef CONFIG_STACKTRACE
+
+static int save_trace(unsigned long addr, void *d)
+{
+        struct stack_trace_data *data = d;
+        struct stack_trace *trace = data->trace;
+
+        if (data->no_sched_functions && in_sched_functions(addr))
+                return 0;
+
+        if (data->skip) {
+                data->skip--;
+                return 0;
+        }
+
+        trace->entries[trace->nr_entries++] = addr;
+
+        return trace->nr_entries >= trace->max_entries;
+}
+
+void save_stack_trace_tsk(struct task_struct *tsk, struct stack_trace *trace)
+{
+        struct stack_trace_data data;
+        unsigned long sp;
+
+        data.trace = trace;
+        data.skip = trace->skip;
+
+        if (tsk != current) {
+                data.no_sched_functions = 1;
+                sp = tsk->thread.ksp;
+        } else {
+                data.no_sched_functions = 0;
+                sp = rdsp();
+        }
+
+        walk_stackframe(sp, save_trace, &data);
+        if (trace->nr_entries < trace->max_entries)
+                trace->entries[trace->nr_entries++] = ULONG_MAX;
+}
+
+void save_stack_trace(struct stack_trace *trace)
+{
+        save_stack_trace_tsk(current, trace);
+}
+EXPORT_SYMBOL_GPL(save_stack_trace);
+
+#endif /* CONFIG_STACKTRACE */
diff --git a/arch/frv/mb93090-mb00/pci-vdk.c b/arch/frv/mb93090-mb00/pci-vdk.c
index f9c86c475bbd..f211839e2cae 100644
--- a/arch/frv/mb93090-mb00/pci-vdk.c
+++ b/arch/frv/mb93090-mb00/pci-vdk.c
@@ -294,6 +294,8 @@ void pcibios_fixup_bus(struct pci_bus *bus)
         printk("### PCIBIOS_FIXUP_BUS(%d)\n",bus->number);
 #endif
 
+        pci_read_bridge_bases(bus);
+
         if (bus->number == 0) {
                 struct pci_dev *dev;
                 list_for_each_entry(dev, &bus->devices, bus_list) {
diff --git a/arch/ia64/include/asm/unistd.h b/arch/ia64/include/asm/unistd.h
index 95c39b95e97e..99c96a5e6016 100644
--- a/arch/ia64/include/asm/unistd.h
+++ b/arch/ia64/include/asm/unistd.h
@@ -11,7 +11,7 @@
 
 
 
-#define NR_syscalls                     319 /* length of syscall table */
+#define NR_syscalls                     321 /* length of syscall table */
 
 /*
  * The following defines stop scripts/checksyscalls.sh from complaining about
diff --git a/arch/ia64/include/uapi/asm/unistd.h b/arch/ia64/include/uapi/asm/unistd.h
index 461079560c78..98e94e19a5a0 100644
--- a/arch/ia64/include/uapi/asm/unistd.h
+++ b/arch/ia64/include/uapi/asm/unistd.h
@@ -332,5 +332,7 @@
 #define __NR_memfd_create               1340
 #define __NR_bpf                        1341
 #define __NR_execveat                   1342
+#define __NR_userfaultfd                1343
+#define __NR_membarrier                 1344
 
 #endif /* _UAPI_ASM_IA64_UNISTD_H */
diff --git a/arch/ia64/kernel/entry.S b/arch/ia64/kernel/entry.S
index ae0de7bf5525..37cc7a65cd3e 100644
--- a/arch/ia64/kernel/entry.S
+++ b/arch/ia64/kernel/entry.S
@@ -1768,5 +1768,7 @@ sys_call_table:
         data8 sys_memfd_create                  // 1340
         data8 sys_bpf
         data8 sys_execveat
+        data8 sys_userfaultfd
+        data8 sys_membarrier
 
         .org sys_call_table + 8*NR_syscalls     // guard against failures to increase NR_syscalls
diff --git a/arch/ia64/pci/pci.c b/arch/ia64/pci/pci.c
index d89b6013c941..7cc3be9fa7c6 100644
--- a/arch/ia64/pci/pci.c
+++ b/arch/ia64/pci/pci.c
@@ -533,9 +533,10 @@ void pcibios_fixup_bus(struct pci_bus *b)
 {
         struct pci_dev *dev;
 
-        if (b->self)
+        if (b->self) {
+                pci_read_bridge_bases(b);
                 pcibios_fixup_bridge_resources(b->self);
-
+        }
         list_for_each_entry(dev, &b->devices, bus_list)
                 pcibios_fixup_device_resources(dev);
         platform_pci_fixup_bus(b);
diff --git a/arch/m68k/amiga/amiints.c b/arch/m68k/amiga/amiints.c
index 47b5f90002ab..7ff739e94896 100644
--- a/arch/m68k/amiga/amiints.c
+++ b/arch/m68k/amiga/amiints.c
@@ -46,7 +46,7 @@ static struct irq_chip amiga_irq_chip = {
  * The builtin Amiga hardware interrupt handlers.
  */
 
-static void ami_int1(unsigned int irq, struct irq_desc *desc)
+static void ami_int1(struct irq_desc *desc)
 {
         unsigned short ints = amiga_custom.intreqr & amiga_custom.intenar;
 
@@ -69,7 +69,7 @@ static void ami_int1(unsigned int irq, struct irq_desc *desc)
         }
 }
 
-static void ami_int3(unsigned int irq, struct irq_desc *desc)
+static void ami_int3(struct irq_desc *desc)
 {
         unsigned short ints = amiga_custom.intreqr & amiga_custom.intenar;
 
@@ -92,7 +92,7 @@ static void ami_int3(unsigned int irq, struct irq_desc *desc)
         }
 }
 
-static void ami_int4(unsigned int irq, struct irq_desc *desc)
+static void ami_int4(struct irq_desc *desc)
 {
         unsigned short ints = amiga_custom.intreqr & amiga_custom.intenar;
 
@@ -121,7 +121,7 @@ static void ami_int4(unsigned int irq, struct irq_desc *desc)
         }
 }
 
-static void ami_int5(unsigned int irq, struct irq_desc *desc)
+static void ami_int5(struct irq_desc *desc)
 {
         unsigned short ints = amiga_custom.intreqr & amiga_custom.intenar;
 
diff --git a/arch/m68k/coldfire/intc-5272.c b/arch/m68k/coldfire/intc-5272.c
index 47371de60427..b0a19e207a63 100644
--- a/arch/m68k/coldfire/intc-5272.c
+++ b/arch/m68k/coldfire/intc-5272.c
@@ -143,12 +143,10 @@ static int intc_irq_set_type(struct irq_data *d, unsigned int type)
  * We need to be careful with the masking/acking due to the side effects
  * of masking an interrupt.
  */
-static void intc_external_irq(unsigned int __irq, struct irq_desc *desc)
+static void intc_external_irq(struct irq_desc *desc)
 {
-        unsigned int irq = irq_desc_get_irq(desc);
-
         irq_desc_get_chip(desc)->irq_ack(&desc->irq_data);
-        handle_simple_irq(irq, desc);
+        handle_simple_irq(desc);
 }
 
 static struct irq_chip intc_irq_chip = {
diff --git a/arch/m68k/include/asm/irq.h b/arch/m68k/include/asm/irq.h
index 81ca118d58af..a644f4a53b94 100644
--- a/arch/m68k/include/asm/irq.h
+++ b/arch/m68k/include/asm/irq.h
@@ -64,8 +64,7 @@ extern void m68k_setup_auto_interrupt(void (*handler)(unsigned int,
                                                       struct pt_regs *));
 extern void m68k_setup_user_interrupt(unsigned int vec, unsigned int cnt);
 extern void m68k_setup_irq_controller(struct irq_chip *,
-                                      void (*handle)(unsigned int irq,
-                                                     struct irq_desc *desc),
+                                      void (*handle)(struct irq_desc *desc),
                                       unsigned int irq, unsigned int cnt);
 
 extern unsigned int irq_canonicalize(unsigned int irq);
diff --git a/arch/m68k/include/asm/mac_via.h b/arch/m68k/include/asm/mac_via.h
index fe3fc9ae1b69..53c632c85b03 100644
--- a/arch/m68k/include/asm/mac_via.h
+++ b/arch/m68k/include/asm/mac_via.h
@@ -261,7 +261,7 @@ extern void via_irq_enable(int);
 extern void via_irq_disable(int);
 extern void via_nubus_irq_startup(int irq);
 extern void via_nubus_irq_shutdown(int irq);
-extern void via1_irq(unsigned int irq, struct irq_desc *desc);
+extern void via1_irq(struct irq_desc *desc);
 extern void via1_set_head(int);
 extern int via2_scsi_drq_pending(void);
 
diff --git a/arch/m68k/mac/baboon.c b/arch/m68k/mac/baboon.c
index 3fe0e43d44f6..f6f7d42713ec 100644
--- a/arch/m68k/mac/baboon.c
+++ b/arch/m68k/mac/baboon.c
@@ -45,7 +45,7 @@ void __init baboon_init(void)
  * Baboon interrupt handler. This works a lot like a VIA.
  */
 
-static void baboon_irq(unsigned int irq, struct irq_desc *desc)
+static void baboon_irq(struct irq_desc *desc)
 {
         int irq_bit, irq_num;
         unsigned char events;
diff --git a/arch/m68k/mac/oss.c b/arch/m68k/mac/oss.c
index 191610d97689..55d6592783f5 100644
--- a/arch/m68k/mac/oss.c
+++ b/arch/m68k/mac/oss.c
@@ -63,7 +63,7 @@ void __init oss_nubus_init(void)
  * Handle miscellaneous OSS interrupts.
  */
 
-static void oss_irq(unsigned int __irq, struct irq_desc *desc)
+static void oss_irq(struct irq_desc *desc)
 {
         int events = oss->irq_pending &
                 (OSS_IP_IOPSCC | OSS_IP_SCSI | OSS_IP_IOPISM);
@@ -99,7 +99,7 @@ static void oss_irq(unsigned int __irq, struct irq_desc *desc)
  * Unlike the VIA/RBV this is on its own autovector interrupt level.
  */
 
-static void oss_nubus_irq(unsigned int irq, struct irq_desc *desc)
+static void oss_nubus_irq(struct irq_desc *desc)
 {
         int events, irq_bit, i;
 
diff --git a/arch/m68k/mac/psc.c b/arch/m68k/mac/psc.c
index 3b9e302e7a37..cd38f29955c8 100644
--- a/arch/m68k/mac/psc.c
+++ b/arch/m68k/mac/psc.c
@@ -113,7 +113,7 @@ void __init psc_init(void)
  * PSC interrupt handler. It's a lot like the VIA interrupt handler.
  */
 
-static void psc_irq(unsigned int __irq, struct irq_desc *desc)
+static void psc_irq(struct irq_desc *desc)
 {
         unsigned int offset = (unsigned int)irq_desc_get_handler_data(desc);
         unsigned int irq = irq_desc_get_irq(desc);
diff --git a/arch/m68k/mac/via.c b/arch/m68k/mac/via.c
index e198dec868e4..ce56e04386e7 100644
--- a/arch/m68k/mac/via.c
+++ b/arch/m68k/mac/via.c
@@ -446,7 +446,7 @@ void via_nubus_irq_shutdown(int irq)
  * via6522.c :-), disable/pending masks added.
  */
 
-void via1_irq(unsigned int irq, struct irq_desc *desc)
+void via1_irq(struct irq_desc *desc)
 {
         int irq_num;
         unsigned char irq_bit, events;
@@ -467,7 +467,7 @@ void via1_irq(unsigned int irq, struct irq_desc *desc)
         } while (events >= irq_bit);
 }
 
-static void via2_irq(unsigned int irq, struct irq_desc *desc)
+static void via2_irq(struct irq_desc *desc)
 {
         int irq_num;
         unsigned char irq_bit, events;
@@ -493,7 +493,7 @@ static void via2_irq(unsigned int irq, struct irq_desc *desc)
  * VIA2 dispatcher as a fast interrupt handler.
  */
 
-void via_nubus_irq(unsigned int irq, struct irq_desc *desc)
+static void via_nubus_irq(struct irq_desc *desc)
 {
         int slot_irq;
         unsigned char slot_bit, events;
diff --git a/arch/metag/kernel/irq.c b/arch/metag/kernel/irq.c
index a336094a7a6c..3074b64793e6 100644
--- a/arch/metag/kernel/irq.c
+++ b/arch/metag/kernel/irq.c
@@ -94,13 +94,11 @@ void do_IRQ(int irq, struct pt_regs *regs)
                         "MOV   D0.5,%0\n"
                         "MOV   D1Ar1,%1\n"
                         "MOV   D1RtP,%2\n"
-                        "MOV   D0Ar2,%3\n"
                         "SWAP  A0StP,D0.5\n"
                         "SWAP  PC,D1RtP\n"
                         "MOV   A0StP,D0.5\n"
                         :
-                        : "r" (isp), "r" (irq), "r" (desc->handle_irq),
-                          "r" (desc)
+                        : "r" (isp), "r" (desc), "r" (desc->handle_irq)
                         : "memory", "cc", "D1Ar1", "D0Ar2", "D1Ar3", "D0Ar4",
                           "D1Ar5", "D0Ar6", "D0Re0", "D1Re0", "D0.4", "D1RtP",
                           "D0.5"
diff --git a/arch/microblaze/pci/pci-common.c b/arch/microblaze/pci/pci-common.c
index 6b8b75266801..ae838ed5fcf2 100644
--- a/arch/microblaze/pci/pci-common.c
+++ b/arch/microblaze/pci/pci-common.c
@@ -863,7 +863,14 @@ void pcibios_setup_bus_devices(struct pci_bus *bus)
 
 void pcibios_fixup_bus(struct pci_bus *bus)
 {
-        /* Fixup the bus */
+        /* When called from the generic PCI probe, read PCI<->PCI bridge
+         * bases. This is -not- called when generating the PCI tree from
+         * the OF device-tree.
+         */
+        if (bus->self != NULL)
+                pci_read_bridge_bases(bus);
+
+        /* Now fixup the bus bus */
         pcibios_setup_bus_self(bus);
 
         /* Now fixup devices on that bus */
diff --git a/arch/mips/alchemy/common/irq.c b/arch/mips/alchemy/common/irq.c
index 4c496c50edf6..da9f9220048f 100644
--- a/arch/mips/alchemy/common/irq.c
+++ b/arch/mips/alchemy/common/irq.c
@@ -851,7 +851,7 @@ static struct syscore_ops alchemy_gpic_pmops = {
 
 /* create chained handlers for the 4 IC requests to the MIPS IRQ ctrl */
 #define DISP(name, base, addr)                                                \
-static void au1000_##name##_dispatch(unsigned int irq, struct irq_desc *d)    \
+static void au1000_##name##_dispatch(struct irq_desc *d)                      \
 {                                                                             \
         unsigned long r = __raw_readl((void __iomem *)KSEG1ADDR(addr));       \
         if (likely(r))                                                        \
@@ -865,7 +865,7 @@ DISP(ic0r1, AU1000_INTC0_INT_BASE, AU1000_IC0_PHYS_ADDR + IC_REQ1INT)
 DISP(ic1r0, AU1000_INTC1_INT_BASE, AU1000_IC1_PHYS_ADDR + IC_REQ0INT)
 DISP(ic1r1, AU1000_INTC1_INT_BASE, AU1000_IC1_PHYS_ADDR + IC_REQ1INT)
 
-static void alchemy_gpic_dispatch(unsigned int irq, struct irq_desc *d)
+static void alchemy_gpic_dispatch(struct irq_desc *d)
 {
         int i = __raw_readl(AU1300_GPIC_ADDR + AU1300_GPIC_PRIENC);
         generic_handle_irq(ALCHEMY_GPIC_INT_BASE + i);
diff --git a/arch/mips/alchemy/devboards/bcsr.c b/arch/mips/alchemy/devboards/bcsr.c
index 324ad72d7c36..faeddf119fd4 100644
--- a/arch/mips/alchemy/devboards/bcsr.c
+++ b/arch/mips/alchemy/devboards/bcsr.c
@@ -86,7 +86,7 @@ EXPORT_SYMBOL_GPL(bcsr_mod);
 /*
  * DB1200/PB1200 CPLD IRQ muxer
  */
-static void bcsr_csc_handler(unsigned int irq, struct irq_desc *d)
+static void bcsr_csc_handler(struct irq_desc *d)
 {
         unsigned short bisr = __raw_readw(bcsr_virt + BCSR_REG_INTSTAT);
         struct irq_chip *chip = irq_desc_get_chip(d);
diff --git a/arch/mips/ath25/ar2315.c b/arch/mips/ath25/ar2315.c
index ec9a371f1e62..8da996142d6a 100644
--- a/arch/mips/ath25/ar2315.c
+++ b/arch/mips/ath25/ar2315.c
@@ -69,7 +69,7 @@ static struct irqaction ar2315_ahb_err_interrupt  = {
         .name           = "ar2315-ahb-error",
 };
 
-static void ar2315_misc_irq_handler(unsigned irq, struct irq_desc *desc)
+static void ar2315_misc_irq_handler(struct irq_desc *desc)
 {
         u32 pending = ar2315_rst_reg_read(AR2315_ISR) &
                       ar2315_rst_reg_read(AR2315_IMR);
diff --git a/arch/mips/ath25/ar5312.c b/arch/mips/ath25/ar5312.c
index e63e38fa4880..acd55a9cffe3 100644
--- a/arch/mips/ath25/ar5312.c
+++ b/arch/mips/ath25/ar5312.c
@@ -73,7 +73,7 @@ static struct irqaction ar5312_ahb_err_interrupt  = {
         .name    = "ar5312-ahb-error",
 };
 
-static void ar5312_misc_irq_handler(unsigned irq, struct irq_desc *desc)
+static void ar5312_misc_irq_handler(struct irq_desc *desc)
 {
         u32 pending = ar5312_rst_reg_read(AR5312_ISR) &
                       ar5312_rst_reg_read(AR5312_IMR);
diff --git a/arch/mips/ath79/irq.c b/arch/mips/ath79/irq.c
index 807132b838b2..15ecb4831e12 100644
--- a/arch/mips/ath79/irq.c
+++ b/arch/mips/ath79/irq.c
@@ -26,7 +26,7 @@
 #include "common.h"
 #include "machtypes.h"
 
-static void ath79_misc_irq_handler(unsigned int irq, struct irq_desc *desc)
+static void ath79_misc_irq_handler(struct irq_desc *desc)
 {
         void __iomem *base = ath79_reset_base;
         u32 pending;
@@ -119,7 +119,7 @@ static void __init ath79_misc_irq_init(void)
         irq_set_chained_handler(ATH79_CPU_IRQ(6), ath79_misc_irq_handler);
 }
 
-static void ar934x_ip2_irq_dispatch(unsigned int irq, struct irq_desc *desc)
+static void ar934x_ip2_irq_dispatch(struct irq_desc *desc)
 {
         u32 status;
 
@@ -148,7 +148,7 @@ static void ar934x_ip2_irq_init(void)
         irq_set_chained_handler(ATH79_CPU_IRQ(2), ar934x_ip2_irq_dispatch);
 }
 
-static void qca955x_ip2_irq_dispatch(unsigned int irq, struct irq_desc *desc)
+static void qca955x_ip2_irq_dispatch(struct irq_desc *desc)
 {
         u32 status;
 
@@ -171,7 +171,7 @@ static void qca955x_ip2_irq_dispatch(unsigned int irq, struct irq_desc *desc)
         }
 }
 
-static void qca955x_ip3_irq_dispatch(unsigned int irq, struct irq_desc *desc)
+static void qca955x_ip3_irq_dispatch(struct irq_desc *desc)
 {
         u32 status;
 
diff --git a/arch/mips/cavium-octeon/octeon-irq.c b/arch/mips/cavium-octeon/octeon-irq.c
index f26c3c661cca..0352bc8d56b3 100644
--- a/arch/mips/cavium-octeon/octeon-irq.c
+++ b/arch/mips/cavium-octeon/octeon-irq.c
@@ -2221,7 +2221,7 @@ static irqreturn_t octeon_irq_cib_handler(int my_irq, void *data)
                         if (irqd_get_trigger_type(irq_data) &
                                 IRQ_TYPE_EDGE_BOTH)
                                 cvmx_write_csr(host_data->raw_reg, 1ull << i);
-                        generic_handle_irq_desc(irq, desc);
+                        generic_handle_irq_desc(desc);
                 }
         }
 
diff --git a/arch/mips/include/asm/kvm_host.h b/arch/mips/include/asm/kvm_host.h
index e8c8d9d0c45f..5a1a882e0a75 100644
--- a/arch/mips/include/asm/kvm_host.h
+++ b/arch/mips/include/asm/kvm_host.h
@@ -61,6 +61,7 @@
 #define KVM_PRIVATE_MEM_SLOTS   0
 
 #define KVM_COALESCED_MMIO_PAGE_OFFSET 1
+#define KVM_HALT_POLL_NS_DEFAULT 500000
 
 
 
@@ -128,6 +129,7 @@ struct kvm_vcpu_stat {
         u32 msa_disabled_exits;
         u32 flush_dcache_exits;
         u32 halt_successful_poll;
+        u32 halt_attempted_poll;
         u32 halt_wakeup;
 };
 
diff --git a/arch/mips/include/asm/netlogic/common.h b/arch/mips/include/asm/netlogic/common.h
index 2a4c128277e4..be52c2125d71 100644
--- a/arch/mips/include/asm/netlogic/common.h
+++ b/arch/mips/include/asm/netlogic/common.h
@@ -57,8 +57,8 @@
 #include <asm/mach-netlogic/multi-node.h>
 
 struct irq_desc;
-void nlm_smp_function_ipi_handler(unsigned int irq, struct irq_desc *desc);
-void nlm_smp_resched_ipi_handler(unsigned int irq, struct irq_desc *desc);
+void nlm_smp_function_ipi_handler(struct irq_desc *desc);
+void nlm_smp_resched_ipi_handler(struct irq_desc *desc);
 void nlm_smp_irq_init(int hwcpuid);
 void nlm_boot_secondary_cpus(void);
 int nlm_wakeup_secondary_cpus(void);
diff --git a/arch/mips/jz4740/gpio.c b/arch/mips/jz4740/gpio.c
index 6cd69fdaa1c5..a74e181058b0 100644
--- a/arch/mips/jz4740/gpio.c
+++ b/arch/mips/jz4740/gpio.c
@@ -291,7 +291,7 @@ static void jz_gpio_check_trigger_both(struct jz_gpio_chip *chip, unsigned int i
         writel(mask, reg);
 }
 
-static void jz_gpio_irq_demux_handler(unsigned int irq, struct irq_desc *desc)
+static void jz_gpio_irq_demux_handler(struct irq_desc *desc)
 {
         uint32_t flag;
         unsigned int gpio_irq;
diff --git a/arch/mips/kvm/mips.c b/arch/mips/kvm/mips.c
index cd4c129ce743..49ff3bfc007e 100644
--- a/arch/mips/kvm/mips.c
+++ b/arch/mips/kvm/mips.c
@@ -55,6 +55,7 @@ struct kvm_stats_debugfs_item debugfs_entries[] = {
         { "msa_disabled", VCPU_STAT(msa_disabled_exits), KVM_STAT_VCPU },
         { "flush_dcache", VCPU_STAT(flush_dcache_exits), KVM_STAT_VCPU },
         { "halt_successful_poll", VCPU_STAT(halt_successful_poll), KVM_STAT_VCPU },
+        { "halt_attempted_poll", VCPU_STAT(halt_attempted_poll), KVM_STAT_VCPU },
         { "halt_wakeup",  VCPU_STAT(halt_wakeup),        KVM_STAT_VCPU },
         {NULL}
 };
diff --git a/arch/mips/netlogic/common/smp.c b/arch/mips/netlogic/common/smp.c
index 0136b4f9c9cd..10d86d54880a 100644
--- a/arch/mips/netlogic/common/smp.c
+++ b/arch/mips/netlogic/common/smp.c
@@ -82,7 +82,7 @@ void nlm_send_ipi_mask(const struct cpumask *mask, unsigned int action)
 }
 
 /* IRQ_IPI_SMP_FUNCTION Handler */
-void nlm_smp_function_ipi_handler(unsigned int __irq, struct irq_desc *desc)
+void nlm_smp_function_ipi_handler(struct irq_desc *desc)
 {
         unsigned int irq = irq_desc_get_irq(desc);
         clear_c0_eimr(irq);
@@ -92,7 +92,7 @@ void nlm_smp_function_ipi_handler(unsigned int __irq, struct irq_desc *desc)
 }
 
 /* IRQ_IPI_SMP_RESCHEDULE  handler */
-void nlm_smp_resched_ipi_handler(unsigned int __irq, struct irq_desc *desc)
+void nlm_smp_resched_ipi_handler(struct irq_desc *desc)
 {
         unsigned int irq = irq_desc_get_irq(desc);
         clear_c0_eimr(irq);
diff --git a/arch/mips/pci/pci-ar2315.c b/arch/mips/pci/pci-ar2315.c
index f8d0acb4f973..b4fa6413c4e5 100644
--- a/arch/mips/pci/pci-ar2315.c
+++ b/arch/mips/pci/pci-ar2315.c
@@ -318,7 +318,7 @@ static int ar2315_pci_host_setup(struct ar2315_pci_ctrl *apc)
         return 0;
 }
 
-static void ar2315_pci_irq_handler(unsigned irq, struct irq_desc *desc)
+static void ar2315_pci_irq_handler(struct irq_desc *desc)
 {
         struct ar2315_pci_ctrl *apc = irq_desc_get_handler_data(desc);
         u32 pending = ar2315_pci_reg_read(apc, AR2315_PCI_ISR) &
diff --git a/arch/mips/pci/pci-ar71xx.c b/arch/mips/pci/pci-ar71xx.c
index ad35a5e6a56c..7db963deec73 100644
--- a/arch/mips/pci/pci-ar71xx.c
+++ b/arch/mips/pci/pci-ar71xx.c
@@ -226,7 +226,7 @@ static struct pci_ops ar71xx_pci_ops = {
         .write  = ar71xx_pci_write_config,
 };
 
-static void ar71xx_pci_irq_handler(unsigned int irq, struct irq_desc *desc)
+static void ar71xx_pci_irq_handler(struct irq_desc *desc)
 {
         struct ar71xx_pci_controller *apc;
         void __iomem *base = ath79_reset_base;
diff --git a/arch/mips/pci/pci-ar724x.c b/arch/mips/pci/pci-ar724x.c
index 907d11dd921b..2013dad700df 100644
--- a/arch/mips/pci/pci-ar724x.c
+++ b/arch/mips/pci/pci-ar724x.c
@@ -225,7 +225,7 @@ static struct pci_ops ar724x_pci_ops = {
         .write  = ar724x_pci_write,
 };
 
-static void ar724x_pci_irq_handler(unsigned int irq, struct irq_desc *desc)
+static void ar724x_pci_irq_handler(struct irq_desc *desc)
 {
         struct ar724x_pci_controller *apc;
         void __iomem *base;
diff --git a/arch/mips/pci/pci-rt3883.c b/arch/mips/pci/pci-rt3883.c
index 53c8efaf1572..ed6732f9aa87 100644
--- a/arch/mips/pci/pci-rt3883.c
+++ b/arch/mips/pci/pci-rt3883.c
@@ -129,7 +129,7 @@ static void rt3883_pci_write_cfg32(struct rt3883_pci_controller *rpc,
         rt3883_pci_w32(rpc, val, RT3883_PCI_REG_CFGDATA);
 }
 
-static void rt3883_pci_irq_handler(unsigned int __irq, struct irq_desc *desc)
+static void rt3883_pci_irq_handler(struct irq_desc *desc)
 {
         struct rt3883_pci_controller *rpc;
         u32 pending;
diff --git a/arch/mips/pci/pci.c b/arch/mips/pci/pci.c
index c6996cf67a5c..b8a0bf5766f2 100644
--- a/arch/mips/pci/pci.c
+++ b/arch/mips/pci/pci.c
@@ -311,6 +311,12 @@ int pcibios_enable_device(struct pci_dev *dev, int mask)
 
 void pcibios_fixup_bus(struct pci_bus *bus)
 {
+        struct pci_dev *dev = bus->self;
+
+        if (pci_has_flag(PCI_PROBE_ONLY) && dev &&
+            (dev->class >> 8) == PCI_CLASS_BRIDGE_PCI) {
+                pci_read_bridge_bases(bus);
+        }
 }
 
 EXPORT_SYMBOL(PCIBIOS_MIN_IO);
diff --git a/arch/mips/ralink/irq.c b/arch/mips/ralink/irq.c
index 8c624a8b9ea2..4cf77f358395 100644
--- a/arch/mips/ralink/irq.c
+++ b/arch/mips/ralink/irq.c
@@ -96,7 +96,7 @@ unsigned int get_c0_compare_int(void)
         return CP0_LEGACY_COMPARE_IRQ;
 }
 
-static void ralink_intc_irq_handler(unsigned int irq, struct irq_desc *desc)
+static void ralink_intc_irq_handler(struct irq_desc *desc)
 {
         u32 pending = rt_intc_r32(INTC_REG_STATUS0);
 
diff --git a/arch/mn10300/unit-asb2305/pci.c b/arch/mn10300/unit-asb2305/pci.c
index deaa893efba5..3dfe2d31c67b 100644
--- a/arch/mn10300/unit-asb2305/pci.c
+++ b/arch/mn10300/unit-asb2305/pci.c
@@ -324,6 +324,7 @@ void pcibios_fixup_bus(struct pci_bus *bus)
         struct pci_dev *dev;
 
         if (bus->self) {
+                pci_read_bridge_bases(bus);
                 pcibios_fixup_bridge_resources(bus->self);
         }
 
diff --git a/arch/powerpc/boot/Makefile b/arch/powerpc/boot/Makefile
index 73eddda53b8e..4eec430d8fa8 100644
--- a/arch/powerpc/boot/Makefile
+++ b/arch/powerpc/boot/Makefile
@@ -28,6 +28,9 @@ BOOTCFLAGS	+= -m64
 endif
 ifdef CONFIG_CPU_BIG_ENDIAN
 BOOTCFLAGS      += -mbig-endian
+else
+BOOTCFLAGS      += -mlittle-endian
+BOOTCFLAGS      += $(call cc-option,-mabi=elfv2)
 endif
 
 BOOTAFLAGS      := -D__ASSEMBLY__ $(BOOTCFLAGS) -traditional -nostdinc
diff --git a/arch/powerpc/include/asm/kvm_host.h b/arch/powerpc/include/asm/kvm_host.h
index 98eebbf66340..827a38d7a9db 100644
--- a/arch/powerpc/include/asm/kvm_host.h
+++ b/arch/powerpc/include/asm/kvm_host.h
@@ -44,6 +44,7 @@
 #ifdef CONFIG_KVM_MMIO
 #define KVM_COALESCED_MMIO_PAGE_OFFSET 1
 #endif
+#define KVM_HALT_POLL_NS_DEFAULT 500000
 
 /* These values are internal and can be increased later */
 #define KVM_NR_IRQCHIPS          1
@@ -108,6 +109,7 @@ struct kvm_vcpu_stat {
         u32 dec_exits;
         u32 ext_intr_exits;
         u32 halt_successful_poll;
+        u32 halt_attempted_poll;
         u32 halt_wakeup;
         u32 dbell_exits;
         u32 gdbell_exits;
diff --git a/arch/powerpc/include/asm/qe_ic.h b/arch/powerpc/include/asm/qe_ic.h
index 25784cc959a0..1e155ca6d33c 100644
--- a/arch/powerpc/include/asm/qe_ic.h
+++ b/arch/powerpc/include/asm/qe_ic.h
@@ -59,14 +59,14 @@ enum qe_ic_grp_id {
 
 #ifdef CONFIG_QUICC_ENGINE
 void qe_ic_init(struct device_node *node, unsigned int flags,
-                void (*low_handler)(unsigned int irq, struct irq_desc *desc),
-                void (*high_handler)(unsigned int irq, struct irq_desc *desc));
+                void (*low_handler)(struct irq_desc *desc),
+                void (*high_handler)(struct irq_desc *desc));
 unsigned int qe_ic_get_low_irq(struct qe_ic *qe_ic);
 unsigned int qe_ic_get_high_irq(struct qe_ic *qe_ic);
 #else
 static inline void qe_ic_init(struct device_node *node, unsigned int flags,
-                void (*low_handler)(unsigned int irq, struct irq_desc *desc),
-                void (*high_handler)(unsigned int irq, struct irq_desc *desc))
+                void (*low_handler)(struct irq_desc *desc),
+                void (*high_handler)(struct irq_desc *desc))
 {}
 static inline unsigned int qe_ic_get_low_irq(struct qe_ic *qe_ic)
 { return 0; }
@@ -78,8 +78,7 @@ void qe_ic_set_highest_priority(unsigned int virq, int high);
 int qe_ic_set_priority(unsigned int virq, unsigned int priority);
 int qe_ic_set_high_priority(unsigned int virq, unsigned int priority, int high);
 
-static inline void qe_ic_cascade_low_ipic(unsigned int irq,
-                                          struct irq_desc *desc)
+static inline void qe_ic_cascade_low_ipic(struct irq_desc *desc)
 {
         struct qe_ic *qe_ic = irq_desc_get_handler_data(desc);
         unsigned int cascade_irq = qe_ic_get_low_irq(qe_ic);
@@ -88,8 +87,7 @@ static inline void qe_ic_cascade_low_ipic(unsigned int irq,
                 generic_handle_irq(cascade_irq);
 }
 
-static inline void qe_ic_cascade_high_ipic(unsigned int irq,
-                                           struct irq_desc *desc)
+static inline void qe_ic_cascade_high_ipic(struct irq_desc *desc)
 {
         struct qe_ic *qe_ic = irq_desc_get_handler_data(desc);
         unsigned int cascade_irq = qe_ic_get_high_irq(qe_ic);
@@ -98,8 +96,7 @@ static inline void qe_ic_cascade_high_ipic(unsigned int irq,
                 generic_handle_irq(cascade_irq);
 }
 
-static inline void qe_ic_cascade_low_mpic(unsigned int irq,
-                                          struct irq_desc *desc)
+static inline void qe_ic_cascade_low_mpic(struct irq_desc *desc)
 {
         struct qe_ic *qe_ic = irq_desc_get_handler_data(desc);
         unsigned int cascade_irq = qe_ic_get_low_irq(qe_ic);
@@ -111,8 +108,7 @@ static inline void qe_ic_cascade_low_mpic(unsigned int irq,
         chip->irq_eoi(&desc->irq_data);
 }
 
-static inline void qe_ic_cascade_high_mpic(unsigned int irq,
-                                           struct irq_desc *desc)
+static inline void qe_ic_cascade_high_mpic(struct irq_desc *desc)
 {
         struct qe_ic *qe_ic = irq_desc_get_handler_data(desc);
         unsigned int cascade_irq = qe_ic_get_high_irq(qe_ic);
@@ -124,8 +120,7 @@ static inline void qe_ic_cascade_high_mpic(unsigned int irq,
         chip->irq_eoi(&desc->irq_data);
 }
 
-static inline void qe_ic_cascade_muxed_mpic(unsigned int irq,
-                                            struct irq_desc *desc)
+static inline void qe_ic_cascade_muxed_mpic(struct irq_desc *desc)
 {
         struct qe_ic *qe_ic = irq_desc_get_handler_data(desc);
         unsigned int cascade_irq;
diff --git a/arch/powerpc/include/asm/systbl.h b/arch/powerpc/include/asm/systbl.h
index 71f2b3f02cf8..126d0c4f9b7d 100644
--- a/arch/powerpc/include/asm/systbl.h
+++ b/arch/powerpc/include/asm/systbl.h
@@ -368,3 +368,5 @@ SYSCALL_SPU(memfd_create)
 SYSCALL_SPU(bpf)
 COMPAT_SYS(execveat)
 PPC64ONLY(switch_endian)
+SYSCALL_SPU(userfaultfd)
+SYSCALL_SPU(membarrier)
diff --git a/arch/powerpc/include/asm/tsi108_pci.h b/arch/powerpc/include/asm/tsi108_pci.h
index 5653d7cc3e24..ae59d5b672b0 100644
--- a/arch/powerpc/include/asm/tsi108_pci.h
+++ b/arch/powerpc/include/asm/tsi108_pci.h
@@ -39,7 +39,7 @@
 
 extern int tsi108_setup_pci(struct device_node *dev, u32 cfg_phys, int primary);
 extern void tsi108_pci_int_init(struct device_node *node);
-extern void tsi108_irq_cascade(unsigned int irq, struct irq_desc *desc);
+extern void tsi108_irq_cascade(struct irq_desc *desc);
 extern void tsi108_clear_pci_cfg_error(void);
 
 #endif                          /*  _ASM_POWERPC_TSI108_PCI_H */
diff --git a/arch/powerpc/include/asm/unistd.h b/arch/powerpc/include/asm/unistd.h
index f4f8b667d75b..13411be86041 100644
--- a/arch/powerpc/include/asm/unistd.h
+++ b/arch/powerpc/include/asm/unistd.h
@@ -12,7 +12,7 @@
 #include <uapi/asm/unistd.h>
 
 
-#define __NR_syscalls           364
+#define __NR_syscalls           366
 
 #define __NR__exit __NR_exit
 #define NR_syscalls     __NR_syscalls
diff --git a/arch/powerpc/include/uapi/asm/unistd.h b/arch/powerpc/include/uapi/asm/unistd.h
index e4aa173dae62..6337738018aa 100644
--- a/arch/powerpc/include/uapi/asm/unistd.h
+++ b/arch/powerpc/include/uapi/asm/unistd.h
@@ -386,5 +386,7 @@
 #define __NR_bpf                361
 #define __NR_execveat           362
 #define __NR_switch_endian      363
+#define __NR_userfaultfd        364
+#define __NR_membarrier         365
 
 #endif /* _UAPI_ASM_POWERPC_UNISTD_H_ */
diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c
index 45096033d37b..290559df1e8b 100644
--- a/arch/powerpc/kernel/irq.c
+++ b/arch/powerpc/kernel/irq.c
@@ -441,7 +441,7 @@ void migrate_irqs(void)
 
                 chip = irq_data_get_irq_chip(data);
 
-                cpumask_and(mask, data->affinity, map);
+                cpumask_and(mask, irq_data_get_affinity_mask(data), map);
                 if (cpumask_any(mask) >= nr_cpu_ids) {
                         pr_warn("Breaking affinity for irq %i\n", irq);
                         cpumask_copy(mask, map);
diff --git a/arch/powerpc/kernel/pci-common.c b/arch/powerpc/kernel/pci-common.c
index a1d0632d97c6..7587b2ae5f77 100644
--- a/arch/powerpc/kernel/pci-common.c
+++ b/arch/powerpc/kernel/pci-common.c
@@ -1032,7 +1032,13 @@ void pcibios_set_master(struct pci_dev *dev)
 
 void pcibios_fixup_bus(struct pci_bus *bus)
 {
-        /* Fixup the bus */
+        /* When called from the generic PCI probe, read PCI<->PCI bridge
+         * bases. This is -not- called when generating the PCI tree from
+         * the OF device-tree.
+         */
+        pci_read_bridge_bases(bus);
+
+        /* Now fixup the bus bus */
         pcibios_setup_bus_self(bus);
 
         /* Now fixup devices on that bus */
diff --git a/arch/powerpc/kernel/setup_32.c b/arch/powerpc/kernel/setup_32.c
index bb02e9f6944e..ad8c9db61237 100644
--- a/arch/powerpc/kernel/setup_32.c
+++ b/arch/powerpc/kernel/setup_32.c
@@ -38,6 +38,7 @@
 #include <asm/udbg.h>
 #include <asm/mmu_context.h>
 #include <asm/epapr_hcalls.h>
+#include <asm/code-patching.h>
 
 #define DBG(fmt...)
 
@@ -109,6 +110,8 @@ notrace unsigned long __init early_init(unsigned long dt_ptr)
  * This is called very early on the boot process, after a minimal
  * MMU environment has been set up but before MMU_init is called.
  */
+extern unsigned int memset_nocache_branch; /* Insn to be replaced by NOP */
+
 notrace void __init machine_init(u64 dt_ptr)
 {
         lockdep_init();
@@ -116,6 +119,9 @@ notrace void __init machine_init(u64 dt_ptr)
         /* Enable early debugging if any specified (see udbg.h) */
         udbg_early_init();
 
+        patch_instruction((unsigned int *)&memcpy, PPC_INST_NOP);
+        patch_instruction(&memset_nocache_branch, PPC_INST_NOP);
+
         /* Do some early initialization based on the flat device tree */
         early_init_devtree(__va(dt_ptr));
 
diff --git a/arch/powerpc/kvm/book3s.c b/arch/powerpc/kvm/book3s.c
index d75bf325f54a..099c79d8c160 100644
--- a/arch/powerpc/kvm/book3s.c
+++ b/arch/powerpc/kvm/book3s.c
@@ -53,6 +53,7 @@ struct kvm_stats_debugfs_item debugfs_entries[] = {
         { "ext_intr",    VCPU_STAT(ext_intr_exits) },
         { "queue_intr",  VCPU_STAT(queue_intr) },
         { "halt_successful_poll", VCPU_STAT(halt_successful_poll), },
+        { "halt_attempted_poll", VCPU_STAT(halt_attempted_poll), },
         { "halt_wakeup", VCPU_STAT(halt_wakeup) },
         { "pf_storage",  VCPU_STAT(pf_storage) },
         { "sp_storage",  VCPU_STAT(sp_storage) },
@@ -828,12 +829,15 @@ int kvmppc_h_logical_ci_load(struct kvm_vcpu *vcpu)
         unsigned long size = kvmppc_get_gpr(vcpu, 4);
         unsigned long addr = kvmppc_get_gpr(vcpu, 5);
         u64 buf;
+        int srcu_idx;
         int ret;
 
         if (!is_power_of_2(size) || (size > sizeof(buf)))
                 return H_TOO_HARD;
 
+        srcu_idx = srcu_read_lock(&vcpu->kvm->srcu);
         ret = kvm_io_bus_read(vcpu, KVM_MMIO_BUS, addr, size, &buf);
+        srcu_read_unlock(&vcpu->kvm->srcu, srcu_idx);
         if (ret != 0)
                 return H_TOO_HARD;
 
@@ -868,6 +872,7 @@ int kvmppc_h_logical_ci_store(struct kvm_vcpu *vcpu)
         unsigned long addr = kvmppc_get_gpr(vcpu, 5);
         unsigned long val = kvmppc_get_gpr(vcpu, 6);
         u64 buf;
+        int srcu_idx;
         int ret;
 
         switch (size) {
@@ -891,7 +896,9 @@ int kvmppc_h_logical_ci_store(struct kvm_vcpu *vcpu)
                 return H_TOO_HARD;
         }
 
+        srcu_idx = srcu_read_lock(&vcpu->kvm->srcu);
         ret = kvm_io_bus_write(vcpu, KVM_MMIO_BUS, addr, size, &buf);
+        srcu_read_unlock(&vcpu->kvm->srcu, srcu_idx);
         if (ret != 0)
                 return H_TOO_HARD;
 
diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
index 9754e6815e52..228049786888 100644
--- a/arch/powerpc/kvm/book3s_hv.c
+++ b/arch/powerpc/kvm/book3s_hv.c
@@ -2692,9 +2692,13 @@ static int kvmppc_run_vcpu(struct kvm_run *kvm_run, struct kvm_vcpu *vcpu)
 
         while (vcpu->arch.state == KVMPPC_VCPU_RUNNABLE &&
                (vc->vcore_state == VCORE_RUNNING ||
-                vc->vcore_state == VCORE_EXITING))
+                vc->vcore_state == VCORE_EXITING ||
+                vc->vcore_state == VCORE_PIGGYBACK))
                 kvmppc_wait_for_exec(vc, vcpu, TASK_UNINTERRUPTIBLE);
 
+        if (vc->vcore_state == VCORE_PREEMPT && vc->runner == NULL)
+                kvmppc_vcore_end_preempt(vc);
+
         if (vcpu->arch.state == KVMPPC_VCPU_RUNNABLE) {
                 kvmppc_remove_runnable(vc, vcpu);
                 vcpu->stat.signal_exits++;
diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
index 2273dcacef39..b98889e9851d 100644
--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
@@ -1257,6 +1257,7 @@ mc_cont:
         bl      kvmhv_accumulate_time
 #endif
 
+        mr      r3, r12
         /* Increment exit count, poke other threads to exit */
         bl      kvmhv_commence_exit
         nop
diff --git a/arch/powerpc/kvm/booke.c b/arch/powerpc/kvm/booke.c
index ae458f0fd061..fd5875179e5c 100644
--- a/arch/powerpc/kvm/booke.c
+++ b/arch/powerpc/kvm/booke.c
@@ -63,6 +63,7 @@ struct kvm_stats_debugfs_item debugfs_entries[] = {
         { "dec",        VCPU_STAT(dec_exits) },
         { "ext_intr",   VCPU_STAT(ext_intr_exits) },
         { "halt_successful_poll", VCPU_STAT(halt_successful_poll) },
+        { "halt_attempted_poll", VCPU_STAT(halt_attempted_poll) },
         { "halt_wakeup", VCPU_STAT(halt_wakeup) },
         { "doorbell", VCPU_STAT(dbell_exits) },
         { "guest doorbell", VCPU_STAT(gdbell_exits) },
diff --git a/arch/powerpc/lib/copy_32.S b/arch/powerpc/lib/copy_32.S
index 2ef50c629470..c44df2dbedd5 100644
--- a/arch/powerpc/lib/copy_32.S
+++ b/arch/powerpc/lib/copy_32.S
@@ -73,6 +73,10 @@ CACHELINE_MASK = (L1_CACHE_BYTES-1)
  * Use dcbz on the complete cache lines in the destination
  * to set them to zero.  This requires that the destination
  * area is cacheable.  -- paulus
+ *
+ * During early init, cache might not be active yet, so dcbz cannot be used.
+ * We therefore skip the optimised bloc that uses dcbz. This jump is
+ * replaced by a nop once cache is active. This is done in machine_init()
  */
 _GLOBAL(memset)
         rlwimi  r4,r4,8,16,23
@@ -88,6 +92,8 @@ _GLOBAL(memset)
         subf    r6,r0,r6
         cmplwi  0,r4,0
         bne     2f      /* Use normal procedure if r4 is not zero */
+_GLOBAL(memset_nocache_branch)
+        b       2f      /* Skip optimised bloc until cache is enabled */
 
         clrlwi  r7,r6,32-LG_CACHELINE_BYTES
         add     r8,r7,r5
@@ -128,6 +134,10 @@ _GLOBAL(memset)
  * the destination area is cacheable.
  * We only use this version if the source and dest don't overlap.
  * -- paulus.
+ *
+ * During early init, cache might not be active yet, so dcbz cannot be used.
+ * We therefore jump to generic_memcpy which doesn't use dcbz. This jump is
+ * replaced by a nop once cache is active. This is done in machine_init()
  */
 _GLOBAL(memmove)
         cmplw   0,r3,r4
@@ -135,6 +145,7 @@ _GLOBAL(memmove)
         /* fall through */
 
 _GLOBAL(memcpy)
+        b       generic_memcpy
         add     r7,r3,r5                /* test if the src & dst overlap */
         add     r8,r4,r5
         cmplw   0,r4,r7
diff --git a/arch/powerpc/mm/hugepage-hash64.c b/arch/powerpc/mm/hugepage-hash64.c
index 43dafb9d6a46..4d87122cf6a7 100644
--- a/arch/powerpc/mm/hugepage-hash64.c
+++ b/arch/powerpc/mm/hugepage-hash64.c
@@ -85,7 +85,6 @@ int __hash_page_thp(unsigned long ea, unsigned long access, unsigned long vsid,
         BUG_ON(index >= 4096);
 
         vpn = hpt_vpn(ea, vsid, ssize);
-        hash = hpt_hash(vpn, shift, ssize);
         hpte_slot_array = get_hpte_slot_array(pmdp);
         if (psize == MMU_PAGE_4K) {
                 /*
@@ -101,6 +100,7 @@ int __hash_page_thp(unsigned long ea, unsigned long access, unsigned long vsid,
         valid = hpte_valid(hpte_slot_array, index);
         if (valid) {
                 /* update the hpte bits */
+                hash = hpt_hash(vpn, shift, ssize);
                 hidx =  hpte_hash_index(hpte_slot_array, index);
                 if (hidx & _PTEIDX_SECONDARY)
                         hash = ~hash;
@@ -126,6 +126,7 @@ int __hash_page_thp(unsigned long ea, unsigned long access, unsigned long vsid,
         if (!valid) {
                 unsigned long hpte_group;
 
+                hash = hpt_hash(vpn, shift, ssize);
                 /* insert new entry */
                 pa = pmd_pfn(__pmd(old_pmd)) << PAGE_SHIFT;
                 new_pmd |= _PAGE_HASHPTE;
diff --git a/arch/powerpc/platforms/512x/mpc5121_ads_cpld.c b/arch/powerpc/platforms/512x/mpc5121_ads_cpld.c
index 11090ab4bf59..0035d146df73 100644
--- a/arch/powerpc/platforms/512x/mpc5121_ads_cpld.c
+++ b/arch/powerpc/platforms/512x/mpc5121_ads_cpld.c
@@ -104,9 +104,10 @@ cpld_pic_get_irq(int offset, u8 ignore, u8 __iomem *statusp,
         return irq_linear_revmap(cpld_pic_host, cpld_irq);
 }
 
-static void
-cpld_pic_cascade(unsigned int irq, struct irq_desc *desc)
+static void cpld_pic_cascade(struct irq_desc *desc)
 {
+        unsigned int irq;
+
         irq = cpld_pic_get_irq(0, PCI_IGNORE, &cpld_regs->pci_status,
                 &cpld_regs->pci_mask);
         if (irq != NO_IRQ) {
diff --git a/arch/powerpc/platforms/52xx/media5200.c b/arch/powerpc/platforms/52xx/media5200.c
index 32cae33c4266..8fb95480fd73 100644
--- a/arch/powerpc/platforms/52xx/media5200.c
+++ b/arch/powerpc/platforms/52xx/media5200.c
@@ -80,7 +80,7 @@ static struct irq_chip media5200_irq_chip = {
         .irq_mask_ack = media5200_irq_mask,
 };
 
-void media5200_irq_cascade(unsigned int virq, struct irq_desc *desc)
+static void media5200_irq_cascade(struct irq_desc *desc)
 {
         struct irq_chip *chip = irq_desc_get_chip(desc);
         int sub_virq, val;
diff --git a/arch/powerpc/platforms/52xx/mpc52xx_gpt.c b/arch/powerpc/platforms/52xx/mpc52xx_gpt.c
index 63016621aff8..78ac19aefa4d 100644
--- a/arch/powerpc/platforms/52xx/mpc52xx_gpt.c
+++ b/arch/powerpc/platforms/52xx/mpc52xx_gpt.c
@@ -191,7 +191,7 @@ static struct irq_chip mpc52xx_gpt_irq_chip = {
         .irq_set_type = mpc52xx_gpt_irq_set_type,
 };
 
-void mpc52xx_gpt_irq_cascade(unsigned int virq, struct irq_desc *desc)
+static void mpc52xx_gpt_irq_cascade(struct irq_desc *desc)
 {
         struct mpc52xx_gpt_priv *gpt = irq_desc_get_handler_data(desc);
         int sub_virq;
diff --git a/arch/powerpc/platforms/52xx/mpc52xx_pic.c b/arch/powerpc/platforms/52xx/mpc52xx_pic.c
index 2944bc84b9d6..4fe2074c88cb 100644
--- a/arch/powerpc/platforms/52xx/mpc52xx_pic.c
+++ b/arch/powerpc/platforms/52xx/mpc52xx_pic.c
@@ -196,7 +196,7 @@ static int mpc52xx_extirq_set_type(struct irq_data *d, unsigned int flow_type)
         ctrl_reg |= (type << (22 - (l2irq * 2)));
         out_be32(&intr->ctrl, ctrl_reg);
 
-        __irq_set_handler_locked(d->irq, handler);
+        irq_set_handler_locked(d, handler);
 
         return 0;
 }
diff --git a/arch/powerpc/platforms/82xx/pq2ads-pci-pic.c b/arch/powerpc/platforms/82xx/pq2ads-pci-pic.c
index 74861a7fb807..60e89fc9c753 100644
--- a/arch/powerpc/platforms/82xx/pq2ads-pci-pic.c
+++ b/arch/powerpc/platforms/82xx/pq2ads-pci-pic.c
@@ -78,7 +78,7 @@ static struct irq_chip pq2ads_pci_ic = {
         .irq_disable = pq2ads_pci_mask_irq
 };
 
-static void pq2ads_pci_irq_demux(unsigned int irq, struct irq_desc *desc)
+static void pq2ads_pci_irq_demux(struct irq_desc *desc)
 {
         struct pq2ads_pci_pic *priv = irq_desc_get_handler_data(desc);
         u32 stat, mask, pend;
diff --git a/arch/powerpc/platforms/85xx/common.c b/arch/powerpc/platforms/85xx/common.c
index 7bfb9b184dd4..23791de7b688 100644
--- a/arch/powerpc/platforms/85xx/common.c
+++ b/arch/powerpc/platforms/85xx/common.c
@@ -49,7 +49,7 @@ int __init mpc85xx_common_publish_devices(void)
         return of_platform_bus_probe(NULL, mpc85xx_common_ids, NULL);
 }
 #ifdef CONFIG_CPM2
-static void cpm2_cascade(unsigned int irq, struct irq_desc *desc)
+static void cpm2_cascade(struct irq_desc *desc)
 {
         struct irq_chip *chip = irq_desc_get_chip(desc);
         int cascade_irq;
diff --git a/arch/powerpc/platforms/85xx/mpc85xx_cds.c b/arch/powerpc/platforms/85xx/mpc85xx_cds.c
index b0753e222086..5ac70de3e48a 100644
--- a/arch/powerpc/platforms/85xx/mpc85xx_cds.c
+++ b/arch/powerpc/platforms/85xx/mpc85xx_cds.c
@@ -192,8 +192,7 @@ void mpc85xx_cds_fixup_bus(struct pci_bus *bus)
 }
 
 #ifdef CONFIG_PPC_I8259
-static void mpc85xx_8259_cascade_handler(unsigned int irq,
-                                         struct irq_desc *desc)
+static void mpc85xx_8259_cascade_handler(struct irq_desc *desc)
 {
         unsigned int cascade_irq = i8259_irq();
 
@@ -202,7 +201,7 @@ static void mpc85xx_8259_cascade_handler(unsigned int irq,
                 generic_handle_irq(cascade_irq);
 
         /* check for any interrupts from the shared IRQ line */
-        handle_fasteoi_irq(irq, desc);
+        handle_fasteoi_irq(desc);
 }
 
 static irqreturn_t mpc85xx_8259_cascade_action(int irq, void *dev_id)
diff --git a/arch/powerpc/platforms/85xx/mpc85xx_ds.c b/arch/powerpc/platforms/85xx/mpc85xx_ds.c
index ffdf02121a7c..f858306dba6a 100644
--- a/arch/powerpc/platforms/85xx/mpc85xx_ds.c
+++ b/arch/powerpc/platforms/85xx/mpc85xx_ds.c
@@ -46,7 +46,7 @@
 #endif
 
 #ifdef CONFIG_PPC_I8259
-static void mpc85xx_8259_cascade(unsigned int irq, struct irq_desc *desc)
+static void mpc85xx_8259_cascade(struct irq_desc *desc)
 {
         struct irq_chip *chip = irq_desc_get_chip(desc);
         unsigned int cascade_irq = i8259_irq();
diff --git a/arch/powerpc/platforms/85xx/socrates_fpga_pic.c b/arch/powerpc/platforms/85xx/socrates_fpga_pic.c
index 55a9682b9529..b02d6a5bb035 100644
--- a/arch/powerpc/platforms/85xx/socrates_fpga_pic.c
+++ b/arch/powerpc/platforms/85xx/socrates_fpga_pic.c
@@ -91,9 +91,10 @@ static inline unsigned int socrates_fpga_pic_get_irq(unsigned int irq)
                         (irq_hw_number_t)i);
 }
 
-void socrates_fpga_pic_cascade(unsigned int irq, struct irq_desc *desc)
+static void socrates_fpga_pic_cascade(struct irq_desc *desc)
 {
         struct irq_chip *chip = irq_desc_get_chip(desc);
+        unsigned int irq = irq_desc_get_irq(desc);
         unsigned int cascade_irq;
 
         /*
diff --git a/arch/powerpc/platforms/86xx/pic.c b/arch/powerpc/platforms/86xx/pic.c
index d5b98c0f958a..845defa1fd19 100644
--- a/arch/powerpc/platforms/86xx/pic.c
+++ b/arch/powerpc/platforms/86xx/pic.c
@@ -17,7 +17,7 @@
 #include <asm/i8259.h>
 
 #ifdef CONFIG_PPC_I8259
-static void mpc86xx_8259_cascade(unsigned int irq, struct irq_desc *desc)
+static void mpc86xx_8259_cascade(struct irq_desc *desc)
 {
         struct irq_chip *chip = irq_desc_get_chip(desc);
         unsigned int cascade_irq = i8259_irq();
diff --git a/arch/powerpc/platforms/8xx/m8xx_setup.c b/arch/powerpc/platforms/8xx/m8xx_setup.c
index d3037747031d..c289fc77b4ba 100644
--- a/arch/powerpc/platforms/8xx/m8xx_setup.c
+++ b/arch/powerpc/platforms/8xx/m8xx_setup.c
@@ -214,7 +214,7 @@ void mpc8xx_restart(char *cmd)
         panic("Restart failed\n");
 }
 
-static void cpm_cascade(unsigned int irq, struct irq_desc *desc)
+static void cpm_cascade(struct irq_desc *desc)
 {
         struct irq_chip *chip = irq_desc_get_chip(desc);
         int cascade_irq = cpm_get_irq();
diff --git a/arch/powerpc/platforms/cell/axon_msi.c b/arch/powerpc/platforms/cell/axon_msi.c
index 306888acb737..e0e68a1c0d3c 100644
--- a/arch/powerpc/platforms/cell/axon_msi.c
+++ b/arch/powerpc/platforms/cell/axon_msi.c
@@ -93,7 +93,7 @@ static void msic_dcr_write(struct axon_msic *msic, unsigned int dcr_n, u32 val)
         dcr_write(msic->dcr_host, dcr_n, val);
 }
 
-static void axon_msi_cascade(unsigned int irq, struct irq_desc *desc)
+static void axon_msi_cascade(struct irq_desc *desc)
 {
         struct irq_chip *chip = irq_desc_get_chip(desc);
         struct axon_msic *msic = irq_desc_get_handler_data(desc);
diff --git a/arch/powerpc/platforms/cell/interrupt.c b/arch/powerpc/platforms/cell/interrupt.c
index a15f1efc295f..9f609fc8d331 100644
--- a/arch/powerpc/platforms/cell/interrupt.c
+++ b/arch/powerpc/platforms/cell/interrupt.c
@@ -99,11 +99,12 @@ static void iic_ioexc_eoi(struct irq_data *d)
 {
 }
 
-static void iic_ioexc_cascade(unsigned int irq, struct irq_desc *desc)
+static void iic_ioexc_cascade(struct irq_desc *desc)
 {
         struct irq_chip *chip = irq_desc_get_chip(desc);
         struct cbe_iic_regs __iomem *node_iic =
                 (void __iomem *)irq_desc_get_handler_data(desc);
+        unsigned int irq = irq_desc_get_irq(desc);
         unsigned int base = (irq & 0xffffff00) | IIC_IRQ_TYPE_IOEXC;
         unsigned long bits, ack;
         int cascade;
diff --git a/arch/powerpc/platforms/cell/spider-pic.c b/arch/powerpc/platforms/cell/spider-pic.c
index 1f72f4ab6353..9d27de62dc62 100644
--- a/arch/powerpc/platforms/cell/spider-pic.c
+++ b/arch/powerpc/platforms/cell/spider-pic.c
@@ -199,7 +199,7 @@ static const struct irq_domain_ops spider_host_ops = {
         .xlate = spider_host_xlate,
 };
 
-static void spider_irq_cascade(unsigned int irq, struct irq_desc *desc)
+static void spider_irq_cascade(struct irq_desc *desc)
 {
         struct irq_chip *chip = irq_desc_get_chip(desc);
         struct spider_pic *pic = irq_desc_get_handler_data(desc);
diff --git a/arch/powerpc/platforms/chrp/setup.c b/arch/powerpc/platforms/chrp/setup.c
index 15ebc4e8a151..987d1b8d68e3 100644
--- a/arch/powerpc/platforms/chrp/setup.c
+++ b/arch/powerpc/platforms/chrp/setup.c
@@ -363,7 +363,7 @@ void __init chrp_setup_arch(void)
         if (ppc_md.progress) ppc_md.progress("Linux/PPC "UTS_RELEASE"\n", 0x0);
 }
 
-static void chrp_8259_cascade(unsigned int irq, struct irq_desc *desc)
+static void chrp_8259_cascade(struct irq_desc *desc)
 {
         struct irq_chip *chip = irq_desc_get_chip(desc);
         unsigned int cascade_irq = i8259_irq();
diff --git a/arch/powerpc/platforms/embedded6xx/hlwd-pic.c b/arch/powerpc/platforms/embedded6xx/hlwd-pic.c
index 9dd154d6f89a..9b7975706bfc 100644
--- a/arch/powerpc/platforms/embedded6xx/hlwd-pic.c
+++ b/arch/powerpc/platforms/embedded6xx/hlwd-pic.c
@@ -120,8 +120,7 @@ static unsigned int __hlwd_pic_get_irq(struct irq_domain *h)
         return irq_linear_revmap(h, irq);
 }
 
-static void hlwd_pic_irq_cascade(unsigned int cascade_virq,
-                                      struct irq_desc *desc)
+static void hlwd_pic_irq_cascade(struct irq_desc *desc)
 {
         struct irq_chip *chip = irq_desc_get_chip(desc);
         struct irq_domain *irq_domain = irq_desc_get_handler_data(desc);
diff --git a/arch/powerpc/platforms/embedded6xx/mvme5100.c b/arch/powerpc/platforms/embedded6xx/mvme5100.c
index 1613303177e6..8f65aa3747f5 100644
--- a/arch/powerpc/platforms/embedded6xx/mvme5100.c
+++ b/arch/powerpc/platforms/embedded6xx/mvme5100.c
@@ -42,7 +42,7 @@
 static phys_addr_t pci_membase;
 static u_char *restart;
 
-static void mvme5100_8259_cascade(unsigned int irq, struct irq_desc *desc)
+static void mvme5100_8259_cascade(struct irq_desc *desc)
 {
         struct irq_chip *chip = irq_desc_get_chip(desc);
         unsigned int cascade_irq = i8259_irq();
diff --git a/arch/powerpc/platforms/pasemi/msi.c b/arch/powerpc/platforms/pasemi/msi.c
index e66ef1943338..b304a9fe55cc 100644
--- a/arch/powerpc/platforms/pasemi/msi.c
+++ b/arch/powerpc/platforms/pasemi/msi.c
@@ -63,6 +63,7 @@ static struct irq_chip mpic_pasemi_msi_chip = {
 static void pasemi_msi_teardown_msi_irqs(struct pci_dev *pdev)
 {
         struct msi_desc *entry;
+        irq_hw_number_t hwirq;
 
         pr_debug("pasemi_msi_teardown_msi_irqs, pdev %p\n", pdev);
 
@@ -70,10 +71,10 @@ static void pasemi_msi_teardown_msi_irqs(struct pci_dev *pdev)
                 if (entry->irq == NO_IRQ)
                         continue;
 
+                hwirq = virq_to_hw(entry->irq);
                 irq_set_msi_desc(entry->irq, NULL);
-                msi_bitmap_free_hwirqs(&msi_mpic->msi_bitmap,
-                                       virq_to_hw(entry->irq), ALLOC_CHUNK);
                 irq_dispose_mapping(entry->irq);
+                msi_bitmap_free_hwirqs(&msi_mpic->msi_bitmap, hwirq, ALLOC_CHUNK);
         }
 
         return;
diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
index 2927cd5c8303..414fd1a00fda 100644
--- a/arch/powerpc/platforms/powernv/pci-ioda.c
+++ b/arch/powerpc/platforms/powernv/pci-ioda.c
@@ -2049,9 +2049,23 @@ static long pnv_pci_ioda2_setup_default_config(struct pnv_ioda_pe *pe)
         struct iommu_table *tbl = NULL;
         long rc;
 
+        /*
+         * crashkernel= specifies the kdump kernel's maximum memory at
+         * some offset and there is no guaranteed the result is a power
+         * of 2, which will cause errors later.
+         */
+        const u64 max_memory = __rounddown_pow_of_two(memory_hotplug_max());
+
+        /*
+         * In memory constrained environments, e.g. kdump kernel, the
+         * DMA window can be larger than available memory, which will
+         * cause errors later.
+         */
+        const u64 window_size = min((u64)pe->table_group.tce32_size, max_memory);
+
         rc = pnv_pci_ioda2_create_table(&pe->table_group, 0,
                         IOMMU_PAGE_SHIFT_4K,
-                        pe->table_group.tce32_size,
+                        window_size,
                         POWERNV_IOMMU_DEFAULT_LEVELS, &tbl);
         if (rc) {
                 pe_err(pe, "Failed to create 32-bit TCE table, err %ld",
diff --git a/arch/powerpc/platforms/powernv/pci.c b/arch/powerpc/platforms/powernv/pci.c
index 9b2480b265c0..f2dd77234240 100644
--- a/arch/powerpc/platforms/powernv/pci.c
+++ b/arch/powerpc/platforms/powernv/pci.c
@@ -99,6 +99,7 @@ void pnv_teardown_msi_irqs(struct pci_dev *pdev)
         struct pci_controller *hose = pci_bus_to_host(pdev->bus);
         struct pnv_phb *phb = hose->private_data;
         struct msi_desc *entry;
+        irq_hw_number_t hwirq;
 
         if (WARN_ON(!phb))
                 return;
@@ -106,10 +107,10 @@ void pnv_teardown_msi_irqs(struct pci_dev *pdev)
         for_each_pci_msi_entry(entry, pdev) {
                 if (entry->irq == NO_IRQ)
                         continue;
+                hwirq = virq_to_hw(entry->irq);
                 irq_set_msi_desc(entry->irq, NULL);
-                msi_bitmap_free_hwirqs(&phb->msi_bmp,
-                        virq_to_hw(entry->irq) - phb->msi_base, 1);
                 irq_dispose_mapping(entry->irq);
+                msi_bitmap_free_hwirqs(&phb->msi_bmp, hwirq - phb->msi_base, 1);
         }
 }
 #endif /* CONFIG_PCI_MSI */
diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c
index 47d9cebe7159..db17827eb746 100644
--- a/arch/powerpc/platforms/pseries/dlpar.c
+++ b/arch/powerpc/platforms/pseries/dlpar.c
@@ -422,8 +422,10 @@ static ssize_t dlpar_cpu_probe(const char *buf, size_t count)
 
         dn = dlpar_configure_connector(cpu_to_be32(drc_index), parent);
         of_node_put(parent);
-        if (!dn)
+        if (!dn) {
+                dlpar_release_drc(drc_index);
                 return -EINVAL;
+        }
 
         rc = dlpar_attach_node(dn);
         if (rc) {
diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c
index 39a74fad3e04..9a83eb71b030 100644
--- a/arch/powerpc/platforms/pseries/setup.c
+++ b/arch/powerpc/platforms/pseries/setup.c
@@ -111,7 +111,7 @@ static void __init fwnmi_init(void)
                 fwnmi_active = 1;
 }
 
-static void pseries_8259_cascade(unsigned int irq, struct irq_desc *desc)
+static void pseries_8259_cascade(struct irq_desc *desc)
 {
         struct irq_chip *chip = irq_desc_get_chip(desc);
         unsigned int cascade_irq = i8259_irq();
diff --git a/arch/powerpc/sysdev/cpm2_pic.c b/arch/powerpc/sysdev/cpm2_pic.c
index a11bd1d433ad..9e86074719a9 100644
--- a/arch/powerpc/sysdev/cpm2_pic.c
+++ b/arch/powerpc/sysdev/cpm2_pic.c
@@ -155,9 +155,9 @@ static int cpm2_set_irq_type(struct irq_data *d, unsigned int flow_type)
 
         irqd_set_trigger_type(d, flow_type);
         if (flow_type & IRQ_TYPE_LEVEL_LOW)
-                __irq_set_handler_locked(d->irq, handle_level_irq);
+                irq_set_handler_locked(d, handle_level_irq);
         else
-                __irq_set_handler_locked(d->irq, handle_edge_irq);
+                irq_set_handler_locked(d, handle_edge_irq);
 
         /* internal IRQ senses are LEVEL_LOW
          * EXT IRQ and Port C IRQ senses are programmable
diff --git a/arch/powerpc/sysdev/fsl_msi.c b/arch/powerpc/sysdev/fsl_msi.c
index 5916da1856a7..48a576aa47b9 100644
--- a/arch/powerpc/sysdev/fsl_msi.c
+++ b/arch/powerpc/sysdev/fsl_msi.c
@@ -128,15 +128,16 @@ static void fsl_teardown_msi_irqs(struct pci_dev *pdev)
 {
         struct msi_desc *entry;
         struct fsl_msi *msi_data;
+        irq_hw_number_t hwirq;
 
         for_each_pci_msi_entry(entry, pdev) {
                 if (entry->irq == NO_IRQ)
                         continue;
+                hwirq = virq_to_hw(entry->irq);
                 msi_data = irq_get_chip_data(entry->irq);
                 irq_set_msi_desc(entry->irq, NULL);
-                msi_bitmap_free_hwirqs(&msi_data->bitmap,
-                                       virq_to_hw(entry->irq), 1);
                 irq_dispose_mapping(entry->irq);
+                msi_bitmap_free_hwirqs(&msi_data->bitmap, hwirq, 1);
         }
 
         return;
diff --git a/arch/powerpc/sysdev/ge/ge_pic.c b/arch/powerpc/sysdev/ge/ge_pic.c
index 2bcb78bb3a15..d57b77573068 100644
--- a/arch/powerpc/sysdev/ge/ge_pic.c
+++ b/arch/powerpc/sysdev/ge/ge_pic.c
@@ -91,7 +91,7 @@ static int gef_pic_cascade_irq;
  * should be masked out.
  */
 
-void gef_pic_cascade(unsigned int irq, struct irq_desc *desc)
+static void gef_pic_cascade(struct irq_desc *desc)
 {
         struct irq_chip *chip = irq_desc_get_chip(desc);
         unsigned int cascade_irq;
diff --git a/arch/powerpc/sysdev/ge/ge_pic.h b/arch/powerpc/sysdev/ge/ge_pic.h
index 908dbd9826b6..5bf7e4b81e36 100644
--- a/arch/powerpc/sysdev/ge/ge_pic.h
+++ b/arch/powerpc/sysdev/ge/ge_pic.h
@@ -1,8 +1,6 @@
 #ifndef __GEF_PIC_H__
 #define __GEF_PIC_H__
 
-
-void gef_pic_cascade(unsigned int, struct irq_desc *);
 unsigned int gef_pic_get_irq(void);
 void gef_pic_init(struct device_node *);
 
diff --git a/arch/powerpc/sysdev/ipic.c b/arch/powerpc/sysdev/ipic.c
index 6b2b68914810..b1297ab1599b 100644
--- a/arch/powerpc/sysdev/ipic.c
+++ b/arch/powerpc/sysdev/ipic.c
@@ -624,10 +624,10 @@ static int ipic_set_irq_type(struct irq_data *d, unsigned int flow_type)
 
         irqd_set_trigger_type(d, flow_type);
         if (flow_type & IRQ_TYPE_LEVEL_LOW)  {
-                __irq_set_handler_locked(d->irq, handle_level_irq);
+                irq_set_handler_locked(d, handle_level_irq);
                 d->chip = &ipic_level_irq_chip;
         } else {
-                __irq_set_handler_locked(d->irq, handle_edge_irq);
+                irq_set_handler_locked(d, handle_edge_irq);
                 d->chip = &ipic_edge_irq_chip;
         }
 
diff --git a/arch/powerpc/sysdev/mpc8xx_pic.c b/arch/powerpc/sysdev/mpc8xx_pic.c
index d93a78be4346..9a423975853a 100644
--- a/arch/powerpc/sysdev/mpc8xx_pic.c
+++ b/arch/powerpc/sysdev/mpc8xx_pic.c
@@ -55,7 +55,7 @@ static int mpc8xx_set_irq_type(struct irq_data *d, unsigned int flow_type)
                 unsigned int siel = in_be32(&siu_reg->sc_siel);
                 siel |= mpc8xx_irqd_to_bit(d);
                 out_be32(&siu_reg->sc_siel, siel);
-                __irq_set_handler_locked(d->irq, handle_edge_irq);
+                irq_set_handler_locked(d, handle_edge_irq);
         }
         return 0;
 }
diff --git a/arch/powerpc/sysdev/mpic.c b/arch/powerpc/sysdev/mpic.c
index 97a8ae8f94dd..537e5db85a06 100644
--- a/arch/powerpc/sysdev/mpic.c
+++ b/arch/powerpc/sysdev/mpic.c
@@ -1181,7 +1181,7 @@ static int mpic_host_xlate(struct irq_domain *h, struct device_node *ct,
 }
 
 /* IRQ handler for a secondary MPIC cascaded from another IRQ controller */
-static void mpic_cascade(unsigned int irq, struct irq_desc *desc)
+static void mpic_cascade(struct irq_desc *desc)
 {
         struct irq_chip *chip = irq_desc_get_chip(desc);
         struct mpic *mpic = irq_desc_get_handler_data(desc);
diff --git a/arch/powerpc/sysdev/mpic_u3msi.c b/arch/powerpc/sysdev/mpic_u3msi.c
index 70fbd5694a8b..2cbc7e29b85f 100644
--- a/arch/powerpc/sysdev/mpic_u3msi.c
+++ b/arch/powerpc/sysdev/mpic_u3msi.c
@@ -107,15 +107,16 @@ static u64 find_u4_magic_addr(struct pci_dev *pdev, unsigned int hwirq)
 static void u3msi_teardown_msi_irqs(struct pci_dev *pdev)
 {
         struct msi_desc *entry;
+        irq_hw_number_t hwirq;
 
         for_each_pci_msi_entry(entry, pdev) {
                 if (entry->irq == NO_IRQ)
                         continue;
 
+                hwirq = virq_to_hw(entry->irq);
                 irq_set_msi_desc(entry->irq, NULL);
-                msi_bitmap_free_hwirqs(&msi_mpic->msi_bitmap,
-                                       virq_to_hw(entry->irq), 1);
                 irq_dispose_mapping(entry->irq);
+                msi_bitmap_free_hwirqs(&msi_mpic->msi_bitmap, hwirq, 1);
         }
 
         return;
diff --git a/arch/powerpc/sysdev/ppc4xx_msi.c b/arch/powerpc/sysdev/ppc4xx_msi.c
index 24d0470c1698..8fb806135043 100644
--- a/arch/powerpc/sysdev/ppc4xx_msi.c
+++ b/arch/powerpc/sysdev/ppc4xx_msi.c
@@ -124,16 +124,17 @@ void ppc4xx_teardown_msi_irqs(struct pci_dev *dev)
 {
         struct msi_desc *entry;
         struct ppc4xx_msi *msi_data = &ppc4xx_msi;
+        irq_hw_number_t hwirq;
 
         dev_dbg(&dev->dev, "PCIE-MSI: tearing down msi irqs\n");
 
         for_each_pci_msi_entry(entry, dev) {
                 if (entry->irq == NO_IRQ)
                         continue;
+                hwirq = virq_to_hw(entry->irq);
                 irq_set_msi_desc(entry->irq, NULL);
-                msi_bitmap_free_hwirqs(&msi_data->bitmap,
-                                virq_to_hw(entry->irq), 1);
                 irq_dispose_mapping(entry->irq);
+                msi_bitmap_free_hwirqs(&msi_data->bitmap, hwirq, 1);
         }
 }
 
diff --git a/arch/powerpc/sysdev/qe_lib/qe_ic.c b/arch/powerpc/sysdev/qe_lib/qe_ic.c
index 47b352e4bc74..fbcc1f855a7f 100644
--- a/arch/powerpc/sysdev/qe_lib/qe_ic.c
+++ b/arch/powerpc/sysdev/qe_lib/qe_ic.c
@@ -311,8 +311,8 @@ unsigned int qe_ic_get_high_irq(struct qe_ic *qe_ic)
 }
 
 void __init qe_ic_init(struct device_node *node, unsigned int flags,
-                void (*low_handler)(unsigned int irq, struct irq_desc *desc),
-                void (*high_handler)(unsigned int irq, struct irq_desc *desc))
+                       void (*low_handler)(struct irq_desc *desc),
+                       void (*high_handler)(struct irq_desc *desc))
 {
         struct qe_ic *qe_ic;
         struct resource res;
diff --git a/arch/powerpc/sysdev/tsi108_pci.c b/arch/powerpc/sysdev/tsi108_pci.c
index 57b54476e747..379de955aae3 100644
--- a/arch/powerpc/sysdev/tsi108_pci.c
+++ b/arch/powerpc/sysdev/tsi108_pci.c
@@ -428,7 +428,7 @@ void __init tsi108_pci_int_init(struct device_node *node)
         init_pci_source();
 }
 
-void tsi108_irq_cascade(unsigned int irq, struct irq_desc *desc)
+void tsi108_irq_cascade(struct irq_desc *desc)
 {
         struct irq_chip *chip = irq_desc_get_chip(desc);
         unsigned int cascade_irq = get_pci_source();
diff --git a/arch/powerpc/sysdev/uic.c b/arch/powerpc/sysdev/uic.c
index d77345338671..6893d8f236df 100644
--- a/arch/powerpc/sysdev/uic.c
+++ b/arch/powerpc/sysdev/uic.c
@@ -194,7 +194,7 @@ static const struct irq_domain_ops uic_host_ops = {
         .xlate  = irq_domain_xlate_twocell,
 };
 
-void uic_irq_cascade(unsigned int virq, struct irq_desc *desc)
+static void uic_irq_cascade(struct irq_desc *desc)
 {
         struct irq_chip *chip = irq_desc_get_chip(desc);
         struct irq_data *idata = irq_desc_get_irq_data(desc);
diff --git a/arch/powerpc/sysdev/xics/ics-opal.c b/arch/powerpc/sysdev/xics/ics-opal.c
index 11ac964d5175..27c936c080a6 100644
--- a/arch/powerpc/sysdev/xics/ics-opal.c
+++ b/arch/powerpc/sysdev/xics/ics-opal.c
@@ -54,7 +54,7 @@ static void ics_opal_unmask_irq(struct irq_data *d)
         if (hw_irq == XICS_IPI || hw_irq == XICS_IRQ_SPURIOUS)
                 return;
 
-        server = xics_get_irq_server(d->irq, d->affinity, 0);
+        server = xics_get_irq_server(d->irq, irq_data_get_affinity_mask(d), 0);
         server = ics_opal_mangle_server(server);
 
         rc = opal_set_xive(hw_irq, server, DEFAULT_PRIORITY);
diff --git a/arch/powerpc/sysdev/xics/ics-rtas.c b/arch/powerpc/sysdev/xics/ics-rtas.c
index d1c625c4cc5a..3854dd41558d 100644
--- a/arch/powerpc/sysdev/xics/ics-rtas.c
+++ b/arch/powerpc/sysdev/xics/ics-rtas.c
@@ -47,7 +47,7 @@ static void ics_rtas_unmask_irq(struct irq_data *d)
         if (hw_irq == XICS_IPI || hw_irq == XICS_IRQ_SPURIOUS)
                 return;
 
-        server = xics_get_irq_server(d->irq, d->affinity, 0);
+        server = xics_get_irq_server(d->irq, irq_data_get_affinity_mask(d), 0);
 
         call_status = rtas_call(ibm_set_xive, 3, 1, NULL, hw_irq, server,
                                 DEFAULT_PRIORITY);
diff --git a/arch/powerpc/sysdev/xilinx_intc.c b/arch/powerpc/sysdev/xilinx_intc.c
index 43b8b275bc5c..0f52d7955796 100644
--- a/arch/powerpc/sysdev/xilinx_intc.c
+++ b/arch/powerpc/sysdev/xilinx_intc.c
@@ -222,7 +222,7 @@ int xilinx_intc_get_irq(void)
 /*
  * Support code for cascading to 8259 interrupt controllers
  */
-static void xilinx_i8259_cascade(unsigned int irq, struct irq_desc *desc)
+static void xilinx_i8259_cascade(struct irq_desc *desc)
 {
         struct irq_chip *chip = irq_desc_get_chip(desc);
         unsigned int cascade_irq = i8259_irq();
diff --git a/arch/s390/configs/zfcpdump_defconfig b/arch/s390/configs/zfcpdump_defconfig
index 1b0184a0f7f2..92805d604173 100644
--- a/arch/s390/configs/zfcpdump_defconfig
+++ b/arch/s390/configs/zfcpdump_defconfig
@@ -1,7 +1,6 @@
 # CONFIG_SWAP is not set
 CONFIG_NO_HZ=y
 CONFIG_HIGH_RES_TIMERS=y
-CONFIG_RCU_FAST_NO_HZ=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 # CONFIG_COMPAT_BRK is not set
@@ -54,10 +53,6 @@ CONFIG_RAW_DRIVER=y
 # CONFIG_MONWRITER is not set
 # CONFIG_S390_VMUR is not set
 # CONFIG_HID is not set
-CONFIG_MEMSTICK=y
-CONFIG_MEMSTICK_DEBUG=y
-CONFIG_MEMSTICK_UNSAFE_RESUME=y
-CONFIG_MSPRO_BLOCK=y
 # CONFIG_IOMMU_SUPPORT is not set
 CONFIG_EXT2_FS=y
 CONFIG_EXT3_FS=y
diff --git a/arch/s390/include/asm/kvm_host.h b/arch/s390/include/asm/kvm_host.h
index 3d012e071647..8ced426091e1 100644
--- a/arch/s390/include/asm/kvm_host.h
+++ b/arch/s390/include/asm/kvm_host.h
@@ -35,6 +35,7 @@
  */
 #define KVM_NR_IRQCHIPS 1
 #define KVM_IRQCHIP_NUM_PINS 4096
+#define KVM_HALT_POLL_NS_DEFAULT 0
 
 #define SIGP_CTRL_C             0x80
 #define SIGP_CTRL_SCN_MASK      0x3f
@@ -210,6 +211,7 @@ struct kvm_vcpu_stat {
         u32 exit_validity;
         u32 exit_instruction;
         u32 halt_successful_poll;
+        u32 halt_attempted_poll;
         u32 halt_wakeup;
         u32 instruction_lctl;
         u32 instruction_lctlg;
diff --git a/arch/s390/include/asm/unistd.h b/arch/s390/include/asm/unistd.h
index 525cef73b085..02613bad8bbb 100644
--- a/arch/s390/include/asm/unistd.h
+++ b/arch/s390/include/asm/unistd.h
@@ -8,28 +8,8 @@
 
 #include <uapi/asm/unistd.h>
 
-
 #define __IGNORE_time
 
-/* Ignore system calls that are also reachable via sys_socketcall */
-#define __IGNORE_recvmmsg
-#define __IGNORE_sendmmsg
-#define __IGNORE_socket
-#define __IGNORE_socketpair
-#define __IGNORE_bind
-#define __IGNORE_connect
-#define __IGNORE_listen
-#define __IGNORE_accept4
-#define __IGNORE_getsockopt
-#define __IGNORE_setsockopt
-#define __IGNORE_getsockname
-#define __IGNORE_getpeername
-#define __IGNORE_sendto
-#define __IGNORE_sendmsg
-#define __IGNORE_recvfrom
-#define __IGNORE_recvmsg
-#define __IGNORE_shutdown
-
 #define __ARCH_WANT_OLD_READDIR
 #define __ARCH_WANT_SYS_ALARM
 #define __ARCH_WANT_SYS_GETHOSTNAME
diff --git a/arch/s390/include/uapi/asm/unistd.h b/arch/s390/include/uapi/asm/unistd.h
index 59d2bb4e2d0c..a848adba1504 100644
--- a/arch/s390/include/uapi/asm/unistd.h
+++ b/arch/s390/include/uapi/asm/unistd.h
@@ -290,7 +290,26 @@
 #define __NR_s390_pci_mmio_write        352
 #define __NR_s390_pci_mmio_read         353
 #define __NR_execveat           354
-#define NR_syscalls 355
+#define __NR_userfaultfd        355
+#define __NR_membarrier         356
+#define __NR_recvmmsg           357
+#define __NR_sendmmsg           358
+#define __NR_socket             359
+#define __NR_socketpair         360
+#define __NR_bind               361
+#define __NR_connect            362
+#define __NR_listen             363
+#define __NR_accept4            364
+#define __NR_getsockopt         365
+#define __NR_setsockopt         366
+#define __NR_getsockname        367
+#define __NR_getpeername        368
+#define __NR_sendto             369
+#define __NR_sendmsg            370
+#define __NR_recvfrom           371
+#define __NR_recvmsg            372
+#define __NR_shutdown           373
+#define NR_syscalls 374
 
 /* 
  * There are some system calls that are not present on 64 bit, some
diff --git a/arch/s390/kernel/compat_signal.c b/arch/s390/kernel/compat_signal.c
index eb4664238613..e0f9d270b30f 100644
--- a/arch/s390/kernel/compat_signal.c
+++ b/arch/s390/kernel/compat_signal.c
@@ -48,6 +48,19 @@ typedef struct
         struct ucontext32 uc;
 } rt_sigframe32;
 
+static inline void sigset_to_sigset32(unsigned long *set64,
+                                      compat_sigset_word *set32)
+{
+        set32[0] = (compat_sigset_word) set64[0];
+        set32[1] = (compat_sigset_word)(set64[0] >> 32);
+}
+
+static inline void sigset32_to_sigset(compat_sigset_word *set32,
+                                      unsigned long *set64)
+{
+        set64[0] = (unsigned long) set32[0] | ((unsigned long) set32[1] << 32);
+}
+
 int copy_siginfo_to_user32(compat_siginfo_t __user *to, const siginfo_t *from)
 {
         int err;
@@ -281,10 +294,12 @@ COMPAT_SYSCALL_DEFINE0(sigreturn)
 {
         struct pt_regs *regs = task_pt_regs(current);
         sigframe32 __user *frame = (sigframe32 __user *)regs->gprs[15];
+        compat_sigset_t cset;
         sigset_t set;
 
-        if (__copy_from_user(&set.sig, &frame->sc.oldmask, _SIGMASK_COPY_SIZE32))
+        if (__copy_from_user(&cset.sig, &frame->sc.oldmask, _SIGMASK_COPY_SIZE32))
                 goto badframe;
+        sigset32_to_sigset(cset.sig, set.sig);
         set_current_blocked(&set);
         save_fpu_regs();
         if (restore_sigregs32(regs, &frame->sregs))
@@ -302,10 +317,12 @@ COMPAT_SYSCALL_DEFINE0(rt_sigreturn)
 {
         struct pt_regs *regs = task_pt_regs(current);
         rt_sigframe32 __user *frame = (rt_sigframe32 __user *)regs->gprs[15];
+        compat_sigset_t cset;
         sigset_t set;
 
-        if (__copy_from_user(&set, &frame->uc.uc_sigmask, sizeof(set)))
+        if (__copy_from_user(&cset, &frame->uc.uc_sigmask, sizeof(cset)))
                 goto badframe;
+        sigset32_to_sigset(cset.sig, set.sig);
         set_current_blocked(&set);
         if (compat_restore_altstack(&frame->uc.uc_stack))
                 goto badframe;
@@ -377,7 +394,7 @@ static int setup_frame32(struct ksignal *ksig, sigset_t *set,
                 return -EFAULT;
 
         /* Create struct sigcontext32 on the signal stack */
-        memcpy(&sc.oldmask, &set->sig, _SIGMASK_COPY_SIZE32);
+        sigset_to_sigset32(set->sig, sc.oldmask);
         sc.sregs = (__u32)(unsigned long __force) &frame->sregs;
         if (__copy_to_user(&frame->sc, &sc, sizeof(frame->sc)))
                 return -EFAULT;
@@ -438,6 +455,7 @@ static int setup_frame32(struct ksignal *ksig, sigset_t *set,
 static int setup_rt_frame32(struct ksignal *ksig, sigset_t *set,
                             struct pt_regs *regs)
 {
+        compat_sigset_t cset;
         rt_sigframe32 __user *frame;
         unsigned long restorer;
         size_t frame_size;
@@ -485,11 +503,12 @@ static int setup_rt_frame32(struct ksignal *ksig, sigset_t *set,
         store_sigregs();
 
         /* Create ucontext on the signal stack. */
+        sigset_to_sigset32(set->sig, cset.sig);
         if (__put_user(uc_flags, &frame->uc.uc_flags) ||
             __put_user(0, &frame->uc.uc_link) ||
             __compat_save_altstack(&frame->uc.uc_stack, regs->gprs[15]) ||
             save_sigregs32(regs, &frame->uc.uc_mcontext) ||
-            __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set)) ||
+            __copy_to_user(&frame->uc.uc_sigmask, &cset, sizeof(cset)) ||
             save_sigregs_ext32(regs, &frame->uc.uc_mcontext_ext))
                 return -EFAULT;
 
diff --git a/arch/s390/kernel/compat_wrapper.c b/arch/s390/kernel/compat_wrapper.c
index f8498dde67b1..09f194052df3 100644
--- a/arch/s390/kernel/compat_wrapper.c
+++ b/arch/s390/kernel/compat_wrapper.c
@@ -52,15 +52,13 @@
  * the regular system call wrappers.
  */
 #define COMPAT_SYSCALL_WRAPx(x, name, ...)                                      \
-        asmlinkage long sys##name(__MAP(x,__SC_DECL,__VA_ARGS__));              \
-        asmlinkage long compat_sys##name(__MAP(x,__SC_COMPAT_TYPE,__VA_ARGS__));\
-        asmlinkage long compat_sys##name(__MAP(x,__SC_COMPAT_TYPE,__VA_ARGS__)) \
-        {                                                                       \
-                return sys##name(__MAP(x,__SC_COMPAT_CAST,__VA_ARGS__));        \
-        }
+asmlinkage long sys##name(__MAP(x,__SC_DECL,__VA_ARGS__));                      \
+asmlinkage long notrace compat_sys##name(__MAP(x,__SC_COMPAT_TYPE,__VA_ARGS__));\
+asmlinkage long notrace compat_sys##name(__MAP(x,__SC_COMPAT_TYPE,__VA_ARGS__)) \
+{                                                                               \
+        return sys##name(__MAP(x,__SC_COMPAT_CAST,__VA_ARGS__));                \
+}
 
-COMPAT_SYSCALL_WRAP1(exit, int, error_code);
-COMPAT_SYSCALL_WRAP1(close, unsigned int, fd);
 COMPAT_SYSCALL_WRAP2(creat, const char __user *, pathname, umode_t, mode);
 COMPAT_SYSCALL_WRAP2(link, const char __user *, oldname, const char __user *, newname);
 COMPAT_SYSCALL_WRAP1(unlink, const char __user *, pathname);
@@ -68,23 +66,16 @@ COMPAT_SYSCALL_WRAP1(chdir, const char __user *, filename);
 COMPAT_SYSCALL_WRAP3(mknod, const char __user *, filename, umode_t, mode, unsigned, dev);
 COMPAT_SYSCALL_WRAP2(chmod, const char __user *, filename, umode_t, mode);
 COMPAT_SYSCALL_WRAP1(oldumount, char __user *, name);
-COMPAT_SYSCALL_WRAP1(alarm, unsigned int, seconds);
 COMPAT_SYSCALL_WRAP2(access, const char __user *, filename, int, mode);
-COMPAT_SYSCALL_WRAP1(nice, int, increment);
-COMPAT_SYSCALL_WRAP2(kill, int, pid, int, sig);
 COMPAT_SYSCALL_WRAP2(rename, const char __user *, oldname, const char __user *, newname);
 COMPAT_SYSCALL_WRAP2(mkdir, const char __user *, pathname, umode_t, mode);
 COMPAT_SYSCALL_WRAP1(rmdir, const char __user *, pathname);
-COMPAT_SYSCALL_WRAP1(dup, unsigned int, fildes);
 COMPAT_SYSCALL_WRAP1(pipe, int __user *, fildes);
 COMPAT_SYSCALL_WRAP1(brk, unsigned long, brk);
 COMPAT_SYSCALL_WRAP2(signal, int, sig, __sighandler_t, handler);
 COMPAT_SYSCALL_WRAP1(acct, const char __user *, name);
 COMPAT_SYSCALL_WRAP2(umount, char __user *, name, int, flags);
-COMPAT_SYSCALL_WRAP2(setpgid, pid_t, pid, pid_t, pgid);
-COMPAT_SYSCALL_WRAP1(umask, int, mask);
 COMPAT_SYSCALL_WRAP1(chroot, const char __user *, filename);
-COMPAT_SYSCALL_WRAP2(dup2, unsigned int, oldfd, unsigned int, newfd);
 COMPAT_SYSCALL_WRAP3(sigsuspend, int, unused1, int, unused2, old_sigset_t, mask);
 COMPAT_SYSCALL_WRAP2(sethostname, char __user *, name, int, len);
 COMPAT_SYSCALL_WRAP2(symlink, const char __user *, old, const char __user *, new);
@@ -93,37 +84,23 @@ COMPAT_SYSCALL_WRAP1(uselib, const char __user *, library);
 COMPAT_SYSCALL_WRAP2(swapon, const char __user *, specialfile, int, swap_flags);
 COMPAT_SYSCALL_WRAP4(reboot, int, magic1, int, magic2, unsigned int, cmd, void __user *, arg);
 COMPAT_SYSCALL_WRAP2(munmap, unsigned long, addr, size_t, len);
-COMPAT_SYSCALL_WRAP2(fchmod, unsigned int, fd, umode_t, mode);
-COMPAT_SYSCALL_WRAP2(getpriority, int, which, int, who);
-COMPAT_SYSCALL_WRAP3(setpriority, int, which, int, who, int, niceval);
 COMPAT_SYSCALL_WRAP3(syslog, int, type, char __user *, buf, int, len);
 COMPAT_SYSCALL_WRAP1(swapoff, const char __user *, specialfile);
-COMPAT_SYSCALL_WRAP1(fsync, unsigned int, fd);
 COMPAT_SYSCALL_WRAP2(setdomainname, char __user *, name, int, len);
 COMPAT_SYSCALL_WRAP1(newuname, struct new_utsname __user *, name);
 COMPAT_SYSCALL_WRAP3(mprotect, unsigned long, start, size_t, len, unsigned long, prot);
 COMPAT_SYSCALL_WRAP3(init_module, void __user *, umod, unsigned long, len, const char __user *, uargs);
 COMPAT_SYSCALL_WRAP2(delete_module, const char __user *, name_user, unsigned int, flags);
 COMPAT_SYSCALL_WRAP4(quotactl, unsigned int, cmd, const char __user *, special, qid_t, id, void __user *, addr);
-COMPAT_SYSCALL_WRAP1(getpgid, pid_t, pid);
-COMPAT_SYSCALL_WRAP1(fchdir, unsigned int, fd);
 COMPAT_SYSCALL_WRAP2(bdflush, int, func, long, data);
 COMPAT_SYSCALL_WRAP3(sysfs, int, option, unsigned long, arg1, unsigned long, arg2);
-COMPAT_SYSCALL_WRAP1(s390_personality, unsigned int, personality);
 COMPAT_SYSCALL_WRAP5(llseek, unsigned int, fd, unsigned long, high, unsigned long, low, loff_t __user *, result, unsigned int, whence);
-COMPAT_SYSCALL_WRAP2(flock, unsigned int, fd, unsigned int, cmd);
 COMPAT_SYSCALL_WRAP3(msync, unsigned long, start, size_t, len, int, flags);
-COMPAT_SYSCALL_WRAP1(getsid, pid_t, pid);
-COMPAT_SYSCALL_WRAP1(fdatasync, unsigned int, fd);
 COMPAT_SYSCALL_WRAP2(mlock, unsigned long, start, size_t, len);
 COMPAT_SYSCALL_WRAP2(munlock, unsigned long, start, size_t, len);
-COMPAT_SYSCALL_WRAP1(mlockall, int, flags);
 COMPAT_SYSCALL_WRAP2(sched_setparam, pid_t, pid, struct sched_param __user *, param);
 COMPAT_SYSCALL_WRAP2(sched_getparam, pid_t, pid, struct sched_param __user *, param);
 COMPAT_SYSCALL_WRAP3(sched_setscheduler, pid_t, pid, int, policy, struct sched_param __user *, param);
-COMPAT_SYSCALL_WRAP1(sched_getscheduler, pid_t, pid);
-COMPAT_SYSCALL_WRAP1(sched_get_priority_max, int, policy);
-COMPAT_SYSCALL_WRAP1(sched_get_priority_min, int, policy);
 COMPAT_SYSCALL_WRAP5(mremap, unsigned long, addr, unsigned long, old_len, unsigned long, new_len, unsigned long, flags, unsigned long, new_addr);
 COMPAT_SYSCALL_WRAP3(poll, struct pollfd __user *, ufds, unsigned int, nfds, int, timeout);
 COMPAT_SYSCALL_WRAP5(prctl, int, option, unsigned long, arg2, unsigned long, arg3, unsigned long, arg4, unsigned long, arg5);
@@ -131,20 +108,11 @@ COMPAT_SYSCALL_WRAP2(getcwd, char __user *, buf, unsigned long, size);
 COMPAT_SYSCALL_WRAP2(capget, cap_user_header_t, header, cap_user_data_t, dataptr);
 COMPAT_SYSCALL_WRAP2(capset, cap_user_header_t, header, const cap_user_data_t, data);
 COMPAT_SYSCALL_WRAP3(lchown, const char __user *, filename, uid_t, user, gid_t, group);
-COMPAT_SYSCALL_WRAP2(setreuid, uid_t, ruid, uid_t, euid);
-COMPAT_SYSCALL_WRAP2(setregid, gid_t, rgid, gid_t, egid);
 COMPAT_SYSCALL_WRAP2(getgroups, int, gidsetsize, gid_t __user *, grouplist);
 COMPAT_SYSCALL_WRAP2(setgroups, int, gidsetsize, gid_t __user *, grouplist);
-COMPAT_SYSCALL_WRAP3(fchown, unsigned int, fd, uid_t, user, gid_t, group);
-COMPAT_SYSCALL_WRAP3(setresuid, uid_t, ruid, uid_t, euid, uid_t, suid);
 COMPAT_SYSCALL_WRAP3(getresuid, uid_t __user *, ruid, uid_t __user *, euid, uid_t __user *, suid);
-COMPAT_SYSCALL_WRAP3(setresgid, gid_t, rgid, gid_t, egid, gid_t, sgid);
 COMPAT_SYSCALL_WRAP3(getresgid, gid_t __user *, rgid, gid_t __user *, egid, gid_t __user *, sgid);
 COMPAT_SYSCALL_WRAP3(chown, const char __user *, filename, uid_t, user, gid_t, group);
-COMPAT_SYSCALL_WRAP1(setuid, uid_t, uid);
-COMPAT_SYSCALL_WRAP1(setgid, gid_t, gid);
-COMPAT_SYSCALL_WRAP1(setfsuid, uid_t, uid);
-COMPAT_SYSCALL_WRAP1(setfsgid, gid_t, gid);
 COMPAT_SYSCALL_WRAP2(pivot_root, const char __user *, new_root, const char __user *, put_old);
 COMPAT_SYSCALL_WRAP3(mincore, unsigned long, start, size_t, len, unsigned char __user *, vec);
 COMPAT_SYSCALL_WRAP3(madvise, unsigned long, start, size_t, len, int, behavior);
@@ -161,23 +129,16 @@ COMPAT_SYSCALL_WRAP3(flistxattr, int, fd, char __user *, list, size_t, size);
 COMPAT_SYSCALL_WRAP2(removexattr, const char __user *, path, const char __user *, name);
 COMPAT_SYSCALL_WRAP2(lremovexattr, const char __user *, path, const char __user *, name);
 COMPAT_SYSCALL_WRAP2(fremovexattr, int, fd, const char __user *, name);
-COMPAT_SYSCALL_WRAP1(exit_group, int, error_code);
 COMPAT_SYSCALL_WRAP1(set_tid_address, int __user *, tidptr);
-COMPAT_SYSCALL_WRAP1(epoll_create, int, size);
 COMPAT_SYSCALL_WRAP4(epoll_ctl, int, epfd, int, op, int, fd, struct epoll_event __user *, event);
 COMPAT_SYSCALL_WRAP4(epoll_wait, int, epfd, struct epoll_event __user *, events, int, maxevents, int, timeout);
-COMPAT_SYSCALL_WRAP1(timer_getoverrun, timer_t, timer_id);
-COMPAT_SYSCALL_WRAP1(timer_delete, compat_timer_t, compat_timer_id);
 COMPAT_SYSCALL_WRAP1(io_destroy, aio_context_t, ctx);
 COMPAT_SYSCALL_WRAP3(io_cancel, aio_context_t, ctx_id, struct iocb __user *, iocb, struct io_event __user *, result);
 COMPAT_SYSCALL_WRAP1(mq_unlink, const char __user *, name);
 COMPAT_SYSCALL_WRAP5(add_key, const char __user *, tp, const char __user *, dsc, const void __user *, pld, size_t, len, key_serial_t, id);
 COMPAT_SYSCALL_WRAP4(request_key, const char __user *, tp, const char __user *, dsc, const char __user *, info, key_serial_t, id);
 COMPAT_SYSCALL_WRAP5(remap_file_pages, unsigned long, start, unsigned long, size, unsigned long, prot, unsigned long, pgoff, unsigned long, flags);
-COMPAT_SYSCALL_WRAP3(ioprio_set, int, which, int, who, int, ioprio);
-COMPAT_SYSCALL_WRAP2(ioprio_get, int, which, int, who);
 COMPAT_SYSCALL_WRAP3(inotify_add_watch, int, fd, const char __user *, path, u32, mask);
-COMPAT_SYSCALL_WRAP2(inotify_rm_watch, int, fd, __s32, wd);
 COMPAT_SYSCALL_WRAP3(mkdirat, int, dfd, const char __user *, pathname, umode_t, mode);
 COMPAT_SYSCALL_WRAP4(mknodat, int, dfd, const char __user *, filename, umode_t, mode, unsigned, dev);
 COMPAT_SYSCALL_WRAP5(fchownat, int, dfd, const char __user *, filename, uid_t, user, gid_t, group, int, flag);
@@ -192,23 +153,11 @@ COMPAT_SYSCALL_WRAP1(unshare, unsigned long, unshare_flags);
 COMPAT_SYSCALL_WRAP6(splice, int, fd_in, loff_t __user *, off_in, int, fd_out, loff_t __user *, off_out, size_t, len, unsigned int, flags);
 COMPAT_SYSCALL_WRAP4(tee, int, fdin, int, fdout, size_t, len, unsigned int, flags);
 COMPAT_SYSCALL_WRAP3(getcpu, unsigned __user *, cpu, unsigned __user *, node, struct getcpu_cache __user *, cache);
-COMPAT_SYSCALL_WRAP1(eventfd, unsigned int, count);
-COMPAT_SYSCALL_WRAP2(timerfd_create, int, clockid, int, flags);
-COMPAT_SYSCALL_WRAP2(eventfd2, unsigned int, count, int, flags);
-COMPAT_SYSCALL_WRAP1(inotify_init1, int, flags);
 COMPAT_SYSCALL_WRAP2(pipe2, int __user *, fildes, int, flags);
-COMPAT_SYSCALL_WRAP3(dup3, unsigned int, oldfd, unsigned int, newfd, int, flags);
-COMPAT_SYSCALL_WRAP1(epoll_create1, int, flags);
-COMPAT_SYSCALL_WRAP2(tkill, int, pid, int, sig);
-COMPAT_SYSCALL_WRAP3(tgkill, int, tgid, int, pid, int, sig);
 COMPAT_SYSCALL_WRAP5(perf_event_open, struct perf_event_attr __user *, attr_uptr, pid_t, pid, int, cpu, int, group_fd, unsigned long, flags);
 COMPAT_SYSCALL_WRAP5(clone, unsigned long, newsp, unsigned long, clone_flags, int __user *, parent_tidptr, int __user *, child_tidptr, unsigned long, tls);
-COMPAT_SYSCALL_WRAP2(fanotify_init, unsigned int, flags, unsigned int, event_f_flags);
 COMPAT_SYSCALL_WRAP4(prlimit64, pid_t, pid, unsigned int, resource, const struct rlimit64 __user *, new_rlim, struct rlimit64 __user *, old_rlim);
 COMPAT_SYSCALL_WRAP5(name_to_handle_at, int, dfd, const char __user *, name, struct file_handle __user *, handle, int __user *, mnt_id, int, flag);
-COMPAT_SYSCALL_WRAP1(syncfs, int, fd);
-COMPAT_SYSCALL_WRAP2(setns, int, fd, int, nstype);
-COMPAT_SYSCALL_WRAP2(s390_runtime_instr, int, command, int, signum);
 COMPAT_SYSCALL_WRAP5(kcmp, pid_t, pid1, pid_t, pid2, int, type, unsigned long, idx1, unsigned long, idx2);
 COMPAT_SYSCALL_WRAP3(finit_module, int, fd, const char __user *, uargs, int, flags);
 COMPAT_SYSCALL_WRAP3(sched_setattr, pid_t, pid, struct sched_attr __user *, attr, unsigned int, flags);
@@ -220,3 +169,10 @@ COMPAT_SYSCALL_WRAP2(memfd_create, const char __user *, uname, unsigned int, fla
 COMPAT_SYSCALL_WRAP3(bpf, int, cmd, union bpf_attr *, attr, unsigned int, size);
 COMPAT_SYSCALL_WRAP3(s390_pci_mmio_write, const unsigned long, mmio_addr, const void __user *, user_buffer, const size_t, length);
 COMPAT_SYSCALL_WRAP3(s390_pci_mmio_read, const unsigned long, mmio_addr, void __user *, user_buffer, const size_t, length);
+COMPAT_SYSCALL_WRAP4(socketpair, int, family, int, type, int, protocol, int __user *, usockvec);
+COMPAT_SYSCALL_WRAP3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen);
+COMPAT_SYSCALL_WRAP3(connect, int, fd, struct sockaddr __user *, uservaddr, int, addrlen);
+COMPAT_SYSCALL_WRAP4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr, int __user *, upeer_addrlen, int, flags);
+COMPAT_SYSCALL_WRAP3(getsockname, int, fd, struct sockaddr __user *, usockaddr, int __user *, usockaddr_len);
+COMPAT_SYSCALL_WRAP3(getpeername, int, fd, struct sockaddr __user *, usockaddr, int __user *, usockaddr_len);
+COMPAT_SYSCALL_WRAP6(sendto, int, fd, void __user *, buff, size_t, len, unsigned int, flags, struct sockaddr __user *, addr, int, addr_len);
diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S
index 247b7aae4c6d..09b039d7983d 100644
--- a/arch/s390/kernel/entry.S
+++ b/arch/s390/kernel/entry.S
@@ -1191,6 +1191,7 @@ cleanup_critical:
         clg     %r9,BASED(.Lcleanup_save_fpu_fpc_end)
         jhe     1f
         lg      %r2,__LC_CURRENT
+        aghi    %r2,__TASK_thread
 0:      # Store floating-point controls
         stfpc   __THREAD_FPU_fpc(%r2)
 1:      # Load register save area and check if VX is active
@@ -1252,6 +1253,7 @@ cleanup_critical:
         clg     %r9,BASED(.Lcleanup_load_fpu_regs_vx_ctl)
         jhe     6f
         lg      %r4,__LC_CURRENT
+        aghi    %r4,__TASK_thread
         lfpc    __THREAD_FPU_fpc(%r4)
         tm      __THREAD_FPU_flags+3(%r4),FPU_USE_VX    # VX-enabled task ?
         lg      %r4,__THREAD_FPU_regs(%r4)      # %r4 <- reg save area
diff --git a/arch/s390/kernel/perf_cpum_cf.c b/arch/s390/kernel/perf_cpum_cf.c
index 56fdad479115..a9563409c36e 100644
--- a/arch/s390/kernel/perf_cpum_cf.c
+++ b/arch/s390/kernel/perf_cpum_cf.c
@@ -157,10 +157,14 @@ static int validate_ctr_auth(const struct hw_perf_event *hwc)
 
         cpuhw = &get_cpu_var(cpu_hw_events);
 
-        /* check authorization for cpu counter sets */
+        /* Check authorization for cpu counter sets.
+         * If the particular CPU counter set is not authorized,
+         * return with -ENOENT in order to fall back to other
+         * PMUs that might suffice the event request.
+         */
         ctrs_state = cpumf_state_ctl[hwc->config_base];
         if (!(ctrs_state & cpuhw->info.auth_ctl))
-                err = -EPERM;
+                err = -ENOENT;
 
         put_cpu_var(cpu_hw_events);
         return err;
@@ -536,7 +540,7 @@ static int cpumf_pmu_add(struct perf_event *event, int flags)
          */
         if (!(cpuhw->flags & PERF_EVENT_TXN))
                 if (validate_ctr_auth(&event->hw))
-                        return -EPERM;
+                        return -ENOENT;
 
         ctr_set_enable(&cpuhw->state, event->hw.config_base);
         event->hw.state = PERF_HES_UPTODATE | PERF_HES_STOPPED;
@@ -611,7 +615,7 @@ static int cpumf_pmu_commit_txn(struct pmu *pmu)
         state = cpuhw->state & ~((1 << CPUMF_LCCTL_ENABLE_SHIFT) - 1);
         state >>= CPUMF_LCCTL_ENABLE_SHIFT;
         if ((state & cpuhw->info.auth_ctl) != state)
-                return -EPERM;
+                return -ENOENT;
 
         cpuhw->flags &= ~PERF_EVENT_TXN;
         perf_pmu_enable(pmu);
diff --git a/arch/s390/kernel/swsusp.S b/arch/s390/kernel/swsusp.S
index ca6294645dd3..2d6b6e81f812 100644
--- a/arch/s390/kernel/swsusp.S
+++ b/arch/s390/kernel/swsusp.S
@@ -30,6 +30,9 @@ ENTRY(swsusp_arch_suspend)
         aghi    %r15,-STACK_FRAME_OVERHEAD
         stg     %r1,__SF_BACKCHAIN(%r15)
 
+        /* Store FPU registers */
+        brasl   %r14,save_fpu_regs
+
         /* Deactivate DAT */
         stnsm   __SF_EMPTY(%r15),0xfb
 
@@ -47,23 +50,6 @@ ENTRY(swsusp_arch_suspend)
 
         /* Store registers */
         mvc     0x318(4,%r1),__SF_EMPTY(%r15)   /* move prefix to lowcore */
-        stfpc   0x31c(%r1)                      /* store fpu control */
-        std     0,0x200(%r1)                    /* store f0 */
-        std     1,0x208(%r1)                    /* store f1 */
-        std     2,0x210(%r1)                    /* store f2 */
-        std     3,0x218(%r1)                    /* store f3 */
-        std     4,0x220(%r1)                    /* store f4 */
-        std     5,0x228(%r1)                    /* store f5 */
-        std     6,0x230(%r1)                    /* store f6 */
-        std     7,0x238(%r1)                    /* store f7 */
-        std     8,0x240(%r1)                    /* store f8 */
-        std     9,0x248(%r1)                    /* store f9 */
-        std     10,0x250(%r1)                   /* store f10 */
-        std     11,0x258(%r1)                   /* store f11 */
-        std     12,0x260(%r1)                   /* store f12 */
-        std     13,0x268(%r1)                   /* store f13 */
-        std     14,0x270(%r1)                   /* store f14 */
-        std     15,0x278(%r1)                   /* store f15 */
         stam    %a0,%a15,0x340(%r1)             /* store access registers */
         stctg   %c0,%c15,0x380(%r1)             /* store control registers */
         stmg    %r0,%r15,0x280(%r1)             /* store general registers */
@@ -249,24 +235,6 @@ restore_registers:
         lctlg   %c0,%c15,0x380(%r13)    /* load control registers */
         lam     %a0,%a15,0x340(%r13)    /* load access registers */
 
-        lfpc    0x31c(%r13)             /* load fpu control */
-        ld      0,0x200(%r13)           /* load f0 */
-        ld      1,0x208(%r13)           /* load f1 */
-        ld      2,0x210(%r13)           /* load f2 */
-        ld      3,0x218(%r13)           /* load f3 */
-        ld      4,0x220(%r13)           /* load f4 */
-        ld      5,0x228(%r13)           /* load f5 */
-        ld      6,0x230(%r13)           /* load f6 */
-        ld      7,0x238(%r13)           /* load f7 */
-        ld      8,0x240(%r13)           /* load f8 */
-        ld      9,0x248(%r13)           /* load f9 */
-        ld      10,0x250(%r13)          /* load f10 */
-        ld      11,0x258(%r13)          /* load f11 */
-        ld      12,0x260(%r13)          /* load f12 */
-        ld      13,0x268(%r13)          /* load f13 */
-        ld      14,0x270(%r13)          /* load f14 */
-        ld      15,0x278(%r13)          /* load f15 */
-
         /* Load old stack */
         lg      %r15,0x2f8(%r13)
 
diff --git a/arch/s390/kernel/syscalls.S b/arch/s390/kernel/syscalls.S
index f3f4a137aef6..8c56929c8d82 100644
--- a/arch/s390/kernel/syscalls.S
+++ b/arch/s390/kernel/syscalls.S
@@ -9,12 +9,12 @@
 #define NI_SYSCALL SYSCALL(sys_ni_syscall,sys_ni_syscall)
 
 NI_SYSCALL                                              /* 0 */
-SYSCALL(sys_exit,compat_sys_exit)
+SYSCALL(sys_exit,sys_exit)
 SYSCALL(sys_fork,sys_fork)
 SYSCALL(sys_read,compat_sys_s390_read)
 SYSCALL(sys_write,compat_sys_s390_write)
 SYSCALL(sys_open,compat_sys_open)                       /* 5 */
-SYSCALL(sys_close,compat_sys_close)
+SYSCALL(sys_close,sys_close)
 SYSCALL(sys_restart_syscall,sys_restart_syscall)
 SYSCALL(sys_creat,compat_sys_creat)
 SYSCALL(sys_link,compat_sys_link)
@@ -35,21 +35,21 @@ SYSCALL(sys_ni_syscall,compat_sys_s390_setuid16)	/* old setuid16 syscall*/
 SYSCALL(sys_ni_syscall,compat_sys_s390_getuid16)        /* old getuid16 syscall*/
 SYSCALL(sys_ni_syscall,compat_sys_stime)                /* 25 old stime syscall */
 SYSCALL(sys_ptrace,compat_sys_ptrace)
-SYSCALL(sys_alarm,compat_sys_alarm)
+SYSCALL(sys_alarm,sys_alarm)
 NI_SYSCALL                                              /* old fstat syscall */
 SYSCALL(sys_pause,sys_pause)
 SYSCALL(sys_utime,compat_sys_utime)                     /* 30 */
 NI_SYSCALL                                              /* old stty syscall */
 NI_SYSCALL                                              /* old gtty syscall */
 SYSCALL(sys_access,compat_sys_access)
-SYSCALL(sys_nice,compat_sys_nice)
+SYSCALL(sys_nice,sys_nice)
 NI_SYSCALL                                              /* 35 old ftime syscall */
 SYSCALL(sys_sync,sys_sync)
-SYSCALL(sys_kill,compat_sys_kill)
+SYSCALL(sys_kill,sys_kill)
 SYSCALL(sys_rename,compat_sys_rename)
 SYSCALL(sys_mkdir,compat_sys_mkdir)
 SYSCALL(sys_rmdir,compat_sys_rmdir)                     /* 40 */
-SYSCALL(sys_dup,compat_sys_dup)
+SYSCALL(sys_dup,sys_dup)
 SYSCALL(sys_pipe,compat_sys_pipe)
 SYSCALL(sys_times,compat_sys_times)
 NI_SYSCALL                                              /* old prof syscall */
@@ -65,13 +65,13 @@ NI_SYSCALL						/* old lock syscall */
 SYSCALL(sys_ioctl,compat_sys_ioctl)
 SYSCALL(sys_fcntl,compat_sys_fcntl)                     /* 55 */
 NI_SYSCALL                                              /* intel mpx syscall */
-SYSCALL(sys_setpgid,compat_sys_setpgid)
+SYSCALL(sys_setpgid,sys_setpgid)
 NI_SYSCALL                                              /* old ulimit syscall */
 NI_SYSCALL                                              /* old uname syscall */
-SYSCALL(sys_umask,compat_sys_umask)                     /* 60 */
+SYSCALL(sys_umask,sys_umask)                            /* 60 */
 SYSCALL(sys_chroot,compat_sys_chroot)
 SYSCALL(sys_ustat,compat_sys_ustat)
-SYSCALL(sys_dup2,compat_sys_dup2)
+SYSCALL(sys_dup2,sys_dup2)
 SYSCALL(sys_getppid,sys_getppid)
 SYSCALL(sys_getpgrp,sys_getpgrp)                        /* 65 */
 SYSCALL(sys_setsid,sys_setsid)
@@ -102,10 +102,10 @@ SYSCALL(sys_old_mmap,compat_sys_s390_old_mmap)		/* 90 */
 SYSCALL(sys_munmap,compat_sys_munmap)
 SYSCALL(sys_truncate,compat_sys_truncate)
 SYSCALL(sys_ftruncate,compat_sys_ftruncate)
-SYSCALL(sys_fchmod,compat_sys_fchmod)
+SYSCALL(sys_fchmod,sys_fchmod)
 SYSCALL(sys_ni_syscall,compat_sys_s390_fchown16)        /* 95 old fchown16 syscall*/
-SYSCALL(sys_getpriority,compat_sys_getpriority)
-SYSCALL(sys_setpriority,compat_sys_setpriority)
+SYSCALL(sys_getpriority,sys_getpriority)
+SYSCALL(sys_setpriority,sys_setpriority)
 NI_SYSCALL                                              /* old profil syscall */
 SYSCALL(sys_statfs,compat_sys_statfs)
 SYSCALL(sys_fstatfs,compat_sys_fstatfs)                 /* 100 */
@@ -126,7 +126,7 @@ SYSCALL(sys_wait4,compat_sys_wait4)
 SYSCALL(sys_swapoff,compat_sys_swapoff)                 /* 115 */
 SYSCALL(sys_sysinfo,compat_sys_sysinfo)
 SYSCALL(sys_s390_ipc,compat_sys_s390_ipc)
-SYSCALL(sys_fsync,compat_sys_fsync)
+SYSCALL(sys_fsync,sys_fsync)
 SYSCALL(sys_sigreturn,compat_sys_sigreturn)
 SYSCALL(sys_clone,compat_sys_clone)                     /* 120 */
 SYSCALL(sys_setdomainname,compat_sys_setdomainname)
@@ -140,35 +140,35 @@ SYSCALL(sys_init_module,compat_sys_init_module)
 SYSCALL(sys_delete_module,compat_sys_delete_module)
 NI_SYSCALL                                              /* 130: old get_kernel_syms */
 SYSCALL(sys_quotactl,compat_sys_quotactl)
-SYSCALL(sys_getpgid,compat_sys_getpgid)
-SYSCALL(sys_fchdir,compat_sys_fchdir)
+SYSCALL(sys_getpgid,sys_getpgid)
+SYSCALL(sys_fchdir,sys_fchdir)
 SYSCALL(sys_bdflush,compat_sys_bdflush)
 SYSCALL(sys_sysfs,compat_sys_sysfs)                     /* 135 */
-SYSCALL(sys_s390_personality,compat_sys_s390_personality)
+SYSCALL(sys_s390_personality,sys_s390_personality)
 NI_SYSCALL                                              /* for afs_syscall */
 SYSCALL(sys_ni_syscall,compat_sys_s390_setfsuid16)      /* old setfsuid16 syscall */
 SYSCALL(sys_ni_syscall,compat_sys_s390_setfsgid16)      /* old setfsgid16 syscall */
 SYSCALL(sys_llseek,compat_sys_llseek)                   /* 140 */
 SYSCALL(sys_getdents,compat_sys_getdents)
 SYSCALL(sys_select,compat_sys_select)
-SYSCALL(sys_flock,compat_sys_flock)
+SYSCALL(sys_flock,sys_flock)
 SYSCALL(sys_msync,compat_sys_msync)
 SYSCALL(sys_readv,compat_sys_readv)                     /* 145 */
 SYSCALL(sys_writev,compat_sys_writev)
-SYSCALL(sys_getsid,compat_sys_getsid)
-SYSCALL(sys_fdatasync,compat_sys_fdatasync)
+SYSCALL(sys_getsid,sys_getsid)
+SYSCALL(sys_fdatasync,sys_fdatasync)
 SYSCALL(sys_sysctl,compat_sys_sysctl)
 SYSCALL(sys_mlock,compat_sys_mlock)                     /* 150 */
 SYSCALL(sys_munlock,compat_sys_munlock)
-SYSCALL(sys_mlockall,compat_sys_mlockall)
+SYSCALL(sys_mlockall,sys_mlockall)
 SYSCALL(sys_munlockall,sys_munlockall)
 SYSCALL(sys_sched_setparam,compat_sys_sched_setparam)
 SYSCALL(sys_sched_getparam,compat_sys_sched_getparam)   /* 155 */
 SYSCALL(sys_sched_setscheduler,compat_sys_sched_setscheduler)
-SYSCALL(sys_sched_getscheduler,compat_sys_sched_getscheduler)
+SYSCALL(sys_sched_getscheduler,sys_sched_getscheduler)
 SYSCALL(sys_sched_yield,sys_sched_yield)
-SYSCALL(sys_sched_get_priority_max,compat_sys_sched_get_priority_max)
-SYSCALL(sys_sched_get_priority_min,compat_sys_sched_get_priority_min)   /* 160 */
+SYSCALL(sys_sched_get_priority_max,sys_sched_get_priority_max)
+SYSCALL(sys_sched_get_priority_min,sys_sched_get_priority_min)  /* 160 */
 SYSCALL(sys_sched_rr_get_interval,compat_sys_sched_rr_get_interval)
 SYSCALL(sys_nanosleep,compat_sys_nanosleep)
 SYSCALL(sys_mremap,compat_sys_mremap)
@@ -211,20 +211,20 @@ SYSCALL(sys_getuid,sys_getuid)
 SYSCALL(sys_getgid,sys_getgid)                          /* 200 */
 SYSCALL(sys_geteuid,sys_geteuid)
 SYSCALL(sys_getegid,sys_getegid)
-SYSCALL(sys_setreuid,compat_sys_setreuid)
-SYSCALL(sys_setregid,compat_sys_setregid)
+SYSCALL(sys_setreuid,sys_setreuid)
+SYSCALL(sys_setregid,sys_setregid)
 SYSCALL(sys_getgroups,compat_sys_getgroups)             /* 205 */
 SYSCALL(sys_setgroups,compat_sys_setgroups)
-SYSCALL(sys_fchown,compat_sys_fchown)
-SYSCALL(sys_setresuid,compat_sys_setresuid)
+SYSCALL(sys_fchown,sys_fchown)
+SYSCALL(sys_setresuid,sys_setresuid)
 SYSCALL(sys_getresuid,compat_sys_getresuid)
-SYSCALL(sys_setresgid,compat_sys_setresgid)             /* 210 */
+SYSCALL(sys_setresgid,sys_setresgid)                    /* 210 */
 SYSCALL(sys_getresgid,compat_sys_getresgid)
 SYSCALL(sys_chown,compat_sys_chown)
-SYSCALL(sys_setuid,compat_sys_setuid)
-SYSCALL(sys_setgid,compat_sys_setgid)
-SYSCALL(sys_setfsuid,compat_sys_setfsuid)               /* 215 */
-SYSCALL(sys_setfsgid,compat_sys_setfsgid)
+SYSCALL(sys_setuid,sys_setuid)
+SYSCALL(sys_setgid,sys_setgid)
+SYSCALL(sys_setfsuid,sys_setfsuid)                      /* 215 */
+SYSCALL(sys_setfsgid,sys_setfsgid)
 SYSCALL(sys_pivot_root,compat_sys_pivot_root)
 SYSCALL(sys_mincore,compat_sys_mincore)
 SYSCALL(sys_madvise,compat_sys_madvise)
@@ -245,19 +245,19 @@ SYSCALL(sys_removexattr,compat_sys_removexattr)
 SYSCALL(sys_lremovexattr,compat_sys_lremovexattr)
 SYSCALL(sys_fremovexattr,compat_sys_fremovexattr)       /* 235 */
 SYSCALL(sys_gettid,sys_gettid)
-SYSCALL(sys_tkill,compat_sys_tkill)
+SYSCALL(sys_tkill,sys_tkill)
 SYSCALL(sys_futex,compat_sys_futex)
 SYSCALL(sys_sched_setaffinity,compat_sys_sched_setaffinity)
 SYSCALL(sys_sched_getaffinity,compat_sys_sched_getaffinity)     /* 240 */
-SYSCALL(sys_tgkill,compat_sys_tgkill)
+SYSCALL(sys_tgkill,sys_tgkill)
 NI_SYSCALL                                              /* reserved for TUX */
 SYSCALL(sys_io_setup,compat_sys_io_setup)
 SYSCALL(sys_io_destroy,compat_sys_io_destroy)
 SYSCALL(sys_io_getevents,compat_sys_io_getevents)       /* 245 */
 SYSCALL(sys_io_submit,compat_sys_io_submit)
 SYSCALL(sys_io_cancel,compat_sys_io_cancel)
-SYSCALL(sys_exit_group,compat_sys_exit_group)
-SYSCALL(sys_epoll_create,compat_sys_epoll_create)
+SYSCALL(sys_exit_group,sys_exit_group)
+SYSCALL(sys_epoll_create,sys_epoll_create)
 SYSCALL(sys_epoll_ctl,compat_sys_epoll_ctl)             /* 250 */
 SYSCALL(sys_epoll_wait,compat_sys_epoll_wait)
 SYSCALL(sys_set_tid_address,compat_sys_set_tid_address)
@@ -265,8 +265,8 @@ SYSCALL(sys_fadvise64_64,compat_sys_s390_fadvise64)
 SYSCALL(sys_timer_create,compat_sys_timer_create)
 SYSCALL(sys_timer_settime,compat_sys_timer_settime)     /* 255 */
 SYSCALL(sys_timer_gettime,compat_sys_timer_gettime)
-SYSCALL(sys_timer_getoverrun,compat_sys_timer_getoverrun)
-SYSCALL(sys_timer_delete,compat_sys_timer_delete)
+SYSCALL(sys_timer_getoverrun,sys_timer_getoverrun)
+SYSCALL(sys_timer_delete,sys_timer_delete)
 SYSCALL(sys_clock_settime,compat_sys_clock_settime)
 SYSCALL(sys_clock_gettime,compat_sys_clock_gettime)     /* 260 */
 SYSCALL(sys_clock_getres,compat_sys_clock_getres)
@@ -290,11 +290,11 @@ SYSCALL(sys_add_key,compat_sys_add_key)
 SYSCALL(sys_request_key,compat_sys_request_key)
 SYSCALL(sys_keyctl,compat_sys_keyctl)                   /* 280 */
 SYSCALL(sys_waitid,compat_sys_waitid)
-SYSCALL(sys_ioprio_set,compat_sys_ioprio_set)
-SYSCALL(sys_ioprio_get,compat_sys_ioprio_get)
+SYSCALL(sys_ioprio_set,sys_ioprio_set)
+SYSCALL(sys_ioprio_get,sys_ioprio_get)
 SYSCALL(sys_inotify_init,sys_inotify_init)
 SYSCALL(sys_inotify_add_watch,compat_sys_inotify_add_watch)     /* 285 */
-SYSCALL(sys_inotify_rm_watch,compat_sys_inotify_rm_watch)
+SYSCALL(sys_inotify_rm_watch,sys_inotify_rm_watch)
 SYSCALL(sys_migrate_pages,compat_sys_migrate_pages)
 SYSCALL(sys_openat,compat_sys_openat)
 SYSCALL(sys_mkdirat,compat_sys_mkdirat)
@@ -326,31 +326,31 @@ SYSCALL(sys_fallocate,compat_sys_s390_fallocate)
 SYSCALL(sys_utimensat,compat_sys_utimensat)             /* 315 */
 SYSCALL(sys_signalfd,compat_sys_signalfd)
 NI_SYSCALL                                              /* 317 old sys_timer_fd */
-SYSCALL(sys_eventfd,compat_sys_eventfd)
-SYSCALL(sys_timerfd_create,compat_sys_timerfd_create)
+SYSCALL(sys_eventfd,sys_eventfd)
+SYSCALL(sys_timerfd_create,sys_timerfd_create)
 SYSCALL(sys_timerfd_settime,compat_sys_timerfd_settime) /* 320 */
 SYSCALL(sys_timerfd_gettime,compat_sys_timerfd_gettime)
 SYSCALL(sys_signalfd4,compat_sys_signalfd4)
-SYSCALL(sys_eventfd2,compat_sys_eventfd2)
-SYSCALL(sys_inotify_init1,compat_sys_inotify_init1)
+SYSCALL(sys_eventfd2,sys_eventfd2)
+SYSCALL(sys_inotify_init1,sys_inotify_init1)
 SYSCALL(sys_pipe2,compat_sys_pipe2)                     /* 325 */
-SYSCALL(sys_dup3,compat_sys_dup3)
-SYSCALL(sys_epoll_create1,compat_sys_epoll_create1)
+SYSCALL(sys_dup3,sys_dup3)
+SYSCALL(sys_epoll_create1,sys_epoll_create1)
 SYSCALL(sys_preadv,compat_sys_preadv)
 SYSCALL(sys_pwritev,compat_sys_pwritev)
 SYSCALL(sys_rt_tgsigqueueinfo,compat_sys_rt_tgsigqueueinfo) /* 330 */
 SYSCALL(sys_perf_event_open,compat_sys_perf_event_open)
-SYSCALL(sys_fanotify_init,compat_sys_fanotify_init)
+SYSCALL(sys_fanotify_init,sys_fanotify_init)
 SYSCALL(sys_fanotify_mark,compat_sys_fanotify_mark)
 SYSCALL(sys_prlimit64,compat_sys_prlimit64)
 SYSCALL(sys_name_to_handle_at,compat_sys_name_to_handle_at) /* 335 */
 SYSCALL(sys_open_by_handle_at,compat_sys_open_by_handle_at)
 SYSCALL(sys_clock_adjtime,compat_sys_clock_adjtime)
-SYSCALL(sys_syncfs,compat_sys_syncfs)
-SYSCALL(sys_setns,compat_sys_setns)
+SYSCALL(sys_syncfs,sys_syncfs)
+SYSCALL(sys_setns,sys_setns)
 SYSCALL(sys_process_vm_readv,compat_sys_process_vm_readv) /* 340 */
 SYSCALL(sys_process_vm_writev,compat_sys_process_vm_writev)
-SYSCALL(sys_s390_runtime_instr,compat_sys_s390_runtime_instr)
+SYSCALL(sys_s390_runtime_instr,sys_s390_runtime_instr)
 SYSCALL(sys_kcmp,compat_sys_kcmp)
 SYSCALL(sys_finit_module,compat_sys_finit_module)
 SYSCALL(sys_sched_setattr,compat_sys_sched_setattr)     /* 345 */
@@ -363,3 +363,22 @@ SYSCALL(sys_bpf,compat_sys_bpf)
 SYSCALL(sys_s390_pci_mmio_write,compat_sys_s390_pci_mmio_write)
 SYSCALL(sys_s390_pci_mmio_read,compat_sys_s390_pci_mmio_read)
 SYSCALL(sys_execveat,compat_sys_execveat)
+SYSCALL(sys_userfaultfd,sys_userfaultfd)                /* 355 */
+SYSCALL(sys_membarrier,sys_membarrier)
+SYSCALL(sys_recvmmsg,compat_sys_recvmmsg)
+SYSCALL(sys_sendmmsg,compat_sys_sendmmsg)
+SYSCALL(sys_socket,sys_socket)
+SYSCALL(sys_socketpair,compat_sys_socketpair)           /* 360 */
+SYSCALL(sys_bind,sys_bind)
+SYSCALL(sys_connect,sys_connect)
+SYSCALL(sys_listen,sys_listen)
+SYSCALL(sys_accept4,sys_accept4)
+SYSCALL(sys_getsockopt,compat_sys_getsockopt)           /* 365 */
+SYSCALL(sys_setsockopt,compat_sys_setsockopt)
+SYSCALL(sys_getsockname,compat_sys_getsockname)
+SYSCALL(sys_getpeername,compat_sys_getpeername)
+SYSCALL(sys_sendto,compat_sys_sendto)
+SYSCALL(sys_sendmsg,compat_sys_sendmsg)                 /* 370 */
+SYSCALL(sys_recvfrom,compat_sys_recvfrom)
+SYSCALL(sys_recvmsg,compat_sys_recvmsg)
+SYSCALL(sys_shutdown,sys_shutdown)
diff --git a/arch/s390/kernel/vtime.c b/arch/s390/kernel/vtime.c
index b9ce650e9e99..c8653435c70d 100644
--- a/arch/s390/kernel/vtime.c
+++ b/arch/s390/kernel/vtime.c
@@ -89,17 +89,21 @@ static int do_account_vtime(struct task_struct *tsk, int hardirq_offset)
         if (smp_cpu_mtid &&
             time_after64(jiffies_64, __this_cpu_read(mt_scaling_jiffies))) {
                 u64 cycles_new[32], *cycles_old;
-                u64 delta, mult, div;
+                u64 delta, fac, mult, div;
 
                 cycles_old = this_cpu_ptr(mt_cycles);
                 if (stcctm5(smp_cpu_mtid + 1, cycles_new) < 2) {
+                        fac = 1;
                         mult = div = 0;
                         for (i = 0; i <= smp_cpu_mtid; i++) {
                                 delta = cycles_new[i] - cycles_old[i];
-                                mult += delta;
-                                div += (i + 1) * delta;
+                                div += delta;
+                                mult *= i + 1;
+                                mult += delta * fac;
+                                fac *= i + 1;
                         }
-                        if (mult > 0) {
+                        div *= fac;
+                        if (div > 0) {
                                 /* Update scaling factor */
                                 __this_cpu_write(mt_scaling_mult, mult);
                                 __this_cpu_write(mt_scaling_div, div);
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index c91eb941b444..0a67c40eece9 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -63,6 +63,7 @@ struct kvm_stats_debugfs_item debugfs_entries[] = {
         { "exit_program_interruption", VCPU_STAT(exit_program_interruption) },
         { "exit_instr_and_program_int", VCPU_STAT(exit_instr_and_program) },
         { "halt_successful_poll", VCPU_STAT(halt_successful_poll) },
+        { "halt_attempted_poll", VCPU_STAT(halt_attempted_poll) },
         { "halt_wakeup", VCPU_STAT(halt_wakeup) },
         { "instruction_lctlg", VCPU_STAT(instruction_lctlg) },
         { "instruction_lctl", VCPU_STAT(instruction_lctl) },
@@ -1574,7 +1575,7 @@ static void kvm_s390_vcpu_request(struct kvm_vcpu *vcpu)
 
 static void kvm_s390_vcpu_request_handled(struct kvm_vcpu *vcpu)
 {
-        atomic_or(PROG_REQUEST, &vcpu->arch.sie_block->prog20);
+        atomic_andnot(PROG_REQUEST, &vcpu->arch.sie_block->prog20);
 }
 
 /*
diff --git a/arch/sh/boards/mach-se/7343/irq.c b/arch/sh/boards/mach-se/7343/irq.c
index 6f97a8f0d0d6..6129aef6db76 100644
--- a/arch/sh/boards/mach-se/7343/irq.c
+++ b/arch/sh/boards/mach-se/7343/irq.c
@@ -29,7 +29,7 @@
 static void __iomem *se7343_irq_regs;
 struct irq_domain *se7343_irq_domain;
 
-static void se7343_irq_demux(unsigned int irq, struct irq_desc *desc)
+static void se7343_irq_demux(struct irq_desc *desc)
 {
         struct irq_data *data = irq_desc_get_irq_data(desc);
         struct irq_chip *chip = irq_data_get_irq_chip(data);
diff --git a/arch/sh/boards/mach-se/7722/irq.c b/arch/sh/boards/mach-se/7722/irq.c
index 60aebd14ccf8..24c74a88290c 100644
--- a/arch/sh/boards/mach-se/7722/irq.c
+++ b/arch/sh/boards/mach-se/7722/irq.c
@@ -28,7 +28,7 @@
 static void __iomem *se7722_irq_regs;
 struct irq_domain *se7722_irq_domain;
 
-static void se7722_irq_demux(unsigned int irq, struct irq_desc *desc)
+static void se7722_irq_demux(struct irq_desc *desc)
 {
         struct irq_data *data = irq_desc_get_irq_data(desc);
         struct irq_chip *chip = irq_data_get_irq_chip(data);
diff --git a/arch/sh/boards/mach-se/7724/irq.c b/arch/sh/boards/mach-se/7724/irq.c
index 9f2033898652..64e681e66c57 100644
--- a/arch/sh/boards/mach-se/7724/irq.c
+++ b/arch/sh/boards/mach-se/7724/irq.c
@@ -92,7 +92,7 @@ static struct irq_chip se7724_irq_chip __read_mostly = {
         .irq_unmask     = enable_se7724_irq,
 };
 
-static void se7724_irq_demux(unsigned int __irq, struct irq_desc *desc)
+static void se7724_irq_demux(struct irq_desc *desc)
 {
         unsigned int irq = irq_desc_get_irq(desc);
         struct fpga_irq set = get_fpga_irq(irq);
diff --git a/arch/sh/boards/mach-x3proto/gpio.c b/arch/sh/boards/mach-x3proto/gpio.c
index 24555c364d5b..1fb2cbee25f2 100644
--- a/arch/sh/boards/mach-x3proto/gpio.c
+++ b/arch/sh/boards/mach-x3proto/gpio.c
@@ -60,7 +60,7 @@ static int x3proto_gpio_to_irq(struct gpio_chip *chip, unsigned gpio)
         return virq;
 }
 
-static void x3proto_gpio_irq_handler(unsigned int irq, struct irq_desc *desc)
+static void x3proto_gpio_irq_handler(struct irq_desc *desc)
 {
         struct irq_data *data = irq_desc_get_irq_data(desc);
         struct irq_chip *chip = irq_data_get_irq_chip(data);
diff --git a/arch/sh/cchips/hd6446x/hd64461.c b/arch/sh/cchips/hd6446x/hd64461.c
index e9735616bdc8..8180092502f7 100644
--- a/arch/sh/cchips/hd6446x/hd64461.c
+++ b/arch/sh/cchips/hd6446x/hd64461.c
@@ -56,7 +56,7 @@ static struct irq_chip hd64461_irq_chip = {
         .irq_unmask     = hd64461_unmask_irq,
 };
 
-static void hd64461_irq_demux(unsigned int irq, struct irq_desc *desc)
+static void hd64461_irq_demux(struct irq_desc *desc)
 {
         unsigned short intv = __raw_readw(HD64461_NIRR);
         unsigned int ext_irq = HD64461_IRQBASE;
diff --git a/arch/sparc/kernel/leon_kernel.c b/arch/sparc/kernel/leon_kernel.c
index 0299f052a2ef..42efcf85f721 100644
--- a/arch/sparc/kernel/leon_kernel.c
+++ b/arch/sparc/kernel/leon_kernel.c
@@ -53,7 +53,7 @@ static inline unsigned int leon_eirq_get(int cpu)
 }
 
 /* Handle one or multiple IRQs from the extended interrupt controller */
-static void leon_handle_ext_irq(unsigned int irq, struct irq_desc *desc)
+static void leon_handle_ext_irq(struct irq_desc *desc)
 {
         unsigned int eirq;
         struct irq_bucket *p;
diff --git a/arch/sparc/kernel/leon_pci_grpci1.c b/arch/sparc/kernel/leon_pci_grpci1.c
index 3382f7b3eeef..1e77128a8f88 100644
--- a/arch/sparc/kernel/leon_pci_grpci1.c
+++ b/arch/sparc/kernel/leon_pci_grpci1.c
@@ -357,7 +357,7 @@ static struct irq_chip grpci1_irq = {
 };
 
 /* Handle one or multiple IRQs from the PCI core */
-static void grpci1_pci_flow_irq(unsigned int irq, struct irq_desc *desc)
+static void grpci1_pci_flow_irq(struct irq_desc *desc)
 {
         struct grpci1_priv *priv = grpci1priv;
         int i, ack = 0;
diff --git a/arch/sparc/kernel/leon_pci_grpci2.c b/arch/sparc/kernel/leon_pci_grpci2.c
index 814fb1729b12..f727c4de1316 100644
--- a/arch/sparc/kernel/leon_pci_grpci2.c
+++ b/arch/sparc/kernel/leon_pci_grpci2.c
@@ -498,7 +498,7 @@ static struct irq_chip grpci2_irq = {
 };
 
 /* Handle one or multiple IRQs from the PCI core */
-static void grpci2_pci_flow_irq(unsigned int irq, struct irq_desc *desc)
+static void grpci2_pci_flow_irq(struct irq_desc *desc)
 {
         struct grpci2_priv *priv = grpci2priv;
         int i, ack = 0;
diff --git a/arch/tile/kernel/pci_gx.c b/arch/tile/kernel/pci_gx.c
index b3f73fd764a3..4c017d0d2de8 100644
--- a/arch/tile/kernel/pci_gx.c
+++ b/arch/tile/kernel/pci_gx.c
@@ -304,17 +304,16 @@ static struct irq_chip tilegx_legacy_irq_chip = {
  * to Linux which just calls handle_level_irq() after clearing the
  * MAC INTx Assert status bit associated with this interrupt.
  */
-static void trio_handle_level_irq(unsigned int __irq, struct irq_desc *desc)
+static void trio_handle_level_irq(struct irq_desc *desc)
 {
         struct pci_controller *controller = irq_desc_get_handler_data(desc);
         gxio_trio_context_t *trio_context = controller->trio;
         uint64_t intx = (uint64_t)irq_desc_get_chip_data(desc);
-        unsigned int irq = irq_desc_get_irq(desc);
         int mac = controller->mac;
         unsigned int reg_offset;
         uint64_t level_mask;
 
-        handle_level_irq(irq, desc);
+        handle_level_irq(desc);
 
         /*
          * Clear the INTx Level status, otherwise future interrupts are
diff --git a/arch/unicore32/kernel/irq.c b/arch/unicore32/kernel/irq.c
index c53729d92e8d..eb1fd0030359 100644
--- a/arch/unicore32/kernel/irq.c
+++ b/arch/unicore32/kernel/irq.c
@@ -112,7 +112,7 @@ static struct irq_chip puv3_low_gpio_chip = {
  * irq_controller_lock held, and IRQs disabled.  Decode the IRQ
  * and call the handler.
  */
-static void puv3_gpio_handler(unsigned int __irq, struct irq_desc *desc)
+static void puv3_gpio_handler(struct irq_desc *desc)
 {
         unsigned int mask, irq;
 
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 7aef2d52daa0..328c8352480c 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -1006,7 +1006,7 @@ config X86_THERMAL_VECTOR
         depends on X86_MCE_INTEL
 
 config X86_LEGACY_VM86
-        bool "Legacy VM86 support (obsolete)"
+        bool "Legacy VM86 support"
         default n
         depends on X86_32
         ---help---
@@ -1018,19 +1018,20 @@ config X86_LEGACY_VM86
           available to accelerate real mode DOS programs.  However, any
           recent version of DOSEMU, X, or vbetool should be fully
           functional even without kernel VM86 support, as they will all
-          fall back to (pretty well performing) software emulation.
+          fall back to software emulation. Nevertheless, if you are using
+          a 16-bit DOS program where 16-bit performance matters, vm86
+          mode might be faster than emulation and you might want to
+          enable this option.
 
-          Anything that works on a 64-bit kernel is unlikely to need
-          this option, as 64-bit kernels don't, and can't, support V8086
-          mode.  This option is also unrelated to 16-bit protected mode
-          and is not needed to run most 16-bit programs under Wine.
+          Note that any app that works on a 64-bit kernel is unlikely to
+          need this option, as 64-bit kernels don't, and can't, support
+          V8086 mode. This option is also unrelated to 16-bit protected
+          mode and is not needed to run most 16-bit programs under Wine.
 
-          Enabling this option adds considerable attack surface to the
-          kernel and slows down system calls and exception handling.
+          Enabling this option increases the complexity of the kernel
+          and slows down exception handling a tiny bit.
 
-          Unless you use very old userspace or need the last drop of
-          performance in your real mode DOS games and can't use KVM,
-          say N here.
+          If unsure, say N here.
 
 config VM86
        bool
diff --git a/arch/x86/entry/syscalls/syscall_32.tbl b/arch/x86/entry/syscalls/syscall_32.tbl
index 477bfa6db370..7663c455b9f6 100644
--- a/arch/x86/entry/syscalls/syscall_32.tbl
+++ b/arch/x86/entry/syscalls/syscall_32.tbl
@@ -381,3 +381,4 @@
 372     i386    recvmsg                 sys_recvmsg                     compat_sys_recvmsg
 373     i386    shutdown                sys_shutdown
 374     i386    userfaultfd             sys_userfaultfd
+375     i386    membarrier              sys_membarrier
diff --git a/arch/x86/entry/syscalls/syscall_64.tbl b/arch/x86/entry/syscalls/syscall_64.tbl
index 81c490634db9..278842fdf1f6 100644
--- a/arch/x86/entry/syscalls/syscall_64.tbl
+++ b/arch/x86/entry/syscalls/syscall_64.tbl
@@ -330,6 +330,7 @@
 321     common  bpf                     sys_bpf
 322     64      execveat                stub_execveat
 323     common  userfaultfd             sys_userfaultfd
+324     common  membarrier              sys_membarrier
 
 #
 # x32-specific system call numbers start at 512 to avoid cache impact
diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
index 477fc28050e4..e6cf2ad350d1 100644
--- a/arch/x86/include/asm/cpufeature.h
+++ b/arch/x86/include/asm/cpufeature.h
@@ -241,6 +241,7 @@
 #define X86_FEATURE_AVX512PF    ( 9*32+26) /* AVX-512 Prefetch */
 #define X86_FEATURE_AVX512ER    ( 9*32+27) /* AVX-512 Exponential and Reciprocal */
 #define X86_FEATURE_AVX512CD    ( 9*32+28) /* AVX-512 Conflict Detection */
+#define X86_FEATURE_SHA_NI      ( 9*32+29) /* SHA1/SHA256 Instruction Extensions */
 
 /* Extended state features, CPUID level 0x0000000d:1 (eax), word 10 */
 #define X86_FEATURE_XSAVEOPT    (10*32+ 0) /* XSAVEOPT */
diff --git a/arch/x86/include/asm/efi.h b/arch/x86/include/asm/efi.h
index 155162ea0e00..ab5f1d447ef9 100644
--- a/arch/x86/include/asm/efi.h
+++ b/arch/x86/include/asm/efi.h
@@ -86,6 +86,16 @@ extern u64 asmlinkage efi_call(void *fp, ...);
 extern void __iomem *__init efi_ioremap(unsigned long addr, unsigned long size,
                                         u32 type, u64 attribute);
 
+/*
+ * CONFIG_KASAN may redefine memset to __memset.  __memset function is present
+ * only in kernel binary.  Since the EFI stub linked into a separate binary it
+ * doesn't have __memset().  So we should use standard memset from
+ * arch/x86/boot/compressed/string.c.  The same applies to memcpy and memmove.
+ */
+#undef memcpy
+#undef memset
+#undef memmove
+
 #endif /* CONFIG_X86_32 */
 
 extern struct efi_scratch efi_scratch;
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index c12e845f59e6..2beee0382088 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -40,6 +40,7 @@
 
 #define KVM_PIO_PAGE_OFFSET 1
 #define KVM_COALESCED_MMIO_PAGE_OFFSET 2
+#define KVM_HALT_POLL_NS_DEFAULT 500000
 
 #define KVM_IRQCHIP_NUM_PINS  KVM_IOAPIC_NUM_PINS
 
@@ -711,6 +712,7 @@ struct kvm_vcpu_stat {
         u32 nmi_window_exits;
         u32 halt_exits;
         u32 halt_successful_poll;
+        u32 halt_attempted_poll;
         u32 halt_wakeup;
         u32 request_irq_exits;
         u32 irq_exits;
diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
index c1c0a1c14344..b98b471a3b7e 100644
--- a/arch/x86/include/asm/msr-index.h
+++ b/arch/x86/include/asm/msr-index.h
@@ -331,6 +331,7 @@
 /* C1E active bits in int pending message */
 #define K8_INTP_C1E_ACTIVE_MASK         0x18000000
 #define MSR_K8_TSEG_ADDR                0xc0010112
+#define MSR_K8_TSEG_MASK                0xc0010113
 #define K8_MTRRFIXRANGE_DRAM_ENABLE     0x00040000 /* MtrrFixDramEn bit    */
 #define K8_MTRRFIXRANGE_DRAM_MODIFY     0x00080000 /* MtrrFixDramModEn bit */
 #define K8_MTRR_RDMEM_WRMEM_MASK        0x18181818 /* Mask: RdMem|WrMem    */
diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/paravirt_types.h
index ce029e4fa7c6..31247b5bff7c 100644
--- a/arch/x86/include/asm/paravirt_types.h
+++ b/arch/x86/include/asm/paravirt_types.h
@@ -97,7 +97,6 @@ struct pv_lazy_ops {
 struct pv_time_ops {
         unsigned long long (*sched_clock)(void);
         unsigned long long (*steal_clock)(int cpu);
-        unsigned long (*get_tsc_khz)(void);
 };
 
 struct pv_cpu_ops {
diff --git a/arch/x86/include/asm/qspinlock.h b/arch/x86/include/asm/qspinlock.h
index 9d51fae1cba3..eaba08076030 100644
--- a/arch/x86/include/asm/qspinlock.h
+++ b/arch/x86/include/asm/qspinlock.h
@@ -39,18 +39,27 @@ static inline void queued_spin_unlock(struct qspinlock *lock)
 }
 #endif
 
-#define virt_queued_spin_lock virt_queued_spin_lock
-
-static inline bool virt_queued_spin_lock(struct qspinlock *lock)
+#ifdef CONFIG_PARAVIRT
+#define virt_spin_lock virt_spin_lock
+static inline bool virt_spin_lock(struct qspinlock *lock)
 {
         if (!static_cpu_has(X86_FEATURE_HYPERVISOR))
                 return false;
 
-        while (atomic_cmpxchg(&lock->val, 0, _Q_LOCKED_VAL) != 0)
-                cpu_relax();
+        /*
+         * On hypervisors without PARAVIRT_SPINLOCKS support we fall
+         * back to a Test-and-Set spinlock, because fair locks have
+         * horrible lock 'holder' preemption issues.
+         */
+
+        do {
+                while (atomic_read(&lock->val) != 0)
+                        cpu_relax();
+        } while (atomic_cmpxchg(&lock->val, 0, _Q_LOCKED_VAL) != 0);
 
         return true;
 }
+#endif /* CONFIG_PARAVIRT */
 
 #include <asm-generic/qspinlock.h>
 
diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
index c42827eb86cf..25f909362b7a 100644
--- a/arch/x86/kernel/alternative.c
+++ b/arch/x86/kernel/alternative.c
@@ -338,10 +338,15 @@ done:
 
 static void __init_or_module optimize_nops(struct alt_instr *a, u8 *instr)
 {
+        unsigned long flags;
+
         if (instr[0] != 0x90)
                 return;
 
+        local_irq_save(flags);
         add_nops(instr + (a->instrlen - a->padlen), a->padlen);
+        sync_core();
+        local_irq_restore(flags);
 
         DUMP_BYTES(instr, a->instrlen, "%p: [%d:%d) optimized NOPs: ",
                    instr, a->instrlen - a->padlen, a->padlen);
diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
index 3ca3e46aa405..24e94ce454e2 100644
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -336,6 +336,13 @@ static void __setup_APIC_LVTT(unsigned int clocks, int oneshot, int irqen)
         apic_write(APIC_LVTT, lvtt_value);
 
         if (lvtt_value & APIC_LVT_TIMER_TSCDEADLINE) {
+                /*
+                 * See Intel SDM: TSC-Deadline Mode chapter. In xAPIC mode,
+                 * writing to the APIC LVTT and TSC_DEADLINE MSR isn't serialized.
+                 * According to Intel, MFENCE can do the serialization here.
+                 */
+                asm volatile("mfence" : : : "memory");
+
                 printk_once(KERN_DEBUG "TSC deadline timer enabled\n");
                 return;
         }
diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
index 38a76f826530..5c60bb162622 100644
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -2522,6 +2522,7 @@ void __init setup_ioapic_dest(void)
         int pin, ioapic, irq, irq_entry;
         const struct cpumask *mask;
         struct irq_data *idata;
+        struct irq_chip *chip;
 
         if (skip_ioapic_setup == 1)
                 return;
@@ -2545,9 +2546,9 @@ void __init setup_ioapic_dest(void)
                 else
                         mask = apic->target_cpus();
 
-                irq_set_affinity(irq, mask);
+                chip = irq_data_get_irq_chip(idata);
+                chip->irq_set_affinity(idata, mask, false);
         }
-
 }
 #endif
 
diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c
index 1bbd0fe2c806..836d11b92811 100644
--- a/arch/x86/kernel/apic/vector.c
+++ b/arch/x86/kernel/apic/vector.c
@@ -489,10 +489,8 @@ static int apic_set_affinity(struct irq_data *irq_data,
 
         err = assign_irq_vector(irq, data, dest);
         if (err) {
-                struct irq_data *top = irq_get_irq_data(irq);
-
                 if (assign_irq_vector(irq, data,
-                                      irq_data_get_affinity_mask(top)))
+                                      irq_data_get_affinity_mask(irq_data)))
                         pr_err("Failed to recover vector for irq %d\n", irq);
                 return err;
         }
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 07ce52c22ec8..de22ea7ff82f 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -1110,10 +1110,10 @@ void print_cpu_info(struct cpuinfo_x86 *c)
         else
                 printk(KERN_CONT "%d86", c->x86);
 
-        printk(KERN_CONT " (fam: %02x, model: %02x", c->x86, c->x86_model);
+        printk(KERN_CONT " (family: 0x%x, model: 0x%x", c->x86, c->x86_model);
 
         if (c->x86_mask || c->cpuid_level >= 0)
-                printk(KERN_CONT ", stepping: %02x)\n", c->x86_mask);
+                printk(KERN_CONT ", stepping: 0x%x)\n", c->x86_mask);
         else
                 printk(KERN_CONT ")\n");
 
diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
index cd9b6d0b10bf..3fefebfbdf4b 100644
--- a/arch/x86/kernel/cpu/perf_event_intel.c
+++ b/arch/x86/kernel/cpu/perf_event_intel.c
@@ -2316,9 +2316,12 @@ static struct event_constraint *
 intel_get_event_constraints(struct cpu_hw_events *cpuc, int idx,
                             struct perf_event *event)
 {
-        struct event_constraint *c1 = cpuc->event_constraint[idx];
+        struct event_constraint *c1 = NULL;
         struct event_constraint *c2;
 
+        if (idx >= 0) /* fake does < 0 */
+                c1 = cpuc->event_constraint[idx];
+
         /*
          * first time only
          * - static constraint: no change across incremental scheduling calls
diff --git a/arch/x86/kernel/cpu/perf_event_intel_bts.c b/arch/x86/kernel/cpu/perf_event_intel_bts.c
index 54690e885759..d1c0f254afbe 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_bts.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_bts.c
@@ -222,6 +222,7 @@ static void __bts_event_start(struct perf_event *event)
         if (!buf || bts_buffer_is_full(buf, bts))
                 return;
 
+        event->hw.itrace_started = 1;
         event->hw.state = 0;
 
         if (!buf->snapshot)
diff --git a/arch/x86/kernel/irq_32.c b/arch/x86/kernel/irq_32.c
index c80cf6699678..38da8f29a9c8 100644
--- a/arch/x86/kernel/irq_32.c
+++ b/arch/x86/kernel/irq_32.c
@@ -68,11 +68,10 @@ static inline void *current_stack(void)
         return (void *)(current_stack_pointer() & ~(THREAD_SIZE - 1));
 }
 
-static inline int
-execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
+static inline int execute_on_irq_stack(int overflow, struct irq_desc *desc)
 {
         struct irq_stack *curstk, *irqstk;
-        u32 *isp, *prev_esp, arg1, arg2;
+        u32 *isp, *prev_esp, arg1;
 
         curstk = (struct irq_stack *) current_stack();
         irqstk = __this_cpu_read(hardirq_stack);
@@ -98,8 +97,8 @@ execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
         asm volatile("xchgl     %%ebx,%%esp     \n"
                      "call      *%%edi          \n"
                      "movl      %%ebx,%%esp     \n"
-                     : "=a" (arg1), "=d" (arg2), "=b" (isp)
-                     :  "0" (irq),   "1" (desc),  "2" (isp),
+                     : "=a" (arg1), "=b" (isp)
+                     :  "0" (desc),   "1" (isp),
                         "D" (desc->handle_irq)
                      : "memory", "cc", "ecx");
         return 1;
@@ -150,19 +149,15 @@ void do_softirq_own_stack(void)
 
 bool handle_irq(struct irq_desc *desc, struct pt_regs *regs)
 {
-        unsigned int irq;
-        int overflow;
-
-        overflow = check_stack_overflow();
+        int overflow = check_stack_overflow();
 
         if (IS_ERR_OR_NULL(desc))
                 return false;
 
-        irq = irq_desc_get_irq(desc);
-        if (user_mode(regs) || !execute_on_irq_stack(overflow, desc, irq)) {
+        if (user_mode(regs) || !execute_on_irq_stack(overflow, desc)) {
                 if (unlikely(overflow))
                         print_stack_overflow();
-                generic_handle_irq_desc(irq, desc);
+                generic_handle_irq_desc(desc);
         }
 
         return true;
diff --git a/arch/x86/kernel/irq_64.c b/arch/x86/kernel/irq_64.c
index ff16ccb918f2..c767cf2bc80a 100644
--- a/arch/x86/kernel/irq_64.c
+++ b/arch/x86/kernel/irq_64.c
@@ -75,6 +75,6 @@ bool handle_irq(struct irq_desc *desc, struct pt_regs *regs)
         if (unlikely(IS_ERR_OR_NULL(desc)))
                 return false;
 
-        generic_handle_irq_desc(irq_desc_get_irq(desc), desc);
+        generic_handle_irq_desc(desc);
         return true;
 }
diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
index 2bcc0525f1c1..6acc9dd91f36 100644
--- a/arch/x86/kernel/ldt.c
+++ b/arch/x86/kernel/ldt.c
@@ -58,7 +58,7 @@ static struct ldt_struct *alloc_ldt_struct(int size)
         if (alloc_size > PAGE_SIZE)
                 new_ldt->entries = vzalloc(alloc_size);
         else
-                new_ldt->entries = kzalloc(PAGE_SIZE, GFP_KERNEL);
+                new_ldt->entries = (void *)get_zeroed_page(GFP_KERNEL);
 
         if (!new_ldt->entries) {
                 kfree(new_ldt);
@@ -95,7 +95,7 @@ static void free_ldt_struct(struct ldt_struct *ldt)
         if (ldt->size * LDT_ENTRY_SIZE > PAGE_SIZE)
                 vfree(ldt->entries);
         else
-                kfree(ldt->entries);
+                free_page((unsigned long)ldt->entries);
         kfree(ldt);
 }
 
diff --git a/arch/x86/kernel/pci-dma.c b/arch/x86/kernel/pci-dma.c
index 84b8ef82a159..1b55de1267cf 100644
--- a/arch/x86/kernel/pci-dma.c
+++ b/arch/x86/kernel/pci-dma.c
@@ -131,8 +131,8 @@ void dma_generic_free_coherent(struct device *dev, size_t size, void *vaddr,
 
 bool arch_dma_alloc_attrs(struct device **dev, gfp_t *gfp)
 {
-        *gfp = dma_alloc_coherent_gfp_flags(*dev, *gfp);
         *gfp &= ~(__GFP_DMA | __GFP_HIGHMEM | __GFP_DMA32);
+        *gfp = dma_alloc_coherent_gfp_flags(*dev, *gfp);
 
         if (!*dev)
                 *dev = &x86_dma_fallback_dev;
diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
index c8d52cb4cb6e..c3f7602cd038 100644
--- a/arch/x86/kernel/tsc.c
+++ b/arch/x86/kernel/tsc.c
@@ -21,6 +21,7 @@
 #include <asm/hypervisor.h>
 #include <asm/nmi.h>
 #include <asm/x86_init.h>
+#include <asm/geode.h>
 
 unsigned int __read_mostly cpu_khz;     /* TSC clocks / usec, not used here */
 EXPORT_SYMBOL(cpu_khz);
@@ -1013,15 +1014,17 @@ EXPORT_SYMBOL_GPL(mark_tsc_unstable);
 
 static void __init check_system_tsc_reliable(void)
 {
-#ifdef CONFIG_MGEODE_LX
-        /* RTSC counts during suspend */
+#if defined(CONFIG_MGEODEGX1) || defined(CONFIG_MGEODE_LX) || defined(CONFIG_X86_GENERIC)
+        if (is_geode_lx()) {
+                /* RTSC counts during suspend */
 #define RTSC_SUSP 0x100
-        unsigned long res_low, res_high;
+                unsigned long res_low, res_high;
 
-        rdmsr_safe(MSR_GEODE_BUSCONT_CONF0, &res_low, &res_high);
-        /* Geode_LX - the OLPC CPU has a very reliable TSC */
-        if (res_low & RTSC_SUSP)
-                tsc_clocksource_reliable = 1;
+                rdmsr_safe(MSR_GEODE_BUSCONT_CONF0, &res_low, &res_high);
+                /* Geode_LX - the OLPC CPU has a very reliable TSC */
+                if (res_low & RTSC_SUSP)
+                        tsc_clocksource_reliable = 1;
+        }
 #endif
         if (boot_cpu_has(X86_FEATURE_TSC_RELIABLE))
                 tsc_clocksource_reliable = 1;
diff --git a/arch/x86/kernel/vm86_32.c b/arch/x86/kernel/vm86_32.c
index abd8b856bd2b..524619351961 100644
--- a/arch/x86/kernel/vm86_32.c
+++ b/arch/x86/kernel/vm86_32.c
@@ -45,6 +45,7 @@
 #include <linux/audit.h>
 #include <linux/stddef.h>
 #include <linux/slab.h>
+#include <linux/security.h>
 
 #include <asm/uaccess.h>
 #include <asm/io.h>
@@ -232,6 +233,32 @@ static long do_sys_vm86(struct vm86plus_struct __user *user_vm86, bool plus)
         struct pt_regs *regs = current_pt_regs();
         unsigned long err = 0;
 
+        err = security_mmap_addr(0);
+        if (err) {
+                /*
+                 * vm86 cannot virtualize the address space, so vm86 users
+                 * need to manage the low 1MB themselves using mmap.  Given
+                 * that BIOS places important data in the first page, vm86
+                 * is essentially useless if mmap_min_addr != 0.  DOSEMU,
+                 * for example, won't even bother trying to use vm86 if it
+                 * can't map a page at virtual address 0.
+                 *
+                 * To reduce the available kernel attack surface, simply
+                 * disallow vm86(old) for users who cannot mmap at va 0.
+                 *
+                 * The implementation of security_mmap_addr will allow
+                 * suitably privileged users to map va 0 even if
+                 * vm.mmap_min_addr is set above 0, and we want this
+                 * behavior for vm86 as well, as it ensures that legacy
+                 * tools like vbetool will not fail just because of
+                 * vm.mmap_min_addr.
+                 */
+                pr_info_once("Denied a call to vm86(old) from %s[%d] (uid: %d).  Set the vm.mmap_min_addr sysctl to 0 and/or adjust LSM mmap_min_addr policy to enable vm86 if you are using a vm86-based DOS emulator.\n",
+                             current->comm, task_pid_nr(current),
+                             from_kuid_munged(&init_user_ns, current_uid()));
+                return -EPERM;
+        }
+
         if (!vm86) {
                 if (!(vm86 = kzalloc(sizeof(*vm86), GFP_KERNEL)))
                         return -ENOMEM;
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index 69088a1ba509..ff606f507913 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -3322,7 +3322,7 @@ walk_shadow_page_get_mmio_spte(struct kvm_vcpu *vcpu, u64 addr, u64 *sptep)
                         break;
 
                 reserved |= is_shadow_zero_bits_set(&vcpu->arch.mmu, spte,
-                                                    leaf);
+                                                    iterator.level);
         }
 
         walk_shadow_page_lockless_end(vcpu);
@@ -3614,7 +3614,7 @@ static void
 __reset_rsvds_bits_mask(struct kvm_vcpu *vcpu,
                         struct rsvd_bits_validate *rsvd_check,
                         int maxphyaddr, int level, bool nx, bool gbpages,
-                        bool pse)
+                        bool pse, bool amd)
 {
         u64 exb_bit_rsvd = 0;
         u64 gbpages_bit_rsvd = 0;
@@ -3631,7 +3631,7 @@ __reset_rsvds_bits_mask(struct kvm_vcpu *vcpu,
          * Non-leaf PML4Es and PDPEs reserve bit 8 (which would be the G bit for
          * leaf entries) on AMD CPUs only.
          */
-        if (guest_cpuid_is_amd(vcpu))
+        if (amd)
                 nonleaf_bit8_rsvd = rsvd_bits(8, 8);
 
         switch (level) {
@@ -3699,7 +3699,7 @@ static void reset_rsvds_bits_mask(struct kvm_vcpu *vcpu,
         __reset_rsvds_bits_mask(vcpu, &context->guest_rsvd_check,
                                 cpuid_maxphyaddr(vcpu), context->root_level,
                                 context->nx, guest_cpuid_has_gbpages(vcpu),
-                                is_pse(vcpu));
+                                is_pse(vcpu), guest_cpuid_is_amd(vcpu));
 }
 
 static void
@@ -3749,13 +3749,24 @@ static void reset_rsvds_bits_mask_ept(struct kvm_vcpu *vcpu,
 void
 reset_shadow_zero_bits_mask(struct kvm_vcpu *vcpu, struct kvm_mmu *context)
 {
+        /*
+         * Passing "true" to the last argument is okay; it adds a check
+         * on bit 8 of the SPTEs which KVM doesn't use anyway.
+         */
         __reset_rsvds_bits_mask(vcpu, &context->shadow_zero_check,
                                 boot_cpu_data.x86_phys_bits,
                                 context->shadow_root_level, context->nx,
-                                guest_cpuid_has_gbpages(vcpu), is_pse(vcpu));
+                                guest_cpuid_has_gbpages(vcpu), is_pse(vcpu),
+                                true);
 }
 EXPORT_SYMBOL_GPL(reset_shadow_zero_bits_mask);
 
+static inline bool boot_cpu_is_amd(void)
+{
+        WARN_ON_ONCE(!tdp_enabled);
+        return shadow_x_mask == 0;
+}
+
 /*
  * the direct page table on host, use as much mmu features as
  * possible, however, kvm currently does not do execution-protection.
@@ -3764,11 +3775,11 @@ static void
 reset_tdp_shadow_zero_bits_mask(struct kvm_vcpu *vcpu,
                                 struct kvm_mmu *context)
 {
-        if (guest_cpuid_is_amd(vcpu))
+        if (boot_cpu_is_amd())
                 __reset_rsvds_bits_mask(vcpu, &context->shadow_zero_check,
                                         boot_cpu_data.x86_phys_bits,
                                         context->shadow_root_level, false,
-                                        cpu_has_gbpages, true);
+                                        cpu_has_gbpages, true, true);
         else
                 __reset_rsvds_bits_mask_ept(&context->shadow_zero_check,
                                             boot_cpu_data.x86_phys_bits,
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index fdb8cb63a6c0..94b7d15db3fc 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -202,6 +202,7 @@ module_param(npt, int, S_IRUGO);
 static int nested = true;
 module_param(nested, int, S_IRUGO);
 
+static void svm_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0);
 static void svm_flush_tlb(struct kvm_vcpu *vcpu);
 static void svm_complete_interrupts(struct vcpu_svm *svm);
 
@@ -1263,7 +1264,8 @@ static void init_vmcb(struct vcpu_svm *svm, bool init_event)
          * svm_set_cr0() sets PG and WP and clears NW and CD on save->cr0.
          * It also updates the guest-visible cr0 value.
          */
-        (void)kvm_set_cr0(&svm->vcpu, X86_CR0_NW | X86_CR0_CD | X86_CR0_ET);
+        svm_set_cr0(&svm->vcpu, X86_CR0_NW | X86_CR0_CD | X86_CR0_ET);
+        kvm_mmu_reset_context(&svm->vcpu);
 
         save->cr4 = X86_CR4_PAE;
         /* rdx = ?? */
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index d01986832afc..64076740251e 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -6064,6 +6064,8 @@ static __init int hardware_setup(void)
         memcpy(vmx_msr_bitmap_longmode_x2apic,
                         vmx_msr_bitmap_longmode, PAGE_SIZE);
 
+        set_bit(0, vmx_vpid_bitmap); /* 0 is reserved for host */
+
         if (enable_apicv) {
                 for (msr = 0x800; msr <= 0x8ff; msr++)
                         vmx_disable_intercept_msr_read_x2apic(msr);
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index a60bdbccff51..991466bf8dee 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -149,6 +149,7 @@ struct kvm_stats_debugfs_item debugfs_entries[] = {
         { "nmi_window", VCPU_STAT(nmi_window_exits) },
         { "halt_exits", VCPU_STAT(halt_exits) },
         { "halt_successful_poll", VCPU_STAT(halt_successful_poll) },
+        { "halt_attempted_poll", VCPU_STAT(halt_attempted_poll) },
         { "halt_wakeup", VCPU_STAT(halt_wakeup) },
         { "hypercalls", VCPU_STAT(hypercalls) },
         { "request_irq", VCPU_STAT(request_irq_exits) },
@@ -2189,6 +2190,8 @@ int kvm_get_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
         case MSR_IA32_LASTINTFROMIP:
         case MSR_IA32_LASTINTTOIP:
         case MSR_K8_SYSCFG:
+        case MSR_K8_TSEG_ADDR:
+        case MSR_K8_TSEG_MASK:
         case MSR_K7_HWCR:
         case MSR_VM_HSAVE_PA:
         case MSR_K8_INT_PENDING_MSG:
diff --git a/arch/x86/lguest/boot.c b/arch/x86/lguest/boot.c
index 161804de124a..a0d09f6c6533 100644
--- a/arch/x86/lguest/boot.c
+++ b/arch/x86/lguest/boot.c
@@ -1015,7 +1015,7 @@ static struct clock_event_device lguest_clockevent = {
  * This is the Guest timer interrupt handler (hardware interrupt 0).  We just
  * call the clockevent infrastructure and it does whatever needs doing.
  */
-static void lguest_time_irq(unsigned int irq, struct irq_desc *desc)
+static void lguest_time_irq(struct irq_desc *desc)
 {
         unsigned long flags;
 
diff --git a/arch/x86/mm/srat.c b/arch/x86/mm/srat.c
index 66338a60aa6e..c2aea63bee20 100644
--- a/arch/x86/mm/srat.c
+++ b/arch/x86/mm/srat.c
@@ -192,10 +192,11 @@ acpi_numa_memory_affinity_init(struct acpi_srat_mem_affinity *ma)
 
         node_set(node, numa_nodes_parsed);
 
-        pr_info("SRAT: Node %u PXM %u [mem %#010Lx-%#010Lx]%s\n",
+        pr_info("SRAT: Node %u PXM %u [mem %#010Lx-%#010Lx]%s%s\n",
                 node, pxm,
                 (unsigned long long) start, (unsigned long long) end - 1,
-                hotpluggable ? " hotplug" : "");
+                hotpluggable ? " hotplug" : "",
+                ma->flags & ACPI_SRAT_MEM_NON_VOLATILE ? " non-volatile" : "");
 
         /* Mark hotplug range in memblock. */
         if (hotpluggable && memblock_mark_hotplug(start, ma->length))
diff --git a/arch/x86/pci/common.c b/arch/x86/pci/common.c
index 09d3afc0a181..dc78a4a9a466 100644
--- a/arch/x86/pci/common.c
+++ b/arch/x86/pci/common.c
@@ -166,6 +166,7 @@ void pcibios_fixup_bus(struct pci_bus *b)
 {
         struct pci_dev *dev;
 
+        pci_read_bridge_bases(b);
         list_for_each_entry(dev, &b->devices, bus_list)
                 pcibios_fixup_device_resources(dev);
 }
diff --git a/arch/xtensa/kernel/pci.c b/arch/xtensa/kernel/pci.c
index d27b4dcf221f..b848cc3dc913 100644
--- a/arch/xtensa/kernel/pci.c
+++ b/arch/xtensa/kernel/pci.c
@@ -210,6 +210,10 @@ subsys_initcall(pcibios_init);
 
 void pcibios_fixup_bus(struct pci_bus *bus)
 {
+        if (bus->parent) {
+                /* This is a subordinate bridge */
+                pci_read_bridge_bases(bus);
+        }
 }
 
 void pcibios_set_master(struct pci_dev *dev)
diff --git a/block/bio-integrity.c b/block/bio-integrity.c
index 4aecca79374a..14b8faf8b09d 100644
--- a/block/bio-integrity.c
+++ b/block/bio-integrity.c
@@ -140,6 +140,11 @@ int bio_integrity_add_page(struct bio *bio, struct page *page,
 
         iv = bip->bip_vec + bip->bip_vcnt;
 
+        if (bip->bip_vcnt &&
+            bvec_gap_to_prev(bdev_get_queue(bio->bi_bdev),
+                             &bip->bip_vec[bip->bip_vcnt - 1], offset))
+                return 0;
+
         iv->bv_page = page;
         iv->bv_len = len;
         iv->bv_offset = offset;
diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
index ac8370cb2515..55512dd62633 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -370,6 +370,9 @@ static void blkg_destroy_all(struct request_queue *q)
                 blkg_destroy(blkg);
                 spin_unlock(&blkcg->lock);
         }
+
+        q->root_blkg = NULL;
+        q->root_rl.blkg = NULL;
 }
 
 /*
diff --git a/block/blk-integrity.c b/block/blk-integrity.c
index f548b64be092..75f29cf70188 100644
--- a/block/blk-integrity.c
+++ b/block/blk-integrity.c
@@ -204,6 +204,9 @@ bool blk_integrity_merge_rq(struct request_queue *q, struct request *req,
             q->limits.max_integrity_segments)
                 return false;
 
+        if (integrity_req_gap_back_merge(req, next->bio))
+                return false;
+
         return true;
 }
 EXPORT_SYMBOL(blk_integrity_merge_rq);
diff --git a/block/blk-map.c b/block/blk-map.c
index 233841644c9d..f565e11f465a 100644
--- a/block/blk-map.c
+++ b/block/blk-map.c
@@ -9,6 +9,24 @@
 
 #include "blk.h"
 
+static bool iovec_gap_to_prv(struct request_queue *q,
+                             struct iovec *prv, struct iovec *cur)
+{
+        unsigned long prev_end;
+
+        if (!queue_virt_boundary(q))
+                return false;
+
+        if (prv->iov_base == NULL && prv->iov_len == 0)
+                /* prv is not set - don't check */
+                return false;
+
+        prev_end = (unsigned long)(prv->iov_base + prv->iov_len);
+
+        return (((unsigned long)cur->iov_base & queue_virt_boundary(q)) ||
+                prev_end & queue_virt_boundary(q));
+}
+
 int blk_rq_append_bio(struct request_queue *q, struct request *rq,
                       struct bio *bio)
 {
@@ -67,7 +85,7 @@ int blk_rq_map_user_iov(struct request_queue *q, struct request *rq,
         struct bio *bio;
         int unaligned = 0;
         struct iov_iter i;
-        struct iovec iov;
+        struct iovec iov, prv = {.iov_base = NULL, .iov_len = 0};
 
         if (!iter || !iter->count)
                 return -EINVAL;
@@ -81,8 +99,12 @@ int blk_rq_map_user_iov(struct request_queue *q, struct request *rq,
                 /*
                  * Keep going so we check length of all segments
                  */
-                if (uaddr & queue_dma_alignment(q))
+                if ((uaddr & queue_dma_alignment(q)) ||
+                    iovec_gap_to_prv(q, &prv, &iov))
                         unaligned = 1;
+
+                prv.iov_base = iov.iov_base;
+                prv.iov_len = iov.iov_len;
         }
 
         if (unaligned || (q->dma_pad_mask & iter->count) || map_data)
diff --git a/block/blk-merge.c b/block/blk-merge.c
index d088cffb8105..c4e9c37f3e38 100644
--- a/block/blk-merge.c
+++ b/block/blk-merge.c
@@ -66,36 +66,33 @@ static struct bio *blk_bio_segment_split(struct request_queue *q,
                                          struct bio *bio,
                                          struct bio_set *bs)
 {
-        struct bio *split;
-        struct bio_vec bv, bvprv;
+        struct bio_vec bv, bvprv, *bvprvp = NULL;
         struct bvec_iter iter;
         unsigned seg_size = 0, nsegs = 0, sectors = 0;
-        int prev = 0;
 
         bio_for_each_segment(bv, bio, iter) {
-                sectors += bv.bv_len >> 9;
-
-                if (sectors > queue_max_sectors(q))
+                if (sectors + (bv.bv_len >> 9) > queue_max_sectors(q))
                         goto split;
 
                 /*
                  * If the queue doesn't support SG gaps and adding this
                  * offset would create a gap, disallow it.
                  */
-                if (prev && bvec_gap_to_prev(q, &bvprv, bv.bv_offset))
+                if (bvprvp && bvec_gap_to_prev(q, bvprvp, bv.bv_offset))
                         goto split;
 
-                if (prev && blk_queue_cluster(q)) {
+                if (bvprvp && blk_queue_cluster(q)) {
                         if (seg_size + bv.bv_len > queue_max_segment_size(q))
                                 goto new_segment;
-                        if (!BIOVEC_PHYS_MERGEABLE(&bvprv, &bv))
+                        if (!BIOVEC_PHYS_MERGEABLE(bvprvp, &bv))
                                 goto new_segment;
-                        if (!BIOVEC_SEG_BOUNDARY(q, &bvprv, &bv))
+                        if (!BIOVEC_SEG_BOUNDARY(q, bvprvp, &bv))
                                 goto new_segment;
 
                         seg_size += bv.bv_len;
                         bvprv = bv;
-                        prev = 1;
+                        bvprvp = &bv;
+                        sectors += bv.bv_len >> 9;
                         continue;
                 }
 new_segment:
@@ -104,23 +101,14 @@ new_segment:
 
                 nsegs++;
                 bvprv = bv;
-                prev = 1;
+                bvprvp = &bv;
                 seg_size = bv.bv_len;
+                sectors += bv.bv_len >> 9;
         }
 
         return NULL;
 split:
-        split = bio_clone_bioset(bio, GFP_NOIO, bs);
-
-        split->bi_iter.bi_size -= iter.bi_size;
-        bio->bi_iter = iter;
-
-        if (bio_integrity(bio)) {
-                bio_integrity_advance(bio, split->bi_iter.bi_size);
-                bio_integrity_trim(split, 0, bio_sectors(split));
-        }
-
-        return split;
+        return bio_split(bio, sectors, GFP_NOIO, bs);
 }
 
 void blk_queue_split(struct request_queue *q, struct bio **bio,
@@ -439,6 +427,11 @@ no_merge:
 int ll_back_merge_fn(struct request_queue *q, struct request *req,
                      struct bio *bio)
 {
+        if (req_gap_back_merge(req, bio))
+                return 0;
+        if (blk_integrity_rq(req) &&
+            integrity_req_gap_back_merge(req, bio))
+                return 0;
         if (blk_rq_sectors(req) + bio_sectors(bio) >
             blk_rq_get_max_sectors(req)) {
                 req->cmd_flags |= REQ_NOMERGE;
@@ -457,6 +450,12 @@ int ll_back_merge_fn(struct request_queue *q, struct request *req,
 int ll_front_merge_fn(struct request_queue *q, struct request *req,
                       struct bio *bio)
 {
+
+        if (req_gap_front_merge(req, bio))
+                return 0;
+        if (blk_integrity_rq(req) &&
+            integrity_req_gap_front_merge(req, bio))
+                return 0;
         if (blk_rq_sectors(req) + bio_sectors(bio) >
             blk_rq_get_max_sectors(req)) {
                 req->cmd_flags |= REQ_NOMERGE;
@@ -483,14 +482,6 @@ static bool req_no_special_merge(struct request *req)
         return !q->mq_ops && req->special;
 }
 
-static int req_gap_to_prev(struct request *req, struct bio *next)
-{
-        struct bio *prev = req->biotail;
-
-        return bvec_gap_to_prev(req->q, &prev->bi_io_vec[prev->bi_vcnt - 1],
-                        next->bi_io_vec[0].bv_offset);
-}
-
 static int ll_merge_requests_fn(struct request_queue *q, struct request *req,
                                 struct request *next)
 {
@@ -505,7 +496,7 @@ static int ll_merge_requests_fn(struct request_queue *q, struct request *req,
         if (req_no_special_merge(req) || req_no_special_merge(next))
                 return 0;
 
-        if (req_gap_to_prev(req, next->bio))
+        if (req_gap_back_merge(req, next->bio))
                 return 0;
 
         /*
@@ -713,10 +704,6 @@ bool blk_rq_merge_ok(struct request *rq, struct bio *bio)
             !blk_write_same_mergeable(rq->bio, bio))
                 return false;
 
-        /* Only check gaps if the bio carries data */
-        if (bio_has_data(bio) && req_gap_to_prev(rq, bio))
-                return false;
-
         return true;
 }
 
diff --git a/block/bounce.c b/block/bounce.c
index 0611aea1cfe9..1cb5dd3a5da1 100644
--- a/block/bounce.c
+++ b/block/bounce.c
@@ -128,12 +128,14 @@ static void bounce_end_io(struct bio *bio, mempool_t *pool)
         struct bio *bio_orig = bio->bi_private;
         struct bio_vec *bvec, *org_vec;
         int i;
+        int start = bio_orig->bi_iter.bi_idx;
 
         /*
          * free up bounce indirect pages used
          */
         bio_for_each_segment_all(bvec, bio, i) {
-                org_vec = bio_orig->bi_io_vec + i;
+                org_vec = bio_orig->bi_io_vec + i + start;
+
                 if (bvec->bv_page == org_vec->bv_page)
                         continue;
 
diff --git a/crypto/testmgr.c b/crypto/testmgr.c
index 35c2de136971..fa18753f5c34 100644
--- a/crypto/testmgr.c
+++ b/crypto/testmgr.c
@@ -940,6 +940,7 @@ static int __test_skcipher(struct crypto_skcipher *tfm, int enc,
         char *xbuf[XBUFSIZE];
         char *xoutbuf[XBUFSIZE];
         int ret = -ENOMEM;
+        unsigned int ivsize = crypto_skcipher_ivsize(tfm);
 
         if (testmgr_alloc_buf(xbuf))
                 goto out_nobuf;
@@ -975,7 +976,7 @@ static int __test_skcipher(struct crypto_skcipher *tfm, int enc,
                         continue;
 
                 if (template[i].iv)
-                        memcpy(iv, template[i].iv, MAX_IVLEN);
+                        memcpy(iv, template[i].iv, ivsize);
                 else
                         memset(iv, 0, MAX_IVLEN);
 
@@ -1051,7 +1052,7 @@ static int __test_skcipher(struct crypto_skcipher *tfm, int enc,
                         continue;
 
                 if (template[i].iv)
-                        memcpy(iv, template[i].iv, MAX_IVLEN);
+                        memcpy(iv, template[i].iv, ivsize);
                 else
                         memset(iv, 0, MAX_IVLEN);
 
diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
index 46506e7687cd..a212cefae524 100644
--- a/drivers/acpi/bus.c
+++ b/drivers/acpi/bus.c
@@ -315,14 +315,10 @@ static void acpi_bus_osc_support(void)
 
         capbuf[OSC_QUERY_DWORD] = OSC_QUERY_ENABLE;
         capbuf[OSC_SUPPORT_DWORD] = OSC_SB_PR3_SUPPORT; /* _PR3 is in use */
-#if defined(CONFIG_ACPI_PROCESSOR_AGGREGATOR) ||\
-                        defined(CONFIG_ACPI_PROCESSOR_AGGREGATOR_MODULE)
-        capbuf[OSC_SUPPORT_DWORD] |= OSC_SB_PAD_SUPPORT;
-#endif
-
-#if defined(CONFIG_ACPI_PROCESSOR) || defined(CONFIG_ACPI_PROCESSOR_MODULE)
-        capbuf[OSC_SUPPORT_DWORD] |= OSC_SB_PPC_OST_SUPPORT;
-#endif
+        if (IS_ENABLED(CONFIG_ACPI_PROCESSOR_AGGREGATOR))
+                capbuf[OSC_SUPPORT_DWORD] |= OSC_SB_PAD_SUPPORT;
+        if (IS_ENABLED(CONFIG_ACPI_PROCESSOR))
+                capbuf[OSC_SUPPORT_DWORD] |= OSC_SB_PPC_OST_SUPPORT;
 
         capbuf[OSC_SUPPORT_DWORD] |= OSC_SB_HOTPLUG_OST_SUPPORT;
 
diff --git a/drivers/acpi/int340x_thermal.c b/drivers/acpi/int340x_thermal.c
index 9dcf83682e36..33505c651f62 100644
--- a/drivers/acpi/int340x_thermal.c
+++ b/drivers/acpi/int340x_thermal.c
@@ -33,13 +33,12 @@ static const struct acpi_device_id int340x_thermal_device_ids[] = {
 static int int340x_thermal_handler_attach(struct acpi_device *adev,
                                         const struct acpi_device_id *id)
 {
-#if defined(CONFIG_INT340X_THERMAL) || defined(CONFIG_INT340X_THERMAL_MODULE)
-        acpi_create_platform_device(adev);
-#elif defined(INTEL_SOC_DTS_THERMAL) || defined(INTEL_SOC_DTS_THERMAL_MODULE)
+        if (IS_ENABLED(CONFIG_INT340X_THERMAL))
+                acpi_create_platform_device(adev);
         /* Intel SoC DTS thermal driver needs INT3401 to set IRQ descriptor */
-        if (id->driver_data == INT3401_DEVICE)
+        else if (IS_ENABLED(CONFIG_INTEL_SOC_DTS_THERMAL) &&
+                 id->driver_data == INT3401_DEVICE)
                 acpi_create_platform_device(adev);
-#endif
         return 1;
 }
 
diff --git a/drivers/acpi/thermal.c b/drivers/acpi/thermal.c
index fc28b9f5aa84..30d8518b25fb 100644
--- a/drivers/acpi/thermal.c
+++ b/drivers/acpi/thermal.c
@@ -525,8 +525,7 @@ static void acpi_thermal_check(void *data)
 
 /* sys I/F for generic thermal sysfs support */
 
-static int thermal_get_temp(struct thermal_zone_device *thermal,
-                            unsigned long *temp)
+static int thermal_get_temp(struct thermal_zone_device *thermal, int *temp)
 {
         struct acpi_thermal *tz = thermal->devdata;
         int result;
@@ -633,7 +632,7 @@ static int thermal_get_trip_type(struct thermal_zone_device *thermal,
 }
 
 static int thermal_get_trip_temp(struct thermal_zone_device *thermal,
-                                 int trip, unsigned long *temp)
+                                 int trip, int *temp)
 {
         struct acpi_thermal *tz = thermal->devdata;
         int i;
@@ -686,7 +685,8 @@ static int thermal_get_trip_temp(struct thermal_zone_device *thermal,
 }
 
 static int thermal_get_crit_temp(struct thermal_zone_device *thermal,
-                                unsigned long *temperature) {
+                                int *temperature)
+{
         struct acpi_thermal *tz = thermal->devdata;
 
         if (tz->trips.critical.flags.valid) {
@@ -709,8 +709,8 @@ static int thermal_get_trend(struct thermal_zone_device *thermal,
                 return -EINVAL;
 
         if (type == THERMAL_TRIP_ACTIVE) {
-                unsigned long trip_temp;
-                unsigned long temp = DECI_KELVIN_TO_MILLICELSIUS_WITH_OFFSET(
+                int trip_temp;
+                int temp = DECI_KELVIN_TO_MILLICELSIUS_WITH_OFFSET(
                                         tz->temperature, tz->kelvin_offset);
                 if (thermal_get_trip_temp(thermal, trip, &trip_temp))
                         return -EINVAL;
diff --git a/drivers/atm/he.c b/drivers/atm/he.c
index a8da3a50e374..0f5cb37636bc 100644
--- a/drivers/atm/he.c
+++ b/drivers/atm/he.c
@@ -1578,9 +1578,7 @@ he_stop(struct he_dev *he_dev)
 
         kfree(he_dev->rbpl_virt);
         kfree(he_dev->rbpl_table);
-
-        if (he_dev->rbpl_pool)
-                dma_pool_destroy(he_dev->rbpl_pool);
+        dma_pool_destroy(he_dev->rbpl_pool);
 
         if (he_dev->rbrq_base)
                 dma_free_coherent(&he_dev->pci_dev->dev, CONFIG_RBRQ_SIZE * sizeof(struct he_rbrq),
@@ -1594,8 +1592,7 @@ he_stop(struct he_dev *he_dev)
                 dma_free_coherent(&he_dev->pci_dev->dev, CONFIG_TBRQ_SIZE * sizeof(struct he_tbrq),
                                   he_dev->tpdrq_base, he_dev->tpdrq_phys);
 
-        if (he_dev->tpd_pool)
-                dma_pool_destroy(he_dev->tpd_pool);
+        dma_pool_destroy(he_dev->tpd_pool);
 
         if (he_dev->pci_dev) {
                 pci_read_config_word(he_dev->pci_dev, PCI_COMMAND, &command);
diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c
index 74e18b0a6d89..3d7fb6516f74 100644
--- a/drivers/atm/solos-pci.c
+++ b/drivers/atm/solos-pci.c
@@ -805,7 +805,12 @@ static void solos_bh(unsigned long card_arg)
                                         continue;
                                 }
 
-                                skb = alloc_skb(size + 1, GFP_ATOMIC);
+                                /* Use netdev_alloc_skb() because it adds NET_SKB_PAD of
+                                 * headroom, and ensures we can route packets back out an
+                                 * Ethernet interface (for example) without having to
+                                 * reallocate. Adding NET_IP_ALIGN also ensures that both
+                                 * PPPoATM and PPPoEoBR2684 packets end up aligned. */
+                                skb = netdev_alloc_skb_ip_align(NULL, size + 1);
                                 if (!skb) {
                                         if (net_ratelimit())
                                                 dev_warn(&card->dev->dev, "Failed to allocate sk_buff for RX\n");
@@ -869,7 +874,10 @@ static void solos_bh(unsigned long card_arg)
                 /* Allocate RX skbs for any ports which need them */
                 if (card->using_dma && card->atmdev[port] &&
                     !card->rx_skb[port]) {
-                        struct sk_buff *skb = alloc_skb(RX_DMA_SIZE, GFP_ATOMIC);
+                        /* Unlike the MMIO case (qv) we can't add NET_IP_ALIGN
+                         * here; the FPGA can only DMA to addresses which are
+                         * aligned to 4 bytes. */
+                        struct sk_buff *skb = dev_alloc_skb(RX_DMA_SIZE);
                         if (skb) {
                                 SKB_CB(skb)->dma_addr =
                                         dma_map_single(&card->dev->dev, skb->data,
diff --git a/drivers/base/platform-msi.c b/drivers/base/platform-msi.c
index 1857a5dd0816..134483daac25 100644
--- a/drivers/base/platform-msi.c
+++ b/drivers/base/platform-msi.c
@@ -63,20 +63,8 @@ static int platform_msi_init(struct irq_domain *domain,
                              unsigned int virq, irq_hw_number_t hwirq,
                              msi_alloc_info_t *arg)
 {
-        struct irq_data *data;
-
-        irq_domain_set_hwirq_and_chip(domain, virq, hwirq,
-                                      info->chip, info->chip_data);
-
-        /*
-         * Save the MSI descriptor in handler_data so that the
-         * irq_write_msi_msg callback can retrieve it (and the
-         * associated device).
-         */
-        data = irq_domain_get_irq_data(domain, virq);
-        data->handler_data = arg->desc;
-
-        return 0;
+        return irq_domain_set_hwirq_and_chip(domain, virq, hwirq,
+                                             info->chip, info->chip_data);
 }
 #else
 #define platform_msi_set_desc           NULL
@@ -97,7 +85,7 @@ static void platform_msi_update_dom_ops(struct msi_domain_info *info)
 
 static void platform_msi_write_msg(struct irq_data *data, struct msi_msg *msg)
 {
-        struct msi_desc *desc = irq_data_get_irq_handler_data(data);
+        struct msi_desc *desc = irq_data_get_msi_desc(data);
         struct platform_msi_priv_data *priv_data;
 
         priv_data = desc->platform.msi_priv_data;
diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
index 416720159e96..16550c63d611 100644
--- a/drivers/base/power/domain.c
+++ b/drivers/base/power/domain.c
@@ -213,6 +213,18 @@ static int genpd_power_off(struct generic_pm_domain *genpd, bool timed)
 }
 
 /**
+ * genpd_queue_power_off_work - Queue up the execution of pm_genpd_poweroff().
+ * @genpd: PM domait to power off.
+ *
+ * Queue up the execution of pm_genpd_poweroff() unless it's already been done
+ * before.
+ */
+static void genpd_queue_power_off_work(struct generic_pm_domain *genpd)
+{
+        queue_work(pm_wq, &genpd->power_off_work);
+}
+
+/**
  * __pm_genpd_poweron - Restore power to a given PM domain and its masters.
  * @genpd: PM domain to power up.
  *
@@ -259,8 +271,12 @@ static int __pm_genpd_poweron(struct generic_pm_domain *genpd)
         return 0;
 
  err:
-        list_for_each_entry_continue_reverse(link, &genpd->slave_links, slave_node)
+        list_for_each_entry_continue_reverse(link,
+                                        &genpd->slave_links,
+                                        slave_node) {
                 genpd_sd_counter_dec(link->master);
+                genpd_queue_power_off_work(link->master);
+        }
 
         return ret;
 }
@@ -349,18 +365,6 @@ static int genpd_dev_pm_qos_notifier(struct notifier_block *nb,
 }
 
 /**
- * genpd_queue_power_off_work - Queue up the execution of pm_genpd_poweroff().
- * @genpd: PM domait to power off.
- *
- * Queue up the execution of pm_genpd_poweroff() unless it's already been done
- * before.
- */
-static void genpd_queue_power_off_work(struct generic_pm_domain *genpd)
-{
-        queue_work(pm_wq, &genpd->power_off_work);
-}
-
-/**
  * pm_genpd_poweroff - Remove power from a given PM domain.
  * @genpd: PM domain to power down.
  *
@@ -1469,6 +1473,13 @@ int pm_genpd_remove_subdomain(struct generic_pm_domain *genpd,
 
         mutex_lock(&genpd->lock);
 
+        if (!list_empty(&subdomain->slave_links) || subdomain->device_count) {
+                pr_warn("%s: unable to remove subdomain %s\n", genpd->name,
+                        subdomain->name);
+                ret = -EBUSY;
+                goto out;
+        }
+
         list_for_each_entry(link, &genpd->master_links, master_node) {
                 if (link->slave != subdomain)
                         continue;
@@ -1487,6 +1498,7 @@ int pm_genpd_remove_subdomain(struct generic_pm_domain *genpd,
                 break;
         }
 
+out:
         mutex_unlock(&genpd->lock);
 
         return ret;
diff --git a/drivers/base/power/opp.c b/drivers/base/power/opp.c
index eb254497a494..28cd75c535b0 100644
--- a/drivers/base/power/opp.c
+++ b/drivers/base/power/opp.c
@@ -341,6 +341,34 @@ unsigned long dev_pm_opp_get_max_clock_latency(struct device *dev)
 EXPORT_SYMBOL_GPL(dev_pm_opp_get_max_clock_latency);
 
 /**
+ * dev_pm_opp_get_suspend_opp() - Get suspend opp
+ * @dev:        device for which we do this operation
+ *
+ * Return: This function returns pointer to the suspend opp if it is
+ * defined and available, otherwise it returns NULL.
+ *
+ * Locking: This function must be called under rcu_read_lock(). opp is a rcu
+ * protected pointer. The reason for the same is that the opp pointer which is
+ * returned will remain valid for use with opp_get_{voltage, freq} only while
+ * under the locked area. The pointer returned must be used prior to unlocking
+ * with rcu_read_unlock() to maintain the integrity of the pointer.
+ */
+struct dev_pm_opp *dev_pm_opp_get_suspend_opp(struct device *dev)
+{
+        struct device_opp *dev_opp;
+
+        opp_rcu_lockdep_assert();
+
+        dev_opp = _find_device_opp(dev);
+        if (IS_ERR(dev_opp) || !dev_opp->suspend_opp ||
+            !dev_opp->suspend_opp->available)
+                return NULL;
+
+        return dev_opp->suspend_opp;
+}
+EXPORT_SYMBOL_GPL(dev_pm_opp_get_suspend_opp);
+
+/**
  * dev_pm_opp_get_opp_count() - Get number of opps available in the opp list
  * @dev:        device for which we do this operation
  *
diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c
index 17269a3b85f2..a295b98c6bae 100644
--- a/drivers/block/null_blk.c
+++ b/drivers/block/null_blk.c
@@ -406,6 +406,22 @@ static struct blk_mq_ops null_mq_ops = {
         .complete       = null_softirq_done_fn,
 };
 
+static void cleanup_queue(struct nullb_queue *nq)
+{
+        kfree(nq->tag_map);
+        kfree(nq->cmds);
+}
+
+static void cleanup_queues(struct nullb *nullb)
+{
+        int i;
+
+        for (i = 0; i < nullb->nr_queues; i++)
+                cleanup_queue(&nullb->queues[i]);
+
+        kfree(nullb->queues);
+}
+
 static void null_del_dev(struct nullb *nullb)
 {
         list_del_init(&nullb->list);
@@ -415,6 +431,7 @@ static void null_del_dev(struct nullb *nullb)
         if (queue_mode == NULL_Q_MQ)
                 blk_mq_free_tag_set(&nullb->tag_set);
         put_disk(nullb->disk);
+        cleanup_queues(nullb);
         kfree(nullb);
 }
 
@@ -459,22 +476,6 @@ static int setup_commands(struct nullb_queue *nq)
         return 0;
 }
 
-static void cleanup_queue(struct nullb_queue *nq)
-{
-        kfree(nq->tag_map);
-        kfree(nq->cmds);
-}
-
-static void cleanup_queues(struct nullb *nullb)
-{
-        int i;
-
-        for (i = 0; i < nullb->nr_queues; i++)
-                cleanup_queue(&nullb->queues[i]);
-
-        kfree(nullb->queues);
-}
-
 static int setup_queues(struct nullb *nullb)
 {
         nullb->queues = kzalloc(submit_queues * sizeof(struct nullb_queue),
@@ -588,8 +589,7 @@ static int null_add_dev(void)
         blk_queue_physical_block_size(nullb->q, bs);
 
         size = gb * 1024 * 1024 * 1024ULL;
-        sector_div(size, bs);
-        set_capacity(disk, size);
+        set_capacity(disk, size >> 9);
 
         disk->flags |= GENHD_FL_EXT_DEVT | GENHD_FL_SUPPRESS_PARTITION_INFO;
         disk->major             = null_major;
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index 698f761037ce..d93a0372b37b 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -4673,7 +4673,10 @@ static int rbd_dev_v2_header_info(struct rbd_device *rbd_dev)
         }
 
         ret = rbd_dev_v2_snap_context(rbd_dev);
-        dout("rbd_dev_v2_snap_context returned %d\n", ret);
+        if (ret && first_time) {
+                kfree(rbd_dev->header.object_prefix);
+                rbd_dev->header.object_prefix = NULL;
+        }
 
         return ret;
 }
@@ -5154,7 +5157,6 @@ static int rbd_dev_probe_parent(struct rbd_device *rbd_dev)
 out_err:
         if (parent) {
                 rbd_dev_unparent(rbd_dev);
-                kfree(rbd_dev->header_name);
                 rbd_dev_destroy(parent);
         } else {
                 rbd_put_client(rbdc);
diff --git a/drivers/block/zram/zcomp.c b/drivers/block/zram/zcomp.c
index 965d1afb0eaa..5cb13ca3a3ac 100644
--- a/drivers/block/zram/zcomp.c
+++ b/drivers/block/zram/zcomp.c
@@ -330,12 +330,14 @@ void zcomp_destroy(struct zcomp *comp)
  * allocate new zcomp and initialize it. return compressing
  * backend pointer or ERR_PTR if things went bad. ERR_PTR(-EINVAL)
  * if requested algorithm is not supported, ERR_PTR(-ENOMEM) in
- * case of allocation error.
+ * case of allocation error, or any other error potentially
+ * returned by functions zcomp_strm_{multi,single}_create.
  */
 struct zcomp *zcomp_create(const char *compress, int max_strm)
 {
         struct zcomp *comp;
         struct zcomp_backend *backend;
+        int error;
 
         backend = find_backend(compress);
         if (!backend)
@@ -347,12 +349,12 @@ struct zcomp *zcomp_create(const char *compress, int max_strm)
 
         comp->backend = backend;
         if (max_strm > 1)
-                zcomp_strm_multi_create(comp, max_strm);
+                error = zcomp_strm_multi_create(comp, max_strm);
         else
-                zcomp_strm_single_create(comp);
-        if (!comp->stream) {
+                error = zcomp_strm_single_create(comp);
+        if (error) {
                 kfree(comp);
-                return ERR_PTR(-ENOMEM);
+                return ERR_PTR(error);
         }
         return comp;
 }
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index 43e2c3ad6c31..0ebcf449778a 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -2437,7 +2437,8 @@ static int __clk_init(struct device *dev, struct clk *clk_user)
         hlist_for_each_entry_safe(orphan, tmp2, &clk_orphan_list, child_node) {
                 if (orphan->num_parents && orphan->ops->get_parent) {
                         i = orphan->ops->get_parent(orphan->hw);
-                        if (!strcmp(core->name, orphan->parent_names[i]))
+                        if (i >= 0 && i < orphan->num_parents &&
+                            !strcmp(core->name, orphan->parent_names[i]))
                                 clk_core_reparent(orphan, core);
                         continue;
                 }
diff --git a/drivers/clk/h8300/clk-h8s2678.c b/drivers/clk/h8300/clk-h8s2678.c
index 2a38eb4a2552..6cf38dc1c929 100644
--- a/drivers/clk/h8300/clk-h8s2678.c
+++ b/drivers/clk/h8300/clk-h8s2678.c
@@ -8,6 +8,7 @@
 #include <linux/err.h>
 #include <linux/device.h>
 #include <linux/of_address.h>
+#include <linux/slab.h>
 
 static DEFINE_SPINLOCK(clklock);
 
diff --git a/drivers/clk/hisilicon/Kconfig b/drivers/clk/hisilicon/Kconfig
index 2c16807341dc..e43485448612 100644
--- a/drivers/clk/hisilicon/Kconfig
+++ b/drivers/clk/hisilicon/Kconfig
@@ -1,6 +1,12 @@
 config COMMON_CLK_HI6220
         bool "Hi6220 Clock Driver"
-        depends on (ARCH_HISI || COMPILE_TEST) && MAILBOX
+        depends on ARCH_HISI || COMPILE_TEST
         default ARCH_HISI
         help
           Build the Hisilicon Hi6220 clock driver based on the common clock framework.
+
+config STUB_CLK_HI6220
+        bool "Hi6220 Stub Clock Driver"
+        depends on COMMON_CLK_HI6220 && MAILBOX
+        help
+          Build the Hisilicon Hi6220 stub clock driver.
diff --git a/drivers/clk/hisilicon/Makefile b/drivers/clk/hisilicon/Makefile
index 4a1001a11f04..74dba31590f9 100644
--- a/drivers/clk/hisilicon/Makefile
+++ b/drivers/clk/hisilicon/Makefile
@@ -7,4 +7,5 @@ obj-y	+= clk.o clkgate-separated.o clkdivider-hi6220.o
 obj-$(CONFIG_ARCH_HI3xxx)       += clk-hi3620.o
 obj-$(CONFIG_ARCH_HIP04)        += clk-hip04.o
 obj-$(CONFIG_ARCH_HIX5HD2)      += clk-hix5hd2.o
-obj-$(CONFIG_COMMON_CLK_HI6220) += clk-hi6220.o clk-hi6220-stub.o
+obj-$(CONFIG_COMMON_CLK_HI6220) += clk-hi6220.o
+obj-$(CONFIG_STUB_CLK_HI6220)   += clk-hi6220-stub.o
diff --git a/drivers/clk/rockchip/clk-rk3188.c b/drivers/clk/rockchip/clk-rk3188.c
index ed02bbc7b11f..abb47608713b 100644
--- a/drivers/clk/rockchip/clk-rk3188.c
+++ b/drivers/clk/rockchip/clk-rk3188.c
@@ -716,6 +716,8 @@ static const char *const rk3188_critical_clocks[] __initconst = {
         "aclk_cpu",
         "aclk_peri",
         "hclk_peri",
+        "pclk_cpu",
+        "pclk_peri",
 };
 
 static void __init rk3188_common_clk_init(struct device_node *np)
@@ -744,8 +746,6 @@ static void __init rk3188_common_clk_init(struct device_node *np)
 
         rockchip_clk_register_branches(common_clk_branches,
                                   ARRAY_SIZE(common_clk_branches));
-        rockchip_clk_protect_critical(rk3188_critical_clocks,
-                                      ARRAY_SIZE(rk3188_critical_clocks));
 
         rockchip_register_softrst(np, 9, reg_base + RK2928_SOFTRST_CON(0),
                                   ROCKCHIP_SOFTRST_HIWORD_MASK);
@@ -765,6 +765,8 @@ static void __init rk3066a_clk_init(struct device_node *np)
                         mux_armclk_p, ARRAY_SIZE(mux_armclk_p),
                         &rk3066_cpuclk_data, rk3066_cpuclk_rates,
                         ARRAY_SIZE(rk3066_cpuclk_rates));
+        rockchip_clk_protect_critical(rk3188_critical_clocks,
+                                      ARRAY_SIZE(rk3188_critical_clocks));
 }
 CLK_OF_DECLARE(rk3066a_cru, "rockchip,rk3066a-cru", rk3066a_clk_init);
 
@@ -801,6 +803,9 @@ static void __init rk3188a_clk_init(struct device_node *np)
                 pr_warn("%s: missing clocks to reparent aclk_cpu_pre to gpll\n",
                         __func__);
         }
+
+        rockchip_clk_protect_critical(rk3188_critical_clocks,
+                                      ARRAY_SIZE(rk3188_critical_clocks));
 }
 CLK_OF_DECLARE(rk3188a_cru, "rockchip,rk3188a-cru", rk3188a_clk_init);
 
diff --git a/drivers/clk/rockchip/clk-rk3368.c b/drivers/clk/rockchip/clk-rk3368.c
index 9c5d61e698ef..7e6b783e6eee 100644
--- a/drivers/clk/rockchip/clk-rk3368.c
+++ b/drivers/clk/rockchip/clk-rk3368.c
@@ -818,6 +818,10 @@ static struct rockchip_clk_branch rk3368_clk_branches[] __initdata = {
         GATE(0, "sclk_timer00", "xin24m", CLK_IGNORE_UNUSED, RK3368_CLKGATE_CON(24), 0, GFLAGS),
 };
 
+static const char *const rk3368_critical_clocks[] __initconst = {
+        "pclk_pd_pmu",
+};
+
 static void __init rk3368_clk_init(struct device_node *np)
 {
         void __iomem *reg_base;
@@ -862,6 +866,8 @@ static void __init rk3368_clk_init(struct device_node *np)
                                    RK3368_GRF_SOC_STATUS0);
         rockchip_clk_register_branches(rk3368_clk_branches,
                                   ARRAY_SIZE(rk3368_clk_branches));
+        rockchip_clk_protect_critical(rk3368_critical_clocks,
+                                      ARRAY_SIZE(rk3368_critical_clocks));
 
         rockchip_clk_register_armclk(ARMCLKB, "armclkb",
                         mux_armclkb_p, ARRAY_SIZE(mux_armclkb_p),
diff --git a/drivers/clk/st/clkgen-fsyn.c b/drivers/clk/st/clkgen-fsyn.c
index 83ccf142ff2a..576cd0354d48 100644
--- a/drivers/clk/st/clkgen-fsyn.c
+++ b/drivers/clk/st/clkgen-fsyn.c
@@ -307,7 +307,7 @@ static const struct clkgen_quadfs_data st_fs660c32_F_416 = {
         .get_rate       = clk_fs660c32_dig_get_rate,
 };
 
-static const struct clkgen_quadfs_data st_fs660c32_C_407 = {
+static const struct clkgen_quadfs_data st_fs660c32_C = {
         .nrst_present = true,
         .nrst   = { CLKGEN_FIELD(0x2f0, 0x1, 0),
                     CLKGEN_FIELD(0x2f0, 0x1, 1),
@@ -350,7 +350,7 @@ static const struct clkgen_quadfs_data st_fs660c32_C_407 = {
         .get_rate       = clk_fs660c32_dig_get_rate,
 };
 
-static const struct clkgen_quadfs_data st_fs660c32_D_407 = {
+static const struct clkgen_quadfs_data st_fs660c32_D = {
         .nrst_present = true,
         .nrst   = { CLKGEN_FIELD(0x2a0, 0x1, 0),
                     CLKGEN_FIELD(0x2a0, 0x1, 1),
@@ -1077,11 +1077,11 @@ static const struct of_device_id quadfs_of_match[] = {
         },
         {
                 .compatible = "st,stih407-quadfs660-C",
-                .data = &st_fs660c32_C_407
+                .data = &st_fs660c32_C
         },
         {
                 .compatible = "st,stih407-quadfs660-D",
-                .data = &st_fs660c32_D_407
+                .data = &st_fs660c32_D
         },
         {}
 };
diff --git a/drivers/clk/st/clkgen-pll.c b/drivers/clk/st/clkgen-pll.c
index 47a38a994cac..b2a332cf8985 100644
--- a/drivers/clk/st/clkgen-pll.c
+++ b/drivers/clk/st/clkgen-pll.c
@@ -193,7 +193,7 @@ static const struct clkgen_pll_data st_pll3200c32_407_a0 = {
         .ops            = &stm_pll3200c32_ops,
 };
 
-static const struct clkgen_pll_data st_pll3200c32_407_c0_0 = {
+static const struct clkgen_pll_data st_pll3200c32_cx_0 = {
         /* 407 C0 PLL0 */
         .pdn_status     = CLKGEN_FIELD(0x2a0,   0x1,                    8),
         .locked_status  = CLKGEN_FIELD(0x2a0,   0x1,                    24),
@@ -205,7 +205,7 @@ static const struct clkgen_pll_data st_pll3200c32_407_c0_0 = {
         .ops            = &stm_pll3200c32_ops,
 };
 
-static const struct clkgen_pll_data st_pll3200c32_407_c0_1 = {
+static const struct clkgen_pll_data st_pll3200c32_cx_1 = {
         /* 407 C0 PLL1 */
         .pdn_status     = CLKGEN_FIELD(0x2c8,   0x1,                    8),
         .locked_status  = CLKGEN_FIELD(0x2c8,   0x1,                    24),
@@ -624,12 +624,12 @@ static const struct of_device_id c32_pll_of_match[] = {
                 .data = &st_pll3200c32_407_a0,
         },
         {
-                .compatible = "st,stih407-plls-c32-c0_0",
-                .data = &st_pll3200c32_407_c0_0,
+                .compatible = "st,plls-c32-cx_0",
+                .data = &st_pll3200c32_cx_0,
         },
         {
-                .compatible = "st,stih407-plls-c32-c0_1",
-                .data = &st_pll3200c32_407_c0_1,
+                .compatible = "st,plls-c32-cx_1",
+                .data = &st_pll3200c32_cx_1,
         },
         {
                 .compatible = "st,stih407-plls-c32-a9",
diff --git a/drivers/clk/tegra/clk-dfll.c b/drivers/clk/tegra/clk-dfll.c
index c2ff859ee0e8..c4e3a52e225b 100644
--- a/drivers/clk/tegra/clk-dfll.c
+++ b/drivers/clk/tegra/clk-dfll.c
@@ -682,11 +682,17 @@ static int find_lut_index_for_rate(struct tegra_dfll *td, unsigned long rate)
         struct dev_pm_opp *opp;
         int i, uv;
 
+        rcu_read_lock();
+
         opp = dev_pm_opp_find_freq_ceil(td->soc->dev, &rate);
-        if (IS_ERR(opp))
+        if (IS_ERR(opp)) {
+                rcu_read_unlock();
                 return PTR_ERR(opp);
+        }
         uv = dev_pm_opp_get_voltage(opp);
 
+        rcu_read_unlock();
+
         for (i = 0; i < td->i2c_lut_size; i++) {
                 if (regulator_list_voltage(td->vdd_reg, td->i2c_lut[i]) == uv)
                         return i;
diff --git a/drivers/cpufreq/Kconfig.arm b/drivers/cpufreq/Kconfig.arm
index 5f498d9f1825..cd0391e46c6d 100644
--- a/drivers/cpufreq/Kconfig.arm
+++ b/drivers/cpufreq/Kconfig.arm
@@ -84,6 +84,7 @@ config ARM_KIRKWOOD_CPUFREQ
 config ARM_MT8173_CPUFREQ
         bool "Mediatek MT8173 CPUFreq support"
         depends on ARCH_MEDIATEK && REGULATOR
+        depends on !CPU_THERMAL || THERMAL=y
         select PM_OPP
         help
           This adds the CPUFreq driver support for Mediatek MT8173 SoC.
diff --git a/drivers/cpufreq/acpi-cpufreq.c b/drivers/cpufreq/acpi-cpufreq.c
index 15b921a9248c..798277227de7 100644
--- a/drivers/cpufreq/acpi-cpufreq.c
+++ b/drivers/cpufreq/acpi-cpufreq.c
@@ -375,12 +375,11 @@ static unsigned int get_cur_freq_on_cpu(unsigned int cpu)
 
         pr_debug("get_cur_freq_on_cpu (%d)\n", cpu);
 
-        policy = cpufreq_cpu_get(cpu);
+        policy = cpufreq_cpu_get_raw(cpu);
         if (unlikely(!policy))
                 return 0;
 
         data = policy->driver_data;
-        cpufreq_cpu_put(policy);
         if (unlikely(!data || !data->freq_table))
                 return 0;
 
diff --git a/drivers/cpufreq/cpufreq-dt.c b/drivers/cpufreq/cpufreq-dt.c
index c3583cdfadbd..7c0d70e2a861 100644
--- a/drivers/cpufreq/cpufreq-dt.c
+++ b/drivers/cpufreq/cpufreq-dt.c
@@ -196,6 +196,7 @@ static int cpufreq_init(struct cpufreq_policy *policy)
         struct device *cpu_dev;
         struct regulator *cpu_reg;
         struct clk *cpu_clk;
+        struct dev_pm_opp *suspend_opp;
         unsigned long min_uV = ~0, max_uV = 0;
         unsigned int transition_latency;
         bool need_update = false;
@@ -239,6 +240,17 @@ static int cpufreq_init(struct cpufreq_policy *policy)
          */
         of_cpumask_init_opp_table(policy->cpus);
 
+        /*
+         * But we need OPP table to function so if it is not there let's
+         * give platform code chance to provide it for us.
+         */
+        ret = dev_pm_opp_get_opp_count(cpu_dev);
+        if (ret <= 0) {
+                pr_debug("OPP table is not ready, deferring probe\n");
+                ret = -EPROBE_DEFER;
+                goto out_free_opp;
+        }
+
         if (need_update) {
                 struct cpufreq_dt_platform_data *pd = cpufreq_get_driver_data();
 
@@ -249,24 +261,16 @@ static int cpufreq_init(struct cpufreq_policy *policy)
                  * OPP tables are initialized only for policy->cpu, do it for
                  * others as well.
                  */
-                set_cpus_sharing_opps(cpu_dev, policy->cpus);
+                ret = set_cpus_sharing_opps(cpu_dev, policy->cpus);
+                if (ret)
+                        dev_err(cpu_dev, "%s: failed to mark OPPs as shared: %d\n",
+                                __func__, ret);
 
                 of_property_read_u32(np, "clock-latency", &transition_latency);
         } else {
                 transition_latency = dev_pm_opp_get_max_clock_latency(cpu_dev);
         }
 
-        /*
-         * But we need OPP table to function so if it is not there let's
-         * give platform code chance to provide it for us.
-         */
-        ret = dev_pm_opp_get_opp_count(cpu_dev);
-        if (ret <= 0) {
-                pr_debug("OPP table is not ready, deferring probe\n");
-                ret = -EPROBE_DEFER;
-                goto out_free_opp;
-        }
-
         priv = kzalloc(sizeof(*priv), GFP_KERNEL);
         if (!priv) {
                 ret = -ENOMEM;
@@ -300,7 +304,8 @@ static int cpufreq_init(struct cpufreq_policy *policy)
                         rcu_read_unlock();
 
                         tol_uV = opp_uV * priv->voltage_tolerance / 100;
-                        if (regulator_is_supported_voltage(cpu_reg, opp_uV,
+                        if (regulator_is_supported_voltage(cpu_reg,
+                                                           opp_uV - tol_uV,
                                                            opp_uV + tol_uV)) {
                                 if (opp_uV < min_uV)
                                         min_uV = opp_uV;
@@ -329,6 +334,13 @@ static int cpufreq_init(struct cpufreq_policy *policy)
         policy->driver_data = priv;
 
         policy->clk = cpu_clk;
+
+        rcu_read_lock();
+        suspend_opp = dev_pm_opp_get_suspend_opp(cpu_dev);
+        if (suspend_opp)
+                policy->suspend_freq = dev_pm_opp_get_freq(suspend_opp) / 1000;
+        rcu_read_unlock();
+
         ret = cpufreq_table_validate_and_show(policy, freq_table);
         if (ret) {
                 dev_err(cpu_dev, "%s: invalid frequency table: %d\n", __func__,
@@ -419,6 +431,7 @@ static struct cpufreq_driver dt_cpufreq_driver = {
         .ready = cpufreq_ready,
         .name = "cpufreq-dt",
         .attr = cpufreq_dt_attr,
+        .suspend = cpufreq_generic_suspend,
 };
 
 static int dt_cpufreq_probe(struct platform_device *pdev)
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index b3d9368339af..ef5ed9470de9 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -238,13 +238,13 @@ int cpufreq_generic_init(struct cpufreq_policy *policy,
 }
 EXPORT_SYMBOL_GPL(cpufreq_generic_init);
 
-/* Only for cpufreq core internal use */
 struct cpufreq_policy *cpufreq_cpu_get_raw(unsigned int cpu)
 {
         struct cpufreq_policy *policy = per_cpu(cpufreq_cpu_data, cpu);
 
         return policy && cpumask_test_cpu(cpu, policy->cpus) ? policy : NULL;
 }
+EXPORT_SYMBOL_GPL(cpufreq_cpu_get_raw);
 
 unsigned int cpufreq_generic_get(unsigned int cpu)
 {
@@ -1626,8 +1626,8 @@ int cpufreq_generic_suspend(struct cpufreq_policy *policy)
         int ret;
 
         if (!policy->suspend_freq) {
-                pr_err("%s: suspend_freq can't be zero\n", __func__);
-                return -EINVAL;
+                pr_debug("%s: suspend_freq not defined\n", __func__);
+                return 0;
         }
 
         pr_debug("%s: Setting suspend-freq: %u\n", __func__,
@@ -2031,8 +2031,7 @@ static int __cpufreq_governor(struct cpufreq_policy *policy,
                 if (!try_module_get(policy->governor->owner))
                         return -EINVAL;
 
-        pr_debug("__cpufreq_governor for CPU %u, event %u\n",
-                 policy->cpu, event);
+        pr_debug("%s: for CPU %u, event %u\n", __func__, policy->cpu, event);
 
         mutex_lock(&cpufreq_governor_lock);
         if ((policy->governor_enabled && event == CPUFREQ_GOV_START)
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index cddc61939a86..3af9dd7332e6 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -260,24 +260,31 @@ static inline void update_turbo_state(void)
                  cpu->pstate.max_pstate == cpu->pstate.turbo_pstate);
 }
 
-#define PCT_TO_HWP(x) (x * 255 / 100)
 static void intel_pstate_hwp_set(void)
 {
-        int min, max, cpu;
-        u64 value, freq;
+        int min, hw_min, max, hw_max, cpu, range, adj_range;
+        u64 value, cap;
+
+        rdmsrl(MSR_HWP_CAPABILITIES, cap);
+        hw_min = HWP_LOWEST_PERF(cap);
+        hw_max = HWP_HIGHEST_PERF(cap);
+        range = hw_max - hw_min;
 
         get_online_cpus();
 
         for_each_online_cpu(cpu) {
                 rdmsrl_on_cpu(cpu, MSR_HWP_REQUEST, &value);
-                min = PCT_TO_HWP(limits.min_perf_pct);
+                adj_range = limits.min_perf_pct * range / 100;
+                min = hw_min + adj_range;
                 value &= ~HWP_MIN_PERF(~0L);
                 value |= HWP_MIN_PERF(min);
 
-                max = PCT_TO_HWP(limits.max_perf_pct);
+                adj_range = limits.max_perf_pct * range / 100;
+                max = hw_min + adj_range;
                 if (limits.no_turbo) {
-                        rdmsrl( MSR_HWP_CAPABILITIES, freq);
-                        max = HWP_GUARANTEED_PERF(freq);
+                        hw_max = HWP_GUARANTEED_PERF(cap);
+                        if (hw_max < max)
+                                max = hw_max;
                 }
 
                 value &= ~HWP_MAX_PERF(~0L);
@@ -423,6 +430,8 @@ static ssize_t store_max_perf_pct(struct kobject *a, struct attribute *b,
 
         limits.max_sysfs_pct = clamp_t(int, input, 0 , 100);
         limits.max_perf_pct = min(limits.max_policy_pct, limits.max_sysfs_pct);
+        limits.max_perf_pct = max(limits.min_policy_pct, limits.max_perf_pct);
+        limits.max_perf_pct = max(limits.min_perf_pct, limits.max_perf_pct);
         limits.max_perf = div_fp(int_tofp(limits.max_perf_pct), int_tofp(100));
 
         if (hwp_active)
@@ -442,6 +451,8 @@ static ssize_t store_min_perf_pct(struct kobject *a, struct attribute *b,
 
         limits.min_sysfs_pct = clamp_t(int, input, 0 , 100);
         limits.min_perf_pct = max(limits.min_policy_pct, limits.min_sysfs_pct);
+        limits.min_perf_pct = min(limits.max_policy_pct, limits.min_perf_pct);
+        limits.min_perf_pct = min(limits.max_perf_pct, limits.min_perf_pct);
         limits.min_perf = div_fp(int_tofp(limits.min_perf_pct), int_tofp(100));
 
         if (hwp_active)
@@ -989,12 +1000,19 @@ static int intel_pstate_set_policy(struct cpufreq_policy *policy)
 
         limits.min_policy_pct = (policy->min * 100) / policy->cpuinfo.max_freq;
         limits.min_policy_pct = clamp_t(int, limits.min_policy_pct, 0 , 100);
-        limits.min_perf_pct = max(limits.min_policy_pct, limits.min_sysfs_pct);
-        limits.min_perf = div_fp(int_tofp(limits.min_perf_pct), int_tofp(100));
-
         limits.max_policy_pct = (policy->max * 100) / policy->cpuinfo.max_freq;
         limits.max_policy_pct = clamp_t(int, limits.max_policy_pct, 0 , 100);
+
+        /* Normalize user input to [min_policy_pct, max_policy_pct] */
+        limits.min_perf_pct = max(limits.min_policy_pct, limits.min_sysfs_pct);
+        limits.min_perf_pct = min(limits.max_policy_pct, limits.min_perf_pct);
         limits.max_perf_pct = min(limits.max_policy_pct, limits.max_sysfs_pct);
+        limits.max_perf_pct = max(limits.min_policy_pct, limits.max_perf_pct);
+
+        /* Make sure min_perf_pct <= max_perf_pct */
+        limits.min_perf_pct = min(limits.max_perf_pct, limits.min_perf_pct);
+
+        limits.min_perf = div_fp(int_tofp(limits.min_perf_pct), int_tofp(100));
         limits.max_perf = div_fp(int_tofp(limits.max_perf_pct), int_tofp(100));
 
         if (hwp_active)
diff --git a/drivers/cpuidle/coupled.c b/drivers/cpuidle/coupled.c
index 1523e2d745eb..344058f8501a 100644
--- a/drivers/cpuidle/coupled.c
+++ b/drivers/cpuidle/coupled.c
@@ -187,6 +187,28 @@ bool cpuidle_state_is_coupled(struct cpuidle_driver *drv, int state)
 }
 
 /**
+ * cpuidle_coupled_state_verify - check if the coupled states are correctly set.
+ * @drv: struct cpuidle_driver for the platform
+ *
+ * Returns 0 for valid state values, a negative error code otherwise:
+ *  * -EINVAL if any coupled state(safe_state_index) is wrongly set.
+ */
+int cpuidle_coupled_state_verify(struct cpuidle_driver *drv)
+{
+        int i;
+
+        for (i = drv->state_count - 1; i >= 0; i--) {
+                if (cpuidle_state_is_coupled(drv, i) &&
+                    (drv->safe_state_index == i ||
+                     drv->safe_state_index < 0 ||
+                     drv->safe_state_index >= drv->state_count))
+                        return -EINVAL;
+        }
+
+        return 0;
+}
+
+/**
  * cpuidle_coupled_set_ready - mark a cpu as ready
  * @coupled: the struct coupled that contains the current cpu
  */
diff --git a/drivers/cpuidle/cpuidle.h b/drivers/cpuidle/cpuidle.h
index 178c5ad3d568..f87f399b0540 100644
--- a/drivers/cpuidle/cpuidle.h
+++ b/drivers/cpuidle/cpuidle.h
@@ -35,6 +35,7 @@ extern void cpuidle_remove_sysfs(struct cpuidle_device *dev);
 
 #ifdef CONFIG_ARCH_NEEDS_CPU_IDLE_COUPLED
 bool cpuidle_state_is_coupled(struct cpuidle_driver *drv, int state);
+int cpuidle_coupled_state_verify(struct cpuidle_driver *drv);
 int cpuidle_enter_state_coupled(struct cpuidle_device *dev,
                 struct cpuidle_driver *drv, int next_state);
 int cpuidle_coupled_register_device(struct cpuidle_device *dev);
@@ -46,6 +47,11 @@ bool cpuidle_state_is_coupled(struct cpuidle_driver *drv, int state)
         return false;
 }
 
+static inline int cpuidle_coupled_state_verify(struct cpuidle_driver *drv)
+{
+        return 0;
+}
+
 static inline int cpuidle_enter_state_coupled(struct cpuidle_device *dev,
                 struct cpuidle_driver *drv, int next_state)
 {
diff --git a/drivers/cpuidle/driver.c b/drivers/cpuidle/driver.c
index 5db147859b90..389ade4572be 100644
--- a/drivers/cpuidle/driver.c
+++ b/drivers/cpuidle/driver.c
@@ -227,6 +227,10 @@ static int __cpuidle_register_driver(struct cpuidle_driver *drv)
         if (!drv || !drv->state_count)
                 return -EINVAL;
 
+        ret = cpuidle_coupled_state_verify(drv);
+        if (ret)
+                return ret;
+
         if (cpuidle_disabled())
                 return -ENODEV;
 
diff --git a/drivers/crypto/Kconfig b/drivers/crypto/Kconfig
index 07bc7aa6b224..d234719065a5 100644
--- a/drivers/crypto/Kconfig
+++ b/drivers/crypto/Kconfig
@@ -461,7 +461,7 @@ config CRYPTO_DEV_QCE
 
 config CRYPTO_DEV_VMX
         bool "Support for VMX cryptographic acceleration instructions"
-        depends on PPC64
+        depends on PPC64 && VSX
         help
           Support for VMX cryptographic acceleration instructions.
 
diff --git a/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c b/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c
index e070c316e8b7..a19ee127edca 100644
--- a/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c
+++ b/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c
@@ -104,7 +104,7 @@ static int sun4i_ss_opti_poll(struct ablkcipher_request *areq)
                         sg_miter_next(&mo);
                         oo = 0;
                 }
-        } while (mo.length > 0);
+        } while (oleft > 0);
 
         if (areq->info) {
                 for (i = 0; i < 4 && i < ivsize / 4; i++) {
diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c
index ca1b362d77e2..3927ed9fdbd5 100644
--- a/drivers/devfreq/devfreq.c
+++ b/drivers/devfreq/devfreq.c
@@ -53,7 +53,7 @@ static struct devfreq *find_device_devfreq(struct device *dev)
 {
         struct devfreq *tmp_devfreq;
 
-        if (unlikely(IS_ERR_OR_NULL(dev))) {
+        if (IS_ERR_OR_NULL(dev)) {
                 pr_err("DEVFREQ: %s: Invalid parameters\n", __func__);
                 return ERR_PTR(-EINVAL);
         }
@@ -133,7 +133,7 @@ static struct devfreq_governor *find_devfreq_governor(const char *name)
 {
         struct devfreq_governor *tmp_governor;
 
-        if (unlikely(IS_ERR_OR_NULL(name))) {
+        if (IS_ERR_OR_NULL(name)) {
                 pr_err("DEVFREQ: %s: Invalid parameters\n", __func__);
                 return ERR_PTR(-EINVAL);
         }
@@ -177,10 +177,10 @@ int update_devfreq(struct devfreq *devfreq)
                 return err;
 
         /*
-         * Adjust the freuqency with user freq and QoS.
+         * Adjust the frequency with user freq and QoS.
          *
-         * List from the highest proiority
-         * max_freq (probably called by thermal when it's too hot)
+         * List from the highest priority
+         * max_freq
          * min_freq
          */
 
@@ -482,7 +482,7 @@ struct devfreq *devfreq_add_device(struct device *dev,
                                                 devfreq->profile->max_state *
                                                 devfreq->profile->max_state,
                                                 GFP_KERNEL);
-        devfreq->time_in_state = devm_kzalloc(dev, sizeof(unsigned int) *
+        devfreq->time_in_state = devm_kzalloc(dev, sizeof(unsigned long) *
                                                 devfreq->profile->max_state,
                                                 GFP_KERNEL);
         devfreq->last_stat_updated = jiffies;
diff --git a/drivers/devfreq/event/exynos-ppmu.c b/drivers/devfreq/event/exynos-ppmu.c
index f9901f52a225..f312485f1451 100644
--- a/drivers/devfreq/event/exynos-ppmu.c
+++ b/drivers/devfreq/event/exynos-ppmu.c
@@ -319,7 +319,8 @@ static int exynos_ppmu_v2_get_event(struct devfreq_event_dev *edev,
         case PPMU_PMNCNT3:
                 pmcnt_high = __raw_readl(info->ppmu.base + PPMU_V2_PMCNT3_HIGH);
                 pmcnt_low = __raw_readl(info->ppmu.base + PPMU_V2_PMCNT3_LOW);
-                load_count = (u64)((pmcnt_high & 0xff) << 32) + (u64)pmcnt_low;
+                load_count = ((u64)((pmcnt_high & 0xff)) << 32)
+                           + (u64)pmcnt_low;
                 break;
         }
         edata->load_count = load_count;
diff --git a/drivers/devfreq/governor_simpleondemand.c b/drivers/devfreq/governor_simpleondemand.c
index 0720ba84ca92..ae72ba5e78df 100644
--- a/drivers/devfreq/governor_simpleondemand.c
+++ b/drivers/devfreq/governor_simpleondemand.c
@@ -21,17 +21,20 @@
 static int devfreq_simple_ondemand_func(struct devfreq *df,
                                         unsigned long *freq)
 {
-        struct devfreq_dev_status stat;
-        int err = df->profile->get_dev_status(df->dev.parent, &stat);
+        int err;
+        struct devfreq_dev_status *stat;
         unsigned long long a, b;
         unsigned int dfso_upthreshold = DFSO_UPTHRESHOLD;
         unsigned int dfso_downdifferential = DFSO_DOWNDIFFERENCTIAL;
         struct devfreq_simple_ondemand_data *data = df->data;
         unsigned long max = (df->max_freq) ? df->max_freq : UINT_MAX;
 
+        err = devfreq_update_stats(df);
         if (err)
                 return err;
 
+        stat = &df->last_status;
+
         if (data) {
                 if (data->upthreshold)
                         dfso_upthreshold = data->upthreshold;
@@ -43,41 +46,41 @@ static int devfreq_simple_ondemand_func(struct devfreq *df,
                 return -EINVAL;
 
         /* Assume MAX if it is going to be divided by zero */
-        if (stat.total_time == 0) {
+        if (stat->total_time == 0) {
                 *freq = max;
                 return 0;
         }
 
         /* Prevent overflow */
-        if (stat.busy_time >= (1 << 24) || stat.total_time >= (1 << 24)) {
-                stat.busy_time >>= 7;
-                stat.total_time >>= 7;
+        if (stat->busy_time >= (1 << 24) || stat->total_time >= (1 << 24)) {
+                stat->busy_time >>= 7;
+                stat->total_time >>= 7;
         }
 
         /* Set MAX if it's busy enough */
-        if (stat.busy_time * 100 >
-            stat.total_time * dfso_upthreshold) {
+        if (stat->busy_time * 100 >
+            stat->total_time * dfso_upthreshold) {
                 *freq = max;
                 return 0;
         }
 
         /* Set MAX if we do not know the initial frequency */
-        if (stat.current_frequency == 0) {
+        if (stat->current_frequency == 0) {
                 *freq = max;
                 return 0;
         }
 
         /* Keep the current frequency */
-        if (stat.busy_time * 100 >
-            stat.total_time * (dfso_upthreshold - dfso_downdifferential)) {
-                *freq = stat.current_frequency;
+        if (stat->busy_time * 100 >
+            stat->total_time * (dfso_upthreshold - dfso_downdifferential)) {
+                *freq = stat->current_frequency;
                 return 0;
         }
 
         /* Set the desired frequency based on the load */
-        a = stat.busy_time;
-        a *= stat.current_frequency;
-        b = div_u64(a, stat.total_time);
+        a = stat->busy_time;
+        a *= stat->current_frequency;
+        b = div_u64(a, stat->total_time);
         b *= 100;
         b = div_u64(b, (dfso_upthreshold - dfso_downdifferential / 2));
         *freq = (unsigned long) b;
diff --git a/drivers/devfreq/tegra-devfreq.c b/drivers/devfreq/tegra-devfreq.c
index 13a1a6e8108c..848b93ee930f 100644
--- a/drivers/devfreq/tegra-devfreq.c
+++ b/drivers/devfreq/tegra-devfreq.c
@@ -541,18 +541,20 @@ static struct devfreq_dev_profile tegra_devfreq_profile = {
 static int tegra_governor_get_target(struct devfreq *devfreq,
                                      unsigned long *freq)
 {
-        struct devfreq_dev_status stat;
+        struct devfreq_dev_status *stat;
         struct tegra_devfreq *tegra;
         struct tegra_devfreq_device *dev;
         unsigned long target_freq = 0;
         unsigned int i;
         int err;
 
-        err = devfreq->profile->get_dev_status(devfreq->dev.parent, &stat);
+        err = devfreq_update_stats(devfreq);
         if (err)
                 return err;
 
-        tegra = stat.private_data;
+        stat = &devfreq->last_status;
+
+        tegra = stat->private_data;
 
         for (i = 0; i < ARRAY_SIZE(tegra->devices); i++) {
                 dev = &tegra->devices[i];
diff --git a/drivers/dma/ipu/ipu_irq.c b/drivers/dma/ipu/ipu_irq.c
index 4768a829253a..2bf37e68ad0f 100644
--- a/drivers/dma/ipu/ipu_irq.c
+++ b/drivers/dma/ipu/ipu_irq.c
@@ -266,7 +266,7 @@ int ipu_irq_unmap(unsigned int source)
 }
 
 /* Chained IRQ handler for IPU function and error interrupt */
-static void ipu_irq_handler(unsigned int __irq, struct irq_desc *desc)
+static void ipu_irq_handler(struct irq_desc *desc)
 {
         struct ipu *ipu = irq_desc_get_handler_data(desc);
         u32 status;
diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
index ca7831168298..cf1268ddef0c 100644
--- a/drivers/edac/sb_edac.c
+++ b/drivers/edac/sb_edac.c
@@ -280,6 +280,7 @@ struct sbridge_info {
         u8              max_interleave;
         u8              (*get_node_id)(struct sbridge_pvt *pvt);
         enum mem_type   (*get_memory_type)(struct sbridge_pvt *pvt);
+        enum dev_type   (*get_width)(struct sbridge_pvt *pvt, u32 mtr);
         struct pci_dev  *pci_vtd;
 };
 
@@ -471,6 +472,9 @@ static const struct pci_id_table pci_dev_descr_ibridge_table[] = {
 #define PCI_DEVICE_ID_INTEL_HASWELL_IMC_HA1_TAD2 0x2f6c
 #define PCI_DEVICE_ID_INTEL_HASWELL_IMC_HA1_TAD3 0x2f6d
 #define PCI_DEVICE_ID_INTEL_HASWELL_IMC_DDRIO0 0x2fbd
+#define PCI_DEVICE_ID_INTEL_HASWELL_IMC_DDRIO1 0x2fbf
+#define PCI_DEVICE_ID_INTEL_HASWELL_IMC_DDRIO2 0x2fb9
+#define PCI_DEVICE_ID_INTEL_HASWELL_IMC_DDRIO3 0x2fbb
 static const struct pci_id_descr pci_dev_descr_haswell[] = {
         /* first item must be the HA */
         { PCI_DESCR(PCI_DEVICE_ID_INTEL_HASWELL_IMC_HA0, 0)             },
@@ -488,6 +492,9 @@ static const struct pci_id_descr pci_dev_descr_haswell[] = {
         { PCI_DESCR(PCI_DEVICE_ID_INTEL_HASWELL_IMC_HA0_TAD3, 1)        },
 
         { PCI_DESCR(PCI_DEVICE_ID_INTEL_HASWELL_IMC_DDRIO0, 1)          },
+        { PCI_DESCR(PCI_DEVICE_ID_INTEL_HASWELL_IMC_DDRIO1, 1)          },
+        { PCI_DESCR(PCI_DEVICE_ID_INTEL_HASWELL_IMC_DDRIO2, 1)          },
+        { PCI_DESCR(PCI_DEVICE_ID_INTEL_HASWELL_IMC_DDRIO3, 1)          },
 
         { PCI_DESCR(PCI_DEVICE_ID_INTEL_HASWELL_IMC_HA1_TA, 1)          },
         { PCI_DESCR(PCI_DEVICE_ID_INTEL_HASWELL_IMC_HA1_THERMAL, 1)     },
@@ -762,6 +769,49 @@ out:
         return mtype;
 }
 
+static enum dev_type sbridge_get_width(struct sbridge_pvt *pvt, u32 mtr)
+{
+        /* there's no way to figure out */
+        return DEV_UNKNOWN;
+}
+
+static enum dev_type __ibridge_get_width(u32 mtr)
+{
+        enum dev_type type;
+
+        switch (mtr) {
+        case 3:
+                type = DEV_UNKNOWN;
+                break;
+        case 2:
+                type = DEV_X16;
+                break;
+        case 1:
+                type = DEV_X8;
+                break;
+        case 0:
+                type = DEV_X4;
+                break;
+        }
+
+        return type;
+}
+
+static enum dev_type ibridge_get_width(struct sbridge_pvt *pvt, u32 mtr)
+{
+        /*
+         * ddr3_width on the documentation but also valid for DDR4 on
+         * Haswell
+         */
+        return __ibridge_get_width(GET_BITFIELD(mtr, 7, 8));
+}
+
+static enum dev_type broadwell_get_width(struct sbridge_pvt *pvt, u32 mtr)
+{
+        /* ddr3_width on the documentation but also valid for DDR4 */
+        return __ibridge_get_width(GET_BITFIELD(mtr, 8, 9));
+}
+
 static u8 get_node_id(struct sbridge_pvt *pvt)
 {
         u32 reg;
@@ -966,17 +1016,7 @@ static int get_dimm_config(struct mem_ctl_info *mci)
 
                                 dimm->nr_pages = npages;
                                 dimm->grain = 32;
-                                switch (banks) {
-                                case 16:
-                                        dimm->dtype = DEV_X16;
-                                        break;
-                                case 8:
-                                        dimm->dtype = DEV_X8;
-                                        break;
-                                case 4:
-                                        dimm->dtype = DEV_X4;
-                                        break;
-                                }
+                                dimm->dtype = pvt->info.get_width(pvt, mtr);
                                 dimm->mtype = mtype;
                                 dimm->edac_mode = mode;
                                 snprintf(dimm->label, sizeof(dimm->label),
@@ -1869,7 +1909,11 @@ static int haswell_mci_bind_devs(struct mem_ctl_info *mci,
                 }
                         break;
                 case PCI_DEVICE_ID_INTEL_HASWELL_IMC_DDRIO0:
-                        pvt->pci_ddrio = pdev;
+                case PCI_DEVICE_ID_INTEL_HASWELL_IMC_DDRIO1:
+                case PCI_DEVICE_ID_INTEL_HASWELL_IMC_DDRIO2:
+                case PCI_DEVICE_ID_INTEL_HASWELL_IMC_DDRIO3:
+                        if (!pvt->pci_ddrio)
+                                pvt->pci_ddrio = pdev;
                         break;
                 case PCI_DEVICE_ID_INTEL_HASWELL_IMC_HA1:
                         pvt->pci_ha1 = pdev;
@@ -2361,6 +2405,7 @@ static int sbridge_register_mci(struct sbridge_dev *sbridge_dev, enum type type)
                 pvt->info.interleave_list = ibridge_interleave_list;
                 pvt->info.max_interleave = ARRAY_SIZE(ibridge_interleave_list);
                 pvt->info.interleave_pkg = ibridge_interleave_pkg;
+                pvt->info.get_width = ibridge_get_width;
                 mci->ctl_name = kasprintf(GFP_KERNEL, "Ivy Bridge Socket#%d", mci->mc_idx);
 
                 /* Store pci devices at mci for faster access */
@@ -2380,6 +2425,7 @@ static int sbridge_register_mci(struct sbridge_dev *sbridge_dev, enum type type)
                 pvt->info.interleave_list = sbridge_interleave_list;
                 pvt->info.max_interleave = ARRAY_SIZE(sbridge_interleave_list);
                 pvt->info.interleave_pkg = sbridge_interleave_pkg;
+                pvt->info.get_width = sbridge_get_width;
                 mci->ctl_name = kasprintf(GFP_KERNEL, "Sandy Bridge Socket#%d", mci->mc_idx);
 
                 /* Store pci devices at mci for faster access */
@@ -2399,6 +2445,7 @@ static int sbridge_register_mci(struct sbridge_dev *sbridge_dev, enum type type)
                 pvt->info.interleave_list = ibridge_interleave_list;
                 pvt->info.max_interleave = ARRAY_SIZE(ibridge_interleave_list);
                 pvt->info.interleave_pkg = ibridge_interleave_pkg;
+                pvt->info.get_width = ibridge_get_width;
                 mci->ctl_name = kasprintf(GFP_KERNEL, "Haswell Socket#%d", mci->mc_idx);
 
                 /* Store pci devices at mci for faster access */
@@ -2418,6 +2465,7 @@ static int sbridge_register_mci(struct sbridge_dev *sbridge_dev, enum type type)
                 pvt->info.interleave_list = ibridge_interleave_list;
                 pvt->info.max_interleave = ARRAY_SIZE(ibridge_interleave_list);
                 pvt->info.interleave_pkg = ibridge_interleave_pkg;
+                pvt->info.get_width = broadwell_get_width;
                 mci->ctl_name = kasprintf(GFP_KERNEL, "Broadwell Socket#%d", mci->mc_idx);
 
                 /* Store pci devices at mci for faster access */
diff --git a/drivers/firmware/efi/libstub/efistub.h b/drivers/firmware/efi/libstub/efistub.h
index e334a01cf92f..6b6548fda089 100644
--- a/drivers/firmware/efi/libstub/efistub.h
+++ b/drivers/firmware/efi/libstub/efistub.h
@@ -5,10 +5,6 @@
 /* error code which can't be mistaken for valid address */
 #define EFI_ERROR       (~0UL)
 
-#undef memcpy
-#undef memset
-#undef memmove
-
 void efi_char16_printk(efi_system_table_t *, efi_char16_t *);
 
 efi_status_t efi_open_volume(efi_system_table_t *sys_table_arg, void *__image,
diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
index b4fc9e4d24c6..8949b3f6f74d 100644
--- a/drivers/gpio/Kconfig
+++ b/drivers/gpio/Kconfig
@@ -356,7 +356,7 @@ config GPIO_PXA
 
 config GPIO_RCAR
         tristate "Renesas R-Car GPIO"
-        depends on ARM && (ARCH_SHMOBILE || COMPILE_TEST)
+        depends on ARCH_SHMOBILE || COMPILE_TEST
         select GPIOLIB_IRQCHIP
         help
           Say yes here to support GPIO on Renesas R-Car SoCs.
diff --git a/drivers/gpio/gpio-altera.c b/drivers/gpio/gpio-altera.c
index 9b7e0b3db387..1b44941574fa 100644
--- a/drivers/gpio/gpio-altera.c
+++ b/drivers/gpio/gpio-altera.c
@@ -201,8 +201,7 @@ static int altera_gpio_direction_output(struct gpio_chip *gc,
         return 0;
 }
 
-static void altera_gpio_irq_edge_handler(unsigned int irq,
-                                        struct irq_desc *desc)
+static void altera_gpio_irq_edge_handler(struct irq_desc *desc)
 {
         struct altera_gpio_chip *altera_gc;
         struct irq_chip *chip;
@@ -231,8 +230,7 @@ static void altera_gpio_irq_edge_handler(unsigned int irq,
 }
 
 
-static void altera_gpio_irq_leveL_high_handler(unsigned int irq,
-                                              struct irq_desc *desc)
+static void altera_gpio_irq_leveL_high_handler(struct irq_desc *desc)
 {
         struct altera_gpio_chip *altera_gc;
         struct irq_chip *chip;
diff --git a/drivers/gpio/gpio-bcm-kona.c b/drivers/gpio/gpio-bcm-kona.c
index 31b90ac15204..33a1f9779b86 100644
--- a/drivers/gpio/gpio-bcm-kona.c
+++ b/drivers/gpio/gpio-bcm-kona.c
@@ -433,7 +433,7 @@ static int bcm_kona_gpio_irq_set_type(struct irq_data *d, unsigned int type)
         return 0;
 }
 
-static void bcm_kona_gpio_irq_handler(unsigned int irq, struct irq_desc *desc)
+static void bcm_kona_gpio_irq_handler(struct irq_desc *desc)
 {
         void __iomem *reg_base;
         int bit, bank_id;
diff --git a/drivers/gpio/gpio-brcmstb.c b/drivers/gpio/gpio-brcmstb.c
index 9ea86d2ac054..4c64627c6bb5 100644
--- a/drivers/gpio/gpio-brcmstb.c
+++ b/drivers/gpio/gpio-brcmstb.c
@@ -236,7 +236,7 @@ static void brcmstb_gpio_irq_bank_handler(struct brcmstb_gpio_bank *bank)
 }
 
 /* Each UPG GIO block has one IRQ for all banks */
-static void brcmstb_gpio_irq_handler(unsigned int irq, struct irq_desc *desc)
+static void brcmstb_gpio_irq_handler(struct irq_desc *desc)
 {
         struct gpio_chip *gc = irq_desc_get_handler_data(desc);
         struct brcmstb_gpio_priv *priv = brcmstb_gpio_gc_to_priv(gc);
diff --git a/drivers/gpio/gpio-davinci.c b/drivers/gpio/gpio-davinci.c
index 94b0ab709721..5e715388803d 100644
--- a/drivers/gpio/gpio-davinci.c
+++ b/drivers/gpio/gpio-davinci.c
@@ -326,8 +326,7 @@ static struct irq_chip gpio_irqchip = {
         .flags          = IRQCHIP_SET_TYPE_MASKED,
 };
 
-static void
-gpio_irq_handler(unsigned __irq, struct irq_desc *desc)
+static void gpio_irq_handler(struct irq_desc *desc)
 {
         unsigned int irq = irq_desc_get_irq(desc);
         struct davinci_gpio_regs __iomem *g;
diff --git a/drivers/gpio/gpio-dwapb.c b/drivers/gpio/gpio-dwapb.c
index c5be4b9b8baf..fcd5b0acfc72 100644
--- a/drivers/gpio/gpio-dwapb.c
+++ b/drivers/gpio/gpio-dwapb.c
@@ -147,7 +147,7 @@ static u32 dwapb_do_irq(struct dwapb_gpio *gpio)
         return ret;
 }
 
-static void dwapb_irq_handler(u32 irq, struct irq_desc *desc)
+static void dwapb_irq_handler(struct irq_desc *desc)
 {
         struct dwapb_gpio *gpio = irq_desc_get_handler_data(desc);
         struct irq_chip *chip = irq_desc_get_chip(desc);
diff --git a/drivers/gpio/gpio-ep93xx.c b/drivers/gpio/gpio-ep93xx.c
index 9d90366ea259..3e3947b35c83 100644
--- a/drivers/gpio/gpio-ep93xx.c
+++ b/drivers/gpio/gpio-ep93xx.c
@@ -78,7 +78,7 @@ static void ep93xx_gpio_int_debounce(unsigned int irq, bool enable)
                 EP93XX_GPIO_REG(int_debounce_register_offset[port]));
 }
 
-static void ep93xx_gpio_ab_irq_handler(unsigned int irq, struct irq_desc *desc)
+static void ep93xx_gpio_ab_irq_handler(struct irq_desc *desc)
 {
         unsigned char status;
         int i;
@@ -100,8 +100,7 @@ static void ep93xx_gpio_ab_irq_handler(unsigned int irq, struct irq_desc *desc)
         }
 }
 
-static void ep93xx_gpio_f_irq_handler(unsigned int __irq,
-                                      struct irq_desc *desc)
+static void ep93xx_gpio_f_irq_handler(struct irq_desc *desc)
 {
         /*
          * map discontiguous hw irq range to continuous sw irq range:
diff --git a/drivers/gpio/gpio-intel-mid.c b/drivers/gpio/gpio-intel-mid.c
index aa28c65eb6b4..70097472b02c 100644
--- a/drivers/gpio/gpio-intel-mid.c
+++ b/drivers/gpio/gpio-intel-mid.c
@@ -301,7 +301,7 @@ static const struct pci_device_id intel_gpio_ids[] = {
 };
 MODULE_DEVICE_TABLE(pci, intel_gpio_ids);
 
-static void intel_mid_irq_handler(unsigned irq, struct irq_desc *desc)
+static void intel_mid_irq_handler(struct irq_desc *desc)
 {
         struct gpio_chip *gc = irq_desc_get_handler_data(desc);
         struct intel_mid_gpio *priv = to_intel_gpio_priv(gc);
diff --git a/drivers/gpio/gpio-lynxpoint.c b/drivers/gpio/gpio-lynxpoint.c
index 153af464c7a7..127c37b380ae 100644
--- a/drivers/gpio/gpio-lynxpoint.c
+++ b/drivers/gpio/gpio-lynxpoint.c
@@ -234,7 +234,7 @@ static int lp_gpio_direction_output(struct gpio_chip *chip,
         return 0;
 }
 
-static void lp_gpio_irq_handler(unsigned hwirq, struct irq_desc *desc)
+static void lp_gpio_irq_handler(struct irq_desc *desc)
 {
         struct irq_data *data = irq_desc_get_irq_data(desc);
         struct gpio_chip *gc = irq_desc_get_handler_data(desc);
diff --git a/drivers/gpio/gpio-mpc8xxx.c b/drivers/gpio/gpio-mpc8xxx.c
index 8ef7a12de983..48ef368347ab 100644
--- a/drivers/gpio/gpio-mpc8xxx.c
+++ b/drivers/gpio/gpio-mpc8xxx.c
@@ -194,7 +194,7 @@ static int mpc8xxx_gpio_to_irq(struct gpio_chip *gc, unsigned offset)
                 return -ENXIO;
 }
 
-static void mpc8xxx_gpio_irq_cascade(unsigned int irq, struct irq_desc *desc)
+static void mpc8xxx_gpio_irq_cascade(struct irq_desc *desc)
 {
         struct mpc8xxx_gpio_chip *mpc8xxx_gc = irq_desc_get_handler_data(desc);
         struct irq_chip *chip = irq_desc_get_chip(desc);
diff --git a/drivers/gpio/gpio-msic.c b/drivers/gpio/gpio-msic.c
index 7bcfb87a5fa6..22523aae8abe 100644
--- a/drivers/gpio/gpio-msic.c
+++ b/drivers/gpio/gpio-msic.c
@@ -232,7 +232,7 @@ static struct irq_chip msic_irqchip = {
         .irq_bus_sync_unlock    = msic_bus_sync_unlock,
 };
 
-static void msic_gpio_irq_handler(unsigned irq, struct irq_desc *desc)
+static void msic_gpio_irq_handler(struct irq_desc *desc)
 {
         struct irq_data *data = irq_desc_get_irq_data(desc);
         struct msic_gpio *mg = irq_data_get_irq_handler_data(data);
diff --git a/drivers/gpio/gpio-msm-v2.c b/drivers/gpio/gpio-msm-v2.c
index d2012cfb5571..4b4222145f10 100644
--- a/drivers/gpio/gpio-msm-v2.c
+++ b/drivers/gpio/gpio-msm-v2.c
@@ -305,7 +305,7 @@ static int msm_gpio_irq_set_type(struct irq_data *d, unsigned int flow_type)
  * which have been set as summary IRQ lines and which are triggered,
  * and to call their interrupt handlers.
  */
-static void msm_summary_irq_handler(unsigned int irq, struct irq_desc *desc)
+static void msm_summary_irq_handler(struct irq_desc *desc)
 {
         unsigned long i;
         struct irq_chip *chip = irq_desc_get_chip(desc);
diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c
index b396bf3bf294..df418b81456d 100644
--- a/drivers/gpio/gpio-mvebu.c
+++ b/drivers/gpio/gpio-mvebu.c
@@ -458,7 +458,7 @@ static int mvebu_gpio_irq_set_type(struct irq_data *d, unsigned int type)
         return 0;
 }
 
-static void mvebu_gpio_irq_handler(unsigned int __irq, struct irq_desc *desc)
+static void mvebu_gpio_irq_handler(struct irq_desc *desc)
 {
         struct mvebu_gpio_chip *mvchip = irq_desc_get_handler_data(desc);
         struct irq_chip *chip = irq_desc_get_chip(desc);
diff --git a/drivers/gpio/gpio-mxc.c b/drivers/gpio/gpio-mxc.c
index b752b560126e..b8dd847443c5 100644
--- a/drivers/gpio/gpio-mxc.c
+++ b/drivers/gpio/gpio-mxc.c
@@ -272,7 +272,7 @@ static void mxc_gpio_irq_handler(struct mxc_gpio_port *port, u32 irq_stat)
 }
 
 /* MX1 and MX3 has one interrupt *per* gpio port */
-static void mx3_gpio_irq_handler(u32 irq, struct irq_desc *desc)
+static void mx3_gpio_irq_handler(struct irq_desc *desc)
 {
         u32 irq_stat;
         struct mxc_gpio_port *port = irq_desc_get_handler_data(desc);
@@ -288,7 +288,7 @@ static void mx3_gpio_irq_handler(u32 irq, struct irq_desc *desc)
 }
 
 /* MX2 has one interrupt *for all* gpio ports */
-static void mx2_gpio_irq_handler(u32 irq, struct irq_desc *desc)
+static void mx2_gpio_irq_handler(struct irq_desc *desc)
 {
         u32 irq_msk, irq_stat;
         struct mxc_gpio_port *port;
@@ -339,13 +339,15 @@ static int gpio_set_wake_irq(struct irq_data *d, u32 enable)
         return 0;
 }
 
-static void mxc_gpio_init_gc(struct mxc_gpio_port *port, int irq_base)
+static int mxc_gpio_init_gc(struct mxc_gpio_port *port, int irq_base)
 {
         struct irq_chip_generic *gc;
         struct irq_chip_type *ct;
 
         gc = irq_alloc_generic_chip("gpio-mxc", 1, irq_base,
                                     port->base, handle_level_irq);
+        if (!gc)
+                return -ENOMEM;
         gc->private = port;
 
         ct = gc->chip_types;
@@ -360,6 +362,8 @@ static void mxc_gpio_init_gc(struct mxc_gpio_port *port, int irq_base)
 
         irq_setup_generic_chip(gc, IRQ_MSK(32), IRQ_GC_INIT_NESTED_LOCK,
                                IRQ_NOREQUEST, 0);
+
+        return 0;
 }
 
 static void mxc_gpio_get_hw(struct platform_device *pdev)
@@ -477,12 +481,16 @@ static int mxc_gpio_probe(struct platform_device *pdev)
         }
 
         /* gpio-mxc can be a generic irq chip */
-        mxc_gpio_init_gc(port, irq_base);
+        err = mxc_gpio_init_gc(port, irq_base);
+        if (err < 0)
+                goto out_irqdomain_remove;
 
         list_add_tail(&port->node, &mxc_gpio_ports);
 
         return 0;
 
+out_irqdomain_remove:
+        irq_domain_remove(port->domain);
 out_irqdesc_free:
         irq_free_descs(irq_base, 32);
 out_gpiochip_remove:
diff --git a/drivers/gpio/gpio-mxs.c b/drivers/gpio/gpio-mxs.c
index b7f383eb18d9..a4288f428819 100644
--- a/drivers/gpio/gpio-mxs.c
+++ b/drivers/gpio/gpio-mxs.c
@@ -154,7 +154,7 @@ static void mxs_flip_edge(struct mxs_gpio_port *port, u32 gpio)
 }
 
 /* MXS has one interrupt *per* gpio port */
-static void mxs_gpio_irq_handler(u32 irq, struct irq_desc *desc)
+static void mxs_gpio_irq_handler(struct irq_desc *desc)
 {
         u32 irq_stat;
         struct mxs_gpio_port *port = irq_desc_get_handler_data(desc);
@@ -196,13 +196,16 @@ static int mxs_gpio_set_wake_irq(struct irq_data *d, unsigned int enable)
         return 0;
 }
 
-static void __init mxs_gpio_init_gc(struct mxs_gpio_port *port, int irq_base)
+static int __init mxs_gpio_init_gc(struct mxs_gpio_port *port, int irq_base)
 {
         struct irq_chip_generic *gc;
         struct irq_chip_type *ct;
 
         gc = irq_alloc_generic_chip("gpio-mxs", 1, irq_base,
                                     port->base, handle_level_irq);
+        if (!gc)
+                return -ENOMEM;
+
         gc->private = port;
 
         ct = gc->chip_types;
@@ -216,6 +219,8 @@ static void __init mxs_gpio_init_gc(struct mxs_gpio_port *port, int irq_base)
 
         irq_setup_generic_chip(gc, IRQ_MSK(32), IRQ_GC_INIT_NESTED_LOCK,
                                IRQ_NOREQUEST, 0);
+
+        return 0;
 }
 
 static int mxs_gpio_to_irq(struct gpio_chip *gc, unsigned offset)
@@ -317,7 +322,9 @@ static int mxs_gpio_probe(struct platform_device *pdev)
         }
 
         /* gpio-mxs can be a generic irq chip */
-        mxs_gpio_init_gc(port, irq_base);
+        err = mxs_gpio_init_gc(port, irq_base);
+        if (err < 0)
+                goto out_irqdomain_remove;
 
         /* setup one handler for each entry */
         irq_set_chained_handler_and_data(port->irq, mxs_gpio_irq_handler,
@@ -343,6 +350,8 @@ static int mxs_gpio_probe(struct platform_device *pdev)
 
 out_bgpio_remove:
         bgpio_remove(&port->bgc);
+out_irqdomain_remove:
+        irq_domain_remove(port->domain);
 out_irqdesc_free:
         irq_free_descs(irq_base, 32);
         return err;
diff --git a/drivers/gpio/gpio-omap.c b/drivers/gpio/gpio-omap.c
index 2ae0d47e9554..5236db161e76 100644
--- a/drivers/gpio/gpio-omap.c
+++ b/drivers/gpio/gpio-omap.c
@@ -709,7 +709,7 @@ static void omap_gpio_free(struct gpio_chip *chip, unsigned offset)
  * line's interrupt handler has been run, we may miss some nested
  * interrupts.
  */
-static void omap_gpio_irq_handler(unsigned int irq, struct irq_desc *desc)
+static void omap_gpio_irq_handler(struct irq_desc *desc)
 {
         void __iomem *isr_reg = NULL;
         u32 isr;
@@ -1098,7 +1098,6 @@ static int omap_gpio_chip_init(struct gpio_bank *bank, struct irq_chip *irqc)
         } else {
                 bank->chip.label = "gpio";
                 bank->chip.base = gpio;
-                gpio += bank->width;
         }
         bank->chip.ngpio = bank->width;
 
@@ -1108,6 +1107,9 @@ static int omap_gpio_chip_init(struct gpio_bank *bank, struct irq_chip *irqc)
                 return ret;
         }
 
+        if (!bank->is_mpuio)
+                gpio += bank->width;
+
 #ifdef CONFIG_ARCH_OMAP1
         /*
          * REVISIT: Once we have OMAP1 supporting SPARSE_IRQ, we can drop
@@ -1253,8 +1255,11 @@ static int omap_gpio_probe(struct platform_device *pdev)
         omap_gpio_mod_init(bank);
 
         ret = omap_gpio_chip_init(bank, irqc);
-        if (ret)
+        if (ret) {
+                pm_runtime_put_sync(bank->dev);
+                pm_runtime_disable(bank->dev);
                 return ret;
+        }
 
         omap_gpio_show_rev(bank);
 
diff --git a/drivers/gpio/gpio-pl061.c b/drivers/gpio/gpio-pl061.c
index 04756130437f..229ef653e0f8 100644
--- a/drivers/gpio/gpio-pl061.c
+++ b/drivers/gpio/gpio-pl061.c
@@ -187,7 +187,7 @@ static int pl061_irq_type(struct irq_data *d, unsigned trigger)
         return 0;
 }
 
-static void pl061_irq_handler(unsigned irq, struct irq_desc *desc)
+static void pl061_irq_handler(struct irq_desc *desc)
 {
         unsigned long pending;
         int offset;
diff --git a/drivers/gpio/gpio-pxa.c b/drivers/gpio/gpio-pxa.c
index 55a11de3d5b7..df2ce550f309 100644
--- a/drivers/gpio/gpio-pxa.c
+++ b/drivers/gpio/gpio-pxa.c
@@ -401,7 +401,7 @@ static int pxa_gpio_irq_type(struct irq_data *d, unsigned int type)
         return 0;
 }
 
-static void pxa_gpio_demux_handler(unsigned int irq, struct irq_desc *desc)
+static void pxa_gpio_demux_handler(struct irq_desc *desc)
 {
         struct pxa_gpio_chip *c;
         int loop, gpio, gpio_base, n;
diff --git a/drivers/gpio/gpio-sa1100.c b/drivers/gpio/gpio-sa1100.c
index 67bd2f5d89e8..990fa9023e22 100644
--- a/drivers/gpio/gpio-sa1100.c
+++ b/drivers/gpio/gpio-sa1100.c
@@ -172,8 +172,7 @@ static struct irq_domain *sa1100_gpio_irqdomain;
  * irq_controller_lock held, and IRQs disabled.  Decode the IRQ
  * and call the handler.
  */
-static void
-sa1100_gpio_handler(unsigned int __irq, struct irq_desc *desc)
+static void sa1100_gpio_handler(struct irq_desc *desc)
 {
         unsigned int irq, mask;
 
diff --git a/drivers/gpio/gpio-sx150x.c b/drivers/gpio/gpio-sx150x.c
index 458d9d7952b8..9c6b96707c9f 100644
--- a/drivers/gpio/gpio-sx150x.c
+++ b/drivers/gpio/gpio-sx150x.c
@@ -706,4 +706,3 @@ module_exit(sx150x_exit);
 MODULE_AUTHOR("Gregory Bean <gbean@codeaurora.org>");
 MODULE_DESCRIPTION("Driver for Semtech SX150X I2C GPIO Expanders");
 MODULE_LICENSE("GPL v2");
-MODULE_ALIAS("i2c:sx150x");
diff --git a/drivers/gpio/gpio-tegra.c b/drivers/gpio/gpio-tegra.c
index 9b14aafb576d..027e5f47dd28 100644
--- a/drivers/gpio/gpio-tegra.c
+++ b/drivers/gpio/gpio-tegra.c
@@ -266,7 +266,7 @@ static void tegra_gpio_irq_shutdown(struct irq_data *d)
         gpiochip_unlock_as_irq(&tegra_gpio_chip, gpio);
 }
 
-static void tegra_gpio_irq_handler(unsigned int irq, struct irq_desc *desc)
+static void tegra_gpio_irq_handler(struct irq_desc *desc)
 {
         int port;
         int pin;
diff --git a/drivers/gpio/gpio-timberdale.c b/drivers/gpio/gpio-timberdale.c
index 5a492054589f..30653e6319e9 100644
--- a/drivers/gpio/gpio-timberdale.c
+++ b/drivers/gpio/gpio-timberdale.c
@@ -192,7 +192,7 @@ out:
         return ret;
 }
 
-static void timbgpio_irq(unsigned int irq, struct irq_desc *desc)
+static void timbgpio_irq(struct irq_desc *desc)
 {
         struct timbgpio *tgpio = irq_desc_get_handler_data(desc);
         struct irq_data *data = irq_desc_get_irq_data(desc);
diff --git a/drivers/gpio/gpio-tz1090.c b/drivers/gpio/gpio-tz1090.c
index bbac92ae4c32..87bb1b1eee8d 100644
--- a/drivers/gpio/gpio-tz1090.c
+++ b/drivers/gpio/gpio-tz1090.c
@@ -375,7 +375,7 @@ static int gpio_set_irq_wake(struct irq_data *data, unsigned int on)
 #define gpio_set_irq_wake NULL
 #endif
 
-static void tz1090_gpio_irq_handler(unsigned int irq, struct irq_desc *desc)
+static void tz1090_gpio_irq_handler(struct irq_desc *desc)
 {
         irq_hw_number_t hw;
         unsigned int irq_stat, irq_no;
@@ -400,7 +400,7 @@ static void tz1090_gpio_irq_handler(unsigned int irq, struct irq_desc *desc)
                                 == IRQ_TYPE_EDGE_BOTH)
                         tz1090_gpio_irq_next_edge(bank, hw);
 
-                generic_handle_irq_desc(irq_no, child_desc);
+                generic_handle_irq_desc(child_desc);
         }
 }
 
diff --git a/drivers/gpio/gpio-vf610.c b/drivers/gpio/gpio-vf610.c
index 3d5714d4f405..069f9e4b7daa 100644
--- a/drivers/gpio/gpio-vf610.c
+++ b/drivers/gpio/gpio-vf610.c
@@ -120,7 +120,7 @@ static int vf610_gpio_direction_output(struct gpio_chip *chip, unsigned gpio,
         return pinctrl_gpio_direction_output(chip->base + gpio);
 }
 
-static void vf610_gpio_irq_handler(u32 irq, struct irq_desc *desc)
+static void vf610_gpio_irq_handler(struct irq_desc *desc)
 {
         struct vf610_gpio_port *port = irq_desc_get_handler_data(desc);
         struct irq_chip *chip = irq_desc_get_chip(desc);
@@ -176,9 +176,9 @@ static int vf610_gpio_irq_set_type(struct irq_data *d, u32 type)
         port->irqc[d->hwirq] = irqc;
 
         if (type & IRQ_TYPE_LEVEL_MASK)
-                __irq_set_handler_locked(d->irq, handle_level_irq);
+                irq_set_handler_locked(d, handle_level_irq);
         else
-                __irq_set_handler_locked(d->irq, handle_edge_irq);
+                irq_set_handler_locked(d, handle_edge_irq);
 
         return 0;
 }
diff --git a/drivers/gpio/gpio-zx.c b/drivers/gpio/gpio-zx.c
index 12ee1969298c..4b8a26910705 100644
--- a/drivers/gpio/gpio-zx.c
+++ b/drivers/gpio/gpio-zx.c
@@ -177,7 +177,7 @@ static int zx_irq_type(struct irq_data *d, unsigned trigger)
         return 0;
 }
 
-static void zx_irq_handler(unsigned irq, struct irq_desc *desc)
+static void zx_irq_handler(struct irq_desc *desc)
 {
         unsigned long pending;
         int offset;
diff --git a/drivers/gpio/gpio-zynq.c b/drivers/gpio/gpio-zynq.c
index 27348e7cb705..1d1a5865ede9 100644
--- a/drivers/gpio/gpio-zynq.c
+++ b/drivers/gpio/gpio-zynq.c
@@ -514,7 +514,7 @@ static void zynq_gpio_handle_bank_irq(struct zynq_gpio *gpio,
  * application for that pin.
  * Note: A bug is reported if no handler is set for the gpio pin.
  */
-static void zynq_gpio_irqhandler(unsigned int irq, struct irq_desc *desc)
+static void zynq_gpio_irqhandler(struct irq_desc *desc)
 {
         u32 int_sts, int_enb;
         unsigned int bank_num;
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 980c1f87866a..5db3445552b1 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -1174,15 +1174,16 @@ EXPORT_SYMBOL_GPL(gpiod_is_active_low);
  * that the GPIO was actually requested.
  */
 
-static bool _gpiod_get_raw_value(const struct gpio_desc *desc)
+static int _gpiod_get_raw_value(const struct gpio_desc *desc)
 {
         struct gpio_chip        *chip;
-        bool value;
         int offset;
+        int value;
 
         chip = desc->chip;
         offset = gpio_chip_hwgpio(desc);
-        value = chip->get ? chip->get(chip, offset) : false;
+        value = chip->get ? chip->get(chip, offset) : -EIO;
+        value = value < 0 ? value : !!value;
         trace_gpio_value(desc_to_gpio(desc), 1, value);
         return value;
 }
@@ -1192,7 +1193,7 @@ static bool _gpiod_get_raw_value(const struct gpio_desc *desc)
  * @desc: gpio whose value will be returned
  *
  * Return the GPIO's raw value, i.e. the value of the physical line disregarding
- * its ACTIVE_LOW status.
+ * its ACTIVE_LOW status, or negative errno on failure.
  *
  * This function should be called from contexts where we cannot sleep, and will
  * complain if the GPIO chip functions potentially sleep.
@@ -1212,7 +1213,7 @@ EXPORT_SYMBOL_GPL(gpiod_get_raw_value);
  * @desc: gpio whose value will be returned
  *
  * Return the GPIO's logical value, i.e. taking the ACTIVE_LOW status into
- * account.
+ * account, or negative errno on failure.
  *
  * This function should be called from contexts where we cannot sleep, and will
  * complain if the GPIO chip functions potentially sleep.
@@ -1226,6 +1227,9 @@ int gpiod_get_value(const struct gpio_desc *desc)
         WARN_ON(desc->chip->can_sleep);
 
         value = _gpiod_get_raw_value(desc);
+        if (value < 0)
+                return value;
+
         if (test_bit(FLAG_ACTIVE_LOW, &desc->flags))
                 value = !value;
 
@@ -1548,7 +1552,7 @@ EXPORT_SYMBOL_GPL(gpiochip_unlock_as_irq);
  * @desc: gpio whose value will be returned
  *
  * Return the GPIO's raw value, i.e. the value of the physical line disregarding
- * its ACTIVE_LOW status.
+ * its ACTIVE_LOW status, or negative errno on failure.
  *
  * This function is to be called from contexts that can sleep.
  */
@@ -1566,7 +1570,7 @@ EXPORT_SYMBOL_GPL(gpiod_get_raw_value_cansleep);
  * @desc: gpio whose value will be returned
  *
  * Return the GPIO's logical value, i.e. taking the ACTIVE_LOW status into
- * account.
+ * account, or negative errno on failure.
  *
  * This function is to be called from contexts that can sleep.
  */
@@ -1579,6 +1583,9 @@ int gpiod_get_value_cansleep(const struct gpio_desc *desc)
                 return 0;
 
         value = _gpiod_get_raw_value(desc);
+        if (value < 0)
+                return value;
+
         if (test_bit(FLAG_ACTIVE_LOW, &desc->flags))
                 value = !value;
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
index 668939a14206..6647fb26ef25 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
@@ -82,6 +82,7 @@ extern int amdgpu_vm_block_size;
 extern int amdgpu_enable_scheduler;
 extern int amdgpu_sched_jobs;
 extern int amdgpu_sched_hw_submission;
+extern int amdgpu_enable_semaphores;
 
 #define AMDGPU_WAIT_IDLE_TIMEOUT_IN_MS          3000
 #define AMDGPU_MAX_USEC_TIMEOUT                 100000  /* 100 ms */
@@ -432,7 +433,7 @@ int amdgpu_fence_driver_init(struct amdgpu_device *adev);
 void amdgpu_fence_driver_fini(struct amdgpu_device *adev);
 void amdgpu_fence_driver_force_completion(struct amdgpu_device *adev);
 
-void amdgpu_fence_driver_init_ring(struct amdgpu_ring *ring);
+int amdgpu_fence_driver_init_ring(struct amdgpu_ring *ring);
 int amdgpu_fence_driver_start_ring(struct amdgpu_ring *ring,
                                    struct amdgpu_irq_src *irq_src,
                                    unsigned irq_type);
@@ -890,7 +891,7 @@ struct amdgpu_ring {
         struct amdgpu_device            *adev;
         const struct amdgpu_ring_funcs  *funcs;
         struct amdgpu_fence_driver      fence_drv;
-        struct amd_gpu_scheduler        *scheduler;
+        struct amd_gpu_scheduler        sched;
 
         spinlock_t              fence_lock;
         struct mutex            *ring_lock;
@@ -1201,8 +1202,6 @@ struct amdgpu_gfx {
         struct amdgpu_irq_src           priv_inst_irq;
         /* gfx status */
         uint32_t gfx_current_status;
-        /* sync signal for const engine */
-        unsigned ce_sync_offs;
         /* ce ram size*/
         unsigned ce_ram_size;
 };
@@ -1274,8 +1273,10 @@ struct amdgpu_job {
         uint32_t                num_ibs;
         struct mutex            job_lock;
         struct amdgpu_user_fence uf;
-        int (*free_job)(struct amdgpu_job *sched_job);
+        int (*free_job)(struct amdgpu_job *job);
 };
+#define to_amdgpu_job(sched_job)                \
+                container_of((sched_job), struct amdgpu_job, base)
 
 static inline u32 amdgpu_get_ib_value(struct amdgpu_cs_parser *p, uint32_t ib_idx, int idx)
 {
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
index 496ed2192eba..84d68d658f8a 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
@@ -183,7 +183,7 @@ int alloc_gtt_mem(struct kgd_dev *kgd, size_t size,
                 return -ENOMEM;
 
         r = amdgpu_bo_create(rdev, size, PAGE_SIZE, true, AMDGPU_GEM_DOMAIN_GTT,
-                        AMDGPU_GEM_CREATE_CPU_GTT_USWC, NULL, &(*mem)->bo);
+                             AMDGPU_GEM_CREATE_CPU_GTT_USWC, NULL, NULL, &(*mem)->bo);
         if (r) {
                 dev_err(rdev->dev,
                         "failed to allocate BO for amdkfd (%d)\n", r);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_benchmark.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_benchmark.c
index 98d59ee640ce..cd639c362df3 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_benchmark.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_benchmark.c
@@ -79,7 +79,8 @@ static void amdgpu_benchmark_move(struct amdgpu_device *adev, unsigned size,
         int time;
 
         n = AMDGPU_BENCHMARK_ITERATIONS;
-        r = amdgpu_bo_create(adev, size, PAGE_SIZE, true, sdomain, 0, NULL, &sobj);
+        r = amdgpu_bo_create(adev, size, PAGE_SIZE, true, sdomain, 0, NULL,
+                             NULL, &sobj);
         if (r) {
                 goto out_cleanup;
         }
@@ -91,7 +92,8 @@ static void amdgpu_benchmark_move(struct amdgpu_device *adev, unsigned size,
         if (r) {
                 goto out_cleanup;
         }
-        r = amdgpu_bo_create(adev, size, PAGE_SIZE, true, ddomain, 0, NULL, &dobj);
+        r = amdgpu_bo_create(adev, size, PAGE_SIZE, true, ddomain, 0, NULL,
+                             NULL, &dobj);
         if (r) {
                 goto out_cleanup;
         }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
index 6b1243f9f86d..1c3fc99c5465 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
@@ -86,7 +86,7 @@ static int amdgpu_cgs_gmap_kmem(void *cgs_device, void *kmem,
 
         struct sg_table *sg = drm_prime_pages_to_sg(&kmem_page, npages);
         ret = amdgpu_bo_create(adev, size, PAGE_SIZE, false,
-                               AMDGPU_GEM_DOMAIN_GTT, 0, sg, &bo);
+                               AMDGPU_GEM_DOMAIN_GTT, 0, sg, NULL, &bo);
         if (ret)
                 return ret;
         ret = amdgpu_bo_reserve(bo, false);
@@ -197,7 +197,8 @@ static int amdgpu_cgs_alloc_gpu_mem(void *cgs_device,
 
         ret = amdgpu_bo_create_restricted(adev, size, PAGE_SIZE,
                                           true, domain, flags,
-                                          NULL, &placement, &obj);
+                                          NULL, &placement, NULL,
+                                          &obj);
         if (ret) {
                 DRM_ERROR("(%d) bo create failed\n", ret);
                 return ret;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
index 3b355aeb62fd..749420f1ea6f 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
@@ -154,42 +154,41 @@ int amdgpu_cs_parser_init(struct amdgpu_cs_parser *p, void *data)
 {
         union drm_amdgpu_cs *cs = data;
         uint64_t *chunk_array_user;
-        uint64_t *chunk_array = NULL;
+        uint64_t *chunk_array;
         struct amdgpu_fpriv *fpriv = p->filp->driver_priv;
         unsigned size, i;
-        int r = 0;
+        int ret;
 
-        if (!cs->in.num_chunks)
-                goto out;
+        if (cs->in.num_chunks == 0)
+                return 0;
+
+        chunk_array = kmalloc_array(cs->in.num_chunks, sizeof(uint64_t), GFP_KERNEL);
+        if (!chunk_array)
+                return -ENOMEM;
 
         p->ctx = amdgpu_ctx_get(fpriv, cs->in.ctx_id);
         if (!p->ctx) {
-                r = -EINVAL;
-                goto out;
+                ret = -EINVAL;
+                goto free_chunk;
         }
+
         p->bo_list = amdgpu_bo_list_get(fpriv, cs->in.bo_list_handle);
 
         /* get chunks */
         INIT_LIST_HEAD(&p->validated);
-        chunk_array = kmalloc_array(cs->in.num_chunks, sizeof(uint64_t), GFP_KERNEL);
-        if (chunk_array == NULL) {
-                r = -ENOMEM;
-                goto out;
-        }
-
         chunk_array_user = (uint64_t __user *)(cs->in.chunks);
         if (copy_from_user(chunk_array, chunk_array_user,
                            sizeof(uint64_t)*cs->in.num_chunks)) {
-                r = -EFAULT;
-                goto out;
+                ret = -EFAULT;
+                goto put_bo_list;
         }
 
         p->nchunks = cs->in.num_chunks;
         p->chunks = kmalloc_array(p->nchunks, sizeof(struct amdgpu_cs_chunk),
                             GFP_KERNEL);
-        if (p->chunks == NULL) {
-                r = -ENOMEM;
-                goto out;
+        if (!p->chunks) {
+                ret = -ENOMEM;
+                goto put_bo_list;
         }
 
         for (i = 0; i < p->nchunks; i++) {
@@ -200,8 +199,9 @@ int amdgpu_cs_parser_init(struct amdgpu_cs_parser *p, void *data)
                 chunk_ptr = (void __user *)chunk_array[i];
                 if (copy_from_user(&user_chunk, chunk_ptr,
                                        sizeof(struct drm_amdgpu_cs_chunk))) {
-                        r = -EFAULT;
-                        goto out;
+                        ret = -EFAULT;
+                        i--;
+                        goto free_partial_kdata;
                 }
                 p->chunks[i].chunk_id = user_chunk.chunk_id;
                 p->chunks[i].length_dw = user_chunk.length_dw;
@@ -212,13 +212,14 @@ int amdgpu_cs_parser_init(struct amdgpu_cs_parser *p, void *data)
 
                 p->chunks[i].kdata = drm_malloc_ab(size, sizeof(uint32_t));
                 if (p->chunks[i].kdata == NULL) {
-                        r = -ENOMEM;
-                        goto out;
+                        ret = -ENOMEM;
+                        i--;
+                        goto free_partial_kdata;
                 }
                 size *= sizeof(uint32_t);
                 if (copy_from_user(p->chunks[i].kdata, cdata, size)) {
-                        r = -EFAULT;
-                        goto out;
+                        ret = -EFAULT;
+                        goto free_partial_kdata;
                 }
 
                 switch (p->chunks[i].chunk_id) {
@@ -238,15 +239,15 @@ int amdgpu_cs_parser_init(struct amdgpu_cs_parser *p, void *data)
                                 gobj = drm_gem_object_lookup(p->adev->ddev,
                                                              p->filp, handle);
                                 if (gobj == NULL) {
-                                        r = -EINVAL;
-                                        goto out;
+                                        ret = -EINVAL;
+                                        goto free_partial_kdata;
                                 }
 
                                 p->uf.bo = gem_to_amdgpu_bo(gobj);
                                 p->uf.offset = fence_data->offset;
                         } else {
-                                r = -EINVAL;
-                                goto out;
+                                ret = -EINVAL;
+                                goto free_partial_kdata;
                         }
                         break;
 
@@ -254,19 +255,35 @@ int amdgpu_cs_parser_init(struct amdgpu_cs_parser *p, void *data)
                         break;
 
                 default:
-                        r = -EINVAL;
-                        goto out;
+                        ret = -EINVAL;
+                        goto free_partial_kdata;
                 }
         }
 
 
         p->ibs = kcalloc(p->num_ibs, sizeof(struct amdgpu_ib), GFP_KERNEL);
-        if (!p->ibs)
-                r = -ENOMEM;
+        if (!p->ibs) {
+                ret = -ENOMEM;
+                goto free_all_kdata;
+        }
 
-out:
         kfree(chunk_array);
-        return r;
+        return 0;
+
+free_all_kdata:
+        i = p->nchunks - 1;
+free_partial_kdata:
+        for (; i >= 0; i--)
+                drm_free_large(p->chunks[i].kdata);
+        kfree(p->chunks);
+put_bo_list:
+        if (p->bo_list)
+                amdgpu_bo_list_put(p->bo_list);
+        amdgpu_ctx_put(p->ctx);
+free_chunk:
+        kfree(chunk_array);
+
+        return ret;
 }
 
 /* Returns how many bytes TTM can move per IB.
@@ -321,25 +338,17 @@ static u64 amdgpu_cs_get_threshold_for_moves(struct amdgpu_device *adev)
         return max(bytes_moved_threshold, 1024*1024ull);
 }
 
-int amdgpu_cs_list_validate(struct amdgpu_cs_parser *p)
+int amdgpu_cs_list_validate(struct amdgpu_device *adev,
+                            struct amdgpu_vm *vm,
+                            struct list_head *validated)
 {
-        struct amdgpu_fpriv *fpriv = p->filp->driver_priv;
-        struct amdgpu_vm *vm = &fpriv->vm;
-        struct amdgpu_device *adev = p->adev;
         struct amdgpu_bo_list_entry *lobj;
-        struct list_head duplicates;
         struct amdgpu_bo *bo;
         u64 bytes_moved = 0, initial_bytes_moved;
         u64 bytes_moved_threshold = amdgpu_cs_get_threshold_for_moves(adev);
         int r;
 
-        INIT_LIST_HEAD(&duplicates);
-        r = ttm_eu_reserve_buffers(&p->ticket, &p->validated, true, &duplicates);
-        if (unlikely(r != 0)) {
-                return r;
-        }
-
-        list_for_each_entry(lobj, &p->validated, tv.head) {
+        list_for_each_entry(lobj, validated, tv.head) {
                 bo = lobj->robj;
                 if (!bo->pin_count) {
                         u32 domain = lobj->prefered_domains;
@@ -373,7 +382,6 @@ int amdgpu_cs_list_validate(struct amdgpu_cs_parser *p)
                                         domain = lobj->allowed_domains;
                                         goto retry;
                                 }
-                                ttm_eu_backoff_reservation(&p->ticket, &p->validated);
                                 return r;
                         }
                 }
@@ -386,6 +394,7 @@ static int amdgpu_cs_parser_relocs(struct amdgpu_cs_parser *p)
 {
         struct amdgpu_fpriv *fpriv = p->filp->driver_priv;
         struct amdgpu_cs_buckets buckets;
+        struct list_head duplicates;
         bool need_mmap_lock = false;
         int i, r;
 
@@ -405,8 +414,22 @@ static int amdgpu_cs_parser_relocs(struct amdgpu_cs_parser *p)
         if (need_mmap_lock)
                 down_read(&current->mm->mmap_sem);
 
-        r = amdgpu_cs_list_validate(p);
+        INIT_LIST_HEAD(&duplicates);
+        r = ttm_eu_reserve_buffers(&p->ticket, &p->validated, true, &duplicates);
+        if (unlikely(r != 0))
+                goto error_reserve;
+
+        r = amdgpu_cs_list_validate(p->adev, &fpriv->vm, &p->validated);
+        if (r)
+                goto error_validate;
+
+        r = amdgpu_cs_list_validate(p->adev, &fpriv->vm, &duplicates);
+
+error_validate:
+        if (r)
+                ttm_eu_backoff_reservation(&p->ticket, &p->validated);
 
+error_reserve:
         if (need_mmap_lock)
                 up_read(&current->mm->mmap_sem);
 
@@ -772,15 +795,15 @@ static int amdgpu_cs_dependencies(struct amdgpu_device *adev,
         return 0;
 }
 
-static int amdgpu_cs_free_job(struct amdgpu_job *sched_job)
+static int amdgpu_cs_free_job(struct amdgpu_job *job)
 {
         int i;
-        if (sched_job->ibs)
-                for (i = 0; i < sched_job->num_ibs; i++)
-                        amdgpu_ib_free(sched_job->adev, &sched_job->ibs[i]);
-        kfree(sched_job->ibs);
-        if (sched_job->uf.bo)
-                drm_gem_object_unreference_unlocked(&sched_job->uf.bo->gem_base);
+        if (job->ibs)
+                for (i = 0; i < job->num_ibs; i++)
+                        amdgpu_ib_free(job->adev, &job->ibs[i]);
+        kfree(job->ibs);
+        if (job->uf.bo)
+                drm_gem_object_unreference_unlocked(&job->uf.bo->gem_base);
         return 0;
 }
 
@@ -804,7 +827,7 @@ int amdgpu_cs_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
         r = amdgpu_cs_parser_init(parser, data);
         if (r) {
                 DRM_ERROR("Failed to initialize parser !\n");
-                amdgpu_cs_parser_fini(parser, r, false);
+                kfree(parser);
                 up_read(&adev->exclusive_lock);
                 r = amdgpu_cs_handle_lockup(adev, r);
                 return r;
@@ -842,7 +865,7 @@ int amdgpu_cs_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
                 job = kzalloc(sizeof(struct amdgpu_job), GFP_KERNEL);
                 if (!job)
                         return -ENOMEM;
-                job->base.sched = ring->scheduler;
+                job->base.sched = &ring->sched;
                 job->base.s_entity = &parser->ctx->rings[ring->idx].entity;
                 job->adev = parser->adev;
                 job->ibs = parser->ibs;
@@ -857,7 +880,7 @@ int amdgpu_cs_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
 
                 job->free_job = amdgpu_cs_free_job;
                 mutex_lock(&job->job_lock);
-                r = amd_sched_entity_push_job((struct amd_sched_job *)job);
+                r = amd_sched_entity_push_job(&job->base);
                 if (r) {
                         mutex_unlock(&job->job_lock);
                         amdgpu_cs_free_job(job);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
index 20cbc4eb5a6f..e0b80ccdfe8a 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
@@ -43,10 +43,10 @@ int amdgpu_ctx_init(struct amdgpu_device *adev, bool kernel,
                 for (i = 0; i < adev->num_rings; i++) {
                         struct amd_sched_rq *rq;
                         if (kernel)
-                                rq = &adev->rings[i]->scheduler->kernel_rq;
+                                rq = &adev->rings[i]->sched.kernel_rq;
                         else
-                                rq = &adev->rings[i]->scheduler->sched_rq;
-                        r = amd_sched_entity_init(adev->rings[i]->scheduler,
+                                rq = &adev->rings[i]->sched.sched_rq;
+                        r = amd_sched_entity_init(&adev->rings[i]->sched,
                                                   &ctx->rings[i].entity,
                                                   rq, amdgpu_sched_jobs);
                         if (r)
@@ -55,7 +55,7 @@ int amdgpu_ctx_init(struct amdgpu_device *adev, bool kernel,
 
                 if (i < adev->num_rings) {
                         for (j = 0; j < i; j++)
-                                amd_sched_entity_fini(adev->rings[j]->scheduler,
+                                amd_sched_entity_fini(&adev->rings[j]->sched,
                                                       &ctx->rings[j].entity);
                         kfree(ctx);
                         return r;
@@ -75,7 +75,7 @@ void amdgpu_ctx_fini(struct amdgpu_ctx *ctx)
 
         if (amdgpu_enable_scheduler) {
                 for (i = 0; i < adev->num_rings; i++)
-                        amd_sched_entity_fini(adev->rings[i]->scheduler,
+                        amd_sched_entity_fini(&adev->rings[i]->sched,
                                               &ctx->rings[i].entity);
         }
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 6ff6ae945794..6068d8207d10 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -246,7 +246,7 @@ static int amdgpu_vram_scratch_init(struct amdgpu_device *adev)
                 r = amdgpu_bo_create(adev, AMDGPU_GPU_PAGE_SIZE,
                                      PAGE_SIZE, true, AMDGPU_GEM_DOMAIN_VRAM,
                                      AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED,
-                                     NULL, &adev->vram_scratch.robj);
+                                     NULL, NULL, &adev->vram_scratch.robj);
                 if (r) {
                         return r;
                 }
@@ -449,7 +449,8 @@ static int amdgpu_wb_init(struct amdgpu_device *adev)
 
         if (adev->wb.wb_obj == NULL) {
                 r = amdgpu_bo_create(adev, AMDGPU_MAX_WB * 4, PAGE_SIZE, true,
-                                     AMDGPU_GEM_DOMAIN_GTT, 0,  NULL, &adev->wb.wb_obj);
+                                     AMDGPU_GEM_DOMAIN_GTT, 0,  NULL, NULL,
+                                     &adev->wb.wb_obj);
                 if (r) {
                         dev_warn(adev->dev, "(%d) create WB bo failed\n", r);
                         return r;
@@ -1650,9 +1651,11 @@ int amdgpu_suspend_kms(struct drm_device *dev, bool suspend, bool fbcon)
         drm_kms_helper_poll_disable(dev);
 
         /* turn off display hw */
+        drm_modeset_lock_all(dev);
         list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
                 drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF);
         }
+        drm_modeset_unlock_all(dev);
 
         /* unpin the front buffers */
         list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
@@ -1747,9 +1750,11 @@ int amdgpu_resume_kms(struct drm_device *dev, bool resume, bool fbcon)
         if (fbcon) {
                 drm_helper_resume_force_mode(dev);
                 /* turn on display hw */
+                drm_modeset_lock_all(dev);
                 list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
                         drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON);
                 }
+                drm_modeset_unlock_all(dev);
         }
 
         drm_kms_helper_poll_enable(dev);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
index 0fcc0bd1622c..adb48353f2e1 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
@@ -79,6 +79,7 @@ int amdgpu_exp_hw_support = 0;
 int amdgpu_enable_scheduler = 0;
 int amdgpu_sched_jobs = 16;
 int amdgpu_sched_hw_submission = 2;
+int amdgpu_enable_semaphores = 1;
 
 MODULE_PARM_DESC(vramlimit, "Restrict VRAM for testing, in megabytes");
 module_param_named(vramlimit, amdgpu_vram_limit, int, 0600);
@@ -152,6 +153,9 @@ module_param_named(sched_jobs, amdgpu_sched_jobs, int, 0444);
 MODULE_PARM_DESC(sched_hw_submission, "the max number of HW submissions (default 2)");
 module_param_named(sched_hw_submission, amdgpu_sched_hw_submission, int, 0444);
 
+MODULE_PARM_DESC(enable_semaphores, "Enable semaphores (1 = enable (default), 0 = disable)");
+module_param_named(enable_semaphores, amdgpu_enable_semaphores, int, 0644);
+
 static struct pci_device_id pciidlist[] = {
 #ifdef CONFIG_DRM_AMDGPU_CIK
         /* Kaveri */
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
index 1be2bd6d07ea..b3fc26c59787 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
@@ -609,9 +609,9 @@ int amdgpu_fence_driver_start_ring(struct amdgpu_ring *ring,
  * Init the fence driver for the requested ring (all asics).
  * Helper function for amdgpu_fence_driver_init().
  */
-void amdgpu_fence_driver_init_ring(struct amdgpu_ring *ring)
+int amdgpu_fence_driver_init_ring(struct amdgpu_ring *ring)
 {
-        int i;
+        int i, r;
 
         ring->fence_drv.cpu_addr = NULL;
         ring->fence_drv.gpu_addr = 0;
@@ -625,15 +625,19 @@ void amdgpu_fence_driver_init_ring(struct amdgpu_ring *ring)
                         amdgpu_fence_check_lockup);
         ring->fence_drv.ring = ring;
 
+        init_waitqueue_head(&ring->fence_drv.fence_queue);
+
         if (amdgpu_enable_scheduler) {
-                ring->scheduler = amd_sched_create(&amdgpu_sched_ops,
-                                                   ring->idx,
-                                                   amdgpu_sched_hw_submission,
-                                                   (void *)ring->adev);
-                if (!ring->scheduler)
-                        DRM_ERROR("Failed to create scheduler on ring %d.\n",
-                                  ring->idx);
+                r = amd_sched_init(&ring->sched, &amdgpu_sched_ops,
+                                   amdgpu_sched_hw_submission, ring->name);
+                if (r) {
+                        DRM_ERROR("Failed to create scheduler on ring %s.\n",
+                                  ring->name);
+                        return r;
+                }
         }
+
+        return 0;
 }
 
 /**
@@ -681,8 +685,7 @@ void amdgpu_fence_driver_fini(struct amdgpu_device *adev)
                 wake_up_all(&ring->fence_drv.fence_queue);
                 amdgpu_irq_put(adev, ring->fence_drv.irq_src,
                                ring->fence_drv.irq_type);
-                if (ring->scheduler)
-                        amd_sched_destroy(ring->scheduler);
+                amd_sched_fini(&ring->sched);
                 ring->fence_drv.initialized = false;
         }
         mutex_unlock(&adev->ring_lock);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c
index cbd3a486c5c2..7312d729d300 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c
@@ -127,7 +127,7 @@ int amdgpu_gart_table_vram_alloc(struct amdgpu_device *adev)
                 r = amdgpu_bo_create(adev, adev->gart.table_size,
                                      PAGE_SIZE, true, AMDGPU_GEM_DOMAIN_VRAM,
                                      AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED,
-                                     NULL, &adev->gart.robj);
+                                     NULL, NULL, &adev->gart.robj);
                 if (r) {
                         return r;
                 }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
index 5839fab374bf..7297ca3a0ba7 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
@@ -69,7 +69,8 @@ int amdgpu_gem_object_create(struct amdgpu_device *adev, unsigned long size,
                 }
         }
 retry:
-        r = amdgpu_bo_create(adev, size, alignment, kernel, initial_domain, flags, NULL, &robj);
+        r = amdgpu_bo_create(adev, size, alignment, kernel, initial_domain,
+                             flags, NULL, NULL, &robj);
         if (r) {
                 if (r != -ERESTARTSYS) {
                         if (initial_domain == AMDGPU_GEM_DOMAIN_VRAM) {
@@ -426,6 +427,10 @@ int amdgpu_gem_metadata_ioctl(struct drm_device *dev, void *data,
                                            &args->data.data_size_bytes,
                                            &args->data.flags);
         } else if (args->op == AMDGPU_GEM_METADATA_OP_SET_METADATA) {
+                if (args->data.data_size_bytes > sizeof(args->data.data)) {
+                        r = -EINVAL;
+                        goto unreserve;
+                }
                 r = amdgpu_bo_set_tiling_flags(robj, args->data.tiling_info);
                 if (!r)
                         r = amdgpu_bo_set_metadata(robj, args->data.data,
@@ -433,6 +438,7 @@ int amdgpu_gem_metadata_ioctl(struct drm_device *dev, void *data,
                                                    args->data.flags);
         }
 
+unreserve:
         amdgpu_bo_unreserve(robj);
 out:
         drm_gem_object_unreference_unlocked(gobj);
@@ -454,11 +460,12 @@ static void amdgpu_gem_va_update_vm(struct amdgpu_device *adev,
         struct ttm_validate_buffer tv, *entry;
         struct amdgpu_bo_list_entry *vm_bos;
         struct ww_acquire_ctx ticket;
-        struct list_head list;
+        struct list_head list, duplicates;
         unsigned domain;
         int r;
 
         INIT_LIST_HEAD(&list);
+        INIT_LIST_HEAD(&duplicates);
 
         tv.bo = &bo_va->bo->tbo;
         tv.shared = true;
@@ -468,7 +475,8 @@ static void amdgpu_gem_va_update_vm(struct amdgpu_device *adev,
         if (!vm_bos)
                 return;
 
-        r = ttm_eu_reserve_buffers(&ticket, &list, true, NULL);
+        /* Provide duplicates to avoid -EALREADY */
+        r = ttm_eu_reserve_buffers(&ticket, &list, true, &duplicates);
         if (r)
                 goto error_free;
 
@@ -651,7 +659,7 @@ int amdgpu_mode_dumb_create(struct drm_file *file_priv,
         int r;
 
         args->pitch = amdgpu_align_pitch(adev, args->width, args->bpp, 0) * ((args->bpp + 1) / 8);
-        args->size = args->pitch * args->height;
+        args->size = (u64)args->pitch * args->height;
         args->size = ALIGN(args->size, PAGE_SIZE);
 
         r = amdgpu_gem_object_create(adev, args->size, 0,
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ih.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ih.c
index 5c8a803acedc..534fc04e80fd 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ih.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ih.c
@@ -43,7 +43,7 @@ static int amdgpu_ih_ring_alloc(struct amdgpu_device *adev)
                 r = amdgpu_bo_create(adev, adev->irq.ih.ring_size,
                                      PAGE_SIZE, true,
                                      AMDGPU_GEM_DOMAIN_GTT, 0,
-                                     NULL, &adev->irq.ih.ring_obj);
+                                     NULL, NULL, &adev->irq.ih.ring_obj);
                 if (r) {
                         DRM_ERROR("amdgpu: failed to create ih ring buffer (%d).\n", r);
                         return r;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c
index 0aba8e9bc8a0..7c42ff670080 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c
@@ -140,7 +140,7 @@ void amdgpu_irq_preinstall(struct drm_device *dev)
  */
 int amdgpu_irq_postinstall(struct drm_device *dev)
 {
-        dev->max_vblank_count = 0x001fffff;
+        dev->max_vblank_count = 0x00ffffff;
         return 0;
 }
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
index 22367939ebf1..8c735f544b66 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
@@ -390,7 +390,7 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file
                                     min((size_t)size, sizeof(vram_gtt))) ? -EFAULT : 0;
         }
         case AMDGPU_INFO_READ_MMR_REG: {
-                unsigned n, alloc_size = info->read_mmr_reg.count * 4;
+                unsigned n, alloc_size;
                 uint32_t *regs;
                 unsigned se_num = (info->read_mmr_reg.instance >>
                                    AMDGPU_INFO_MMR_SE_INDEX_SHIFT) &
@@ -406,9 +406,10 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file
                 if (sh_num == AMDGPU_INFO_MMR_SH_INDEX_MASK)
                         sh_num = 0xffffffff;
 
-                regs = kmalloc(alloc_size, GFP_KERNEL);
+                regs = kmalloc_array(info->read_mmr_reg.count, sizeof(*regs), GFP_KERNEL);
                 if (!regs)
                         return -ENOMEM;
+                alloc_size = info->read_mmr_reg.count * sizeof(*regs);
 
                 for (i = 0; i < info->read_mmr_reg.count; i++)
                         if (amdgpu_asic_read_register(adev, se_num, sh_num,
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
index 08b09d55b96f..1a7708f365f3 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
@@ -215,6 +215,7 @@ int amdgpu_bo_create_restricted(struct amdgpu_device *adev,
                                 bool kernel, u32 domain, u64 flags,
                                 struct sg_table *sg,
                                 struct ttm_placement *placement,
+                                struct reservation_object *resv,
                                 struct amdgpu_bo **bo_ptr)
 {
         struct amdgpu_bo *bo;
@@ -261,7 +262,7 @@ int amdgpu_bo_create_restricted(struct amdgpu_device *adev,
         /* Kernel allocation are uninterruptible */
         r = ttm_bo_init(&adev->mman.bdev, &bo->tbo, size, type,
                         &bo->placement, page_align, !kernel, NULL,
-                        acc_size, sg, NULL, &amdgpu_ttm_bo_destroy);
+                        acc_size, sg, resv, &amdgpu_ttm_bo_destroy);
         if (unlikely(r != 0)) {
                 return r;
         }
@@ -275,7 +276,9 @@ int amdgpu_bo_create_restricted(struct amdgpu_device *adev,
 int amdgpu_bo_create(struct amdgpu_device *adev,
                      unsigned long size, int byte_align,
                      bool kernel, u32 domain, u64 flags,
-                     struct sg_table *sg, struct amdgpu_bo **bo_ptr)
+                     struct sg_table *sg,
+                     struct reservation_object *resv,
+                     struct amdgpu_bo **bo_ptr)
 {
         struct ttm_placement placement = {0};
         struct ttm_place placements[AMDGPU_GEM_DOMAIN_MAX + 1];
@@ -286,11 +289,9 @@ int amdgpu_bo_create(struct amdgpu_device *adev,
         amdgpu_ttm_placement_init(adev, &placement,
                                   placements, domain, flags);
 
-        return amdgpu_bo_create_restricted(adev, size, byte_align,
-                                           kernel, domain, flags,
-                                           sg,
-                                           &placement,
-                                           bo_ptr);
+        return amdgpu_bo_create_restricted(adev, size, byte_align, kernel,
+                                           domain, flags, sg, &placement,
+                                           resv, bo_ptr);
 }
 
 int amdgpu_bo_kmap(struct amdgpu_bo *bo, void **ptr)
@@ -535,12 +536,10 @@ int amdgpu_bo_set_metadata (struct amdgpu_bo *bo, void *metadata,
         if (metadata == NULL)
                 return -EINVAL;
 
-        buffer = kzalloc(metadata_size, GFP_KERNEL);
+        buffer = kmemdup(metadata, metadata_size, GFP_KERNEL);
         if (buffer == NULL)
                 return -ENOMEM;
 
-        memcpy(buffer, metadata, metadata_size);
-
         kfree(bo->metadata);
         bo->metadata_flags = flags;
         bo->metadata = buffer;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.h
index 6ea18dcec561..3c2ff4567798 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.h
@@ -129,12 +129,14 @@ int amdgpu_bo_create(struct amdgpu_device *adev,
                             unsigned long size, int byte_align,
                             bool kernel, u32 domain, u64 flags,
                             struct sg_table *sg,
+                            struct reservation_object *resv,
                             struct amdgpu_bo **bo_ptr);
 int amdgpu_bo_create_restricted(struct amdgpu_device *adev,
                                 unsigned long size, int byte_align,
                                 bool kernel, u32 domain, u64 flags,
                                 struct sg_table *sg,
                                 struct ttm_placement *placement,
+                                struct reservation_object *resv,
                                 struct amdgpu_bo **bo_ptr);
 int amdgpu_bo_kmap(struct amdgpu_bo *bo, void **ptr);
 void amdgpu_bo_kunmap(struct amdgpu_bo *bo);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c
index d9652fe32d6a..59f735a933a9 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c
@@ -61,12 +61,15 @@ struct drm_gem_object *amdgpu_gem_prime_import_sg_table(struct drm_device *dev,
                                                         struct dma_buf_attachment *attach,
                                                         struct sg_table *sg)
 {
+        struct reservation_object *resv = attach->dmabuf->resv;
         struct amdgpu_device *adev = dev->dev_private;
         struct amdgpu_bo *bo;
         int ret;
 
+        ww_mutex_lock(&resv->lock, NULL);
         ret = amdgpu_bo_create(adev, attach->dmabuf->size, PAGE_SIZE, false,
-                               AMDGPU_GEM_DOMAIN_GTT, 0, sg, &bo);
+                               AMDGPU_GEM_DOMAIN_GTT, 0, sg, resv, &bo);
+        ww_mutex_unlock(&resv->lock);
         if (ret)
                 return ERR_PTR(ret);
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
index 9bec91484c24..30dce235ddeb 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
@@ -357,11 +357,11 @@ int amdgpu_ring_init(struct amdgpu_device *adev, struct amdgpu_ring *ring,
                 ring->adev = adev;
                 ring->idx = adev->num_rings++;
                 adev->rings[ring->idx] = ring;
-                amdgpu_fence_driver_init_ring(ring);
+                r = amdgpu_fence_driver_init_ring(ring);
+                if (r)
+                        return r;
         }
 
-        init_waitqueue_head(&ring->fence_drv.fence_queue);
-
         r = amdgpu_wb_get(adev, &ring->rptr_offs);
         if (r) {
                 dev_err(adev->dev, "(%d) ring rptr_offs wb alloc failed\n", r);
@@ -407,7 +407,7 @@ int amdgpu_ring_init(struct amdgpu_device *adev, struct amdgpu_ring *ring,
         if (ring->ring_obj == NULL) {
                 r = amdgpu_bo_create(adev, ring->ring_size, PAGE_SIZE, true,
                                      AMDGPU_GEM_DOMAIN_GTT, 0,
-                                     NULL, &ring->ring_obj);
+                                     NULL, NULL, &ring->ring_obj);
                 if (r) {
                         dev_err(adev->dev, "(%d) ring create failed\n", r);
                         return r;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_sa.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_sa.c
index 74dad270362c..e90712443fe9 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_sa.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_sa.c
@@ -64,8 +64,8 @@ int amdgpu_sa_bo_manager_init(struct amdgpu_device *adev,
                 INIT_LIST_HEAD(&sa_manager->flist[i]);
         }
 
-        r = amdgpu_bo_create(adev, size, align, true,
-                             domain, 0, NULL, &sa_manager->bo);
+        r = amdgpu_bo_create(adev, size, align, true, domain,
+                             0, NULL, NULL, &sa_manager->bo);
         if (r) {
                 dev_err(adev->dev, "(%d) failed to allocate bo for manager\n", r);
                 return r;
@@ -145,8 +145,13 @@ static uint32_t amdgpu_sa_get_ring_from_fence(struct fence *f)
         struct amd_sched_fence *s_fence;
 
         s_fence = to_amd_sched_fence(f);
-        if (s_fence)
-                return s_fence->scheduler->ring_id;
+        if (s_fence) {
+                struct amdgpu_ring *ring;
+
+                ring = container_of(s_fence->sched, struct amdgpu_ring, sched);
+                return ring->idx;
+        }
+
         a_fence = to_amdgpu_fence(f);
         if (a_fence)
                 return a_fence->ring->idx;
@@ -412,6 +417,26 @@ void amdgpu_sa_bo_free(struct amdgpu_device *adev, struct amdgpu_sa_bo **sa_bo,
 }
 
 #if defined(CONFIG_DEBUG_FS)
+
+static void amdgpu_sa_bo_dump_fence(struct fence *fence, struct seq_file *m)
+{
+        struct amdgpu_fence *a_fence = to_amdgpu_fence(fence);
+        struct amd_sched_fence *s_fence = to_amd_sched_fence(fence);
+
+        if (a_fence)
+                seq_printf(m, " protected by 0x%016llx on ring %d",
+                           a_fence->seq, a_fence->ring->idx);
+
+        if (s_fence) {
+                struct amdgpu_ring *ring;
+
+
+                ring = container_of(s_fence->sched, struct amdgpu_ring, sched);
+                seq_printf(m, " protected by 0x%016x on ring %d",
+                           s_fence->base.seqno, ring->idx);
+        }
+}
+
 void amdgpu_sa_bo_dump_debug_info(struct amdgpu_sa_manager *sa_manager,
                                   struct seq_file *m)
 {
@@ -428,18 +453,8 @@ void amdgpu_sa_bo_dump_debug_info(struct amdgpu_sa_manager *sa_manager,
                 }
                 seq_printf(m, "[0x%010llx 0x%010llx] size %8lld",
                            soffset, eoffset, eoffset - soffset);
-                if (i->fence) {
-                        struct amdgpu_fence *a_fence = to_amdgpu_fence(i->fence);
-                        struct amd_sched_fence *s_fence = to_amd_sched_fence(i->fence);
-                        if (a_fence)
-                                seq_printf(m, " protected by 0x%016llx on ring %d",
-                                           a_fence->seq, a_fence->ring->idx);
-                        if (s_fence)
-                                seq_printf(m, " protected by 0x%016x on ring %d",
-                                           s_fence->base.seqno,
-                                           s_fence->scheduler->ring_id);
-
-                }
+                if (i->fence)
+                        amdgpu_sa_bo_dump_fence(i->fence, m);
                 seq_printf(m, "\n");
         }
         spin_unlock(&sa_manager->wq.lock);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c
index de98fbd2971e..2e946b2cad88 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c
@@ -27,63 +27,48 @@
 #include <drm/drmP.h>
 #include "amdgpu.h"
 
-static struct fence *amdgpu_sched_dependency(struct amd_sched_job *job)
+static struct fence *amdgpu_sched_dependency(struct amd_sched_job *sched_job)
 {
-        struct amdgpu_job *sched_job = (struct amdgpu_job *)job;
-        return amdgpu_sync_get_fence(&sched_job->ibs->sync);
+        struct amdgpu_job *job = to_amdgpu_job(sched_job);
+        return amdgpu_sync_get_fence(&job->ibs->sync);
 }
 
-static struct fence *amdgpu_sched_run_job(struct amd_sched_job *job)
+static struct fence *amdgpu_sched_run_job(struct amd_sched_job *sched_job)
 {
-        struct amdgpu_job *sched_job;
-        struct amdgpu_fence *fence;
+        struct amdgpu_fence *fence = NULL;
+        struct amdgpu_job *job;
         int r;
 
-        if (!job) {
+        if (!sched_job) {
                 DRM_ERROR("job is null\n");
                 return NULL;
         }
-        sched_job = (struct amdgpu_job *)job;
-        mutex_lock(&sched_job->job_lock);
-        r = amdgpu_ib_schedule(sched_job->adev,
-                               sched_job->num_ibs,
-                               sched_job->ibs,
-                               sched_job->base.owner);
-        if (r)
+        job = to_amdgpu_job(sched_job);
+        mutex_lock(&job->job_lock);
+        r = amdgpu_ib_schedule(job->adev,
+                               job->num_ibs,
+                               job->ibs,
+                               job->base.owner);
+        if (r) {
+                DRM_ERROR("Error scheduling IBs (%d)\n", r);
                 goto err;
-        fence = amdgpu_fence_ref(sched_job->ibs[sched_job->num_ibs - 1].fence);
-
-        if (sched_job->free_job)
-                sched_job->free_job(sched_job);
+        }
 
-        mutex_unlock(&sched_job->job_lock);
-        return &fence->base;
+        fence = amdgpu_fence_ref(job->ibs[job->num_ibs - 1].fence);
 
 err:
-        DRM_ERROR("Run job error\n");
-        mutex_unlock(&sched_job->job_lock);
-        job->sched->ops->process_job(job);
-        return NULL;
-}
+        if (job->free_job)
+                job->free_job(job);
 
-static void amdgpu_sched_process_job(struct amd_sched_job *job)
-{
-        struct amdgpu_job *sched_job;
-
-        if (!job) {
-                DRM_ERROR("job is null\n");
-                return;
-        }
-        sched_job = (struct amdgpu_job *)job;
-        /* after processing job, free memory */
-        fence_put(&sched_job->base.s_fence->base);
-        kfree(sched_job);
+        mutex_unlock(&job->job_lock);
+        fence_put(&job->base.s_fence->base);
+        kfree(job);
+        return fence ? &fence->base : NULL;
 }
 
 struct amd_sched_backend_ops amdgpu_sched_ops = {
         .dependency = amdgpu_sched_dependency,
         .run_job = amdgpu_sched_run_job,
-        .process_job = amdgpu_sched_process_job
 };
 
 int amdgpu_sched_ib_submit_kernel_helper(struct amdgpu_device *adev,
@@ -100,7 +85,7 @@ int amdgpu_sched_ib_submit_kernel_helper(struct amdgpu_device *adev,
                         kzalloc(sizeof(struct amdgpu_job), GFP_KERNEL);
                 if (!job)
                         return -ENOMEM;
-                job->base.sched = ring->scheduler;
+                job->base.sched = &ring->sched;
                 job->base.s_entity = &adev->kernel_ctx.rings[ring->idx].entity;
                 job->adev = adev;
                 job->ibs = ibs;
@@ -109,7 +94,7 @@ int amdgpu_sched_ib_submit_kernel_helper(struct amdgpu_device *adev,
                 mutex_init(&job->job_lock);
                 job->free_job = free_job;
                 mutex_lock(&job->job_lock);
-                r = amd_sched_entity_push_job((struct amd_sched_job *)job);
+                r = amd_sched_entity_push_job(&job->base);
                 if (r) {
                         mutex_unlock(&job->job_lock);
                         kfree(job);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c
index 068aeaff7183..4921de15b451 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c
@@ -65,8 +65,14 @@ static bool amdgpu_sync_same_dev(struct amdgpu_device *adev, struct fence *f)
 
         if (a_fence)
                 return a_fence->ring->adev == adev;
-        if (s_fence)
-                return (struct amdgpu_device *)s_fence->scheduler->priv == adev;
+
+        if (s_fence) {
+                struct amdgpu_ring *ring;
+
+                ring = container_of(s_fence->sched, struct amdgpu_ring, sched);
+                return ring->adev == adev;
+        }
+
         return false;
 }
 
@@ -251,6 +257,20 @@ int amdgpu_sync_wait(struct amdgpu_sync *sync)
                 fence_put(e->fence);
                 kfree(e);
         }
+
+        if (amdgpu_enable_semaphores)
+                return 0;
+
+        for (i = 0; i < AMDGPU_MAX_RINGS; ++i) {
+                struct amdgpu_fence *fence = sync->sync_to[i];
+                if (!fence)
+                        continue;
+
+                r = fence_wait(&fence->base, false);
+                if (r)
+                        return r;
+        }
+
         return 0;
 }
 
@@ -285,7 +305,8 @@ int amdgpu_sync_rings(struct amdgpu_sync *sync,
                         return -EINVAL;
                 }
 
-                if (amdgpu_enable_scheduler || (count >= AMDGPU_NUM_SYNCS)) {
+                if (amdgpu_enable_scheduler || !amdgpu_enable_semaphores ||
+                    (count >= AMDGPU_NUM_SYNCS)) {
                         /* not enough room, wait manually */
                         r = fence_wait(&fence->base, false);
                         if (r)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_test.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_test.c
index f80b1a43be8a..4865615e9c06 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_test.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_test.c
@@ -59,8 +59,9 @@ static void amdgpu_do_test_moves(struct amdgpu_device *adev)
                 goto out_cleanup;
         }
 
-        r = amdgpu_bo_create(adev, size, PAGE_SIZE, true, AMDGPU_GEM_DOMAIN_VRAM, 0,
-                             NULL, &vram_obj);
+        r = amdgpu_bo_create(adev, size, PAGE_SIZE, true,
+                             AMDGPU_GEM_DOMAIN_VRAM, 0,
+                             NULL, NULL, &vram_obj);
         if (r) {
                 DRM_ERROR("Failed to create VRAM object\n");
                 goto out_cleanup;
@@ -80,7 +81,8 @@ static void amdgpu_do_test_moves(struct amdgpu_device *adev)
                 struct fence *fence = NULL;
 
                 r = amdgpu_bo_create(adev, size, PAGE_SIZE, true,
-                                     AMDGPU_GEM_DOMAIN_GTT, 0, NULL, gtt_obj + i);
+                                     AMDGPU_GEM_DOMAIN_GTT, 0, NULL,
+                                     NULL, gtt_obj + i);
                 if (r) {
                         DRM_ERROR("Failed to create GTT object %d\n", i);
                         goto out_lclean;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
index b5abd5cde413..364cbe975332 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
@@ -861,7 +861,7 @@ int amdgpu_ttm_init(struct amdgpu_device *adev)
         r = amdgpu_bo_create(adev, 256 * 1024, PAGE_SIZE, true,
                              AMDGPU_GEM_DOMAIN_VRAM,
                              AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED,
-                             NULL, &adev->stollen_vga_memory);
+                             NULL, NULL, &adev->stollen_vga_memory);
         if (r) {
                 return r;
         }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c
index 482e66797ae6..5cc95f1a7dab 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c
@@ -247,7 +247,7 @@ int amdgpu_ucode_init_bo(struct amdgpu_device *adev)
         const struct common_firmware_header *header = NULL;
 
         err = amdgpu_bo_create(adev, adev->firmware.fw_size, PAGE_SIZE, true,
-                        AMDGPU_GEM_DOMAIN_GTT, 0, NULL, bo);
+                        AMDGPU_GEM_DOMAIN_GTT, 0, NULL, NULL, bo);
         if (err) {
                 dev_err(adev->dev, "(%d) Firmware buffer allocate failed\n", err);
                 err = -ENOMEM;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
index 2cf6c6b06e3b..d0312364d950 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
@@ -156,7 +156,7 @@ int amdgpu_uvd_sw_init(struct amdgpu_device *adev)
         r = amdgpu_bo_create(adev, bo_size, PAGE_SIZE, true,
                              AMDGPU_GEM_DOMAIN_VRAM,
                              AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED,
-                             NULL, &adev->uvd.vcpu_bo);
+                             NULL, NULL, &adev->uvd.vcpu_bo);
         if (r) {
                 dev_err(adev->dev, "(%d) failed to allocate UVD bo\n", r);
                 return r;
@@ -543,46 +543,60 @@ static int amdgpu_uvd_cs_msg(struct amdgpu_uvd_cs_ctx *ctx,
                 return -EINVAL;
         }
 
-        if (msg_type == 1) {
+        switch (msg_type) {
+        case 0:
+                /* it's a create msg, calc image size (width * height) */
+                amdgpu_bo_kunmap(bo);
+
+                /* try to alloc a new handle */
+                for (i = 0; i < AMDGPU_MAX_UVD_HANDLES; ++i) {
+                        if (atomic_read(&adev->uvd.handles[i]) == handle) {
+                                DRM_ERROR("Handle 0x%x already in use!\n", handle);
+                                return -EINVAL;
+                        }
+
+                        if (!atomic_cmpxchg(&adev->uvd.handles[i], 0, handle)) {
+                                adev->uvd.filp[i] = ctx->parser->filp;
+                                return 0;
+                        }
+                }
+
+                DRM_ERROR("No more free UVD handles!\n");
+                return -EINVAL;
+
+        case 1:
                 /* it's a decode msg, calc buffer sizes */
                 r = amdgpu_uvd_cs_msg_decode(msg, ctx->buf_sizes);
                 amdgpu_bo_kunmap(bo);
                 if (r)
                         return r;
 
-        } else if (msg_type == 2) {
+                /* validate the handle */
+                for (i = 0; i < AMDGPU_MAX_UVD_HANDLES; ++i) {
+                        if (atomic_read(&adev->uvd.handles[i]) == handle) {
+                                if (adev->uvd.filp[i] != ctx->parser->filp) {
+                                        DRM_ERROR("UVD handle collision detected!\n");
+                                        return -EINVAL;
+                                }
+                                return 0;
+                        }
+                }
+
+                DRM_ERROR("Invalid UVD handle 0x%x!\n", handle);
+                return -ENOENT;
+
+        case 2:
                 /* it's a destroy msg, free the handle */
                 for (i = 0; i < AMDGPU_MAX_UVD_HANDLES; ++i)
                         atomic_cmpxchg(&adev->uvd.handles[i], handle, 0);
                 amdgpu_bo_kunmap(bo);
                 return 0;
-        } else {
-                /* it's a create msg */
-                amdgpu_bo_kunmap(bo);
-
-                if (msg_type != 0) {
-                        DRM_ERROR("Illegal UVD message type (%d)!\n", msg_type);
-                        return -EINVAL;
-                }
-
-                /* it's a create msg, no special handling needed */
-        }
-
-        /* create or decode, validate the handle */
-        for (i = 0; i < AMDGPU_MAX_UVD_HANDLES; ++i) {
-                if (atomic_read(&adev->uvd.handles[i]) == handle)
-                        return 0;
-        }
 
-        /* handle not found try to alloc a new one */
-        for (i = 0; i < AMDGPU_MAX_UVD_HANDLES; ++i) {
-                if (!atomic_cmpxchg(&adev->uvd.handles[i], 0, handle)) {
-                        adev->uvd.filp[i] = ctx->parser->filp;
-                        return 0;
-                }
+        default:
+                DRM_ERROR("Illegal UVD message type (%d)!\n", msg_type);
+                return -EINVAL;
         }
-
-        DRM_ERROR("No more free UVD handles!\n");
+        BUG();
         return -EINVAL;
 }
 
@@ -805,10 +819,10 @@ int amdgpu_uvd_ring_parse_cs(struct amdgpu_cs_parser *parser, uint32_t ib_idx)
 }
 
 static int amdgpu_uvd_free_job(
-        struct amdgpu_job *sched_job)
+        struct amdgpu_job *job)
 {
-        amdgpu_ib_free(sched_job->adev, sched_job->ibs);
-        kfree(sched_job->ibs);
+        amdgpu_ib_free(job->adev, job->ibs);
+        kfree(job->ibs);
         return 0;
 }
 
@@ -905,7 +919,7 @@ int amdgpu_uvd_get_create_msg(struct amdgpu_ring *ring, uint32_t handle,
         r = amdgpu_bo_create(adev, 1024, PAGE_SIZE, true,
                              AMDGPU_GEM_DOMAIN_VRAM,
                              AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED,
-                             NULL, &bo);
+                             NULL, NULL, &bo);
         if (r)
                 return r;
 
@@ -954,7 +968,7 @@ int amdgpu_uvd_get_destroy_msg(struct amdgpu_ring *ring, uint32_t handle,
         r = amdgpu_bo_create(adev, 1024, PAGE_SIZE, true,
                              AMDGPU_GEM_DOMAIN_VRAM,
                              AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED,
-                             NULL, &bo);
+                             NULL, NULL, &bo);
         if (r)
                 return r;
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c
index 3cab96c42aa8..74f2038ac747 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c
@@ -143,7 +143,7 @@ int amdgpu_vce_sw_init(struct amdgpu_device *adev, unsigned long size)
         r = amdgpu_bo_create(adev, size, PAGE_SIZE, true,
                              AMDGPU_GEM_DOMAIN_VRAM,
                              AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED,
-                             NULL, &adev->vce.vcpu_bo);
+                             NULL, NULL, &adev->vce.vcpu_bo);
         if (r) {
                 dev_err(adev->dev, "(%d) failed to allocate VCE bo\n", r);
                 return r;
@@ -342,10 +342,10 @@ void amdgpu_vce_free_handles(struct amdgpu_device *adev, struct drm_file *filp)
 }
 
 static int amdgpu_vce_free_job(
-        struct amdgpu_job *sched_job)
+        struct amdgpu_job *job)
 {
-        amdgpu_ib_free(sched_job->adev, sched_job->ibs);
-        kfree(sched_job->ibs);
+        amdgpu_ib_free(job->adev, job->ibs);
+        kfree(job->ibs);
         return 0;
 }
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
index f68b7cdc370a..1e14531353e0 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
@@ -316,12 +316,12 @@ static void amdgpu_vm_update_pages(struct amdgpu_device *adev,
         }
 }
 
-int amdgpu_vm_free_job(struct amdgpu_job *sched_job)
+int amdgpu_vm_free_job(struct amdgpu_job *job)
 {
         int i;
-        for (i = 0; i < sched_job->num_ibs; i++)
-                amdgpu_ib_free(sched_job->adev, &sched_job->ibs[i]);
-        kfree(sched_job->ibs);
+        for (i = 0; i < job->num_ibs; i++)
+                amdgpu_ib_free(job->adev, &job->ibs[i]);
+        kfree(job->ibs);
         return 0;
 }
 
@@ -686,31 +686,6 @@ static int amdgpu_vm_update_ptes(struct amdgpu_device *adev,
 }
 
 /**
- * amdgpu_vm_fence_pts - fence page tables after an update
- *
- * @vm: requested vm
- * @start: start of GPU address range
- * @end: end of GPU address range
- * @fence: fence to use
- *
- * Fence the page tables in the range @start - @end (cayman+).
- *
- * Global and local mutex must be locked!
- */
-static void amdgpu_vm_fence_pts(struct amdgpu_vm *vm,
-                                uint64_t start, uint64_t end,
-                                struct fence *fence)
-{
-        unsigned i;
-
-        start >>= amdgpu_vm_block_size;
-        end >>= amdgpu_vm_block_size;
-
-        for (i = start; i <= end; ++i)
-                amdgpu_bo_fence(vm->page_tables[i].bo, fence, true);
-}
-
-/**
  * amdgpu_vm_bo_update_mapping - update a mapping in the vm page table
  *
  * @adev: amdgpu_device pointer
@@ -813,8 +788,7 @@ static int amdgpu_vm_bo_update_mapping(struct amdgpu_device *adev,
         if (r)
                 goto error_free;
 
-        amdgpu_vm_fence_pts(vm, mapping->it.start,
-                            mapping->it.last + 1, f);
+        amdgpu_bo_fence(vm->page_directory, f, true);
         if (fence) {
                 fence_put(*fence);
                 *fence = fence_get(f);
@@ -855,7 +829,7 @@ int amdgpu_vm_bo_update(struct amdgpu_device *adev,
         int r;
 
         if (mem) {
-                addr = mem->start << PAGE_SHIFT;
+                addr = (u64)mem->start << PAGE_SHIFT;
                 if (mem->mem_type != TTM_PL_TT)
                         addr += adev->vm_manager.vram_base_offset;
         } else {
@@ -1089,6 +1063,7 @@ int amdgpu_vm_bo_map(struct amdgpu_device *adev,
 
         /* walk over the address space and allocate the page tables */
         for (pt_idx = saddr; pt_idx <= eaddr; ++pt_idx) {
+                struct reservation_object *resv = vm->page_directory->tbo.resv;
                 struct amdgpu_bo *pt;
 
                 if (vm->page_tables[pt_idx].bo)
@@ -1097,11 +1072,13 @@ int amdgpu_vm_bo_map(struct amdgpu_device *adev,
                 /* drop mutex to allocate and clear page table */
                 mutex_unlock(&vm->mutex);
 
+                ww_mutex_lock(&resv->lock, NULL);
                 r = amdgpu_bo_create(adev, AMDGPU_VM_PTE_COUNT * 8,
                                      AMDGPU_GPU_PAGE_SIZE, true,
                                      AMDGPU_GEM_DOMAIN_VRAM,
                                      AMDGPU_GEM_CREATE_NO_CPU_ACCESS,
-                                     NULL, &pt);
+                                     NULL, resv, &pt);
+                ww_mutex_unlock(&resv->lock);
                 if (r)
                         goto error_free;
 
@@ -1303,7 +1280,7 @@ int amdgpu_vm_init(struct amdgpu_device *adev, struct amdgpu_vm *vm)
         r = amdgpu_bo_create(adev, pd_size, align, true,
                              AMDGPU_GEM_DOMAIN_VRAM,
                              AMDGPU_GEM_CREATE_NO_CPU_ACCESS,
-                             NULL, &vm->page_directory);
+                             NULL, NULL, &vm->page_directory);
         if (r)
                 return r;
 
diff --git a/drivers/gpu/drm/amd/amdgpu/cz_smc.c b/drivers/gpu/drm/amd/amdgpu/cz_smc.c
index a72ffc7d6c26..e33180d3314a 100644
--- a/drivers/gpu/drm/amd/amdgpu/cz_smc.c
+++ b/drivers/gpu/drm/amd/amdgpu/cz_smc.c
@@ -814,7 +814,8 @@ int cz_smu_init(struct amdgpu_device *adev)
         * 3. map kernel virtual address
         */
         ret = amdgpu_bo_create(adev, priv->toc_buffer.data_size, PAGE_SIZE,
-                                true, AMDGPU_GEM_DOMAIN_GTT, 0, NULL, toc_buf);
+                               true, AMDGPU_GEM_DOMAIN_GTT, 0, NULL, NULL,
+                               toc_buf);
 
         if (ret) {
                 dev_err(adev->dev, "(%d) SMC TOC buffer allocation failed\n", ret);
@@ -822,7 +823,8 @@ int cz_smu_init(struct amdgpu_device *adev)
         }
 
         ret = amdgpu_bo_create(adev, priv->smu_buffer.data_size, PAGE_SIZE,
-                                true, AMDGPU_GEM_DOMAIN_GTT, 0, NULL, smu_buf);
+                               true, AMDGPU_GEM_DOMAIN_GTT, 0, NULL, NULL,
+                               smu_buf);
 
         if (ret) {
                 dev_err(adev->dev, "(%d) SMC Internal buffer allocation failed\n", ret);
diff --git a/drivers/gpu/drm/amd/amdgpu/fiji_smc.c b/drivers/gpu/drm/amd/amdgpu/fiji_smc.c
index 322edea65857..bda1249eb871 100644
--- a/drivers/gpu/drm/amd/amdgpu/fiji_smc.c
+++ b/drivers/gpu/drm/amd/amdgpu/fiji_smc.c
@@ -764,7 +764,7 @@ int fiji_smu_init(struct amdgpu_device *adev)
         ret = amdgpu_bo_create(adev, image_size, PAGE_SIZE,
                                true, AMDGPU_GEM_DOMAIN_VRAM,
                                AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED,
-                               NULL, toc_buf);
+                               NULL, NULL, toc_buf);
         if (ret) {
                 DRM_ERROR("Failed to allocate memory for TOC buffer\n");
                 return -ENOMEM;
@@ -774,7 +774,7 @@ int fiji_smu_init(struct amdgpu_device *adev)
         ret = amdgpu_bo_create(adev, smu_internal_buffer_size, PAGE_SIZE,
                                true, AMDGPU_GEM_DOMAIN_VRAM,
                                AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED,
-                               NULL, smu_buf);
+                               NULL, NULL, smu_buf);
         if (ret) {
                 DRM_ERROR("Failed to allocate memory for SMU internal buffer\n");
                 return -ENOMEM;
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
index 4bd1e5cf65ca..e992bf2ff66c 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
@@ -3206,7 +3206,7 @@ static int gfx_v7_0_mec_init(struct amdgpu_device *adev)
                 r = amdgpu_bo_create(adev,
                                      adev->gfx.mec.num_mec *adev->gfx.mec.num_pipe * MEC_HPD_SIZE * 2,
                                      PAGE_SIZE, true,
-                                     AMDGPU_GEM_DOMAIN_GTT, 0, NULL,
+                                     AMDGPU_GEM_DOMAIN_GTT, 0, NULL, NULL,
                                      &adev->gfx.mec.hpd_eop_obj);
                 if (r) {
                         dev_warn(adev->dev, "(%d) create HDP EOP bo failed\n", r);
@@ -3373,7 +3373,7 @@ static int gfx_v7_0_cp_compute_resume(struct amdgpu_device *adev)
                         r = amdgpu_bo_create(adev,
                                              sizeof(struct bonaire_mqd),
                                              PAGE_SIZE, true,
-                                             AMDGPU_GEM_DOMAIN_GTT, 0, NULL,
+                                             AMDGPU_GEM_DOMAIN_GTT, 0, NULL, NULL,
                                              &ring->mqd_obj);
                         if (r) {
                                 dev_warn(adev->dev, "(%d) create MQD bo failed\n", r);
@@ -3610,41 +3610,6 @@ static int gfx_v7_0_cp_resume(struct amdgpu_device *adev)
         return 0;
 }
 
-static void gfx_v7_0_ce_sync_me(struct amdgpu_ring *ring)
-{
-        struct amdgpu_device *adev = ring->adev;
-        u64 gpu_addr = adev->wb.gpu_addr + adev->gfx.ce_sync_offs * 4;
-
-        /* instruct DE to set a magic number */
-        amdgpu_ring_write(ring, PACKET3(PACKET3_WRITE_DATA, 3));
-        amdgpu_ring_write(ring, (WRITE_DATA_ENGINE_SEL(0) |
-                                                         WRITE_DATA_DST_SEL(5)));
-        amdgpu_ring_write(ring, gpu_addr & 0xfffffffc);
-        amdgpu_ring_write(ring, upper_32_bits(gpu_addr) & 0xffffffff);
-        amdgpu_ring_write(ring, 1);
-
-        /* let CE wait till condition satisfied */
-        amdgpu_ring_write(ring, PACKET3(PACKET3_WAIT_REG_MEM, 5));
-        amdgpu_ring_write(ring, (WAIT_REG_MEM_OPERATION(0) | /* wait */
-                                                         WAIT_REG_MEM_MEM_SPACE(1) | /* memory */
-                                                         WAIT_REG_MEM_FUNCTION(3) |  /* == */
-                                                         WAIT_REG_MEM_ENGINE(2)));   /* ce */
-        amdgpu_ring_write(ring, gpu_addr & 0xfffffffc);
-        amdgpu_ring_write(ring, upper_32_bits(gpu_addr) & 0xffffffff);
-        amdgpu_ring_write(ring, 1);
-        amdgpu_ring_write(ring, 0xffffffff);
-        amdgpu_ring_write(ring, 4); /* poll interval */
-
-        /* instruct CE to reset wb of ce_sync to zero */
-        amdgpu_ring_write(ring, PACKET3(PACKET3_WRITE_DATA, 3));
-        amdgpu_ring_write(ring, (WRITE_DATA_ENGINE_SEL(2) |
-                                                         WRITE_DATA_DST_SEL(5) |
-                                                         WR_CONFIRM));
-        amdgpu_ring_write(ring, gpu_addr & 0xfffffffc);
-        amdgpu_ring_write(ring, upper_32_bits(gpu_addr) & 0xffffffff);
-        amdgpu_ring_write(ring, 0);
-}
-
 /*
  * vm
  * VMID 0 is the physical GPU addresses as used by the kernel.
@@ -3663,6 +3628,13 @@ static void gfx_v7_0_ring_emit_vm_flush(struct amdgpu_ring *ring,
                                         unsigned vm_id, uint64_t pd_addr)
 {
         int usepfp = (ring->type == AMDGPU_RING_TYPE_GFX);
+        if (usepfp) {
+                /* synce CE with ME to prevent CE fetch CEIB before context switch done */
+                amdgpu_ring_write(ring, PACKET3(PACKET3_SWITCH_BUFFER, 0));
+                amdgpu_ring_write(ring, 0);
+                amdgpu_ring_write(ring, PACKET3(PACKET3_SWITCH_BUFFER, 0));
+                amdgpu_ring_write(ring, 0);
+        }
 
         amdgpu_ring_write(ring, PACKET3(PACKET3_WRITE_DATA, 3));
         amdgpu_ring_write(ring, (WRITE_DATA_ENGINE_SEL(usepfp) |
@@ -3703,7 +3675,10 @@ static void gfx_v7_0_ring_emit_vm_flush(struct amdgpu_ring *ring,
                 amdgpu_ring_write(ring, 0x0);
 
                 /* synce CE with ME to prevent CE fetch CEIB before context switch done */
-                gfx_v7_0_ce_sync_me(ring);
+                amdgpu_ring_write(ring, PACKET3(PACKET3_SWITCH_BUFFER, 0));
+                amdgpu_ring_write(ring, 0);
+                amdgpu_ring_write(ring, PACKET3(PACKET3_SWITCH_BUFFER, 0));
+                amdgpu_ring_write(ring, 0);
         }
 }
 
@@ -3788,7 +3763,8 @@ static int gfx_v7_0_rlc_init(struct amdgpu_device *adev)
                         r = amdgpu_bo_create(adev, dws * 4, PAGE_SIZE, true,
                                              AMDGPU_GEM_DOMAIN_VRAM,
                                              AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED,
-                                             NULL, &adev->gfx.rlc.save_restore_obj);
+                                             NULL, NULL,
+                                             &adev->gfx.rlc.save_restore_obj);
                         if (r) {
                                 dev_warn(adev->dev, "(%d) create RLC sr bo failed\n", r);
                                 return r;
@@ -3831,7 +3807,8 @@ static int gfx_v7_0_rlc_init(struct amdgpu_device *adev)
                         r = amdgpu_bo_create(adev, dws * 4, PAGE_SIZE, true,
                                              AMDGPU_GEM_DOMAIN_VRAM,
                                              AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED,
-                                             NULL, &adev->gfx.rlc.clear_state_obj);
+                                             NULL, NULL,
+                                             &adev->gfx.rlc.clear_state_obj);
                         if (r) {
                                 dev_warn(adev->dev, "(%d) create RLC c bo failed\n", r);
                                 gfx_v7_0_rlc_fini(adev);
@@ -3870,7 +3847,8 @@ static int gfx_v7_0_rlc_init(struct amdgpu_device *adev)
                         r = amdgpu_bo_create(adev, adev->gfx.rlc.cp_table_size, PAGE_SIZE, true,
                                              AMDGPU_GEM_DOMAIN_VRAM,
                                              AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED,
-                                             NULL, &adev->gfx.rlc.cp_table_obj);
+                                             NULL, NULL,
+                                             &adev->gfx.rlc.cp_table_obj);
                         if (r) {
                                 dev_warn(adev->dev, "(%d) create RLC cp table bo failed\n", r);
                                 gfx_v7_0_rlc_fini(adev);
@@ -4802,12 +4780,6 @@ static int gfx_v7_0_sw_init(void *handle)
                 return r;
         }
 
-        r = amdgpu_wb_get(adev, &adev->gfx.ce_sync_offs);
-        if (r) {
-                DRM_ERROR("(%d) gfx.ce_sync_offs wb alloc failed\n", r);
-                return r;
-        }
-
         for (i = 0; i < adev->gfx.num_gfx_rings; i++) {
                 ring = &adev->gfx.gfx_ring[i];
                 ring->ring_obj = NULL;
@@ -4851,21 +4823,21 @@ static int gfx_v7_0_sw_init(void *handle)
         r = amdgpu_bo_create(adev, adev->gds.mem.gfx_partition_size,
                         PAGE_SIZE, true,
                         AMDGPU_GEM_DOMAIN_GDS, 0,
-                        NULL, &adev->gds.gds_gfx_bo);
+                        NULL, NULL, &adev->gds.gds_gfx_bo);
         if (r)
                 return r;
 
         r = amdgpu_bo_create(adev, adev->gds.gws.gfx_partition_size,
                 PAGE_SIZE, true,
                 AMDGPU_GEM_DOMAIN_GWS, 0,
-                NULL, &adev->gds.gws_gfx_bo);
+                NULL, NULL, &adev->gds.gws_gfx_bo);
         if (r)
                 return r;
 
         r = amdgpu_bo_create(adev, adev->gds.oa.gfx_partition_size,
                         PAGE_SIZE, true,
                         AMDGPU_GEM_DOMAIN_OA, 0,
-                        NULL, &adev->gds.oa_gfx_bo);
+                        NULL, NULL, &adev->gds.oa_gfx_bo);
         if (r)
                 return r;
 
@@ -4886,8 +4858,6 @@ static int gfx_v7_0_sw_fini(void *handle)
         for (i = 0; i < adev->gfx.num_compute_rings; i++)
                 amdgpu_ring_fini(&adev->gfx.compute_ring[i]);
 
-        amdgpu_wb_free(adev, adev->gfx.ce_sync_offs);
-
         gfx_v7_0_cp_compute_fini(adev);
         gfx_v7_0_rlc_fini(adev);
         gfx_v7_0_mec_fini(adev);
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
index 53f07439a512..cb4f68f53f24 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
@@ -868,7 +868,7 @@ static int gfx_v8_0_mec_init(struct amdgpu_device *adev)
                 r = amdgpu_bo_create(adev,
                                      adev->gfx.mec.num_mec *adev->gfx.mec.num_pipe * MEC_HPD_SIZE * 2,
                                      PAGE_SIZE, true,
-                                     AMDGPU_GEM_DOMAIN_GTT, 0, NULL,
+                                     AMDGPU_GEM_DOMAIN_GTT, 0, NULL, NULL,
                                      &adev->gfx.mec.hpd_eop_obj);
                 if (r) {
                         dev_warn(adev->dev, "(%d) create HDP EOP bo failed\n", r);
@@ -940,12 +940,6 @@ static int gfx_v8_0_sw_init(void *handle)
                 return r;
         }
 
-        r = amdgpu_wb_get(adev, &adev->gfx.ce_sync_offs);
-        if (r) {
-                DRM_ERROR("(%d) gfx.ce_sync_offs wb alloc failed\n", r);
-                return r;
-        }
-
         /* set up the gfx ring */
         for (i = 0; i < adev->gfx.num_gfx_rings; i++) {
                 ring = &adev->gfx.gfx_ring[i];
@@ -995,21 +989,21 @@ static int gfx_v8_0_sw_init(void *handle)
         /* reserve GDS, GWS and OA resource for gfx */
         r = amdgpu_bo_create(adev, adev->gds.mem.gfx_partition_size,
                         PAGE_SIZE, true,
-                        AMDGPU_GEM_DOMAIN_GDS, 0,
+                        AMDGPU_GEM_DOMAIN_GDS, 0, NULL,
                         NULL, &adev->gds.gds_gfx_bo);
         if (r)
                 return r;
 
         r = amdgpu_bo_create(adev, adev->gds.gws.gfx_partition_size,
                 PAGE_SIZE, true,
-                AMDGPU_GEM_DOMAIN_GWS, 0,
+                AMDGPU_GEM_DOMAIN_GWS, 0, NULL,
                 NULL, &adev->gds.gws_gfx_bo);
         if (r)
                 return r;
 
         r = amdgpu_bo_create(adev, adev->gds.oa.gfx_partition_size,
                         PAGE_SIZE, true,
-                        AMDGPU_GEM_DOMAIN_OA, 0,
+                        AMDGPU_GEM_DOMAIN_OA, 0, NULL,
                         NULL, &adev->gds.oa_gfx_bo);
         if (r)
                 return r;
@@ -1033,8 +1027,6 @@ static int gfx_v8_0_sw_fini(void *handle)
         for (i = 0; i < adev->gfx.num_compute_rings; i++)
                 amdgpu_ring_fini(&adev->gfx.compute_ring[i]);
 
-        amdgpu_wb_free(adev, adev->gfx.ce_sync_offs);
-
         gfx_v8_0_mec_fini(adev);
 
         return 0;
@@ -3106,7 +3098,7 @@ static int gfx_v8_0_cp_compute_resume(struct amdgpu_device *adev)
                                              sizeof(struct vi_mqd),
                                              PAGE_SIZE, true,
                                              AMDGPU_GEM_DOMAIN_GTT, 0, NULL,
-                                             &ring->mqd_obj);
+                                             NULL, &ring->mqd_obj);
                         if (r) {
                                 dev_warn(adev->dev, "(%d) create MQD bo failed\n", r);
                                 return r;
@@ -3965,6 +3957,7 @@ static void gfx_v8_0_ring_emit_fence_gfx(struct amdgpu_ring *ring, u64 addr,
                           DATA_SEL(write64bit ? 2 : 1) | INT_SEL(int_sel ? 2 : 0));
         amdgpu_ring_write(ring, lower_32_bits(seq));
         amdgpu_ring_write(ring, upper_32_bits(seq));
+
 }
 
 /**
@@ -4005,49 +3998,34 @@ static bool gfx_v8_0_ring_emit_semaphore(struct amdgpu_ring *ring,
         return true;
 }
 
-static void gfx_v8_0_ce_sync_me(struct amdgpu_ring *ring)
+static void gfx_v8_0_ring_emit_vm_flush(struct amdgpu_ring *ring,
+                                        unsigned vm_id, uint64_t pd_addr)
 {
-        struct amdgpu_device *adev = ring->adev;
-        u64 gpu_addr = adev->wb.gpu_addr + adev->gfx.ce_sync_offs * 4;
-
-        /* instruct DE to set a magic number */
-        amdgpu_ring_write(ring, PACKET3(PACKET3_WRITE_DATA, 3));
-        amdgpu_ring_write(ring, (WRITE_DATA_ENGINE_SEL(0) |
-                                                         WRITE_DATA_DST_SEL(5)));
-        amdgpu_ring_write(ring, gpu_addr & 0xfffffffc);
-        amdgpu_ring_write(ring, upper_32_bits(gpu_addr) & 0xffffffff);
-        amdgpu_ring_write(ring, 1);
+        int usepfp = (ring->type == AMDGPU_RING_TYPE_GFX);
+        uint32_t seq = ring->fence_drv.sync_seq[ring->idx];
+        uint64_t addr = ring->fence_drv.gpu_addr;
 
-        /* let CE wait till condition satisfied */
         amdgpu_ring_write(ring, PACKET3(PACKET3_WAIT_REG_MEM, 5));
-        amdgpu_ring_write(ring, (WAIT_REG_MEM_OPERATION(0) | /* wait */
-                                                         WAIT_REG_MEM_MEM_SPACE(1) | /* memory */
-                                                         WAIT_REG_MEM_FUNCTION(3) |  /* == */
-                                                         WAIT_REG_MEM_ENGINE(2)));   /* ce */
-        amdgpu_ring_write(ring, gpu_addr & 0xfffffffc);
-        amdgpu_ring_write(ring, upper_32_bits(gpu_addr) & 0xffffffff);
-        amdgpu_ring_write(ring, 1);
+        amdgpu_ring_write(ring, (WAIT_REG_MEM_MEM_SPACE(1) | /* memory */
+                 WAIT_REG_MEM_FUNCTION(3))); /* equal */
+        amdgpu_ring_write(ring, addr & 0xfffffffc);
+        amdgpu_ring_write(ring, upper_32_bits(addr) & 0xffffffff);
+        amdgpu_ring_write(ring, seq);
         amdgpu_ring_write(ring, 0xffffffff);
         amdgpu_ring_write(ring, 4); /* poll interval */
 
-        /* instruct CE to reset wb of ce_sync to zero */
-        amdgpu_ring_write(ring, PACKET3(PACKET3_WRITE_DATA, 3));
-        amdgpu_ring_write(ring, (WRITE_DATA_ENGINE_SEL(2) |
-                                                         WRITE_DATA_DST_SEL(5) |
-                                                         WR_CONFIRM));
-        amdgpu_ring_write(ring, gpu_addr & 0xfffffffc);
-        amdgpu_ring_write(ring, upper_32_bits(gpu_addr) & 0xffffffff);
-        amdgpu_ring_write(ring, 0);
-}
-
-static void gfx_v8_0_ring_emit_vm_flush(struct amdgpu_ring *ring,
-                                        unsigned vm_id, uint64_t pd_addr)
-{
-        int usepfp = (ring->type == AMDGPU_RING_TYPE_GFX);
+        if (usepfp) {
+                /* synce CE with ME to prevent CE fetch CEIB before context switch done */
+                amdgpu_ring_write(ring, PACKET3(PACKET3_SWITCH_BUFFER, 0));
+                amdgpu_ring_write(ring, 0);
+                amdgpu_ring_write(ring, PACKET3(PACKET3_SWITCH_BUFFER, 0));
+                amdgpu_ring_write(ring, 0);
+        }
 
         amdgpu_ring_write(ring, PACKET3(PACKET3_WRITE_DATA, 3));
         amdgpu_ring_write(ring, (WRITE_DATA_ENGINE_SEL(usepfp) |
-                                 WRITE_DATA_DST_SEL(0)));
+                                 WRITE_DATA_DST_SEL(0)) |
+                                 WR_CONFIRM);
         if (vm_id < 8) {
                 amdgpu_ring_write(ring,
                                   (mmVM_CONTEXT0_PAGE_TABLE_BASE_ADDR + vm_id));
@@ -4083,9 +4061,10 @@ static void gfx_v8_0_ring_emit_vm_flush(struct amdgpu_ring *ring,
                 /* sync PFP to ME, otherwise we might get invalid PFP reads */
                 amdgpu_ring_write(ring, PACKET3(PACKET3_PFP_SYNC_ME, 0));
                 amdgpu_ring_write(ring, 0x0);
-
-                /* synce CE with ME to prevent CE fetch CEIB before context switch done */
-                gfx_v8_0_ce_sync_me(ring);
+                amdgpu_ring_write(ring, PACKET3(PACKET3_SWITCH_BUFFER, 0));
+                amdgpu_ring_write(ring, 0);
+                amdgpu_ring_write(ring, PACKET3(PACKET3_SWITCH_BUFFER, 0));
+                amdgpu_ring_write(ring, 0);
         }
 }
 
diff --git a/drivers/gpu/drm/amd/amdgpu/iceland_smc.c b/drivers/gpu/drm/amd/amdgpu/iceland_smc.c
index c900aa942ade..966d4b2ed9da 100644
--- a/drivers/gpu/drm/amd/amdgpu/iceland_smc.c
+++ b/drivers/gpu/drm/amd/amdgpu/iceland_smc.c
@@ -625,7 +625,7 @@ int iceland_smu_init(struct amdgpu_device *adev)
         ret = amdgpu_bo_create(adev, image_size, PAGE_SIZE,
                                true, AMDGPU_GEM_DOMAIN_VRAM,
                                AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED,
-                               NULL, toc_buf);
+                               NULL, NULL, toc_buf);
         if (ret) {
                 DRM_ERROR("Failed to allocate memory for TOC buffer\n");
                 return -ENOMEM;
diff --git a/drivers/gpu/drm/amd/amdgpu/tonga_smc.c b/drivers/gpu/drm/amd/amdgpu/tonga_smc.c
index 1f5ac941a610..5421309c1862 100644
--- a/drivers/gpu/drm/amd/amdgpu/tonga_smc.c
+++ b/drivers/gpu/drm/amd/amdgpu/tonga_smc.c
@@ -763,7 +763,7 @@ int tonga_smu_init(struct amdgpu_device *adev)
         ret = amdgpu_bo_create(adev, image_size, PAGE_SIZE,
                                true, AMDGPU_GEM_DOMAIN_VRAM,
                                AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED,
-                               NULL, toc_buf);
+                               NULL, NULL, toc_buf);
         if (ret) {
                 DRM_ERROR("Failed to allocate memory for TOC buffer\n");
                 return -ENOMEM;
@@ -773,7 +773,7 @@ int tonga_smu_init(struct amdgpu_device *adev)
         ret = amdgpu_bo_create(adev, smu_internal_buffer_size, PAGE_SIZE,
                                true, AMDGPU_GEM_DOMAIN_VRAM,
                                AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED,
-                               NULL, smu_buf);
+                               NULL, NULL, smu_buf);
         if (ret) {
                 DRM_ERROR("Failed to allocate memory for SMU internal buffer\n");
                 return -ENOMEM;
diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v4_2.c b/drivers/gpu/drm/amd/amdgpu/uvd_v4_2.c
index 5fac5da694f0..ed50dd725788 100644
--- a/drivers/gpu/drm/amd/amdgpu/uvd_v4_2.c
+++ b/drivers/gpu/drm/amd/amdgpu/uvd_v4_2.c
@@ -224,11 +224,11 @@ static int uvd_v4_2_suspend(void *handle)
         int r;
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
-        r = uvd_v4_2_hw_fini(adev);
+        r = amdgpu_uvd_suspend(adev);
         if (r)
                 return r;
 
-        r = amdgpu_uvd_suspend(adev);
+        r = uvd_v4_2_hw_fini(adev);
         if (r)
                 return r;
 
diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v5_0.c b/drivers/gpu/drm/amd/amdgpu/uvd_v5_0.c
index 2d5c59c318af..9ad8b9906c0b 100644
--- a/drivers/gpu/drm/amd/amdgpu/uvd_v5_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/uvd_v5_0.c
@@ -220,11 +220,11 @@ static int uvd_v5_0_suspend(void *handle)
         int r;
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
-        r = uvd_v5_0_hw_fini(adev);
+        r = amdgpu_uvd_suspend(adev);
         if (r)
                 return r;
 
-        r = amdgpu_uvd_suspend(adev);
+        r = uvd_v5_0_hw_fini(adev);
         if (r)
                 return r;
 
diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c b/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c
index d9f553fce531..7e9934fa4193 100644
--- a/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c
@@ -214,14 +214,16 @@ static int uvd_v6_0_suspend(void *handle)
         int r;
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
+        /* Skip this for APU for now */
+        if (!(adev->flags & AMD_IS_APU)) {
+                r = amdgpu_uvd_suspend(adev);
+                if (r)
+                        return r;
+        }
         r = uvd_v6_0_hw_fini(adev);
         if (r)
                 return r;
 
-        r = amdgpu_uvd_suspend(adev);
-        if (r)
-                return r;
-
         return r;
 }
 
@@ -230,10 +232,12 @@ static int uvd_v6_0_resume(void *handle)
         int r;
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
-        r = amdgpu_uvd_resume(adev);
-        if (r)
-                return r;
-
+        /* Skip this for APU for now */
+        if (!(adev->flags & AMD_IS_APU)) {
+                r = amdgpu_uvd_resume(adev);
+                if (r)
+                        return r;
+        }
         r = uvd_v6_0_hw_init(adev);
         if (r)
                 return r;
diff --git a/drivers/gpu/drm/amd/amdgpu/vi.c b/drivers/gpu/drm/amd/amdgpu/vi.c
index 552d9e75ad1b..b55ceb14fdcd 100644
--- a/drivers/gpu/drm/amd/amdgpu/vi.c
+++ b/drivers/gpu/drm/amd/amdgpu/vi.c
@@ -1400,7 +1400,8 @@ static int vi_common_early_init(void *handle)
         case CHIP_CARRIZO:
                 adev->has_uvd = true;
                 adev->cg_flags = 0;
-                adev->pg_flags = AMDGPU_PG_SUPPORT_UVD | AMDGPU_PG_SUPPORT_VCE;
+                /* Disable UVD pg */
+                adev->pg_flags = /* AMDGPU_PG_SUPPORT_UVD | */AMDGPU_PG_SUPPORT_VCE;
                 adev->external_rev_id = adev->rev_id + 0x1;
                 if (amdgpu_smc_load_fw && smc_enabled)
                         adev->firmware.smu_load = true;
diff --git a/drivers/gpu/drm/amd/scheduler/gpu_sched_trace.h b/drivers/gpu/drm/amd/scheduler/gpu_sched_trace.h
new file mode 100644
index 000000000000..144f50acc971
--- /dev/null
+++ b/drivers/gpu/drm/amd/scheduler/gpu_sched_trace.h
@@ -0,0 +1,41 @@
+#if !defined(_GPU_SCHED_TRACE_H) || defined(TRACE_HEADER_MULTI_READ)
+#define _GPU_SCHED_TRACE_H_
+
+#include <linux/stringify.h>
+#include <linux/types.h>
+#include <linux/tracepoint.h>
+
+#include <drm/drmP.h>
+
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM gpu_sched
+#define TRACE_INCLUDE_FILE gpu_sched_trace
+
+TRACE_EVENT(amd_sched_job,
+            TP_PROTO(struct amd_sched_job *sched_job),
+            TP_ARGS(sched_job),
+            TP_STRUCT__entry(
+                             __field(struct amd_sched_entity *, entity)
+                             __field(const char *, name)
+                             __field(u32, job_count)
+                             __field(int, hw_job_count)
+                             ),
+
+            TP_fast_assign(
+                           __entry->entity = sched_job->s_entity;
+                           __entry->name = sched_job->sched->name;
+                           __entry->job_count = kfifo_len(
+                                   &sched_job->s_entity->job_queue) / sizeof(sched_job);
+                           __entry->hw_job_count = atomic_read(
+                                   &sched_job->sched->hw_rq_count);
+                           ),
+            TP_printk("entity=%p, ring=%s, job count:%u, hw job count:%d",
+                      __entry->entity, __entry->name, __entry->job_count,
+                      __entry->hw_job_count)
+);
+#endif
+
+/* This part must be outside protection */
+#undef TRACE_INCLUDE_PATH
+#define TRACE_INCLUDE_PATH .
+#include <trace/define_trace.h>
diff --git a/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c b/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c
index 9259f1b6664c..3697eeeecf82 100644
--- a/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c
+++ b/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c
@@ -27,6 +27,9 @@
 #include <drm/drmP.h>
 #include "gpu_scheduler.h"
 
+#define CREATE_TRACE_POINTS
+#include "gpu_sched_trace.h"
+
 static struct amd_sched_job *
 amd_sched_entity_pop_job(struct amd_sched_entity *entity);
 static void amd_sched_wakeup(struct amd_gpu_scheduler *sched);
@@ -65,29 +68,29 @@ static struct amd_sched_job *
 amd_sched_rq_select_job(struct amd_sched_rq *rq)
 {
         struct amd_sched_entity *entity;
-        struct amd_sched_job *job;
+        struct amd_sched_job *sched_job;
 
         spin_lock(&rq->lock);
 
         entity = rq->current_entity;
         if (entity) {
                 list_for_each_entry_continue(entity, &rq->entities, list) {
-                        job = amd_sched_entity_pop_job(entity);
-                        if (job) {
+                        sched_job = amd_sched_entity_pop_job(entity);
+                        if (sched_job) {
                                 rq->current_entity = entity;
                                 spin_unlock(&rq->lock);
-                                return job;
+                                return sched_job;
                         }
                 }
         }
 
         list_for_each_entry(entity, &rq->entities, list) {
 
-                job = amd_sched_entity_pop_job(entity);
-                if (job) {
+                sched_job = amd_sched_entity_pop_job(entity);
+                if (sched_job) {
                         rq->current_entity = entity;
                         spin_unlock(&rq->lock);
-                        return job;
+                        return sched_job;
                 }
 
                 if (entity == rq->current_entity)
@@ -115,23 +118,27 @@ int amd_sched_entity_init(struct amd_gpu_scheduler *sched,
                           struct amd_sched_rq *rq,
                           uint32_t jobs)
 {
+        int r;
+
         if (!(sched && entity && rq))
                 return -EINVAL;
 
         memset(entity, 0, sizeof(struct amd_sched_entity));
-        entity->belongto_rq = rq;
-        entity->scheduler = sched;
-        entity->fence_context = fence_context_alloc(1);
-        if(kfifo_alloc(&entity->job_queue,
-                       jobs * sizeof(void *),
-                       GFP_KERNEL))
-                return -EINVAL;
+        INIT_LIST_HEAD(&entity->list);
+        entity->rq = rq;
+        entity->sched = sched;
 
         spin_lock_init(&entity->queue_lock);
+        r = kfifo_alloc(&entity->job_queue, jobs * sizeof(void *), GFP_KERNEL);
+        if (r)
+                return r;
+
         atomic_set(&entity->fence_seq, 0);
+        entity->fence_context = fence_context_alloc(1);
 
         /* Add the entity to the run queue */
         amd_sched_rq_add_entity(rq, entity);
+
         return 0;
 }
 
@@ -146,8 +153,8 @@ int amd_sched_entity_init(struct amd_gpu_scheduler *sched,
 static bool amd_sched_entity_is_initialized(struct amd_gpu_scheduler *sched,
                                             struct amd_sched_entity *entity)
 {
-        return entity->scheduler == sched &&
-                entity->belongto_rq != NULL;
+        return entity->sched == sched &&
+                entity->rq != NULL;
 }
 
 /**
@@ -177,7 +184,7 @@ static bool amd_sched_entity_is_idle(struct amd_sched_entity *entity)
 void amd_sched_entity_fini(struct amd_gpu_scheduler *sched,
                            struct amd_sched_entity *entity)
 {
-        struct amd_sched_rq *rq = entity->belongto_rq;
+        struct amd_sched_rq *rq = entity->rq;
 
         if (!amd_sched_entity_is_initialized(sched, entity))
                 return;
@@ -198,22 +205,22 @@ static void amd_sched_entity_wakeup(struct fence *f, struct fence_cb *cb)
                 container_of(cb, struct amd_sched_entity, cb);
         entity->dependency = NULL;
         fence_put(f);
-        amd_sched_wakeup(entity->scheduler);
+        amd_sched_wakeup(entity->sched);
 }
 
 static struct amd_sched_job *
 amd_sched_entity_pop_job(struct amd_sched_entity *entity)
 {
-        struct amd_gpu_scheduler *sched = entity->scheduler;
-        struct amd_sched_job *job;
+        struct amd_gpu_scheduler *sched = entity->sched;
+        struct amd_sched_job *sched_job;
 
         if (ACCESS_ONCE(entity->dependency))
                 return NULL;
 
-        if (!kfifo_out_peek(&entity->job_queue, &job, sizeof(job)))
+        if (!kfifo_out_peek(&entity->job_queue, &sched_job, sizeof(sched_job)))
                 return NULL;
 
-        while ((entity->dependency = sched->ops->dependency(job))) {
+        while ((entity->dependency = sched->ops->dependency(sched_job))) {
 
                 if (fence_add_callback(entity->dependency, &entity->cb,
                                        amd_sched_entity_wakeup))
@@ -222,32 +229,33 @@ amd_sched_entity_pop_job(struct amd_sched_entity *entity)
                         return NULL;
         }
 
-        return job;
+        return sched_job;
 }
 
 /**
  * Helper to submit a job to the job queue
  *
- * @job         The pointer to job required to submit
+ * @sched_job           The pointer to job required to submit
  *
  * Returns true if we could submit the job.
  */
-static bool amd_sched_entity_in(struct amd_sched_job *job)
+static bool amd_sched_entity_in(struct amd_sched_job *sched_job)
 {
-        struct amd_sched_entity *entity = job->s_entity;
+        struct amd_sched_entity *entity = sched_job->s_entity;
         bool added, first = false;
 
         spin_lock(&entity->queue_lock);
-        added = kfifo_in(&entity->job_queue, &job, sizeof(job)) == sizeof(job);
+        added = kfifo_in(&entity->job_queue, &sched_job,
+                        sizeof(sched_job)) == sizeof(sched_job);
 
-        if (added && kfifo_len(&entity->job_queue) == sizeof(job))
+        if (added && kfifo_len(&entity->job_queue) == sizeof(sched_job))
                 first = true;
 
         spin_unlock(&entity->queue_lock);
 
         /* first job wakes up scheduler */
         if (first)
-                amd_sched_wakeup(job->sched);
+                amd_sched_wakeup(sched_job->sched);
 
         return added;
 }
@@ -255,7 +263,7 @@ static bool amd_sched_entity_in(struct amd_sched_job *job)
 /**
  * Submit a job to the job queue
  *
- * @job         The pointer to job required to submit
+ * @sched_job           The pointer to job required to submit
  *
  * Returns 0 for success, negative error code otherwise.
  */
@@ -271,9 +279,9 @@ int amd_sched_entity_push_job(struct amd_sched_job *sched_job)
         fence_get(&fence->base);
         sched_job->s_fence = fence;
 
-        wait_event(entity->scheduler->job_scheduled,
+        wait_event(entity->sched->job_scheduled,
                    amd_sched_entity_in(sched_job));
-
+        trace_amd_sched_job(sched_job);
         return 0;
 }
 
@@ -301,30 +309,28 @@ static void amd_sched_wakeup(struct amd_gpu_scheduler *sched)
 static struct amd_sched_job *
 amd_sched_select_job(struct amd_gpu_scheduler *sched)
 {
-        struct amd_sched_job *job;
+        struct amd_sched_job *sched_job;
 
         if (!amd_sched_ready(sched))
                 return NULL;
 
         /* Kernel run queue has higher priority than normal run queue*/
-        job = amd_sched_rq_select_job(&sched->kernel_rq);
-        if (job == NULL)
-                job = amd_sched_rq_select_job(&sched->sched_rq);
+        sched_job = amd_sched_rq_select_job(&sched->kernel_rq);
+        if (sched_job == NULL)
+                sched_job = amd_sched_rq_select_job(&sched->sched_rq);
 
-        return job;
+        return sched_job;
 }
 
 static void amd_sched_process_job(struct fence *f, struct fence_cb *cb)
 {
-        struct amd_sched_job *sched_job =
-                container_of(cb, struct amd_sched_job, cb);
-        struct amd_gpu_scheduler *sched;
+        struct amd_sched_fence *s_fence =
+                container_of(cb, struct amd_sched_fence, cb);
+        struct amd_gpu_scheduler *sched = s_fence->sched;
 
-        sched = sched_job->sched;
-        amd_sched_fence_signal(sched_job->s_fence);
         atomic_dec(&sched->hw_rq_count);
-        fence_put(&sched_job->s_fence->base);
-        sched->ops->process_job(sched_job);
+        amd_sched_fence_signal(s_fence);
+        fence_put(&s_fence->base);
         wake_up_interruptible(&sched->wake_up_worker);
 }
 
@@ -338,87 +344,82 @@ static int amd_sched_main(void *param)
 
         while (!kthread_should_stop()) {
                 struct amd_sched_entity *entity;
-                struct amd_sched_job *job;
+                struct amd_sched_fence *s_fence;
+                struct amd_sched_job *sched_job;
                 struct fence *fence;
 
                 wait_event_interruptible(sched->wake_up_worker,
                         kthread_should_stop() ||
-                        (job = amd_sched_select_job(sched)));
+                        (sched_job = amd_sched_select_job(sched)));
 
-                if (!job)
+                if (!sched_job)
                         continue;
 
-                entity = job->s_entity;
+                entity = sched_job->s_entity;
+                s_fence = sched_job->s_fence;
                 atomic_inc(&sched->hw_rq_count);
-                fence = sched->ops->run_job(job);
+                fence = sched->ops->run_job(sched_job);
                 if (fence) {
-                        r = fence_add_callback(fence, &job->cb,
+                        r = fence_add_callback(fence, &s_fence->cb,
                                                amd_sched_process_job);
                         if (r == -ENOENT)
-                                amd_sched_process_job(fence, &job->cb);
+                                amd_sched_process_job(fence, &s_fence->cb);
                         else if (r)
                                 DRM_ERROR("fence add callback failed (%d)\n", r);
                         fence_put(fence);
+                } else {
+                        DRM_ERROR("Failed to run job!\n");
+                        amd_sched_process_job(NULL, &s_fence->cb);
                 }
 
-                count = kfifo_out(&entity->job_queue, &job, sizeof(job));
-                WARN_ON(count != sizeof(job));
+                count = kfifo_out(&entity->job_queue, &sched_job,
+                                sizeof(sched_job));
+                WARN_ON(count != sizeof(sched_job));
                 wake_up(&sched->job_scheduled);
         }
         return 0;
 }
 
 /**
- * Create a gpu scheduler
+ * Init a gpu scheduler instance
  *
+ * @sched               The pointer to the scheduler
  * @ops                 The backend operations for this scheduler.
- * @ring                The the ring id for the scheduler.
  * @hw_submissions      Number of hw submissions to do.
+ * @name                Name used for debugging
  *
- * Return the pointer to scheduler for success, otherwise return NULL
+ * Return 0 on success, otherwise error code.
 */
-struct amd_gpu_scheduler *amd_sched_create(struct amd_sched_backend_ops *ops,
-                                           unsigned ring, unsigned hw_submission,
-                                           void *priv)
+int amd_sched_init(struct amd_gpu_scheduler *sched,
+                   struct amd_sched_backend_ops *ops,
+                   unsigned hw_submission, const char *name)
 {
-        struct amd_gpu_scheduler *sched;
-
-        sched = kzalloc(sizeof(struct amd_gpu_scheduler), GFP_KERNEL);
-        if (!sched)
-                return NULL;
-
         sched->ops = ops;
-        sched->ring_id = ring;
         sched->hw_submission_limit = hw_submission;
-        sched->priv = priv;
-        snprintf(sched->name, sizeof(sched->name), "amdgpu[%d]", ring);
+        sched->name = name;
         amd_sched_rq_init(&sched->sched_rq);
         amd_sched_rq_init(&sched->kernel_rq);
 
         init_waitqueue_head(&sched->wake_up_worker);
         init_waitqueue_head(&sched->job_scheduled);
         atomic_set(&sched->hw_rq_count, 0);
+
         /* Each scheduler will run on a seperate kernel thread */
         sched->thread = kthread_run(amd_sched_main, sched, sched->name);
         if (IS_ERR(sched->thread)) {
-                DRM_ERROR("Failed to create scheduler for id %d.\n", ring);
-                kfree(sched);
-                return NULL;
+                DRM_ERROR("Failed to create scheduler for %s.\n", name);
+                return PTR_ERR(sched->thread);
         }
 
-        return sched;
+        return 0;
 }
 
 /**
  * Destroy a gpu scheduler
  *
  * @sched       The pointer to the scheduler
- *
- * return 0 if succeed. -1 if failed.
  */
-int amd_sched_destroy(struct amd_gpu_scheduler *sched)
+void amd_sched_fini(struct amd_gpu_scheduler *sched)
 {
         kthread_stop(sched->thread);
-        kfree(sched);
-        return  0;
 }
diff --git a/drivers/gpu/drm/amd/scheduler/gpu_scheduler.h b/drivers/gpu/drm/amd/scheduler/gpu_scheduler.h
index 2af0e4d4d817..80b64dc22214 100644
--- a/drivers/gpu/drm/amd/scheduler/gpu_scheduler.h
+++ b/drivers/gpu/drm/amd/scheduler/gpu_scheduler.h
@@ -38,13 +38,15 @@ struct amd_sched_rq;
 */
 struct amd_sched_entity {
         struct list_head                list;
-        struct amd_sched_rq             *belongto_rq;
-        atomic_t                        fence_seq;
-        /* the job_queue maintains the jobs submitted by clients */
-        struct kfifo                    job_queue;
+        struct amd_sched_rq             *rq;
+        struct amd_gpu_scheduler        *sched;
+
         spinlock_t                      queue_lock;
-        struct amd_gpu_scheduler        *scheduler;
+        struct kfifo                    job_queue;
+
+        atomic_t                        fence_seq;
         uint64_t                        fence_context;
+
         struct fence                    *dependency;
         struct fence_cb                 cb;
 };
@@ -62,13 +64,13 @@ struct amd_sched_rq {
 
 struct amd_sched_fence {
         struct fence                    base;
-        struct amd_gpu_scheduler        *scheduler;
+        struct fence_cb                 cb;
+        struct amd_gpu_scheduler        *sched;
         spinlock_t                      lock;
         void                            *owner;
 };
 
 struct amd_sched_job {
-        struct fence_cb                 cb;
         struct amd_gpu_scheduler        *sched;
         struct amd_sched_entity         *s_entity;
         struct amd_sched_fence          *s_fence;
@@ -91,32 +93,29 @@ static inline struct amd_sched_fence *to_amd_sched_fence(struct fence *f)
  * these functions should be implemented in driver side
 */
 struct amd_sched_backend_ops {
-        struct fence *(*dependency)(struct amd_sched_job *job);
-        struct fence *(*run_job)(struct amd_sched_job *job);
-        void (*process_job)(struct amd_sched_job *job);
+        struct fence *(*dependency)(struct amd_sched_job *sched_job);
+        struct fence *(*run_job)(struct amd_sched_job *sched_job);
 };
 
 /**
  * One scheduler is implemented for each hardware ring
 */
 struct amd_gpu_scheduler {
-        struct task_struct              *thread;
+        struct amd_sched_backend_ops    *ops;
+        uint32_t                        hw_submission_limit;
+        const char                      *name;
         struct amd_sched_rq             sched_rq;
         struct amd_sched_rq             kernel_rq;
-        atomic_t                        hw_rq_count;
-        struct amd_sched_backend_ops    *ops;
-        uint32_t                        ring_id;
         wait_queue_head_t               wake_up_worker;
         wait_queue_head_t               job_scheduled;
-        uint32_t                        hw_submission_limit;
-        char                            name[20];
-        void                            *priv;
+        atomic_t                        hw_rq_count;
+        struct task_struct              *thread;
 };
 
-struct amd_gpu_scheduler *
-amd_sched_create(struct amd_sched_backend_ops *ops,
-                 uint32_t ring, uint32_t hw_submission, void *priv);
-int amd_sched_destroy(struct amd_gpu_scheduler *sched);
+int amd_sched_init(struct amd_gpu_scheduler *sched,
+                   struct amd_sched_backend_ops *ops,
+                   uint32_t hw_submission, const char *name);
+void amd_sched_fini(struct amd_gpu_scheduler *sched);
 
 int amd_sched_entity_init(struct amd_gpu_scheduler *sched,
                           struct amd_sched_entity *entity,
diff --git a/drivers/gpu/drm/amd/scheduler/sched_fence.c b/drivers/gpu/drm/amd/scheduler/sched_fence.c
index e62c37920e11..d802638094f4 100644
--- a/drivers/gpu/drm/amd/scheduler/sched_fence.c
+++ b/drivers/gpu/drm/amd/scheduler/sched_fence.c
@@ -36,7 +36,7 @@ struct amd_sched_fence *amd_sched_fence_create(struct amd_sched_entity *s_entity
         if (fence == NULL)
                 return NULL;
         fence->owner = owner;
-        fence->scheduler = s_entity->scheduler;
+        fence->sched = s_entity->sched;
         spin_lock_init(&fence->lock);
 
         seq = atomic_inc_return(&s_entity->fence_seq);
@@ -63,7 +63,7 @@ static const char *amd_sched_fence_get_driver_name(struct fence *fence)
 static const char *amd_sched_fence_get_timeline_name(struct fence *f)
 {
         struct amd_sched_fence *fence = to_amd_sched_fence(f);
-        return (const char *)fence->scheduler->name;
+        return (const char *)fence->sched->name;
 }
 
 static bool amd_sched_fence_enable_signaling(struct fence *f)
diff --git a/drivers/gpu/drm/drm_ioctl.c b/drivers/gpu/drm/drm_ioctl.c
index 9a860ca1e9d7..d93e7378c077 100644
--- a/drivers/gpu/drm/drm_ioctl.c
+++ b/drivers/gpu/drm/drm_ioctl.c
@@ -520,7 +520,8 @@ EXPORT_SYMBOL(drm_ioctl_permit);
 
 /** Ioctl table */
 static const struct drm_ioctl_desc drm_ioctls[] = {
-        DRM_IOCTL_DEF(DRM_IOCTL_VERSION, drm_version, DRM_UNLOCKED|DRM_RENDER_ALLOW),
+        DRM_IOCTL_DEF(DRM_IOCTL_VERSION, drm_version,
+                      DRM_UNLOCKED|DRM_RENDER_ALLOW|DRM_CONTROL_ALLOW),
         DRM_IOCTL_DEF(DRM_IOCTL_GET_UNIQUE, drm_getunique, 0),
         DRM_IOCTL_DEF(DRM_IOCTL_GET_MAGIC, drm_getmagic, 0),
         DRM_IOCTL_DEF(DRM_IOCTL_IRQ_BUSID, drm_irq_by_busid, DRM_MASTER|DRM_ROOT_ONLY),
diff --git a/drivers/gpu/drm/exynos/Kconfig b/drivers/gpu/drm/exynos/Kconfig
index df0b61a60501..bd1a4156f647 100644
--- a/drivers/gpu/drm/exynos/Kconfig
+++ b/drivers/gpu/drm/exynos/Kconfig
@@ -77,6 +77,7 @@ config DRM_EXYNOS_VIDI
 config DRM_EXYNOS_G2D
         bool "Exynos DRM G2D"
         depends on DRM_EXYNOS && !VIDEO_SAMSUNG_S5P_G2D
+        select FRAME_VECTOR
         help
           Choose this option if you want to use Exynos G2D for DRM.
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_g2d.c b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
index 535b4ad6c4b1..3734c34aed16 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_g2d.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
@@ -194,10 +194,8 @@ struct g2d_cmdlist_userptr {
         dma_addr_t              dma_addr;
         unsigned long           userptr;
         unsigned long           size;
-        struct page             **pages;
-        unsigned int            npages;
+        struct frame_vector     *vec;
         struct sg_table         *sgt;
-        struct vm_area_struct   *vma;
         atomic_t                refcount;
         bool                    in_pool;
         bool                    out_of_list;
@@ -367,6 +365,7 @@ static void g2d_userptr_put_dma_addr(struct drm_device *drm_dev,
 {
         struct g2d_cmdlist_userptr *g2d_userptr =
                                         (struct g2d_cmdlist_userptr *)obj;
+        struct page **pages;
 
         if (!obj)
                 return;
@@ -386,19 +385,21 @@ out:
         exynos_gem_unmap_sgt_from_dma(drm_dev, g2d_userptr->sgt,
                                         DMA_BIDIRECTIONAL);
 
-        exynos_gem_put_pages_to_userptr(g2d_userptr->pages,
-                                        g2d_userptr->npages,
-                                        g2d_userptr->vma);
+        pages = frame_vector_pages(g2d_userptr->vec);
+        if (!IS_ERR(pages)) {
+                int i;
 
-        exynos_gem_put_vma(g2d_userptr->vma);
+                for (i = 0; i < frame_vector_count(g2d_userptr->vec); i++)
+                        set_page_dirty_lock(pages[i]);
+        }
+        put_vaddr_frames(g2d_userptr->vec);
+        frame_vector_destroy(g2d_userptr->vec);
 
         if (!g2d_userptr->out_of_list)
                 list_del_init(&g2d_userptr->list);
 
         sg_free_table(g2d_userptr->sgt);
         kfree(g2d_userptr->sgt);
-
-        drm_free_large(g2d_userptr->pages);
         kfree(g2d_userptr);
 }
 
@@ -412,9 +413,7 @@ static dma_addr_t *g2d_userptr_get_dma_addr(struct drm_device *drm_dev,
         struct exynos_drm_g2d_private *g2d_priv = file_priv->g2d_priv;
         struct g2d_cmdlist_userptr *g2d_userptr;
         struct g2d_data *g2d;
-        struct page **pages;
         struct sg_table *sgt;
-        struct vm_area_struct *vma;
         unsigned long start, end;
         unsigned int npages, offset;
         int ret;
@@ -460,65 +459,40 @@ static dma_addr_t *g2d_userptr_get_dma_addr(struct drm_device *drm_dev,
                 return ERR_PTR(-ENOMEM);
 
         atomic_set(&g2d_userptr->refcount, 1);
+        g2d_userptr->size = size;
 
         start = userptr & PAGE_MASK;
         offset = userptr & ~PAGE_MASK;
         end = PAGE_ALIGN(userptr + size);
         npages = (end - start) >> PAGE_SHIFT;
-        g2d_userptr->npages = npages;
-
-        pages = drm_calloc_large(npages, sizeof(struct page *));
-        if (!pages) {
-                DRM_ERROR("failed to allocate pages.\n");
+        g2d_userptr->vec = frame_vector_create(npages);
+        if (!g2d_userptr->vec) {
                 ret = -ENOMEM;
                 goto err_free;
         }
 
-        down_read(&current->mm->mmap_sem);
-        vma = find_vma(current->mm, userptr);
-        if (!vma) {
-                up_read(&current->mm->mmap_sem);
-                DRM_ERROR("failed to get vm region.\n");
+        ret = get_vaddr_frames(start, npages, true, true, g2d_userptr->vec);
+        if (ret != npages) {
+                DRM_ERROR("failed to get user pages from userptr.\n");
+                if (ret < 0)
+                        goto err_destroy_framevec;
                 ret = -EFAULT;
-                goto err_free_pages;
+                goto err_put_framevec;
         }
-
-        if (vma->vm_end < userptr + size) {
-                up_read(&current->mm->mmap_sem);
-                DRM_ERROR("vma is too small.\n");
+        if (frame_vector_to_pages(g2d_userptr->vec) < 0) {
                 ret = -EFAULT;
-                goto err_free_pages;
-        }
-
-        g2d_userptr->vma = exynos_gem_get_vma(vma);
-        if (!g2d_userptr->vma) {
-                up_read(&current->mm->mmap_sem);
-                DRM_ERROR("failed to copy vma.\n");
-                ret = -ENOMEM;
-                goto err_free_pages;
-        }
-
-        g2d_userptr->size = size;
-
-        ret = exynos_gem_get_pages_from_userptr(start & PAGE_MASK,
-                                                npages, pages, vma);
-        if (ret < 0) {
-                up_read(&current->mm->mmap_sem);
-                DRM_ERROR("failed to get user pages from userptr.\n");
-                goto err_put_vma;
+                goto err_put_framevec;
         }
 
-        up_read(&current->mm->mmap_sem);
-        g2d_userptr->pages = pages;
-
         sgt = kzalloc(sizeof(*sgt), GFP_KERNEL);
         if (!sgt) {
                 ret = -ENOMEM;
-                goto err_free_userptr;
+                goto err_put_framevec;
         }
 
-        ret = sg_alloc_table_from_pages(sgt, pages, npages, offset,
-                                        size, GFP_KERNEL);
+        ret = sg_alloc_table_from_pages(sgt,
+                                        frame_vector_pages(g2d_userptr->vec),
+                                        npages, offset, size, GFP_KERNEL);
         if (ret < 0) {
                 DRM_ERROR("failed to get sgt from pages.\n");
                 goto err_free_sgt;
@@ -553,16 +527,11 @@ err_sg_free_table:
 err_free_sgt:
         kfree(sgt);
 
-err_free_userptr:
-        exynos_gem_put_pages_to_userptr(g2d_userptr->pages,
-                                        g2d_userptr->npages,
-                                        g2d_userptr->vma);
-
-err_put_vma:
-        exynos_gem_put_vma(g2d_userptr->vma);
+err_put_framevec:
+        put_vaddr_frames(g2d_userptr->vec);
 
-err_free_pages:
-        drm_free_large(pages);
+err_destroy_framevec:
+        frame_vector_destroy(g2d_userptr->vec);
 
 err_free:
         kfree(g2d_userptr);
diff --git a/drivers/gpu/drm/exynos/exynos_drm_gem.c b/drivers/gpu/drm/exynos/exynos_drm_gem.c
index 62b9ea1b07fb..f12fbc36b120 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_gem.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_gem.c
@@ -366,103 +366,6 @@ int exynos_drm_gem_get_ioctl(struct drm_device *dev, void *data,
         return 0;
 }
 
-struct vm_area_struct *exynos_gem_get_vma(struct vm_area_struct *vma)
-{
-        struct vm_area_struct *vma_copy;
-
-        vma_copy = kmalloc(sizeof(*vma_copy), GFP_KERNEL);
-        if (!vma_copy)
-                return NULL;
-
-        if (vma->vm_ops && vma->vm_ops->open)
-                vma->vm_ops->open(vma);
-
-        if (vma->vm_file)
-                get_file(vma->vm_file);
-
-        memcpy(vma_copy, vma, sizeof(*vma));
-
-        vma_copy->vm_mm = NULL;
-        vma_copy->vm_next = NULL;
-        vma_copy->vm_prev = NULL;
-
-        return vma_copy;
-}
-
-void exynos_gem_put_vma(struct vm_area_struct *vma)
-{
-        if (!vma)
-                return;
-
-        if (vma->vm_ops && vma->vm_ops->close)
-                vma->vm_ops->close(vma);
-
-        if (vma->vm_file)
-                fput(vma->vm_file);
-
-        kfree(vma);
-}
-
-int exynos_gem_get_pages_from_userptr(unsigned long start,
-                                                unsigned int npages,
-                                                struct page **pages,
-                                                struct vm_area_struct *vma)
-{
-        int get_npages;
-
-        /* the memory region mmaped with VM_PFNMAP. */
-        if (vma_is_io(vma)) {
-                unsigned int i;
-
-                for (i = 0; i < npages; ++i, start += PAGE_SIZE) {
-                        unsigned long pfn;
-                        int ret = follow_pfn(vma, start, &pfn);
-                        if (ret)
-                                return ret;
-
-                        pages[i] = pfn_to_page(pfn);
-                }
-
-                if (i != npages) {
-                        DRM_ERROR("failed to get user_pages.\n");
-                        return -EINVAL;
-                }
-
-                return 0;
-        }
-
-        get_npages = get_user_pages(current, current->mm, start,
-                                        npages, 1, 1, pages, NULL);
-        get_npages = max(get_npages, 0);
-        if (get_npages != npages) {
-                DRM_ERROR("failed to get user_pages.\n");
-                while (get_npages)
-                        put_page(pages[--get_npages]);
-                return -EFAULT;
-        }
-
-        return 0;
-}
-
-void exynos_gem_put_pages_to_userptr(struct page **pages,
-                                        unsigned int npages,
-                                        struct vm_area_struct *vma)
-{
-        if (!vma_is_io(vma)) {
-                unsigned int i;
-
-                for (i = 0; i < npages; i++) {
-                        set_page_dirty_lock(pages[i]);
-
-                        /*
-                         * undo the reference we took when populating
-                         * the table.
-                         */
-                        put_page(pages[i]);
-                }
-        }
-}
-
 int exynos_gem_map_sgt_with_dma(struct drm_device *drm_dev,
                                 struct sg_table *sgt,
                                 enum dma_data_direction dir)
diff --git a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c
index 82be6b86a168..d1e300dcd544 100644
--- a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c
+++ b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_plane.c
@@ -58,7 +58,8 @@ static void fsl_dcu_drm_plane_atomic_disable(struct drm_plane *plane,
                                              struct drm_plane_state *old_state)
 {
         struct fsl_dcu_drm_device *fsl_dev = plane->dev->dev_private;
-        unsigned int index, value, ret;
+        unsigned int value;
+        int index, ret;
 
         index = fsl_dcu_drm_plane_index(plane);
         if (index < 0)
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 5a244ab9395b..39d73dbc1c47 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -640,6 +640,32 @@ static int __intel_get_crtc_scanline(struct intel_crtc *crtc)
                 position = __raw_i915_read32(dev_priv, PIPEDSL(pipe)) & DSL_LINEMASK_GEN3;
 
         /*
+         * On HSW, the DSL reg (0x70000) appears to return 0 if we
+         * read it just before the start of vblank.  So try it again
+         * so we don't accidentally end up spanning a vblank frame
+         * increment, causing the pipe_update_end() code to squak at us.
+         *
+         * The nature of this problem means we can't simply check the ISR
+         * bit and return the vblank start value; nor can we use the scanline
+         * debug register in the transcoder as it appears to have the same
+         * problem.  We may need to extend this to include other platforms,
+         * but so far testing only shows the problem on HSW.
+         */
+        if (IS_HASWELL(dev) && !position) {
+                int i, temp;
+
+                for (i = 0; i < 100; i++) {
+                        udelay(1);
+                        temp = __raw_i915_read32(dev_priv, PIPEDSL(pipe)) &
+                                DSL_LINEMASK_GEN3;
+                        if (temp != position) {
+                                position = temp;
+                                break;
+                        }
+                }
+        }
+
+        /*
          * See update_scanline_offset() for the details on the
          * scanline_offset adjustment.
          */
diff --git a/drivers/gpu/drm/i915/intel_audio.c b/drivers/gpu/drm/i915/intel_audio.c
index 89c1a8ce1f98..2a5c76faf9f8 100644
--- a/drivers/gpu/drm/i915/intel_audio.c
+++ b/drivers/gpu/drm/i915/intel_audio.c
@@ -430,7 +430,7 @@ void intel_audio_codec_enable(struct intel_encoder *intel_encoder)
 
 /**
  * intel_audio_codec_disable - Disable the audio codec for HD audio
- * @encoder: encoder on which to disable audio
+ * @intel_encoder: encoder on which to disable audio
  *
  * The disable sequences must be performed before disabling the transcoder or
  * port.
diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
index b3e437b3bb54..c19e669ffe50 100644
--- a/drivers/gpu/drm/i915/intel_bios.c
+++ b/drivers/gpu/drm/i915/intel_bios.c
@@ -42,7 +42,7 @@ find_section(const void *_bdb, int section_id)
         const struct bdb_header *bdb = _bdb;
         const u8 *base = _bdb;
         int index = 0;
-        u16 total, current_size;
+        u32 total, current_size;
         u8 current_id;
 
         /* skip to first section */
@@ -57,6 +57,10 @@ find_section(const void *_bdb, int section_id)
                 current_size = *((const u16 *)(base + index));
                 index += 2;
 
+                /* The MIPI Sequence Block v3+ has a separate size field. */
+                if (current_id == BDB_MIPI_SEQUENCE && *(base + index) >= 3)
+                        current_size = *((const u32 *)(base + index + 1));
+
                 if (index + current_size > total)
                         return NULL;
 
@@ -799,6 +803,12 @@ parse_mipi(struct drm_i915_private *dev_priv, const struct bdb_header *bdb)
                 return;
         }
 
+        /* Fail gracefully for forward incompatible sequence block. */
+        if (sequence->version >= 3) {
+                DRM_ERROR("Unable to parse MIPI Sequence Block v3+\n");
+                return;
+        }
+
         DRM_DEBUG_DRIVER("Found MIPI sequence block\n");
 
         block_size = get_blocksize(sequence);
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 8cc9264f7809..cf418be7d30a 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -15087,9 +15087,12 @@ static void readout_plane_state(struct intel_crtc *crtc,
 
                 plane_state = to_intel_plane_state(p->base.state);
 
-                if (p->base.type == DRM_PLANE_TYPE_PRIMARY)
+                if (p->base.type == DRM_PLANE_TYPE_PRIMARY) {
                         plane_state->visible = primary_get_hw_state(crtc);
-                else {
+                        if (plane_state->visible)
+                                crtc->base.state->plane_mask |=
+                                        1 << drm_plane_index(&p->base);
+                } else {
                         if (active)
                                 p->disable_plane(&p->base, &crtc->base);
 
diff --git a/drivers/gpu/drm/mgag200/mgag200_fb.c b/drivers/gpu/drm/mgag200/mgag200_fb.c
index 87de15ea1f93..b35b5b2db4ec 100644
--- a/drivers/gpu/drm/mgag200/mgag200_fb.c
+++ b/drivers/gpu/drm/mgag200/mgag200_fb.c
@@ -186,17 +186,19 @@ static int mgag200fb_create(struct drm_fb_helper *helper,
 
         sysram = vmalloc(size);
         if (!sysram)
-                return -ENOMEM;
+                goto err_sysram;
 
         info = drm_fb_helper_alloc_fbi(helper);
-        if (IS_ERR(info))
-                return PTR_ERR(info);
+        if (IS_ERR(info)) {
+                ret = PTR_ERR(info);
+                goto err_alloc_fbi;
+        }
 
         info->par = mfbdev;
 
         ret = mgag200_framebuffer_init(dev, &mfbdev->mfb, &mode_cmd, gobj);
         if (ret)
-                return ret;
+                goto err_framebuffer_init;
 
         mfbdev->sysram = sysram;
         mfbdev->size = size;
@@ -225,7 +227,17 @@ static int mgag200fb_create(struct drm_fb_helper *helper,
 
         DRM_DEBUG_KMS("allocated %dx%d\n",
                       fb->width, fb->height);
+
         return 0;
+
+err_framebuffer_init:
+        drm_fb_helper_release_fbi(helper);
+err_alloc_fbi:
+        vfree(sysram);
+err_sysram:
+        drm_gem_object_unreference_unlocked(gobj);
+
+        return ret;
 }
 
 static int mga_fbdev_destroy(struct drm_device *dev,
@@ -276,23 +288,26 @@ int mgag200_fbdev_init(struct mga_device *mdev)
         ret = drm_fb_helper_init(mdev->dev, &mfbdev->helper,
                                  mdev->num_crtc, MGAG200FB_CONN_LIMIT);
         if (ret)
-                return ret;
+                goto err_fb_helper;
 
         ret = drm_fb_helper_single_add_all_connectors(&mfbdev->helper);
         if (ret)
-                goto fini;
+                goto err_fb_setup;
 
         /* disable all the possible outputs/crtcs before entering KMS mode */
         drm_helper_disable_unused_functions(mdev->dev);
 
         ret = drm_fb_helper_initial_config(&mfbdev->helper, bpp_sel);
         if (ret)
-                goto fini;
+                goto err_fb_setup;
 
         return 0;
 
-fini:
+err_fb_setup:
         drm_fb_helper_fini(&mfbdev->helper);
+err_fb_helper:
+        mdev->mfbdev = NULL;
+
         return ret;
 }
 
diff --git a/drivers/gpu/drm/mgag200/mgag200_main.c b/drivers/gpu/drm/mgag200/mgag200_main.c
index de06388069e7..b1a0f5656175 100644
--- a/drivers/gpu/drm/mgag200/mgag200_main.c
+++ b/drivers/gpu/drm/mgag200/mgag200_main.c
@@ -220,7 +220,7 @@ int mgag200_driver_load(struct drm_device *dev, unsigned long flags)
         }
         r = mgag200_mm_init(mdev);
         if (r)
-                goto out;
+                goto err_mm;
 
         drm_mode_config_init(dev);
         dev->mode_config.funcs = (void *)&mga_mode_funcs;
@@ -233,7 +233,7 @@ int mgag200_driver_load(struct drm_device *dev, unsigned long flags)
         r = mgag200_modeset_init(mdev);
         if (r) {
                 dev_err(&dev->pdev->dev, "Fatal error during modeset init: %d\n", r);
-                goto out;
+                goto err_modeset;
         }
 
         /* Make small buffers to store a hardware cursor (double buffered icon updates) */
@@ -241,20 +241,24 @@ int mgag200_driver_load(struct drm_device *dev, unsigned long flags)
                                           &mdev->cursor.pixels_1);
         mgag200_bo_create(dev, roundup(48*64, PAGE_SIZE), 0, 0,
                                           &mdev->cursor.pixels_2);
-        if (!mdev->cursor.pixels_2 || !mdev->cursor.pixels_1)
-                goto cursor_nospace;
-        mdev->cursor.pixels_current = mdev->cursor.pixels_1;
-        mdev->cursor.pixels_prev = mdev->cursor.pixels_2;
-        goto cursor_done;
- cursor_nospace:
-        mdev->cursor.pixels_1 = NULL;
-        mdev->cursor.pixels_2 = NULL;
-        dev_warn(&dev->pdev->dev, "Could not allocate space for cursors. Not doing hardware cursors.\n");
- cursor_done:
-
-out:
-        if (r)
-                mgag200_driver_unload(dev);
+        if (!mdev->cursor.pixels_2 || !mdev->cursor.pixels_1) {
+                mdev->cursor.pixels_1 = NULL;
+                mdev->cursor.pixels_2 = NULL;
+                dev_warn(&dev->pdev->dev,
+                        "Could not allocate space for cursors. Not doing hardware cursors.\n");
+        } else {
+                mdev->cursor.pixels_current = mdev->cursor.pixels_1;
+                mdev->cursor.pixels_prev = mdev->cursor.pixels_2;
+        }
+
+        return 0;
+
+err_modeset:
+        drm_mode_config_cleanup(dev);
+        mgag200_mm_fini(mdev);
+err_mm:
+        dev->dev_private = NULL;
+
         return r;
 }
 
diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_irq.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_irq.c
index b1f73bee1368..b0d4b53b97f4 100644
--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_irq.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_irq.c
@@ -178,7 +178,6 @@ static int mdp5_hw_irqdomain_map(struct irq_domain *d,
 
         irq_set_chip_and_handler(irq, &mdp5_hw_irq_chip, handle_level_irq);
         irq_set_chip_data(irq, mdp5_kms);
-        set_irq_flags(irq, IRQF_VALID);
 
         return 0;
 }
diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c
index 7c6225c84ba6..dd845f82cc24 100644
--- a/drivers/gpu/drm/qxl/qxl_display.c
+++ b/drivers/gpu/drm/qxl/qxl_display.c
@@ -886,13 +886,15 @@ static enum drm_connector_status qxl_conn_detect(
                 drm_connector_to_qxl_output(connector);
         struct drm_device *ddev = connector->dev;
         struct qxl_device *qdev = ddev->dev_private;
-        int connected;
+        bool connected = false;
 
         /* The first monitor is always connected */
-        connected = (output->index == 0) ||
-                    (qdev->client_monitors_config &&
-                     qdev->client_monitors_config->count > output->index &&
-                     qxl_head_enabled(&qdev->client_monitors_config->heads[output->index]));
+        if (!qdev->client_monitors_config) {
+                if (output->index == 0)
+                        connected = true;
+        } else
+                connected = qdev->client_monitors_config->count > output->index &&
+                     qxl_head_enabled(&qdev->client_monitors_config->heads[output->index]);
 
         DRM_DEBUG("#%d connected: %d\n", output->index, connected);
         if (!connected)
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index d8319dae8358..f3f562f6d848 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -1573,10 +1573,12 @@ int radeon_suspend_kms(struct drm_device *dev, bool suspend, bool fbcon)
 
         drm_kms_helper_poll_disable(dev);
 
+        drm_modeset_lock_all(dev);
         /* turn off display hw */
         list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
                 drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF);
         }
+        drm_modeset_unlock_all(dev);
 
         /* unpin the front buffers and cursors */
         list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
@@ -1734,9 +1736,11 @@ int radeon_resume_kms(struct drm_device *dev, bool resume, bool fbcon)
         if (fbcon) {
                 drm_helper_resume_force_mode(dev);
                 /* turn on display hw */
+                drm_modeset_lock_all(dev);
                 list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
                         drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON);
                 }
+                drm_modeset_unlock_all(dev);
         }
 
         drm_kms_helper_poll_enable(dev);
diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
index 787cd8fd897f..e9115d3f67b0 100644
--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -2927,6 +2927,7 @@ static struct si_dpm_quirk si_dpm_quirk_list[] = {
         { PCI_VENDOR_ID_ATI, 0x6810, 0x1462, 0x3036, 0, 120000 },
         { PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0xe271, 0, 120000 },
         { PCI_VENDOR_ID_ATI, 0x6810, 0x174b, 0xe271, 85000, 90000 },
+        { PCI_VENDOR_ID_ATI, 0x6811, 0x1762, 0x2015, 0, 120000 },
         { 0, 0, 0, 0 },
 };
 
diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index 8d9b7de25613..745e996d2dbc 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -882,6 +882,8 @@ int ttm_bo_mem_space(struct ttm_buffer_object *bo,
                 if (ret)
                         return ret;
                 man = &bdev->man[mem_type];
+                if (!man->has_type || !man->use_type)
+                        continue;
 
                 type_ok = ttm_bo_mt_compatible(man, mem_type, place,
                                                 &cur_flags);
@@ -889,6 +891,7 @@ int ttm_bo_mem_space(struct ttm_buffer_object *bo,
                 if (!type_ok)
                         continue;
 
+                type_found = true;
                 cur_flags = ttm_bo_select_caching(man, bo->mem.placement,
                                                   cur_flags);
                 /*
@@ -901,12 +904,10 @@ int ttm_bo_mem_space(struct ttm_buffer_object *bo,
                 if (mem_type == TTM_PL_SYSTEM)
                         break;
 
-                if (man->has_type && man->use_type) {
-                        type_found = true;
-                        ret = (*man->func->get_node)(man, bo, place, mem);
-                        if (unlikely(ret))
-                                return ret;
-                }
+                ret = (*man->func->get_node)(man, bo, place, mem);
+                if (unlikely(ret))
+                        return ret;
+                
                 if (mem->mm_node)
                         break;
         }
@@ -917,9 +918,6 @@ int ttm_bo_mem_space(struct ttm_buffer_object *bo,
                 return 0;
         }
 
-        if (!type_found)
-                return -EINVAL;
-
         for (i = 0; i < placement->num_busy_placement; ++i) {
                 const struct ttm_place *place = &placement->busy_placement[i];
 
@@ -927,11 +925,12 @@ int ttm_bo_mem_space(struct ttm_buffer_object *bo,
                 if (ret)
                         return ret;
                 man = &bdev->man[mem_type];
-                if (!man->has_type)
+                if (!man->has_type || !man->use_type)
                         continue;
                 if (!ttm_bo_mt_compatible(man, mem_type, place, &cur_flags))
                         continue;
 
+                type_found = true;
                 cur_flags = ttm_bo_select_caching(man, bo->mem.placement,
                                                   cur_flags);
                 /*
@@ -957,8 +956,13 @@ int ttm_bo_mem_space(struct ttm_buffer_object *bo,
                 if (ret == -ERESTARTSYS)
                         has_erestartsys = true;
         }
-        ret = (has_erestartsys) ? -ERESTARTSYS : -ENOMEM;
-        return ret;
+
+        if (!type_found) {
+                printk(KERN_ERR TTM_PFX "No compatible memory type found.\n");
+                return -EINVAL;
+        }
+
+        return (has_erestartsys) ? -ERESTARTSYS : -ENOMEM;
 }
 EXPORT_SYMBOL(ttm_bo_mem_space);
 
diff --git a/drivers/gpu/drm/vmwgfx/Kconfig b/drivers/gpu/drm/vmwgfx/Kconfig
index 67720f70fe29..b49445df8a7e 100644
--- a/drivers/gpu/drm/vmwgfx/Kconfig
+++ b/drivers/gpu/drm/vmwgfx/Kconfig
@@ -1,6 +1,6 @@
 config DRM_VMWGFX
         tristate "DRM driver for VMware Virtual GPU"
-        depends on DRM && PCI
+        depends on DRM && PCI && X86
         select FB_DEFERRED_IO
         select FB_CFB_FILLRECT
         select FB_CFB_COPYAREA
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_cotable.c b/drivers/gpu/drm/vmwgfx/vmwgfx_cotable.c
index ce659a125f2b..092ea81eeff7 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_cotable.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_cotable.c
@@ -311,7 +311,6 @@ static int vmw_cotable_unbind(struct vmw_resource *res,
         struct vmw_private *dev_priv = res->dev_priv;
         struct ttm_buffer_object *bo = val_buf->bo;
         struct vmw_fence_obj *fence;
-        int ret;
 
         if (list_empty(&res->mob_head))
                 return 0;
@@ -328,7 +327,7 @@ static int vmw_cotable_unbind(struct vmw_resource *res,
         if (likely(fence != NULL))
                 vmw_fence_obj_unreference(&fence);
 
-        return ret;
+        return 0;
 }
 
 /**
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index e13b20bd9908..2c7a25c71af2 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -752,12 +752,8 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
         ttm_lock_set_kill(&dev_priv->fbdev_master.lock, false, SIGTERM);
         dev_priv->active_master = &dev_priv->fbdev_master;
 
-
-        dev_priv->mmio_mtrr = arch_phys_wc_add(dev_priv->mmio_start,
-                                               dev_priv->mmio_size);
-
-        dev_priv->mmio_virt = ioremap_wc(dev_priv->mmio_start,
-                                         dev_priv->mmio_size);
+        dev_priv->mmio_virt = ioremap_cache(dev_priv->mmio_start,
+                                            dev_priv->mmio_size);
 
         if (unlikely(dev_priv->mmio_virt == NULL)) {
                 ret = -ENOMEM;
@@ -913,7 +909,6 @@ out_no_device:
 out_err4:
         iounmap(dev_priv->mmio_virt);
 out_err3:
-        arch_phys_wc_del(dev_priv->mmio_mtrr);
         vmw_ttm_global_release(dev_priv);
 out_err0:
         for (i = vmw_res_context; i < vmw_res_max; ++i)
@@ -964,7 +959,6 @@ static int vmw_driver_unload(struct drm_device *dev)
 
         ttm_object_device_release(&dev_priv->tdev);
         iounmap(dev_priv->mmio_virt);
-        arch_phys_wc_del(dev_priv->mmio_mtrr);
         if (dev_priv->ctx.staged_bindings)
                 vmw_binding_state_free(dev_priv->ctx.staged_bindings);
         vmw_ttm_global_release(dev_priv);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
index 6d02de6dc36c..f19fd39b43e1 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
@@ -376,7 +376,6 @@ struct vmw_private {
         uint32_t initial_width;
         uint32_t initial_height;
         u32 __iomem *mmio_virt;
-        int mmio_mtrr;
         uint32_t capabilities;
         uint32_t max_gmr_ids;
         uint32_t max_gmr_pages;
@@ -631,7 +630,8 @@ extern int vmw_user_dmabuf_alloc(struct vmw_private *dev_priv,
                                  uint32_t size,
                                  bool shareable,
                                  uint32_t *handle,
-                                 struct vmw_dma_buffer **p_dma_buf);
+                                 struct vmw_dma_buffer **p_dma_buf,
+                                 struct ttm_base_object **p_base);
 extern int vmw_user_dmabuf_reference(struct ttm_object_file *tfile,
                                      struct vmw_dma_buffer *dma_buf,
                                      uint32_t *handle);
@@ -645,7 +645,8 @@ extern uint32_t vmw_dmabuf_validate_node(struct ttm_buffer_object *bo,
                                          uint32_t cur_validate_node);
 extern void vmw_dmabuf_validate_clear(struct ttm_buffer_object *bo);
 extern int vmw_user_dmabuf_lookup(struct ttm_object_file *tfile,
-                                  uint32_t id, struct vmw_dma_buffer **out);
+                                  uint32_t id, struct vmw_dma_buffer **out,
+                                  struct ttm_base_object **base);
 extern int vmw_stream_claim_ioctl(struct drm_device *dev, void *data,
                                   struct drm_file *file_priv);
 extern int vmw_stream_unref_ioctl(struct drm_device *dev, void *data,
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
index b56565457c96..5da5de0cb522 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -1236,7 +1236,8 @@ static int vmw_translate_mob_ptr(struct vmw_private *dev_priv,
         struct vmw_relocation *reloc;
         int ret;
 
-        ret = vmw_user_dmabuf_lookup(sw_context->fp->tfile, handle, &vmw_bo);
+        ret = vmw_user_dmabuf_lookup(sw_context->fp->tfile, handle, &vmw_bo,
+                                     NULL);
         if (unlikely(ret != 0)) {
                 DRM_ERROR("Could not find or use MOB buffer.\n");
                 ret = -EINVAL;
@@ -1296,7 +1297,8 @@ static int vmw_translate_guest_ptr(struct vmw_private *dev_priv,
         struct vmw_relocation *reloc;
         int ret;
 
-        ret = vmw_user_dmabuf_lookup(sw_context->fp->tfile, handle, &vmw_bo);
+        ret = vmw_user_dmabuf_lookup(sw_context->fp->tfile, handle, &vmw_bo,
+                                     NULL);
         if (unlikely(ret != 0)) {
                 DRM_ERROR("Could not find or use GMR region.\n");
                 ret = -EINVAL;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index 61fb7f3de311..15a6c01cd016 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -1685,7 +1685,6 @@ int vmw_kms_helper_dirty(struct vmw_private *dev_priv,
         struct drm_crtc *crtc;
         u32 num_units = 0;
         u32 i, k;
-        int ret;
 
         dirty->dev_priv = dev_priv;
 
@@ -1711,7 +1710,7 @@ int vmw_kms_helper_dirty(struct vmw_private *dev_priv,
                         if (!dirty->cmd) {
                                 DRM_ERROR("Couldn't reserve fifo space "
                                           "for dirty blits.\n");
-                                return ret;
+                                return -ENOMEM;
                         }
                         memset(dirty->cmd, 0, dirty->fifo_reserve_size);
                 }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_overlay.c b/drivers/gpu/drm/vmwgfx/vmwgfx_overlay.c
index 76069f093ccf..222c9c2123a1 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_overlay.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_overlay.c
@@ -484,7 +484,7 @@ int vmw_overlay_ioctl(struct drm_device *dev, void *data,
                 goto out_unlock;
         }
 
-        ret = vmw_user_dmabuf_lookup(tfile, arg->handle, &buf);
+        ret = vmw_user_dmabuf_lookup(tfile, arg->handle, &buf, NULL);
         if (ret)
                 goto out_unlock;
 
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
index c1912f852b42..e57667ca7557 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
@@ -354,7 +354,7 @@ int vmw_user_lookup_handle(struct vmw_private *dev_priv,
         }
 
         *out_surf = NULL;
-        ret = vmw_user_dmabuf_lookup(tfile, handle, out_buf);
+        ret = vmw_user_dmabuf_lookup(tfile, handle, out_buf, NULL);
         return ret;
 }
 
@@ -481,7 +481,8 @@ int vmw_user_dmabuf_alloc(struct vmw_private *dev_priv,
                           uint32_t size,
                           bool shareable,
                           uint32_t *handle,
-                          struct vmw_dma_buffer **p_dma_buf)
+                          struct vmw_dma_buffer **p_dma_buf,
+                          struct ttm_base_object **p_base)
 {
         struct vmw_user_dma_buffer *user_bo;
         struct ttm_buffer_object *tmp;
@@ -515,6 +516,10 @@ int vmw_user_dmabuf_alloc(struct vmw_private *dev_priv,
         }
 
         *p_dma_buf = &user_bo->dma;
+        if (p_base) {
+                *p_base = &user_bo->prime.base;
+                kref_get(&(*p_base)->refcount);
+        }
         *handle = user_bo->prime.base.hash.key;
 
 out_no_base_object:
@@ -631,6 +636,7 @@ int vmw_user_dmabuf_synccpu_ioctl(struct drm_device *dev, void *data,
         struct vmw_dma_buffer *dma_buf;
         struct vmw_user_dma_buffer *user_bo;
         struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
+        struct ttm_base_object *buffer_base;
         int ret;
 
         if ((arg->flags & (drm_vmw_synccpu_read | drm_vmw_synccpu_write)) == 0
@@ -643,7 +649,8 @@ int vmw_user_dmabuf_synccpu_ioctl(struct drm_device *dev, void *data,
 
         switch (arg->op) {
         case drm_vmw_synccpu_grab:
-                ret = vmw_user_dmabuf_lookup(tfile, arg->handle, &dma_buf);
+                ret = vmw_user_dmabuf_lookup(tfile, arg->handle, &dma_buf,
+                                             &buffer_base);
                 if (unlikely(ret != 0))
                         return ret;
 
@@ -651,6 +658,7 @@ int vmw_user_dmabuf_synccpu_ioctl(struct drm_device *dev, void *data,
                                        dma);
                 ret = vmw_user_dmabuf_synccpu_grab(user_bo, tfile, arg->flags);
                 vmw_dmabuf_unreference(&dma_buf);
+                ttm_base_object_unref(&buffer_base);
                 if (unlikely(ret != 0 && ret != -ERESTARTSYS &&
                              ret != -EBUSY)) {
                         DRM_ERROR("Failed synccpu grab on handle 0x%08x.\n",
@@ -692,7 +700,8 @@ int vmw_dmabuf_alloc_ioctl(struct drm_device *dev, void *data,
                 return ret;
 
         ret = vmw_user_dmabuf_alloc(dev_priv, vmw_fpriv(file_priv)->tfile,
-                                    req->size, false, &handle, &dma_buf);
+                                    req->size, false, &handle, &dma_buf,
+                                    NULL);
         if (unlikely(ret != 0))
                 goto out_no_dmabuf;
 
@@ -721,7 +730,8 @@ int vmw_dmabuf_unref_ioctl(struct drm_device *dev, void *data,
 }
 
 int vmw_user_dmabuf_lookup(struct ttm_object_file *tfile,
-                           uint32_t handle, struct vmw_dma_buffer **out)
+                           uint32_t handle, struct vmw_dma_buffer **out,
+                           struct ttm_base_object **p_base)
 {
         struct vmw_user_dma_buffer *vmw_user_bo;
         struct ttm_base_object *base;
@@ -743,7 +753,10 @@ int vmw_user_dmabuf_lookup(struct ttm_object_file *tfile,
         vmw_user_bo = container_of(base, struct vmw_user_dma_buffer,
                                    prime.base);
         (void)ttm_bo_reference(&vmw_user_bo->dma.base);
-        ttm_base_object_unref(&base);
+        if (p_base)
+                *p_base = base;
+        else
+                ttm_base_object_unref(&base);
         *out = &vmw_user_bo->dma;
 
         return 0;
@@ -1004,7 +1017,7 @@ int vmw_dumb_create(struct drm_file *file_priv,
 
         ret = vmw_user_dmabuf_alloc(dev_priv, vmw_fpriv(file_priv)->tfile,
                                     args->size, false, &args->handle,
-                                    &dma_buf);
+                                    &dma_buf, NULL);
         if (unlikely(ret != 0))
                 goto out_no_dmabuf;
 
@@ -1032,7 +1045,7 @@ int vmw_dumb_map_offset(struct drm_file *file_priv,
         struct vmw_dma_buffer *out_buf;
         int ret;
 
-        ret = vmw_user_dmabuf_lookup(tfile, handle, &out_buf);
+        ret = vmw_user_dmabuf_lookup(tfile, handle, &out_buf, NULL);
         if (ret != 0)
                 return -EINVAL;
 
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c b/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c
index bba1ee395478..fd47547b0234 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c
@@ -855,7 +855,7 @@ static int vmw_shader_define(struct drm_device *dev, struct drm_file *file_priv,
 
         if (buffer_handle != SVGA3D_INVALID_ID) {
                 ret = vmw_user_dmabuf_lookup(tfile, buffer_handle,
-                                             &buffer);
+                                             &buffer, NULL);
                 if (unlikely(ret != 0)) {
                         DRM_ERROR("Could not find buffer for shader "
                                   "creation.\n");
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
index 3361769842f4..64b50409fa07 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
@@ -46,6 +46,7 @@ struct vmw_user_surface {
         struct vmw_surface srf;
         uint32_t size;
         struct drm_master *master;
+        struct ttm_base_object *backup_base;
 };
 
 /**
@@ -656,6 +657,7 @@ static void vmw_user_surface_base_release(struct ttm_base_object **p_base)
         struct vmw_resource *res = &user_srf->srf.res;
 
         *p_base = NULL;
+        ttm_base_object_unref(&user_srf->backup_base);
         vmw_resource_unreference(&res);
 }
 
@@ -851,7 +853,8 @@ int vmw_surface_define_ioctl(struct drm_device *dev, void *data,
                                             res->backup_size,
                                             true,
                                             &backup_handle,
-                                            &res->backup);
+                                            &res->backup,
+                                            &user_srf->backup_base);
                 if (unlikely(ret != 0)) {
                         vmw_resource_unreference(&res);
                         goto out_unlock;
@@ -1321,7 +1324,8 @@ int vmw_gb_surface_define_ioctl(struct drm_device *dev, void *data,
 
         if (req->buffer_handle != SVGA3D_INVALID_ID) {
                 ret = vmw_user_dmabuf_lookup(tfile, req->buffer_handle,
-                                             &res->backup);
+                                             &res->backup,
+                                             &user_srf->backup_base);
                 if (ret == 0 && res->backup->base.num_pages * PAGE_SIZE <
                     res->backup_size) {
                         DRM_ERROR("Surface backup buffer is too small.\n");
@@ -1335,7 +1339,8 @@ int vmw_gb_surface_define_ioctl(struct drm_device *dev, void *data,
                                             req->drm_surface_flags &
                                             drm_vmw_surface_flag_shareable,
                                             &backup_handle,
-                                            &res->backup);
+                                            &res->backup,
+                                            &user_srf->backup_base);
 
         if (unlikely(ret != 0)) {
                 vmw_resource_unreference(&res);
diff --git a/drivers/gpu/ipu-v3/ipu-common.c b/drivers/gpu/ipu-v3/ipu-common.c
index 243f99a80253..e5a38d202a21 100644
--- a/drivers/gpu/ipu-v3/ipu-common.c
+++ b/drivers/gpu/ipu-v3/ipu-common.c
@@ -912,7 +912,7 @@ static void ipu_irq_handle(struct ipu_soc *ipu, const int *regs, int num_regs)
         }
 }
 
-static void ipu_irq_handler(unsigned int irq, struct irq_desc *desc)
+static void ipu_irq_handler(struct irq_desc *desc)
 {
         struct ipu_soc *ipu = irq_desc_get_handler_data(desc);
         struct irq_chip *chip = irq_desc_get_chip(desc);
@@ -925,7 +925,7 @@ static void ipu_irq_handler(unsigned int irq, struct irq_desc *desc)
         chained_irq_exit(chip, desc);
 }
 
-static void ipu_err_irq_handler(unsigned int irq, struct irq_desc *desc)
+static void ipu_err_irq_handler(struct irq_desc *desc)
 {
         struct ipu_soc *ipu = irq_desc_get_handler_data(desc);
         struct irq_chip *chip = irq_desc_get_chip(desc);
@@ -1099,8 +1099,7 @@ static int ipu_irq_init(struct ipu_soc *ipu)
         }
 
         ret = irq_alloc_domain_generic_chips(ipu->domain, 32, 1, "IPU",
-                                             handle_level_irq, 0,
-                                             IRQF_VALID, 0);
+                                             handle_level_irq, 0, 0, 0);
         if (ret < 0) {
                 dev_err(ipu->dev, "failed to alloc generic irq chips\n");
                 irq_domain_remove(ipu->domain);
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index 500b262b89bb..e13c902e8966 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -1140,8 +1140,8 @@ config SENSORS_NCT6775
         help
           If you say yes here you get support for the hardware monitoring
           functionality of the Nuvoton NCT6106D, NCT6775F, NCT6776F, NCT6779D,
-          NCT6791D, NCT6792D and compatible Super-I/O chips. This driver
-          replaces the w83627ehf driver for NCT6775F and NCT6776F.
+          NCT6791D, NCT6792D, NCT6793D, and compatible Super-I/O chips. This
+          driver replaces the w83627ehf driver for NCT6775F and NCT6776F.
 
           This driver can also be built as a module.  If so, the module
           will be called nct6775.
diff --git a/drivers/hwmon/lm75.c b/drivers/hwmon/lm75.c
index fe41d5ae7cb2..e4e57bbafb10 100644
--- a/drivers/hwmon/lm75.c
+++ b/drivers/hwmon/lm75.c
@@ -104,7 +104,7 @@ static inline long lm75_reg_to_mc(s16 temp, u8 resolution)
 
 /* sysfs attributes for hwmon */
 
-static int lm75_read_temp(void *dev, long *temp)
+static int lm75_read_temp(void *dev, int *temp)
 {
         struct lm75_data *data = lm75_update_device(dev);
 
diff --git a/drivers/hwmon/nct6775.c b/drivers/hwmon/nct6775.c
index bd1c99deac71..8b4fa55e46c6 100644
--- a/drivers/hwmon/nct6775.c
+++ b/drivers/hwmon/nct6775.c
@@ -39,6 +39,7 @@
  * nct6779d    15      5       5       2+6    0xc560 0xc1    0x5ca3
  * nct6791d    15      6       6       2+6    0xc800 0xc1    0x5ca3
  * nct6792d    15      6       6       2+6    0xc910 0xc1    0x5ca3
+ * nct6793d    15      6       6       2+6    0xd120 0xc1    0x5ca3
  *
  * #temp lists the number of monitored temperature sources (first value) plus
  * the number of directly connectable temperature sensors (second value).
@@ -63,7 +64,7 @@
 
 #define USE_ALTERNATE
 
-enum kinds { nct6106, nct6775, nct6776, nct6779, nct6791, nct6792 };
+enum kinds { nct6106, nct6775, nct6776, nct6779, nct6791, nct6792, nct6793 };
 
 /* used to set data->name = nct6775_device_names[data->sio_kind] */
 static const char * const nct6775_device_names[] = {
@@ -73,6 +74,17 @@ static const char * const nct6775_device_names[] = {
         "nct6779",
         "nct6791",
         "nct6792",
+        "nct6793",
+};
+
+static const char * const nct6775_sio_names[] __initconst = {
+        "NCT6106D",
+        "NCT6775F",
+        "NCT6776D/F",
+        "NCT6779D",
+        "NCT6791D",
+        "NCT6792D",
+        "NCT6793D",
 };
 
 static unsigned short force_id;
@@ -104,6 +116,7 @@ MODULE_PARM_DESC(fan_debounce, "Enable debouncing for fan RPM signal");
 #define SIO_NCT6779_ID          0xc560
 #define SIO_NCT6791_ID          0xc800
 #define SIO_NCT6792_ID          0xc910
+#define SIO_NCT6793_ID          0xd120
 #define SIO_ID_MASK             0xFFF0
 
 enum pwm_enable { off, manual, thermal_cruise, speed_cruise, sf3, sf4 };
@@ -354,6 +367,10 @@ static const u16 NCT6775_REG_TEMP_CRIT[ARRAY_SIZE(nct6775_temp_label) - 1]
 
 /* NCT6776 specific data */
 
+/* STEP_UP_TIME and STEP_DOWN_TIME regs are swapped for all chips but NCT6775 */
+#define NCT6776_REG_FAN_STEP_UP_TIME NCT6775_REG_FAN_STEP_DOWN_TIME
+#define NCT6776_REG_FAN_STEP_DOWN_TIME NCT6775_REG_FAN_STEP_UP_TIME
+
 static const s8 NCT6776_ALARM_BITS[] = {
         0, 1, 2, 3, 8, 21, 20, 16,      /* in0.. in7 */
         17, -1, -1, -1, -1, -1, -1,     /* in8..in14 */
@@ -533,7 +550,7 @@ static const s8 NCT6791_ALARM_BITS[] = {
         4, 5, 13, -1, -1, -1,           /* temp1..temp6 */
         12, 9 };                        /* intrusion0, intrusion1 */
 
-/* NCT6792 specific data */
+/* NCT6792/NCT6793 specific data */
 
 static const u16 NCT6792_REG_TEMP_MON[] = {
         0x73, 0x75, 0x77, 0x79, 0x7b, 0x7d };
@@ -1056,6 +1073,7 @@ static bool is_word_sized(struct nct6775_data *data, u16 reg)
         case nct6779:
         case nct6791:
         case nct6792:
+        case nct6793:
                 return reg == 0x150 || reg == 0x153 || reg == 0x155 ||
                   ((reg & 0xfff0) == 0x4b0 && (reg & 0x000f) < 0x0b) ||
                   reg == 0x402 ||
@@ -1407,6 +1425,7 @@ static void nct6775_update_pwm_limits(struct device *dev)
                 case nct6779:
                 case nct6791:
                 case nct6792:
+                case nct6793:
                         reg = nct6775_read_value(data,
                                         data->REG_CRITICAL_PWM_ENABLE[i]);
                         if (reg & data->CRITICAL_PWM_ENABLE_MASK)
@@ -2822,6 +2841,7 @@ store_auto_pwm(struct device *dev, struct device_attribute *attr,
                 case nct6779:
                 case nct6791:
                 case nct6792:
+                case nct6793:
                         nct6775_write_value(data, data->REG_CRITICAL_PWM[nr],
                                             val);
                         reg = nct6775_read_value(data,
@@ -3256,7 +3276,7 @@ nct6775_check_fan_inputs(struct nct6775_data *data)
                 pwm4pin = false;
                 pwm5pin = false;
                 pwm6pin = false;
-        } else {        /* NCT6779D, NCT6791D, or NCT6792D */
+        } else {        /* NCT6779D, NCT6791D, NCT6792D, or NCT6793D */
                 regval = superio_inb(sioreg, 0x1c);
 
                 fan3pin = !(regval & (1 << 5));
@@ -3269,7 +3289,8 @@ nct6775_check_fan_inputs(struct nct6775_data *data)
 
                 fan4min = fan4pin;
 
-                if (data->kind == nct6791 || data->kind == nct6792) {
+                if (data->kind == nct6791 || data->kind == nct6792 ||
+                    data->kind == nct6793) {
                         regval = superio_inb(sioreg, 0x2d);
                         fan6pin = (regval & (1 << 1));
                         pwm6pin = (regval & (1 << 0));
@@ -3528,8 +3549,8 @@ static int nct6775_probe(struct platform_device *pdev)
                 data->REG_FAN_PULSES = NCT6776_REG_FAN_PULSES;
                 data->FAN_PULSE_SHIFT = NCT6775_FAN_PULSE_SHIFT;
                 data->REG_FAN_TIME[0] = NCT6775_REG_FAN_STOP_TIME;
-                data->REG_FAN_TIME[1] = NCT6775_REG_FAN_STEP_UP_TIME;
-                data->REG_FAN_TIME[2] = NCT6775_REG_FAN_STEP_DOWN_TIME;
+                data->REG_FAN_TIME[1] = NCT6776_REG_FAN_STEP_UP_TIME;
+                data->REG_FAN_TIME[2] = NCT6776_REG_FAN_STEP_DOWN_TIME;
                 data->REG_TOLERANCE_H = NCT6776_REG_TOLERANCE_H;
                 data->REG_PWM[0] = NCT6775_REG_PWM;
                 data->REG_PWM[1] = NCT6775_REG_FAN_START_OUTPUT;
@@ -3600,8 +3621,8 @@ static int nct6775_probe(struct platform_device *pdev)
                 data->REG_FAN_PULSES = NCT6779_REG_FAN_PULSES;
                 data->FAN_PULSE_SHIFT = NCT6775_FAN_PULSE_SHIFT;
                 data->REG_FAN_TIME[0] = NCT6775_REG_FAN_STOP_TIME;
-                data->REG_FAN_TIME[1] = NCT6775_REG_FAN_STEP_UP_TIME;
-                data->REG_FAN_TIME[2] = NCT6775_REG_FAN_STEP_DOWN_TIME;
+                data->REG_FAN_TIME[1] = NCT6776_REG_FAN_STEP_UP_TIME;
+                data->REG_FAN_TIME[2] = NCT6776_REG_FAN_STEP_DOWN_TIME;
                 data->REG_TOLERANCE_H = NCT6776_REG_TOLERANCE_H;
                 data->REG_PWM[0] = NCT6775_REG_PWM;
                 data->REG_PWM[1] = NCT6775_REG_FAN_START_OUTPUT;
@@ -3643,6 +3664,7 @@ static int nct6775_probe(struct platform_device *pdev)
                 break;
         case nct6791:
         case nct6792:
+        case nct6793:
                 data->in_num = 15;
                 data->pwm_num = 6;
                 data->auto_pwm_num = 4;
@@ -3677,8 +3699,8 @@ static int nct6775_probe(struct platform_device *pdev)
                 data->REG_FAN_PULSES = NCT6779_REG_FAN_PULSES;
                 data->FAN_PULSE_SHIFT = NCT6775_FAN_PULSE_SHIFT;
                 data->REG_FAN_TIME[0] = NCT6775_REG_FAN_STOP_TIME;
-                data->REG_FAN_TIME[1] = NCT6775_REG_FAN_STEP_UP_TIME;
-                data->REG_FAN_TIME[2] = NCT6775_REG_FAN_STEP_DOWN_TIME;
+                data->REG_FAN_TIME[1] = NCT6776_REG_FAN_STEP_UP_TIME;
+                data->REG_FAN_TIME[2] = NCT6776_REG_FAN_STEP_DOWN_TIME;
                 data->REG_TOLERANCE_H = NCT6776_REG_TOLERANCE_H;
                 data->REG_PWM[0] = NCT6775_REG_PWM;
                 data->REG_PWM[1] = NCT6775_REG_FAN_START_OUTPUT;
@@ -3918,6 +3940,7 @@ static int nct6775_probe(struct platform_device *pdev)
         case nct6779:
         case nct6791:
         case nct6792:
+        case nct6793:
                 break;
         }
 
@@ -3950,6 +3973,7 @@ static int nct6775_probe(struct platform_device *pdev)
                         break;
                 case nct6791:
                 case nct6792:
+                case nct6793:
                         tmp |= 0x7e;
                         break;
                 }
@@ -4047,7 +4071,8 @@ static int __maybe_unused nct6775_resume(struct device *dev)
         if (reg != data->sio_reg_enable)
                 superio_outb(sioreg, SIO_REG_ENABLE, data->sio_reg_enable);
 
-        if (data->kind == nct6791 || data->kind == nct6792)
+        if (data->kind == nct6791 || data->kind == nct6792 ||
+            data->kind == nct6793)
                 nct6791_enable_io_mapping(sioreg);
 
         superio_exit(sioreg);
@@ -4106,15 +4131,6 @@ static struct platform_driver nct6775_driver = {
         .probe          = nct6775_probe,
 };
 
-static const char * const nct6775_sio_names[] __initconst = {
-        "NCT6106D",
-        "NCT6775F",
-        "NCT6776D/F",
-        "NCT6779D",
-        "NCT6791D",
-        "NCT6792D",
-};
-
 /* nct6775_find() looks for a '627 in the Super-I/O config space */
 static int __init nct6775_find(int sioaddr, struct nct6775_sio_data *sio_data)
 {
@@ -4150,6 +4166,9 @@ static int __init nct6775_find(int sioaddr, struct nct6775_sio_data *sio_data)
         case SIO_NCT6792_ID:
                 sio_data->kind = nct6792;
                 break;
+        case SIO_NCT6793_ID:
+                sio_data->kind = nct6793;
+                break;
         default:
                 if (val != 0xffff)
                         pr_debug("unsupported chip ID: 0x%04x\n", val);
@@ -4175,7 +4194,8 @@ static int __init nct6775_find(int sioaddr, struct nct6775_sio_data *sio_data)
                 superio_outb(sioaddr, SIO_REG_ENABLE, val | 0x01);
         }
 
-        if (sio_data->kind == nct6791 || sio_data->kind == nct6792)
+        if (sio_data->kind == nct6791 || sio_data->kind == nct6792 ||
+            sio_data->kind == nct6793)
                 nct6791_enable_io_mapping(sioaddr);
 
         superio_exit(sioaddr);
@@ -4285,7 +4305,7 @@ static void __exit sensors_nct6775_exit(void)
 }
 
 MODULE_AUTHOR("Guenter Roeck <linux@roeck-us.net>");
-MODULE_DESCRIPTION("NCT6106D/NCT6775F/NCT6776F/NCT6779D/NCT6791D/NCT6792D driver");
+MODULE_DESCRIPTION("Driver for NCT6775F and compatible chips");
 MODULE_LICENSE("GPL");
 
 module_init(sensors_nct6775_init);
diff --git a/drivers/hwmon/ntc_thermistor.c b/drivers/hwmon/ntc_thermistor.c
index dc0b76c5e302..feed30646d91 100644
--- a/drivers/hwmon/ntc_thermistor.c
+++ b/drivers/hwmon/ntc_thermistor.c
@@ -477,7 +477,7 @@ static int ntc_thermistor_get_ohm(struct ntc_data *data)
         return -EINVAL;
 }
 
-static int ntc_read_temp(void *dev, long *temp)
+static int ntc_read_temp(void *dev, int *temp)
 {
         struct ntc_data *data = dev_get_drvdata(dev);
         int ohm;
diff --git a/drivers/hwmon/tmp102.c b/drivers/hwmon/tmp102.c
index 9da2735f1424..65482624ea2c 100644
--- a/drivers/hwmon/tmp102.c
+++ b/drivers/hwmon/tmp102.c
@@ -98,7 +98,7 @@ static struct tmp102 *tmp102_update_device(struct device *dev)
         return tmp102;
 }
 
-static int tmp102_read_temp(void *dev, long *temp)
+static int tmp102_read_temp(void *dev, int *temp)
 {
         struct tmp102 *tmp102 = tmp102_update_device(dev);
 
diff --git a/drivers/infiniband/Kconfig b/drivers/infiniband/Kconfig
index da4c6979fbb8..aa26f3c3416b 100644
--- a/drivers/infiniband/Kconfig
+++ b/drivers/infiniband/Kconfig
@@ -56,7 +56,6 @@ config INFINIBAND_ADDR_TRANS
 
 source "drivers/infiniband/hw/mthca/Kconfig"
 source "drivers/infiniband/hw/qib/Kconfig"
-source "drivers/infiniband/hw/ehca/Kconfig"
 source "drivers/infiniband/hw/cxgb3/Kconfig"
 source "drivers/infiniband/hw/cxgb4/Kconfig"
 source "drivers/infiniband/hw/mlx4/Kconfig"
diff --git a/drivers/infiniband/hw/Makefile b/drivers/infiniband/hw/Makefile
index 1bdb9996d371..aded2a5cc2d5 100644
--- a/drivers/infiniband/hw/Makefile
+++ b/drivers/infiniband/hw/Makefile
@@ -1,6 +1,5 @@
 obj-$(CONFIG_INFINIBAND_MTHCA)          += mthca/
 obj-$(CONFIG_INFINIBAND_QIB)            += qib/
-obj-$(CONFIG_INFINIBAND_EHCA)           += ehca/
 obj-$(CONFIG_INFINIBAND_CXGB3)          += cxgb3/
 obj-$(CONFIG_INFINIBAND_CXGB4)          += cxgb4/
 obj-$(CONFIG_MLX4_INFINIBAND)           += mlx4/
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index dc439a40da3f..403bd29443b8 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -3095,7 +3095,7 @@ out:
 
 static int
 isert_setup_np(struct iscsi_np *np,
-               struct __kernel_sockaddr_storage *ksockaddr)
+               struct sockaddr_storage *ksockaddr)
 {
         struct isert_np *isert_np;
         struct rdma_cm_id *isert_lid;
@@ -3117,7 +3117,7 @@ isert_setup_np(struct iscsi_np *np,
          * in iscsi_target_configfs.c code..
          */
         memcpy(&np->np_sockaddr, ksockaddr,
-               sizeof(struct __kernel_sockaddr_storage));
+               sizeof(struct sockaddr_storage));
 
         isert_lid = isert_setup_id(isert_np);
         if (IS_ERR(isert_lid)) {
@@ -3199,32 +3199,11 @@ isert_set_conn_info(struct iscsi_np *np, struct iscsi_conn *conn,
 {
         struct rdma_cm_id *cm_id = isert_conn->cm_id;
         struct rdma_route *cm_route = &cm_id->route;
-        struct sockaddr_in *sock_in;
-        struct sockaddr_in6 *sock_in6;
 
         conn->login_family = np->np_sockaddr.ss_family;
 
-        if (np->np_sockaddr.ss_family == AF_INET6) {
-                sock_in6 = (struct sockaddr_in6 *)&cm_route->addr.dst_addr;
-                snprintf(conn->login_ip, sizeof(conn->login_ip), "%pI6c",
-                         &sock_in6->sin6_addr.in6_u);
-                conn->login_port = ntohs(sock_in6->sin6_port);
-
-                sock_in6 = (struct sockaddr_in6 *)&cm_route->addr.src_addr;
-                snprintf(conn->local_ip, sizeof(conn->local_ip), "%pI6c",
-                         &sock_in6->sin6_addr.in6_u);
-                conn->local_port = ntohs(sock_in6->sin6_port);
-        } else {
-                sock_in = (struct sockaddr_in *)&cm_route->addr.dst_addr;
-                sprintf(conn->login_ip, "%pI4",
-                        &sock_in->sin_addr.s_addr);
-                conn->login_port = ntohs(sock_in->sin_port);
-
-                sock_in = (struct sockaddr_in *)&cm_route->addr.src_addr;
-                sprintf(conn->local_ip, "%pI4",
-                        &sock_in->sin_addr.s_addr);
-                conn->local_port = ntohs(sock_in->sin_port);
-        }
+        conn->login_sockaddr = cm_route->addr.dst_addr;
+        conn->local_sockaddr = cm_route->addr.src_addr;
 }
 
 static int
diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index 9d35499faca4..08d496411f75 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -290,19 +290,14 @@ static int evdev_flush(struct file *file, fl_owner_t id)
 {
         struct evdev_client *client = file->private_data;
         struct evdev *evdev = client->evdev;
-        int retval;
 
-        retval = mutex_lock_interruptible(&evdev->mutex);
-        if (retval)
-                return retval;
+        mutex_lock(&evdev->mutex);
 
-        if (!evdev->exist || client->revoked)
-                retval = -ENODEV;
-        else
-                retval = input_flush_device(&evdev->handle, file);
+        if (evdev->exist && !client->revoked)
+                input_flush_device(&evdev->handle, file);
 
         mutex_unlock(&evdev->mutex);
-        return retval;
+        return 0;
 }
 
 static void evdev_free(struct device *dev)
diff --git a/drivers/input/keyboard/imx_keypad.c b/drivers/input/keyboard/imx_keypad.c
index d2ea863d6a45..2165f3dd328b 100644
--- a/drivers/input/keyboard/imx_keypad.c
+++ b/drivers/input/keyboard/imx_keypad.c
@@ -5,8 +5,6 @@
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
- *
- * <<Power management needs to be implemented>>.
  */
 
 #include <linux/clk.h>
diff --git a/drivers/input/misc/ab8500-ponkey.c b/drivers/input/misc/ab8500-ponkey.c
index 1f7e15ca5fbe..4f5ef5bb535b 100644
--- a/drivers/input/misc/ab8500-ponkey.c
+++ b/drivers/input/misc/ab8500-ponkey.c
@@ -118,6 +118,7 @@ static const struct of_device_id ab8500_ponkey_match[] = {
         { .compatible = "stericsson,ab8500-ponkey", },
         {}
 };
+MODULE_DEVICE_TABLE(of, ab8500_ponkey_match);
 #endif
 
 static struct platform_driver ab8500_ponkey_driver = {
diff --git a/drivers/input/misc/pwm-beeper.c b/drivers/input/misc/pwm-beeper.c
index e82edf810d1f..f2261ab54701 100644
--- a/drivers/input/misc/pwm-beeper.c
+++ b/drivers/input/misc/pwm-beeper.c
@@ -173,6 +173,7 @@ static const struct of_device_id pwm_beeper_match[] = {
         { .compatible = "pwm-beeper", },
         { },
 };
+MODULE_DEVICE_TABLE(of, pwm_beeper_match);
 #endif
 
 static struct platform_driver pwm_beeper_driver = {
diff --git a/drivers/input/misc/regulator-haptic.c b/drivers/input/misc/regulator-haptic.c
index 6bf3f1082f71..a804705eb04a 100644
--- a/drivers/input/misc/regulator-haptic.c
+++ b/drivers/input/misc/regulator-haptic.c
@@ -249,6 +249,7 @@ static const struct of_device_id regulator_haptic_dt_match[] = {
         { .compatible = "regulator-haptic" },
         { /* sentinel */ },
 };
+MODULE_DEVICE_TABLE(of, regulator_haptic_dt_match);
 
 static struct platform_driver regulator_haptic_driver = {
         .probe          = regulator_haptic_probe,
diff --git a/drivers/input/misc/sparcspkr.c b/drivers/input/misc/sparcspkr.c
index 54116e544c96..6f997aa49183 100644
--- a/drivers/input/misc/sparcspkr.c
+++ b/drivers/input/misc/sparcspkr.c
@@ -253,6 +253,7 @@ static const struct of_device_id bbc_beep_match[] = {
         },
         {},
 };
+MODULE_DEVICE_TABLE(of, bbc_beep_match);
 
 static struct platform_driver bbc_beep_driver = {
         .driver = {
@@ -332,6 +333,7 @@ static const struct of_device_id grover_beep_match[] = {
         },
         {},
 };
+MODULE_DEVICE_TABLE(of, grover_beep_match);
 
 static struct platform_driver grover_beep_driver = {
         .driver = {
diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
index e2b7420eed97..fa945304b9a5 100644
--- a/drivers/input/mouse/elan_i2c_core.c
+++ b/drivers/input/mouse/elan_i2c_core.c
@@ -1170,6 +1170,7 @@ static const struct acpi_device_id elan_acpi_id[] = {
         { "ELAN0000", 0 },
         { "ELAN0100", 0 },
         { "ELAN0600", 0 },
+        { "ELAN1000", 0 },
         { }
 };
 MODULE_DEVICE_TABLE(acpi, elan_acpi_id);
diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
index c9c98f0ab284..db91de539ee3 100644
--- a/drivers/input/serio/i8042.c
+++ b/drivers/input/serio/i8042.c
@@ -877,7 +877,7 @@ static int __init i8042_check_aux(void)
 static int i8042_controller_check(void)
 {
         if (i8042_flush()) {
-                pr_err("No controller found\n");
+                pr_info("No controller found\n");
                 return -ENODEV;
         }
 
diff --git a/drivers/input/touchscreen/Kconfig b/drivers/input/touchscreen/Kconfig
index 059edeb7f04a..600dcceff542 100644
--- a/drivers/input/touchscreen/Kconfig
+++ b/drivers/input/touchscreen/Kconfig
@@ -479,6 +479,18 @@ config TOUCHSCREEN_MTOUCH
           To compile this driver as a module, choose M here: the
           module will be called mtouch.
 
+config TOUCHSCREEN_IMX6UL_TSC
+        tristate "Freescale i.MX6UL touchscreen controller"
+        depends on (OF && GPIOLIB) || COMPILE_TEST
+        help
+          Say Y here if you have a Freescale i.MX6UL, and want to
+          use the internal touchscreen controller.
+
+          If unsure, say N.
+
+          To compile this driver as a module, choose M here: the
+          module will be called imx6ul_tsc.
+
 config TOUCHSCREEN_INEXIO
         tristate "iNexio serial touchscreens"
         select SERIO
@@ -1040,4 +1052,16 @@ config TOUCHSCREEN_ZFORCE
           To compile this driver as a module, choose M here: the
           module will be called zforce_ts.
 
+config TOUCHSCREEN_COLIBRI_VF50
+        tristate "Toradex Colibri on board touchscreen driver"
+        depends on GPIOLIB && IIO && VF610_ADC
+        help
+          Say Y here if you have a Colibri VF50 and plan to use
+          the on-board provided 4-wire touchscreen driver.
+
+          If unsure, say N.
+
+          To compile this driver as a module, choose M here: the
+          module will be called colibri_vf50_ts.
+
 endif
diff --git a/drivers/input/touchscreen/Makefile b/drivers/input/touchscreen/Makefile
index c85aae23e7f8..1b79cc09744a 100644
--- a/drivers/input/touchscreen/Makefile
+++ b/drivers/input/touchscreen/Makefile
@@ -38,6 +38,7 @@ obj-$(CONFIG_TOUCHSCREEN_EGALAX)	+= egalax_ts.o
 obj-$(CONFIG_TOUCHSCREEN_FUJITSU)       += fujitsu_ts.o
 obj-$(CONFIG_TOUCHSCREEN_GOODIX)        += goodix.o
 obj-$(CONFIG_TOUCHSCREEN_ILI210X)       += ili210x.o
+obj-$(CONFIG_TOUCHSCREEN_IMX6UL_TSC)    += imx6ul_tsc.o
 obj-$(CONFIG_TOUCHSCREEN_INEXIO)        += inexio.o
 obj-$(CONFIG_TOUCHSCREEN_INTEL_MID)     += intel-mid-touch.o
 obj-$(CONFIG_TOUCHSCREEN_IPROC)         += bcm_iproc_tsc.o
@@ -85,3 +86,4 @@ obj-$(CONFIG_TOUCHSCREEN_W90X900)	+= w90p910_ts.o
 obj-$(CONFIG_TOUCHSCREEN_SX8654)        += sx8654.o
 obj-$(CONFIG_TOUCHSCREEN_TPS6507X)      += tps6507x-ts.o
 obj-$(CONFIG_TOUCHSCREEN_ZFORCE)        += zforce_ts.o
+obj-$(CONFIG_TOUCHSCREEN_COLIBRI_VF50)  += colibri-vf50-ts.o
diff --git a/drivers/input/touchscreen/colibri-vf50-ts.c b/drivers/input/touchscreen/colibri-vf50-ts.c
new file mode 100644
index 000000000000..5d4903a402cc
--- /dev/null
+++ b/drivers/input/touchscreen/colibri-vf50-ts.c
@@ -0,0 +1,386 @@
+/*
+ * Toradex Colibri VF50 Touchscreen driver
+ *
+ * Copyright 2015 Toradex AG
+ *
+ * Originally authored by Stefan Agner for 3.0 kernel
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <linux/delay.h>
+#include <linux/err.h>
+#include <linux/gpio.h>
+#include <linux/gpio/consumer.h>
+#include <linux/iio/consumer.h>
+#include <linux/iio/types.h>
+#include <linux/input.h>
+#include <linux/interrupt.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/pinctrl/consumer.h>
+#include <linux/platform_device.h>
+#include <linux/slab.h>
+#include <linux/types.h>
+
+#define DRIVER_NAME                     "colibri-vf50-ts"
+#define DRV_VERSION                     "1.0"
+
+#define VF_ADC_MAX                      ((1 << 12) - 1)
+
+#define COLI_TOUCH_MIN_DELAY_US         1000
+#define COLI_TOUCH_MAX_DELAY_US         2000
+#define COLI_PULLUP_MIN_DELAY_US        10000
+#define COLI_PULLUP_MAX_DELAY_US        11000
+#define COLI_TOUCH_NO_OF_AVGS           5
+#define COLI_TOUCH_REQ_ADC_CHAN         4
+
+struct vf50_touch_device {
+        struct platform_device *pdev;
+        struct input_dev *ts_input;
+        struct iio_channel *channels;
+        struct gpio_desc *gpio_xp;
+        struct gpio_desc *gpio_xm;
+        struct gpio_desc *gpio_yp;
+        struct gpio_desc *gpio_ym;
+        int pen_irq;
+        int min_pressure;
+        bool stop_touchscreen;
+};
+
+/*
+ * Enables given plates and measures touch parameters using ADC
+ */
+static int adc_ts_measure(struct iio_channel *channel,
+                          struct gpio_desc *plate_p, struct gpio_desc *plate_m)
+{
+        int i, value = 0, val = 0;
+        int error;
+
+        gpiod_set_value(plate_p, 1);
+        gpiod_set_value(plate_m, 1);
+
+        usleep_range(COLI_TOUCH_MIN_DELAY_US, COLI_TOUCH_MAX_DELAY_US);
+
+        for (i = 0; i < COLI_TOUCH_NO_OF_AVGS; i++) {
+                error = iio_read_channel_raw(channel, &val);
+                if (error < 0) {
+                        value = error;
+                        goto error_iio_read;
+                }
+
+                value += val;
+        }
+
+        value /= COLI_TOUCH_NO_OF_AVGS;
+
+error_iio_read:
+        gpiod_set_value(plate_p, 0);
+        gpiod_set_value(plate_m, 0);
+
+        return value;
+}
+
+/*
+ * Enable touch detection using falling edge detection on XM
+ */
+static void vf50_ts_enable_touch_detection(struct vf50_touch_device *vf50_ts)
+{
+        /* Enable plate YM (needs to be strong GND, high active) */
+        gpiod_set_value(vf50_ts->gpio_ym, 1);
+
+        /*
+         * Let the platform mux to idle state in order to enable
+         * Pull-Up on GPIO
+         */
+        pinctrl_pm_select_idle_state(&vf50_ts->pdev->dev);
+
+        /* Wait for the pull-up to be stable on high */
+        usleep_range(COLI_PULLUP_MIN_DELAY_US, COLI_PULLUP_MAX_DELAY_US);
+}
+
+/*
+ * ADC touch screen sampling bottom half irq handler
+ */
+static irqreturn_t vf50_ts_irq_bh(int irq, void *private)
+{
+        struct vf50_touch_device *vf50_ts = private;
+        struct device *dev = &vf50_ts->pdev->dev;
+        int val_x, val_y, val_z1, val_z2, val_p = 0;
+        bool discard_val_on_start = true;
+
+        /* Disable the touch detection plates */
+        gpiod_set_value(vf50_ts->gpio_ym, 0);
+
+        /* Let the platform mux to default state in order to mux as ADC */
+        pinctrl_pm_select_default_state(dev);
+
+        while (!vf50_ts->stop_touchscreen) {
+                /* X-Direction */
+                val_x = adc_ts_measure(&vf50_ts->channels[0],
+                                vf50_ts->gpio_xp, vf50_ts->gpio_xm);
+                if (val_x < 0)
+                        break;
+
+                /* Y-Direction */
+                val_y = adc_ts_measure(&vf50_ts->channels[1],
+                                vf50_ts->gpio_yp, vf50_ts->gpio_ym);
+                if (val_y < 0)
+                        break;
+
+                /*
+                 * Touch pressure
+                 * Measure on XP/YM
+                 */
+                val_z1 = adc_ts_measure(&vf50_ts->channels[2],
+                                vf50_ts->gpio_yp, vf50_ts->gpio_xm);
+                if (val_z1 < 0)
+                        break;
+                val_z2 = adc_ts_measure(&vf50_ts->channels[3],
+                                vf50_ts->gpio_yp, vf50_ts->gpio_xm);
+                if (val_z2 < 0)
+                        break;
+
+                /* Validate signal (avoid calculation using noise) */
+                if (val_z1 > 64 && val_x > 64) {
+                        /*
+                         * Calculate resistance between the plates
+                         * lower resistance means higher pressure
+                         */
+                        int r_x = (1000 * val_x) / VF_ADC_MAX;
+
+                        val_p = (r_x * val_z2) / val_z1 - r_x;
+
+                } else {
+                        val_p = 2000;
+                }
+
+                val_p = 2000 - val_p;
+                dev_dbg(dev,
+                        "Measured values: x: %d, y: %d, z1: %d, z2: %d, p: %d\n",
+                        val_x, val_y, val_z1, val_z2, val_p);
+
+                /*
+                 * If touch pressure is too low, stop measuring and reenable
+                 * touch detection
+                 */
+                if (val_p < vf50_ts->min_pressure || val_p > 2000)
+                        break;
+
+                /*
+                 * The pressure may not be enough for the first x and the
+                 * second y measurement, but, the pressure is ok when the
+                 * driver is doing the third and fourth measurement. To
+                 * take care of this, we drop the first measurement always.
+                 */
+                if (discard_val_on_start) {
+                        discard_val_on_start = false;
+                } else {
+                        /*
+                         * Report touch position and sleep for
+                         * the next measurement.
+                         */
+                        input_report_abs(vf50_ts->ts_input,
+                                        ABS_X, VF_ADC_MAX - val_x);
+                        input_report_abs(vf50_ts->ts_input,
+                                        ABS_Y, VF_ADC_MAX - val_y);
+                        input_report_abs(vf50_ts->ts_input,
+                                        ABS_PRESSURE, val_p);
+                        input_report_key(vf50_ts->ts_input, BTN_TOUCH, 1);
+                        input_sync(vf50_ts->ts_input);
+                }
+
+                usleep_range(COLI_PULLUP_MIN_DELAY_US,
+                             COLI_PULLUP_MAX_DELAY_US);
+        }
+
+        /* Report no more touch, re-enable touch detection */
+        input_report_abs(vf50_ts->ts_input, ABS_PRESSURE, 0);
+        input_report_key(vf50_ts->ts_input, BTN_TOUCH, 0);
+        input_sync(vf50_ts->ts_input);
+
+        vf50_ts_enable_touch_detection(vf50_ts);
+
+        return IRQ_HANDLED;
+}
+
+static int vf50_ts_open(struct input_dev *dev_input)
+{
+        struct vf50_touch_device *touchdev = input_get_drvdata(dev_input);
+        struct device *dev = &touchdev->pdev->dev;
+
+        dev_dbg(dev, "Input device %s opened, starting touch detection\n",
+                dev_input->name);
+
+        touchdev->stop_touchscreen = false;
+
+        /* Mux detection before request IRQ, wait for pull-up to settle */
+        vf50_ts_enable_touch_detection(touchdev);
+
+        return 0;
+}
+
+static void vf50_ts_close(struct input_dev *dev_input)
+{
+        struct vf50_touch_device *touchdev = input_get_drvdata(dev_input);
+        struct device *dev = &touchdev->pdev->dev;
+
+        touchdev->stop_touchscreen = true;
+
+        /* Make sure IRQ is not running past close */
+        mb();
+        synchronize_irq(touchdev->pen_irq);
+
+        gpiod_set_value(touchdev->gpio_ym, 0);
+        pinctrl_pm_select_default_state(dev);
+
+        dev_dbg(dev, "Input device %s closed, disable touch detection\n",
+                dev_input->name);
+}
+
+static int vf50_ts_get_gpiod(struct device *dev, struct gpio_desc **gpio_d,
+                             const char *con_id, enum gpiod_flags flags)
+{
+        int error;
+
+        *gpio_d = devm_gpiod_get(dev, con_id, flags);
+        if (IS_ERR(*gpio_d)) {
+                error = PTR_ERR(*gpio_d);
+                dev_err(dev, "Could not get gpio_%s %d\n", con_id, error);
+                return error;
+        }
+
+        return 0;
+}
+
+static void vf50_ts_channel_release(void *data)
+{
+        struct iio_channel *channels = data;
+
+        iio_channel_release_all(channels);
+}
+
+static int vf50_ts_probe(struct platform_device *pdev)
+{
+        struct input_dev *input;
+        struct iio_channel *channels;
+        struct device *dev = &pdev->dev;
+        struct vf50_touch_device *touchdev;
+        int num_adc_channels;
+        int error;
+
+        channels = iio_channel_get_all(dev);
+        if (IS_ERR(channels))
+                return PTR_ERR(channels);
+
+        error = devm_add_action(dev, vf50_ts_channel_release, channels);
+        if (error) {
+                iio_channel_release_all(channels);
+                dev_err(dev, "Failed to register iio channel release action");
+                return error;
+        }
+
+        num_adc_channels = 0;
+        while (channels[num_adc_channels].indio_dev)
+                num_adc_channels++;
+
+        if (num_adc_channels != COLI_TOUCH_REQ_ADC_CHAN) {
+                dev_err(dev, "Inadequate ADC channels specified\n");
+                return -EINVAL;
+        }
+
+        touchdev = devm_kzalloc(dev, sizeof(*touchdev), GFP_KERNEL);
+        if (!touchdev)
+                return -ENOMEM;
+
+        touchdev->pdev = pdev;
+        touchdev->channels = channels;
+
+        error = of_property_read_u32(dev->of_node, "vf50-ts-min-pressure",
+                                 &touchdev->min_pressure);
+        if (error)
+                return error;
+
+        input = devm_input_allocate_device(dev);
+        if (!input) {
+                dev_err(dev, "Failed to allocate TS input device\n");
+                return -ENOMEM;
+        }
+
+        platform_set_drvdata(pdev, touchdev);
+
+        input->name = DRIVER_NAME;
+        input->id.bustype = BUS_HOST;
+        input->dev.parent = dev;
+        input->open = vf50_ts_open;
+        input->close = vf50_ts_close;
+
+        input_set_capability(input, EV_KEY, BTN_TOUCH);
+        input_set_abs_params(input, ABS_X, 0, VF_ADC_MAX, 0, 0);
+        input_set_abs_params(input, ABS_Y, 0, VF_ADC_MAX, 0, 0);
+        input_set_abs_params(input, ABS_PRESSURE, 0, VF_ADC_MAX, 0, 0);
+
+        touchdev->ts_input = input;
+        input_set_drvdata(input, touchdev);
+
+        error = input_register_device(input);
+        if (error) {
+                dev_err(dev, "Failed to register input device\n");
+                return error;
+        }
+
+        error = vf50_ts_get_gpiod(dev, &touchdev->gpio_xp, "xp", GPIOD_OUT_LOW);
+        if (error)
+                return error;
+
+        error = vf50_ts_get_gpiod(dev, &touchdev->gpio_xm,
+                                "xm", GPIOD_OUT_LOW);
+        if (error)
+                return error;
+
+        error = vf50_ts_get_gpiod(dev, &touchdev->gpio_yp, "yp", GPIOD_OUT_LOW);
+        if (error)
+                return error;
+
+        error = vf50_ts_get_gpiod(dev, &touchdev->gpio_ym, "ym", GPIOD_OUT_LOW);
+        if (error)
+                return error;
+
+        touchdev->pen_irq = platform_get_irq(pdev, 0);
+        if (touchdev->pen_irq < 0)
+                return touchdev->pen_irq;
+
+        error = devm_request_threaded_irq(dev, touchdev->pen_irq,
+                                          NULL, vf50_ts_irq_bh, IRQF_ONESHOT,
+                                          "vf50 touch", touchdev);
+        if (error) {
+                dev_err(dev, "Failed to request IRQ %d: %d\n",
+                        touchdev->pen_irq, error);
+                return error;
+        }
+
+        return 0;
+}
+
+static const struct of_device_id vf50_touch_of_match[] = {
+        { .compatible = "toradex,vf50-touchscreen", },
+        { }
+};
+MODULE_DEVICE_TABLE(of, vf50_touch_of_match);
+
+static struct platform_driver vf50_touch_driver = {
+        .driver = {
+                .name = "toradex,vf50_touchctrl",
+                .of_match_table = vf50_touch_of_match,
+        },
+        .probe = vf50_ts_probe,
+};
+module_platform_driver(vf50_touch_driver);
+
+MODULE_AUTHOR("Sanchayan Maity");
+MODULE_DESCRIPTION("Colibri VF50 Touchscreen driver");
+MODULE_LICENSE("GPL");
+MODULE_VERSION(DRV_VERSION);
diff --git a/drivers/input/touchscreen/cyttsp4_i2c.c b/drivers/input/touchscreen/cyttsp4_i2c.c
index 9a323dd915de..a9f95c7d3c00 100644
--- a/drivers/input/touchscreen/cyttsp4_i2c.c
+++ b/drivers/input/touchscreen/cyttsp4_i2c.c
@@ -86,4 +86,3 @@ module_i2c_driver(cyttsp4_i2c_driver);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Cypress TrueTouch(R) Standard Product (TTSP) I2C driver");
 MODULE_AUTHOR("Cypress");
-MODULE_ALIAS("i2c:cyttsp4");
diff --git a/drivers/input/touchscreen/cyttsp_i2c.c b/drivers/input/touchscreen/cyttsp_i2c.c
index 519e2de2f8df..eee51b3f2e3f 100644
--- a/drivers/input/touchscreen/cyttsp_i2c.c
+++ b/drivers/input/touchscreen/cyttsp_i2c.c
@@ -86,4 +86,3 @@ module_i2c_driver(cyttsp_i2c_driver);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Cypress TrueTouch(R) Standard Product (TTSP) I2C driver");
 MODULE_AUTHOR("Cypress");
-MODULE_ALIAS("i2c:cyttsp");
diff --git a/drivers/input/touchscreen/elants_i2c.c b/drivers/input/touchscreen/elants_i2c.c
index ddac134b25b1..17cc20ef4923 100644
--- a/drivers/input/touchscreen/elants_i2c.c
+++ b/drivers/input/touchscreen/elants_i2c.c
@@ -102,7 +102,7 @@
 #define ELAN_FW_PAGESIZE        132
 
 /* calibration timeout definition */
-#define ELAN_CALI_TIMEOUT_MSEC  10000
+#define ELAN_CALI_TIMEOUT_MSEC  12000
 
 #define ELAN_POWERON_DELAY_USEC 500
 #define ELAN_RESET_DELAY_MSEC   20
diff --git a/drivers/input/touchscreen/imx6ul_tsc.c b/drivers/input/touchscreen/imx6ul_tsc.c
new file mode 100644
index 000000000000..ff0b75813daa
--- /dev/null
+++ b/drivers/input/touchscreen/imx6ul_tsc.c
@@ -0,0 +1,523 @@
+/*
+ * Freescale i.MX6UL touchscreen controller driver
+ *
+ * Copyright (C) 2015 Freescale Semiconductor, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/gpio/consumer.h>
+#include <linux/input.h>
+#include <linux/slab.h>
+#include <linux/completion.h>
+#include <linux/delay.h>
+#include <linux/of.h>
+#include <linux/interrupt.h>
+#include <linux/platform_device.h>
+#include <linux/clk.h>
+#include <linux/io.h>
+
+/* ADC configuration registers field define */
+#define ADC_AIEN                (0x1 << 7)
+#define ADC_CONV_DISABLE        0x1F
+#define ADC_CAL                 (0x1 << 7)
+#define ADC_CALF                0x2
+#define ADC_12BIT_MODE          (0x2 << 2)
+#define ADC_IPG_CLK             0x00
+#define ADC_CLK_DIV_8           (0x03 << 5)
+#define ADC_SHORT_SAMPLE_MODE   (0x0 << 4)
+#define ADC_HARDWARE_TRIGGER    (0x1 << 13)
+#define SELECT_CHANNEL_4        0x04
+#define SELECT_CHANNEL_1        0x01
+#define DISABLE_CONVERSION_INT  (0x0 << 7)
+
+/* ADC registers */
+#define REG_ADC_HC0             0x00
+#define REG_ADC_HC1             0x04
+#define REG_ADC_HC2             0x08
+#define REG_ADC_HC3             0x0C
+#define REG_ADC_HC4             0x10
+#define REG_ADC_HS              0x14
+#define REG_ADC_R0              0x18
+#define REG_ADC_CFG             0x2C
+#define REG_ADC_GC              0x30
+#define REG_ADC_GS              0x34
+
+#define ADC_TIMEOUT             msecs_to_jiffies(100)
+
+/* TSC registers */
+#define REG_TSC_BASIC_SETING    0x00
+#define REG_TSC_PRE_CHARGE_TIME 0x10
+#define REG_TSC_FLOW_CONTROL    0x20
+#define REG_TSC_MEASURE_VALUE   0x30
+#define REG_TSC_INT_EN          0x40
+#define REG_TSC_INT_SIG_EN      0x50
+#define REG_TSC_INT_STATUS      0x60
+#define REG_TSC_DEBUG_MODE      0x70
+#define REG_TSC_DEBUG_MODE2     0x80
+
+/* TSC configuration registers field define */
+#define DETECT_4_WIRE_MODE      (0x0 << 4)
+#define AUTO_MEASURE            0x1
+#define MEASURE_SIGNAL          0x1
+#define DETECT_SIGNAL           (0x1 << 4)
+#define VALID_SIGNAL            (0x1 << 8)
+#define MEASURE_INT_EN          0x1
+#define MEASURE_SIG_EN          0x1
+#define VALID_SIG_EN            (0x1 << 8)
+#define DE_GLITCH_2             (0x2 << 29)
+#define START_SENSE             (0x1 << 12)
+#define TSC_DISABLE             (0x1 << 16)
+#define DETECT_MODE             0x2
+
+struct imx6ul_tsc {
+        struct device *dev;
+        struct input_dev *input;
+        void __iomem *tsc_regs;
+        void __iomem *adc_regs;
+        struct clk *tsc_clk;
+        struct clk *adc_clk;
+        struct gpio_desc *xnur_gpio;
+
+        int measure_delay_time;
+        int pre_charge_time;
+
+        struct completion completion;
+};
+
+/*
+ * TSC module need ADC to get the measure value. So
+ * before config TSC, we should initialize ADC module.
+ */
+static void imx6ul_adc_init(struct imx6ul_tsc *tsc)
+{
+        int adc_hc = 0;
+        int adc_gc;
+        int adc_gs;
+        int adc_cfg;
+        int timeout;
+
+        reinit_completion(&tsc->completion);
+
+        adc_cfg = readl(tsc->adc_regs + REG_ADC_CFG);
+        adc_cfg |= ADC_12BIT_MODE | ADC_IPG_CLK;
+        adc_cfg |= ADC_CLK_DIV_8 | ADC_SHORT_SAMPLE_MODE;
+        adc_cfg &= ~ADC_HARDWARE_TRIGGER;
+        writel(adc_cfg, tsc->adc_regs + REG_ADC_CFG);
+
+        /* enable calibration interrupt */
+        adc_hc |= ADC_AIEN;
+        adc_hc |= ADC_CONV_DISABLE;
+        writel(adc_hc, tsc->adc_regs + REG_ADC_HC0);
+
+        /* start ADC calibration */
+        adc_gc = readl(tsc->adc_regs + REG_ADC_GC);
+        adc_gc |= ADC_CAL;
+        writel(adc_gc, tsc->adc_regs + REG_ADC_GC);
+
+        timeout = wait_for_completion_timeout
+                        (&tsc->completion, ADC_TIMEOUT);
+        if (timeout == 0)
+                dev_err(tsc->dev, "Timeout for adc calibration\n");
+
+        adc_gs = readl(tsc->adc_regs + REG_ADC_GS);
+        if (adc_gs & ADC_CALF)
+                dev_err(tsc->dev, "ADC calibration failed\n");
+
+        /* TSC need the ADC work in hardware trigger */
+        adc_cfg = readl(tsc->adc_regs + REG_ADC_CFG);
+        adc_cfg |= ADC_HARDWARE_TRIGGER;
+        writel(adc_cfg, tsc->adc_regs + REG_ADC_CFG);
+}
+
+/*
+ * This is a TSC workaround. Currently TSC misconnect two
+ * ADC channels, this function remap channel configure for
+ * hardware trigger.
+ */
+static void imx6ul_tsc_channel_config(struct imx6ul_tsc *tsc)
+{
+        int adc_hc0, adc_hc1, adc_hc2, adc_hc3, adc_hc4;
+
+        adc_hc0 = DISABLE_CONVERSION_INT;
+        writel(adc_hc0, tsc->adc_regs + REG_ADC_HC0);
+
+        adc_hc1 = DISABLE_CONVERSION_INT | SELECT_CHANNEL_4;
+        writel(adc_hc1, tsc->adc_regs + REG_ADC_HC1);
+
+        adc_hc2 = DISABLE_CONVERSION_INT;
+        writel(adc_hc2, tsc->adc_regs + REG_ADC_HC2);
+
+        adc_hc3 = DISABLE_CONVERSION_INT | SELECT_CHANNEL_1;
+        writel(adc_hc3, tsc->adc_regs + REG_ADC_HC3);
+
+        adc_hc4 = DISABLE_CONVERSION_INT;
+        writel(adc_hc4, tsc->adc_regs + REG_ADC_HC4);
+}
+
+/*
+ * TSC setting, confige the pre-charge time and measure delay time.
+ * different touch screen may need different pre-charge time and
+ * measure delay time.
+ */
+static void imx6ul_tsc_set(struct imx6ul_tsc *tsc)
+{
+        int basic_setting = 0;
+        int start;
+
+        basic_setting |= tsc->measure_delay_time << 8;
+        basic_setting |= DETECT_4_WIRE_MODE | AUTO_MEASURE;
+        writel(basic_setting, tsc->tsc_regs + REG_TSC_BASIC_SETING);
+
+        writel(DE_GLITCH_2, tsc->tsc_regs + REG_TSC_DEBUG_MODE2);
+
+        writel(tsc->pre_charge_time, tsc->tsc_regs + REG_TSC_PRE_CHARGE_TIME);
+        writel(MEASURE_INT_EN, tsc->tsc_regs + REG_TSC_INT_EN);
+        writel(MEASURE_SIG_EN | VALID_SIG_EN,
+                tsc->tsc_regs + REG_TSC_INT_SIG_EN);
+
+        /* start sense detection */
+        start = readl(tsc->tsc_regs + REG_TSC_FLOW_CONTROL);
+        start |= START_SENSE;
+        start &= ~TSC_DISABLE;
+        writel(start, tsc->tsc_regs + REG_TSC_FLOW_CONTROL);
+}
+
+static void imx6ul_tsc_init(struct imx6ul_tsc *tsc)
+{
+        imx6ul_adc_init(tsc);
+        imx6ul_tsc_channel_config(tsc);
+        imx6ul_tsc_set(tsc);
+}
+
+static void imx6ul_tsc_disable(struct imx6ul_tsc *tsc)
+{
+        int tsc_flow;
+        int adc_cfg;
+
+        /* TSC controller enters to idle status */
+        tsc_flow = readl(tsc->tsc_regs + REG_TSC_FLOW_CONTROL);
+        tsc_flow |= TSC_DISABLE;
+        writel(tsc_flow, tsc->tsc_regs + REG_TSC_FLOW_CONTROL);
+
+        /* ADC controller enters to stop mode */
+        adc_cfg = readl(tsc->adc_regs + REG_ADC_HC0);
+        adc_cfg |= ADC_CONV_DISABLE;
+        writel(adc_cfg, tsc->adc_regs + REG_ADC_HC0);
+}
+
+/* Delay some time (max 2ms), wait the pre-charge done. */
+static bool tsc_wait_detect_mode(struct imx6ul_tsc *tsc)
+{
+        unsigned long timeout = jiffies + msecs_to_jiffies(2);
+        int state_machine;
+        int debug_mode2;
+
+        do {
+                if (time_after(jiffies, timeout))
+                        return false;
+
+                usleep_range(200, 400);
+                debug_mode2 = readl(tsc->tsc_regs + REG_TSC_DEBUG_MODE2);
+                state_machine = (debug_mode2 >> 20) & 0x7;
+        } while (state_machine != DETECT_MODE);
+
+        usleep_range(200, 400);
+        return true;
+}
+
+static irqreturn_t tsc_irq_fn(int irq, void *dev_id)
+{
+        struct imx6ul_tsc *tsc = dev_id;
+        int status;
+        int value;
+        int x, y;
+        int start;
+
+        status = readl(tsc->tsc_regs + REG_TSC_INT_STATUS);
+
+        /* write 1 to clear the bit measure-signal */
+        writel(MEASURE_SIGNAL | DETECT_SIGNAL,
+                tsc->tsc_regs + REG_TSC_INT_STATUS);
+
+        /* It's a HW self-clean bit. Set this bit and start sense detection */
+        start = readl(tsc->tsc_regs + REG_TSC_FLOW_CONTROL);
+        start |= START_SENSE;
+        writel(start, tsc->tsc_regs + REG_TSC_FLOW_CONTROL);
+
+        if (status & MEASURE_SIGNAL) {
+                value = readl(tsc->tsc_regs + REG_TSC_MEASURE_VALUE);
+                x = (value >> 16) & 0x0fff;
+                y = value & 0x0fff;
+
+                /*
+                 * In detect mode, we can get the xnur gpio value,
+                 * otherwise assume contact is stiull active.
+                 */
+                if (!tsc_wait_detect_mode(tsc) ||
+                    gpiod_get_value_cansleep(tsc->xnur_gpio)) {
+                        input_report_key(tsc->input, BTN_TOUCH, 1);
+                        input_report_abs(tsc->input, ABS_X, x);
+                        input_report_abs(tsc->input, ABS_Y, y);
+                } else {
+                        input_report_key(tsc->input, BTN_TOUCH, 0);
+                }
+
+                input_sync(tsc->input);
+        }
+
+        return IRQ_HANDLED;
+}
+
+static irqreturn_t adc_irq_fn(int irq, void *dev_id)
+{
+        struct imx6ul_tsc *tsc = dev_id;
+        int coco;
+        int value;
+
+        coco = readl(tsc->adc_regs + REG_ADC_HS);
+        if (coco & 0x01) {
+                value = readl(tsc->adc_regs + REG_ADC_R0);
+                complete(&tsc->completion);
+        }
+
+        return IRQ_HANDLED;
+}
+
+static int imx6ul_tsc_open(struct input_dev *input_dev)
+{
+        struct imx6ul_tsc *tsc = input_get_drvdata(input_dev);
+        int err;
+
+        err = clk_prepare_enable(tsc->adc_clk);
+        if (err) {
+                dev_err(tsc->dev,
+                        "Could not prepare or enable the adc clock: %d\n",
+                        err);
+                return err;
+        }
+
+        err = clk_prepare_enable(tsc->tsc_clk);
+        if (err) {
+                dev_err(tsc->dev,
+                        "Could not prepare or enable the tsc clock: %d\n",
+                        err);
+                clk_disable_unprepare(tsc->adc_clk);
+                return err;
+        }
+
+        imx6ul_tsc_init(tsc);
+
+        return 0;
+}
+
+static void imx6ul_tsc_close(struct input_dev *input_dev)
+{
+        struct imx6ul_tsc *tsc = input_get_drvdata(input_dev);
+
+        imx6ul_tsc_disable(tsc);
+
+        clk_disable_unprepare(tsc->tsc_clk);
+        clk_disable_unprepare(tsc->adc_clk);
+}
+
+static int imx6ul_tsc_probe(struct platform_device *pdev)
+{
+        struct device_node *np = pdev->dev.of_node;
+        struct imx6ul_tsc *tsc;
+        struct input_dev *input_dev;
+        struct resource *tsc_mem;
+        struct resource *adc_mem;
+        int err;
+        int tsc_irq;
+        int adc_irq;
+
+        tsc = devm_kzalloc(&pdev->dev, sizeof(struct imx6ul_tsc), GFP_KERNEL);
+        if (!tsc)
+                return -ENOMEM;
+
+        input_dev = devm_input_allocate_device(&pdev->dev);
+        if (!input_dev)
+                return -ENOMEM;
+
+        input_dev->name = "iMX6UL TouchScreen Controller";
+        input_dev->id.bustype = BUS_HOST;
+
+        input_dev->open = imx6ul_tsc_open;
+        input_dev->close = imx6ul_tsc_close;
+
+        input_set_capability(input_dev, EV_KEY, BTN_TOUCH);
+        input_set_abs_params(input_dev, ABS_X, 0, 0xFFF, 0, 0);
+        input_set_abs_params(input_dev, ABS_Y, 0, 0xFFF, 0, 0);
+
+        input_set_drvdata(input_dev, tsc);
+
+        tsc->dev = &pdev->dev;
+        tsc->input = input_dev;
+        init_completion(&tsc->completion);
+
+        tsc->xnur_gpio = devm_gpiod_get(&pdev->dev, "xnur", GPIOD_IN);
+        if (IS_ERR(tsc->xnur_gpio)) {
+                err = PTR_ERR(tsc->xnur_gpio);
+                dev_err(&pdev->dev,
+                        "failed to request GPIO tsc_X- (xnur): %d\n", err);
+                return err;
+        }
+
+        tsc_mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        tsc->tsc_regs = devm_ioremap_resource(&pdev->dev, tsc_mem);
+        if (IS_ERR(tsc->tsc_regs)) {
+                err = PTR_ERR(tsc->tsc_regs);
+                dev_err(&pdev->dev, "failed to remap tsc memory: %d\n", err);
+                return err;
+        }
+
+        adc_mem = platform_get_resource(pdev, IORESOURCE_MEM, 1);
+        tsc->adc_regs = devm_ioremap_resource(&pdev->dev, adc_mem);
+        if (IS_ERR(tsc->adc_regs)) {
+                err = PTR_ERR(tsc->adc_regs);
+                dev_err(&pdev->dev, "failed to remap adc memory: %d\n", err);
+                return err;
+        }
+
+        tsc->tsc_clk = devm_clk_get(&pdev->dev, "tsc");
+        if (IS_ERR(tsc->tsc_clk)) {
+                err = PTR_ERR(tsc->tsc_clk);
+                dev_err(&pdev->dev, "failed getting tsc clock: %d\n", err);
+                return err;
+        }
+
+        tsc->adc_clk = devm_clk_get(&pdev->dev, "adc");
+        if (IS_ERR(tsc->adc_clk)) {
+                err = PTR_ERR(tsc->adc_clk);
+                dev_err(&pdev->dev, "failed getting adc clock: %d\n", err);
+                return err;
+        }
+
+        tsc_irq = platform_get_irq(pdev, 0);
+        if (tsc_irq < 0) {
+                dev_err(&pdev->dev, "no tsc irq resource?\n");
+                return tsc_irq;
+        }
+
+        adc_irq = platform_get_irq(pdev, 1);
+        if (adc_irq <= 0) {
+                dev_err(&pdev->dev, "no adc irq resource?\n");
+                return adc_irq;
+        }
+
+        err = devm_request_threaded_irq(tsc->dev, tsc_irq,
+                                        NULL, tsc_irq_fn, IRQF_ONESHOT,
+                                        dev_name(&pdev->dev), tsc);
+        if (err) {
+                dev_err(&pdev->dev,
+                        "failed requesting tsc irq %d: %d\n",
+                        tsc_irq, err);
+                return err;
+        }
+
+        err = devm_request_irq(tsc->dev, adc_irq, adc_irq_fn, 0,
+                                dev_name(&pdev->dev), tsc);
+        if (err) {
+                dev_err(&pdev->dev,
+                        "failed requesting adc irq %d: %d\n",
+                        adc_irq, err);
+                return err;
+        }
+
+        err = of_property_read_u32(np, "measure-delay-time",
+                                   &tsc->measure_delay_time);
+        if (err)
+                tsc->measure_delay_time = 0xffff;
+
+        err = of_property_read_u32(np, "pre-charge-time",
+                                   &tsc->pre_charge_time);
+        if (err)
+                tsc->pre_charge_time = 0xfff;
+
+        err = input_register_device(tsc->input);
+        if (err) {
+                dev_err(&pdev->dev,
+                        "failed to register input device: %d\n", err);
+                return err;
+        }
+
+        platform_set_drvdata(pdev, tsc);
+        return 0;
+}
+
+static int __maybe_unused imx6ul_tsc_suspend(struct device *dev)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct imx6ul_tsc *tsc = platform_get_drvdata(pdev);
+        struct input_dev *input_dev = tsc->input;
+
+        mutex_lock(&input_dev->mutex);
+
+        if (input_dev->users) {
+                imx6ul_tsc_disable(tsc);
+
+                clk_disable_unprepare(tsc->tsc_clk);
+                clk_disable_unprepare(tsc->adc_clk);
+        }
+
+        mutex_unlock(&input_dev->mutex);
+
+        return 0;
+}
+
+static int __maybe_unused imx6ul_tsc_resume(struct device *dev)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct imx6ul_tsc *tsc = platform_get_drvdata(pdev);
+        struct input_dev *input_dev = tsc->input;
+        int retval = 0;
+
+        mutex_lock(&input_dev->mutex);
+
+        if (input_dev->users) {
+                retval = clk_prepare_enable(tsc->adc_clk);
+                if (retval)
+                        goto out;
+
+                retval = clk_prepare_enable(tsc->tsc_clk);
+                if (retval) {
+                        clk_disable_unprepare(tsc->adc_clk);
+                        goto out;
+                }
+
+                imx6ul_tsc_init(tsc);
+        }
+
+out:
+        mutex_unlock(&input_dev->mutex);
+        return retval;
+}
+
+static SIMPLE_DEV_PM_OPS(imx6ul_tsc_pm_ops,
+                         imx6ul_tsc_suspend, imx6ul_tsc_resume);
+
+static const struct of_device_id imx6ul_tsc_match[] = {
+        { .compatible = "fsl,imx6ul-tsc", },
+        { /* sentinel */ }
+};
+MODULE_DEVICE_TABLE(of, imx6ul_tsc_match);
+
+static struct platform_driver imx6ul_tsc_driver = {
+        .driver         = {
+                .name   = "imx6ul-tsc",
+                .of_match_table = imx6ul_tsc_match,
+                .pm     = &imx6ul_tsc_pm_ops,
+        },
+        .probe          = imx6ul_tsc_probe,
+};
+module_platform_driver(imx6ul_tsc_driver);
+
+MODULE_AUTHOR("Haibo Chen <haibo.chen@freescale.com>");
+MODULE_DESCRIPTION("Freescale i.MX6UL Touchscreen controller driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/input/touchscreen/sun4i-ts.c b/drivers/input/touchscreen/sun4i-ts.c
index c0116994067d..485794376ee5 100644
--- a/drivers/input/touchscreen/sun4i-ts.c
+++ b/drivers/input/touchscreen/sun4i-ts.c
@@ -191,7 +191,7 @@ static void sun4i_ts_close(struct input_dev *dev)
         writel(TEMP_IRQ_EN(1), ts->base + TP_INT_FIFOC);
 }
 
-static int sun4i_get_temp(const struct sun4i_ts_data *ts, long *temp)
+static int sun4i_get_temp(const struct sun4i_ts_data *ts, int *temp)
 {
         /* No temp_data until the first irq */
         if (ts->temp_data == -1)
@@ -202,7 +202,7 @@ static int sun4i_get_temp(const struct sun4i_ts_data *ts, long *temp)
         return 0;
 }
 
-static int sun4i_get_tz_temp(void *data, long *temp)
+static int sun4i_get_tz_temp(void *data, int *temp)
 {
         return sun4i_get_temp(data, temp);
 }
@@ -215,14 +215,14 @@ static ssize_t show_temp(struct device *dev, struct device_attribute *devattr,
                          char *buf)
 {
         struct sun4i_ts_data *ts = dev_get_drvdata(dev);
-        long temp;
+        int temp;
         int error;
 
         error = sun4i_get_temp(ts, &temp);
         if (error)
                 return error;
 
-        return sprintf(buf, "%ld\n", temp);
+        return sprintf(buf, "%d\n", temp);
 }
 
 static ssize_t show_temp_label(struct device *dev,
diff --git a/drivers/iommu/omap-iommu-debug.c b/drivers/iommu/omap-iommu-debug.c
index 0717aa96ce39..9bc20e2119a3 100644
--- a/drivers/iommu/omap-iommu-debug.c
+++ b/drivers/iommu/omap-iommu-debug.c
@@ -135,8 +135,9 @@ __dump_tlb_entries(struct omap_iommu *obj, struct cr_regs *crs, int num)
 static ssize_t iotlb_dump_cr(struct omap_iommu *obj, struct cr_regs *cr,
                              struct seq_file *s)
 {
-        return seq_printf(s, "%08x %08x %01x\n", cr->cam, cr->ram,
+        seq_printf(s, "%08x %08x %01x\n", cr->cam, cr->ram,
                           (cr->cam & MMU_CAM_P) ? 1 : 0);
+        return 0;
 }
 
 static size_t omap_dump_tlb_entries(struct omap_iommu *obj, struct seq_file *s)
diff --git a/drivers/irqchip/exynos-combiner.c b/drivers/irqchip/exynos-combiner.c
index e9c6f2a5b52d..cd7d3bc78e34 100644
--- a/drivers/irqchip/exynos-combiner.c
+++ b/drivers/irqchip/exynos-combiner.c
@@ -65,12 +65,10 @@ static void combiner_unmask_irq(struct irq_data *data)
         __raw_writel(mask, combiner_base(data) + COMBINER_ENABLE_SET);
 }
 
-static void combiner_handle_cascade_irq(unsigned int __irq,
-                                        struct irq_desc *desc)
+static void combiner_handle_cascade_irq(struct irq_desc *desc)
 {
         struct combiner_chip_data *chip_data = irq_desc_get_handler_data(desc);
         struct irq_chip *chip = irq_desc_get_chip(desc);
-        unsigned int irq = irq_desc_get_irq(desc);
         unsigned int cascade_irq, combiner_irq;
         unsigned long status;
 
@@ -88,7 +86,7 @@ static void combiner_handle_cascade_irq(unsigned int __irq,
         cascade_irq = irq_find_mapping(combiner_irq_domain, combiner_irq);
 
         if (unlikely(!cascade_irq))
-                handle_bad_irq(irq, desc);
+                handle_bad_irq(desc);
         else
                 generic_handle_irq(cascade_irq);
 
@@ -165,7 +163,7 @@ static int combiner_irq_domain_map(struct irq_domain *d, unsigned int irq,
 
         irq_set_chip_and_handler(irq, &combiner_chip, handle_level_irq);
         irq_set_chip_data(irq, &combiner_data[hw >> 3]);
-        set_irq_flags(irq, IRQF_VALID | IRQF_PROBE);
+        irq_set_probe(irq);
 
         return 0;
 }
diff --git a/drivers/irqchip/irq-armada-370-xp.c b/drivers/irqchip/irq-armada-370-xp.c
index 39b72da0c143..655cb967a1f2 100644
--- a/drivers/irqchip/irq-armada-370-xp.c
+++ b/drivers/irqchip/irq-armada-370-xp.c
@@ -200,7 +200,6 @@ static int armada_370_xp_msi_map(struct irq_domain *domain, unsigned int virq,
 {
         irq_set_chip_and_handler(virq, &armada_370_xp_msi_irq_chip,
                                  handle_simple_irq);
-        set_irq_flags(virq, IRQF_VALID);
 
         return 0;
 }
@@ -317,7 +316,7 @@ static int armada_370_xp_mpic_irq_map(struct irq_domain *h,
                 irq_set_chip_and_handler(virq, &armada_370_xp_irq_chip,
                                         handle_level_irq);
         }
-        set_irq_flags(virq, IRQF_VALID | IRQF_PROBE);
+        irq_set_probe(virq);
 
         return 0;
 }
@@ -447,8 +446,7 @@ static void armada_370_xp_handle_msi_irq(struct pt_regs *regs, bool is_chained)
 static void armada_370_xp_handle_msi_irq(struct pt_regs *r, bool b) {}
 #endif
 
-static void armada_370_xp_mpic_handle_cascade_irq(unsigned int irq,
-                                                  struct irq_desc *desc)
+static void armada_370_xp_mpic_handle_cascade_irq(struct irq_desc *desc)
 {
         struct irq_chip *chip = irq_desc_get_chip(desc);
         unsigned long irqmap, irqn, irqsrc, cpuid;
diff --git a/drivers/irqchip/irq-bcm2835.c b/drivers/irqchip/irq-bcm2835.c
index ed4ca9deca70..bf9cc5f2e839 100644
--- a/drivers/irqchip/irq-bcm2835.c
+++ b/drivers/irqchip/irq-bcm2835.c
@@ -96,7 +96,7 @@ struct armctrl_ic {
 static struct armctrl_ic intc __read_mostly;
 static void __exception_irq_entry bcm2835_handle_irq(
         struct pt_regs *regs);
-static void bcm2836_chained_handle_irq(unsigned int irq, struct irq_desc *desc);
+static void bcm2836_chained_handle_irq(struct irq_desc *desc);
 
 static void armctrl_mask_irq(struct irq_data *d)
 {
@@ -166,7 +166,7 @@ static int __init armctrl_of_init(struct device_node *node,
                         BUG_ON(irq <= 0);
                         irq_set_chip_and_handler(irq, &armctrl_chip,
                                 handle_level_irq);
-                        set_irq_flags(irq, IRQF_VALID | IRQF_PROBE);
+                        irq_set_probe(irq);
                 }
         }
 
@@ -245,7 +245,7 @@ static void __exception_irq_entry bcm2835_handle_irq(
                 handle_IRQ(irq_linear_revmap(intc.domain, hwirq), regs);
 }
 
-static void bcm2836_chained_handle_irq(unsigned int irq, struct irq_desc *desc)
+static void bcm2836_chained_handle_irq(struct irq_desc *desc)
 {
         u32 hwirq;
 
diff --git a/drivers/irqchip/irq-bcm7038-l1.c b/drivers/irqchip/irq-bcm7038-l1.c
index 409bdc6366c2..0fea985ef1dc 100644
--- a/drivers/irqchip/irq-bcm7038-l1.c
+++ b/drivers/irqchip/irq-bcm7038-l1.c
@@ -115,7 +115,7 @@ static inline void l1_writel(u32 val, void __iomem *reg)
                 writel(val, reg);
 }
 
-static void bcm7038_l1_irq_handle(unsigned int irq, struct irq_desc *desc)
+static void bcm7038_l1_irq_handle(struct irq_desc *desc)
 {
         struct bcm7038_l1_chip *intc = irq_desc_get_handler_data(desc);
         struct bcm7038_l1_cpu *cpu;
diff --git a/drivers/irqchip/irq-bcm7120-l2.c b/drivers/irqchip/irq-bcm7120-l2.c
index d3f976913a6f..61b18ab33ad9 100644
--- a/drivers/irqchip/irq-bcm7120-l2.c
+++ b/drivers/irqchip/irq-bcm7120-l2.c
@@ -56,7 +56,7 @@ struct bcm7120_l2_intc_data {
         const __be32 *map_mask_prop;
 };
 
-static void bcm7120_l2_intc_irq_handle(unsigned int irq, struct irq_desc *desc)
+static void bcm7120_l2_intc_irq_handle(struct irq_desc *desc)
 {
         struct bcm7120_l1_intc_data *data = irq_desc_get_handler_data(desc);
         struct bcm7120_l2_intc_data *b = data->b;
diff --git a/drivers/irqchip/irq-brcmstb-l2.c b/drivers/irqchip/irq-brcmstb-l2.c
index aedda06191eb..65cd341f331a 100644
--- a/drivers/irqchip/irq-brcmstb-l2.c
+++ b/drivers/irqchip/irq-brcmstb-l2.c
@@ -49,13 +49,12 @@ struct brcmstb_l2_intc_data {
         u32 saved_mask; /* for suspend/resume */
 };
 
-static void brcmstb_l2_intc_irq_handle(unsigned int __irq,
-                                       struct irq_desc *desc)
+static void brcmstb_l2_intc_irq_handle(struct irq_desc *desc)
 {
         struct brcmstb_l2_intc_data *b = irq_desc_get_handler_data(desc);
         struct irq_chip_generic *gc = irq_get_domain_generic_chip(b->domain, 0);
         struct irq_chip *chip = irq_desc_get_chip(desc);
-        unsigned int irq = irq_desc_get_irq(desc);
+        unsigned int irq;
         u32 status;
 
         chained_irq_enter(chip, desc);
@@ -65,7 +64,7 @@ static void brcmstb_l2_intc_irq_handle(unsigned int __irq,
 
         if (status == 0) {
                 raw_spin_lock(&desc->lock);
-                handle_bad_irq(irq, desc);
+                handle_bad_irq(desc);
                 raw_spin_unlock(&desc->lock);
                 goto out;
         }
diff --git a/drivers/irqchip/irq-clps711x.c b/drivers/irqchip/irq-clps711x.c
index 2dd929eed9e0..eb5eb0cd414d 100644
--- a/drivers/irqchip/irq-clps711x.c
+++ b/drivers/irqchip/irq-clps711x.c
@@ -132,14 +132,14 @@ static int __init clps711x_intc_irq_map(struct irq_domain *h, unsigned int virq,
                                         irq_hw_number_t hw)
 {
         irq_flow_handler_t handler = handle_level_irq;
-        unsigned int flags = IRQF_VALID | IRQF_PROBE;
+        unsigned int flags = 0;
 
         if (!clps711x_irqs[hw].flags)
                 return 0;
 
         if (clps711x_irqs[hw].flags & CLPS711X_FLAG_FIQ) {
                 handler = handle_bad_irq;
-                flags |= IRQF_NOAUTOEN;
+                flags |= IRQ_NOAUTOEN;
         } else if (clps711x_irqs[hw].eoi) {
                 handler = handle_fasteoi_irq;
         }
@@ -149,7 +149,7 @@ static int __init clps711x_intc_irq_map(struct irq_domain *h, unsigned int virq,
                 writel_relaxed(0, clps711x_intc->base + clps711x_irqs[hw].eoi);
 
         irq_set_chip_and_handler(virq, &clps711x_intc_chip, handler);
-        set_irq_flags(virq, flags);
+        irq_modify_status(virq, IRQ_NOPROBE, flags);
 
         return 0;
 }
diff --git a/drivers/irqchip/irq-dw-apb-ictl.c b/drivers/irqchip/irq-dw-apb-ictl.c
index efd95d9955e7..052f266364c0 100644
--- a/drivers/irqchip/irq-dw-apb-ictl.c
+++ b/drivers/irqchip/irq-dw-apb-ictl.c
@@ -26,7 +26,7 @@
 #define APB_INT_FINALSTATUS_H   0x34
 #define APB_INT_BASE_OFFSET     0x04
 
-static void dw_apb_ictl_handler(unsigned int irq, struct irq_desc *desc)
+static void dw_apb_ictl_handler(struct irq_desc *desc)
 {
         struct irq_domain *d = irq_desc_get_handler_data(desc);
         struct irq_chip *chip = irq_desc_get_chip(desc);
diff --git a/drivers/irqchip/irq-gic-v2m.c b/drivers/irqchip/irq-gic-v2m.c
index db04fc1f56b2..12985daa66ab 100644
--- a/drivers/irqchip/irq-gic-v2m.c
+++ b/drivers/irqchip/irq-gic-v2m.c
@@ -95,8 +95,8 @@ static void gicv2m_compose_msi_msg(struct irq_data *data, struct msi_msg *msg)
         struct v2m_data *v2m = irq_data_get_irq_chip_data(data);
         phys_addr_t addr = v2m->res.start + V2M_MSI_SETSPI_NS;
 
-        msg->address_hi = (u32) (addr >> 32);
-        msg->address_lo = (u32) (addr);
+        msg->address_hi = upper_32_bits(addr);
+        msg->address_lo = lower_32_bits(addr);
         msg->data = data->hwirq;
 }
 
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 26b55c53755f..ac7ae2b3cb83 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -898,8 +898,10 @@ retry_baser:
                          * non-cacheable as well.
                          */
                         shr = tmp & GITS_BASER_SHAREABILITY_MASK;
-                        if (!shr)
+                        if (!shr) {
                                 cache = GITS_BASER_nC;
+                                __flush_dcache_area(base, alloc_size);
+                        }
                         goto retry_baser;
                 }
 
@@ -1140,6 +1142,8 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id,
                 return NULL;
         }
 
+        __flush_dcache_area(itt, sz);
+
         dev->its = its;
         dev->itt = itt;
         dev->nr_ites = nr_ites;
diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
index 7deed6ef54c2..36ecfc870e5a 100644
--- a/drivers/irqchip/irq-gic-v3.c
+++ b/drivers/irqchip/irq-gic-v3.c
@@ -70,11 +70,6 @@ static inline int gic_irq_in_rdist(struct irq_data *d)
         return gic_irq(d) < 32;
 }
 
-static inline bool forwarded_irq(struct irq_data *d)
-{
-        return d->handler_data != NULL;
-}
-
 static inline void __iomem *gic_dist_base(struct irq_data *d)
 {
         if (gic_irq_in_rdist(d))        /* SGI+PPI -> SGI_base for this CPU */
@@ -249,7 +244,7 @@ static void gic_eoimode1_mask_irq(struct irq_data *d)
          * disabled/masked will not get "stuck", because there is
          * noone to deactivate it (guest is being terminated).
          */
-        if (forwarded_irq(d))
+        if (irqd_is_forwarded_to_vcpu(d))
                 gic_poke_irq(d, GICD_ICACTIVER);
 }
 
@@ -324,7 +319,7 @@ static void gic_eoimode1_eoi_irq(struct irq_data *d)
          * No need to deactivate an LPI, or an interrupt that
          * is is getting forwarded to a vcpu.
          */
-        if (gic_irq(d) >= 8192 || forwarded_irq(d))
+        if (gic_irq(d) >= 8192 || irqd_is_forwarded_to_vcpu(d))
                 return;
         gic_write_dir(gic_irq(d));
 }
@@ -357,7 +352,10 @@ static int gic_set_type(struct irq_data *d, unsigned int type)
 
 static int gic_irq_set_vcpu_affinity(struct irq_data *d, void *vcpu)
 {
-        d->handler_data = vcpu;
+        if (vcpu)
+                irqd_set_forwarded_to_vcpu(d);
+        else
+                irqd_clr_forwarded_to_vcpu(d);
         return 0;
 }
 
@@ -754,13 +752,13 @@ static int gic_irq_domain_map(struct irq_domain *d, unsigned int irq,
                 irq_set_percpu_devid(irq);
                 irq_domain_set_info(d, irq, hw, chip, d->host_data,
                                     handle_percpu_devid_irq, NULL, NULL);
-                set_irq_flags(irq, IRQF_VALID | IRQF_NOAUTOEN);
+                irq_set_status_flags(irq, IRQ_NOAUTOEN);
         }
         /* SPIs */
         if (hw >= 32 && hw < gic_data.irq_nr) {
                 irq_domain_set_info(d, irq, hw, chip, d->host_data,
                                     handle_fasteoi_irq, NULL, NULL);
-                set_irq_flags(irq, IRQF_VALID | IRQF_PROBE);
+                irq_set_probe(irq);
         }
         /* LPIs */
         if (hw >= 8192 && hw < GIC_ID_NR) {
@@ -768,7 +766,6 @@ static int gic_irq_domain_map(struct irq_domain *d, unsigned int irq,
                         return -EPERM;
                 irq_domain_set_info(d, irq, hw, chip, d->host_data,
                                     handle_fasteoi_irq, NULL, NULL);
-                set_irq_flags(irq, IRQF_VALID);
         }
 
         return 0;
diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
index e6b7ed537952..982c09c2d791 100644
--- a/drivers/irqchip/irq-gic.c
+++ b/drivers/irqchip/irq-gic.c
@@ -145,29 +145,10 @@ static inline bool cascading_gic_irq(struct irq_data *d)
         void *data = irq_data_get_irq_handler_data(d);
 
         /*
-         * If handler_data pointing to one of the secondary GICs, then
-         * this is a cascading interrupt, and it cannot possibly be
-         * forwarded.
+         * If handler_data is set, this is a cascading interrupt, and
+         * it cannot possibly be forwarded.
          */
-        if (data >= (void *)(gic_data + 1) &&
-            data <  (void *)(gic_data + MAX_GIC_NR))
-                return true;
-
-        return false;
-}
-
-static inline bool forwarded_irq(struct irq_data *d)
-{
-        /*
-         * A forwarded interrupt:
-         * - is on the primary GIC
-         * - has its handler_data set to a value
-         * - that isn't a secondary GIC
-         */
-        if (d->handler_data && !cascading_gic_irq(d))
-                return true;
-
-        return false;
+        return data != NULL;
 }
 
 /*
@@ -201,7 +182,7 @@ static void gic_eoimode1_mask_irq(struct irq_data *d)
          * disabled/masked will not get "stuck", because there is
          * noone to deactivate it (guest is being terminated).
          */
-        if (forwarded_irq(d))
+        if (irqd_is_forwarded_to_vcpu(d))
                 gic_poke_irq(d, GIC_DIST_ACTIVE_CLEAR);
 }
 
@@ -218,7 +199,7 @@ static void gic_eoi_irq(struct irq_data *d)
 static void gic_eoimode1_eoi_irq(struct irq_data *d)
 {
         /* Do not deactivate an IRQ forwarded to a vcpu. */
-        if (forwarded_irq(d))
+        if (irqd_is_forwarded_to_vcpu(d))
                 return;
 
         writel_relaxed(gic_irq(d), gic_cpu_base(d) + GIC_CPU_DEACTIVATE);
@@ -296,7 +277,10 @@ static int gic_irq_set_vcpu_affinity(struct irq_data *d, void *vcpu)
         if (cascading_gic_irq(d))
                 return -EINVAL;
 
-        d->handler_data = vcpu;
+        if (vcpu)
+                irqd_set_forwarded_to_vcpu(d);
+        else
+                irqd_clr_forwarded_to_vcpu(d);
         return 0;
 }
 
@@ -357,7 +341,7 @@ static void __exception_irq_entry gic_handle_irq(struct pt_regs *regs)
         } while (1);
 }
 
-static void gic_handle_cascade_irq(unsigned int irq, struct irq_desc *desc)
+static void gic_handle_cascade_irq(struct irq_desc *desc)
 {
         struct gic_chip_data *chip_data = irq_desc_get_handler_data(desc);
         struct irq_chip *chip = irq_desc_get_chip(desc);
@@ -376,7 +360,7 @@ static void gic_handle_cascade_irq(unsigned int irq, struct irq_desc *desc)
 
         cascade_irq = irq_find_mapping(chip_data->domain, gic_irq);
         if (unlikely(gic_irq < 32 || gic_irq > 1020))
-                handle_bad_irq(cascade_irq, desc);
+                handle_bad_irq(desc);
         else
                 generic_handle_irq(cascade_irq);
 
@@ -906,11 +890,11 @@ static int gic_irq_domain_map(struct irq_domain *d, unsigned int irq,
                 irq_set_percpu_devid(irq);
                 irq_domain_set_info(d, irq, hw, chip, d->host_data,
                                     handle_percpu_devid_irq, NULL, NULL);
-                set_irq_flags(irq, IRQF_VALID | IRQF_NOAUTOEN);
+                irq_set_status_flags(irq, IRQ_NOAUTOEN);
         } else {
                 irq_domain_set_info(d, irq, hw, chip, d->host_data,
                                     handle_fasteoi_irq, NULL, NULL);
-                set_irq_flags(irq, IRQF_VALID | IRQF_PROBE);
+                irq_set_probe(irq);
         }
         return 0;
 }
@@ -1119,12 +1103,49 @@ void __init gic_init_bases(unsigned int gic_nr, int irq_start,
 #ifdef CONFIG_OF
 static int gic_cnt __initdata;
 
+static bool gic_check_eoimode(struct device_node *node, void __iomem **base)
+{
+        struct resource cpuif_res;
+
+        of_address_to_resource(node, 1, &cpuif_res);
+
+        if (!is_hyp_mode_available())
+                return false;
+        if (resource_size(&cpuif_res) < SZ_8K)
+                return false;
+        if (resource_size(&cpuif_res) == SZ_128K) {
+                u32 val_low, val_high;
+
+                /*
+                 * Verify that we have the first 4kB of a GIC400
+                 * aliased over the first 64kB by checking the
+                 * GICC_IIDR register on both ends.
+                 */
+                val_low = readl_relaxed(*base + GIC_CPU_IDENT);
+                val_high = readl_relaxed(*base + GIC_CPU_IDENT + 0xf000);
+                if ((val_low & 0xffff0fff) != 0x0202043B ||
+                    val_low != val_high)
+                        return false;
+
+                /*
+                 * Move the base up by 60kB, so that we have a 8kB
+                 * contiguous region, which allows us to use GICC_DIR
+                 * at its normal offset. Please pass me that bucket.
+                 */
+                *base += 0xf000;
+                cpuif_res.start += 0xf000;
+                pr_warn("GIC: Adjusting CPU interface base to %pa",
+                        &cpuif_res.start);
+        }
+
+        return true;
+}
+
 static int __init
 gic_of_init(struct device_node *node, struct device_node *parent)
 {
         void __iomem *cpu_base;
         void __iomem *dist_base;
-        struct resource cpu_res;
         u32 percpu_offset;
         int irq;
 
@@ -1137,14 +1158,11 @@ gic_of_init(struct device_node *node, struct device_node *parent)
         cpu_base = of_iomap(node, 1);
         WARN(!cpu_base, "unable to map gic cpu registers\n");
 
-        of_address_to_resource(node, 1, &cpu_res);
-
         /*
          * Disable split EOI/Deactivate if either HYP is not available
          * or the CPU interface is too small.
          */
-        if (gic_cnt == 0 && (!is_hyp_mode_available() ||
-                             resource_size(&cpu_res) < SZ_8K))
+        if (gic_cnt == 0 && !gic_check_eoimode(node, &cpu_base))
                 static_key_slow_dec(&supports_deactivate);
 
         if (of_property_read_u32(node, "cpu-offset", &percpu_offset))
diff --git a/drivers/irqchip/irq-hip04.c b/drivers/irqchip/irq-hip04.c
index a0128c7c98dd..8f3ca8f3a62b 100644
--- a/drivers/irqchip/irq-hip04.c
+++ b/drivers/irqchip/irq-hip04.c
@@ -307,11 +307,11 @@ static int hip04_irq_domain_map(struct irq_domain *d, unsigned int irq,
                 irq_set_percpu_devid(irq);
                 irq_set_chip_and_handler(irq, &hip04_irq_chip,
                                          handle_percpu_devid_irq);
-                set_irq_flags(irq, IRQF_VALID | IRQF_NOAUTOEN);
+                irq_set_status_flags(irq, IRQ_NOAUTOEN);
         } else {
                 irq_set_chip_and_handler(irq, &hip04_irq_chip,
                                          handle_fasteoi_irq);
-                set_irq_flags(irq, IRQF_VALID | IRQF_PROBE);
+                irq_set_probe(irq);
         }
         irq_set_chip_data(irq, d->host_data);
         return 0;
diff --git a/drivers/irqchip/irq-i8259.c b/drivers/irqchip/irq-i8259.c
index 4836102ba312..e484fd255321 100644
--- a/drivers/irqchip/irq-i8259.c
+++ b/drivers/irqchip/irq-i8259.c
@@ -352,7 +352,7 @@ void __init init_i8259_irqs(void)
         __init_i8259_irqs(NULL);
 }
 
-static void i8259_irq_dispatch(unsigned int __irq, struct irq_desc *desc)
+static void i8259_irq_dispatch(struct irq_desc *desc)
 {
         struct irq_domain *domain = irq_desc_get_handler_data(desc);
         int hwirq = i8259_irq();
diff --git a/drivers/irqchip/irq-imgpdc.c b/drivers/irqchip/irq-imgpdc.c
index 841604b81004..c02d29c9dc05 100644
--- a/drivers/irqchip/irq-imgpdc.c
+++ b/drivers/irqchip/irq-imgpdc.c
@@ -218,7 +218,7 @@ static int pdc_irq_set_wake(struct irq_data *data, unsigned int on)
         return 0;
 }
 
-static void pdc_intc_perip_isr(unsigned int __irq, struct irq_desc *desc)
+static void pdc_intc_perip_isr(struct irq_desc *desc)
 {
         unsigned int irq = irq_desc_get_irq(desc);
         struct pdc_intc_priv *priv;
@@ -240,7 +240,7 @@ found:
         generic_handle_irq(irq_no);
 }
 
-static void pdc_intc_syswake_isr(unsigned int irq, struct irq_desc *desc)
+static void pdc_intc_syswake_isr(struct irq_desc *desc)
 {
         struct pdc_intc_priv *priv;
         unsigned int syswake, irq_no;
diff --git a/drivers/irqchip/irq-keystone.c b/drivers/irqchip/irq-keystone.c
index c1517267b5db..deb89d63a728 100644
--- a/drivers/irqchip/irq-keystone.c
+++ b/drivers/irqchip/irq-keystone.c
@@ -83,7 +83,7 @@ static void keystone_irq_ack(struct irq_data *d)
         /* nothing to do here */
 }
 
-static void keystone_irq_handler(unsigned __irq, struct irq_desc *desc)
+static void keystone_irq_handler(struct irq_desc *desc)
 {
         unsigned int irq = irq_desc_get_irq(desc);
         struct keystone_irq_device *kirq = irq_desc_get_handler_data(desc);
@@ -127,7 +127,7 @@ static int keystone_irq_map(struct irq_domain *h, unsigned int virq,
 
         irq_set_chip_data(virq, kirq);
         irq_set_chip_and_handler(virq, &kirq->chip, handle_level_irq);
-        set_irq_flags(virq, IRQF_VALID | IRQF_PROBE);
+        irq_set_probe(virq);
         return 0;
 }
 
diff --git a/drivers/irqchip/irq-metag-ext.c b/drivers/irqchip/irq-metag-ext.c
index 5f4c52928d16..8c38b3d92e1c 100644
--- a/drivers/irqchip/irq-metag-ext.c
+++ b/drivers/irqchip/irq-metag-ext.c
@@ -446,7 +446,7 @@ static int meta_intc_irq_set_type(struct irq_data *data, unsigned int flow_type)
  * Whilst using TR2 to detect external interrupts is a software convention it is
  * (hopefully) unlikely to change.
  */
-static void meta_intc_irq_demux(unsigned int irq, struct irq_desc *desc)
+static void meta_intc_irq_demux(struct irq_desc *desc)
 {
         struct meta_intc_priv *priv = &meta_intc_priv;
         irq_hw_number_t hw;
diff --git a/drivers/irqchip/irq-metag.c b/drivers/irqchip/irq-metag.c
index 3d23ce3edb5c..a5f053bd2f44 100644
--- a/drivers/irqchip/irq-metag.c
+++ b/drivers/irqchip/irq-metag.c
@@ -220,7 +220,7 @@ static int metag_internal_irq_set_affinity(struct irq_data *data,
  *      occurred. It is this function's job to demux this irq and
  *      figure out exactly which trigger needs servicing.
  */
-static void metag_internal_irq_demux(unsigned int irq, struct irq_desc *desc)
+static void metag_internal_irq_demux(struct irq_desc *desc)
 {
         struct metag_internal_irq_priv *priv = irq_desc_get_handler_data(desc);
         irq_hw_number_t hw;
diff --git a/drivers/irqchip/irq-mips-gic.c b/drivers/irqchip/irq-mips-gic.c
index 1764bcf8ee6b..af2f16bb8a94 100644
--- a/drivers/irqchip/irq-mips-gic.c
+++ b/drivers/irqchip/irq-mips-gic.c
@@ -546,7 +546,7 @@ static void __gic_irq_dispatch(void)
         gic_handle_shared_int(false);
 }
 
-static void gic_irq_dispatch(unsigned int irq, struct irq_desc *desc)
+static void gic_irq_dispatch(struct irq_desc *desc)
 {
         gic_handle_local_int(true);
         gic_handle_shared_int(true);
diff --git a/drivers/irqchip/irq-mmp.c b/drivers/irqchip/irq-mmp.c
index 781ed6e71dbb..013fc9659a84 100644
--- a/drivers/irqchip/irq-mmp.c
+++ b/drivers/irqchip/irq-mmp.c
@@ -129,7 +129,7 @@ struct irq_chip icu_irq_chip = {
         .irq_unmask     = icu_unmask_irq,
 };
 
-static void icu_mux_irq_demux(unsigned int __irq, struct irq_desc *desc)
+static void icu_mux_irq_demux(struct irq_desc *desc)
 {
         unsigned int irq = irq_desc_get_irq(desc);
         struct irq_domain *domain;
@@ -164,7 +164,6 @@ static int mmp_irq_domain_map(struct irq_domain *d, unsigned int irq,
                               irq_hw_number_t hw)
 {
         irq_set_chip_and_handler(irq, &icu_irq_chip, handle_level_irq);
-        set_irq_flags(irq, IRQF_VALID);
         return 0;
 }
 
@@ -234,7 +233,6 @@ void __init icu_init_irq(void)
         for (irq = 0; irq < 64; irq++) {
                 icu_mask_irq(irq_get_irq_data(irq));
                 irq_set_chip_and_handler(irq, &icu_irq_chip, handle_level_irq);
-                set_irq_flags(irq, IRQF_VALID);
         }
         irq_set_default_host(icu_data[0].domain);
         set_handle_irq(mmp_handle_irq);
@@ -337,7 +335,6 @@ void __init mmp2_init_icu(void)
                         irq_set_chip_and_handler(irq, &icu_irq_chip,
                                                  handle_level_irq);
                 }
-                set_irq_flags(irq, IRQF_VALID);
         }
         irq_set_default_host(icu_data[0].domain);
         set_handle_irq(mmp2_handle_irq);
diff --git a/drivers/irqchip/irq-mxs.c b/drivers/irqchip/irq-mxs.c
index 1faf812f3dc8..604df63e2edf 100644
--- a/drivers/irqchip/irq-mxs.c
+++ b/drivers/irqchip/irq-mxs.c
@@ -84,7 +84,6 @@ static int icoll_irq_domain_map(struct irq_domain *d, unsigned int virq,
                                 irq_hw_number_t hw)
 {
         irq_set_chip_and_handler(virq, &mxs_icoll_chip, handle_level_irq);
-        set_irq_flags(virq, IRQF_VALID);
 
         return 0;
 }
diff --git a/drivers/irqchip/irq-orion.c b/drivers/irqchip/irq-orion.c
index 5ea999a724b5..be4c5a8c9659 100644
--- a/drivers/irqchip/irq-orion.c
+++ b/drivers/irqchip/irq-orion.c
@@ -106,7 +106,7 @@ IRQCHIP_DECLARE(orion_intc, "marvell,orion-intc", orion_irq_init);
 #define ORION_BRIDGE_IRQ_CAUSE  0x00
 #define ORION_BRIDGE_IRQ_MASK   0x04
 
-static void orion_bridge_irq_handler(unsigned int irq, struct irq_desc *desc)
+static void orion_bridge_irq_handler(struct irq_desc *desc)
 {
         struct irq_domain *d = irq_desc_get_handler_data(desc);
 
diff --git a/drivers/irqchip/irq-renesas-intc-irqpin.c b/drivers/irqchip/irq-renesas-intc-irqpin.c
index 0670ab4e3897..9525335723f6 100644
--- a/drivers/irqchip/irq-renesas-intc-irqpin.c
+++ b/drivers/irqchip/irq-renesas-intc-irqpin.c
@@ -283,6 +283,9 @@ static int intc_irqpin_irq_set_type(struct irq_data *d, unsigned int type)
 static int intc_irqpin_irq_set_wake(struct irq_data *d, unsigned int on)
 {
         struct intc_irqpin_priv *p = irq_data_get_irq_chip_data(d);
+        int hw_irq = irqd_to_hwirq(d);
+
+        irq_set_irq_wake(p->irq[hw_irq].requested_irq, on);
 
         if (!p->clk)
                 return 0;
@@ -332,6 +335,12 @@ static irqreturn_t intc_irqpin_shared_irq_handler(int irq, void *dev_id)
         return status;
 }
 
+/*
+ * This lock class tells lockdep that INTC External IRQ Pin irqs are in a
+ * different category than their parents, so it won't report false recursion.
+ */
+static struct lock_class_key intc_irqpin_irq_lock_class;
+
 static int intc_irqpin_irq_domain_map(struct irq_domain *h, unsigned int virq,
                                       irq_hw_number_t hw)
 {
@@ -342,8 +351,8 @@ static int intc_irqpin_irq_domain_map(struct irq_domain *h, unsigned int virq,
 
         intc_irqpin_dbg(&p->irq[hw], "map");
         irq_set_chip_data(virq, h->host_data);
+        irq_set_lockdep_class(virq, &intc_irqpin_irq_lock_class);
         irq_set_chip_and_handler(virq, &p->irq_chip, handle_level_irq);
-        set_irq_flags(virq, IRQF_VALID); /* kill me now */
         return 0;
 }
 
diff --git a/drivers/irqchip/irq-renesas-irqc.c b/drivers/irqchip/irq-renesas-irqc.c
index 2aa3add711a6..35bf97ba4a3d 100644
--- a/drivers/irqchip/irq-renesas-irqc.c
+++ b/drivers/irqchip/irq-renesas-irqc.c
@@ -121,6 +121,9 @@ static int irqc_irq_set_type(struct irq_data *d, unsigned int type)
 static int irqc_irq_set_wake(struct irq_data *d, unsigned int on)
 {
         struct irqc_priv *p = irq_data_get_irq_chip_data(d);
+        int hw_irq = irqd_to_hwirq(d);
+
+        irq_set_irq_wake(p->irq[hw_irq].requested_irq, on);
 
         if (!p->clk)
                 return 0;
@@ -150,6 +153,12 @@ static irqreturn_t irqc_irq_handler(int irq, void *dev_id)
         return IRQ_NONE;
 }
 
+/*
+ * This lock class tells lockdep that IRQC irqs are in a different
+ * category than their parents, so it won't report false recursion.
+ */
+static struct lock_class_key irqc_irq_lock_class;
+
 static int irqc_irq_domain_map(struct irq_domain *h, unsigned int virq,
                                irq_hw_number_t hw)
 {
@@ -157,6 +166,7 @@ static int irqc_irq_domain_map(struct irq_domain *h, unsigned int virq,
 
         irqc_dbg(&p->irq[hw], "map");
         irq_set_chip_data(virq, h->host_data);
+        irq_set_lockdep_class(virq, &irqc_irq_lock_class);
         irq_set_chip_and_handler(virq, &p->irq_chip, handle_level_irq);
         return 0;
 }
diff --git a/drivers/irqchip/irq-s3c24xx.c b/drivers/irqchip/irq-s3c24xx.c
index 506d9f20ca51..7154b011ddd2 100644
--- a/drivers/irqchip/irq-s3c24xx.c
+++ b/drivers/irqchip/irq-s3c24xx.c
@@ -298,7 +298,7 @@ static struct irq_chip s3c_irq_eint0t4 = {
         .irq_set_type   = s3c_irqext0_type,
 };
 
-static void s3c_irq_demux(unsigned int __irq, struct irq_desc *desc)
+static void s3c_irq_demux(struct irq_desc *desc)
 {
         struct irq_chip *chip = irq_desc_get_chip(desc);
         struct s3c_irq_data *irq_data = irq_desc_get_chip_data(desc);
@@ -466,13 +466,11 @@ static int s3c24xx_irq_map(struct irq_domain *h, unsigned int virq,
 
         irq_set_chip_data(virq, irq_data);
 
-        set_irq_flags(virq, IRQF_VALID);
-
         if (parent_intc && irq_data->type != S3C_IRQTYPE_NONE) {
                 if (irq_data->parent_irq > 31) {
                         pr_err("irq-s3c24xx: parent irq %lu is out of range\n",
                                irq_data->parent_irq);
-                        goto err;
+                        return -EINVAL;
                 }
 
                 parent_irq_data = &parent_intc->irqs[irq_data->parent_irq];
@@ -485,18 +483,12 @@ static int s3c24xx_irq_map(struct irq_domain *h, unsigned int virq,
                 if (!irqno) {
                         pr_err("irq-s3c24xx: could not find mapping for parent irq %lu\n",
                                irq_data->parent_irq);
-                        goto err;
+                        return -EINVAL;
                 }
                 irq_set_chained_handler(irqno, s3c_irq_demux);
         }
 
         return 0;
-
-err:
-        set_irq_flags(virq, 0);
-
-        /* the only error can result from bad mapping data*/
-        return -EINVAL;
 }
 
 static const struct irq_domain_ops s3c24xx_irq_ops = {
@@ -1174,8 +1166,6 @@ static int s3c24xx_irq_map_of(struct irq_domain *h, unsigned int virq,
 
         irq_set_chip_data(virq, irq_data);
 
-        set_irq_flags(virq, IRQF_VALID);
-
         return 0;
 }
 
diff --git a/drivers/irqchip/irq-sun4i.c b/drivers/irqchip/irq-sun4i.c
index 4ad3e7c69aa7..0704362f4c82 100644
--- a/drivers/irqchip/irq-sun4i.c
+++ b/drivers/irqchip/irq-sun4i.c
@@ -83,7 +83,7 @@ static int sun4i_irq_map(struct irq_domain *d, unsigned int virq,
                          irq_hw_number_t hw)
 {
         irq_set_chip_and_handler(virq, &sun4i_irq_chip, handle_fasteoi_irq);
-        set_irq_flags(virq, IRQF_VALID | IRQF_PROBE);
+        irq_set_probe(virq);
 
         return 0;
 }
diff --git a/drivers/irqchip/irq-sunxi-nmi.c b/drivers/irqchip/irq-sunxi-nmi.c
index 772a82cacbf7..c143dd58410c 100644
--- a/drivers/irqchip/irq-sunxi-nmi.c
+++ b/drivers/irqchip/irq-sunxi-nmi.c
@@ -58,7 +58,7 @@ static inline u32 sunxi_sc_nmi_read(struct irq_chip_generic *gc, u32 off)
         return irq_reg_readl(gc, off);
 }
 
-static void sunxi_sc_nmi_handle_irq(unsigned int irq, struct irq_desc *desc)
+static void sunxi_sc_nmi_handle_irq(struct irq_desc *desc)
 {
         struct irq_domain *domain = irq_desc_get_handler_data(desc);
         struct irq_chip *chip = irq_desc_get_chip(desc);
diff --git a/drivers/irqchip/irq-tb10x.c b/drivers/irqchip/irq-tb10x.c
index 331829661366..848d782a2a3b 100644
--- a/drivers/irqchip/irq-tb10x.c
+++ b/drivers/irqchip/irq-tb10x.c
@@ -97,7 +97,7 @@ static int tb10x_irq_set_type(struct irq_data *data, unsigned int flow_type)
         return IRQ_SET_MASK_OK;
 }
 
-static void tb10x_irq_cascade(unsigned int __irq, struct irq_desc *desc)
+static void tb10x_irq_cascade(struct irq_desc *desc)
 {
         struct irq_domain *domain = irq_desc_get_handler_data(desc);
         unsigned int irq = irq_desc_get_irq(desc);
diff --git a/drivers/irqchip/irq-versatile-fpga.c b/drivers/irqchip/irq-versatile-fpga.c
index 16123f688768..598ab3f0e0ac 100644
--- a/drivers/irqchip/irq-versatile-fpga.c
+++ b/drivers/irqchip/irq-versatile-fpga.c
@@ -65,19 +65,19 @@ static void fpga_irq_unmask(struct irq_data *d)
         writel(mask, f->base + IRQ_ENABLE_SET);
 }
 
-static void fpga_irq_handle(unsigned int __irq, struct irq_desc *desc)
+static void fpga_irq_handle(struct irq_desc *desc)
 {
         struct fpga_irq_data *f = irq_desc_get_handler_data(desc);
-        unsigned int irq = irq_desc_get_irq(desc);
         u32 status = readl(f->base + IRQ_STATUS);
 
         if (status == 0) {
-                do_bad_IRQ(irq, desc);
+                do_bad_IRQ(desc);
                 return;
         }
 
         do {
-                irq = ffs(status) - 1;
+                unsigned int irq = ffs(status) - 1;
+
                 status &= ~(1 << irq);
                 generic_handle_irq(irq_find_mapping(f->domain, irq));
         } while (status);
@@ -128,7 +128,7 @@ static int fpga_irqdomain_map(struct irq_domain *d, unsigned int irq,
         irq_set_chip_data(irq, f);
         irq_set_chip_and_handler(irq, &f->chip,
                                 handle_level_irq);
-        set_irq_flags(irq, IRQF_VALID | IRQF_PROBE);
+        irq_set_probe(irq);
         return 0;
 }
 
diff --git a/drivers/irqchip/irq-vic.c b/drivers/irqchip/irq-vic.c
index 03846dff4212..b956dfffe78c 100644
--- a/drivers/irqchip/irq-vic.c
+++ b/drivers/irqchip/irq-vic.c
@@ -201,7 +201,7 @@ static int vic_irqdomain_map(struct irq_domain *d, unsigned int irq,
                 return -EPERM;
         irq_set_chip_and_handler(irq, &vic_chip, handle_level_irq);
         irq_set_chip_data(irq, v->base);
-        set_irq_flags(irq, IRQF_VALID | IRQF_PROBE);
+        irq_set_probe(irq);
         return 0;
 }
 
@@ -225,7 +225,7 @@ static int handle_one_vic(struct vic_device *vic, struct pt_regs *regs)
         return handled;
 }
 
-static void vic_handle_irq_cascaded(unsigned int irq, struct irq_desc *desc)
+static void vic_handle_irq_cascaded(struct irq_desc *desc)
 {
         u32 stat, hwirq;
         struct irq_chip *host_chip = irq_desc_get_chip(desc);
diff --git a/drivers/irqchip/irq-vt8500.c b/drivers/irqchip/irq-vt8500.c
index 8371d9978d31..f9af0af21751 100644
--- a/drivers/irqchip/irq-vt8500.c
+++ b/drivers/irqchip/irq-vt8500.c
@@ -167,7 +167,6 @@ static int vt8500_irq_map(struct irq_domain *h, unsigned int virq,
                                                         irq_hw_number_t hw)
 {
         irq_set_chip_and_handler(virq, &vt8500_irq_chip, handle_level_irq);
-        set_irq_flags(virq, IRQF_VALID);
 
         return 0;
 }
diff --git a/drivers/irqchip/spear-shirq.c b/drivers/irqchip/spear-shirq.c
index 4cbd9c5dc1e6..1ccd2abed65f 100644
--- a/drivers/irqchip/spear-shirq.c
+++ b/drivers/irqchip/spear-shirq.c
@@ -182,7 +182,7 @@ static struct spear_shirq *spear320_shirq_blocks[] = {
         &spear320_shirq_intrcomm_ras,
 };
 
-static void shirq_handler(unsigned __irq, struct irq_desc *desc)
+static void shirq_handler(struct irq_desc *desc)
 {
         struct spear_shirq *shirq = irq_desc_get_handler_data(desc);
         u32 pend;
@@ -211,7 +211,6 @@ static void __init spear_shirq_register(struct spear_shirq *shirq,
         for (i = 0; i < shirq->nr_irqs; i++) {
                 irq_set_chip_and_handler(shirq->virq_base + i,
                                          shirq->irq_chip, handle_simple_irq);
-                set_irq_flags(shirq->virq_base + i, IRQF_VALID);
                 irq_set_chip_data(shirq->virq_base + i, shirq);
         }
 }
diff --git a/drivers/leds/Kconfig b/drivers/leds/Kconfig
index 70f4255ff291..42990f2d0317 100644
--- a/drivers/leds/Kconfig
+++ b/drivers/leds/Kconfig
@@ -170,6 +170,7 @@ config LEDS_SUNFIRE
 
 config LEDS_IPAQ_MICRO
         tristate "LED Support for the Compaq iPAQ h3xxx"
+        depends on LEDS_CLASS
         depends on MFD_IPAQ_MICRO
         help
           Choose this option if you want to use the notification LED on
@@ -229,7 +230,7 @@ config LEDS_LP55XX_COMMON
         tristate "Common Driver for TI/National LP5521/5523/55231/5562/8501"
         depends on LEDS_LP5521 || LEDS_LP5523 || LEDS_LP5562 || LEDS_LP8501
         select FW_LOADER
-        select FW_LOADER_USER_HELPER_FALLBACK
+        select FW_LOADER_USER_HELPER
         help
           This option supports common operations for LP5521/5523/55231/5562/8501
           devices.
diff --git a/drivers/leds/leds-aat1290.c b/drivers/leds/leds-aat1290.c
index fd7c25fd29c1..ac77d36b630c 100644
--- a/drivers/leds/leds-aat1290.c
+++ b/drivers/leds/leds-aat1290.c
@@ -331,7 +331,7 @@ static void aat1290_led_validate_mm_current(struct aat1290_led *led,
         cfg->max_brightness = b + 1;
 }
 
-int init_mm_current_scale(struct aat1290_led *led,
+static int init_mm_current_scale(struct aat1290_led *led,
                         struct aat1290_led_config_data *cfg)
 {
         int max_mm_current_percent[] = { 20, 22, 25, 28, 32, 36, 40, 45, 50, 56,
@@ -559,6 +559,7 @@ static const struct of_device_id aat1290_led_dt_match[] = {
         { .compatible = "skyworks,aat1290" },
         {},
 };
+MODULE_DEVICE_TABLE(of, aat1290_led_dt_match);
 
 static struct platform_driver aat1290_led_driver = {
         .probe          = aat1290_led_probe,
diff --git a/drivers/leds/leds-bcm6328.c b/drivers/leds/leds-bcm6328.c
index 986fe1e28f84..1793727bc9ae 100644
--- a/drivers/leds/leds-bcm6328.c
+++ b/drivers/leds/leds-bcm6328.c
@@ -395,6 +395,7 @@ static const struct of_device_id bcm6328_leds_of_match[] = {
         { .compatible = "brcm,bcm6328-leds", },
         { },
 };
+MODULE_DEVICE_TABLE(of, bcm6328_leds_of_match);
 
 static struct platform_driver bcm6328_leds_driver = {
         .probe = bcm6328_leds_probe,
diff --git a/drivers/leds/leds-bcm6358.c b/drivers/leds/leds-bcm6358.c
index 21f96930b3be..7ea3526702e0 100644
--- a/drivers/leds/leds-bcm6358.c
+++ b/drivers/leds/leds-bcm6358.c
@@ -226,6 +226,7 @@ static const struct of_device_id bcm6358_leds_of_match[] = {
         { .compatible = "brcm,bcm6358-leds", },
         { },
 };
+MODULE_DEVICE_TABLE(of, bcm6358_leds_of_match);
 
 static struct platform_driver bcm6358_leds_driver = {
         .probe = bcm6358_leds_probe,
diff --git a/drivers/leds/leds-ktd2692.c b/drivers/leds/leds-ktd2692.c
index 2ae8c4d17ff8..feca07be85f5 100644
--- a/drivers/leds/leds-ktd2692.c
+++ b/drivers/leds/leds-ktd2692.c
@@ -426,6 +426,7 @@ static const struct of_device_id ktd2692_match[] = {
         { .compatible = "kinetic,ktd2692", },
         { /* sentinel */ },
 };
+MODULE_DEVICE_TABLE(of, ktd2692_match);
 
 static struct platform_driver ktd2692_driver = {
         .driver = {
diff --git a/drivers/leds/leds-max77693.c b/drivers/leds/leds-max77693.c
index df348a06d8c7..afbb1409b2e2 100644
--- a/drivers/leds/leds-max77693.c
+++ b/drivers/leds/leds-max77693.c
@@ -1080,6 +1080,7 @@ static const struct of_device_id max77693_led_dt_match[] = {
         { .compatible = "maxim,max77693-led" },
         {},
 };
+MODULE_DEVICE_TABLE(of, max77693_led_dt_match);
 
 static struct platform_driver max77693_led_driver = {
         .probe          = max77693_led_probe,
diff --git a/drivers/leds/leds-ns2.c b/drivers/leds/leds-ns2.c
index b33514d9f427..a95a61220169 100644
--- a/drivers/leds/leds-ns2.c
+++ b/drivers/leds/leds-ns2.c
@@ -337,6 +337,7 @@ static const struct of_device_id of_ns2_leds_match[] = {
         { .compatible = "lacie,ns2-leds", },
         {},
 };
+MODULE_DEVICE_TABLE(of, of_ns2_leds_match);
 #endif /* CONFIG_OF_GPIO */
 
 struct ns2_led_priv {
diff --git a/drivers/md/Kconfig b/drivers/md/Kconfig
index d5415eedba86..3e01e6fb3424 100644
--- a/drivers/md/Kconfig
+++ b/drivers/md/Kconfig
@@ -393,7 +393,7 @@ config DM_MULTIPATH
         # of SCSI_DH if the latter isn't defined but if
         # it is, DM_MULTIPATH must depend on it.  We get a build
         # error if SCSI_DH=m and DM_MULTIPATH=y
-        depends on SCSI_DH || !SCSI_DH
+        depends on !SCSI_DH || SCSI
         ---help---
           Allow volume managers to support multipath hardware.
 
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index d60c88df5234..4b3b6f8aff0c 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -968,7 +968,8 @@ static void crypt_free_buffer_pages(struct crypt_config *cc, struct bio *clone);
 
 /*
  * Generate a new unfragmented bio with the given size
- * This should never violate the device limitations
+ * This should never violate the device limitations (but only because
+ * max_segment_size is being constrained to PAGE_SIZE).
  *
  * This function may be called concurrently. If we allocate from the mempool
  * concurrently, there is a possibility of deadlock. For example, if we have
@@ -2045,9 +2046,20 @@ static int crypt_iterate_devices(struct dm_target *ti,
         return fn(ti, cc->dev, cc->start, ti->len, data);
 }
 
+static void crypt_io_hints(struct dm_target *ti, struct queue_limits *limits)
+{
+        /*
+         * Unfortunate constraint that is required to avoid the potential
+         * for exceeding underlying device's max_segments limits -- due to
+         * crypt_alloc_buffer() possibly allocating pages for the encryption
+         * bio that are not as physically contiguous as the original bio.
+         */
+        limits->max_segment_size = PAGE_SIZE;
+}
+
 static struct target_type crypt_target = {
         .name   = "crypt",
-        .version = {1, 14, 0},
+        .version = {1, 14, 1},
         .module = THIS_MODULE,
         .ctr    = crypt_ctr,
         .dtr    = crypt_dtr,
@@ -2058,6 +2070,7 @@ static struct target_type crypt_target = {
         .resume = crypt_resume,
         .message = crypt_message,
         .iterate_devices = crypt_iterate_devices,
+        .io_hints = crypt_io_hints,
 };
 
 static int __init dm_crypt_init(void)
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index eff7bdd7731d..5a67671a3973 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -159,12 +159,9 @@ static struct priority_group *alloc_priority_group(void)
 static void free_pgpaths(struct list_head *pgpaths, struct dm_target *ti)
 {
         struct pgpath *pgpath, *tmp;
-        struct multipath *m = ti->private;
 
         list_for_each_entry_safe(pgpath, tmp, pgpaths, list) {
                 list_del(&pgpath->list);
-                if (m->hw_handler_name)
-                        scsi_dh_detach(bdev_get_queue(pgpath->path.dev->bdev));
                 dm_put_device(ti, pgpath->path.dev);
                 free_pgpath(pgpath);
         }
@@ -580,6 +577,7 @@ static struct pgpath *parse_path(struct dm_arg_set *as, struct path_selector *ps
                 q = bdev_get_queue(p->path.dev->bdev);
 
         if (m->retain_attached_hw_handler) {
+retain:
                 attached_handler_name = scsi_dh_attached_handler_name(q, GFP_KERNEL);
                 if (attached_handler_name) {
                         /*
@@ -599,20 +597,14 @@ static struct pgpath *parse_path(struct dm_arg_set *as, struct path_selector *ps
         }
 
         if (m->hw_handler_name) {
-                /*
-                 * Increments scsi_dh reference, even when using an
-                 * already-attached handler.
-                 */
                 r = scsi_dh_attach(q, m->hw_handler_name);
                 if (r == -EBUSY) {
-                        /*
-                         * Already attached to different hw_handler:
-                         * try to reattach with correct one.
-                         */
-                        scsi_dh_detach(q);
-                        r = scsi_dh_attach(q, m->hw_handler_name);
-                }
+                        char b[BDEVNAME_SIZE];
 
+                        printk(KERN_INFO "dm-mpath: retaining handler on device %s\n",
+                                bdevname(p->path.dev->bdev, b));
+                        goto retain;
+                }
                 if (r < 0) {
                         ti->error = "error attaching hardware handler";
                         dm_put_device(ti, p->path.dev);
@@ -624,7 +616,6 @@ static struct pgpath *parse_path(struct dm_arg_set *as, struct path_selector *ps
                         if (r < 0) {
                                 ti->error = "unable to set hardware "
                                                         "handler parameters";
-                                scsi_dh_detach(q);
                                 dm_put_device(ti, p->path.dev);
                                 goto bad;
                         }
@@ -734,12 +725,6 @@ static int parse_hw_handler(struct dm_arg_set *as, struct multipath *m)
                 return 0;
 
         m->hw_handler_name = kstrdup(dm_shift_arg(as), GFP_KERNEL);
-        if (!try_then_request_module(scsi_dh_handler_exist(m->hw_handler_name),
-                                     "scsi_dh_%s", m->hw_handler_name)) {
-                ti->error = "unknown hardware handler type";
-                ret = -EINVAL;
-                goto fail;
-        }
 
         if (hw_argc > 1) {
                 char *p;
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 6578b7bc1fbb..6fcbfb063366 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -4249,6 +4249,10 @@ static void thin_io_hints(struct dm_target *ti, struct queue_limits *limits)
 {
         struct thin_c *tc = ti->private;
         struct pool *pool = tc->pool;
+        struct queue_limits *pool_limits = dm_get_queue_limits(pool->pool_md);
+
+        if (!pool_limits->discard_granularity)
+                return; /* pool's discard support is disabled */
 
         limits->discard_granularity = pool->sectors_per_block << SECTOR_SHIFT;
         limits->max_discard_sectors = 2048 * 1024 * 16; /* 16G */
diff --git a/drivers/media/platform/omap/Kconfig b/drivers/media/platform/omap/Kconfig
index dc2aaab54aef..217d613b0fe7 100644
--- a/drivers/media/platform/omap/Kconfig
+++ b/drivers/media/platform/omap/Kconfig
@@ -10,6 +10,7 @@ config VIDEO_OMAP2_VOUT
         select OMAP2_DSS if HAS_IOMEM && ARCH_OMAP2PLUS
         select OMAP2_VRFB if ARCH_OMAP2 || ARCH_OMAP3
         select VIDEO_OMAP2_VOUT_VRFB if VIDEO_OMAP2_VOUT && OMAP2_VRFB
+        select FRAME_VECTOR
         default n
         ---help---
           V4L2 Display driver support for OMAP2/3 based boards.
diff --git a/drivers/media/platform/omap/omap_vout.c b/drivers/media/platform/omap/omap_vout.c
index de2474e1132d..70c28d19ea04 100644
--- a/drivers/media/platform/omap/omap_vout.c
+++ b/drivers/media/platform/omap/omap_vout.c
@@ -195,46 +195,34 @@ static int omap_vout_try_format(struct v4l2_pix_format *pix)
 }
 
 /*
- * omap_vout_uservirt_to_phys: This inline function is used to convert user
- * space virtual address to physical address.
+ * omap_vout_get_userptr: Convert user space virtual address to physical
+ * address.
  */
-static unsigned long omap_vout_uservirt_to_phys(unsigned long virtp)
+static int omap_vout_get_userptr(struct videobuf_buffer *vb, u32 virtp,
+                                 u32 *physp)
 {
-        unsigned long physp = 0;
-        struct vm_area_struct *vma;
-        struct mm_struct *mm = current->mm;
+        struct frame_vector *vec;
+        int ret;
 
         /* For kernel direct-mapped memory, take the easy way */
-        if (virtp >= PAGE_OFFSET)
-                return virt_to_phys((void *) virtp);
-
-        down_read(&current->mm->mmap_sem);
-        vma = find_vma(mm, virtp);
-        if (vma && (vma->vm_flags & VM_IO) && vma->vm_pgoff) {
-                /* this will catch, kernel-allocated, mmaped-to-usermode
-                   addresses */
-                physp = (vma->vm_pgoff << PAGE_SHIFT) + (virtp - vma->vm_start);
-                up_read(&current->mm->mmap_sem);
-        } else {
-                /* otherwise, use get_user_pages() for general userland pages */
-                int res, nr_pages = 1;
-                struct page *pages;
+        if (virtp >= PAGE_OFFSET) {
+                *physp = virt_to_phys((void *)virtp);
+                return 0;
+        }
 
-                res = get_user_pages(current, current->mm, virtp, nr_pages, 1,
-                                0, &pages, NULL);
-                up_read(&current->mm->mmap_sem);
+        vec = frame_vector_create(1);
+        if (!vec)
+                return -ENOMEM;
 
-                if (res == nr_pages) {
-                        physp =  __pa(page_address(&pages[0]) +
-                                        (virtp & ~PAGE_MASK));
-                } else {
-                        printk(KERN_WARNING VOUT_NAME
-                                        "get_user_pages failed\n");
-                        return 0;
-                }
+        ret = get_vaddr_frames(virtp, 1, true, false, vec);
+        if (ret != 1) {
+                frame_vector_destroy(vec);
+                return -EINVAL;
         }
+        *physp = __pfn_to_phys(frame_vector_pfns(vec)[0]);
+        vb->priv = vec;
 
-        return physp;
+        return 0;
 }
 
 /*
@@ -784,11 +772,15 @@ static int omap_vout_buffer_prepare(struct videobuf_queue *q,
          * address of the buffer
          */
         if (V4L2_MEMORY_USERPTR == vb->memory) {
+                int ret;
+
                 if (0 == vb->baddr)
                         return -EINVAL;
                 /* Physical address */
-                vout->queued_buf_addr[vb->i] = (u8 *)
-                        omap_vout_uservirt_to_phys(vb->baddr);
+                ret = omap_vout_get_userptr(vb, vb->baddr,
+                                (u32 *)&vout->queued_buf_addr[vb->i]);
+                if (ret < 0)
+                        return ret;
         } else {
                 unsigned long addr, dma_addr;
                 unsigned long size;
@@ -834,12 +826,13 @@ static void omap_vout_buffer_queue(struct videobuf_queue *q,
 static void omap_vout_buffer_release(struct videobuf_queue *q,
                             struct videobuf_buffer *vb)
 {
-        struct omap_vout_device *vout = q->priv_data;
-
         vb->state = VIDEOBUF_NEEDS_INIT;
+        if (vb->memory == V4L2_MEMORY_USERPTR && vb->priv) {
+                struct frame_vector *vec = vb->priv;
 
-        if (V4L2_MEMORY_MMAP != vout->memory)
-                return;
+                put_vaddr_frames(vec);
+                frame_vector_destroy(vec);
+        }
 }
 
 /*
diff --git a/drivers/media/v4l2-core/Kconfig b/drivers/media/v4l2-core/Kconfig
index b4b022933e29..82876a67f144 100644
--- a/drivers/media/v4l2-core/Kconfig
+++ b/drivers/media/v4l2-core/Kconfig
@@ -84,6 +84,7 @@ config VIDEOBUF2_CORE
 
 config VIDEOBUF2_MEMOPS
         tristate
+        select FRAME_VECTOR
 
 config VIDEOBUF2_DMA_CONTIG
         tristate
diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c
index f1022d810d22..4f59b7ec05d0 100644
--- a/drivers/media/v4l2-core/videobuf2-core.c
+++ b/drivers/media/v4l2-core/videobuf2-core.c
@@ -1691,9 +1691,7 @@ static int __buf_prepare(struct vb2_buffer *vb, const struct v4l2_buffer *b)
                 ret = __qbuf_mmap(vb, b);
                 break;
         case V4L2_MEMORY_USERPTR:
-                down_read(&current->mm->mmap_sem);
                 ret = __qbuf_userptr(vb, b);
-                up_read(&current->mm->mmap_sem);
                 break;
         case V4L2_MEMORY_DMABUF:
                 ret = __qbuf_dmabuf(vb, b);
diff --git a/drivers/media/v4l2-core/videobuf2-dma-contig.c b/drivers/media/v4l2-core/videobuf2-dma-contig.c
index 94c1e6455d36..2397ceb1dc6b 100644
--- a/drivers/media/v4l2-core/videobuf2-dma-contig.c
+++ b/drivers/media/v4l2-core/videobuf2-dma-contig.c
@@ -32,15 +32,13 @@ struct vb2_dc_buf {
         dma_addr_t                      dma_addr;
         enum dma_data_direction         dma_dir;
         struct sg_table                 *dma_sgt;
+        struct frame_vector             *vec;
 
         /* MMAP related */
         struct vb2_vmarea_handler       handler;
         atomic_t                        refcount;
         struct sg_table                 *sgt_base;
 
-        /* USERPTR related */
-        struct vm_area_struct           *vma;
-
         /* DMABUF related */
         struct dma_buf_attachment       *db_attach;
 };
@@ -49,24 +47,6 @@ struct vb2_dc_buf {
 /*        scatterlist table functions        */
 /*********************************************/
 
-
-static void vb2_dc_sgt_foreach_page(struct sg_table *sgt,
-        void (*cb)(struct page *pg))
-{
-        struct scatterlist *s;
-        unsigned int i;
-
-        for_each_sg(sgt->sgl, s, sgt->orig_nents, i) {
-                struct page *page = sg_page(s);
-                unsigned int n_pages = PAGE_ALIGN(s->offset + s->length)
-                        >> PAGE_SHIFT;
-                unsigned int j;
-
-                for (j = 0; j < n_pages; ++j, ++page)
-                        cb(page);
-        }
-}
-
 static unsigned long vb2_dc_get_contiguous_size(struct sg_table *sgt)
 {
         struct scatterlist *s;
@@ -429,92 +409,12 @@ static struct dma_buf *vb2_dc_get_dmabuf(void *buf_priv, unsigned long flags)
 /*       callbacks for USERPTR buffers       */
 /*********************************************/
 
-static inline int vma_is_io(struct vm_area_struct *vma)
-{
-        return !!(vma->vm_flags & (VM_IO | VM_PFNMAP));
-}
-
-static int vb2_dc_get_user_pfn(unsigned long start, int n_pages,
-        struct vm_area_struct *vma, unsigned long *res)
-{
-        unsigned long pfn, start_pfn, prev_pfn;
-        unsigned int i;
-        int ret;
-
-        if (!vma_is_io(vma))
-                return -EFAULT;
-
-        ret = follow_pfn(vma, start, &pfn);
-        if (ret)
-                return ret;
-
-        start_pfn = pfn;
-        start += PAGE_SIZE;
-
-        for (i = 1; i < n_pages; ++i, start += PAGE_SIZE) {
-                prev_pfn = pfn;
-                ret = follow_pfn(vma, start, &pfn);
-
-                if (ret) {
-                        pr_err("no page for address %lu\n", start);
-                        return ret;
-                }
-                if (pfn != prev_pfn + 1)
-                        return -EINVAL;
-        }
-
-        *res = start_pfn;
-        return 0;
-}
-
-static int vb2_dc_get_user_pages(unsigned long start, struct page **pages,
-        int n_pages, struct vm_area_struct *vma,
-        enum dma_data_direction dma_dir)
-{
-        if (vma_is_io(vma)) {
-                unsigned int i;
-
-                for (i = 0; i < n_pages; ++i, start += PAGE_SIZE) {
-                        unsigned long pfn;
-                        int ret = follow_pfn(vma, start, &pfn);
-
-                        if (!pfn_valid(pfn))
-                                return -EINVAL;
-
-                        if (ret) {
-                                pr_err("no page for address %lu\n", start);
-                                return ret;
-                        }
-                        pages[i] = pfn_to_page(pfn);
-                }
-        } else {
-                int n;
-
-                n = get_user_pages(current, current->mm, start & PAGE_MASK,
-                        n_pages, dma_dir == DMA_FROM_DEVICE, 1, pages, NULL);
-                /* negative error means that no page was pinned */
-                n = max(n, 0);
-                if (n != n_pages) {
-                        pr_err("got only %d of %d user pages\n", n, n_pages);
-                        while (n)
-                                put_page(pages[--n]);
-                        return -EFAULT;
-                }
-        }
-
-        return 0;
-}
-
-static void vb2_dc_put_dirty_page(struct page *page)
-{
-        set_page_dirty_lock(page);
-        put_page(page);
-}
-
 static void vb2_dc_put_userptr(void *buf_priv)
 {
         struct vb2_dc_buf *buf = buf_priv;
         struct sg_table *sgt = buf->dma_sgt;
+        int i;
+        struct page **pages;
 
         if (sgt) {
                 DEFINE_DMA_ATTRS(attrs);
@@ -526,13 +426,15 @@ static void vb2_dc_put_userptr(void *buf_priv)
                  */
                 dma_unmap_sg_attrs(buf->dev, sgt->sgl, sgt->orig_nents,
                                    buf->dma_dir, &attrs);
-                if (!vma_is_io(buf->vma))
-                        vb2_dc_sgt_foreach_page(sgt, vb2_dc_put_dirty_page);
-
+                pages = frame_vector_pages(buf->vec);
+                /* sgt should exist only if vector contains pages... */
+                BUG_ON(IS_ERR(pages));
+                for (i = 0; i < frame_vector_count(buf->vec); i++)
+                        set_page_dirty_lock(pages[i]);
                 sg_free_table(sgt);
                 kfree(sgt);
         }
-        vb2_put_vma(buf->vma);
+        vb2_destroy_framevec(buf->vec);
         kfree(buf);
 }
 
@@ -572,13 +474,10 @@ static void *vb2_dc_get_userptr(void *alloc_ctx, unsigned long vaddr,
 {
         struct vb2_dc_conf *conf = alloc_ctx;
         struct vb2_dc_buf *buf;
-        unsigned long start;
-        unsigned long end;
+        struct frame_vector *vec;
         unsigned long offset;
-        struct page **pages;
-        int n_pages;
+        int n_pages, i;
         int ret = 0;
-        struct vm_area_struct *vma;
         struct sg_table *sgt;
         unsigned long contig_size;
         unsigned long dma_align = dma_get_cache_alignment();
@@ -604,72 +503,43 @@ static void *vb2_dc_get_userptr(void *alloc_ctx, unsigned long vaddr,
         buf->dev = conf->dev;
         buf->dma_dir = dma_dir;
 
-        start = vaddr & PAGE_MASK;
         offset = vaddr & ~PAGE_MASK;
-        end = PAGE_ALIGN(vaddr + size);
-        n_pages = (end - start) >> PAGE_SHIFT;
-
-        pages = kmalloc(n_pages * sizeof(pages[0]), GFP_KERNEL);
-        if (!pages) {
-                ret = -ENOMEM;
-                pr_err("failed to allocate pages table\n");
+        vec = vb2_create_framevec(vaddr, size, dma_dir == DMA_FROM_DEVICE);
+        if (IS_ERR(vec)) {
+                ret = PTR_ERR(vec);
                 goto fail_buf;
         }
+        buf->vec = vec;
+        n_pages = frame_vector_count(vec);
+        ret = frame_vector_to_pages(vec);
+        if (ret < 0) {
+                unsigned long *nums = frame_vector_pfns(vec);
 
-        /* current->mm->mmap_sem is taken by videobuf2 core */
-        vma = find_vma(current->mm, vaddr);
-        if (!vma) {
-                pr_err("no vma for address %lu\n", vaddr);
-                ret = -EFAULT;
-                goto fail_pages;
-        }
-
-        if (vma->vm_end < vaddr + size) {
-                pr_err("vma at %lu is too small for %lu bytes\n", vaddr, size);
-                ret = -EFAULT;
-                goto fail_pages;
-        }
-
-        buf->vma = vb2_get_vma(vma);
-        if (!buf->vma) {
-                pr_err("failed to copy vma\n");
-                ret = -ENOMEM;
-                goto fail_pages;
-        }
-
-        /* extract page list from userspace mapping */
-        ret = vb2_dc_get_user_pages(start, pages, n_pages, vma, dma_dir);
-        if (ret) {
-                unsigned long pfn;
-                if (vb2_dc_get_user_pfn(start, n_pages, vma, &pfn) == 0) {
-                        buf->dma_addr = vb2_dc_pfn_to_dma(buf->dev, pfn);
-                        buf->size = size;
-                        kfree(pages);
-                        return buf;
-                }
-
-                pr_err("failed to get user pages\n");
-                goto fail_vma;
+                /*
+                 * Failed to convert to pages... Check the memory is physically
+                 * contiguous and use direct mapping
+                 */
+                for (i = 1; i < n_pages; i++)
+                        if (nums[i-1] + 1 != nums[i])
+                                goto fail_pfnvec;
+                buf->dma_addr = vb2_dc_pfn_to_dma(buf->dev, nums[0]);
+                goto out;
         }
 
         sgt = kzalloc(sizeof(*sgt), GFP_KERNEL);
         if (!sgt) {
                 pr_err("failed to allocate sg table\n");
                 ret = -ENOMEM;
-                goto fail_get_user_pages;
+                goto fail_pfnvec;
         }
 
-        ret = sg_alloc_table_from_pages(sgt, pages, n_pages,
+        ret = sg_alloc_table_from_pages(sgt, frame_vector_pages(vec), n_pages,
                 offset, size, GFP_KERNEL);
         if (ret) {
                 pr_err("failed to initialize sg table\n");
                 goto fail_sgt;
         }
 
-        /* pages are no longer needed */
-        kfree(pages);
-        pages = NULL;
-
         /*
          * No need to sync to the device, this will happen later when the
          * prepare() memop is called.
@@ -691,8 +561,9 @@ static void *vb2_dc_get_userptr(void *alloc_ctx, unsigned long vaddr,
         }
 
         buf->dma_addr = sg_dma_address(sgt->sgl);
-        buf->size = size;
         buf->dma_sgt = sgt;
+out:
+        buf->size = size;
 
         return buf;
 
@@ -701,23 +572,13 @@ fail_map_sg:
                            buf->dma_dir, &attrs);
 
 fail_sgt_init:
-        if (!vma_is_io(buf->vma))
-                vb2_dc_sgt_foreach_page(sgt, put_page);
         sg_free_table(sgt);
 
 fail_sgt:
         kfree(sgt);
 
-fail_get_user_pages:
-        if (pages && !vma_is_io(buf->vma))
-                while (n_pages)
-                        put_page(pages[--n_pages]);
-
-fail_vma:
-        vb2_put_vma(buf->vma);
-
-fail_pages:
-        kfree(pages); /* kfree is NULL-proof */
+fail_pfnvec:
+        vb2_destroy_framevec(vec);
 
 fail_buf:
         kfree(buf);
diff --git a/drivers/media/v4l2-core/videobuf2-dma-sg.c b/drivers/media/v4l2-core/videobuf2-dma-sg.c
index 7289b81bd7b7..be7bd6535c9d 100644
--- a/drivers/media/v4l2-core/videobuf2-dma-sg.c
+++ b/drivers/media/v4l2-core/videobuf2-dma-sg.c
@@ -38,6 +38,7 @@ struct vb2_dma_sg_buf {
         struct device                   *dev;
         void                            *vaddr;
         struct page                     **pages;
+        struct frame_vector             *vec;
         int                             offset;
         enum dma_data_direction         dma_dir;
         struct sg_table                 sg_table;
@@ -51,7 +52,6 @@ struct vb2_dma_sg_buf {
         unsigned int                    num_pages;
         atomic_t                        refcount;
         struct vb2_vmarea_handler       handler;
-        struct vm_area_struct           *vma;
 
         struct dma_buf_attachment       *db_attach;
 };
@@ -225,25 +225,17 @@ static void vb2_dma_sg_finish(void *buf_priv)
         dma_sync_sg_for_cpu(buf->dev, sgt->sgl, sgt->nents, buf->dma_dir);
 }
 
-static inline int vma_is_io(struct vm_area_struct *vma)
-{
-        return !!(vma->vm_flags & (VM_IO | VM_PFNMAP));
-}
-
 static void *vb2_dma_sg_get_userptr(void *alloc_ctx, unsigned long vaddr,
                                     unsigned long size,
                                     enum dma_data_direction dma_dir)
 {
         struct vb2_dma_sg_conf *conf = alloc_ctx;
         struct vb2_dma_sg_buf *buf;
-        unsigned long first, last;
-        int num_pages_from_user;
-        struct vm_area_struct *vma;
         struct sg_table *sgt;
         DEFINE_DMA_ATTRS(attrs);
+        struct frame_vector *vec;
 
         dma_set_attr(DMA_ATTR_SKIP_CPU_SYNC, &attrs);
-
         buf = kzalloc(sizeof *buf, GFP_KERNEL);
         if (!buf)
                 return NULL;
@@ -254,61 +246,19 @@ static void *vb2_dma_sg_get_userptr(void *alloc_ctx, unsigned long vaddr,
         buf->offset = vaddr & ~PAGE_MASK;
         buf->size = size;
         buf->dma_sgt = &buf->sg_table;
+        vec = vb2_create_framevec(vaddr, size, buf->dma_dir == DMA_FROM_DEVICE);
+        if (IS_ERR(vec))
+                goto userptr_fail_pfnvec;
+        buf->vec = vec;
 
-        first = (vaddr           & PAGE_MASK) >> PAGE_SHIFT;
-        last  = ((vaddr + size - 1) & PAGE_MASK) >> PAGE_SHIFT;
-        buf->num_pages = last - first + 1;
-
-        buf->pages = kzalloc(buf->num_pages * sizeof(struct page *),
-                             GFP_KERNEL);
-        if (!buf->pages)
-                goto userptr_fail_alloc_pages;
-
-        vma = find_vma(current->mm, vaddr);
-        if (!vma) {
-                dprintk(1, "no vma for address %lu\n", vaddr);
-                goto userptr_fail_find_vma;
-        }
-
-        if (vma->vm_end < vaddr + size) {
-                dprintk(1, "vma at %lu is too small for %lu bytes\n",
-                        vaddr, size);
-                goto userptr_fail_find_vma;
-        }
-
-        buf->vma = vb2_get_vma(vma);
-        if (!buf->vma) {
-                dprintk(1, "failed to copy vma\n");
-                goto userptr_fail_find_vma;
-        }
-
-        if (vma_is_io(buf->vma)) {
-                for (num_pages_from_user = 0;
-                     num_pages_from_user < buf->num_pages;
-                     ++num_pages_from_user, vaddr += PAGE_SIZE) {
-                        unsigned long pfn;
-
-                        if (follow_pfn(vma, vaddr, &pfn)) {
-                                dprintk(1, "no page for address %lu\n", vaddr);
-                                break;
-                        }
-                        buf->pages[num_pages_from_user] = pfn_to_page(pfn);
-                }
-        } else
-                num_pages_from_user = get_user_pages(current, current->mm,
-                                             vaddr & PAGE_MASK,
-                                             buf->num_pages,
-                                             buf->dma_dir == DMA_FROM_DEVICE,
-                                             1, /* force */
-                                             buf->pages,
-                                             NULL);
-
-        if (num_pages_from_user != buf->num_pages)
-                goto userptr_fail_get_user_pages;
+        buf->pages = frame_vector_pages(vec);
+        if (IS_ERR(buf->pages))
+                goto userptr_fail_sgtable;
+        buf->num_pages = frame_vector_count(vec);
 
         if (sg_alloc_table_from_pages(buf->dma_sgt, buf->pages,
                         buf->num_pages, buf->offset, size, 0))
-                goto userptr_fail_alloc_table_from_pages;
+                goto userptr_fail_sgtable;
 
         sgt = &buf->sg_table;
         /*
@@ -324,17 +274,9 @@ static void *vb2_dma_sg_get_userptr(void *alloc_ctx, unsigned long vaddr,
 
 userptr_fail_map:
         sg_free_table(&buf->sg_table);
-userptr_fail_alloc_table_from_pages:
-userptr_fail_get_user_pages:
-        dprintk(1, "get_user_pages requested/got: %d/%d]\n",
-                buf->num_pages, num_pages_from_user);
-        if (!vma_is_io(buf->vma))
-                while (--num_pages_from_user >= 0)
-                        put_page(buf->pages[num_pages_from_user]);
-        vb2_put_vma(buf->vma);
-userptr_fail_find_vma:
-        kfree(buf->pages);
-userptr_fail_alloc_pages:
+userptr_fail_sgtable:
+        vb2_destroy_framevec(vec);
+userptr_fail_pfnvec:
         kfree(buf);
         return NULL;
 }
@@ -362,11 +304,8 @@ static void vb2_dma_sg_put_userptr(void *buf_priv)
         while (--i >= 0) {
                 if (buf->dma_dir == DMA_FROM_DEVICE)
                         set_page_dirty_lock(buf->pages[i]);
-                if (!vma_is_io(buf->vma))
-                        put_page(buf->pages[i]);
         }
-        kfree(buf->pages);
-        vb2_put_vma(buf->vma);
+        vb2_destroy_framevec(buf->vec);
         kfree(buf);
 }
 
diff --git a/drivers/media/v4l2-core/videobuf2-memops.c b/drivers/media/v4l2-core/videobuf2-memops.c
index 0d49b7951f84..48c6a49c4928 100644
--- a/drivers/media/v4l2-core/videobuf2-memops.c
+++ b/drivers/media/v4l2-core/videobuf2-memops.c
@@ -23,118 +23,62 @@
 #include <media/videobuf2-memops.h>
 
 /**
- * vb2_get_vma() - acquire and lock the virtual memory area
- * @vma:        given virtual memory area
+ * vb2_create_framevec() - map virtual addresses to pfns
+ * @start:      Virtual user address where we start mapping
+ * @length:     Length of a range to map
+ * @write:      Should we map for writing into the area
  *
- * This function attempts to acquire an area mapped in the userspace for
- * the duration of a hardware operation. The area is "locked" by performing
- * the same set of operation that are done when process calls fork() and
- * memory areas are duplicated.
- *
- * Returns a copy of a virtual memory region on success or NULL.
- */
-struct vm_area_struct *vb2_get_vma(struct vm_area_struct *vma)
-{
-        struct vm_area_struct *vma_copy;
-
-        vma_copy = kmalloc(sizeof(*vma_copy), GFP_KERNEL);
-        if (vma_copy == NULL)
-                return NULL;
-
-        if (vma->vm_ops && vma->vm_ops->open)
-                vma->vm_ops->open(vma);
-
-        if (vma->vm_file)
-                get_file(vma->vm_file);
-
-        memcpy(vma_copy, vma, sizeof(*vma));
-
-        vma_copy->vm_mm = NULL;
-        vma_copy->vm_next = NULL;
-        vma_copy->vm_prev = NULL;
-
-        return vma_copy;
-}
-EXPORT_SYMBOL_GPL(vb2_get_vma);
-
-/**
- * vb2_put_userptr() - release a userspace virtual memory area
- * @vma:        virtual memory region associated with the area to be released
- *
- * This function releases the previously acquired memory area after a hardware
- * operation.
+ * This function allocates and fills in a vector with pfns corresponding to
+ * virtual address range passed in arguments. If pfns have corresponding pages,
+ * page references are also grabbed to pin pages in memory. The function
+ * returns pointer to the vector on success and error pointer in case of
+ * failure. Returned vector needs to be freed via vb2_destroy_pfnvec().
  */
-void vb2_put_vma(struct vm_area_struct *vma)
+struct frame_vector *vb2_create_framevec(unsigned long start,
+                                         unsigned long length,
+                                         bool write)
 {
-        if (!vma)
-                return;
-
-        if (vma->vm_ops && vma->vm_ops->close)
-                vma->vm_ops->close(vma);
-
-        if (vma->vm_file)
-                fput(vma->vm_file);
-
-        kfree(vma);
+        int ret;
+        unsigned long first, last;
+        unsigned long nr;
+        struct frame_vector *vec;
+
+        first = start >> PAGE_SHIFT;
+        last = (start + length - 1) >> PAGE_SHIFT;
+        nr = last - first + 1;
+        vec = frame_vector_create(nr);
+        if (!vec)
+                return ERR_PTR(-ENOMEM);
+        ret = get_vaddr_frames(start, nr, write, 1, vec);
+        if (ret < 0)
+                goto out_destroy;
+        /* We accept only complete set of PFNs */
+        if (ret != nr) {
+                ret = -EFAULT;
+                goto out_release;
+        }
+        return vec;
+out_release:
+        put_vaddr_frames(vec);
+out_destroy:
+        frame_vector_destroy(vec);
+        return ERR_PTR(ret);
 }
-EXPORT_SYMBOL_GPL(vb2_put_vma);
+EXPORT_SYMBOL(vb2_create_framevec);
 
 /**
- * vb2_get_contig_userptr() - lock physically contiguous userspace mapped memory
- * @vaddr:      starting virtual address of the area to be verified
- * @size:       size of the area
- * @res_paddr:  will return physical address for the given vaddr
- * @res_vma:    will return locked copy of struct vm_area for the given area
- *
- * This function will go through memory area of size @size mapped at @vaddr and
- * verify that the underlying physical pages are contiguous. If they are
- * contiguous the virtual memory area is locked and a @res_vma is filled with
- * the copy and @res_pa set to the physical address of the buffer.
+ * vb2_destroy_framevec() - release vector of mapped pfns
+ * @vec:        vector of pfns / pages to release
  *
- * Returns 0 on success.
+ * This releases references to all pages in the vector @vec (if corresponding
+ * pfns are backed by pages) and frees the passed vector.
  */
-int vb2_get_contig_userptr(unsigned long vaddr, unsigned long size,
-                           struct vm_area_struct **res_vma, dma_addr_t *res_pa)
+void vb2_destroy_framevec(struct frame_vector *vec)
 {
-        struct mm_struct *mm = current->mm;
-        struct vm_area_struct *vma;
-        unsigned long offset, start, end;
-        unsigned long this_pfn, prev_pfn;
-        dma_addr_t pa = 0;
-
-        start = vaddr;
-        offset = start & ~PAGE_MASK;
-        end = start + size;
-
-        vma = find_vma(mm, start);
-
-        if (vma == NULL || vma->vm_end < end)
-                return -EFAULT;
-
-        for (prev_pfn = 0; start < end; start += PAGE_SIZE) {
-                int ret = follow_pfn(vma, start, &this_pfn);
-                if (ret)
-                        return ret;
-
-                if (prev_pfn == 0)
-                        pa = this_pfn << PAGE_SHIFT;
-                else if (this_pfn != prev_pfn + 1)
-                        return -EFAULT;
-
-                prev_pfn = this_pfn;
-        }
-
-        /*
-         * Memory is contiguous, lock vma and return to the caller
-         */
-        *res_vma = vb2_get_vma(vma);
-        if (*res_vma == NULL)
-                return -ENOMEM;
-
-        *res_pa = pa + offset;
-        return 0;
+        put_vaddr_frames(vec);
+        frame_vector_destroy(vec);
 }
-EXPORT_SYMBOL_GPL(vb2_get_contig_userptr);
+EXPORT_SYMBOL(vb2_destroy_framevec);
 
 /**
  * vb2_common_vm_open() - increase refcount of the vma
diff --git a/drivers/media/v4l2-core/videobuf2-vmalloc.c b/drivers/media/v4l2-core/videobuf2-vmalloc.c
index 2fe4c27f524a..ecb8f0c7f025 100644
--- a/drivers/media/v4l2-core/videobuf2-vmalloc.c
+++ b/drivers/media/v4l2-core/videobuf2-vmalloc.c
@@ -23,11 +23,9 @@
 
 struct vb2_vmalloc_buf {
         void                            *vaddr;
-        struct page                     **pages;
-        struct vm_area_struct           *vma;
+        struct frame_vector             *vec;
         enum dma_data_direction         dma_dir;
         unsigned long                   size;
-        unsigned int                    n_pages;
         atomic_t                        refcount;
         struct vb2_vmarea_handler       handler;
         struct dma_buf                  *dbuf;
@@ -76,10 +74,8 @@ static void *vb2_vmalloc_get_userptr(void *alloc_ctx, unsigned long vaddr,
                                      enum dma_data_direction dma_dir)
 {
         struct vb2_vmalloc_buf *buf;
-        unsigned long first, last;
-        int n_pages, offset;
-        struct vm_area_struct *vma;
-        dma_addr_t physp;
+        struct frame_vector *vec;
+        int n_pages, offset, i;
 
         buf = kzalloc(sizeof(*buf), GFP_KERNEL);
         if (!buf)
@@ -88,51 +84,36 @@ static void *vb2_vmalloc_get_userptr(void *alloc_ctx, unsigned long vaddr,
         buf->dma_dir = dma_dir;
         offset = vaddr & ~PAGE_MASK;
         buf->size = size;
-
-
-        vma = find_vma(current->mm, vaddr);
-        if (vma && (vma->vm_flags & VM_PFNMAP) && (vma->vm_pgoff)) {
-                if (vb2_get_contig_userptr(vaddr, size, &vma, &physp))
-                        goto fail_pages_array_alloc;
-                buf->vma = vma;
-                buf->vaddr = (__force void *)ioremap_nocache(physp, size);
-                if (!buf->vaddr)
-                        goto fail_pages_array_alloc;
+        vec = vb2_create_framevec(vaddr, size, dma_dir == DMA_FROM_DEVICE);
+        if (IS_ERR(vec))
+                goto fail_pfnvec_create;
+        buf->vec = vec;
+        n_pages = frame_vector_count(vec);
+        if (frame_vector_to_pages(vec) < 0) {
+                unsigned long *nums = frame_vector_pfns(vec);
+
+                /*
+                 * We cannot get page pointers for these pfns. Check memory is
+                 * physically contiguous and use direct mapping.
+                 */
+                for (i = 1; i < n_pages; i++)
+                        if (nums[i-1] + 1 != nums[i])
+                                goto fail_map;
+                buf->vaddr = (__force void *)
+                                ioremap_nocache(nums[0] << PAGE_SHIFT, size);
         } else {
-                first = vaddr >> PAGE_SHIFT;
-                last  = (vaddr + size - 1) >> PAGE_SHIFT;
-                buf->n_pages = last - first + 1;
-                buf->pages = kzalloc(buf->n_pages * sizeof(struct page *),
-                                     GFP_KERNEL);
-                if (!buf->pages)
-                        goto fail_pages_array_alloc;
-
-                /* current->mm->mmap_sem is taken by videobuf2 core */
-                n_pages = get_user_pages(current, current->mm,
-                                         vaddr & PAGE_MASK, buf->n_pages,
-                                         dma_dir == DMA_FROM_DEVICE,
-                                         1, /* force */
-                                         buf->pages, NULL);
-                if (n_pages != buf->n_pages)
-                        goto fail_get_user_pages;
-
-                buf->vaddr = vm_map_ram(buf->pages, buf->n_pages, -1,
+                buf->vaddr = vm_map_ram(frame_vector_pages(vec), n_pages, -1,
                                         PAGE_KERNEL);
-                if (!buf->vaddr)
-                        goto fail_get_user_pages;
         }
 
+        if (!buf->vaddr)
+                goto fail_map;
         buf->vaddr += offset;
         return buf;
 
-fail_get_user_pages:
-        pr_debug("get_user_pages requested/got: %d/%d]\n", n_pages,
-                 buf->n_pages);
-        while (--n_pages >= 0)
-                put_page(buf->pages[n_pages]);
-        kfree(buf->pages);
-
-fail_pages_array_alloc:
+fail_map:
+        vb2_destroy_framevec(vec);
+fail_pfnvec_create:
         kfree(buf);
 
         return NULL;
@@ -143,20 +124,21 @@ static void vb2_vmalloc_put_userptr(void *buf_priv)
         struct vb2_vmalloc_buf *buf = buf_priv;
         unsigned long vaddr = (unsigned long)buf->vaddr & PAGE_MASK;
         unsigned int i;
+        struct page **pages;
+        unsigned int n_pages;
 
-        if (buf->pages) {
+        if (!buf->vec->is_pfns) {
+                n_pages = frame_vector_count(buf->vec);
+                pages = frame_vector_pages(buf->vec);
                 if (vaddr)
-                        vm_unmap_ram((void *)vaddr, buf->n_pages);
-                for (i = 0; i < buf->n_pages; ++i) {
-                        if (buf->dma_dir == DMA_FROM_DEVICE)
-                                set_page_dirty_lock(buf->pages[i]);
-                        put_page(buf->pages[i]);
-                }
-                kfree(buf->pages);
+                        vm_unmap_ram((void *)vaddr, n_pages);
+                if (buf->dma_dir == DMA_FROM_DEVICE)
+                        for (i = 0; i < n_pages; i++)
+                                set_page_dirty_lock(pages[i]);
         } else {
-                vb2_put_vma(buf->vma);
                 iounmap((__force void __iomem *)buf->vaddr);
         }
+        vb2_destroy_framevec(buf->vec);
         kfree(buf);
 }
 
diff --git a/drivers/mfd/asic3.c b/drivers/mfd/asic3.c
index 4b54128bc78e..a726f01e3b02 100644
--- a/drivers/mfd/asic3.c
+++ b/drivers/mfd/asic3.c
@@ -138,7 +138,7 @@ static void asic3_irq_flip_edge(struct asic3 *asic,
         spin_unlock_irqrestore(&asic->lock, flags);
 }
 
-static void asic3_irq_demux(unsigned int irq, struct irq_desc *desc)
+static void asic3_irq_demux(struct irq_desc *desc)
 {
         struct asic3 *asic = irq_desc_get_handler_data(desc);
         struct irq_data *data = irq_desc_get_irq_data(desc);
diff --git a/drivers/mfd/ezx-pcap.c b/drivers/mfd/ezx-pcap.c
index a76eb6ef47a0..b279205659a4 100644
--- a/drivers/mfd/ezx-pcap.c
+++ b/drivers/mfd/ezx-pcap.c
@@ -205,7 +205,7 @@ static void pcap_isr_work(struct work_struct *work)
         } while (gpio_get_value(pdata->gpio));
 }
 
-static void pcap_irq_handler(unsigned int irq, struct irq_desc *desc)
+static void pcap_irq_handler(struct irq_desc *desc)
 {
         struct pcap_chip *pcap = irq_desc_get_handler_data(desc);
 
diff --git a/drivers/mfd/htc-egpio.c b/drivers/mfd/htc-egpio.c
index 9131cdcdc64a..6ccaf90d98fd 100644
--- a/drivers/mfd/htc-egpio.c
+++ b/drivers/mfd/htc-egpio.c
@@ -98,7 +98,7 @@ static struct irq_chip egpio_muxed_chip = {
         .irq_unmask     = egpio_unmask,
 };
 
-static void egpio_handler(unsigned int irq, struct irq_desc *desc)
+static void egpio_handler(struct irq_desc *desc)
 {
         struct egpio_info *ei = irq_desc_get_handler_data(desc);
         int irqpin;
diff --git a/drivers/mfd/jz4740-adc.c b/drivers/mfd/jz4740-adc.c
index 5bb49f08955d..798e44306382 100644
--- a/drivers/mfd/jz4740-adc.c
+++ b/drivers/mfd/jz4740-adc.c
@@ -65,7 +65,7 @@ struct jz4740_adc {
         spinlock_t lock;
 };
 
-static void jz4740_adc_irq_demux(unsigned int irq, struct irq_desc *desc)
+static void jz4740_adc_irq_demux(struct irq_desc *desc)
 {
         struct irq_chip_generic *gc = irq_desc_get_handler_data(desc);
         uint8_t status;
diff --git a/drivers/mfd/pm8921-core.c b/drivers/mfd/pm8921-core.c
index 59502d02cd15..1b7ec0870c2a 100644
--- a/drivers/mfd/pm8921-core.c
+++ b/drivers/mfd/pm8921-core.c
@@ -156,7 +156,7 @@ static int pm8xxx_irq_master_handler(struct pm_irq_chip *chip, int master)
         return ret;
 }
 
-static void pm8xxx_irq_handler(unsigned int irq, struct irq_desc *desc)
+static void pm8xxx_irq_handler(struct irq_desc *desc)
 {
         struct pm_irq_chip *chip = irq_desc_get_handler_data(desc);
         struct irq_chip *irq_chip = irq_desc_get_chip(desc);
diff --git a/drivers/mfd/t7l66xb.c b/drivers/mfd/t7l66xb.c
index 16fc1adc4fa3..94bd89cb1f06 100644
--- a/drivers/mfd/t7l66xb.c
+++ b/drivers/mfd/t7l66xb.c
@@ -185,7 +185,7 @@ static struct mfd_cell t7l66xb_cells[] = {
 /*--------------------------------------------------------------------------*/
 
 /* Handle the T7L66XB interrupt mux */
-static void t7l66xb_irq(unsigned int irq, struct irq_desc *desc)
+static void t7l66xb_irq(struct irq_desc *desc)
 {
         struct t7l66xb *t7l66xb = irq_desc_get_handler_data(desc);
         unsigned int isr;
diff --git a/drivers/mfd/tc6393xb.c b/drivers/mfd/tc6393xb.c
index 775b9aca871a..8c84a513016b 100644
--- a/drivers/mfd/tc6393xb.c
+++ b/drivers/mfd/tc6393xb.c
@@ -522,8 +522,7 @@ static int tc6393xb_register_gpio(struct tc6393xb *tc6393xb, int gpio_base)
 
 /*--------------------------------------------------------------------------*/
 
-static void
-tc6393xb_irq(unsigned int irq, struct irq_desc *desc)
+static void tc6393xb_irq(struct irq_desc *desc)
 {
         struct tc6393xb *tc6393xb = irq_desc_get_handler_data(desc);
         unsigned int isr;
diff --git a/drivers/mfd/ucb1x00-core.c b/drivers/mfd/ucb1x00-core.c
index 9a2302129711..f691d7ecad52 100644
--- a/drivers/mfd/ucb1x00-core.c
+++ b/drivers/mfd/ucb1x00-core.c
@@ -282,7 +282,7 @@ void ucb1x00_adc_disable(struct ucb1x00 *ucb)
  * SIBCLK to talk to the chip.  We leave the clock running until
  * we have finished processing all interrupts from the chip.
  */
-static void ucb1x00_irq(unsigned int __irq, struct irq_desc *desc)
+static void ucb1x00_irq(struct irq_desc *desc)
 {
         struct ucb1x00 *ucb = irq_desc_get_handler_data(desc);
         unsigned int isr, i;
diff --git a/drivers/misc/cxl/Makefile b/drivers/misc/cxl/Makefile
index 6f484dfe78f9..6982f603fadc 100644
--- a/drivers/misc/cxl/Makefile
+++ b/drivers/misc/cxl/Makefile
@@ -1,4 +1,4 @@
-ccflags-y := -Werror
+ccflags-y := -Werror -Wno-unused-const-variable
 
 cxl-y                           += main.o file.o irq.o fault.o native.o
 cxl-y                           += context.o sysfs.o debugfs.o pci.o trace.o
diff --git a/drivers/misc/cxl/pci.c b/drivers/misc/cxl/pci.c
index 02c85160bfe9..a5e977192b61 100644
--- a/drivers/misc/cxl/pci.c
+++ b/drivers/misc/cxl/pci.c
@@ -1249,8 +1249,6 @@ static int cxl_probe(struct pci_dev *dev, const struct pci_device_id *id)
         int slice;
         int rc;
 
-        pci_dev_get(dev);
-
         if (cxl_verbose)
                 dump_cxl_config_space(dev);
 
diff --git a/drivers/misc/cxl/sysfs.c b/drivers/misc/cxl/sysfs.c
index 25868c2ec03e..02006f7109a8 100644
--- a/drivers/misc/cxl/sysfs.c
+++ b/drivers/misc/cxl/sysfs.c
@@ -592,6 +592,8 @@ int cxl_sysfs_afu_add(struct cxl_afu *afu)
 
         /* conditionally create the add the binary file for error info buffer */
         if (afu->eb_len) {
+                sysfs_attr_init(&afu->attr_eb.attr);
+
                 afu->attr_eb.attr.name = "afu_err_buff";
                 afu->attr_eb.attr.mode = S_IRUGO;
                 afu->attr_eb.size = afu->eb_len;
diff --git a/drivers/misc/cxl/vphb.c b/drivers/misc/cxl/vphb.c
index 6dd16a6d153f..94b520896b18 100644
--- a/drivers/misc/cxl/vphb.c
+++ b/drivers/misc/cxl/vphb.c
@@ -48,6 +48,12 @@ static bool cxl_pci_enable_device_hook(struct pci_dev *dev)
 
         phb = pci_bus_to_host(dev->bus);
         afu = (struct cxl_afu *)phb->private_data;
+
+        if (!cxl_adapter_link_ok(afu->adapter)) {
+                dev_warn(&dev->dev, "%s: Device link is down, refusing to enable AFU\n", __func__);
+                return false;
+        }
+
         set_dma_ops(&dev->dev, &dma_direct_ops);
         set_dma_offset(&dev->dev, PAGE_OFFSET);
 
diff --git a/drivers/misc/mei/wd.c b/drivers/misc/mei/wd.c
index 2bc0f5089f82..b346638833b0 100644
--- a/drivers/misc/mei/wd.c
+++ b/drivers/misc/mei/wd.c
@@ -364,6 +364,7 @@ int mei_watchdog_register(struct mei_device *dev)
 
         int ret;
 
+        amt_wd_dev.parent = dev->dev;
         /* unlock to perserve correct locking order */
         mutex_unlock(&dev->device_lock);
         ret = watchdog_register_device(&amt_wd_dev);
diff --git a/drivers/net/arcnet/arcnet.c b/drivers/net/arcnet/arcnet.c
index 2158e985a0e7..e41dd36fe832 100644
--- a/drivers/net/arcnet/arcnet.c
+++ b/drivers/net/arcnet/arcnet.c
@@ -302,7 +302,7 @@ static void arcdev_setup(struct net_device *dev)
         dev->type = ARPHRD_ARCNET;
         dev->netdev_ops = &arcnet_netdev_ops;
         dev->header_ops = &arcnet_header_ops;
-        dev->hard_header_len = sizeof(struct archdr);
+        dev->hard_header_len = sizeof(struct arc_hardware);
         dev->mtu = choose_mtu();
 
         dev->addr_len = ARCNET_ALEN;
diff --git a/drivers/net/dsa/mv88e6xxx.c b/drivers/net/dsa/mv88e6xxx.c
index 30227ca2d5db..8e9d172543a0 100644
--- a/drivers/net/dsa/mv88e6xxx.c
+++ b/drivers/net/dsa/mv88e6xxx.c
@@ -2074,6 +2074,7 @@ static int mv88e6xxx_setup_port(struct dsa_switch *ds, int port)
                  */
                 reg = _mv88e6xxx_reg_read(ds, REG_PORT(port), PORT_PCS_CTRL);
                 if (dsa_is_cpu_port(ds, port) || dsa_is_dsa_port(ds, port)) {
+                        reg &= ~PORT_PCS_CTRL_UNFORCED;
                         reg |= PORT_PCS_CTRL_FORCE_LINK |
                                 PORT_PCS_CTRL_LINK_UP |
                                 PORT_PCS_CTRL_DUPLEX_FULL |
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c
index 21749f01827d..652f21889a48 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c
@@ -690,16 +690,24 @@ static int xgene_enet_phy_connect(struct net_device *ndev)
                         netdev_dbg(ndev, "No phy-handle found in DT\n");
                         return -ENODEV;
                 }
-                pdata->phy_dev = of_phy_find_device(phy_np);
-        }
 
-        phy_dev = pdata->phy_dev;
+                phy_dev = of_phy_connect(ndev, phy_np, &xgene_enet_adjust_link,
+                                         0, pdata->phy_mode);
+                if (!phy_dev) {
+                        netdev_err(ndev, "Could not connect to PHY\n");
+                        return -ENODEV;
+                }
+
+                pdata->phy_dev = phy_dev;
+        } else {
+                phy_dev = pdata->phy_dev;
 
-        if (!phy_dev ||
-            phy_connect_direct(ndev, phy_dev, &xgene_enet_adjust_link,
-                               pdata->phy_mode)) {
-                netdev_err(ndev, "Could not connect to PHY\n");
-                return  -ENODEV;
+                if (!phy_dev ||
+                    phy_connect_direct(ndev, phy_dev, &xgene_enet_adjust_link,
+                                       pdata->phy_mode)) {
+                        netdev_err(ndev, "Could not connect to PHY\n");
+                        return  -ENODEV;
+                }
         }
 
         pdata->phy_speed = SPEED_UNKNOWN;
diff --git a/drivers/net/ethernet/arc/emac_arc.c b/drivers/net/ethernet/arc/emac_arc.c
index f9cb99bfb511..ffd180570920 100644
--- a/drivers/net/ethernet/arc/emac_arc.c
+++ b/drivers/net/ethernet/arc/emac_arc.c
@@ -78,6 +78,7 @@ static const struct of_device_id emac_arc_dt_ids[] = {
         { .compatible = "snps,arc-emac" },
         { /* Sentinel */ }
 };
+MODULE_DEVICE_TABLE(of, emac_arc_dt_ids);
 
 static struct platform_driver emac_arc_driver = {
         .probe = emac_arc_probe,
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index b9a5a97ed4dd..f1b5364f3521 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -2079,6 +2079,7 @@ static const struct of_device_id bcm_sysport_of_match[] = {
         { .compatible = "brcm,systemport" },
         { /* sentinel */ }
 };
+MODULE_DEVICE_TABLE(of, bcm_sysport_of_match);
 
 static struct platform_driver bcm_sysport_driver = {
         .probe  = bcm_sysport_probe,
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
index ba936635322a..b5e64b02200c 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
@@ -1946,6 +1946,7 @@ struct bnx2x {
         u16 vlan_cnt;
         u16 vlan_credit;
         u16 vxlan_dst_port;
+        u8 vxlan_dst_port_count;
         bool accept_any_vlan;
 };
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index e3da2bddf143..f1d62d5dbaff 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -3705,16 +3705,14 @@ out:
 
 void bnx2x_update_mfw_dump(struct bnx2x *bp)
 {
-        struct timeval epoc;
         u32 drv_ver;
         u32 valid_dump;
 
         if (!SHMEM2_HAS(bp, drv_info))
                 return;
 
-        /* Update Driver load time */
-        do_gettimeofday(&epoc);
-        SHMEM2_WR(bp, drv_info.epoc, epoc.tv_sec);
+        /* Update Driver load time, possibly broken in y2038 */
+        SHMEM2_WR(bp, drv_info.epoc, (u32)ktime_get_real_seconds());
 
         drv_ver = bnx2x_update_mng_version_utility(DRV_MODULE_VERSION, true);
         SHMEM2_WR(bp, drv_info.drv_ver, drv_ver);
@@ -10110,12 +10108,18 @@ static void __bnx2x_add_vxlan_port(struct bnx2x *bp, u16 port)
         if (!netif_running(bp->dev))
                 return;
 
-        if (bp->vxlan_dst_port || !IS_PF(bp)) {
+        if (bp->vxlan_dst_port_count && bp->vxlan_dst_port == port) {
+                bp->vxlan_dst_port_count++;
+                return;
+        }
+
+        if (bp->vxlan_dst_port_count || !IS_PF(bp)) {
                 DP(BNX2X_MSG_SP, "Vxlan destination port limit reached\n");
                 return;
         }
 
         bp->vxlan_dst_port = port;
+        bp->vxlan_dst_port_count = 1;
         bnx2x_schedule_sp_rtnl(bp, BNX2X_SP_RTNL_ADD_VXLAN_PORT, 0);
 }
 
@@ -10130,10 +10134,14 @@ static void bnx2x_add_vxlan_port(struct net_device *netdev,
 
 static void __bnx2x_del_vxlan_port(struct bnx2x *bp, u16 port)
 {
-        if (!bp->vxlan_dst_port || bp->vxlan_dst_port != port || !IS_PF(bp)) {
+        if (!bp->vxlan_dst_port_count || bp->vxlan_dst_port != port ||
+            !IS_PF(bp)) {
                 DP(BNX2X_MSG_SP, "Invalid vxlan port\n");
                 return;
         }
+        bp->vxlan_dst_port--;
+        if (bp->vxlan_dst_port)
+                return;
 
         if (netif_running(bp->dev)) {
                 bnx2x_schedule_sp_rtnl(bp, BNX2X_SP_RTNL_DEL_VXLAN_PORT, 0);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
index c9bd7f16018e..ff702a707a91 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
@@ -4319,8 +4319,16 @@ static int bnx2x_setup_rss(struct bnx2x *bp,
 
         /* RSS keys */
         if (test_bit(BNX2X_RSS_SET_SRCH, &p->rss_flags)) {
-                memcpy(&data->rss_key[0], &p->rss_key[0],
-                       sizeof(data->rss_key));
+                u8 *dst = (u8 *)(data->rss_key) + sizeof(data->rss_key);
+                const u8 *src = (const u8 *)p->rss_key;
+                int i;
+
+                /* Apparently, bnx2x reads this array in reverse order
+                 * We need to byte swap rss_key to comply with Toeplitz specs.
+                 */
+                for (i = 0; i < sizeof(data->rss_key); i++)
+                        *--dst = *src++;
+
                 caps |= ETH_RSS_UPDATE_RAMROD_DATA_UPDATE_RSS_KEY;
         }
 
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
index efcb1119076f..1a3988f51305 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -3304,6 +3304,7 @@ static const struct of_device_id bcmgenet_match[] = {
         { .compatible = "brcm,genet-v4", .data = (void *)GENET_V4 },
         { },
 };
+MODULE_DEVICE_TABLE(of, bcmgenet_match);
 
 static int bcmgenet_probe(struct platform_device *pdev)
 {
diff --git a/drivers/net/ethernet/brocade/bna/bna_tx_rx.c b/drivers/net/ethernet/brocade/bna/bna_tx_rx.c
index 5d0753cc7e73..04b0d16b210e 100644
--- a/drivers/net/ethernet/brocade/bna/bna_tx_rx.c
+++ b/drivers/net/ethernet/brocade/bna/bna_tx_rx.c
@@ -2400,6 +2400,7 @@ bna_rx_create(struct bna *bna, struct bnad *bnad,
                 q0->rcb->id = 0;
                 q0->rx_packets = q0->rx_bytes = 0;
                 q0->rx_packets_with_error = q0->rxbuf_alloc_failed = 0;
+                q0->rxbuf_map_failed = 0;
 
                 bna_rxq_qpt_setup(q0, rxp, dpage_count, PAGE_SIZE,
                         &dqpt_mem[i], &dsqpt_mem[i], &dpage_mem[i]);
@@ -2428,6 +2429,7 @@ bna_rx_create(struct bna *bna, struct bnad *bnad,
                                         : rx_cfg->q1_buf_size;
                         q1->rx_packets = q1->rx_bytes = 0;
                         q1->rx_packets_with_error = q1->rxbuf_alloc_failed = 0;
+                        q1->rxbuf_map_failed = 0;
 
                         bna_rxq_qpt_setup(q1, rxp, hpage_count, PAGE_SIZE,
                                 &hqpt_mem[i], &hsqpt_mem[i],
diff --git a/drivers/net/ethernet/brocade/bna/bna_types.h b/drivers/net/ethernet/brocade/bna/bna_types.h
index e0e797f2ea14..c438d032e8bf 100644
--- a/drivers/net/ethernet/brocade/bna/bna_types.h
+++ b/drivers/net/ethernet/brocade/bna/bna_types.h
@@ -587,6 +587,7 @@ struct bna_rxq {
         u64             rx_bytes;
         u64             rx_packets_with_error;
         u64             rxbuf_alloc_failed;
+        u64             rxbuf_map_failed;
 };
 
 /* RxQ pair */
diff --git a/drivers/net/ethernet/brocade/bna/bnad.c b/drivers/net/ethernet/brocade/bna/bnad.c
index 506047c38607..21a0cfc3e7ec 100644
--- a/drivers/net/ethernet/brocade/bna/bnad.c
+++ b/drivers/net/ethernet/brocade/bna/bnad.c
@@ -399,7 +399,13 @@ bnad_rxq_refill_page(struct bnad *bnad, struct bna_rcb *rcb, u32 nalloc)
                 }
 
                 dma_addr = dma_map_page(&bnad->pcidev->dev, page, page_offset,
-                                unmap_q->map_size, DMA_FROM_DEVICE);
+                                        unmap_q->map_size, DMA_FROM_DEVICE);
+                if (dma_mapping_error(&bnad->pcidev->dev, dma_addr)) {
+                        put_page(page);
+                        BNAD_UPDATE_CTR(bnad, rxbuf_map_failed);
+                        rcb->rxq->rxbuf_map_failed++;
+                        goto finishing;
+                }
 
                 unmap->page = page;
                 unmap->page_offset = page_offset;
@@ -454,8 +460,15 @@ bnad_rxq_refill_skb(struct bnad *bnad, struct bna_rcb *rcb, u32 nalloc)
                         rcb->rxq->rxbuf_alloc_failed++;
                         goto finishing;
                 }
+
                 dma_addr = dma_map_single(&bnad->pcidev->dev, skb->data,
                                           buff_sz, DMA_FROM_DEVICE);
+                if (dma_mapping_error(&bnad->pcidev->dev, dma_addr)) {
+                        dev_kfree_skb_any(skb);
+                        BNAD_UPDATE_CTR(bnad, rxbuf_map_failed);
+                        rcb->rxq->rxbuf_map_failed++;
+                        goto finishing;
+                }
 
                 unmap->skb = skb;
                 dma_unmap_addr_set(&unmap->vector, dma_addr, dma_addr);
@@ -3025,6 +3038,11 @@ bnad_start_xmit(struct sk_buff *skb, struct net_device *netdev)
         unmap = head_unmap;
         dma_addr = dma_map_single(&bnad->pcidev->dev, skb->data,
                                   len, DMA_TO_DEVICE);
+        if (dma_mapping_error(&bnad->pcidev->dev, dma_addr)) {
+                dev_kfree_skb_any(skb);
+                BNAD_UPDATE_CTR(bnad, tx_skb_map_failed);
+                return NETDEV_TX_OK;
+        }
         BNA_SET_DMA_ADDR(dma_addr, &txqent->vector[0].host_addr);
         txqent->vector[0].length = htons(len);
         dma_unmap_addr_set(&unmap->vectors[0], dma_addr, dma_addr);
@@ -3056,6 +3074,15 @@ bnad_start_xmit(struct sk_buff *skb, struct net_device *netdev)
 
                 dma_addr = skb_frag_dma_map(&bnad->pcidev->dev, frag,
                                             0, size, DMA_TO_DEVICE);
+                if (dma_mapping_error(&bnad->pcidev->dev, dma_addr)) {
+                        /* Undo the changes starting at tcb->producer_index */
+                        bnad_tx_buff_unmap(bnad, unmap_q, q_depth,
+                                           tcb->producer_index);
+                        dev_kfree_skb_any(skb);
+                        BNAD_UPDATE_CTR(bnad, tx_skb_map_failed);
+                        return NETDEV_TX_OK;
+                }
+
                 dma_unmap_len_set(&unmap->vectors[vect_id], dma_len, size);
                 BNA_SET_DMA_ADDR(dma_addr, &txqent->vector[vect_id].host_addr);
                 txqent->vector[vect_id].length = htons(size);
diff --git a/drivers/net/ethernet/brocade/bna/bnad.h b/drivers/net/ethernet/brocade/bna/bnad.h
index faedbf24777e..f4ed816b93ee 100644
--- a/drivers/net/ethernet/brocade/bna/bnad.h
+++ b/drivers/net/ethernet/brocade/bna/bnad.h
@@ -175,6 +175,7 @@ struct bnad_drv_stats {
         u64             tx_skb_headlen_zero;
         u64             tx_skb_frag_zero;
         u64             tx_skb_len_mismatch;
+        u64             tx_skb_map_failed;
 
         u64             hw_stats_updates;
         u64             netif_rx_dropped;
@@ -189,6 +190,7 @@ struct bnad_drv_stats {
         u64             rx_unmap_q_alloc_failed;
 
         u64             rxbuf_alloc_failed;
+        u64             rxbuf_map_failed;
 };
 
 /* Complete driver stats */
diff --git a/drivers/net/ethernet/brocade/bna/bnad_ethtool.c b/drivers/net/ethernet/brocade/bna/bnad_ethtool.c
index 2bdfc5dff4b1..0e4fdc3dd729 100644
--- a/drivers/net/ethernet/brocade/bna/bnad_ethtool.c
+++ b/drivers/net/ethernet/brocade/bna/bnad_ethtool.c
@@ -90,6 +90,7 @@ static const char *bnad_net_stats_strings[BNAD_ETHTOOL_STATS_NUM] = {
         "tx_skb_headlen_zero",
         "tx_skb_frag_zero",
         "tx_skb_len_mismatch",
+        "tx_skb_map_failed",
         "hw_stats_updates",
         "netif_rx_dropped",
 
@@ -102,6 +103,7 @@ static const char *bnad_net_stats_strings[BNAD_ETHTOOL_STATS_NUM] = {
         "tx_unmap_q_alloc_failed",
         "rx_unmap_q_alloc_failed",
         "rxbuf_alloc_failed",
+        "rxbuf_map_failed",
 
         "mac_stats_clr_cnt",
         "mac_frame_64",
@@ -807,6 +809,7 @@ bnad_per_q_stats_fill(struct bnad *bnad, u64 *buf, int bi)
                                                         rx_packets_with_error;
                                         buf[bi++] = rcb->rxq->
                                                         rxbuf_alloc_failed;
+                                        buf[bi++] = rcb->rxq->rxbuf_map_failed;
                                         buf[bi++] = rcb->producer_index;
                                         buf[bi++] = rcb->consumer_index;
                                 }
@@ -821,6 +824,7 @@ bnad_per_q_stats_fill(struct bnad *bnad, u64 *buf, int bi)
                                                         rx_packets_with_error;
                                         buf[bi++] = rcb->rxq->
                                                         rxbuf_alloc_failed;
+                                        buf[bi++] = rcb->rxq->rxbuf_map_failed;
                                         buf[bi++] = rcb->producer_index;
                                         buf[bi++] = rcb->consumer_index;
                                 }
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_pci_id_tbl.h b/drivers/net/ethernet/chelsio/cxgb4/t4_pci_id_tbl.h
index 8353a6cbfcc2..03ed00c49823 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_pci_id_tbl.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_pci_id_tbl.h
@@ -157,6 +157,11 @@ CH_PCI_DEVICE_ID_TABLE_DEFINE_BEGIN
         CH_PCI_ID_TABLE_FENTRY(0x5090), /* Custom T540-CR */
         CH_PCI_ID_TABLE_FENTRY(0x5091), /* Custom T522-CR */
         CH_PCI_ID_TABLE_FENTRY(0x5092), /* Custom T520-CR */
+        CH_PCI_ID_TABLE_FENTRY(0x5093), /* Custom T580-LP-CR */
+        CH_PCI_ID_TABLE_FENTRY(0x5094), /* Custom T540-CR */
+        CH_PCI_ID_TABLE_FENTRY(0x5095), /* Custom T540-CR-SO */
+        CH_PCI_ID_TABLE_FENTRY(0x5096), /* Custom T580-CR */
+        CH_PCI_ID_TABLE_FENTRY(0x5097), /* Custom T520-KR */
 
         /* T6 adapters:
          */
diff --git a/drivers/net/ethernet/emulex/benet/be.h b/drivers/net/ethernet/emulex/benet/be.h
index 0a27805cbbbd..821540913343 100644
--- a/drivers/net/ethernet/emulex/benet/be.h
+++ b/drivers/net/ethernet/emulex/benet/be.h
@@ -582,6 +582,7 @@ struct be_adapter {
         u16 pvid;
         __be16 vxlan_port;
         int vxlan_port_count;
+        int vxlan_port_aliases;
         struct phy_info phy;
         u8 wol_cap;
         bool wol_en;
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 12687bf52b95..7bf51a1a0a77 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -5176,6 +5176,11 @@ static void be_add_vxlan_port(struct net_device *netdev, sa_family_t sa_family,
         if (lancer_chip(adapter) || BEx_chip(adapter) || be_is_mc(adapter))
                 return;
 
+        if (adapter->vxlan_port == port && adapter->vxlan_port_count) {
+                adapter->vxlan_port_aliases++;
+                return;
+        }
+
         if (adapter->flags & BE_FLAGS_VXLAN_OFFLOADS) {
                 dev_info(dev,
                          "Only one UDP port supported for VxLAN offloads\n");
@@ -5226,6 +5231,11 @@ static void be_del_vxlan_port(struct net_device *netdev, sa_family_t sa_family,
         if (adapter->vxlan_port != port)
                 goto done;
 
+        if (adapter->vxlan_port_aliases) {
+                adapter->vxlan_port_aliases--;
+                return;
+        }
+
         be_disable_vxlan_offloads(adapter);
 
         dev_info(&adapter->pdev->dev,
diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index 4b69d061d90f..710715fcb23d 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -1710,8 +1710,10 @@ static void gfar_configure_serdes(struct net_device *dev)
          * everything for us?  Resetting it takes the link down and requires
          * several seconds for it to come back.
          */
-        if (phy_read(tbiphy, MII_BMSR) & BMSR_LSTATUS)
+        if (phy_read(tbiphy, MII_BMSR) & BMSR_LSTATUS) {
+                put_device(&tbiphy->dev);
                 return;
+        }
 
         /* Single clk mode, mii mode off(for serdes communication) */
         phy_write(tbiphy, MII_TBICON, TBICON_CLK_SELECT);
@@ -1723,6 +1725,8 @@ static void gfar_configure_serdes(struct net_device *dev)
         phy_write(tbiphy, MII_BMCR,
                   BMCR_ANENABLE | BMCR_ANRESTART | BMCR_FULLDPLX |
                   BMCR_SPEED1000);
+
+        put_device(&tbiphy->dev);
 }
 
 static int __gfar_is_rx_idle(struct gfar_private *priv)
@@ -1970,8 +1974,7 @@ static int register_grp_irqs(struct gfar_priv_grp *grp)
                 /* Install our interrupt handlers for Error,
                  * Transmit, and Receive
                  */
-                err = request_irq(gfar_irq(grp, ER)->irq, gfar_error,
-                                  IRQF_NO_SUSPEND,
+                err = request_irq(gfar_irq(grp, ER)->irq, gfar_error, 0,
                                   gfar_irq(grp, ER)->name, grp);
                 if (err < 0) {
                         netif_err(priv, intr, dev, "Can't get IRQ %d\n",
@@ -1979,6 +1982,8 @@ static int register_grp_irqs(struct gfar_priv_grp *grp)
 
                         goto err_irq_fail;
                 }
+                enable_irq_wake(gfar_irq(grp, ER)->irq);
+
                 err = request_irq(gfar_irq(grp, TX)->irq, gfar_transmit, 0,
                                   gfar_irq(grp, TX)->name, grp);
                 if (err < 0) {
@@ -1994,14 +1999,14 @@ static int register_grp_irqs(struct gfar_priv_grp *grp)
                         goto rx_irq_fail;
                 }
         } else {
-                err = request_irq(gfar_irq(grp, TX)->irq, gfar_interrupt,
-                                  IRQF_NO_SUSPEND,
+                err = request_irq(gfar_irq(grp, TX)->irq, gfar_interrupt, 0,
                                   gfar_irq(grp, TX)->name, grp);
                 if (err < 0) {
                         netif_err(priv, intr, dev, "Can't get IRQ %d\n",
                                   gfar_irq(grp, TX)->irq);
                         goto err_irq_fail;
                 }
+                enable_irq_wake(gfar_irq(grp, TX)->irq);
         }
 
         return 0;
diff --git a/drivers/net/ethernet/freescale/gianfar_ptp.c b/drivers/net/ethernet/freescale/gianfar_ptp.c
index 8e3cd77aa347..664d0c261269 100644
--- a/drivers/net/ethernet/freescale/gianfar_ptp.c
+++ b/drivers/net/ethernet/freescale/gianfar_ptp.c
@@ -557,6 +557,7 @@ static const struct of_device_id match_table[] = {
         { .compatible = "fsl,etsec-ptp" },
         {},
 };
+MODULE_DEVICE_TABLE(of, match_table);
 
 static struct platform_driver gianfar_ptp_driver = {
         .driver = {
diff --git a/drivers/net/ethernet/freescale/ucc_geth.c b/drivers/net/ethernet/freescale/ucc_geth.c
index 4dd40e057f40..650f7888e32b 100644
--- a/drivers/net/ethernet/freescale/ucc_geth.c
+++ b/drivers/net/ethernet/freescale/ucc_geth.c
@@ -1384,6 +1384,8 @@ static int adjust_enet_interface(struct ucc_geth_private *ugeth)
                 value = phy_read(tbiphy, ENET_TBI_MII_CR);
                 value &= ~0x1000;       /* Turn off autonegotiation */
                 phy_write(tbiphy, ENET_TBI_MII_CR, value);
+
+                put_device(&tbiphy->dev);
         }
 
         init_check_frame_length_mode(ug_info->lengthCheckRx, &ug_regs->maccfg2);
@@ -1702,8 +1704,10 @@ static void uec_configure_serdes(struct net_device *dev)
          * everything for us?  Resetting it takes the link down and requires
          * several seconds for it to come back.
          */
-        if (phy_read(tbiphy, ENET_TBI_MII_SR) & TBISR_LSTATUS)
+        if (phy_read(tbiphy, ENET_TBI_MII_SR) & TBISR_LSTATUS) {
+                put_device(&tbiphy->dev);
                 return;
+        }
 
         /* Single clk mode, mii mode off(for serdes communication) */
         phy_write(tbiphy, ENET_TBI_MII_ANA, TBIANA_SETTINGS);
@@ -1711,6 +1715,8 @@ static void uec_configure_serdes(struct net_device *dev)
         phy_write(tbiphy, ENET_TBI_MII_TBICON, TBICON_CLK_SELECT);
 
         phy_write(tbiphy, ENET_TBI_MII_CR, TBICR_SETTINGS);
+
+        put_device(&tbiphy->dev);
 }
 
 /* Configure the PHY for dev.
diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
index fe2299ac4f5c..514df76fc70f 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -1479,6 +1479,7 @@ static int mvneta_rx(struct mvneta_port *pp, int rx_todo,
                 struct mvneta_rx_desc *rx_desc = mvneta_rxq_next_desc_get(rxq);
                 struct sk_buff *skb;
                 unsigned char *data;
+                dma_addr_t phys_addr;
                 u32 rx_status;
                 int rx_bytes, err;
 
@@ -1486,6 +1487,7 @@ static int mvneta_rx(struct mvneta_port *pp, int rx_todo,
                 rx_status = rx_desc->status;
                 rx_bytes = rx_desc->data_size - (ETH_FCS_LEN + MVNETA_MH_SIZE);
                 data = (unsigned char *)rx_desc->buf_cookie;
+                phys_addr = rx_desc->buf_phys_addr;
 
                 if (!mvneta_rxq_desc_is_first_last(rx_status) ||
                     (rx_status & MVNETA_RXD_ERR_SUMMARY)) {
@@ -1534,7 +1536,7 @@ static int mvneta_rx(struct mvneta_port *pp, int rx_todo,
                 if (!skb)
                         goto err_drop_frame;
 
-                dma_unmap_single(dev->dev.parent, rx_desc->buf_phys_addr,
+                dma_unmap_single(dev->dev.parent, phys_addr,
                                  MVNETA_RX_BUF_SIZE(pp->pkt_size), DMA_FROM_DEVICE);
 
                 rcvd_pkts++;
@@ -3173,6 +3175,8 @@ static int mvneta_probe(struct platform_device *pdev)
                 struct phy_device *phy = of_phy_find_device(dn);
 
                 mvneta_fixed_link_update(pp, phy);
+
+                put_device(&phy->dev);
         }
 
         return 0;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
index 4402a1e48c9b..e7a5000aa12c 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
@@ -1047,13 +1047,15 @@ int mlx4_en_poll_rx_cq(struct napi_struct *napi, int budget)
 
         /* If we used up all the quota - we're probably not done yet... */
         if (done == budget) {
-                int cpu_curr;
                 const struct cpumask *aff;
+                struct irq_data *idata;
+                int cpu_curr;
 
                 INC_PERF_COUNTER(priv->pstats.napi_quota);
 
                 cpu_curr = smp_processor_id();
-                aff = irq_desc_get_irq_data(cq->irq_desc)->affinity;
+                idata = irq_desc_get_irq_data(cq->irq_desc);
+                aff = irq_data_get_affinity_mask(idata);
 
                 if (likely(cpumask_test_cpu(cpu_curr, aff)))
                         return budget;
@@ -1268,8 +1270,6 @@ int mlx4_en_config_rss_steer(struct mlx4_en_priv *priv)
                 rss_context->hash_fn = MLX4_RSS_HASH_TOP;
                 memcpy(rss_context->rss_key, priv->rss_key,
                        MLX4_EN_RSS_KEY_SIZE);
-                netdev_rss_key_fill(rss_context->rss_key,
-                                    MLX4_EN_RSS_KEY_SIZE);
         } else {
                 en_err(priv, "Unknown RSS hash function requested\n");
                 err = -EINVAL;
diff --git a/drivers/net/ethernet/micrel/ks8851.c b/drivers/net/ethernet/micrel/ks8851.c
index 66d4ab703f45..60f43ec22175 100644
--- a/drivers/net/ethernet/micrel/ks8851.c
+++ b/drivers/net/ethernet/micrel/ks8851.c
@@ -1601,6 +1601,7 @@ static const struct of_device_id ks8851_match_table[] = {
         { .compatible = "micrel,ks8851" },
         { }
 };
+MODULE_DEVICE_TABLE(of, ks8851_match_table);
 
 static struct spi_driver ks8851_driver = {
         .driver = {
diff --git a/drivers/net/ethernet/moxa/moxart_ether.c b/drivers/net/ethernet/moxa/moxart_ether.c
index becbb5f1f5a7..a10c928bbd6b 100644
--- a/drivers/net/ethernet/moxa/moxart_ether.c
+++ b/drivers/net/ethernet/moxa/moxart_ether.c
@@ -552,6 +552,7 @@ static const struct of_device_id moxart_mac_match[] = {
         { .compatible = "moxa,moxart-mac" },
         { }
 };
+MODULE_DEVICE_TABLE(of, moxart_mac_match);
 
 static struct platform_driver moxart_mac_driver = {
         .probe  = moxart_mac_probe,
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
index 06bcc734fe8d..d6696cfa11d2 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
@@ -536,6 +536,7 @@ struct qlcnic_hardware_context {
         u8 extend_lb_time;
         u8 phys_port_id[ETH_ALEN];
         u8 lb_mode;
+        u8 vxlan_port_count;
         u16 vxlan_port;
         struct device *hwmon_dev;
         u32 post_mode;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index 8b08b20e8b30..d4481454b5f8 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -483,11 +483,17 @@ static void qlcnic_add_vxlan_port(struct net_device *netdev,
         /* Adapter supports only one VXLAN port. Use very first port
          * for enabling offload
          */
-        if (!qlcnic_encap_rx_offload(adapter) || ahw->vxlan_port)
+        if (!qlcnic_encap_rx_offload(adapter))
                 return;
+        if (!ahw->vxlan_port_count) {
+                ahw->vxlan_port_count = 1;
+                ahw->vxlan_port = ntohs(port);
+                adapter->flags |= QLCNIC_ADD_VXLAN_PORT;
+                return;
+        }
+        if (ahw->vxlan_port == ntohs(port))
+                ahw->vxlan_port_count++;
 
-        ahw->vxlan_port = ntohs(port);
-        adapter->flags |= QLCNIC_ADD_VXLAN_PORT;
 }
 
 static void qlcnic_del_vxlan_port(struct net_device *netdev,
@@ -496,11 +502,13 @@ static void qlcnic_del_vxlan_port(struct net_device *netdev,
         struct qlcnic_adapter *adapter = netdev_priv(netdev);
         struct qlcnic_hardware_context *ahw = adapter->ahw;
 
-        if (!qlcnic_encap_rx_offload(adapter) || !ahw->vxlan_port ||
+        if (!qlcnic_encap_rx_offload(adapter) || !ahw->vxlan_port_count ||
             (ahw->vxlan_port != ntohs(port)))
                 return;
 
-        adapter->flags |= QLCNIC_DEL_VXLAN_PORT;
+        ahw->vxlan_port_count--;
+        if (!ahw->vxlan_port_count)
+                adapter->flags |= QLCNIC_DEL_VXLAN_PORT;
 }
 
 static netdev_features_t qlcnic_features_check(struct sk_buff *skb,
diff --git a/drivers/net/ethernet/realtek/8139cp.c b/drivers/net/ethernet/realtek/8139cp.c
index d79e33b3c191..686334f4588d 100644
--- a/drivers/net/ethernet/realtek/8139cp.c
+++ b/drivers/net/ethernet/realtek/8139cp.c
@@ -157,6 +157,7 @@ enum {
         NWayAdvert      = 0x66, /* MII ADVERTISE */
         NWayLPAR        = 0x68, /* MII LPA */
         NWayExpansion   = 0x6A, /* MII Expansion */
+        TxDmaOkLowDesc  = 0x82, /* Low 16 bit address of a Tx descriptor. */
         Config5         = 0xD8, /* Config5 */
         TxPoll          = 0xD9, /* Tell chip to check Tx descriptors for work */
         RxMaxSize       = 0xDA, /* Max size of an Rx packet (8169 only) */
@@ -341,6 +342,7 @@ struct cp_private {
         unsigned                tx_tail;
         struct cp_desc          *tx_ring;
         struct sk_buff          *tx_skb[CP_TX_RING_SIZE];
+        u32                     tx_opts[CP_TX_RING_SIZE];
 
         unsigned                rx_buf_sz;
         unsigned                wol_enabled : 1; /* Is Wake-on-LAN enabled? */
@@ -665,7 +667,7 @@ static void cp_tx (struct cp_private *cp)
                 BUG_ON(!skb);
 
                 dma_unmap_single(&cp->pdev->dev, le64_to_cpu(txd->addr),
-                                 le32_to_cpu(txd->opts1) & 0xffff,
+                                 cp->tx_opts[tx_tail] & 0xffff,
                                  PCI_DMA_TODEVICE);
 
                 if (status & LastFrag) {
@@ -733,7 +735,7 @@ static netdev_tx_t cp_start_xmit (struct sk_buff *skb,
 {
         struct cp_private *cp = netdev_priv(dev);
         unsigned entry;
-        u32 eor, flags;
+        u32 eor, opts1;
         unsigned long intr_flags;
         __le32 opts2;
         int mss = 0;
@@ -753,6 +755,21 @@ static netdev_tx_t cp_start_xmit (struct sk_buff *skb,
         mss = skb_shinfo(skb)->gso_size;
 
         opts2 = cpu_to_le32(cp_tx_vlan_tag(skb));
+        opts1 = DescOwn;
+        if (mss)
+                opts1 |= LargeSend | ((mss & MSSMask) << MSSShift);
+        else if (skb->ip_summed == CHECKSUM_PARTIAL) {
+                const struct iphdr *ip = ip_hdr(skb);
+                if (ip->protocol == IPPROTO_TCP)
+                        opts1 |= IPCS | TCPCS;
+                else if (ip->protocol == IPPROTO_UDP)
+                        opts1 |= IPCS | UDPCS;
+                else {
+                        WARN_ONCE(1,
+                                  "Net bug: asked to checksum invalid Legacy IP packet\n");
+                        goto out_dma_error;
+                }
+        }
 
         if (skb_shinfo(skb)->nr_frags == 0) {
                 struct cp_desc *txd = &cp->tx_ring[entry];
@@ -768,31 +785,20 @@ static netdev_tx_t cp_start_xmit (struct sk_buff *skb,
                 txd->addr = cpu_to_le64(mapping);
                 wmb();
 
-                flags = eor | len | DescOwn | FirstFrag | LastFrag;
-
-                if (mss)
-                        flags |= LargeSend | ((mss & MSSMask) << MSSShift);
-                else if (skb->ip_summed == CHECKSUM_PARTIAL) {
-                        const struct iphdr *ip = ip_hdr(skb);
-                        if (ip->protocol == IPPROTO_TCP)
-                                flags |= IPCS | TCPCS;
-                        else if (ip->protocol == IPPROTO_UDP)
-                                flags |= IPCS | UDPCS;
-                        else
-                                WARN_ON(1);     /* we need a WARN() */
-                }
+                opts1 |= eor | len | FirstFrag | LastFrag;
 
-                txd->opts1 = cpu_to_le32(flags);
+                txd->opts1 = cpu_to_le32(opts1);
                 wmb();
 
                 cp->tx_skb[entry] = skb;
-                entry = NEXT_TX(entry);
+                cp->tx_opts[entry] = opts1;
+                netif_dbg(cp, tx_queued, cp->dev, "tx queued, slot %d, skblen %d\n",
+                          entry, skb->len);
         } else {
                 struct cp_desc *txd;
-                u32 first_len, first_eor;
+                u32 first_len, first_eor, ctrl;
                 dma_addr_t first_mapping;
                 int frag, first_entry = entry;
-                const struct iphdr *ip = ip_hdr(skb);
 
                 /* We must give this initial chunk to the device last.
                  * Otherwise we could race with the device.
@@ -805,14 +811,14 @@ static netdev_tx_t cp_start_xmit (struct sk_buff *skb,
                         goto out_dma_error;
 
                 cp->tx_skb[entry] = skb;
-                entry = NEXT_TX(entry);
 
                 for (frag = 0; frag < skb_shinfo(skb)->nr_frags; frag++) {
                         const skb_frag_t *this_frag = &skb_shinfo(skb)->frags[frag];
                         u32 len;
-                        u32 ctrl;
                         dma_addr_t mapping;
 
+                        entry = NEXT_TX(entry);
+
                         len = skb_frag_size(this_frag);
                         mapping = dma_map_single(&cp->pdev->dev,
                                                  skb_frag_address(this_frag),
@@ -824,19 +830,7 @@ static netdev_tx_t cp_start_xmit (struct sk_buff *skb,
 
                         eor = (entry == (CP_TX_RING_SIZE - 1)) ? RingEnd : 0;
 
-                        ctrl = eor | len | DescOwn;
-
-                        if (mss)
-                                ctrl |= LargeSend |
-                                        ((mss & MSSMask) << MSSShift);
-                        else if (skb->ip_summed == CHECKSUM_PARTIAL) {
-                                if (ip->protocol == IPPROTO_TCP)
-                                        ctrl |= IPCS | TCPCS;
-                                else if (ip->protocol == IPPROTO_UDP)
-                                        ctrl |= IPCS | UDPCS;
-                                else
-                                        BUG();
-                        }
+                        ctrl = opts1 | eor | len;
 
                         if (frag == skb_shinfo(skb)->nr_frags - 1)
                                 ctrl |= LastFrag;
@@ -849,8 +843,8 @@ static netdev_tx_t cp_start_xmit (struct sk_buff *skb,
                         txd->opts1 = cpu_to_le32(ctrl);
                         wmb();
 
+                        cp->tx_opts[entry] = ctrl;
                         cp->tx_skb[entry] = skb;
-                        entry = NEXT_TX(entry);
                 }
 
                 txd = &cp->tx_ring[first_entry];
@@ -858,27 +852,17 @@ static netdev_tx_t cp_start_xmit (struct sk_buff *skb,
                 txd->addr = cpu_to_le64(first_mapping);
                 wmb();
 
-                if (skb->ip_summed == CHECKSUM_PARTIAL) {
-                        if (ip->protocol == IPPROTO_TCP)
-                                txd->opts1 = cpu_to_le32(first_eor | first_len |
-                                                         FirstFrag | DescOwn |
-                                                         IPCS | TCPCS);
-                        else if (ip->protocol == IPPROTO_UDP)
-                                txd->opts1 = cpu_to_le32(first_eor | first_len |
-                                                         FirstFrag | DescOwn |
-                                                         IPCS | UDPCS);
-                        else
-                                BUG();
-                } else
-                        txd->opts1 = cpu_to_le32(first_eor | first_len |
-                                                 FirstFrag | DescOwn);
+                ctrl = opts1 | first_eor | first_len | FirstFrag;
+                txd->opts1 = cpu_to_le32(ctrl);
                 wmb();
+
+                cp->tx_opts[first_entry] = ctrl;
+                netif_dbg(cp, tx_queued, cp->dev, "tx queued, slots %d-%d, skblen %d\n",
+                          first_entry, entry, skb->len);
         }
-        cp->tx_head = entry;
+        cp->tx_head = NEXT_TX(entry);
 
         netdev_sent_queue(dev, skb->len);
-        netif_dbg(cp, tx_queued, cp->dev, "tx queued, slot %d, skblen %d\n",
-                  entry, skb->len);
         if (TX_BUFFS_AVAIL(cp) <= (MAX_SKB_FRAGS + 1))
                 netif_stop_queue(dev);
 
@@ -1115,6 +1099,7 @@ static int cp_init_rings (struct cp_private *cp)
 {
         memset(cp->tx_ring, 0, sizeof(struct cp_desc) * CP_TX_RING_SIZE);
         cp->tx_ring[CP_TX_RING_SIZE - 1].opts1 = cpu_to_le32(RingEnd);
+        memset(cp->tx_opts, 0, sizeof(cp->tx_opts));
 
         cp_init_rings_index(cp);
 
@@ -1151,7 +1136,7 @@ static void cp_clean_rings (struct cp_private *cp)
                         desc = cp->rx_ring + i;
                         dma_unmap_single(&cp->pdev->dev,le64_to_cpu(desc->addr),
                                          cp->rx_buf_sz, PCI_DMA_FROMDEVICE);
-                        dev_kfree_skb(cp->rx_skb[i]);
+                        dev_kfree_skb_any(cp->rx_skb[i]);
                 }
         }
 
@@ -1164,7 +1149,7 @@ static void cp_clean_rings (struct cp_private *cp)
                                          le32_to_cpu(desc->opts1) & 0xffff,
                                          PCI_DMA_TODEVICE);
                         if (le32_to_cpu(desc->opts1) & LastFrag)
-                                dev_kfree_skb(skb);
+                                dev_kfree_skb_any(skb);
                         cp->dev->stats.tx_dropped++;
                 }
         }
@@ -1172,6 +1157,7 @@ static void cp_clean_rings (struct cp_private *cp)
 
         memset(cp->rx_ring, 0, sizeof(struct cp_desc) * CP_RX_RING_SIZE);
         memset(cp->tx_ring, 0, sizeof(struct cp_desc) * CP_TX_RING_SIZE);
+        memset(cp->tx_opts, 0, sizeof(cp->tx_opts));
 
         memset(cp->rx_skb, 0, sizeof(struct sk_buff *) * CP_RX_RING_SIZE);
         memset(cp->tx_skb, 0, sizeof(struct sk_buff *) * CP_TX_RING_SIZE);
@@ -1249,7 +1235,7 @@ static void cp_tx_timeout(struct net_device *dev)
 {
         struct cp_private *cp = netdev_priv(dev);
         unsigned long flags;
-        int rc;
+        int rc, i;
 
         netdev_warn(dev, "Transmit timeout, status %2x %4x %4x %4x\n",
                     cpr8(Cmd), cpr16(CpCmd),
@@ -1257,13 +1243,26 @@ static void cp_tx_timeout(struct net_device *dev)
 
         spin_lock_irqsave(&cp->lock, flags);
 
+        netif_dbg(cp, tx_err, cp->dev, "TX ring head %d tail %d desc %x\n",
+                  cp->tx_head, cp->tx_tail, cpr16(TxDmaOkLowDesc));
+        for (i = 0; i < CP_TX_RING_SIZE; i++) {
+                netif_dbg(cp, tx_err, cp->dev,
+                          "TX slot %d @%p: %08x (%08x) %08x %llx %p\n",
+                          i, &cp->tx_ring[i], le32_to_cpu(cp->tx_ring[i].opts1),
+                          cp->tx_opts[i], le32_to_cpu(cp->tx_ring[i].opts2),
+                          le64_to_cpu(cp->tx_ring[i].addr),
+                          cp->tx_skb[i]);
+        }
+
         cp_stop_hw(cp);
         cp_clean_rings(cp);
         rc = cp_init_rings(cp);
         cp_start_hw(cp);
-        cp_enable_irq(cp);
+        __cp_set_rx_mode(dev);
+        cpw16_f(IntrMask, cp_norx_intr_mask);
 
         netif_wake_queue(dev);
+        napi_schedule_irqoff(&cp->napi);
 
         spin_unlock_irqrestore(&cp->lock, flags);
 }
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
index b735fa22ac95..ebf6abc4853f 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
@@ -161,11 +161,16 @@ int stmmac_mdio_reset(struct mii_bus *bus)
 
                 if (!gpio_request(reset_gpio, "mdio-reset")) {
                         gpio_direction_output(reset_gpio, active_low ? 1 : 0);
-                        udelay(data->delays[0]);
+                        if (data->delays[0])
+                                msleep(DIV_ROUND_UP(data->delays[0], 1000));
+
                         gpio_set_value(reset_gpio, active_low ? 0 : 1);
-                        udelay(data->delays[1]);
+                        if (data->delays[1])
+                                msleep(DIV_ROUND_UP(data->delays[1], 1000));
+
                         gpio_set_value(reset_gpio, active_low ? 1 : 0);
-                        udelay(data->delays[2]);
+                        if (data->delays[2])
+                                msleep(DIV_ROUND_UP(data->delays[2], 1000));
                 }
         }
 #endif
diff --git a/drivers/net/ethernet/sun/sunvnet.c b/drivers/net/ethernet/sun/sunvnet.c
index 53fe200e0b79..cc106d892e29 100644
--- a/drivers/net/ethernet/sun/sunvnet.c
+++ b/drivers/net/ethernet/sun/sunvnet.c
@@ -1756,7 +1756,8 @@ static const struct net_device_ops vnet_ops = {
 #endif
 };
 
-static struct vnet *vnet_new(const u64 *local_mac)
+static struct vnet *vnet_new(const u64 *local_mac,
+                             struct vio_dev *vdev)
 {
         struct net_device *dev;
         struct vnet *vp;
@@ -1790,6 +1791,8 @@ static struct vnet *vnet_new(const u64 *local_mac)
                            NETIF_F_HW_CSUM | NETIF_F_SG;
         dev->features = dev->hw_features;
 
+        SET_NETDEV_DEV(dev, &vdev->dev);
+
         err = register_netdev(dev);
         if (err) {
                 pr_err("Cannot register net device, aborting\n");
@@ -1808,7 +1811,8 @@ err_out_free_dev:
         return ERR_PTR(err);
 }
 
-static struct vnet *vnet_find_or_create(const u64 *local_mac)
+static struct vnet *vnet_find_or_create(const u64 *local_mac,
+                                        struct vio_dev *vdev)
 {
         struct vnet *iter, *vp;
 
@@ -1821,7 +1825,7 @@ static struct vnet *vnet_find_or_create(const u64 *local_mac)
                 }
         }
         if (!vp)
-                vp = vnet_new(local_mac);
+                vp = vnet_new(local_mac, vdev);
         mutex_unlock(&vnet_list_mutex);
 
         return vp;
@@ -1848,7 +1852,8 @@ static void vnet_cleanup(void)
 static const char *local_mac_prop = "local-mac-address";
 
 static struct vnet *vnet_find_parent(struct mdesc_handle *hp,
-                                                u64 port_node)
+                                     u64 port_node,
+                                     struct vio_dev *vdev)
 {
         const u64 *local_mac = NULL;
         u64 a;
@@ -1869,7 +1874,7 @@ static struct vnet *vnet_find_parent(struct mdesc_handle *hp,
         if (!local_mac)
                 return ERR_PTR(-ENODEV);
 
-        return vnet_find_or_create(local_mac);
+        return vnet_find_or_create(local_mac, vdev);
 }
 
 static struct ldc_channel_config vnet_ldc_cfg = {
@@ -1923,7 +1928,7 @@ static int vnet_port_probe(struct vio_dev *vdev, const struct vio_device_id *id)
 
         hp = mdesc_grab();
 
-        vp = vnet_find_parent(hp, vdev->mp);
+        vp = vnet_find_parent(hp, vdev->mp, vdev);
         if (IS_ERR(vp)) {
                 pr_err("Cannot find port parent vnet\n");
                 err = PTR_ERR(vp);
diff --git a/drivers/net/ethernet/ti/netcp_core.c b/drivers/net/ethernet/ti/netcp_core.c
index 1a5aca55ea9f..9f9832f0dea9 100644
--- a/drivers/net/ethernet/ti/netcp_core.c
+++ b/drivers/net/ethernet/ti/netcp_core.c
@@ -291,13 +291,6 @@ static int netcp_module_probe(struct netcp_device *netcp_device,
                             interface_list) {
                 struct netcp_intf_modpriv *intf_modpriv;
 
-                /* If interface not registered then register now */
-                if (!netcp_intf->netdev_registered)
-                        ret = netcp_register_interface(netcp_intf);
-
-                if (ret)
-                        return -ENODEV;
-
                 intf_modpriv = devm_kzalloc(dev, sizeof(*intf_modpriv),
                                             GFP_KERNEL);
                 if (!intf_modpriv)
@@ -306,6 +299,11 @@ static int netcp_module_probe(struct netcp_device *netcp_device,
                 interface = of_parse_phandle(netcp_intf->node_interface,
                                              module->name, 0);
 
+                if (!interface) {
+                        devm_kfree(dev, intf_modpriv);
+                        continue;
+                }
+
                 intf_modpriv->netcp_priv = netcp_intf;
                 intf_modpriv->netcp_module = module;
                 list_add_tail(&intf_modpriv->intf_list,
@@ -323,6 +321,18 @@ static int netcp_module_probe(struct netcp_device *netcp_device,
                         continue;
                 }
         }
+
+        /* Now register the interface with netdev */
+        list_for_each_entry(netcp_intf,
+                            &netcp_device->interface_head,
+                            interface_list) {
+                /* If interface not registered then register now */
+                if (!netcp_intf->netdev_registered) {
+                        ret = netcp_register_interface(netcp_intf);
+                        if (ret)
+                                return -ENODEV;
+                }
+        }
         return 0;
 }
 
@@ -357,7 +367,6 @@ int netcp_register_module(struct netcp_module *module)
                 if (ret < 0)
                         goto fail;
         }
-
         mutex_unlock(&netcp_modules_lock);
         return 0;
 
@@ -796,7 +805,7 @@ static void netcp_rxpool_free(struct netcp_intf *netcp)
         netcp->rx_pool = NULL;
 }
 
-static void netcp_allocate_rx_buf(struct netcp_intf *netcp, int fdq)
+static int netcp_allocate_rx_buf(struct netcp_intf *netcp, int fdq)
 {
         struct knav_dma_desc *hwdesc;
         unsigned int buf_len, dma_sz;
@@ -810,7 +819,7 @@ static void netcp_allocate_rx_buf(struct netcp_intf *netcp, int fdq)
         hwdesc = knav_pool_desc_get(netcp->rx_pool);
         if (IS_ERR_OR_NULL(hwdesc)) {
                 dev_dbg(netcp->ndev_dev, "out of rx pool desc\n");
-                return;
+                return -ENOMEM;
         }
 
         if (likely(fdq == 0)) {
@@ -862,25 +871,26 @@ static void netcp_allocate_rx_buf(struct netcp_intf *netcp, int fdq)
         knav_pool_desc_map(netcp->rx_pool, hwdesc, sizeof(*hwdesc), &dma,
                            &dma_sz);
         knav_queue_push(netcp->rx_fdq[fdq], dma, sizeof(*hwdesc), 0);
-        return;
+        return 0;
 
 fail:
         knav_pool_desc_put(netcp->rx_pool, hwdesc);
+        return -ENOMEM;
 }
 
 /* Refill Rx FDQ with descriptors & attached buffers */
 static void netcp_rxpool_refill(struct netcp_intf *netcp)
 {
         u32 fdq_deficit[KNAV_DMA_FDQ_PER_CHAN] = {0};
-        int i;
+        int i, ret = 0;
 
         /* Calculate the FDQ deficit and refill */
         for (i = 0; i < KNAV_DMA_FDQ_PER_CHAN && netcp->rx_fdq[i]; i++) {
                 fdq_deficit[i] = netcp->rx_queue_depths[i] -
                                  knav_queue_get_count(netcp->rx_fdq[i]);
 
-                while (fdq_deficit[i]--)
-                        netcp_allocate_rx_buf(netcp, i);
+                while (fdq_deficit[i]-- && !ret)
+                        ret = netcp_allocate_rx_buf(netcp, i);
         } /* end for fdqs */
 }
 
@@ -893,12 +903,12 @@ static int netcp_rx_poll(struct napi_struct *napi, int budget)
 
         packets = netcp_process_rx_packets(netcp, budget);
 
+        netcp_rxpool_refill(netcp);
         if (packets < budget) {
                 napi_complete(&netcp->rx_napi);
                 knav_queue_enable_notify(netcp->rx_queue);
         }
 
-        netcp_rxpool_refill(netcp);
         return packets;
 }
 
@@ -1384,7 +1394,6 @@ static void netcp_addr_sweep_del(struct netcp_intf *netcp)
                         continue;
                 dev_dbg(netcp->ndev_dev, "deleting address %pM, type %x\n",
                         naddr->addr, naddr->type);
-                mutex_lock(&netcp_modules_lock);
                 for_each_module(netcp, priv) {
                         module = priv->netcp_module;
                         if (!module->del_addr)
@@ -1393,7 +1402,6 @@ static void netcp_addr_sweep_del(struct netcp_intf *netcp)
                                                  naddr);
                         WARN_ON(error);
                 }
-                mutex_unlock(&netcp_modules_lock);
                 netcp_addr_del(netcp, naddr);
         }
 }
@@ -1410,7 +1418,7 @@ static void netcp_addr_sweep_add(struct netcp_intf *netcp)
                         continue;
                 dev_dbg(netcp->ndev_dev, "adding address %pM, type %x\n",
                         naddr->addr, naddr->type);
-                mutex_lock(&netcp_modules_lock);
+
                 for_each_module(netcp, priv) {
                         module = priv->netcp_module;
                         if (!module->add_addr)
@@ -1418,7 +1426,6 @@ static void netcp_addr_sweep_add(struct netcp_intf *netcp)
                         error = module->add_addr(priv->module_priv, naddr);
                         WARN_ON(error);
                 }
-                mutex_unlock(&netcp_modules_lock);
         }
 }
 
@@ -1432,6 +1439,7 @@ static void netcp_set_rx_mode(struct net_device *ndev)
                    ndev->flags & IFF_ALLMULTI ||
                    netdev_mc_count(ndev) > NETCP_MAX_MCAST_ADDR);
 
+        spin_lock(&netcp->lock);
         /* first clear all marks */
         netcp_addr_clear_mark(netcp);
 
@@ -1450,6 +1458,7 @@ static void netcp_set_rx_mode(struct net_device *ndev)
         /* finally sweep and callout into modules */
         netcp_addr_sweep_del(netcp);
         netcp_addr_sweep_add(netcp);
+        spin_unlock(&netcp->lock);
 }
 
 static void netcp_free_navigator_resources(struct netcp_intf *netcp)
@@ -1614,7 +1623,6 @@ static int netcp_ndo_open(struct net_device *ndev)
                 goto fail;
         }
 
-        mutex_lock(&netcp_modules_lock);
         for_each_module(netcp, intf_modpriv) {
                 module = intf_modpriv->netcp_module;
                 if (module->open) {
@@ -1625,7 +1633,6 @@ static int netcp_ndo_open(struct net_device *ndev)
                         }
                 }
         }
-        mutex_unlock(&netcp_modules_lock);
 
         napi_enable(&netcp->rx_napi);
         napi_enable(&netcp->tx_napi);
@@ -1642,7 +1649,6 @@ fail_open:
                 if (module->close)
                         module->close(intf_modpriv->module_priv, ndev);
         }
-        mutex_unlock(&netcp_modules_lock);
 
 fail:
         netcp_free_navigator_resources(netcp);
@@ -1666,7 +1672,6 @@ static int netcp_ndo_stop(struct net_device *ndev)
         napi_disable(&netcp->rx_napi);
         napi_disable(&netcp->tx_napi);
 
-        mutex_lock(&netcp_modules_lock);
         for_each_module(netcp, intf_modpriv) {
                 module = intf_modpriv->netcp_module;
                 if (module->close) {
@@ -1675,7 +1680,6 @@ static int netcp_ndo_stop(struct net_device *ndev)
                                 dev_err(netcp->ndev_dev, "Close failed\n");
                 }
         }
-        mutex_unlock(&netcp_modules_lock);
 
         /* Recycle Rx descriptors from completion queue */
         netcp_empty_rx_queue(netcp);
@@ -1703,7 +1707,6 @@ static int netcp_ndo_ioctl(struct net_device *ndev,
         if (!netif_running(ndev))
                 return -EINVAL;
 
-        mutex_lock(&netcp_modules_lock);
         for_each_module(netcp, intf_modpriv) {
                 module = intf_modpriv->netcp_module;
                 if (!module->ioctl)
@@ -1719,7 +1722,6 @@ static int netcp_ndo_ioctl(struct net_device *ndev,
         }
 
 out:
-        mutex_unlock(&netcp_modules_lock);
         return (ret == 0) ? 0 : err;
 }
 
@@ -1754,11 +1756,12 @@ static int netcp_rx_add_vid(struct net_device *ndev, __be16 proto, u16 vid)
         struct netcp_intf *netcp = netdev_priv(ndev);
         struct netcp_intf_modpriv *intf_modpriv;
         struct netcp_module *module;
+        unsigned long flags;
         int err = 0;
 
         dev_dbg(netcp->ndev_dev, "adding rx vlan id: %d\n", vid);
 
-        mutex_lock(&netcp_modules_lock);
+        spin_lock_irqsave(&netcp->lock, flags);
         for_each_module(netcp, intf_modpriv) {
                 module = intf_modpriv->netcp_module;
                 if ((module->add_vid) && (vid != 0)) {
@@ -1770,7 +1773,8 @@ static int netcp_rx_add_vid(struct net_device *ndev, __be16 proto, u16 vid)
                         }
                 }
         }
-        mutex_unlock(&netcp_modules_lock);
+        spin_unlock_irqrestore(&netcp->lock, flags);
+
         return err;
 }
 
@@ -1779,11 +1783,12 @@ static int netcp_rx_kill_vid(struct net_device *ndev, __be16 proto, u16 vid)
         struct netcp_intf *netcp = netdev_priv(ndev);
         struct netcp_intf_modpriv *intf_modpriv;
         struct netcp_module *module;
+        unsigned long flags;
         int err = 0;
 
         dev_dbg(netcp->ndev_dev, "removing rx vlan id: %d\n", vid);
 
-        mutex_lock(&netcp_modules_lock);
+        spin_lock_irqsave(&netcp->lock, flags);
         for_each_module(netcp, intf_modpriv) {
                 module = intf_modpriv->netcp_module;
                 if (module->del_vid) {
@@ -1795,7 +1800,7 @@ static int netcp_rx_kill_vid(struct net_device *ndev, __be16 proto, u16 vid)
                         }
                 }
         }
-        mutex_unlock(&netcp_modules_lock);
+        spin_unlock_irqrestore(&netcp->lock, flags);
         return err;
 }
 
@@ -2040,7 +2045,6 @@ static int netcp_probe(struct platform_device *pdev)
         struct device_node *child, *interfaces;
         struct netcp_device *netcp_device;
         struct device *dev = &pdev->dev;
-        struct netcp_module *module;
         int ret;
 
         if (!node) {
@@ -2087,14 +2091,6 @@ static int netcp_probe(struct platform_device *pdev)
         /* Add the device instance to the list */
         list_add_tail(&netcp_device->device_list, &netcp_devices);
 
-        /* Probe & attach any modules already registered */
-        mutex_lock(&netcp_modules_lock);
-        for_each_netcp_module(module) {
-                ret = netcp_module_probe(netcp_device, module);
-                if (ret < 0)
-                        dev_err(dev, "module(%s) probe failed\n", module->name);
-        }
-        mutex_unlock(&netcp_modules_lock);
         return 0;
 
 probe_quit_interface:
diff --git a/drivers/net/ethernet/ti/netcp_ethss.c b/drivers/net/ethernet/ti/netcp_ethss.c
index 6f16d6aaf7b7..6bff8d82ceab 100644
--- a/drivers/net/ethernet/ti/netcp_ethss.c
+++ b/drivers/net/ethernet/ti/netcp_ethss.c
@@ -77,6 +77,7 @@
 #define GBENU_ALE_OFFSET                0x1e000
 #define GBENU_HOST_PORT_NUM             0
 #define GBENU_NUM_ALE_ENTRIES           1024
+#define GBENU_SGMII_MODULE_SIZE         0x100
 
 /* 10G Ethernet SS defines */
 #define XGBE_MODULE_NAME                "netcp-xgbe"
@@ -149,8 +150,8 @@
 #define XGBE_STATS2_MODULE                      2
 
 /* s: 0-based slave_port */
-#define SGMII_BASE(s) \
-        (((s) < 2) ? gbe_dev->sgmii_port_regs : gbe_dev->sgmii_port34_regs)
+#define SGMII_BASE(d, s) \
+        (((s) < 2) ? (d)->sgmii_port_regs : (d)->sgmii_port34_regs)
 
 #define GBE_TX_QUEUE                            648
 #define GBE_TXHOOK_ORDER                        0
@@ -1997,13 +1998,8 @@ static void netcp_ethss_update_link_state(struct gbe_priv *gbe_dev,
                 return;
 
         if (!SLAVE_LINK_IS_XGMII(slave)) {
-                if (gbe_dev->ss_version == GBE_SS_VERSION_14)
-                        sgmii_link_state =
-                                netcp_sgmii_get_port_link(SGMII_BASE(sp), sp);
-                else
-                        sgmii_link_state =
-                                netcp_sgmii_get_port_link(
-                                                gbe_dev->sgmii_port_regs, sp);
+                sgmii_link_state =
+                        netcp_sgmii_get_port_link(SGMII_BASE(gbe_dev, sp), sp);
         }
 
         phy_link_state = gbe_phy_link_status(slave);
@@ -2100,17 +2096,11 @@ static void gbe_port_config(struct gbe_priv *gbe_dev, struct gbe_slave *slave,
 static void gbe_sgmii_rtreset(struct gbe_priv *priv,
                               struct gbe_slave *slave, bool set)
 {
-        void __iomem *sgmii_port_regs;
-
         if (SLAVE_LINK_IS_XGMII(slave))
                 return;
 
-        if ((priv->ss_version == GBE_SS_VERSION_14) && (slave->slave_num >= 2))
-                sgmii_port_regs = priv->sgmii_port34_regs;
-        else
-                sgmii_port_regs = priv->sgmii_port_regs;
-
-        netcp_sgmii_rtreset(sgmii_port_regs, slave->slave_num, set);
+        netcp_sgmii_rtreset(SGMII_BASE(priv, slave->slave_num),
+                            slave->slave_num, set);
 }
 
 static void gbe_slave_stop(struct gbe_intf *intf)
@@ -2136,17 +2126,12 @@ static void gbe_slave_stop(struct gbe_intf *intf)
 
 static void gbe_sgmii_config(struct gbe_priv *priv, struct gbe_slave *slave)
 {
-        void __iomem *sgmii_port_regs;
-
-        sgmii_port_regs = priv->sgmii_port_regs;
-        if ((priv->ss_version == GBE_SS_VERSION_14) && (slave->slave_num >= 2))
-                sgmii_port_regs = priv->sgmii_port34_regs;
+        if (SLAVE_LINK_IS_XGMII(slave))
+                return;
 
-        if (!SLAVE_LINK_IS_XGMII(slave)) {
-                netcp_sgmii_reset(sgmii_port_regs, slave->slave_num);
-                netcp_sgmii_config(sgmii_port_regs, slave->slave_num,
-                                   slave->link_interface);
-        }
+        netcp_sgmii_reset(SGMII_BASE(priv, slave->slave_num), slave->slave_num);
+        netcp_sgmii_config(SGMII_BASE(priv, slave->slave_num), slave->slave_num,
+                           slave->link_interface);
 }
 
 static int gbe_slave_open(struct gbe_intf *gbe_intf)
@@ -2997,6 +2982,14 @@ static int set_gbenu_ethss_priv(struct gbe_priv *gbe_dev,
         gbe_dev->switch_regs = regs;
 
         gbe_dev->sgmii_port_regs = gbe_dev->ss_regs + GBENU_SGMII_MODULE_OFFSET;
+
+        /* Although sgmii modules are mem mapped to one contiguous
+         * region on GBENU devices, setting sgmii_port34_regs allows
+         * consistent code when accessing sgmii api
+         */
+        gbe_dev->sgmii_port34_regs = gbe_dev->sgmii_port_regs +
+                                     (2 * GBENU_SGMII_MODULE_SIZE);
+
         gbe_dev->host_port_regs = gbe_dev->switch_regs + GBENU_HOST_PORT_OFFSET;
 
         for (i = 0; i < (gbe_dev->max_num_ports); i++)
diff --git a/drivers/net/ethernet/via/Kconfig b/drivers/net/ethernet/via/Kconfig
index 2f1264b882b9..d3d094742a7e 100644
--- a/drivers/net/ethernet/via/Kconfig
+++ b/drivers/net/ethernet/via/Kconfig
@@ -17,7 +17,7 @@ if NET_VENDOR_VIA
 
 config VIA_RHINE
         tristate "VIA Rhine support"
-        depends on (PCI || OF_IRQ)
+        depends on PCI || (OF_IRQ && GENERIC_PCI_IOMAP)
         depends on HAS_DMA
         select CRC32
         select MII
diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
index 6008eee01a33..cf468c87ce57 100644
--- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
@@ -828,6 +828,8 @@ static int xemaclite_mdio_setup(struct net_local *lp, struct device *dev)
                 if (!phydev)
                         dev_info(dev,
                                  "MDIO of the phy is not registered yet\n");
+                else
+                        put_device(&phydev->dev);
                 return 0;
         }
 
diff --git a/drivers/net/fjes/fjes_hw.c b/drivers/net/fjes/fjes_hw.c
index b5f4a78da828..2d3848c9dc35 100644
--- a/drivers/net/fjes/fjes_hw.c
+++ b/drivers/net/fjes/fjes_hw.c
@@ -1011,11 +1011,11 @@ static void fjes_hw_update_zone_task(struct work_struct *work)
                                         set_bit(epidx, &irq_bit);
                                 break;
                         }
-                }
-
-                hw->ep_shm_info[epidx].es_status = info[epidx].es_status;
-                hw->ep_shm_info[epidx].zone = info[epidx].zone;
 
+                        hw->ep_shm_info[epidx].es_status =
+                                info[epidx].es_status;
+                        hw->ep_shm_info[epidx].zone = info[epidx].zone;
+                }
                 break;
         }
 
diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
index da3259ce7c8d..8f5c02eed47d 100644
--- a/drivers/net/geneve.c
+++ b/drivers/net/geneve.c
@@ -126,6 +126,8 @@ static void geneve_rx(struct geneve_sock *gs, struct sk_buff *skb)
         __be32 addr;
         int err;
 
+        iph = ip_hdr(skb); /* outer IP header... */
+
         if (gs->collect_md) {
                 static u8 zero_vni[3];
 
@@ -133,7 +135,6 @@ static void geneve_rx(struct geneve_sock *gs, struct sk_buff *skb)
                 addr = 0;
         } else {
                 vni = gnvh->vni;
-                iph = ip_hdr(skb); /* Still outer IP header... */
                 addr = iph->saddr;
         }
 
@@ -178,7 +179,6 @@ static void geneve_rx(struct geneve_sock *gs, struct sk_buff *skb)
 
         skb_reset_network_header(skb);
 
-        iph = ip_hdr(skb); /* Now inner IP header... */
         err = IP_ECN_decapsulate(iph, skb);
 
         if (unlikely(err)) {
@@ -626,6 +626,7 @@ static netdev_tx_t geneve_xmit(struct sk_buff *skb, struct net_device *dev)
         struct geneve_sock *gs = geneve->sock;
         struct ip_tunnel_info *info = NULL;
         struct rtable *rt = NULL;
+        const struct iphdr *iip; /* interior IP header */
         struct flowi4 fl4;
         __u8 tos, ttl;
         __be16 sport;
@@ -653,6 +654,8 @@ static netdev_tx_t geneve_xmit(struct sk_buff *skb, struct net_device *dev)
         sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true);
         skb_reset_mac_header(skb);
 
+        iip = ip_hdr(skb);
+
         if (info) {
                 const struct ip_tunnel_key *key = &info->key;
                 u8 *opts = NULL;
@@ -668,19 +671,16 @@ static netdev_tx_t geneve_xmit(struct sk_buff *skb, struct net_device *dev)
                 if (unlikely(err))
                         goto err;
 
-                tos = key->tos;
+                tos = ip_tunnel_ecn_encap(key->tos, iip, skb);
                 ttl = key->ttl;
                 df = key->tun_flags & TUNNEL_DONT_FRAGMENT ? htons(IP_DF) : 0;
         } else {
-                const struct iphdr *iip; /* interior IP header */
-
                 udp_csum = false;
                 err = geneve_build_skb(rt, skb, 0, geneve->vni,
                                        0, NULL, udp_csum);
                 if (unlikely(err))
                         goto err;
 
-                iip = ip_hdr(skb);
                 tos = ip_tunnel_ecn_encap(fl4.flowi4_tos, iip, skb);
                 ttl = geneve->ttl;
                 if (!ttl && IN_MULTICAST(ntohl(fl4.daddr)))
@@ -748,12 +748,8 @@ static void geneve_setup(struct net_device *dev)
         dev->features    |= NETIF_F_RXCSUM;
         dev->features    |= NETIF_F_GSO_SOFTWARE;
 
-        dev->vlan_features = dev->features;
-        dev->features    |= NETIF_F_HW_VLAN_CTAG_TX | NETIF_F_HW_VLAN_STAG_TX;
-
         dev->hw_features |= NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_RXCSUM;
         dev->hw_features |= NETIF_F_GSO_SOFTWARE;
-        dev->hw_features |= NETIF_F_HW_VLAN_CTAG_TX | NETIF_F_HW_VLAN_STAG_TX;
 
         netif_keep_dst(dev);
         dev->priv_flags |= IFF_LIVE_ADDR_CHANGE | IFF_NO_QUEUE;
@@ -819,7 +815,7 @@ static struct geneve_dev *geneve_find_dev(struct geneve_net *gn,
 
 static int geneve_configure(struct net *net, struct net_device *dev,
                             __be32 rem_addr, __u32 vni, __u8 ttl, __u8 tos,
-                            __u16 dst_port, bool metadata)
+                            __be16 dst_port, bool metadata)
 {
         struct geneve_net *gn = net_generic(net, geneve_net_id);
         struct geneve_dev *t, *geneve = netdev_priv(dev);
@@ -844,10 +840,10 @@ static int geneve_configure(struct net *net, struct net_device *dev,
 
         geneve->ttl = ttl;
         geneve->tos = tos;
-        geneve->dst_port = htons(dst_port);
+        geneve->dst_port = dst_port;
         geneve->collect_md = metadata;
 
-        t = geneve_find_dev(gn, htons(dst_port), rem_addr, geneve->vni,
+        t = geneve_find_dev(gn, dst_port, rem_addr, geneve->vni,
                             &tun_on_same_port, &tun_collect_md);
         if (t)
                 return -EBUSY;
@@ -871,7 +867,7 @@ static int geneve_configure(struct net *net, struct net_device *dev,
 static int geneve_newlink(struct net *net, struct net_device *dev,
                           struct nlattr *tb[], struct nlattr *data[])
 {
-        __u16 dst_port = GENEVE_UDP_PORT;
+        __be16 dst_port = htons(GENEVE_UDP_PORT);
         __u8 ttl = 0, tos = 0;
         bool metadata = false;
         __be32 rem_addr;
@@ -890,7 +886,7 @@ static int geneve_newlink(struct net *net, struct net_device *dev,
                 tos = nla_get_u8(data[IFLA_GENEVE_TOS]);
 
         if (data[IFLA_GENEVE_PORT])
-                dst_port = nla_get_u16(data[IFLA_GENEVE_PORT]);
+                dst_port = nla_get_be16(data[IFLA_GENEVE_PORT]);
 
         if (data[IFLA_GENEVE_COLLECT_METADATA])
                 metadata = true;
@@ -913,7 +909,7 @@ static size_t geneve_get_size(const struct net_device *dev)
                 nla_total_size(sizeof(struct in_addr)) + /* IFLA_GENEVE_REMOTE */
                 nla_total_size(sizeof(__u8)) +  /* IFLA_GENEVE_TTL */
                 nla_total_size(sizeof(__u8)) +  /* IFLA_GENEVE_TOS */
-                nla_total_size(sizeof(__u16)) +  /* IFLA_GENEVE_PORT */
+                nla_total_size(sizeof(__be16)) +  /* IFLA_GENEVE_PORT */
                 nla_total_size(0) +      /* IFLA_GENEVE_COLLECT_METADATA */
                 0;
 }
@@ -935,7 +931,7 @@ static int geneve_fill_info(struct sk_buff *skb, const struct net_device *dev)
             nla_put_u8(skb, IFLA_GENEVE_TOS, geneve->tos))
                 goto nla_put_failure;
 
-        if (nla_put_u16(skb, IFLA_GENEVE_PORT, ntohs(geneve->dst_port)))
+        if (nla_put_be16(skb, IFLA_GENEVE_PORT, geneve->dst_port))
                 goto nla_put_failure;
 
         if (geneve->collect_md) {
@@ -975,7 +971,7 @@ struct net_device *geneve_dev_create_fb(struct net *net, const char *name,
         if (IS_ERR(dev))
                 return dev;
 
-        err = geneve_configure(net, dev, 0, 0, 0, 0, dst_port, true);
+        err = geneve_configure(net, dev, 0, 0, 0, 0, htons(dst_port), true);
         if (err) {
                 free_netdev(dev);
                 return ERR_PTR(err);
diff --git a/drivers/net/irda/ali-ircc.c b/drivers/net/irda/ali-ircc.c
index 58ae11a14bb6..64bb44d5d867 100644
--- a/drivers/net/irda/ali-ircc.c
+++ b/drivers/net/irda/ali-ircc.c
@@ -1031,7 +1031,6 @@ static void ali_ircc_fir_change_speed(struct ali_ircc_cb *priv, __u32 baud)
 static void ali_ircc_sir_change_speed(struct ali_ircc_cb *priv, __u32 speed)
 {
         struct ali_ircc_cb *self = priv;
-        unsigned long flags;
         int iobase; 
         int fcr;    /* FIFO control reg */
         int lcr;    /* Line control reg */
@@ -1061,8 +1060,6 @@ static void ali_ircc_sir_change_speed(struct ali_ircc_cb *priv, __u32 speed)
         /* Update accounting for new speed */
         self->io.speed = speed;
 
-        spin_lock_irqsave(&self->lock, flags);
-
         divisor = 115200/speed;
         
         fcr = UART_FCR_ENABLE_FIFO;
@@ -1089,9 +1086,6 @@ static void ali_ircc_sir_change_speed(struct ali_ircc_cb *priv, __u32 speed)
         /* without this, the connection will be broken after come back from FIR speed,
            but with this, the SIR connection is harder to established */
         outb((UART_MCR_DTR | UART_MCR_RTS | UART_MCR_OUT2), iobase+UART_MCR);
-        
-        spin_unlock_irqrestore(&self->lock, flags);
-        
 }
 
 static void ali_ircc_change_dongle_speed(struct ali_ircc_cb *priv, int speed)
diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index edd77342773a..248478c6f6e4 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -1111,10 +1111,10 @@ static long macvtap_ioctl(struct file *file, unsigned int cmd,
                 return 0;
 
         case TUNSETSNDBUF:
-                if (get_user(u, up))
+                if (get_user(s, sp))
                         return -EFAULT;
 
-                q->sk.sk_sndbuf = u;
+                q->sk.sk_sndbuf = s;
                 return 0;
 
         case TUNGETVNETHDRSZ:
diff --git a/drivers/net/ntb_netdev.c b/drivers/net/ntb_netdev.c
index d8757bf9ad75..a9acf7156855 100644
--- a/drivers/net/ntb_netdev.c
+++ b/drivers/net/ntb_netdev.c
@@ -61,11 +61,21 @@ MODULE_VERSION(NTB_NETDEV_VER);
 MODULE_LICENSE("Dual BSD/GPL");
 MODULE_AUTHOR("Intel Corporation");
 
+/* Time in usecs for tx resource reaper */
+static unsigned int tx_time = 1;
+
+/* Number of descriptors to free before resuming tx */
+static unsigned int tx_start = 10;
+
+/* Number of descriptors still available before stop upper layer tx */
+static unsigned int tx_stop = 5;
+
 struct ntb_netdev {
         struct list_head list;
         struct pci_dev *pdev;
         struct net_device *ndev;
         struct ntb_transport_qp *qp;
+        struct timer_list tx_timer;
 };
 
 #define NTB_TX_TIMEOUT_MS       1000
@@ -136,11 +146,42 @@ enqueue_again:
         }
 }
 
+static int __ntb_netdev_maybe_stop_tx(struct net_device *netdev,
+                                      struct ntb_transport_qp *qp, int size)
+{
+        struct ntb_netdev *dev = netdev_priv(netdev);
+
+        netif_stop_queue(netdev);
+        /* Make sure to see the latest value of ntb_transport_tx_free_entry()
+         * since the queue was last started.
+         */
+        smp_mb();
+
+        if (likely(ntb_transport_tx_free_entry(qp) < size)) {
+                mod_timer(&dev->tx_timer, jiffies + usecs_to_jiffies(tx_time));
+                return -EBUSY;
+        }
+
+        netif_start_queue(netdev);
+        return 0;
+}
+
+static int ntb_netdev_maybe_stop_tx(struct net_device *ndev,
+                                    struct ntb_transport_qp *qp, int size)
+{
+        if (netif_queue_stopped(ndev) ||
+            (ntb_transport_tx_free_entry(qp) >= size))
+                return 0;
+
+        return __ntb_netdev_maybe_stop_tx(ndev, qp, size);
+}
+
 static void ntb_netdev_tx_handler(struct ntb_transport_qp *qp, void *qp_data,
                                   void *data, int len)
 {
         struct net_device *ndev = qp_data;
         struct sk_buff *skb;
+        struct ntb_netdev *dev = netdev_priv(ndev);
 
         skb = data;
         if (!skb || !ndev)
@@ -155,6 +196,15 @@ static void ntb_netdev_tx_handler(struct ntb_transport_qp *qp, void *qp_data,
         }
 
         dev_kfree_skb(skb);
+
+        if (ntb_transport_tx_free_entry(dev->qp) >= tx_start) {
+                /* Make sure anybody stopping the queue after this sees the new
+                 * value of ntb_transport_tx_free_entry()
+                 */
+                smp_mb();
+                if (netif_queue_stopped(ndev))
+                        netif_wake_queue(ndev);
+        }
 }
 
 static netdev_tx_t ntb_netdev_start_xmit(struct sk_buff *skb,
@@ -163,10 +213,15 @@ static netdev_tx_t ntb_netdev_start_xmit(struct sk_buff *skb,
         struct ntb_netdev *dev = netdev_priv(ndev);
         int rc;
 
+        ntb_netdev_maybe_stop_tx(ndev, dev->qp, tx_stop);
+
         rc = ntb_transport_tx_enqueue(dev->qp, skb, skb->data, skb->len);
         if (rc)
                 goto err;
 
+        /* check for next submit */
+        ntb_netdev_maybe_stop_tx(ndev, dev->qp, tx_stop);
+
         return NETDEV_TX_OK;
 
 err:
@@ -175,6 +230,23 @@ err:
         return NETDEV_TX_BUSY;
 }
 
+static void ntb_netdev_tx_timer(unsigned long data)
+{
+        struct net_device *ndev = (struct net_device *)data;
+        struct ntb_netdev *dev = netdev_priv(ndev);
+
+        if (ntb_transport_tx_free_entry(dev->qp) < tx_stop) {
+                mod_timer(&dev->tx_timer, jiffies + msecs_to_jiffies(tx_time));
+        } else {
+                /* Make sure anybody stopping the queue after this sees the new
+                 * value of ntb_transport_tx_free_entry()
+                 */
+                smp_mb();
+                if (netif_queue_stopped(ndev))
+                        netif_wake_queue(ndev);
+        }
+}
+
 static int ntb_netdev_open(struct net_device *ndev)
 {
         struct ntb_netdev *dev = netdev_priv(ndev);
@@ -197,8 +269,11 @@ static int ntb_netdev_open(struct net_device *ndev)
                 }
         }
 
+        setup_timer(&dev->tx_timer, ntb_netdev_tx_timer, (unsigned long)ndev);
+
         netif_carrier_off(ndev);
         ntb_transport_link_up(dev->qp);
+        netif_start_queue(ndev);
 
         return 0;
 
@@ -219,6 +294,8 @@ static int ntb_netdev_close(struct net_device *ndev)
         while ((skb = ntb_transport_rx_remove(dev->qp, &len)))
                 dev_kfree_skb(skb);
 
+        del_timer_sync(&dev->tx_timer);
+
         return 0;
 }
 
diff --git a/drivers/net/phy/fixed_phy.c b/drivers/net/phy/fixed_phy.c
index fb1299c6326e..e23bf5b90e17 100644
--- a/drivers/net/phy/fixed_phy.c
+++ b/drivers/net/phy/fixed_phy.c
@@ -220,7 +220,7 @@ int fixed_phy_update_state(struct phy_device *phydev,
         struct fixed_mdio_bus *fmb = &platform_fmb;
         struct fixed_phy *fp;
 
-        if (!phydev || !phydev->bus)
+        if (!phydev || phydev->bus != fmb->mii_bus)
                 return -EINVAL;
 
         list_for_each_entry(fp, &fmb->phys, node) {
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index e6897b6a8a53..5de8d5827536 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -785,6 +785,7 @@ static int marvell_read_status(struct phy_device *phydev)
         int adv;
         int err;
         int lpa;
+        int lpagb;
         int status = 0;
 
         /* Update the link, but return if there
@@ -802,10 +803,17 @@ static int marvell_read_status(struct phy_device *phydev)
                 if (lpa < 0)
                         return lpa;
 
+                lpagb = phy_read(phydev, MII_STAT1000);
+                if (lpagb < 0)
+                        return lpagb;
+
                 adv = phy_read(phydev, MII_ADVERTISE);
                 if (adv < 0)
                         return adv;
 
+                phydev->lp_advertising = mii_stat1000_to_ethtool_lpa_t(lpagb) |
+                                         mii_lpa_to_ethtool_lpa_t(lpa);
+
                 lpa &= adv;
 
                 if (status & MII_M1011_PHY_STATUS_FULLDUPLEX)
@@ -853,6 +861,7 @@ static int marvell_read_status(struct phy_device *phydev)
                         phydev->speed = SPEED_10;
 
                 phydev->pause = phydev->asym_pause = 0;
+                phydev->lp_advertising = 0;
         }
 
         return 0;
diff --git a/drivers/net/phy/mdio-bcm-unimac.c b/drivers/net/phy/mdio-bcm-unimac.c
index 6a52a7f0fa0d..4bde5e728fe0 100644
--- a/drivers/net/phy/mdio-bcm-unimac.c
+++ b/drivers/net/phy/mdio-bcm-unimac.c
@@ -244,6 +244,7 @@ static const struct of_device_id unimac_mdio_ids[] = {
         { .compatible = "brcm,unimac-mdio", },
         { /* sentinel */ },
 };
+MODULE_DEVICE_TABLE(of, unimac_mdio_ids);
 
 static struct platform_driver unimac_mdio_driver = {
         .driver = {
diff --git a/drivers/net/phy/mdio-gpio.c b/drivers/net/phy/mdio-gpio.c
index 7dc21e56a7aa..3bc9f03349f3 100644
--- a/drivers/net/phy/mdio-gpio.c
+++ b/drivers/net/phy/mdio-gpio.c
@@ -261,6 +261,7 @@ static const struct of_device_id mdio_gpio_of_match[] = {
         { .compatible = "virtual,mdio-gpio", },
         { /* sentinel */ }
 };
+MODULE_DEVICE_TABLE(of, mdio_gpio_of_match);
 
 static struct platform_driver mdio_gpio_driver = {
         .probe = mdio_gpio_probe,
diff --git a/drivers/net/phy/mdio-mux.c b/drivers/net/phy/mdio-mux.c
index 4d4d25efc1e1..280c7c311f72 100644
--- a/drivers/net/phy/mdio-mux.c
+++ b/drivers/net/phy/mdio-mux.c
@@ -113,18 +113,18 @@ int mdio_mux_init(struct device *dev,
         if (!parent_bus_node)
                 return -ENODEV;
 
-        parent_bus = of_mdio_find_bus(parent_bus_node);
-        if (parent_bus == NULL) {
-                ret_val = -EPROBE_DEFER;
-                goto err_parent_bus;
-        }
-
         pb = devm_kzalloc(dev, sizeof(*pb), GFP_KERNEL);
         if (pb == NULL) {
                 ret_val = -ENOMEM;
                 goto err_parent_bus;
         }
 
+        parent_bus = of_mdio_find_bus(parent_bus_node);
+        if (parent_bus == NULL) {
+                ret_val = -EPROBE_DEFER;
+                goto err_parent_bus;
+        }
+
         pb->switch_data = data;
         pb->switch_fn = switch_fn;
         pb->current_child = -1;
@@ -173,6 +173,10 @@ int mdio_mux_init(struct device *dev,
                 dev_info(dev, "Version " DRV_VERSION "\n");
                 return 0;
         }
+
+        /* balance the reference of_mdio_find_bus() took */
+        put_device(&pb->mii_bus->dev);
+
 err_parent_bus:
         of_node_put(parent_bus_node);
         return ret_val;
@@ -189,6 +193,9 @@ void mdio_mux_uninit(void *mux_handle)
                 mdiobus_free(cb->mii_bus);
                 cb = cb->next;
         }
+
+        /* balance the reference of_mdio_find_bus() in mdio_mux_init() took */
+        put_device(&pb->mii_bus->dev);
 }
 EXPORT_SYMBOL_GPL(mdio_mux_uninit);
 
diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index 02a4615b65f8..12f44c53cc8e 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -167,7 +167,9 @@ static int of_mdio_bus_match(struct device *dev, const void *mdio_bus_np)
  * of_mdio_find_bus - Given an mii_bus node, find the mii_bus.
  * @mdio_bus_np: Pointer to the mii_bus.
  *
- * Returns a pointer to the mii_bus, or NULL if none found.
+ * Returns a reference to the mii_bus, or NULL if none found.  The
+ * embedded struct device will have its reference count incremented,
+ * and this must be put once the bus is finished with.
  *
  * Because the association of a device_node and mii_bus is made via
  * of_mdiobus_register(), the mii_bus cannot be found before it is
@@ -234,15 +236,18 @@ static inline void of_mdiobus_link_phydev(struct mii_bus *mdio,
 #endif
 
 /**
- * mdiobus_register - bring up all the PHYs on a given bus and attach them to bus
+ * __mdiobus_register - bring up all the PHYs on a given bus and attach them to bus
  * @bus: target mii_bus
+ * @owner: module containing bus accessor functions
  *
  * Description: Called by a bus driver to bring up all the PHYs
- *   on a given bus, and attach them to the bus.
+ *   on a given bus, and attach them to the bus. Drivers should use
+ *   mdiobus_register() rather than __mdiobus_register() unless they
+ *   need to pass a specific owner module.
  *
  * Returns 0 on success or < 0 on error.
  */
-int mdiobus_register(struct mii_bus *bus)
+int __mdiobus_register(struct mii_bus *bus, struct module *owner)
 {
         int i, err;
 
@@ -253,6 +258,7 @@ int mdiobus_register(struct mii_bus *bus)
         BUG_ON(bus->state != MDIOBUS_ALLOCATED &&
                bus->state != MDIOBUS_UNREGISTERED);
 
+        bus->owner = owner;
         bus->dev.parent = bus->parent;
         bus->dev.class = &mdio_bus_class;
         bus->dev.groups = NULL;
@@ -288,13 +294,16 @@ int mdiobus_register(struct mii_bus *bus)
 
 error:
         while (--i >= 0) {
-                if (bus->phy_map[i])
-                        device_unregister(&bus->phy_map[i]->dev);
+                struct phy_device *phydev = bus->phy_map[i];
+                if (phydev) {
+                        phy_device_remove(phydev);
+                        phy_device_free(phydev);
+                }
         }
         device_del(&bus->dev);
         return err;
 }
-EXPORT_SYMBOL(mdiobus_register);
+EXPORT_SYMBOL(__mdiobus_register);
 
 void mdiobus_unregister(struct mii_bus *bus)
 {
@@ -304,9 +313,11 @@ void mdiobus_unregister(struct mii_bus *bus)
         bus->state = MDIOBUS_UNREGISTERED;
 
         for (i = 0; i < PHY_MAX_ADDR; i++) {
-                if (bus->phy_map[i])
-                        device_unregister(&bus->phy_map[i]->dev);
-                bus->phy_map[i] = NULL;
+                struct phy_device *phydev = bus->phy_map[i];
+                if (phydev) {
+                        phy_device_remove(phydev);
+                        phy_device_free(phydev);
+                }
         }
         device_del(&bus->dev);
 }
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index c0f211127274..f761288abe66 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -384,6 +384,24 @@ int phy_device_register(struct phy_device *phydev)
 EXPORT_SYMBOL(phy_device_register);
 
 /**
+ * phy_device_remove - Remove a previously registered phy device from the MDIO bus
+ * @phydev: phy_device structure to remove
+ *
+ * This doesn't free the phy_device itself, it merely reverses the effects
+ * of phy_device_register(). Use phy_device_free() to free the device
+ * after calling this function.
+ */
+void phy_device_remove(struct phy_device *phydev)
+{
+        struct mii_bus *bus = phydev->bus;
+        int addr = phydev->addr;
+
+        device_del(&phydev->dev);
+        bus->phy_map[addr] = NULL;
+}
+EXPORT_SYMBOL(phy_device_remove);
+
+/**
  * phy_find_first - finds the first PHY device on the bus
  * @bus: the target MII bus
  */
@@ -578,14 +596,22 @@ EXPORT_SYMBOL(phy_init_hw);
  *     generic driver is used.  The phy_device is given a ptr to
  *     the attaching device, and given a callback for link status
  *     change.  The phy_device is returned to the attaching driver.
+ *     This function takes a reference on the phy device.
  */
 int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
                       u32 flags, phy_interface_t interface)
 {
+        struct mii_bus *bus = phydev->bus;
         struct device *d = &phydev->dev;
-        struct module *bus_module;
         int err;
 
+        if (!try_module_get(bus->owner)) {
+                dev_err(&dev->dev, "failed to get the bus module\n");
+                return -EIO;
+        }
+
+        get_device(d);
+
         /* Assume that if there is no driver, that it doesn't
          * exist, and we should use the genphy driver.
          */
@@ -600,20 +626,13 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
                         err = device_bind_driver(d);
 
                 if (err)
-                        return err;
+                        goto error;
         }
 
         if (phydev->attached_dev) {
                 dev_err(&dev->dev, "PHY already attached\n");
-                return -EBUSY;
-        }
-
-        /* Increment the bus module reference count */
-        bus_module = phydev->bus->dev.driver ?
-                     phydev->bus->dev.driver->owner : NULL;
-        if (!try_module_get(bus_module)) {
-                dev_err(&dev->dev, "failed to get the bus module\n");
-                return -EIO;
+                err = -EBUSY;
+                goto error;
         }
 
         phydev->attached_dev = dev;
@@ -636,6 +655,11 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
                 phy_resume(phydev);
 
         return err;
+
+error:
+        put_device(d);
+        module_put(bus->owner);
+        return err;
 }
 EXPORT_SYMBOL(phy_attach_direct);
 
@@ -677,14 +701,15 @@ EXPORT_SYMBOL(phy_attach);
 /**
  * phy_detach - detach a PHY device from its network device
  * @phydev: target phy_device struct
+ *
+ * This detaches the phy device from its network device and the phy
+ * driver, and drops the reference count taken in phy_attach_direct().
  */
 void phy_detach(struct phy_device *phydev)
 {
+        struct mii_bus *bus;
         int i;
 
-        if (phydev->bus->dev.driver)
-                module_put(phydev->bus->dev.driver->owner);
-
         phydev->attached_dev->phydev = NULL;
         phydev->attached_dev = NULL;
         phy_suspend(phydev);
@@ -700,6 +725,15 @@ void phy_detach(struct phy_device *phydev)
                         break;
                 }
         }
+
+        /*
+         * The phydev might go away on the put_device() below, so avoid
+         * a use-after-free bug by reading the underlying bus first.
+         */
+        bus = phydev->bus;
+
+        put_device(&phydev->dev);
+        module_put(bus->owner);
 }
 EXPORT_SYMBOL(phy_detach);
 
diff --git a/drivers/net/phy/vitesse.c b/drivers/net/phy/vitesse.c
index 17cad185169d..76cad712ddb2 100644
--- a/drivers/net/phy/vitesse.c
+++ b/drivers/net/phy/vitesse.c
@@ -66,7 +66,6 @@
 #define PHY_ID_VSC8244                  0x000fc6c0
 #define PHY_ID_VSC8514                  0x00070670
 #define PHY_ID_VSC8574                  0x000704a0
-#define PHY_ID_VSC8641                  0x00070431
 #define PHY_ID_VSC8662                  0x00070660
 #define PHY_ID_VSC8221                  0x000fc550
 #define PHY_ID_VSC8211                  0x000fc4b0
@@ -273,18 +272,6 @@ static struct phy_driver vsc82xx_driver[] = {
         .config_intr    = &vsc82xx_config_intr,
         .driver         = { .owner = THIS_MODULE,},
 }, {
-        .phy_id         = PHY_ID_VSC8641,
-        .name           = "Vitesse VSC8641",
-        .phy_id_mask    = 0x000ffff0,
-        .features       = PHY_GBIT_FEATURES,
-        .flags          = PHY_HAS_INTERRUPT,
-        .config_init    = &vsc824x_config_init,
-        .config_aneg    = &vsc82x4_config_aneg,
-        .read_status    = &genphy_read_status,
-        .ack_interrupt  = &vsc824x_ack_interrupt,
-        .config_intr    = &vsc82xx_config_intr,
-        .driver         = { .owner = THIS_MODULE,},
-}, {
         .phy_id         = PHY_ID_VSC8662,
         .name           = "Vitesse VSC8662",
         .phy_id_mask    = 0x000ffff0,
@@ -331,7 +318,6 @@ static struct mdio_device_id __maybe_unused vitesse_tbl[] = {
         { PHY_ID_VSC8244, 0x000fffc0 },
         { PHY_ID_VSC8514, 0x000ffff0 },
         { PHY_ID_VSC8574, 0x000ffff0 },
-        { PHY_ID_VSC8641, 0x000ffff0 },
         { PHY_ID_VSC8662, 0x000ffff0 },
         { PHY_ID_VSC8221, 0x000ffff0 },
         { PHY_ID_VSC8211, 0x000ffff0 },
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index 0481daf9201a..ed00446759b2 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -2755,6 +2755,7 @@ static struct ppp *ppp_create_interface(struct net *net, int unit,
          */
         dev_net_set(dev, net);
 
+        rtnl_lock();
         mutex_lock(&pn->all_ppp_mutex);
 
         if (unit < 0) {
@@ -2785,7 +2786,7 @@ static struct ppp *ppp_create_interface(struct net *net, int unit,
         ppp->file.index = unit;
         sprintf(dev->name, "ppp%d", unit);
 
-        ret = register_netdev(dev);
+        ret = register_netdevice(dev);
         if (ret != 0) {
                 unit_put(&pn->units_idr, unit);
                 netdev_err(ppp->dev, "PPP: couldn't register device %s (%d)\n",
@@ -2797,6 +2798,7 @@ static struct ppp *ppp_create_interface(struct net *net, int unit,
 
         atomic_inc(&ppp_unit_count);
         mutex_unlock(&pn->all_ppp_mutex);
+        rtnl_unlock();
 
         *retp = 0;
         return ppp;
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index 167cfc503a78..3a8a36c8ded1 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -585,4 +585,15 @@ config USB_VL600
 
           http://ubuntuforums.org/showpost.php?p=10589647&postcount=17
 
+config USB_NET_CH9200
+        tristate "QingHeng CH9200 USB ethernet support"
+        depends on USB_USBNET
+        select MII
+        help
+          Choose this option if you have a USB ethernet adapter with a QinHeng
+          CH9200 chipset.
+
+          To compile this driver as a module, choose M here: the
+          module will be called ch9200.
+
 endif # USB_NET_DRIVERS
diff --git a/drivers/net/usb/Makefile b/drivers/net/usb/Makefile
index cf6a0e610a7f..b5f04068dbe4 100644
--- a/drivers/net/usb/Makefile
+++ b/drivers/net/usb/Makefile
@@ -38,4 +38,4 @@ obj-$(CONFIG_USB_NET_HUAWEI_CDC_NCM)	+= huawei_cdc_ncm.o
 obj-$(CONFIG_USB_VL600)         += lg-vl600.o
 obj-$(CONFIG_USB_NET_QMI_WWAN)  += qmi_wwan.o
 obj-$(CONFIG_USB_NET_CDC_MBIM)  += cdc_mbim.o
-
+obj-$(CONFIG_USB_NET_CH9200)    += ch9200.o
diff --git a/drivers/net/usb/ch9200.c b/drivers/net/usb/ch9200.c
new file mode 100644
index 000000000000..5e151e6a3e09
--- /dev/null
+++ b/drivers/net/usb/ch9200.c
@@ -0,0 +1,432 @@
+/*
+ * USB 10M/100M ethernet adapter
+ *
+ * This file is licensed under the terms of the GNU General Public License
+ * version 2. This program is licensed "as is" without any warranty of any
+ * kind, whether express or implied
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/sched.h>
+#include <linux/stddef.h>
+#include <linux/init.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/ethtool.h>
+#include <linux/mii.h>
+#include <linux/usb.h>
+#include <linux/crc32.h>
+#include <linux/usb/usbnet.h>
+#include <linux/slab.h>
+
+#define CH9200_VID              0x1A86
+#define CH9200_PID_E092         0xE092
+
+#define CTRL_TIMEOUT_MS         1000
+
+#define CONTROL_TIMEOUT_MS 1000
+
+#define REQUEST_READ    0x0E
+#define REQUEST_WRITE   0x0F
+
+/* Address space:
+ * 00-63 : MII
+ * 64-128: MAC
+ *
+ * Note: all accesses must be 16-bit
+ */
+
+#define MAC_REG_CTRL 64
+#define MAC_REG_STATUS 66
+#define MAC_REG_INTERRUPT_MASK 68
+#define MAC_REG_PHY_COMMAND 70
+#define MAC_REG_PHY_DATA 72
+#define MAC_REG_STATION_L 74
+#define MAC_REG_STATION_M 76
+#define MAC_REG_STATION_H 78
+#define MAC_REG_HASH_L 80
+#define MAC_REG_HASH_M1 82
+#define MAC_REG_HASH_M2 84
+#define MAC_REG_HASH_H 86
+#define MAC_REG_THRESHOLD 88
+#define MAC_REG_FIFO_DEPTH 90
+#define MAC_REG_PAUSE 92
+#define MAC_REG_FLOW_CONTROL 94
+
+/* Control register bits
+ *
+ * Note: bits 13 and 15 are reserved
+ */
+#define LOOPBACK                (0x01 << 14)
+#define BASE100X                (0x01 << 12)
+#define MBPS_10                 (0x01 << 11)
+#define DUPLEX_MODE             (0x01 << 10)
+#define PAUSE_FRAME             (0x01 << 9)
+#define PROMISCUOUS             (0x01 << 8)
+#define MULTICAST               (0x01 << 7)
+#define BROADCAST               (0x01 << 6)
+#define HASH                    (0x01 << 5)
+#define APPEND_PAD              (0x01 << 4)
+#define APPEND_CRC              (0x01 << 3)
+#define TRANSMITTER_ACTION      (0x01 << 2)
+#define RECEIVER_ACTION         (0x01 << 1)
+#define DMA_ACTION              (0x01 << 0)
+
+/* Status register bits
+ *
+ * Note: bits 7-15 are reserved
+ */
+#define ALIGNMENT               (0x01 << 6)
+#define FIFO_OVER_RUN           (0x01 << 5)
+#define FIFO_UNDER_RUN          (0x01 << 4)
+#define RX_ERROR                (0x01 << 3)
+#define RX_COMPLETE             (0x01 << 2)
+#define TX_ERROR                (0x01 << 1)
+#define TX_COMPLETE             (0x01 << 0)
+
+/* FIFO depth register bits
+ *
+ * Note: bits 6 and 14 are reserved
+ */
+
+#define ETH_TXBD                (0x01 << 15)
+#define ETN_TX_FIFO_DEPTH       (0x01 << 8)
+#define ETH_RXBD                (0x01 << 7)
+#define ETH_RX_FIFO_DEPTH       (0x01 << 0)
+
+static int control_read(struct usbnet *dev,
+                        unsigned char request, unsigned short value,
+                        unsigned short index, void *data, unsigned short size,
+                        int timeout)
+{
+        unsigned char *buf = NULL;
+        unsigned char request_type;
+        int err = 0;
+
+        if (request == REQUEST_READ)
+                request_type = (USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_OTHER);
+        else
+                request_type = (USB_DIR_IN | USB_TYPE_VENDOR |
+                                USB_RECIP_DEVICE);
+
+        netdev_dbg(dev->net, "Control_read() index=0x%02x size=%d\n",
+                   index, size);
+
+        buf = kmalloc(size, GFP_KERNEL);
+        if (!buf) {
+                err = -ENOMEM;
+                goto err_out;
+        }
+
+        err = usb_control_msg(dev->udev,
+                              usb_rcvctrlpipe(dev->udev, 0),
+                              request, request_type, value, index, buf, size,
+                              timeout);
+        if (err == size)
+                memcpy(data, buf, size);
+        else if (err >= 0)
+                err = -EINVAL;
+        kfree(buf);
+
+        return err;
+
+err_out:
+        return err;
+}
+
+static int control_write(struct usbnet *dev, unsigned char request,
+                         unsigned short value, unsigned short index,
+                         void *data, unsigned short size, int timeout)
+{
+        unsigned char *buf = NULL;
+        unsigned char request_type;
+        int err = 0;
+
+        if (request == REQUEST_WRITE)
+                request_type = (USB_DIR_OUT | USB_TYPE_VENDOR |
+                                USB_RECIP_OTHER);
+        else
+                request_type = (USB_DIR_OUT | USB_TYPE_VENDOR |
+                                USB_RECIP_DEVICE);
+
+        netdev_dbg(dev->net, "Control_write() index=0x%02x size=%d\n",
+                   index, size);
+
+        if (data) {
+                buf = kmalloc(size, GFP_KERNEL);
+                if (!buf) {
+                        err = -ENOMEM;
+                        goto err_out;
+                }
+                memcpy(buf, data, size);
+        }
+
+        err = usb_control_msg(dev->udev,
+                              usb_sndctrlpipe(dev->udev, 0),
+                              request, request_type, value, index, buf, size,
+                              timeout);
+        if (err >= 0 && err < size)
+                err = -EINVAL;
+        kfree(buf);
+
+        return 0;
+
+err_out:
+        return err;
+}
+
+static int ch9200_mdio_read(struct net_device *netdev, int phy_id, int loc)
+{
+        struct usbnet *dev = netdev_priv(netdev);
+        unsigned char buff[2];
+
+        netdev_dbg(netdev, "ch9200_mdio_read phy_id:%02x loc:%02x\n",
+                   phy_id, loc);
+
+        if (phy_id != 0)
+                return -ENODEV;
+
+        control_read(dev, REQUEST_READ, 0, loc * 2, buff, 0x02,
+                     CONTROL_TIMEOUT_MS);
+
+        return (buff[0] | buff[1] << 8);
+}
+
+static void ch9200_mdio_write(struct net_device *netdev,
+                              int phy_id, int loc, int val)
+{
+        struct usbnet *dev = netdev_priv(netdev);
+        unsigned char buff[2];
+
+        netdev_dbg(netdev, "ch9200_mdio_write() phy_id=%02x loc:%02x\n",
+                   phy_id, loc);
+
+        if (phy_id != 0)
+                return;
+
+        buff[0] = (unsigned char)val;
+        buff[1] = (unsigned char)(val >> 8);
+
+        control_write(dev, REQUEST_WRITE, 0, loc * 2, buff, 0x02,
+                      CONTROL_TIMEOUT_MS);
+}
+
+static int ch9200_link_reset(struct usbnet *dev)
+{
+        struct ethtool_cmd ecmd;
+
+        mii_check_media(&dev->mii, 1, 1);
+        mii_ethtool_gset(&dev->mii, &ecmd);
+
+        netdev_dbg(dev->net, "link_reset() speed:%d duplex:%d\n",
+                   ecmd.speed, ecmd.duplex);
+
+        return 0;
+}
+
+static void ch9200_status(struct usbnet *dev, struct urb *urb)
+{
+        int link;
+        unsigned char *buf;
+
+        if (urb->actual_length < 16)
+                return;
+
+        buf = urb->transfer_buffer;
+        link = !!(buf[0] & 0x01);
+
+        if (link) {
+                netif_carrier_on(dev->net);
+                usbnet_defer_kevent(dev, EVENT_LINK_RESET);
+        } else {
+                netif_carrier_off(dev->net);
+        }
+}
+
+static struct sk_buff *ch9200_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
+                                       gfp_t flags)
+{
+        int i = 0;
+        int len = 0;
+        int tx_overhead = 0;
+
+        tx_overhead = 0x40;
+
+        len = skb->len;
+        if (skb_headroom(skb) < tx_overhead) {
+                struct sk_buff *skb2;
+
+                skb2 = skb_copy_expand(skb, tx_overhead, 0, flags);
+                dev_kfree_skb_any(skb);
+                skb = skb2;
+                if (!skb)
+                        return NULL;
+        }
+
+        __skb_push(skb, tx_overhead);
+        /* usbnet adds padding if length is a multiple of packet size
+         * if so, adjust length value in header
+         */
+        if ((skb->len % dev->maxpacket) == 0)
+                len++;
+
+        skb->data[0] = len;
+        skb->data[1] = len >> 8;
+        skb->data[2] = 0x00;
+        skb->data[3] = 0x80;
+
+        for (i = 4; i < 48; i++)
+                skb->data[i] = 0x00;
+
+        skb->data[48] = len;
+        skb->data[49] = len >> 8;
+        skb->data[50] = 0x00;
+        skb->data[51] = 0x80;
+
+        for (i = 52; i < 64; i++)
+                skb->data[i] = 0x00;
+
+        return skb;
+}
+
+static int ch9200_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+{
+        int len = 0;
+        int rx_overhead = 0;
+
+        rx_overhead = 64;
+
+        if (unlikely(skb->len < rx_overhead)) {
+                dev_err(&dev->udev->dev, "unexpected tiny rx frame\n");
+                return 0;
+        }
+
+        len = (skb->data[skb->len - 16] | skb->data[skb->len - 15] << 8);
+        skb_trim(skb, len);
+
+        return 1;
+}
+
+static int get_mac_address(struct usbnet *dev, unsigned char *data)
+{
+        int err = 0;
+        unsigned char mac_addr[0x06];
+        int rd_mac_len = 0;
+
+        netdev_dbg(dev->net, "get_mac_address:\n\tusbnet VID:%0x PID:%0x\n",
+                   dev->udev->descriptor.idVendor,
+                   dev->udev->descriptor.idProduct);
+
+        memset(mac_addr, 0, sizeof(mac_addr));
+        rd_mac_len = control_read(dev, REQUEST_READ, 0,
+                                  MAC_REG_STATION_L, mac_addr, 0x02,
+                                  CONTROL_TIMEOUT_MS);
+        rd_mac_len += control_read(dev, REQUEST_READ, 0, MAC_REG_STATION_M,
+                                   mac_addr + 2, 0x02, CONTROL_TIMEOUT_MS);
+        rd_mac_len += control_read(dev, REQUEST_READ, 0, MAC_REG_STATION_H,
+                                   mac_addr + 4, 0x02, CONTROL_TIMEOUT_MS);
+        if (rd_mac_len != ETH_ALEN)
+                err = -EINVAL;
+
+        data[0] = mac_addr[5];
+        data[1] = mac_addr[4];
+        data[2] = mac_addr[3];
+        data[3] = mac_addr[2];
+        data[4] = mac_addr[1];
+        data[5] = mac_addr[0];
+
+        return err;
+}
+
+static int ch9200_bind(struct usbnet *dev, struct usb_interface *intf)
+{
+        int retval = 0;
+        unsigned char data[2];
+
+        retval = usbnet_get_endpoints(dev, intf);
+        if (retval)
+                return retval;
+
+        dev->mii.dev = dev->net;
+        dev->mii.mdio_read = ch9200_mdio_read;
+        dev->mii.mdio_write = ch9200_mdio_write;
+        dev->mii.reg_num_mask = 0x1f;
+
+        dev->mii.phy_id_mask = 0x1f;
+
+        dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len;
+        dev->rx_urb_size = 24 * 64 + 16;
+        mii_nway_restart(&dev->mii);
+
+        data[0] = 0x01;
+        data[1] = 0x0F;
+        retval = control_write(dev, REQUEST_WRITE, 0, MAC_REG_THRESHOLD, data,
+                               0x02, CONTROL_TIMEOUT_MS);
+
+        data[0] = 0xA0;
+        data[1] = 0x90;
+        retval = control_write(dev, REQUEST_WRITE, 0, MAC_REG_FIFO_DEPTH, data,
+                               0x02, CONTROL_TIMEOUT_MS);
+
+        data[0] = 0x30;
+        data[1] = 0x00;
+        retval = control_write(dev, REQUEST_WRITE, 0, MAC_REG_PAUSE, data,
+                               0x02, CONTROL_TIMEOUT_MS);
+
+        data[0] = 0x17;
+        data[1] = 0xD8;
+        retval = control_write(dev, REQUEST_WRITE, 0, MAC_REG_FLOW_CONTROL,
+                               data, 0x02, CONTROL_TIMEOUT_MS);
+
+        /* Undocumented register */
+        data[0] = 0x01;
+        data[1] = 0x00;
+        retval = control_write(dev, REQUEST_WRITE, 0, 254, data, 0x02,
+                               CONTROL_TIMEOUT_MS);
+
+        data[0] = 0x5F;
+        data[1] = 0x0D;
+        retval = control_write(dev, REQUEST_WRITE, 0, MAC_REG_CTRL, data, 0x02,
+                               CONTROL_TIMEOUT_MS);
+
+        retval = get_mac_address(dev, dev->net->dev_addr);
+
+        return retval;
+}
+
+static const struct driver_info ch9200_info = {
+        .description = "CH9200 USB to Network Adaptor",
+        .flags = FLAG_ETHER,
+        .bind = ch9200_bind,
+        .rx_fixup = ch9200_rx_fixup,
+        .tx_fixup = ch9200_tx_fixup,
+        .status = ch9200_status,
+        .link_reset = ch9200_link_reset,
+        .reset = ch9200_link_reset,
+};
+
+static const struct usb_device_id ch9200_products[] = {
+        {
+         USB_DEVICE(0x1A86, 0xE092),
+         .driver_info = (unsigned long)&ch9200_info,
+         },
+        {},
+};
+
+MODULE_DEVICE_TABLE(usb, ch9200_products);
+
+static struct usb_driver ch9200_driver = {
+        .name = "ch9200",
+        .id_table = ch9200_products,
+        .probe = usbnet_probe,
+        .disconnect = usbnet_disconnect,
+        .suspend = usbnet_suspend,
+        .resume = usbnet_resume,
+};
+
+module_usb_driver(ch9200_driver);
+
+MODULE_DESCRIPTION("QinHeng CH9200 USB Network device");
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
index 637e9fd1e14c..4ecb3a3e516a 100644
--- a/drivers/net/vrf.c
+++ b/drivers/net/vrf.c
@@ -193,7 +193,8 @@ static netdev_tx_t vrf_process_v4_outbound(struct sk_buff *skb,
                 .flowi4_oif = vrf_dev->ifindex,
                 .flowi4_iif = LOOPBACK_IFINDEX,
                 .flowi4_tos = RT_TOS(ip4h->tos),
-                .flowi4_flags = FLOWI_FLAG_ANYSRC | FLOWI_FLAG_VRFSRC,
+                .flowi4_flags = FLOWI_FLAG_ANYSRC | FLOWI_FLAG_VRFSRC |
+                                FLOWI_FLAG_SKIP_NH_OIF,
                 .daddr = ip4h->daddr,
         };
 
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index cf8b7f0473b3..bbac1d35ed4e 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -2392,10 +2392,6 @@ static void vxlan_setup(struct net_device *dev)
 
         eth_hw_addr_random(dev);
         ether_setup(dev);
-        if (vxlan->default_dst.remote_ip.sa.sa_family == AF_INET6)
-                dev->needed_headroom = ETH_HLEN + VXLAN6_HEADROOM;
-        else
-                dev->needed_headroom = ETH_HLEN + VXLAN_HEADROOM;
 
         dev->netdev_ops = &vxlan_netdev_ops;
         dev->destructor = free_netdev;
@@ -2640,8 +2636,11 @@ static int vxlan_dev_configure(struct net *src_net, struct net_device *dev,
                 dst->remote_ip.sa.sa_family = AF_INET;
 
         if (dst->remote_ip.sa.sa_family == AF_INET6 ||
-            vxlan->cfg.saddr.sa.sa_family == AF_INET6)
+            vxlan->cfg.saddr.sa.sa_family == AF_INET6) {
+                if (!IS_ENABLED(CONFIG_IPV6))
+                        return -EPFNOSUPPORT;
                 use_ipv6 = true;
+        }
 
         if (conf->remote_ifindex) {
                 struct net_device *lowerdev
@@ -2670,8 +2669,12 @@ static int vxlan_dev_configure(struct net *src_net, struct net_device *dev,
 
                 dev->needed_headroom = lowerdev->hard_header_len +
                                        (use_ipv6 ? VXLAN6_HEADROOM : VXLAN_HEADROOM);
-        } else if (use_ipv6)
+        } else if (use_ipv6) {
                 vxlan->flags |= VXLAN_F_IPV6;
+                dev->needed_headroom = ETH_HLEN + VXLAN6_HEADROOM;
+        } else {
+                dev->needed_headroom = ETH_HLEN + VXLAN_HEADROOM;
+        }
 
         memcpy(&vxlan->cfg, conf, sizeof(*conf));
         if (!vxlan->cfg.dst_port)
diff --git a/drivers/ntb/hw/intel/ntb_hw_intel.c b/drivers/ntb/hw/intel/ntb_hw_intel.c
index 87751cfd6f4f..865a3e3cc581 100644
--- a/drivers/ntb/hw/intel/ntb_hw_intel.c
+++ b/drivers/ntb/hw/intel/ntb_hw_intel.c
@@ -190,14 +190,17 @@ static inline int pdev_is_xeon(struct pci_dev *pdev)
         case PCI_DEVICE_ID_INTEL_NTB_SS_SNB:
         case PCI_DEVICE_ID_INTEL_NTB_SS_IVT:
         case PCI_DEVICE_ID_INTEL_NTB_SS_HSX:
+        case PCI_DEVICE_ID_INTEL_NTB_SS_BDX:
         case PCI_DEVICE_ID_INTEL_NTB_PS_JSF:
         case PCI_DEVICE_ID_INTEL_NTB_PS_SNB:
         case PCI_DEVICE_ID_INTEL_NTB_PS_IVT:
         case PCI_DEVICE_ID_INTEL_NTB_PS_HSX:
+        case PCI_DEVICE_ID_INTEL_NTB_PS_BDX:
         case PCI_DEVICE_ID_INTEL_NTB_B2B_JSF:
         case PCI_DEVICE_ID_INTEL_NTB_B2B_SNB:
         case PCI_DEVICE_ID_INTEL_NTB_B2B_IVT:
         case PCI_DEVICE_ID_INTEL_NTB_B2B_HSX:
+        case PCI_DEVICE_ID_INTEL_NTB_B2B_BDX:
                 return 1;
         }
         return 0;
@@ -237,7 +240,7 @@ static inline int ndev_ignore_unsafe(struct intel_ntb_dev *ndev,
 
 static int ndev_mw_to_bar(struct intel_ntb_dev *ndev, int idx)
 {
-        if (idx < 0 || idx > ndev->mw_count)
+        if (idx < 0 || idx >= ndev->mw_count)
                 return -EINVAL;
         return ndev->reg->mw_bar[idx];
 }
@@ -572,10 +575,13 @@ static ssize_t ndev_debugfs_read(struct file *filp, char __user *ubuf,
                          "Connection Topology -\t%s\n",
                          ntb_topo_string(ndev->ntb.topo));
 
-        off += scnprintf(buf + off, buf_size - off,
-                         "B2B Offset -\t\t%#lx\n", ndev->b2b_off);
-        off += scnprintf(buf + off, buf_size - off,
-                         "B2B MW Idx -\t\t%d\n", ndev->b2b_idx);
+        if (ndev->b2b_idx != UINT_MAX) {
+                off += scnprintf(buf + off, buf_size - off,
+                                 "B2B MW Idx -\t\t%u\n", ndev->b2b_idx);
+                off += scnprintf(buf + off, buf_size - off,
+                                 "B2B Offset -\t\t%#lx\n", ndev->b2b_off);
+        }
+
         off += scnprintf(buf + off, buf_size - off,
                          "BAR4 Split -\t\t%s\n",
                          ndev->bar4_split ? "yes" : "no");
@@ -1484,7 +1490,7 @@ static int xeon_setup_b2b_mw(struct intel_ntb_dev *ndev,
         pdev = ndev_pdev(ndev);
         mmio = ndev->self_mmio;
 
-        if (ndev->b2b_idx >= ndev->mw_count) {
+        if (ndev->b2b_idx == UINT_MAX) {
                 dev_dbg(ndev_dev(ndev), "not using b2b mw\n");
                 b2b_bar = 0;
                 ndev->b2b_off = 0;
@@ -1776,6 +1782,13 @@ static int xeon_init_ntb(struct intel_ntb_dev *ndev)
                         else
                                 ndev->b2b_idx = b2b_mw_idx;
 
+                        if (ndev->b2b_idx >= ndev->mw_count) {
+                                dev_dbg(ndev_dev(ndev),
+                                        "b2b_mw_idx %d invalid for mw_count %u\n",
+                                        b2b_mw_idx, ndev->mw_count);
+                                return -EINVAL;
+                        }
+
                         dev_dbg(ndev_dev(ndev),
                                 "setting up b2b mw idx %d means %d\n",
                                 b2b_mw_idx, ndev->b2b_idx);
@@ -1843,6 +1856,9 @@ static int xeon_init_dev(struct intel_ntb_dev *ndev)
         case PCI_DEVICE_ID_INTEL_NTB_SS_HSX:
         case PCI_DEVICE_ID_INTEL_NTB_PS_HSX:
         case PCI_DEVICE_ID_INTEL_NTB_B2B_HSX:
+        case PCI_DEVICE_ID_INTEL_NTB_SS_BDX:
+        case PCI_DEVICE_ID_INTEL_NTB_PS_BDX:
+        case PCI_DEVICE_ID_INTEL_NTB_B2B_BDX:
                 ndev->hwerr_flags |= NTB_HWERR_SDOORBELL_LOCKUP;
                 break;
         }
@@ -1857,6 +1873,9 @@ static int xeon_init_dev(struct intel_ntb_dev *ndev)
         case PCI_DEVICE_ID_INTEL_NTB_SS_HSX:
         case PCI_DEVICE_ID_INTEL_NTB_PS_HSX:
         case PCI_DEVICE_ID_INTEL_NTB_B2B_HSX:
+        case PCI_DEVICE_ID_INTEL_NTB_SS_BDX:
+        case PCI_DEVICE_ID_INTEL_NTB_PS_BDX:
+        case PCI_DEVICE_ID_INTEL_NTB_B2B_BDX:
                 ndev->hwerr_flags |= NTB_HWERR_SB01BASE_LOCKUP;
                 break;
         }
@@ -1878,6 +1897,9 @@ static int xeon_init_dev(struct intel_ntb_dev *ndev)
         case PCI_DEVICE_ID_INTEL_NTB_SS_HSX:
         case PCI_DEVICE_ID_INTEL_NTB_PS_HSX:
         case PCI_DEVICE_ID_INTEL_NTB_B2B_HSX:
+        case PCI_DEVICE_ID_INTEL_NTB_SS_BDX:
+        case PCI_DEVICE_ID_INTEL_NTB_PS_BDX:
+        case PCI_DEVICE_ID_INTEL_NTB_B2B_BDX:
                 ndev->hwerr_flags |= NTB_HWERR_B2BDOORBELL_BIT14;
                 break;
         }
@@ -1996,7 +2018,7 @@ static inline void ndev_init_struct(struct intel_ntb_dev *ndev,
         ndev->ntb.ops = &intel_ntb_ops;
 
         ndev->b2b_off = 0;
-        ndev->b2b_idx = INT_MAX;
+        ndev->b2b_idx = UINT_MAX;
 
         ndev->bar4_split = 0;
 
@@ -2234,14 +2256,17 @@ static const struct pci_device_id intel_ntb_pci_tbl[] = {
         {PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_NTB_B2B_SNB)},
         {PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_NTB_B2B_IVT)},
         {PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_NTB_B2B_HSX)},
+        {PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_NTB_B2B_BDX)},
         {PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_NTB_PS_JSF)},
         {PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_NTB_PS_SNB)},
         {PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_NTB_PS_IVT)},
         {PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_NTB_PS_HSX)},
+        {PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_NTB_PS_BDX)},
         {PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_NTB_SS_JSF)},
         {PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_NTB_SS_SNB)},
         {PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_NTB_SS_IVT)},
         {PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_NTB_SS_HSX)},
+        {PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_NTB_SS_BDX)},
         {0}
 };
 MODULE_DEVICE_TABLE(pci, intel_ntb_pci_tbl);
diff --git a/drivers/ntb/hw/intel/ntb_hw_intel.h b/drivers/ntb/hw/intel/ntb_hw_intel.h
index 7ddaf387b679..ea0612f797df 100644
--- a/drivers/ntb/hw/intel/ntb_hw_intel.h
+++ b/drivers/ntb/hw/intel/ntb_hw_intel.h
@@ -67,6 +67,9 @@
 #define PCI_DEVICE_ID_INTEL_NTB_PS_HSX  0x2F0E
 #define PCI_DEVICE_ID_INTEL_NTB_SS_HSX  0x2F0F
 #define PCI_DEVICE_ID_INTEL_NTB_B2B_BWD 0x0C4E
+#define PCI_DEVICE_ID_INTEL_NTB_B2B_BDX 0x6F0D
+#define PCI_DEVICE_ID_INTEL_NTB_PS_BDX  0x6F0E
+#define PCI_DEVICE_ID_INTEL_NTB_SS_BDX  0x6F0F
 
 /* Intel Xeon hardware */
 
diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c
index 1c6386d5f79c..6e3ee907d186 100644
--- a/drivers/ntb/ntb_transport.c
+++ b/drivers/ntb/ntb_transport.c
@@ -119,7 +119,8 @@ struct ntb_transport_qp {
         struct ntb_transport_ctx *transport;
         struct ntb_dev *ndev;
         void *cb_data;
-        struct dma_chan *dma_chan;
+        struct dma_chan *tx_dma_chan;
+        struct dma_chan *rx_dma_chan;
 
         bool client_ready;
         bool link_is_up;
@@ -297,7 +298,7 @@ static LIST_HEAD(ntb_transport_list);
 
 static int ntb_bus_init(struct ntb_transport_ctx *nt)
 {
-        list_add(&nt->entry, &ntb_transport_list);
+        list_add_tail(&nt->entry, &ntb_transport_list);
         return 0;
 }
 
@@ -452,7 +453,7 @@ static ssize_t debugfs_read(struct file *filp, char __user *ubuf, size_t count,
 
         out_offset = 0;
         out_offset += snprintf(buf + out_offset, out_count - out_offset,
-                               "NTB QP stats\n");
+                               "\nNTB QP stats:\n\n");
         out_offset += snprintf(buf + out_offset, out_count - out_offset,
                                "rx_bytes - \t%llu\n", qp->rx_bytes);
         out_offset += snprintf(buf + out_offset, out_count - out_offset,
@@ -470,11 +471,11 @@ static ssize_t debugfs_read(struct file *filp, char __user *ubuf, size_t count,
         out_offset += snprintf(buf + out_offset, out_count - out_offset,
                                "rx_err_ver - \t%llu\n", qp->rx_err_ver);
         out_offset += snprintf(buf + out_offset, out_count - out_offset,
-                               "rx_buff - \t%p\n", qp->rx_buff);
+                               "rx_buff - \t0x%p\n", qp->rx_buff);
         out_offset += snprintf(buf + out_offset, out_count - out_offset,
                                "rx_index - \t%u\n", qp->rx_index);
         out_offset += snprintf(buf + out_offset, out_count - out_offset,
-                               "rx_max_entry - \t%u\n", qp->rx_max_entry);
+                               "rx_max_entry - \t%u\n\n", qp->rx_max_entry);
 
         out_offset += snprintf(buf + out_offset, out_count - out_offset,
                                "tx_bytes - \t%llu\n", qp->tx_bytes);
@@ -489,15 +490,32 @@ static ssize_t debugfs_read(struct file *filp, char __user *ubuf, size_t count,
         out_offset += snprintf(buf + out_offset, out_count - out_offset,
                                "tx_err_no_buf - %llu\n", qp->tx_err_no_buf);
         out_offset += snprintf(buf + out_offset, out_count - out_offset,
-                               "tx_mw - \t%p\n", qp->tx_mw);
+                               "tx_mw - \t0x%p\n", qp->tx_mw);
         out_offset += snprintf(buf + out_offset, out_count - out_offset,
-                               "tx_index - \t%u\n", qp->tx_index);
+                               "tx_index (H) - \t%u\n", qp->tx_index);
+        out_offset += snprintf(buf + out_offset, out_count - out_offset,
+                               "RRI (T) - \t%u\n",
+                               qp->remote_rx_info->entry);
         out_offset += snprintf(buf + out_offset, out_count - out_offset,
                                "tx_max_entry - \t%u\n", qp->tx_max_entry);
+        out_offset += snprintf(buf + out_offset, out_count - out_offset,
+                               "free tx - \t%u\n",
+                               ntb_transport_tx_free_entry(qp));
 
         out_offset += snprintf(buf + out_offset, out_count - out_offset,
-                               "\nQP Link %s\n",
+                               "\n");
+        out_offset += snprintf(buf + out_offset, out_count - out_offset,
+                               "Using TX DMA - \t%s\n",
+                               qp->tx_dma_chan ? "Yes" : "No");
+        out_offset += snprintf(buf + out_offset, out_count - out_offset,
+                               "Using RX DMA - \t%s\n",
+                               qp->rx_dma_chan ? "Yes" : "No");
+        out_offset += snprintf(buf + out_offset, out_count - out_offset,
+                               "QP Link - \t%s\n",
                                qp->link_is_up ? "Up" : "Down");
+        out_offset += snprintf(buf + out_offset, out_count - out_offset,
+                               "\n");
+
         if (out_offset > out_count)
                 out_offset = out_count;
 
@@ -535,6 +553,7 @@ static struct ntb_queue_entry *ntb_list_rm(spinlock_t *lock,
         }
         entry = list_first_entry(list, struct ntb_queue_entry, entry);
         list_del(&entry->entry);
+
 out:
         spin_unlock_irqrestore(lock, flags);
 
@@ -1206,7 +1225,7 @@ static void ntb_async_rx(struct ntb_queue_entry *entry, void *offset)
 {
         struct dma_async_tx_descriptor *txd;
         struct ntb_transport_qp *qp = entry->qp;
-        struct dma_chan *chan = qp->dma_chan;
+        struct dma_chan *chan = qp->rx_dma_chan;
         struct dma_device *device;
         size_t pay_off, buff_off, len;
         struct dmaengine_unmap_data *unmap;
@@ -1219,18 +1238,18 @@ static void ntb_async_rx(struct ntb_queue_entry *entry, void *offset)
                 goto err;
 
         if (len < copy_bytes)
-                goto err_wait;
+                goto err;
 
         device = chan->device;
         pay_off = (size_t)offset & ~PAGE_MASK;
         buff_off = (size_t)buf & ~PAGE_MASK;
 
         if (!is_dma_copy_aligned(device, pay_off, buff_off, len))
-                goto err_wait;
+                goto err;
 
         unmap = dmaengine_get_unmap_data(device->dev, 2, GFP_NOWAIT);
         if (!unmap)
-                goto err_wait;
+                goto err;
 
         unmap->len = len;
         unmap->addr[0] = dma_map_page(device->dev, virt_to_page(offset),
@@ -1273,12 +1292,6 @@ err_set_unmap:
         dmaengine_unmap_put(unmap);
 err_get_unmap:
         dmaengine_unmap_put(unmap);
-err_wait:
-        /* If the callbacks come out of order, the writing of the index to the
-         * last completed will be out of order.  This may result in the
-         * receive stalling forever.
-         */
-        dma_sync_wait(chan, qp->last_cookie);
 err:
         ntb_memcpy_rx(entry, offset);
         qp->rx_memcpy++;
@@ -1373,8 +1386,8 @@ static void ntb_transport_rxc_db(unsigned long data)
                         break;
         }
 
-        if (i && qp->dma_chan)
-                dma_async_issue_pending(qp->dma_chan);
+        if (i && qp->rx_dma_chan)
+                dma_async_issue_pending(qp->rx_dma_chan);
 
         if (i == qp->rx_max_entry) {
                 /* there is more work to do */
@@ -1441,7 +1454,7 @@ static void ntb_async_tx(struct ntb_transport_qp *qp,
 {
         struct ntb_payload_header __iomem *hdr;
         struct dma_async_tx_descriptor *txd;
-        struct dma_chan *chan = qp->dma_chan;
+        struct dma_chan *chan = qp->tx_dma_chan;
         struct dma_device *device;
         size_t dest_off, buff_off;
         struct dmaengine_unmap_data *unmap;
@@ -1634,14 +1647,27 @@ ntb_transport_create_queue(void *data, struct device *client_dev,
         dma_cap_set(DMA_MEMCPY, dma_mask);
 
         if (use_dma) {
-                qp->dma_chan = dma_request_channel(dma_mask, ntb_dma_filter_fn,
-                                                   (void *)(unsigned long)node);
-                if (!qp->dma_chan)
-                        dev_info(&pdev->dev, "Unable to allocate DMA channel\n");
+                qp->tx_dma_chan =
+                        dma_request_channel(dma_mask, ntb_dma_filter_fn,
+                                            (void *)(unsigned long)node);
+                if (!qp->tx_dma_chan)
+                        dev_info(&pdev->dev, "Unable to allocate TX DMA channel\n");
+
+                qp->rx_dma_chan =
+                        dma_request_channel(dma_mask, ntb_dma_filter_fn,
+                                            (void *)(unsigned long)node);
+                if (!qp->rx_dma_chan)
+                        dev_info(&pdev->dev, "Unable to allocate RX DMA channel\n");
         } else {
-                qp->dma_chan = NULL;
+                qp->tx_dma_chan = NULL;
+                qp->rx_dma_chan = NULL;
         }
-        dev_dbg(&pdev->dev, "Using %s memcpy\n", qp->dma_chan ? "DMA" : "CPU");
+
+        dev_dbg(&pdev->dev, "Using %s memcpy for TX\n",
+                qp->tx_dma_chan ? "DMA" : "CPU");
+
+        dev_dbg(&pdev->dev, "Using %s memcpy for RX\n",
+                qp->rx_dma_chan ? "DMA" : "CPU");
 
         for (i = 0; i < NTB_QP_DEF_NUM_ENTRIES; i++) {
                 entry = kzalloc_node(sizeof(*entry), GFP_ATOMIC, node);
@@ -1676,8 +1702,10 @@ err2:
 err1:
         while ((entry = ntb_list_rm(&qp->ntb_rx_q_lock, &qp->rx_free_q)))
                 kfree(entry);
-        if (qp->dma_chan)
-                dma_release_channel(qp->dma_chan);
+        if (qp->tx_dma_chan)
+                dma_release_channel(qp->tx_dma_chan);
+        if (qp->rx_dma_chan)
+                dma_release_channel(qp->rx_dma_chan);
         nt->qp_bitmap_free |= qp_bit;
 err:
         return NULL;
@@ -1701,12 +1729,27 @@ void ntb_transport_free_queue(struct ntb_transport_qp *qp)
 
         pdev = qp->ndev->pdev;
 
-        if (qp->dma_chan) {
-                struct dma_chan *chan = qp->dma_chan;
+        if (qp->tx_dma_chan) {
+                struct dma_chan *chan = qp->tx_dma_chan;
+                /* Putting the dma_chan to NULL will force any new traffic to be
+                 * processed by the CPU instead of the DAM engine
+                 */
+                qp->tx_dma_chan = NULL;
+
+                /* Try to be nice and wait for any queued DMA engine
+                 * transactions to process before smashing it with a rock
+                 */
+                dma_sync_wait(chan, qp->last_cookie);
+                dmaengine_terminate_all(chan);
+                dma_release_channel(chan);
+        }
+
+        if (qp->rx_dma_chan) {
+                struct dma_chan *chan = qp->rx_dma_chan;
                 /* Putting the dma_chan to NULL will force any new traffic to be
                  * processed by the CPU instead of the DAM engine
                  */
-                qp->dma_chan = NULL;
+                qp->rx_dma_chan = NULL;
 
                 /* Try to be nice and wait for any queued DMA engine
                  * transactions to process before smashing it with a rock
@@ -1843,7 +1886,7 @@ int ntb_transport_tx_enqueue(struct ntb_transport_qp *qp, void *cb, void *data,
         entry = ntb_list_rm(&qp->ntb_tx_free_q_lock, &qp->tx_free_q);
         if (!entry) {
                 qp->tx_err_no_buf++;
-                return -ENOMEM;
+                return -EBUSY;
         }
 
         entry->cb_data = cb;
@@ -1954,21 +1997,34 @@ EXPORT_SYMBOL_GPL(ntb_transport_qp_num);
 unsigned int ntb_transport_max_size(struct ntb_transport_qp *qp)
 {
         unsigned int max;
+        unsigned int copy_align;
 
         if (!qp)
                 return 0;
 
-        if (!qp->dma_chan)
+        if (!qp->tx_dma_chan && !qp->rx_dma_chan)
                 return qp->tx_max_frame - sizeof(struct ntb_payload_header);
 
+        copy_align = max(qp->tx_dma_chan->device->copy_align,
+                         qp->rx_dma_chan->device->copy_align);
+
         /* If DMA engine usage is possible, try to find the max size for that */
         max = qp->tx_max_frame - sizeof(struct ntb_payload_header);
-        max -= max % (1 << qp->dma_chan->device->copy_align);
+        max -= max % (1 << copy_align);
 
         return max;
 }
 EXPORT_SYMBOL_GPL(ntb_transport_max_size);
 
+unsigned int ntb_transport_tx_free_entry(struct ntb_transport_qp *qp)
+{
+        unsigned int head = qp->tx_index;
+        unsigned int tail = qp->remote_rx_info->entry;
+
+        return tail > head ? tail - head : qp->tx_max_entry + tail - head;
+}
+EXPORT_SYMBOL_GPL(ntb_transport_tx_free_entry);
+
 static void ntb_transport_doorbell_callback(void *data, int vector)
 {
         struct ntb_transport_ctx *nt = data;
diff --git a/drivers/nvdimm/btt_devs.c b/drivers/nvdimm/btt_devs.c
index 59ad54a63d9f..cb477518dd0e 100644
--- a/drivers/nvdimm/btt_devs.c
+++ b/drivers/nvdimm/btt_devs.c
@@ -128,13 +128,13 @@ static ssize_t namespace_store(struct device *dev,
         struct nd_btt *nd_btt = to_nd_btt(dev);
         ssize_t rc;
 
-        nvdimm_bus_lock(dev);
         device_lock(dev);
+        nvdimm_bus_lock(dev);
         rc = nd_namespace_store(dev, &nd_btt->ndns, buf, len);
         dev_dbg(dev, "%s: result: %zd wrote: %s%s", __func__,
                         rc, buf, buf[len - 1] == '\n' ? "" : "\n");
-        device_unlock(dev);
         nvdimm_bus_unlock(dev);
+        device_unlock(dev);
 
         return rc;
 }
diff --git a/drivers/nvdimm/pfn_devs.c b/drivers/nvdimm/pfn_devs.c
index 3fd7d0d81a47..71805a1aa0f3 100644
--- a/drivers/nvdimm/pfn_devs.c
+++ b/drivers/nvdimm/pfn_devs.c
@@ -148,13 +148,13 @@ static ssize_t namespace_store(struct device *dev,
         struct nd_pfn *nd_pfn = to_nd_pfn(dev);
         ssize_t rc;
 
-        nvdimm_bus_lock(dev);
         device_lock(dev);
+        nvdimm_bus_lock(dev);
         rc = nd_namespace_store(dev, &nd_pfn->ndns, buf, len);
         dev_dbg(dev, "%s: result: %zd wrote: %s%s", __func__,
                         rc, buf, buf[len - 1] == '\n' ? "" : "\n");
-        device_unlock(dev);
         nvdimm_bus_unlock(dev);
+        device_unlock(dev);
 
         return rc;
 }
diff --git a/drivers/nvdimm/pmem.c b/drivers/nvdimm/pmem.c
index b9525385c0dc..0ba6a978f227 100644
--- a/drivers/nvdimm/pmem.c
+++ b/drivers/nvdimm/pmem.c
@@ -92,6 +92,8 @@ static int pmem_rw_page(struct block_device *bdev, sector_t sector,
         struct pmem_device *pmem = bdev->bd_disk->private_data;
 
         pmem_do_bvec(pmem, page, PAGE_CACHE_SIZE, 0, rw, sector);
+        if (rw & WRITE)
+                wmb_pmem();
         page_endio(page, rw & WRITE, 0);
 
         return 0;
diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c
index 1350fa25cdb0..a87a868fed64 100644
--- a/drivers/of/of_mdio.c
+++ b/drivers/of/of_mdio.c
@@ -197,7 +197,8 @@ static int of_phy_match(struct device *dev, void *phy_np)
  * of_phy_find_device - Give a PHY node, find the phy_device
  * @phy_np: Pointer to the phy's device tree node
  *
- * Returns a pointer to the phy_device.
+ * If successful, returns a pointer to the phy_device with the embedded
+ * struct device refcount incremented by one, or NULL on failure.
  */
 struct phy_device *of_phy_find_device(struct device_node *phy_np)
 {
@@ -217,7 +218,9 @@ EXPORT_SYMBOL(of_phy_find_device);
  * @hndlr: Link state callback for the network device
  * @iface: PHY data interface type
  *
- * Returns a pointer to the phy_device if successful.  NULL otherwise
+ * If successful, returns a pointer to the phy_device with the embedded
+ * struct device refcount incremented by one, or NULL on failure. The
+ * refcount must be dropped by calling phy_disconnect() or phy_detach().
  */
 struct phy_device *of_phy_connect(struct net_device *dev,
                                   struct device_node *phy_np,
@@ -225,13 +228,19 @@ struct phy_device *of_phy_connect(struct net_device *dev,
                                   phy_interface_t iface)
 {
         struct phy_device *phy = of_phy_find_device(phy_np);
+        int ret;
 
         if (!phy)
                 return NULL;
 
         phy->dev_flags = flags;
 
-        return phy_connect_direct(dev, phy, hndlr, iface) ? NULL : phy;
+        ret = phy_connect_direct(dev, phy, hndlr, iface);
+
+        /* refcount is held by phy_connect_direct() on success */
+        put_device(&phy->dev);
+
+        return ret ? NULL : phy;
 }
 EXPORT_SYMBOL(of_phy_connect);
 
@@ -241,17 +250,27 @@ EXPORT_SYMBOL(of_phy_connect);
  * @phy_np: Node pointer for the PHY
  * @flags: flags to pass to the PHY
  * @iface: PHY data interface type
+ *
+ * If successful, returns a pointer to the phy_device with the embedded
+ * struct device refcount incremented by one, or NULL on failure. The
+ * refcount must be dropped by calling phy_disconnect() or phy_detach().
  */
 struct phy_device *of_phy_attach(struct net_device *dev,
                                  struct device_node *phy_np, u32 flags,
                                  phy_interface_t iface)
 {
         struct phy_device *phy = of_phy_find_device(phy_np);
+        int ret;
 
         if (!phy)
                 return NULL;
 
-        return phy_attach_direct(dev, phy, flags, iface) ? NULL : phy;
+        ret = phy_attach_direct(dev, phy, flags, iface);
+
+        /* refcount is held by phy_attach_direct() on success */
+        put_device(&phy->dev);
+
+        return ret ? NULL : phy;
 }
 EXPORT_SYMBOL(of_phy_attach);
 
diff --git a/drivers/of/of_pci_irq.c b/drivers/of/of_pci_irq.c
index 1710d9dc7fc2..2306313c0029 100644
--- a/drivers/of/of_pci_irq.c
+++ b/drivers/of/of_pci_irq.c
@@ -38,8 +38,8 @@ int of_irq_parse_pci(const struct pci_dev *pdev, struct of_phandle_args *out_irq
          */
         rc = pci_read_config_byte(pdev, PCI_INTERRUPT_PIN, &pin);
         if (rc != 0)
-                return rc;
-        /* No pin, exit */
+                goto err;
+        /* No pin, exit with no error message. */
         if (pin == 0)
                 return -ENODEV;
 
@@ -53,8 +53,10 @@ int of_irq_parse_pci(const struct pci_dev *pdev, struct of_phandle_args *out_irq
                         ppnode = pci_bus_to_OF_node(pdev->bus);
 
                         /* No node for host bridge ? give up */
-                        if (ppnode == NULL)
-                                return -EINVAL;
+                        if (ppnode == NULL) {
+                                rc = -EINVAL;
+                                goto err;
+                        }
                 } else {
                         /* We found a P2P bridge, check if it has a node */
                         ppnode = pci_device_to_OF_node(ppdev);
@@ -86,7 +88,13 @@ int of_irq_parse_pci(const struct pci_dev *pdev, struct of_phandle_args *out_irq
         out_irq->args[0] = pin;
         laddr[0] = cpu_to_be32((pdev->bus->number << 16) | (pdev->devfn << 8));
         laddr[1] = laddr[2] = cpu_to_be32(0);
-        return of_irq_parse_raw(laddr, out_irq);
+        rc = of_irq_parse_raw(laddr, out_irq);
+        if (rc)
+                goto err;
+        return 0;
+err:
+        dev_err(&pdev->dev, "of_irq_parse_pci() failed with rc=%d\n", rc);
+        return rc;
 }
 EXPORT_SYMBOL_GPL(of_irq_parse_pci);
 
@@ -105,10 +113,8 @@ int of_irq_parse_and_map_pci(const struct pci_dev *dev, u8 slot, u8 pin)
         int ret;
 
         ret = of_irq_parse_pci(dev, &oirq);
-        if (ret) {
-                dev_err(&dev->dev, "of_irq_parse_pci() failed with rc=%d\n", ret);
+        if (ret)
                 return 0; /* Proper return code 0 == NO_IRQ */
-        }
 
         return irq_create_of_mapping(&oirq);
 }
diff --git a/drivers/parisc/dino.c b/drivers/parisc/dino.c
index baec33c4e698..a0580afe1713 100644
--- a/drivers/parisc/dino.c
+++ b/drivers/parisc/dino.c
@@ -560,6 +560,9 @@ dino_fixup_bus(struct pci_bus *bus)
         } else if (bus->parent) {
                 int i;
 
+                pci_read_bridge_bases(bus);
+
+
                 for(i = PCI_BRIDGE_RESOURCES; i < PCI_NUM_RESOURCES; i++) {
                         if((bus->self->resource[i].flags & 
                             (IORESOURCE_IO | IORESOURCE_MEM)) == 0)
diff --git a/drivers/parisc/lba_pci.c b/drivers/parisc/lba_pci.c
index 7b9e89ba0465..a32c1f6c252c 100644
--- a/drivers/parisc/lba_pci.c
+++ b/drivers/parisc/lba_pci.c
@@ -693,6 +693,7 @@ lba_fixup_bus(struct pci_bus *bus)
         if (bus->parent) {
                 int i;
                 /* PCI-PCI Bridge */
+                pci_read_bridge_bases(bus);
                 for (i = PCI_BRIDGE_RESOURCES; i < PCI_NUM_RESOURCES; i++)
                         pci_claim_bridge_resource(bus->self, i);
         } else {
diff --git a/drivers/pci/access.c b/drivers/pci/access.c
index 769f7e35f1a2..59ac36fe7c42 100644
--- a/drivers/pci/access.c
+++ b/drivers/pci/access.c
@@ -442,7 +442,8 @@ static const struct pci_vpd_ops pci_vpd_pci22_ops = {
 static ssize_t pci_vpd_f0_read(struct pci_dev *dev, loff_t pos, size_t count,
                                void *arg)
 {
-        struct pci_dev *tdev = pci_get_slot(dev->bus, PCI_SLOT(dev->devfn));
+        struct pci_dev *tdev = pci_get_slot(dev->bus,
+                                            PCI_DEVFN(PCI_SLOT(dev->devfn), 0));
         ssize_t ret;
 
         if (!tdev)
@@ -456,7 +457,8 @@ static ssize_t pci_vpd_f0_read(struct pci_dev *dev, loff_t pos, size_t count,
 static ssize_t pci_vpd_f0_write(struct pci_dev *dev, loff_t pos, size_t count,
                                 const void *arg)
 {
-        struct pci_dev *tdev = pci_get_slot(dev->bus, PCI_SLOT(dev->devfn));
+        struct pci_dev *tdev = pci_get_slot(dev->bus,
+                                            PCI_DEVFN(PCI_SLOT(dev->devfn), 0));
         ssize_t ret;
 
         if (!tdev)
@@ -473,22 +475,6 @@ static const struct pci_vpd_ops pci_vpd_f0_ops = {
         .release = pci_vpd_pci22_release,
 };
 
-static int pci_vpd_f0_dev_check(struct pci_dev *dev)
-{
-        struct pci_dev *tdev = pci_get_slot(dev->bus, PCI_SLOT(dev->devfn));
-        int ret = 0;
-
-        if (!tdev)
-                return -ENODEV;
-        if (!tdev->vpd || !tdev->multifunction ||
-            dev->class != tdev->class || dev->vendor != tdev->vendor ||
-            dev->device != tdev->device)
-                ret = -ENODEV;
-
-        pci_dev_put(tdev);
-        return ret;
-}
-
 int pci_vpd_pci22_init(struct pci_dev *dev)
 {
         struct pci_vpd_pci22 *vpd;
@@ -497,12 +483,7 @@ int pci_vpd_pci22_init(struct pci_dev *dev)
         cap = pci_find_capability(dev, PCI_CAP_ID_VPD);
         if (!cap)
                 return -ENODEV;
-        if (dev->dev_flags & PCI_DEV_FLAGS_VPD_REF_F0) {
-                int ret = pci_vpd_f0_dev_check(dev);
 
-                if (ret)
-                        return ret;
-        }
         vpd = kzalloc(sizeof(*vpd), GFP_ATOMIC);
         if (!vpd)
                 return -ENOMEM;
diff --git a/drivers/pci/bus.c b/drivers/pci/bus.c
index 6fbd3f2b5992..d3346d23963b 100644
--- a/drivers/pci/bus.c
+++ b/drivers/pci/bus.c
@@ -256,6 +256,8 @@ bool pci_bus_clip_resource(struct pci_dev *dev, int idx)
 
                 res->start = start;
                 res->end = end;
+                res->flags &= ~IORESOURCE_UNSET;
+                orig_res.flags &= ~IORESOURCE_UNSET;
                 dev_printk(KERN_DEBUG, &dev->dev, "%pR clipped to %pR\n",
                                  &orig_res, res);
 
diff --git a/drivers/pci/host/pci-keystone.c b/drivers/pci/host/pci-keystone.c
index 81253e70b1c5..0aa81bd3de12 100644
--- a/drivers/pci/host/pci-keystone.c
+++ b/drivers/pci/host/pci-keystone.c
@@ -110,7 +110,7 @@ static int ks_pcie_establish_link(struct keystone_pcie *ks_pcie)
         return -EINVAL;
 }
 
-static void ks_pcie_msi_irq_handler(unsigned int __irq, struct irq_desc *desc)
+static void ks_pcie_msi_irq_handler(struct irq_desc *desc)
 {
         unsigned int irq = irq_desc_get_irq(desc);
         struct keystone_pcie *ks_pcie = irq_desc_get_handler_data(desc);
@@ -138,8 +138,7 @@ static void ks_pcie_msi_irq_handler(unsigned int __irq, struct irq_desc *desc)
  * Traverse through pending legacy interrupts and invoke handler for each. Also
  * takes care of interrupt controller level mask/ack operation.
  */
-static void ks_pcie_legacy_irq_handler(unsigned int __irq,
-                                       struct irq_desc *desc)
+static void ks_pcie_legacy_irq_handler(struct irq_desc *desc)
 {
         unsigned int irq = irq_desc_get_irq(desc);
         struct keystone_pcie *ks_pcie = irq_desc_get_handler_data(desc);
diff --git a/drivers/pci/host/pci-rcar-gen2.c b/drivers/pci/host/pci-rcar-gen2.c
index 367e28fa7564..c4f64bfee551 100644
--- a/drivers/pci/host/pci-rcar-gen2.c
+++ b/drivers/pci/host/pci-rcar-gen2.c
@@ -362,6 +362,7 @@ static int rcar_pci_probe(struct platform_device *pdev)
 static struct of_device_id rcar_pci_of_match[] = {
         { .compatible = "renesas,pci-r8a7790", },
         { .compatible = "renesas,pci-r8a7791", },
+        { .compatible = "renesas,pci-r8a7794", },
         { },
 };
 
diff --git a/drivers/pci/host/pci-xgene-msi.c b/drivers/pci/host/pci-xgene-msi.c
index 996327cfa1e1..e491681daf22 100644
--- a/drivers/pci/host/pci-xgene-msi.c
+++ b/drivers/pci/host/pci-xgene-msi.c
@@ -295,7 +295,7 @@ static int xgene_msi_init_allocator(struct xgene_msi *xgene_msi)
         return 0;
 }
 
-static void xgene_msi_isr(unsigned int irq, struct irq_desc *desc)
+static void xgene_msi_isr(struct irq_desc *desc)
 {
         struct irq_chip *chip = irq_desc_get_chip(desc);
         struct xgene_msi_group *msi_groups;
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index 0b2be174d981..8361d27e5eca 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -676,15 +676,20 @@ static struct irq_domain *pci_host_bridge_msi_domain(struct pci_bus *bus)
 static void pci_set_bus_msi_domain(struct pci_bus *bus)
 {
         struct irq_domain *d;
+        struct pci_bus *b;
 
         /*
-         * Either bus is the root, and we must obtain it from the
-         * firmware, or we inherit it from the bridge device.
+         * The bus can be a root bus, a subordinate bus, or a virtual bus
+         * created by an SR-IOV device.  Walk up to the first bridge device
+         * found or derive the domain from the host bridge.
          */
-        if (pci_is_root_bus(bus))
-                d = pci_host_bridge_msi_domain(bus);
-        else
-                d = dev_get_msi_domain(&bus->self->dev);
+        for (b = bus, d = NULL; !d && !pci_is_root_bus(b); b = b->parent) {
+                if (b->self)
+                        d = dev_get_msi_domain(&b->self->dev);
+        }
+
+        if (!d)
+                d = pci_host_bridge_msi_domain(b);
 
         dev_set_msi_domain(&bus->dev, d);
 }
@@ -855,9 +860,6 @@ int pci_scan_bridge(struct pci_bus *bus, struct pci_dev *dev, int max, int pass)
                         child->bridge_ctl = bctl;
                 }
 
-                /* Read and initialize bridge resources */
-                pci_read_bridge_bases(child);
-
                 cmax = pci_scan_child_bus(child);
                 if (cmax > subordinate)
                         dev_warn(&dev->dev, "bridge has subordinate %02x but max busn %02x\n",
@@ -918,9 +920,6 @@ int pci_scan_bridge(struct pci_bus *bus, struct pci_dev *dev, int max, int pass)
 
                 if (!is_cardbus) {
                         child->bridge_ctl = bctl;
-
-                        /* Read and initialize bridge resources */
-                        pci_read_bridge_bases(child);
                         max = pci_scan_child_bus(child);
                 } else {
                         /*
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 6a30252cd79f..b03373fd05ca 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -1907,11 +1907,27 @@ static void quirk_netmos(struct pci_dev *dev)
 DECLARE_PCI_FIXUP_CLASS_HEADER(PCI_VENDOR_ID_NETMOS, PCI_ANY_ID,
                          PCI_CLASS_COMMUNICATION_SERIAL, 8, quirk_netmos);
 
+/*
+ * Quirk non-zero PCI functions to route VPD access through function 0 for
+ * devices that share VPD resources between functions.  The functions are
+ * expected to be identical devices.
+ */
 static void quirk_f0_vpd_link(struct pci_dev *dev)
 {
-        if (!dev->multifunction || !PCI_FUNC(dev->devfn))
+        struct pci_dev *f0;
+
+        if (!PCI_FUNC(dev->devfn))
                 return;
-        dev->dev_flags |= PCI_DEV_FLAGS_VPD_REF_F0;
+
+        f0 = pci_get_slot(dev->bus, PCI_DEVFN(PCI_SLOT(dev->devfn), 0));
+        if (!f0)
+                return;
+
+        if (f0->vpd && dev->class == f0->class &&
+            dev->vendor == f0->vendor && dev->device == f0->device)
+                dev->dev_flags |= PCI_DEV_FLAGS_VPD_REF_F0;
+
+        pci_dev_put(f0);
 }
 DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, PCI_ANY_ID,
                               PCI_CLASS_NETWORK_ETHERNET, 8, quirk_f0_vpd_link);
diff --git a/drivers/pinctrl/bcm/pinctrl-cygnus-gpio.c b/drivers/pinctrl/bcm/pinctrl-cygnus-gpio.c
index 7d9482bf8252..1ca783098e47 100644
--- a/drivers/pinctrl/bcm/pinctrl-cygnus-gpio.c
+++ b/drivers/pinctrl/bcm/pinctrl-cygnus-gpio.c
@@ -143,7 +143,7 @@ static inline bool cygnus_get_bit(struct cygnus_gpio *chip, unsigned int reg,
         return !!(readl(chip->base + offset) & BIT(shift));
 }
 
-static void cygnus_gpio_irq_handler(unsigned int irq, struct irq_desc *desc)
+static void cygnus_gpio_irq_handler(struct irq_desc *desc)
 {
         struct gpio_chip *gc = irq_desc_get_handler_data(desc);
         struct cygnus_gpio *chip = to_cygnus_gpio(gc);
diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c
index 69723e07036b..9638a00c67c2 100644
--- a/drivers/pinctrl/core.c
+++ b/drivers/pinctrl/core.c
@@ -349,6 +349,9 @@ static bool pinctrl_ready_for_gpio_range(unsigned gpio)
         struct pinctrl_gpio_range *range = NULL;
         struct gpio_chip *chip = gpio_to_chip(gpio);
 
+        if (WARN(!chip, "no gpio_chip for gpio%i?", gpio))
+                return false;
+
         mutex_lock(&pinctrldev_list_mutex);
 
         /* Loop over the pin controllers */
diff --git a/drivers/pinctrl/intel/pinctrl-baytrail.c b/drivers/pinctrl/intel/pinctrl-baytrail.c
index dac4865f3203..f79ea430f651 100644
--- a/drivers/pinctrl/intel/pinctrl-baytrail.c
+++ b/drivers/pinctrl/intel/pinctrl-baytrail.c
@@ -425,7 +425,7 @@ static void byt_gpio_dbg_show(struct seq_file *s, struct gpio_chip *chip)
         }
 }
 
-static void byt_gpio_irq_handler(unsigned irq, struct irq_desc *desc)
+static void byt_gpio_irq_handler(struct irq_desc *desc)
 {
         struct irq_data *data = irq_desc_get_irq_data(desc);
         struct byt_gpio *vg = to_byt_gpio(irq_desc_get_handler_data(desc));
diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
index 2d5d3ddc36e5..270c127e03ea 100644
--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
+++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
@@ -1414,7 +1414,7 @@ static struct irq_chip chv_gpio_irqchip = {
         .flags = IRQCHIP_SKIP_SET_WAKE,
 };
 
-static void chv_gpio_irq_handler(unsigned irq, struct irq_desc *desc)
+static void chv_gpio_irq_handler(struct irq_desc *desc)
 {
         struct gpio_chip *gc = irq_desc_get_handler_data(desc);
         struct chv_pinctrl *pctrl = gpiochip_to_pinctrl(gc);
diff --git a/drivers/pinctrl/intel/pinctrl-intel.c b/drivers/pinctrl/intel/pinctrl-intel.c
index bb377c110541..54848b8decef 100644
--- a/drivers/pinctrl/intel/pinctrl-intel.c
+++ b/drivers/pinctrl/intel/pinctrl-intel.c
@@ -836,7 +836,7 @@ static void intel_gpio_community_irq_handler(struct gpio_chip *gc,
         }
 }
 
-static void intel_gpio_irq_handler(unsigned irq, struct irq_desc *desc)
+static void intel_gpio_irq_handler(struct irq_desc *desc)
 {
         struct gpio_chip *gc = irq_desc_get_handler_data(desc);
         struct intel_pinctrl *pctrl = gpiochip_to_pinctrl(gc);
diff --git a/drivers/pinctrl/mediatek/pinctrl-mtk-common.c b/drivers/pinctrl/mediatek/pinctrl-mtk-common.c
index 7726c6caaf83..1b22f96ba839 100644
--- a/drivers/pinctrl/mediatek/pinctrl-mtk-common.c
+++ b/drivers/pinctrl/mediatek/pinctrl-mtk-common.c
@@ -1190,7 +1190,7 @@ mtk_eint_debounce_process(struct mtk_pinctrl *pctl, int index)
         }
 }
 
-static void mtk_eint_irq_handler(unsigned irq, struct irq_desc *desc)
+static void mtk_eint_irq_handler(struct irq_desc *desc)
 {
         struct irq_chip *chip = irq_desc_get_chip(desc);
         struct mtk_pinctrl *pctl = irq_desc_get_handler_data(desc);
diff --git a/drivers/pinctrl/nomadik/pinctrl-nomadik.c b/drivers/pinctrl/nomadik/pinctrl-nomadik.c
index 352ede13a9e9..96cf03908e93 100644
--- a/drivers/pinctrl/nomadik/pinctrl-nomadik.c
+++ b/drivers/pinctrl/nomadik/pinctrl-nomadik.c
@@ -860,7 +860,7 @@ static void __nmk_gpio_irq_handler(struct irq_desc *desc, u32 status)
         chained_irq_exit(host_chip, desc);
 }
 
-static void nmk_gpio_irq_handler(unsigned int irq, struct irq_desc *desc)
+static void nmk_gpio_irq_handler(struct irq_desc *desc)
 {
         struct gpio_chip *chip = irq_desc_get_handler_data(desc);
         struct nmk_gpio_chip *nmk_chip = container_of(chip, struct nmk_gpio_chip, chip);
@@ -873,7 +873,7 @@ static void nmk_gpio_irq_handler(unsigned int irq, struct irq_desc *desc)
         __nmk_gpio_irq_handler(desc, status);
 }
 
-static void nmk_gpio_latent_irq_handler(unsigned int irq, struct irq_desc *desc)
+static void nmk_gpio_latent_irq_handler(struct irq_desc *desc)
 {
         struct gpio_chip *chip = irq_desc_get_handler_data(desc);
         struct nmk_gpio_chip *nmk_chip = container_of(chip, struct nmk_gpio_chip, chip);
diff --git a/drivers/pinctrl/pinctrl-adi2.c b/drivers/pinctrl/pinctrl-adi2.c
index a5976ebc4482..f6be68518c87 100644
--- a/drivers/pinctrl/pinctrl-adi2.c
+++ b/drivers/pinctrl/pinctrl-adi2.c
@@ -530,8 +530,7 @@ static inline void preflow_handler(struct irq_desc *desc)
 static inline void preflow_handler(struct irq_desc *desc) { }
 #endif
 
-static void adi_gpio_handle_pint_irq(unsigned int inta_irq,
-                        struct irq_desc *desc)
+static void adi_gpio_handle_pint_irq(struct irq_desc *desc)
 {
         u32 request;
         u32 level_mask, hwirq;
diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c
index 5e86bb8ca80e..3318f1d6193c 100644
--- a/drivers/pinctrl/pinctrl-amd.c
+++ b/drivers/pinctrl/pinctrl-amd.c
@@ -492,15 +492,15 @@ static struct irq_chip amd_gpio_irqchip = {
         .irq_set_type = amd_gpio_irq_set_type,
 };
 
-static void amd_gpio_irq_handler(unsigned int __irq, struct irq_desc *desc)
+static void amd_gpio_irq_handler(struct irq_desc *desc)
 {
-        unsigned int irq = irq_desc_get_irq(desc);
         u32 i;
         u32 off;
         u32 reg;
         u32 pin_reg;
         u64 reg64;
         int handled = 0;
+        unsigned int irq;
         unsigned long flags;
         struct irq_chip *chip = irq_desc_get_chip(desc);
         struct gpio_chip *gc = irq_desc_get_handler_data(desc);
@@ -541,7 +541,7 @@ static void amd_gpio_irq_handler(unsigned int __irq, struct irq_desc *desc)
         }
 
         if (handled == 0)
-                handle_bad_irq(irq, desc);
+                handle_bad_irq(desc);
 
         spin_lock_irqsave(&gpio_dev->lock, flags);
         reg = readl(gpio_dev->base + WAKE_INT_MASTER_REG);
diff --git a/drivers/pinctrl/pinctrl-at91.c b/drivers/pinctrl/pinctrl-at91.c
index bae0012ee356..b0fde0f385e6 100644
--- a/drivers/pinctrl/pinctrl-at91.c
+++ b/drivers/pinctrl/pinctrl-at91.c
@@ -1585,7 +1585,7 @@ static struct irq_chip gpio_irqchip = {
         .irq_set_wake   = gpio_irq_set_wake,
 };
 
-static void gpio_irq_handler(unsigned irq, struct irq_desc *desc)
+static void gpio_irq_handler(struct irq_desc *desc)
 {
         struct irq_chip *chip = irq_desc_get_chip(desc);
         struct gpio_chip *gpio_chip = irq_desc_get_handler_data(desc);
diff --git a/drivers/pinctrl/pinctrl-coh901.c b/drivers/pinctrl/pinctrl-coh901.c
index 3731cc67a88b..9c9b88934bcc 100644
--- a/drivers/pinctrl/pinctrl-coh901.c
+++ b/drivers/pinctrl/pinctrl-coh901.c
@@ -519,7 +519,7 @@ static struct irq_chip u300_gpio_irqchip = {
         .irq_set_type           = u300_gpio_irq_type,
 };
 
-static void u300_gpio_irq_handler(unsigned __irq, struct irq_desc *desc)
+static void u300_gpio_irq_handler(struct irq_desc *desc)
 {
         unsigned int irq = irq_desc_get_irq(desc);
         struct irq_chip *parent_chip = irq_desc_get_chip(desc);
diff --git a/drivers/pinctrl/pinctrl-digicolor.c b/drivers/pinctrl/pinctrl-digicolor.c
index 461fffc4c62a..11f8b835d3b6 100644
--- a/drivers/pinctrl/pinctrl-digicolor.c
+++ b/drivers/pinctrl/pinctrl-digicolor.c
@@ -337,9 +337,9 @@ static int dc_pinctrl_probe(struct platform_device *pdev)
         pmap->dev = &pdev->dev;
 
         pmap->pctl = pinctrl_register(pctl_desc, &pdev->dev, pmap);
-        if (!pmap->pctl) {
+        if (IS_ERR(pmap->pctl)) {
                 dev_err(&pdev->dev, "pinctrl driver registration failed\n");
-                return -EINVAL;
+                return PTR_ERR(pmap->pctl);
         }
 
         ret = dc_gpiochip_add(pmap, pdev->dev.of_node);
diff --git a/drivers/pinctrl/pinctrl-pistachio.c b/drivers/pinctrl/pinctrl-pistachio.c
index 3dc2ae15f3a1..952b1c623887 100644
--- a/drivers/pinctrl/pinctrl-pistachio.c
+++ b/drivers/pinctrl/pinctrl-pistachio.c
@@ -1303,20 +1303,18 @@ static int pistachio_gpio_irq_set_type(struct irq_data *data, unsigned int type)
         }
 
         if (type & IRQ_TYPE_LEVEL_MASK)
-                __irq_set_handler_locked(data->irq, handle_level_irq);
+                irq_set_handler_locked(data, handle_level_irq);
         else
-                __irq_set_handler_locked(data->irq, handle_edge_irq);
+                irq_set_handler_locked(data, handle_edge_irq);
 
         return 0;
 }
 
-static void pistachio_gpio_irq_handler(unsigned int __irq,
-                                       struct irq_desc *desc)
+static void pistachio_gpio_irq_handler(struct irq_desc *desc)
 {
-        unsigned int irq = irq_desc_get_irq(desc);
         struct gpio_chip *gc = irq_desc_get_handler_data(desc);
         struct pistachio_gpio_bank *bank = gc_to_bank(gc);
-        struct irq_chip *chip = irq_get_chip(irq);
+        struct irq_chip *chip = irq_desc_get_chip(desc);
         unsigned long pending;
         unsigned int pin;
 
diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c
index c5246c05f70c..88bb707e107a 100644
--- a/drivers/pinctrl/pinctrl-rockchip.c
+++ b/drivers/pinctrl/pinctrl-rockchip.c
@@ -1475,7 +1475,7 @@ static const struct gpio_chip rockchip_gpiolib_chip = {
  * Interrupt handling
  */
 
-static void rockchip_irq_demux(unsigned int __irq, struct irq_desc *desc)
+static void rockchip_irq_demux(struct irq_desc *desc)
 {
         struct irq_chip *chip = irq_desc_get_chip(desc);
         struct rockchip_pin_bank *bank = irq_desc_get_handler_data(desc);
diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
index bf548c2a7a9d..ef04b962c3d5 100644
--- a/drivers/pinctrl/pinctrl-single.c
+++ b/drivers/pinctrl/pinctrl-single.c
@@ -1679,7 +1679,7 @@ static irqreturn_t pcs_irq_handler(int irq, void *d)
  * Use this if you have a separate interrupt for each
  * pinctrl-single instance.
  */
-static void pcs_irq_chain_handler(unsigned int irq, struct irq_desc *desc)
+static void pcs_irq_chain_handler(struct irq_desc *desc)
 {
         struct pcs_soc_data *pcs_soc = irq_desc_get_handler_data(desc);
         struct irq_chip *chip;
diff --git a/drivers/pinctrl/pinctrl-st.c b/drivers/pinctrl/pinctrl-st.c
index f8338d2e6b6b..389526e704fb 100644
--- a/drivers/pinctrl/pinctrl-st.c
+++ b/drivers/pinctrl/pinctrl-st.c
@@ -1460,7 +1460,7 @@ static void __gpio_irq_handler(struct st_gpio_bank *bank)
         }
 }
 
-static void st_gpio_irq_handler(unsigned irq, struct irq_desc *desc)
+static void st_gpio_irq_handler(struct irq_desc *desc)
 {
         /* interrupt dedicated per bank */
         struct irq_chip *chip = irq_desc_get_chip(desc);
@@ -1472,7 +1472,7 @@ static void st_gpio_irq_handler(unsigned irq, struct irq_desc *desc)
         chained_irq_exit(chip, desc);
 }
 
-static void st_gpio_irqmux_handler(unsigned irq, struct irq_desc *desc)
+static void st_gpio_irqmux_handler(struct irq_desc *desc)
 {
         struct irq_chip *chip = irq_desc_get_chip(desc);
         struct st_pinctrl *info = irq_desc_get_handler_data(desc);
diff --git a/drivers/pinctrl/pinmux.c b/drivers/pinctrl/pinmux.c
index 67e08cb315c4..29984b36926a 100644
--- a/drivers/pinctrl/pinmux.c
+++ b/drivers/pinctrl/pinmux.c
@@ -313,8 +313,7 @@ static int pinmux_func_name_to_selector(struct pinctrl_dev *pctldev,
 
         /* See if this pctldev has this function */
         while (selector < nfuncs) {
-                const char *fname = ops->get_function_name(pctldev,
-                                                           selector);
+                const char *fname = ops->get_function_name(pctldev, selector);
 
                 if (!strcmp(function, fname))
                         return selector;
diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c
index 492cdd51dc5c..a0c7407c1cac 100644
--- a/drivers/pinctrl/qcom/pinctrl-msm.c
+++ b/drivers/pinctrl/qcom/pinctrl-msm.c
@@ -765,9 +765,8 @@ static struct irq_chip msm_gpio_irq_chip = {
         .irq_set_wake   = msm_gpio_irq_set_wake,
 };
 
-static void msm_gpio_irq_handler(unsigned int __irq, struct irq_desc *desc)
+static void msm_gpio_irq_handler(struct irq_desc *desc)
 {
-        unsigned int irq = irq_desc_get_irq(desc);
         struct gpio_chip *gc = irq_desc_get_handler_data(desc);
         const struct msm_pingroup *g;
         struct msm_pinctrl *pctrl = to_msm_pinctrl(gc);
@@ -795,7 +794,7 @@ static void msm_gpio_irq_handler(unsigned int __irq, struct irq_desc *desc)
 
         /* No interrupts were flagged */
         if (handled == 0)
-                handle_bad_irq(irq, desc);
+                handle_bad_irq(desc);
 
         chained_irq_exit(chip, desc);
 }
diff --git a/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c b/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c
index c978b311031b..e1a3721bc8e5 100644
--- a/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c
+++ b/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c
@@ -723,9 +723,9 @@ static int pm8xxx_gpio_probe(struct platform_device *pdev)
 #endif
 
         pctrl->pctrl = pinctrl_register(&pctrl->desc, &pdev->dev, pctrl);
-        if (!pctrl->pctrl) {
+        if (IS_ERR(pctrl->pctrl)) {
                 dev_err(&pdev->dev, "couldn't register pm8xxx gpio driver\n");
-                return -ENODEV;
+                return PTR_ERR(pctrl->pctrl);
         }
 
         pctrl->chip = pm8xxx_gpio_template;
diff --git a/drivers/pinctrl/qcom/pinctrl-ssbi-mpp.c b/drivers/pinctrl/qcom/pinctrl-ssbi-mpp.c
index 2d1b69f171be..6652b8d7f707 100644
--- a/drivers/pinctrl/qcom/pinctrl-ssbi-mpp.c
+++ b/drivers/pinctrl/qcom/pinctrl-ssbi-mpp.c
@@ -814,9 +814,9 @@ static int pm8xxx_mpp_probe(struct platform_device *pdev)
 #endif
 
         pctrl->pctrl = pinctrl_register(&pctrl->desc, &pdev->dev, pctrl);
-        if (!pctrl->pctrl) {
+        if (IS_ERR(pctrl->pctrl)) {
                 dev_err(&pdev->dev, "couldn't register pm8xxx mpp driver\n");
-                return -ENODEV;
+                return PTR_ERR(pctrl->pctrl);
         }
 
         pctrl->chip = pm8xxx_mpp_template;
diff --git a/drivers/pinctrl/samsung/pinctrl-exynos.c b/drivers/pinctrl/samsung/pinctrl-exynos.c
index 5f45caaef46d..71ccf6a90b22 100644
--- a/drivers/pinctrl/samsung/pinctrl-exynos.c
+++ b/drivers/pinctrl/samsung/pinctrl-exynos.c
@@ -419,7 +419,7 @@ static const struct of_device_id exynos_wkup_irq_ids[] = {
 };
 
 /* interrupt handler for wakeup interrupts 0..15 */
-static void exynos_irq_eint0_15(unsigned int irq, struct irq_desc *desc)
+static void exynos_irq_eint0_15(struct irq_desc *desc)
 {
         struct exynos_weint_data *eintd = irq_desc_get_handler_data(desc);
         struct samsung_pin_bank *bank = eintd->bank;
@@ -451,7 +451,7 @@ static inline void exynos_irq_demux_eint(unsigned long pend,
 }
 
 /* interrupt handler for wakeup interrupt 16 */
-static void exynos_irq_demux_eint16_31(unsigned int irq, struct irq_desc *desc)
+static void exynos_irq_demux_eint16_31(struct irq_desc *desc)
 {
         struct irq_chip *chip = irq_desc_get_chip(desc);
         struct exynos_muxed_weint_data *eintd = irq_desc_get_handler_data(desc);
diff --git a/drivers/pinctrl/samsung/pinctrl-s3c24xx.c b/drivers/pinctrl/samsung/pinctrl-s3c24xx.c
index 019844d479bb..3d92f827da7a 100644
--- a/drivers/pinctrl/samsung/pinctrl-s3c24xx.c
+++ b/drivers/pinctrl/samsung/pinctrl-s3c24xx.c
@@ -240,7 +240,7 @@ static struct irq_chip s3c2410_eint0_3_chip = {
         .irq_set_type   = s3c24xx_eint_type,
 };
 
-static void s3c2410_demux_eint0_3(unsigned int irq, struct irq_desc *desc)
+static void s3c2410_demux_eint0_3(struct irq_desc *desc)
 {
         struct irq_data *data = irq_desc_get_irq_data(desc);
         struct s3c24xx_eint_data *eint_data = irq_desc_get_handler_data(desc);
@@ -295,7 +295,7 @@ static struct irq_chip s3c2412_eint0_3_chip = {
         .irq_set_type   = s3c24xx_eint_type,
 };
 
-static void s3c2412_demux_eint0_3(unsigned int irq, struct irq_desc *desc)
+static void s3c2412_demux_eint0_3(struct irq_desc *desc)
 {
         struct s3c24xx_eint_data *eint_data = irq_desc_get_handler_data(desc);
         struct irq_data *data = irq_desc_get_irq_data(desc);
@@ -361,7 +361,7 @@ static inline void s3c24xx_demux_eint(struct irq_desc *desc,
                                       u32 offset, u32 range)
 {
         struct s3c24xx_eint_data *data = irq_desc_get_handler_data(desc);
-        struct irq_chip *chip = irq_desc_get_irq_chip(desc);
+        struct irq_chip *chip = irq_desc_get_chip(desc);
         struct samsung_pinctrl_drv_data *d = data->drvdata;
         unsigned int pend, mask;
 
@@ -388,12 +388,12 @@ static inline void s3c24xx_demux_eint(struct irq_desc *desc,
         chained_irq_exit(chip, desc);
 }
 
-static void s3c24xx_demux_eint4_7(unsigned int irq, struct irq_desc *desc)
+static void s3c24xx_demux_eint4_7(struct irq_desc *desc)
 {
         s3c24xx_demux_eint(desc, 0, 0xf0);
 }
 
-static void s3c24xx_demux_eint8_23(unsigned int irq, struct irq_desc *desc)
+static void s3c24xx_demux_eint8_23(struct irq_desc *desc)
 {
         s3c24xx_demux_eint(desc, 8, 0xffff00);
 }
diff --git a/drivers/pinctrl/samsung/pinctrl-s3c64xx.c b/drivers/pinctrl/samsung/pinctrl-s3c64xx.c
index f5ea40a69711..43407ab248f5 100644
--- a/drivers/pinctrl/samsung/pinctrl-s3c64xx.c
+++ b/drivers/pinctrl/samsung/pinctrl-s3c64xx.c
@@ -407,7 +407,7 @@ static const struct irq_domain_ops s3c64xx_gpio_irqd_ops = {
         .xlate  = irq_domain_xlate_twocell,
 };
 
-static void s3c64xx_eint_gpio_irq(unsigned int irq, struct irq_desc *desc)
+static void s3c64xx_eint_gpio_irq(struct irq_desc *desc)
 {
         struct irq_chip *chip = irq_desc_get_chip(desc);
         struct s3c64xx_eint_gpio_data *data = irq_desc_get_handler_data(desc);
@@ -631,22 +631,22 @@ static inline void s3c64xx_irq_demux_eint(struct irq_desc *desc, u32 range)
         chained_irq_exit(chip, desc);
 }
 
-static void s3c64xx_demux_eint0_3(unsigned int irq, struct irq_desc *desc)
+static void s3c64xx_demux_eint0_3(struct irq_desc *desc)
 {
         s3c64xx_irq_demux_eint(desc, 0xf);
 }
 
-static void s3c64xx_demux_eint4_11(unsigned int irq, struct irq_desc *desc)
+static void s3c64xx_demux_eint4_11(struct irq_desc *desc)
 {
         s3c64xx_irq_demux_eint(desc, 0xff0);
 }
 
-static void s3c64xx_demux_eint12_19(unsigned int irq, struct irq_desc *desc)
+static void s3c64xx_demux_eint12_19(struct irq_desc *desc)
 {
         s3c64xx_irq_demux_eint(desc, 0xff000);
 }
 
-static void s3c64xx_demux_eint20_27(unsigned int irq, struct irq_desc *desc)
+static void s3c64xx_demux_eint20_27(struct irq_desc *desc)
 {
         s3c64xx_irq_demux_eint(desc, 0xff00000);
 }
diff --git a/drivers/pinctrl/sirf/pinctrl-atlas7.c b/drivers/pinctrl/sirf/pinctrl-atlas7.c
index 9df0c5f25824..0d24d9e4b70c 100644
--- a/drivers/pinctrl/sirf/pinctrl-atlas7.c
+++ b/drivers/pinctrl/sirf/pinctrl-atlas7.c
@@ -4489,7 +4489,7 @@ static struct irq_chip atlas7_gpio_irq_chip = {
         .irq_set_type = atlas7_gpio_irq_type,
 };
 
-static void atlas7_gpio_handle_irq(unsigned int __irq, struct irq_desc *desc)
+static void atlas7_gpio_handle_irq(struct irq_desc *desc)
 {
         struct gpio_chip *gc = irq_desc_get_handler_data(desc);
         struct atlas7_gpio_chip *a7gc = to_atlas7_gpio(gc);
@@ -4512,7 +4512,7 @@ static void atlas7_gpio_handle_irq(unsigned int __irq, struct irq_desc *desc)
         if (!status) {
                 pr_warn("%s: gpio [%s] status %#x no interrupt is flaged\n",
                         __func__, gc->label, status);
-                handle_bad_irq(irq, desc);
+                handle_bad_irq(desc);
                 return;
         }
 
diff --git a/drivers/pinctrl/sirf/pinctrl-sirf.c b/drivers/pinctrl/sirf/pinctrl-sirf.c
index f8bd9fb52033..2a8d69725de8 100644
--- a/drivers/pinctrl/sirf/pinctrl-sirf.c
+++ b/drivers/pinctrl/sirf/pinctrl-sirf.c
@@ -545,7 +545,7 @@ static struct irq_chip sirfsoc_irq_chip = {
         .irq_set_type = sirfsoc_gpio_irq_type,
 };
 
-static void sirfsoc_gpio_handle_irq(unsigned int __irq, struct irq_desc *desc)
+static void sirfsoc_gpio_handle_irq(struct irq_desc *desc)
 {
         unsigned int irq = irq_desc_get_irq(desc);
         struct gpio_chip *gc = irq_desc_get_handler_data(desc);
@@ -570,7 +570,7 @@ static void sirfsoc_gpio_handle_irq(unsigned int __irq, struct irq_desc *desc)
                 printk(KERN_WARNING
                         "%s: gpio id %d status %#x no interrupt is flagged\n",
                         __func__, bank->id, status);
-                handle_bad_irq(irq, desc);
+                handle_bad_irq(desc);
                 return;
         }
 
diff --git a/drivers/pinctrl/spear/pinctrl-plgpio.c b/drivers/pinctrl/spear/pinctrl-plgpio.c
index ae8f29fb5536..1f0af250dbb5 100644
--- a/drivers/pinctrl/spear/pinctrl-plgpio.c
+++ b/drivers/pinctrl/spear/pinctrl-plgpio.c
@@ -356,7 +356,7 @@ static struct irq_chip plgpio_irqchip = {
         .irq_set_type   = plgpio_irq_set_type,
 };
 
-static void plgpio_irq_handler(unsigned irq, struct irq_desc *desc)
+static void plgpio_irq_handler(struct irq_desc *desc)
 {
         struct gpio_chip *gc = irq_desc_get_handler_data(desc);
         struct plgpio *plgpio = container_of(gc, struct plgpio, chip);
diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.c b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
index fb4669c0ce0e..38e0c7bdd2ac 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sunxi.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
@@ -617,13 +617,11 @@ static int sunxi_pinctrl_irq_set_type(struct irq_data *d, unsigned int type)
         spin_lock_irqsave(&pctl->lock, flags);
 
         if (type & IRQ_TYPE_LEVEL_MASK)
-                __irq_set_chip_handler_name_locked(d->irq,
-                                                   &sunxi_pinctrl_level_irq_chip,
-                                                   handle_fasteoi_irq, NULL);
+                irq_set_chip_handler_name_locked(d, &sunxi_pinctrl_level_irq_chip,
+                                                 handle_fasteoi_irq, NULL);
         else
-                __irq_set_chip_handler_name_locked(d->irq,
-                                                   &sunxi_pinctrl_edge_irq_chip,
-                                                   handle_edge_irq, NULL);
+                irq_set_chip_handler_name_locked(d, &sunxi_pinctrl_edge_irq_chip,
+                                                 handle_edge_irq, NULL);
 
         regval = readl(pctl->membase + reg);
         regval &= ~(IRQ_CFG_IRQ_MASK << index);
@@ -742,7 +740,7 @@ static struct irq_domain_ops sunxi_pinctrl_irq_domain_ops = {
         .xlate          = sunxi_pinctrl_irq_of_xlate,
 };
 
-static void sunxi_pinctrl_irq_handler(unsigned __irq, struct irq_desc *desc)
+static void sunxi_pinctrl_irq_handler(struct irq_desc *desc)
 {
         unsigned int irq = irq_desc_get_irq(desc);
         struct irq_chip *chip = irq_desc_get_chip(desc);
diff --git a/drivers/platform/x86/acerhdf.c b/drivers/platform/x86/acerhdf.c
index 1ef02daddb60..460fa6708bfc 100644
--- a/drivers/platform/x86/acerhdf.c
+++ b/drivers/platform/x86/acerhdf.c
@@ -346,8 +346,7 @@ static void acerhdf_check_param(struct thermal_zone_device *thermal)
  * as late as the polling interval is since we can't do that in the respective
  * accessors of the module parameters.
  */
-static int acerhdf_get_ec_temp(struct thermal_zone_device *thermal,
-                               unsigned long *t)
+static int acerhdf_get_ec_temp(struct thermal_zone_device *thermal, int *t)
 {
         int temp, err = 0;
 
@@ -453,7 +452,7 @@ static int acerhdf_get_trip_type(struct thermal_zone_device *thermal, int trip,
 }
 
 static int acerhdf_get_trip_hyst(struct thermal_zone_device *thermal, int trip,
-                                 unsigned long *temp)
+                                 int *temp)
 {
         if (trip != 0)
                 return -EINVAL;
@@ -464,7 +463,7 @@ static int acerhdf_get_trip_hyst(struct thermal_zone_device *thermal, int trip,
 }
 
 static int acerhdf_get_trip_temp(struct thermal_zone_device *thermal, int trip,
-                                 unsigned long *temp)
+                                 int *temp)
 {
         if (trip == 0)
                 *temp = fanon;
@@ -477,7 +476,7 @@ static int acerhdf_get_trip_temp(struct thermal_zone_device *thermal, int trip,
 }
 
 static int acerhdf_get_crit_temp(struct thermal_zone_device *thermal,
-                                 unsigned long *temperature)
+                                 int *temperature)
 {
         *temperature = ACERHDF_TEMP_CRIT;
         return 0;
diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c
index abdaed34c728..131fee2b093e 100644
--- a/drivers/platform/x86/asus-nb-wmi.c
+++ b/drivers/platform/x86/asus-nb-wmi.c
@@ -128,6 +128,24 @@ static const struct dmi_system_id asus_quirks[] = {
         },
         {
                 .callback = dmi_matched,
+                .ident = "ASUSTeK COMPUTER INC. X456UA",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "X456UA"),
+                },
+                .driver_data = &quirk_asus_wapf4,
+        },
+        {
+                .callback = dmi_matched,
+                .ident = "ASUSTeK COMPUTER INC. X456UF",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "X456UF"),
+                },
+                .driver_data = &quirk_asus_wapf4,
+        },
+        {
+                .callback = dmi_matched,
                 .ident = "ASUSTeK COMPUTER INC. X501U",
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c
index 06697315a088..fb4dd7b3ee71 100644
--- a/drivers/platform/x86/hp-wmi.c
+++ b/drivers/platform/x86/hp-wmi.c
@@ -54,8 +54,9 @@ MODULE_ALIAS("wmi:5FB7F034-2C63-45e9-BE91-3D44E2C707E4");
 #define HPWMI_HARDWARE_QUERY 0x4
 #define HPWMI_WIRELESS_QUERY 0x5
 #define HPWMI_BIOS_QUERY 0x9
+#define HPWMI_FEATURE_QUERY 0xb
 #define HPWMI_HOTKEY_QUERY 0xc
-#define HPWMI_FEATURE_QUERY 0xd
+#define HPWMI_FEATURE2_QUERY 0xd
 #define HPWMI_WIRELESS2_QUERY 0x1b
 #define HPWMI_POSTCODEERROR_QUERY 0x2a
 
@@ -295,25 +296,33 @@ static int hp_wmi_tablet_state(void)
         return (state & 0x4) ? 1 : 0;
 }
 
-static int __init hp_wmi_bios_2009_later(void)
+static int __init hp_wmi_bios_2008_later(void)
 {
         int state = 0;
         int ret = hp_wmi_perform_query(HPWMI_FEATURE_QUERY, 0, &state,
                                        sizeof(state), sizeof(state));
-        if (ret)
-                return ret;
+        if (!ret)
+                return 1;
 
-        return (state & 0x10) ? 1 : 0;
+        return (ret == HPWMI_RET_UNKNOWN_CMDTYPE) ? 0 : -ENXIO;
 }
 
-static int hp_wmi_enable_hotkeys(void)
+static int __init hp_wmi_bios_2009_later(void)
 {
-        int ret;
-        int query = 0x6e;
+        int state = 0;
+        int ret = hp_wmi_perform_query(HPWMI_FEATURE2_QUERY, 0, &state,
+                                       sizeof(state), sizeof(state));
+        if (!ret)
+                return 1;
 
-        ret = hp_wmi_perform_query(HPWMI_BIOS_QUERY, 1, &query, sizeof(query),
-                                   0);
+        return (ret == HPWMI_RET_UNKNOWN_CMDTYPE) ? 0 : -ENXIO;
+}
 
+static int __init hp_wmi_enable_hotkeys(void)
+{
+        int value = 0x6e;
+        int ret = hp_wmi_perform_query(HPWMI_BIOS_QUERY, 1, &value,
+                                       sizeof(value), 0);
         if (ret)
                 return -EINVAL;
         return 0;
@@ -663,7 +672,7 @@ static int __init hp_wmi_input_setup(void)
                             hp_wmi_tablet_state());
         input_sync(hp_wmi_input_dev);
 
-        if (hp_wmi_bios_2009_later() == 4)
+        if (!hp_wmi_bios_2009_later() && hp_wmi_bios_2008_later())
                 hp_wmi_enable_hotkeys();
 
         status = wmi_install_notify_handler(HPWMI_EVENT_GUID, hp_wmi_notify, NULL);
diff --git a/drivers/platform/x86/intel_mid_thermal.c b/drivers/platform/x86/intel_mid_thermal.c
index 0944e834af8d..9f713b832ba3 100644
--- a/drivers/platform/x86/intel_mid_thermal.c
+++ b/drivers/platform/x86/intel_mid_thermal.c
@@ -132,7 +132,7 @@ static int is_valid_adc(uint16_t adc_val, uint16_t min, uint16_t max)
  * to achieve very close approximate temp value with less than
  * 0.5C error
  */
-static int adc_to_temp(int direct, uint16_t adc_val, unsigned long *tp)
+static int adc_to_temp(int direct, uint16_t adc_val, int *tp)
 {
         int temp;
 
@@ -174,14 +174,13 @@ static int adc_to_temp(int direct, uint16_t adc_val, unsigned long *tp)
  *
  * Can sleep
  */
-static int mid_read_temp(struct thermal_zone_device *tzd, unsigned long *temp)
+static int mid_read_temp(struct thermal_zone_device *tzd, int *temp)
 {
         struct thermal_device_info *td_info = tzd->devdata;
         uint16_t adc_val, addr;
         uint8_t data = 0;
         int ret;
-        unsigned long curr_temp;
-
+        int curr_temp;
 
         addr = td_info->chnl_addr;
 
@@ -453,7 +452,7 @@ static SIMPLE_DEV_PM_OPS(mid_thermal_pm,
  *
  * Can sleep
  */
-static int read_curr_temp(struct thermal_zone_device *tzd, unsigned long *temp)
+static int read_curr_temp(struct thermal_zone_device *tzd, int *temp)
 {
         WARN_ON(tzd == NULL);
         return mid_read_temp(tzd, temp);
diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c
index 6740c513919c..f2372f400ddb 100644
--- a/drivers/platform/x86/toshiba_acpi.c
+++ b/drivers/platform/x86/toshiba_acpi.c
@@ -938,7 +938,7 @@ static int toshiba_usb_sleep_music_get(struct toshiba_acpi_dev *dev, u32 *state)
         else if (result == TOS_NOT_SUPPORTED)
                 return -ENODEV;
 
-        return result = TOS_SUCCESS ? 0 : -EIO;
+        return result == TOS_SUCCESS ? 0 : -EIO;
 }
 
 static int toshiba_usb_sleep_music_set(struct toshiba_acpi_dev *dev, u32 state)
@@ -2398,11 +2398,9 @@ static int toshiba_acpi_setup_keyboard(struct toshiba_acpi_dev *dev)
         if (error)
                 return error;
 
-        error = toshiba_hotkey_event_type_get(dev, &events_type);
-        if (error) {
-                pr_err("Unable to query Hotkey Event Type\n");
-                return error;
-        }
+        if (toshiba_hotkey_event_type_get(dev, &events_type))
+                pr_notice("Unable to query Hotkey Event Type\n");
+
         dev->hotkey_event_type = events_type;
 
         dev->hotkey_dev = input_allocate_device();
diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
index aac47573f9ed..eb391a281833 100644
--- a/drivers/platform/x86/wmi.c
+++ b/drivers/platform/x86/wmi.c
@@ -194,34 +194,6 @@ static bool wmi_parse_guid(const u8 *src, u8 *dest)
         return true;
 }
 
-/*
- * Convert a raw GUID to the ACII string representation
- */
-static int wmi_gtoa(const char *in, char *out)
-{
-        int i;
-
-        for (i = 3; i >= 0; i--)
-                out += sprintf(out, "%02X", in[i] & 0xFF);
-
-        out += sprintf(out, "-");
-        out += sprintf(out, "%02X", in[5] & 0xFF);
-        out += sprintf(out, "%02X", in[4] & 0xFF);
-        out += sprintf(out, "-");
-        out += sprintf(out, "%02X", in[7] & 0xFF);
-        out += sprintf(out, "%02X", in[6] & 0xFF);
-        out += sprintf(out, "-");
-        out += sprintf(out, "%02X", in[8] & 0xFF);
-        out += sprintf(out, "%02X", in[9] & 0xFF);
-        out += sprintf(out, "-");
-
-        for (i = 10; i <= 15; i++)
-                out += sprintf(out, "%02X", in[i] & 0xFF);
-
-        *out = '\0';
-        return 0;
-}
-
 static bool find_guid(const char *guid_string, struct wmi_block **out)
 {
         char tmp[16], guid_input[16];
@@ -457,11 +429,7 @@ EXPORT_SYMBOL_GPL(wmi_set_block);
 
 static void wmi_dump_wdg(const struct guid_block *g)
 {
-        char guid_string[37];
-
-        wmi_gtoa(g->guid, guid_string);
-
-        pr_info("%s:\n", guid_string);
+        pr_info("%pUL:\n", g->guid);
         pr_info("\tobject_id: %c%c\n", g->object_id[0], g->object_id[1]);
         pr_info("\tnotify_id: %02X\n", g->notify_id);
         pr_info("\treserved: %02X\n", g->reserved);
@@ -661,7 +629,6 @@ EXPORT_SYMBOL_GPL(wmi_has_guid);
 static ssize_t modalias_show(struct device *dev, struct device_attribute *attr,
                              char *buf)
 {
-        char guid_string[37];
         struct wmi_block *wblock;
 
         wblock = dev_get_drvdata(dev);
@@ -670,9 +637,7 @@ static ssize_t modalias_show(struct device *dev, struct device_attribute *attr,
                 return strlen(buf);
         }
 
-        wmi_gtoa(wblock->gblock.guid, guid_string);
-
-        return sprintf(buf, "wmi:%s\n", guid_string);
+        return sprintf(buf, "wmi:%pUL\n", wblock->gblock.guid);
 }
 static DEVICE_ATTR_RO(modalias);
 
@@ -695,7 +660,7 @@ static int wmi_dev_uevent(struct device *dev, struct kobj_uevent_env *env)
         if (!wblock)
                 return -ENOMEM;
 
-        wmi_gtoa(wblock->gblock.guid, guid_string);
+        sprintf(guid_string, "%pUL", wblock->gblock.guid);
 
         strcpy(&env->buf[env->buflen - 1], "wmi:");
         memcpy(&env->buf[env->buflen - 1 + 4], guid_string, 36);
@@ -721,12 +686,9 @@ static struct class wmi_class = {
 static int wmi_create_device(const struct guid_block *gblock,
                              struct wmi_block *wblock, acpi_handle handle)
 {
-        char guid_string[37];
-
         wblock->dev.class = &wmi_class;
 
-        wmi_gtoa(gblock->guid, guid_string);
-        dev_set_name(&wblock->dev, "%s", guid_string);
+        dev_set_name(&wblock->dev, "%pUL", gblock->guid);
 
         dev_set_drvdata(&wblock->dev, wblock);
 
@@ -877,7 +839,6 @@ static void acpi_wmi_notify(struct acpi_device *device, u32 event)
         struct guid_block *block;
         struct wmi_block *wblock;
         struct list_head *p;
-        char guid_string[37];
 
         list_for_each(p, &wmi_block_list) {
                 wblock = list_entry(p, struct wmi_block, list);
@@ -888,8 +849,8 @@ static void acpi_wmi_notify(struct acpi_device *device, u32 event)
                         if (wblock->handler)
                                 wblock->handler(event, wblock->handler_data);
                         if (debug_event) {
-                                wmi_gtoa(wblock->gblock.guid, guid_string);
-                                pr_info("DEBUG Event GUID: %s\n", guid_string);
+                                pr_info("DEBUG Event GUID: %pUL\n",
+                                        wblock->gblock.guid);
                         }
 
                         acpi_bus_generate_netlink_event(
diff --git a/drivers/power/charger-manager.c b/drivers/power/charger-manager.c
index 1c202ccbd2a6..907293e6f2a4 100644
--- a/drivers/power/charger-manager.c
+++ b/drivers/power/charger-manager.c
@@ -619,7 +619,7 @@ static int cm_get_battery_temperature(struct charger_manager *cm,
 
 #ifdef CONFIG_THERMAL
         if (cm->tzd_batt) {
-                ret = thermal_zone_get_temp(cm->tzd_batt, (unsigned long *)temp);
+                ret = thermal_zone_get_temp(cm->tzd_batt, temp);
                 if (!ret)
                         /* Calibrate temperature unit */
                         *temp /= 100;
diff --git a/drivers/power/power_supply_core.c b/drivers/power/power_supply_core.c
index 869284c2e1e8..456987c88baa 100644
--- a/drivers/power/power_supply_core.c
+++ b/drivers/power/power_supply_core.c
@@ -557,7 +557,7 @@ EXPORT_SYMBOL_GPL(power_supply_unreg_notifier);
 
 #ifdef CONFIG_THERMAL
 static int power_supply_read_temp(struct thermal_zone_device *tzd,
-                unsigned long *temp)
+                int *temp)
 {
         struct power_supply *psy;
         union power_supply_propval val;
diff --git a/drivers/power/twl4030_charger.c b/drivers/power/twl4030_charger.c
index f4f2c1f76c32..74f2d3ff1d7c 100644
--- a/drivers/power/twl4030_charger.c
+++ b/drivers/power/twl4030_charger.c
@@ -91,7 +91,7 @@
 #define TWL4030_MSTATEC_COMPLETE1       0x0b
 #define TWL4030_MSTATEC_COMPLETE4       0x0e
 
-#if IS_ENABLED(CONFIG_TWL4030_MADC)
+#if IS_REACHABLE(CONFIG_TWL4030_MADC)
 /*
  * If AC (Accessory Charger) voltage exceeds 4.5V (MADC 11)
  * then AC is available.
@@ -1057,13 +1057,9 @@ static int twl4030_bci_probe(struct platform_device *pdev)
 
                 phynode = of_find_compatible_node(bci->dev->of_node->parent,
                                                   NULL, "ti,twl4030-usb");
-                if (phynode) {
+                if (phynode)
                         bci->transceiver = devm_usb_get_phy_by_node(
                                 bci->dev, phynode, &bci->usb_nb);
-                        if (IS_ERR(bci->transceiver) &&
-                            PTR_ERR(bci->transceiver) == -EPROBE_DEFER)
-                                return -EPROBE_DEFER;
-                }
         }
 
         /* Enable interrupts now. */
diff --git a/drivers/regulator/anatop-regulator.c b/drivers/regulator/anatop-regulator.c
index 738adfa5332b..52ea605f8130 100644
--- a/drivers/regulator/anatop-regulator.c
+++ b/drivers/regulator/anatop-regulator.c
@@ -318,6 +318,7 @@ static const struct of_device_id of_anatop_regulator_match_tbl[] = {
         { .compatible = "fsl,anatop-regulator", },
         { /* end */ }
 };
+MODULE_DEVICE_TABLE(of, of_anatop_regulator_match_tbl);
 
 static struct platform_driver anatop_regulator_driver = {
         .driver = {
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index 7a85ac9e32c5..7849187d91ae 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -1394,15 +1394,15 @@ static int regulator_resolve_supply(struct regulator_dev *rdev)
                 return 0;
 
         r = regulator_dev_lookup(dev, rdev->supply_name, &ret);
-        if (ret == -ENODEV) {
-                /*
-                 * No supply was specified for this regulator and
-                 * there will never be one.
-                 */
-                return 0;
-        }
-
         if (!r) {
+                if (ret == -ENODEV) {
+                        /*
+                         * No supply was specified for this regulator and
+                         * there will never be one.
+                         */
+                        return 0;
+                }
+
                 if (have_full_constraints()) {
                         r = dummy_regulator_rdev;
                 } else {
@@ -1422,11 +1422,10 @@ static int regulator_resolve_supply(struct regulator_dev *rdev)
                 return ret;
 
         /* Cascade always-on state to supply */
-        if (_regulator_is_enabled(rdev)) {
+        if (_regulator_is_enabled(rdev) && rdev->supply) {
                 ret = regulator_enable(rdev->supply);
                 if (ret < 0) {
-                        if (rdev->supply)
-                                _regulator_put(rdev->supply);
+                        _regulator_put(rdev->supply);
                         return ret;
                 }
         }
diff --git a/drivers/regulator/gpio-regulator.c b/drivers/regulator/gpio-regulator.c
index 464018de7e97..7bba8b747f30 100644
--- a/drivers/regulator/gpio-regulator.c
+++ b/drivers/regulator/gpio-regulator.c
@@ -394,6 +394,7 @@ static const struct of_device_id regulator_gpio_of_match[] = {
         { .compatible = "regulator-gpio", },
         {},
 };
+MODULE_DEVICE_TABLE(of, regulator_gpio_of_match);
 #endif
 
 static struct platform_driver gpio_regulator_driver = {
diff --git a/drivers/regulator/pbias-regulator.c b/drivers/regulator/pbias-regulator.c
index 4fa7bcaf454e..f9d74d63be7c 100644
--- a/drivers/regulator/pbias-regulator.c
+++ b/drivers/regulator/pbias-regulator.c
@@ -45,6 +45,10 @@ struct pbias_regulator_data {
         int voltage;
 };
 
+struct pbias_of_data {
+        unsigned int offset;
+};
+
 static const unsigned int pbias_volt_table[] = {
         1800000,
         3000000
@@ -102,8 +106,35 @@ static struct of_regulator_match pbias_matches[] = {
 };
 #define PBIAS_NUM_REGS  ARRAY_SIZE(pbias_matches)
 
+/* Offset from SCM general area (and syscon) base */
+
+static const struct pbias_of_data pbias_of_data_omap2 = {
+        .offset = 0x230,
+};
+
+static const struct pbias_of_data pbias_of_data_omap3 = {
+        .offset = 0x2b0,
+};
+
+static const struct pbias_of_data pbias_of_data_omap4 = {
+        .offset = 0x60,
+};
+
+static const struct pbias_of_data pbias_of_data_omap5 = {
+        .offset = 0x60,
+};
+
+static const struct pbias_of_data pbias_of_data_dra7 = {
+        .offset = 0xe00,
+};
+
 static const struct of_device_id pbias_of_match[] = {
         { .compatible = "ti,pbias-omap", },
+        { .compatible = "ti,pbias-omap2", .data = &pbias_of_data_omap2, },
+        { .compatible = "ti,pbias-omap3", .data = &pbias_of_data_omap3, },
+        { .compatible = "ti,pbias-omap4", .data = &pbias_of_data_omap4, },
+        { .compatible = "ti,pbias-omap5", .data = &pbias_of_data_omap5, },
+        { .compatible = "ti,pbias-dra7", .data = &pbias_of_data_dra7, },
         {},
 };
 MODULE_DEVICE_TABLE(of, pbias_of_match);
@@ -118,6 +149,9 @@ static int pbias_regulator_probe(struct platform_device *pdev)
         const struct pbias_reg_info *info;
         int ret = 0;
         int count, idx, data_idx = 0;
+        const struct of_device_id *match;
+        const struct pbias_of_data *data;
+        unsigned int offset;
 
         count = of_regulator_match(&pdev->dev, np, pbias_matches,
                                                 PBIAS_NUM_REGS);
@@ -133,6 +167,20 @@ static int pbias_regulator_probe(struct platform_device *pdev)
         if (IS_ERR(syscon))
                 return PTR_ERR(syscon);
 
+        match = of_match_device(of_match_ptr(pbias_of_match), &pdev->dev);
+        if (match && match->data) {
+                data = match->data;
+                offset = data->offset;
+        } else {
+                res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+                if (!res)
+                        return -EINVAL;
+
+                offset = res->start;
+                dev_WARN(&pdev->dev,
+                         "using legacy dt data for pbias offset\n");
+        }
+
         cfg.regmap = syscon;
         cfg.dev = &pdev->dev;
 
@@ -145,10 +193,6 @@ static int pbias_regulator_probe(struct platform_device *pdev)
                 if (!info)
                         return -ENODEV;
 
-                res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-                if (!res)
-                        return -EINVAL;
-
                 drvdata[data_idx].syscon = syscon;
                 drvdata[data_idx].info = info;
                 drvdata[data_idx].desc.name = info->name;
@@ -158,9 +202,9 @@ static int pbias_regulator_probe(struct platform_device *pdev)
                 drvdata[data_idx].desc.volt_table = pbias_volt_table;
                 drvdata[data_idx].desc.n_voltages = 2;
                 drvdata[data_idx].desc.enable_time = info->enable_time;
-                drvdata[data_idx].desc.vsel_reg = res->start;
+                drvdata[data_idx].desc.vsel_reg = offset;
                 drvdata[data_idx].desc.vsel_mask = info->vmode;
-                drvdata[data_idx].desc.enable_reg = res->start;
+                drvdata[data_idx].desc.enable_reg = offset;
                 drvdata[data_idx].desc.enable_mask = info->enable_mask;
                 drvdata[data_idx].desc.enable_val = info->enable;
                 drvdata[data_idx].desc.disable_val = info->disable_val;
diff --git a/drivers/regulator/tps65218-regulator.c b/drivers/regulator/tps65218-regulator.c
index 7f97223f95c5..a02c1b961039 100644
--- a/drivers/regulator/tps65218-regulator.c
+++ b/drivers/regulator/tps65218-regulator.c
@@ -73,7 +73,7 @@ static const struct regulator_linear_range dcdc4_ranges[] = {
 };
 
 static struct tps_info tps65218_pmic_regs[] = {
-        TPS65218_INFO(DCDC1, "DCDC1", 850000, 167500),
+        TPS65218_INFO(DCDC1, "DCDC1", 850000, 1675000),
         TPS65218_INFO(DCDC2, "DCDC2", 850000, 1675000),
         TPS65218_INFO(DCDC3, "DCDC3", 900000, 3400000),
         TPS65218_INFO(DCDC4, "DCDC4", 1175000, 3400000),
diff --git a/drivers/regulator/vexpress.c b/drivers/regulator/vexpress.c
index bed9d3ee4198..c810cbbd463f 100644
--- a/drivers/regulator/vexpress.c
+++ b/drivers/regulator/vexpress.c
@@ -103,6 +103,7 @@ static const struct of_device_id vexpress_regulator_of_match[] = {
         { .compatible = "arm,vexpress-volt", },
         { }
 };
+MODULE_DEVICE_TABLE(of, vexpress_regulator_of_match);
 
 static struct platform_driver vexpress_regulator_driver = {
         .probe = vexpress_regulator_probe,
diff --git a/drivers/s390/virtio/virtio_ccw.c b/drivers/s390/virtio/virtio_ccw.c
index f8d8fdb26b72..e9fae30fafda 100644
--- a/drivers/s390/virtio/virtio_ccw.c
+++ b/drivers/s390/virtio/virtio_ccw.c
@@ -400,12 +400,16 @@ static bool virtio_ccw_kvm_notify(struct virtqueue *vq)
 static int virtio_ccw_read_vq_conf(struct virtio_ccw_device *vcdev,
                                    struct ccw1 *ccw, int index)
 {
+        int ret;
+
         vcdev->config_block->index = index;
         ccw->cmd_code = CCW_CMD_READ_VQ_CONF;
         ccw->flags = 0;
         ccw->count = sizeof(struct vq_config_block);
         ccw->cda = (__u32)(unsigned long)(vcdev->config_block);
-        ccw_io_helper(vcdev, ccw, VIRTIO_CCW_DOING_READ_VQ_CONF);
+        ret = ccw_io_helper(vcdev, ccw, VIRTIO_CCW_DOING_READ_VQ_CONF);
+        if (ret)
+                return ret;
         return vcdev->config_block->num;
 }
 
@@ -503,6 +507,10 @@ static struct virtqueue *virtio_ccw_setup_vq(struct virtio_device *vdev,
                 goto out_err;
         }
         info->num = virtio_ccw_read_vq_conf(vcdev, ccw, i);
+        if (info->num < 0) {
+                err = info->num;
+                goto out_err;
+        }
         size = PAGE_ALIGN(vring_size(info->num, KVM_VIRTIO_CCW_RING_ALIGN));
         info->queue = alloc_pages_exact(size, GFP_KERNEL | __GFP_ZERO);
         if (info->queue == NULL) {
diff --git a/drivers/scsi/Makefile b/drivers/scsi/Makefile
index 471d08791766..1a8c9b53fafa 100644
--- a/drivers/scsi/Makefile
+++ b/drivers/scsi/Makefile
@@ -172,6 +172,7 @@ scsi_mod-$(CONFIG_SYSCTL)	+= scsi_sysctl.o
 scsi_mod-$(CONFIG_SCSI_PROC_FS) += scsi_proc.o
 scsi_mod-y                      += scsi_trace.o scsi_logging.o
 scsi_mod-$(CONFIG_PM)           += scsi_pm.o
+scsi_mod-$(CONFIG_SCSI_DH)      += scsi_dh.o
 
 hv_storvsc-y                    := storvsc_drv.o
 
diff --git a/drivers/scsi/aic94xx/aic94xx_sds.c b/drivers/scsi/aic94xx/aic94xx_sds.c
index edb43fda9f36..c831e30411fa 100644
--- a/drivers/scsi/aic94xx/aic94xx_sds.c
+++ b/drivers/scsi/aic94xx/aic94xx_sds.c
@@ -983,7 +983,7 @@ static int asd_process_ctrl_a_user(struct asd_ha_struct *asd_ha,
 {
         int err, i;
         u32 offs, size;
-        struct asd_ll_el *el;
+        struct asd_ll_el *el = NULL;
         struct asd_ctrla_phy_settings *ps;
         struct asd_ctrla_phy_settings dflt_ps;
 
@@ -1004,6 +1004,7 @@ static int asd_process_ctrl_a_user(struct asd_ha_struct *asd_ha,
 
                 size = sizeof(struct asd_ctrla_phy_settings);
                 ps = &dflt_ps;
+                goto out_process;
         }
 
         if (size == 0)
@@ -1028,7 +1029,7 @@ static int asd_process_ctrl_a_user(struct asd_ha_struct *asd_ha,
                 ASD_DPRINTK("couldn't find ctrla phy settings struct\n");
                 goto out2;
         }
-
+out_process:
         err = asd_process_ctrla_phy_settings(asd_ha, ps);
         if (err) {
                 ASD_DPRINTK("couldn't process ctrla phy settings\n");
diff --git a/drivers/scsi/bfa/bfa_ioc.c b/drivers/scsi/bfa/bfa_ioc.c
index 315d6d6dcfc8..98f7e8cca52d 100644
--- a/drivers/scsi/bfa/bfa_ioc.c
+++ b/drivers/scsi/bfa/bfa_ioc.c
@@ -3665,19 +3665,19 @@ bfa_cb_sfp_state_query(struct bfa_sfp_s *sfp)
                 if (sfp->state_query_cbfn)
                         sfp->state_query_cbfn(sfp->state_query_cbarg,
                                         sfp->status);
-                        sfp->media = NULL;
-                }
+                sfp->media = NULL;
+        }
 
-                if (sfp->portspeed) {
-                        sfp->status = bfa_sfp_speed_valid(sfp, sfp->portspeed);
-                        if (sfp->state_query_cbfn)
-                                sfp->state_query_cbfn(sfp->state_query_cbarg,
-                                                sfp->status);
-                                sfp->portspeed = BFA_PORT_SPEED_UNKNOWN;
-                }
+        if (sfp->portspeed) {
+                sfp->status = bfa_sfp_speed_valid(sfp, sfp->portspeed);
+                if (sfp->state_query_cbfn)
+                        sfp->state_query_cbfn(sfp->state_query_cbarg,
+                                        sfp->status);
+                sfp->portspeed = BFA_PORT_SPEED_UNKNOWN;
+        }
 
-                sfp->state_query_lock = 0;
-                sfp->state_query_cbfn = NULL;
+        sfp->state_query_lock = 0;
+        sfp->state_query_cbfn = NULL;
 }
 
 /*
@@ -3878,7 +3878,7 @@ bfa_sfp_show_comp(struct bfa_sfp_s *sfp, struct bfi_mbmsg_s *msg)
                 bfa_trc(sfp, sfp->data_valid);
                 if (sfp->data_valid) {
                         u32     size = sizeof(struct sfp_mem_s);
-                        u8 *des = (u8 *) &(sfp->sfpmem);
+                        u8 *des = (u8 *)(sfp->sfpmem);
                         memcpy(des, sfp->dbuf_kva, size);
                 }
                 /*
diff --git a/drivers/scsi/device_handler/Kconfig b/drivers/scsi/device_handler/Kconfig
index 69abd0ad48e2..e5647d59224f 100644
--- a/drivers/scsi/device_handler/Kconfig
+++ b/drivers/scsi/device_handler/Kconfig
@@ -3,7 +3,7 @@
 #
 
 menuconfig SCSI_DH
-        tristate "SCSI Device Handlers"
+        bool "SCSI Device Handlers"
         depends on SCSI
         default n
         help
diff --git a/drivers/scsi/device_handler/Makefile b/drivers/scsi/device_handler/Makefile
index e1d2ea083e15..09866c50fbb4 100644
--- a/drivers/scsi/device_handler/Makefile
+++ b/drivers/scsi/device_handler/Makefile
@@ -1,7 +1,6 @@
 #
 # SCSI Device Handler
 #
-obj-$(CONFIG_SCSI_DH)           += scsi_dh.o
 obj-$(CONFIG_SCSI_DH_RDAC)      += scsi_dh_rdac.o
 obj-$(CONFIG_SCSI_DH_HP_SW)     += scsi_dh_hp_sw.o
 obj-$(CONFIG_SCSI_DH_EMC)       += scsi_dh_emc.o
diff --git a/drivers/scsi/device_handler/scsi_dh.c b/drivers/scsi/device_handler/scsi_dh.c
deleted file mode 100644
index 1efebc9eedfb..000000000000
--- a/drivers/scsi/device_handler/scsi_dh.c
+++ /dev/null
@@ -1,621 +0,0 @@
-/*
- * SCSI device handler infrastruture.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
- *
- * Copyright IBM Corporation, 2007
- *      Authors:
- *               Chandra Seetharaman <sekharan@us.ibm.com>
- *               Mike Anderson <andmike@linux.vnet.ibm.com>
- */
-
-#include <linux/slab.h>
-#include <linux/module.h>
-#include <scsi/scsi_dh.h>
-#include "../scsi_priv.h"
-
-static DEFINE_SPINLOCK(list_lock);
-static LIST_HEAD(scsi_dh_list);
-
-static struct scsi_device_handler *get_device_handler(const char *name)
-{
-        struct scsi_device_handler *tmp, *found = NULL;
-
-        spin_lock(&list_lock);
-        list_for_each_entry(tmp, &scsi_dh_list, list) {
-                if (!strncmp(tmp->name, name, strlen(tmp->name))) {
-                        found = tmp;
-                        break;
-                }
-        }
-        spin_unlock(&list_lock);
-        return found;
-}
-
-/*
- * device_handler_match_function - Match a device handler to a device
- * @sdev - SCSI device to be tested
- *
- * Tests @sdev against the match function of all registered device_handler.
- * Returns the found device handler or NULL if not found.
- */
-static struct scsi_device_handler *
-device_handler_match_function(struct scsi_device *sdev)
-{
-        struct scsi_device_handler *tmp_dh, *found_dh = NULL;
-
-        spin_lock(&list_lock);
-        list_for_each_entry(tmp_dh, &scsi_dh_list, list) {
-                if (tmp_dh->match && tmp_dh->match(sdev)) {
-                        found_dh = tmp_dh;
-                        break;
-                }
-        }
-        spin_unlock(&list_lock);
-        return found_dh;
-}
-
-/*
- * device_handler_match - Attach a device handler to a device
- * @scsi_dh - The device handler to match against or NULL
- * @sdev - SCSI device to be tested against @scsi_dh
- *
- * Tests @sdev against the device handler @scsi_dh or against
- * all registered device_handler if @scsi_dh == NULL.
- * Returns the found device handler or NULL if not found.
- */
-static struct scsi_device_handler *
-device_handler_match(struct scsi_device_handler *scsi_dh,
-                     struct scsi_device *sdev)
-{
-        struct scsi_device_handler *found_dh;
-
-        found_dh = device_handler_match_function(sdev);
-
-        if (scsi_dh && found_dh != scsi_dh)
-                found_dh = NULL;
-
-        return found_dh;
-}
-
-/*
- * scsi_dh_handler_attach - Attach a device handler to a device
- * @sdev - SCSI device the device handler should attach to
- * @scsi_dh - The device handler to attach
- */
-static int scsi_dh_handler_attach(struct scsi_device *sdev,
-                                  struct scsi_device_handler *scsi_dh)
-{
-        struct scsi_dh_data *d;
-
-        if (sdev->scsi_dh_data) {
-                if (sdev->scsi_dh_data->scsi_dh != scsi_dh)
-                        return -EBUSY;
-
-                kref_get(&sdev->scsi_dh_data->kref);
-                return 0;
-        }
-
-        if (!try_module_get(scsi_dh->module))
-                return -EINVAL;
-
-        d = scsi_dh->attach(sdev);
-        if (IS_ERR(d)) {
-                sdev_printk(KERN_ERR, sdev, "%s: Attach failed (%ld)\n",
-                            scsi_dh->name, PTR_ERR(d));
-                module_put(scsi_dh->module);
-                return PTR_ERR(d);
-        }
-
-        d->scsi_dh = scsi_dh;
-        kref_init(&d->kref);
-        d->sdev = sdev;
-
-        spin_lock_irq(sdev->request_queue->queue_lock);
-        sdev->scsi_dh_data = d;
-        spin_unlock_irq(sdev->request_queue->queue_lock);
-        return 0;
-}
-
-static void __detach_handler (struct kref *kref)
-{
-        struct scsi_dh_data *scsi_dh_data =
-                container_of(kref, struct scsi_dh_data, kref);
-        struct scsi_device_handler *scsi_dh = scsi_dh_data->scsi_dh;
-        struct scsi_device *sdev = scsi_dh_data->sdev;
-
-        scsi_dh->detach(sdev);
-
-        spin_lock_irq(sdev->request_queue->queue_lock);
-        sdev->scsi_dh_data = NULL;
-        spin_unlock_irq(sdev->request_queue->queue_lock);
-
-        sdev_printk(KERN_NOTICE, sdev, "%s: Detached\n", scsi_dh->name);
-        module_put(scsi_dh->module);
-}
-
-/*
- * scsi_dh_handler_detach - Detach a device handler from a device
- * @sdev - SCSI device the device handler should be detached from
- * @scsi_dh - Device handler to be detached
- *
- * Detach from a device handler. If a device handler is specified,
- * only detach if the currently attached handler matches @scsi_dh.
- */
-static void scsi_dh_handler_detach(struct scsi_device *sdev,
-                                   struct scsi_device_handler *scsi_dh)
-{
-        if (!sdev->scsi_dh_data)
-                return;
-
-        if (scsi_dh && scsi_dh != sdev->scsi_dh_data->scsi_dh)
-                return;
-
-        if (!scsi_dh)
-                scsi_dh = sdev->scsi_dh_data->scsi_dh;
-
-        if (scsi_dh)
-                kref_put(&sdev->scsi_dh_data->kref, __detach_handler);
-}
-
-/*
- * Functions for sysfs attribute 'dh_state'
- */
-static ssize_t
-store_dh_state(struct device *dev, struct device_attribute *attr,
-               const char *buf, size_t count)
-{
-        struct scsi_device *sdev = to_scsi_device(dev);
-        struct scsi_device_handler *scsi_dh;
-        int err = -EINVAL;
-
-        if (sdev->sdev_state == SDEV_CANCEL ||
-            sdev->sdev_state == SDEV_DEL)
-                return -ENODEV;
-
-        if (!sdev->scsi_dh_data) {
-                /*
-                 * Attach to a device handler
-                 */
-                if (!(scsi_dh = get_device_handler(buf)))
-                        return err;
-                err = scsi_dh_handler_attach(sdev, scsi_dh);
-        } else {
-                scsi_dh = sdev->scsi_dh_data->scsi_dh;
-                if (!strncmp(buf, "detach", 6)) {
-                        /*
-                         * Detach from a device handler
-                         */
-                        scsi_dh_handler_detach(sdev, scsi_dh);
-                        err = 0;
-                } else if (!strncmp(buf, "activate", 8)) {
-                        /*
-                         * Activate a device handler
-                         */
-                        if (scsi_dh->activate)
-                                err = scsi_dh->activate(sdev, NULL, NULL);
-                        else
-                                err = 0;
-                }
-        }
-
-        return err<0?err:count;
-}
-
-static ssize_t
-show_dh_state(struct device *dev, struct device_attribute *attr, char *buf)
-{
-        struct scsi_device *sdev = to_scsi_device(dev);
-
-        if (!sdev->scsi_dh_data)
-                return snprintf(buf, 20, "detached\n");
-
-        return snprintf(buf, 20, "%s\n", sdev->scsi_dh_data->scsi_dh->name);
-}
-
-static struct device_attribute scsi_dh_state_attr =
-        __ATTR(dh_state, S_IRUGO | S_IWUSR, show_dh_state,
-               store_dh_state);
-
-/*
- * scsi_dh_sysfs_attr_add - Callback for scsi_init_dh
- */
-static int scsi_dh_sysfs_attr_add(struct device *dev, void *data)
-{
-        struct scsi_device *sdev;
-        int err;
-
-        if (!scsi_is_sdev_device(dev))
-                return 0;
-
-        sdev = to_scsi_device(dev);
-
-        err = device_create_file(&sdev->sdev_gendev,
-                                 &scsi_dh_state_attr);
-
-        return 0;
-}
-
-/*
- * scsi_dh_sysfs_attr_remove - Callback for scsi_exit_dh
- */
-static int scsi_dh_sysfs_attr_remove(struct device *dev, void *data)
-{
-        struct scsi_device *sdev;
-
-        if (!scsi_is_sdev_device(dev))
-                return 0;
-
-        sdev = to_scsi_device(dev);
-
-        device_remove_file(&sdev->sdev_gendev,
-                           &scsi_dh_state_attr);
-
-        return 0;
-}
-
-/*
- * scsi_dh_notifier - notifier chain callback
- */
-static int scsi_dh_notifier(struct notifier_block *nb,
-                            unsigned long action, void *data)
-{
-        struct device *dev = data;
-        struct scsi_device *sdev;
-        int err = 0;
-        struct scsi_device_handler *devinfo = NULL;
-
-        if (!scsi_is_sdev_device(dev))
-                return 0;
-
-        sdev = to_scsi_device(dev);
-
-        if (action == BUS_NOTIFY_ADD_DEVICE) {
-                err = device_create_file(dev, &scsi_dh_state_attr);
-                /* don't care about err */
-                devinfo = device_handler_match(NULL, sdev);
-                if (devinfo)
-                        err = scsi_dh_handler_attach(sdev, devinfo);
-        } else if (action == BUS_NOTIFY_DEL_DEVICE) {
-                device_remove_file(dev, &scsi_dh_state_attr);
-                scsi_dh_handler_detach(sdev, NULL);
-        }
-        return err;
-}
-
-/*
- * scsi_dh_notifier_add - Callback for scsi_register_device_handler
- */
-static int scsi_dh_notifier_add(struct device *dev, void *data)
-{
-        struct scsi_device_handler *scsi_dh = data;
-        struct scsi_device *sdev;
-
-        if (!scsi_is_sdev_device(dev))
-                return 0;
-
-        if (!get_device(dev))
-                return 0;
-
-        sdev = to_scsi_device(dev);
-
-        if (device_handler_match(scsi_dh, sdev))
-                scsi_dh_handler_attach(sdev, scsi_dh);
-
-        put_device(dev);
-
-        return 0;
-}
-
-/*
- * scsi_dh_notifier_remove - Callback for scsi_unregister_device_handler
- */
-static int scsi_dh_notifier_remove(struct device *dev, void *data)
-{
-        struct scsi_device_handler *scsi_dh = data;
-        struct scsi_device *sdev;
-
-        if (!scsi_is_sdev_device(dev))
-                return 0;
-
-        if (!get_device(dev))
-                return 0;
-
-        sdev = to_scsi_device(dev);
-
-        scsi_dh_handler_detach(sdev, scsi_dh);
-
-        put_device(dev);
-
-        return 0;
-}
-
-/*
- * scsi_register_device_handler - register a device handler personality
- *      module.
- * @scsi_dh - device handler to be registered.
- *
- * Returns 0 on success, -EBUSY if handler already registered.
- */
-int scsi_register_device_handler(struct scsi_device_handler *scsi_dh)
-{
-
-        if (get_device_handler(scsi_dh->name))
-                return -EBUSY;
-
-        if (!scsi_dh->attach || !scsi_dh->detach)
-                return -EINVAL;
-
-        spin_lock(&list_lock);
-        list_add(&scsi_dh->list, &scsi_dh_list);
-        spin_unlock(&list_lock);
-
-        bus_for_each_dev(&scsi_bus_type, NULL, scsi_dh, scsi_dh_notifier_add);
-        printk(KERN_INFO "%s: device handler registered\n", scsi_dh->name);
-
-        return SCSI_DH_OK;
-}
-EXPORT_SYMBOL_GPL(scsi_register_device_handler);
-
-/*
- * scsi_unregister_device_handler - register a device handler personality
- *      module.
- * @scsi_dh - device handler to be unregistered.
- *
- * Returns 0 on success, -ENODEV if handler not registered.
- */
-int scsi_unregister_device_handler(struct scsi_device_handler *scsi_dh)
-{
-
-        if (!get_device_handler(scsi_dh->name))
-                return -ENODEV;
-
-        bus_for_each_dev(&scsi_bus_type, NULL, scsi_dh,
-                         scsi_dh_notifier_remove);
-
-        spin_lock(&list_lock);
-        list_del(&scsi_dh->list);
-        spin_unlock(&list_lock);
-        printk(KERN_INFO "%s: device handler unregistered\n", scsi_dh->name);
-
-        return SCSI_DH_OK;
-}
-EXPORT_SYMBOL_GPL(scsi_unregister_device_handler);
-
-/*
- * scsi_dh_activate - activate the path associated with the scsi_device
- *      corresponding to the given request queue.
- *     Returns immediately without waiting for activation to be completed.
- * @q    - Request queue that is associated with the scsi_device to be
- *         activated.
- * @fn   - Function to be called upon completion of the activation.
- *         Function fn is called with data (below) and the error code.
- *         Function fn may be called from the same calling context. So,
- *         do not hold the lock in the caller which may be needed in fn.
- * @data - data passed to the function fn upon completion.
- *
- */
-int scsi_dh_activate(struct request_queue *q, activate_complete fn, void *data)
-{
-        int err = 0;
-        unsigned long flags;
-        struct scsi_device *sdev;
-        struct scsi_device_handler *scsi_dh = NULL;
-        struct device *dev = NULL;
-
-        spin_lock_irqsave(q->queue_lock, flags);
-        sdev = q->queuedata;
-        if (!sdev) {
-                spin_unlock_irqrestore(q->queue_lock, flags);
-                err = SCSI_DH_NOSYS;
-                if (fn)
-                        fn(data, err);
-                return err;
-        }
-
-        if (sdev->scsi_dh_data)
-                scsi_dh = sdev->scsi_dh_data->scsi_dh;
-        dev = get_device(&sdev->sdev_gendev);
-        if (!scsi_dh || !dev ||
-            sdev->sdev_state == SDEV_CANCEL ||
-            sdev->sdev_state == SDEV_DEL)
-                err = SCSI_DH_NOSYS;
-        if (sdev->sdev_state == SDEV_OFFLINE)
-                err = SCSI_DH_DEV_OFFLINED;
-        spin_unlock_irqrestore(q->queue_lock, flags);
-
-        if (err) {
-                if (fn)
-                        fn(data, err);
-                goto out;
-        }
-
-        if (scsi_dh->activate)
-                err = scsi_dh->activate(sdev, fn, data);
-out:
-        put_device(dev);
-        return err;
-}
-EXPORT_SYMBOL_GPL(scsi_dh_activate);
-
-/*
- * scsi_dh_set_params - set the parameters for the device as per the
- *      string specified in params.
- * @q - Request queue that is associated with the scsi_device for
- *      which the parameters to be set.
- * @params - parameters in the following format
- *      "no_of_params\0param1\0param2\0param3\0...\0"
- *      for example, string for 2 parameters with value 10 and 21
- *      is specified as "2\010\021\0".
- */
-int scsi_dh_set_params(struct request_queue *q, const char *params)
-{
-        int err = -SCSI_DH_NOSYS;
-        unsigned long flags;
-        struct scsi_device *sdev;
-        struct scsi_device_handler *scsi_dh = NULL;
-
-        spin_lock_irqsave(q->queue_lock, flags);
-        sdev = q->queuedata;
-        if (sdev && sdev->scsi_dh_data)
-                scsi_dh = sdev->scsi_dh_data->scsi_dh;
-        if (scsi_dh && scsi_dh->set_params && get_device(&sdev->sdev_gendev))
-                err = 0;
-        spin_unlock_irqrestore(q->queue_lock, flags);
-
-        if (err)
-                return err;
-        err = scsi_dh->set_params(sdev, params);
-        put_device(&sdev->sdev_gendev);
-        return err;
-}
-EXPORT_SYMBOL_GPL(scsi_dh_set_params);
-
-/*
- * scsi_dh_handler_exist - Return TRUE(1) if a device handler exists for
- *      the given name. FALSE(0) otherwise.
- * @name - name of the device handler.
- */
-int scsi_dh_handler_exist(const char *name)
-{
-        return (get_device_handler(name) != NULL);
-}
-EXPORT_SYMBOL_GPL(scsi_dh_handler_exist);
-
-/*
- * scsi_dh_attach - Attach device handler
- * @q - Request queue that is associated with the scsi_device
- *      the handler should be attached to
- * @name - name of the handler to attach
- */
-int scsi_dh_attach(struct request_queue *q, const char *name)
-{
-        unsigned long flags;
-        struct scsi_device *sdev;
-        struct scsi_device_handler *scsi_dh;
-        int err = 0;
-
-        scsi_dh = get_device_handler(name);
-        if (!scsi_dh)
-                return -EINVAL;
-
-        spin_lock_irqsave(q->queue_lock, flags);
-        sdev = q->queuedata;
-        if (!sdev || !get_device(&sdev->sdev_gendev))
-                err = -ENODEV;
-        spin_unlock_irqrestore(q->queue_lock, flags);
-
-        if (!err) {
-                err = scsi_dh_handler_attach(sdev, scsi_dh);
-                put_device(&sdev->sdev_gendev);
-        }
-        return err;
-}
-EXPORT_SYMBOL_GPL(scsi_dh_attach);
-
-/*
- * scsi_dh_detach - Detach device handler
- * @q - Request queue that is associated with the scsi_device
- *      the handler should be detached from
- *
- * This function will detach the device handler only
- * if the sdev is not part of the internal list, ie
- * if it has been attached manually.
- */
-void scsi_dh_detach(struct request_queue *q)
-{
-        unsigned long flags;
-        struct scsi_device *sdev;
-        struct scsi_device_handler *scsi_dh = NULL;
-
-        spin_lock_irqsave(q->queue_lock, flags);
-        sdev = q->queuedata;
-        if (!sdev || !get_device(&sdev->sdev_gendev))
-                sdev = NULL;
-        spin_unlock_irqrestore(q->queue_lock, flags);
-
-        if (!sdev)
-                return;
-
-        if (sdev->scsi_dh_data) {
-                scsi_dh = sdev->scsi_dh_data->scsi_dh;
-                scsi_dh_handler_detach(sdev, scsi_dh);
-        }
-        put_device(&sdev->sdev_gendev);
-}
-EXPORT_SYMBOL_GPL(scsi_dh_detach);
-
-/*
- * scsi_dh_attached_handler_name - Get attached device handler's name
- * @q - Request queue that is associated with the scsi_device
- *      that may have a device handler attached
- * @gfp - the GFP mask used in the kmalloc() call when allocating memory
- *
- * Returns name of attached handler, NULL if no handler is attached.
- * Caller must take care to free the returned string.
- */
-const char *scsi_dh_attached_handler_name(struct request_queue *q, gfp_t gfp)
-{
-        unsigned long flags;
-        struct scsi_device *sdev;
-        const char *handler_name = NULL;
-
-        spin_lock_irqsave(q->queue_lock, flags);
-        sdev = q->queuedata;
-        if (!sdev || !get_device(&sdev->sdev_gendev))
-                sdev = NULL;
-        spin_unlock_irqrestore(q->queue_lock, flags);
-
-        if (!sdev)
-                return NULL;
-
-        if (sdev->scsi_dh_data)
-                handler_name = kstrdup(sdev->scsi_dh_data->scsi_dh->name, gfp);
-
-        put_device(&sdev->sdev_gendev);
-        return handler_name;
-}
-EXPORT_SYMBOL_GPL(scsi_dh_attached_handler_name);
-
-static struct notifier_block scsi_dh_nb = {
-        .notifier_call = scsi_dh_notifier
-};
-
-static int __init scsi_dh_init(void)
-{
-        int r;
-
-        r = bus_register_notifier(&scsi_bus_type, &scsi_dh_nb);
-
-        if (!r)
-                bus_for_each_dev(&scsi_bus_type, NULL, NULL,
-                                 scsi_dh_sysfs_attr_add);
-
-        return r;
-}
-
-static void __exit scsi_dh_exit(void)
-{
-        bus_for_each_dev(&scsi_bus_type, NULL, NULL,
-                         scsi_dh_sysfs_attr_remove);
-        bus_unregister_notifier(&scsi_bus_type, &scsi_dh_nb);
-}
-
-module_init(scsi_dh_init);
-module_exit(scsi_dh_exit);
-
-MODULE_DESCRIPTION("SCSI device handler");
-MODULE_AUTHOR("Chandra Seetharaman <sekharan@us.ibm.com>");
-MODULE_LICENSE("GPL");
diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c
index 854b568b9931..cc2773b5de68 100644
--- a/drivers/scsi/device_handler/scsi_dh_alua.c
+++ b/drivers/scsi/device_handler/scsi_dh_alua.c
@@ -62,7 +62,6 @@
 #define ALUA_OPTIMIZE_STPG              1
 
 struct alua_dh_data {
-        struct scsi_dh_data     dh_data;
         int                     group_id;
         int                     rel_port;
         int                     tpgs;
@@ -86,11 +85,6 @@ struct alua_dh_data {
 static char print_alua_state(int);
 static int alua_check_sense(struct scsi_device *, struct scsi_sense_hdr *);
 
-static inline struct alua_dh_data *get_alua_data(struct scsi_device *sdev)
-{
-        return container_of(sdev->scsi_dh_data, struct alua_dh_data, dh_data);
-}
-
 static int realloc_buffer(struct alua_dh_data *h, unsigned len)
 {
         if (h->buff && h->buff != h->inq)
@@ -708,7 +702,7 @@ out:
  */
 static int alua_set_params(struct scsi_device *sdev, const char *params)
 {
-        struct alua_dh_data *h = get_alua_data(sdev);
+        struct alua_dh_data *h = sdev->handler_data;
         unsigned int optimize = 0, argc;
         const char *p = params;
         int result = SCSI_DH_OK;
@@ -746,7 +740,7 @@ MODULE_PARM_DESC(optimize_stpg, "Allow use of a non-optimized path, rather than
 static int alua_activate(struct scsi_device *sdev,
                         activate_complete fn, void *data)
 {
-        struct alua_dh_data *h = get_alua_data(sdev);
+        struct alua_dh_data *h = sdev->handler_data;
         int err = SCSI_DH_OK;
         int stpg = 0;
 
@@ -804,7 +798,7 @@ out:
  */
 static int alua_prep_fn(struct scsi_device *sdev, struct request *req)
 {
-        struct alua_dh_data *h = get_alua_data(sdev);
+        struct alua_dh_data *h = sdev->handler_data;
         int ret = BLKPREP_OK;
 
         if (h->state == TPGS_STATE_TRANSITIONING)
@@ -819,23 +813,18 @@ static int alua_prep_fn(struct scsi_device *sdev, struct request *req)
 
 }
 
-static bool alua_match(struct scsi_device *sdev)
-{
-        return (scsi_device_tpgs(sdev) != 0);
-}
-
 /*
  * alua_bus_attach - Attach device handler
  * @sdev: device to be attached to
  */
-static struct scsi_dh_data *alua_bus_attach(struct scsi_device *sdev)
+static int alua_bus_attach(struct scsi_device *sdev)
 {
         struct alua_dh_data *h;
         int err;
 
         h = kzalloc(sizeof(*h) , GFP_KERNEL);
         if (!h)
-                return ERR_PTR(-ENOMEM);
+                return -ENOMEM;
         h->tpgs = TPGS_MODE_UNINITIALIZED;
         h->state = TPGS_STATE_OPTIMIZED;
         h->group_id = -1;
@@ -848,11 +837,11 @@ static struct scsi_dh_data *alua_bus_attach(struct scsi_device *sdev)
         if (err != SCSI_DH_OK && err != SCSI_DH_DEV_OFFLINED)
                 goto failed;
 
-        sdev_printk(KERN_NOTICE, sdev, "%s: Attached\n", ALUA_DH_NAME);
-        return &h->dh_data;
+        sdev->handler_data = h;
+        return 0;
 failed:
         kfree(h);
-        return ERR_PTR(-EINVAL);
+        return -EINVAL;
 }
 
 /*
@@ -861,10 +850,11 @@ failed:
  */
 static void alua_bus_detach(struct scsi_device *sdev)
 {
-        struct alua_dh_data *h = get_alua_data(sdev);
+        struct alua_dh_data *h = sdev->handler_data;
 
         if (h->buff && h->inq != h->buff)
                 kfree(h->buff);
+        sdev->handler_data = NULL;
         kfree(h);
 }
 
@@ -877,7 +867,6 @@ static struct scsi_device_handler alua_dh = {
         .check_sense = alua_check_sense,
         .activate = alua_activate,
         .set_params = alua_set_params,
-        .match = alua_match,
 };
 
 static int __init alua_init(void)
diff --git a/drivers/scsi/device_handler/scsi_dh_emc.c b/drivers/scsi/device_handler/scsi_dh_emc.c
index 6ed1caadbc6a..e6fb97cb12f4 100644
--- a/drivers/scsi/device_handler/scsi_dh_emc.c
+++ b/drivers/scsi/device_handler/scsi_dh_emc.c
@@ -72,7 +72,6 @@ static const char * lun_state[] =
 };
 
 struct clariion_dh_data {
-        struct scsi_dh_data dh_data;
         /*
          * Flags:
          *  CLARIION_SHORT_TRESPASS
@@ -114,13 +113,6 @@ struct clariion_dh_data {
         int current_sp;
 };
 
-static inline struct clariion_dh_data
-                        *get_clariion_data(struct scsi_device *sdev)
-{
-        return container_of(sdev->scsi_dh_data, struct clariion_dh_data,
-                        dh_data);
-}
-
 /*
  * Parse MODE_SELECT cmd reply.
  */
@@ -450,7 +442,7 @@ static int clariion_check_sense(struct scsi_device *sdev,
 
 static int clariion_prep_fn(struct scsi_device *sdev, struct request *req)
 {
-        struct clariion_dh_data *h = get_clariion_data(sdev);
+        struct clariion_dh_data *h = sdev->handler_data;
         int ret = BLKPREP_OK;
 
         if (h->lun_state != CLARIION_LUN_OWNED) {
@@ -533,7 +525,7 @@ retry:
 static int clariion_activate(struct scsi_device *sdev,
                                 activate_complete fn, void *data)
 {
-        struct clariion_dh_data *csdev = get_clariion_data(sdev);
+        struct clariion_dh_data *csdev = sdev->handler_data;
         int result;
 
         result = clariion_send_inquiry(sdev, csdev);
@@ -574,7 +566,7 @@ done:
  */
 static int clariion_set_params(struct scsi_device *sdev, const char *params)
 {
-        struct clariion_dh_data *csdev = get_clariion_data(sdev);
+        struct clariion_dh_data *csdev = sdev->handler_data;
         unsigned int hr = 0, st = 0, argc;
         const char *p = params;
         int result = SCSI_DH_OK;
@@ -622,42 +614,14 @@ done:
         return result;
 }
 
-static const struct {
-        char *vendor;
-        char *model;
-} clariion_dev_list[] = {
-        {"DGC", "RAID"},
-        {"DGC", "DISK"},
-        {"DGC", "VRAID"},
-        {NULL, NULL},
-};
-
-static bool clariion_match(struct scsi_device *sdev)
-{
-        int i;
-
-        if (scsi_device_tpgs(sdev))
-                return false;
-
-        for (i = 0; clariion_dev_list[i].vendor; i++) {
-                if (!strncmp(sdev->vendor, clariion_dev_list[i].vendor,
-                        strlen(clariion_dev_list[i].vendor)) &&
-                    !strncmp(sdev->model, clariion_dev_list[i].model,
-                        strlen(clariion_dev_list[i].model))) {
-                        return true;
-                }
-        }
-        return false;
-}
-
-static struct scsi_dh_data *clariion_bus_attach(struct scsi_device *sdev)
+static int clariion_bus_attach(struct scsi_device *sdev)
 {
         struct clariion_dh_data *h;
         int err;
 
         h = kzalloc(sizeof(*h) , GFP_KERNEL);
         if (!h)
-                return ERR_PTR(-ENOMEM);
+                return -ENOMEM;
         h->lun_state = CLARIION_LUN_UNINITIALIZED;
         h->default_sp = CLARIION_UNBOUND_LU;
         h->current_sp = CLARIION_UNBOUND_LU;
@@ -675,18 +639,19 @@ static struct scsi_dh_data *clariion_bus_attach(struct scsi_device *sdev)
                     CLARIION_NAME, h->current_sp + 'A',
                     h->port, lun_state[h->lun_state],
                     h->default_sp + 'A');
-        return &h->dh_data;
+
+        sdev->handler_data = h;
+        return 0;
 
 failed:
         kfree(h);
-        return ERR_PTR(-EINVAL);
+        return -EINVAL;
 }
 
 static void clariion_bus_detach(struct scsi_device *sdev)
 {
-        struct clariion_dh_data *h = get_clariion_data(sdev);
-
-        kfree(h);
+        kfree(sdev->handler_data);
+        sdev->handler_data = NULL;
 }
 
 static struct scsi_device_handler clariion_dh = {
@@ -698,7 +663,6 @@ static struct scsi_device_handler clariion_dh = {
         .activate       = clariion_activate,
         .prep_fn        = clariion_prep_fn,
         .set_params     = clariion_set_params,
-        .match          = clariion_match,
 };
 
 static int __init clariion_init(void)
diff --git a/drivers/scsi/device_handler/scsi_dh_hp_sw.c b/drivers/scsi/device_handler/scsi_dh_hp_sw.c
index 485d99544a15..9406d5f4a3d3 100644
--- a/drivers/scsi/device_handler/scsi_dh_hp_sw.c
+++ b/drivers/scsi/device_handler/scsi_dh_hp_sw.c
@@ -38,7 +38,6 @@
 #define HP_SW_PATH_PASSIVE              1
 
 struct hp_sw_dh_data {
-        struct scsi_dh_data dh_data;
         unsigned char sense[SCSI_SENSE_BUFFERSIZE];
         int path_state;
         int retries;
@@ -50,11 +49,6 @@ struct hp_sw_dh_data {
 
 static int hp_sw_start_stop(struct hp_sw_dh_data *);
 
-static inline struct hp_sw_dh_data *get_hp_sw_data(struct scsi_device *sdev)
-{
-        return container_of(sdev->scsi_dh_data, struct hp_sw_dh_data, dh_data);
-}
-
 /*
  * tur_done - Handle TEST UNIT READY return status
  * @sdev: sdev the command has been sent to
@@ -267,7 +261,7 @@ static int hp_sw_start_stop(struct hp_sw_dh_data *h)
 
 static int hp_sw_prep_fn(struct scsi_device *sdev, struct request *req)
 {
-        struct hp_sw_dh_data *h = get_hp_sw_data(sdev);
+        struct hp_sw_dh_data *h = sdev->handler_data;
         int ret = BLKPREP_OK;
 
         if (h->path_state != HP_SW_PATH_ACTIVE) {
@@ -292,7 +286,7 @@ static int hp_sw_activate(struct scsi_device *sdev,
                                 activate_complete fn, void *data)
 {
         int ret = SCSI_DH_OK;
-        struct hp_sw_dh_data *h = get_hp_sw_data(sdev);
+        struct hp_sw_dh_data *h = sdev->handler_data;
 
         ret = hp_sw_tur(sdev, h);
 
@@ -311,43 +305,14 @@ static int hp_sw_activate(struct scsi_device *sdev,
         return 0;
 }
 
-static const struct {
-        char *vendor;
-        char *model;
-} hp_sw_dh_data_list[] = {
-        {"COMPAQ", "MSA1000 VOLUME"},
-        {"COMPAQ", "HSV110"},
-        {"HP", "HSV100"},
-        {"DEC", "HSG80"},
-        {NULL, NULL},
-};
-
-static bool hp_sw_match(struct scsi_device *sdev)
-{
-        int i;
-
-        if (scsi_device_tpgs(sdev))
-                return false;
-
-        for (i = 0; hp_sw_dh_data_list[i].vendor; i++) {
-                if (!strncmp(sdev->vendor, hp_sw_dh_data_list[i].vendor,
-                        strlen(hp_sw_dh_data_list[i].vendor)) &&
-                    !strncmp(sdev->model, hp_sw_dh_data_list[i].model,
-                        strlen(hp_sw_dh_data_list[i].model))) {
-                        return true;
-                }
-        }
-        return false;
-}
-
-static struct scsi_dh_data *hp_sw_bus_attach(struct scsi_device *sdev)
+static int hp_sw_bus_attach(struct scsi_device *sdev)
 {
         struct hp_sw_dh_data *h;
         int ret;
 
         h = kzalloc(sizeof(*h), GFP_KERNEL);
         if (!h)
-                return ERR_PTR(-ENOMEM);
+                return -ENOMEM;
         h->path_state = HP_SW_PATH_UNINITIALIZED;
         h->retries = HP_SW_RETRIES;
         h->sdev = sdev;
@@ -359,17 +324,18 @@ static struct scsi_dh_data *hp_sw_bus_attach(struct scsi_device *sdev)
         sdev_printk(KERN_INFO, sdev, "%s: attached to %s path\n",
                     HP_SW_NAME, h->path_state == HP_SW_PATH_ACTIVE?
                     "active":"passive");
-        return &h->dh_data;
+
+        sdev->handler_data = h;
+        return 0;
 failed:
         kfree(h);
-        return ERR_PTR(-EINVAL);
+        return -EINVAL;
 }
 
 static void hp_sw_bus_detach( struct scsi_device *sdev )
 {
-        struct hp_sw_dh_data *h = get_hp_sw_data(sdev);
-
-        kfree(h);
+        kfree(sdev->handler_data);
+        sdev->handler_data = NULL;
 }
 
 static struct scsi_device_handler hp_sw_dh = {
@@ -379,7 +345,6 @@ static struct scsi_device_handler hp_sw_dh = {
         .detach         = hp_sw_bus_detach,
         .activate       = hp_sw_activate,
         .prep_fn        = hp_sw_prep_fn,
-        .match          = hp_sw_match,
 };
 
 static int __init hp_sw_init(void)
diff --git a/drivers/scsi/device_handler/scsi_dh_rdac.c b/drivers/scsi/device_handler/scsi_dh_rdac.c
index b46ace3d4bf0..361358134315 100644
--- a/drivers/scsi/device_handler/scsi_dh_rdac.c
+++ b/drivers/scsi/device_handler/scsi_dh_rdac.c
@@ -181,7 +181,6 @@ struct c2_inquiry {
 };
 
 struct rdac_dh_data {
-        struct scsi_dh_data     dh_data;
         struct rdac_controller  *ctlr;
 #define UNINITIALIZED_LUN       (1 << 8)
         unsigned                lun;
@@ -260,11 +259,6 @@ do { \
                 sdev_printk(KERN_INFO, sdev, RDAC_NAME ": " f "\n", ## arg); \
 } while (0);
 
-static inline struct rdac_dh_data *get_rdac_data(struct scsi_device *sdev)
-{
-        return container_of(sdev->scsi_dh_data, struct rdac_dh_data, dh_data);
-}
-
 static struct request *get_rdac_req(struct scsi_device *sdev,
                         void *buffer, unsigned buflen, int rw)
 {
@@ -544,7 +538,7 @@ static int mode_select_handle_sense(struct scsi_device *sdev,
 {
         struct scsi_sense_hdr sense_hdr;
         int err = SCSI_DH_IO, ret;
-        struct rdac_dh_data *h = get_rdac_data(sdev);
+        struct rdac_dh_data *h = sdev->handler_data;
 
         ret = scsi_normalize_sense(sensebuf, SCSI_SENSE_BUFFERSIZE, &sense_hdr);
         if (!ret)
@@ -589,7 +583,7 @@ static void send_mode_select(struct work_struct *work)
                 container_of(work, struct rdac_controller, ms_work);
         struct request *rq;
         struct scsi_device *sdev = ctlr->ms_sdev;
-        struct rdac_dh_data *h = get_rdac_data(sdev);
+        struct rdac_dh_data *h = sdev->handler_data;
         struct request_queue *q = sdev->request_queue;
         int err, retry_cnt = RDAC_RETRY_COUNT;
         struct rdac_queue_data *tmp, *qdata;
@@ -648,7 +642,7 @@ static int queue_mode_select(struct scsi_device *sdev,
         if (!qdata)
                 return SCSI_DH_RETRY;
 
-        qdata->h = get_rdac_data(sdev);
+        qdata->h = sdev->handler_data;
         qdata->callback_fn = fn;
         qdata->callback_data = data;
 
@@ -667,7 +661,7 @@ static int queue_mode_select(struct scsi_device *sdev,
 static int rdac_activate(struct scsi_device *sdev,
                         activate_complete fn, void *data)
 {
-        struct rdac_dh_data *h = get_rdac_data(sdev);
+        struct rdac_dh_data *h = sdev->handler_data;
         int err = SCSI_DH_OK;
         int act = 0;
 
@@ -702,7 +696,7 @@ done:
 
 static int rdac_prep_fn(struct scsi_device *sdev, struct request *req)
 {
-        struct rdac_dh_data *h = get_rdac_data(sdev);
+        struct rdac_dh_data *h = sdev->handler_data;
         int ret = BLKPREP_OK;
 
         if (h->state != RDAC_STATE_ACTIVE) {
@@ -716,7 +710,7 @@ static int rdac_prep_fn(struct scsi_device *sdev, struct request *req)
 static int rdac_check_sense(struct scsi_device *sdev,
                                 struct scsi_sense_hdr *sense_hdr)
 {
-        struct rdac_dh_data *h = get_rdac_data(sdev);
+        struct rdac_dh_data *h = sdev->handler_data;
 
         RDAC_LOG(RDAC_LOG_SENSE, sdev, "array %s, ctlr %d, "
                         "I/O returned with sense %02x/%02x/%02x",
@@ -778,56 +772,7 @@ static int rdac_check_sense(struct scsi_device *sdev,
         return SCSI_RETURN_NOT_HANDLED;
 }
 
-static const struct {
-        char *vendor;
-        char *model;
-} rdac_dev_list[] = {
-        {"IBM", "1722"},
-        {"IBM", "1724"},
-        {"IBM", "1726"},
-        {"IBM", "1742"},
-        {"IBM", "1745"},
-        {"IBM", "1746"},
-        {"IBM", "1813"},
-        {"IBM", "1814"},
-        {"IBM", "1815"},
-        {"IBM", "1818"},
-        {"IBM", "3526"},
-        {"SGI", "TP9"},
-        {"SGI", "IS"},
-        {"STK", "OPENstorage D280"},
-        {"STK", "FLEXLINE 380"},
-        {"SUN", "CSM"},
-        {"SUN", "LCSM100"},
-        {"SUN", "STK6580_6780"},
-        {"SUN", "SUN_6180"},
-        {"SUN", "ArrayStorage"},
-        {"DELL", "MD3"},
-        {"NETAPP", "INF-01-00"},
-        {"LSI", "INF-01-00"},
-        {"ENGENIO", "INF-01-00"},
-        {NULL, NULL},
-};
-
-static bool rdac_match(struct scsi_device *sdev)
-{
-        int i;
-
-        if (scsi_device_tpgs(sdev))
-                return false;
-
-        for (i = 0; rdac_dev_list[i].vendor; i++) {
-                if (!strncmp(sdev->vendor, rdac_dev_list[i].vendor,
-                        strlen(rdac_dev_list[i].vendor)) &&
-                    !strncmp(sdev->model, rdac_dev_list[i].model,
-                        strlen(rdac_dev_list[i].model))) {
-                        return true;
-                }
-        }
-        return false;
-}
-
-static struct scsi_dh_data *rdac_bus_attach(struct scsi_device *sdev)
+static int rdac_bus_attach(struct scsi_device *sdev)
 {
         struct rdac_dh_data *h;
         int err;
@@ -836,7 +781,7 @@ static struct scsi_dh_data *rdac_bus_attach(struct scsi_device *sdev)
 
         h = kzalloc(sizeof(*h) , GFP_KERNEL);
         if (!h)
-                return ERR_PTR(-ENOMEM);
+                return -ENOMEM;
         h->lun = UNINITIALIZED_LUN;
         h->state = RDAC_STATE_ACTIVE;
 
@@ -861,7 +806,8 @@ static struct scsi_dh_data *rdac_bus_attach(struct scsi_device *sdev)
                     RDAC_NAME, h->lun, mode[(int)h->mode],
                     lun_state[(int)h->lun_state]);
 
-        return &h->dh_data;
+        sdev->handler_data = h;
+        return 0;
 
 clean_ctlr:
         spin_lock(&list_lock);
@@ -870,12 +816,12 @@ clean_ctlr:
 
 failed:
         kfree(h);
-        return ERR_PTR(-EINVAL);
+        return -EINVAL;
 }
 
 static void rdac_bus_detach( struct scsi_device *sdev )
 {
-        struct rdac_dh_data *h = get_rdac_data(sdev);
+        struct rdac_dh_data *h = sdev->handler_data;
 
         if (h->ctlr && h->ctlr->ms_queued)
                 flush_workqueue(kmpath_rdacd);
@@ -884,6 +830,7 @@ static void rdac_bus_detach( struct scsi_device *sdev )
         if (h->ctlr)
                 kref_put(&h->ctlr->kref, release_controller);
         spin_unlock(&list_lock);
+        sdev->handler_data = NULL;
         kfree(h);
 }
 
@@ -895,7 +842,6 @@ static struct scsi_device_handler rdac_dh = {
         .attach = rdac_bus_attach,
         .detach = rdac_bus_detach,
         .activate = rdac_activate,
-        .match = rdac_match,
 };
 
 static int __init rdac_init(void)
diff --git a/drivers/scsi/fcoe/fcoe.c b/drivers/scsi/fcoe/fcoe.c
index ec193a8357d7..d3eb80c46bbe 100644
--- a/drivers/scsi/fcoe/fcoe.c
+++ b/drivers/scsi/fcoe/fcoe.c
@@ -364,7 +364,7 @@ static int fcoe_interface_setup(struct fcoe_interface *fcoe,
          * on the ethertype for the given device
          */
         fcoe->fcoe_packet_type.func = fcoe_rcv;
-        fcoe->fcoe_packet_type.type = __constant_htons(ETH_P_FCOE);
+        fcoe->fcoe_packet_type.type = htons(ETH_P_FCOE);
         fcoe->fcoe_packet_type.dev = netdev;
         dev_add_pack(&fcoe->fcoe_packet_type);
 
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index 341191952155..b62836ddbbee 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -4555,7 +4555,7 @@ static ssize_t ipr_store_raw_mode(struct device *dev,
         spin_lock_irqsave(ioa_cfg->host->host_lock, lock_flags);
         res = (struct ipr_resource_entry *)sdev->hostdata;
         if (res) {
-                if (ioa_cfg->sis64 && ipr_is_af_dasd_device(res)) {
+                if (ipr_is_af_dasd_device(res)) {
                         res->raw_mode = simple_strtoul(buf, NULL, 10);
                         len = strlen(buf);
                         if (res->sdev)
@@ -6383,9 +6383,13 @@ static int ipr_queuecommand(struct Scsi_Host *shost,
             (!ipr_is_gscsi(res) || scsi_cmd->cmnd[0] == IPR_QUERY_RSRC_STATE)) {
                 ioarcb->cmd_pkt.request_type = IPR_RQTYPE_IOACMD;
         }
-        if (res->raw_mode && ipr_is_af_dasd_device(res))
+        if (res->raw_mode && ipr_is_af_dasd_device(res)) {
                 ioarcb->cmd_pkt.request_type = IPR_RQTYPE_PIPE;
 
+                if (scsi_cmd->underflow == 0)
+                        ioarcb->cmd_pkt.flags_hi |= IPR_FLAGS_HI_NO_ULEN_CHK;
+        }
+
         if (ioa_cfg->sis64)
                 rc = ipr_build_ioadl64(ioa_cfg, ipr_cmd);
         else
diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index 98d9bb6ff725..33c74d3436c9 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -853,12 +853,9 @@ static void iscsi_scsi_cmd_rsp(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
                                      SAM_STAT_CHECK_CONDITION;
                         scsi_build_sense_buffer(1, sc->sense_buffer,
                                                 ILLEGAL_REQUEST, 0x10, ascq);
-                        sc->sense_buffer[7] = 0xc; /* Additional sense length */
-                        sc->sense_buffer[8] = 0;   /* Information desc type */
-                        sc->sense_buffer[9] = 0xa; /* Additional desc length */
-                        sc->sense_buffer[10] = 0x80; /* Validity bit */
-
-                        put_unaligned_be64(sector, &sc->sense_buffer[12]);
+                        scsi_set_sense_information(sc->sense_buffer,
+                                                   SCSI_SENSE_BUFFERSIZE,
+                                                   sector);
                         goto out;
                 }
         }
diff --git a/drivers/scsi/lpfc/lpfc_mbox.c b/drivers/scsi/lpfc/lpfc_mbox.c
index eb627724417e..4abb93a83e0f 100644
--- a/drivers/scsi/lpfc/lpfc_mbox.c
+++ b/drivers/scsi/lpfc/lpfc_mbox.c
@@ -2284,7 +2284,7 @@ lpfc_mbx_cmpl_rdp_page_a2(struct lpfc_hba *phba, LPFC_MBOXQ_t *mbox)
                         (struct lpfc_rdp_context *)(mbox->context2);
 
         if (bf_get(lpfc_mqe_status, &mbox->u.mqe))
-                goto error;
+                goto error_mbuf_free;
 
         lpfc_sli_bemem_bcopy(mp->virt, &rdp_context->page_a2,
                                 DMP_SFF_PAGE_A2_SIZE);
@@ -2299,13 +2299,14 @@ lpfc_mbx_cmpl_rdp_page_a2(struct lpfc_hba *phba, LPFC_MBOXQ_t *mbox)
         mbox->mbox_cmpl = lpfc_mbx_cmpl_rdp_link_stat;
         mbox->context2 = (struct lpfc_rdp_context *) rdp_context;
         if (lpfc_sli_issue_mbox(phba, mbox, MBX_NOWAIT) == MBX_NOT_FINISHED)
-                goto error;
+                goto error_cmd_free;
 
         return;
 
-error:
+error_mbuf_free:
         lpfc_mbuf_free(phba, mp->virt, mp->phys);
         kfree(mp);
+error_cmd_free:
         lpfc_sli4_mbox_cmd_free(phba, mbox);
         rdp_context->cmpl(phba, rdp_context, FAILURE);
 }
diff --git a/drivers/scsi/mpt2sas/mpt2sas_base.c b/drivers/scsi/mpt2sas/mpt2sas_base.c
index 6dec7cff316f..c167911221e9 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_base.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_base.c
@@ -112,9 +112,12 @@ _scsih_set_fwfault_debug(const char *val, struct kernel_param *kp)
         if (ret)
                 return ret;
 
+        /* global ioc spinlock to protect controller list on list operations */
         printk(KERN_INFO "setting fwfault_debug(%d)\n", mpt2sas_fwfault_debug);
+        spin_lock(&gioc_lock);
         list_for_each_entry(ioc, &mpt2sas_ioc_list, list)
                 ioc->fwfault_debug = mpt2sas_fwfault_debug;
+        spin_unlock(&gioc_lock);
         return 0;
 }
 
@@ -4437,6 +4440,8 @@ mpt2sas_base_free_resources(struct MPT2SAS_ADAPTER *ioc)
         dexitprintk(ioc, printk(MPT2SAS_INFO_FMT "%s\n", ioc->name,
             __func__));
 
+        /* synchronizing freeing resource with pci_access_mutex lock */
+        mutex_lock(&ioc->pci_access_mutex);
         if (ioc->chip_phys && ioc->chip) {
                 _base_mask_interrupts(ioc);
                 ioc->shost_recovery = 1;
@@ -4456,6 +4461,7 @@ mpt2sas_base_free_resources(struct MPT2SAS_ADAPTER *ioc)
                 pci_disable_pcie_error_reporting(pdev);
                 pci_disable_device(pdev);
         }
+        mutex_unlock(&ioc->pci_access_mutex);
         return;
 }
 
diff --git a/drivers/scsi/mpt2sas/mpt2sas_base.h b/drivers/scsi/mpt2sas/mpt2sas_base.h
index caff8d10cca4..97ea360c6920 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_base.h
+++ b/drivers/scsi/mpt2sas/mpt2sas_base.h
@@ -238,6 +238,7 @@
  * @flags: MPT_TARGET_FLAGS_XXX flags
  * @deleted: target flaged for deletion
  * @tm_busy: target is busy with TM request.
+ * @sdev: The sas_device associated with this target
  */
 struct MPT2SAS_TARGET {
         struct scsi_target *starget;
@@ -248,6 +249,7 @@ struct MPT2SAS_TARGET {
         u32     flags;
         u8      deleted;
         u8      tm_busy;
+        struct _sas_device *sdev;
 };
 
 
@@ -376,8 +378,24 @@ struct _sas_device {
         u8      phy;
         u8      responding;
         u8      pfa_led_on;
+        struct kref refcount;
 };
 
+static inline void sas_device_get(struct _sas_device *s)
+{
+        kref_get(&s->refcount);
+}
+
+static inline void sas_device_free(struct kref *r)
+{
+        kfree(container_of(r, struct _sas_device, refcount));
+}
+
+static inline void sas_device_put(struct _sas_device *s)
+{
+        kref_put(&s->refcount, sas_device_free);
+}
+
 /**
  * struct _raid_device - raid volume link list
  * @list: sas device list
@@ -799,6 +817,12 @@ typedef void (*MPT2SAS_FLUSH_RUNNING_CMDS)(struct MPT2SAS_ADAPTER *ioc);
  * @delayed_tr_list: target reset link list
  * @delayed_tr_volume_list: volume target reset link list
  * @@temp_sensors_count: flag to carry the number of temperature sensors
+ * @pci_access_mutex: Mutex to synchronize ioctl,sysfs show path and
+ * pci resource handling. PCI resource freeing will lead to free
+ * vital hardware/memory resource, which might be in use by cli/sysfs
+ * path functions resulting in Null pointer reference followed by kernel
+ * crash. To avoid the above race condition we use mutex syncrhonization
+ * which ensures the syncrhonization between cli/sysfs_show path
  */
 struct MPT2SAS_ADAPTER {
         struct list_head list;
@@ -1015,6 +1039,7 @@ struct MPT2SAS_ADAPTER {
         u8              mfg_pg10_hide_flag;
         u8              hide_drives;
 
+        struct mutex pci_access_mutex;
 };
 
 typedef u8 (*MPT_CALLBACK)(struct MPT2SAS_ADAPTER *ioc, u16 smid, u8 msix_index,
@@ -1023,6 +1048,17 @@ typedef u8 (*MPT_CALLBACK)(struct MPT2SAS_ADAPTER *ioc, u16 smid, u8 msix_index,
 
 /* base shared API */
 extern struct list_head mpt2sas_ioc_list;
+/* spinlock on list operations over IOCs
+ * Case: when multiple warpdrive cards(IOCs) are in use
+ * Each IOC will added to the ioc list stucture on initialization.
+ * Watchdog threads run at regular intervals to check IOC for any
+ * fault conditions which will trigger the dead_ioc thread to
+ * deallocate pci resource, resulting deleting the IOC netry from list,
+ * this deletion need to protected by spinlock to enusre that
+ * ioc removal is syncrhonized, if not synchronized it might lead to
+ * list_del corruption as the ioc list is traversed in cli path
+ */
+extern spinlock_t gioc_lock;
 void mpt2sas_base_start_watchdog(struct MPT2SAS_ADAPTER *ioc);
 void mpt2sas_base_stop_watchdog(struct MPT2SAS_ADAPTER *ioc);
 
@@ -1095,11 +1131,12 @@ struct _sas_node *mpt2sas_scsih_expander_find_by_handle(struct MPT2SAS_ADAPTER *
     u16 handle);
 struct _sas_node *mpt2sas_scsih_expander_find_by_sas_address(struct MPT2SAS_ADAPTER
     *ioc, u64 sas_address);
-struct _sas_device *mpt2sas_scsih_sas_device_find_by_sas_address(
+struct _sas_device *mpt2sas_get_sdev_by_addr(
+    struct MPT2SAS_ADAPTER *ioc, u64 sas_address);
+struct _sas_device *__mpt2sas_get_sdev_by_addr(
     struct MPT2SAS_ADAPTER *ioc, u64 sas_address);
 
 void mpt2sas_port_enable_complete(struct MPT2SAS_ADAPTER *ioc);
-
 void mpt2sas_scsih_reset_handler(struct MPT2SAS_ADAPTER *ioc, int reset_phase);
 
 /* config shared API */
diff --git a/drivers/scsi/mpt2sas/mpt2sas_ctl.c b/drivers/scsi/mpt2sas/mpt2sas_ctl.c
index 4e509604b571..3694b63bd993 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_ctl.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_ctl.c
@@ -427,13 +427,16 @@ static int
 _ctl_verify_adapter(int ioc_number, struct MPT2SAS_ADAPTER **iocpp)
 {
         struct MPT2SAS_ADAPTER *ioc;
-
+        /* global ioc lock to protect controller on list operations */
+        spin_lock(&gioc_lock);
         list_for_each_entry(ioc, &mpt2sas_ioc_list, list) {
                 if (ioc->id != ioc_number)
                         continue;
+                spin_unlock(&gioc_lock);
                 *iocpp = ioc;
                 return ioc_number;
         }
+        spin_unlock(&gioc_lock);
         *iocpp = NULL;
         return -1;
 }
@@ -522,10 +525,15 @@ _ctl_poll(struct file *filep, poll_table *wait)
 
         poll_wait(filep, &ctl_poll_wait, wait);
 
+        /* global ioc lock to protect controller on list operations */
+        spin_lock(&gioc_lock);
         list_for_each_entry(ioc, &mpt2sas_ioc_list, list) {
-                if (ioc->aen_event_read_flag)
+                if (ioc->aen_event_read_flag) {
+                        spin_unlock(&gioc_lock);
                         return POLLIN | POLLRDNORM;
+                }
         }
+        spin_unlock(&gioc_lock);
         return 0;
 }
 
@@ -2168,16 +2176,23 @@ _ctl_ioctl_main(struct file *file, unsigned int cmd, void __user *arg,
 
         if (_ctl_verify_adapter(ioctl_header.ioc_number, &ioc) == -1 || !ioc)
                 return -ENODEV;
+        /* pci_access_mutex lock acquired by ioctl path */
+        mutex_lock(&ioc->pci_access_mutex);
         if (ioc->shost_recovery || ioc->pci_error_recovery ||
-            ioc->is_driver_loading)
-                return -EAGAIN;
+                ioc->is_driver_loading || ioc->remove_host) {
+                ret = -EAGAIN;
+                goto out_unlock_pciaccess;
+        }
 
         state = (file->f_flags & O_NONBLOCK) ? NON_BLOCKING : BLOCKING;
         if (state == NON_BLOCKING) {
-                if (!mutex_trylock(&ioc->ctl_cmds.mutex))
-                        return -EAGAIN;
+                if (!mutex_trylock(&ioc->ctl_cmds.mutex)) {
+                        ret = -EAGAIN;
+                        goto out_unlock_pciaccess;
+                }
         } else if (mutex_lock_interruptible(&ioc->ctl_cmds.mutex)) {
-                return -ERESTARTSYS;
+                ret = -ERESTARTSYS;
+                goto out_unlock_pciaccess;
         }
 
         switch (cmd) {
@@ -2258,6 +2273,8 @@ _ctl_ioctl_main(struct file *file, unsigned int cmd, void __user *arg,
         }
 
         mutex_unlock(&ioc->ctl_cmds.mutex);
+out_unlock_pciaccess:
+        mutex_unlock(&ioc->pci_access_mutex);
         return ret;
 }
 
@@ -2711,6 +2728,12 @@ _ctl_BRM_status_show(struct device *cdev, struct device_attribute *attr,
                     "warpdrive\n", ioc->name, __func__);
                 goto out;
         }
+        /* pci_access_mutex lock acquired by sysfs show path */
+        mutex_lock(&ioc->pci_access_mutex);
+        if (ioc->pci_error_recovery || ioc->remove_host) {
+                mutex_unlock(&ioc->pci_access_mutex);
+                return 0;
+        }
 
         /* allocate upto GPIOVal 36 entries */
         sz = offsetof(Mpi2IOUnitPage3_t, GPIOVal) + (sizeof(u16) * 36);
@@ -2749,6 +2772,7 @@ _ctl_BRM_status_show(struct device *cdev, struct device_attribute *attr,
 
  out:
         kfree(io_unit_pg3);
+        mutex_unlock(&ioc->pci_access_mutex);
         return rc;
 }
 static DEVICE_ATTR(BRM_status, S_IRUGO, _ctl_BRM_status_show, NULL);
diff --git a/drivers/scsi/mpt2sas/mpt2sas_scsih.c b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
index 3f26147bbc64..0ad09b2bff9c 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
@@ -79,7 +79,8 @@ static int _scsih_scan_finished(struct Scsi_Host *shost, unsigned long time);
 
 /* global parameters */
 LIST_HEAD(mpt2sas_ioc_list);
-
+/* global ioc lock for list operations */
+DEFINE_SPINLOCK(gioc_lock);
 /* local parameters */
 static u8 scsi_io_cb_idx = -1;
 static u8 tm_cb_idx = -1;
@@ -176,9 +177,37 @@ struct fw_event_work {
         u8                      VP_ID;
         u8                      ignore;
         u16                     event;
+        struct kref             refcount;
         char                    event_data[0] __aligned(4);
 };
 
+static void fw_event_work_free(struct kref *r)
+{
+        kfree(container_of(r, struct fw_event_work, refcount));
+}
+
+static void fw_event_work_get(struct fw_event_work *fw_work)
+{
+        kref_get(&fw_work->refcount);
+}
+
+static void fw_event_work_put(struct fw_event_work *fw_work)
+{
+        kref_put(&fw_work->refcount, fw_event_work_free);
+}
+
+static struct fw_event_work *alloc_fw_event_work(int len)
+{
+        struct fw_event_work *fw_event;
+
+        fw_event = kzalloc(sizeof(*fw_event) + len, GFP_ATOMIC);
+        if (!fw_event)
+                return NULL;
+
+        kref_init(&fw_event->refcount);
+        return fw_event;
+}
+
 /* raid transport support */
 static struct raid_template *mpt2sas_raid_template;
 
@@ -293,8 +322,10 @@ _scsih_set_debug_level(const char *val, struct kernel_param *kp)
                 return ret;
 
         printk(KERN_INFO "setting logging_level(0x%08x)\n", logging_level);
+        spin_lock(&gioc_lock);
         list_for_each_entry(ioc, &mpt2sas_ioc_list, list)
                 ioc->logging_level = logging_level;
+        spin_unlock(&gioc_lock);
         return 0;
 }
 module_param_call(logging_level, _scsih_set_debug_level, param_get_int,
@@ -526,8 +557,61 @@ _scsih_determine_boot_device(struct MPT2SAS_ADAPTER *ioc,
         }
 }
 
+static struct _sas_device *
+__mpt2sas_get_sdev_from_target(struct MPT2SAS_ADAPTER *ioc,
+                struct MPT2SAS_TARGET *tgt_priv)
+{
+        struct _sas_device *ret;
+
+        assert_spin_locked(&ioc->sas_device_lock);
+
+        ret = tgt_priv->sdev;
+        if (ret)
+                sas_device_get(ret);
+
+        return ret;
+}
+
+static struct _sas_device *
+mpt2sas_get_sdev_from_target(struct MPT2SAS_ADAPTER *ioc,
+                struct MPT2SAS_TARGET *tgt_priv)
+{
+        struct _sas_device *ret;
+        unsigned long flags;
+
+        spin_lock_irqsave(&ioc->sas_device_lock, flags);
+        ret = __mpt2sas_get_sdev_from_target(ioc, tgt_priv);
+        spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
+
+        return ret;
+}
+
+
+struct _sas_device *
+__mpt2sas_get_sdev_by_addr(struct MPT2SAS_ADAPTER *ioc,
+    u64 sas_address)
+{
+        struct _sas_device *sas_device;
+
+        assert_spin_locked(&ioc->sas_device_lock);
+
+        list_for_each_entry(sas_device, &ioc->sas_device_list, list)
+                if (sas_device->sas_address == sas_address)
+                        goto found_device;
+
+        list_for_each_entry(sas_device, &ioc->sas_device_init_list, list)
+                if (sas_device->sas_address == sas_address)
+                        goto found_device;
+
+        return NULL;
+
+found_device:
+        sas_device_get(sas_device);
+        return sas_device;
+}
+
 /**
- * mpt2sas_scsih_sas_device_find_by_sas_address - sas device search
+ * mpt2sas_get_sdev_by_addr - sas device search
  * @ioc: per adapter object
  * @sas_address: sas address
  * Context: Calling function should acquire ioc->sas_device_lock
@@ -536,24 +620,44 @@ _scsih_determine_boot_device(struct MPT2SAS_ADAPTER *ioc,
  * object.
  */
 struct _sas_device *
-mpt2sas_scsih_sas_device_find_by_sas_address(struct MPT2SAS_ADAPTER *ioc,
+mpt2sas_get_sdev_by_addr(struct MPT2SAS_ADAPTER *ioc,
     u64 sas_address)
 {
         struct _sas_device *sas_device;
+        unsigned long flags;
+
+        spin_lock_irqsave(&ioc->sas_device_lock, flags);
+        sas_device = __mpt2sas_get_sdev_by_addr(ioc,
+                        sas_address);
+        spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
+
+        return sas_device;
+}
+
+static struct _sas_device *
+__mpt2sas_get_sdev_by_handle(struct MPT2SAS_ADAPTER *ioc, u16 handle)
+{
+        struct _sas_device *sas_device;
+
+        assert_spin_locked(&ioc->sas_device_lock);
 
         list_for_each_entry(sas_device, &ioc->sas_device_list, list)
-                if (sas_device->sas_address == sas_address)
-                        return sas_device;
+                if (sas_device->handle == handle)
+                        goto found_device;
 
         list_for_each_entry(sas_device, &ioc->sas_device_init_list, list)
-                if (sas_device->sas_address == sas_address)
-                        return sas_device;
+                if (sas_device->handle == handle)
+                        goto found_device;
 
         return NULL;
+
+found_device:
+        sas_device_get(sas_device);
+        return sas_device;
 }
 
 /**
- * _scsih_sas_device_find_by_handle - sas device search
+ * mpt2sas_get_sdev_by_handle - sas device search
  * @ioc: per adapter object
  * @handle: sas device handle (assigned by firmware)
  * Context: Calling function should acquire ioc->sas_device_lock
@@ -562,19 +666,16 @@ mpt2sas_scsih_sas_device_find_by_sas_address(struct MPT2SAS_ADAPTER *ioc,
  * object.
  */
 static struct _sas_device *
-_scsih_sas_device_find_by_handle(struct MPT2SAS_ADAPTER *ioc, u16 handle)
+mpt2sas_get_sdev_by_handle(struct MPT2SAS_ADAPTER *ioc, u16 handle)
 {
         struct _sas_device *sas_device;
+        unsigned long flags;
 
-        list_for_each_entry(sas_device, &ioc->sas_device_list, list)
-                if (sas_device->handle == handle)
-                        return sas_device;
-
-        list_for_each_entry(sas_device, &ioc->sas_device_init_list, list)
-                if (sas_device->handle == handle)
-                        return sas_device;
+        spin_lock_irqsave(&ioc->sas_device_lock, flags);
+        sas_device = __mpt2sas_get_sdev_by_handle(ioc, handle);
+        spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
 
-        return NULL;
+        return sas_device;
 }
 
 /**
@@ -583,7 +684,7 @@ _scsih_sas_device_find_by_handle(struct MPT2SAS_ADAPTER *ioc, u16 handle)
  * @sas_device: the sas_device object
  * Context: This function will acquire ioc->sas_device_lock.
  *
- * Removing object and freeing associated memory from the ioc->sas_device_list.
+ * If sas_device is on the list, remove it and decrement its reference count.
  */
 static void
 _scsih_sas_device_remove(struct MPT2SAS_ADAPTER *ioc,
@@ -594,9 +695,15 @@ _scsih_sas_device_remove(struct MPT2SAS_ADAPTER *ioc,
         if (!sas_device)
                 return;
 
+        /*
+         * The lock serializes access to the list, but we still need to verify
+         * that nobody removed the entry while we were waiting on the lock.
+         */
         spin_lock_irqsave(&ioc->sas_device_lock, flags);
-        list_del(&sas_device->list);
-        kfree(sas_device);
+        if (!list_empty(&sas_device->list)) {
+                list_del_init(&sas_device->list);
+                sas_device_put(sas_device);
+        }
         spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
 }
 
@@ -620,6 +727,7 @@ _scsih_sas_device_add(struct MPT2SAS_ADAPTER *ioc,
             sas_device->handle, (unsigned long long)sas_device->sas_address));
 
         spin_lock_irqsave(&ioc->sas_device_lock, flags);
+        sas_device_get(sas_device);
         list_add_tail(&sas_device->list, &ioc->sas_device_list);
         spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
 
@@ -659,6 +767,7 @@ _scsih_sas_device_init_add(struct MPT2SAS_ADAPTER *ioc,
             sas_device->handle, (unsigned long long)sas_device->sas_address));
 
         spin_lock_irqsave(&ioc->sas_device_lock, flags);
+        sas_device_get(sas_device);
         list_add_tail(&sas_device->list, &ioc->sas_device_init_list);
         _scsih_determine_boot_device(ioc, sas_device, 0);
         spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
@@ -1208,12 +1317,15 @@ _scsih_change_queue_depth(struct scsi_device *sdev, int qdepth)
                 goto not_sata;
         if ((sas_target_priv_data->flags & MPT_TARGET_FLAGS_VOLUME))
                 goto not_sata;
+
         spin_lock_irqsave(&ioc->sas_device_lock, flags);
-        sas_device = mpt2sas_scsih_sas_device_find_by_sas_address(ioc,
-           sas_device_priv_data->sas_target->sas_address);
-        if (sas_device && sas_device->device_info &
-            MPI2_SAS_DEVICE_INFO_SATA_DEVICE)
-                max_depth = MPT2SAS_SATA_QUEUE_DEPTH;
+        sas_device = __mpt2sas_get_sdev_from_target(ioc, sas_target_priv_data);
+        if (sas_device) {
+                if (sas_device->device_info & MPI2_SAS_DEVICE_INFO_SATA_DEVICE)
+                        max_depth = MPT2SAS_SATA_QUEUE_DEPTH;
+
+                sas_device_put(sas_device);
+        }
         spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
 
  not_sata:
@@ -1271,18 +1383,20 @@ _scsih_target_alloc(struct scsi_target *starget)
         /* sas/sata devices */
         spin_lock_irqsave(&ioc->sas_device_lock, flags);
         rphy = dev_to_rphy(starget->dev.parent);
-        sas_device = mpt2sas_scsih_sas_device_find_by_sas_address(ioc,
+        sas_device = __mpt2sas_get_sdev_by_addr(ioc,
            rphy->identify.sas_address);
 
         if (sas_device) {
                 sas_target_priv_data->handle = sas_device->handle;
                 sas_target_priv_data->sas_address = sas_device->sas_address;
+                sas_target_priv_data->sdev = sas_device;
                 sas_device->starget = starget;
                 sas_device->id = starget->id;
                 sas_device->channel = starget->channel;
                 if (test_bit(sas_device->handle, ioc->pd_handles))
                         sas_target_priv_data->flags |=
                             MPT_TARGET_FLAGS_RAID_COMPONENT;
+
         }
         spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
 
@@ -1324,13 +1438,21 @@ _scsih_target_destroy(struct scsi_target *starget)
 
         spin_lock_irqsave(&ioc->sas_device_lock, flags);
         rphy = dev_to_rphy(starget->dev.parent);
-        sas_device = mpt2sas_scsih_sas_device_find_by_sas_address(ioc,
-           rphy->identify.sas_address);
+        sas_device = __mpt2sas_get_sdev_from_target(ioc, sas_target_priv_data);
         if (sas_device && (sas_device->starget == starget) &&
             (sas_device->id == starget->id) &&
             (sas_device->channel == starget->channel))
                 sas_device->starget = NULL;
 
+        if (sas_device) {
+                /*
+                 * Corresponding get() is in _scsih_target_alloc()
+                 */
+                sas_target_priv_data->sdev = NULL;
+                sas_device_put(sas_device);
+
+                sas_device_put(sas_device);
+        }
         spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
 
  out:
@@ -1386,7 +1508,7 @@ _scsih_slave_alloc(struct scsi_device *sdev)
 
         if (!(sas_target_priv_data->flags & MPT_TARGET_FLAGS_VOLUME)) {
                 spin_lock_irqsave(&ioc->sas_device_lock, flags);
-                sas_device = mpt2sas_scsih_sas_device_find_by_sas_address(ioc,
+                sas_device = __mpt2sas_get_sdev_by_addr(ioc,
                                 sas_target_priv_data->sas_address);
                 if (sas_device && (sas_device->starget == NULL)) {
                         sdev_printk(KERN_INFO, sdev,
@@ -1394,6 +1516,10 @@ _scsih_slave_alloc(struct scsi_device *sdev)
                              __func__, __LINE__);
                         sas_device->starget = starget;
                 }
+
+                if (sas_device)
+                        sas_device_put(sas_device);
+
                 spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
         }
 
@@ -1428,10 +1554,13 @@ _scsih_slave_destroy(struct scsi_device *sdev)
 
         if (!(sas_target_priv_data->flags & MPT_TARGET_FLAGS_VOLUME)) {
                 spin_lock_irqsave(&ioc->sas_device_lock, flags);
-                sas_device = mpt2sas_scsih_sas_device_find_by_sas_address(ioc,
-                   sas_target_priv_data->sas_address);
+                sas_device = __mpt2sas_get_sdev_from_target(ioc,
+                                sas_target_priv_data);
                 if (sas_device && !sas_target_priv_data->num_luns)
                         sas_device->starget = NULL;
+
+                if (sas_device)
+                        sas_device_put(sas_device);
                 spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
         }
 
@@ -2078,7 +2207,7 @@ _scsih_slave_configure(struct scsi_device *sdev)
         }
 
         spin_lock_irqsave(&ioc->sas_device_lock, flags);
-        sas_device = mpt2sas_scsih_sas_device_find_by_sas_address(ioc,
+        sas_device = __mpt2sas_get_sdev_by_addr(ioc,
            sas_device_priv_data->sas_target->sas_address);
         if (!sas_device) {
                 spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
@@ -2112,17 +2241,18 @@ _scsih_slave_configure(struct scsi_device *sdev)
             (unsigned long long) sas_device->enclosure_logical_id,
             sas_device->slot);
 
+        sas_device_put(sas_device);
         spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
         if (!ssp_target)
                 _scsih_display_sata_capabilities(ioc, handle, sdev);
 
-
         _scsih_change_queue_depth(sdev, qdepth);
 
         if (ssp_target) {
                 sas_read_port_mode_page(sdev);
                 _scsih_enable_tlr(ioc, sdev);
         }
+
         return 0;
 }
 
@@ -2509,8 +2639,7 @@ _scsih_tm_display_info(struct MPT2SAS_ADAPTER *ioc, struct scsi_cmnd *scmd)
                     device_str, (unsigned long long)priv_target->sas_address);
         } else {
                 spin_lock_irqsave(&ioc->sas_device_lock, flags);
-                sas_device = mpt2sas_scsih_sas_device_find_by_sas_address(ioc,
-                    priv_target->sas_address);
+                sas_device = __mpt2sas_get_sdev_from_target(ioc, priv_target);
                 if (sas_device) {
                         if (priv_target->flags &
                             MPT_TARGET_FLAGS_RAID_COMPONENT) {
@@ -2529,6 +2658,8 @@ _scsih_tm_display_info(struct MPT2SAS_ADAPTER *ioc, struct scsi_cmnd *scmd)
                             "enclosure_logical_id(0x%016llx), slot(%d)\n",
                            (unsigned long long)sas_device->enclosure_logical_id,
                             sas_device->slot);
+
+                        sas_device_put(sas_device);
                 }
                 spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
         }
@@ -2604,12 +2735,12 @@ _scsih_dev_reset(struct scsi_cmnd *scmd)
 {
         struct MPT2SAS_ADAPTER *ioc = shost_priv(scmd->device->host);
         struct MPT2SAS_DEVICE *sas_device_priv_data;
-        struct _sas_device *sas_device;
-        unsigned long flags;
+        struct _sas_device *sas_device = NULL;
         u16     handle;
         int r;
 
         struct scsi_target *starget = scmd->device->sdev_target;
+        struct MPT2SAS_TARGET *target_priv_data = starget->hostdata;
 
         starget_printk(KERN_INFO, starget, "attempting device reset! "
             "scmd(%p)\n", scmd);
@@ -2629,12 +2760,10 @@ _scsih_dev_reset(struct scsi_cmnd *scmd)
         handle = 0;
         if (sas_device_priv_data->sas_target->flags &
             MPT_TARGET_FLAGS_RAID_COMPONENT) {
-                spin_lock_irqsave(&ioc->sas_device_lock, flags);
-                sas_device = _scsih_sas_device_find_by_handle(ioc,
-                   sas_device_priv_data->sas_target->handle);
+                sas_device = mpt2sas_get_sdev_from_target(ioc,
+                                target_priv_data);
                 if (sas_device)
                         handle = sas_device->volume_handle;
-                spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
         } else
                 handle = sas_device_priv_data->sas_target->handle;
 
@@ -2651,6 +2780,10 @@ _scsih_dev_reset(struct scsi_cmnd *scmd)
  out:
         sdev_printk(KERN_INFO, scmd->device, "device reset: %s scmd(%p)\n",
             ((r == SUCCESS) ? "SUCCESS" : "FAILED"), scmd);
+
+        if (sas_device)
+                sas_device_put(sas_device);
+
         return r;
 }
 
@@ -2665,11 +2798,11 @@ _scsih_target_reset(struct scsi_cmnd *scmd)
 {
         struct MPT2SAS_ADAPTER *ioc = shost_priv(scmd->device->host);
         struct MPT2SAS_DEVICE *sas_device_priv_data;
-        struct _sas_device *sas_device;
-        unsigned long flags;
+        struct _sas_device *sas_device = NULL;
         u16     handle;
         int r;
         struct scsi_target *starget = scmd->device->sdev_target;
+        struct MPT2SAS_TARGET *target_priv_data = starget->hostdata;
 
         starget_printk(KERN_INFO, starget, "attempting target reset! "
             "scmd(%p)\n", scmd);
@@ -2689,12 +2822,10 @@ _scsih_target_reset(struct scsi_cmnd *scmd)
         handle = 0;
         if (sas_device_priv_data->sas_target->flags &
             MPT_TARGET_FLAGS_RAID_COMPONENT) {
-                spin_lock_irqsave(&ioc->sas_device_lock, flags);
-                sas_device = _scsih_sas_device_find_by_handle(ioc,
-                   sas_device_priv_data->sas_target->handle);
+                sas_device = mpt2sas_get_sdev_from_target(ioc,
+                                target_priv_data);
                 if (sas_device)
                         handle = sas_device->volume_handle;
-                spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
         } else
                 handle = sas_device_priv_data->sas_target->handle;
 
@@ -2711,6 +2842,10 @@ _scsih_target_reset(struct scsi_cmnd *scmd)
  out:
         starget_printk(KERN_INFO, starget, "target reset: %s scmd(%p)\n",
             ((r == SUCCESS) ? "SUCCESS" : "FAILED"), scmd);
+
+        if (sas_device)
+                sas_device_put(sas_device);
+
         return r;
 }
 
@@ -2768,36 +2903,39 @@ _scsih_fw_event_add(struct MPT2SAS_ADAPTER *ioc, struct fw_event_work *fw_event)
                 return;
 
         spin_lock_irqsave(&ioc->fw_event_lock, flags);
+        fw_event_work_get(fw_event);
         list_add_tail(&fw_event->list, &ioc->fw_event_list);
         INIT_DELAYED_WORK(&fw_event->delayed_work, _firmware_event_work);
+        fw_event_work_get(fw_event);
         queue_delayed_work(ioc->firmware_event_thread,
             &fw_event->delayed_work, 0);
         spin_unlock_irqrestore(&ioc->fw_event_lock, flags);
 }
 
 /**
- * _scsih_fw_event_free - delete fw_event
+ * _scsih_fw_event_del_from_list - delete fw_event from the list
  * @ioc: per adapter object
  * @fw_event: object describing the event
  * Context: This function will acquire ioc->fw_event_lock.
  *
- * This removes firmware event object from link list, frees associated memory.
+ * If the fw_event is on the fw_event_list, remove it and do a put.
  *
  * Return nothing.
  */
 static void
-_scsih_fw_event_free(struct MPT2SAS_ADAPTER *ioc, struct fw_event_work
+_scsih_fw_event_del_from_list(struct MPT2SAS_ADAPTER *ioc, struct fw_event_work
     *fw_event)
 {
         unsigned long flags;
 
         spin_lock_irqsave(&ioc->fw_event_lock, flags);
-        list_del(&fw_event->list);
-        kfree(fw_event);
+        if (!list_empty(&fw_event->list)) {
+                list_del_init(&fw_event->list);
+                fw_event_work_put(fw_event);
+        }
         spin_unlock_irqrestore(&ioc->fw_event_lock, flags);
 }
 
-
 /**
  * _scsih_error_recovery_delete_devices - remove devices not responding
  * @ioc: per adapter object
@@ -2812,13 +2950,14 @@ _scsih_error_recovery_delete_devices(struct MPT2SAS_ADAPTER *ioc)
         if (ioc->is_driver_loading)
                 return;
 
-        fw_event = kzalloc(sizeof(struct fw_event_work), GFP_ATOMIC);
+        fw_event = alloc_fw_event_work(0);
         if (!fw_event)
                 return;
 
         fw_event->event = MPT2SAS_REMOVE_UNRESPONDING_DEVICES;
         fw_event->ioc = ioc;
         _scsih_fw_event_add(ioc, fw_event);
+        fw_event_work_put(fw_event);
 }
 
 /**
@@ -2832,12 +2971,29 @@ mpt2sas_port_enable_complete(struct MPT2SAS_ADAPTER *ioc)
 {
         struct fw_event_work *fw_event;
 
-        fw_event = kzalloc(sizeof(struct fw_event_work), GFP_ATOMIC);
+        fw_event = alloc_fw_event_work(0);
         if (!fw_event)
                 return;
         fw_event->event = MPT2SAS_PORT_ENABLE_COMPLETE;
         fw_event->ioc = ioc;
         _scsih_fw_event_add(ioc, fw_event);
+        fw_event_work_put(fw_event);
+}
+
+static struct fw_event_work *dequeue_next_fw_event(struct MPT2SAS_ADAPTER *ioc)
+{
+        unsigned long flags;
+        struct fw_event_work *fw_event = NULL;
+
+        spin_lock_irqsave(&ioc->fw_event_lock, flags);
+        if (!list_empty(&ioc->fw_event_list)) {
+                fw_event = list_first_entry(&ioc->fw_event_list,
+                                struct fw_event_work, list);
+                list_del_init(&fw_event->list);
+        }
+        spin_unlock_irqrestore(&ioc->fw_event_lock, flags);
+
+        return fw_event;
 }
 
 /**
@@ -2852,17 +3008,25 @@ mpt2sas_port_enable_complete(struct MPT2SAS_ADAPTER *ioc)
 static void
 _scsih_fw_event_cleanup_queue(struct MPT2SAS_ADAPTER *ioc)
 {
-        struct fw_event_work *fw_event, *next;
+        struct fw_event_work *fw_event;
 
         if (list_empty(&ioc->fw_event_list) ||
              !ioc->firmware_event_thread || in_interrupt())
                 return;
 
-        list_for_each_entry_safe(fw_event, next, &ioc->fw_event_list, list) {
-                if (cancel_delayed_work_sync(&fw_event->delayed_work)) {
-                        _scsih_fw_event_free(ioc, fw_event);
-                        continue;
-                }
+        while ((fw_event = dequeue_next_fw_event(ioc))) {
+                /*
+                 * Wait on the fw_event to complete. If this returns 1, then
+                 * the event was never executed, and we need a put for the
+                 * reference the delayed_work had on the fw_event.
+                 *
+                 * If it did execute, we wait for it to finish, and the put will
+                 * happen from _firmware_event_work()
+                 */
+                if (cancel_delayed_work_sync(&fw_event->delayed_work))
+                        fw_event_work_put(fw_event);
+
+                fw_event_work_put(fw_event);
         }
 }
 
@@ -3002,15 +3166,15 @@ _scsih_block_io_to_children_attached_to_ex(struct MPT2SAS_ADAPTER *ioc,
 
         list_for_each_entry(mpt2sas_port,
            &sas_expander->sas_port_list, port_list) {
-                if (mpt2sas_port->remote_identify.device_type ==
-                    SAS_END_DEVICE) {
+                if (mpt2sas_port->remote_identify.device_type == SAS_END_DEVICE) {
                         spin_lock_irqsave(&ioc->sas_device_lock, flags);
-                        sas_device =
-                            mpt2sas_scsih_sas_device_find_by_sas_address(ioc,
-                           mpt2sas_port->remote_identify.sas_address);
-                        if (sas_device)
+                        sas_device = __mpt2sas_get_sdev_by_addr(ioc,
+                                        mpt2sas_port->remote_identify.sas_address);
+                        if (sas_device) {
                                 set_bit(sas_device->handle,
-                                    ioc->blocking_handles);
+                                                ioc->blocking_handles);
+                                sas_device_put(sas_device);
+                        }
                         spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
                 }
         }
@@ -3080,7 +3244,7 @@ _scsih_tm_tr_send(struct MPT2SAS_ADAPTER *ioc, u16 handle)
 {
         Mpi2SCSITaskManagementRequest_t *mpi_request;
         u16 smid;
-        struct _sas_device *sas_device;
+        struct _sas_device *sas_device = NULL;
         struct MPT2SAS_TARGET *sas_target_priv_data = NULL;
         u64 sas_address = 0;
         unsigned long flags;
@@ -3110,7 +3274,7 @@ _scsih_tm_tr_send(struct MPT2SAS_ADAPTER *ioc, u16 handle)
                 return;
 
         spin_lock_irqsave(&ioc->sas_device_lock, flags);
-        sas_device = _scsih_sas_device_find_by_handle(ioc, handle);
+        sas_device = __mpt2sas_get_sdev_by_handle(ioc, handle);
         if (sas_device && sas_device->starget &&
              sas_device->starget->hostdata) {
                 sas_target_priv_data = sas_device->starget->hostdata;
@@ -3131,14 +3295,14 @@ _scsih_tm_tr_send(struct MPT2SAS_ADAPTER *ioc, u16 handle)
         if (!smid) {
                 delayed_tr = kzalloc(sizeof(*delayed_tr), GFP_ATOMIC);
                 if (!delayed_tr)
-                        return;
+                        goto out;
                 INIT_LIST_HEAD(&delayed_tr->list);
                 delayed_tr->handle = handle;
                 list_add_tail(&delayed_tr->list, &ioc->delayed_tr_list);
                 dewtprintk(ioc, printk(MPT2SAS_INFO_FMT
                     "DELAYED:tr:handle(0x%04x), (open)\n",
                     ioc->name, handle));
-                return;
+                goto out;
         }
 
         dewtprintk(ioc, printk(MPT2SAS_INFO_FMT "tr_send:handle(0x%04x), "
@@ -3150,6 +3314,9 @@ _scsih_tm_tr_send(struct MPT2SAS_ADAPTER *ioc, u16 handle)
         mpi_request->DevHandle = cpu_to_le16(handle);
         mpi_request->TaskType = MPI2_SCSITASKMGMT_TASKTYPE_TARGET_RESET;
         mpt2sas_base_put_smid_hi_priority(ioc, smid);
+out:
+        if (sas_device)
+                sas_device_put(sas_device);
 }
 
 
@@ -4068,7 +4235,6 @@ _scsih_scsi_ioc_info(struct MPT2SAS_ADAPTER *ioc, struct scsi_cmnd *scmd,
         char *desc_scsi_state = ioc->tmp_string;
         u32 log_info = le32_to_cpu(mpi_reply->IOCLogInfo);
         struct _sas_device *sas_device = NULL;
-        unsigned long flags;
         struct scsi_target *starget = scmd->device->sdev_target;
         struct MPT2SAS_TARGET *priv_target = starget->hostdata;
         char *device_str = NULL;
@@ -4200,9 +4366,7 @@ _scsih_scsi_ioc_info(struct MPT2SAS_ADAPTER *ioc, struct scsi_cmnd *scmd,
                 printk(MPT2SAS_WARN_FMT "\t%s wwid(0x%016llx)\n", ioc->name,
                     device_str, (unsigned long long)priv_target->sas_address);
         } else {
-                spin_lock_irqsave(&ioc->sas_device_lock, flags);
-                sas_device = mpt2sas_scsih_sas_device_find_by_sas_address(ioc,
-                    priv_target->sas_address);
+                sas_device = mpt2sas_get_sdev_from_target(ioc, priv_target);
                 if (sas_device) {
                         printk(MPT2SAS_WARN_FMT "\tsas_address(0x%016llx), "
                             "phy(%d)\n", ioc->name, sas_device->sas_address,
@@ -4211,8 +4375,9 @@ _scsih_scsi_ioc_info(struct MPT2SAS_ADAPTER *ioc, struct scsi_cmnd *scmd,
                             "\tenclosure_logical_id(0x%016llx), slot(%d)\n",
                             ioc->name, sas_device->enclosure_logical_id,
                             sas_device->slot);
+
+                        sas_device_put(sas_device);
                 }
-                spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
         }
 
         printk(MPT2SAS_WARN_FMT "\thandle(0x%04x), ioc_status(%s)(0x%04x), "
@@ -4259,7 +4424,7 @@ _scsih_turn_on_pfa_led(struct MPT2SAS_ADAPTER *ioc, u16 handle)
         Mpi2SepRequest_t mpi_request;
         struct _sas_device *sas_device;
 
-        sas_device = _scsih_sas_device_find_by_handle(ioc, handle);
+        sas_device = mpt2sas_get_sdev_by_handle(ioc, handle);
         if (!sas_device)
                 return;
 
@@ -4274,7 +4439,7 @@ _scsih_turn_on_pfa_led(struct MPT2SAS_ADAPTER *ioc, u16 handle)
             &mpi_request)) != 0) {
                 printk(MPT2SAS_ERR_FMT "failure at %s:%d/%s()!\n", ioc->name,
                 __FILE__, __LINE__, __func__);
-                return;
+                goto out;
         }
         sas_device->pfa_led_on = 1;
 
@@ -4284,8 +4449,10 @@ _scsih_turn_on_pfa_led(struct MPT2SAS_ADAPTER *ioc, u16 handle)
                  "enclosure_processor: ioc_status (0x%04x), loginfo(0x%08x)\n",
                  ioc->name, le16_to_cpu(mpi_reply.IOCStatus),
                  le32_to_cpu(mpi_reply.IOCLogInfo)));
-                return;
+                goto out;
         }
+out:
+        sas_device_put(sas_device);
 }
 
 /**
@@ -4340,13 +4507,14 @@ _scsih_send_event_to_turn_on_pfa_led(struct MPT2SAS_ADAPTER *ioc, u16 handle)
 {
         struct fw_event_work *fw_event;
 
-        fw_event = kzalloc(sizeof(struct fw_event_work), GFP_ATOMIC);
+        fw_event = alloc_fw_event_work(0);
         if (!fw_event)
                 return;
         fw_event->event = MPT2SAS_TURN_ON_PFA_LED;
         fw_event->device_handle = handle;
         fw_event->ioc = ioc;
         _scsih_fw_event_add(ioc, fw_event);
+        fw_event_work_put(fw_event);
 }
 
 /**
@@ -4370,19 +4538,17 @@ _scsih_smart_predicted_fault(struct MPT2SAS_ADAPTER *ioc, u16 handle)
 
         /* only handle non-raid devices */
         spin_lock_irqsave(&ioc->sas_device_lock, flags);
-        sas_device = _scsih_sas_device_find_by_handle(ioc, handle);
+        sas_device = __mpt2sas_get_sdev_by_handle(ioc, handle);
         if (!sas_device) {
-                spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
-                return;
+                goto out_unlock;
         }
         starget = sas_device->starget;
         sas_target_priv_data = starget->hostdata;
 
         if ((sas_target_priv_data->flags & MPT_TARGET_FLAGS_RAID_COMPONENT) ||
-           ((sas_target_priv_data->flags & MPT_TARGET_FLAGS_VOLUME))) {
-                spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
-                return;
-        }
+           ((sas_target_priv_data->flags & MPT_TARGET_FLAGS_VOLUME)))
+                goto out_unlock;
+
         starget_printk(KERN_WARNING, starget, "predicted fault\n");
         spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
 
@@ -4396,7 +4562,7 @@ _scsih_smart_predicted_fault(struct MPT2SAS_ADAPTER *ioc, u16 handle)
         if (!event_reply) {
                 printk(MPT2SAS_ERR_FMT "failure at %s:%d/%s()!\n",
                     ioc->name, __FILE__, __LINE__, __func__);
-                return;
+                goto out;
         }
 
         event_reply->Function = MPI2_FUNCTION_EVENT_NOTIFICATION;
@@ -4413,6 +4579,14 @@ _scsih_smart_predicted_fault(struct MPT2SAS_ADAPTER *ioc, u16 handle)
         event_data->SASAddress = cpu_to_le64(sas_target_priv_data->sas_address);
         mpt2sas_ctl_add_to_event_log(ioc, event_reply);
         kfree(event_reply);
+out:
+        if (sas_device)
+                sas_device_put(sas_device);
+        return;
+
+out_unlock:
+        spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
+        goto out;
 }
 
 /**
@@ -5148,14 +5322,13 @@ _scsih_check_device(struct MPT2SAS_ADAPTER *ioc, u16 handle)
 
         spin_lock_irqsave(&ioc->sas_device_lock, flags);
         sas_address = le64_to_cpu(sas_device_pg0.SASAddress);
-        sas_device = mpt2sas_scsih_sas_device_find_by_sas_address(ioc,
+        sas_device = __mpt2sas_get_sdev_by_addr(ioc,
             sas_address);
 
         if (!sas_device) {
                 printk(MPT2SAS_ERR_FMT "device is not present "
                     "handle(0x%04x), no sas_device!!!\n", ioc->name, handle);
-                spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
-                return;
+                goto out_unlock;
         }
 
         if (unlikely(sas_device->handle != handle)) {
@@ -5172,19 +5345,24 @@ _scsih_check_device(struct MPT2SAS_ADAPTER *ioc, u16 handle)
             MPI2_SAS_DEVICE0_FLAGS_DEVICE_PRESENT)) {
                 printk(MPT2SAS_ERR_FMT "device is not present "
                     "handle(0x%04x), flags!!!\n", ioc->name, handle);
-                spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
-                return;
+                goto out_unlock;
         }
 
         /* check if there were any issues with discovery */
         if (_scsih_check_access_status(ioc, sas_address, handle,
-            sas_device_pg0.AccessStatus)) {
-                spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
-                return;
-        }
+            sas_device_pg0.AccessStatus))
+                goto out_unlock;
+
         spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
         _scsih_ublock_io_device(ioc, sas_address);
+        if (sas_device)
+                sas_device_put(sas_device);
+        return;
 
+out_unlock:
+        spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
+        if (sas_device)
+                sas_device_put(sas_device);
 }
 
 /**
@@ -5208,7 +5386,6 @@ _scsih_add_device(struct MPT2SAS_ADAPTER *ioc, u16 handle, u8 phy_num, u8 is_pd)
         u32 ioc_status;
         __le64 sas_address;
         u32 device_info;
-        unsigned long flags;
 
         if ((mpt2sas_config_get_sas_device_pg0(ioc, &mpi_reply, &sas_device_pg0,
             MPI2_SAS_DEVICE_PGAD_FORM_HANDLE, handle))) {
@@ -5250,14 +5427,13 @@ _scsih_add_device(struct MPT2SAS_ADAPTER *ioc, u16 handle, u8 phy_num, u8 is_pd)
                 return -1;
         }
 
-
-        spin_lock_irqsave(&ioc->sas_device_lock, flags);
-        sas_device = mpt2sas_scsih_sas_device_find_by_sas_address(ioc,
+        sas_device = mpt2sas_get_sdev_by_addr(ioc,
             sas_address);
-        spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
 
-        if (sas_device)
+        if (sas_device) {
+                sas_device_put(sas_device);
                 return 0;
+        }
 
         sas_device = kzalloc(sizeof(struct _sas_device),
             GFP_KERNEL);
@@ -5267,6 +5443,7 @@ _scsih_add_device(struct MPT2SAS_ADAPTER *ioc, u16 handle, u8 phy_num, u8 is_pd)
                 return -1;
         }
 
+        kref_init(&sas_device->refcount);
         sas_device->handle = handle;
         if (_scsih_get_sas_address(ioc, le16_to_cpu
                 (sas_device_pg0.ParentDevHandle),
@@ -5296,6 +5473,7 @@ _scsih_add_device(struct MPT2SAS_ADAPTER *ioc, u16 handle, u8 phy_num, u8 is_pd)
         else
                 _scsih_sas_device_add(ioc, sas_device);
 
+        sas_device_put(sas_device);
         return 0;
 }
 
@@ -5344,7 +5522,6 @@ _scsih_remove_device(struct MPT2SAS_ADAPTER *ioc,
             "handle(0x%04x), sas_addr(0x%016llx)\n", ioc->name, __func__,
             sas_device->handle, (unsigned long long)
             sas_device->sas_address));
-        kfree(sas_device);
 }
 /**
  * _scsih_device_remove_by_handle - removing device object by handle
@@ -5363,12 +5540,17 @@ _scsih_device_remove_by_handle(struct MPT2SAS_ADAPTER *ioc, u16 handle)
                 return;
 
         spin_lock_irqsave(&ioc->sas_device_lock, flags);
-        sas_device = _scsih_sas_device_find_by_handle(ioc, handle);
-        if (sas_device)
-                list_del(&sas_device->list);
+        sas_device = __mpt2sas_get_sdev_by_handle(ioc, handle);
+        if (sas_device) {
+                list_del_init(&sas_device->list);
+                sas_device_put(sas_device);
+        }
         spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
-        if (sas_device)
+
+        if (sas_device) {
                 _scsih_remove_device(ioc, sas_device);
+                sas_device_put(sas_device);
+        }
 }
 
 /**
@@ -5389,13 +5571,17 @@ mpt2sas_device_remove_by_sas_address(struct MPT2SAS_ADAPTER *ioc,
                 return;
 
         spin_lock_irqsave(&ioc->sas_device_lock, flags);
-        sas_device = mpt2sas_scsih_sas_device_find_by_sas_address(ioc,
-            sas_address);
-        if (sas_device)
-                list_del(&sas_device->list);
+        sas_device = __mpt2sas_get_sdev_by_addr(ioc, sas_address);
+        if (sas_device) {
+                list_del_init(&sas_device->list);
+                sas_device_put(sas_device);
+        }
         spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
-        if (sas_device)
+
+        if (sas_device) {
                 _scsih_remove_device(ioc, sas_device);
+                sas_device_put(sas_device);
+        }
 }
 #ifdef CONFIG_SCSI_MPT2SAS_LOGGING
 /**
@@ -5716,26 +5902,28 @@ _scsih_sas_device_status_change_event(struct MPT2SAS_ADAPTER *ioc,
 
         spin_lock_irqsave(&ioc->sas_device_lock, flags);
         sas_address = le64_to_cpu(event_data->SASAddress);
-        sas_device = mpt2sas_scsih_sas_device_find_by_sas_address(ioc,
+        sas_device = __mpt2sas_get_sdev_by_addr(ioc,
             sas_address);
 
-        if (!sas_device || !sas_device->starget) {
-                spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
-                return;
-        }
+        if (!sas_device || !sas_device->starget)
+                goto out;
 
         target_priv_data = sas_device->starget->hostdata;
-        if (!target_priv_data) {
-                spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
-                return;
-        }
+        if (!target_priv_data)
+                goto out;
 
         if (event_data->ReasonCode ==
             MPI2_EVENT_SAS_DEV_STAT_RC_INTERNAL_DEVICE_RESET)
                 target_priv_data->tm_busy = 1;
         else
                 target_priv_data->tm_busy = 0;
+
+out:
+        if (sas_device)
+                sas_device_put(sas_device);
+
         spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
+
 }
 
 #ifdef CONFIG_SCSI_MPT2SAS_LOGGING
@@ -6123,7 +6311,7 @@ _scsih_sas_pd_expose(struct MPT2SAS_ADAPTER *ioc,
         u16 handle = le16_to_cpu(element->PhysDiskDevHandle);
 
         spin_lock_irqsave(&ioc->sas_device_lock, flags);
-        sas_device = _scsih_sas_device_find_by_handle(ioc, handle);
+        sas_device = __mpt2sas_get_sdev_by_handle(ioc, handle);
         if (sas_device) {
                 sas_device->volume_handle = 0;
                 sas_device->volume_wwid = 0;
@@ -6142,6 +6330,8 @@ _scsih_sas_pd_expose(struct MPT2SAS_ADAPTER *ioc,
         /* exposing raid component */
         if (starget)
                 starget_for_each_device(starget, NULL, _scsih_reprobe_lun);
+
+        sas_device_put(sas_device);
 }
 
 /**
@@ -6170,7 +6360,7 @@ _scsih_sas_pd_hide(struct MPT2SAS_ADAPTER *ioc,
                     &volume_wwid);
 
         spin_lock_irqsave(&ioc->sas_device_lock, flags);
-        sas_device = _scsih_sas_device_find_by_handle(ioc, handle);
+        sas_device = __mpt2sas_get_sdev_by_handle(ioc, handle);
         if (sas_device) {
                 set_bit(handle, ioc->pd_handles);
                 if (sas_device->starget && sas_device->starget->hostdata) {
@@ -6189,6 +6379,8 @@ _scsih_sas_pd_hide(struct MPT2SAS_ADAPTER *ioc,
         /* hiding raid component */
         if (starget)
                 starget_for_each_device(starget, (void *)1, _scsih_reprobe_lun);
+
+        sas_device_put(sas_device);
 }
 
 /**
@@ -6221,7 +6413,6 @@ _scsih_sas_pd_add(struct MPT2SAS_ADAPTER *ioc,
     Mpi2EventIrConfigElement_t *element)
 {
         struct _sas_device *sas_device;
-        unsigned long flags;
         u16 handle = le16_to_cpu(element->PhysDiskDevHandle);
         Mpi2ConfigReply_t mpi_reply;
         Mpi2SasDevicePage0_t sas_device_pg0;
@@ -6231,11 +6422,11 @@ _scsih_sas_pd_add(struct MPT2SAS_ADAPTER *ioc,
 
         set_bit(handle, ioc->pd_handles);
 
-        spin_lock_irqsave(&ioc->sas_device_lock, flags);
-        sas_device = _scsih_sas_device_find_by_handle(ioc, handle);
-        spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
-        if (sas_device)
+        sas_device = mpt2sas_get_sdev_by_handle(ioc, handle);
+        if (sas_device) {
+                sas_device_put(sas_device);
                 return;
+        }
 
         if ((mpt2sas_config_get_sas_device_pg0(ioc, &mpi_reply, &sas_device_pg0,
             MPI2_SAS_DEVICE_PGAD_FORM_HANDLE, handle))) {
@@ -6509,7 +6700,6 @@ _scsih_sas_ir_physical_disk_event(struct MPT2SAS_ADAPTER *ioc,
         u16 handle, parent_handle;
         u32 state;
         struct _sas_device *sas_device;
-        unsigned long flags;
         Mpi2ConfigReply_t mpi_reply;
         Mpi2SasDevicePage0_t sas_device_pg0;
         u32 ioc_status;
@@ -6542,12 +6732,11 @@ _scsih_sas_ir_physical_disk_event(struct MPT2SAS_ADAPTER *ioc,
                 if (!ioc->is_warpdrive)
                         set_bit(handle, ioc->pd_handles);
 
-                spin_lock_irqsave(&ioc->sas_device_lock, flags);
-                sas_device = _scsih_sas_device_find_by_handle(ioc, handle);
-                spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
-
-                if (sas_device)
+                sas_device = mpt2sas_get_sdev_by_handle(ioc, handle);
+                if (sas_device) {
+                        sas_device_put(sas_device);
                         return;
+                }
 
                 if ((mpt2sas_config_get_sas_device_pg0(ioc, &mpi_reply,
                     &sas_device_pg0, MPI2_SAS_DEVICE_PGAD_FORM_HANDLE,
@@ -7015,6 +7204,7 @@ _scsih_remove_unresponding_sas_devices(struct MPT2SAS_ADAPTER *ioc)
         struct _raid_device *raid_device, *raid_device_next;
         struct list_head tmp_list;
         unsigned long flags;
+        LIST_HEAD(head);
 
         printk(MPT2SAS_INFO_FMT "removing unresponding devices: start\n",
             ioc->name);
@@ -7022,14 +7212,29 @@ _scsih_remove_unresponding_sas_devices(struct MPT2SAS_ADAPTER *ioc)
         /* removing unresponding end devices */
         printk(MPT2SAS_INFO_FMT "removing unresponding devices: end-devices\n",
             ioc->name);
+
+        /*
+         * Iterate, pulling off devices marked as non-responding. We become the
+         * owner for the reference the list had on any object we prune.
+         */
+        spin_lock_irqsave(&ioc->sas_device_lock, flags);
         list_for_each_entry_safe(sas_device, sas_device_next,
-            &ioc->sas_device_list, list) {
+                        &ioc->sas_device_list, list) {
                 if (!sas_device->responding)
-                        mpt2sas_device_remove_by_sas_address(ioc,
-                                sas_device->sas_address);
+                        list_move_tail(&sas_device->list, &head);
                 else
                         sas_device->responding = 0;
         }
+        spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
+
+        /*
+         * Now, uninitialize and remove the unresponding devices we pruned.
+         */
+        list_for_each_entry_safe(sas_device, sas_device_next, &head, list) {
+                _scsih_remove_device(ioc, sas_device);
+                list_del_init(&sas_device->list);
+                sas_device_put(sas_device);
+        }
 
         /* removing unresponding volumes */
         if (ioc->ir_firmware) {
@@ -7179,11 +7384,11 @@ _scsih_scan_for_devices_after_reset(struct MPT2SAS_ADAPTER *ioc)
                 }
                 phys_disk_num = pd_pg0.PhysDiskNum;
                 handle = le16_to_cpu(pd_pg0.DevHandle);
-                spin_lock_irqsave(&ioc->sas_device_lock, flags);
-                sas_device = _scsih_sas_device_find_by_handle(ioc, handle);
-                spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
-                if (sas_device)
+                sas_device = mpt2sas_get_sdev_by_handle(ioc, handle);
+                if (sas_device) {
+                        sas_device_put(sas_device);
                         continue;
+                }
                 if (mpt2sas_config_get_sas_device_pg0(ioc, &mpi_reply,
                     &sas_device_pg0, MPI2_SAS_DEVICE_PGAD_FORM_HANDLE,
                     handle) != 0)
@@ -7302,12 +7507,12 @@ _scsih_scan_for_devices_after_reset(struct MPT2SAS_ADAPTER *ioc)
                 if (!(_scsih_is_end_device(
                     le32_to_cpu(sas_device_pg0.DeviceInfo))))
                         continue;
-                spin_lock_irqsave(&ioc->sas_device_lock, flags);
-                sas_device = mpt2sas_scsih_sas_device_find_by_sas_address(ioc,
+                sas_device = mpt2sas_get_sdev_by_addr(ioc,
                     le64_to_cpu(sas_device_pg0.SASAddress));
-                spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
-                if (sas_device)
+                if (sas_device) {
+                        sas_device_put(sas_device);
                         continue;
+                }
                 parent_handle = le16_to_cpu(sas_device_pg0.ParentDevHandle);
                 if (!_scsih_get_sas_address(ioc, parent_handle, &sas_address)) {
                         printk(MPT2SAS_INFO_FMT "\tBEFORE adding end device: "
@@ -7410,17 +7615,27 @@ _firmware_event_work(struct work_struct *work)
             struct fw_event_work, delayed_work.work);
         struct MPT2SAS_ADAPTER *ioc = fw_event->ioc;
 
+        _scsih_fw_event_del_from_list(ioc, fw_event);
+
         /* the queue is being flushed so ignore this event */
-        if (ioc->remove_host ||
-            ioc->pci_error_recovery) {
-                _scsih_fw_event_free(ioc, fw_event);
+        if (ioc->remove_host || ioc->pci_error_recovery) {
+                fw_event_work_put(fw_event);
                 return;
         }
 
         switch (fw_event->event) {
         case MPT2SAS_REMOVE_UNRESPONDING_DEVICES:
-                while (scsi_host_in_recovery(ioc->shost) || ioc->shost_recovery)
+                while (scsi_host_in_recovery(ioc->shost) ||
+                                ioc->shost_recovery) {
+                        /*
+                         * If we're unloading, bail. Otherwise, this can become
+                         * an infinite loop.
+                         */
+                        if (ioc->remove_host)
+                                goto out;
+
                         ssleep(1);
+                }
                 _scsih_remove_unresponding_sas_devices(ioc);
                 _scsih_scan_for_devices_after_reset(ioc);
                 break;
@@ -7469,7 +7684,8 @@ _firmware_event_work(struct work_struct *work)
                 _scsih_sas_ir_operation_status_event(ioc, fw_event);
                 break;
         }
-        _scsih_fw_event_free(ioc, fw_event);
+out:
+        fw_event_work_put(fw_event);
 }
 
 /**
@@ -7607,7 +7823,7 @@ mpt2sas_scsih_event_callback(struct MPT2SAS_ADAPTER *ioc, u8 msix_index,
         }
 
         sz = le16_to_cpu(mpi_reply->EventDataLength) * 4;
-        fw_event = kzalloc(sizeof(*fw_event) + sz, GFP_ATOMIC);
+        fw_event = alloc_fw_event_work(sz);
         if (!fw_event) {
                 printk(MPT2SAS_ERR_FMT "failure at %s:%d/%s()!\n",
                     ioc->name, __FILE__, __LINE__, __func__);
@@ -7620,6 +7836,7 @@ mpt2sas_scsih_event_callback(struct MPT2SAS_ADAPTER *ioc, u8 msix_index,
         fw_event->VP_ID = mpi_reply->VP_ID;
         fw_event->event = event;
         _scsih_fw_event_add(ioc, fw_event);
+        fw_event_work_put(fw_event);
         return;
 }
 
@@ -7867,7 +8084,9 @@ _scsih_remove(struct pci_dev *pdev)
         sas_remove_host(shost);
         scsi_remove_host(shost);
         mpt2sas_base_detach(ioc);
+        spin_lock(&gioc_lock);
         list_del(&ioc->list);
+        spin_unlock(&gioc_lock);
         scsi_host_put(shost);
 }
 
@@ -7966,6 +8185,48 @@ _scsih_probe_raid(struct MPT2SAS_ADAPTER *ioc)
         }
 }
 
+static struct _sas_device *get_next_sas_device(struct MPT2SAS_ADAPTER *ioc)
+{
+        struct _sas_device *sas_device = NULL;
+        unsigned long flags;
+
+        spin_lock_irqsave(&ioc->sas_device_lock, flags);
+        if (!list_empty(&ioc->sas_device_init_list)) {
+                sas_device = list_first_entry(&ioc->sas_device_init_list,
+                                struct _sas_device, list);
+                sas_device_get(sas_device);
+        }
+        spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
+
+        return sas_device;
+}
+
+static void sas_device_make_active(struct MPT2SAS_ADAPTER *ioc,
+                struct _sas_device *sas_device)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&ioc->sas_device_lock, flags);
+
+        /*
+         * Since we dropped the lock during the call to port_add(), we need to
+         * be careful here that somebody else didn't move or delete this item
+         * while we were busy with other things.
+         *
+         * If it was on the list, we need a put() for the reference the list
+         * had. Either way, we need a get() for the destination list.
+         */
+        if (!list_empty(&sas_device->list)) {
+                list_del_init(&sas_device->list);
+                sas_device_put(sas_device);
+        }
+
+        sas_device_get(sas_device);
+        list_add_tail(&sas_device->list, &ioc->sas_device_list);
+
+        spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
+}
+
 /**
  * _scsih_probe_sas - reporting sas devices to sas transport
  * @ioc: per adapter object
@@ -7975,34 +8236,30 @@ _scsih_probe_raid(struct MPT2SAS_ADAPTER *ioc)
 static void
 _scsih_probe_sas(struct MPT2SAS_ADAPTER *ioc)
 {
-        struct _sas_device *sas_device, *next;
-        unsigned long flags;
-
-        /* SAS Device List */
-        list_for_each_entry_safe(sas_device, next, &ioc->sas_device_init_list,
-            list) {
+        struct _sas_device *sas_device;
 
-                if (ioc->hide_drives)
-                        continue;
+        if (ioc->hide_drives)
+                return;
 
+        while ((sas_device = get_next_sas_device(ioc))) {
                 if (!mpt2sas_transport_port_add(ioc, sas_device->handle,
-                    sas_device->sas_address_parent)) {
-                        list_del(&sas_device->list);
-                        kfree(sas_device);
+                                sas_device->sas_address_parent)) {
+                        _scsih_sas_device_remove(ioc, sas_device);
+                        sas_device_put(sas_device);
                         continue;
                 } else if (!sas_device->starget) {
                         if (!ioc->is_driver_loading) {
                                 mpt2sas_transport_port_remove(ioc,
-                                        sas_device->sas_address,
-                                        sas_device->sas_address_parent);
-                                list_del(&sas_device->list);
-                                kfree(sas_device);
+                                                sas_device->sas_address,
+                                                sas_device->sas_address_parent);
+                                _scsih_sas_device_remove(ioc, sas_device);
+                                sas_device_put(sas_device);
                                 continue;
                         }
                 }
-                spin_lock_irqsave(&ioc->sas_device_lock, flags);
-                list_move_tail(&sas_device->list, &ioc->sas_device_list);
-                spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
+
+                sas_device_make_active(ioc, sas_device);
+                sas_device_put(sas_device);
         }
 }
 
@@ -8142,7 +8399,9 @@ _scsih_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         ioc = shost_priv(shost);
         memset(ioc, 0, sizeof(struct MPT2SAS_ADAPTER));
         INIT_LIST_HEAD(&ioc->list);
+        spin_lock(&gioc_lock);
         list_add_tail(&ioc->list, &mpt2sas_ioc_list);
+        spin_unlock(&gioc_lock);
         ioc->shost = shost;
         ioc->id = mpt_ids++;
         sprintf(ioc->name, "%s%d", MPT2SAS_DRIVER_NAME, ioc->id);
@@ -8167,6 +8426,8 @@ _scsih_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         ioc->schedule_dead_ioc_flush_running_cmds = &_scsih_flush_running_cmds;
         /* misc semaphores and spin locks */
         mutex_init(&ioc->reset_in_progress_mutex);
+        /* initializing pci_access_mutex lock */
+        mutex_init(&ioc->pci_access_mutex);
         spin_lock_init(&ioc->ioc_reset_in_progress_lock);
         spin_lock_init(&ioc->scsi_lookup_lock);
         spin_lock_init(&ioc->sas_device_lock);
@@ -8269,7 +8530,9 @@ _scsih_probe(struct pci_dev *pdev, const struct pci_device_id *id)
  out_attach_fail:
         destroy_workqueue(ioc->firmware_event_thread);
  out_thread_fail:
+        spin_lock(&gioc_lock);
         list_del(&ioc->list);
+        spin_unlock(&gioc_lock);
         scsi_host_put(shost);
         return rv;
 }
diff --git a/drivers/scsi/mpt2sas/mpt2sas_transport.c b/drivers/scsi/mpt2sas/mpt2sas_transport.c
index ff2500ab9ba4..af868009395d 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_transport.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_transport.c
@@ -1323,15 +1323,17 @@ _transport_get_enclosure_identifier(struct sas_rphy *rphy, u64 *identifier)
         int rc;
 
         spin_lock_irqsave(&ioc->sas_device_lock, flags);
-        sas_device = mpt2sas_scsih_sas_device_find_by_sas_address(ioc,
+        sas_device = __mpt2sas_get_sdev_by_addr(ioc,
             rphy->identify.sas_address);
         if (sas_device) {
                 *identifier = sas_device->enclosure_logical_id;
                 rc = 0;
+                sas_device_put(sas_device);
         } else {
                 *identifier = 0;
                 rc = -ENXIO;
         }
+
         spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
         return rc;
 }
@@ -1351,12 +1353,14 @@ _transport_get_bay_identifier(struct sas_rphy *rphy)
         int rc;
 
         spin_lock_irqsave(&ioc->sas_device_lock, flags);
-        sas_device = mpt2sas_scsih_sas_device_find_by_sas_address(ioc,
+        sas_device = __mpt2sas_get_sdev_by_addr(ioc,
             rphy->identify.sas_address);
-        if (sas_device)
+        if (sas_device) {
                 rc = sas_device->slot;
-        else
+                sas_device_put(sas_device);
+        } else {
                 rc = -ENXIO;
+        }
         spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
         return rc;
 }
diff --git a/drivers/scsi/mpt3sas/mpi/mpi2.h b/drivers/scsi/mpt3sas/mpi/mpi2.h
index c34c1157907b..ec27ad2d186f 100644
--- a/drivers/scsi/mpt3sas/mpi/mpi2.h
+++ b/drivers/scsi/mpt3sas/mpi/mpi2.h
@@ -8,7 +8,7 @@
  *                 scatter/gather formats.
  * Creation Date:  June 21, 2006
  *
- * mpi2.h Version:  02.00.31
+ * mpi2.h Version:  02.00.35
  *
  * NOTE: Names (typedefs, defines, etc.) beginning with an MPI25 or Mpi25
  *       prefix are for use only on MPI v2.5 products, and must not be used
@@ -88,6 +88,10 @@
  *                     Added MPI25_SUP_REPLY_POST_HOST_INDEX_OFFSET.
  * 04-09-13  02.00.30  Bumped MPI2_HEADER_VERSION_UNIT.
  * 04-17-13  02.00.31  Bumped MPI2_HEADER_VERSION_UNIT.
+ * 08-19-13  02.00.32  Bumped MPI2_HEADER_VERSION_UNIT.
+ * 12-05-13  02.00.33  Bumped MPI2_HEADER_VERSION_UNIT.
+ * 01-08-14  02.00.34  Bumped MPI2_HEADER_VERSION_UNIT
+ * 06-13-14  02.00.35  Bumped MPI2_HEADER_VERSION_UNIT.
  * --------------------------------------------------------------------------
  */
 
@@ -121,7 +125,7 @@
 #define MPI2_VERSION_02_05                  (0x0205)
 
 /*Unit and Dev versioning for this MPI header set */
-#define MPI2_HEADER_VERSION_UNIT            (0x1F)
+#define MPI2_HEADER_VERSION_UNIT            (0x23)
 #define MPI2_HEADER_VERSION_DEV             (0x00)
 #define MPI2_HEADER_VERSION_UNIT_MASK       (0xFF00)
 #define MPI2_HEADER_VERSION_UNIT_SHIFT      (8)
diff --git a/drivers/scsi/mpt3sas/mpi/mpi2_cnfg.h b/drivers/scsi/mpt3sas/mpi/mpi2_cnfg.h
index e261a3153bb3..581fdb375db5 100644
--- a/drivers/scsi/mpt3sas/mpi/mpi2_cnfg.h
+++ b/drivers/scsi/mpt3sas/mpi/mpi2_cnfg.h
@@ -6,7 +6,7 @@
  *         Title:  MPI Configuration messages and pages
  * Creation Date:  November 10, 2006
  *
- *   mpi2_cnfg.h Version:  02.00.26
+ *   mpi2_cnfg.h Version:  02.00.29
  *
  * NOTE: Names (typedefs, defines, etc.) beginning with an MPI25 or Mpi25
  *       prefix are for use only on MPI v2.5 products, and must not be used
@@ -165,6 +165,20 @@
  *                     match the specification.
  * 08-19-13  02.00.26  Added reserved words to MPI2_CONFIG_PAGE_IO_UNIT_7 for
  *                      future use.
+ * 12-05-13  02.00.27  Added MPI2_MANPAGE7_FLAG_BASE_ENCLOSURE_LEVEL for
+ *                     MPI2_CONFIG_PAGE_MAN_7.
+ *                     Added EnclosureLevel and ConnectorName fields to
+ *                     MPI2_CONFIG_PAGE_SAS_DEV_0.
+ *                     Added MPI2_SAS_DEVICE0_FLAGS_ENCL_LEVEL_VALID for
+ *                     MPI2_CONFIG_PAGE_SAS_DEV_0.
+ *                     Added EnclosureLevel field to
+ *                     MPI2_CONFIG_PAGE_SAS_ENCLOSURE_0.
+ *                     Added MPI2_SAS_ENCLS0_FLAGS_ENCL_LEVEL_VALID for
+ *                     MPI2_CONFIG_PAGE_SAS_ENCLOSURE_0.
+ * 01-08-14  02.00.28  Added more defines for the BiosOptions field of
+ *                     MPI2_CONFIG_PAGE_BIOS_1.
+ * 06-13-14  02.00.29  Added SSUTimeout field to MPI2_CONFIG_PAGE_BIOS_1, and
+ *                     more defines for the BiosOptions field..
  * --------------------------------------------------------------------------
  */
 
@@ -724,6 +738,7 @@ typedef struct _MPI2_CONFIG_PAGE_MAN_7 {
 #define MPI2_MANUFACTURING7_PAGEVERSION                 (0x01)
 
 /*defines for the Flags field */
+#define MPI2_MANPAGE7_FLAG_BASE_ENCLOSURE_LEVEL         (0x00000008)
 #define MPI2_MANPAGE7_FLAG_EVENTREPLAY_SLOT_ORDER       (0x00000002)
 #define MPI2_MANPAGE7_FLAG_USE_SLOT_INFO                (0x00000001)
 
@@ -1311,7 +1326,9 @@ typedef struct _MPI2_CONFIG_PAGE_BIOS_1 {
         MPI2_CONFIG_PAGE_HEADER Header;                     /*0x00 */
         U32                     BiosOptions;                /*0x04 */
         U32                     IOCSettings;                /*0x08 */
-        U32                     Reserved1;                  /*0x0C */
+        U8                      SSUTimeout;                 /*0x0C */
+        U8                      Reserved1;                  /*0x0D */
+        U16                     Reserved2;                  /*0x0E */
         U32                     DeviceSettings;             /*0x10 */
         U16                     NumberOfDevices;            /*0x14 */
         U16                     UEFIVersion;                /*0x16 */
@@ -1323,9 +1340,24 @@ typedef struct _MPI2_CONFIG_PAGE_BIOS_1 {
         *PTR_MPI2_CONFIG_PAGE_BIOS_1,
         Mpi2BiosPage1_t, *pMpi2BiosPage1_t;
 
-#define MPI2_BIOSPAGE1_PAGEVERSION                      (0x05)
+#define MPI2_BIOSPAGE1_PAGEVERSION                      (0x07)
 
 /*values for BIOS Page 1 BiosOptions field */
+#define MPI2_BIOSPAGE1_OPTIONS_PNS_MASK                         (0x00003800)
+#define MPI2_BIOSPAGE1_OPTIONS_PNS_PBDHL                        (0x00000000)
+#define MPI2_BIOSPAGE1_OPTIONS_PNS_ENCSLOSURE                   (0x00000800)
+#define MPI2_BIOSPAGE1_OPTIONS_PNS_LWWID                        (0x00001000)
+#define MPI2_BIOSPAGE1_OPTIONS_PNS_PSENS                        (0x00001800)
+#define MPI2_BIOSPAGE1_OPTIONS_PNS_ESPHY                        (0x00002000)
+
+#define MPI2_BIOSPAGE1_OPTIONS_X86_DISABLE_BIOS         (0x00000400)
+
+#define MPI2_BIOSPAGE1_OPTIONS_MASK_REGISTRATION_UEFI_BSD       (0x00000300)
+#define MPI2_BIOSPAGE1_OPTIONS_USE_BIT0_REGISTRATION_UEFI_BSD   (0x00000000)
+#define MPI2_BIOSPAGE1_OPTIONS_FULL_REGISTRATION_UEFI_BSD       (0x00000100)
+#define MPI2_BIOSPAGE1_OPTIONS_ADAPTER_REGISTRATION_UEFI_BSD    (0x00000200)
+#define MPI2_BIOSPAGE1_OPTIONS_DISABLE_REGISTRATION_UEFI_BSD    (0x00000300)
+
 #define MPI2_BIOSPAGE1_OPTIONS_MASK_OEM_ID                  (0x000000F0)
 #define MPI2_BIOSPAGE1_OPTIONS_LSI_OEM_ID                   (0x00000000)
 
@@ -2633,9 +2665,9 @@ typedef struct _MPI2_CONFIG_PAGE_SAS_DEV_0 {
         U8
                 ControlGroup;           /*0x2E */
         U8
-                Reserved1;              /*0x2F */
+                EnclosureLevel;         /*0x2F */
         U32
-                Reserved2;              /*0x30 */
+                ConnectorName[4];       /*0x30 */
         U32
                 Reserved3;              /*0x34 */
 } MPI2_CONFIG_PAGE_SAS_DEV_0,
@@ -2643,7 +2675,7 @@ typedef struct _MPI2_CONFIG_PAGE_SAS_DEV_0 {
         Mpi2SasDevicePage0_t,
         *pMpi2SasDevicePage0_t;
 
-#define MPI2_SASDEVICE0_PAGEVERSION         (0x08)
+#define MPI2_SASDEVICE0_PAGEVERSION         (0x09)
 
 /*values for SAS Device Page 0 AccessStatus field */
 #define MPI2_SAS_DEVICE0_ASTATUS_NO_ERRORS                  (0x00)
@@ -2683,6 +2715,7 @@ typedef struct _MPI2_CONFIG_PAGE_SAS_DEV_0 {
 #define MPI2_SAS_DEVICE0_FLAGS_SATA_NCQ_SUPPORTED           (0x0020)
 #define MPI2_SAS_DEVICE0_FLAGS_SATA_FUA_SUPPORTED           (0x0010)
 #define MPI2_SAS_DEVICE0_FLAGS_PORT_SELECTOR_ATTACH         (0x0008)
+#define MPI2_SAS_DEVICE0_FLAGS_ENCL_LEVEL_VALID             (0x0002)
 #define MPI2_SAS_DEVICE0_FLAGS_DEVICE_PRESENT               (0x0001)
 
 
@@ -3019,8 +3052,10 @@ typedef struct _MPI2_CONFIG_PAGE_SAS_ENCLOSURE_0 {
                 NumSlots;                   /*0x18 */
         U16
                 StartSlot;                  /*0x1A */
-        U16
+        U8
                 Reserved2;                  /*0x1C */
+        U8
+                EnclosureLevel;             /*0x1D */
         U16
                 SEPDevHandle;               /*0x1E */
         U32
@@ -3031,9 +3066,10 @@ typedef struct _MPI2_CONFIG_PAGE_SAS_ENCLOSURE_0 {
         *PTR_MPI2_CONFIG_PAGE_SAS_ENCLOSURE_0,
         Mpi2SasEnclosurePage0_t, *pMpi2SasEnclosurePage0_t;
 
-#define MPI2_SASENCLOSURE0_PAGEVERSION      (0x03)
+#define MPI2_SASENCLOSURE0_PAGEVERSION      (0x04)
 
 /*values for SAS Enclosure Page 0 Flags field */
+#define MPI2_SAS_ENCLS0_FLAGS_ENCL_LEVEL_VALID      (0x0010)
 #define MPI2_SAS_ENCLS0_FLAGS_MNG_MASK              (0x000F)
 #define MPI2_SAS_ENCLS0_FLAGS_MNG_UNKNOWN           (0x0000)
 #define MPI2_SAS_ENCLS0_FLAGS_MNG_IOC_SES           (0x0001)
diff --git a/drivers/scsi/mpt3sas/mpi/mpi2_ioc.h b/drivers/scsi/mpt3sas/mpi/mpi2_ioc.h
index 490830957806..d7598cc4bb8e 100644
--- a/drivers/scsi/mpt3sas/mpi/mpi2_ioc.h
+++ b/drivers/scsi/mpt3sas/mpi/mpi2_ioc.h
@@ -6,7 +6,7 @@
  *         Title:  MPI IOC, Port, Event, FW Download, and FW Upload messages
  * Creation Date:  October 11, 2006
  *
- * mpi2_ioc.h Version:  02.00.23
+ * mpi2_ioc.h Version:  02.00.24
  *
  * NOTE: Names (typedefs, defines, etc.) beginning with an MPI25 or Mpi25
  *       prefix are for use only on MPI v2.5 products, and must not be used
@@ -132,6 +132,7 @@
  *                      Added MPI2_IOCFACTS_CAPABILITY_RDPQ_ARRAY_CAPABLE.
  *                      Added MPI2_FW_DOWNLOAD_ITYPE_PUBLIC_KEY.
  *                      Added Encrypted Hash Extended Image.
+ * 12-05-13  02.00.24  Added MPI25_HASH_IMAGE_TYPE_BIOS.
  * --------------------------------------------------------------------------
  */
 
@@ -1598,6 +1599,7 @@ Mpi25EncryptedHashEntry_t, *pMpi25EncryptedHashEntry_t;
 /* values for HashImageType */
 #define MPI25_HASH_IMAGE_TYPE_UNUSED            (0x00)
 #define MPI25_HASH_IMAGE_TYPE_FIRMWARE          (0x01)
+#define MPI25_HASH_IMAGE_TYPE_BIOS              (0x02)
 
 /* values for HashAlgorithm */
 #define MPI25_HASH_ALGORITHM_UNUSED             (0x00)
diff --git a/drivers/scsi/mpt3sas/mpi/mpi2_tool.h b/drivers/scsi/mpt3sas/mpi/mpi2_tool.h
index 904910d8a737..1629e5bce7e1 100644
--- a/drivers/scsi/mpt3sas/mpi/mpi2_tool.h
+++ b/drivers/scsi/mpt3sas/mpi/mpi2_tool.h
@@ -6,7 +6,7 @@
  *         Title:  MPI diagnostic tool structures and definitions
  * Creation Date:  March 26, 2007
  *
- *   mpi2_tool.h Version:  02.00.11
+ *   mpi2_tool.h Version:  02.00.12
  *
  * Version History
  * ---------------
@@ -33,6 +33,7 @@
  * 07-26-12  02.00.10  Modified MPI2_TOOLBOX_DIAGNOSTIC_CLI_REQUEST so that
  *                     it uses MPI Chain SGE as well as MPI Simple SGE.
  * 08-19-13  02.00.11  Added MPI2_TOOLBOX_TEXT_DISPLAY_TOOL and related info.
+ * 01-08-14  02.00.12  Added MPI2_TOOLBOX_CLEAN_BIT26_PRODUCT_SPECIFIC.
  * --------------------------------------------------------------------------
  */
 
@@ -100,6 +101,7 @@ typedef struct _MPI2_TOOLBOX_CLEAN_REQUEST {
 #define MPI2_TOOLBOX_CLEAN_OTHER_PERSIST_PAGES      (0x20000000)
 #define MPI2_TOOLBOX_CLEAN_FW_CURRENT               (0x10000000)
 #define MPI2_TOOLBOX_CLEAN_FW_BACKUP                (0x08000000)
+#define MPI2_TOOLBOX_CLEAN_BIT26_PRODUCT_SPECIFIC   (0x04000000)
 #define MPI2_TOOLBOX_CLEAN_MEGARAID                 (0x02000000)
 #define MPI2_TOOLBOX_CLEAN_INITIALIZATION           (0x01000000)
 #define MPI2_TOOLBOX_CLEAN_FLASH                    (0x00000004)
diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
index 43f87e904b98..d4f1dcdb8361 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
@@ -83,10 +83,10 @@ static int msix_disable = -1;
 module_param(msix_disable, int, 0);
 MODULE_PARM_DESC(msix_disable, " disable msix routed interrupts (default=0)");
 
-static int max_msix_vectors = 8;
+static int max_msix_vectors = -1;
 module_param(max_msix_vectors, int, 0);
 MODULE_PARM_DESC(max_msix_vectors,
-        " max msix vectors - (default=8)");
+        " max msix vectors");
 
 static int mpt3sas_fwfault_debug;
 MODULE_PARM_DESC(mpt3sas_fwfault_debug,
@@ -1009,8 +1009,30 @@ _base_interrupt(int irq, void *bus_id)
         }
 
         wmb();
-        writel(reply_q->reply_post_host_index | (msix_index <<
-            MPI2_RPHI_MSIX_INDEX_SHIFT), &ioc->chip->ReplyPostHostIndex);
+
+        /* Update Reply Post Host Index.
+         * For those HBA's which support combined reply queue feature
+         * 1. Get the correct Supplemental Reply Post Host Index Register.
+         *    i.e. (msix_index / 8)th entry from Supplemental Reply Post Host
+         *    Index Register address bank i.e replyPostRegisterIndex[],
+         * 2. Then update this register with new reply host index value
+         *    in ReplyPostIndex field and the MSIxIndex field with
+         *    msix_index value reduced to a value between 0 and 7,
+         *    using a modulo 8 operation. Since each Supplemental Reply Post
+         *    Host Index Register supports 8 MSI-X vectors.
+         *
+         * For other HBA's just update the Reply Post Host Index register with
+         * new reply host index value in ReplyPostIndex Field and msix_index
+         * value in MSIxIndex field.
+         */
+        if (ioc->msix96_vector)
+                writel(reply_q->reply_post_host_index | ((msix_index  & 7) <<
+                        MPI2_RPHI_MSIX_INDEX_SHIFT),
+                        ioc->replyPostRegisterIndex[msix_index/8]);
+        else
+                writel(reply_q->reply_post_host_index | (msix_index <<
+                        MPI2_RPHI_MSIX_INDEX_SHIFT),
+                        &ioc->chip->ReplyPostHostIndex);
         atomic_dec(&reply_q->busy);
         return IRQ_HANDLED;
 }
@@ -1338,7 +1360,7 @@ _base_build_sg_scmd_ieee(struct MPT3SAS_ADAPTER *ioc,
 
         sg_scmd = scsi_sglist(scmd);
         sges_left = scsi_dma_map(scmd);
-        if (!sges_left) {
+        if (sges_left < 0) {
                 sdev_printk(KERN_ERR, scmd->device,
                         "pci_map_sg failed: request for %d bytes!\n",
                         scsi_bufflen(scmd));
@@ -1407,7 +1429,7 @@ _base_build_sg_scmd_ieee(struct MPT3SAS_ADAPTER *ioc,
  fill_in_last_segment:
 
         /* fill the last segment */
-        while (sges_left) {
+        while (sges_left > 0) {
                 if (sges_left == 1)
                         _base_add_sg_single_ieee(sg_local,
                             simple_sgl_flags_last, 0, sg_dma_len(sg_scmd),
@@ -1560,8 +1582,6 @@ _base_check_enable_msix(struct MPT3SAS_ADAPTER *ioc)
 
         pci_read_config_word(ioc->pdev, base + 2, &message_control);
         ioc->msix_vector_count = (message_control & 0x3FF) + 1;
-        if (ioc->msix_vector_count > 8)
-                ioc->msix_vector_count = 8;
         dinitprintk(ioc, pr_info(MPT3SAS_FMT
                 "msix is supported, vector_count(%d)\n",
                 ioc->name, ioc->msix_vector_count));
@@ -1793,6 +1813,36 @@ _base_enable_msix(struct MPT3SAS_ADAPTER *ioc)
 }
 
 /**
+ * mpt3sas_base_unmap_resources - free controller resources
+ * @ioc: per adapter object
+ */
+void
+mpt3sas_base_unmap_resources(struct MPT3SAS_ADAPTER *ioc)
+{
+        struct pci_dev *pdev = ioc->pdev;
+
+        dexitprintk(ioc, printk(MPT3SAS_FMT "%s\n",
+                ioc->name, __func__));
+
+        _base_free_irq(ioc);
+        _base_disable_msix(ioc);
+
+        if (ioc->msix96_vector)
+                kfree(ioc->replyPostRegisterIndex);
+
+        if (ioc->chip_phys) {
+                iounmap(ioc->chip);
+                ioc->chip_phys = 0;
+        }
+
+        if (pci_is_enabled(pdev)) {
+                pci_release_selected_regions(ioc->pdev, ioc->bars);
+                pci_disable_pcie_error_reporting(pdev);
+                pci_disable_device(pdev);
+        }
+}
+
+/**
  * mpt3sas_base_map_resources - map in controller resources (io/irq/memap)
  * @ioc: per adapter object
  *
@@ -1882,6 +1932,36 @@ mpt3sas_base_map_resources(struct MPT3SAS_ADAPTER *ioc)
         if (r)
                 goto out_fail;
 
+        /* Use the Combined reply queue feature only for SAS3 C0 & higher
+         * revision HBAs and also only when reply queue count is greater than 8
+         */
+        if (ioc->msix96_vector && ioc->reply_queue_count > 8) {
+                /* Determine the Supplemental Reply Post Host Index Registers
+                 * Addresse. Supplemental Reply Post Host Index Registers
+                 * starts at offset MPI25_SUP_REPLY_POST_HOST_INDEX_OFFSET and
+                 * each register is at offset bytes of
+                 * MPT3_SUP_REPLY_POST_HOST_INDEX_REG_OFFSET from previous one.
+                 */
+                ioc->replyPostRegisterIndex = kcalloc(
+                     MPT3_SUP_REPLY_POST_HOST_INDEX_REG_COUNT,
+                     sizeof(resource_size_t *), GFP_KERNEL);
+                if (!ioc->replyPostRegisterIndex) {
+                        dfailprintk(ioc, printk(MPT3SAS_FMT
+                        "allocation for reply Post Register Index failed!!!\n",
+                                                                   ioc->name));
+                        r = -ENOMEM;
+                        goto out_fail;
+                }
+
+                for (i = 0; i < MPT3_SUP_REPLY_POST_HOST_INDEX_REG_COUNT; i++) {
+                        ioc->replyPostRegisterIndex[i] = (resource_size_t *)
+                             ((u8 *)&ioc->chip->Doorbell +
+                             MPI25_SUP_REPLY_POST_HOST_INDEX_OFFSET +
+                             (i * MPT3_SUP_REPLY_POST_HOST_INDEX_REG_OFFSET));
+                }
+        } else
+                ioc->msix96_vector = 0;
+
         list_for_each_entry(reply_q, &ioc->reply_queue_list, list)
                 pr_info(MPT3SAS_FMT "%s: IRQ %d\n",
                     reply_q->name,  ((ioc->msix_enable) ? "PCI-MSI-X enabled" :
@@ -1897,12 +1977,7 @@ mpt3sas_base_map_resources(struct MPT3SAS_ADAPTER *ioc)
         return 0;
 
  out_fail:
-        if (ioc->chip_phys)
-                iounmap(ioc->chip);
-        ioc->chip_phys = 0;
-        pci_release_selected_regions(ioc->pdev, ioc->bars);
-        pci_disable_pcie_error_reporting(pdev);
-        pci_disable_device(pdev);
+        mpt3sas_base_unmap_resources(ioc);
         return r;
 }
 
@@ -2292,6 +2367,99 @@ _base_display_intel_branding(struct MPT3SAS_ADAPTER *ioc)
 
 
 /**
+ * _base_display_dell_branding - Display branding string
+ * @ioc: per adapter object
+ *
+ * Return nothing.
+ */
+static void
+_base_display_dell_branding(struct MPT3SAS_ADAPTER *ioc)
+{
+        if (ioc->pdev->subsystem_vendor != PCI_VENDOR_ID_DELL)
+                return;
+
+        switch (ioc->pdev->device) {
+        case MPI25_MFGPAGE_DEVID_SAS3008:
+                switch (ioc->pdev->subsystem_device) {
+                case MPT3SAS_DELL_12G_HBA_SSDID:
+                        pr_info(MPT3SAS_FMT "%s\n", ioc->name,
+                                MPT3SAS_DELL_12G_HBA_BRANDING);
+                        break;
+                default:
+                        pr_info(MPT3SAS_FMT
+                           "Dell 12Gbps HBA: Subsystem ID: 0x%X\n", ioc->name,
+                           ioc->pdev->subsystem_device);
+                        break;
+                }
+                break;
+        default:
+                pr_info(MPT3SAS_FMT
+                        "Dell 12Gbps HBA: Subsystem ID: 0x%X\n", ioc->name,
+                        ioc->pdev->subsystem_device);
+                break;
+        }
+}
+
+/**
+ * _base_display_cisco_branding - Display branding string
+ * @ioc: per adapter object
+ *
+ * Return nothing.
+ */
+static void
+_base_display_cisco_branding(struct MPT3SAS_ADAPTER *ioc)
+{
+        if (ioc->pdev->subsystem_vendor != PCI_VENDOR_ID_CISCO)
+                return;
+
+        switch (ioc->pdev->device) {
+        case MPI25_MFGPAGE_DEVID_SAS3008:
+                switch (ioc->pdev->subsystem_device) {
+                case MPT3SAS_CISCO_12G_8E_HBA_SSDID:
+                        pr_info(MPT3SAS_FMT "%s\n", ioc->name,
+                                MPT3SAS_CISCO_12G_8E_HBA_BRANDING);
+                        break;
+                case MPT3SAS_CISCO_12G_8I_HBA_SSDID:
+                        pr_info(MPT3SAS_FMT "%s\n", ioc->name,
+                                MPT3SAS_CISCO_12G_8I_HBA_BRANDING);
+                        break;
+                case MPT3SAS_CISCO_12G_AVILA_HBA_SSDID:
+                        pr_info(MPT3SAS_FMT "%s\n", ioc->name,
+                                MPT3SAS_CISCO_12G_AVILA_HBA_BRANDING);
+                        break;
+                default:
+                        pr_info(MPT3SAS_FMT
+                          "Cisco 12Gbps SAS HBA: Subsystem ID: 0x%X\n",
+                          ioc->name, ioc->pdev->subsystem_device);
+                        break;
+                }
+                break;
+        case MPI25_MFGPAGE_DEVID_SAS3108_1:
+                switch (ioc->pdev->subsystem_device) {
+                case MPT3SAS_CISCO_12G_AVILA_HBA_SSDID:
+                        pr_info(MPT3SAS_FMT "%s\n", ioc->name,
+                        MPT3SAS_CISCO_12G_AVILA_HBA_BRANDING);
+                        break;
+                case MPT3SAS_CISCO_12G_COLUSA_MEZZANINE_HBA_SSDID:
+                        pr_info(MPT3SAS_FMT "%s\n", ioc->name,
+                        MPT3SAS_CISCO_12G_COLUSA_MEZZANINE_HBA_BRANDING);
+                        break;
+                default:
+                        pr_info(MPT3SAS_FMT
+                         "Cisco 12Gbps SAS HBA: Subsystem ID: 0x%X\n",
+                         ioc->name, ioc->pdev->subsystem_device);
+                        break;
+                }
+                break;
+        default:
+                 pr_info(MPT3SAS_FMT
+                        "Cisco 12Gbps SAS HBA: Subsystem ID: 0x%X\n",
+                        ioc->name, ioc->pdev->subsystem_device);
+                break;
+        }
+}
+
+/**
  * _base_display_ioc_capabilities - Disply IOC's capabilities.
  * @ioc: per adapter object
  *
@@ -2321,6 +2489,8 @@ _base_display_ioc_capabilities(struct MPT3SAS_ADAPTER *ioc)
             bios_version & 0x000000FF);
 
         _base_display_intel_branding(ioc);
+        _base_display_dell_branding(ioc);
+        _base_display_cisco_branding(ioc);
 
         pr_info(MPT3SAS_FMT "Protocol=(", ioc->name);
 
@@ -3139,6 +3309,9 @@ _base_wait_on_iocstate(struct MPT3SAS_ADAPTER *ioc, u32 ioc_state, int timeout,
  * Notes: MPI2_HIS_IOC2SYS_DB_STATUS - set to one when IOC writes to doorbell.
  */
 static int
+_base_diag_reset(struct MPT3SAS_ADAPTER *ioc, int sleep_flag);
+
+static int
 _base_wait_for_doorbell_int(struct MPT3SAS_ADAPTER *ioc, int timeout,
         int sleep_flag)
 {
@@ -3681,6 +3854,64 @@ _base_get_port_facts(struct MPT3SAS_ADAPTER *ioc, int port, int sleep_flag)
 }
 
 /**
+ * _base_wait_for_iocstate - Wait until the card is in READY or OPERATIONAL
+ * @ioc: per adapter object
+ * @timeout:
+ * @sleep_flag: CAN_SLEEP or NO_SLEEP
+ *
+ * Returns 0 for success, non-zero for failure.
+ */
+static int
+_base_wait_for_iocstate(struct MPT3SAS_ADAPTER *ioc, int timeout,
+        int sleep_flag)
+{
+        u32 ioc_state;
+        int rc;
+
+        dinitprintk(ioc, printk(MPT3SAS_FMT "%s\n", ioc->name,
+            __func__));
+
+        if (ioc->pci_error_recovery) {
+                dfailprintk(ioc, printk(MPT3SAS_FMT
+                    "%s: host in pci error recovery\n", ioc->name, __func__));
+                return -EFAULT;
+        }
+
+        ioc_state = mpt3sas_base_get_iocstate(ioc, 0);
+        dhsprintk(ioc, printk(MPT3SAS_FMT "%s: ioc_state(0x%08x)\n",
+            ioc->name, __func__, ioc_state));
+
+        if (((ioc_state & MPI2_IOC_STATE_MASK) == MPI2_IOC_STATE_READY) ||
+            (ioc_state & MPI2_IOC_STATE_MASK) == MPI2_IOC_STATE_OPERATIONAL)
+                return 0;
+
+        if (ioc_state & MPI2_DOORBELL_USED) {
+                dhsprintk(ioc, printk(MPT3SAS_FMT
+                    "unexpected doorbell active!\n", ioc->name));
+                goto issue_diag_reset;
+        }
+
+        if ((ioc_state & MPI2_IOC_STATE_MASK) == MPI2_IOC_STATE_FAULT) {
+                mpt3sas_base_fault_info(ioc, ioc_state &
+                    MPI2_DOORBELL_DATA_MASK);
+                goto issue_diag_reset;
+        }
+
+        ioc_state = _base_wait_on_iocstate(ioc, MPI2_IOC_STATE_READY,
+            timeout, sleep_flag);
+        if (ioc_state) {
+                dfailprintk(ioc, printk(MPT3SAS_FMT
+                    "%s: failed going to ready state (ioc_state=0x%x)\n",
+                    ioc->name, __func__, ioc_state));
+                return -EFAULT;
+        }
+
+ issue_diag_reset:
+        rc = _base_diag_reset(ioc, sleep_flag);
+        return rc;
+}
+
+/**
  * _base_get_ioc_facts - obtain ioc facts reply and save in ioc
  * @ioc: per adapter object
  * @sleep_flag: CAN_SLEEP or NO_SLEEP
@@ -3698,6 +3929,13 @@ _base_get_ioc_facts(struct MPT3SAS_ADAPTER *ioc, int sleep_flag)
         dinitprintk(ioc, pr_info(MPT3SAS_FMT "%s\n", ioc->name,
             __func__));
 
+        r = _base_wait_for_iocstate(ioc, 10, sleep_flag);
+        if (r) {
+                dfailprintk(ioc, printk(MPT3SAS_FMT
+                    "%s: failed getting to correct state\n",
+                    ioc->name, __func__));
+                return r;
+        }
         mpi_reply_sz = sizeof(Mpi2IOCFactsReply_t);
         mpi_request_sz = sizeof(Mpi2IOCFactsRequest_t);
         memset(&mpi_request, 0, mpi_request_sz);
@@ -3783,7 +4021,7 @@ _base_send_ioc_init(struct MPT3SAS_ADAPTER *ioc, int sleep_flag)
         mpi_request.WhoInit = MPI2_WHOINIT_HOST_DRIVER;
         mpi_request.VF_ID = 0; /* TODO */
         mpi_request.VP_ID = 0;
-        mpi_request.MsgVersion = cpu_to_le16(MPI2_VERSION);
+        mpi_request.MsgVersion = cpu_to_le16(MPI25_VERSION);
         mpi_request.HeaderVersion = cpu_to_le16(MPI2_HEADER_VERSION);
 
         if (_base_is_controller_msix_enabled(ioc))
@@ -4524,8 +4762,15 @@ _base_make_ioc_operational(struct MPT3SAS_ADAPTER *ioc, int sleep_flag)
 
         /* initialize reply post host index */
         list_for_each_entry(reply_q, &ioc->reply_queue_list, list) {
-                writel(reply_q->msix_index << MPI2_RPHI_MSIX_INDEX_SHIFT,
-                    &ioc->chip->ReplyPostHostIndex);
+                if (ioc->msix96_vector)
+                        writel((reply_q->msix_index & 7)<<
+                           MPI2_RPHI_MSIX_INDEX_SHIFT,
+                           ioc->replyPostRegisterIndex[reply_q->msix_index/8]);
+                else
+                        writel(reply_q->msix_index <<
+                                MPI2_RPHI_MSIX_INDEX_SHIFT,
+                                &ioc->chip->ReplyPostHostIndex);
+
                 if (!_base_is_controller_msix_enabled(ioc))
                         goto skip_init_reply_post_host_index;
         }
@@ -4564,8 +4809,6 @@ _base_make_ioc_operational(struct MPT3SAS_ADAPTER *ioc, int sleep_flag)
 void
 mpt3sas_base_free_resources(struct MPT3SAS_ADAPTER *ioc)
 {
-        struct pci_dev *pdev = ioc->pdev;
-
         dexitprintk(ioc, pr_info(MPT3SAS_FMT "%s\n", ioc->name,
             __func__));
 
@@ -4576,18 +4819,7 @@ mpt3sas_base_free_resources(struct MPT3SAS_ADAPTER *ioc)
                 ioc->shost_recovery = 0;
         }
 
-        _base_free_irq(ioc);
-        _base_disable_msix(ioc);
-
-        if (ioc->chip_phys && ioc->chip)
-                iounmap(ioc->chip);
-        ioc->chip_phys = 0;
-
-        if (pci_is_enabled(pdev)) {
-                pci_release_selected_regions(ioc->pdev, ioc->bars);
-                pci_disable_pcie_error_reporting(pdev);
-                pci_disable_device(pdev);
-        }
+        mpt3sas_base_unmap_resources(ioc);
         return;
 }
 
@@ -4602,6 +4834,7 @@ mpt3sas_base_attach(struct MPT3SAS_ADAPTER *ioc)
 {
         int r, i;
         int cpu_id, last_cpu_id = 0;
+        u8 revision;
 
         dinitprintk(ioc, pr_info(MPT3SAS_FMT "%s\n", ioc->name,
             __func__));
@@ -4621,6 +4854,20 @@ mpt3sas_base_attach(struct MPT3SAS_ADAPTER *ioc)
                 goto out_free_resources;
         }
 
+        /* Check whether the controller revision is C0 or above.
+         * only C0 and above revision controllers support 96 MSI-X vectors.
+         */
+        revision = ioc->pdev->revision;
+
+        if ((ioc->pdev->device == MPI25_MFGPAGE_DEVID_SAS3004 ||
+             ioc->pdev->device == MPI25_MFGPAGE_DEVID_SAS3008 ||
+             ioc->pdev->device == MPI25_MFGPAGE_DEVID_SAS3108_1 ||
+             ioc->pdev->device == MPI25_MFGPAGE_DEVID_SAS3108_2 ||
+             ioc->pdev->device == MPI25_MFGPAGE_DEVID_SAS3108_5 ||
+             ioc->pdev->device == MPI25_MFGPAGE_DEVID_SAS3108_6) &&
+             (revision >= 0x02))
+                ioc->msix96_vector = 1;
+
         ioc->rdpq_array_enable_assigned = 0;
         ioc->dma_mask = 0;
         r = mpt3sas_base_map_resources(ioc);
@@ -4643,7 +4890,6 @@ mpt3sas_base_attach(struct MPT3SAS_ADAPTER *ioc)
         ioc->build_sg_scmd = &_base_build_sg_scmd_ieee;
         ioc->build_sg = &_base_build_sg_ieee;
         ioc->build_zero_len_sge = &_base_build_zero_len_sge_ieee;
-        ioc->mpi25 = 1;
         ioc->sge_size_ieee = sizeof(Mpi2IeeeSgeSimple64_t);
 
         /*
diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.h b/drivers/scsi/mpt3sas/mpt3sas_base.h
index afa881682bef..f0e462b0880d 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_base.h
+++ b/drivers/scsi/mpt3sas/mpt3sas_base.h
@@ -71,8 +71,8 @@
 #define MPT3SAS_DRIVER_NAME             "mpt3sas"
 #define MPT3SAS_AUTHOR "Avago Technologies <MPT-FusionLinux.pdl@avagotech.com>"
 #define MPT3SAS_DESCRIPTION     "LSI MPT Fusion SAS 3.0 Device Driver"
-#define MPT3SAS_DRIVER_VERSION          "04.100.00.00"
-#define MPT3SAS_MAJOR_VERSION           4
+#define MPT3SAS_DRIVER_VERSION          "09.100.00.00"
+#define MPT3SAS_MAJOR_VERSION           9
 #define MPT3SAS_MINOR_VERSION           100
 #define MPT3SAS_BUILD_VERSION           0
 #define MPT3SAS_RELEASE_VERSION 00
@@ -152,12 +152,49 @@
 #define MPT3SAS_INTEL_RS3UC080_SSDID    0x3524
 
 /*
+ * Dell HBA branding
+ */
+#define MPT3SAS_DELL_12G_HBA_BRANDING       \
+        "Dell 12Gbps HBA"
+
+/*
+ * Dell HBA SSDIDs
+ */
+#define MPT3SAS_DELL_12G_HBA_SSDID      0x1F46
+
+/*
+ * Cisco HBA branding
+ */
+#define MPT3SAS_CISCO_12G_8E_HBA_BRANDING               \
+                "Cisco 9300-8E 12G SAS HBA"
+#define MPT3SAS_CISCO_12G_8I_HBA_BRANDING               \
+                "Cisco 9300-8i 12G SAS HBA"
+#define MPT3SAS_CISCO_12G_AVILA_HBA_BRANDING    \
+                "Cisco 12G Modular SAS Pass through Controller"
+#define MPT3SAS_CISCO_12G_COLUSA_MEZZANINE_HBA_BRANDING         \
+                "UCS C3X60 12G SAS Pass through Controller"
+/*
+ * Cisco HBA SSSDIDs
+ */
+#define MPT3SAS_CISCO_12G_8E_HBA_SSDID  0x14C
+#define MPT3SAS_CISCO_12G_8I_HBA_SSDID  0x154
+#define MPT3SAS_CISCO_12G_AVILA_HBA_SSDID  0x155
+#define MPT3SAS_CISCO_12G_COLUSA_MEZZANINE_HBA_SSDID  0x156
+
+/*
  * status bits for ioc->diag_buffer_status
  */
 #define MPT3_DIAG_BUFFER_IS_REGISTERED  (0x01)
 #define MPT3_DIAG_BUFFER_IS_RELEASED    (0x02)
 #define MPT3_DIAG_BUFFER_IS_DIAG_RESET  (0x04)
 
+/*
+ * Combined Reply Queue constants,
+ * There are twelve Supplemental Reply Post Host Index Registers
+ * and each register is at offset 0x10 bytes from the previous one.
+ */
+#define MPT3_SUP_REPLY_POST_HOST_INDEX_REG_COUNT 12
+#define MPT3_SUP_REPLY_POST_HOST_INDEX_REG_OFFSET (0x10)
 
 /* OEM Identifiers */
 #define MFG10_OEM_ID_INVALID                   (0x00000000)
@@ -173,6 +210,8 @@
 #define MFG10_GF0_SSD_DATA_SCRUB_DISABLE       (0x00000008)
 #define MFG10_GF0_SINGLE_DRIVE_R0              (0x00000010)
 
+#define VIRTUAL_IO_FAILED_RETRY                 (0x32010081)
+
 /* OEM Specific Flags will come from OEM specific header files */
 struct Mpi2ManufacturingPage10_t {
         MPI2_CONFIG_PAGE_HEADER Header;         /* 00h */
@@ -294,7 +333,8 @@ struct _internal_cmd {
  * @responding: used in _scsih_sas_device_mark_responding
  * @fast_path: fast path feature enable bit
  * @pfa_led_on: flag for PFA LED status
- *
+ * @pend_sas_rphy_add: flag to check if device is in sas_rphy_add()
+ *      addition routine.
  */
 struct _sas_device {
         struct list_head list;
@@ -315,6 +355,9 @@ struct _sas_device {
         u8      responding;
         u8      fast_path;
         u8      pfa_led_on;
+        u8      pend_sas_rphy_add;
+        u8      enclosure_level;
+        u8      connector_name[4];
 };
 
 /**
@@ -728,7 +771,8 @@ typedef void (*MPT3SAS_FLUSH_RUNNING_CMDS)(struct MPT3SAS_ADAPTER *ioc);
  *                              is assigned only ones
  * @reply_queue_count: number of reply queue's
  * @reply_queue_list: link list contaning the reply queue info
- * @reply_post_host_index: head index in the pool where FW completes IO
+ * @msix96_vector: 96 MSI-X vector support
+ * @replyPostRegisterIndex: index of next position in Reply Desc Post Queue
  * @delayed_tr_list: target reset link list
  * @delayed_tr_volume_list: volume target reset link list
  * @@temp_sensors_count: flag to carry the number of temperature sensors
@@ -814,7 +858,6 @@ struct MPT3SAS_ADAPTER {
         MPT_BUILD_SG_SCMD build_sg_scmd;
         MPT_BUILD_SG    build_sg;
         MPT_BUILD_ZERO_LEN_SGE build_zero_len_sge;
-        u8              mpi25;
         u16             sge_size_ieee;
 
         /* function ptr for MPI sg elements only */
@@ -937,6 +980,10 @@ struct MPT3SAS_ADAPTER {
         u8              reply_queue_count;
         struct list_head reply_queue_list;
 
+        u8              msix96_vector;
+        /* reply post register index */
+        resource_size_t **replyPostRegisterIndex;
+
         struct list_head delayed_tr_list;
         struct list_head delayed_tr_volume_list;
         u8              temp_sensors_count;
diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
index 5a97e3286719..8ccef38523fa 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
@@ -585,6 +585,22 @@ _scsih_sas_device_remove(struct MPT3SAS_ADAPTER *ioc,
 
         if (!sas_device)
                 return;
+        pr_info(MPT3SAS_FMT
+            "removing handle(0x%04x), sas_addr(0x%016llx)\n",
+            ioc->name, sas_device->handle,
+            (unsigned long long) sas_device->sas_address);
+
+        if (sas_device->enclosure_handle != 0)
+                pr_info(MPT3SAS_FMT
+                   "removing enclosure logical id(0x%016llx), slot(%d)\n",
+                   ioc->name, (unsigned long long)
+                   sas_device->enclosure_logical_id, sas_device->slot);
+
+        if (sas_device->connector_name[0] != '\0')
+                pr_info(MPT3SAS_FMT
+                   "removing enclosure level(0x%04x), connector name( %s)\n",
+                   ioc->name, sas_device->enclosure_level,
+                   sas_device->connector_name);
 
         spin_lock_irqsave(&ioc->sas_device_lock, flags);
         list_del(&sas_device->list);
@@ -663,6 +679,18 @@ _scsih_sas_device_add(struct MPT3SAS_ADAPTER *ioc,
                 ioc->name, __func__, sas_device->handle,
                 (unsigned long long)sas_device->sas_address));
 
+        if (sas_device->enclosure_handle != 0)
+                dewtprintk(ioc, pr_info(MPT3SAS_FMT
+                    "%s: enclosure logical id(0x%016llx), slot( %d)\n",
+                    ioc->name, __func__, (unsigned long long)
+                    sas_device->enclosure_logical_id, sas_device->slot));
+
+        if (sas_device->connector_name[0] != '\0')
+                dewtprintk(ioc, pr_info(MPT3SAS_FMT
+                    "%s: enclosure level(0x%04x), connector name( %s)\n",
+                    ioc->name, __func__,
+                    sas_device->enclosure_level, sas_device->connector_name));
+
         spin_lock_irqsave(&ioc->sas_device_lock, flags);
         list_add_tail(&sas_device->list, &ioc->sas_device_list);
         spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
@@ -704,6 +732,18 @@ _scsih_sas_device_init_add(struct MPT3SAS_ADAPTER *ioc,
                 __func__, sas_device->handle,
                 (unsigned long long)sas_device->sas_address));
 
+        if (sas_device->enclosure_handle != 0)
+                dewtprintk(ioc, pr_info(MPT3SAS_FMT
+                    "%s: enclosure logical id(0x%016llx), slot( %d)\n",
+                    ioc->name, __func__, (unsigned long long)
+                    sas_device->enclosure_logical_id, sas_device->slot));
+
+        if (sas_device->connector_name[0] != '\0')
+                dewtprintk(ioc, pr_info(MPT3SAS_FMT
+                    "%s: enclosure level(0x%04x), connector name( %s)\n",
+                    ioc->name, __func__, sas_device->enclosure_level,
+                    sas_device->connector_name));
+
         spin_lock_irqsave(&ioc->sas_device_lock, flags);
         list_add_tail(&sas_device->list, &ioc->sas_device_init_list);
         _scsih_determine_boot_device(ioc, sas_device, 0);
@@ -1772,10 +1812,16 @@ _scsih_slave_configure(struct scsi_device *sdev)
             "sas_addr(0x%016llx), phy(%d), device_name(0x%016llx)\n",
             ds, handle, (unsigned long long)sas_device->sas_address,
             sas_device->phy, (unsigned long long)sas_device->device_name);
-        sdev_printk(KERN_INFO, sdev,
-                "%s: enclosure_logical_id(0x%016llx), slot(%d)\n",
-                ds, (unsigned long long)
-            sas_device->enclosure_logical_id, sas_device->slot);
+        if (sas_device->enclosure_handle != 0)
+                sdev_printk(KERN_INFO, sdev,
+                     "%s: enclosure_logical_id(0x%016llx), slot(%d)\n",
+                     ds, (unsigned long long)
+                     sas_device->enclosure_logical_id, sas_device->slot);
+        if (sas_device->connector_name[0] != '\0')
+                sdev_printk(KERN_INFO, sdev,
+                     "%s: enclosure level(0x%04x), connector name( %s)\n",
+                     ds, sas_device->enclosure_level,
+                     sas_device->connector_name);
 
         spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
 
@@ -2189,10 +2235,17 @@ _scsih_tm_display_info(struct MPT3SAS_ADAPTER *ioc, struct scsi_cmnd *scmd)
                             sas_device->handle,
                             (unsigned long long)sas_device->sas_address,
                             sas_device->phy);
-                        starget_printk(KERN_INFO, starget,
-                            "enclosure_logical_id(0x%016llx), slot(%d)\n",
-                           (unsigned long long)sas_device->enclosure_logical_id,
-                            sas_device->slot);
+                        if (sas_device->enclosure_handle != 0)
+                                starget_printk(KERN_INFO, starget,
+                                 "enclosure_logical_id(0x%016llx), slot(%d)\n",
+                                 (unsigned long long)
+                                 sas_device->enclosure_logical_id,
+                                 sas_device->slot);
+                        if (sas_device->connector_name)
+                                starget_printk(KERN_INFO, starget,
+                                "enclosure level(0x%04x),connector name(%s)\n",
+                                 sas_device->enclosure_level,
+                                 sas_device->connector_name);
                 }
                 spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
         }
@@ -2552,6 +2605,75 @@ _scsih_fw_event_cleanup_queue(struct MPT3SAS_ADAPTER *ioc)
 }
 
 /**
+ * _scsih_internal_device_block - block the sdev device
+ * @sdev: per device object
+ * @sas_device_priv_data : per device driver private data
+ *
+ * make sure device is blocked without error, if not
+ * print an error
+ */
+static void
+_scsih_internal_device_block(struct scsi_device *sdev,
+                        struct MPT3SAS_DEVICE *sas_device_priv_data)
+{
+        int r = 0;
+
+        sdev_printk(KERN_INFO, sdev, "device_block, handle(0x%04x)\n",
+            sas_device_priv_data->sas_target->handle);
+        sas_device_priv_data->block = 1;
+
+        r = scsi_internal_device_block(sdev);
+        if (r == -EINVAL)
+                sdev_printk(KERN_WARNING, sdev,
+                    "device_block failed with return(%d) for handle(0x%04x)\n",
+                    sas_device_priv_data->sas_target->handle, r);
+}
+
+/**
+ * _scsih_internal_device_unblock - unblock the sdev device
+ * @sdev: per device object
+ * @sas_device_priv_data : per device driver private data
+ * make sure device is unblocked without error, if not retry
+ * by blocking and then unblocking
+ */
+
+static void
+_scsih_internal_device_unblock(struct scsi_device *sdev,
+                        struct MPT3SAS_DEVICE *sas_device_priv_data)
+{
+        int r = 0;
+
+        sdev_printk(KERN_WARNING, sdev, "device_unblock and setting to running, "
+            "handle(0x%04x)\n", sas_device_priv_data->sas_target->handle);
+        sas_device_priv_data->block = 0;
+        r = scsi_internal_device_unblock(sdev, SDEV_RUNNING);
+        if (r == -EINVAL) {
+                /* The device has been set to SDEV_RUNNING by SD layer during
+                 * device addition but the request queue is still stopped by
+                 * our earlier block call. We need to perform a block again
+                 * to get the device to SDEV_BLOCK and then to SDEV_RUNNING */
+
+                sdev_printk(KERN_WARNING, sdev,
+                    "device_unblock failed with return(%d) for handle(0x%04x) "
+                    "performing a block followed by an unblock\n",
+                    sas_device_priv_data->sas_target->handle, r);
+                sas_device_priv_data->block = 1;
+                r = scsi_internal_device_block(sdev);
+                if (r)
+                        sdev_printk(KERN_WARNING, sdev, "retried device_block "
+                            "failed with return(%d) for handle(0x%04x)\n",
+                            sas_device_priv_data->sas_target->handle, r);
+
+                sas_device_priv_data->block = 0;
+                r = scsi_internal_device_unblock(sdev, SDEV_RUNNING);
+                if (r)
+                        sdev_printk(KERN_WARNING, sdev, "retried device_unblock"
+                            " failed with return(%d) for handle(0x%04x)\n",
+                            sas_device_priv_data->sas_target->handle, r);
+        }
+}
+
+/**
  * _scsih_ublock_io_all_device - unblock every device
  * @ioc: per adapter object
  *
@@ -2570,11 +2692,10 @@ _scsih_ublock_io_all_device(struct MPT3SAS_ADAPTER *ioc)
                 if (!sas_device_priv_data->block)
                         continue;
 
-                sas_device_priv_data->block = 0;
                 dewtprintk(ioc, sdev_printk(KERN_INFO, sdev,
                         "device_running, handle(0x%04x)\n",
                     sas_device_priv_data->sas_target->handle));
-                scsi_internal_device_unblock(sdev, SDEV_RUNNING);
+                _scsih_internal_device_unblock(sdev, sas_device_priv_data);
         }
 }
 
@@ -2599,10 +2720,9 @@ _scsih_ublock_io_device(struct MPT3SAS_ADAPTER *ioc, u64 sas_address)
                 if (sas_device_priv_data->sas_target->sas_address
                     != sas_address)
                         continue;
-                if (sas_device_priv_data->block) {
-                        sas_device_priv_data->block = 0;
-                        scsi_internal_device_unblock(sdev, SDEV_RUNNING);
-                }
+                if (sas_device_priv_data->block)
+                        _scsih_internal_device_unblock(sdev,
+                                sas_device_priv_data);
         }
 }
 
@@ -2625,10 +2745,7 @@ _scsih_block_io_all_device(struct MPT3SAS_ADAPTER *ioc)
                         continue;
                 if (sas_device_priv_data->block)
                         continue;
-                sas_device_priv_data->block = 1;
-                scsi_internal_device_block(sdev);
-                sdev_printk(KERN_INFO, sdev, "device_blocked, handle(0x%04x)\n",
-                    sas_device_priv_data->sas_target->handle);
+                _scsih_internal_device_block(sdev, sas_device_priv_data);
         }
 }
 
@@ -2644,6 +2761,11 @@ _scsih_block_io_device(struct MPT3SAS_ADAPTER *ioc, u16 handle)
 {
         struct MPT3SAS_DEVICE *sas_device_priv_data;
         struct scsi_device *sdev;
+        struct _sas_device *sas_device;
+
+        sas_device = _scsih_sas_device_find_by_handle(ioc, handle);
+        if (!sas_device)
+                return;
 
         shost_for_each_device(sdev, ioc->shost) {
                 sas_device_priv_data = sdev->hostdata;
@@ -2653,10 +2775,9 @@ _scsih_block_io_device(struct MPT3SAS_ADAPTER *ioc, u16 handle)
                         continue;
                 if (sas_device_priv_data->block)
                         continue;
-                sas_device_priv_data->block = 1;
-                scsi_internal_device_block(sdev);
-                sdev_printk(KERN_INFO, sdev,
-                        "device_blocked, handle(0x%04x)\n", handle);
+                if (sas_device->pend_sas_rphy_add)
+                        continue;
+                _scsih_internal_device_block(sdev, sas_device_priv_data);
         }
 }
 
@@ -2806,6 +2927,18 @@ _scsih_tm_tr_send(struct MPT3SAS_ADAPTER *ioc, u16 handle)
                         "setting delete flag: handle(0x%04x), sas_addr(0x%016llx)\n",
                         ioc->name, handle,
                     (unsigned long long)sas_address));
+                if (sas_device->enclosure_handle != 0)
+                        dewtprintk(ioc, pr_info(MPT3SAS_FMT
+                         "setting delete flag:enclosure logical id(0x%016llx),"
+                         " slot(%d)\n", ioc->name, (unsigned long long)
+                          sas_device->enclosure_logical_id,
+                          sas_device->slot));
+                if (sas_device->connector_name)
+                        dewtprintk(ioc, pr_info(MPT3SAS_FMT
+                         "setting delete flag: enclosure level(0x%04x),"
+                         " connector name( %s)\n", ioc->name,
+                          sas_device->enclosure_level,
+                          sas_device->connector_name));
                 _scsih_ublock_io_device(ioc, sas_address);
                 sas_target_priv_data->handle = MPT3SAS_INVALID_DEVICE_HANDLE;
         }
@@ -3821,10 +3954,19 @@ _scsih_scsi_ioc_info(struct MPT3SAS_ADAPTER *ioc, struct scsi_cmnd *scmd,
                                 "\tsas_address(0x%016llx), phy(%d)\n",
                                 ioc->name, (unsigned long long)
                             sas_device->sas_address, sas_device->phy);
-                        pr_warn(MPT3SAS_FMT
-                            "\tenclosure_logical_id(0x%016llx), slot(%d)\n",
-                            ioc->name, (unsigned long long)
-                            sas_device->enclosure_logical_id, sas_device->slot);
+                        if (sas_device->enclosure_handle != 0)
+                                pr_warn(MPT3SAS_FMT
+                                  "\tenclosure_logical_id(0x%016llx),"
+                                  "slot(%d)\n", ioc->name,
+                                  (unsigned long long)
+                                  sas_device->enclosure_logical_id,
+                                  sas_device->slot);
+                        if (sas_device->connector_name[0])
+                                pr_warn(MPT3SAS_FMT
+                                  "\tenclosure level(0x%04x),"
+                                  " connector name( %s)\n", ioc->name,
+                                  sas_device->enclosure_level,
+                                  sas_device->connector_name);
                 }
                 spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
         }
@@ -3999,7 +4141,16 @@ _scsih_smart_predicted_fault(struct MPT3SAS_ADAPTER *ioc, u16 handle)
                 spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
                 return;
         }
-        starget_printk(KERN_WARNING, starget, "predicted fault\n");
+        if (sas_device->enclosure_handle != 0)
+                starget_printk(KERN_INFO, starget, "predicted fault, "
+                        "enclosure logical id(0x%016llx), slot(%d)\n",
+                        (unsigned long long)sas_device->enclosure_logical_id,
+                        sas_device->slot);
+        if (sas_device->connector_name[0] != '\0')
+                starget_printk(KERN_WARNING, starget, "predicted fault, "
+                        "enclosure level(0x%04x), connector name( %s)\n",
+                        sas_device->enclosure_level,
+                        sas_device->connector_name);
         spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
 
         if (ioc->pdev->subsystem_vendor == PCI_VENDOR_ID_IBM)
@@ -4119,8 +4270,15 @@ _scsih_io_done(struct MPT3SAS_ADAPTER *ioc, u16 smid, u8 msix_index, u32 reply)
                         _scsih_smart_predicted_fault(ioc,
                             le16_to_cpu(mpi_reply->DevHandle));
                 mpt3sas_trigger_scsi(ioc, data.skey, data.asc, data.ascq);
-        }
 
+#ifdef CONFIG_SCSI_MPT3SAS_LOGGING
+                if (!(ioc->logging_level & MPT_DEBUG_REPLY) &&
+                     ((scmd->sense_buffer[2] == UNIT_ATTENTION) ||
+                     (scmd->sense_buffer[2] == MEDIUM_ERROR) ||
+                     (scmd->sense_buffer[2] == HARDWARE_ERROR)))
+                        _scsih_scsi_ioc_info(ioc, scmd, mpi_reply, smid);
+#endif
+        }
         switch (ioc_status) {
         case MPI2_IOCSTATUS_BUSY:
         case MPI2_IOCSTATUS_INSUFFICIENT_RESOURCES:
@@ -4146,6 +4304,9 @@ _scsih_io_done(struct MPT3SAS_ADAPTER *ioc, u16 smid, u8 msix_index, u32 reply)
                                 scmd->device->expecting_cc_ua = 1;
                         }
                         break;
+                } else if (log_info == VIRTUAL_IO_FAILED_RETRY) {
+                        scmd->result = DID_RESET << 16;
+                        break;
                 }
                 scmd->result = DID_SOFT_ERROR << 16;
                 break;
@@ -4788,6 +4949,16 @@ _scsih_check_device(struct MPT3SAS_ADAPTER *ioc,
                         sas_device->handle, handle);
                 sas_target_priv_data->handle = handle;
                 sas_device->handle = handle;
+                if (sas_device_pg0.Flags &
+                     MPI2_SAS_DEVICE0_FLAGS_ENCL_LEVEL_VALID) {
+                        sas_device->enclosure_level =
+                                le16_to_cpu(sas_device_pg0.EnclosureLevel);
+                        memcpy(&sas_device->connector_name[0],
+                                &sas_device_pg0.ConnectorName[0], 4);
+                } else {
+                        sas_device->enclosure_level = 0;
+                        sas_device->connector_name[0] = '\0';
+                }
         }
 
         /* check if device is present */
@@ -4894,14 +5065,24 @@ _scsih_add_device(struct MPT3SAS_ADAPTER *ioc, u16 handle, u8 phy_num,
                     ioc->name, __FILE__, __LINE__, __func__);
         sas_device->enclosure_handle =
             le16_to_cpu(sas_device_pg0.EnclosureHandle);
-        sas_device->slot =
-            le16_to_cpu(sas_device_pg0.Slot);
+        if (sas_device->enclosure_handle != 0)
+                sas_device->slot =
+                    le16_to_cpu(sas_device_pg0.Slot);
         sas_device->device_info = device_info;
         sas_device->sas_address = sas_address;
         sas_device->phy = sas_device_pg0.PhyNum;
         sas_device->fast_path = (le16_to_cpu(sas_device_pg0.Flags) &
             MPI25_SAS_DEVICE0_FLAGS_FAST_PATH_CAPABLE) ? 1 : 0;
 
+        if (sas_device_pg0.Flags & MPI2_SAS_DEVICE0_FLAGS_ENCL_LEVEL_VALID) {
+                sas_device->enclosure_level =
+                        le16_to_cpu(sas_device_pg0.EnclosureLevel);
+                memcpy(&sas_device->connector_name[0],
+                        &sas_device_pg0.ConnectorName[0], 4);
+        } else {
+                sas_device->enclosure_level = 0;
+                sas_device->connector_name[0] = '\0';
+        }
         /* get enclosure_logical_id */
         if (sas_device->enclosure_handle && !(mpt3sas_config_get_enclosure_pg0(
            ioc, &mpi_reply, &enclosure_pg0, MPI2_SAS_ENCLOS_PGAD_FORM_HANDLE,
@@ -4943,6 +5124,18 @@ _scsih_remove_device(struct MPT3SAS_ADAPTER *ioc,
                 ioc->name, __func__,
             sas_device->handle, (unsigned long long)
             sas_device->sas_address));
+        if (sas_device->enclosure_handle != 0)
+                dewtprintk(ioc, pr_info(MPT3SAS_FMT
+                    "%s: enter: enclosure logical id(0x%016llx), slot(%d)\n",
+                    ioc->name, __func__,
+                    (unsigned long long)sas_device->enclosure_logical_id,
+                    sas_device->slot));
+        if (sas_device->connector_name[0] != '\0')
+                dewtprintk(ioc, pr_info(MPT3SAS_FMT
+                  "%s: enter: enclosure level(0x%04x), connector name( %s)\n",
+                  ioc->name, __func__,
+                  sas_device->enclosure_level,
+                  sas_device->connector_name));
 
         if (sas_device->starget && sas_device->starget->hostdata) {
                 sas_target_priv_data = sas_device->starget->hostdata;
@@ -4959,12 +5152,34 @@ _scsih_remove_device(struct MPT3SAS_ADAPTER *ioc,
                 "removing handle(0x%04x), sas_addr(0x%016llx)\n",
                 ioc->name, sas_device->handle,
             (unsigned long long) sas_device->sas_address);
+        if (sas_device->enclosure_handle != 0)
+                pr_info(MPT3SAS_FMT
+                  "removing : enclosure logical id(0x%016llx), slot(%d)\n",
+                  ioc->name,
+                  (unsigned long long)sas_device->enclosure_logical_id,
+                  sas_device->slot);
+        if (sas_device->connector_name[0] != '\0')
+                pr_info(MPT3SAS_FMT
+                  "removing enclosure level(0x%04x), connector name( %s)\n",
+                  ioc->name, sas_device->enclosure_level,
+                  sas_device->connector_name);
 
         dewtprintk(ioc, pr_info(MPT3SAS_FMT
                 "%s: exit: handle(0x%04x), sas_addr(0x%016llx)\n",
                 ioc->name, __func__,
-            sas_device->handle, (unsigned long long)
-            sas_device->sas_address));
+                sas_device->handle, (unsigned long long)
+                sas_device->sas_address));
+        if (sas_device->enclosure_handle != 0)
+                dewtprintk(ioc, pr_info(MPT3SAS_FMT
+                    "%s: exit: enclosure logical id(0x%016llx), slot(%d)\n",
+                    ioc->name, __func__,
+                    (unsigned long long)sas_device->enclosure_logical_id,
+                    sas_device->slot));
+        if (sas_device->connector_name[0] != '\0')
+                dewtprintk(ioc, pr_info(MPT3SAS_FMT
+                    "%s: exit: enclosure level(0x%04x), connector name(%s)\n",
+                    ioc->name, __func__, sas_device->enclosure_level,
+                    sas_device->connector_name));
 
         kfree(sas_device);
 }
@@ -6357,9 +6572,7 @@ _scsih_prep_device_scan(struct MPT3SAS_ADAPTER *ioc)
 /**
  * _scsih_mark_responding_sas_device - mark a sas_devices as responding
  * @ioc: per adapter object
- * @sas_address: sas address
- * @slot: enclosure slot id
- * @handle: device handle
+ * @sas_device_pg0: SAS Device page 0
  *
  * After host reset, find out whether devices are still responding.
  * Used in _scsih_remove_unresponsive_sas_devices.
@@ -6367,8 +6580,8 @@ _scsih_prep_device_scan(struct MPT3SAS_ADAPTER *ioc)
  * Return nothing.
  */
 static void
-_scsih_mark_responding_sas_device(struct MPT3SAS_ADAPTER *ioc, u64 sas_address,
-        u16 slot, u16 handle)
+_scsih_mark_responding_sas_device(struct MPT3SAS_ADAPTER *ioc,
+Mpi2SasDevicePage0_t *sas_device_pg0)
 {
         struct MPT3SAS_TARGET *sas_target_priv_data = NULL;
         struct scsi_target *starget;
@@ -6377,8 +6590,8 @@ _scsih_mark_responding_sas_device(struct MPT3SAS_ADAPTER *ioc, u64 sas_address,
 
         spin_lock_irqsave(&ioc->sas_device_lock, flags);
         list_for_each_entry(sas_device, &ioc->sas_device_list, list) {
-                if (sas_device->sas_address == sas_address &&
-                    sas_device->slot == slot) {
+                if ((sas_device->sas_address == sas_device_pg0->SASAddress) &&
+                        (sas_device->slot == sas_device_pg0->Slot)) {
                         sas_device->responding = 1;
                         starget = sas_device->starget;
                         if (starget && starget->hostdata) {
@@ -6387,22 +6600,40 @@ _scsih_mark_responding_sas_device(struct MPT3SAS_ADAPTER *ioc, u64 sas_address,
                                 sas_target_priv_data->deleted = 0;
                         } else
                                 sas_target_priv_data = NULL;
-                        if (starget)
+                        if (starget) {
                                 starget_printk(KERN_INFO, starget,
-                                    "handle(0x%04x), sas_addr(0x%016llx), "
-                                    "enclosure logical id(0x%016llx), "
-                                    "slot(%d)\n", handle,
-                                    (unsigned long long)sas_device->sas_address,
+                                    "handle(0x%04x), sas_addr(0x%016llx)\n",
+                                    sas_device_pg0->DevHandle,
                                     (unsigned long long)
-                                    sas_device->enclosure_logical_id,
-                                    sas_device->slot);
-                        if (sas_device->handle == handle)
+                                    sas_device->sas_address);
+
+                                if (sas_device->enclosure_handle != 0)
+                                        starget_printk(KERN_INFO, starget,
+                                         "enclosure logical id(0x%016llx),"
+                                         " slot(%d)\n",
+                                         (unsigned long long)
+                                         sas_device->enclosure_logical_id,
+                                         sas_device->slot);
+                        }
+                        if (sas_device_pg0->Flags &
+                              MPI2_SAS_DEVICE0_FLAGS_ENCL_LEVEL_VALID) {
+                                sas_device->enclosure_level =
+                                   le16_to_cpu(sas_device_pg0->EnclosureLevel);
+                                memcpy(&sas_device->connector_name[0],
+                                        &sas_device_pg0->ConnectorName[0], 4);
+                        } else {
+                                sas_device->enclosure_level = 0;
+                                sas_device->connector_name[0] = '\0';
+                        }
+
+                        if (sas_device->handle == sas_device_pg0->DevHandle)
                                 goto out;
                         pr_info("\thandle changed from(0x%04x)!!!\n",
                             sas_device->handle);
-                        sas_device->handle = handle;
+                        sas_device->handle = sas_device_pg0->DevHandle;
                         if (sas_target_priv_data)
-                                sas_target_priv_data->handle = handle;
+                                sas_target_priv_data->handle =
+                                        sas_device_pg0->DevHandle;
                         goto out;
                 }
         }
@@ -6441,13 +6672,15 @@ _scsih_search_responding_sas_devices(struct MPT3SAS_ADAPTER *ioc)
                     MPI2_IOCSTATUS_MASK;
                 if (ioc_status != MPI2_IOCSTATUS_SUCCESS)
                         break;
-                handle = le16_to_cpu(sas_device_pg0.DevHandle);
+                handle = sas_device_pg0.DevHandle =
+                                le16_to_cpu(sas_device_pg0.DevHandle);
                 device_info = le32_to_cpu(sas_device_pg0.DeviceInfo);
                 if (!(_scsih_is_end_device(device_info)))
                         continue;
-                _scsih_mark_responding_sas_device(ioc,
-                    le64_to_cpu(sas_device_pg0.SASAddress),
-                    le16_to_cpu(sas_device_pg0.Slot), handle);
+                sas_device_pg0.SASAddress =
+                                le64_to_cpu(sas_device_pg0.SASAddress);
+                sas_device_pg0.Slot = le16_to_cpu(sas_device_pg0.Slot);
+                _scsih_mark_responding_sas_device(ioc, &sas_device_pg0);
         }
 
  out:
@@ -7854,8 +8087,8 @@ _scsih_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         /* event thread */
         snprintf(ioc->firmware_event_name, sizeof(ioc->firmware_event_name),
             "fw_event%d", ioc->id);
-        ioc->firmware_event_thread = create_singlethread_workqueue(
-            ioc->firmware_event_name);
+        ioc->firmware_event_thread = alloc_ordered_workqueue(
+            ioc->firmware_event_name, WQ_MEM_RECLAIM);
         if (!ioc->firmware_event_thread) {
                 pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n",
                     ioc->name, __FILE__, __LINE__, __func__);
diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c
index efb98afc46e0..70fd019e7ee5 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_transport.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c
@@ -649,6 +649,7 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle,
         unsigned long flags;
         struct _sas_node *sas_node;
         struct sas_rphy *rphy;
+        struct _sas_device *sas_device = NULL;
         int i;
         struct sas_port *port;
 
@@ -731,10 +732,27 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle,
                     mpt3sas_port->remote_identify.device_type);
 
         rphy->identify = mpt3sas_port->remote_identify;
+
+        if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE) {
+                sas_device = mpt3sas_scsih_sas_device_find_by_sas_address(ioc,
+                                    mpt3sas_port->remote_identify.sas_address);
+                if (!sas_device) {
+                        dfailprintk(ioc, printk(MPT3SAS_FMT
+                                "failure at %s:%d/%s()!\n",
+                                ioc->name, __FILE__, __LINE__, __func__));
+                        goto out_fail;
+                }
+                sas_device->pend_sas_rphy_add = 1;
+        }
+
         if ((sas_rphy_add(rphy))) {
                 pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n",
                     ioc->name, __FILE__, __LINE__, __func__);
         }
+
+        if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE)
+                sas_device->pend_sas_rphy_add = 0;
+
         if ((ioc->logging_level & MPT_DEBUG_TRANSPORT))
                 dev_printk(KERN_INFO, &rphy->dev,
                         "add: handle(0x%04x), sas_addr(0x%016llx)\n",
@@ -1946,7 +1964,7 @@ _transport_smp_handler(struct Scsi_Host *shost, struct sas_rphy *rphy,
         } else {
                 dma_addr_out = pci_map_single(ioc->pdev, bio_data(req->bio),
                     blk_rq_bytes(req), PCI_DMA_BIDIRECTIONAL);
-                if (!dma_addr_out) {
+                if (pci_dma_mapping_error(ioc->pdev, dma_addr_out)) {
                         pr_info(MPT3SAS_FMT "%s(): DMA Addr out = NULL\n",
                             ioc->name, __func__);
                         rc = -ENOMEM;
@@ -1968,7 +1986,7 @@ _transport_smp_handler(struct Scsi_Host *shost, struct sas_rphy *rphy,
         } else {
                 dma_addr_in =  pci_map_single(ioc->pdev, bio_data(rsp->bio),
                     blk_rq_bytes(rsp), PCI_DMA_BIDIRECTIONAL);
-                if (!dma_addr_in) {
+                if (pci_dma_mapping_error(ioc->pdev, dma_addr_in)) {
                         pr_info(MPT3SAS_FMT "%s(): DMA Addr in = NULL\n",
                             ioc->name, __func__);
                         rc = -ENOMEM;
diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c
index 39306b1e704c..04e67a190652 100644
--- a/drivers/scsi/pm8001/pm8001_hwi.c
+++ b/drivers/scsi/pm8001/pm8001_hwi.c
@@ -2642,6 +2642,7 @@ mpi_sata_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)
                 ts->resp = SAS_TASK_COMPLETE;
                 ts->stat = SAS_OPEN_REJECT;
                 ts->open_rej_reason = SAS_OREJ_RSVD_RETRY;
+                break;
         default:
                 PM8001_IO_DBG(pm8001_ha,
                         pm8001_printk("Unknown status 0x%x\n", status));
diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
index 0e1628f2018e..9a389f1508de 100644
--- a/drivers/scsi/pm8001/pm80xx_hwi.c
+++ b/drivers/scsi/pm8001/pm80xx_hwi.c
@@ -2337,6 +2337,7 @@ mpi_sata_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)
                 ts->resp = SAS_TASK_COMPLETE;
                 ts->stat = SAS_OPEN_REJECT;
                 ts->open_rej_reason = SAS_OREJ_RSVD_RETRY;
+                break;
         default:
                 PM8001_IO_DBG(pm8001_ha,
                         pm8001_printk("Unknown status 0x%x\n", status));
diff --git a/drivers/scsi/qla2xxx/Kconfig b/drivers/scsi/qla2xxx/Kconfig
index 33f60c92e20e..a0f732b138e4 100644
--- a/drivers/scsi/qla2xxx/Kconfig
+++ b/drivers/scsi/qla2xxx/Kconfig
@@ -32,10 +32,10 @@ config SCSI_QLA_FC
         They are also included in the linux-firmware tree as well.
 
 config TCM_QLA2XXX
-        tristate "TCM_QLA2XXX fabric module for Qlogic 2xxx series target mode HBAs"
+        tristate "TCM_QLA2XXX fabric module for QLogic 24xx+ series target mode HBAs"
         depends on SCSI_QLA_FC && TARGET_CORE
         depends on LIBFC
         select BTREE
         default n
         ---help---
-        Say Y here to enable the TCM_QLA2XXX fabric module for Qlogic 2xxx series target mode HBAs
+        Say Y here to enable the TCM_QLA2XXX fabric module for QLogic 24xx+ series target mode HBAs
diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
index 7ed7bae6172b..ac65cb7b4886 100644
--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
@@ -1359,9 +1359,7 @@ static void tcm_qla2xxx_free_session(struct qla_tgt_sess *sess)
         struct qla_hw_data *ha = tgt->ha;
         scsi_qla_host_t *vha = pci_get_drvdata(ha->pdev);
         struct se_session *se_sess;
-        struct se_node_acl *se_nacl;
         struct tcm_qla2xxx_lport *lport;
-        struct tcm_qla2xxx_nacl *nacl;
 
         BUG_ON(in_interrupt());
 
@@ -1371,8 +1369,6 @@ static void tcm_qla2xxx_free_session(struct qla_tgt_sess *sess)
                 dump_stack();
                 return;
         }
-        se_nacl = se_sess->se_node_acl;
-        nacl = container_of(se_nacl, struct tcm_qla2xxx_nacl, se_node_acl);
 
         lport = vha->vha_tgt.target_lport_ptr;
         if (!lport) {
@@ -1680,7 +1676,6 @@ static int tcm_qla2xxx_lport_register_npiv_cb(struct scsi_qla_host *base_vha,
                         (struct tcm_qla2xxx_lport *)target_lport_ptr;
         struct tcm_qla2xxx_lport *base_lport =
                         (struct tcm_qla2xxx_lport *)base_vha->vha_tgt.target_lport_ptr;
-        struct tcm_qla2xxx_tpg *base_tpg;
         struct fc_vport_identifiers vport_id;
 
         if (!qla_tgt_mode_enabled(base_vha)) {
@@ -1693,7 +1688,6 @@ static int tcm_qla2xxx_lport_register_npiv_cb(struct scsi_qla_host *base_vha,
                 pr_err("qla2xxx base_lport or tpg_1 not available\n");
                 return -EPERM;
         }
-        base_tpg = base_lport->tpg_1;
 
         memset(&vport_id, 0, sizeof(vport_id));
         vport_id.port_name = npiv_wwpn;
@@ -1810,6 +1804,11 @@ static const struct target_core_fabric_ops tcm_qla2xxx_ops = {
         .module                         = THIS_MODULE,
         .name                           = "qla2xxx",
         .node_acl_size                  = sizeof(struct tcm_qla2xxx_nacl),
+        /*
+         * XXX: Limit assumes single page per scatter-gather-list entry.
+         * Current maximum is ~4.9 MB per se_cmd->t_data_sg with PAGE_SIZE=4096
+         */
+        .max_data_sg_nents              = 1200,
         .get_fabric_name                = tcm_qla2xxx_get_fabric_name,
         .tpg_get_wwn                    = tcm_qla2xxx_get_fabric_wwn,
         .tpg_get_tag                    = tcm_qla2xxx_get_tag,
@@ -1958,7 +1957,7 @@ static void __exit tcm_qla2xxx_exit(void)
         tcm_qla2xxx_deregister_configfs();
 }
 
-MODULE_DESCRIPTION("TCM QLA2XXX series NPIV enabled fabric driver");
+MODULE_DESCRIPTION("TCM QLA24XX+ series NPIV enabled fabric driver");
 MODULE_LICENSE("GPL");
 module_init(tcm_qla2xxx_init);
 module_exit(tcm_qla2xxx_exit);
diff --git a/drivers/scsi/scsi_common.c b/drivers/scsi/scsi_common.c
index 2ff092252b76..c126966130ab 100644
--- a/drivers/scsi/scsi_common.c
+++ b/drivers/scsi/scsi_common.c
@@ -5,6 +5,8 @@
 #include <linux/bug.h>
 #include <linux/kernel.h>
 #include <linux/string.h>
+#include <linux/errno.h>
+#include <asm/unaligned.h>
 #include <scsi/scsi_common.h>
 
 /* NB: These are exposed through /proc/scsi/scsi and form part of the ABI.
@@ -176,3 +178,110 @@ bool scsi_normalize_sense(const u8 *sense_buffer, int sb_len,
         return true;
 }
 EXPORT_SYMBOL(scsi_normalize_sense);
+
+/**
+ * scsi_sense_desc_find - search for a given descriptor type in descriptor sense data format.
+ * @sense_buffer:       byte array of descriptor format sense data
+ * @sb_len:             number of valid bytes in sense_buffer
+ * @desc_type:          value of descriptor type to find
+ *                      (e.g. 0 -> information)
+ *
+ * Notes:
+ *      only valid when sense data is in descriptor format
+ *
+ * Return value:
+ *      pointer to start of (first) descriptor if found else NULL
+ */
+const u8 * scsi_sense_desc_find(const u8 * sense_buffer, int sb_len,
+                                int desc_type)
+{
+        int add_sen_len, add_len, desc_len, k;
+        const u8 * descp;
+
+        if ((sb_len < 8) || (0 == (add_sen_len = sense_buffer[7])))
+                return NULL;
+        if ((sense_buffer[0] < 0x72) || (sense_buffer[0] > 0x73))
+                return NULL;
+        add_sen_len = (add_sen_len < (sb_len - 8)) ?
+                        add_sen_len : (sb_len - 8);
+        descp = &sense_buffer[8];
+        for (desc_len = 0, k = 0; k < add_sen_len; k += desc_len) {
+                descp += desc_len;
+                add_len = (k < (add_sen_len - 1)) ? descp[1]: -1;
+                desc_len = add_len + 2;
+                if (descp[0] == desc_type)
+                        return descp;
+                if (add_len < 0) // short descriptor ??
+                        break;
+        }
+        return NULL;
+}
+EXPORT_SYMBOL(scsi_sense_desc_find);
+
+/**
+ * scsi_build_sense_buffer - build sense data in a buffer
+ * @desc:       Sense format (non zero == descriptor format,
+ *              0 == fixed format)
+ * @buf:        Where to build sense data
+ * @key:        Sense key
+ * @asc:        Additional sense code
+ * @ascq:       Additional sense code qualifier
+ *
+ **/
+void scsi_build_sense_buffer(int desc, u8 *buf, u8 key, u8 asc, u8 ascq)
+{
+        if (desc) {
+                buf[0] = 0x72;  /* descriptor, current */
+                buf[1] = key;
+                buf[2] = asc;
+                buf[3] = ascq;
+                buf[7] = 0;
+        } else {
+                buf[0] = 0x70;  /* fixed, current */
+                buf[2] = key;
+                buf[7] = 0xa;
+                buf[12] = asc;
+                buf[13] = ascq;
+        }
+}
+EXPORT_SYMBOL(scsi_build_sense_buffer);
+
+/**
+ * scsi_set_sense_information - set the information field in a
+ *              formatted sense data buffer
+ * @buf:        Where to build sense data
+ * @buf_len:    buffer length
+ * @info:       64-bit information value to be set
+ *
+ * Return value:
+ *      0 on success or EINVAL for invalid sense buffer length
+ **/
+int scsi_set_sense_information(u8 *buf, int buf_len, u64 info)
+{
+        if ((buf[0] & 0x7f) == 0x72) {
+                u8 *ucp, len;
+
+                len = buf[7];
+                ucp = (char *)scsi_sense_desc_find(buf, len + 8, 0);
+                if (!ucp) {
+                        buf[7] = len + 0xc;
+                        ucp = buf + 8 + len;
+                }
+
+                if (buf_len < len + 0xc)
+                        /* Not enough room for info */
+                        return -EINVAL;
+
+                ucp[0] = 0;
+                ucp[1] = 0xa;
+                ucp[2] = 0x80; /* Valid bit */
+                ucp[3] = 0;
+                put_unaligned_be64(info, &ucp[4]);
+        } else if ((buf[0] & 0x7f) == 0x70) {
+                buf[0] |= 0x80;
+                put_unaligned_be64(info, &buf[3]);
+        }
+
+        return 0;
+}
+EXPORT_SYMBOL(scsi_set_sense_information);
diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index 30268bb2ddb6..dfcc45bb03b1 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -25,6 +25,9 @@
  *        module options to "modprobe scsi_debug num_tgts=2" [20021221]
  */
 
+
+#define pr_fmt(fmt) KBUILD_MODNAME ":%s: " fmt, __func__
+
 #include <linux/module.h>
 
 #include <linux/kernel.h>
@@ -201,7 +204,6 @@ static const char *scsi_debug_version_date = "20141022";
 /* If REPORT LUNS has luns >= 256 it can choose "flat space" (value 1)
  * or "peripheral device" addressing (value 0) */
 #define SAM2_LUN_ADDRESS_METHOD 0
-#define SAM2_WLUN_REPORT_LUNS 0xc101
 
 /* SCSI_DEBUG_CANQUEUE is the maximum number of commands that can be queued
  * (for response) at one time. Can be reduced by max_queue option. Command
@@ -698,7 +700,7 @@ static void sdebug_max_tgts_luns(void)
                 else
                         hpnt->max_id = scsi_debug_num_tgts;
                 /* scsi_debug_max_luns; */
-                hpnt->max_lun = SAM2_WLUN_REPORT_LUNS;
+                hpnt->max_lun = SCSI_W_LUN_REPORT_LUNS + 1;
         }
         spin_unlock(&sdebug_host_list_lock);
 }
@@ -1288,7 +1290,7 @@ static int resp_inquiry(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
         arr = kzalloc(SDEBUG_MAX_INQ_ARR_SZ, GFP_ATOMIC);
         if (! arr)
                 return DID_REQUEUE << 16;
-        have_wlun = (scp->device->lun == SAM2_WLUN_REPORT_LUNS);
+        have_wlun = (scp->device->lun == SCSI_W_LUN_REPORT_LUNS);
         if (have_wlun)
                 pq_pdt = 0x1e;  /* present, wlun */
         else if (scsi_debug_no_lun_0 && (0 == devip->lun))
@@ -1427,12 +1429,11 @@ static int resp_requests(struct scsi_cmnd * scp,
         unsigned char * sbuff;
         unsigned char *cmd = scp->cmnd;
         unsigned char arr[SCSI_SENSE_BUFFERSIZE];
-        bool dsense, want_dsense;
+        bool dsense;
         int len = 18;
 
         memset(arr, 0, sizeof(arr));
         dsense = !!(cmd[1] & 1);
-        want_dsense = dsense || scsi_debug_dsense;
         sbuff = scp->sense_buffer;
         if ((iec_m_pg[2] & 0x4) && (6 == (iec_m_pg[3] & 0xf))) {
                 if (dsense) {
@@ -2446,8 +2447,7 @@ static int dif_verify(struct sd_dif_tuple *sdt, const void *data,
         __be16 csum = dif_compute_csum(data, scsi_debug_sector_size);
 
         if (sdt->guard_tag != csum) {
-                pr_err("%s: GUARD check failed on sector %lu rcvd 0x%04x, data 0x%04x\n",
-                        __func__,
+                pr_err("GUARD check failed on sector %lu rcvd 0x%04x, data 0x%04x\n",
                         (unsigned long)sector,
                         be16_to_cpu(sdt->guard_tag),
                         be16_to_cpu(csum));
@@ -2455,14 +2455,14 @@ static int dif_verify(struct sd_dif_tuple *sdt, const void *data,
         }
         if (scsi_debug_dif == SD_DIF_TYPE1_PROTECTION &&
             be32_to_cpu(sdt->ref_tag) != (sector & 0xffffffff)) {
-                pr_err("%s: REF check failed on sector %lu\n",
-                        __func__, (unsigned long)sector);
+                pr_err("REF check failed on sector %lu\n",
+                        (unsigned long)sector);
                 return 0x03;
         }
         if (scsi_debug_dif == SD_DIF_TYPE2_PROTECTION &&
             be32_to_cpu(sdt->ref_tag) != ei_lba) {
-                pr_err("%s: REF check failed on sector %lu\n",
-                        __func__, (unsigned long)sector);
+                pr_err("REF check failed on sector %lu\n",
+                        (unsigned long)sector);
                 return 0x03;
         }
         return 0;
@@ -2680,7 +2680,7 @@ resp_read_dt0(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
         return 0;
 }
 
-void dump_sector(unsigned char *buf, int len)
+static void dump_sector(unsigned char *buf, int len)
 {
         int i, j, n;
 
@@ -3365,8 +3365,8 @@ static int resp_report_luns(struct scsi_cmnd * scp,
                 one_lun[i].scsi_lun[1] = lun & 0xff;
         }
         if (want_wlun) {
-                one_lun[i].scsi_lun[0] = (SAM2_WLUN_REPORT_LUNS >> 8) & 0xff;
-                one_lun[i].scsi_lun[1] = SAM2_WLUN_REPORT_LUNS & 0xff;
+                one_lun[i].scsi_lun[0] = (SCSI_W_LUN_REPORT_LUNS >> 8) & 0xff;
+                one_lun[i].scsi_lun[1] = SCSI_W_LUN_REPORT_LUNS & 0xff;
                 i++;
         }
         alloc_len = (unsigned char *)(one_lun + i) - arr;
@@ -3449,7 +3449,7 @@ static void sdebug_q_cmd_complete(unsigned long indx)
         atomic_inc(&sdebug_completions);
         qa_indx = indx;
         if ((qa_indx < 0) || (qa_indx >= SCSI_DEBUG_CANQUEUE)) {
-                pr_err("%s: wild qa_indx=%d\n", __func__, qa_indx);
+                pr_err("wild qa_indx=%d\n", qa_indx);
                 return;
         }
         spin_lock_irqsave(&queued_arr_lock, iflags);
@@ -3457,21 +3457,21 @@ static void sdebug_q_cmd_complete(unsigned long indx)
         scp = sqcp->a_cmnd;
         if (NULL == scp) {
                 spin_unlock_irqrestore(&queued_arr_lock, iflags);
-                pr_err("%s: scp is NULL\n", __func__);
+                pr_err("scp is NULL\n");
                 return;
         }
         devip = (struct sdebug_dev_info *)scp->device->hostdata;
         if (devip)
                 atomic_dec(&devip->num_in_q);
         else
-                pr_err("%s: devip=NULL\n", __func__);
+                pr_err("devip=NULL\n");
         if (atomic_read(&retired_max_queue) > 0)
                 retiring = 1;
 
         sqcp->a_cmnd = NULL;
         if (!test_and_clear_bit(qa_indx, queued_in_use_bm)) {
                 spin_unlock_irqrestore(&queued_arr_lock, iflags);
-                pr_err("%s: Unexpected completion\n", __func__);
+                pr_err("Unexpected completion\n");
                 return;
         }
 
@@ -3481,7 +3481,7 @@ static void sdebug_q_cmd_complete(unsigned long indx)
                 retval = atomic_read(&retired_max_queue);
                 if (qa_indx >= retval) {
                         spin_unlock_irqrestore(&queued_arr_lock, iflags);
-                        pr_err("%s: index %d too large\n", __func__, retval);
+                        pr_err("index %d too large\n", retval);
                         return;
                 }
                 k = find_last_bit(queued_in_use_bm, retval);
@@ -3509,7 +3509,7 @@ sdebug_q_cmd_hrt_complete(struct hrtimer *timer)
         atomic_inc(&sdebug_completions);
         qa_indx = sd_hrtp->qa_indx;
         if ((qa_indx < 0) || (qa_indx >= SCSI_DEBUG_CANQUEUE)) {
-                pr_err("%s: wild qa_indx=%d\n", __func__, qa_indx);
+                pr_err("wild qa_indx=%d\n", qa_indx);
                 goto the_end;
         }
         spin_lock_irqsave(&queued_arr_lock, iflags);
@@ -3517,21 +3517,21 @@ sdebug_q_cmd_hrt_complete(struct hrtimer *timer)
         scp = sqcp->a_cmnd;
         if (NULL == scp) {
                 spin_unlock_irqrestore(&queued_arr_lock, iflags);
-                pr_err("%s: scp is NULL\n", __func__);
+                pr_err("scp is NULL\n");
                 goto the_end;
         }
         devip = (struct sdebug_dev_info *)scp->device->hostdata;
         if (devip)
                 atomic_dec(&devip->num_in_q);
         else
-                pr_err("%s: devip=NULL\n", __func__);
+                pr_err("devip=NULL\n");
         if (atomic_read(&retired_max_queue) > 0)
                 retiring = 1;
 
         sqcp->a_cmnd = NULL;
         if (!test_and_clear_bit(qa_indx, queued_in_use_bm)) {
                 spin_unlock_irqrestore(&queued_arr_lock, iflags);
-                pr_err("%s: Unexpected completion\n", __func__);
+                pr_err("Unexpected completion\n");
                 goto the_end;
         }
 
@@ -3541,7 +3541,7 @@ sdebug_q_cmd_hrt_complete(struct hrtimer *timer)
                 retval = atomic_read(&retired_max_queue);
                 if (qa_indx >= retval) {
                         spin_unlock_irqrestore(&queued_arr_lock, iflags);
-                        pr_err("%s: index %d too large\n", __func__, retval);
+                        pr_err("index %d too large\n", retval);
                         goto the_end;
                 }
                 k = find_last_bit(queued_in_use_bm, retval);
@@ -3580,7 +3580,7 @@ static struct sdebug_dev_info * devInfoReg(struct scsi_device * sdev)
                 return devip;
         sdbg_host = *(struct sdebug_host_info **)shost_priv(sdev->host);
         if (!sdbg_host) {
-                pr_err("%s: Host info NULL\n", __func__);
+                pr_err("Host info NULL\n");
                 return NULL;
         }
         list_for_each_entry(devip, &sdbg_host->dev_info_list, dev_list) {
@@ -3596,8 +3596,7 @@ static struct sdebug_dev_info * devInfoReg(struct scsi_device * sdev)
         if (!open_devip) { /* try and make a new one */
                 open_devip = sdebug_device_create(sdbg_host, GFP_ATOMIC);
                 if (!open_devip) {
-                        printk(KERN_ERR "%s: out of memory at line %d\n",
-                                __func__, __LINE__);
+                        pr_err("out of memory at line %d\n", __LINE__);
                         return NULL;
                 }
         }
@@ -3615,7 +3614,7 @@ static struct sdebug_dev_info * devInfoReg(struct scsi_device * sdev)
 static int scsi_debug_slave_alloc(struct scsi_device *sdp)
 {
         if (SCSI_DEBUG_OPT_NOISE & scsi_debug_opts)
-                printk(KERN_INFO "scsi_debug: slave_alloc <%u %u %u %llu>\n",
+                pr_info("slave_alloc <%u %u %u %llu>\n",
                        sdp->host->host_no, sdp->channel, sdp->id, sdp->lun);
         queue_flag_set_unlocked(QUEUE_FLAG_BIDI, sdp->request_queue);
         return 0;
@@ -3626,7 +3625,7 @@ static int scsi_debug_slave_configure(struct scsi_device *sdp)
         struct sdebug_dev_info *devip;
 
         if (SCSI_DEBUG_OPT_NOISE & scsi_debug_opts)
-                printk(KERN_INFO "scsi_debug: slave_configure <%u %u %u %llu>\n",
+                pr_info("slave_configure <%u %u %u %llu>\n",
                        sdp->host->host_no, sdp->channel, sdp->id, sdp->lun);
         if (sdp->host->max_cmd_len != SCSI_DEBUG_MAX_CMD_LEN)
                 sdp->host->max_cmd_len = SCSI_DEBUG_MAX_CMD_LEN;
@@ -3646,7 +3645,7 @@ static void scsi_debug_slave_destroy(struct scsi_device *sdp)
                 (struct sdebug_dev_info *)sdp->hostdata;
 
         if (SCSI_DEBUG_OPT_NOISE & scsi_debug_opts)
-                printk(KERN_INFO "scsi_debug: slave_destroy <%u %u %u %llu>\n",
+                pr_info("slave_destroy <%u %u %u %llu>\n",
                        sdp->host->host_no, sdp->channel, sdp->id, sdp->lun);
         if (devip) {
                 /* make this slot available for re-use */
@@ -3897,8 +3896,7 @@ static void __init sdebug_build_parts(unsigned char *ramp,
                 return;
         if (scsi_debug_num_parts > SDEBUG_MAX_PARTS) {
                 scsi_debug_num_parts = SDEBUG_MAX_PARTS;
-                pr_warn("%s: reducing partitions to %d\n", __func__,
-                        SDEBUG_MAX_PARTS);
+                pr_warn("reducing partitions to %d\n", SDEBUG_MAX_PARTS);
         }
         num_sectors = (int)sdebug_store_sectors;
         sectors_per_part = (num_sectors - sdebug_sectors_per)
@@ -3942,14 +3940,20 @@ schedule_resp(struct scsi_cmnd *cmnd, struct sdebug_dev_info *devip,
         unsigned long iflags;
         int k, num_in_q, qdepth, inject;
         struct sdebug_queued_cmd *sqcp = NULL;
-        struct scsi_device *sdp = cmnd->device;
+        struct scsi_device *sdp;
+
+        /* this should never happen */
+        if (WARN_ON(!cmnd))
+                return SCSI_MLQUEUE_HOST_BUSY;
 
-        if (NULL == cmnd || NULL == devip) {
-                pr_warn("%s: called with NULL cmnd or devip pointer\n",
-                        __func__);
+        if (NULL == devip) {
+                pr_warn("called devip == NULL\n");
                 /* no particularly good error to report back */
                 return SCSI_MLQUEUE_HOST_BUSY;
         }
+
+        sdp = cmnd->device;
+
         if ((scsi_result) && (SCSI_DEBUG_OPT_NOISE & scsi_debug_opts))
                 sdev_printk(KERN_INFO, sdp, "%s: non-zero result=0x%x\n",
                             __func__, scsi_result);
@@ -4383,8 +4387,7 @@ static ssize_t fake_rw_store(struct device_driver *ddp, const char *buf,
 
                                 fake_storep = vmalloc(sz);
                                 if (NULL == fake_storep) {
-                                        pr_err("%s: out of memory, 9\n",
-                                               __func__);
+                                        pr_err("out of memory, 9\n");
                                         return -ENOMEM;
                                 }
                                 memset(fake_storep, 0, sz);
@@ -4784,8 +4787,7 @@ static int __init scsi_debug_init(void)
         atomic_set(&retired_max_queue, 0);
 
         if (scsi_debug_ndelay >= 1000000000) {
-                pr_warn("%s: ndelay must be less than 1 second, ignored\n",
-                        __func__);
+                pr_warn("ndelay must be less than 1 second, ignored\n");
                 scsi_debug_ndelay = 0;
         } else if (scsi_debug_ndelay > 0)
                 scsi_debug_delay = DELAY_OVERRIDDEN;
@@ -4797,8 +4799,7 @@ static int __init scsi_debug_init(void)
         case 4096:
                 break;
         default:
-                pr_err("%s: invalid sector_size %d\n", __func__,
-                       scsi_debug_sector_size);
+                pr_err("invalid sector_size %d\n", scsi_debug_sector_size);
                 return -EINVAL;
         }
 
@@ -4811,29 +4812,28 @@ static int __init scsi_debug_init(void)
                 break;
 
         default:
-                pr_err("%s: dif must be 0, 1, 2 or 3\n", __func__);
+                pr_err("dif must be 0, 1, 2 or 3\n");
                 return -EINVAL;
         }
 
         if (scsi_debug_guard > 1) {
-                pr_err("%s: guard must be 0 or 1\n", __func__);
+                pr_err("guard must be 0 or 1\n");
                 return -EINVAL;
         }
 
         if (scsi_debug_ato > 1) {
-                pr_err("%s: ato must be 0 or 1\n", __func__);
+                pr_err("ato must be 0 or 1\n");
                 return -EINVAL;
         }
 
         if (scsi_debug_physblk_exp > 15) {
-                pr_err("%s: invalid physblk_exp %u\n", __func__,
-                       scsi_debug_physblk_exp);
+                pr_err("invalid physblk_exp %u\n", scsi_debug_physblk_exp);
                 return -EINVAL;
         }
 
         if (scsi_debug_lowest_aligned > 0x3fff) {
-                pr_err("%s: lowest_aligned too big: %u\n", __func__,
-                       scsi_debug_lowest_aligned);
+                pr_err("lowest_aligned too big: %u\n",
+                        scsi_debug_lowest_aligned);
                 return -EINVAL;
         }
 
@@ -4863,7 +4863,7 @@ static int __init scsi_debug_init(void)
         if (0 == scsi_debug_fake_rw) {
                 fake_storep = vmalloc(sz);
                 if (NULL == fake_storep) {
-                        pr_err("%s: out of memory, 1\n", __func__);
+                        pr_err("out of memory, 1\n");
                         return -ENOMEM;
                 }
                 memset(fake_storep, 0, sz);
@@ -4877,11 +4877,10 @@ static int __init scsi_debug_init(void)
                 dif_size = sdebug_store_sectors * sizeof(struct sd_dif_tuple);
                 dif_storep = vmalloc(dif_size);
 
-                pr_err("%s: dif_storep %u bytes @ %p\n", __func__, dif_size,
-                        dif_storep);
+                pr_err("dif_storep %u bytes @ %p\n", dif_size, dif_storep);
 
                 if (dif_storep == NULL) {
-                        pr_err("%s: out of mem. (DIX)\n", __func__);
+                        pr_err("out of mem. (DIX)\n");
                         ret = -ENOMEM;
                         goto free_vm;
                 }
@@ -4903,18 +4902,17 @@ static int __init scsi_debug_init(void)
                 if (scsi_debug_unmap_alignment &&
                     scsi_debug_unmap_granularity <=
                     scsi_debug_unmap_alignment) {
-                        pr_err("%s: ERR: unmap_granularity <= unmap_alignment\n",
-                               __func__);
+                        pr_err("ERR: unmap_granularity <= unmap_alignment\n");
                         return -EINVAL;
                 }
 
                 map_size = lba_to_map_index(sdebug_store_sectors - 1) + 1;
                 map_storep = vmalloc(BITS_TO_LONGS(map_size) * sizeof(long));
 
-                pr_info("%s: %lu provisioning blocks\n", __func__, map_size);
+                pr_info("%lu provisioning blocks\n", map_size);
 
                 if (map_storep == NULL) {
-                        pr_err("%s: out of mem. (MAP)\n", __func__);
+                        pr_err("out of mem. (MAP)\n");
                         ret = -ENOMEM;
                         goto free_vm;
                 }
@@ -4928,18 +4926,18 @@ static int __init scsi_debug_init(void)
 
         pseudo_primary = root_device_register("pseudo_0");
         if (IS_ERR(pseudo_primary)) {
-                pr_warn("%s: root_device_register() error\n", __func__);
+                pr_warn("root_device_register() error\n");
                 ret = PTR_ERR(pseudo_primary);
                 goto free_vm;
         }
         ret = bus_register(&pseudo_lld_bus);
         if (ret < 0) {
-                pr_warn("%s: bus_register error: %d\n", __func__, ret);
+                pr_warn("bus_register error: %d\n", ret);
                 goto dev_unreg;
         }
         ret = driver_register(&sdebug_driverfs_driver);
         if (ret < 0) {
-                pr_warn("%s: driver_register error: %d\n", __func__, ret);
+                pr_warn("driver_register error: %d\n", ret);
                 goto bus_unreg;
         }
 
@@ -4948,16 +4946,14 @@ static int __init scsi_debug_init(void)
 
         for (k = 0; k < host_to_add; k++) {
                 if (sdebug_add_adapter()) {
-                        pr_err("%s: sdebug_add_adapter failed k=%d\n",
-                                __func__, k);
+                        pr_err("sdebug_add_adapter failed k=%d\n", k);
                         break;
                 }
         }
 
-        if (SCSI_DEBUG_OPT_NOISE & scsi_debug_opts) {
-                pr_info("%s: built %d host(s)\n", __func__,
-                        scsi_debug_add_host);
-        }
+        if (SCSI_DEBUG_OPT_NOISE & scsi_debug_opts)
+                pr_info("built %d host(s)\n", scsi_debug_add_host);
+
         return 0;
 
 bus_unreg:
@@ -4965,10 +4961,8 @@ bus_unreg:
 dev_unreg:
         root_device_unregister(pseudo_primary);
 free_vm:
-        if (map_storep)
-                vfree(map_storep);
-        if (dif_storep)
-                vfree(dif_storep);
+        vfree(map_storep);
+        vfree(dif_storep);
         vfree(fake_storep);
 
         return ret;
@@ -4986,9 +4980,7 @@ static void __exit scsi_debug_exit(void)
         bus_unregister(&pseudo_lld_bus);
         root_device_unregister(pseudo_primary);
 
-        if (dif_storep)
-                vfree(dif_storep);
-
+        vfree(dif_storep);
         vfree(fake_storep);
 }
 
@@ -5012,8 +5004,7 @@ static int sdebug_add_adapter(void)
 
         sdbg_host = kzalloc(sizeof(*sdbg_host),GFP_KERNEL);
         if (NULL == sdbg_host) {
-                printk(KERN_ERR "%s: out of memory at line %d\n",
-                       __func__, __LINE__);
+                pr_err("out of memory at line %d\n", __LINE__);
                 return -ENOMEM;
         }
 
@@ -5023,8 +5014,7 @@ static int sdebug_add_adapter(void)
         for (k = 0; k < devs_per_host; k++) {
                 sdbg_devinfo = sdebug_device_create(sdbg_host, GFP_KERNEL);
                 if (!sdbg_devinfo) {
-                        printk(KERN_ERR "%s: out of memory at line %d\n",
-                               __func__, __LINE__);
+                        pr_err("out of memory at line %d\n", __LINE__);
                         error = -ENOMEM;
                         goto clean;
                 }
@@ -5178,7 +5168,7 @@ scsi_debug_queuecommand(struct scsi_cmnd *scp)
                 }
                 sdev_printk(KERN_INFO, sdp, "%s: cmd %s\n", my_name, b);
         }
-        has_wlun_rl = (sdp->lun == SAM2_WLUN_REPORT_LUNS);
+        has_wlun_rl = (sdp->lun == SCSI_W_LUN_REPORT_LUNS);
         if ((sdp->lun >= scsi_debug_max_luns) && !has_wlun_rl)
                 return schedule_resp(scp, NULL, errsts_no_connect, 0);
 
@@ -5338,7 +5328,7 @@ static int sdebug_driver_probe(struct device * dev)
                 sdebug_driver_template.use_clustering = ENABLE_CLUSTERING;
         hpnt = scsi_host_alloc(&sdebug_driver_template, sizeof(sdbg_host));
         if (NULL == hpnt) {
-                pr_err("%s: scsi_host_alloc failed\n", __func__);
+                pr_err("scsi_host_alloc failed\n");
                 error = -ENODEV;
                 return error;
         }
@@ -5349,7 +5339,8 @@ static int sdebug_driver_probe(struct device * dev)
                 hpnt->max_id = scsi_debug_num_tgts + 1;
         else
                 hpnt->max_id = scsi_debug_num_tgts;
-        hpnt->max_lun = SAM2_WLUN_REPORT_LUNS;  /* = scsi_debug_max_luns; */
+        /* = scsi_debug_max_luns; */
+        hpnt->max_lun = SCSI_W_LUN_REPORT_LUNS + 1;
 
         host_prot = 0;
 
@@ -5381,7 +5372,7 @@ static int sdebug_driver_probe(struct device * dev)
 
         scsi_host_set_prot(hpnt, host_prot);
 
-        printk(KERN_INFO "scsi_debug: host protection%s%s%s%s%s%s%s\n",
+        pr_info("host protection%s%s%s%s%s%s%s\n",
                (host_prot & SHOST_DIF_TYPE1_PROTECTION) ? " DIF1" : "",
                (host_prot & SHOST_DIF_TYPE2_PROTECTION) ? " DIF2" : "",
                (host_prot & SHOST_DIF_TYPE3_PROTECTION) ? " DIF3" : "",
@@ -5409,7 +5400,7 @@ static int sdebug_driver_probe(struct device * dev)
 
         error = scsi_add_host(hpnt, &sdbg_host->dev);
         if (error) {
-                printk(KERN_ERR "%s: scsi_add_host failed\n", __func__);
+                pr_err("scsi_add_host failed\n");
                 error = -ENODEV;
                 scsi_host_put(hpnt);
         } else
@@ -5426,8 +5417,7 @@ static int sdebug_driver_remove(struct device * dev)
         sdbg_host = to_sdebug_host(dev);
 
         if (!sdbg_host) {
-                printk(KERN_ERR "%s: Unable to locate host info\n",
-                       __func__);
+                pr_err("Unable to locate host info\n");
                 return -ENODEV;
         }
 
diff --git a/drivers/scsi/scsi_dh.c b/drivers/scsi/scsi_dh.c
new file mode 100644
index 000000000000..edb044a7b56d
--- /dev/null
+++ b/drivers/scsi/scsi_dh.c
@@ -0,0 +1,437 @@
+/*
+ * SCSI device handler infrastruture.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ *
+ * Copyright IBM Corporation, 2007
+ *      Authors:
+ *               Chandra Seetharaman <sekharan@us.ibm.com>
+ *               Mike Anderson <andmike@linux.vnet.ibm.com>
+ */
+
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <scsi/scsi_dh.h>
+#include "scsi_priv.h"
+
+static DEFINE_SPINLOCK(list_lock);
+static LIST_HEAD(scsi_dh_list);
+
+struct scsi_dh_blist {
+        const char *vendor;
+        const char *model;
+        const char *driver;
+};
+
+static const struct scsi_dh_blist scsi_dh_blist[] = {
+        {"DGC", "RAID",                 "clariion" },
+        {"DGC", "DISK",                 "clariion" },
+        {"DGC", "VRAID",                "clariion" },
+
+        {"COMPAQ", "MSA1000 VOLUME",    "hp_sw" },
+        {"COMPAQ", "HSV110",            "hp_sw" },
+        {"HP", "HSV100",                "hp_sw"},
+        {"DEC", "HSG80",                "hp_sw"},
+
+        {"IBM", "1722",                 "rdac", },
+        {"IBM", "1724",                 "rdac", },
+        {"IBM", "1726",                 "rdac", },
+        {"IBM", "1742",                 "rdac", },
+        {"IBM", "1745",                 "rdac", },
+        {"IBM", "1746",                 "rdac", },
+        {"IBM", "1813",                 "rdac", },
+        {"IBM", "1814",                 "rdac", },
+        {"IBM", "1815",                 "rdac", },
+        {"IBM", "1818",                 "rdac", },
+        {"IBM", "3526",                 "rdac", },
+        {"SGI", "TP9",                  "rdac", },
+        {"SGI", "IS",                   "rdac", },
+        {"STK", "OPENstorage D280",     "rdac", },
+        {"STK", "FLEXLINE 380",         "rdac", },
+        {"SUN", "CSM",                  "rdac", },
+        {"SUN", "LCSM100",              "rdac", },
+        {"SUN", "STK6580_6780",         "rdac", },
+        {"SUN", "SUN_6180",             "rdac", },
+        {"SUN", "ArrayStorage",         "rdac", },
+        {"DELL", "MD3",                 "rdac", },
+        {"NETAPP", "INF-01-00",         "rdac", },
+        {"LSI", "INF-01-00",            "rdac", },
+        {"ENGENIO", "INF-01-00",        "rdac", },
+        {NULL, NULL,                    NULL },
+};
+
+static const char *
+scsi_dh_find_driver(struct scsi_device *sdev)
+{
+        const struct scsi_dh_blist *b;
+
+        if (scsi_device_tpgs(sdev))
+                return "alua";
+
+        for (b = scsi_dh_blist; b->vendor; b++) {
+                if (!strncmp(sdev->vendor, b->vendor, strlen(b->vendor)) &&
+                    !strncmp(sdev->model, b->model, strlen(b->model))) {
+                        return b->driver;
+                }
+        }
+        return NULL;
+}
+
+
+static struct scsi_device_handler *__scsi_dh_lookup(const char *name)
+{
+        struct scsi_device_handler *tmp, *found = NULL;
+
+        spin_lock(&list_lock);
+        list_for_each_entry(tmp, &scsi_dh_list, list) {
+                if (!strncmp(tmp->name, name, strlen(tmp->name))) {
+                        found = tmp;
+                        break;
+                }
+        }
+        spin_unlock(&list_lock);
+        return found;
+}
+
+static struct scsi_device_handler *scsi_dh_lookup(const char *name)
+{
+        struct scsi_device_handler *dh;
+
+        dh = __scsi_dh_lookup(name);
+        if (!dh) {
+                request_module(name);
+                dh = __scsi_dh_lookup(name);
+        }
+
+        return dh;
+}
+
+/*
+ * scsi_dh_handler_attach - Attach a device handler to a device
+ * @sdev - SCSI device the device handler should attach to
+ * @scsi_dh - The device handler to attach
+ */
+static int scsi_dh_handler_attach(struct scsi_device *sdev,
+                                  struct scsi_device_handler *scsi_dh)
+{
+        int error;
+
+        if (!try_module_get(scsi_dh->module))
+                return -EINVAL;
+
+        error = scsi_dh->attach(sdev);
+        if (error) {
+                sdev_printk(KERN_ERR, sdev, "%s: Attach failed (%d)\n",
+                            scsi_dh->name, error);
+                module_put(scsi_dh->module);
+        } else
+                sdev->handler = scsi_dh;
+
+        return error;
+}
+
+/*
+ * scsi_dh_handler_detach - Detach a device handler from a device
+ * @sdev - SCSI device the device handler should be detached from
+ */
+static void scsi_dh_handler_detach(struct scsi_device *sdev)
+{
+        sdev->handler->detach(sdev);
+        sdev_printk(KERN_NOTICE, sdev, "%s: Detached\n", sdev->handler->name);
+        module_put(sdev->handler->module);
+}
+
+/*
+ * Functions for sysfs attribute 'dh_state'
+ */
+static ssize_t
+store_dh_state(struct device *dev, struct device_attribute *attr,
+               const char *buf, size_t count)
+{
+        struct scsi_device *sdev = to_scsi_device(dev);
+        struct scsi_device_handler *scsi_dh;
+        int err = -EINVAL;
+
+        if (sdev->sdev_state == SDEV_CANCEL ||
+            sdev->sdev_state == SDEV_DEL)
+                return -ENODEV;
+
+        if (!sdev->handler) {
+                /*
+                 * Attach to a device handler
+                 */
+                scsi_dh = scsi_dh_lookup(buf);
+                if (!scsi_dh)
+                        return err;
+                err = scsi_dh_handler_attach(sdev, scsi_dh);
+        } else {
+                if (!strncmp(buf, "detach", 6)) {
+                        /*
+                         * Detach from a device handler
+                         */
+                        sdev_printk(KERN_WARNING, sdev,
+                                    "can't detach handler %s.\n",
+                                    sdev->handler->name);
+                        err = -EINVAL;
+                } else if (!strncmp(buf, "activate", 8)) {
+                        /*
+                         * Activate a device handler
+                         */
+                        if (sdev->handler->activate)
+                                err = sdev->handler->activate(sdev, NULL, NULL);
+                        else
+                                err = 0;
+                }
+        }
+
+        return err<0?err:count;
+}
+
+static ssize_t
+show_dh_state(struct device *dev, struct device_attribute *attr, char *buf)
+{
+        struct scsi_device *sdev = to_scsi_device(dev);
+
+        if (!sdev->handler)
+                return snprintf(buf, 20, "detached\n");
+
+        return snprintf(buf, 20, "%s\n", sdev->handler->name);
+}
+
+static struct device_attribute scsi_dh_state_attr =
+        __ATTR(dh_state, S_IRUGO | S_IWUSR, show_dh_state,
+               store_dh_state);
+
+int scsi_dh_add_device(struct scsi_device *sdev)
+{
+        struct scsi_device_handler *devinfo = NULL;
+        const char *drv;
+        int err;
+
+        err = device_create_file(&sdev->sdev_gendev, &scsi_dh_state_attr);
+        if (err)
+                return err;
+
+        drv = scsi_dh_find_driver(sdev);
+        if (drv)
+                devinfo = scsi_dh_lookup(drv);
+        if (devinfo)
+                err = scsi_dh_handler_attach(sdev, devinfo);
+        return err;
+}
+
+void scsi_dh_remove_device(struct scsi_device *sdev)
+{
+        if (sdev->handler)
+                scsi_dh_handler_detach(sdev);
+        device_remove_file(&sdev->sdev_gendev, &scsi_dh_state_attr);
+}
+
+/*
+ * scsi_register_device_handler - register a device handler personality
+ *      module.
+ * @scsi_dh - device handler to be registered.
+ *
+ * Returns 0 on success, -EBUSY if handler already registered.
+ */
+int scsi_register_device_handler(struct scsi_device_handler *scsi_dh)
+{
+        if (__scsi_dh_lookup(scsi_dh->name))
+                return -EBUSY;
+
+        if (!scsi_dh->attach || !scsi_dh->detach)
+                return -EINVAL;
+
+        spin_lock(&list_lock);
+        list_add(&scsi_dh->list, &scsi_dh_list);
+        spin_unlock(&list_lock);
+
+        printk(KERN_INFO "%s: device handler registered\n", scsi_dh->name);
+
+        return SCSI_DH_OK;
+}
+EXPORT_SYMBOL_GPL(scsi_register_device_handler);
+
+/*
+ * scsi_unregister_device_handler - register a device handler personality
+ *      module.
+ * @scsi_dh - device handler to be unregistered.
+ *
+ * Returns 0 on success, -ENODEV if handler not registered.
+ */
+int scsi_unregister_device_handler(struct scsi_device_handler *scsi_dh)
+{
+        if (!__scsi_dh_lookup(scsi_dh->name))
+                return -ENODEV;
+
+        spin_lock(&list_lock);
+        list_del(&scsi_dh->list);
+        spin_unlock(&list_lock);
+        printk(KERN_INFO "%s: device handler unregistered\n", scsi_dh->name);
+
+        return SCSI_DH_OK;
+}
+EXPORT_SYMBOL_GPL(scsi_unregister_device_handler);
+
+static struct scsi_device *get_sdev_from_queue(struct request_queue *q)
+{
+        struct scsi_device *sdev;
+        unsigned long flags;
+
+        spin_lock_irqsave(q->queue_lock, flags);
+        sdev = q->queuedata;
+        if (!sdev || !get_device(&sdev->sdev_gendev))
+                sdev = NULL;
+        spin_unlock_irqrestore(q->queue_lock, flags);
+
+        return sdev;
+}
+
+/*
+ * scsi_dh_activate - activate the path associated with the scsi_device
+ *      corresponding to the given request queue.
+ *     Returns immediately without waiting for activation to be completed.
+ * @q    - Request queue that is associated with the scsi_device to be
+ *         activated.
+ * @fn   - Function to be called upon completion of the activation.
+ *         Function fn is called with data (below) and the error code.
+ *         Function fn may be called from the same calling context. So,
+ *         do not hold the lock in the caller which may be needed in fn.
+ * @data - data passed to the function fn upon completion.
+ *
+ */
+int scsi_dh_activate(struct request_queue *q, activate_complete fn, void *data)
+{
+        struct scsi_device *sdev;
+        int err = SCSI_DH_NOSYS;
+
+        sdev = get_sdev_from_queue(q);
+        if (!sdev) {
+                if (fn)
+                        fn(data, err);
+                return err;
+        }
+
+        if (!sdev->handler)
+                goto out_fn;
+        err = SCSI_DH_NOTCONN;
+        if (sdev->sdev_state == SDEV_CANCEL ||
+            sdev->sdev_state == SDEV_DEL)
+                goto out_fn;
+
+        err = SCSI_DH_DEV_OFFLINED;
+        if (sdev->sdev_state == SDEV_OFFLINE)
+                goto out_fn;
+
+        if (sdev->handler->activate)
+                err = sdev->handler->activate(sdev, fn, data);
+
+out_put_device:
+        put_device(&sdev->sdev_gendev);
+        return err;
+
+out_fn:
+        if (fn)
+                fn(data, err);
+        goto out_put_device;
+}
+EXPORT_SYMBOL_GPL(scsi_dh_activate);
+
+/*
+ * scsi_dh_set_params - set the parameters for the device as per the
+ *      string specified in params.
+ * @q - Request queue that is associated with the scsi_device for
+ *      which the parameters to be set.
+ * @params - parameters in the following format
+ *      "no_of_params\0param1\0param2\0param3\0...\0"
+ *      for example, string for 2 parameters with value 10 and 21
+ *      is specified as "2\010\021\0".
+ */
+int scsi_dh_set_params(struct request_queue *q, const char *params)
+{
+        struct scsi_device *sdev;
+        int err = -SCSI_DH_NOSYS;
+
+        sdev = get_sdev_from_queue(q);
+        if (!sdev)
+                return err;
+
+        if (sdev->handler && sdev->handler->set_params)
+                err = sdev->handler->set_params(sdev, params);
+        put_device(&sdev->sdev_gendev);
+        return err;
+}
+EXPORT_SYMBOL_GPL(scsi_dh_set_params);
+
+/*
+ * scsi_dh_attach - Attach device handler
+ * @q - Request queue that is associated with the scsi_device
+ *      the handler should be attached to
+ * @name - name of the handler to attach
+ */
+int scsi_dh_attach(struct request_queue *q, const char *name)
+{
+        struct scsi_device *sdev;
+        struct scsi_device_handler *scsi_dh;
+        int err = 0;
+
+        sdev = get_sdev_from_queue(q);
+        if (!sdev)
+                return -ENODEV;
+
+        scsi_dh = scsi_dh_lookup(name);
+        if (!scsi_dh) {
+                err = -EINVAL;
+                goto out_put_device;
+        }
+
+        if (sdev->handler) {
+                if (sdev->handler != scsi_dh)
+                        err = -EBUSY;
+                goto out_put_device;
+        }
+
+        err = scsi_dh_handler_attach(sdev, scsi_dh);
+
+out_put_device:
+        put_device(&sdev->sdev_gendev);
+        return err;
+}
+EXPORT_SYMBOL_GPL(scsi_dh_attach);
+
+/*
+ * scsi_dh_attached_handler_name - Get attached device handler's name
+ * @q - Request queue that is associated with the scsi_device
+ *      that may have a device handler attached
+ * @gfp - the GFP mask used in the kmalloc() call when allocating memory
+ *
+ * Returns name of attached handler, NULL if no handler is attached.
+ * Caller must take care to free the returned string.
+ */
+const char *scsi_dh_attached_handler_name(struct request_queue *q, gfp_t gfp)
+{
+        struct scsi_device *sdev;
+        const char *handler_name = NULL;
+
+        sdev = get_sdev_from_queue(q);
+        if (!sdev)
+                return NULL;
+
+        if (sdev->handler)
+                handler_name = kstrdup(sdev->handler->name, gfp);
+        put_device(&sdev->sdev_gendev);
+        return handler_name;
+}
+EXPORT_SYMBOL_GPL(scsi_dh_attached_handler_name);
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index afd34a608fe7..66a96cd98b97 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -33,9 +33,11 @@
 #include <scsi/scsi_device.h>
 #include <scsi/scsi_driver.h>
 #include <scsi/scsi_eh.h>
+#include <scsi/scsi_common.h>
 #include <scsi/scsi_transport.h>
 #include <scsi/scsi_host.h>
 #include <scsi/scsi_ioctl.h>
+#include <scsi/scsi_dh.h>
 #include <scsi/sg.h>
 
 #include "scsi_priv.h"
@@ -463,11 +465,10 @@ static int scsi_check_sense(struct scsi_cmnd *scmd)
         if (scsi_sense_is_deferred(&sshdr))
                 return NEEDS_RETRY;
 
-        if (sdev->scsi_dh_data && sdev->scsi_dh_data->scsi_dh &&
-                        sdev->scsi_dh_data->scsi_dh->check_sense) {
+        if (sdev->handler && sdev->handler->check_sense) {
                 int rc;
 
-                rc = sdev->scsi_dh_data->scsi_dh->check_sense(sdev, &sshdr);
+                rc = sdev->handler->check_sense(sdev, &sshdr);
                 if (rc != SCSI_RETURN_NOT_HANDLED)
                         return rc;
                 /* handler does not care. Drop down to default handling */
@@ -2178,8 +2179,17 @@ int scsi_error_handler(void *data)
          * We never actually get interrupted because kthread_run
          * disables signal delivery for the created thread.
          */
-        while (!kthread_should_stop()) {
+        while (true) {
+                /*
+                 * The sequence in kthread_stop() sets the stop flag first
+                 * then wakes the process.  To avoid missed wakeups, the task
+                 * should always be in a non running state before the stop
+                 * flag is checked
+                 */
                 set_current_state(TASK_INTERRUPTIBLE);
+                if (kthread_should_stop())
+                        break;
+
                 if ((shost->host_failed == 0 && shost->host_eh_scheduled == 0) ||
                     shost->host_failed != atomic_read(&shost->host_busy)) {
                         SCSI_LOG_ERROR_RECOVERY(1,
@@ -2416,45 +2426,6 @@ bool scsi_command_normalize_sense(const struct scsi_cmnd *cmd,
 EXPORT_SYMBOL(scsi_command_normalize_sense);
 
 /**
- * scsi_sense_desc_find - search for a given descriptor type in descriptor sense data format.
- * @sense_buffer:       byte array of descriptor format sense data
- * @sb_len:             number of valid bytes in sense_buffer
- * @desc_type:          value of descriptor type to find
- *                      (e.g. 0 -> information)
- *
- * Notes:
- *      only valid when sense data is in descriptor format
- *
- * Return value:
- *      pointer to start of (first) descriptor if found else NULL
- */
-const u8 * scsi_sense_desc_find(const u8 * sense_buffer, int sb_len,
-                                int desc_type)
-{
-        int add_sen_len, add_len, desc_len, k;
-        const u8 * descp;
-
-        if ((sb_len < 8) || (0 == (add_sen_len = sense_buffer[7])))
-                return NULL;
-        if ((sense_buffer[0] < 0x72) || (sense_buffer[0] > 0x73))
-                return NULL;
-        add_sen_len = (add_sen_len < (sb_len - 8)) ?
-                        add_sen_len : (sb_len - 8);
-        descp = &sense_buffer[8];
-        for (desc_len = 0, k = 0; k < add_sen_len; k += desc_len) {
-                descp += desc_len;
-                add_len = (k < (add_sen_len - 1)) ? descp[1]: -1;
-                desc_len = add_len + 2;
-                if (descp[0] == desc_type)
-                        return descp;
-                if (add_len < 0) // short descriptor ??
-                        break;
-        }
-        return NULL;
-}
-EXPORT_SYMBOL(scsi_sense_desc_find);
-
-/**
  * scsi_get_sense_info_fld - get information field from sense data (either fixed or descriptor format)
  * @sense_buffer:       byte array of sense data
  * @sb_len:             number of valid bytes in sense_buffer
@@ -2503,31 +2474,3 @@ int scsi_get_sense_info_fld(const u8 * sense_buffer, int sb_len,
         }
 }
 EXPORT_SYMBOL(scsi_get_sense_info_fld);
-
-/**
- * scsi_build_sense_buffer - build sense data in a buffer
- * @desc:       Sense format (non zero == descriptor format,
- *              0 == fixed format)
- * @buf:        Where to build sense data
- * @key:        Sense key
- * @asc:        Additional sense code
- * @ascq:       Additional sense code qualifier
- *
- **/
-void scsi_build_sense_buffer(int desc, u8 *buf, u8 key, u8 asc, u8 ascq)
-{
-        if (desc) {
-                buf[0] = 0x72;  /* descriptor, current */
-                buf[1] = key;
-                buf[2] = asc;
-                buf[3] = ascq;
-                buf[7] = 0;
-        } else {
-                buf[0] = 0x70;  /* fixed, current */
-                buf[2] = key;
-                buf[7] = 0xa;
-                buf[12] = asc;
-                buf[13] = ascq;
-        }
-}
-EXPORT_SYMBOL(scsi_build_sense_buffer);
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 882864f5cbae..cbfc5990052b 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -31,6 +31,7 @@
 #include <scsi/scsi_driver.h>
 #include <scsi/scsi_eh.h>
 #include <scsi/scsi_host.h>
+#include <scsi/scsi_dh.h>
 
 #include <trace/events/scsi.h>
 
@@ -1248,9 +1249,8 @@ static int scsi_setup_fs_cmnd(struct scsi_device *sdev, struct request *req)
 {
         struct scsi_cmnd *cmd = req->special;
 
-        if (unlikely(sdev->scsi_dh_data && sdev->scsi_dh_data->scsi_dh
-                         && sdev->scsi_dh_data->scsi_dh->prep_fn)) {
-                int ret = sdev->scsi_dh_data->scsi_dh->prep_fn(sdev, req);
+        if (unlikely(sdev->handler && sdev->handler->prep_fn)) {
+                int ret = sdev->handler->prep_fn(sdev, req);
                 if (ret != BLKPREP_OK)
                         return ret;
         }
diff --git a/drivers/scsi/scsi_priv.h b/drivers/scsi/scsi_priv.h
index e3902fc66278..644bb7339b55 100644
--- a/drivers/scsi/scsi_priv.h
+++ b/drivers/scsi/scsi_priv.h
@@ -170,6 +170,15 @@ static inline void scsi_autopm_put_host(struct Scsi_Host *h) {}
 extern struct async_domain scsi_sd_pm_domain;
 extern struct async_domain scsi_sd_probe_domain;
 
+/* scsi_dh.c */
+#ifdef CONFIG_SCSI_DH
+int scsi_dh_add_device(struct scsi_device *sdev);
+void scsi_dh_remove_device(struct scsi_device *sdev);
+#else
+static inline int scsi_dh_add_device(struct scsi_device *sdev) { return 0; }
+static inline void scsi_dh_remove_device(struct scsi_device *sdev) { }
+#endif
+
 /* 
  * internal scsi timeout functions: for use by mid-layer and transport
  * classes.
diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index 9ad41168d26d..b333389f248f 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -1030,11 +1030,20 @@ int scsi_sysfs_add_sdev(struct scsi_device *sdev)
                                 "failed to add device: %d\n", error);
                 return error;
         }
+
+        error = scsi_dh_add_device(sdev);
+        if (error) {
+                sdev_printk(KERN_INFO, sdev,
+                                "failed to add device handler: %d\n", error);
+                return error;
+        }
+
         device_enable_async_suspend(&sdev->sdev_dev);
         error = device_add(&sdev->sdev_dev);
         if (error) {
                 sdev_printk(KERN_INFO, sdev,
                                 "failed to add class device: %d\n", error);
+                scsi_dh_remove_device(sdev);
                 device_del(&sdev->sdev_gendev);
                 return error;
         }
@@ -1074,6 +1083,7 @@ void __scsi_remove_device(struct scsi_device *sdev)
                 bsg_unregister_queue(sdev->request_queue);
                 device_unregister(&sdev->sdev_dev);
                 transport_remove_device(dev);
+                scsi_dh_remove_device(sdev);
                 device_del(dev);
         } else
                 put_device(&sdev->sdev_dev);
diff --git a/drivers/scsi/scsi_transport_sas.c b/drivers/scsi/scsi_transport_sas.c
index 9a058194b9bd..30d26e345dcc 100644
--- a/drivers/scsi/scsi_transport_sas.c
+++ b/drivers/scsi/scsi_transport_sas.c
@@ -1222,13 +1222,6 @@ show_sas_rphy_enclosure_identifier(struct device *dev,
         u64 identifier;
         int error;
 
-        /*
-         * Only devices behind an expander are supported, because the
-         * enclosure identifier is a SMP feature.
-         */
-        if (scsi_is_sas_phy_local(phy))
-                return -EINVAL;
-
         error = i->f->get_enclosure_identifier(rphy, &identifier);
         if (error)
                 return error;
@@ -1248,9 +1241,6 @@ show_sas_rphy_bay_identifier(struct device *dev,
         struct sas_internal *i = to_sas_internal(shost->transportt);
         int val;
 
-        if (scsi_is_sas_phy_local(phy))
-                return -EINVAL;
-
         val = i->f->get_bay_identifier(rphy);
         if (val < 0)
                 return val;
diff --git a/drivers/sh/intc/core.c b/drivers/sh/intc/core.c
index 043419dcee92..8e72bcbd3d6d 100644
--- a/drivers/sh/intc/core.c
+++ b/drivers/sh/intc/core.c
@@ -65,7 +65,7 @@ void intc_set_prio_level(unsigned int irq, unsigned int level)
         raw_spin_unlock_irqrestore(&intc_big_lock, flags);
 }
 
-static void intc_redirect_irq(unsigned int irq, struct irq_desc *desc)
+static void intc_redirect_irq(struct irq_desc *desc)
 {
         generic_handle_irq((unsigned int)irq_desc_get_handler_data(desc));
 }
diff --git a/drivers/sh/intc/internals.h b/drivers/sh/intc/internals.h
index 7dff08e2a071..6ce7f0d26dcf 100644
--- a/drivers/sh/intc/internals.h
+++ b/drivers/sh/intc/internals.h
@@ -99,15 +99,7 @@ static inline struct intc_desc_int *get_intc_desc(unsigned int irq)
  */
 static inline void activate_irq(int irq)
 {
-#ifdef CONFIG_ARM
-        /* ARM requires an extra step to clear IRQ_NOREQUEST, which it
-         * sets on behalf of every irq_chip.  Also sets IRQ_NOPROBE.
-         */
-        set_irq_flags(irq, IRQF_VALID);
-#else
-        /* same effect on other architectures */
-        irq_set_noprobe(irq);
-#endif
+        irq_modify_status(irq, IRQ_NOREQUEST, IRQ_NOPROBE);
 }
 
 static inline int intc_handle_int_cmp(const void *a, const void *b)
diff --git a/drivers/sh/intc/virq.c b/drivers/sh/intc/virq.c
index bafc51c6f0ba..e7899624aa0b 100644
--- a/drivers/sh/intc/virq.c
+++ b/drivers/sh/intc/virq.c
@@ -109,7 +109,7 @@ static int add_virq_to_pirq(unsigned int irq, unsigned int virq)
         return 0;
 }
 
-static void intc_virq_handler(unsigned int __irq, struct irq_desc *desc)
+static void intc_virq_handler(struct irq_desc *desc)
 {
         unsigned int irq = irq_desc_get_irq(desc);
         struct irq_data *data = irq_desc_get_irq_data(desc);
@@ -127,7 +127,7 @@ static void intc_virq_handler(unsigned int __irq, struct irq_desc *desc)
                         handle = (unsigned long)irq_desc_get_handler_data(vdesc);
                         addr = INTC_REG(d, _INTC_ADDR_E(handle), 0);
                         if (intc_reg_fns[_INTC_FN(handle)](addr, handle, 0))
-                                generic_handle_irq_desc(entry->irq, vdesc);
+                                generic_handle_irq_desc(vdesc);
                 }
         }
 
diff --git a/drivers/sh/pm_runtime.c b/drivers/sh/pm_runtime.c
index d3d1891cda3c..25abd4eb7d10 100644
--- a/drivers/sh/pm_runtime.c
+++ b/drivers/sh/pm_runtime.c
@@ -35,20 +35,11 @@ static struct pm_clk_notifier_block platform_bus_notifier = {
 static int __init sh_pm_runtime_init(void)
 {
         if (IS_ENABLED(CONFIG_ARCH_SHMOBILE_MULTI)) {
-                if (!of_machine_is_compatible("renesas,emev2") &&
-                    !of_machine_is_compatible("renesas,r7s72100") &&
-#ifndef CONFIG_PM_GENERIC_DOMAINS_OF
-                    !of_machine_is_compatible("renesas,r8a73a4") &&
-                    !of_machine_is_compatible("renesas,r8a7740") &&
-                    !of_machine_is_compatible("renesas,sh73a0") &&
-#endif
-                    !of_machine_is_compatible("renesas,r8a7778") &&
-                    !of_machine_is_compatible("renesas,r8a7779") &&
-                    !of_machine_is_compatible("renesas,r8a7790") &&
-                    !of_machine_is_compatible("renesas,r8a7791") &&
-                    !of_machine_is_compatible("renesas,r8a7792") &&
-                    !of_machine_is_compatible("renesas,r8a7793") &&
-                    !of_machine_is_compatible("renesas,r8a7794"))
+                if (!of_find_compatible_node(NULL, NULL,
+                                             "renesas,cpg-mstp-clocks"))
+                        return 0;
+                if (IS_ENABLED(CONFIG_PM_GENERIC_DOMAINS_OF) &&
+                    of_find_node_with_property(NULL, "#power-domain-cells"))
                         return 0;
         }
 
diff --git a/drivers/soc/dove/pmu.c b/drivers/soc/dove/pmu.c
index 6792aae9e2e5..052aecf29893 100644
--- a/drivers/soc/dove/pmu.c
+++ b/drivers/soc/dove/pmu.c
@@ -222,9 +222,9 @@ static void __pmu_domain_register(struct pmu_domain *domain,
 }
 
 /* PMU IRQ controller */
-static void pmu_irq_handler(unsigned int irq, struct irq_desc *desc)
+static void pmu_irq_handler(struct irq_desc *desc)
 {
-        struct pmu_data *pmu = irq_get_handler_data(irq);
+        struct pmu_data *pmu = irq_desc_get_handler_data(desc);
         struct irq_chip_generic *gc = pmu->irq_gc;
         struct irq_domain *domain = pmu->irq_domain;
         void __iomem *base = gc->reg_base;
@@ -232,7 +232,7 @@ static void pmu_irq_handler(unsigned int irq, struct irq_desc *desc)
         u32 done = ~0;
 
         if (stat == 0) {
-                handle_bad_irq(irq, desc);
+                handle_bad_irq(desc);
                 return;
         }
 
diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c
index bf9ed380bb1c..63318e2afba1 100644
--- a/drivers/spi/spi-atmel.c
+++ b/drivers/spi/spi-atmel.c
@@ -1720,6 +1720,7 @@ static int atmel_spi_runtime_resume(struct device *dev)
         return clk_prepare_enable(as->clk);
 }
 
+#ifdef CONFIG_PM_SLEEP
 static int atmel_spi_suspend(struct device *dev)
 {
         struct spi_master *master = dev_get_drvdata(dev);
@@ -1756,6 +1757,7 @@ static int atmel_spi_resume(struct device *dev)
 
         return ret;
 }
+#endif
 
 static const struct dev_pm_ops atmel_spi_pm_ops = {
         SET_SYSTEM_SLEEP_PM_OPS(atmel_spi_suspend, atmel_spi_resume)
diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c
index e7874a6171ec..3e8eeb23d4e9 100644
--- a/drivers/spi/spi-bcm2835.c
+++ b/drivers/spi/spi-bcm2835.c
@@ -386,14 +386,14 @@ static bool bcm2835_spi_can_dma(struct spi_master *master,
         /* otherwise we only allow transfers within the same page
          * to avoid wasting time on dma_mapping when it is not practical
          */
-        if (((size_t)tfr->tx_buf & PAGE_MASK) + tfr->len > PAGE_SIZE) {
+        if (((size_t)tfr->tx_buf & (PAGE_SIZE - 1)) + tfr->len > PAGE_SIZE) {
                 dev_warn_once(&spi->dev,
                               "Unaligned spi tx-transfer bridging page\n");
                 return false;
         }
-        if (((size_t)tfr->rx_buf & PAGE_MASK) + tfr->len > PAGE_SIZE) {
+        if (((size_t)tfr->rx_buf & (PAGE_SIZE - 1)) + tfr->len > PAGE_SIZE) {
                 dev_warn_once(&spi->dev,
-                              "Unaligned spi tx-transfer bridging page\n");
+                              "Unaligned spi rx-transfer bridging page\n");
                 return false;
         }
 
diff --git a/drivers/spi/spi-meson-spifc.c b/drivers/spi/spi-meson-spifc.c
index 5468fc70dbf8..2465259f6241 100644
--- a/drivers/spi/spi-meson-spifc.c
+++ b/drivers/spi/spi-meson-spifc.c
@@ -444,6 +444,7 @@ static const struct of_device_id meson_spifc_dt_match[] = {
         { .compatible = "amlogic,meson6-spifc", },
         { },
 };
+MODULE_DEVICE_TABLE(of, meson_spifc_dt_match);
 
 static struct platform_driver meson_spifc_driver = {
         .probe  = meson_spifc_probe,
diff --git a/drivers/spi/spi-mt65xx.c b/drivers/spi/spi-mt65xx.c
index 5f6315c47920..ecb6c58238c4 100644
--- a/drivers/spi/spi-mt65xx.c
+++ b/drivers/spi/spi-mt65xx.c
@@ -85,7 +85,7 @@ struct mtk_spi {
         void __iomem *base;
         u32 state;
         u32 pad_sel;
-        struct clk *spi_clk, *parent_clk;
+        struct clk *parent_clk, *sel_clk, *spi_clk;
         struct spi_transfer *cur_transfer;
         u32 xfer_len;
         struct scatterlist *tx_sgl, *rx_sgl;
@@ -173,22 +173,6 @@ static void mtk_spi_config(struct mtk_spi *mdata,
                 writel(mdata->pad_sel, mdata->base + SPI_PAD_SEL_REG);
 }
 
-static int mtk_spi_prepare_hardware(struct spi_master *master)
-{
-        struct spi_transfer *trans;
-        struct mtk_spi *mdata = spi_master_get_devdata(master);
-        struct spi_message *msg = master->cur_msg;
-
-        trans = list_first_entry(&msg->transfers, struct spi_transfer,
-                                 transfer_list);
-        if (!trans->cs_change) {
-                mdata->state = MTK_SPI_IDLE;
-                mtk_spi_reset(mdata);
-        }
-
-        return 0;
-}
-
 static int mtk_spi_prepare_message(struct spi_master *master,
                                    struct spi_message *msg)
 {
@@ -228,11 +212,15 @@ static void mtk_spi_set_cs(struct spi_device *spi, bool enable)
         struct mtk_spi *mdata = spi_master_get_devdata(spi->master);
 
         reg_val = readl(mdata->base + SPI_CMD_REG);
-        if (!enable)
+        if (!enable) {
                 reg_val |= SPI_CMD_PAUSE_EN;
-        else
+                writel(reg_val, mdata->base + SPI_CMD_REG);
+        } else {
                 reg_val &= ~SPI_CMD_PAUSE_EN;
-        writel(reg_val, mdata->base + SPI_CMD_REG);
+                writel(reg_val, mdata->base + SPI_CMD_REG);
+                mdata->state = MTK_SPI_IDLE;
+                mtk_spi_reset(mdata);
+        }
 }
 
 static void mtk_spi_prepare_transfer(struct spi_master *master,
@@ -509,7 +497,6 @@ static int mtk_spi_probe(struct platform_device *pdev)
         master->mode_bits = SPI_CPOL | SPI_CPHA;
 
         master->set_cs = mtk_spi_set_cs;
-        master->prepare_transfer_hardware = mtk_spi_prepare_hardware;
         master->prepare_message = mtk_spi_prepare_message;
         master->transfer_one = mtk_spi_transfer_one;
         master->can_dma = mtk_spi_can_dma;
@@ -576,13 +563,6 @@ static int mtk_spi_probe(struct platform_device *pdev)
                 goto err_put_master;
         }
 
-        mdata->spi_clk = devm_clk_get(&pdev->dev, "spi-clk");
-        if (IS_ERR(mdata->spi_clk)) {
-                ret = PTR_ERR(mdata->spi_clk);
-                dev_err(&pdev->dev, "failed to get spi-clk: %d\n", ret);
-                goto err_put_master;
-        }
-
         mdata->parent_clk = devm_clk_get(&pdev->dev, "parent-clk");
         if (IS_ERR(mdata->parent_clk)) {
                 ret = PTR_ERR(mdata->parent_clk);
@@ -590,13 +570,27 @@ static int mtk_spi_probe(struct platform_device *pdev)
                 goto err_put_master;
         }
 
+        mdata->sel_clk = devm_clk_get(&pdev->dev, "sel-clk");
+        if (IS_ERR(mdata->sel_clk)) {
+                ret = PTR_ERR(mdata->sel_clk);
+                dev_err(&pdev->dev, "failed to get sel-clk: %d\n", ret);
+                goto err_put_master;
+        }
+
+        mdata->spi_clk = devm_clk_get(&pdev->dev, "spi-clk");
+        if (IS_ERR(mdata->spi_clk)) {
+                ret = PTR_ERR(mdata->spi_clk);
+                dev_err(&pdev->dev, "failed to get spi-clk: %d\n", ret);
+                goto err_put_master;
+        }
+
         ret = clk_prepare_enable(mdata->spi_clk);
         if (ret < 0) {
                 dev_err(&pdev->dev, "failed to enable spi_clk (%d)\n", ret);
                 goto err_put_master;
         }
 
-        ret = clk_set_parent(mdata->spi_clk, mdata->parent_clk);
+        ret = clk_set_parent(mdata->sel_clk, mdata->parent_clk);
         if (ret < 0) {
                 dev_err(&pdev->dev, "failed to clk_set_parent (%d)\n", ret);
                 goto err_disable_clk;
@@ -630,7 +624,6 @@ static int mtk_spi_remove(struct platform_device *pdev)
         pm_runtime_disable(&pdev->dev);
 
         mtk_spi_reset(mdata);
-        clk_disable_unprepare(mdata->spi_clk);
         spi_master_put(master);
 
         return 0;
diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
index fdd791977041..a8ef38ebb9c9 100644
--- a/drivers/spi/spi-pxa2xx.c
+++ b/drivers/spi/spi-pxa2xx.c
@@ -654,6 +654,10 @@ static irqreturn_t ssp_int(int irq, void *dev_id)
         if (!(sccr1_reg & SSCR1_TIE))
                 mask &= ~SSSR_TFS;
 
+        /* Ignore RX timeout interrupt if it is disabled */
+        if (!(sccr1_reg & SSCR1_TINTE))
+                mask &= ~SSSR_TINT;
+
         if (!(status & mask))
                 return IRQ_NONE;
 
diff --git a/drivers/spi/spi-xtensa-xtfpga.c b/drivers/spi/spi-xtensa-xtfpga.c
index 2e32ea2f194f..be6155cba9de 100644
--- a/drivers/spi/spi-xtensa-xtfpga.c
+++ b/drivers/spi/spi-xtensa-xtfpga.c
@@ -34,13 +34,13 @@ struct xtfpga_spi {
 static inline void xtfpga_spi_write32(const struct xtfpga_spi *spi,
                                       unsigned addr, u32 val)
 {
-        iowrite32(val, spi->regs + addr);
+        __raw_writel(val, spi->regs + addr);
 }
 
 static inline unsigned int xtfpga_spi_read32(const struct xtfpga_spi *spi,
                                              unsigned addr)
 {
-        return ioread32(spi->regs + addr);
+        return __raw_readl(spi->regs + addr);
 }
 
 static inline void xtfpga_spi_wait_busy(struct xtfpga_spi *xspi)
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 3abb3903f2ad..a5f53de813d3 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -1610,8 +1610,7 @@ static struct class spi_master_class = {
  *
  * The caller is responsible for assigning the bus number and initializing
  * the master's methods before calling spi_register_master(); and (after errors
- * adding the device) calling spi_master_put() and kfree() to prevent a memory
- * leak.
+ * adding the device) calling spi_master_put() to prevent a memory leak.
  */
 struct spi_master *spi_alloc_master(struct device *dev, unsigned size)
 {
diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c
index fba92a526531..ef008e52f953 100644
--- a/drivers/spi/spidev.c
+++ b/drivers/spi/spidev.c
@@ -651,7 +651,8 @@ static int spidev_release(struct inode *inode, struct file *filp)
                 kfree(spidev->rx_buffer);
                 spidev->rx_buffer = NULL;
 
-                spidev->speed_hz = spidev->spi->max_speed_hz;
+                if (spidev->spi)
+                        spidev->speed_hz = spidev->spi->max_speed_hz;
 
                 /* ... after we unbound from the underlying device? */
                 spin_lock_irq(&spidev->spi_lock);
diff --git a/drivers/spmi/spmi-pmic-arb.c b/drivers/spmi/spmi-pmic-arb.c
index bdfb3c84c3cb..4a3cf9ba152f 100644
--- a/drivers/spmi/spmi-pmic-arb.c
+++ b/drivers/spmi/spmi-pmic-arb.c
@@ -451,7 +451,7 @@ static void periph_interrupt(struct spmi_pmic_arb_dev *pa, u8 apid)
         }
 }
 
-static void pmic_arb_chained_irq(unsigned int irq, struct irq_desc *desc)
+static void pmic_arb_chained_irq(struct irq_desc *desc)
 {
         struct spmi_pmic_arb_dev *pa = irq_desc_get_handler_data(desc);
         struct irq_chip *chip = irq_desc_get_chip(desc);
diff --git a/drivers/staging/board/armadillo800eva.c b/drivers/staging/board/armadillo800eva.c
index 81df77bd55cc..9c41652ee908 100644
--- a/drivers/staging/board/armadillo800eva.c
+++ b/drivers/staging/board/armadillo800eva.c
@@ -91,7 +91,7 @@ static const struct board_staging_dev armadillo800eva_devices[] __initconst = {
                 .pdev           = &lcdc0_device,
                 .clocks         = lcdc0_clocks,
                 .nclocks        = ARRAY_SIZE(lcdc0_clocks),
-                .domain         = "a4lc",
+                .domain         = "/system-controller@e6180000/pm-domains/c5/a4lc@1"
         },
 };
 
diff --git a/drivers/staging/board/board.c b/drivers/staging/board/board.c
index 29d456e29f38..3eb5eb8f069c 100644
--- a/drivers/staging/board/board.c
+++ b/drivers/staging/board/board.c
@@ -135,6 +135,40 @@ int __init board_staging_register_clock(const struct board_staging_clk *bsc)
         return error;
 }
 
+#ifdef CONFIG_PM_GENERIC_DOMAINS_OF
+static int board_staging_add_dev_domain(struct platform_device *pdev,
+                                        const char *domain)
+{
+        struct of_phandle_args pd_args;
+        struct generic_pm_domain *pd;
+        struct device_node *np;
+
+        np = of_find_node_by_path(domain);
+        if (!np) {
+                pr_err("Cannot find domain node %s\n", domain);
+                return -ENOENT;
+        }
+
+        pd_args.np = np;
+        pd_args.args_count = 0;
+        pd = of_genpd_get_from_provider(&pd_args);
+        if (IS_ERR(pd)) {
+                pr_err("Cannot find genpd %s (%ld)\n", domain, PTR_ERR(pd));
+                return PTR_ERR(pd);
+
+        }
+        pr_debug("Found genpd %s for device %s\n", pd->name, pdev->name);
+
+        return pm_genpd_add_device(pd, &pdev->dev);
+}
+#else
+static inline int board_staging_add_dev_domain(struct platform_device *pdev,
+                                               const char *domain)
+{
+        return 0;
+}
+#endif
+
 int __init board_staging_register_device(const struct board_staging_dev *dev)
 {
         struct platform_device *pdev = dev->pdev;
@@ -161,7 +195,7 @@ int __init board_staging_register_device(const struct board_staging_dev *dev)
         }
 
         if (dev->domain)
-                __pm_genpd_name_add_device(dev->domain, &pdev->dev, NULL);
+                board_staging_add_dev_domain(pdev, dev->domain);
 
         return error;
 }
diff --git a/drivers/staging/rdma/Kconfig b/drivers/staging/rdma/Kconfig
index cf5fe9bb87a1..d7f62359d743 100644
--- a/drivers/staging/rdma/Kconfig
+++ b/drivers/staging/rdma/Kconfig
@@ -24,6 +24,8 @@ if STAGING_RDMA
 
 source "drivers/staging/rdma/amso1100/Kconfig"
 
+source "drivers/staging/rdma/ehca/Kconfig"
+
 source "drivers/staging/rdma/hfi1/Kconfig"
 
 source "drivers/staging/rdma/ipath/Kconfig"
diff --git a/drivers/staging/rdma/Makefile b/drivers/staging/rdma/Makefile
index cbd915ac7f20..139d78ef2c24 100644
--- a/drivers/staging/rdma/Makefile
+++ b/drivers/staging/rdma/Makefile
@@ -1,4 +1,5 @@
 # Entries for RDMA_STAGING tree
 obj-$(CONFIG_INFINIBAND_AMSO1100)       += amso1100/
+obj-$(CONFIG_INFINIBAND_EHCA)   += ehca/
 obj-$(CONFIG_INFINIBAND_HFI1)   += hfi1/
 obj-$(CONFIG_INFINIBAND_IPATH)  += ipath/
diff --git a/drivers/infiniband/hw/ehca/Kconfig b/drivers/staging/rdma/ehca/Kconfig
index 59f807d8d58e..3fadd2ad6426 100644
--- a/drivers/infiniband/hw/ehca/Kconfig
+++ b/drivers/staging/rdma/ehca/Kconfig
@@ -2,7 +2,8 @@ config INFINIBAND_EHCA
         tristate "eHCA support"
         depends on IBMEBUS
         ---help---
-        This driver supports the IBM pSeries eHCA InfiniBand adapter.
+        This driver supports the deprecated IBM pSeries eHCA InfiniBand
+        adapter.
 
         To compile the driver as a module, choose M here. The module
         will be called ib_ehca.
diff --git a/drivers/infiniband/hw/ehca/Makefile b/drivers/staging/rdma/ehca/Makefile
index 74d284e46a40..74d284e46a40 100644
--- a/drivers/infiniband/hw/ehca/Makefile
+++ b/drivers/staging/rdma/ehca/Makefile
diff --git a/drivers/staging/rdma/ehca/TODO b/drivers/staging/rdma/ehca/TODO
new file mode 100644
index 000000000000..199a4a600142
--- /dev/null
+++ b/drivers/staging/rdma/ehca/TODO
@@ -0,0 +1,4 @@
+9/2015
+
+The ehca driver has been deprecated and moved to drivers/staging/rdma.
+It will be removed in the 4.6 merge window.
diff --git a/drivers/infiniband/hw/ehca/ehca_av.c b/drivers/staging/rdma/ehca/ehca_av.c
index 465926319f3d..465926319f3d 100644
--- a/drivers/infiniband/hw/ehca/ehca_av.c
+++ b/drivers/staging/rdma/ehca/ehca_av.c
diff --git a/drivers/infiniband/hw/ehca/ehca_classes.h b/drivers/staging/rdma/ehca/ehca_classes.h
index bd45e0f3923f..bd45e0f3923f 100644
--- a/drivers/infiniband/hw/ehca/ehca_classes.h
+++ b/drivers/staging/rdma/ehca/ehca_classes.h
diff --git a/drivers/infiniband/hw/ehca/ehca_classes_pSeries.h b/drivers/staging/rdma/ehca/ehca_classes_pSeries.h
index 689c35786dd2..689c35786dd2 100644
--- a/drivers/infiniband/hw/ehca/ehca_classes_pSeries.h
+++ b/drivers/staging/rdma/ehca/ehca_classes_pSeries.h
diff --git a/drivers/infiniband/hw/ehca/ehca_cq.c b/drivers/staging/rdma/ehca/ehca_cq.c
index 9b68b175069b..9b68b175069b 100644
--- a/drivers/infiniband/hw/ehca/ehca_cq.c
+++ b/drivers/staging/rdma/ehca/ehca_cq.c
diff --git a/drivers/infiniband/hw/ehca/ehca_eq.c b/drivers/staging/rdma/ehca/ehca_eq.c
index 90da6747d395..90da6747d395 100644
--- a/drivers/infiniband/hw/ehca/ehca_eq.c
+++ b/drivers/staging/rdma/ehca/ehca_eq.c
diff --git a/drivers/infiniband/hw/ehca/ehca_hca.c b/drivers/staging/rdma/ehca/ehca_hca.c
index e8b1bb65797a..e8b1bb65797a 100644
--- a/drivers/infiniband/hw/ehca/ehca_hca.c
+++ b/drivers/staging/rdma/ehca/ehca_hca.c
diff --git a/drivers/infiniband/hw/ehca/ehca_irq.c b/drivers/staging/rdma/ehca/ehca_irq.c
index 8615d7cf7e01..8615d7cf7e01 100644
--- a/drivers/infiniband/hw/ehca/ehca_irq.c
+++ b/drivers/staging/rdma/ehca/ehca_irq.c
diff --git a/drivers/infiniband/hw/ehca/ehca_irq.h b/drivers/staging/rdma/ehca/ehca_irq.h
index 5370199f08c7..5370199f08c7 100644
--- a/drivers/infiniband/hw/ehca/ehca_irq.h
+++ b/drivers/staging/rdma/ehca/ehca_irq.h
diff --git a/drivers/infiniband/hw/ehca/ehca_iverbs.h b/drivers/staging/rdma/ehca/ehca_iverbs.h
index 80e6a3d5df3e..80e6a3d5df3e 100644
--- a/drivers/infiniband/hw/ehca/ehca_iverbs.h
+++ b/drivers/staging/rdma/ehca/ehca_iverbs.h
diff --git a/drivers/infiniband/hw/ehca/ehca_main.c b/drivers/staging/rdma/ehca/ehca_main.c
index 8246418cd4e0..8246418cd4e0 100644
--- a/drivers/infiniband/hw/ehca/ehca_main.c
+++ b/drivers/staging/rdma/ehca/ehca_main.c
diff --git a/drivers/infiniband/hw/ehca/ehca_mcast.c b/drivers/staging/rdma/ehca/ehca_mcast.c
index cec181532924..cec181532924 100644
--- a/drivers/infiniband/hw/ehca/ehca_mcast.c
+++ b/drivers/staging/rdma/ehca/ehca_mcast.c
diff --git a/drivers/infiniband/hw/ehca/ehca_mrmw.c b/drivers/staging/rdma/ehca/ehca_mrmw.c
index f914b30999f8..f914b30999f8 100644
--- a/drivers/infiniband/hw/ehca/ehca_mrmw.c
+++ b/drivers/staging/rdma/ehca/ehca_mrmw.c
diff --git a/drivers/infiniband/hw/ehca/ehca_mrmw.h b/drivers/staging/rdma/ehca/ehca_mrmw.h
index 50d8b51306dd..50d8b51306dd 100644
--- a/drivers/infiniband/hw/ehca/ehca_mrmw.h
+++ b/drivers/staging/rdma/ehca/ehca_mrmw.h
diff --git a/drivers/infiniband/hw/ehca/ehca_pd.c b/drivers/staging/rdma/ehca/ehca_pd.c
index 351577a6670a..351577a6670a 100644
--- a/drivers/infiniband/hw/ehca/ehca_pd.c
+++ b/drivers/staging/rdma/ehca/ehca_pd.c
diff --git a/drivers/infiniband/hw/ehca/ehca_qes.h b/drivers/staging/rdma/ehca/ehca_qes.h
index 90c4efa67586..90c4efa67586 100644
--- a/drivers/infiniband/hw/ehca/ehca_qes.h
+++ b/drivers/staging/rdma/ehca/ehca_qes.h
diff --git a/drivers/infiniband/hw/ehca/ehca_qp.c b/drivers/staging/rdma/ehca/ehca_qp.c
index 2e89356c46fa..2e89356c46fa 100644
--- a/drivers/infiniband/hw/ehca/ehca_qp.c
+++ b/drivers/staging/rdma/ehca/ehca_qp.c
diff --git a/drivers/infiniband/hw/ehca/ehca_reqs.c b/drivers/staging/rdma/ehca/ehca_reqs.c
index 47f94984353d..47f94984353d 100644
--- a/drivers/infiniband/hw/ehca/ehca_reqs.c
+++ b/drivers/staging/rdma/ehca/ehca_reqs.c
diff --git a/drivers/infiniband/hw/ehca/ehca_sqp.c b/drivers/staging/rdma/ehca/ehca_sqp.c
index 376b031c2c7f..376b031c2c7f 100644
--- a/drivers/infiniband/hw/ehca/ehca_sqp.c
+++ b/drivers/staging/rdma/ehca/ehca_sqp.c
diff --git a/drivers/infiniband/hw/ehca/ehca_tools.h b/drivers/staging/rdma/ehca/ehca_tools.h
index d280b12aae64..d280b12aae64 100644
--- a/drivers/infiniband/hw/ehca/ehca_tools.h
+++ b/drivers/staging/rdma/ehca/ehca_tools.h
diff --git a/drivers/infiniband/hw/ehca/ehca_uverbs.c b/drivers/staging/rdma/ehca/ehca_uverbs.c
index 1a1d5d99fcf9..1a1d5d99fcf9 100644
--- a/drivers/infiniband/hw/ehca/ehca_uverbs.c
+++ b/drivers/staging/rdma/ehca/ehca_uverbs.c
diff --git a/drivers/infiniband/hw/ehca/hcp_if.c b/drivers/staging/rdma/ehca/hcp_if.c
index 89517ffb4389..89517ffb4389 100644
--- a/drivers/infiniband/hw/ehca/hcp_if.c
+++ b/drivers/staging/rdma/ehca/hcp_if.c
diff --git a/drivers/infiniband/hw/ehca/hcp_if.h b/drivers/staging/rdma/ehca/hcp_if.h
index a46e514c367b..a46e514c367b 100644
--- a/drivers/infiniband/hw/ehca/hcp_if.h
+++ b/drivers/staging/rdma/ehca/hcp_if.h
diff --git a/drivers/infiniband/hw/ehca/hcp_phyp.c b/drivers/staging/rdma/ehca/hcp_phyp.c
index 077376ff3d28..077376ff3d28 100644
--- a/drivers/infiniband/hw/ehca/hcp_phyp.c
+++ b/drivers/staging/rdma/ehca/hcp_phyp.c
diff --git a/drivers/infiniband/hw/ehca/hcp_phyp.h b/drivers/staging/rdma/ehca/hcp_phyp.h
index d1b029910249..d1b029910249 100644
--- a/drivers/infiniband/hw/ehca/hcp_phyp.h
+++ b/drivers/staging/rdma/ehca/hcp_phyp.h
diff --git a/drivers/infiniband/hw/ehca/hipz_fns.h b/drivers/staging/rdma/ehca/hipz_fns.h
index 9dac93d02140..9dac93d02140 100644
--- a/drivers/infiniband/hw/ehca/hipz_fns.h
+++ b/drivers/staging/rdma/ehca/hipz_fns.h
diff --git a/drivers/infiniband/hw/ehca/hipz_fns_core.h b/drivers/staging/rdma/ehca/hipz_fns_core.h
index 868735fd3187..868735fd3187 100644
--- a/drivers/infiniband/hw/ehca/hipz_fns_core.h
+++ b/drivers/staging/rdma/ehca/hipz_fns_core.h
diff --git a/drivers/infiniband/hw/ehca/hipz_hw.h b/drivers/staging/rdma/ehca/hipz_hw.h
index bf996c7acc42..bf996c7acc42 100644
--- a/drivers/infiniband/hw/ehca/hipz_hw.h
+++ b/drivers/staging/rdma/ehca/hipz_hw.h
diff --git a/drivers/infiniband/hw/ehca/ipz_pt_fn.c b/drivers/staging/rdma/ehca/ipz_pt_fn.c
index 7ffc748cb973..7ffc748cb973 100644
--- a/drivers/infiniband/hw/ehca/ipz_pt_fn.c
+++ b/drivers/staging/rdma/ehca/ipz_pt_fn.c
diff --git a/drivers/infiniband/hw/ehca/ipz_pt_fn.h b/drivers/staging/rdma/ehca/ipz_pt_fn.h
index a801274ea337..a801274ea337 100644
--- a/drivers/infiniband/hw/ehca/ipz_pt_fn.h
+++ b/drivers/staging/rdma/ehca/ipz_pt_fn.h
diff --git a/drivers/staging/rdma/hfi1/chip.c b/drivers/staging/rdma/hfi1/chip.c
index 654eafef1d30..aa58e597df06 100644
--- a/drivers/staging/rdma/hfi1/chip.c
+++ b/drivers/staging/rdma/hfi1/chip.c
@@ -2710,7 +2710,7 @@ int acquire_lcb_access(struct hfi1_devdata *dd, int sleep_ok)
         if (sleep_ok) {
                 mutex_lock(&ppd->hls_lock);
         } else {
-                while (mutex_trylock(&ppd->hls_lock) == EBUSY)
+                while (!mutex_trylock(&ppd->hls_lock))
                         udelay(1);
         }
 
@@ -2758,7 +2758,7 @@ int release_lcb_access(struct hfi1_devdata *dd, int sleep_ok)
         if (sleep_ok) {
                 mutex_lock(&dd->pport->hls_lock);
         } else {
-                while (mutex_trylock(&dd->pport->hls_lock) == EBUSY)
+                while (!mutex_trylock(&dd->pport->hls_lock))
                         udelay(1);
         }
 
diff --git a/drivers/staging/rdma/hfi1/device.c b/drivers/staging/rdma/hfi1/device.c
index 07c87a87775f..bc26a5392712 100644
--- a/drivers/staging/rdma/hfi1/device.c
+++ b/drivers/staging/rdma/hfi1/device.c
@@ -57,11 +57,13 @@
 #include "device.h"
 
 static struct class *class;
+static struct class *user_class;
 static dev_t hfi1_dev;
 
 int hfi1_cdev_init(int minor, const char *name,
                    const struct file_operations *fops,
-                   struct cdev *cdev, struct device **devp)
+                   struct cdev *cdev, struct device **devp,
+                   bool user_accessible)
 {
         const dev_t dev = MKDEV(MAJOR(hfi1_dev), minor);
         struct device *device = NULL;
@@ -78,7 +80,11 @@ int hfi1_cdev_init(int minor, const char *name,
                 goto done;
         }
 
-        device = device_create(class, NULL, dev, NULL, "%s", name);
+        if (user_accessible)
+                device = device_create(user_class, NULL, dev, NULL, "%s", name);
+        else
+                device = device_create(class, NULL, dev, NULL, "%s", name);
+
         if (!IS_ERR(device))
                 goto done;
         ret = PTR_ERR(device);
@@ -110,6 +116,26 @@ const char *class_name(void)
         return hfi1_class_name;
 }
 
+static char *hfi1_devnode(struct device *dev, umode_t *mode)
+{
+        if (mode)
+                *mode = 0600;
+        return kasprintf(GFP_KERNEL, "%s", dev_name(dev));
+}
+
+static const char *hfi1_class_name_user = "hfi1_user";
+const char *class_name_user(void)
+{
+        return hfi1_class_name_user;
+}
+
+static char *hfi1_user_devnode(struct device *dev, umode_t *mode)
+{
+        if (mode)
+                *mode = 0666;
+        return kasprintf(GFP_KERNEL, "%s", dev_name(dev));
+}
+
 int __init dev_init(void)
 {
         int ret;
@@ -125,7 +151,22 @@ int __init dev_init(void)
                 ret = PTR_ERR(class);
                 pr_err("Could not create device class (err %d)\n", -ret);
                 unregister_chrdev_region(hfi1_dev, HFI1_NMINORS);
+                goto done;
         }
+        class->devnode = hfi1_devnode;
+
+        user_class = class_create(THIS_MODULE, class_name_user());
+        if (IS_ERR(user_class)) {
+                ret = PTR_ERR(user_class);
+                pr_err("Could not create device class for user accessible files (err %d)\n",
+                       -ret);
+                class_destroy(class);
+                class = NULL;
+                user_class = NULL;
+                unregister_chrdev_region(hfi1_dev, HFI1_NMINORS);
+                goto done;
+        }
+        user_class->devnode = hfi1_user_devnode;
 
 done:
         return ret;
@@ -133,10 +174,11 @@ done:
 
 void dev_cleanup(void)
 {
-        if (class) {
-                class_destroy(class);
-                class = NULL;
-        }
+        class_destroy(class);
+        class = NULL;
+
+        class_destroy(user_class);
+        user_class = NULL;
 
         unregister_chrdev_region(hfi1_dev, HFI1_NMINORS);
 }
diff --git a/drivers/staging/rdma/hfi1/device.h b/drivers/staging/rdma/hfi1/device.h
index 98caecd3d807..2850ff739d81 100644
--- a/drivers/staging/rdma/hfi1/device.h
+++ b/drivers/staging/rdma/hfi1/device.h
@@ -52,7 +52,8 @@
 
 int hfi1_cdev_init(int minor, const char *name,
                    const struct file_operations *fops,
-                   struct cdev *cdev, struct device **devp);
+                   struct cdev *cdev, struct device **devp,
+                   bool user_accessible);
 void hfi1_cdev_cleanup(struct cdev *cdev, struct device **devp);
 const char *class_name(void);
 int __init dev_init(void);
diff --git a/drivers/staging/rdma/hfi1/diag.c b/drivers/staging/rdma/hfi1/diag.c
index 6777d6b659cf..3e8d5ac4c626 100644
--- a/drivers/staging/rdma/hfi1/diag.c
+++ b/drivers/staging/rdma/hfi1/diag.c
@@ -292,7 +292,7 @@ int hfi1_diag_add(struct hfi1_devdata *dd)
         if (atomic_inc_return(&diagpkt_count) == 1) {
                 ret = hfi1_cdev_init(HFI1_DIAGPKT_MINOR, name,
                                      &diagpkt_file_ops, &diagpkt_cdev,
-                                     &diagpkt_device);
+                                     &diagpkt_device, false);
         }
 
         return ret;
@@ -592,7 +592,8 @@ static int hfi1_snoop_add(struct hfi1_devdata *dd, const char *name)
 
         ret = hfi1_cdev_init(HFI1_SNOOP_CAPTURE_BASE + dd->unit, name,
                              &snoop_file_ops,
-                             &dd->hfi1_snoop.cdev, &dd->hfi1_snoop.class_dev);
+                             &dd->hfi1_snoop.cdev, &dd->hfi1_snoop.class_dev,
+                             false);
 
         if (ret) {
                 dd_dev_err(dd, "Couldn't create %s device: %d", name, ret);
@@ -1012,11 +1013,10 @@ static long hfi1_ioctl(struct file *fp, unsigned int cmd, unsigned long arg)
                 case HFI1_SNOOP_IOCSETLINKSTATE_EXTRA:
                         memset(&link_info, 0, sizeof(link_info));
 
-                        ret = copy_from_user(&link_info,
+                        if (copy_from_user(&link_info,
                                 (struct hfi1_link_info __user *)arg,
-                                sizeof(link_info));
-                        if (ret)
-                                break;
+                                sizeof(link_info)))
+                                ret = -EFAULT;
 
                         value = link_info.port_state;
                         index = link_info.port_number;
@@ -1080,9 +1080,10 @@ static long hfi1_ioctl(struct file *fp, unsigned int cmd, unsigned long arg)
                 case HFI1_SNOOP_IOCGETLINKSTATE_EXTRA:
                         if (cmd == HFI1_SNOOP_IOCGETLINKSTATE_EXTRA) {
                                 memset(&link_info, 0, sizeof(link_info));
-                                ret = copy_from_user(&link_info,
+                                if (copy_from_user(&link_info,
                                         (struct hfi1_link_info __user *)arg,
-                                        sizeof(link_info));
+                                        sizeof(link_info)))
+                                        ret = -EFAULT;
                                 index = link_info.port_number;
                         } else {
                                 ret = __get_user(index, (int __user *) arg);
@@ -1114,9 +1115,10 @@ static long hfi1_ioctl(struct file *fp, unsigned int cmd, unsigned long arg)
                                                         ppd->link_speed_active;
                                 link_info.link_width_active =
                                                         ppd->link_width_active;
-                                ret = copy_to_user(
+                                if (copy_to_user(
                                         (struct hfi1_link_info __user *)arg,
-                                        &link_info, sizeof(link_info));
+                                        &link_info, sizeof(link_info)))
+                                        ret = -EFAULT;
                         } else {
                                 ret = __put_user(value, (int __user *)arg);
                         }
@@ -1142,10 +1144,9 @@ static long hfi1_ioctl(struct file *fp, unsigned int cmd, unsigned long arg)
                         snoop_dbg("Setting filter");
                         /* just copy command structure */
                         argp = (unsigned long *)arg;
-                        ret = copy_from_user(&filter_cmd, (void __user *)argp,
-                                             sizeof(filter_cmd));
-                        if (ret < 0) {
-                                pr_alert("Error copying filter command\n");
+                        if (copy_from_user(&filter_cmd, (void __user *)argp,
+                                             sizeof(filter_cmd))) {
+                                ret = -EFAULT;
                                 break;
                         }
                         if (filter_cmd.opcode >= HFI1_MAX_FILTERS) {
@@ -1167,12 +1168,11 @@ static long hfi1_ioctl(struct file *fp, unsigned int cmd, unsigned long arg)
                                 break;
                         }
                         /* copy remaining data from userspace */
-                        ret = copy_from_user((u8 *)filter_value,
+                        if (copy_from_user((u8 *)filter_value,
                                         (void __user *)filter_cmd.value_ptr,
-                                        filter_cmd.length);
-                        if (ret < 0) {
+                                        filter_cmd.length)) {
                                 kfree(filter_value);
-                                pr_alert("Error copying filter data\n");
+                                ret = -EFAULT;
                                 break;
                         }
                         /* Drain packets first */
diff --git a/drivers/staging/rdma/hfi1/file_ops.c b/drivers/staging/rdma/hfi1/file_ops.c
index 469861750b76..72d38500d8ce 100644
--- a/drivers/staging/rdma/hfi1/file_ops.c
+++ b/drivers/staging/rdma/hfi1/file_ops.c
@@ -1181,6 +1181,7 @@ static int get_ctxt_info(struct file *fp, void __user *ubase, __u32 len)
         struct hfi1_filedata *fd = fp->private_data;
         int ret = 0;
 
+        memset(&cinfo, 0, sizeof(cinfo));
         ret = hfi1_get_base_kinfo(uctxt, &cinfo);
         if (ret < 0)
                 goto done;
@@ -2089,14 +2090,16 @@ static int user_add(struct hfi1_devdata *dd)
 
         if (atomic_inc_return(&user_count) == 1) {
                 ret = hfi1_cdev_init(0, class_name(), &hfi1_file_ops,
-                                     &wildcard_cdev, &wildcard_device);
+                                     &wildcard_cdev, &wildcard_device,
+                                     true);
                 if (ret)
                         goto done;
         }
 
         snprintf(name, sizeof(name), "%s_%d", class_name(), dd->unit);
         ret = hfi1_cdev_init(dd->unit + 1, name, &hfi1_file_ops,
-                             &dd->user_cdev, &dd->user_device);
+                             &dd->user_cdev, &dd->user_device,
+                             true);
         if (ret)
                 goto done;
 
@@ -2104,7 +2107,8 @@ static int user_add(struct hfi1_devdata *dd)
                 snprintf(name, sizeof(name),
                          "%s_ui%d", class_name(), dd->unit);
                 ret = hfi1_cdev_init(dd->unit + UI_OFFSET, name, &ui_file_ops,
-                                     &dd->ui_cdev, &dd->ui_device);
+                                     &dd->ui_cdev, &dd->ui_device,
+                                     false);
                 if (ret)
                         goto done;
         }
diff --git a/drivers/staging/rdma/hfi1/mad.c b/drivers/staging/rdma/hfi1/mad.c
index 37269eb90c34..b2c1b72d38ce 100644
--- a/drivers/staging/rdma/hfi1/mad.c
+++ b/drivers/staging/rdma/hfi1/mad.c
@@ -1717,9 +1717,9 @@ static int __subn_get_opa_psi(struct opa_smp *smp, u32 am, u8 *data,
         psi->port_states.portphysstate_portstate =
                 (hfi1_ibphys_portstate(ppd) << 4) | (lstate & 0xf);
         psi->link_width_downgrade_tx_active =
-          ppd->link_width_downgrade_tx_active;
+                cpu_to_be16(ppd->link_width_downgrade_tx_active);
         psi->link_width_downgrade_rx_active =
-          ppd->link_width_downgrade_rx_active;
+                cpu_to_be16(ppd->link_width_downgrade_rx_active);
         if (resp_len)
                 *resp_len += sizeof(struct opa_port_state_info);
 
diff --git a/drivers/staging/rdma/hfi1/sdma.c b/drivers/staging/rdma/hfi1/sdma.c
index a8c903caecce..aecd1a74741c 100644
--- a/drivers/staging/rdma/hfi1/sdma.c
+++ b/drivers/staging/rdma/hfi1/sdma.c
@@ -737,7 +737,7 @@ u16 sdma_get_descq_cnt(void)
          */
         if (!is_power_of_2(count))
                 return SDMA_DESCQ_CNT;
-        if (count < 64 && count > 32768)
+        if (count < 64 || count > 32768)
                 return SDMA_DESCQ_CNT;
         return count;
 }
@@ -1848,7 +1848,7 @@ static void dump_sdma_state(struct sdma_engine *sde)
                         dd_dev_err(sde->dd,
                                 "\taidx: %u amode: %u alen: %u\n",
                                 (u8)((desc[1] & SDMA_DESC1_HEADER_INDEX_SMASK)
-                                        >> SDMA_DESC1_HEADER_INDEX_MASK),
+                                        >> SDMA_DESC1_HEADER_INDEX_SHIFT),
                                 (u8)((desc[1] & SDMA_DESC1_HEADER_MODE_SMASK)
                                         >> SDMA_DESC1_HEADER_MODE_SHIFT),
                                 (u8)((desc[1] & SDMA_DESC1_HEADER_DWS_SMASK)
@@ -1926,7 +1926,7 @@ void sdma_seqfile_dump_sde(struct seq_file *s, struct sdma_engine *sde)
                 if (desc[0] & SDMA_DESC0_FIRST_DESC_FLAG)
                         seq_printf(s, "\t\tahgidx: %u ahgmode: %u\n",
                                 (u8)((desc[1] & SDMA_DESC1_HEADER_INDEX_SMASK)
-                                        >> SDMA_DESC1_HEADER_INDEX_MASK),
+                                        >> SDMA_DESC1_HEADER_INDEX_SHIFT),
                                 (u8)((desc[1] & SDMA_DESC1_HEADER_MODE_SMASK)
                                         >> SDMA_DESC1_HEADER_MODE_SHIFT));
                 head = (head + 1) & sde->sdma_mask;
diff --git a/drivers/staging/rdma/hfi1/sdma.h b/drivers/staging/rdma/hfi1/sdma.h
index 1e613fcd8f4c..496086903891 100644
--- a/drivers/staging/rdma/hfi1/sdma.h
+++ b/drivers/staging/rdma/hfi1/sdma.h
@@ -109,53 +109,53 @@
 /*
  * Bits defined in the send DMA descriptor.
  */
-#define SDMA_DESC0_FIRST_DESC_FLAG      (1ULL<<63)
-#define SDMA_DESC0_LAST_DESC_FLAG       (1ULL<<62)
+#define SDMA_DESC0_FIRST_DESC_FLAG      (1ULL << 63)
+#define SDMA_DESC0_LAST_DESC_FLAG       (1ULL << 62)
 #define SDMA_DESC0_BYTE_COUNT_SHIFT     48
 #define SDMA_DESC0_BYTE_COUNT_WIDTH     14
 #define SDMA_DESC0_BYTE_COUNT_MASK \
-        ((1ULL<<SDMA_DESC0_BYTE_COUNT_WIDTH)-1ULL)
+        ((1ULL << SDMA_DESC0_BYTE_COUNT_WIDTH) - 1)
 #define SDMA_DESC0_BYTE_COUNT_SMASK \
-        (SDMA_DESC0_BYTE_COUNT_MASK<<SDMA_DESC0_BYTE_COUNT_SHIFT)
+        (SDMA_DESC0_BYTE_COUNT_MASK << SDMA_DESC0_BYTE_COUNT_SHIFT)
 #define SDMA_DESC0_PHY_ADDR_SHIFT       0
 #define SDMA_DESC0_PHY_ADDR_WIDTH       48
 #define SDMA_DESC0_PHY_ADDR_MASK \
-        ((1ULL<<SDMA_DESC0_PHY_ADDR_WIDTH)-1ULL)
+        ((1ULL << SDMA_DESC0_PHY_ADDR_WIDTH) - 1)
 #define SDMA_DESC0_PHY_ADDR_SMASK \
-        (SDMA_DESC0_PHY_ADDR_MASK<<SDMA_DESC0_PHY_ADDR_SHIFT)
+        (SDMA_DESC0_PHY_ADDR_MASK << SDMA_DESC0_PHY_ADDR_SHIFT)
 
 #define SDMA_DESC1_HEADER_UPDATE1_SHIFT 32
 #define SDMA_DESC1_HEADER_UPDATE1_WIDTH 32
 #define SDMA_DESC1_HEADER_UPDATE1_MASK \
-        ((1ULL<<SDMA_DESC1_HEADER_UPDATE1_WIDTH)-1ULL)
+        ((1ULL << SDMA_DESC1_HEADER_UPDATE1_WIDTH) - 1)
 #define SDMA_DESC1_HEADER_UPDATE1_SMASK \
-        (SDMA_DESC1_HEADER_UPDATE1_MASK<<SDMA_DESC1_HEADER_UPDATE1_SHIFT)
+        (SDMA_DESC1_HEADER_UPDATE1_MASK << SDMA_DESC1_HEADER_UPDATE1_SHIFT)
 #define SDMA_DESC1_HEADER_MODE_SHIFT    13
 #define SDMA_DESC1_HEADER_MODE_WIDTH    3
 #define SDMA_DESC1_HEADER_MODE_MASK \
-        ((1ULL<<SDMA_DESC1_HEADER_MODE_WIDTH)-1ULL)
+        ((1ULL << SDMA_DESC1_HEADER_MODE_WIDTH) - 1)
 #define SDMA_DESC1_HEADER_MODE_SMASK \
-        (SDMA_DESC1_HEADER_MODE_MASK<<SDMA_DESC1_HEADER_MODE_SHIFT)
+        (SDMA_DESC1_HEADER_MODE_MASK << SDMA_DESC1_HEADER_MODE_SHIFT)
 #define SDMA_DESC1_HEADER_INDEX_SHIFT   8
 #define SDMA_DESC1_HEADER_INDEX_WIDTH   5
 #define SDMA_DESC1_HEADER_INDEX_MASK \
-        ((1ULL<<SDMA_DESC1_HEADER_INDEX_WIDTH)-1ULL)
+        ((1ULL << SDMA_DESC1_HEADER_INDEX_WIDTH) - 1)
 #define SDMA_DESC1_HEADER_INDEX_SMASK \
-        (SDMA_DESC1_HEADER_INDEX_MASK<<SDMA_DESC1_HEADER_INDEX_SHIFT)
+        (SDMA_DESC1_HEADER_INDEX_MASK << SDMA_DESC1_HEADER_INDEX_SHIFT)
 #define SDMA_DESC1_HEADER_DWS_SHIFT     4
 #define SDMA_DESC1_HEADER_DWS_WIDTH     4
 #define SDMA_DESC1_HEADER_DWS_MASK \
-        ((1ULL<<SDMA_DESC1_HEADER_DWS_WIDTH)-1ULL)
+        ((1ULL << SDMA_DESC1_HEADER_DWS_WIDTH) - 1)
 #define SDMA_DESC1_HEADER_DWS_SMASK \
-        (SDMA_DESC1_HEADER_DWS_MASK<<SDMA_DESC1_HEADER_DWS_SHIFT)
+        (SDMA_DESC1_HEADER_DWS_MASK << SDMA_DESC1_HEADER_DWS_SHIFT)
 #define SDMA_DESC1_GENERATION_SHIFT     2
 #define SDMA_DESC1_GENERATION_WIDTH     2
 #define SDMA_DESC1_GENERATION_MASK \
-        ((1ULL<<SDMA_DESC1_GENERATION_WIDTH)-1ULL)
+        ((1ULL << SDMA_DESC1_GENERATION_WIDTH) - 1)
 #define SDMA_DESC1_GENERATION_SMASK \
-        (SDMA_DESC1_GENERATION_MASK<<SDMA_DESC1_GENERATION_SHIFT)
-#define SDMA_DESC1_INT_REQ_FLAG         (1ULL<<1)
-#define SDMA_DESC1_HEAD_TO_HOST_FLAG    (1ULL<<0)
+        (SDMA_DESC1_GENERATION_MASK << SDMA_DESC1_GENERATION_SHIFT)
+#define SDMA_DESC1_INT_REQ_FLAG         (1ULL << 1)
+#define SDMA_DESC1_HEAD_TO_HOST_FLAG    (1ULL << 0)
 
 enum sdma_states {
         sdma_state_s00_hw_down,
diff --git a/drivers/staging/rdma/hfi1/verbs.c b/drivers/staging/rdma/hfi1/verbs.c
index 53ac21431542..41bb59eb001c 100644
--- a/drivers/staging/rdma/hfi1/verbs.c
+++ b/drivers/staging/rdma/hfi1/verbs.c
@@ -749,11 +749,13 @@ static inline struct verbs_txreq *get_txreq(struct hfi1_ibdev *dev,
         struct verbs_txreq *tx;
 
         tx = kmem_cache_alloc(dev->verbs_txreq_cache, GFP_ATOMIC);
-        if (!tx)
+        if (!tx) {
                 /* call slow path to get the lock */
                 tx =  __get_txreq(dev, qp);
-        if (tx)
-                tx->qp = qp;
+                if (IS_ERR(tx))
+                        return tx;
+        }
+        tx->qp = qp;
         return tx;
 }
 
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index fd092909a457..342a07c58d89 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -269,14 +269,14 @@ int iscsit_deaccess_np(struct iscsi_np *np, struct iscsi_portal_group *tpg,
 }
 
 bool iscsit_check_np_match(
-        struct __kernel_sockaddr_storage *sockaddr,
+        struct sockaddr_storage *sockaddr,
         struct iscsi_np *np,
         int network_transport)
 {
         struct sockaddr_in *sock_in, *sock_in_e;
         struct sockaddr_in6 *sock_in6, *sock_in6_e;
         bool ip_match = false;
-        u16 port;
+        u16 port, port_e;
 
         if (sockaddr->ss_family == AF_INET6) {
                 sock_in6 = (struct sockaddr_in6 *)sockaddr;
@@ -288,6 +288,7 @@ bool iscsit_check_np_match(
                         ip_match = true;
 
                 port = ntohs(sock_in6->sin6_port);
+                port_e = ntohs(sock_in6_e->sin6_port);
         } else {
                 sock_in = (struct sockaddr_in *)sockaddr;
                 sock_in_e = (struct sockaddr_in *)&np->np_sockaddr;
@@ -296,9 +297,10 @@ bool iscsit_check_np_match(
                         ip_match = true;
 
                 port = ntohs(sock_in->sin_port);
+                port_e = ntohs(sock_in_e->sin_port);
         }
 
-        if (ip_match && (np->np_port == port) &&
+        if (ip_match && (port_e == port) &&
             (np->np_network_transport == network_transport))
                 return true;
 
@@ -309,7 +311,7 @@ bool iscsit_check_np_match(
  * Called with mutex np_lock held
  */
 static struct iscsi_np *iscsit_get_np(
-        struct __kernel_sockaddr_storage *sockaddr,
+        struct sockaddr_storage *sockaddr,
         int network_transport)
 {
         struct iscsi_np *np;
@@ -340,12 +342,9 @@ static struct iscsi_np *iscsit_get_np(
 }
 
 struct iscsi_np *iscsit_add_np(
-        struct __kernel_sockaddr_storage *sockaddr,
-        char *ip_str,
+        struct sockaddr_storage *sockaddr,
         int network_transport)
 {
-        struct sockaddr_in *sock_in;
-        struct sockaddr_in6 *sock_in6;
         struct iscsi_np *np;
         int ret;
 
@@ -368,16 +367,6 @@ struct iscsi_np *iscsit_add_np(
         }
 
         np->np_flags |= NPF_IP_NETWORK;
-        if (sockaddr->ss_family == AF_INET6) {
-                sock_in6 = (struct sockaddr_in6 *)sockaddr;
-                snprintf(np->np_ip, IPV6_ADDRESS_SPACE, "%s", ip_str);
-                np->np_port = ntohs(sock_in6->sin6_port);
-        } else {
-                sock_in = (struct sockaddr_in *)sockaddr;
-                sprintf(np->np_ip, "%s", ip_str);
-                np->np_port = ntohs(sock_in->sin_port);
-        }
-
         np->np_network_transport = network_transport;
         spin_lock_init(&np->np_thread_lock);
         init_completion(&np->np_restart_comp);
@@ -411,8 +400,8 @@ struct iscsi_np *iscsit_add_np(
         list_add_tail(&np->np_list, &g_np_list);
         mutex_unlock(&np_lock);
 
-        pr_debug("CORE[0] - Added Network Portal: %s:%hu on %s\n",
-                np->np_ip, np->np_port, np->np_transport->name);
+        pr_debug("CORE[0] - Added Network Portal: %pISpc on %s\n",
+                &np->np_sockaddr, np->np_transport->name);
 
         return np;
 }
@@ -481,8 +470,8 @@ int iscsit_del_np(struct iscsi_np *np)
         list_del(&np->np_list);
         mutex_unlock(&np_lock);
 
-        pr_debug("CORE[0] - Removed Network Portal: %s:%hu on %s\n",
-                np->np_ip, np->np_port, np->np_transport->name);
+        pr_debug("CORE[0] - Removed Network Portal: %pISpc on %s\n",
+                &np->np_sockaddr, np->np_transport->name);
 
         iscsit_put_transport(np->np_transport);
         kfree(np);
@@ -1209,7 +1198,6 @@ static u32 iscsit_do_crypto_hash_sg(
         u8 *pad_bytes)
 {
         u32 data_crc;
-        u32 i;
         struct scatterlist *sg;
         unsigned int page_off;
 
@@ -1218,15 +1206,15 @@ static u32 iscsit_do_crypto_hash_sg(
         sg = cmd->first_data_sg;
         page_off = cmd->first_data_sg_off;
 
-        i = 0;
         while (data_length) {
-                u32 cur_len = min_t(u32, data_length, (sg[i].length - page_off));
+                u32 cur_len = min_t(u32, data_length, (sg->length - page_off));
 
-                crypto_hash_update(hash, &sg[i], cur_len);
+                crypto_hash_update(hash, sg, cur_len);
 
                 data_length -= cur_len;
                 page_off = 0;
-                i++;
+                /* iscsit_map_iovec has already checked for invalid sg pointers */
+                sg = sg_next(sg);
         }
 
         if (padding) {
@@ -2556,7 +2544,7 @@ static int iscsit_send_conn_drop_async_message(
         cmd->stat_sn            = conn->stat_sn++;
         hdr->statsn             = cpu_to_be32(cmd->stat_sn);
         hdr->exp_cmdsn          = cpu_to_be32(conn->sess->exp_cmd_sn);
-        hdr->max_cmdsn          = cpu_to_be32(conn->sess->max_cmd_sn);
+        hdr->max_cmdsn          = cpu_to_be32((u32) atomic_read(&conn->sess->max_cmd_sn));
         hdr->async_event        = ISCSI_ASYNC_MSG_DROPPING_CONNECTION;
         hdr->param1             = cpu_to_be16(cmd->logout_cid);
         hdr->param2             = cpu_to_be16(conn->sess->sess_ops->DefaultTime2Wait);
@@ -2628,7 +2616,7 @@ iscsit_build_datain_pdu(struct iscsi_cmd *cmd, struct iscsi_conn *conn,
                 hdr->statsn             = cpu_to_be32(0xFFFFFFFF);
 
         hdr->exp_cmdsn          = cpu_to_be32(conn->sess->exp_cmd_sn);
-        hdr->max_cmdsn          = cpu_to_be32(conn->sess->max_cmd_sn);
+        hdr->max_cmdsn          = cpu_to_be32((u32) atomic_read(&conn->sess->max_cmd_sn));
         hdr->datasn             = cpu_to_be32(datain->data_sn);
         hdr->offset             = cpu_to_be32(datain->offset);
 
@@ -2839,7 +2827,7 @@ iscsit_build_logout_rsp(struct iscsi_cmd *cmd, struct iscsi_conn *conn,
 
         iscsit_increment_maxcmdsn(cmd, conn->sess);
         hdr->exp_cmdsn          = cpu_to_be32(conn->sess->exp_cmd_sn);
-        hdr->max_cmdsn          = cpu_to_be32(conn->sess->max_cmd_sn);
+        hdr->max_cmdsn          = cpu_to_be32((u32) atomic_read(&conn->sess->max_cmd_sn));
 
         pr_debug("Built Logout Response ITT: 0x%08x StatSN:"
                 " 0x%08x Response: 0x%02x CID: %hu on CID: %hu\n",
@@ -2902,7 +2890,7 @@ iscsit_build_nopin_rsp(struct iscsi_cmd *cmd, struct iscsi_conn *conn,
                 iscsit_increment_maxcmdsn(cmd, conn->sess);
 
         hdr->exp_cmdsn          = cpu_to_be32(conn->sess->exp_cmd_sn);
-        hdr->max_cmdsn          = cpu_to_be32(conn->sess->max_cmd_sn);
+        hdr->max_cmdsn          = cpu_to_be32((u32) atomic_read(&conn->sess->max_cmd_sn));
 
         pr_debug("Built NOPIN %s Response ITT: 0x%08x, TTT: 0x%08x,"
                 " StatSN: 0x%08x, Length %u\n", (nopout_response) ?
@@ -3049,7 +3037,7 @@ static int iscsit_send_r2t(
         hdr->ttt                = cpu_to_be32(r2t->targ_xfer_tag);
         hdr->statsn             = cpu_to_be32(conn->stat_sn);
         hdr->exp_cmdsn          = cpu_to_be32(conn->sess->exp_cmd_sn);
-        hdr->max_cmdsn          = cpu_to_be32(conn->sess->max_cmd_sn);
+        hdr->max_cmdsn          = cpu_to_be32((u32) atomic_read(&conn->sess->max_cmd_sn));
         hdr->r2tsn              = cpu_to_be32(r2t->r2t_sn);
         hdr->data_offset        = cpu_to_be32(r2t->offset);
         hdr->data_length        = cpu_to_be32(r2t->xfer_len);
@@ -3202,7 +3190,7 @@ void iscsit_build_rsp_pdu(struct iscsi_cmd *cmd, struct iscsi_conn *conn,
 
         iscsit_increment_maxcmdsn(cmd, conn->sess);
         hdr->exp_cmdsn          = cpu_to_be32(conn->sess->exp_cmd_sn);
-        hdr->max_cmdsn          = cpu_to_be32(conn->sess->max_cmd_sn);
+        hdr->max_cmdsn          = cpu_to_be32((u32) atomic_read(&conn->sess->max_cmd_sn));
 
         pr_debug("Built SCSI Response, ITT: 0x%08x, StatSN: 0x%08x,"
                 " Response: 0x%02x, SAM Status: 0x%02x, CID: %hu\n",
@@ -3321,7 +3309,7 @@ iscsit_build_task_mgt_rsp(struct iscsi_cmd *cmd, struct iscsi_conn *conn,
 
         iscsit_increment_maxcmdsn(cmd, conn->sess);
         hdr->exp_cmdsn          = cpu_to_be32(conn->sess->exp_cmd_sn);
-        hdr->max_cmdsn          = cpu_to_be32(conn->sess->max_cmd_sn);
+        hdr->max_cmdsn          = cpu_to_be32((u32) atomic_read(&conn->sess->max_cmd_sn));
 
         pr_debug("Built Task Management Response ITT: 0x%08x,"
                 " StatSN: 0x%08x, Response: 0x%02x, CID: %hu\n",
@@ -3399,6 +3387,7 @@ iscsit_build_sendtargets_response(struct iscsi_cmd *cmd,
         int target_name_printed;
         unsigned char buf[ISCSI_IQN_LEN+12]; /* iqn + "TargetName=" + \0 */
         unsigned char *text_in = cmd->text_in_ptr, *text_ptr = NULL;
+        bool active;
 
         buffer_len = min(conn->conn_ops->MaxRecvDataSegmentLength,
                          SENDTARGETS_BUF_LIMIT);
@@ -3452,19 +3441,18 @@ iscsit_build_sendtargets_response(struct iscsi_cmd *cmd,
                         }
 
                         spin_lock(&tpg->tpg_state_lock);
-                        if ((tpg->tpg_state == TPG_STATE_FREE) ||
-                            (tpg->tpg_state == TPG_STATE_INACTIVE)) {
-                                spin_unlock(&tpg->tpg_state_lock);
-                                continue;
-                        }
+                        active = (tpg->tpg_state == TPG_STATE_ACTIVE);
                         spin_unlock(&tpg->tpg_state_lock);
 
+                        if (!active && tpg->tpg_attrib.tpg_enabled_sendtargets)
+                                continue;
+
                         spin_lock(&tpg->tpg_np_lock);
                         list_for_each_entry(tpg_np, &tpg->tpg_gnp_list,
                                                 tpg_np_list) {
                                 struct iscsi_np *np = tpg_np->tpg_np;
                                 bool inaddr_any = iscsit_check_inaddr_any(np);
-                                char *fmt_str;
+                                struct sockaddr_storage *sockaddr;
 
                                 if (np->np_network_transport != network_transport)
                                         continue;
@@ -3492,15 +3480,15 @@ iscsit_build_sendtargets_response(struct iscsi_cmd *cmd,
                                         }
                                 }
 
-                                if (np->np_sockaddr.ss_family == AF_INET6)
-                                        fmt_str = "TargetAddress=[%s]:%hu,%hu";
+                                if (inaddr_any)
+                                        sockaddr = &conn->local_sockaddr;
                                 else
-                                        fmt_str = "TargetAddress=%s:%hu,%hu";
+                                        sockaddr = &np->np_sockaddr;
 
-                                len = sprintf(buf, fmt_str,
-                                        inaddr_any ? conn->local_ip : np->np_ip,
-                                        np->np_port,
-                                        tpg->tpgt);
+                                len = sprintf(buf, "TargetAddress="
+                                              "%pISpc,%hu",
+                                              sockaddr,
+                                              tpg->tpgt);
                                 len += 1;
 
                                 if ((len + payload_len) > buffer_len) {
@@ -3576,7 +3564,7 @@ iscsit_build_text_rsp(struct iscsi_cmd *cmd, struct iscsi_conn *conn,
          */
         cmd->maxcmdsn_inc = 0;
         hdr->exp_cmdsn = cpu_to_be32(conn->sess->exp_cmd_sn);
-        hdr->max_cmdsn = cpu_to_be32(conn->sess->max_cmd_sn);
+        hdr->max_cmdsn = cpu_to_be32((u32) atomic_read(&conn->sess->max_cmd_sn));
 
         pr_debug("Built Text Response: ITT: 0x%08x, TTT: 0x%08x, StatSN: 0x%08x,"
                 " Length: %u, CID: %hu F: %d C: %d\n", cmd->init_task_tag,
@@ -3654,7 +3642,7 @@ iscsit_build_reject(struct iscsi_cmd *cmd, struct iscsi_conn *conn,
         cmd->stat_sn            = conn->stat_sn++;
         hdr->statsn             = cpu_to_be32(cmd->stat_sn);
         hdr->exp_cmdsn          = cpu_to_be32(conn->sess->exp_cmd_sn);
-        hdr->max_cmdsn          = cpu_to_be32(conn->sess->max_cmd_sn);
+        hdr->max_cmdsn          = cpu_to_be32((u32) atomic_read(&conn->sess->max_cmd_sn));
 
 }
 EXPORT_SYMBOL(iscsit_build_reject);
diff --git a/drivers/target/iscsi/iscsi_target.h b/drivers/target/iscsi/iscsi_target.h
index 7d0f9c00d9c2..4cf2c0f2ba2f 100644
--- a/drivers/target/iscsi/iscsi_target.h
+++ b/drivers/target/iscsi/iscsi_target.h
@@ -10,10 +10,10 @@ extern int iscsit_access_np(struct iscsi_np *, struct iscsi_portal_group *);
 extern void iscsit_login_kref_put(struct kref *);
 extern int iscsit_deaccess_np(struct iscsi_np *, struct iscsi_portal_group *,
                                 struct iscsi_tpg_np *);
-extern bool iscsit_check_np_match(struct __kernel_sockaddr_storage *,
+extern bool iscsit_check_np_match(struct sockaddr_storage *,
                                 struct iscsi_np *, int);
-extern struct iscsi_np *iscsit_add_np(struct __kernel_sockaddr_storage *,
-                                char *, int);
+extern struct iscsi_np *iscsit_add_np(struct sockaddr_storage *,
+                                int);
 extern int iscsit_reset_np_thread(struct iscsi_np *, struct iscsi_tpg_np *,
                                 struct iscsi_portal_group *, bool);
 extern int iscsit_del_np(struct iscsi_np *);
diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c
index c1898c84b3d2..c7461d770d3a 100644
--- a/drivers/target/iscsi/iscsi_target_configfs.c
+++ b/drivers/target/iscsi/iscsi_target_configfs.c
@@ -99,7 +99,7 @@ static ssize_t lio_target_np_store_sctp(
                  * Use existing np->np_sockaddr for SCTP network portal reference
                  */
                 tpg_np_sctp = iscsit_tpg_add_network_portal(tpg, &np->np_sockaddr,
-                                        np->np_ip, tpg_np, ISCSI_SCTP_TCP);
+                                        tpg_np, ISCSI_SCTP_TCP);
                 if (!tpg_np_sctp || IS_ERR(tpg_np_sctp))
                         goto out;
         } else {
@@ -177,7 +177,7 @@ static ssize_t lio_target_np_store_iser(
                 }
 
                 tpg_np_iser = iscsit_tpg_add_network_portal(tpg, &np->np_sockaddr,
-                                np->np_ip, tpg_np, ISCSI_INFINIBAND);
+                                tpg_np, ISCSI_INFINIBAND);
                 if (IS_ERR(tpg_np_iser)) {
                         rc = PTR_ERR(tpg_np_iser);
                         goto out;
@@ -220,7 +220,7 @@ static struct se_tpg_np *lio_target_call_addnptotpg(
         struct iscsi_portal_group *tpg;
         struct iscsi_tpg_np *tpg_np;
         char *str, *str2, *ip_str, *port_str;
-        struct __kernel_sockaddr_storage sockaddr;
+        struct sockaddr_storage sockaddr;
         struct sockaddr_in *sock_in;
         struct sockaddr_in6 *sock_in6;
         unsigned long port;
@@ -235,7 +235,7 @@ static struct se_tpg_np *lio_target_call_addnptotpg(
         memset(buf, 0, MAX_PORTAL_LEN + 1);
         snprintf(buf, MAX_PORTAL_LEN + 1, "%s", name);
 
-        memset(&sockaddr, 0, sizeof(struct __kernel_sockaddr_storage));
+        memset(&sockaddr, 0, sizeof(struct sockaddr_storage));
 
         str = strstr(buf, "[");
         if (str) {
@@ -248,8 +248,8 @@ static struct se_tpg_np *lio_target_call_addnptotpg(
                         return ERR_PTR(-EINVAL);
                 }
                 str++; /* Skip over leading "[" */
-                *str2 = '\0'; /* Terminate the IPv6 address */
-                str2++; /* Skip over the "]" */
+                *str2 = '\0'; /* Terminate the unbracketed IPv6 address */
+                str2++; /* Skip over the \0 */
                 port_str = strstr(str2, ":");
                 if (!port_str) {
                         pr_err("Unable to locate \":port\""
@@ -267,7 +267,7 @@ static struct se_tpg_np *lio_target_call_addnptotpg(
                 sock_in6 = (struct sockaddr_in6 *)&sockaddr;
                 sock_in6->sin6_family = AF_INET6;
                 sock_in6->sin6_port = htons((unsigned short)port);
-                ret = in6_pton(str, IPV6_ADDRESS_SPACE,
+                ret = in6_pton(str, -1,
                                 (void *)&sock_in6->sin6_addr.in6_u, -1, &end);
                 if (ret <= 0) {
                         pr_err("in6_pton returned: %d\n", ret);
@@ -316,7 +316,7 @@ static struct se_tpg_np *lio_target_call_addnptotpg(
          * sys/kernel/config/iscsi/$IQN/$TPG/np/$IP:$PORT/
          *
          */
-        tpg_np = iscsit_tpg_add_network_portal(tpg, &sockaddr, str, NULL,
+        tpg_np = iscsit_tpg_add_network_portal(tpg, &sockaddr, NULL,
                                 ISCSI_TCP);
         if (IS_ERR(tpg_np)) {
                 iscsit_put_tpg(tpg);
@@ -344,8 +344,8 @@ static void lio_target_call_delnpfromtpg(
 
         se_tpg = &tpg->tpg_se_tpg;
         pr_debug("LIO_Target_ConfigFS: DEREGISTER -> %s TPGT: %hu"
-                " PORTAL: %s:%hu\n", config_item_name(&se_tpg->se_tpg_wwn->wwn_group.cg_item),
-                tpg->tpgt, tpg_np->tpg_np->np_ip, tpg_np->tpg_np->np_port);
+                " PORTAL: %pISpc\n", config_item_name(&se_tpg->se_tpg_wwn->wwn_group.cg_item),
+                tpg->tpgt, &tpg_np->tpg_np->np_sockaddr);
 
         ret = iscsit_tpg_del_network_portal(tpg, tpg_np);
         if (ret < 0)
@@ -656,6 +656,7 @@ static ssize_t lio_target_nacl_show_info(
         struct iscsi_conn *conn;
         struct se_session *se_sess;
         ssize_t rb = 0;
+        u32 max_cmd_sn;
 
         spin_lock_bh(&se_nacl->nacl_sess_lock);
         se_sess = se_nacl->nacl_sess;
@@ -703,11 +704,12 @@ static ssize_t lio_target_nacl_show_info(
                                 " Values]-----------------------\n");
                 rb += sprintf(page+rb, "  CmdSN/WR  :  CmdSN/WC  :  ExpCmdSN"
                                 "  :  MaxCmdSN  :     ITT    :     TTT\n");
+                max_cmd_sn = (u32) atomic_read(&sess->max_cmd_sn);
                 rb += sprintf(page+rb, " 0x%08x   0x%08x   0x%08x   0x%08x"
                                 "   0x%08x   0x%08x\n",
                         sess->cmdsn_window,
-                        (sess->max_cmd_sn - sess->exp_cmd_sn) + 1,
-                        sess->exp_cmd_sn, sess->max_cmd_sn,
+                        (max_cmd_sn - sess->exp_cmd_sn) + 1,
+                        sess->exp_cmd_sn, max_cmd_sn,
                         sess->init_task_tag, sess->targ_xfer_tag);
                 rb += sprintf(page+rb, "----------------------[iSCSI"
                                 " Connections]-------------------------\n");
@@ -751,7 +753,7 @@ static ssize_t lio_target_nacl_show_info(
                                 break;
                         }
 
-                        rb += sprintf(page+rb, "   Address %s %s", conn->login_ip,
+                        rb += sprintf(page+rb, "   Address %pISc %s", &conn->login_sockaddr,
                                 (conn->network_transport == ISCSI_TCP) ?
                                 "TCP" : "SCTP");
                         rb += sprintf(page+rb, "  StatSN: 0x%08x\n",
@@ -1010,6 +1012,11 @@ TPG_ATTR(t10_pi, S_IRUGO | S_IWUSR);
  */
 DEF_TPG_ATTRIB(fabric_prot_type);
 TPG_ATTR(fabric_prot_type, S_IRUGO | S_IWUSR);
+/*
+ * Define iscsi_tpg_attrib_s_tpg_enabled_sendtargets
+ */
+DEF_TPG_ATTRIB(tpg_enabled_sendtargets);
+TPG_ATTR(tpg_enabled_sendtargets, S_IRUGO | S_IWUSR);
 
 static struct configfs_attribute *lio_target_tpg_attrib_attrs[] = {
         &iscsi_tpg_attrib_authentication.attr,
@@ -1024,6 +1031,7 @@ static struct configfs_attribute *lio_target_tpg_attrib_attrs[] = {
         &iscsi_tpg_attrib_default_erl.attr,
         &iscsi_tpg_attrib_t10_pi.attr,
         &iscsi_tpg_attrib_fabric_prot_type.attr,
+        &iscsi_tpg_attrib_tpg_enabled_sendtargets.attr,
         NULL,
 };
 
diff --git a/drivers/target/iscsi/iscsi_target_device.c b/drivers/target/iscsi/iscsi_target_device.c
index 5fabcd3d623f..0382fa24b53b 100644
--- a/drivers/target/iscsi/iscsi_target_device.c
+++ b/drivers/target/iscsi/iscsi_target_device.c
@@ -47,19 +47,19 @@ void iscsit_determine_maxcmdsn(struct iscsi_session *sess)
          * core_set_queue_depth_for_node().
          */
         sess->cmdsn_window = se_nacl->queue_depth;
-        sess->max_cmd_sn = (sess->max_cmd_sn + se_nacl->queue_depth) - 1;
+        atomic_add(se_nacl->queue_depth - 1, &sess->max_cmd_sn);
 }
 
 void iscsit_increment_maxcmdsn(struct iscsi_cmd *cmd, struct iscsi_session *sess)
 {
+        u32 max_cmd_sn;
+
         if (cmd->immediate_cmd || cmd->maxcmdsn_inc)
                 return;
 
         cmd->maxcmdsn_inc = 1;
 
-        mutex_lock(&sess->cmdsn_mutex);
-        sess->max_cmd_sn += 1;
-        pr_debug("Updated MaxCmdSN to 0x%08x\n", sess->max_cmd_sn);
-        mutex_unlock(&sess->cmdsn_mutex);
+        max_cmd_sn = atomic_inc_return(&sess->max_cmd_sn);
+        pr_debug("Updated MaxCmdSN to 0x%08x\n", max_cmd_sn);
 }
 EXPORT_SYMBOL(iscsit_increment_maxcmdsn);
diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
index 7e8f65e5448f..96e78c823d13 100644
--- a/drivers/target/iscsi/iscsi_target_login.c
+++ b/drivers/target/iscsi/iscsi_target_login.c
@@ -331,7 +331,7 @@ static int iscsi_login_zero_tsih_s1(
          * The FFP CmdSN window values will be allocated from the TPG's
          * Initiator Node's ACL once the login has been successfully completed.
          */
-        sess->max_cmd_sn        = be32_to_cpu(pdu->cmdsn);
+        atomic_set(&sess->max_cmd_sn, be32_to_cpu(pdu->cmdsn));
 
         sess->sess_ops = kzalloc(sizeof(struct iscsi_sess_ops), GFP_KERNEL);
         if (!sess->sess_ops) {
@@ -729,9 +729,9 @@ void iscsi_post_login_handler(
                         stop_timer = 1;
                 }
 
-                pr_debug("iSCSI Login successful on CID: %hu from %s to"
-                        " %s:%hu,%hu\n", conn->cid, conn->login_ip,
-                        conn->local_ip, conn->local_port, tpg->tpgt);
+                pr_debug("iSCSI Login successful on CID: %hu from %pISpc to"
+                        " %pISpc,%hu\n", conn->cid, &conn->login_sockaddr,
+                        &conn->local_sockaddr, tpg->tpgt);
 
                 list_add_tail(&conn->conn_list, &sess->sess_conn_list);
                 atomic_inc(&sess->nconn);
@@ -776,8 +776,8 @@ void iscsi_post_login_handler(
         pr_debug("Moving to TARG_SESS_STATE_LOGGED_IN.\n");
         sess->session_state = TARG_SESS_STATE_LOGGED_IN;
 
-        pr_debug("iSCSI Login successful on CID: %hu from %s to %s:%hu,%hu\n",
-                conn->cid, conn->login_ip, conn->local_ip, conn->local_port,
+        pr_debug("iSCSI Login successful on CID: %hu from %pISpc to %pISpc,%hu\n",
+                conn->cid, &conn->login_sockaddr, &conn->local_sockaddr,
                 tpg->tpgt);
 
         spin_lock_bh(&sess->conn_lock);
@@ -823,8 +823,8 @@ static void iscsi_handle_login_thread_timeout(unsigned long data)
         struct iscsi_np *np = (struct iscsi_np *) data;
 
         spin_lock_bh(&np->np_thread_lock);
-        pr_err("iSCSI Login timeout on Network Portal %s:%hu\n",
-                        np->np_ip, np->np_port);
+        pr_err("iSCSI Login timeout on Network Portal %pISpc\n",
+                        &np->np_sockaddr);
 
         if (np->np_login_timer_flags & ISCSI_TF_STOP) {
                 spin_unlock_bh(&np->np_thread_lock);
@@ -877,7 +877,7 @@ static void iscsi_stop_login_thread_timer(struct iscsi_np *np)
 
 int iscsit_setup_np(
         struct iscsi_np *np,
-        struct __kernel_sockaddr_storage *sockaddr)
+        struct sockaddr_storage *sockaddr)
 {
         struct socket *sock = NULL;
         int backlog = ISCSIT_TCP_BACKLOG, ret, opt = 0, len;
@@ -916,7 +916,7 @@ int iscsit_setup_np(
          * in iscsi_target_configfs.c code..
          */
         memcpy(&np->np_sockaddr, sockaddr,
-                        sizeof(struct __kernel_sockaddr_storage));
+                        sizeof(struct sockaddr_storage));
 
         if (sockaddr->ss_family == AF_INET6)
                 len = sizeof(struct sockaddr_in6);
@@ -975,7 +975,7 @@ fail:
 
 int iscsi_target_setup_login_socket(
         struct iscsi_np *np,
-        struct __kernel_sockaddr_storage *sockaddr)
+        struct sockaddr_storage *sockaddr)
 {
         struct iscsit_transport *t;
         int rc;
@@ -1015,44 +1015,42 @@ int iscsit_accept_np(struct iscsi_np *np, struct iscsi_conn *conn)
                 rc = conn->sock->ops->getname(conn->sock,
                                 (struct sockaddr *)&sock_in6, &err, 1);
                 if (!rc) {
-                        if (!ipv6_addr_v4mapped(&sock_in6.sin6_addr))
-                                snprintf(conn->login_ip, sizeof(conn->login_ip), "[%pI6c]",
-                                        &sock_in6.sin6_addr.in6_u);
-                        else
-                                snprintf(conn->login_ip, sizeof(conn->login_ip), "%pI4",
-                                        &sock_in6.sin6_addr.s6_addr32[3]);
-                        conn->login_port = ntohs(sock_in6.sin6_port);
+                        if (!ipv6_addr_v4mapped(&sock_in6.sin6_addr)) {
+                                memcpy(&conn->login_sockaddr, &sock_in6, sizeof(sock_in6));
+                        } else {
+                                /* Pretend to be an ipv4 socket */
+                                sock_in.sin_family = AF_INET;
+                                sock_in.sin_port = sock_in6.sin6_port;
+                                memcpy(&sock_in.sin_addr, &sock_in6.sin6_addr.s6_addr32[3], 4);
+                                memcpy(&conn->login_sockaddr, &sock_in, sizeof(sock_in));
+                        }
                 }
 
                 rc = conn->sock->ops->getname(conn->sock,
                                 (struct sockaddr *)&sock_in6, &err, 0);
                 if (!rc) {
-                        if (!ipv6_addr_v4mapped(&sock_in6.sin6_addr))
-                                snprintf(conn->local_ip, sizeof(conn->local_ip), "[%pI6c]",
-                                        &sock_in6.sin6_addr.in6_u);
-                        else
-                                snprintf(conn->local_ip, sizeof(conn->local_ip), "%pI4",
-                                        &sock_in6.sin6_addr.s6_addr32[3]);
-                        conn->local_port = ntohs(sock_in6.sin6_port);
+                        if (!ipv6_addr_v4mapped(&sock_in6.sin6_addr)) {
+                                memcpy(&conn->local_sockaddr, &sock_in6, sizeof(sock_in6));
+                        } else {
+                                /* Pretend to be an ipv4 socket */
+                                sock_in.sin_family = AF_INET;
+                                sock_in.sin_port = sock_in6.sin6_port;
+                                memcpy(&sock_in.sin_addr, &sock_in6.sin6_addr.s6_addr32[3], 4);
+                                memcpy(&conn->local_sockaddr, &sock_in, sizeof(sock_in));
+                        }
                 }
         } else {
                 memset(&sock_in, 0, sizeof(struct sockaddr_in));
 
                 rc = conn->sock->ops->getname(conn->sock,
                                 (struct sockaddr *)&sock_in, &err, 1);
-                if (!rc) {
-                        sprintf(conn->login_ip, "%pI4",
-                                        &sock_in.sin_addr.s_addr);
-                        conn->login_port = ntohs(sock_in.sin_port);
-                }
+                if (!rc)
+                        memcpy(&conn->login_sockaddr, &sock_in, sizeof(sock_in));
 
                 rc = conn->sock->ops->getname(conn->sock,
                                 (struct sockaddr *)&sock_in, &err, 0);
-                if (!rc) {
-                        sprintf(conn->local_ip, "%pI4",
-                                        &sock_in.sin_addr.s_addr);
-                        conn->local_port = ntohs(sock_in.sin_port);
-                }
+                if (!rc)
+                        memcpy(&conn->local_sockaddr, &sock_in, sizeof(sock_in));
         }
 
         return 0;
@@ -1302,8 +1300,8 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
         spin_lock_bh(&np->np_thread_lock);
         if (np->np_thread_state != ISCSI_NP_THREAD_ACTIVE) {
                 spin_unlock_bh(&np->np_thread_lock);
-                pr_err("iSCSI Network Portal on %s:%hu currently not"
-                        " active.\n", np->np_ip, np->np_port);
+                pr_err("iSCSI Network Portal on %pISpc currently not"
+                        " active.\n", &np->np_sockaddr);
                 iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
                                 ISCSI_LOGIN_STATUS_SVC_UNAVAILABLE);
                 goto new_sess_out;
@@ -1312,9 +1310,9 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
 
         conn->network_transport = np->np_network_transport;
 
-        pr_debug("Received iSCSI login request from %s on %s Network"
-                " Portal %s:%hu\n", conn->login_ip, np->np_transport->name,
-                conn->local_ip, conn->local_port);
+        pr_debug("Received iSCSI login request from %pISpc on %s Network"
+                " Portal %pISpc\n", &conn->login_sockaddr, np->np_transport->name,
+                &conn->local_sockaddr);
 
         pr_debug("Moving to TARG_CONN_STATE_IN_LOGIN.\n");
         conn->conn_state        = TARG_CONN_STATE_IN_LOGIN;
diff --git a/drivers/target/iscsi/iscsi_target_login.h b/drivers/target/iscsi/iscsi_target_login.h
index 57aa0d0fd820..b597aa2c61a1 100644
--- a/drivers/target/iscsi/iscsi_target_login.h
+++ b/drivers/target/iscsi/iscsi_target_login.h
@@ -5,9 +5,9 @@ extern int iscsi_login_setup_crypto(struct iscsi_conn *);
 extern int iscsi_check_for_session_reinstatement(struct iscsi_conn *);
 extern int iscsi_login_post_auth_non_zero_tsih(struct iscsi_conn *, u16, u32);
 extern int iscsit_setup_np(struct iscsi_np *,
-                                struct __kernel_sockaddr_storage *);
+                                struct sockaddr_storage *);
 extern int iscsi_target_setup_login_socket(struct iscsi_np *,
-                                struct __kernel_sockaddr_storage *);
+                                struct sockaddr_storage *);
 extern int iscsit_accept_np(struct iscsi_np *, struct iscsi_conn *);
 extern int iscsit_get_login_rx(struct iscsi_conn *, struct iscsi_login *);
 extern int iscsit_put_login_tx(struct iscsi_conn *, struct iscsi_login *, u32);
diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c
index f9cde9141836..5c964c09c89f 100644
--- a/drivers/target/iscsi/iscsi_target_nego.c
+++ b/drivers/target/iscsi/iscsi_target_nego.c
@@ -341,7 +341,6 @@ static int iscsi_target_check_first_request(
 static int iscsi_target_do_tx_login_io(struct iscsi_conn *conn, struct iscsi_login *login)
 {
         u32 padding = 0;
-        struct iscsi_session *sess = conn->sess;
         struct iscsi_login_rsp *login_rsp;
 
         login_rsp = (struct iscsi_login_rsp *) login->rsp;
@@ -353,7 +352,7 @@ static int iscsi_target_do_tx_login_io(struct iscsi_conn *conn, struct iscsi_log
         login_rsp->itt                  = login->init_task_tag;
         login_rsp->statsn               = cpu_to_be32(conn->stat_sn++);
         login_rsp->exp_cmdsn            = cpu_to_be32(conn->sess->exp_cmd_sn);
-        login_rsp->max_cmdsn            = cpu_to_be32(conn->sess->max_cmd_sn);
+        login_rsp->max_cmdsn            = cpu_to_be32((u32) atomic_read(&conn->sess->max_cmd_sn));
 
         pr_debug("Sending Login Response, Flags: 0x%02x, ITT: 0x%08x,"
                 " ExpCmdSN; 0x%08x, MaxCmdSN: 0x%08x, StatSN: 0x%08x, Length:"
@@ -382,10 +381,6 @@ static int iscsi_target_do_tx_login_io(struct iscsi_conn *conn, struct iscsi_log
                 goto err;
 
         login->rsp_length               = 0;
-        mutex_lock(&sess->cmdsn_mutex);
-        login_rsp->exp_cmdsn            = cpu_to_be32(sess->exp_cmd_sn);
-        login_rsp->max_cmdsn            = cpu_to_be32(sess->max_cmd_sn);
-        mutex_unlock(&sess->cmdsn_mutex);
 
         return 0;
 
diff --git a/drivers/target/iscsi/iscsi_target_stat.c b/drivers/target/iscsi/iscsi_target_stat.c
index 5e1349a3b143..9dd94ff0b62c 100644
--- a/drivers/target/iscsi/iscsi_target_stat.c
+++ b/drivers/target/iscsi/iscsi_target_stat.c
@@ -430,7 +430,7 @@ static ssize_t iscsi_stat_tgt_attr_show_attr_fail_intr_addr(
         int ret;
 
         spin_lock(&lstat->lock);
-        ret = snprintf(page, PAGE_SIZE, "%s\n", lstat->last_intr_fail_ip_addr);
+        ret = snprintf(page, PAGE_SIZE, "%pISc\n", &lstat->last_intr_fail_sockaddr);
         spin_unlock(&lstat->lock);
 
         return ret;
diff --git a/drivers/target/iscsi/iscsi_target_tmr.c b/drivers/target/iscsi/iscsi_target_tmr.c
index cf59c397007b..11320df939f7 100644
--- a/drivers/target/iscsi/iscsi_target_tmr.c
+++ b/drivers/target/iscsi/iscsi_target_tmr.c
@@ -50,7 +50,7 @@ u8 iscsit_tmr_abort_task(
                 pr_err("Unable to locate RefTaskTag: 0x%08x on CID:"
                         " %hu.\n", hdr->rtt, conn->cid);
                 return (iscsi_sna_gte(be32_to_cpu(hdr->refcmdsn), conn->sess->exp_cmd_sn) &&
-                        iscsi_sna_lte(be32_to_cpu(hdr->refcmdsn), conn->sess->max_cmd_sn)) ?
+                        iscsi_sna_lte(be32_to_cpu(hdr->refcmdsn), (u32) atomic_read(&conn->sess->max_cmd_sn))) ?
                         ISCSI_TMF_RSP_COMPLETE : ISCSI_TMF_RSP_NO_TASK;
         }
         if (ref_cmd->cmd_sn != be32_to_cpu(hdr->refcmdsn)) {
diff --git a/drivers/target/iscsi/iscsi_target_tpg.c b/drivers/target/iscsi/iscsi_target_tpg.c
index 968068ffcb1c..23c95cd14167 100644
--- a/drivers/target/iscsi/iscsi_target_tpg.c
+++ b/drivers/target/iscsi/iscsi_target_tpg.c
@@ -226,6 +226,7 @@ static void iscsit_set_default_tpg_attribs(struct iscsi_portal_group *tpg)
         a->default_erl = TA_DEFAULT_ERL;
         a->t10_pi = TA_DEFAULT_T10_PI;
         a->fabric_prot_type = TA_DEFAULT_FABRIC_PROT_TYPE;
+        a->tpg_enabled_sendtargets = TA_DEFAULT_TPG_ENABLED_SENDTARGETS;
 }
 
 int iscsit_tpg_add_portal_group(struct iscsi_tiqn *tiqn, struct iscsi_portal_group *tpg)
@@ -430,7 +431,7 @@ struct iscsi_tpg_np *iscsit_tpg_locate_child_np(
 
 static bool iscsit_tpg_check_network_portal(
         struct iscsi_tiqn *tiqn,
-        struct __kernel_sockaddr_storage *sockaddr,
+        struct sockaddr_storage *sockaddr,
         int network_transport)
 {
         struct iscsi_portal_group *tpg;
@@ -459,8 +460,7 @@ static bool iscsit_tpg_check_network_portal(
 
 struct iscsi_tpg_np *iscsit_tpg_add_network_portal(
         struct iscsi_portal_group *tpg,
-        struct __kernel_sockaddr_storage *sockaddr,
-        char *ip_str,
+        struct sockaddr_storage *sockaddr,
         struct iscsi_tpg_np *tpg_np_parent,
         int network_transport)
 {
@@ -470,8 +470,8 @@ struct iscsi_tpg_np *iscsit_tpg_add_network_portal(
         if (!tpg_np_parent) {
                 if (iscsit_tpg_check_network_portal(tpg->tpg_tiqn, sockaddr,
                                 network_transport)) {
-                        pr_err("Network Portal: %s already exists on a"
-                                " different TPG on %s\n", ip_str,
+                        pr_err("Network Portal: %pISc already exists on a"
+                                " different TPG on %s\n", sockaddr,
                                 tpg->tpg_tiqn->tiqn);
                         return ERR_PTR(-EEXIST);
                 }
@@ -484,7 +484,7 @@ struct iscsi_tpg_np *iscsit_tpg_add_network_portal(
                 return ERR_PTR(-ENOMEM);
         }
 
-        np = iscsit_add_np(sockaddr, ip_str, network_transport);
+        np = iscsit_add_np(sockaddr, network_transport);
         if (IS_ERR(np)) {
                 kfree(tpg_np);
                 return ERR_CAST(np);
@@ -514,8 +514,8 @@ struct iscsi_tpg_np *iscsit_tpg_add_network_portal(
                 spin_unlock(&tpg_np_parent->tpg_np_parent_lock);
         }
 
-        pr_debug("CORE[%s] - Added Network Portal: %s:%hu,%hu on %s\n",
-                tpg->tpg_tiqn->tiqn, np->np_ip, np->np_port, tpg->tpgt,
+        pr_debug("CORE[%s] - Added Network Portal: %pISpc,%hu on %s\n",
+                tpg->tpg_tiqn->tiqn, &np->np_sockaddr, tpg->tpgt,
                 np->np_transport->name);
 
         return tpg_np;
@@ -528,8 +528,8 @@ static int iscsit_tpg_release_np(
 {
         iscsit_clear_tpg_np_login_thread(tpg_np, tpg, true);
 
-        pr_debug("CORE[%s] - Removed Network Portal: %s:%hu,%hu on %s\n",
-                tpg->tpg_tiqn->tiqn, np->np_ip, np->np_port, tpg->tpgt,
+        pr_debug("CORE[%s] - Removed Network Portal: %pISpc,%hu on %s\n",
+                tpg->tpg_tiqn->tiqn, &np->np_sockaddr, tpg->tpgt,
                 np->np_transport->name);
 
         tpg_np->tpg_np = NULL;
@@ -892,3 +892,21 @@ int iscsit_ta_fabric_prot_type(
 
         return 0;
 }
+
+int iscsit_ta_tpg_enabled_sendtargets(
+        struct iscsi_portal_group *tpg,
+        u32 flag)
+{
+        struct iscsi_tpg_attrib *a = &tpg->tpg_attrib;
+
+        if ((flag != 0) && (flag != 1)) {
+                pr_err("Illegal value %d\n", flag);
+                return -EINVAL;
+        }
+
+        a->tpg_enabled_sendtargets = flag;
+        pr_debug("iSCSI_TPG[%hu] - TPG enabled bit required for SendTargets:"
+                " %s\n", tpg->tpgt, (a->tpg_enabled_sendtargets) ? "ON" : "OFF");
+
+        return 0;
+}
diff --git a/drivers/target/iscsi/iscsi_target_tpg.h b/drivers/target/iscsi/iscsi_target_tpg.h
index 95ff5bdecd71..9db32bd24cd4 100644
--- a/drivers/target/iscsi/iscsi_target_tpg.h
+++ b/drivers/target/iscsi/iscsi_target_tpg.h
@@ -22,7 +22,7 @@ extern struct iscsi_node_attrib *iscsit_tpg_get_node_attrib(struct iscsi_session
 extern void iscsit_tpg_del_external_nps(struct iscsi_tpg_np *);
 extern struct iscsi_tpg_np *iscsit_tpg_locate_child_np(struct iscsi_tpg_np *, int);
 extern struct iscsi_tpg_np *iscsit_tpg_add_network_portal(struct iscsi_portal_group *,
-                        struct __kernel_sockaddr_storage *, char *, struct iscsi_tpg_np *,
+                        struct sockaddr_storage *, struct iscsi_tpg_np *,
                         int);
 extern int iscsit_tpg_del_network_portal(struct iscsi_portal_group *,
                         struct iscsi_tpg_np *);
@@ -40,5 +40,6 @@ extern int iscsit_ta_demo_mode_discovery(struct iscsi_portal_group *, u32);
 extern int iscsit_ta_default_erl(struct iscsi_portal_group *, u32);
 extern int iscsit_ta_t10_pi(struct iscsi_portal_group *, u32);
 extern int iscsit_ta_fabric_prot_type(struct iscsi_portal_group *, u32);
+extern int iscsit_ta_tpg_enabled_sendtargets(struct iscsi_portal_group *, u32);
 
 #endif /* ISCSI_TARGET_TPG_H */
diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c
index a2bff0702eb2..428b0d9e3dba 100644
--- a/drivers/target/iscsi/iscsi_target_util.c
+++ b/drivers/target/iscsi/iscsi_target_util.c
@@ -233,6 +233,7 @@ struct iscsi_r2t *iscsit_get_holder_for_r2tsn(
 
 static inline int iscsit_check_received_cmdsn(struct iscsi_session *sess, u32 cmdsn)
 {
+        u32 max_cmdsn;
         int ret;
 
         /*
@@ -241,10 +242,10 @@ static inline int iscsit_check_received_cmdsn(struct iscsi_session *sess, u32 cm
          * or order CmdSNs due to multiple connection sessions and/or
          * CRC failures.
          */
-        if (iscsi_sna_gt(cmdsn, sess->max_cmd_sn)) {
+        max_cmdsn = atomic_read(&sess->max_cmd_sn);
+        if (iscsi_sna_gt(cmdsn, max_cmdsn)) {
                 pr_err("Received CmdSN: 0x%08x is greater than"
-                       " MaxCmdSN: 0x%08x, ignoring.\n", cmdsn,
-                       sess->max_cmd_sn);
+                       " MaxCmdSN: 0x%08x, ignoring.\n", cmdsn, max_cmdsn);
                 ret = CMDSN_MAXCMDSN_OVERRUN;
 
         } else if (cmdsn == sess->exp_cmd_sn) {
@@ -1371,6 +1372,33 @@ int tx_data(
         return iscsit_do_tx_data(conn, &c);
 }
 
+static bool sockaddr_equal(struct sockaddr_storage *x, struct sockaddr_storage *y)
+{
+        switch (x->ss_family) {
+        case AF_INET: {
+                struct sockaddr_in *sinx = (struct sockaddr_in *)x;
+                struct sockaddr_in *siny = (struct sockaddr_in *)y;
+                if (sinx->sin_addr.s_addr != siny->sin_addr.s_addr)
+                        return false;
+                if (sinx->sin_port != siny->sin_port)
+                        return false;
+                break;
+        }
+        case AF_INET6: {
+                struct sockaddr_in6 *sinx = (struct sockaddr_in6 *)x;
+                struct sockaddr_in6 *siny = (struct sockaddr_in6 *)y;
+                if (!ipv6_addr_equal(&sinx->sin6_addr, &siny->sin6_addr))
+                        return false;
+                if (sinx->sin6_port != siny->sin6_port)
+                        return false;
+                break;
+        }
+        default:
+                return false;
+        }
+        return true;
+}
+
 void iscsit_collect_login_stats(
         struct iscsi_conn *conn,
         u8 status_class,
@@ -1387,7 +1415,7 @@ void iscsit_collect_login_stats(
         ls = &tiqn->login_stats;
 
         spin_lock(&ls->lock);
-        if (!strcmp(conn->login_ip, ls->last_intr_fail_ip_addr) &&
+        if (sockaddr_equal(&conn->login_sockaddr, &ls->last_intr_fail_sockaddr) &&
             ((get_jiffies_64() - ls->last_fail_time) < 10)) {
                 /* We already have the failure info for this login */
                 spin_unlock(&ls->lock);
@@ -1427,8 +1455,7 @@ void iscsit_collect_login_stats(
 
                 ls->last_intr_fail_ip_family = conn->login_family;
 
-                snprintf(ls->last_intr_fail_ip_addr, IPV6_ADDRESS_SPACE,
-                                "%s", conn->login_ip);
+                ls->last_intr_fail_sockaddr = conn->login_sockaddr;
                 ls->last_fail_time = get_jiffies_64();
         }
 
diff --git a/drivers/target/loopback/tcm_loop.c b/drivers/target/loopback/tcm_loop.c
index a556bdebd775..5bc85ffed720 100644
--- a/drivers/target/loopback/tcm_loop.c
+++ b/drivers/target/loopback/tcm_loop.c
@@ -526,7 +526,7 @@ static inline struct tcm_loop_tpg *tl_tpg(struct se_portal_group *se_tpg)
 static char *tcm_loop_get_endpoint_wwn(struct se_portal_group *se_tpg)
 {
         /*
-         * Return the passed NAA identifier for the SAS Target Port
+         * Return the passed NAA identifier for the Target Port
          */
         return &tl_tpg(se_tpg)->tl_hba->tl_wwn_address[0];
 }
@@ -845,7 +845,7 @@ static int tcm_loop_make_nexus(
                 transport_free_session(tl_nexus->se_sess);
                 goto out;
         }
-        /* Now, register the SAS I_T Nexus as active. */
+        /* Now, register the I_T Nexus as active. */
         transport_register_session(se_tpg, tl_nexus->se_sess->se_node_acl,
                         tl_nexus->se_sess, tl_nexus);
         tl_tpg->tl_nexus = tl_nexus;
@@ -884,7 +884,7 @@ static int tcm_loop_drop_nexus(
                 " %s Initiator Port: %s\n", tcm_loop_dump_proto_id(tpg->tl_hba),
                 tl_nexus->se_sess->se_node_acl->initiatorname);
         /*
-         * Release the SCSI I_T Nexus to the emulated SAS Target Port
+         * Release the SCSI I_T Nexus to the emulated Target Port
          */
         transport_deregister_session(tl_nexus->se_sess);
         tpg->tl_nexus = NULL;
@@ -1034,6 +1034,11 @@ static ssize_t tcm_loop_tpg_store_transport_status(
         }
         if (!strncmp(page, "offline", 7)) {
                 tl_tpg->tl_transport_status = TCM_TRANSPORT_OFFLINE;
+                if (tl_tpg->tl_nexus) {
+                        struct se_session *tl_sess = tl_tpg->tl_nexus->se_sess;
+
+                        core_allocate_nexus_loss_ua(tl_sess->se_node_acl);
+                }
                 return count;
         }
         return -EINVAL;
@@ -1077,7 +1082,7 @@ static struct se_portal_group *tcm_loop_make_naa_tpg(
         tl_tpg->tl_hba = tl_hba;
         tl_tpg->tl_tpgt = tpgt;
         /*
-         * Register the tl_tpg as a emulated SAS TCM Target Endpoint
+         * Register the tl_tpg as a emulated TCM Target Endpoint
          */
         ret = core_tpg_register(wwn, &tl_tpg->tl_se_tpg, tl_hba->tl_proto_id);
         if (ret < 0)
@@ -1102,11 +1107,11 @@ static void tcm_loop_drop_naa_tpg(
         tl_hba = tl_tpg->tl_hba;
         tpgt = tl_tpg->tl_tpgt;
         /*
-         * Release the I_T Nexus for the Virtual SAS link if present
+         * Release the I_T Nexus for the Virtual target link if present
          */
         tcm_loop_drop_nexus(tl_tpg);
         /*
-         * Deregister the tl_tpg as a emulated SAS TCM Target Endpoint
+         * Deregister the tl_tpg as a emulated TCM Target Endpoint
          */
         core_tpg_deregister(se_tpg);
 
@@ -1199,8 +1204,9 @@ static void tcm_loop_drop_scsi_hba(
                                 struct tcm_loop_hba, tl_hba_wwn);
 
         pr_debug("TCM_Loop_ConfigFS: Deallocating emulated Target"
-                " SAS Address: %s at Linux/SCSI Host ID: %d\n",
-                tl_hba->tl_wwn_address, tl_hba->sh->host_no);
+                " %s Address: %s at Linux/SCSI Host ID: %d\n",
+                tcm_loop_dump_proto_id(tl_hba), tl_hba->tl_wwn_address,
+                tl_hba->sh->host_no);
         /*
          * Call device_unregister() on the original tl_hba->dev.
          * tcm_loop_fabric_scsi.c:tcm_loop_release_adapter() will
diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
index 09e682b1c549..dcc424ac35d4 100644
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -620,8 +620,6 @@ struct se_lun_acl *core_dev_init_initiator_node_lun_acl(
 
         lacl->mapped_lun = mapped_lun;
         lacl->se_lun_nacl = nacl;
-        snprintf(lacl->initiatorname, TRANSPORT_IQN_LEN, "%s",
-                 nacl->initiatorname);
 
         return lacl;
 }
@@ -656,7 +654,7 @@ int core_dev_add_initiator_node_lun_acl(
                 " InitiatorNode: %s\n", tpg->se_tpg_tfo->get_fabric_name(),
                 tpg->se_tpg_tfo->tpg_get_tag(tpg), lun->unpacked_lun, lacl->mapped_lun,
                 (lun_access & TRANSPORT_LUNFLAGS_READ_WRITE) ? "RW" : "RO",
-                lacl->initiatorname);
+                nacl->initiatorname);
         /*
          * Check to see if there are any existing persistent reservation APTPL
          * pre-registrations that need to be enabled for this LUN ACL..
@@ -688,7 +686,7 @@ int core_dev_del_initiator_node_lun_acl(
                 " InitiatorNode: %s Mapped LUN: %llu\n",
                 tpg->se_tpg_tfo->get_fabric_name(),
                 tpg->se_tpg_tfo->tpg_get_tag(tpg), lun->unpacked_lun,
-                lacl->initiatorname, lacl->mapped_lun);
+                nacl->initiatorname, lacl->mapped_lun);
 
         return 0;
 }
@@ -701,7 +699,7 @@ void core_dev_free_initiator_node_lun_acl(
                 " Mapped LUN: %llu\n", tpg->se_tpg_tfo->get_fabric_name(),
                 tpg->se_tpg_tfo->tpg_get_tag(tpg),
                 tpg->se_tpg_tfo->get_fabric_name(),
-                lacl->initiatorname, lacl->mapped_lun);
+                lacl->se_lun_nacl->initiatorname, lacl->mapped_lun);
 
         kfree(lacl);
 }
@@ -754,7 +752,7 @@ struct se_device *target_alloc_device(struct se_hba *hba, const char *name)
         dev->dev_link_magic = SE_DEV_LINK_MAGIC;
         dev->se_hba = hba;
         dev->transport = hba->backend->ops;
-        dev->prot_length = sizeof(struct se_dif_v1_tuple);
+        dev->prot_length = sizeof(struct t10_pi_tuple);
         dev->hba_index = hba->hba_index;
 
         INIT_LIST_HEAD(&dev->dev_list);
@@ -771,7 +769,6 @@ struct se_device *target_alloc_device(struct se_hba *hba, const char *name)
         spin_lock_init(&dev->se_tmr_lock);
         spin_lock_init(&dev->qf_cmd_lock);
         sema_init(&dev->caw_sem, 1);
-        atomic_set(&dev->dev_ordered_id, 0);
         INIT_LIST_HEAD(&dev->t10_wwn.t10_vpd_list);
         spin_lock_init(&dev->t10_wwn.t10_vpd_lock);
         INIT_LIST_HEAD(&dev->t10_pr.registration_list);
diff --git a/drivers/target/target_core_fabric_configfs.c b/drivers/target/target_core_fabric_configfs.c
index 48a36989c1a6..be42429468e2 100644
--- a/drivers/target/target_core_fabric_configfs.c
+++ b/drivers/target/target_core_fabric_configfs.c
@@ -203,7 +203,7 @@ static ssize_t target_fabric_mappedlun_store_write_protect(
         pr_debug("%s_ConfigFS: Changed Initiator ACL: %s"
                 " Mapped LUN: %llu Write Protect bit to %s\n",
                 se_tpg->se_tpg_tfo->get_fabric_name(),
-                lacl->initiatorname, lacl->mapped_lun, (op) ? "ON" : "OFF");
+                se_nacl->initiatorname, lacl->mapped_lun, (op) ? "ON" : "OFF");
 
         return count;
 
diff --git a/drivers/target/target_core_hba.c b/drivers/target/target_core_hba.c
index be9cefc07407..9522960c7fdd 100644
--- a/drivers/target/target_core_hba.c
+++ b/drivers/target/target_core_hba.c
@@ -184,3 +184,8 @@ core_delete_hba(struct se_hba *hba)
         kfree(hba);
         return 0;
 }
+
+bool target_sense_desc_format(struct se_device *dev)
+{
+        return dev->transport->get_blocks(dev) > U32_MAX;
+}
diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
index e318ddbe15da..0b4b2a67d9f9 100644
--- a/drivers/target/target_core_sbc.c
+++ b/drivers/target/target_core_sbc.c
@@ -154,6 +154,38 @@ sbc_emulate_readcapacity_16(struct se_cmd *cmd)
         return 0;
 }
 
+static sense_reason_t
+sbc_emulate_startstop(struct se_cmd *cmd)
+{
+        unsigned char *cdb = cmd->t_task_cdb;
+
+        /*
+         * See sbc3r36 section 5.25
+         * Immediate bit should be set since there is nothing to complete
+         * POWER CONDITION MODIFIER 0h
+         */
+        if (!(cdb[1] & 1) || cdb[2] || cdb[3])
+                return TCM_INVALID_CDB_FIELD;
+
+        /*
+         * See sbc3r36 section 5.25
+         * POWER CONDITION 0h START_VALID - process START and LOEJ
+         */
+        if (cdb[4] >> 4 & 0xf)
+                return TCM_INVALID_CDB_FIELD;
+
+        /*
+         * See sbc3r36 section 5.25
+         * LOEJ 0h - nothing to load or unload
+         * START 1h - we are ready
+         */
+        if (!(cdb[4] & 1) || (cdb[4] & 2) || (cdb[4] & 4))
+                return TCM_INVALID_CDB_FIELD;
+
+        target_complete_cmd(cmd, SAM_STAT_GOOD);
+        return 0;
+}
+
 sector_t sbc_get_write_same_sectors(struct se_cmd *cmd)
 {
         u32 num_blocks;
@@ -960,6 +992,9 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops)
                                " than 1\n", sectors);
                         return TCM_INVALID_CDB_FIELD;
                 }
+                if (sbc_check_dpofua(dev, cmd, cdb))
+                        return TCM_INVALID_CDB_FIELD;
+
                 /*
                  * Double size because we have two buffers, note that
                  * zero is not an error..
@@ -1069,6 +1104,10 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops)
                 size = 0;
                 cmd->execute_cmd = sbc_emulate_noop;
                 break;
+        case START_STOP:
+                size = 0;
+                cmd->execute_cmd = sbc_emulate_startstop;
+                break;
         default:
                 ret = spc_parse_cdb(cmd, &size);
                 if (ret)
@@ -1191,7 +1230,7 @@ void
 sbc_dif_generate(struct se_cmd *cmd)
 {
         struct se_device *dev = cmd->se_dev;
-        struct se_dif_v1_tuple *sdt;
+        struct t10_pi_tuple *sdt;
         struct scatterlist *dsg = cmd->t_data_sg, *psg;
         sector_t sector = cmd->t_task_lba;
         void *daddr, *paddr;
@@ -1203,7 +1242,7 @@ sbc_dif_generate(struct se_cmd *cmd)
                 daddr = kmap_atomic(sg_page(dsg)) + dsg->offset;
 
                 for (j = 0; j < psg->length;
-                                j += sizeof(struct se_dif_v1_tuple)) {
+                                j += sizeof(*sdt)) {
                         __u16 crc;
                         unsigned int avail;
 
@@ -1256,7 +1295,7 @@ sbc_dif_generate(struct se_cmd *cmd)
 }
 
 static sense_reason_t
-sbc_dif_v1_verify(struct se_cmd *cmd, struct se_dif_v1_tuple *sdt,
+sbc_dif_v1_verify(struct se_cmd *cmd, struct t10_pi_tuple *sdt,
                   __u16 crc, sector_t sector, unsigned int ei_lba)
 {
         __be16 csum;
@@ -1346,7 +1385,7 @@ sbc_dif_verify(struct se_cmd *cmd, sector_t start, unsigned int sectors,
                unsigned int ei_lba, struct scatterlist *psg, int psg_off)
 {
         struct se_device *dev = cmd->se_dev;
-        struct se_dif_v1_tuple *sdt;
+        struct t10_pi_tuple *sdt;
         struct scatterlist *dsg = cmd->t_data_sg;
         sector_t sector = start;
         void *daddr, *paddr;
@@ -1361,7 +1400,7 @@ sbc_dif_verify(struct se_cmd *cmd, sector_t start, unsigned int sectors,
 
                 for (i = psg_off; i < psg->length &&
                                 sector < start + sectors;
-                                i += sizeof(struct se_dif_v1_tuple)) {
+                                i += sizeof(*sdt)) {
                         __u16 crc;
                         unsigned int avail;
 
diff --git a/drivers/target/target_core_spc.c b/drivers/target/target_core_spc.c
index f87d4cef6d39..9413e1a949e5 100644
--- a/drivers/target/target_core_spc.c
+++ b/drivers/target/target_core_spc.c
@@ -484,8 +484,8 @@ static sense_reason_t
 spc_emulate_evpd_b0(struct se_cmd *cmd, unsigned char *buf)
 {
         struct se_device *dev = cmd->se_dev;
-        int have_tp = 0;
-        int opt, min;
+        u32 mtl = 0;
+        int have_tp = 0, opt, min;
 
         /*
          * Following spc3r22 section 6.5.3 Block Limits VPD page, when
@@ -516,8 +516,15 @@ spc_emulate_evpd_b0(struct se_cmd *cmd, unsigned char *buf)
 
         /*
          * Set MAXIMUM TRANSFER LENGTH
+         *
+         * XXX: Currently assumes single PAGE_SIZE per scatterlist for fabrics
+         * enforcing maximum HW scatter-gather-list entry limit
          */
-        put_unaligned_be32(dev->dev_attrib.hw_max_sectors, &buf[8]);
+        if (cmd->se_tfo->max_data_sg_nents) {
+                mtl = (cmd->se_tfo->max_data_sg_nents * PAGE_SIZE) /
+                       dev->dev_attrib.block_size;
+        }
+        put_unaligned_be32(min_not_zero(mtl, dev->dev_attrib.hw_max_sectors), &buf[8]);
 
         /*
          * Set OPTIMAL TRANSFER LENGTH
@@ -768,7 +775,12 @@ static int spc_modesense_control(struct se_cmd *cmd, u8 pc, u8 *p)
         if (pc == 1)
                 goto out;
 
-        p[2] = 2;
+        /* GLTSD: No implicit save of log parameters */
+        p[2] = (1 << 1);
+        if (target_sense_desc_format(dev))
+                /* D_SENSE: Descriptor format sense data for 64bit sectors */
+                p[2] |= (1 << 2);
+
         /*
          * From spc4r23, 7.4.7 Control mode page
          *
@@ -1151,6 +1163,7 @@ static sense_reason_t spc_emulate_request_sense(struct se_cmd *cmd)
         unsigned char *rbuf;
         u8 ua_asc = 0, ua_ascq = 0;
         unsigned char buf[SE_SENSE_BUF];
+        bool desc_format = target_sense_desc_format(cmd->se_dev);
 
         memset(buf, 0, SE_SENSE_BUF);
 
@@ -1164,32 +1177,11 @@ static sense_reason_t spc_emulate_request_sense(struct se_cmd *cmd)
         if (!rbuf)
                 return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
 
-        if (!core_scsi3_ua_clear_for_request_sense(cmd, &ua_asc, &ua_ascq)) {
-                /*
-                 * CURRENT ERROR, UNIT ATTENTION
-                 */
-                buf[0] = 0x70;
-                buf[SPC_SENSE_KEY_OFFSET] = UNIT_ATTENTION;
-
-                /*
-                 * The Additional Sense Code (ASC) from the UNIT ATTENTION
-                 */
-                buf[SPC_ASC_KEY_OFFSET] = ua_asc;
-                buf[SPC_ASCQ_KEY_OFFSET] = ua_ascq;
-                buf[7] = 0x0A;
-        } else {
-                /*
-                 * CURRENT ERROR, NO SENSE
-                 */
-                buf[0] = 0x70;
-                buf[SPC_SENSE_KEY_OFFSET] = NO_SENSE;
-
-                /*
-                 * NO ADDITIONAL SENSE INFORMATION
-                 */
-                buf[SPC_ASC_KEY_OFFSET] = 0x00;
-                buf[7] = 0x0A;
-        }
+        if (!core_scsi3_ua_clear_for_request_sense(cmd, &ua_asc, &ua_ascq))
+                scsi_build_sense_buffer(desc_format, buf, UNIT_ATTENTION,
+                                        ua_asc, ua_ascq);
+        else
+                scsi_build_sense_buffer(desc_format, buf, NO_SENSE, 0x0, 0x0);
 
         memcpy(rbuf, buf, min_t(u32, sizeof(buf), cmd->data_length));
         transport_kunmap_data_sg(cmd);
@@ -1418,9 +1410,6 @@ spc_parse_cdb(struct se_cmd *cmd, unsigned int *size)
                 }
                 break;
         default:
-                pr_warn("TARGET_CORE[%s]: Unsupported SCSI Opcode"
-                        " 0x%02x, sending CHECK_CONDITION.\n",
-                        cmd->se_tfo->get_fabric_name(), cdb[0]);
                 return TCM_UNSUPPORTED_SCSI_OPCODE;
         }
 
diff --git a/drivers/target/target_core_tpg.c b/drivers/target/target_core_tpg.c
index babde4ad841f..2d0381dd105c 100644
--- a/drivers/target/target_core_tpg.c
+++ b/drivers/target/target_core_tpg.c
@@ -41,6 +41,7 @@
 #include "target_core_internal.h"
 #include "target_core_alua.h"
 #include "target_core_pr.h"
+#include "target_core_ua.h"
 
 extern struct se_device *g_lun0_dev;
 
@@ -83,6 +84,22 @@ struct se_node_acl *core_tpg_get_initiator_node_acl(
 }
 EXPORT_SYMBOL(core_tpg_get_initiator_node_acl);
 
+void core_allocate_nexus_loss_ua(
+        struct se_node_acl *nacl)
+{
+        struct se_dev_entry *deve;
+
+        if (!nacl)
+                return;
+
+        rcu_read_lock();
+        hlist_for_each_entry_rcu(deve, &nacl->lun_entry_hlist, link)
+                core_scsi3_ua_allocate(deve, 0x29,
+                        ASCQ_29H_NEXUS_LOSS_OCCURRED);
+        rcu_read_unlock();
+}
+EXPORT_SYMBOL(core_allocate_nexus_loss_ua);
+
 /*      core_tpg_add_node_to_devs():
  *
  *
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index ce8574b7220c..5bacc7b5ed6d 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -39,6 +39,7 @@
 #include <net/sock.h>
 #include <net/tcp.h>
 #include <scsi/scsi_proto.h>
+#include <scsi/scsi_common.h>
 
 #include <target/target_core_base.h>
 #include <target/target_core_backend.h>
@@ -1074,6 +1075,55 @@ transport_set_vpd_ident(struct t10_vpd *vpd, unsigned char *page_83)
 }
 EXPORT_SYMBOL(transport_set_vpd_ident);
 
+static sense_reason_t
+target_check_max_data_sg_nents(struct se_cmd *cmd, struct se_device *dev,
+                               unsigned int size)
+{
+        u32 mtl;
+
+        if (!cmd->se_tfo->max_data_sg_nents)
+                return TCM_NO_SENSE;
+        /*
+         * Check if fabric enforced maximum SGL entries per I/O descriptor
+         * exceeds se_cmd->data_length.  If true, set SCF_UNDERFLOW_BIT +
+         * residual_count and reduce original cmd->data_length to maximum
+         * length based on single PAGE_SIZE entry scatter-lists.
+         */
+        mtl = (cmd->se_tfo->max_data_sg_nents * PAGE_SIZE);
+        if (cmd->data_length > mtl) {
+                /*
+                 * If an existing CDB overflow is present, calculate new residual
+                 * based on CDB size minus fabric maximum transfer length.
+                 *
+                 * If an existing CDB underflow is present, calculate new residual
+                 * based on original cmd->data_length minus fabric maximum transfer
+                 * length.
+                 *
+                 * Otherwise, set the underflow residual based on cmd->data_length
+                 * minus fabric maximum transfer length.
+                 */
+                if (cmd->se_cmd_flags & SCF_OVERFLOW_BIT) {
+                        cmd->residual_count = (size - mtl);
+                } else if (cmd->se_cmd_flags & SCF_UNDERFLOW_BIT) {
+                        u32 orig_dl = size + cmd->residual_count;
+                        cmd->residual_count = (orig_dl - mtl);
+                } else {
+                        cmd->se_cmd_flags |= SCF_UNDERFLOW_BIT;
+                        cmd->residual_count = (cmd->data_length - mtl);
+                }
+                cmd->data_length = mtl;
+                /*
+                 * Reset sbc_check_prot() calculated protection payload
+                 * length based upon the new smaller MTL.
+                 */
+                if (cmd->prot_length) {
+                        u32 sectors = (mtl / dev->dev_attrib.block_size);
+                        cmd->prot_length = dev->prot_length * sectors;
+                }
+        }
+        return TCM_NO_SENSE;
+}
+
 sense_reason_t
 target_cmd_size_check(struct se_cmd *cmd, unsigned int size)
 {
@@ -1087,9 +1137,9 @@ target_cmd_size_check(struct se_cmd *cmd, unsigned int size)
                         " 0x%02x\n", cmd->se_tfo->get_fabric_name(),
                                 cmd->data_length, size, cmd->t_task_cdb[0]);
 
-                if (cmd->data_direction == DMA_TO_DEVICE) {
-                        pr_err("Rejecting underflow/overflow"
-                                        " WRITE data\n");
+                if (cmd->data_direction == DMA_TO_DEVICE &&
+                    cmd->se_cmd_flags & SCF_SCSI_DATA_CDB) {
+                        pr_err("Rejecting underflow/overflow WRITE data\n");
                         return TCM_INVALID_CDB_FIELD;
                 }
                 /*
@@ -1119,7 +1169,7 @@ target_cmd_size_check(struct se_cmd *cmd, unsigned int size)
                 }
         }
 
-        return 0;
+        return target_check_max_data_sg_nents(cmd, dev, size);
 
 }
 
@@ -1177,14 +1227,7 @@ transport_check_alloc_task_attr(struct se_cmd *cmd)
                         " emulation is not supported\n");
                 return TCM_INVALID_CDB_FIELD;
         }
-        /*
-         * Used to determine when ORDERED commands should go from
-         * Dormant to Active status.
-         */
-        cmd->se_ordered_id = atomic_inc_return(&dev->dev_ordered_id);
-        pr_debug("Allocated se_ordered_id: %u for Task Attr: 0x%02x on %s\n",
-                        cmd->se_ordered_id, cmd->sam_task_attr,
-                        dev->transport->name);
+
         return 0;
 }
 
@@ -1246,6 +1289,11 @@ target_setup_cmd_from_cdb(struct se_cmd *cmd, unsigned char *cdb)
         }
 
         ret = dev->transport->parse_cdb(cmd);
+        if (ret == TCM_UNSUPPORTED_SCSI_OPCODE)
+                pr_warn_ratelimited("%s/%s: Unsupported SCSI Opcode 0x%02x, sending CHECK_CONDITION.\n",
+                                    cmd->se_tfo->get_fabric_name(),
+                                    cmd->se_sess->se_node_acl->initiatorname,
+                                    cmd->t_task_cdb[0]);
         if (ret)
                 return ret;
 
@@ -1693,8 +1741,7 @@ void transport_generic_request_failure(struct se_cmd *cmd,
 
 check_stop:
         transport_lun_remove_cmd(cmd);
-        if (!transport_cmd_check_stop_to_fabric(cmd))
-                ;
+        transport_cmd_check_stop_to_fabric(cmd);
         return;
 
 queue_full:
@@ -1767,16 +1814,14 @@ static bool target_handle_task_attr(struct se_cmd *cmd)
          */
         switch (cmd->sam_task_attr) {
         case TCM_HEAD_TAG:
-                pr_debug("Added HEAD_OF_QUEUE for CDB: 0x%02x, "
-                         "se_ordered_id: %u\n",
-                         cmd->t_task_cdb[0], cmd->se_ordered_id);
+                pr_debug("Added HEAD_OF_QUEUE for CDB: 0x%02x\n",
+                         cmd->t_task_cdb[0]);
                 return false;
         case TCM_ORDERED_TAG:
                 atomic_inc_mb(&dev->dev_ordered_sync);
 
-                pr_debug("Added ORDERED for CDB: 0x%02x to ordered list, "
-                         " se_ordered_id: %u\n",
-                         cmd->t_task_cdb[0], cmd->se_ordered_id);
+                pr_debug("Added ORDERED for CDB: 0x%02x to ordered list\n",
+                         cmd->t_task_cdb[0]);
 
                 /*
                  * Execute an ORDERED command if no other older commands
@@ -1800,10 +1845,8 @@ static bool target_handle_task_attr(struct se_cmd *cmd)
         list_add_tail(&cmd->se_delayed_node, &dev->delayed_cmd_list);
         spin_unlock(&dev->delayed_cmd_lock);
 
-        pr_debug("Added CDB: 0x%02x Task Attr: 0x%02x to"
-                " delayed CMD list, se_ordered_id: %u\n",
-                cmd->t_task_cdb[0], cmd->sam_task_attr,
-                cmd->se_ordered_id);
+        pr_debug("Added CDB: 0x%02x Task Attr: 0x%02x to delayed CMD listn",
+                cmd->t_task_cdb[0], cmd->sam_task_attr);
         return true;
 }
 
@@ -1888,20 +1931,18 @@ static void transport_complete_task_attr(struct se_cmd *cmd)
         if (cmd->sam_task_attr == TCM_SIMPLE_TAG) {
                 atomic_dec_mb(&dev->simple_cmds);
                 dev->dev_cur_ordered_id++;
-                pr_debug("Incremented dev->dev_cur_ordered_id: %u for"
-                        " SIMPLE: %u\n", dev->dev_cur_ordered_id,
-                        cmd->se_ordered_id);
+                pr_debug("Incremented dev->dev_cur_ordered_id: %u for SIMPLE\n",
+                         dev->dev_cur_ordered_id);
         } else if (cmd->sam_task_attr == TCM_HEAD_TAG) {
                 dev->dev_cur_ordered_id++;
-                pr_debug("Incremented dev_cur_ordered_id: %u for"
-                        " HEAD_OF_QUEUE: %u\n", dev->dev_cur_ordered_id,
-                        cmd->se_ordered_id);
+                pr_debug("Incremented dev_cur_ordered_id: %u for HEAD_OF_QUEUE\n",
+                         dev->dev_cur_ordered_id);
         } else if (cmd->sam_task_attr == TCM_ORDERED_TAG) {
                 atomic_dec_mb(&dev->dev_ordered_sync);
 
                 dev->dev_cur_ordered_id++;
-                pr_debug("Incremented dev_cur_ordered_id: %u for ORDERED:"
-                        " %u\n", dev->dev_cur_ordered_id, cmd->se_ordered_id);
+                pr_debug("Incremented dev_cur_ordered_id: %u for ORDERED\n",
+                         dev->dev_cur_ordered_id);
         }
 
         target_restart_delayed_cmds(dev);
@@ -2615,37 +2656,159 @@ bool transport_wait_for_tasks(struct se_cmd *cmd)
 }
 EXPORT_SYMBOL(transport_wait_for_tasks);
 
-static int transport_get_sense_codes(
-        struct se_cmd *cmd,
-        u8 *asc,
-        u8 *ascq)
+struct sense_info {
+        u8 key;
+        u8 asc;
+        u8 ascq;
+        bool add_sector_info;
+};
+
+static const struct sense_info sense_info_table[] = {
+        [TCM_NO_SENSE] = {
+                .key = NOT_READY
+        },
+        [TCM_NON_EXISTENT_LUN] = {
+                .key = ILLEGAL_REQUEST,
+                .asc = 0x25 /* LOGICAL UNIT NOT SUPPORTED */
+        },
+        [TCM_UNSUPPORTED_SCSI_OPCODE] = {
+                .key = ILLEGAL_REQUEST,
+                .asc = 0x20, /* INVALID COMMAND OPERATION CODE */
+        },
+        [TCM_SECTOR_COUNT_TOO_MANY] = {
+                .key = ILLEGAL_REQUEST,
+                .asc = 0x20, /* INVALID COMMAND OPERATION CODE */
+        },
+        [TCM_UNKNOWN_MODE_PAGE] = {
+                .key = ILLEGAL_REQUEST,
+                .asc = 0x24, /* INVALID FIELD IN CDB */
+        },
+        [TCM_CHECK_CONDITION_ABORT_CMD] = {
+                .key = ABORTED_COMMAND,
+                .asc = 0x29, /* BUS DEVICE RESET FUNCTION OCCURRED */
+                .ascq = 0x03,
+        },
+        [TCM_INCORRECT_AMOUNT_OF_DATA] = {
+                .key = ABORTED_COMMAND,
+                .asc = 0x0c, /* WRITE ERROR */
+                .ascq = 0x0d, /* NOT ENOUGH UNSOLICITED DATA */
+        },
+        [TCM_INVALID_CDB_FIELD] = {
+                .key = ILLEGAL_REQUEST,
+                .asc = 0x24, /* INVALID FIELD IN CDB */
+        },
+        [TCM_INVALID_PARAMETER_LIST] = {
+                .key = ILLEGAL_REQUEST,
+                .asc = 0x26, /* INVALID FIELD IN PARAMETER LIST */
+        },
+        [TCM_PARAMETER_LIST_LENGTH_ERROR] = {
+                .key = ILLEGAL_REQUEST,
+                .asc = 0x1a, /* PARAMETER LIST LENGTH ERROR */
+        },
+        [TCM_UNEXPECTED_UNSOLICITED_DATA] = {
+                .key = ILLEGAL_REQUEST,
+                .asc = 0x0c, /* WRITE ERROR */
+                .ascq = 0x0c, /* UNEXPECTED_UNSOLICITED_DATA */
+        },
+        [TCM_SERVICE_CRC_ERROR] = {
+                .key = ABORTED_COMMAND,
+                .asc = 0x47, /* PROTOCOL SERVICE CRC ERROR */
+                .ascq = 0x05, /* N/A */
+        },
+        [TCM_SNACK_REJECTED] = {
+                .key = ABORTED_COMMAND,
+                .asc = 0x11, /* READ ERROR */
+                .ascq = 0x13, /* FAILED RETRANSMISSION REQUEST */
+        },
+        [TCM_WRITE_PROTECTED] = {
+                .key = DATA_PROTECT,
+                .asc = 0x27, /* WRITE PROTECTED */
+        },
+        [TCM_ADDRESS_OUT_OF_RANGE] = {
+                .key = ILLEGAL_REQUEST,
+                .asc = 0x21, /* LOGICAL BLOCK ADDRESS OUT OF RANGE */
+        },
+        [TCM_CHECK_CONDITION_UNIT_ATTENTION] = {
+                .key = UNIT_ATTENTION,
+        },
+        [TCM_CHECK_CONDITION_NOT_READY] = {
+                .key = NOT_READY,
+        },
+        [TCM_MISCOMPARE_VERIFY] = {
+                .key = MISCOMPARE,
+                .asc = 0x1d, /* MISCOMPARE DURING VERIFY OPERATION */
+                .ascq = 0x00,
+        },
+        [TCM_LOGICAL_BLOCK_GUARD_CHECK_FAILED] = {
+                .key = ABORTED_COMMAND,
+                .asc = 0x10,
+                .ascq = 0x01, /* LOGICAL BLOCK GUARD CHECK FAILED */
+                .add_sector_info = true,
+        },
+        [TCM_LOGICAL_BLOCK_APP_TAG_CHECK_FAILED] = {
+                .key = ABORTED_COMMAND,
+                .asc = 0x10,
+                .ascq = 0x02, /* LOGICAL BLOCK APPLICATION TAG CHECK FAILED */
+                .add_sector_info = true,
+        },
+        [TCM_LOGICAL_BLOCK_REF_TAG_CHECK_FAILED] = {
+                .key = ABORTED_COMMAND,
+                .asc = 0x10,
+                .ascq = 0x03, /* LOGICAL BLOCK REFERENCE TAG CHECK FAILED */
+                .add_sector_info = true,
+        },
+        [TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE] = {
+                /*
+                 * Returning ILLEGAL REQUEST would cause immediate IO errors on
+                 * Solaris initiators.  Returning NOT READY instead means the
+                 * operations will be retried a finite number of times and we
+                 * can survive intermittent errors.
+                 */
+                .key = NOT_READY,
+                .asc = 0x08, /* LOGICAL UNIT COMMUNICATION FAILURE */
+        },
+};
+
+static int translate_sense_reason(struct se_cmd *cmd, sense_reason_t reason)
 {
-        *asc = cmd->scsi_asc;
-        *ascq = cmd->scsi_ascq;
+        const struct sense_info *si;
+        u8 *buffer = cmd->sense_buffer;
+        int r = (__force int)reason;
+        u8 asc, ascq;
+        bool desc_format = target_sense_desc_format(cmd->se_dev);
 
-        return 0;
-}
+        if (r < ARRAY_SIZE(sense_info_table) && sense_info_table[r].key)
+                si = &sense_info_table[r];
+        else
+                si = &sense_info_table[(__force int)
+                                       TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE];
 
-static
-void transport_err_sector_info(unsigned char *buffer, sector_t bad_sector)
-{
-        /* Place failed LBA in sense data information descriptor 0. */
-        buffer[SPC_ADD_SENSE_LEN_OFFSET] = 0xc;
-        buffer[SPC_DESC_TYPE_OFFSET] = 0; /* Information */
-        buffer[SPC_ADDITIONAL_DESC_LEN_OFFSET] = 0xa;
-        buffer[SPC_VALIDITY_OFFSET] = 0x80;
+        if (reason == TCM_CHECK_CONDITION_UNIT_ATTENTION) {
+                core_scsi3_ua_for_check_condition(cmd, &asc, &ascq);
+                WARN_ON_ONCE(asc == 0);
+        } else if (si->asc == 0) {
+                WARN_ON_ONCE(cmd->scsi_asc == 0);
+                asc = cmd->scsi_asc;
+                ascq = cmd->scsi_ascq;
+        } else {
+                asc = si->asc;
+                ascq = si->ascq;
+        }
+
+        scsi_build_sense_buffer(desc_format, buffer, si->key, asc, ascq);
+        if (si->add_sector_info)
+                return scsi_set_sense_information(buffer,
+                                                  cmd->scsi_sense_length,
+                                                  cmd->bad_sector);
 
-        /* Descriptor Information: failing sector */
-        put_unaligned_be64(bad_sector, &buffer[12]);
+        return 0;
 }
 
 int
 transport_send_check_condition_and_sense(struct se_cmd *cmd,
                 sense_reason_t reason, int from_transport)
 {
-        unsigned char *buffer = cmd->sense_buffer;
         unsigned long flags;
-        u8 asc = 0, ascq = 0;
 
         spin_lock_irqsave(&cmd->t_state_lock, flags);
         if (cmd->se_cmd_flags & SCF_SENT_CHECK_CONDITION) {
@@ -2655,243 +2818,17 @@ transport_send_check_condition_and_sense(struct se_cmd *cmd,
         cmd->se_cmd_flags |= SCF_SENT_CHECK_CONDITION;
         spin_unlock_irqrestore(&cmd->t_state_lock, flags);
 
-        if (!reason && from_transport)
-                goto after_reason;
+        if (!from_transport) {
+                int rc;
 
-        if (!from_transport)
                 cmd->se_cmd_flags |= SCF_EMULATED_TASK_SENSE;
-
-        /*
-         * Actual SENSE DATA, see SPC-3 7.23.2  SPC_SENSE_KEY_OFFSET uses
-         * SENSE KEY values from include/scsi/scsi.h
-         */
-        switch (reason) {
-        case TCM_NO_SENSE:
-                /* CURRENT ERROR */
-                buffer[0] = 0x70;
-                buffer[SPC_ADD_SENSE_LEN_OFFSET] = 10;
-                /* Not Ready */
-                buffer[SPC_SENSE_KEY_OFFSET] = NOT_READY;
-                /* NO ADDITIONAL SENSE INFORMATION */
-                buffer[SPC_ASC_KEY_OFFSET] = 0;
-                buffer[SPC_ASCQ_KEY_OFFSET] = 0;
-                break;
-        case TCM_NON_EXISTENT_LUN:
-                /* CURRENT ERROR */
-                buffer[0] = 0x70;
-                buffer[SPC_ADD_SENSE_LEN_OFFSET] = 10;
-                /* ILLEGAL REQUEST */
-                buffer[SPC_SENSE_KEY_OFFSET] = ILLEGAL_REQUEST;
-                /* LOGICAL UNIT NOT SUPPORTED */
-                buffer[SPC_ASC_KEY_OFFSET] = 0x25;
-                break;
-        case TCM_UNSUPPORTED_SCSI_OPCODE:
-        case TCM_SECTOR_COUNT_TOO_MANY:
-                /* CURRENT ERROR */
-                buffer[0] = 0x70;
-                buffer[SPC_ADD_SENSE_LEN_OFFSET] = 10;
-                /* ILLEGAL REQUEST */
-                buffer[SPC_SENSE_KEY_OFFSET] = ILLEGAL_REQUEST;
-                /* INVALID COMMAND OPERATION CODE */
-                buffer[SPC_ASC_KEY_OFFSET] = 0x20;
-                break;
-        case TCM_UNKNOWN_MODE_PAGE:
-                /* CURRENT ERROR */
-                buffer[0] = 0x70;
-                buffer[SPC_ADD_SENSE_LEN_OFFSET] = 10;
-                /* ILLEGAL REQUEST */
-                buffer[SPC_SENSE_KEY_OFFSET] = ILLEGAL_REQUEST;
-                /* INVALID FIELD IN CDB */
-                buffer[SPC_ASC_KEY_OFFSET] = 0x24;
-                break;
-        case TCM_CHECK_CONDITION_ABORT_CMD:
-                /* CURRENT ERROR */
-                buffer[0] = 0x70;
-                buffer[SPC_ADD_SENSE_LEN_OFFSET] = 10;
-                /* ABORTED COMMAND */
-                buffer[SPC_SENSE_KEY_OFFSET] = ABORTED_COMMAND;
-                /* BUS DEVICE RESET FUNCTION OCCURRED */
-                buffer[SPC_ASC_KEY_OFFSET] = 0x29;
-                buffer[SPC_ASCQ_KEY_OFFSET] = 0x03;
-                break;
-        case TCM_INCORRECT_AMOUNT_OF_DATA:
-                /* CURRENT ERROR */
-                buffer[0] = 0x70;
-                buffer[SPC_ADD_SENSE_LEN_OFFSET] = 10;
-                /* ABORTED COMMAND */
-                buffer[SPC_SENSE_KEY_OFFSET] = ABORTED_COMMAND;
-                /* WRITE ERROR */
-                buffer[SPC_ASC_KEY_OFFSET] = 0x0c;
-                /* NOT ENOUGH UNSOLICITED DATA */
-                buffer[SPC_ASCQ_KEY_OFFSET] = 0x0d;
-                break;
-        case TCM_INVALID_CDB_FIELD:
-                /* CURRENT ERROR */
-                buffer[0] = 0x70;
-                buffer[SPC_ADD_SENSE_LEN_OFFSET] = 10;
-                /* ILLEGAL REQUEST */
-                buffer[SPC_SENSE_KEY_OFFSET] = ILLEGAL_REQUEST;
-                /* INVALID FIELD IN CDB */
-                buffer[SPC_ASC_KEY_OFFSET] = 0x24;
-                break;
-        case TCM_INVALID_PARAMETER_LIST:
-                /* CURRENT ERROR */
-                buffer[0] = 0x70;
-                buffer[SPC_ADD_SENSE_LEN_OFFSET] = 10;
-                /* ILLEGAL REQUEST */
-                buffer[SPC_SENSE_KEY_OFFSET] = ILLEGAL_REQUEST;
-                /* INVALID FIELD IN PARAMETER LIST */
-                buffer[SPC_ASC_KEY_OFFSET] = 0x26;
-                break;
-        case TCM_PARAMETER_LIST_LENGTH_ERROR:
-                /* CURRENT ERROR */
-                buffer[0] = 0x70;
-                buffer[SPC_ADD_SENSE_LEN_OFFSET] = 10;
-                /* ILLEGAL REQUEST */
-                buffer[SPC_SENSE_KEY_OFFSET] = ILLEGAL_REQUEST;
-                /* PARAMETER LIST LENGTH ERROR */
-                buffer[SPC_ASC_KEY_OFFSET] = 0x1a;
-                break;
-        case TCM_UNEXPECTED_UNSOLICITED_DATA:
-                /* CURRENT ERROR */
-                buffer[0] = 0x70;
-                buffer[SPC_ADD_SENSE_LEN_OFFSET] = 10;
-                /* ABORTED COMMAND */
-                buffer[SPC_SENSE_KEY_OFFSET] = ABORTED_COMMAND;
-                /* WRITE ERROR */
-                buffer[SPC_ASC_KEY_OFFSET] = 0x0c;
-                /* UNEXPECTED_UNSOLICITED_DATA */
-                buffer[SPC_ASCQ_KEY_OFFSET] = 0x0c;
-                break;
-        case TCM_SERVICE_CRC_ERROR:
-                /* CURRENT ERROR */
-                buffer[0] = 0x70;
-                buffer[SPC_ADD_SENSE_LEN_OFFSET] = 10;
-                /* ABORTED COMMAND */
-                buffer[SPC_SENSE_KEY_OFFSET] = ABORTED_COMMAND;
-                /* PROTOCOL SERVICE CRC ERROR */
-                buffer[SPC_ASC_KEY_OFFSET] = 0x47;
-                /* N/A */
-                buffer[SPC_ASCQ_KEY_OFFSET] = 0x05;
-                break;
-        case TCM_SNACK_REJECTED:
-                /* CURRENT ERROR */
-                buffer[0] = 0x70;
-                buffer[SPC_ADD_SENSE_LEN_OFFSET] = 10;
-                /* ABORTED COMMAND */
-                buffer[SPC_SENSE_KEY_OFFSET] = ABORTED_COMMAND;
-                /* READ ERROR */
-                buffer[SPC_ASC_KEY_OFFSET] = 0x11;
-                /* FAILED RETRANSMISSION REQUEST */
-                buffer[SPC_ASCQ_KEY_OFFSET] = 0x13;
-                break;
-        case TCM_WRITE_PROTECTED:
-                /* CURRENT ERROR */
-                buffer[0] = 0x70;
-                buffer[SPC_ADD_SENSE_LEN_OFFSET] = 10;
-                /* DATA PROTECT */
-                buffer[SPC_SENSE_KEY_OFFSET] = DATA_PROTECT;
-                /* WRITE PROTECTED */
-                buffer[SPC_ASC_KEY_OFFSET] = 0x27;
-                break;
-        case TCM_ADDRESS_OUT_OF_RANGE:
-                /* CURRENT ERROR */
-                buffer[0] = 0x70;
-                buffer[SPC_ADD_SENSE_LEN_OFFSET] = 10;
-                /* ILLEGAL REQUEST */
-                buffer[SPC_SENSE_KEY_OFFSET] = ILLEGAL_REQUEST;
-                /* LOGICAL BLOCK ADDRESS OUT OF RANGE */
-                buffer[SPC_ASC_KEY_OFFSET] = 0x21;
-                break;
-        case TCM_CHECK_CONDITION_UNIT_ATTENTION:
-                /* CURRENT ERROR */
-                buffer[0] = 0x70;
-                buffer[SPC_ADD_SENSE_LEN_OFFSET] = 10;
-                /* UNIT ATTENTION */
-                buffer[SPC_SENSE_KEY_OFFSET] = UNIT_ATTENTION;
-                core_scsi3_ua_for_check_condition(cmd, &asc, &ascq);
-                buffer[SPC_ASC_KEY_OFFSET] = asc;
-                buffer[SPC_ASCQ_KEY_OFFSET] = ascq;
-                break;
-        case TCM_CHECK_CONDITION_NOT_READY:
-                /* CURRENT ERROR */
-                buffer[0] = 0x70;
-                buffer[SPC_ADD_SENSE_LEN_OFFSET] = 10;
-                /* Not Ready */
-                buffer[SPC_SENSE_KEY_OFFSET] = NOT_READY;
-                transport_get_sense_codes(cmd, &asc, &ascq);
-                buffer[SPC_ASC_KEY_OFFSET] = asc;
-                buffer[SPC_ASCQ_KEY_OFFSET] = ascq;
-                break;
-        case TCM_MISCOMPARE_VERIFY:
-                /* CURRENT ERROR */
-                buffer[0] = 0x70;
-                buffer[SPC_ADD_SENSE_LEN_OFFSET] = 10;
-                buffer[SPC_SENSE_KEY_OFFSET] = MISCOMPARE;
-                /* MISCOMPARE DURING VERIFY OPERATION */
-                buffer[SPC_ASC_KEY_OFFSET] = 0x1d;
-                buffer[SPC_ASCQ_KEY_OFFSET] = 0x00;
-                break;
-        case TCM_LOGICAL_BLOCK_GUARD_CHECK_FAILED:
-                /* CURRENT ERROR */
-                buffer[0] = 0x70;
-                buffer[SPC_ADD_SENSE_LEN_OFFSET] = 10;
-                /* ILLEGAL REQUEST */
-                buffer[SPC_SENSE_KEY_OFFSET] = ILLEGAL_REQUEST;
-                /* LOGICAL BLOCK GUARD CHECK FAILED */
-                buffer[SPC_ASC_KEY_OFFSET] = 0x10;
-                buffer[SPC_ASCQ_KEY_OFFSET] = 0x01;
-                transport_err_sector_info(buffer, cmd->bad_sector);
-                break;
-        case TCM_LOGICAL_BLOCK_APP_TAG_CHECK_FAILED:
-                /* CURRENT ERROR */
-                buffer[0] = 0x70;
-                buffer[SPC_ADD_SENSE_LEN_OFFSET] = 10;
-                /* ILLEGAL REQUEST */
-                buffer[SPC_SENSE_KEY_OFFSET] = ILLEGAL_REQUEST;
-                /* LOGICAL BLOCK APPLICATION TAG CHECK FAILED */
-                buffer[SPC_ASC_KEY_OFFSET] = 0x10;
-                buffer[SPC_ASCQ_KEY_OFFSET] = 0x02;
-                transport_err_sector_info(buffer, cmd->bad_sector);
-                break;
-        case TCM_LOGICAL_BLOCK_REF_TAG_CHECK_FAILED:
-                /* CURRENT ERROR */
-                buffer[0] = 0x70;
-                buffer[SPC_ADD_SENSE_LEN_OFFSET] = 10;
-                /* ILLEGAL REQUEST */
-                buffer[SPC_SENSE_KEY_OFFSET] = ILLEGAL_REQUEST;
-                /* LOGICAL BLOCK REFERENCE TAG CHECK FAILED */
-                buffer[SPC_ASC_KEY_OFFSET] = 0x10;
-                buffer[SPC_ASCQ_KEY_OFFSET] = 0x03;
-                transport_err_sector_info(buffer, cmd->bad_sector);
-                break;
-        case TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE:
-        default:
-                /* CURRENT ERROR */
-                buffer[0] = 0x70;
-                buffer[SPC_ADD_SENSE_LEN_OFFSET] = 10;
-                /*
-                 * Returning ILLEGAL REQUEST would cause immediate IO errors on
-                 * Solaris initiators.  Returning NOT READY instead means the
-                 * operations will be retried a finite number of times and we
-                 * can survive intermittent errors.
-                 */
-                buffer[SPC_SENSE_KEY_OFFSET] = NOT_READY;
-                /* LOGICAL UNIT COMMUNICATION FAILURE */
-                buffer[SPC_ASC_KEY_OFFSET] = 0x08;
-                break;
+                cmd->scsi_status = SAM_STAT_CHECK_CONDITION;
+                cmd->scsi_sense_length  = TRANSPORT_SENSE_BUFFER;
+                rc = translate_sense_reason(cmd, reason);
+                if (rc)
+                        return rc;
         }
-        /*
-         * This code uses linux/include/scsi/scsi.h SAM status codes!
-         */
-        cmd->scsi_status = SAM_STAT_CHECK_CONDITION;
-        /*
-         * Automatically padded, this value is encoded in the fabric's
-         * data_length response PDU containing the SCSI defined sense data.
-         */
-        cmd->scsi_sense_length  = TRANSPORT_SENSE_BUFFER;
 
-after_reason:
         trace_target_cmd_complete(cmd);
         return cmd->se_tfo->queue_status(cmd);
 }
diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
index c448ef421ce7..937cebf76633 100644
--- a/drivers/target/target_core_user.c
+++ b/drivers/target/target_core_user.c
@@ -25,6 +25,7 @@
 #include <linux/parser.h>
 #include <linux/vmalloc.h>
 #include <linux/uio_driver.h>
+#include <linux/stringify.h>
 #include <net/genetlink.h>
 #include <scsi/scsi_common.h>
 #include <scsi/scsi_proto.h>
@@ -538,14 +539,8 @@ static void tcmu_handle_completion(struct tcmu_cmd *cmd, struct tcmu_cmd_entry *
                 UPDATE_HEAD(udev->data_tail, cmd->data_length, udev->data_size);
                 pr_warn("TCMU: Userspace set UNKNOWN_OP flag on se_cmd %p\n",
                         cmd->se_cmd);
-                transport_generic_request_failure(cmd->se_cmd,
-                        TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE);
-                cmd->se_cmd = NULL;
-                kmem_cache_free(tcmu_cmd_cache, cmd);
-                return;
-        }
-
-        if (entry->rsp.scsi_status == SAM_STAT_CHECK_CONDITION) {
+                entry->rsp.scsi_status = SAM_STAT_CHECK_CONDITION;
+        } else if (entry->rsp.scsi_status == SAM_STAT_CHECK_CONDITION) {
                 memcpy(se_cmd->sense_buffer, entry->rsp.sense_buffer,
                                se_cmd->scsi_sense_length);
 
@@ -577,7 +572,6 @@ static void tcmu_handle_completion(struct tcmu_cmd *cmd, struct tcmu_cmd_entry *
 static unsigned int tcmu_handle_completions(struct tcmu_dev *udev)
 {
         struct tcmu_mailbox *mb;
-        LIST_HEAD(cpl_cmds);
         unsigned long flags;
         int handled = 0;
 
@@ -905,7 +899,7 @@ static int tcmu_configure_device(struct se_device *dev)
         WARN_ON(!PAGE_ALIGNED(udev->data_off));
         WARN_ON(udev->data_size % PAGE_SIZE);
 
-        info->version = xstr(TCMU_MAILBOX_VERSION);
+        info->version = __stringify(TCMU_MAILBOX_VERSION);
 
         info->mem[0].name = "tcm-user command & data buffer";
         info->mem[0].addr = (phys_addr_t) udev->mb_addr;
diff --git a/drivers/target/target_core_xcopy.c b/drivers/target/target_core_xcopy.c
index 4515f52546f8..47fe94ee10b8 100644
--- a/drivers/target/target_core_xcopy.c
+++ b/drivers/target/target_core_xcopy.c
@@ -450,6 +450,8 @@ int target_xcopy_setup_pt(void)
         memset(&xcopy_pt_sess, 0, sizeof(struct se_session));
         INIT_LIST_HEAD(&xcopy_pt_sess.sess_list);
         INIT_LIST_HEAD(&xcopy_pt_sess.sess_acl_list);
+        INIT_LIST_HEAD(&xcopy_pt_sess.sess_cmd_list);
+        spin_lock_init(&xcopy_pt_sess.sess_cmd_lock);
 
         xcopy_pt_nacl.se_tpg = &xcopy_pt_tpg;
         xcopy_pt_nacl.nacl_sess = &xcopy_pt_sess;
@@ -644,7 +646,7 @@ static int target_xcopy_read_source(
         pr_debug("XCOPY: Built READ_16: LBA: %llu Sectors: %u Length: %u\n",
                 (unsigned long long)src_lba, src_sectors, length);
 
-        transport_init_se_cmd(se_cmd, &xcopy_pt_tfo, NULL, length,
+        transport_init_se_cmd(se_cmd, &xcopy_pt_tfo, &xcopy_pt_sess, length,
                               DMA_FROM_DEVICE, 0, &xpt_cmd->sense_buffer[0]);
         xop->src_pt_cmd = xpt_cmd;
 
@@ -704,7 +706,7 @@ static int target_xcopy_write_destination(
         pr_debug("XCOPY: Built WRITE_16: LBA: %llu Sectors: %u Length: %u\n",
                 (unsigned long long)dst_lba, dst_sectors, length);
 
-        transport_init_se_cmd(se_cmd, &xcopy_pt_tfo, NULL, length,
+        transport_init_se_cmd(se_cmd, &xcopy_pt_tfo, &xcopy_pt_sess, length,
                               DMA_TO_DEVICE, 0, &xpt_cmd->sense_buffer[0]);
         xop->dst_pt_cmd = xpt_cmd;
 
diff --git a/drivers/target/tcm_fc/tfc_cmd.c b/drivers/target/tcm_fc/tfc_cmd.c
index 68031723e5be..aa3caca8bace 100644
--- a/drivers/target/tcm_fc/tfc_cmd.c
+++ b/drivers/target/tcm_fc/tfc_cmd.c
@@ -255,7 +255,7 @@ static void ft_recv_seq(struct fc_seq *sp, struct fc_frame *fp, void *arg)
         struct ft_cmd *cmd = arg;
         struct fc_frame_header *fh;
 
-        if (unlikely(IS_ERR(fp))) {
+        if (IS_ERR(fp)) {
                 /* XXX need to find cmd if queued */
                 cmd->seq = NULL;
                 cmd->aborted = true;
diff --git a/drivers/thermal/Kconfig b/drivers/thermal/Kconfig
index 118938ee8552..5aabc4bc0d75 100644
--- a/drivers/thermal/Kconfig
+++ b/drivers/thermal/Kconfig
@@ -163,7 +163,7 @@ config THERMAL_EMULATION
 
 config HISI_THERMAL
         tristate "Hisilicon thermal driver"
-        depends on ARCH_HISI && CPU_THERMAL && OF
+        depends on (ARCH_HISI && CPU_THERMAL && OF) || COMPILE_TEST
         help
           Enable this to plug hisilicon's thermal sensor driver into the Linux
           thermal framework. cpufreq is used as the cooling device to throttle
@@ -182,7 +182,7 @@ config IMX_THERMAL
 
 config SPEAR_THERMAL
         bool "SPEAr thermal sensor driver"
-        depends on PLAT_SPEAR
+        depends on PLAT_SPEAR || COMPILE_TEST
         depends on OF
         help
           Enable this to plug the SPEAr thermal sensor driver into the Linux
@@ -190,7 +190,7 @@ config SPEAR_THERMAL
 
 config ROCKCHIP_THERMAL
         tristate "Rockchip thermal driver"
-        depends on ARCH_ROCKCHIP
+        depends on ARCH_ROCKCHIP || COMPILE_TEST
         depends on RESET_CONTROLLER
         help
           Rockchip thermal driver provides support for Temperature sensor
@@ -208,7 +208,7 @@ config RCAR_THERMAL
 
 config KIRKWOOD_THERMAL
         tristate "Temperature sensor on Marvell Kirkwood SoCs"
-        depends on MACH_KIRKWOOD
+        depends on MACH_KIRKWOOD || COMPILE_TEST
         depends on OF
         help
           Support for the Kirkwood thermal sensor driver into the Linux thermal
@@ -216,7 +216,7 @@ config KIRKWOOD_THERMAL
 
 config DOVE_THERMAL
         tristate "Temperature sensor on Marvell Dove SoCs"
-        depends on ARCH_DOVE || MACH_DOVE
+        depends on ARCH_DOVE || MACH_DOVE || COMPILE_TEST
         depends on OF
         help
           Support for the Dove thermal sensor driver in the Linux thermal
@@ -234,7 +234,7 @@ config DB8500_THERMAL
 
 config ARMADA_THERMAL
         tristate "Armada 370/XP thermal management"
-        depends on ARCH_MVEBU
+        depends on ARCH_MVEBU || COMPILE_TEST
         depends on OF
         help
           Enable this option if you want to have support for thermal management
@@ -340,12 +340,21 @@ config ACPI_THERMAL_REL
         tristate
         depends on ACPI
 
+config INTEL_PCH_THERMAL
+        tristate "Intel PCH Thermal Reporting Driver"
+        depends on X86 && PCI
+        help
+          Enable this to support thermal reporting on certain intel PCHs.
+          Thermal reporting device will provide temperature reading,
+          programmable trip points and other information.
+
 menu "Texas Instruments thermal drivers"
+depends on ARCH_HAS_BANDGAP || COMPILE_TEST
 source "drivers/thermal/ti-soc-thermal/Kconfig"
 endmenu
 
 menu "Samsung thermal drivers"
-depends on ARCH_EXYNOS
+depends on ARCH_EXYNOS || COMPILE_TEST
 source "drivers/thermal/samsung/Kconfig"
 endmenu
 
@@ -356,7 +365,7 @@ endmenu
 
 config QCOM_SPMI_TEMP_ALARM
         tristate "Qualcomm SPMI PMIC Temperature Alarm"
-        depends on OF && SPMI && IIO
+        depends on OF && (SPMI || COMPILE_TEST) && IIO
         select REGMAP_SPMI
         help
           This enables a thermal sysfs driver for Qualcomm plug-and-play (QPNP)
diff --git a/drivers/thermal/Makefile b/drivers/thermal/Makefile
index 535dfee1496f..26f160809959 100644
--- a/drivers/thermal/Makefile
+++ b/drivers/thermal/Makefile
@@ -41,6 +41,7 @@ obj-$(CONFIG_INTEL_SOC_DTS_THERMAL)	+= intel_soc_dts_thermal.o
 obj-$(CONFIG_INTEL_QUARK_DTS_THERMAL)   += intel_quark_dts_thermal.o
 obj-$(CONFIG_TI_SOC_THERMAL)    += ti-soc-thermal/
 obj-$(CONFIG_INT340X_THERMAL)  += int340x_thermal/
+obj-$(CONFIG_INTEL_PCH_THERMAL) += intel_pch_thermal.o
 obj-$(CONFIG_ST_THERMAL)        += st/
 obj-$(CONFIG_TEGRA_SOCTHERM)    += tegra_soctherm.o
 obj-$(CONFIG_HISI_THERMAL)     += hisi_thermal.o
diff --git a/drivers/thermal/armada_thermal.c b/drivers/thermal/armada_thermal.c
index 01255fd65135..26b8d326546a 100644
--- a/drivers/thermal/armada_thermal.c
+++ b/drivers/thermal/armada_thermal.c
@@ -155,7 +155,7 @@ static bool armada_is_valid(struct armada_thermal_priv *priv)
 }
 
 static int armada_get_temp(struct thermal_zone_device *thermal,
-                          unsigned long *temp)
+                          int *temp)
 {
         struct armada_thermal_priv *priv = thermal->devdata;
         unsigned long reg;
diff --git a/drivers/thermal/cpu_cooling.c b/drivers/thermal/cpu_cooling.c
index 620dcd405ff6..42c6f71bdcc1 100644
--- a/drivers/thermal/cpu_cooling.c
+++ b/drivers/thermal/cpu_cooling.c
@@ -262,7 +262,9 @@ static int cpufreq_thermal_notifier(struct notifier_block *nb,
  * efficiently.  Power is stored in mW, frequency in KHz.  The
  * resulting table is in ascending order.
  *
- * Return: 0 on success, -E* on error.
+ * Return: 0 on success, -EINVAL if there are no OPPs for any CPUs,
+ * -ENOMEM if we run out of memory or -EAGAIN if an OPP was
+ * added/enabled while the function was executing.
  */
 static int build_dyn_power_table(struct cpufreq_cooling_device *cpufreq_device,
                                  u32 capacitance)
@@ -273,8 +275,6 @@ static int build_dyn_power_table(struct cpufreq_cooling_device *cpufreq_device,
         int num_opps = 0, cpu, i, ret = 0;
         unsigned long freq;
 
-        rcu_read_lock();
-
         for_each_cpu(cpu, &cpufreq_device->allowed_cpus) {
                 dev = get_cpu_device(cpu);
                 if (!dev) {
@@ -284,24 +284,20 @@ static int build_dyn_power_table(struct cpufreq_cooling_device *cpufreq_device,
                 }
 
                 num_opps = dev_pm_opp_get_opp_count(dev);
-                if (num_opps > 0) {
+                if (num_opps > 0)
                         break;
-                } else if (num_opps < 0) {
-                        ret = num_opps;
-                        goto unlock;
-                }
+                else if (num_opps < 0)
+                        return num_opps;
         }
 
-        if (num_opps == 0) {
-                ret = -EINVAL;
-                goto unlock;
-        }
+        if (num_opps == 0)
+                return -EINVAL;
 
         power_table = kcalloc(num_opps, sizeof(*power_table), GFP_KERNEL);
-        if (!power_table) {
-                ret = -ENOMEM;
-                goto unlock;
-        }
+        if (!power_table)
+                return -ENOMEM;
+
+        rcu_read_lock();
 
         for (freq = 0, i = 0;
              opp = dev_pm_opp_find_freq_ceil(dev, &freq), !IS_ERR(opp);
@@ -309,6 +305,12 @@ static int build_dyn_power_table(struct cpufreq_cooling_device *cpufreq_device,
                 u32 freq_mhz, voltage_mv;
                 u64 power;
 
+                if (i >= num_opps) {
+                        rcu_read_unlock();
+                        ret = -EAGAIN;
+                        goto free_power_table;
+                }
+
                 freq_mhz = freq / 1000000;
                 voltage_mv = dev_pm_opp_get_voltage(opp) / 1000;
 
@@ -326,17 +328,22 @@ static int build_dyn_power_table(struct cpufreq_cooling_device *cpufreq_device,
                 power_table[i].power = power;
         }
 
-        if (i == 0) {
+        rcu_read_unlock();
+
+        if (i != num_opps) {
                 ret = PTR_ERR(opp);
-                goto unlock;
+                goto free_power_table;
         }
 
         cpufreq_device->cpu_dev = dev;
         cpufreq_device->dyn_power_table = power_table;
         cpufreq_device->dyn_power_table_entries = i;
 
-unlock:
-        rcu_read_unlock();
+        return 0;
+
+free_power_table:
+        kfree(power_table);
+
         return ret;
 }
 
@@ -847,7 +854,7 @@ __cpufreq_cooling_register(struct device_node *np,
         ret = get_idr(&cpufreq_idr, &cpufreq_dev->id);
         if (ret) {
                 cool_dev = ERR_PTR(ret);
-                goto free_table;
+                goto free_power_table;
         }
 
         snprintf(dev_name, sizeof(dev_name), "thermal-cpufreq-%d",
@@ -889,6 +896,8 @@ __cpufreq_cooling_register(struct device_node *np,
 
 remove_idr:
         release_idr(&cpufreq_idr, cpufreq_dev->id);
+free_power_table:
+        kfree(cpufreq_dev->dyn_power_table);
 free_table:
         kfree(cpufreq_dev->freq_table);
 free_time_in_idle_timestamp:
@@ -1039,6 +1048,7 @@ void cpufreq_cooling_unregister(struct thermal_cooling_device *cdev)
 
         thermal_cooling_device_unregister(cpufreq_dev->cool_dev);
         release_idr(&cpufreq_idr, cpufreq_dev->id);
+        kfree(cpufreq_dev->dyn_power_table);
         kfree(cpufreq_dev->time_in_idle_timestamp);
         kfree(cpufreq_dev->time_in_idle);
         kfree(cpufreq_dev->freq_table);
diff --git a/drivers/thermal/db8500_cpufreq_cooling.c b/drivers/thermal/db8500_cpufreq_cooling.c
index 607b62c7e611..e58bd0b658b5 100644
--- a/drivers/thermal/db8500_cpufreq_cooling.c
+++ b/drivers/thermal/db8500_cpufreq_cooling.c
@@ -72,6 +72,7 @@ static const struct of_device_id db8500_cpufreq_cooling_match[] = {
         { .compatible = "stericsson,db8500-cpufreq-cooling" },
         {},
 };
+MODULE_DEVICE_TABLE(of, db8500_cpufreq_cooling_match);
 #endif
 
 static struct platform_driver db8500_cpufreq_cooling_driver = {
diff --git a/drivers/thermal/db8500_thermal.c b/drivers/thermal/db8500_thermal.c
index 2fb273c4baa9..652acd8fbe48 100644
--- a/drivers/thermal/db8500_thermal.c
+++ b/drivers/thermal/db8500_thermal.c
@@ -107,8 +107,7 @@ static int db8500_cdev_unbind(struct thermal_zone_device *thermal,
 }
 
 /* Callback to get current temperature */
-static int db8500_sys_get_temp(struct thermal_zone_device *thermal,
-                unsigned long *temp)
+static int db8500_sys_get_temp(struct thermal_zone_device *thermal, int *temp)
 {
         struct db8500_thermal_zone *pzone = thermal->devdata;
 
@@ -180,7 +179,7 @@ static int db8500_sys_get_trip_type(struct thermal_zone_device *thermal,
 
 /* Callback to get trip point temperature */
 static int db8500_sys_get_trip_temp(struct thermal_zone_device *thermal,
-                int trip, unsigned long *temp)
+                int trip, int *temp)
 {
         struct db8500_thermal_zone *pzone = thermal->devdata;
         struct db8500_thsens_platform_data *ptrips = pzone->trip_tab;
@@ -195,7 +194,7 @@ static int db8500_sys_get_trip_temp(struct thermal_zone_device *thermal,
 
 /* Callback to get critical trip point temperature */
 static int db8500_sys_get_crit_temp(struct thermal_zone_device *thermal,
-                unsigned long *temp)
+                int *temp)
 {
         struct db8500_thermal_zone *pzone = thermal->devdata;
         struct db8500_thsens_platform_data *ptrips = pzone->trip_tab;
diff --git a/drivers/thermal/dove_thermal.c b/drivers/thermal/dove_thermal.c
index 09f6e304c274..a0bc9de42553 100644
--- a/drivers/thermal/dove_thermal.c
+++ b/drivers/thermal/dove_thermal.c
@@ -93,7 +93,7 @@ static int dove_init_sensor(const struct dove_thermal_priv *priv)
 }
 
 static int dove_get_temp(struct thermal_zone_device *thermal,
-                          unsigned long *temp)
+                          int *temp)
 {
         unsigned long reg;
         struct dove_thermal_priv *priv = thermal->devdata;
diff --git a/drivers/thermal/fair_share.c b/drivers/thermal/fair_share.c
index c2c10bbe24d6..34fe36504a55 100644
--- a/drivers/thermal/fair_share.c
+++ b/drivers/thermal/fair_share.c
@@ -34,7 +34,7 @@
 static int get_trip_level(struct thermal_zone_device *tz)
 {
         int count = 0;
-        unsigned long trip_temp;
+        int trip_temp;
         enum thermal_trip_type trip_type;
 
         if (tz->trips == 0 || !tz->ops->get_trip_temp)
diff --git a/drivers/thermal/gov_bang_bang.c b/drivers/thermal/gov_bang_bang.c
index c5dd76b2ee74..70836c5b89bc 100644
--- a/drivers/thermal/gov_bang_bang.c
+++ b/drivers/thermal/gov_bang_bang.c
@@ -25,14 +25,13 @@
 
 static void thermal_zone_trip_update(struct thermal_zone_device *tz, int trip)
 {
-        long trip_temp;
-        unsigned long trip_hyst;
+        int trip_temp, trip_hyst;
         struct thermal_instance *instance;
 
         tz->ops->get_trip_temp(tz, trip, &trip_temp);
         tz->ops->get_trip_hyst(tz, trip, &trip_hyst);
 
-        dev_dbg(&tz->device, "Trip%d[temp=%ld]:temp=%d:hyst=%ld\n",
+        dev_dbg(&tz->device, "Trip%d[temp=%d]:temp=%d:hyst=%d\n",
                                 trip, trip_temp, tz->temperature,
                                 trip_hyst);
 
diff --git a/drivers/thermal/hisi_thermal.c b/drivers/thermal/hisi_thermal.c
index b49f97c734d0..36d07295f8e3 100644
--- a/drivers/thermal/hisi_thermal.c
+++ b/drivers/thermal/hisi_thermal.c
@@ -155,7 +155,7 @@ static void hisi_thermal_disable_sensor(struct hisi_thermal_data *data)
         mutex_unlock(&data->thermal_lock);
 }
 
-static int hisi_thermal_get_temp(void *_sensor, long *temp)
+static int hisi_thermal_get_temp(void *_sensor, int *temp)
 {
         struct hisi_thermal_sensor *sensor = _sensor;
         struct hisi_thermal_data *data = sensor->thermal;
@@ -178,7 +178,7 @@ static int hisi_thermal_get_temp(void *_sensor, long *temp)
         data->irq_bind_sensor = sensor_id;
         mutex_unlock(&data->thermal_lock);
 
-        dev_dbg(&data->pdev->dev, "id=%d, irq=%d, temp=%ld, thres=%d\n",
+        dev_dbg(&data->pdev->dev, "id=%d, irq=%d, temp=%d, thres=%d\n",
                 sensor->id, data->irq_enabled, *temp, sensor->thres_temp);
         /*
          * Bind irq to sensor for two cases:
diff --git a/drivers/thermal/imx_thermal.c b/drivers/thermal/imx_thermal.c
index fde4c2876d14..4bec1d3c3d27 100644
--- a/drivers/thermal/imx_thermal.c
+++ b/drivers/thermal/imx_thermal.c
@@ -98,10 +98,10 @@ struct imx_thermal_data {
         enum thermal_device_mode mode;
         struct regmap *tempmon;
         u32 c1, c2; /* See formula in imx_get_sensor_data() */
-        unsigned long temp_passive;
-        unsigned long temp_critical;
-        unsigned long alarm_temp;
-        unsigned long last_temp;
+        int temp_passive;
+        int temp_critical;
+        int alarm_temp;
+        int last_temp;
         bool irq_enabled;
         int irq;
         struct clk *thermal_clk;
@@ -109,7 +109,7 @@ struct imx_thermal_data {
 };
 
 static void imx_set_panic_temp(struct imx_thermal_data *data,
-                               signed long panic_temp)
+                               int panic_temp)
 {
         struct regmap *map = data->tempmon;
         int critical_value;
@@ -121,7 +121,7 @@ static void imx_set_panic_temp(struct imx_thermal_data *data,
 }
 
 static void imx_set_alarm_temp(struct imx_thermal_data *data,
-                               signed long alarm_temp)
+                               int alarm_temp)
 {
         struct regmap *map = data->tempmon;
         int alarm_value;
@@ -133,7 +133,7 @@ static void imx_set_alarm_temp(struct imx_thermal_data *data,
                         TEMPSENSE0_ALARM_VALUE_SHIFT);
 }
 
-static int imx_get_temp(struct thermal_zone_device *tz, unsigned long *temp)
+static int imx_get_temp(struct thermal_zone_device *tz, int *temp)
 {
         struct imx_thermal_data *data = tz->devdata;
         struct regmap *map = data->tempmon;
@@ -189,13 +189,13 @@ static int imx_get_temp(struct thermal_zone_device *tz, unsigned long *temp)
                 if (data->alarm_temp == data->temp_critical &&
                         *temp < data->temp_passive) {
                         imx_set_alarm_temp(data, data->temp_passive);
-                        dev_dbg(&tz->device, "thermal alarm off: T < %lu\n",
+                        dev_dbg(&tz->device, "thermal alarm off: T < %d\n",
                                 data->alarm_temp / 1000);
                 }
         }
 
         if (*temp != data->last_temp) {
-                dev_dbg(&tz->device, "millicelsius: %ld\n", *temp);
+                dev_dbg(&tz->device, "millicelsius: %d\n", *temp);
                 data->last_temp = *temp;
         }
 
@@ -262,8 +262,7 @@ static int imx_get_trip_type(struct thermal_zone_device *tz, int trip,
         return 0;
 }
 
-static int imx_get_crit_temp(struct thermal_zone_device *tz,
-                             unsigned long *temp)
+static int imx_get_crit_temp(struct thermal_zone_device *tz, int *temp)
 {
         struct imx_thermal_data *data = tz->devdata;
 
@@ -272,7 +271,7 @@ static int imx_get_crit_temp(struct thermal_zone_device *tz,
 }
 
 static int imx_get_trip_temp(struct thermal_zone_device *tz, int trip,
-                             unsigned long *temp)
+                             int *temp)
 {
         struct imx_thermal_data *data = tz->devdata;
 
@@ -282,7 +281,7 @@ static int imx_get_trip_temp(struct thermal_zone_device *tz, int trip,
 }
 
 static int imx_set_trip_temp(struct thermal_zone_device *tz, int trip,
-                             unsigned long temp)
+                             int temp)
 {
         struct imx_thermal_data *data = tz->devdata;
 
@@ -434,7 +433,7 @@ static irqreturn_t imx_thermal_alarm_irq_thread(int irq, void *dev)
 {
         struct imx_thermal_data *data = dev;
 
-        dev_dbg(&data->tz->device, "THERMAL ALARM: T > %lu\n",
+        dev_dbg(&data->tz->device, "THERMAL ALARM: T > %d\n",
                 data->alarm_temp / 1000);
 
         thermal_zone_device_update(data->tz);
diff --git a/drivers/thermal/int340x_thermal/int3400_thermal.c b/drivers/thermal/int340x_thermal/int3400_thermal.c
index 031018e7a65b..5836e5554433 100644
--- a/drivers/thermal/int340x_thermal/int3400_thermal.c
+++ b/drivers/thermal/int340x_thermal/int3400_thermal.c
@@ -186,7 +186,7 @@ static int int3400_thermal_run_osc(acpi_handle handle,
 }
 
 static int int3400_thermal_get_temp(struct thermal_zone_device *thermal,
-                        unsigned long *temp)
+                        int *temp)
 {
         *temp = 20 * 1000; /* faked temp sensor with 20C */
         return 0;
diff --git a/drivers/thermal/int340x_thermal/int340x_thermal_zone.c b/drivers/thermal/int340x_thermal/int340x_thermal_zone.c
index 1e25133d35e2..b9b2666aa94c 100644
--- a/drivers/thermal/int340x_thermal/int340x_thermal_zone.c
+++ b/drivers/thermal/int340x_thermal/int340x_thermal_zone.c
@@ -20,7 +20,7 @@
 #include "int340x_thermal_zone.h"
 
 static int int340x_thermal_get_zone_temp(struct thermal_zone_device *zone,
-                                         unsigned long *temp)
+                                         int *temp)
 {
         struct int34x_thermal_zone *d = zone->devdata;
         unsigned long long tmp;
@@ -49,7 +49,7 @@ static int int340x_thermal_get_zone_temp(struct thermal_zone_device *zone,
 }
 
 static int int340x_thermal_get_trip_temp(struct thermal_zone_device *zone,
-                                         int trip, unsigned long *temp)
+                                         int trip, int *temp)
 {
         struct int34x_thermal_zone *d = zone->devdata;
         int i;
@@ -114,7 +114,7 @@ static int int340x_thermal_get_trip_type(struct thermal_zone_device *zone,
 }
 
 static int int340x_thermal_set_trip_temp(struct thermal_zone_device *zone,
-                                      int trip, unsigned long temp)
+                                      int trip, int temp)
 {
         struct int34x_thermal_zone *d = zone->devdata;
         acpi_status status;
@@ -136,7 +136,7 @@ static int int340x_thermal_set_trip_temp(struct thermal_zone_device *zone,
 
 
 static int int340x_thermal_get_trip_hyst(struct thermal_zone_device *zone,
-                int trip, unsigned long *temp)
+                int trip, int *temp)
 {
         struct int34x_thermal_zone *d = zone->devdata;
         acpi_status status;
@@ -163,7 +163,7 @@ static struct thermal_zone_device_ops int340x_thermal_zone_ops = {
 };
 
 static int int340x_thermal_get_trip_config(acpi_handle handle, char *name,
-                                      unsigned long *temp)
+                                      int *temp)
 {
         unsigned long long r;
         acpi_status status;
diff --git a/drivers/thermal/int340x_thermal/int340x_thermal_zone.h b/drivers/thermal/int340x_thermal/int340x_thermal_zone.h
index 9f38ab72c4bf..aaadf724ff2e 100644
--- a/drivers/thermal/int340x_thermal/int340x_thermal_zone.h
+++ b/drivers/thermal/int340x_thermal/int340x_thermal_zone.h
@@ -21,7 +21,7 @@
 #define INT340X_THERMAL_MAX_ACT_TRIP_COUNT      10
 
 struct active_trip {
-        unsigned long temp;
+        int temp;
         int id;
         bool valid;
 };
@@ -31,11 +31,11 @@ struct int34x_thermal_zone {
         struct active_trip act_trips[INT340X_THERMAL_MAX_ACT_TRIP_COUNT];
         unsigned long *aux_trips;
         int aux_trip_nr;
-        unsigned long psv_temp;
+        int psv_temp;
         int psv_trip_id;
-        unsigned long crt_temp;
+        int crt_temp;
         int crt_trip_id;
-        unsigned long hot_temp;
+        int hot_temp;
         int hot_trip_id;
         struct thermal_zone_device *zone;
         struct thermal_zone_device_ops *override_ops;
diff --git a/drivers/thermal/int340x_thermal/processor_thermal_device.c b/drivers/thermal/int340x_thermal/processor_thermal_device.c
index 3df3dc34b124..ccc0ad02d066 100644
--- a/drivers/thermal/int340x_thermal/processor_thermal_device.c
+++ b/drivers/thermal/int340x_thermal/processor_thermal_device.c
@@ -145,7 +145,7 @@ static int get_tjmax(void)
         return -EINVAL;
 }
 
-static int read_temp_msr(unsigned long *temp)
+static int read_temp_msr(int *temp)
 {
         int cpu;
         u32 eax, edx;
@@ -177,7 +177,7 @@ err_ret:
 }
 
 static int proc_thermal_get_zone_temp(struct thermal_zone_device *zone,
-                                         unsigned long *temp)
+                                         int *temp)
 {
         int ret;
 
diff --git a/drivers/thermal/intel_pch_thermal.c b/drivers/thermal/intel_pch_thermal.c
new file mode 100644
index 000000000000..50c7da79be83
--- /dev/null
+++ b/drivers/thermal/intel_pch_thermal.c
@@ -0,0 +1,283 @@
+/* intel_pch_thermal.c - Intel PCH Thermal driver
+ *
+ * Copyright (c) 2015, Intel Corporation.
+ *
+ * Authors:
+ *     Tushar Dave <tushar.n.dave@intel.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/init.h>
+#include <linux/pci.h>
+#include <linux/thermal.h>
+
+/* Intel PCH thermal Device IDs */
+#define PCH_THERMAL_DID_WPT     0x9CA4 /* Wildcat Point */
+
+/* Wildcat Point-LP  PCH Thermal registers */
+#define WPT_TEMP        0x0000  /* Temperature */
+#define WPT_TSC 0x04    /* Thermal Sensor Control */
+#define WPT_TSS 0x06    /* Thermal Sensor Status */
+#define WPT_TSEL        0x08    /* Thermal Sensor Enable and Lock */
+#define WPT_TSREL       0x0A    /* Thermal Sensor Report Enable and Lock */
+#define WPT_TSMIC       0x0C    /* Thermal Sensor SMI Control */
+#define WPT_CTT 0x0010  /* Catastrophic Trip Point */
+#define WPT_TAHV        0x0014  /* Thermal Alert High Value */
+#define WPT_TALV        0x0018  /* Thermal Alert Low Value */
+#define WPT_TL          0x00000040      /* Throttle Value */
+#define WPT_PHL 0x0060  /* PCH Hot Level */
+#define WPT_PHLC        0x62    /* PHL Control */
+#define WPT_TAS 0x80    /* Thermal Alert Status */
+#define WPT_TSPIEN      0x82    /* PCI Interrupt Event Enables */
+#define WPT_TSGPEN      0x84    /* General Purpose Event Enables */
+
+/*  Wildcat Point-LP  PCH Thermal Register bit definitions */
+#define WPT_TEMP_TSR    0x00ff  /* Temp TS Reading */
+#define WPT_TSC_CPDE    0x01    /* Catastrophic Power-Down Enable */
+#define WPT_TSS_TSDSS   0x10    /* Thermal Sensor Dynamic Shutdown Status */
+#define WPT_TSS_GPES    0x08    /* GPE status */
+#define WPT_TSEL_ETS    0x01    /* Enable TS */
+#define WPT_TSEL_PLDB   0x80    /* TSEL Policy Lock-Down Bit */
+#define WPT_TL_TOL      0x000001FF      /* T0 Level */
+#define WPT_TL_T1L      0x1ff00000      /* T1 Level */
+#define WPT_TL_TTEN     0x20000000      /* TT Enable */
+
+static char driver_name[] = "Intel PCH thermal driver";
+
+struct pch_thermal_device {
+        void __iomem *hw_base;
+        const struct pch_dev_ops *ops;
+        struct pci_dev *pdev;
+        struct thermal_zone_device *tzd;
+        int crt_trip_id;
+        unsigned long crt_temp;
+        int hot_trip_id;
+        unsigned long hot_temp;
+};
+
+static int pch_wpt_init(struct pch_thermal_device *ptd, int *nr_trips)
+{
+        u8 tsel;
+        u16 trip_temp;
+
+        *nr_trips = 0;
+
+        /* Check if BIOS has already enabled thermal sensor */
+        if (WPT_TSS_TSDSS & readb(ptd->hw_base + WPT_TSS))
+                goto read_trips;
+
+        tsel = readb(ptd->hw_base + WPT_TSEL);
+        /*
+         * When TSEL's Policy Lock-Down bit is 1, TSEL become RO.
+         * If so, thermal sensor cannot enable. Bail out.
+         */
+        if (tsel & WPT_TSEL_PLDB) {
+                dev_err(&ptd->pdev->dev, "Sensor can't be enabled\n");
+                return -ENODEV;
+        }
+
+        writeb(tsel|WPT_TSEL_ETS, ptd->hw_base + WPT_TSEL);
+        if (!(WPT_TSS_TSDSS & readb(ptd->hw_base + WPT_TSS))) {
+                dev_err(&ptd->pdev->dev, "Sensor can't be enabled\n");
+                return -ENODEV;
+        }
+
+read_trips:
+        ptd->crt_trip_id = -1;
+        trip_temp = readw(ptd->hw_base + WPT_CTT);
+        trip_temp &= 0x1FF;
+        if (trip_temp) {
+                /* Resolution of 1/2 degree C and an offset of -50C */
+                ptd->crt_temp = trip_temp * 1000 / 2 - 50000;
+                ptd->crt_trip_id = 0;
+                ++(*nr_trips);
+        }
+
+        ptd->hot_trip_id = -1;
+        trip_temp = readw(ptd->hw_base + WPT_PHL);
+        trip_temp &= 0x1FF;
+        if (trip_temp) {
+                /* Resolution of 1/2 degree C and an offset of -50C */
+                ptd->hot_temp = trip_temp * 1000 / 2 - 50000;
+                ptd->hot_trip_id = *nr_trips;
+                ++(*nr_trips);
+        }
+
+        return 0;
+}
+
+static int pch_wpt_get_temp(struct pch_thermal_device *ptd, int *temp)
+{
+        u8 wpt_temp;
+
+        wpt_temp = WPT_TEMP_TSR & readl(ptd->hw_base + WPT_TEMP);
+
+        /* Resolution of 1/2 degree C and an offset of -50C */
+        *temp = (wpt_temp * 1000 / 2 - 50000);
+
+        return 0;
+}
+
+struct pch_dev_ops {
+        int (*hw_init)(struct pch_thermal_device *ptd, int *nr_trips);
+        int (*get_temp)(struct pch_thermal_device *ptd, int *temp);
+};
+
+
+/* dev ops for Wildcat Point */
+static struct pch_dev_ops pch_dev_ops_wpt = {
+        .hw_init = pch_wpt_init,
+        .get_temp = pch_wpt_get_temp,
+};
+
+static int pch_thermal_get_temp(struct thermal_zone_device *tzd, int *temp)
+{
+        struct pch_thermal_device *ptd = tzd->devdata;
+
+        return  ptd->ops->get_temp(ptd, temp);
+}
+
+static int pch_get_trip_type(struct thermal_zone_device *tzd, int trip,
+                             enum thermal_trip_type *type)
+{
+        struct pch_thermal_device *ptd = tzd->devdata;
+
+        if (ptd->crt_trip_id == trip)
+                *type = THERMAL_TRIP_CRITICAL;
+        else if (ptd->hot_trip_id == trip)
+                *type = THERMAL_TRIP_HOT;
+        else
+                return -EINVAL;
+
+        return 0;
+}
+
+static int pch_get_trip_temp(struct thermal_zone_device *tzd, int trip, int *temp)
+{
+        struct pch_thermal_device *ptd = tzd->devdata;
+
+        if (ptd->crt_trip_id == trip)
+                *temp = ptd->crt_temp;
+        else if (ptd->hot_trip_id == trip)
+                *temp = ptd->hot_temp;
+        else
+                return -EINVAL;
+
+        return 0;
+}
+
+static struct thermal_zone_device_ops tzd_ops = {
+        .get_temp = pch_thermal_get_temp,
+        .get_trip_type = pch_get_trip_type,
+        .get_trip_temp = pch_get_trip_temp,
+};
+
+
+static int intel_pch_thermal_probe(struct pci_dev *pdev,
+                                   const struct pci_device_id *id)
+{
+        struct pch_thermal_device *ptd;
+        int err;
+        int nr_trips;
+        char *dev_name;
+
+        ptd = devm_kzalloc(&pdev->dev, sizeof(*ptd), GFP_KERNEL);
+        if (!ptd)
+                return -ENOMEM;
+
+        switch (pdev->device) {
+        case PCH_THERMAL_DID_WPT:
+                ptd->ops = &pch_dev_ops_wpt;
+                dev_name = "pch_wildcat_point";
+                break;
+        default:
+                dev_err(&pdev->dev, "unknown pch thermal device\n");
+                return -ENODEV;
+        }
+
+        pci_set_drvdata(pdev, ptd);
+        ptd->pdev = pdev;
+
+        err = pci_enable_device(pdev);
+        if (err) {
+                dev_err(&pdev->dev, "failed to enable pci device\n");
+                return err;
+        }
+
+        err = pci_request_regions(pdev, driver_name);
+        if (err) {
+                dev_err(&pdev->dev, "failed to request pci region\n");
+                goto error_disable;
+        }
+
+        ptd->hw_base = pci_ioremap_bar(pdev, 0);
+        if (!ptd->hw_base) {
+                err = -ENOMEM;
+                dev_err(&pdev->dev, "failed to map mem base\n");
+                goto error_release;
+        }
+
+        err = ptd->ops->hw_init(ptd, &nr_trips);
+        if (err)
+                goto error_cleanup;
+
+        ptd->tzd = thermal_zone_device_register(dev_name, nr_trips, 0, ptd,
+                                                &tzd_ops, NULL, 0, 0);
+        if (IS_ERR(ptd->tzd)) {
+                dev_err(&pdev->dev, "Failed to register thermal zone %s\n",
+                        dev_name);
+                err = PTR_ERR(ptd->tzd);
+                goto error_cleanup;
+        }
+
+        return 0;
+
+error_cleanup:
+        iounmap(ptd->hw_base);
+error_release:
+        pci_release_regions(pdev);
+error_disable:
+        pci_disable_device(pdev);
+        dev_err(&pdev->dev, "pci device failed to probe\n");
+        return err;
+}
+
+static void intel_pch_thermal_remove(struct pci_dev *pdev)
+{
+        struct pch_thermal_device *ptd = pci_get_drvdata(pdev);
+
+        thermal_zone_device_unregister(ptd->tzd);
+        iounmap(ptd->hw_base);
+        pci_set_drvdata(pdev, NULL);
+        pci_release_region(pdev, 0);
+        pci_disable_device(pdev);
+}
+
+static struct pci_device_id intel_pch_thermal_id[] = {
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCH_THERMAL_DID_WPT) },
+        { 0, },
+};
+MODULE_DEVICE_TABLE(pci, intel_pch_thermal_id);
+
+static struct pci_driver intel_pch_thermal_driver = {
+        .name           = "intel_pch_thermal",
+        .id_table       = intel_pch_thermal_id,
+        .probe          = intel_pch_thermal_probe,
+        .remove         = intel_pch_thermal_remove,
+};
+
+module_pci_driver(intel_pch_thermal_driver);
+
+MODULE_LICENSE("GPL v2");
+MODULE_DESCRIPTION("Intel PCH Thermal driver");
diff --git a/drivers/thermal/intel_powerclamp.c b/drivers/thermal/intel_powerclamp.c
index 2ac0c704bcb8..6c79588251d5 100644
--- a/drivers/thermal/intel_powerclamp.c
+++ b/drivers/thermal/intel_powerclamp.c
@@ -693,11 +693,14 @@ static const struct x86_cpu_id intel_powerclamp_ids[] __initconst = {
         { X86_VENDOR_INTEL, 6, 0x3f},
         { X86_VENDOR_INTEL, 6, 0x45},
         { X86_VENDOR_INTEL, 6, 0x46},
+        { X86_VENDOR_INTEL, 6, 0x47},
         { X86_VENDOR_INTEL, 6, 0x4c},
         { X86_VENDOR_INTEL, 6, 0x4d},
+        { X86_VENDOR_INTEL, 6, 0x4e},
         { X86_VENDOR_INTEL, 6, 0x4f},
         { X86_VENDOR_INTEL, 6, 0x56},
         { X86_VENDOR_INTEL, 6, 0x57},
+        { X86_VENDOR_INTEL, 6, 0x5e},
         {}
 };
 MODULE_DEVICE_TABLE(x86cpu, intel_powerclamp_ids);
diff --git a/drivers/thermal/intel_quark_dts_thermal.c b/drivers/thermal/intel_quark_dts_thermal.c
index 4434ec812cb7..5ed90e6c8a64 100644
--- a/drivers/thermal/intel_quark_dts_thermal.c
+++ b/drivers/thermal/intel_quark_dts_thermal.c
@@ -186,7 +186,7 @@ static int soc_dts_disable(struct thermal_zone_device *tzd)
         return ret;
 }
 
-static int _get_trip_temp(int trip, unsigned long *temp)
+static int _get_trip_temp(int trip, int *temp)
 {
         int status;
         u32 out;
@@ -212,19 +212,18 @@ static int _get_trip_temp(int trip, unsigned long *temp)
 }
 
 static inline int sys_get_trip_temp(struct thermal_zone_device *tzd,
-                                int trip, unsigned long *temp)
+                                int trip, int *temp)
 {
         return _get_trip_temp(trip, temp);
 }
 
-static inline int sys_get_crit_temp(struct thermal_zone_device *tzd,
-                                unsigned long *temp)
+static inline int sys_get_crit_temp(struct thermal_zone_device *tzd, int *temp)
 {
         return _get_trip_temp(QRK_DTS_ID_TP_CRITICAL, temp);
 }
 
 static int update_trip_temp(struct soc_sensor_entry *aux_entry,
-                                int trip, unsigned long temp)
+                                int trip, int temp)
 {
         u32 out;
         u32 temp_out;
@@ -272,7 +271,7 @@ failed:
 }
 
 static inline int sys_set_trip_temp(struct thermal_zone_device *tzd, int trip,
-                                unsigned long temp)
+                                int temp)
 {
         return update_trip_temp(tzd->devdata, trip, temp);
 }
@@ -289,7 +288,7 @@ static int sys_get_trip_type(struct thermal_zone_device *thermal,
 }
 
 static int sys_get_curr_temp(struct thermal_zone_device *tzd,
-                                unsigned long *temp)
+                                int *temp)
 {
         u32 out;
         int ret;
diff --git a/drivers/thermal/intel_soc_dts_iosf.c b/drivers/thermal/intel_soc_dts_iosf.c
index 42e4b6ac3875..5841d1d72996 100644
--- a/drivers/thermal/intel_soc_dts_iosf.c
+++ b/drivers/thermal/intel_soc_dts_iosf.c
@@ -80,7 +80,7 @@ err_ret:
 }
 
 static int sys_get_trip_temp(struct thermal_zone_device *tzd, int trip,
-                             unsigned long *temp)
+                             int *temp)
 {
         int status;
         u32 out;
@@ -106,7 +106,7 @@ static int sys_get_trip_temp(struct thermal_zone_device *tzd, int trip,
 }
 
 static int update_trip_temp(struct intel_soc_dts_sensor_entry *dts,
-                            int thres_index, unsigned long temp,
+                            int thres_index, int temp,
                             enum thermal_trip_type trip_type)
 {
         int status;
@@ -196,7 +196,7 @@ err_restore_ptps:
 }
 
 static int sys_set_trip_temp(struct thermal_zone_device *tzd, int trip,
-                             unsigned long temp)
+                             int temp)
 {
         struct intel_soc_dts_sensor_entry *dts = tzd->devdata;
         struct intel_soc_dts_sensors *sensors = dts->sensors;
@@ -226,7 +226,7 @@ static int sys_get_trip_type(struct thermal_zone_device *tzd,
 }
 
 static int sys_get_curr_temp(struct thermal_zone_device *tzd,
-                             unsigned long *temp)
+                             int *temp)
 {
         int status;
         u32 out;
diff --git a/drivers/thermal/kirkwood_thermal.c b/drivers/thermal/kirkwood_thermal.c
index 11041fe63dc2..892236621767 100644
--- a/drivers/thermal/kirkwood_thermal.c
+++ b/drivers/thermal/kirkwood_thermal.c
@@ -33,7 +33,7 @@ struct kirkwood_thermal_priv {
 };
 
 static int kirkwood_get_temp(struct thermal_zone_device *thermal,
-                          unsigned long *temp)
+                          int *temp)
 {
         unsigned long reg;
         struct kirkwood_thermal_priv *priv = thermal->devdata;
diff --git a/drivers/thermal/of-thermal.c b/drivers/thermal/of-thermal.c
index b295b2b6c191..42b7d4253b94 100644
--- a/drivers/thermal/of-thermal.c
+++ b/drivers/thermal/of-thermal.c
@@ -91,7 +91,7 @@ struct __thermal_zone {
 /***   DT thermal zone device callbacks   ***/
 
 static int of_thermal_get_temp(struct thermal_zone_device *tz,
-                               unsigned long *temp)
+                               int *temp)
 {
         struct __thermal_zone *data = tz->devdata;
 
@@ -177,7 +177,7 @@ EXPORT_SYMBOL_GPL(of_thermal_get_trip_points);
  * Return: zero on success, error code otherwise
  */
 static int of_thermal_set_emul_temp(struct thermal_zone_device *tz,
-                                    unsigned long temp)
+                                    int temp)
 {
         struct __thermal_zone *data = tz->devdata;
 
@@ -311,7 +311,7 @@ static int of_thermal_get_trip_type(struct thermal_zone_device *tz, int trip,
 }
 
 static int of_thermal_get_trip_temp(struct thermal_zone_device *tz, int trip,
-                                    unsigned long *temp)
+                                    int *temp)
 {
         struct __thermal_zone *data = tz->devdata;
 
@@ -324,7 +324,7 @@ static int of_thermal_get_trip_temp(struct thermal_zone_device *tz, int trip,
 }
 
 static int of_thermal_set_trip_temp(struct thermal_zone_device *tz, int trip,
-                                    unsigned long temp)
+                                    int temp)
 {
         struct __thermal_zone *data = tz->devdata;
 
@@ -338,7 +338,7 @@ static int of_thermal_set_trip_temp(struct thermal_zone_device *tz, int trip,
 }
 
 static int of_thermal_get_trip_hyst(struct thermal_zone_device *tz, int trip,
-                                    unsigned long *hyst)
+                                    int *hyst)
 {
         struct __thermal_zone *data = tz->devdata;
 
@@ -351,7 +351,7 @@ static int of_thermal_get_trip_hyst(struct thermal_zone_device *tz, int trip,
 }
 
 static int of_thermal_set_trip_hyst(struct thermal_zone_device *tz, int trip,
-                                    unsigned long hyst)
+                                    int hyst)
 {
         struct __thermal_zone *data = tz->devdata;
 
@@ -365,7 +365,7 @@ static int of_thermal_set_trip_hyst(struct thermal_zone_device *tz, int trip,
 }
 
 static int of_thermal_get_crit_temp(struct thermal_zone_device *tz,
-                                    unsigned long *temp)
+                                    int *temp)
 {
         struct __thermal_zone *data = tz->devdata;
         int i;
diff --git a/drivers/thermal/power_allocator.c b/drivers/thermal/power_allocator.c
index 251676902869..7ff96270c933 100644
--- a/drivers/thermal/power_allocator.c
+++ b/drivers/thermal/power_allocator.c
@@ -24,6 +24,8 @@
 
 #include "thermal_core.h"
 
+#define INVALID_TRIP -1
+
 #define FRAC_BITS 10
 #define int_to_frac(x) ((x) << FRAC_BITS)
 #define frac_to_int(x) ((x) >> FRAC_BITS)
@@ -56,16 +58,21 @@ static inline s64 div_frac(s64 x, s64 y)
 
 /**
  * struct power_allocator_params - parameters for the power allocator governor
+ * @allocated_tzp:      whether we have allocated tzp for this thermal zone and
+ *                      it needs to be freed on unbind
  * @err_integral:       accumulated error in the PID controller.
  * @prev_err:   error in the previous iteration of the PID controller.
  *              Used to calculate the derivative term.
  * @trip_switch_on:     first passive trip point of the thermal zone.  The
  *                      governor switches on when this trip point is crossed.
+ *                      If the thermal zone only has one passive trip point,
+ *                      @trip_switch_on should be INVALID_TRIP.
  * @trip_max_desired_temperature:       last passive trip point of the thermal
  *                                      zone.  The temperature we are
  *                                      controlling for.
  */
 struct power_allocator_params {
+        bool allocated_tzp;
         s64 err_integral;
         s32 prev_err;
         int trip_switch_on;
@@ -73,6 +80,88 @@ struct power_allocator_params {
 };
 
 /**
+ * estimate_sustainable_power() - Estimate the sustainable power of a thermal zone
+ * @tz: thermal zone we are operating in
+ *
+ * For thermal zones that don't provide a sustainable_power in their
+ * thermal_zone_params, estimate one.  Calculate it using the minimum
+ * power of all the cooling devices as that gives a valid value that
+ * can give some degree of functionality.  For optimal performance of
+ * this governor, provide a sustainable_power in the thermal zone's
+ * thermal_zone_params.
+ */
+static u32 estimate_sustainable_power(struct thermal_zone_device *tz)
+{
+        u32 sustainable_power = 0;
+        struct thermal_instance *instance;
+        struct power_allocator_params *params = tz->governor_data;
+
+        list_for_each_entry(instance, &tz->thermal_instances, tz_node) {
+                struct thermal_cooling_device *cdev = instance->cdev;
+                u32 min_power;
+
+                if (instance->trip != params->trip_max_desired_temperature)
+                        continue;
+
+                if (power_actor_get_min_power(cdev, tz, &min_power))
+                        continue;
+
+                sustainable_power += min_power;
+        }
+
+        return sustainable_power;
+}
+
+/**
+ * estimate_pid_constants() - Estimate the constants for the PID controller
+ * @tz:         thermal zone for which to estimate the constants
+ * @sustainable_power:  sustainable power for the thermal zone
+ * @trip_switch_on:     trip point number for the switch on temperature
+ * @control_temp:       target temperature for the power allocator governor
+ * @force:      whether to force the update of the constants
+ *
+ * This function is used to update the estimation of the PID
+ * controller constants in struct thermal_zone_parameters.
+ * Sustainable power is provided in case it was estimated.  The
+ * estimated sustainable_power should not be stored in the
+ * thermal_zone_parameters so it has to be passed explicitly to this
+ * function.
+ *
+ * If @force is not set, the values in the thermal zone's parameters
+ * are preserved if they are not zero.  If @force is set, the values
+ * in thermal zone's parameters are overwritten.
+ */
+static void estimate_pid_constants(struct thermal_zone_device *tz,
+                                   u32 sustainable_power, int trip_switch_on,
+                                   int control_temp, bool force)
+{
+        int ret;
+        int switch_on_temp;
+        u32 temperature_threshold;
+
+        ret = tz->ops->get_trip_temp(tz, trip_switch_on, &switch_on_temp);
+        if (ret)
+                switch_on_temp = 0;
+
+        temperature_threshold = control_temp - switch_on_temp;
+
+        if (!tz->tzp->k_po || force)
+                tz->tzp->k_po = int_to_frac(sustainable_power) /
+                        temperature_threshold;
+
+        if (!tz->tzp->k_pu || force)
+                tz->tzp->k_pu = int_to_frac(2 * sustainable_power) /
+                        temperature_threshold;
+
+        if (!tz->tzp->k_i || force)
+                tz->tzp->k_i = int_to_frac(10) / 1000;
+        /*
+         * The default for k_d and integral_cutoff is 0, so we can
+         * leave them as they are.
+         */
+}
+
+/**
  * pid_controller() - PID controller
  * @tz: thermal zone we are operating in
  * @current_temp:       the current temperature in millicelsius
@@ -92,17 +181,27 @@ struct power_allocator_params {
  * Return: The power budget for the next period.
  */
 static u32 pid_controller(struct thermal_zone_device *tz,
-                          unsigned long current_temp,
-                          unsigned long control_temp,
+                          int current_temp,
+                          int control_temp,
                           u32 max_allocatable_power)
 {
         s64 p, i, d, power_range;
         s32 err, max_power_frac;
+        u32 sustainable_power;
         struct power_allocator_params *params = tz->governor_data;
 
         max_power_frac = int_to_frac(max_allocatable_power);
 
-        err = ((s32)control_temp - (s32)current_temp);
+        if (tz->tzp->sustainable_power) {
+                sustainable_power = tz->tzp->sustainable_power;
+        } else {
+                sustainable_power = estimate_sustainable_power(tz);
+                estimate_pid_constants(tz, sustainable_power,
+                                       params->trip_switch_on, control_temp,
+                                       true);
+        }
+
+        err = control_temp - current_temp;
         err = int_to_frac(err);
 
         /* Calculate the proportional term */
@@ -139,7 +238,7 @@ static u32 pid_controller(struct thermal_zone_device *tz,
         power_range = p + i + d;
 
         /* feed-forward the known sustainable dissipatable power */
-        power_range = tz->tzp->sustainable_power + frac_to_int(power_range);
+        power_range = sustainable_power + frac_to_int(power_range);
 
         power_range = clamp(power_range, (s64)0, (s64)max_allocatable_power);
 
@@ -223,8 +322,8 @@ static void divvy_up_power(u32 *req_power, u32 *max_power, int num_actors,
 }
 
 static int allocate_power(struct thermal_zone_device *tz,
-                          unsigned long current_temp,
-                          unsigned long control_temp)
+                          int current_temp,
+                          int control_temp)
 {
         struct thermal_instance *instance;
         struct power_allocator_params *params = tz->governor_data;
@@ -247,6 +346,11 @@ static int allocate_power(struct thermal_zone_device *tz,
                 }
         }
 
+        if (!num_actors) {
+                ret = -ENODEV;
+                goto unlock;
+        }
+
         /*
          * We need to allocate five arrays of the same size:
          * req_power, max_power, granted_power, extra_actor_power and
@@ -331,7 +435,7 @@ static int allocate_power(struct thermal_zone_device *tz,
                                       granted_power, total_granted_power,
                                       num_actors, power_range,
                                       max_allocatable_power, current_temp,
-                                      (s32)control_temp - (s32)current_temp);
+                                      control_temp - current_temp);
 
         kfree(req_power);
 unlock:
@@ -340,43 +444,66 @@ unlock:
         return ret;
 }
 
-static int get_governor_trips(struct thermal_zone_device *tz,
-                              struct power_allocator_params *params)
+/**
+ * get_governor_trips() - get the number of the two trip points that are key for this governor
+ * @tz: thermal zone to operate on
+ * @params:     pointer to private data for this governor
+ *
+ * The power allocator governor works optimally with two trips points:
+ * a "switch on" trip point and a "maximum desired temperature".  These
+ * are defined as the first and last passive trip points.
+ *
+ * If there is only one trip point, then that's considered to be the
+ * "maximum desired temperature" trip point and the governor is always
+ * on.  If there are no passive or active trip points, then the
+ * governor won't do anything.  In fact, its throttle function
+ * won't be called at all.
+ */
+static void get_governor_trips(struct thermal_zone_device *tz,
+                               struct power_allocator_params *params)
 {
-        int i, ret, last_passive;
+        int i, last_active, last_passive;
         bool found_first_passive;
 
         found_first_passive = false;
-        last_passive = -1;
-        ret = -EINVAL;
+        last_active = INVALID_TRIP;
+        last_passive = INVALID_TRIP;
 
         for (i = 0; i < tz->trips; i++) {
                 enum thermal_trip_type type;
+                int ret;
 
                 ret = tz->ops->get_trip_type(tz, i, &type);
-                if (ret)
-                        return ret;
+                if (ret) {
+                        dev_warn(&tz->device,
+                                 "Failed to get trip point %d type: %d\n", i,
+                                 ret);
+                        continue;
+                }
 
-                if (!found_first_passive) {
-                        if (type == THERMAL_TRIP_PASSIVE) {
+                if (type == THERMAL_TRIP_PASSIVE) {
+                        if (!found_first_passive) {
                                 params->trip_switch_on = i;
                                 found_first_passive = true;
+                        } else  {
+                                last_passive = i;
                         }
-                } else if (type == THERMAL_TRIP_PASSIVE) {
-                        last_passive = i;
+                } else if (type == THERMAL_TRIP_ACTIVE) {
+                        last_active = i;
                 } else {
                         break;
                 }
         }
 
-        if (last_passive != -1) {
+        if (last_passive != INVALID_TRIP) {
                 params->trip_max_desired_temperature = last_passive;
-                ret = 0;
+        } else if (found_first_passive) {
+                params->trip_max_desired_temperature = params->trip_switch_on;
+                params->trip_switch_on = INVALID_TRIP;
         } else {
-                ret = -EINVAL;
+                params->trip_switch_on = INVALID_TRIP;
+                params->trip_max_desired_temperature = last_active;
         }
-
-        return ret;
 }
 
 static void reset_pid_controller(struct power_allocator_params *params)
@@ -405,60 +532,45 @@ static void allow_maximum_power(struct thermal_zone_device *tz)
  * power_allocator_bind() - bind the power_allocator governor to a thermal zone
  * @tz: thermal zone to bind it to
  *
- * Check that the thermal zone is valid for this governor, that is, it
- * has two thermal trips.  If so, initialize the PID controller
- * parameters and bind it to the thermal zone.
+ * Initialize the PID controller parameters and bind it to the thermal
+ * zone.
  *
- * Return: 0 on success, -EINVAL if the trips were invalid or -ENOMEM
- * if we ran out of memory.
+ * Return: 0 on success, or -ENOMEM if we ran out of memory.
  */
 static int power_allocator_bind(struct thermal_zone_device *tz)
 {
         int ret;
         struct power_allocator_params *params;
-        unsigned long switch_on_temp, control_temp;
-        u32 temperature_threshold;
-
-        if (!tz->tzp || !tz->tzp->sustainable_power) {
-                dev_err(&tz->device,
-                        "power_allocator: missing sustainable_power\n");
-                return -EINVAL;
-        }
+        int control_temp;
 
         params = kzalloc(sizeof(*params), GFP_KERNEL);
         if (!params)
                 return -ENOMEM;
 
-        ret = get_governor_trips(tz, params);
-        if (ret) {
-                dev_err(&tz->device,
-                        "thermal zone %s has wrong trip setup for power allocator\n",
-                        tz->type);
-                goto free;
-        }
+        if (!tz->tzp) {
+                tz->tzp = kzalloc(sizeof(*tz->tzp), GFP_KERNEL);
+                if (!tz->tzp) {
+                        ret = -ENOMEM;
+                        goto free_params;
+                }
 
-        ret = tz->ops->get_trip_temp(tz, params->trip_switch_on,
-                                     &switch_on_temp);
-        if (ret)
-                goto free;
+                params->allocated_tzp = true;
+        }
 
-        ret = tz->ops->get_trip_temp(tz, params->trip_max_desired_temperature,
-                                     &control_temp);
-        if (ret)
-                goto free;
+        if (!tz->tzp->sustainable_power)
+                dev_warn(&tz->device, "power_allocator: sustainable_power will be estimated\n");
 
-        temperature_threshold = control_temp - switch_on_temp;
+        get_governor_trips(tz, params);
 
-        tz->tzp->k_po = tz->tzp->k_po ?:
-                int_to_frac(tz->tzp->sustainable_power) / temperature_threshold;
-        tz->tzp->k_pu = tz->tzp->k_pu ?:
-                int_to_frac(2 * tz->tzp->sustainable_power) /
-                temperature_threshold;
-        tz->tzp->k_i = tz->tzp->k_i ?: int_to_frac(10) / 1000;
-        /*
-         * The default for k_d and integral_cutoff is 0, so we can
-         * leave them as they are.
-         */
+        if (tz->trips > 0) {
+                ret = tz->ops->get_trip_temp(tz,
+                                        params->trip_max_desired_temperature,
+                                        &control_temp);
+                if (!ret)
+                        estimate_pid_constants(tz, tz->tzp->sustainable_power,
+                                               params->trip_switch_on,
+                                               control_temp, false);
+        }
 
         reset_pid_controller(params);
 
@@ -466,14 +578,23 @@ static int power_allocator_bind(struct thermal_zone_device *tz)
 
         return 0;
 
-free:
+free_params:
         kfree(params);
+
         return ret;
 }
 
 static void power_allocator_unbind(struct thermal_zone_device *tz)
 {
+        struct power_allocator_params *params = tz->governor_data;
+
         dev_dbg(&tz->device, "Unbinding from thermal zone %d\n", tz->id);
+
+        if (params->allocated_tzp) {
+                kfree(tz->tzp);
+                tz->tzp = NULL;
+        }
+
         kfree(tz->governor_data);
         tz->governor_data = NULL;
 }
@@ -481,7 +602,7 @@ static void power_allocator_unbind(struct thermal_zone_device *tz)
 static int power_allocator_throttle(struct thermal_zone_device *tz, int trip)
 {
         int ret;
-        unsigned long switch_on_temp, control_temp, current_temp;
+        int switch_on_temp, control_temp, current_temp;
         struct power_allocator_params *params = tz->governor_data;
 
         /*
@@ -499,13 +620,7 @@ static int power_allocator_throttle(struct thermal_zone_device *tz, int trip)
 
         ret = tz->ops->get_trip_temp(tz, params->trip_switch_on,
                                      &switch_on_temp);
-        if (ret) {
-                dev_warn(&tz->device,
-                         "Failed to get switch on temperature: %d\n", ret);
-                return ret;
-        }
-
-        if (current_temp < switch_on_temp) {
+        if (!ret && (current_temp < switch_on_temp)) {
                 tz->passive = 0;
                 reset_pid_controller(params);
                 allow_maximum_power(tz);
diff --git a/drivers/thermal/qcom-spmi-temp-alarm.c b/drivers/thermal/qcom-spmi-temp-alarm.c
index c8d27b8fb9ec..b677aada5b52 100644
--- a/drivers/thermal/qcom-spmi-temp-alarm.c
+++ b/drivers/thermal/qcom-spmi-temp-alarm.c
@@ -117,7 +117,7 @@ static int qpnp_tm_update_temp_no_adc(struct qpnp_tm_chip *chip)
         return 0;
 }
 
-static int qpnp_tm_get_temp(void *data, long *temp)
+static int qpnp_tm_get_temp(void *data, int *temp)
 {
         struct qpnp_tm_chip *chip = data;
         int ret, mili_celsius;
diff --git a/drivers/thermal/rcar_thermal.c b/drivers/thermal/rcar_thermal.c
index fe4e767018c4..5d4ae7d705e0 100644
--- a/drivers/thermal/rcar_thermal.c
+++ b/drivers/thermal/rcar_thermal.c
@@ -200,8 +200,7 @@ err_out_unlock:
         return ret;
 }
 
-static int rcar_thermal_get_temp(struct thermal_zone_device *zone,
-                                 unsigned long *temp)
+static int rcar_thermal_get_temp(struct thermal_zone_device *zone, int *temp)
 {
         struct rcar_thermal_priv *priv = rcar_zone_to_priv(zone);
 
@@ -235,7 +234,7 @@ static int rcar_thermal_get_trip_type(struct thermal_zone_device *zone,
 }
 
 static int rcar_thermal_get_trip_temp(struct thermal_zone_device *zone,
-                                      int trip, unsigned long *temp)
+                                      int trip, int *temp)
 {
         struct rcar_thermal_priv *priv = rcar_zone_to_priv(zone);
         struct device *dev = rcar_priv_to_dev(priv);
@@ -299,7 +298,7 @@ static void _rcar_thermal_irq_ctrl(struct rcar_thermal_priv *priv, int enable)
 static void rcar_thermal_work(struct work_struct *work)
 {
         struct rcar_thermal_priv *priv;
-        unsigned long cctemp, nctemp;
+        int cctemp, nctemp;
 
         priv = container_of(work, struct rcar_thermal_priv, work.work);
 
diff --git a/drivers/thermal/rockchip_thermal.c b/drivers/thermal/rockchip_thermal.c
index cd8f5f93b42c..c89ffb26a354 100644
--- a/drivers/thermal/rockchip_thermal.c
+++ b/drivers/thermal/rockchip_thermal.c
@@ -64,7 +64,7 @@ struct rockchip_tsadc_chip {
         void (*control)(void __iomem *reg, bool on);
 
         /* Per-sensor methods */
-        int (*get_temp)(int chn, void __iomem *reg, long *temp);
+        int (*get_temp)(int chn, void __iomem *reg, int *temp);
         void (*set_tshut_temp)(int chn, void __iomem *reg, long temp);
         void (*set_tshut_mode)(int chn, void __iomem *reg, enum tshut_mode m);
 };
@@ -191,7 +191,7 @@ static u32 rk_tsadcv2_temp_to_code(long temp)
         return 0;
 }
 
-static long rk_tsadcv2_code_to_temp(u32 code)
+static int rk_tsadcv2_code_to_temp(u32 code)
 {
         unsigned int low = 0;
         unsigned int high = ARRAY_SIZE(v2_code_table) - 1;
@@ -277,7 +277,7 @@ static void rk_tsadcv2_control(void __iomem *regs, bool enable)
         writel_relaxed(val, regs + TSADCV2_AUTO_CON);
 }
 
-static int rk_tsadcv2_get_temp(int chn, void __iomem *regs, long *temp)
+static int rk_tsadcv2_get_temp(int chn, void __iomem *regs, int *temp)
 {
         u32 val;
 
@@ -366,7 +366,7 @@ static irqreturn_t rockchip_thermal_alarm_irq_thread(int irq, void *dev)
         return IRQ_HANDLED;
 }
 
-static int rockchip_thermal_get_temp(void *_sensor, long *out_temp)
+static int rockchip_thermal_get_temp(void *_sensor, int *out_temp)
 {
         struct rockchip_thermal_sensor *sensor = _sensor;
         struct rockchip_thermal_data *thermal = sensor->thermal;
@@ -374,7 +374,7 @@ static int rockchip_thermal_get_temp(void *_sensor, long *out_temp)
         int retval;
 
         retval = tsadc->get_temp(sensor->id, thermal->regs, out_temp);
-        dev_dbg(&thermal->pdev->dev, "sensor %d - temp: %ld, retval: %d\n",
+        dev_dbg(&thermal->pdev->dev, "sensor %d - temp: %d, retval: %d\n",
                 sensor->id, *out_temp, retval);
 
         return retval;
diff --git a/drivers/thermal/samsung/exynos_tmu.c b/drivers/thermal/samsung/exynos_tmu.c
index c96ff10b869e..0bae8cc6c23a 100644
--- a/drivers/thermal/samsung/exynos_tmu.c
+++ b/drivers/thermal/samsung/exynos_tmu.c
@@ -207,8 +207,7 @@ struct exynos_tmu_data {
         int (*tmu_initialize)(struct platform_device *pdev);
         void (*tmu_control)(struct platform_device *pdev, bool on);
         int (*tmu_read)(struct exynos_tmu_data *data);
-        void (*tmu_set_emulation)(struct exynos_tmu_data *data,
-                                  unsigned long temp);
+        void (*tmu_set_emulation)(struct exynos_tmu_data *data, int temp);
         void (*tmu_clear_irqs)(struct exynos_tmu_data *data);
 };
 
@@ -216,7 +215,7 @@ static void exynos_report_trigger(struct exynos_tmu_data *p)
 {
         char data[10], *envp[] = { data, NULL };
         struct thermal_zone_device *tz = p->tzd;
-        unsigned long temp;
+        int temp;
         unsigned int i;
 
         if (!tz) {
@@ -517,7 +516,7 @@ static int exynos5433_tmu_initialize(struct platform_device *pdev)
         struct thermal_zone_device *tz = data->tzd;
         unsigned int status, trim_info;
         unsigned int rising_threshold = 0, falling_threshold = 0;
-        unsigned long temp, temp_hist;
+        int temp, temp_hist;
         int ret = 0, threshold_code, i, sensor_id, cal_type;
 
         status = readb(data->base + EXYNOS_TMU_REG_STATUS);
@@ -610,7 +609,7 @@ static int exynos5440_tmu_initialize(struct platform_device *pdev)
         struct exynos_tmu_data *data = platform_get_drvdata(pdev);
         unsigned int trim_info = 0, con, rising_threshold;
         int ret = 0, threshold_code;
-        unsigned long crit_temp = 0;
+        int crit_temp = 0;
 
         /*
          * For exynos5440 soc triminfo value is swapped between TMU0 and
@@ -663,7 +662,7 @@ static int exynos7_tmu_initialize(struct platform_device *pdev)
         unsigned int status, trim_info;
         unsigned int rising_threshold = 0, falling_threshold = 0;
         int ret = 0, threshold_code, i;
-        unsigned long temp, temp_hist;
+        int temp, temp_hist;
         unsigned int reg_off, bit_off;
 
         status = readb(data->base + EXYNOS_TMU_REG_STATUS);
@@ -876,7 +875,7 @@ static void exynos7_tmu_control(struct platform_device *pdev, bool on)
         writel(con, data->base + EXYNOS_TMU_REG_CONTROL);
 }
 
-static int exynos_get_temp(void *p, long *temp)
+static int exynos_get_temp(void *p, int *temp)
 {
         struct exynos_tmu_data *data = p;
 
@@ -896,7 +895,7 @@ static int exynos_get_temp(void *p, long *temp)
 
 #ifdef CONFIG_THERMAL_EMULATION
 static u32 get_emul_con_reg(struct exynos_tmu_data *data, unsigned int val,
-                            unsigned long temp)
+                            int temp)
 {
         if (temp) {
                 temp /= MCELSIUS;
@@ -926,7 +925,7 @@ static u32 get_emul_con_reg(struct exynos_tmu_data *data, unsigned int val,
 }
 
 static void exynos4412_tmu_set_emulation(struct exynos_tmu_data *data,
-                                         unsigned long temp)
+                                         int temp)
 {
         unsigned int val;
         u32 emul_con;
@@ -946,7 +945,7 @@ static void exynos4412_tmu_set_emulation(struct exynos_tmu_data *data,
 }
 
 static void exynos5440_tmu_set_emulation(struct exynos_tmu_data *data,
-                                         unsigned long temp)
+                                         int temp)
 {
         unsigned int val;
 
@@ -955,7 +954,7 @@ static void exynos5440_tmu_set_emulation(struct exynos_tmu_data *data,
         writel(val, data->base + EXYNOS5440_TMU_S0_7_DEBUG);
 }
 
-static int exynos_tmu_set_emulation(void *drv_data, unsigned long temp)
+static int exynos_tmu_set_emulation(void *drv_data, int temp)
 {
         struct exynos_tmu_data *data = drv_data;
         int ret = -EINVAL;
@@ -978,7 +977,7 @@ out:
 #else
 #define exynos4412_tmu_set_emulation NULL
 #define exynos5440_tmu_set_emulation NULL
-static int exynos_tmu_set_emulation(void *drv_data,     unsigned long temp)
+static int exynos_tmu_set_emulation(void *drv_data, int temp)
         { return -EINVAL; }
 #endif /* CONFIG_THERMAL_EMULATION */
 
diff --git a/drivers/thermal/spear_thermal.c b/drivers/thermal/spear_thermal.c
index bddb71744a6c..534dd9136662 100644
--- a/drivers/thermal/spear_thermal.c
+++ b/drivers/thermal/spear_thermal.c
@@ -38,7 +38,7 @@ struct spear_thermal_dev {
 };
 
 static inline int thermal_get_temp(struct thermal_zone_device *thermal,
-                                unsigned long *temp)
+                                int *temp)
 {
         struct spear_thermal_dev *stdev = thermal->devdata;
 
diff --git a/drivers/thermal/st/st_thermal.c b/drivers/thermal/st/st_thermal.c
index 88c759d746c3..be637e6b01d2 100644
--- a/drivers/thermal/st/st_thermal.c
+++ b/drivers/thermal/st/st_thermal.c
@@ -111,8 +111,7 @@ static int st_thermal_calibration(struct st_thermal_sensor *sensor)
 }
 
 /* Callback to get temperature from HW*/
-static int st_thermal_get_temp(struct thermal_zone_device *th,
-                unsigned long *temperature)
+static int st_thermal_get_temp(struct thermal_zone_device *th, int *temperature)
 {
         struct st_thermal_sensor *sensor = th->devdata;
         struct device *dev = sensor->dev;
@@ -159,7 +158,7 @@ static int st_thermal_get_trip_type(struct thermal_zone_device *th,
 }
 
 static int st_thermal_get_trip_temp(struct thermal_zone_device *th,
-                                    int trip, unsigned long *temp)
+                                    int trip, int *temp)
 {
         struct st_thermal_sensor *sensor = th->devdata;
         struct device *dev = sensor->dev;
diff --git a/drivers/thermal/step_wise.c b/drivers/thermal/step_wise.c
index 5a0f12d08e8b..2f9f7086ac3d 100644
--- a/drivers/thermal/step_wise.c
+++ b/drivers/thermal/step_wise.c
@@ -113,7 +113,7 @@ static void update_passive_instance(struct thermal_zone_device *tz,
 
 static void thermal_zone_trip_update(struct thermal_zone_device *tz, int trip)
 {
-        long trip_temp;
+        int trip_temp;
         enum thermal_trip_type trip_type;
         enum thermal_trend trend;
         struct thermal_instance *instance;
@@ -135,7 +135,7 @@ static void thermal_zone_trip_update(struct thermal_zone_device *tz, int trip)
                 trace_thermal_zone_trip(tz, trip, trip_type);
         }
 
-        dev_dbg(&tz->device, "Trip%d[type=%d,temp=%ld]:trend=%d,throttle=%d\n",
+        dev_dbg(&tz->device, "Trip%d[type=%d,temp=%d]:trend=%d,throttle=%d\n",
                                 trip, trip_type, trip_temp, trend, throttle);
 
         mutex_lock(&tz->lock);
diff --git a/drivers/thermal/tegra_soctherm.c b/drivers/thermal/tegra_soctherm.c
index 9197fc05c5cc..74ea5765938b 100644
--- a/drivers/thermal/tegra_soctherm.c
+++ b/drivers/thermal/tegra_soctherm.c
@@ -293,7 +293,7 @@ static int enable_tsensor(struct tegra_soctherm *tegra,
  * H denotes an addition of 0.5 Celsius and N denotes negation
  * of the final value.
  */
-static long translate_temp(u16 val)
+static int translate_temp(u16 val)
 {
         long t;
 
@@ -306,7 +306,7 @@ static long translate_temp(u16 val)
         return t;
 }
 
-static int tegra_thermctl_get_temp(void *data, long *out_temp)
+static int tegra_thermctl_get_temp(void *data, int *out_temp)
 {
         struct tegra_thermctl_zone *zone = data;
         u32 val;
diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
index 4ca211be4c0f..d9e525cc9c1c 100644
--- a/drivers/thermal/thermal_core.c
+++ b/drivers/thermal/thermal_core.c
@@ -426,7 +426,7 @@ static void handle_non_critical_trips(struct thermal_zone_device *tz,
 static void handle_critical_trips(struct thermal_zone_device *tz,
                                 int trip, enum thermal_trip_type trip_type)
 {
-        long trip_temp;
+        int trip_temp;
 
         tz->ops->get_trip_temp(tz, trip, &trip_temp);
 
@@ -465,7 +465,7 @@ static void handle_thermal_trip(struct thermal_zone_device *tz, int trip)
 }
 
 /**
- * thermal_zone_get_temp() - returns its the temperature of thermal zone
+ * thermal_zone_get_temp() - returns the temperature of a thermal zone
  * @tz: a valid pointer to a struct thermal_zone_device
  * @temp: a valid pointer to where to store the resulting temperature.
  *
@@ -474,14 +474,12 @@ static void handle_thermal_trip(struct thermal_zone_device *tz, int trip)
  *
  * Return: On success returns 0, an error code otherwise
  */
-int thermal_zone_get_temp(struct thermal_zone_device *tz, unsigned long *temp)
+int thermal_zone_get_temp(struct thermal_zone_device *tz, int *temp)
 {
         int ret = -EINVAL;
-#ifdef CONFIG_THERMAL_EMULATION
         int count;
-        unsigned long crit_temp = -1UL;
+        int crit_temp = INT_MAX;
         enum thermal_trip_type type;
-#endif
 
         if (!tz || IS_ERR(tz) || !tz->ops->get_temp)
                 goto exit;
@@ -489,25 +487,26 @@ int thermal_zone_get_temp(struct thermal_zone_device *tz, unsigned long *temp)
         mutex_lock(&tz->lock);
 
         ret = tz->ops->get_temp(tz, temp);
-#ifdef CONFIG_THERMAL_EMULATION
-        if (!tz->emul_temperature)
-                goto skip_emul;
-
-        for (count = 0; count < tz->trips; count++) {
-                ret = tz->ops->get_trip_type(tz, count, &type);
-                if (!ret && type == THERMAL_TRIP_CRITICAL) {
-                        ret = tz->ops->get_trip_temp(tz, count, &crit_temp);
-                        break;
-                }
-        }
 
-        if (ret)
-                goto skip_emul;
+        if (IS_ENABLED(CONFIG_THERMAL_EMULATION) && tz->emul_temperature) {
+                for (count = 0; count < tz->trips; count++) {
+                        ret = tz->ops->get_trip_type(tz, count, &type);
+                        if (!ret && type == THERMAL_TRIP_CRITICAL) {
+                                ret = tz->ops->get_trip_temp(tz, count,
+                                                &crit_temp);
+                                break;
+                        }
+                }
 
-        if (*temp < crit_temp)
-                *temp = tz->emul_temperature;
-skip_emul:
-#endif
+                /*
+                 * Only allow emulating a temperature when the real temperature
+                 * is below the critical temperature so that the emulation code
+                 * cannot hide critical conditions.
+                 */
+                if (!ret && *temp < crit_temp)
+                        *temp = tz->emul_temperature;
+        }
+ 
         mutex_unlock(&tz->lock);
 exit:
         return ret;
@@ -516,8 +515,7 @@ EXPORT_SYMBOL_GPL(thermal_zone_get_temp);
 
 static void update_temperature(struct thermal_zone_device *tz)
 {
-        long temp;
-        int ret;
+        int temp, ret;
 
         ret = thermal_zone_get_temp(tz, &temp);
         if (ret) {
@@ -577,15 +575,14 @@ static ssize_t
 temp_show(struct device *dev, struct device_attribute *attr, char *buf)
 {
         struct thermal_zone_device *tz = to_thermal_zone(dev);
-        long temperature;
-        int ret;
+        int temperature, ret;
 
         ret = thermal_zone_get_temp(tz, &temperature);
 
         if (ret)
                 return ret;
 
-        return sprintf(buf, "%ld\n", temperature);
+        return sprintf(buf, "%d\n", temperature);
 }
 
 static ssize_t
@@ -689,7 +686,7 @@ trip_point_temp_show(struct device *dev, struct device_attribute *attr,
 {
         struct thermal_zone_device *tz = to_thermal_zone(dev);
         int trip, ret;
-        long temperature;
+        int temperature;
 
         if (!tz->ops->get_trip_temp)
                 return -EPERM;
@@ -702,7 +699,7 @@ trip_point_temp_show(struct device *dev, struct device_attribute *attr,
         if (ret)
                 return ret;
 
-        return sprintf(buf, "%ld\n", temperature);
+        return sprintf(buf, "%d\n", temperature);
 }
 
 static ssize_t
@@ -711,7 +708,7 @@ trip_point_hyst_store(struct device *dev, struct device_attribute *attr,
 {
         struct thermal_zone_device *tz = to_thermal_zone(dev);
         int trip, ret;
-        unsigned long temperature;
+        int temperature;
 
         if (!tz->ops->set_trip_hyst)
                 return -EPERM;
@@ -719,7 +716,7 @@ trip_point_hyst_store(struct device *dev, struct device_attribute *attr,
         if (!sscanf(attr->attr.name, "trip_point_%d_hyst", &trip))
                 return -EINVAL;
 
-        if (kstrtoul(buf, 10, &temperature))
+        if (kstrtoint(buf, 10, &temperature))
                 return -EINVAL;
 
         /*
@@ -738,7 +735,7 @@ trip_point_hyst_show(struct device *dev, struct device_attribute *attr,
 {
         struct thermal_zone_device *tz = to_thermal_zone(dev);
         int trip, ret;
-        unsigned long temperature;
+        int temperature;
 
         if (!tz->ops->get_trip_hyst)
                 return -EPERM;
@@ -748,7 +745,7 @@ trip_point_hyst_show(struct device *dev, struct device_attribute *attr,
 
         ret = tz->ops->get_trip_hyst(tz, trip, &temperature);
 
-        return ret ? ret : sprintf(buf, "%ld\n", temperature);
+        return ret ? ret : sprintf(buf, "%d\n", temperature);
 }
 
 static ssize_t
@@ -847,7 +844,27 @@ policy_show(struct device *dev, struct device_attribute *devattr, char *buf)
         return sprintf(buf, "%s\n", tz->governor->name);
 }
 
-#ifdef CONFIG_THERMAL_EMULATION
+static ssize_t
+available_policies_show(struct device *dev, struct device_attribute *devattr,
+                        char *buf)
+{
+        struct thermal_governor *pos;
+        ssize_t count = 0;
+        ssize_t size = PAGE_SIZE;
+
+        mutex_lock(&thermal_governor_lock);
+
+        list_for_each_entry(pos, &thermal_governor_list, governor_list) {
+                size = PAGE_SIZE - count;
+                count += scnprintf(buf + count, size, "%s ", pos->name);
+        }
+        count += scnprintf(buf + count, size, "\n");
+
+        mutex_unlock(&thermal_governor_lock);
+
+        return count;
+}
+
 static ssize_t
 emul_temp_store(struct device *dev, struct device_attribute *attr,
                      const char *buf, size_t count)
@@ -873,7 +890,6 @@ emul_temp_store(struct device *dev, struct device_attribute *attr,
         return ret ? ret : count;
 }
 static DEVICE_ATTR(emul_temp, S_IWUSR, NULL, emul_temp_store);
-#endif/*CONFIG_THERMAL_EMULATION*/
 
 static ssize_t
 sustainable_power_show(struct device *dev, struct device_attribute *devattr,
@@ -997,6 +1013,34 @@ int power_actor_get_max_power(struct thermal_cooling_device *cdev,
 }
 
 /**
+ * power_actor_get_min_power() - get the mainimum power that a cdev can consume
+ * @cdev:       pointer to &thermal_cooling_device
+ * @tz:         a valid thermal zone device pointer
+ * @min_power:  pointer in which to store the minimum power
+ *
+ * Calculate the minimum power consumption in milliwatts that the
+ * cooling device can currently consume and store it in @min_power.
+ *
+ * Return: 0 on success, -EINVAL if @cdev doesn't support the
+ * power_actor API or -E* on other error.
+ */
+int power_actor_get_min_power(struct thermal_cooling_device *cdev,
+                              struct thermal_zone_device *tz, u32 *min_power)
+{
+        unsigned long max_state;
+        int ret;
+
+        if (!cdev_is_power_actor(cdev))
+                return -EINVAL;
+
+        ret = cdev->ops->get_max_state(cdev, &max_state);
+        if (ret)
+                return ret;
+
+        return cdev->ops->state2power(cdev, tz, max_state, min_power);
+}
+
+/**
  * power_actor_set_power() - limit the maximum power that a cooling device can consume
  * @cdev:       pointer to &thermal_cooling_device
  * @instance:   thermal instance to update
@@ -1032,6 +1076,7 @@ static DEVICE_ATTR(temp, 0444, temp_show, NULL);
 static DEVICE_ATTR(mode, 0644, mode_show, mode_store);
 static DEVICE_ATTR(passive, S_IRUGO | S_IWUSR, passive_show, passive_store);
 static DEVICE_ATTR(policy, S_IRUGO | S_IWUSR, policy_show, policy_store);
+static DEVICE_ATTR(available_policies, S_IRUGO, available_policies_show, NULL);
 
 /* sys I/F for cooling device */
 #define to_cooling_device(_dev) \
@@ -1803,11 +1848,12 @@ struct thermal_zone_device *thermal_zone_device_register(const char *type,
                         goto unregister;
         }
 
-#ifdef CONFIG_THERMAL_EMULATION
-        result = device_create_file(&tz->device, &dev_attr_emul_temp);
-        if (result)
-                goto unregister;
-#endif
+        if (IS_ENABLED(CONFIG_THERMAL_EMULATION)) {
+                result = device_create_file(&tz->device, &dev_attr_emul_temp);
+                if (result)
+                        goto unregister;
+        }
+
         /* Create policy attribute */
         result = device_create_file(&tz->device, &dev_attr_policy);
         if (result)
@@ -1818,6 +1864,11 @@ struct thermal_zone_device *thermal_zone_device_register(const char *type,
         if (result)
                 goto unregister;
 
+        /* Create available_policies attribute */
+        result = device_create_file(&tz->device, &dev_attr_available_policies);
+        if (result)
+                goto unregister;
+
         /* Update 'this' zone's governor information */
         mutex_lock(&thermal_governor_lock);
 
@@ -1849,9 +1900,6 @@ struct thermal_zone_device *thermal_zone_device_register(const char *type,
 
         INIT_DELAYED_WORK(&(tz->poll_queue), thermal_zone_device_check);
 
-        if (!tz->ops->get_temp)
-                thermal_zone_device_set_polling(tz, 0);
-
         thermal_zone_device_update(tz);
 
         return tz;
@@ -1918,6 +1966,7 @@ void thermal_zone_device_unregister(struct thermal_zone_device *tz)
         if (tz->ops->get_mode)
                 device_remove_file(&tz->device, &dev_attr_mode);
         device_remove_file(&tz->device, &dev_attr_policy);
+        device_remove_file(&tz->device, &dev_attr_available_policies);
         remove_trip_attrs(tz);
         thermal_set_governor(tz, NULL);
 
diff --git a/drivers/thermal/thermal_hwmon.c b/drivers/thermal/thermal_hwmon.c
index 1967bee4f076..06fd2ed9ef9d 100644
--- a/drivers/thermal/thermal_hwmon.c
+++ b/drivers/thermal/thermal_hwmon.c
@@ -69,7 +69,7 @@ static DEVICE_ATTR(name, 0444, name_show, NULL);
 static ssize_t
 temp_input_show(struct device *dev, struct device_attribute *attr, char *buf)
 {
-        long temperature;
+        int temperature;
         int ret;
         struct thermal_hwmon_attr *hwmon_attr
                         = container_of(attr, struct thermal_hwmon_attr, attr);
@@ -83,7 +83,7 @@ temp_input_show(struct device *dev, struct device_attribute *attr, char *buf)
         if (ret)
                 return ret;
 
-        return sprintf(buf, "%ld\n", temperature);
+        return sprintf(buf, "%d\n", temperature);
 }
 
 static ssize_t
@@ -95,14 +95,14 @@ temp_crit_show(struct device *dev, struct device_attribute *attr, char *buf)
                         = container_of(hwmon_attr, struct thermal_hwmon_temp,
                                        temp_crit);
         struct thermal_zone_device *tz = temp->tz;
-        long temperature;
+        int temperature;
         int ret;
 
         ret = tz->ops->get_trip_temp(tz, 0, &temperature);
         if (ret)
                 return ret;
 
-        return sprintf(buf, "%ld\n", temperature);
+        return sprintf(buf, "%d\n", temperature);
 }
 
 
@@ -142,7 +142,7 @@ thermal_hwmon_lookup_temp(const struct thermal_hwmon_device *hwmon,
 
 static bool thermal_zone_crit_temp_valid(struct thermal_zone_device *tz)
 {
-        unsigned long temp;
+        int temp;
         return tz->ops->get_crit_temp && !tz->ops->get_crit_temp(tz, &temp);
 }
 
diff --git a/drivers/thermal/ti-soc-thermal/Kconfig b/drivers/thermal/ti-soc-thermal/Kconfig
index bd4c7beba679..cb6686ff09ae 100644
--- a/drivers/thermal/ti-soc-thermal/Kconfig
+++ b/drivers/thermal/ti-soc-thermal/Kconfig
@@ -1,7 +1,5 @@
 config TI_SOC_THERMAL
         tristate "Texas Instruments SoCs temperature sensor driver"
-        depends on THERMAL
-        depends on ARCH_HAS_BANDGAP
         help
           If you say yes here you get support for the Texas Instruments
           OMAP4460+ on die bandgap temperature sensor support. The register
@@ -24,7 +22,7 @@ config TI_THERMAL
 config OMAP4_THERMAL
         bool "Texas Instruments OMAP4 thermal support"
         depends on TI_SOC_THERMAL
-        depends on ARCH_OMAP4
+        depends on ARCH_OMAP4 || COMPILE_TEST
         help
           If you say yes here you get thermal support for the Texas Instruments
           OMAP4 SoC family. The current chip supported are:
@@ -38,7 +36,7 @@ config OMAP4_THERMAL
 config OMAP5_THERMAL
         bool "Texas Instruments OMAP5 thermal support"
         depends on TI_SOC_THERMAL
-        depends on SOC_OMAP5
+        depends on SOC_OMAP5 || COMPILE_TEST
         help
           If you say yes here you get thermal support for the Texas Instruments
           OMAP5 SoC family. The current chip supported are:
@@ -50,7 +48,7 @@ config OMAP5_THERMAL
 config DRA752_THERMAL
         bool "Texas Instruments DRA752 thermal support"
         depends on TI_SOC_THERMAL
-        depends on SOC_DRA7XX
+        depends on SOC_DRA7XX || COMPILE_TEST
         help
           If you say yes here you get thermal support for the Texas Instruments
           DRA752 SoC family. The current chip supported are:
diff --git a/drivers/thermal/ti-soc-thermal/ti-thermal-common.c b/drivers/thermal/ti-soc-thermal/ti-thermal-common.c
index c7c5b3779dac..b213a1222295 100644
--- a/drivers/thermal/ti-soc-thermal/ti-thermal-common.c
+++ b/drivers/thermal/ti-soc-thermal/ti-thermal-common.c
@@ -76,14 +76,14 @@ static inline int ti_thermal_hotspot_temperature(int t, int s, int c)
 
 /* thermal zone ops */
 /* Get temperature callback function for thermal zone */
-static inline int __ti_thermal_get_temp(void *devdata, long *temp)
+static inline int __ti_thermal_get_temp(void *devdata, int *temp)
 {
         struct thermal_zone_device *pcb_tz = NULL;
         struct ti_thermal_data *data = devdata;
         struct ti_bandgap *bgp;
         const struct ti_temp_sensor *s;
         int ret, tmp, slope, constant;
-        unsigned long pcb_temp;
+        int pcb_temp;
 
         if (!data)
                 return 0;
@@ -119,7 +119,7 @@ static inline int __ti_thermal_get_temp(void *devdata, long *temp)
 }
 
 static inline int ti_thermal_get_temp(struct thermal_zone_device *thermal,
-                                      unsigned long *temp)
+                                      int *temp)
 {
         struct ti_thermal_data *data = thermal->devdata;
 
@@ -229,7 +229,7 @@ static int ti_thermal_get_trip_type(struct thermal_zone_device *thermal,
 
 /* Get trip temperature callback functions for thermal zone */
 static int ti_thermal_get_trip_temp(struct thermal_zone_device *thermal,
-                                    int trip, unsigned long *temp)
+                                    int trip, int *temp)
 {
         if (!ti_thermal_is_valid_trip(trip))
                 return -EINVAL;
@@ -280,7 +280,7 @@ static int ti_thermal_get_trend(struct thermal_zone_device *thermal,
 
 /* Get critical temperature callback functions for thermal zone */
 static int ti_thermal_get_crit_temp(struct thermal_zone_device *thermal,
-                                    unsigned long *temp)
+                                    int *temp)
 {
         /* shutdown zone */
         return ti_thermal_get_trip_temp(thermal, OMAP_TRIP_NUMBER - 1, temp);
diff --git a/drivers/thermal/x86_pkg_temp_thermal.c b/drivers/thermal/x86_pkg_temp_thermal.c
index 50d1d2cb091a..7fc919f7da4d 100644
--- a/drivers/thermal/x86_pkg_temp_thermal.c
+++ b/drivers/thermal/x86_pkg_temp_thermal.c
@@ -164,7 +164,7 @@ err_ret:
         return err;
 }
 
-static int sys_get_curr_temp(struct thermal_zone_device *tzd, unsigned long *temp)
+static int sys_get_curr_temp(struct thermal_zone_device *tzd, int *temp)
 {
         u32 eax, edx;
         struct phy_dev_entry *phy_dev_entry;
@@ -175,7 +175,7 @@ static int sys_get_curr_temp(struct thermal_zone_device *tzd, unsigned long *tem
         if (eax & 0x80000000) {
                 *temp = phy_dev_entry->tj_max -
                                 ((eax >> 16) & 0x7f) * 1000;
-                pr_debug("sys_get_curr_temp %ld\n", *temp);
+                pr_debug("sys_get_curr_temp %d\n", *temp);
                 return 0;
         }
 
@@ -183,7 +183,7 @@ static int sys_get_curr_temp(struct thermal_zone_device *tzd, unsigned long *tem
 }
 
 static int sys_get_trip_temp(struct thermal_zone_device *tzd,
-                int trip, unsigned long *temp)
+                int trip, int *temp)
 {
         u32 eax, edx;
         struct phy_dev_entry *phy_dev_entry;
@@ -214,13 +214,13 @@ static int sys_get_trip_temp(struct thermal_zone_device *tzd,
                 *temp = phy_dev_entry->tj_max - thres_reg_value * 1000;
         else
                 *temp = 0;
-        pr_debug("sys_get_trip_temp %ld\n", *temp);
+        pr_debug("sys_get_trip_temp %d\n", *temp);
 
         return 0;
 }
 
 static int sys_set_trip_temp(struct thermal_zone_device *tzd, int trip,
-                                                        unsigned long temp)
+                                                        int temp)
 {
         u32 l, h;
         struct phy_dev_entry *phy_dev_entry;
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index 7d137a43cc86..9eda69e40678 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -61,8 +61,7 @@ MODULE_PARM_DESC(experimental_zcopytx, "Enable Zero Copy TX;"
 enum {
         VHOST_NET_FEATURES = VHOST_FEATURES |
                          (1ULL << VHOST_NET_F_VIRTIO_NET_HDR) |
-                         (1ULL << VIRTIO_NET_F_MRG_RXBUF) |
-                         (1ULL << VIRTIO_F_VERSION_1),
+                         (1ULL << VIRTIO_NET_F_MRG_RXBUF)
 };
 
 enum {
diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index f114a9dbb48f..e25a23692822 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -166,9 +166,7 @@ enum {
 /* Note: can't set VIRTIO_F_VERSION_1 yet, since that implies ANY_LAYOUT. */
 enum {
         VHOST_SCSI_FEATURES = VHOST_FEATURES | (1ULL << VIRTIO_SCSI_F_HOTPLUG) |
-                                               (1ULL << VIRTIO_SCSI_F_T10_PI) |
-                                               (1ULL << VIRTIO_F_ANY_LAYOUT) |
-                                               (1ULL << VIRTIO_F_VERSION_1)
+                                               (1ULL << VIRTIO_SCSI_F_T10_PI)
 };
 
 #define VHOST_SCSI_MAX_TARGET   256
diff --git a/drivers/vhost/test.c b/drivers/vhost/test.c
index d9c501eaa6c3..f2882ac98726 100644
--- a/drivers/vhost/test.c
+++ b/drivers/vhost/test.c
@@ -277,10 +277,13 @@ static long vhost_test_ioctl(struct file *f, unsigned int ioctl,
                         return -EFAULT;
                 return 0;
         case VHOST_SET_FEATURES:
+                printk(KERN_ERR "1\n");
                 if (copy_from_user(&features, featurep, sizeof features))
                         return -EFAULT;
+                printk(KERN_ERR "2\n");
                 if (features & ~VHOST_FEATURES)
                         return -EOPNOTSUPP;
+                printk(KERN_ERR "3\n");
                 return vhost_test_set_features(n, features);
         case VHOST_RESET_OWNER:
                 return vhost_test_reset_owner(n);
diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h
index ce6f6da4b09f..4772862b71a7 100644
--- a/drivers/vhost/vhost.h
+++ b/drivers/vhost/vhost.h
@@ -173,7 +173,9 @@ enum {
         VHOST_FEATURES = (1ULL << VIRTIO_F_NOTIFY_ON_EMPTY) |
                          (1ULL << VIRTIO_RING_F_INDIRECT_DESC) |
                          (1ULL << VIRTIO_RING_F_EVENT_IDX) |
-                         (1ULL << VHOST_F_LOG_ALL),
+                         (1ULL << VHOST_F_LOG_ALL) |
+                         (1ULL << VIRTIO_F_ANY_LAYOUT) |
+                         (1ULL << VIRTIO_F_VERSION_1)
 };
 
 static inline bool vhost_has_feature(struct vhost_virtqueue *vq, int bit)
diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index 55c4b5b0a317..c68edc16aa54 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -188,6 +188,15 @@ config AT91SAM9X_WATCHDOG
           Watchdog timer embedded into AT91SAM9X and AT91CAP9 chips. This will
           reboot your system when the timeout is reached.
 
+config SAMA5D4_WATCHDOG
+        tristate "Atmel SAMA5D4 Watchdog Timer"
+        depends on ARCH_AT91
+        select WATCHDOG_CORE
+        help
+          Atmel SAMA5D4 watchdog timer is embedded into SAMA5D4 chips.
+          Its Watchdog Timer Mode Register can be written more than once.
+          This will reboot your system when the timeout is reached.
+
 config CADENCE_WATCHDOG
         tristate "Cadence Watchdog Timer"
         depends on HAS_IOMEM
@@ -558,6 +567,17 @@ config DIGICOLOR_WATCHDOG
           To compile this driver as a module, choose M here: the
           module will be called digicolor_wdt.
 
+config LPC18XX_WATCHDOG
+        tristate "LPC18xx/43xx Watchdog"
+        depends on ARCH_LPC18XX || COMPILE_TEST
+        select WATCHDOG_CORE
+        help
+          Say Y here if to include support for the watchdog timer
+          in NXP LPC SoCs family, which includes LPC18xx/LPC43xx
+          processors.
+          To compile this driver as a module, choose M here: the
+          module will be called lpc18xx_wdt.
+
 # AVR32 Architecture
 
 config AT32AP700X_WDT
@@ -1334,7 +1354,7 @@ config MPC5200_WDT
 
 config 8xxx_WDT
         tristate "MPC8xxx Platform Watchdog Timer"
-        depends on PPC_8xx || PPC_83xx || PPC_86xx
+        depends on PPC_8xx || PPC_83xx || PPC_86xx || PPC_MPC512x
         select WATCHDOG_CORE
         help
           This driver is for a SoC level watchdog that exists on some
diff --git a/drivers/watchdog/Makefile b/drivers/watchdog/Makefile
index 59ea9a1b8e76..0c616e3f67bb 100644
--- a/drivers/watchdog/Makefile
+++ b/drivers/watchdog/Makefile
@@ -41,6 +41,7 @@ obj-$(CONFIG_IXP4XX_WATCHDOG) += ixp4xx_wdt.o
 obj-$(CONFIG_KS8695_WATCHDOG) += ks8695_wdt.o
 obj-$(CONFIG_S3C2410_WATCHDOG) += s3c2410_wdt.o
 obj-$(CONFIG_SA1100_WATCHDOG) += sa1100_wdt.o
+obj-$(CONFIG_SAMA5D4_WATCHDOG) += sama5d4_wdt.o
 obj-$(CONFIG_DW_WATCHDOG) += dw_wdt.o
 obj-$(CONFIG_EP93XX_WATCHDOG) += ep93xx_wdt.o
 obj-$(CONFIG_PNX4008_WATCHDOG) += pnx4008_wdt.o
@@ -66,6 +67,7 @@ obj-$(CONFIG_TEGRA_WATCHDOG) += tegra_wdt.o
 obj-$(CONFIG_MESON_WATCHDOG) += meson_wdt.o
 obj-$(CONFIG_MEDIATEK_WATCHDOG) += mtk_wdt.o
 obj-$(CONFIG_DIGICOLOR_WATCHDOG) += digicolor_wdt.o
+obj-$(CONFIG_LPC18XX_WATCHDOG) += lpc18xx_wdt.o
 
 # AVR32 Architecture
 obj-$(CONFIG_AT32AP700X_WDT) += at32ap700x_wdt.o
diff --git a/drivers/watchdog/at91rm9200_wdt.c b/drivers/watchdog/at91rm9200_wdt.c
index 9ba1153465ae..e12a797cb820 100644
--- a/drivers/watchdog/at91rm9200_wdt.c
+++ b/drivers/watchdog/at91rm9200_wdt.c
@@ -244,7 +244,7 @@ static int at91wdt_probe(struct platform_device *pdev)
         }
 
         regmap_st = syscon_node_to_regmap(parent->of_node);
-        if (!regmap_st)
+        if (IS_ERR(regmap_st))
                 return -ENODEV;
 
         res = misc_register(&at91wdt_miscdev);
diff --git a/drivers/watchdog/at91sam9_wdt.c b/drivers/watchdog/at91sam9_wdt.c
index e4698f7c5f93..7e6acaf3ece4 100644
--- a/drivers/watchdog/at91sam9_wdt.c
+++ b/drivers/watchdog/at91sam9_wdt.c
@@ -17,6 +17,7 @@
 
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
+#include <linux/clk.h>
 #include <linux/errno.h>
 #include <linux/init.h>
 #include <linux/interrupt.h>
@@ -90,6 +91,7 @@ struct at91wdt {
         unsigned long heartbeat;        /* WDT heartbeat in jiffies */
         bool nowayout;
         unsigned int irq;
+        struct clk *sclk;
 };
 
 /* ......................................................................... */
@@ -352,15 +354,25 @@ static int __init at91wdt_probe(struct platform_device *pdev)
         if (IS_ERR(wdt->base))
                 return PTR_ERR(wdt->base);
 
+        wdt->sclk = devm_clk_get(&pdev->dev, NULL);
+        if (IS_ERR(wdt->sclk))
+                return PTR_ERR(wdt->sclk);
+
+        err = clk_prepare_enable(wdt->sclk);
+        if (err) {
+                dev_err(&pdev->dev, "Could not enable slow clock\n");
+                return err;
+        }
+
         if (pdev->dev.of_node) {
                 err = of_at91wdt_init(pdev->dev.of_node, wdt);
                 if (err)
-                        return err;
+                        goto err_clk;
         }
 
         err = at91_wdt_init(pdev, wdt);
         if (err)
-                return err;
+                goto err_clk;
 
         platform_set_drvdata(pdev, wdt);
 
@@ -368,6 +380,11 @@ static int __init at91wdt_probe(struct platform_device *pdev)
                 wdt->wdd.timeout, wdt->nowayout);
 
         return 0;
+
+err_clk:
+        clk_disable_unprepare(wdt->sclk);
+
+        return err;
 }
 
 static int __exit at91wdt_remove(struct platform_device *pdev)
@@ -377,6 +394,7 @@ static int __exit at91wdt_remove(struct platform_device *pdev)
 
         pr_warn("I quit now, hardware will probably reboot!\n");
         del_timer(&wdt->timer);
+        clk_disable_unprepare(wdt->sclk);
 
         return 0;
 }
diff --git a/drivers/watchdog/at91sam9_wdt.h b/drivers/watchdog/at91sam9_wdt.h
index c6fbb2e6c41b..b79a83b467ce 100644
--- a/drivers/watchdog/at91sam9_wdt.h
+++ b/drivers/watchdog/at91sam9_wdt.h
@@ -22,11 +22,13 @@
 
 #define AT91_WDT_MR             0x04                    /* Watchdog Mode Register */
 #define         AT91_WDT_WDV            (0xfff << 0)            /* Counter Value */
+#define                 AT91_WDT_SET_WDV(x)     ((x) & AT91_WDT_WDV)
 #define         AT91_WDT_WDFIEN         (1     << 12)           /* Fault Interrupt Enable */
 #define         AT91_WDT_WDRSTEN        (1     << 13)           /* Reset Processor */
 #define         AT91_WDT_WDRPROC        (1     << 14)           /* Timer Restart */
 #define         AT91_WDT_WDDIS          (1     << 15)           /* Watchdog Disable */
 #define         AT91_WDT_WDD            (0xfff << 16)           /* Delta Value */
+#define                 AT91_WDT_SET_WDD(x)     (((x) << 16) & AT91_WDT_WDD)
 #define         AT91_WDT_WDDBGHLT       (1     << 28)           /* Debug Halt */
 #define         AT91_WDT_WDIDLEHLT      (1     << 29)           /* Idle Halt */
 
diff --git a/drivers/watchdog/bcm2835_wdt.c b/drivers/watchdog/bcm2835_wdt.c
index 7116968dee12..66c3e656a616 100644
--- a/drivers/watchdog/bcm2835_wdt.c
+++ b/drivers/watchdog/bcm2835_wdt.c
@@ -182,6 +182,7 @@ static int bcm2835_wdt_probe(struct platform_device *pdev)
         watchdog_set_drvdata(&bcm2835_wdt_wdd, wdt);
         watchdog_init_timeout(&bcm2835_wdt_wdd, heartbeat, dev);
         watchdog_set_nowayout(&bcm2835_wdt_wdd, nowayout);
+        bcm2835_wdt_wdd.parent = &pdev->dev;
         err = watchdog_register_device(&bcm2835_wdt_wdd);
         if (err) {
                 dev_err(dev, "Failed to register watchdog device");
diff --git a/drivers/watchdog/bcm47xx_wdt.c b/drivers/watchdog/bcm47xx_wdt.c
index b28a072abf78..4064a43f1360 100644
--- a/drivers/watchdog/bcm47xx_wdt.c
+++ b/drivers/watchdog/bcm47xx_wdt.c
@@ -209,6 +209,7 @@ static int bcm47xx_wdt_probe(struct platform_device *pdev)
 
         wdt->wdd.info = &bcm47xx_wdt_info;
         wdt->wdd.timeout = WDT_DEFAULT_TIME;
+        wdt->wdd.parent = &pdev->dev;
         ret = wdt->wdd.ops->set_timeout(&wdt->wdd, timeout);
         if (ret)
                 goto err_timer;
diff --git a/drivers/watchdog/bcm_kona_wdt.c b/drivers/watchdog/bcm_kona_wdt.c
index 22d8ae65772a..e0c98423f2c9 100644
--- a/drivers/watchdog/bcm_kona_wdt.c
+++ b/drivers/watchdog/bcm_kona_wdt.c
@@ -319,6 +319,7 @@ static int bcm_kona_wdt_probe(struct platform_device *pdev)
         spin_lock_init(&wdt->lock);
         platform_set_drvdata(pdev, wdt);
         watchdog_set_drvdata(&bcm_kona_wdt_wdd, wdt);
+        bcm_kona_wdt_wdd.parent = &pdev->dev;
 
         ret = bcm_kona_wdt_set_timeout_reg(&bcm_kona_wdt_wdd, 0);
         if (ret) {
diff --git a/drivers/watchdog/booke_wdt.c b/drivers/watchdog/booke_wdt.c
index e96b09b135c8..04da4b66c75e 100644
--- a/drivers/watchdog/booke_wdt.c
+++ b/drivers/watchdog/booke_wdt.c
@@ -186,8 +186,6 @@ static int booke_wdt_stop(struct watchdog_device *wdog)
 static int booke_wdt_set_timeout(struct watchdog_device *wdt_dev,
                                  unsigned int timeout)
 {
-        if (timeout > MAX_WDT_TIMEOUT)
-                return -EINVAL;
         wdt_dev->timeout = timeout;
         booke_wdt_set(wdt_dev);
 
@@ -211,7 +209,6 @@ static struct watchdog_device booke_wdt_dev = {
         .info = &booke_wdt_info,
         .ops = &booke_wdt_ops,
         .min_timeout = 1,
-        .max_timeout = 0xFFFF
 };
 
 static void __exit booke_wdt_exit(void)
@@ -229,6 +226,7 @@ static int __init booke_wdt_init(void)
         booke_wdt_set_timeout(&booke_wdt_dev,
                               period_to_sec(booke_wdt_period));
         watchdog_set_nowayout(&booke_wdt_dev, nowayout);
+        booke_wdt_dev.max_timeout = MAX_WDT_TIMEOUT;
         if (booke_wdt_enabled)
                 booke_wdt_start(&booke_wdt_dev);
 
diff --git a/drivers/watchdog/coh901327_wdt.c b/drivers/watchdog/coh901327_wdt.c
index ce12f437f195..a099b77fc0b9 100644
--- a/drivers/watchdog/coh901327_wdt.c
+++ b/drivers/watchdog/coh901327_wdt.c
@@ -358,6 +358,7 @@ static int __init coh901327_probe(struct platform_device *pdev)
         if (ret < 0)
                 coh901327_wdt.timeout = 60;
 
+        coh901327_wdt.parent = &pdev->dev;
         ret = watchdog_register_device(&coh901327_wdt);
         if (ret == 0)
                 dev_info(&pdev->dev,
diff --git a/drivers/watchdog/da9052_wdt.c b/drivers/watchdog/da9052_wdt.c
index 2e9589652e1e..67e67977bd29 100644
--- a/drivers/watchdog/da9052_wdt.c
+++ b/drivers/watchdog/da9052_wdt.c
@@ -195,6 +195,7 @@ static int da9052_wdt_probe(struct platform_device *pdev)
         da9052_wdt->timeout = DA9052_DEF_TIMEOUT;
         da9052_wdt->info = &da9052_wdt_info;
         da9052_wdt->ops = &da9052_wdt_ops;
+        da9052_wdt->parent = &pdev->dev;
         watchdog_set_drvdata(da9052_wdt, driver_data);
 
         kref_init(&driver_data->kref);
diff --git a/drivers/watchdog/da9055_wdt.c b/drivers/watchdog/da9055_wdt.c
index 495089d8dbfe..04d1430d93d2 100644
--- a/drivers/watchdog/da9055_wdt.c
+++ b/drivers/watchdog/da9055_wdt.c
@@ -161,6 +161,7 @@ static int da9055_wdt_probe(struct platform_device *pdev)
         da9055_wdt->timeout = DA9055_DEF_TIMEOUT;
         da9055_wdt->info = &da9055_wdt_info;
         da9055_wdt->ops = &da9055_wdt_ops;
+        da9055_wdt->parent = &pdev->dev;
         watchdog_set_nowayout(da9055_wdt, nowayout);
         watchdog_set_drvdata(da9055_wdt, driver_data);
 
diff --git a/drivers/watchdog/da9062_wdt.c b/drivers/watchdog/da9062_wdt.c
index b3a870ce85be..7386111220d5 100644
--- a/drivers/watchdog/da9062_wdt.c
+++ b/drivers/watchdog/da9062_wdt.c
@@ -210,6 +210,7 @@ static int da9062_wdt_probe(struct platform_device *pdev)
         wdt->wdtdev.max_timeout = DA9062_WDT_MAX_TIMEOUT;
         wdt->wdtdev.timeout = DA9062_WDG_DEFAULT_TIMEOUT;
         wdt->wdtdev.status = WATCHDOG_NOWAYOUT_INIT_STATUS;
+        wdt->wdtdev.parent = &pdev->dev;
 
         watchdog_set_drvdata(&wdt->wdtdev, wdt);
         dev_set_drvdata(&pdev->dev, wdt);
diff --git a/drivers/watchdog/da9063_wdt.c b/drivers/watchdog/da9063_wdt.c
index e2fe2ebdebd4..6bf130bd863d 100644
--- a/drivers/watchdog/da9063_wdt.c
+++ b/drivers/watchdog/da9063_wdt.c
@@ -175,6 +175,7 @@ static int da9063_wdt_probe(struct platform_device *pdev)
         wdt->wdtdev.min_timeout = DA9063_WDT_MIN_TIMEOUT;
         wdt->wdtdev.max_timeout = DA9063_WDT_MAX_TIMEOUT;
         wdt->wdtdev.timeout = DA9063_WDG_TIMEOUT;
+        wdt->wdtdev.parent = &pdev->dev;
 
         wdt->wdtdev.status = WATCHDOG_NOWAYOUT_INIT_STATUS;
 
diff --git a/drivers/watchdog/davinci_wdt.c b/drivers/watchdog/davinci_wdt.c
index cfdf8a408aea..17454ca653f4 100644
--- a/drivers/watchdog/davinci_wdt.c
+++ b/drivers/watchdog/davinci_wdt.c
@@ -179,6 +179,7 @@ static int davinci_wdt_probe(struct platform_device *pdev)
         wdd->min_timeout        = 1;
         wdd->max_timeout        = MAX_HEARTBEAT;
         wdd->timeout            = DEFAULT_HEARTBEAT;
+        wdd->parent             = &pdev->dev;
 
         watchdog_init_timeout(wdd, heartbeat, dev);
 
diff --git a/drivers/watchdog/digicolor_wdt.c b/drivers/watchdog/digicolor_wdt.c
index 31d8e4936611..50abe1bf62a5 100644
--- a/drivers/watchdog/digicolor_wdt.c
+++ b/drivers/watchdog/digicolor_wdt.c
@@ -143,6 +143,7 @@ static int dc_wdt_probe(struct platform_device *pdev)
         }
         dc_wdt_wdd.max_timeout = U32_MAX / clk_get_rate(wdt->clk);
         dc_wdt_wdd.timeout = dc_wdt_wdd.max_timeout;
+        dc_wdt_wdd.parent = &pdev->dev;
 
         spin_lock_init(&wdt->lock);
 
diff --git a/drivers/watchdog/ep93xx_wdt.c b/drivers/watchdog/ep93xx_wdt.c
index 7a2cc7191c58..0a4d7cc05d54 100644
--- a/drivers/watchdog/ep93xx_wdt.c
+++ b/drivers/watchdog/ep93xx_wdt.c
@@ -132,6 +132,7 @@ static int ep93xx_wdt_probe(struct platform_device *pdev)
         val = readl(mmio_base + EP93XX_WATCHDOG);
         ep93xx_wdt_wdd.bootstatus = (val & 0x01) ? WDIOF_CARDRESET : 0;
         ep93xx_wdt_wdd.timeout = timeout;
+        ep93xx_wdt_wdd.parent = &pdev->dev;
 
         watchdog_set_nowayout(&ep93xx_wdt_wdd, nowayout);
 
diff --git a/drivers/watchdog/gpio_wdt.c b/drivers/watchdog/gpio_wdt.c
index 1687cc2d7122..90d59d3f38a3 100644
--- a/drivers/watchdog/gpio_wdt.c
+++ b/drivers/watchdog/gpio_wdt.c
@@ -50,12 +50,41 @@ static void gpio_wdt_disable(struct gpio_wdt_priv *priv)
                 gpio_direction_input(priv->gpio);
 }
 
+static void gpio_wdt_hwping(unsigned long data)
+{
+        struct watchdog_device *wdd = (struct watchdog_device *)data;
+        struct gpio_wdt_priv *priv = watchdog_get_drvdata(wdd);
+
+        if (priv->armed && time_after(jiffies, priv->last_jiffies +
+                                      msecs_to_jiffies(wdd->timeout * 1000))) {
+                dev_crit(wdd->dev, "Timer expired. System will reboot soon!\n");
+                return;
+        }
+
+        /* Restart timer */
+        mod_timer(&priv->timer, jiffies + priv->hw_margin);
+
+        switch (priv->hw_algo) {
+        case HW_ALGO_TOGGLE:
+                /* Toggle output pin */
+                priv->state = !priv->state;
+                gpio_set_value_cansleep(priv->gpio, priv->state);
+                break;
+        case HW_ALGO_LEVEL:
+                /* Pulse */
+                gpio_set_value_cansleep(priv->gpio, !priv->active_low);
+                udelay(1);
+                gpio_set_value_cansleep(priv->gpio, priv->active_low);
+                break;
+        }
+}
+
 static void gpio_wdt_start_impl(struct gpio_wdt_priv *priv)
 {
         priv->state = priv->active_low;
         gpio_direction_output(priv->gpio, priv->state);
         priv->last_jiffies = jiffies;
-        mod_timer(&priv->timer, priv->last_jiffies + priv->hw_margin);
+        gpio_wdt_hwping((unsigned long)&priv->wdd);
 }
 
 static int gpio_wdt_start(struct watchdog_device *wdd)
@@ -97,35 +126,6 @@ static int gpio_wdt_set_timeout(struct watchdog_device *wdd, unsigned int t)
         return gpio_wdt_ping(wdd);
 }
 
-static void gpio_wdt_hwping(unsigned long data)
-{
-        struct watchdog_device *wdd = (struct watchdog_device *)data;
-        struct gpio_wdt_priv *priv = watchdog_get_drvdata(wdd);
-
-        if (priv->armed && time_after(jiffies, priv->last_jiffies +
-                                      msecs_to_jiffies(wdd->timeout * 1000))) {
-                dev_crit(wdd->dev, "Timer expired. System will reboot soon!\n");
-                return;
-        }
-
-        /* Restart timer */
-        mod_timer(&priv->timer, jiffies + priv->hw_margin);
-
-        switch (priv->hw_algo) {
-        case HW_ALGO_TOGGLE:
-                /* Toggle output pin */
-                priv->state = !priv->state;
-                gpio_set_value_cansleep(priv->gpio, priv->state);
-                break;
-        case HW_ALGO_LEVEL:
-                /* Pulse */
-                gpio_set_value_cansleep(priv->gpio, !priv->active_low);
-                udelay(1);
-                gpio_set_value_cansleep(priv->gpio, priv->active_low);
-                break;
-        }
-}
-
 static int gpio_wdt_notify_sys(struct notifier_block *nb, unsigned long code,
                                void *unused)
 {
@@ -182,10 +182,10 @@ static int gpio_wdt_probe(struct platform_device *pdev)
         ret = of_property_read_string(pdev->dev.of_node, "hw_algo", &algo);
         if (ret)
                 return ret;
-        if (!strncmp(algo, "toggle", 6)) {
+        if (!strcmp(algo, "toggle")) {
                 priv->hw_algo = HW_ALGO_TOGGLE;
                 f = GPIOF_IN;
-        } else if (!strncmp(algo, "level", 5)) {
+        } else if (!strcmp(algo, "level")) {
                 priv->hw_algo = HW_ALGO_LEVEL;
                 f = priv->active_low ? GPIOF_OUT_INIT_HIGH : GPIOF_OUT_INIT_LOW;
         } else {
@@ -217,6 +217,7 @@ static int gpio_wdt_probe(struct platform_device *pdev)
         priv->wdd.ops           = &gpio_wdt_ops;
         priv->wdd.min_timeout   = SOFT_TIMEOUT_MIN;
         priv->wdd.max_timeout   = SOFT_TIMEOUT_MAX;
+        priv->wdd.parent        = &pdev->dev;
 
         if (watchdog_init_timeout(&priv->wdd, 0, &pdev->dev) < 0)
                 priv->wdd.timeout = SOFT_TIMEOUT_DEF;
diff --git a/drivers/watchdog/ie6xx_wdt.c b/drivers/watchdog/ie6xx_wdt.c
index 9bc39ae51624..78c2541f5d52 100644
--- a/drivers/watchdog/ie6xx_wdt.c
+++ b/drivers/watchdog/ie6xx_wdt.c
@@ -267,6 +267,7 @@ static int ie6xx_wdt_probe(struct platform_device *pdev)
 
         ie6xx_wdt_dev.timeout = timeout;
         watchdog_set_nowayout(&ie6xx_wdt_dev, nowayout);
+        ie6xx_wdt_dev.parent = &pdev->dev;
 
         spin_lock_init(&ie6xx_wdt_data.unlock_sequence);
 
diff --git a/drivers/watchdog/imgpdc_wdt.c b/drivers/watchdog/imgpdc_wdt.c
index 0f73621827ab..15ab07230960 100644
--- a/drivers/watchdog/imgpdc_wdt.c
+++ b/drivers/watchdog/imgpdc_wdt.c
@@ -316,6 +316,7 @@ static int pdc_wdt_remove(struct platform_device *pdev)
 {
         struct pdc_wdt_dev *pdc_wdt = platform_get_drvdata(pdev);
 
+        unregister_restart_handler(&pdc_wdt->restart_handler);
         pdc_wdt_stop(&pdc_wdt->wdt_dev);
         watchdog_unregister_device(&pdc_wdt->wdt_dev);
         clk_disable_unprepare(pdc_wdt->wdt_clk);
diff --git a/drivers/watchdog/intel-mid_wdt.c b/drivers/watchdog/intel-mid_wdt.c
index 84f6701c391f..0a436b5d1e84 100644
--- a/drivers/watchdog/intel-mid_wdt.c
+++ b/drivers/watchdog/intel-mid_wdt.c
@@ -137,6 +137,7 @@ static int mid_wdt_probe(struct platform_device *pdev)
         wdt_dev->min_timeout = MID_WDT_TIMEOUT_MIN;
         wdt_dev->max_timeout = MID_WDT_TIMEOUT_MAX;
         wdt_dev->timeout = MID_WDT_DEFAULT_TIMEOUT;
+        wdt_dev->parent = &pdev->dev;
 
         watchdog_set_drvdata(wdt_dev, &pdev->dev);
         platform_set_drvdata(pdev, wdt_dev);
diff --git a/drivers/watchdog/jz4740_wdt.c b/drivers/watchdog/jz4740_wdt.c
index 4c2cc09c0c57..6a7d5c365438 100644
--- a/drivers/watchdog/jz4740_wdt.c
+++ b/drivers/watchdog/jz4740_wdt.c
@@ -174,6 +174,7 @@ static int jz4740_wdt_probe(struct platform_device *pdev)
         jz4740_wdt->timeout = heartbeat;
         jz4740_wdt->min_timeout = 1;
         jz4740_wdt->max_timeout = MAX_HEARTBEAT;
+        jz4740_wdt->parent = &pdev->dev;
         watchdog_set_nowayout(jz4740_wdt, nowayout);
         watchdog_set_drvdata(jz4740_wdt, drvdata);
 
diff --git a/drivers/watchdog/lpc18xx_wdt.c b/drivers/watchdog/lpc18xx_wdt.c
new file mode 100644
index 000000000000..ab7b8b185d99
--- /dev/null
+++ b/drivers/watchdog/lpc18xx_wdt.c
@@ -0,0 +1,340 @@
+/*
+ * NXP LPC18xx Watchdog Timer (WDT)
+ *
+ * Copyright (c) 2015 Ariel D'Alessandro <ariel@vanguardiasur.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation.
+ *
+ * Notes
+ * -----
+ * The Watchdog consists of a fixed divide-by-4 clock pre-scaler and a 24-bit
+ * counter which decrements on every clock cycle.
+ */
+
+#include <linux/clk.h>
+#include <linux/io.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
+#include <linux/reboot.h>
+#include <linux/watchdog.h>
+
+/* Registers */
+#define LPC18XX_WDT_MOD                 0x00
+#define LPC18XX_WDT_MOD_WDEN            BIT(0)
+#define LPC18XX_WDT_MOD_WDRESET         BIT(1)
+
+#define LPC18XX_WDT_TC                  0x04
+#define LPC18XX_WDT_TC_MIN              0xff
+#define LPC18XX_WDT_TC_MAX              0xffffff
+
+#define LPC18XX_WDT_FEED                0x08
+#define LPC18XX_WDT_FEED_MAGIC1         0xaa
+#define LPC18XX_WDT_FEED_MAGIC2         0x55
+
+#define LPC18XX_WDT_TV                  0x0c
+
+/* Clock pre-scaler */
+#define LPC18XX_WDT_CLK_DIV             4
+
+/* Timeout values in seconds */
+#define LPC18XX_WDT_DEF_TIMEOUT         30U
+
+static int heartbeat;
+module_param(heartbeat, int, 0);
+MODULE_PARM_DESC(heartbeat, "Watchdog heartbeats in seconds (default="
+                 __MODULE_STRING(LPC18XX_WDT_DEF_TIMEOUT) ")");
+
+static bool nowayout = WATCHDOG_NOWAYOUT;
+module_param(nowayout, bool, 0);
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default="
+                 __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
+
+struct lpc18xx_wdt_dev {
+        struct watchdog_device  wdt_dev;
+        struct clk              *reg_clk;
+        struct clk              *wdt_clk;
+        unsigned long           clk_rate;
+        void __iomem            *base;
+        struct timer_list       timer;
+        struct notifier_block   restart_handler;
+        spinlock_t              lock;
+};
+
+static int lpc18xx_wdt_feed(struct watchdog_device *wdt_dev)
+{
+        struct lpc18xx_wdt_dev *lpc18xx_wdt = watchdog_get_drvdata(wdt_dev);
+        unsigned long flags;
+
+        /*
+         * An abort condition will occur if an interrupt happens during the feed
+         * sequence.
+         */
+        spin_lock_irqsave(&lpc18xx_wdt->lock, flags);
+        writel(LPC18XX_WDT_FEED_MAGIC1, lpc18xx_wdt->base + LPC18XX_WDT_FEED);
+        writel(LPC18XX_WDT_FEED_MAGIC2, lpc18xx_wdt->base + LPC18XX_WDT_FEED);
+        spin_unlock_irqrestore(&lpc18xx_wdt->lock, flags);
+
+        return 0;
+}
+
+static void lpc18xx_wdt_timer_feed(unsigned long data)
+{
+        struct watchdog_device *wdt_dev = (struct watchdog_device *)data;
+        struct lpc18xx_wdt_dev *lpc18xx_wdt = watchdog_get_drvdata(wdt_dev);
+
+        lpc18xx_wdt_feed(wdt_dev);
+
+        /* Use safe value (1/2 of real timeout) */
+        mod_timer(&lpc18xx_wdt->timer, jiffies +
+                  msecs_to_jiffies((wdt_dev->timeout * MSEC_PER_SEC) / 2));
+}
+
+/*
+ * Since LPC18xx Watchdog cannot be disabled in hardware, we must keep feeding
+ * it with a timer until userspace watchdog software takes over.
+ */
+static int lpc18xx_wdt_stop(struct watchdog_device *wdt_dev)
+{
+        lpc18xx_wdt_timer_feed((unsigned long)wdt_dev);
+
+        return 0;
+}
+
+static void __lpc18xx_wdt_set_timeout(struct lpc18xx_wdt_dev *lpc18xx_wdt)
+{
+        unsigned int val;
+
+        val = DIV_ROUND_UP(lpc18xx_wdt->wdt_dev.timeout * lpc18xx_wdt->clk_rate,
+                           LPC18XX_WDT_CLK_DIV);
+        writel(val, lpc18xx_wdt->base + LPC18XX_WDT_TC);
+}
+
+static int lpc18xx_wdt_set_timeout(struct watchdog_device *wdt_dev,
+                                   unsigned int new_timeout)
+{
+        struct lpc18xx_wdt_dev *lpc18xx_wdt = watchdog_get_drvdata(wdt_dev);
+
+        lpc18xx_wdt->wdt_dev.timeout = new_timeout;
+        __lpc18xx_wdt_set_timeout(lpc18xx_wdt);
+
+        return 0;
+}
+
+static unsigned int lpc18xx_wdt_get_timeleft(struct watchdog_device *wdt_dev)
+{
+        struct lpc18xx_wdt_dev *lpc18xx_wdt = watchdog_get_drvdata(wdt_dev);
+        unsigned int val;
+
+        val = readl(lpc18xx_wdt->base + LPC18XX_WDT_TV);
+        return (val * LPC18XX_WDT_CLK_DIV) / lpc18xx_wdt->clk_rate;
+}
+
+static int lpc18xx_wdt_start(struct watchdog_device *wdt_dev)
+{
+        struct lpc18xx_wdt_dev *lpc18xx_wdt = watchdog_get_drvdata(wdt_dev);
+        unsigned int val;
+
+        if (timer_pending(&lpc18xx_wdt->timer))
+                del_timer(&lpc18xx_wdt->timer);
+
+        val = readl(lpc18xx_wdt->base + LPC18XX_WDT_MOD);
+        val |= LPC18XX_WDT_MOD_WDEN;
+        val |= LPC18XX_WDT_MOD_WDRESET;
+        writel(val, lpc18xx_wdt->base + LPC18XX_WDT_MOD);
+
+        /*
+         * Setting the WDEN bit in the WDMOD register is not sufficient to
+         * enable the Watchdog. A valid feed sequence must be completed after
+         * setting WDEN before the Watchdog is capable of generating a reset.
+         */
+        lpc18xx_wdt_feed(wdt_dev);
+
+        return 0;
+}
+
+static struct watchdog_info lpc18xx_wdt_info = {
+        .identity       = "NXP LPC18xx Watchdog",
+        .options        = WDIOF_SETTIMEOUT |
+                          WDIOF_KEEPALIVEPING |
+                          WDIOF_MAGICCLOSE,
+};
+
+static const struct watchdog_ops lpc18xx_wdt_ops = {
+        .owner          = THIS_MODULE,
+        .start          = lpc18xx_wdt_start,
+        .stop           = lpc18xx_wdt_stop,
+        .ping           = lpc18xx_wdt_feed,
+        .set_timeout    = lpc18xx_wdt_set_timeout,
+        .get_timeleft   = lpc18xx_wdt_get_timeleft,
+};
+
+static int lpc18xx_wdt_restart(struct notifier_block *this, unsigned long mode,
+                               void *cmd)
+{
+        struct lpc18xx_wdt_dev *lpc18xx_wdt = container_of(this,
+                                struct lpc18xx_wdt_dev, restart_handler);
+        unsigned long flags;
+        int val;
+
+        /*
+         * Incorrect feed sequence causes immediate watchdog reset if enabled.
+         */
+        spin_lock_irqsave(&lpc18xx_wdt->lock, flags);
+
+        val = readl(lpc18xx_wdt->base + LPC18XX_WDT_MOD);
+        val |= LPC18XX_WDT_MOD_WDEN;
+        val |= LPC18XX_WDT_MOD_WDRESET;
+        writel(val, lpc18xx_wdt->base + LPC18XX_WDT_MOD);
+
+        writel(LPC18XX_WDT_FEED_MAGIC1, lpc18xx_wdt->base + LPC18XX_WDT_FEED);
+        writel(LPC18XX_WDT_FEED_MAGIC2, lpc18xx_wdt->base + LPC18XX_WDT_FEED);
+
+        writel(LPC18XX_WDT_FEED_MAGIC1, lpc18xx_wdt->base + LPC18XX_WDT_FEED);
+        writel(LPC18XX_WDT_FEED_MAGIC1, lpc18xx_wdt->base + LPC18XX_WDT_FEED);
+
+        spin_unlock_irqrestore(&lpc18xx_wdt->lock, flags);
+
+        return NOTIFY_OK;
+}
+
+static int lpc18xx_wdt_probe(struct platform_device *pdev)
+{
+        struct lpc18xx_wdt_dev *lpc18xx_wdt;
+        struct device *dev = &pdev->dev;
+        struct resource *res;
+        int ret;
+
+        lpc18xx_wdt = devm_kzalloc(dev, sizeof(*lpc18xx_wdt), GFP_KERNEL);
+        if (!lpc18xx_wdt)
+                return -ENOMEM;
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        lpc18xx_wdt->base = devm_ioremap_resource(dev, res);
+        if (IS_ERR(lpc18xx_wdt->base))
+                return PTR_ERR(lpc18xx_wdt->base);
+
+        lpc18xx_wdt->reg_clk = devm_clk_get(dev, "reg");
+        if (IS_ERR(lpc18xx_wdt->reg_clk)) {
+                dev_err(dev, "failed to get the reg clock\n");
+                return PTR_ERR(lpc18xx_wdt->reg_clk);
+        }
+
+        lpc18xx_wdt->wdt_clk = devm_clk_get(dev, "wdtclk");
+        if (IS_ERR(lpc18xx_wdt->wdt_clk)) {
+                dev_err(dev, "failed to get the wdt clock\n");
+                return PTR_ERR(lpc18xx_wdt->wdt_clk);
+        }
+
+        ret = clk_prepare_enable(lpc18xx_wdt->reg_clk);
+        if (ret) {
+                dev_err(dev, "could not prepare or enable sys clock\n");
+                return ret;
+        }
+
+        ret = clk_prepare_enable(lpc18xx_wdt->wdt_clk);
+        if (ret) {
+                dev_err(dev, "could not prepare or enable wdt clock\n");
+                goto disable_reg_clk;
+        }
+
+        /* We use the clock rate to calculate timeouts */
+        lpc18xx_wdt->clk_rate = clk_get_rate(lpc18xx_wdt->wdt_clk);
+        if (lpc18xx_wdt->clk_rate == 0) {
+                dev_err(dev, "failed to get clock rate\n");
+                ret = -EINVAL;
+                goto disable_wdt_clk;
+        }
+
+        lpc18xx_wdt->wdt_dev.info = &lpc18xx_wdt_info;
+        lpc18xx_wdt->wdt_dev.ops = &lpc18xx_wdt_ops;
+
+        lpc18xx_wdt->wdt_dev.min_timeout = DIV_ROUND_UP(LPC18XX_WDT_TC_MIN *
+                                LPC18XX_WDT_CLK_DIV, lpc18xx_wdt->clk_rate);
+
+        lpc18xx_wdt->wdt_dev.max_timeout = (LPC18XX_WDT_TC_MAX *
+                                LPC18XX_WDT_CLK_DIV) / lpc18xx_wdt->clk_rate;
+
+        lpc18xx_wdt->wdt_dev.timeout = min(lpc18xx_wdt->wdt_dev.max_timeout,
+                                           LPC18XX_WDT_DEF_TIMEOUT);
+
+        spin_lock_init(&lpc18xx_wdt->lock);
+
+        lpc18xx_wdt->wdt_dev.parent = dev;
+        watchdog_set_drvdata(&lpc18xx_wdt->wdt_dev, lpc18xx_wdt);
+
+        ret = watchdog_init_timeout(&lpc18xx_wdt->wdt_dev, heartbeat, dev);
+
+        __lpc18xx_wdt_set_timeout(lpc18xx_wdt);
+
+        setup_timer(&lpc18xx_wdt->timer, lpc18xx_wdt_timer_feed,
+                    (unsigned long)&lpc18xx_wdt->wdt_dev);
+
+        watchdog_set_nowayout(&lpc18xx_wdt->wdt_dev, nowayout);
+
+        platform_set_drvdata(pdev, lpc18xx_wdt);
+
+        ret = watchdog_register_device(&lpc18xx_wdt->wdt_dev);
+        if (ret)
+                goto disable_wdt_clk;
+
+        lpc18xx_wdt->restart_handler.notifier_call = lpc18xx_wdt_restart;
+        lpc18xx_wdt->restart_handler.priority = 128;
+        ret = register_restart_handler(&lpc18xx_wdt->restart_handler);
+        if (ret)
+                dev_warn(dev, "failed to register restart handler: %d\n", ret);
+
+        return 0;
+
+disable_wdt_clk:
+        clk_disable_unprepare(lpc18xx_wdt->wdt_clk);
+disable_reg_clk:
+        clk_disable_unprepare(lpc18xx_wdt->reg_clk);
+        return ret;
+}
+
+static void lpc18xx_wdt_shutdown(struct platform_device *pdev)
+{
+        struct lpc18xx_wdt_dev *lpc18xx_wdt = platform_get_drvdata(pdev);
+
+        lpc18xx_wdt_stop(&lpc18xx_wdt->wdt_dev);
+}
+
+static int lpc18xx_wdt_remove(struct platform_device *pdev)
+{
+        struct lpc18xx_wdt_dev *lpc18xx_wdt = platform_get_drvdata(pdev);
+
+        unregister_restart_handler(&lpc18xx_wdt->restart_handler);
+
+        dev_warn(&pdev->dev, "I quit now, hardware will probably reboot!\n");
+        del_timer(&lpc18xx_wdt->timer);
+
+        watchdog_unregister_device(&lpc18xx_wdt->wdt_dev);
+        clk_disable_unprepare(lpc18xx_wdt->wdt_clk);
+        clk_disable_unprepare(lpc18xx_wdt->reg_clk);
+
+        return 0;
+}
+
+static const struct of_device_id lpc18xx_wdt_match[] = {
+        { .compatible = "nxp,lpc1850-wwdt" },
+        {}
+};
+MODULE_DEVICE_TABLE(of, lpc18xx_wdt_match);
+
+static struct platform_driver lpc18xx_wdt_driver = {
+        .driver = {
+                .name = "lpc18xx-wdt",
+                .of_match_table = lpc18xx_wdt_match,
+        },
+        .probe = lpc18xx_wdt_probe,
+        .remove = lpc18xx_wdt_remove,
+        .shutdown = lpc18xx_wdt_shutdown,
+};
+module_platform_driver(lpc18xx_wdt_driver);
+
+MODULE_AUTHOR("Ariel D'Alessandro <ariel@vanguardiasur.com.ar>");
+MODULE_DESCRIPTION("NXP LPC18xx Watchdog Timer Driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/watchdog/mena21_wdt.c b/drivers/watchdog/mena21_wdt.c
index d193a5e79c38..69013007dc47 100644
--- a/drivers/watchdog/mena21_wdt.c
+++ b/drivers/watchdog/mena21_wdt.c
@@ -197,6 +197,7 @@ static int a21_wdt_probe(struct platform_device *pdev)
         watchdog_init_timeout(&a21_wdt, 30, &pdev->dev);
         watchdog_set_nowayout(&a21_wdt, nowayout);
         watchdog_set_drvdata(&a21_wdt, drv);
+        a21_wdt.parent = &pdev->dev;
 
         reset = a21_wdt_get_bootstatus(drv);
         if (reset == 2)
diff --git a/drivers/watchdog/menf21bmc_wdt.c b/drivers/watchdog/menf21bmc_wdt.c
index 59f0913c7341..3aefddebb386 100644
--- a/drivers/watchdog/menf21bmc_wdt.c
+++ b/drivers/watchdog/menf21bmc_wdt.c
@@ -130,6 +130,7 @@ static int menf21bmc_wdt_probe(struct platform_device *pdev)
         drv_data->wdt.info = &menf21bmc_wdt_info;
         drv_data->wdt.min_timeout = BMC_WD_TIMEOUT_MIN;
         drv_data->wdt.max_timeout = BMC_WD_TIMEOUT_MAX;
+        drv_data->wdt.parent = &pdev->dev;
         drv_data->i2c_client = i2c_client;
 
         /*
diff --git a/drivers/watchdog/mpc8xxx_wdt.c b/drivers/watchdog/mpc8xxx_wdt.c
index 689381a24887..5f2273aac37d 100644
--- a/drivers/watchdog/mpc8xxx_wdt.c
+++ b/drivers/watchdog/mpc8xxx_wdt.c
@@ -50,8 +50,12 @@ struct mpc8xxx_wdt_type {
         bool hw_enabled;
 };
 
-static struct mpc8xxx_wdt __iomem *wd_base;
-static int mpc8xxx_wdt_init_late(void);
+struct mpc8xxx_wdt_ddata {
+        struct mpc8xxx_wdt __iomem *base;
+        struct watchdog_device wdd;
+        struct timer_list timer;
+        spinlock_t lock;
+};
 
 static u16 timeout = 0xffff;
 module_param(timeout, ushort, 0);
@@ -68,65 +72,59 @@ module_param(nowayout, bool, 0);
 MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started "
                  "(default=" __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
 
-/*
- * We always prescale, but if someone really doesn't want to they can set this
- * to 0
- */
-static int prescale = 1;
-
-static DEFINE_SPINLOCK(wdt_spinlock);
-
-static void mpc8xxx_wdt_keepalive(void)
+static void mpc8xxx_wdt_keepalive(struct mpc8xxx_wdt_ddata *ddata)
 {
         /* Ping the WDT */
-        spin_lock(&wdt_spinlock);
-        out_be16(&wd_base->swsrr, 0x556c);
-        out_be16(&wd_base->swsrr, 0xaa39);
-        spin_unlock(&wdt_spinlock);
+        spin_lock(&ddata->lock);
+        out_be16(&ddata->base->swsrr, 0x556c);
+        out_be16(&ddata->base->swsrr, 0xaa39);
+        spin_unlock(&ddata->lock);
 }
 
-static struct watchdog_device mpc8xxx_wdt_dev;
-static void mpc8xxx_wdt_timer_ping(unsigned long arg);
-static DEFINE_TIMER(wdt_timer, mpc8xxx_wdt_timer_ping, 0,
-                (unsigned long)&mpc8xxx_wdt_dev);
-
 static void mpc8xxx_wdt_timer_ping(unsigned long arg)
 {
-        struct watchdog_device *w = (struct watchdog_device *)arg;
+        struct mpc8xxx_wdt_ddata *ddata = (void *)arg;
 
-        mpc8xxx_wdt_keepalive();
+        mpc8xxx_wdt_keepalive(ddata);
         /* We're pinging it twice faster than needed, just to be sure. */
-        mod_timer(&wdt_timer, jiffies + HZ * w->timeout / 2);
+        mod_timer(&ddata->timer, jiffies + HZ * ddata->wdd.timeout / 2);
 }
 
 static int mpc8xxx_wdt_start(struct watchdog_device *w)
 {
-        u32 tmp = SWCRR_SWEN;
+        struct mpc8xxx_wdt_ddata *ddata =
+                container_of(w, struct mpc8xxx_wdt_ddata, wdd);
+
+        u32 tmp = SWCRR_SWEN | SWCRR_SWPR;
 
         /* Good, fire up the show */
-        if (prescale)
-                tmp |= SWCRR_SWPR;
         if (reset)
                 tmp |= SWCRR_SWRI;
 
         tmp |= timeout << 16;
 
-        out_be32(&wd_base->swcrr, tmp);
+        out_be32(&ddata->base->swcrr, tmp);
 
-        del_timer_sync(&wdt_timer);
+        del_timer_sync(&ddata->timer);
 
         return 0;
 }
 
 static int mpc8xxx_wdt_ping(struct watchdog_device *w)
 {
-        mpc8xxx_wdt_keepalive();
+        struct mpc8xxx_wdt_ddata *ddata =
+                container_of(w, struct mpc8xxx_wdt_ddata, wdd);
+
+        mpc8xxx_wdt_keepalive(ddata);
         return 0;
 }
 
 static int mpc8xxx_wdt_stop(struct watchdog_device *w)
 {
-        mod_timer(&wdt_timer, jiffies);
+        struct mpc8xxx_wdt_ddata *ddata =
+                container_of(w, struct mpc8xxx_wdt_ddata, wdd);
+
+        mod_timer(&ddata->timer, jiffies);
         return 0;
 }
 
@@ -143,53 +141,57 @@ static struct watchdog_ops mpc8xxx_wdt_ops = {
         .stop = mpc8xxx_wdt_stop,
 };
 
-static struct watchdog_device mpc8xxx_wdt_dev = {
-        .info = &mpc8xxx_wdt_info,
-        .ops = &mpc8xxx_wdt_ops,
-};
-
-static const struct of_device_id mpc8xxx_wdt_match[];
 static int mpc8xxx_wdt_probe(struct platform_device *ofdev)
 {
         int ret;
-        const struct of_device_id *match;
-        struct device_node *np = ofdev->dev.of_node;
+        struct resource *res;
         const struct mpc8xxx_wdt_type *wdt_type;
+        struct mpc8xxx_wdt_ddata *ddata;
         u32 freq = fsl_get_sys_freq();
         bool enabled;
         unsigned int timeout_sec;
 
-        match = of_match_device(mpc8xxx_wdt_match, &ofdev->dev);
-        if (!match)
+        wdt_type = of_device_get_match_data(&ofdev->dev);
+        if (!wdt_type)
                 return -EINVAL;
-        wdt_type = match->data;
 
         if (!freq || freq == -1)
                 return -EINVAL;
 
-        wd_base = of_iomap(np, 0);
-        if (!wd_base)
+        ddata = devm_kzalloc(&ofdev->dev, sizeof(*ddata), GFP_KERNEL);
+        if (!ddata)
                 return -ENOMEM;
 
-        enabled = in_be32(&wd_base->swcrr) & SWCRR_SWEN;
+        res = platform_get_resource(ofdev, IORESOURCE_MEM, 0);
+        ddata->base = devm_ioremap_resource(&ofdev->dev, res);
+        if (IS_ERR(ddata->base))
+                return PTR_ERR(ddata->base);
+
+        enabled = in_be32(&ddata->base->swcrr) & SWCRR_SWEN;
         if (!enabled && wdt_type->hw_enabled) {
                 pr_info("could not be enabled in software\n");
-                ret = -ENOSYS;
-                goto err_unmap;
+                return -ENODEV;
         }
 
+        spin_lock_init(&ddata->lock);
+        setup_timer(&ddata->timer, mpc8xxx_wdt_timer_ping,
+                    (unsigned long)ddata);
+
+        ddata->wdd.info = &mpc8xxx_wdt_info,
+        ddata->wdd.ops = &mpc8xxx_wdt_ops,
+
         /* Calculate the timeout in seconds */
-        if (prescale)
-                timeout_sec = (timeout * wdt_type->prescaler) / freq;
-        else
-                timeout_sec = timeout / freq;
-
-        mpc8xxx_wdt_dev.timeout = timeout_sec;
-#ifdef MODULE
-        ret = mpc8xxx_wdt_init_late();
-        if (ret)
-                goto err_unmap;
-#endif
+        timeout_sec = (timeout * wdt_type->prescaler) / freq;
+
+        ddata->wdd.timeout = timeout_sec;
+
+        watchdog_set_nowayout(&ddata->wdd, nowayout);
+
+        ret = watchdog_register_device(&ddata->wdd);
+        if (ret) {
+                pr_err("cannot register watchdog device (err=%d)\n", ret);
+                return ret;
+        }
 
         pr_info("WDT driver for MPC8xxx initialized. mode:%s timeout=%d (%d seconds)\n",
                 reset ? "reset" : "interrupt", timeout, timeout_sec);
@@ -200,21 +202,20 @@ static int mpc8xxx_wdt_probe(struct platform_device *ofdev)
          * userspace handles it.
          */
         if (enabled)
-                mod_timer(&wdt_timer, jiffies);
+                mod_timer(&ddata->timer, jiffies);
+
+        platform_set_drvdata(ofdev, ddata);
         return 0;
-err_unmap:
-        iounmap(wd_base);
-        wd_base = NULL;
-        return ret;
 }
 
 static int mpc8xxx_wdt_remove(struct platform_device *ofdev)
 {
+        struct mpc8xxx_wdt_ddata *ddata = platform_get_drvdata(ofdev);
+
         pr_crit("Watchdog removed, expect the %s soon!\n",
                 reset ? "reset" : "machine check exception");
-        del_timer_sync(&wdt_timer);
-        watchdog_unregister_device(&mpc8xxx_wdt_dev);
-        iounmap(wd_base);
+        del_timer_sync(&ddata->timer);
+        watchdog_unregister_device(&ddata->wdd);
 
         return 0;
 }
@@ -253,31 +254,6 @@ static struct platform_driver mpc8xxx_wdt_driver = {
         },
 };
 
-/*
- * We do wdt initialization in two steps: arch_initcall probes the wdt
- * very early to start pinging the watchdog (misc devices are not yet
- * available), and later module_init() just registers the misc device.
- */
-static int mpc8xxx_wdt_init_late(void)
-{
-        int ret;
-
-        if (!wd_base)
-                return -ENODEV;
-
-        watchdog_set_nowayout(&mpc8xxx_wdt_dev, nowayout);
-
-        ret = watchdog_register_device(&mpc8xxx_wdt_dev);
-        if (ret) {
-                pr_err("cannot register watchdog device (err=%d)\n", ret);
-                return ret;
-        }
-        return 0;
-}
-#ifndef MODULE
-module_init(mpc8xxx_wdt_init_late);
-#endif
-
 static int __init mpc8xxx_wdt_init(void)
 {
         return platform_driver_register(&mpc8xxx_wdt_driver);
diff --git a/drivers/watchdog/mtk_wdt.c b/drivers/watchdog/mtk_wdt.c
index 938b987de551..6ad9df948711 100644
--- a/drivers/watchdog/mtk_wdt.c
+++ b/drivers/watchdog/mtk_wdt.c
@@ -210,6 +210,14 @@ static int mtk_wdt_probe(struct platform_device *pdev)
         return 0;
 }
 
+static void mtk_wdt_shutdown(struct platform_device *pdev)
+{
+        struct mtk_wdt_dev *mtk_wdt = platform_get_drvdata(pdev);
+
+        if (watchdog_active(&mtk_wdt->wdt_dev))
+                mtk_wdt_stop(&mtk_wdt->wdt_dev);
+}
+
 static int mtk_wdt_remove(struct platform_device *pdev)
 {
         struct mtk_wdt_dev *mtk_wdt = platform_get_drvdata(pdev);
@@ -221,17 +229,48 @@ static int mtk_wdt_remove(struct platform_device *pdev)
         return 0;
 }
 
+#ifdef CONFIG_PM_SLEEP
+static int mtk_wdt_suspend(struct device *dev)
+{
+        struct mtk_wdt_dev *mtk_wdt = dev_get_drvdata(dev);
+
+        if (watchdog_active(&mtk_wdt->wdt_dev))
+                mtk_wdt_stop(&mtk_wdt->wdt_dev);
+
+        return 0;
+}
+
+static int mtk_wdt_resume(struct device *dev)
+{
+        struct mtk_wdt_dev *mtk_wdt = dev_get_drvdata(dev);
+
+        if (watchdog_active(&mtk_wdt->wdt_dev)) {
+                mtk_wdt_start(&mtk_wdt->wdt_dev);
+                mtk_wdt_ping(&mtk_wdt->wdt_dev);
+        }
+
+        return 0;
+}
+#endif
+
 static const struct of_device_id mtk_wdt_dt_ids[] = {
         { .compatible = "mediatek,mt6589-wdt" },
         { /* sentinel */ }
 };
 MODULE_DEVICE_TABLE(of, mtk_wdt_dt_ids);
 
+static const struct dev_pm_ops mtk_wdt_pm_ops = {
+        SET_SYSTEM_SLEEP_PM_OPS(mtk_wdt_suspend,
+                                mtk_wdt_resume)
+};
+
 static struct platform_driver mtk_wdt_driver = {
         .probe          = mtk_wdt_probe,
         .remove         = mtk_wdt_remove,
+        .shutdown       = mtk_wdt_shutdown,
         .driver         = {
                 .name           = DRV_NAME,
+                .pm             = &mtk_wdt_pm_ops,
                 .of_match_table = mtk_wdt_dt_ids,
         },
 };
diff --git a/drivers/watchdog/nv_tco.c b/drivers/watchdog/nv_tco.c
index c028454be66c..bd917bb757b8 100644
--- a/drivers/watchdog/nv_tco.c
+++ b/drivers/watchdog/nv_tco.c
@@ -294,6 +294,8 @@ static const struct pci_device_id tco_pci_tbl[] = {
           PCI_ANY_ID, PCI_ANY_ID, },
         { PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP55_SMBUS,
           PCI_ANY_ID, PCI_ANY_ID, },
+        { PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP79_SMBUS,
+          PCI_ANY_ID, PCI_ANY_ID, },
         { 0, },                 /* End of list */
 };
 MODULE_DEVICE_TABLE(pci, tco_pci_tbl);
diff --git a/drivers/watchdog/omap_wdt.c b/drivers/watchdog/omap_wdt.c
index de911c7e477c..d96bee017fd3 100644
--- a/drivers/watchdog/omap_wdt.c
+++ b/drivers/watchdog/omap_wdt.c
@@ -253,6 +253,7 @@ static int omap_wdt_probe(struct platform_device *pdev)
         wdev->wdog.ops = &omap_wdt_ops;
         wdev->wdog.min_timeout = TIMER_MARGIN_MIN;
         wdev->wdog.max_timeout = TIMER_MARGIN_MAX;
+        wdev->wdog.parent = &pdev->dev;
 
         if (watchdog_init_timeout(&wdev->wdog, timer_margin, &pdev->dev) < 0)
                 wdev->wdog.timeout = TIMER_MARGIN_DEFAULT;
diff --git a/drivers/watchdog/orion_wdt.c b/drivers/watchdog/orion_wdt.c
index ef0c628d5037..c6b8f4a43bde 100644
--- a/drivers/watchdog/orion_wdt.c
+++ b/drivers/watchdog/orion_wdt.c
@@ -567,6 +567,7 @@ static int orion_wdt_probe(struct platform_device *pdev)
 
         dev->wdt.timeout = wdt_max_duration;
         dev->wdt.max_timeout = wdt_max_duration;
+        dev->wdt.parent = &pdev->dev;
         watchdog_init_timeout(&dev->wdt, heartbeat, &pdev->dev);
 
         platform_set_drvdata(pdev, &dev->wdt);
diff --git a/drivers/watchdog/pnx4008_wdt.c b/drivers/watchdog/pnx4008_wdt.c
index b9c6049c3e78..4224b3ec83a5 100644
--- a/drivers/watchdog/pnx4008_wdt.c
+++ b/drivers/watchdog/pnx4008_wdt.c
@@ -167,6 +167,7 @@ static int pnx4008_wdt_probe(struct platform_device *pdev)
 
         pnx4008_wdd.bootstatus = (readl(WDTIM_RES(wdt_base)) & WDOG_RESET) ?
                         WDIOF_CARDRESET : 0;
+        pnx4008_wdd.parent = &pdev->dev;
         watchdog_set_nowayout(&pnx4008_wdd, nowayout);
 
         pnx4008_wdt_stop(&pnx4008_wdd); /* disable for now */
diff --git a/drivers/watchdog/qcom-wdt.c b/drivers/watchdog/qcom-wdt.c
index aa03ca8f2d9b..773dcfaee7b2 100644
--- a/drivers/watchdog/qcom-wdt.c
+++ b/drivers/watchdog/qcom-wdt.c
@@ -171,6 +171,7 @@ static int qcom_wdt_probe(struct platform_device *pdev)
         wdt->wdd.ops = &qcom_wdt_ops;
         wdt->wdd.min_timeout = 1;
         wdt->wdd.max_timeout = 0x10000000U / wdt->rate;
+        wdt->wdd.parent = &pdev->dev;
 
         /*
          * If 'timeout-sec' unspecified in devicetree, assume a 30 second
diff --git a/drivers/watchdog/retu_wdt.c b/drivers/watchdog/retu_wdt.c
index b7c68e275aeb..39cd51df2ffc 100644
--- a/drivers/watchdog/retu_wdt.c
+++ b/drivers/watchdog/retu_wdt.c
@@ -127,6 +127,7 @@ static int retu_wdt_probe(struct platform_device *pdev)
         retu_wdt->timeout       = RETU_WDT_MAX_TIMER;
         retu_wdt->min_timeout   = 0;
         retu_wdt->max_timeout   = RETU_WDT_MAX_TIMER;
+        retu_wdt->parent        = &pdev->dev;
 
         watchdog_set_drvdata(retu_wdt, wdev);
         watchdog_set_nowayout(retu_wdt, nowayout);
diff --git a/drivers/watchdog/rt2880_wdt.c b/drivers/watchdog/rt2880_wdt.c
index a6f7e2e29beb..1967919ae743 100644
--- a/drivers/watchdog/rt2880_wdt.c
+++ b/drivers/watchdog/rt2880_wdt.c
@@ -161,6 +161,7 @@ static int rt288x_wdt_probe(struct platform_device *pdev)
         rt288x_wdt_dev.dev = &pdev->dev;
         rt288x_wdt_dev.bootstatus = rt288x_wdt_bootcause();
         rt288x_wdt_dev.max_timeout = (0xfffful / rt288x_wdt_freq);
+        rt288x_wdt_dev.parent = &pdev->dev;
 
         watchdog_init_timeout(&rt288x_wdt_dev, rt288x_wdt_dev.max_timeout,
                               &pdev->dev);
diff --git a/drivers/watchdog/s3c2410_wdt.c b/drivers/watchdog/s3c2410_wdt.c
index e89ae027c91d..d781000c7825 100644
--- a/drivers/watchdog/s3c2410_wdt.c
+++ b/drivers/watchdog/s3c2410_wdt.c
@@ -607,6 +607,7 @@ static int s3c2410wdt_probe(struct platform_device *pdev)
         watchdog_set_nowayout(&wdt->wdt_device, nowayout);
 
         wdt->wdt_device.bootstatus = s3c2410wdt_get_bootstatus(wdt);
+        wdt->wdt_device.parent = &pdev->dev;
 
         ret = watchdog_register_device(&wdt->wdt_device);
         if (ret) {
diff --git a/drivers/watchdog/sama5d4_wdt.c b/drivers/watchdog/sama5d4_wdt.c
new file mode 100644
index 000000000000..a49634cdc1cc
--- /dev/null
+++ b/drivers/watchdog/sama5d4_wdt.c
@@ -0,0 +1,280 @@
+/*
+ * Driver for Atmel SAMA5D4 Watchdog Timer
+ *
+ * Copyright (C) 2015 Atmel Corporation
+ *
+ * Licensed under GPLv2.
+ */
+
+#include <linux/interrupt.h>
+#include <linux/io.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/of_irq.h>
+#include <linux/platform_device.h>
+#include <linux/reboot.h>
+#include <linux/watchdog.h>
+
+#include "at91sam9_wdt.h"
+
+/* minimum and maximum watchdog timeout, in seconds */
+#define MIN_WDT_TIMEOUT         1
+#define MAX_WDT_TIMEOUT         16
+#define WDT_DEFAULT_TIMEOUT     MAX_WDT_TIMEOUT
+
+#define WDT_SEC2TICKS(s)        ((s) ? (((s) << 8) - 1) : 0)
+
+struct sama5d4_wdt {
+        struct watchdog_device  wdd;
+        void __iomem            *reg_base;
+        u32     config;
+};
+
+static int wdt_timeout = WDT_DEFAULT_TIMEOUT;
+static bool nowayout = WATCHDOG_NOWAYOUT;
+
+module_param(wdt_timeout, int, 0);
+MODULE_PARM_DESC(wdt_timeout,
+        "Watchdog timeout in seconds. (default = "
+        __MODULE_STRING(WDT_DEFAULT_TIMEOUT) ")");
+
+module_param(nowayout, bool, 0);
+MODULE_PARM_DESC(nowayout,
+        "Watchdog cannot be stopped once started (default="
+        __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
+
+#define wdt_read(wdt, field) \
+        readl_relaxed((wdt)->reg_base + (field))
+
+#define wdt_write(wtd, field, val) \
+        writel_relaxed((val), (wdt)->reg_base + (field))
+
+static int sama5d4_wdt_start(struct watchdog_device *wdd)
+{
+        struct sama5d4_wdt *wdt = watchdog_get_drvdata(wdd);
+        u32 reg;
+
+        reg = wdt_read(wdt, AT91_WDT_MR);
+        reg &= ~AT91_WDT_WDDIS;
+        wdt_write(wdt, AT91_WDT_MR, reg);
+
+        return 0;
+}
+
+static int sama5d4_wdt_stop(struct watchdog_device *wdd)
+{
+        struct sama5d4_wdt *wdt = watchdog_get_drvdata(wdd);
+        u32 reg;
+
+        reg = wdt_read(wdt, AT91_WDT_MR);
+        reg |= AT91_WDT_WDDIS;
+        wdt_write(wdt, AT91_WDT_MR, reg);
+
+        return 0;
+}
+
+static int sama5d4_wdt_ping(struct watchdog_device *wdd)
+{
+        struct sama5d4_wdt *wdt = watchdog_get_drvdata(wdd);
+
+        wdt_write(wdt, AT91_WDT_CR, AT91_WDT_KEY | AT91_WDT_WDRSTT);
+
+        return 0;
+}
+
+static int sama5d4_wdt_set_timeout(struct watchdog_device *wdd,
+                                 unsigned int timeout)
+{
+        struct sama5d4_wdt *wdt = watchdog_get_drvdata(wdd);
+        u32 value = WDT_SEC2TICKS(timeout);
+        u32 reg;
+
+        reg = wdt_read(wdt, AT91_WDT_MR);
+        reg &= ~AT91_WDT_WDV;
+        reg &= ~AT91_WDT_WDD;
+        reg |= AT91_WDT_SET_WDV(value);
+        reg |= AT91_WDT_SET_WDD(value);
+        wdt_write(wdt, AT91_WDT_MR, reg);
+
+        wdd->timeout = timeout;
+
+        return 0;
+}
+
+static const struct watchdog_info sama5d4_wdt_info = {
+        .options = WDIOF_SETTIMEOUT | WDIOF_MAGICCLOSE | WDIOF_KEEPALIVEPING,
+        .identity = "Atmel SAMA5D4 Watchdog",
+};
+
+static struct watchdog_ops sama5d4_wdt_ops = {
+        .owner = THIS_MODULE,
+        .start = sama5d4_wdt_start,
+        .stop = sama5d4_wdt_stop,
+        .ping = sama5d4_wdt_ping,
+        .set_timeout = sama5d4_wdt_set_timeout,
+};
+
+static irqreturn_t sama5d4_wdt_irq_handler(int irq, void *dev_id)
+{
+        struct sama5d4_wdt *wdt = platform_get_drvdata(dev_id);
+
+        if (wdt_read(wdt, AT91_WDT_SR)) {
+                pr_crit("Atmel Watchdog Software Reset\n");
+                emergency_restart();
+                pr_crit("Reboot didn't succeed\n");
+        }
+
+        return IRQ_HANDLED;
+}
+
+static int of_sama5d4_wdt_init(struct device_node *np, struct sama5d4_wdt *wdt)
+{
+        const char *tmp;
+
+        wdt->config = AT91_WDT_WDDIS;
+
+        if (!of_property_read_string(np, "atmel,watchdog-type", &tmp) &&
+            !strcmp(tmp, "software"))
+                wdt->config |= AT91_WDT_WDFIEN;
+        else
+                wdt->config |= AT91_WDT_WDRSTEN;
+
+        if (of_property_read_bool(np, "atmel,idle-halt"))
+                wdt->config |= AT91_WDT_WDIDLEHLT;
+
+        if (of_property_read_bool(np, "atmel,dbg-halt"))
+                wdt->config |= AT91_WDT_WDDBGHLT;
+
+        return 0;
+}
+
+static int sama5d4_wdt_init(struct sama5d4_wdt *wdt)
+{
+        struct watchdog_device *wdd = &wdt->wdd;
+        u32 value = WDT_SEC2TICKS(wdd->timeout);
+        u32 reg;
+
+        /*
+         * Because the fields WDV and WDD must not be modified when the WDDIS
+         * bit is set, so clear the WDDIS bit before writing the WDT_MR.
+         */
+        reg = wdt_read(wdt, AT91_WDT_MR);
+        reg &= ~AT91_WDT_WDDIS;
+        wdt_write(wdt, AT91_WDT_MR, reg);
+
+        reg = wdt->config;
+        reg |= AT91_WDT_SET_WDD(value);
+        reg |= AT91_WDT_SET_WDV(value);
+
+        wdt_write(wdt, AT91_WDT_MR, reg);
+
+        return 0;
+}
+
+static int sama5d4_wdt_probe(struct platform_device *pdev)
+{
+        struct watchdog_device *wdd;
+        struct sama5d4_wdt *wdt;
+        struct resource *res;
+        void __iomem *regs;
+        u32 irq = 0;
+        int ret;
+
+        wdt = devm_kzalloc(&pdev->dev, sizeof(*wdt), GFP_KERNEL);
+        if (!wdt)
+                return -ENOMEM;
+
+        wdd = &wdt->wdd;
+        wdd->timeout = wdt_timeout;
+        wdd->info = &sama5d4_wdt_info;
+        wdd->ops = &sama5d4_wdt_ops;
+        wdd->min_timeout = MIN_WDT_TIMEOUT;
+        wdd->max_timeout = MAX_WDT_TIMEOUT;
+
+        watchdog_set_drvdata(wdd, wdt);
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        regs = devm_ioremap_resource(&pdev->dev, res);
+        if (IS_ERR(regs))
+                return PTR_ERR(regs);
+
+        wdt->reg_base = regs;
+
+        if (pdev->dev.of_node) {
+                irq = irq_of_parse_and_map(pdev->dev.of_node, 0);
+                if (!irq)
+                        dev_warn(&pdev->dev, "failed to get IRQ from DT\n");
+
+                ret = of_sama5d4_wdt_init(pdev->dev.of_node, wdt);
+                if (ret)
+                        return ret;
+        }
+
+        if ((wdt->config & AT91_WDT_WDFIEN) && irq) {
+                ret = devm_request_irq(&pdev->dev, irq, sama5d4_wdt_irq_handler,
+                                       IRQF_SHARED | IRQF_IRQPOLL |
+                                       IRQF_NO_SUSPEND, pdev->name, pdev);
+                if (ret) {
+                        dev_err(&pdev->dev,
+                                "cannot register interrupt handler\n");
+                        return ret;
+                }
+        }
+
+        ret = watchdog_init_timeout(wdd, wdt_timeout, &pdev->dev);
+        if (ret) {
+                dev_err(&pdev->dev, "unable to set timeout value\n");
+                return ret;
+        }
+
+        ret = sama5d4_wdt_init(wdt);
+        if (ret)
+                return ret;
+
+        watchdog_set_nowayout(wdd, nowayout);
+
+        ret = watchdog_register_device(wdd);
+        if (ret) {
+                dev_err(&pdev->dev, "failed to register watchdog device\n");
+                return ret;
+        }
+
+        platform_set_drvdata(pdev, wdt);
+
+        dev_info(&pdev->dev, "initialized (timeout = %d sec, nowayout = %d)\n",
+                 wdt_timeout, nowayout);
+
+        return 0;
+}
+
+static int sama5d4_wdt_remove(struct platform_device *pdev)
+{
+        struct sama5d4_wdt *wdt = platform_get_drvdata(pdev);
+
+        sama5d4_wdt_stop(&wdt->wdd);
+
+        watchdog_unregister_device(&wdt->wdd);
+
+        return 0;
+}
+
+static const struct of_device_id sama5d4_wdt_of_match[] = {
+        { .compatible = "atmel,sama5d4-wdt", },
+        { }
+};
+MODULE_DEVICE_TABLE(of, sama5d4_wdt_of_match);
+
+static struct platform_driver sama5d4_wdt_driver = {
+        .probe          = sama5d4_wdt_probe,
+        .remove         = sama5d4_wdt_remove,
+        .driver         = {
+                .name   = "sama5d4_wdt",
+                .of_match_table = sama5d4_wdt_of_match,
+        }
+};
+module_platform_driver(sama5d4_wdt_driver);
+
+MODULE_AUTHOR("Atmel Corporation");
+MODULE_DESCRIPTION("Atmel SAMA5D4 Watchdog Timer driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/watchdog/shwdt.c b/drivers/watchdog/shwdt.c
index 567458b137a6..f90812170657 100644
--- a/drivers/watchdog/shwdt.c
+++ b/drivers/watchdog/shwdt.c
@@ -252,6 +252,7 @@ static int sh_wdt_probe(struct platform_device *pdev)
 
         watchdog_set_nowayout(&sh_wdt_dev, nowayout);
         watchdog_set_drvdata(&sh_wdt_dev, wdt);
+        sh_wdt_dev.parent = &pdev->dev;
 
         spin_lock_init(&wdt->lock);
 
diff --git a/drivers/watchdog/sirfsoc_wdt.c b/drivers/watchdog/sirfsoc_wdt.c
index 42fa5c0c518a..d0578ab2e636 100644
--- a/drivers/watchdog/sirfsoc_wdt.c
+++ b/drivers/watchdog/sirfsoc_wdt.c
@@ -154,6 +154,7 @@ static int sirfsoc_wdt_probe(struct platform_device *pdev)
 
         watchdog_init_timeout(&sirfsoc_wdd, timeout, &pdev->dev);
         watchdog_set_nowayout(&sirfsoc_wdd, nowayout);
+        sirfsoc_wdd.parent = &pdev->dev;
 
         ret = watchdog_register_device(&sirfsoc_wdd);
         if (ret)
diff --git a/drivers/watchdog/sp805_wdt.c b/drivers/watchdog/sp805_wdt.c
index 4e7fec36f5c3..01d816251302 100644
--- a/drivers/watchdog/sp805_wdt.c
+++ b/drivers/watchdog/sp805_wdt.c
@@ -226,6 +226,7 @@ sp805_wdt_probe(struct amba_device *adev, const struct amba_id *id)
         wdt->adev = adev;
         wdt->wdd.info = &wdt_info;
         wdt->wdd.ops = &wdt_ops;
+        wdt->wdd.parent = &adev->dev;
 
         spin_lock_init(&wdt->lock);
         watchdog_set_nowayout(&wdt->wdd, nowayout);
diff --git a/drivers/watchdog/st_lpc_wdt.c b/drivers/watchdog/st_lpc_wdt.c
index 6785afdc0fca..14e9badf2bfa 100644
--- a/drivers/watchdog/st_lpc_wdt.c
+++ b/drivers/watchdog/st_lpc_wdt.c
@@ -241,6 +241,7 @@ static int st_wdog_probe(struct platform_device *pdev)
                 return -EINVAL;
         }
         st_wdog_dev.max_timeout = 0xFFFFFFFF / st_wdog->clkrate;
+        st_wdog_dev.parent = &pdev->dev;
 
         ret = clk_prepare_enable(clk);
         if (ret) {
diff --git a/drivers/watchdog/stmp3xxx_rtc_wdt.c b/drivers/watchdog/stmp3xxx_rtc_wdt.c
index e7f0d5b60d3d..3ee6128a540e 100644
--- a/drivers/watchdog/stmp3xxx_rtc_wdt.c
+++ b/drivers/watchdog/stmp3xxx_rtc_wdt.c
@@ -76,6 +76,7 @@ static int stmp3xxx_wdt_probe(struct platform_device *pdev)
         watchdog_set_drvdata(&stmp3xxx_wdd, &pdev->dev);
 
         stmp3xxx_wdd.timeout = clamp_t(unsigned, heartbeat, 1, STMP3XXX_MAX_TIMEOUT);
+        stmp3xxx_wdd.parent = &pdev->dev;
 
         ret = watchdog_register_device(&stmp3xxx_wdd);
         if (ret < 0) {
diff --git a/drivers/watchdog/sunxi_wdt.c b/drivers/watchdog/sunxi_wdt.c
index a29afb37c48c..47bd8a14d01f 100644
--- a/drivers/watchdog/sunxi_wdt.c
+++ b/drivers/watchdog/sunxi_wdt.c
@@ -184,7 +184,7 @@ static int sunxi_wdt_start(struct watchdog_device *wdt_dev)
         /* Set system reset function */
         reg = readl(wdt_base + regs->wdt_cfg);
         reg &= ~(regs->wdt_reset_mask);
-        reg |= ~(regs->wdt_reset_val);
+        reg |= regs->wdt_reset_val;
         writel(reg, wdt_base + regs->wdt_cfg);
 
         /* Enable watchdog */
diff --git a/drivers/watchdog/tegra_wdt.c b/drivers/watchdog/tegra_wdt.c
index 30451ea46902..7f97cdd53f29 100644
--- a/drivers/watchdog/tegra_wdt.c
+++ b/drivers/watchdog/tegra_wdt.c
@@ -218,6 +218,7 @@ static int tegra_wdt_probe(struct platform_device *pdev)
         wdd->ops = &tegra_wdt_ops;
         wdd->min_timeout = MIN_WDT_TIMEOUT;
         wdd->max_timeout = MAX_WDT_TIMEOUT;
+        wdd->parent = &pdev->dev;
 
         watchdog_set_drvdata(wdd, wdt);
 
diff --git a/drivers/watchdog/twl4030_wdt.c b/drivers/watchdog/twl4030_wdt.c
index 2c1db6fa9a27..9bf3cc0f3961 100644
--- a/drivers/watchdog/twl4030_wdt.c
+++ b/drivers/watchdog/twl4030_wdt.c
@@ -83,6 +83,7 @@ static int twl4030_wdt_probe(struct platform_device *pdev)
         wdt->timeout            = 30;
         wdt->min_timeout        = 1;
         wdt->max_timeout        = 30;
+        wdt->parent = &pdev->dev;
 
         watchdog_set_nowayout(wdt, nowayout);
         platform_set_drvdata(pdev, wdt);
diff --git a/drivers/watchdog/txx9wdt.c b/drivers/watchdog/txx9wdt.c
index 7f615933d31a..c2da880292bc 100644
--- a/drivers/watchdog/txx9wdt.c
+++ b/drivers/watchdog/txx9wdt.c
@@ -131,6 +131,7 @@ static int __init txx9wdt_probe(struct platform_device *dev)
         txx9wdt.timeout = timeout;
         txx9wdt.min_timeout = 1;
         txx9wdt.max_timeout = WD_MAX_TIMEOUT;
+        txx9wdt.parent = &dev->dev;
         watchdog_set_nowayout(&txx9wdt, nowayout);
 
         ret = watchdog_register_device(&txx9wdt);
diff --git a/drivers/watchdog/ux500_wdt.c b/drivers/watchdog/ux500_wdt.c
index 9de09ab00838..37c084353cce 100644
--- a/drivers/watchdog/ux500_wdt.c
+++ b/drivers/watchdog/ux500_wdt.c
@@ -96,6 +96,7 @@ static int ux500_wdt_probe(struct platform_device *pdev)
                         ux500_wdt.max_timeout = WATCHDOG_MAX28;
         }
 
+        ux500_wdt.parent = &pdev->dev;
         watchdog_set_nowayout(&ux500_wdt, nowayout);
 
         /* disable auto off on sleep */
diff --git a/drivers/watchdog/via_wdt.c b/drivers/watchdog/via_wdt.c
index 56369c4f1961..5f9cbc37520d 100644
--- a/drivers/watchdog/via_wdt.c
+++ b/drivers/watchdog/via_wdt.c
@@ -206,6 +206,7 @@ static int wdt_probe(struct pci_dev *pdev,
                 timeout = WDT_TIMEOUT;
 
         wdt_dev.timeout = timeout;
+        wdt_dev.parent = &pdev->dev;
         watchdog_set_nowayout(&wdt_dev, nowayout);
         if (readl(wdt_mem) & VIA_WDT_FIRED)
                 wdt_dev.bootstatus |= WDIOF_CARDRESET;
diff --git a/drivers/watchdog/wm831x_wdt.c b/drivers/watchdog/wm831x_wdt.c
index 2fa17e746ff6..8d1184aee932 100644
--- a/drivers/watchdog/wm831x_wdt.c
+++ b/drivers/watchdog/wm831x_wdt.c
@@ -215,6 +215,7 @@ static int wm831x_wdt_probe(struct platform_device *pdev)
 
         wm831x_wdt->info = &wm831x_wdt_info;
         wm831x_wdt->ops = &wm831x_wdt_ops;
+        wm831x_wdt->parent = &pdev->dev;
         watchdog_set_nowayout(wm831x_wdt, nowayout);
         watchdog_set_drvdata(wm831x_wdt, driver_data);
 
diff --git a/drivers/watchdog/wm8350_wdt.c b/drivers/watchdog/wm8350_wdt.c
index 34d272ada23d..4ab4b8347d45 100644
--- a/drivers/watchdog/wm8350_wdt.c
+++ b/drivers/watchdog/wm8350_wdt.c
@@ -151,6 +151,7 @@ static int wm8350_wdt_probe(struct platform_device *pdev)
 
         watchdog_set_nowayout(&wm8350_wdt, nowayout);
         watchdog_set_drvdata(&wm8350_wdt, wm8350);
+        wm8350_wdt.parent = &pdev->dev;
 
         /* Default to 4s timeout */
         wm8350_wdt_set_timeout(&wm8350_wdt, 4);
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 22ea424ee741..073bb57adab1 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -1242,6 +1242,13 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
                                 goto out_clear;
                         }
                         bd_set_size(bdev, (loff_t)bdev->bd_part->nr_sects << 9);
+                        /*
+                         * If the partition is not aligned on a page
+                         * boundary, we can't do dax I/O to it.
+                         */
+                        if ((bdev->bd_part->start_sect % (PAGE_SIZE / 512)) ||
+                            (bdev->bd_part->nr_sects % (PAGE_SIZE / 512)))
+                                bdev->bd_inode->i_flags &= ~S_DAX;
                 }
         } else {
                 if (bdev->bd_contains == bdev) {
diff --git a/fs/btrfs/async-thread.c b/fs/btrfs/async-thread.c
index 1ce06c849a86..3e36e4adc4a3 100644
--- a/fs/btrfs/async-thread.c
+++ b/fs/btrfs/async-thread.c
@@ -42,8 +42,14 @@ struct __btrfs_workqueue {
 
         /* Thresholding related variants */
         atomic_t pending;
-        int max_active;
-        int current_max;
+
+        /* Up limit of concurrency workers */
+        int limit_active;
+
+        /* Current number of concurrency workers */
+        int current_active;
+
+        /* Threshold to change current_active */
         int thresh;
         unsigned int count;
         spinlock_t thres_lock;
@@ -88,7 +94,7 @@ BTRFS_WORK_HELPER(scrubnc_helper);
 BTRFS_WORK_HELPER(scrubparity_helper);
 
 static struct __btrfs_workqueue *
-__btrfs_alloc_workqueue(const char *name, unsigned int flags, int max_active,
+__btrfs_alloc_workqueue(const char *name, unsigned int flags, int limit_active,
                          int thresh)
 {
         struct __btrfs_workqueue *ret = kzalloc(sizeof(*ret), GFP_NOFS);
@@ -96,26 +102,31 @@ __btrfs_alloc_workqueue(const char *name, unsigned int flags, int max_active,
         if (!ret)
                 return NULL;
 
-        ret->max_active = max_active;
+        ret->limit_active = limit_active;
         atomic_set(&ret->pending, 0);
         if (thresh == 0)
                 thresh = DFT_THRESHOLD;
         /* For low threshold, disabling threshold is a better choice */
         if (thresh < DFT_THRESHOLD) {
-                ret->current_max = max_active;
+                ret->current_active = limit_active;
                 ret->thresh = NO_THRESHOLD;
         } else {
-                ret->current_max = 1;
+                /*
+                 * For threshold-able wq, let its concurrency grow on demand.
+                 * Use minimal max_active at alloc time to reduce resource
+                 * usage.
+                 */
+                ret->current_active = 1;
                 ret->thresh = thresh;
         }
 
         if (flags & WQ_HIGHPRI)
                 ret->normal_wq = alloc_workqueue("%s-%s-high", flags,
-                                                 ret->max_active,
-                                                 "btrfs", name);
+                                                 ret->current_active, "btrfs",
+                                                 name);
         else
                 ret->normal_wq = alloc_workqueue("%s-%s", flags,
-                                                 ret->max_active, "btrfs",
+                                                 ret->current_active, "btrfs",
                                                  name);
         if (!ret->normal_wq) {
                 kfree(ret);
@@ -134,7 +145,7 @@ __btrfs_destroy_workqueue(struct __btrfs_workqueue *wq);
 
 struct btrfs_workqueue *btrfs_alloc_workqueue(const char *name,
                                               unsigned int flags,
-                                              int max_active,
+                                              int limit_active,
                                               int thresh)
 {
         struct btrfs_workqueue *ret = kzalloc(sizeof(*ret), GFP_NOFS);
@@ -143,14 +154,14 @@ struct btrfs_workqueue *btrfs_alloc_workqueue(const char *name,
                 return NULL;
 
         ret->normal = __btrfs_alloc_workqueue(name, flags & ~WQ_HIGHPRI,
-                                              max_active, thresh);
+                                              limit_active, thresh);
         if (!ret->normal) {
                 kfree(ret);
                 return NULL;
         }
 
         if (flags & WQ_HIGHPRI) {
-                ret->high = __btrfs_alloc_workqueue(name, flags, max_active,
+                ret->high = __btrfs_alloc_workqueue(name, flags, limit_active,
                                                     thresh);
                 if (!ret->high) {
                         __btrfs_destroy_workqueue(ret->normal);
@@ -180,7 +191,7 @@ static inline void thresh_queue_hook(struct __btrfs_workqueue *wq)
  */
 static inline void thresh_exec_hook(struct __btrfs_workqueue *wq)
 {
-        int new_max_active;
+        int new_current_active;
         long pending;
         int need_change = 0;
 
@@ -197,7 +208,7 @@ static inline void thresh_exec_hook(struct __btrfs_workqueue *wq)
         wq->count %= (wq->thresh / 4);
         if (!wq->count)
                 goto  out;
-        new_max_active = wq->current_max;
+        new_current_active = wq->current_active;
 
         /*
          * pending may be changed later, but it's OK since we really
@@ -205,19 +216,19 @@ static inline void thresh_exec_hook(struct __btrfs_workqueue *wq)
          */
         pending = atomic_read(&wq->pending);
         if (pending > wq->thresh)
-                new_max_active++;
+                new_current_active++;
         if (pending < wq->thresh / 2)
-                new_max_active--;
-        new_max_active = clamp_val(new_max_active, 1, wq->max_active);
-        if (new_max_active != wq->current_max)  {
+                new_current_active--;
+        new_current_active = clamp_val(new_current_active, 1, wq->limit_active);
+        if (new_current_active != wq->current_active)  {
                 need_change = 1;
-                wq->current_max = new_max_active;
+                wq->current_active = new_current_active;
         }
 out:
         spin_unlock(&wq->thres_lock);
 
         if (need_change) {
-                workqueue_set_max_active(wq->normal_wq, wq->current_max);
+                workqueue_set_max_active(wq->normal_wq, wq->current_active);
         }
 }
 
@@ -351,13 +362,13 @@ void btrfs_destroy_workqueue(struct btrfs_workqueue *wq)
         kfree(wq);
 }
 
-void btrfs_workqueue_set_max(struct btrfs_workqueue *wq, int max)
+void btrfs_workqueue_set_max(struct btrfs_workqueue *wq, int limit_active)
 {
         if (!wq)
                 return;
-        wq->normal->max_active = max;
+        wq->normal->limit_active = limit_active;
         if (wq->high)
-                wq->high->max_active = max;
+                wq->high->limit_active = limit_active;
 }
 
 void btrfs_set_work_high_priority(struct btrfs_work *work)
diff --git a/fs/btrfs/async-thread.h b/fs/btrfs/async-thread.h
index b0b093b6afec..ad4d0647d1a6 100644
--- a/fs/btrfs/async-thread.h
+++ b/fs/btrfs/async-thread.h
@@ -69,7 +69,7 @@ BTRFS_WORK_HELPER_PROTO(scrubparity_helper);
 
 struct btrfs_workqueue *btrfs_alloc_workqueue(const char *name,
                                               unsigned int flags,
-                                              int max_active,
+                                              int limit_active,
                                               int thresh);
 void btrfs_init_work(struct btrfs_work *work, btrfs_work_func_t helper,
                      btrfs_func_t func,
diff --git a/fs/btrfs/btrfs_inode.h b/fs/btrfs/btrfs_inode.h
index 81220b2203c6..0ef5cc13fae2 100644
--- a/fs/btrfs/btrfs_inode.h
+++ b/fs/btrfs/btrfs_inode.h
@@ -44,8 +44,6 @@
 #define BTRFS_INODE_IN_DELALLOC_LIST            9
 #define BTRFS_INODE_READDIO_NEED_LOCK           10
 #define BTRFS_INODE_HAS_PROPS                   11
-/* DIO is ready to submit */
-#define BTRFS_INODE_DIO_READY                   12
 /*
  * The following 3 bits are meant only for the btree inode.
  * When any of them is set, it means an error happened while writing an
diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c
index 564a7de17d99..e54dd5905cee 100644
--- a/fs/btrfs/dev-replace.c
+++ b/fs/btrfs/dev-replace.c
@@ -183,8 +183,7 @@ no_valid_dev_replace_entry_found:
         }
 
 out:
-        if (path)
-                btrfs_free_path(path);
+        btrfs_free_path(path);
         return ret;
 }
 
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 9ebd34f1c677..295795aebe0b 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -3443,6 +3443,26 @@ static int barrier_all_devices(struct btrfs_fs_info *info)
         return 0;
 }
 
+int btrfs_get_num_tolerated_disk_barrier_failures(u64 flags)
+{
+        if ((flags & (BTRFS_BLOCK_GROUP_DUP |
+                      BTRFS_BLOCK_GROUP_RAID0 |
+                      BTRFS_AVAIL_ALLOC_BIT_SINGLE)) ||
+            ((flags & BTRFS_BLOCK_GROUP_PROFILE_MASK) == 0))
+                return 0;
+
+        if (flags & (BTRFS_BLOCK_GROUP_RAID1 |
+                     BTRFS_BLOCK_GROUP_RAID5 |
+                     BTRFS_BLOCK_GROUP_RAID10))
+                return 1;
+
+        if (flags & BTRFS_BLOCK_GROUP_RAID6)
+                return 2;
+
+        pr_warn("BTRFS: unknown raid type: %llu\n", flags);
+        return 0;
+}
+
 int btrfs_calc_num_tolerated_disk_barrier_failures(
         struct btrfs_fs_info *fs_info)
 {
@@ -3452,13 +3472,12 @@ int btrfs_calc_num_tolerated_disk_barrier_failures(
                        BTRFS_BLOCK_GROUP_SYSTEM,
                        BTRFS_BLOCK_GROUP_METADATA,
                        BTRFS_BLOCK_GROUP_DATA | BTRFS_BLOCK_GROUP_METADATA};
-        int num_types = 4;
         int i;
         int c;
         int num_tolerated_disk_barrier_failures =
                 (int)fs_info->fs_devices->num_devices;
 
-        for (i = 0; i < num_types; i++) {
+        for (i = 0; i < ARRAY_SIZE(types); i++) {
                 struct btrfs_space_info *tmp;
 
                 sinfo = NULL;
@@ -3476,44 +3495,21 @@ int btrfs_calc_num_tolerated_disk_barrier_failures(
 
                 down_read(&sinfo->groups_sem);
                 for (c = 0; c < BTRFS_NR_RAID_TYPES; c++) {
-                        if (!list_empty(&sinfo->block_groups[c])) {
-                                u64 flags;
-
-                                btrfs_get_block_group_info(
-                                        &sinfo->block_groups[c], &space);
-                                if (space.total_bytes == 0 ||
-                                    space.used_bytes == 0)
-                                        continue;
-                                flags = space.flags;
-                                /*
-                                 * return
-                                 * 0: if dup, single or RAID0 is configured for
-                                 *    any of metadata, system or data, else
-                                 * 1: if RAID5 is configured, or if RAID1 or
-                                 *    RAID10 is configured and only two mirrors
-                                 *    are used, else
-                                 * 2: if RAID6 is configured, else
-                                 * num_mirrors - 1: if RAID1 or RAID10 is
-                                 *                  configured and more than
-                                 *                  2 mirrors are used.
-                                 */
-                                if (num_tolerated_disk_barrier_failures > 0 &&
-                                    ((flags & (BTRFS_BLOCK_GROUP_DUP |
-                                               BTRFS_BLOCK_GROUP_RAID0)) ||
-                                     ((flags & BTRFS_BLOCK_GROUP_PROFILE_MASK)
-                                      == 0)))
-                                        num_tolerated_disk_barrier_failures = 0;
-                                else if (num_tolerated_disk_barrier_failures > 1) {
-                                        if (flags & (BTRFS_BLOCK_GROUP_RAID1 |
-                                            BTRFS_BLOCK_GROUP_RAID5 |
-                                            BTRFS_BLOCK_GROUP_RAID10)) {
-                                                num_tolerated_disk_barrier_failures = 1;
-                                        } else if (flags &
-                                                   BTRFS_BLOCK_GROUP_RAID6) {
-                                                num_tolerated_disk_barrier_failures = 2;
-                                        }
-                                }
-                        }
+                        u64 flags;
+
+                        if (list_empty(&sinfo->block_groups[c]))
+                                continue;
+
+                        btrfs_get_block_group_info(&sinfo->block_groups[c],
+                                                   &space);
+                        if (space.total_bytes == 0 || space.used_bytes == 0)
+                                continue;
+                        flags = space.flags;
+
+                        num_tolerated_disk_barrier_failures = min(
+                                num_tolerated_disk_barrier_failures,
+                                btrfs_get_num_tolerated_disk_barrier_failures(
+                                        flags));
                 }
                 up_read(&sinfo->groups_sem);
         }
@@ -3769,9 +3765,7 @@ void close_ctree(struct btrfs_root *root)
                  * block groups queued for removal, the deletion will be
                  * skipped when we quit the cleaner thread.
                  */
-                mutex_lock(&root->fs_info->cleaner_mutex);
                 btrfs_delete_unused_bgs(root->fs_info);
-                mutex_unlock(&root->fs_info->cleaner_mutex);
 
                 ret = btrfs_commit_super(root);
                 if (ret)
diff --git a/fs/btrfs/disk-io.h b/fs/btrfs/disk-io.h
index d4cbfeeeedd4..bdfb479ea859 100644
--- a/fs/btrfs/disk-io.h
+++ b/fs/btrfs/disk-io.h
@@ -139,6 +139,7 @@ struct btrfs_root *btrfs_create_tree(struct btrfs_trans_handle *trans,
                                      u64 objectid);
 int btree_lock_page_hook(struct page *page, void *data,
                                 void (*flush_fn)(void *));
+int btrfs_get_num_tolerated_disk_barrier_failures(u64 flags);
 int btrfs_calc_num_tolerated_disk_barrier_failures(
         struct btrfs_fs_info *fs_info);
 int __init btrfs_end_io_wq_init(void);
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 5411f0ab5683..9f9604201333 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -3742,10 +3742,7 @@ static int update_space_info(struct btrfs_fs_info *info, u64 flags,
         found->bytes_reserved = 0;
         found->bytes_readonly = 0;
         found->bytes_may_use = 0;
-        if (total_bytes > 0)
-                found->full = 0;
-        else
-                found->full = 1;
+        found->full = 0;
         found->force_alloc = CHUNK_ALLOC_NO_FORCE;
         found->chunk_alloc = 0;
         found->flush = 0;
@@ -8668,7 +8665,7 @@ int btrfs_drop_snapshot(struct btrfs_root *root,
         }
 
         if (test_bit(BTRFS_ROOT_IN_RADIX, &root->state)) {
-                btrfs_drop_and_free_fs_root(tree_root->fs_info, root);
+                btrfs_add_dropped_root(trans, root);
         } else {
                 free_extent_buffer(root->node);
                 free_extent_buffer(root->commit_root);
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index f1018cfbfefa..e2357e31609a 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -2798,7 +2798,8 @@ static int submit_extent_page(int rw, struct extent_io_tree *tree,
                               bio_end_io_t end_io_func,
                               int mirror_num,
                               unsigned long prev_bio_flags,
-                              unsigned long bio_flags)
+                              unsigned long bio_flags,
+                              bool force_bio_submit)
 {
         int ret = 0;
         struct bio *bio;
@@ -2814,6 +2815,7 @@ static int submit_extent_page(int rw, struct extent_io_tree *tree,
                         contig = bio_end_sector(bio) == sector;
 
                 if (prev_bio_flags != bio_flags || !contig ||
+                    force_bio_submit ||
                     merge_bio(rw, tree, page, offset, page_size, bio, bio_flags) ||
                     bio_add_page(bio, page, page_size, offset) < page_size) {
                         ret = submit_one_bio(rw, bio, mirror_num,
@@ -2910,7 +2912,8 @@ static int __do_readpage(struct extent_io_tree *tree,
                          get_extent_t *get_extent,
                          struct extent_map **em_cached,
                          struct bio **bio, int mirror_num,
-                         unsigned long *bio_flags, int rw)
+                         unsigned long *bio_flags, int rw,
+                         u64 *prev_em_start)
 {
         struct inode *inode = page->mapping->host;
         u64 start = page_offset(page);
@@ -2958,6 +2961,7 @@ static int __do_readpage(struct extent_io_tree *tree,
         }
         while (cur <= end) {
                 unsigned long pnr = (last_byte >> PAGE_CACHE_SHIFT) + 1;
+                bool force_bio_submit = false;
 
                 if (cur >= last_byte) {
                         char *userpage;
@@ -3008,6 +3012,49 @@ static int __do_readpage(struct extent_io_tree *tree,
                 block_start = em->block_start;
                 if (test_bit(EXTENT_FLAG_PREALLOC, &em->flags))
                         block_start = EXTENT_MAP_HOLE;
+
+                /*
+                 * If we have a file range that points to a compressed extent
+                 * and it's followed by a consecutive file range that points to
+                 * to the same compressed extent (possibly with a different
+                 * offset and/or length, so it either points to the whole extent
+                 * or only part of it), we must make sure we do not submit a
+                 * single bio to populate the pages for the 2 ranges because
+                 * this makes the compressed extent read zero out the pages
+                 * belonging to the 2nd range. Imagine the following scenario:
+                 *
+                 *  File layout
+                 *  [0 - 8K]                     [8K - 24K]
+                 *    |                               |
+                 *    |                               |
+                 * points to extent X,         points to extent X,
+                 * offset 4K, length of 8K     offset 0, length 16K
+                 *
+                 * [extent X, compressed length = 4K uncompressed length = 16K]
+                 *
+                 * If the bio to read the compressed extent covers both ranges,
+                 * it will decompress extent X into the pages belonging to the
+                 * first range and then it will stop, zeroing out the remaining
+                 * pages that belong to the other range that points to extent X.
+                 * So here we make sure we submit 2 bios, one for the first
+                 * range and another one for the third range. Both will target
+                 * the same physical extent from disk, but we can't currently
+                 * make the compressed bio endio callback populate the pages
+                 * for both ranges because each compressed bio is tightly
+                 * coupled with a single extent map, and each range can have
+                 * an extent map with a different offset value relative to the
+                 * uncompressed data of our extent and different lengths. This
+                 * is a corner case so we prioritize correctness over
+                 * non-optimal behavior (submitting 2 bios for the same extent).
+                 */
+                if (test_bit(EXTENT_FLAG_COMPRESSED, &em->flags) &&
+                    prev_em_start && *prev_em_start != (u64)-1 &&
+                    *prev_em_start != em->orig_start)
+                        force_bio_submit = true;
+
+                if (prev_em_start)
+                        *prev_em_start = em->orig_start;
+
                 free_extent_map(em);
                 em = NULL;
 
@@ -3057,7 +3104,8 @@ static int __do_readpage(struct extent_io_tree *tree,
                                          bdev, bio, pnr,
                                          end_bio_extent_readpage, mirror_num,
                                          *bio_flags,
-                                         this_bio_flag);
+                                         this_bio_flag,
+                                         force_bio_submit);
                 if (!ret) {
                         nr++;
                         *bio_flags = this_bio_flag;
@@ -3089,6 +3137,7 @@ static inline void __do_contiguous_readpages(struct extent_io_tree *tree,
         struct inode *inode;
         struct btrfs_ordered_extent *ordered;
         int index;
+        u64 prev_em_start = (u64)-1;
 
         inode = pages[0]->mapping->host;
         while (1) {
@@ -3104,7 +3153,7 @@ static inline void __do_contiguous_readpages(struct extent_io_tree *tree,
 
         for (index = 0; index < nr_pages; index++) {
                 __do_readpage(tree, pages[index], get_extent, em_cached, bio,
-                              mirror_num, bio_flags, rw);
+                              mirror_num, bio_flags, rw, &prev_em_start);
                 page_cache_release(pages[index]);
         }
 }
@@ -3172,7 +3221,7 @@ static int __extent_read_full_page(struct extent_io_tree *tree,
         }
 
         ret = __do_readpage(tree, page, get_extent, NULL, bio, mirror_num,
-                            bio_flags, rw);
+                            bio_flags, rw, NULL);
         return ret;
 }
 
@@ -3198,7 +3247,7 @@ int extent_read_full_page_nolock(struct extent_io_tree *tree, struct page *page,
         int ret;
 
         ret = __do_readpage(tree, page, get_extent, NULL, &bio, mirror_num,
-                                      &bio_flags, READ);
+                            &bio_flags, READ, NULL);
         if (bio)
                 ret = submit_one_bio(READ, bio, mirror_num, bio_flags);
         return ret;
@@ -3451,7 +3500,7 @@ static noinline_for_stack int __extent_writepage_io(struct inode *inode,
                                                  sector, iosize, pg_offset,
                                                  bdev, &epd->bio, max_nr,
                                                  end_bio_extent_writepage,
-                                                 0, 0, 0);
+                                                 0, 0, 0, false);
                         if (ret)
                                 SetPageError(page);
                 }
@@ -3754,7 +3803,7 @@ static noinline_for_stack int write_one_eb(struct extent_buffer *eb,
                 ret = submit_extent_page(rw, tree, wbc, p, offset >> 9,
                                          PAGE_CACHE_SIZE, 0, bdev, &epd->bio,
                                          -1, end_bio_extent_buffer_writepage,
-                                         0, epd->bio_flags, bio_flags);
+                                         0, epd->bio_flags, bio_flags, false);
                 epd->bio_flags = bio_flags;
                 if (ret) {
                         set_btree_ioerr(p);
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 237da012f7d0..611b66d73e80 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -5084,7 +5084,8 @@ void btrfs_evict_inode(struct inode *inode)
                 goto no_delete;
         }
         /* do we really want it for ->i_nlink > 0 and zero btrfs_root_refs? */
-        btrfs_wait_ordered_range(inode, 0, (u64)-1);
+        if (!special_file(inode->i_mode))
+                btrfs_wait_ordered_range(inode, 0, (u64)-1);
 
         btrfs_free_io_failure_record(inode, 0, (u64)-1);
 
@@ -6909,8 +6910,7 @@ out:
 
         trace_btrfs_get_extent(root, em);
 
-        if (path)
-                btrfs_free_path(path);
+        btrfs_free_path(path);
         if (trans) {
                 ret = btrfs_end_transaction(trans, root);
                 if (!err)
@@ -7409,6 +7409,10 @@ static struct extent_map *create_pinned_em(struct inode *inode, u64 start,
         return em;
 }
 
+struct btrfs_dio_data {
+        u64 outstanding_extents;
+        u64 reserve;
+};
 
 static int btrfs_get_blocks_direct(struct inode *inode, sector_t iblock,
                                    struct buffer_head *bh_result, int create)
@@ -7416,10 +7420,10 @@ static int btrfs_get_blocks_direct(struct inode *inode, sector_t iblock,
         struct extent_map *em;
         struct btrfs_root *root = BTRFS_I(inode)->root;
         struct extent_state *cached_state = NULL;
+        struct btrfs_dio_data *dio_data = NULL;
         u64 start = iblock << inode->i_blkbits;
         u64 lockstart, lockend;
         u64 len = bh_result->b_size;
-        u64 *outstanding_extents = NULL;
         int unlock_bits = EXTENT_LOCKED;
         int ret = 0;
 
@@ -7437,7 +7441,7 @@ static int btrfs_get_blocks_direct(struct inode *inode, sector_t iblock,
                  * that anything that needs to check if there's a transction doesn't get
                  * confused.
                  */
-                outstanding_extents = current->journal_info;
+                dio_data = current->journal_info;
                 current->journal_info = NULL;
         }
 
@@ -7569,17 +7573,18 @@ unlock:
                  * within our reservation, otherwise we need to adjust our inode
                  * counter appropriately.
                  */
-                if (*outstanding_extents) {
-                        (*outstanding_extents)--;
+                if (dio_data->outstanding_extents) {
+                        (dio_data->outstanding_extents)--;
                 } else {
                         spin_lock(&BTRFS_I(inode)->lock);
                         BTRFS_I(inode)->outstanding_extents++;
                         spin_unlock(&BTRFS_I(inode)->lock);
                 }
 
-                current->journal_info = outstanding_extents;
                 btrfs_free_reserved_data_space(inode, len);
-                set_bit(BTRFS_INODE_DIO_READY, &BTRFS_I(inode)->runtime_flags);
+                WARN_ON(dio_data->reserve < len);
+                dio_data->reserve -= len;
+                current->journal_info = dio_data;
         }
 
         /*
@@ -7602,8 +7607,8 @@ unlock:
 unlock_err:
         clear_extent_bit(&BTRFS_I(inode)->io_tree, lockstart, lockend,
                          unlock_bits, 1, 0, &cached_state, GFP_NOFS);
-        if (outstanding_extents)
-                current->journal_info = outstanding_extents;
+        if (dio_data)
+                current->journal_info = dio_data;
         return ret;
 }
 
@@ -8330,7 +8335,8 @@ static ssize_t btrfs_direct_IO(struct kiocb *iocb, struct iov_iter *iter,
 {
         struct file *file = iocb->ki_filp;
         struct inode *inode = file->f_mapping->host;
-        u64 outstanding_extents = 0;
+        struct btrfs_root *root = BTRFS_I(inode)->root;
+        struct btrfs_dio_data dio_data = { 0 };
         size_t count = 0;
         int flags = 0;
         bool wakeup = true;
@@ -8368,7 +8374,7 @@ static ssize_t btrfs_direct_IO(struct kiocb *iocb, struct iov_iter *iter,
                 ret = btrfs_delalloc_reserve_space(inode, count);
                 if (ret)
                         goto out;
-                outstanding_extents = div64_u64(count +
+                dio_data.outstanding_extents = div64_u64(count +
                                                 BTRFS_MAX_EXTENT_SIZE - 1,
                                                 BTRFS_MAX_EXTENT_SIZE);
 
@@ -8377,7 +8383,8 @@ static ssize_t btrfs_direct_IO(struct kiocb *iocb, struct iov_iter *iter,
                  * do the accounting properly if we go over the number we
                  * originally calculated.  Abuse current->journal_info for this.
                  */
-                current->journal_info = &outstanding_extents;
+                dio_data.reserve = round_up(count, root->sectorsize);
+                current->journal_info = &dio_data;
         } else if (test_bit(BTRFS_INODE_READDIO_NEED_LOCK,
                                      &BTRFS_I(inode)->runtime_flags)) {
                 inode_dio_end(inode);
@@ -8392,16 +8399,9 @@ static ssize_t btrfs_direct_IO(struct kiocb *iocb, struct iov_iter *iter,
         if (iov_iter_rw(iter) == WRITE) {
                 current->journal_info = NULL;
                 if (ret < 0 && ret != -EIOCBQUEUED) {
-                        /*
-                         * If the error comes from submitting stage,
-                         * btrfs_get_blocsk_direct() has free'd data space,
-                         * and metadata space will be handled by
-                         * finish_ordered_fn, don't do that again to make
-                         * sure bytes_may_use is correct.
-                         */
-                        if (!test_and_clear_bit(BTRFS_INODE_DIO_READY,
-                                     &BTRFS_I(inode)->runtime_flags))
-                                btrfs_delalloc_release_space(inode, count);
+                        if (dio_data.reserve)
+                                btrfs_delalloc_release_space(inode,
+                                                        dio_data.reserve);
                 } else if (ret >= 0 && (size_t)ret < count)
                         btrfs_delalloc_release_space(inode,
                                                      count - (size_t)ret);
diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
index 9a11db0c47ee..a39f5d1144e8 100644
--- a/fs/btrfs/scrub.c
+++ b/fs/btrfs/scrub.c
@@ -3267,13 +3267,13 @@ static noinline_for_stack int scrub_stripe(struct scrub_ctx *sctx,
                         scrub_blocked_if_needed(fs_info);
                 }
 
-                /* for raid56, we skip parity stripe */
                 if (map->type & BTRFS_BLOCK_GROUP_RAID56_MASK) {
                         ret = get_raid56_logic_offset(physical, num, map,
                                                       &logical,
                                                       &stripe_logical);
                         logical += base;
                         if (ret) {
+                                /* it is parity strip */
                                 stripe_logical += base;
                                 stripe_end = stripe_logical + increment;
                                 ret = scrub_raid56_parity(sctx, map, scrub_dev,
@@ -3480,7 +3480,6 @@ out:
 
 static noinline_for_stack int scrub_chunk(struct scrub_ctx *sctx,
                                           struct btrfs_device *scrub_dev,
-                                          u64 chunk_tree, u64 chunk_objectid,
                                           u64 chunk_offset, u64 length,
                                           u64 dev_offset, int is_dev_replace)
 {
@@ -3531,8 +3530,6 @@ int scrub_enumerate_chunks(struct scrub_ctx *sctx,
         struct btrfs_root *root = sctx->dev_root;
         struct btrfs_fs_info *fs_info = root->fs_info;
         u64 length;
-        u64 chunk_tree;
-        u64 chunk_objectid;
         u64 chunk_offset;
         int ret = 0;
         int slot;
@@ -3596,8 +3593,6 @@ int scrub_enumerate_chunks(struct scrub_ctx *sctx,
                 if (found_key.offset + length <= start)
                         goto skip;
 
-                chunk_tree = btrfs_dev_extent_chunk_tree(l, dev_extent);
-                chunk_objectid = btrfs_dev_extent_chunk_objectid(l, dev_extent);
                 chunk_offset = btrfs_dev_extent_chunk_offset(l, dev_extent);
 
                 /*
@@ -3630,9 +3625,8 @@ int scrub_enumerate_chunks(struct scrub_ctx *sctx,
                 dev_replace->cursor_right = found_key.offset + length;
                 dev_replace->cursor_left = found_key.offset;
                 dev_replace->item_needs_writeback = 1;
-                ret = scrub_chunk(sctx, scrub_dev, chunk_tree, chunk_objectid,
-                                  chunk_offset, length, found_key.offset,
-                                  is_dev_replace);
+                ret = scrub_chunk(sctx, scrub_dev, chunk_offset, length,
+                                  found_key.offset, is_dev_replace);
 
                 /*
                  * flush, submit all pending read and write bios, afterwards
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 2b07b3581781..11d1eab9234d 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -1658,9 +1658,7 @@ static int btrfs_remount(struct super_block *sb, int *flags, char *data)
                  * groups on disk until we're mounted read-write again
                  * unless we clean them up here.
                  */
-                mutex_lock(&root->fs_info->cleaner_mutex);
                 btrfs_delete_unused_bgs(fs_info);
-                mutex_unlock(&root->fs_info->cleaner_mutex);
 
                 btrfs_dev_replace_suspend_for_unmount(fs_info);
                 btrfs_scrub_cancel(fs_info);
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 8f259b3a66b3..74bc3338418b 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -117,6 +117,18 @@ static noinline void switch_commit_roots(struct btrfs_transaction *trans,
                         btrfs_unpin_free_ino(root);
                 clear_btree_io_tree(&root->dirty_log_pages);
         }
+
+        /* We can free old roots now. */
+        spin_lock(&trans->dropped_roots_lock);
+        while (!list_empty(&trans->dropped_roots)) {
+                root = list_first_entry(&trans->dropped_roots,
+                                        struct btrfs_root, root_list);
+                list_del_init(&root->root_list);
+                spin_unlock(&trans->dropped_roots_lock);
+                btrfs_drop_and_free_fs_root(fs_info, root);
+                spin_lock(&trans->dropped_roots_lock);
+        }
+        spin_unlock(&trans->dropped_roots_lock);
         up_write(&fs_info->commit_root_sem);
 }
 
@@ -255,11 +267,13 @@ loop:
         INIT_LIST_HEAD(&cur_trans->pending_ordered);
         INIT_LIST_HEAD(&cur_trans->dirty_bgs);
         INIT_LIST_HEAD(&cur_trans->io_bgs);
+        INIT_LIST_HEAD(&cur_trans->dropped_roots);
         mutex_init(&cur_trans->cache_write_mutex);
         cur_trans->num_dirty_bgs = 0;
         spin_lock_init(&cur_trans->dirty_bgs_lock);
         INIT_LIST_HEAD(&cur_trans->deleted_bgs);
         spin_lock_init(&cur_trans->deleted_bgs_lock);
+        spin_lock_init(&cur_trans->dropped_roots_lock);
         list_add_tail(&cur_trans->list, &fs_info->trans_list);
         extent_io_tree_init(&cur_trans->dirty_pages,
                              fs_info->btree_inode->i_mapping);
@@ -336,6 +350,24 @@ static int record_root_in_trans(struct btrfs_trans_handle *trans,
 }
 
 
+void btrfs_add_dropped_root(struct btrfs_trans_handle *trans,
+                            struct btrfs_root *root)
+{
+        struct btrfs_transaction *cur_trans = trans->transaction;
+
+        /* Add ourselves to the transaction dropped list */
+        spin_lock(&cur_trans->dropped_roots_lock);
+        list_add_tail(&root->root_list, &cur_trans->dropped_roots);
+        spin_unlock(&cur_trans->dropped_roots_lock);
+
+        /* Make sure we don't try to update the root at commit time */
+        spin_lock(&root->fs_info->fs_roots_radix_lock);
+        radix_tree_tag_clear(&root->fs_info->fs_roots_radix,
+                             (unsigned long)root->root_key.objectid,
+                             BTRFS_ROOT_TRANS_TAG);
+        spin_unlock(&root->fs_info->fs_roots_radix_lock);
+}
+
 int btrfs_record_root_in_trans(struct btrfs_trans_handle *trans,
                                struct btrfs_root *root)
 {
diff --git a/fs/btrfs/transaction.h b/fs/btrfs/transaction.h
index edc2fbc262d7..87964bf8892d 100644
--- a/fs/btrfs/transaction.h
+++ b/fs/btrfs/transaction.h
@@ -65,6 +65,7 @@ struct btrfs_transaction {
         struct list_head switch_commits;
         struct list_head dirty_bgs;
         struct list_head io_bgs;
+        struct list_head dropped_roots;
         u64 num_dirty_bgs;
 
         /*
@@ -76,6 +77,7 @@ struct btrfs_transaction {
         spinlock_t dirty_bgs_lock;
         struct list_head deleted_bgs;
         spinlock_t deleted_bgs_lock;
+        spinlock_t dropped_roots_lock;
         struct btrfs_delayed_ref_root delayed_refs;
         int aborted;
         int dirty_bg_run;
@@ -216,5 +218,6 @@ int btrfs_transaction_blocked(struct btrfs_fs_info *info);
 int btrfs_transaction_in_commit(struct btrfs_fs_info *info);
 void btrfs_put_transaction(struct btrfs_transaction *transaction);
 void btrfs_apply_pending_changes(struct btrfs_fs_info *fs_info);
-
+void btrfs_add_dropped_root(struct btrfs_trans_handle *trans,
+                            struct btrfs_root *root);
 #endif
diff --git a/fs/btrfs/tree-defrag.c b/fs/btrfs/tree-defrag.c
index a4b9c8b2d35a..f31db4325339 100644
--- a/fs/btrfs/tree-defrag.c
+++ b/fs/btrfs/tree-defrag.c
@@ -115,8 +115,7 @@ int btrfs_defrag_leaves(struct btrfs_trans_handle *trans,
                 ret = -EAGAIN;
         }
 out:
-        if (path)
-                btrfs_free_path(path);
+        btrfs_free_path(path);
         if (ret == -EAGAIN) {
                 if (root->defrag_max.objectid > root->defrag_progress.objectid)
                         goto done;
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 76201d6f6ce4..6fc735869c18 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -3585,23 +3585,10 @@ int btrfs_balance(struct btrfs_balance_control *bctl,
         } while (read_seqretry(&fs_info->profiles_lock, seq));
 
         if (bctl->sys.flags & BTRFS_BALANCE_ARGS_CONVERT) {
-                int num_tolerated_disk_barrier_failures;
-                u64 target = bctl->sys.target;
-
-                num_tolerated_disk_barrier_failures =
-                        btrfs_calc_num_tolerated_disk_barrier_failures(fs_info);
-                if (num_tolerated_disk_barrier_failures > 0 &&
-                    (target &
-                     (BTRFS_BLOCK_GROUP_DUP | BTRFS_BLOCK_GROUP_RAID0 |
-                      BTRFS_AVAIL_ALLOC_BIT_SINGLE)))
-                        num_tolerated_disk_barrier_failures = 0;
-                else if (num_tolerated_disk_barrier_failures > 1 &&
-                         (target &
-                          (BTRFS_BLOCK_GROUP_RAID1 | BTRFS_BLOCK_GROUP_RAID10)))
-                        num_tolerated_disk_barrier_failures = 1;
-
-                fs_info->num_tolerated_disk_barrier_failures =
-                        num_tolerated_disk_barrier_failures;
+                fs_info->num_tolerated_disk_barrier_failures = min(
+                        btrfs_calc_num_tolerated_disk_barrier_failures(fs_info),
+                        btrfs_get_num_tolerated_disk_barrier_failures(
+                                bctl->sys.target));
         }
 
         ret = insert_balance_item(fs_info->tree_root, bctl);
diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
index a268abfe60ac..9d23e788d1df 100644
--- a/fs/ceph/addr.c
+++ b/fs/ceph/addr.c
@@ -276,7 +276,7 @@ static void finish_read(struct ceph_osd_request *req, struct ceph_msg *msg)
         for (i = 0; i < num_pages; i++) {
                 struct page *page = osd_data->pages[i];
 
-                if (rc < 0)
+                if (rc < 0 && rc != ENOENT)
                         goto unlock;
                 if (bytes < (int)PAGE_CACHE_SIZE) {
                         /* zero (remainder of) page */
@@ -717,8 +717,10 @@ static int ceph_writepages_start(struct address_space *mapping,
              wbc->sync_mode == WB_SYNC_NONE ? "NONE" :
              (wbc->sync_mode == WB_SYNC_ALL ? "ALL" : "HOLD"));
 
-        if (fsc->mount_state == CEPH_MOUNT_SHUTDOWN) {
+        if (ACCESS_ONCE(fsc->mount_state) == CEPH_MOUNT_SHUTDOWN) {
                 pr_warn("writepage_start %p on forced umount\n", inode);
+                truncate_pagecache(inode, 0);
+                mapping_set_error(mapping, -EIO);
                 return -EIO; /* we're in a forced umount, don't write! */
         }
         if (fsc->mount_options->wsize && fsc->mount_options->wsize < wsize)
diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index ddd5e9471290..27b566874bc1 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -2413,6 +2413,14 @@ again:
                         goto out_unlock;
                 }
 
+                if (!__ceph_is_any_caps(ci) &&
+                    ACCESS_ONCE(mdsc->fsc->mount_state) == CEPH_MOUNT_SHUTDOWN) {
+                        dout("get_cap_refs %p forced umount\n", inode);
+                        *err = -EIO;
+                        ret = 1;
+                        goto out_unlock;
+                }
+
                 dout("get_cap_refs %p have %s needed %s\n", inode,
                      ceph_cap_string(have), ceph_cap_string(need));
         }
diff --git a/fs/ceph/file.c b/fs/ceph/file.c
index 8b79d87eaf46..0c62868b5c56 100644
--- a/fs/ceph/file.c
+++ b/fs/ceph/file.c
@@ -136,7 +136,6 @@ int ceph_open(struct inode *inode, struct file *file)
         struct ceph_mds_client *mdsc = fsc->mdsc;
         struct ceph_mds_request *req;
         struct ceph_file_info *cf = file->private_data;
-        struct inode *parent_inode = NULL;
         int err;
         int flags, fmode, wanted;
 
@@ -210,10 +209,7 @@ int ceph_open(struct inode *inode, struct file *file)
         ihold(inode);
 
         req->r_num_caps = 1;
-        if (flags & O_CREAT)
-                parent_inode = ceph_get_dentry_parent_inode(file->f_path.dentry);
-        err = ceph_mdsc_do_request(mdsc, parent_inode, req);
-        iput(parent_inode);
+        err = ceph_mdsc_do_request(mdsc, NULL, req);
         if (!err)
                 err = ceph_init_file(inode, file, req->r_fmode);
         ceph_mdsc_put_request(req);
@@ -279,7 +275,7 @@ int ceph_atomic_open(struct inode *dir, struct dentry *dentry,
         if (err)
                 goto out_req;
 
-        if (err == 0 && (flags & O_CREAT) && !req->r_reply_info.head->is_dentry)
+        if ((flags & O_CREAT) && !req->r_reply_info.head->is_dentry)
                 err = ceph_handle_notrace_create(dir, dentry);
 
         if (d_unhashed(dentry)) {
@@ -956,6 +952,12 @@ static ssize_t ceph_write_iter(struct kiocb *iocb, struct iov_iter *from)
         /* We can write back this queue in page reclaim */
         current->backing_dev_info = inode_to_bdi(inode);
 
+        if (iocb->ki_flags & IOCB_APPEND) {
+                err = ceph_do_getattr(inode, CEPH_STAT_CAP_SIZE, false);
+                if (err < 0)
+                        goto out;
+        }
+
         err = generic_write_checks(iocb, from);
         if (err <= 0)
                 goto out;
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 6aa07af67603..51cb02da75d9 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -2107,7 +2107,6 @@ static int __prepare_send_request(struct ceph_mds_client *mdsc,
         msg = create_request_message(mdsc, req, mds, drop_cap_releases);
         if (IS_ERR(msg)) {
                 req->r_err = PTR_ERR(msg);
-                complete_request(mdsc, req);
                 return PTR_ERR(msg);
         }
         req->r_request = msg;
@@ -2135,7 +2134,7 @@ static int __do_request(struct ceph_mds_client *mdsc,
 {
         struct ceph_mds_session *session = NULL;
         int mds = -1;
-        int err = -EAGAIN;
+        int err = 0;
 
         if (req->r_err || req->r_got_result) {
                 if (req->r_aborted)
@@ -2149,6 +2148,11 @@ static int __do_request(struct ceph_mds_client *mdsc,
                 err = -EIO;
                 goto finish;
         }
+        if (ACCESS_ONCE(mdsc->fsc->mount_state) == CEPH_MOUNT_SHUTDOWN) {
+                dout("do_request forced umount\n");
+                err = -EIO;
+                goto finish;
+        }
 
         put_request_session(req);
 
@@ -2196,13 +2200,15 @@ static int __do_request(struct ceph_mds_client *mdsc,
 
 out_session:
         ceph_put_mds_session(session);
+finish:
+        if (err) {
+                dout("__do_request early error %d\n", err);
+                req->r_err = err;
+                complete_request(mdsc, req);
+                __unregister_request(mdsc, req);
+        }
 out:
         return err;
-
-finish:
-        req->r_err = err;
-        complete_request(mdsc, req);
-        goto out;
 }
 
 /*
@@ -2289,8 +2295,6 @@ int ceph_mdsc_do_request(struct ceph_mds_client *mdsc,
 
         if (req->r_err) {
                 err = req->r_err;
-                __unregister_request(mdsc, req);
-                dout("do_request early error %d\n", err);
                 goto out;
         }
 
@@ -2411,7 +2415,7 @@ static void handle_reply(struct ceph_mds_session *session, struct ceph_msg *msg)
                 mutex_unlock(&mdsc->mutex);
                 goto out;
         }
-        if (req->r_got_safe && !head->safe) {
+        if (req->r_got_safe) {
                 pr_warn("got unsafe after safe on %llu from mds%d\n",
                            tid, mds);
                 mutex_unlock(&mdsc->mutex);
@@ -2520,8 +2524,7 @@ out_err:
                 if (err) {
                         req->r_err = err;
                 } else {
-                        req->r_reply = msg;
-                        ceph_msg_get(msg);
+                        req->r_reply =  ceph_msg_get(msg);
                         req->r_got_result = true;
                 }
         } else {
@@ -3555,7 +3558,7 @@ void ceph_mdsc_sync(struct ceph_mds_client *mdsc)
 {
         u64 want_tid, want_flush, want_snap;
 
-        if (mdsc->fsc->mount_state == CEPH_MOUNT_SHUTDOWN)
+        if (ACCESS_ONCE(mdsc->fsc->mount_state) == CEPH_MOUNT_SHUTDOWN)
                 return;
 
         dout("sync\n");
@@ -3584,7 +3587,7 @@ void ceph_mdsc_sync(struct ceph_mds_client *mdsc)
  */
 static bool done_closing_sessions(struct ceph_mds_client *mdsc)
 {
-        if (mdsc->fsc->mount_state == CEPH_MOUNT_SHUTDOWN)
+        if (ACCESS_ONCE(mdsc->fsc->mount_state) == CEPH_MOUNT_SHUTDOWN)
                 return true;
         return atomic_read(&mdsc->num_sessions) == 0;
 }
@@ -3643,6 +3646,34 @@ void ceph_mdsc_close_sessions(struct ceph_mds_client *mdsc)
         dout("stopped\n");
 }
 
+void ceph_mdsc_force_umount(struct ceph_mds_client *mdsc)
+{
+        struct ceph_mds_session *session;
+        int mds;
+
+        dout("force umount\n");
+
+        mutex_lock(&mdsc->mutex);
+        for (mds = 0; mds < mdsc->max_sessions; mds++) {
+                session = __ceph_lookup_mds_session(mdsc, mds);
+                if (!session)
+                        continue;
+                mutex_unlock(&mdsc->mutex);
+                mutex_lock(&session->s_mutex);
+                __close_session(mdsc, session);
+                if (session->s_state == CEPH_MDS_SESSION_CLOSING) {
+                        cleanup_session_requests(mdsc, session);
+                        remove_session_caps(session);
+                }
+                mutex_unlock(&session->s_mutex);
+                ceph_put_mds_session(session);
+                mutex_lock(&mdsc->mutex);
+                kick_requests(mdsc, mds);
+        }
+        __wake_requests(mdsc, &mdsc->waiting_for_map);
+        mutex_unlock(&mdsc->mutex);
+}
+
 static void ceph_mdsc_stop(struct ceph_mds_client *mdsc)
 {
         dout("stop\n");
diff --git a/fs/ceph/mds_client.h b/fs/ceph/mds_client.h
index 762757e6cebf..f575eafe2261 100644
--- a/fs/ceph/mds_client.h
+++ b/fs/ceph/mds_client.h
@@ -366,6 +366,7 @@ extern int ceph_send_msg_mds(struct ceph_mds_client *mdsc,
 
 extern int ceph_mdsc_init(struct ceph_fs_client *fsc);
 extern void ceph_mdsc_close_sessions(struct ceph_mds_client *mdsc);
+extern void ceph_mdsc_force_umount(struct ceph_mds_client *mdsc);
 extern void ceph_mdsc_destroy(struct ceph_fs_client *fsc);
 
 extern void ceph_mdsc_sync(struct ceph_mds_client *mdsc);
diff --git a/fs/ceph/snap.c b/fs/ceph/snap.c
index 233d906aec02..4aa7122a8d38 100644
--- a/fs/ceph/snap.c
+++ b/fs/ceph/snap.c
@@ -338,12 +338,6 @@ static int build_snap_context(struct ceph_snap_realm *realm)
                 return 0;
         }
 
-        if (num == 0 && realm->seq == ceph_empty_snapc->seq) {
-                ceph_get_snap_context(ceph_empty_snapc);
-                snapc = ceph_empty_snapc;
-                goto done;
-        }
-
         /* alloc new snap context */
         err = -ENOMEM;
         if (num > (SIZE_MAX - sizeof(*snapc)) / sizeof(u64))
@@ -381,7 +375,6 @@ static int build_snap_context(struct ceph_snap_realm *realm)
              realm->ino, realm, snapc, snapc->seq,
              (unsigned int) snapc->num_snaps);
 
-done:
         ceph_put_snap_context(realm->cached_context);
         realm->cached_context = snapc;
         return 0;
diff --git a/fs/ceph/super.c b/fs/ceph/super.c
index 7b6bfcbf801c..f446afada328 100644
--- a/fs/ceph/super.c
+++ b/fs/ceph/super.c
@@ -708,6 +708,7 @@ static void ceph_umount_begin(struct super_block *sb)
         if (!fsc)
                 return;
         fsc->mount_state = CEPH_MOUNT_SHUTDOWN;
+        ceph_mdsc_force_umount(fsc->mdsc);
         return;
 }
 
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 6a1119e87fbb..e739950ca084 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -325,8 +325,11 @@ cifs_show_address(struct seq_file *s, struct TCP_Server_Info *server)
 static void
 cifs_show_security(struct seq_file *s, struct cifs_ses *ses)
 {
-        if (ses->sectype == Unspecified)
+        if (ses->sectype == Unspecified) {
+                if (ses->user_name == NULL)
+                        seq_puts(s, ",sec=none");
                 return;
+        }
 
         seq_puts(s, ",sec=");
 
diff --git a/fs/cifs/ioctl.c b/fs/cifs/ioctl.c
index c63f5227b681..28a77bf1d559 100644
--- a/fs/cifs/ioctl.c
+++ b/fs/cifs/ioctl.c
@@ -67,6 +67,12 @@ static long cifs_ioctl_clone(unsigned int xid, struct file *dst_file,
                 goto out_drop_write;
         }
 
+        if (src_file.file->f_op->unlocked_ioctl != cifs_ioctl) {
+                rc = -EBADF;
+                cifs_dbg(VFS, "src file seems to be from a different filesystem type\n");
+                goto out_fput;
+        }
+
         if ((!src_file.file->private_data) || (!dst_file->private_data)) {
                 rc = -EBADF;
                 cifs_dbg(VFS, "missing cifsFileInfo on copy range src file\n");
diff --git a/fs/dax.c b/fs/dax.c
index 93bf2f990ace..7ae6df7ea1d2 100644
--- a/fs/dax.c
+++ b/fs/dax.c
@@ -119,7 +119,8 @@ static ssize_t dax_io(struct inode *inode, struct iov_iter *iter,
                 size_t len;
                 if (pos == max) {
                         unsigned blkbits = inode->i_blkbits;
-                        sector_t block = pos >> blkbits;
+                        long page = pos >> PAGE_SHIFT;
+                        sector_t block = page << (PAGE_SHIFT - blkbits);
                         unsigned first = pos - (block << blkbits);
                         long size;
 
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index 24489126f8ca..091a36444972 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -1380,6 +1380,10 @@ static long writeback_chunk_size(struct bdi_writeback *wb,
  * Write a portion of b_io inodes which belong to @sb.
  *
  * Return the number of pages and/or inodes written.
+ *
+ * NOTE! This is called with wb->list_lock held, and will
+ * unlock and relock that for each inode it ends up doing
+ * IO for.
  */
 static long writeback_sb_inodes(struct super_block *sb,
                                 struct bdi_writeback *wb,
@@ -1398,9 +1402,7 @@ static long writeback_sb_inodes(struct super_block *sb,
         unsigned long start_time = jiffies;
         long write_chunk;
         long wrote = 0;  /* count both pages and inodes */
-        struct blk_plug plug;
 
-        blk_start_plug(&plug);
         while (!list_empty(&wb->b_io)) {
                 struct inode *inode = wb_inode(wb->b_io.prev);
 
@@ -1479,6 +1481,21 @@ static long writeback_sb_inodes(struct super_block *sb,
                 wbc_detach_inode(&wbc);
                 work->nr_pages -= write_chunk - wbc.nr_to_write;
                 wrote += write_chunk - wbc.nr_to_write;
+
+                if (need_resched()) {
+                        /*
+                         * We're trying to balance between building up a nice
+                         * long list of IOs to improve our merge rate, and
+                         * getting those IOs out quickly for anyone throttling
+                         * in balance_dirty_pages().  cond_resched() doesn't
+                         * unplug, so get our IOs out the door before we
+                         * give up the CPU.
+                         */
+                        blk_flush_plug(current);
+                        cond_resched();
+                }
+
+
                 spin_lock(&wb->list_lock);
                 spin_lock(&inode->i_lock);
                 if (!(inode->i_state & I_DIRTY_ALL))
@@ -1486,7 +1503,7 @@ static long writeback_sb_inodes(struct super_block *sb,
                 requeue_inode(inode, wb, &wbc);
                 inode_sync_complete(inode);
                 spin_unlock(&inode->i_lock);
-                cond_resched_lock(&wb->list_lock);
+
                 /*
                  * bail out to wb_writeback() often enough to check
                  * background threshold and other termination conditions.
@@ -1498,7 +1515,6 @@ static long writeback_sb_inodes(struct super_block *sb,
                                 break;
                 }
         }
-        blk_finish_plug(&plug);
         return wrote;
 }
 
@@ -1545,12 +1561,15 @@ static long writeback_inodes_wb(struct bdi_writeback *wb, long nr_pages,
                 .range_cyclic   = 1,
                 .reason         = reason,
         };
+        struct blk_plug plug;
 
+        blk_start_plug(&plug);
         spin_lock(&wb->list_lock);
         if (list_empty(&wb->b_io))
                 queue_io(wb, &work);
         __writeback_inodes_wb(wb, &work);
         spin_unlock(&wb->list_lock);
+        blk_finish_plug(&plug);
 
         return nr_pages - work.nr_pages;
 }
@@ -1578,10 +1597,12 @@ static long wb_writeback(struct bdi_writeback *wb,
         unsigned long oldest_jif;
         struct inode *inode;
         long progress;
+        struct blk_plug plug;
 
         oldest_jif = jiffies;
         work->older_than_this = &oldest_jif;
 
+        blk_start_plug(&plug);
         spin_lock(&wb->list_lock);
         for (;;) {
                 /*
@@ -1661,6 +1682,7 @@ static long wb_writeback(struct bdi_writeback *wb,
                 }
         }
         spin_unlock(&wb->list_lock);
+        blk_finish_plug(&plug);
 
         return nr_pages - work->nr_pages;
 }
diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index a38e38f7b6fc..9bd1244caf38 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -34,6 +34,7 @@
 #include <linux/percpu.h>
 #include <linux/list_sort.h>
 #include <linux/lockref.h>
+#include <linux/rhashtable.h>
 
 #include "gfs2.h"
 #include "incore.h"
@@ -50,9 +51,8 @@
 #include "trace_gfs2.h"
 
 struct gfs2_glock_iter {
-        int hash;                       /* hash bucket index           */
-        unsigned nhash;                 /* Index within current bucket */
         struct gfs2_sbd *sdp;           /* incore superblock           */
+        struct rhashtable_iter hti;     /* rhashtable iterator         */
         struct gfs2_glock *gl;          /* current glock struct        */
         loff_t last_pos;                /* last position               */
 };
@@ -70,44 +70,19 @@ static DEFINE_SPINLOCK(lru_lock);
 
 #define GFS2_GL_HASH_SHIFT      15
 #define GFS2_GL_HASH_SIZE       (1 << GFS2_GL_HASH_SHIFT)
-#define GFS2_GL_HASH_MASK       (GFS2_GL_HASH_SIZE - 1)
 
-static struct hlist_bl_head gl_hash_table[GFS2_GL_HASH_SIZE];
-static struct dentry *gfs2_root;
-
-/**
- * gl_hash() - Turn glock number into hash bucket number
- * @lock: The glock number
- *
- * Returns: The number of the corresponding hash bucket
- */
-
-static unsigned int gl_hash(const struct gfs2_sbd *sdp,
-                            const struct lm_lockname *name)
-{
-        unsigned int h;
-
-        h = jhash(&name->ln_number, sizeof(u64), 0);
-        h = jhash(&name->ln_type, sizeof(unsigned int), h);
-        h = jhash(&sdp, sizeof(struct gfs2_sbd *), h);
-        h &= GFS2_GL_HASH_MASK;
-
-        return h;
-}
-
-static inline void spin_lock_bucket(unsigned int hash)
-{
-        hlist_bl_lock(&gl_hash_table[hash]);
-}
+static struct rhashtable_params ht_parms = {
+        .nelem_hint = GFS2_GL_HASH_SIZE * 3 / 4,
+        .key_len = sizeof(struct lm_lockname),
+        .key_offset = offsetof(struct gfs2_glock, gl_name),
+        .head_offset = offsetof(struct gfs2_glock, gl_node),
+};
 
-static inline void spin_unlock_bucket(unsigned int hash)
-{
-        hlist_bl_unlock(&gl_hash_table[hash]);
-}
+static struct rhashtable gl_hash_table;
 
-static void gfs2_glock_dealloc(struct rcu_head *rcu)
+void gfs2_glock_free(struct gfs2_glock *gl)
 {
-        struct gfs2_glock *gl = container_of(rcu, struct gfs2_glock, gl_rcu);
+        struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
 
         if (gl->gl_ops->go_flags & GLOF_ASPACE) {
                 kmem_cache_free(gfs2_glock_aspace_cachep, gl);
@@ -115,13 +90,6 @@ static void gfs2_glock_dealloc(struct rcu_head *rcu)
                 kfree(gl->gl_lksb.sb_lvbptr);
                 kmem_cache_free(gfs2_glock_cachep, gl);
         }
-}
-
-void gfs2_glock_free(struct gfs2_glock *gl)
-{
-        struct gfs2_sbd *sdp = gl->gl_sbd;
-
-        call_rcu(&gl->gl_rcu, gfs2_glock_dealloc);
         if (atomic_dec_and_test(&sdp->sd_glock_disposal))
                 wake_up(&sdp->sd_glock_wait);
 }
@@ -192,7 +160,7 @@ static void gfs2_glock_remove_from_lru(struct gfs2_glock *gl)
 
 void gfs2_glock_put(struct gfs2_glock *gl)
 {
-        struct gfs2_sbd *sdp = gl->gl_sbd;
+        struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
         struct address_space *mapping = gfs2_glock2aspace(gl);
 
         if (lockref_put_or_lock(&gl->gl_lockref))
@@ -202,9 +170,7 @@ void gfs2_glock_put(struct gfs2_glock *gl)
 
         gfs2_glock_remove_from_lru(gl);
         spin_unlock(&gl->gl_lockref.lock);
-        spin_lock_bucket(gl->gl_hash);
-        hlist_bl_del_rcu(&gl->gl_list);
-        spin_unlock_bucket(gl->gl_hash);
+        rhashtable_remove_fast(&gl_hash_table, &gl->gl_node, ht_parms);
         GLOCK_BUG_ON(gl, !list_empty(&gl->gl_holders));
         GLOCK_BUG_ON(gl, mapping && mapping->nrpages);
         trace_gfs2_glock_put(gl);
@@ -212,33 +178,6 @@ void gfs2_glock_put(struct gfs2_glock *gl)
 }
 
 /**
- * search_bucket() - Find struct gfs2_glock by lock number
- * @bucket: the bucket to search
- * @name: The lock name
- *
- * Returns: NULL, or the struct gfs2_glock with the requested number
- */
-
-static struct gfs2_glock *search_bucket(unsigned int hash,
-                                        const struct gfs2_sbd *sdp,
-                                        const struct lm_lockname *name)
-{
-        struct gfs2_glock *gl;
-        struct hlist_bl_node *h;
-
-        hlist_bl_for_each_entry_rcu(gl, h, &gl_hash_table[hash], gl_list) {
-                if (!lm_name_equal(&gl->gl_name, name))
-                        continue;
-                if (gl->gl_sbd != sdp)
-                        continue;
-                if (lockref_get_not_dead(&gl->gl_lockref))
-                        return gl;
-        }
-
-        return NULL;
-}
-
-/**
  * may_grant - check if its ok to grant a new lock
  * @gl: The glock
  * @gh: The lock request which we wish to grant
@@ -506,7 +445,7 @@ __releases(&gl->gl_spin)
 __acquires(&gl->gl_spin)
 {
         const struct gfs2_glock_operations *glops = gl->gl_ops;
-        struct gfs2_sbd *sdp = gl->gl_sbd;
+        struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
         unsigned int lck_flags = gh ? gh->gh_flags : 0;
         int ret;
 
@@ -628,7 +567,7 @@ out_unlock:
 static void delete_work_func(struct work_struct *work)
 {
         struct gfs2_glock *gl = container_of(work, struct gfs2_glock, gl_delete);
-        struct gfs2_sbd *sdp = gl->gl_sbd;
+        struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
         struct gfs2_inode *ip;
         struct inode *inode;
         u64 no_addr = gl->gl_name.ln_number;
@@ -704,15 +643,17 @@ int gfs2_glock_get(struct gfs2_sbd *sdp, u64 number,
                    struct gfs2_glock **glp)
 {
         struct super_block *s = sdp->sd_vfs;
-        struct lm_lockname name = { .ln_number = number, .ln_type = glops->go_type };
-        struct gfs2_glock *gl, *tmp;
-        unsigned int hash = gl_hash(sdp, &name);
+        struct lm_lockname name = { .ln_number = number,
+                                    .ln_type = glops->go_type,
+                                    .ln_sbd = sdp };
+        struct gfs2_glock *gl, *tmp = NULL;
         struct address_space *mapping;
         struct kmem_cache *cachep;
+        int ret, tries = 0;
 
-        rcu_read_lock();
-        gl = search_bucket(hash, sdp, &name);
-        rcu_read_unlock();
+        gl = rhashtable_lookup_fast(&gl_hash_table, &name, ht_parms);
+        if (gl && !lockref_get_not_dead(&gl->gl_lockref))
+                gl = NULL;
 
         *glp = gl;
         if (gl)
@@ -739,14 +680,13 @@ int gfs2_glock_get(struct gfs2_sbd *sdp, u64 number,
         }
 
         atomic_inc(&sdp->sd_glock_disposal);
-        gl->gl_sbd = sdp;
+        gl->gl_node.next = NULL;
         gl->gl_flags = 0;
         gl->gl_name = name;
         gl->gl_lockref.count = 1;
         gl->gl_state = LM_ST_UNLOCKED;
         gl->gl_target = LM_ST_UNLOCKED;
         gl->gl_demote_state = LM_ST_EXCLUSIVE;
-        gl->gl_hash = hash;
         gl->gl_ops = glops;
         gl->gl_dstamp = ktime_set(0, 0);
         preempt_disable();
@@ -771,22 +711,34 @@ int gfs2_glock_get(struct gfs2_sbd *sdp, u64 number,
                 mapping->writeback_index = 0;
         }
 
-        spin_lock_bucket(hash);
-        tmp = search_bucket(hash, sdp, &name);
-        if (tmp) {
-                spin_unlock_bucket(hash);
-                kfree(gl->gl_lksb.sb_lvbptr);
-                kmem_cache_free(cachep, gl);
-                atomic_dec(&sdp->sd_glock_disposal);
-                gl = tmp;
-        } else {
-                hlist_bl_add_head_rcu(&gl->gl_list, &gl_hash_table[hash]);
-                spin_unlock_bucket(hash);
+again:
+        ret = rhashtable_lookup_insert_fast(&gl_hash_table, &gl->gl_node,
+                                            ht_parms);
+        if (ret == 0) {
+                *glp = gl;
+                return 0;
         }
 
-        *glp = gl;
+        if (ret == -EEXIST) {
+                ret = 0;
+                tmp = rhashtable_lookup_fast(&gl_hash_table, &name, ht_parms);
+                if (tmp == NULL || !lockref_get_not_dead(&tmp->gl_lockref)) {
+                        if (++tries < 100) {
+                                cond_resched();
+                                goto again;
+                        }
+                        tmp = NULL;
+                        ret = -ENOMEM;
+                }
+        } else {
+                WARN_ON_ONCE(ret);
+        }
+        kfree(gl->gl_lksb.sb_lvbptr);
+        kmem_cache_free(cachep, gl);
+        atomic_dec(&sdp->sd_glock_disposal);
+        *glp = tmp;
 
-        return 0;
+        return ret;
 }
 
 /**
@@ -928,7 +880,7 @@ __releases(&gl->gl_spin)
 __acquires(&gl->gl_spin)
 {
         struct gfs2_glock *gl = gh->gh_gl;
-        struct gfs2_sbd *sdp = gl->gl_sbd;
+        struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
         struct list_head *insert_pt = NULL;
         struct gfs2_holder *gh2;
         int try_futile = 0;
@@ -1006,7 +958,7 @@ trap_recursive:
 int gfs2_glock_nq(struct gfs2_holder *gh)
 {
         struct gfs2_glock *gl = gh->gh_gl;
-        struct gfs2_sbd *sdp = gl->gl_sbd;
+        struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
         int error = 0;
 
         if (unlikely(test_bit(SDF_SHUTDOWN, &sdp->sd_flags)))
@@ -1313,7 +1265,7 @@ static int gfs2_should_freeze(const struct gfs2_glock *gl)
 
 void gfs2_glock_complete(struct gfs2_glock *gl, int ret)
 {
-        struct lm_lockstruct *ls = &gl->gl_sbd->sd_lockstruct;
+        struct lm_lockstruct *ls = &gl->gl_name.ln_sbd->sd_lockstruct;
 
         spin_lock(&gl->gl_spin);
         gl->gl_reply = ret;
@@ -1462,31 +1414,26 @@ static struct shrinker glock_shrinker = {
  *
  */
 
-static void examine_bucket(glock_examiner examiner, const struct gfs2_sbd *sdp,
-                          unsigned int hash)
+static void glock_hash_walk(glock_examiner examiner, const struct gfs2_sbd *sdp)
 {
         struct gfs2_glock *gl;
-        struct hlist_bl_head *head = &gl_hash_table[hash];
-        struct hlist_bl_node *pos;
+        struct rhash_head *pos, *next;
+        const struct bucket_table *tbl;
+        int i;
 
         rcu_read_lock();
-        hlist_bl_for_each_entry_rcu(gl, pos, head, gl_list) {
-                if ((gl->gl_sbd == sdp) && lockref_get_not_dead(&gl->gl_lockref))
-                        examiner(gl);
+        tbl = rht_dereference_rcu(gl_hash_table.tbl, &gl_hash_table);
+        for (i = 0; i < tbl->size; i++) {
+                rht_for_each_entry_safe(gl, pos, next, tbl, i, gl_node) {
+                        if ((gl->gl_name.ln_sbd == sdp) &&
+                            lockref_get_not_dead(&gl->gl_lockref))
+                                examiner(gl);
+                }
         }
         rcu_read_unlock();
         cond_resched();
 }
 
-static void glock_hash_walk(glock_examiner examiner, const struct gfs2_sbd *sdp)
-{
-        unsigned x;
-
-        for (x = 0; x < GFS2_GL_HASH_SIZE; x++)
-                examine_bucket(examiner, sdp, x);
-}
-
-
 /**
  * thaw_glock - thaw out a glock which has an unprocessed reply waiting
  * @gl: The glock to thaw
@@ -1569,7 +1516,7 @@ void gfs2_glock_finish_truncate(struct gfs2_inode *ip)
         int ret;
 
         ret = gfs2_truncatei_resume(ip);
-        gfs2_assert_withdraw(gl->gl_sbd, ret == 0);
+        gfs2_assert_withdraw(gl->gl_name.ln_sbd, ret == 0);
 
         spin_lock(&gl->gl_spin);
         clear_bit(GLF_LOCK, &gl->gl_flags);
@@ -1733,17 +1680,17 @@ static int gfs2_glstats_seq_show(struct seq_file *seq, void *iter_ptr)
 {
         struct gfs2_glock *gl = iter_ptr;
 
-        seq_printf(seq, "G: n:%u/%llx rtt:%lld/%lld rttb:%lld/%lld irt:%lld/%lld dcnt: %lld qcnt: %lld\n",
+        seq_printf(seq, "G: n:%u/%llx rtt:%llu/%llu rttb:%llu/%llu irt:%llu/%llu dcnt: %llu qcnt: %llu\n",
                    gl->gl_name.ln_type,
                    (unsigned long long)gl->gl_name.ln_number,
-                   (long long)gl->gl_stats.stats[GFS2_LKS_SRTT],
-                   (long long)gl->gl_stats.stats[GFS2_LKS_SRTTVAR],
-                   (long long)gl->gl_stats.stats[GFS2_LKS_SRTTB],
-                   (long long)gl->gl_stats.stats[GFS2_LKS_SRTTVARB],
-                   (long long)gl->gl_stats.stats[GFS2_LKS_SIRT],
-                   (long long)gl->gl_stats.stats[GFS2_LKS_SIRTVAR],
-                   (long long)gl->gl_stats.stats[GFS2_LKS_DCOUNT],
-                   (long long)gl->gl_stats.stats[GFS2_LKS_QCOUNT]);
+                   (unsigned long long)gl->gl_stats.stats[GFS2_LKS_SRTT],
+                   (unsigned long long)gl->gl_stats.stats[GFS2_LKS_SRTTVAR],
+                   (unsigned long long)gl->gl_stats.stats[GFS2_LKS_SRTTB],
+                   (unsigned long long)gl->gl_stats.stats[GFS2_LKS_SRTTVARB],
+                   (unsigned long long)gl->gl_stats.stats[GFS2_LKS_SIRT],
+                   (unsigned long long)gl->gl_stats.stats[GFS2_LKS_SIRTVAR],
+                   (unsigned long long)gl->gl_stats.stats[GFS2_LKS_DCOUNT],
+                   (unsigned long long)gl->gl_stats.stats[GFS2_LKS_QCOUNT]);
         return 0;
 }
 
@@ -1776,11 +1723,10 @@ static const char *gfs2_stype[] = {
 
 static int gfs2_sbstats_seq_show(struct seq_file *seq, void *iter_ptr)
 {
-        struct gfs2_glock_iter *gi = seq->private;
-        struct gfs2_sbd *sdp = gi->sdp;
-        unsigned index = gi->hash >> 3;
-        unsigned subindex = gi->hash & 0x07;
-        s64 value;
+        struct gfs2_sbd *sdp = seq->private;
+        loff_t pos = *(loff_t *)iter_ptr;
+        unsigned index = pos >> 3;
+        unsigned subindex = pos & 0x07;
         int i;
 
         if (index == 0 && subindex != 0)
@@ -1791,12 +1737,12 @@ static int gfs2_sbstats_seq_show(struct seq_file *seq, void *iter_ptr)
 
         for_each_possible_cpu(i) {
                 const struct gfs2_pcpu_lkstats *lkstats = per_cpu_ptr(sdp->sd_lkstats, i);
-                if (index == 0) {
-                        value = i;
-                } else {
-                        value = lkstats->lkstats[index - 1].stats[subindex];
-                }
-                seq_printf(seq, " %15lld", (long long)value);
+
+                if (index == 0)
+                        seq_printf(seq, " %15u", i);
+                else
+                        seq_printf(seq, " %15llu", (unsigned long long)lkstats->
+                                   lkstats[index - 1].stats[subindex]);
         }
         seq_putc(seq, '\n');
         return 0;
@@ -1804,20 +1750,24 @@ static int gfs2_sbstats_seq_show(struct seq_file *seq, void *iter_ptr)
 
 int __init gfs2_glock_init(void)
 {
-        unsigned i;
-        for(i = 0; i < GFS2_GL_HASH_SIZE; i++) {
-                INIT_HLIST_BL_HEAD(&gl_hash_table[i]);
-        }
+        int ret;
+
+        ret = rhashtable_init(&gl_hash_table, &ht_parms);
+        if (ret < 0)
+                return ret;
 
         glock_workqueue = alloc_workqueue("glock_workqueue", WQ_MEM_RECLAIM |
                                           WQ_HIGHPRI | WQ_FREEZABLE, 0);
-        if (!glock_workqueue)
+        if (!glock_workqueue) {
+                rhashtable_destroy(&gl_hash_table);
                 return -ENOMEM;
+        }
         gfs2_delete_workqueue = alloc_workqueue("delete_workqueue",
                                                 WQ_MEM_RECLAIM | WQ_FREEZABLE,
                                                 0);
         if (!gfs2_delete_workqueue) {
                 destroy_workqueue(glock_workqueue);
+                rhashtable_destroy(&gl_hash_table);
                 return -ENOMEM;
         }
 
@@ -1829,72 +1779,41 @@ int __init gfs2_glock_init(void)
 void gfs2_glock_exit(void)
 {
         unregister_shrinker(&glock_shrinker);
+        rhashtable_destroy(&gl_hash_table);
         destroy_workqueue(glock_workqueue);
         destroy_workqueue(gfs2_delete_workqueue);
 }
 
-static inline struct gfs2_glock *glock_hash_chain(unsigned hash)
+static void gfs2_glock_iter_next(struct gfs2_glock_iter *gi)
 {
-        return hlist_bl_entry(hlist_bl_first_rcu(&gl_hash_table[hash]),
-                              struct gfs2_glock, gl_list);
-}
-
-static inline struct gfs2_glock *glock_hash_next(struct gfs2_glock *gl)
-{
-        return hlist_bl_entry(rcu_dereference(gl->gl_list.next),
-                              struct gfs2_glock, gl_list);
-}
-
-static int gfs2_glock_iter_next(struct gfs2_glock_iter *gi)
-{
-        struct gfs2_glock *gl;
-
         do {
-                gl = gi->gl;
-                if (gl) {
-                        gi->gl = glock_hash_next(gl);
-                        gi->nhash++;
-                } else {
-                        if (gi->hash >= GFS2_GL_HASH_SIZE) {
-                                rcu_read_unlock();
-                                return 1;
-                        }
-                        gi->gl = glock_hash_chain(gi->hash);
-                        gi->nhash = 0;
-                }
-                while (gi->gl == NULL) {
-                        gi->hash++;
-                        if (gi->hash >= GFS2_GL_HASH_SIZE) {
-                                rcu_read_unlock();
-                                return 1;
-                        }
-                        gi->gl = glock_hash_chain(gi->hash);
-                        gi->nhash = 0;
+                gi->gl = rhashtable_walk_next(&gi->hti);
+                if (IS_ERR(gi->gl)) {
+                        if (PTR_ERR(gi->gl) == -EAGAIN)
+                                continue;
+                        gi->gl = NULL;
                 }
         /* Skip entries for other sb and dead entries */
-        } while (gi->sdp != gi->gl->gl_sbd ||
-                 __lockref_is_dead(&gi->gl->gl_lockref));
-
-        return 0;
+        } while ((gi->gl) && ((gi->sdp != gi->gl->gl_name.ln_sbd) ||
+                              __lockref_is_dead(&gi->gl->gl_lockref)));
 }
 
 static void *gfs2_glock_seq_start(struct seq_file *seq, loff_t *pos)
 {
         struct gfs2_glock_iter *gi = seq->private;
         loff_t n = *pos;
+        int ret;
 
         if (gi->last_pos <= *pos)
-                n = gi->nhash + (*pos - gi->last_pos);
-        else
-                gi->hash = 0;
+                n = (*pos - gi->last_pos);
 
-        gi->nhash = 0;
-        rcu_read_lock();
+        ret = rhashtable_walk_start(&gi->hti);
+        if (ret)
+                return NULL;
 
         do {
-                if (gfs2_glock_iter_next(gi))
-                        return NULL;
-        } while (n--);
+                gfs2_glock_iter_next(gi);
+        } while (gi->gl && n--);
 
         gi->last_pos = *pos;
         return gi->gl;
@@ -1907,9 +1826,7 @@ static void *gfs2_glock_seq_next(struct seq_file *seq, void *iter_ptr,
 
         (*pos)++;
         gi->last_pos = *pos;
-        if (gfs2_glock_iter_next(gi))
-                return NULL;
-
+        gfs2_glock_iter_next(gi);
         return gi->gl;
 }
 
@@ -1917,9 +1834,8 @@ static void gfs2_glock_seq_stop(struct seq_file *seq, void *iter_ptr)
 {
         struct gfs2_glock_iter *gi = seq->private;
 
-        if (gi->gl)
-                rcu_read_unlock();
         gi->gl = NULL;
+        rhashtable_walk_stop(&gi->hti);
 }
 
 static int gfs2_glock_seq_show(struct seq_file *seq, void *iter_ptr)
@@ -1930,26 +1846,19 @@ static int gfs2_glock_seq_show(struct seq_file *seq, void *iter_ptr)
 
 static void *gfs2_sbstats_seq_start(struct seq_file *seq, loff_t *pos)
 {
-        struct gfs2_glock_iter *gi = seq->private;
-
-        gi->hash = *pos;
+        preempt_disable();
         if (*pos >= GFS2_NR_SBSTATS)
                 return NULL;
-        preempt_disable();
-        return SEQ_START_TOKEN;
+        return pos;
 }
 
 static void *gfs2_sbstats_seq_next(struct seq_file *seq, void *iter_ptr,
                                    loff_t *pos)
 {
-        struct gfs2_glock_iter *gi = seq->private;
         (*pos)++;
-        gi->hash++;
-        if (gi->hash >= GFS2_NR_SBSTATS) {
-                preempt_enable();
+        if (*pos >= GFS2_NR_SBSTATS)
                 return NULL;
-        }
-        return SEQ_START_TOKEN;
+        return pos;
 }
 
 static void gfs2_sbstats_seq_stop(struct seq_file *seq, void *iter_ptr)
@@ -1987,14 +1896,28 @@ static int gfs2_glocks_open(struct inode *inode, struct file *file)
         if (ret == 0) {
                 struct seq_file *seq = file->private_data;
                 struct gfs2_glock_iter *gi = seq->private;
+
                 gi->sdp = inode->i_private;
+                gi->last_pos = 0;
                 seq->buf = kmalloc(GFS2_SEQ_GOODSIZE, GFP_KERNEL | __GFP_NOWARN);
                 if (seq->buf)
                         seq->size = GFS2_SEQ_GOODSIZE;
+                gi->gl = NULL;
+                ret = rhashtable_walk_init(&gl_hash_table, &gi->hti);
         }
         return ret;
 }
 
+static int gfs2_glocks_release(struct inode *inode, struct file *file)
+{
+        struct seq_file *seq = file->private_data;
+        struct gfs2_glock_iter *gi = seq->private;
+
+        gi->gl = NULL;
+        rhashtable_walk_exit(&gi->hti);
+        return seq_release_private(inode, file);
+}
+
 static int gfs2_glstats_open(struct inode *inode, struct file *file)
 {
         int ret = seq_open_private(file, &gfs2_glstats_seq_ops,
@@ -2003,21 +1926,22 @@ static int gfs2_glstats_open(struct inode *inode, struct file *file)
                 struct seq_file *seq = file->private_data;
                 struct gfs2_glock_iter *gi = seq->private;
                 gi->sdp = inode->i_private;
+                gi->last_pos = 0;
                 seq->buf = kmalloc(GFS2_SEQ_GOODSIZE, GFP_KERNEL | __GFP_NOWARN);
                 if (seq->buf)
                         seq->size = GFS2_SEQ_GOODSIZE;
+                gi->gl = NULL;
+                ret = rhashtable_walk_init(&gl_hash_table, &gi->hti);
         }
         return ret;
 }
 
 static int gfs2_sbstats_open(struct inode *inode, struct file *file)
 {
-        int ret = seq_open_private(file, &gfs2_sbstats_seq_ops,
-                                   sizeof(struct gfs2_glock_iter));
+        int ret = seq_open(file, &gfs2_sbstats_seq_ops);
         if (ret == 0) {
                 struct seq_file *seq = file->private_data;
-                struct gfs2_glock_iter *gi = seq->private;
-                gi->sdp = inode->i_private;
+                seq->private = inode->i_private;  /* sdp */
         }
         return ret;
 }
@@ -2027,7 +1951,7 @@ static const struct file_operations gfs2_glocks_fops = {
         .open    = gfs2_glocks_open,
         .read    = seq_read,
         .llseek  = seq_lseek,
-        .release = seq_release_private,
+        .release = gfs2_glocks_release,
 };
 
 static const struct file_operations gfs2_glstats_fops = {
@@ -2035,7 +1959,7 @@ static const struct file_operations gfs2_glstats_fops = {
         .open    = gfs2_glstats_open,
         .read    = seq_read,
         .llseek  = seq_lseek,
-        .release = seq_release_private,
+        .release = gfs2_glocks_release,
 };
 
 static const struct file_operations gfs2_sbstats_fops = {
@@ -2043,7 +1967,7 @@ static const struct file_operations gfs2_sbstats_fops = {
         .open    = gfs2_sbstats_open,
         .read    = seq_read,
         .llseek  = seq_lseek,
-        .release = seq_release_private,
+        .release = seq_release,
 };
 
 int gfs2_create_debugfs_file(struct gfs2_sbd *sdp)
diff --git a/fs/gfs2/glops.c b/fs/gfs2/glops.c
index fa3fa5e94553..1f6c9c3fe5cb 100644
--- a/fs/gfs2/glops.c
+++ b/fs/gfs2/glops.c
@@ -32,13 +32,15 @@ struct workqueue_struct *gfs2_freeze_wq;
 
 static void gfs2_ail_error(struct gfs2_glock *gl, const struct buffer_head *bh)
 {
-        fs_err(gl->gl_sbd, "AIL buffer %p: blocknr %llu state 0x%08lx mapping %p page state 0x%lx\n",
+        fs_err(gl->gl_name.ln_sbd,
+               "AIL buffer %p: blocknr %llu state 0x%08lx mapping %p page "
+               "state 0x%lx\n",
                bh, (unsigned long long)bh->b_blocknr, bh->b_state,
                bh->b_page->mapping, bh->b_page->flags);
-        fs_err(gl->gl_sbd, "AIL glock %u:%llu mapping %p\n",
+        fs_err(gl->gl_name.ln_sbd, "AIL glock %u:%llu mapping %p\n",
                gl->gl_name.ln_type, gl->gl_name.ln_number,
                gfs2_glock2aspace(gl));
-        gfs2_lm_withdraw(gl->gl_sbd, "AIL error\n");
+        gfs2_lm_withdraw(gl->gl_name.ln_sbd, "AIL error\n");
 }
 
 /**
@@ -52,7 +54,7 @@ static void gfs2_ail_error(struct gfs2_glock *gl, const struct buffer_head *bh)
 static void __gfs2_ail_flush(struct gfs2_glock *gl, bool fsync,
                              unsigned int nr_revokes)
 {
-        struct gfs2_sbd *sdp = gl->gl_sbd;
+        struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
         struct list_head *head = &gl->gl_ail_list;
         struct gfs2_bufdata *bd, *tmp;
         struct buffer_head *bh;
@@ -80,7 +82,7 @@ static void __gfs2_ail_flush(struct gfs2_glock *gl, bool fsync,
 
 static void gfs2_ail_empty_gl(struct gfs2_glock *gl)
 {
-        struct gfs2_sbd *sdp = gl->gl_sbd;
+        struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
         struct gfs2_trans tr;
 
         memset(&tr, 0, sizeof(tr));
@@ -109,7 +111,7 @@ static void gfs2_ail_empty_gl(struct gfs2_glock *gl)
 
 void gfs2_ail_flush(struct gfs2_glock *gl, bool fsync)
 {
-        struct gfs2_sbd *sdp = gl->gl_sbd;
+        struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
         unsigned int revokes = atomic_read(&gl->gl_ail_count);
         unsigned int max_revokes = (sdp->sd_sb.sb_bsize - sizeof(struct gfs2_log_descriptor)) / sizeof(u64);
         int ret;
@@ -139,7 +141,7 @@ void gfs2_ail_flush(struct gfs2_glock *gl, bool fsync)
 
 static void rgrp_go_sync(struct gfs2_glock *gl)
 {
-        struct gfs2_sbd *sdp = gl->gl_sbd;
+        struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
         struct address_space *mapping = &sdp->sd_aspace;
         struct gfs2_rgrpd *rgd;
         int error;
@@ -179,7 +181,7 @@ static void rgrp_go_sync(struct gfs2_glock *gl)
 
 static void rgrp_go_inval(struct gfs2_glock *gl, int flags)
 {
-        struct gfs2_sbd *sdp = gl->gl_sbd;
+        struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
         struct address_space *mapping = &sdp->sd_aspace;
         struct gfs2_rgrpd *rgd = gl->gl_object;
 
@@ -218,7 +220,7 @@ static void inode_go_sync(struct gfs2_glock *gl)
 
         GLOCK_BUG_ON(gl, gl->gl_state != LM_ST_EXCLUSIVE);
 
-        gfs2_log_flush(gl->gl_sbd, gl, NORMAL_FLUSH);
+        gfs2_log_flush(gl->gl_name.ln_sbd, gl, NORMAL_FLUSH);
         filemap_fdatawrite(metamapping);
         if (ip) {
                 struct address_space *mapping = ip->i_inode.i_mapping;
@@ -252,7 +254,7 @@ static void inode_go_inval(struct gfs2_glock *gl, int flags)
 {
         struct gfs2_inode *ip = gl->gl_object;
 
-        gfs2_assert_withdraw(gl->gl_sbd, !atomic_read(&gl->gl_ail_count));
+        gfs2_assert_withdraw(gl->gl_name.ln_sbd, !atomic_read(&gl->gl_ail_count));
 
         if (flags & DIO_METADATA) {
                 struct address_space *mapping = gfs2_glock2aspace(gl);
@@ -264,9 +266,9 @@ static void inode_go_inval(struct gfs2_glock *gl, int flags)
                 }
         }
 
-        if (ip == GFS2_I(gl->gl_sbd->sd_rindex)) {
-                gfs2_log_flush(gl->gl_sbd, NULL, NORMAL_FLUSH);
-                gl->gl_sbd->sd_rindex_uptodate = 0;
+        if (ip == GFS2_I(gl->gl_name.ln_sbd->sd_rindex)) {
+                gfs2_log_flush(gl->gl_name.ln_sbd, NULL, NORMAL_FLUSH);
+                gl->gl_name.ln_sbd->sd_rindex_uptodate = 0;
         }
         if (ip && S_ISREG(ip->i_inode.i_mode))
                 truncate_inode_pages(ip->i_inode.i_mapping, 0);
@@ -281,7 +283,7 @@ static void inode_go_inval(struct gfs2_glock *gl, int flags)
 
 static int inode_go_demote_ok(const struct gfs2_glock *gl)
 {
-        struct gfs2_sbd *sdp = gl->gl_sbd;
+        struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
         struct gfs2_holder *gh;
 
         if (sdp->sd_jindex == gl->gl_object || sdp->sd_rindex == gl->gl_object)
@@ -416,7 +418,7 @@ int gfs2_inode_refresh(struct gfs2_inode *ip)
 static int inode_go_lock(struct gfs2_holder *gh)
 {
         struct gfs2_glock *gl = gh->gh_gl;
-        struct gfs2_sbd *sdp = gl->gl_sbd;
+        struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
         struct gfs2_inode *ip = gl->gl_object;
         int error = 0;
 
@@ -477,7 +479,7 @@ static void inode_go_dump(struct seq_file *seq, const struct gfs2_glock *gl)
 static void freeze_go_sync(struct gfs2_glock *gl)
 {
         int error = 0;
-        struct gfs2_sbd *sdp = gl->gl_sbd;
+        struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
 
         if (gl->gl_state == LM_ST_SHARED &&
             test_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags)) {
@@ -500,7 +502,7 @@ static void freeze_go_sync(struct gfs2_glock *gl)
 
 static int freeze_go_xmote_bh(struct gfs2_glock *gl, struct gfs2_holder *gh)
 {
-        struct gfs2_sbd *sdp = gl->gl_sbd;
+        struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
         struct gfs2_inode *ip = GFS2_I(sdp->sd_jdesc->jd_inode);
         struct gfs2_glock *j_gl = ip->i_gl;
         struct gfs2_log_header_host head;
@@ -545,7 +547,7 @@ static int freeze_go_demote_ok(const struct gfs2_glock *gl)
 static void iopen_go_callback(struct gfs2_glock *gl, bool remote)
 {
         struct gfs2_inode *ip = (struct gfs2_inode *)gl->gl_object;
-        struct gfs2_sbd *sdp = gl->gl_sbd;
+        struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
 
         if (!remote || (sdp->sd_vfs->s_flags & MS_RDONLY))
                 return;
diff --git a/fs/gfs2/incore.h b/fs/gfs2/incore.h
index a1ec7c20e498..121ed08d9d9f 100644
--- a/fs/gfs2/incore.h
+++ b/fs/gfs2/incore.h
@@ -22,6 +22,7 @@
 #include <linux/ktime.h>
 #include <linux/percpu.h>
 #include <linux/lockref.h>
+#include <linux/rhashtable.h>
 
 #define DIO_WAIT        0x00000010
 #define DIO_METADATA    0x00000020
@@ -203,13 +204,15 @@ enum {
 };
 
 struct lm_lockname {
+        struct gfs2_sbd *ln_sbd;
         u64 ln_number;
         unsigned int ln_type;
 };
 
 #define lm_name_equal(name1, name2) \
-        (((name1)->ln_number == (name2)->ln_number) && \
-         ((name1)->ln_type == (name2)->ln_type))
+        (((name1)->ln_number == (name2)->ln_number) &&  \
+         ((name1)->ln_type == (name2)->ln_type) &&      \
+         ((name1)->ln_sbd == (name2)->ln_sbd))
 
 
 struct gfs2_glock_operations {
@@ -241,7 +244,7 @@ enum {
 };
 
 struct gfs2_lkstats {
-        s64 stats[GFS2_NR_LKSTATS];
+        u64 stats[GFS2_NR_LKSTATS];
 };
 
 enum {
@@ -327,7 +330,6 @@ enum {
 
 struct gfs2_glock {
         struct hlist_bl_node gl_list;
-        struct gfs2_sbd *gl_sbd;
         unsigned long gl_flags;         /* GLF_... */
         struct lm_lockname gl_name;
 
@@ -341,7 +343,6 @@ struct gfs2_glock {
                      gl_req:2,          /* State in last dlm request */
                      gl_reply:8;        /* Last reply from the dlm */
 
-        unsigned int gl_hash;
         unsigned long gl_demote_time; /* time of first demote request */
         long gl_hold_time;
         struct list_head gl_holders;
@@ -367,7 +368,7 @@ struct gfs2_glock {
                         loff_t end;
                 } gl_vm;
         };
-        struct rcu_head gl_rcu;
+        struct rhash_head gl_node;
 };
 
 #define GFS2_MIN_LVB_SIZE 32    /* Min size of LVB that gfs2 supports */
@@ -835,7 +836,7 @@ static inline void gfs2_glstats_inc(struct gfs2_glock *gl, int which)
 
 static inline void gfs2_sbstats_inc(const struct gfs2_glock *gl, int which)
 {
-        const struct gfs2_sbd *sdp = gl->gl_sbd;
+        const struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
         preempt_disable();
         this_cpu_ptr(sdp->sd_lkstats)->lkstats[gl->gl_name.ln_type].stats[which]++;
         preempt_enable();
diff --git a/fs/gfs2/lock_dlm.c b/fs/gfs2/lock_dlm.c
index 641383a9c1bb..284c1542783e 100644
--- a/fs/gfs2/lock_dlm.c
+++ b/fs/gfs2/lock_dlm.c
@@ -31,7 +31,7 @@ extern struct workqueue_struct *gfs2_control_wq;
  *
  * @delta is the difference between the current rtt sample and the
  * running average srtt. We add 1/8 of that to the srtt in order to
- * update the current srtt estimate. The varience estimate is a bit
+ * update the current srtt estimate. The variance estimate is a bit
  * more complicated. We subtract the abs value of the @delta from
  * the current variance estimate and add 1/4 of that to the running
  * total.
@@ -80,7 +80,7 @@ static inline void gfs2_update_reply_times(struct gfs2_glock *gl)
 
         preempt_disable();
         rtt = ktime_to_ns(ktime_sub(ktime_get_real(), gl->gl_dstamp));
-        lks = this_cpu_ptr(gl->gl_sbd->sd_lkstats);
+        lks = this_cpu_ptr(gl->gl_name.ln_sbd->sd_lkstats);
         gfs2_update_stats(&gl->gl_stats, index, rtt);           /* Local */
         gfs2_update_stats(&lks->lkstats[gltype], index, rtt);   /* Global */
         preempt_enable();
@@ -108,7 +108,7 @@ static inline void gfs2_update_request_times(struct gfs2_glock *gl)
         dstamp = gl->gl_dstamp;
         gl->gl_dstamp = ktime_get_real();
         irt = ktime_to_ns(ktime_sub(gl->gl_dstamp, dstamp));
-        lks = this_cpu_ptr(gl->gl_sbd->sd_lkstats);
+        lks = this_cpu_ptr(gl->gl_name.ln_sbd->sd_lkstats);
         gfs2_update_stats(&gl->gl_stats, GFS2_LKS_SIRT, irt);           /* Local */
         gfs2_update_stats(&lks->lkstats[gltype], GFS2_LKS_SIRT, irt);   /* Global */
         preempt_enable();
@@ -253,7 +253,7 @@ static void gfs2_reverse_hex(char *c, u64 value)
 static int gdlm_lock(struct gfs2_glock *gl, unsigned int req_state,
                      unsigned int flags)
 {
-        struct lm_lockstruct *ls = &gl->gl_sbd->sd_lockstruct;
+        struct lm_lockstruct *ls = &gl->gl_name.ln_sbd->sd_lockstruct;
         int req;
         u32 lkf;
         char strname[GDLM_STRNAME_BYTES] = "";
@@ -281,7 +281,7 @@ static int gdlm_lock(struct gfs2_glock *gl, unsigned int req_state,
 
 static void gdlm_put_lock(struct gfs2_glock *gl)
 {
-        struct gfs2_sbd *sdp = gl->gl_sbd;
+        struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
         struct lm_lockstruct *ls = &sdp->sd_lockstruct;
         int lvb_needs_unlock = 0;
         int error;
@@ -319,7 +319,7 @@ static void gdlm_put_lock(struct gfs2_glock *gl)
 
 static void gdlm_cancel(struct gfs2_glock *gl)
 {
-        struct lm_lockstruct *ls = &gl->gl_sbd->sd_lockstruct;
+        struct lm_lockstruct *ls = &gl->gl_name.ln_sbd->sd_lockstruct;
         dlm_unlock(ls->ls_dlm, gl->gl_lksb.sb_lkid, DLM_LKF_CANCEL, NULL, gl);
 }
 
diff --git a/fs/gfs2/lops.c b/fs/gfs2/lops.c
index 92324ac58290..d5369a109781 100644
--- a/fs/gfs2/lops.c
+++ b/fs/gfs2/lops.c
@@ -70,7 +70,7 @@ static bool buffer_is_rgrp(const struct gfs2_bufdata *bd)
 static void maybe_release_space(struct gfs2_bufdata *bd)
 {
         struct gfs2_glock *gl = bd->bd_gl;
-        struct gfs2_sbd *sdp = gl->gl_sbd;
+        struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
         struct gfs2_rgrpd *rgd = gl->gl_object;
         unsigned int index = bd->bd_bh->b_blocknr - gl->gl_name.ln_number;
         struct gfs2_bitmap *bi = rgd->rd_bits + index;
@@ -578,7 +578,7 @@ static int buf_lo_scan_elements(struct gfs2_jdesc *jd, unsigned int start,
 static void gfs2_meta_sync(struct gfs2_glock *gl)
 {
         struct address_space *mapping = gfs2_glock2aspace(gl);
-        struct gfs2_sbd *sdp = gl->gl_sbd;
+        struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
         int error;
 
         if (mapping == NULL)
@@ -588,7 +588,7 @@ static void gfs2_meta_sync(struct gfs2_glock *gl)
         error = filemap_fdatawait(mapping);
 
         if (error)
-                gfs2_io_error(gl->gl_sbd);
+                gfs2_io_error(gl->gl_name.ln_sbd);
 }
 
 static void buf_lo_after_scan(struct gfs2_jdesc *jd, int error, int pass)
diff --git a/fs/gfs2/meta_io.c b/fs/gfs2/meta_io.c
index b984a6e190bc..0e1d4be5865a 100644
--- a/fs/gfs2/meta_io.c
+++ b/fs/gfs2/meta_io.c
@@ -114,7 +114,7 @@ const struct address_space_operations gfs2_rgrp_aops = {
 struct buffer_head *gfs2_getbuf(struct gfs2_glock *gl, u64 blkno, int create)
 {
         struct address_space *mapping = gfs2_glock2aspace(gl);
-        struct gfs2_sbd *sdp = gl->gl_sbd;
+        struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
         struct page *page;
         struct buffer_head *bh;
         unsigned int shift;
@@ -200,7 +200,7 @@ struct buffer_head *gfs2_meta_new(struct gfs2_glock *gl, u64 blkno)
 int gfs2_meta_read(struct gfs2_glock *gl, u64 blkno, int flags,
                    struct buffer_head **bhp)
 {
-        struct gfs2_sbd *sdp = gl->gl_sbd;
+        struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
         struct buffer_head *bh;
 
         if (unlikely(test_bit(SDF_SHUTDOWN, &sdp->sd_flags))) {
@@ -362,7 +362,7 @@ int gfs2_meta_indirect_buffer(struct gfs2_inode *ip, int height, u64 num,
 
 struct buffer_head *gfs2_meta_ra(struct gfs2_glock *gl, u64 dblock, u32 extlen)
 {
-        struct gfs2_sbd *sdp = gl->gl_sbd;
+        struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
         struct buffer_head *first_bh, *bh;
         u32 max_ra = gfs2_tune_get(sdp, gt_max_readahead) >>
                           sdp->sd_sb.sb_bsize_shift;
diff --git a/fs/gfs2/meta_io.h b/fs/gfs2/meta_io.h
index ac5d8027d335..8ca161567a93 100644
--- a/fs/gfs2/meta_io.h
+++ b/fs/gfs2/meta_io.h
@@ -44,7 +44,7 @@ static inline struct gfs2_sbd *gfs2_mapping2sbd(struct address_space *mapping)
 {
         struct inode *inode = mapping->host;
         if (mapping->a_ops == &gfs2_meta_aops)
-                return (((struct gfs2_glock *)mapping) - 1)->gl_sbd;
+                return (((struct gfs2_glock *)mapping) - 1)->gl_name.ln_sbd;
         else if (mapping->a_ops == &gfs2_rgrp_aops)
                 return container_of(mapping, struct gfs2_sbd, sd_aspace);
         else
diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c
index 9b61f92fcfdf..3a31226531ea 100644
--- a/fs/gfs2/quota.c
+++ b/fs/gfs2/quota.c
@@ -119,7 +119,7 @@ static void gfs2_qd_dispose(struct list_head *list)
 
         while (!list_empty(list)) {
                 qd = list_entry(list->next, struct gfs2_quota_data, qd_lru);
-                sdp = qd->qd_gl->gl_sbd;
+                sdp = qd->qd_gl->gl_name.ln_sbd;
 
                 list_del(&qd->qd_lru);
 
@@ -302,7 +302,7 @@ static int qd_get(struct gfs2_sbd *sdp, struct kqid qid,
 
 static void qd_hold(struct gfs2_quota_data *qd)
 {
-        struct gfs2_sbd *sdp = qd->qd_gl->gl_sbd;
+        struct gfs2_sbd *sdp = qd->qd_gl->gl_name.ln_sbd;
         gfs2_assert(sdp, !__lockref_is_dead(&qd->qd_lockref));
         lockref_get(&qd->qd_lockref);
 }
@@ -367,7 +367,7 @@ static void slot_put(struct gfs2_quota_data *qd)
 
 static int bh_get(struct gfs2_quota_data *qd)
 {
-        struct gfs2_sbd *sdp = qd->qd_gl->gl_sbd;
+        struct gfs2_sbd *sdp = qd->qd_gl->gl_name.ln_sbd;
         struct gfs2_inode *ip = GFS2_I(sdp->sd_qc_inode);
         unsigned int block, offset;
         struct buffer_head *bh;
@@ -414,7 +414,7 @@ fail:
 
 static void bh_put(struct gfs2_quota_data *qd)
 {
-        struct gfs2_sbd *sdp = qd->qd_gl->gl_sbd;
+        struct gfs2_sbd *sdp = qd->qd_gl->gl_name.ln_sbd;
 
         mutex_lock(&sdp->sd_quota_mutex);
         gfs2_assert(sdp, qd->qd_bh_count);
@@ -486,7 +486,7 @@ static int qd_fish(struct gfs2_sbd *sdp, struct gfs2_quota_data **qdp)
 
 static void qd_unlock(struct gfs2_quota_data *qd)
 {
-        gfs2_assert_warn(qd->qd_gl->gl_sbd,
+        gfs2_assert_warn(qd->qd_gl->gl_name.ln_sbd,
                          test_bit(QDF_LOCKED, &qd->qd_flags));
         clear_bit(QDF_LOCKED, &qd->qd_flags);
         bh_put(qd);
@@ -614,7 +614,7 @@ static int sort_qd(const void *a, const void *b)
 
 static void do_qc(struct gfs2_quota_data *qd, s64 change)
 {
-        struct gfs2_sbd *sdp = qd->qd_gl->gl_sbd;
+        struct gfs2_sbd *sdp = qd->qd_gl->gl_name.ln_sbd;
         struct gfs2_inode *ip = GFS2_I(sdp->sd_qc_inode);
         struct gfs2_quota_change *qc = qd->qd_bh_qc;
         s64 x;
@@ -831,7 +831,7 @@ static int gfs2_adjust_quota(struct gfs2_inode *ip, loff_t loc,
 
 static int do_sync(unsigned int num_qd, struct gfs2_quota_data **qda)
 {
-        struct gfs2_sbd *sdp = (*qda)->qd_gl->gl_sbd;
+        struct gfs2_sbd *sdp = (*qda)->qd_gl->gl_name.ln_sbd;
         struct gfs2_inode *ip = GFS2_I(sdp->sd_quota_inode);
         struct gfs2_alloc_parms ap = { .aflags = 0, };
         unsigned int data_blocks, ind_blocks;
@@ -922,7 +922,7 @@ out:
                 gfs2_glock_dq_uninit(&ghs[qx]);
         mutex_unlock(&ip->i_inode.i_mutex);
         kfree(ghs);
-        gfs2_log_flush(ip->i_gl->gl_sbd, ip->i_gl, NORMAL_FLUSH);
+        gfs2_log_flush(ip->i_gl->gl_name.ln_sbd, ip->i_gl, NORMAL_FLUSH);
         return error;
 }
 
@@ -954,7 +954,7 @@ static int update_qd(struct gfs2_sbd *sdp, struct gfs2_quota_data *qd)
 static int do_glock(struct gfs2_quota_data *qd, int force_refresh,
                     struct gfs2_holder *q_gh)
 {
-        struct gfs2_sbd *sdp = qd->qd_gl->gl_sbd;
+        struct gfs2_sbd *sdp = qd->qd_gl->gl_name.ln_sbd;
         struct gfs2_inode *ip = GFS2_I(sdp->sd_quota_inode);
         struct gfs2_holder i_gh;
         int error;
@@ -1037,7 +1037,7 @@ int gfs2_quota_lock(struct gfs2_inode *ip, kuid_t uid, kgid_t gid)
 
 static int need_sync(struct gfs2_quota_data *qd)
 {
-        struct gfs2_sbd *sdp = qd->qd_gl->gl_sbd;
+        struct gfs2_sbd *sdp = qd->qd_gl->gl_name.ln_sbd;
         struct gfs2_tune *gt = &sdp->sd_tune;
         s64 value;
         unsigned int num, den;
@@ -1125,7 +1125,7 @@ out:
 
 static int print_message(struct gfs2_quota_data *qd, char *type)
 {
-        struct gfs2_sbd *sdp = qd->qd_gl->gl_sbd;
+        struct gfs2_sbd *sdp = qd->qd_gl->gl_name.ln_sbd;
 
         fs_info(sdp, "quota %s for %s %u\n",
                 type,
diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index c6c62321dfd6..475985d14758 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -1860,13 +1860,13 @@ static void try_rgrp_unlink(struct gfs2_rgrpd *rgd, u64 *last_unlinked, u64 skip
 static bool gfs2_rgrp_congested(const struct gfs2_rgrpd *rgd, int loops)
 {
         const struct gfs2_glock *gl = rgd->rd_gl;
-        const struct gfs2_sbd *sdp = gl->gl_sbd;
+        const struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
         struct gfs2_lkstats *st;
-        s64 r_dcount, l_dcount;
-        s64 l_srttb, a_srttb = 0;
+        u64 r_dcount, l_dcount;
+        u64 l_srttb, a_srttb = 0;
         s64 srttb_diff;
-        s64 sqr_diff;
-        s64 var;
+        u64 sqr_diff;
+        u64 var;
         int cpu, nonzero = 0;
 
         preempt_disable();
diff --git a/fs/gfs2/trace_gfs2.h b/fs/gfs2/trace_gfs2.h
index 20c007d747ab..49ac55da4e33 100644
--- a/fs/gfs2/trace_gfs2.h
+++ b/fs/gfs2/trace_gfs2.h
@@ -104,7 +104,7 @@ TRACE_EVENT(gfs2_glock_state_change,
         ),
 
         TP_fast_assign(
-                __entry->dev            = gl->gl_sbd->sd_vfs->s_dev;
+                __entry->dev            = gl->gl_name.ln_sbd->sd_vfs->s_dev;
                 __entry->glnum          = gl->gl_name.ln_number;
                 __entry->gltype         = gl->gl_name.ln_type;
                 __entry->cur_state      = glock_trace_state(gl->gl_state);
@@ -140,7 +140,7 @@ TRACE_EVENT(gfs2_glock_put,
         ),
 
         TP_fast_assign(
-                __entry->dev            = gl->gl_sbd->sd_vfs->s_dev;
+                __entry->dev            = gl->gl_name.ln_sbd->sd_vfs->s_dev;
                 __entry->gltype         = gl->gl_name.ln_type;
                 __entry->glnum          = gl->gl_name.ln_number;
                 __entry->cur_state      = glock_trace_state(gl->gl_state);
@@ -174,7 +174,7 @@ TRACE_EVENT(gfs2_demote_rq,
         ),
 
         TP_fast_assign(
-                __entry->dev            = gl->gl_sbd->sd_vfs->s_dev;
+                __entry->dev            = gl->gl_name.ln_sbd->sd_vfs->s_dev;
                 __entry->gltype         = gl->gl_name.ln_type;
                 __entry->glnum          = gl->gl_name.ln_number;
                 __entry->cur_state      = glock_trace_state(gl->gl_state);
@@ -209,7 +209,7 @@ TRACE_EVENT(gfs2_promote,
         ),
 
         TP_fast_assign(
-                __entry->dev    = gh->gh_gl->gl_sbd->sd_vfs->s_dev;
+                __entry->dev    = gh->gh_gl->gl_name.ln_sbd->sd_vfs->s_dev;
                 __entry->glnum  = gh->gh_gl->gl_name.ln_number;
                 __entry->gltype = gh->gh_gl->gl_name.ln_type;
                 __entry->first  = first;
@@ -239,7 +239,7 @@ TRACE_EVENT(gfs2_glock_queue,
         ),
 
         TP_fast_assign(
-                __entry->dev    = gh->gh_gl->gl_sbd->sd_vfs->s_dev;
+                __entry->dev    = gh->gh_gl->gl_name.ln_sbd->sd_vfs->s_dev;
                 __entry->glnum  = gh->gh_gl->gl_name.ln_number;
                 __entry->gltype = gh->gh_gl->gl_name.ln_type;
                 __entry->queue  = queue;
@@ -267,18 +267,18 @@ TRACE_EVENT(gfs2_glock_lock_time,
                 __field(        int,    status          )
                 __field(        char,   flags           )
                 __field(        s64,    tdiff           )
-                __field(        s64,    srtt            )
-                __field(        s64,    srttvar         )
-                __field(        s64,    srttb           )
-                __field(        s64,    srttvarb        )
-                __field(        s64,    sirt            )
-                __field(        s64,    sirtvar         )
-                __field(        s64,    dcount          )
-                __field(        s64,    qcount          )
+                __field(        u64,    srtt            )
+                __field(        u64,    srttvar         )
+                __field(        u64,    srttb           )
+                __field(        u64,    srttvarb        )
+                __field(        u64,    sirt            )
+                __field(        u64,    sirtvar         )
+                __field(        u64,    dcount          )
+                __field(        u64,    qcount          )
         ),
 
         TP_fast_assign(
-                __entry->dev            = gl->gl_sbd->sd_vfs->s_dev;
+                __entry->dev            = gl->gl_name.ln_sbd->sd_vfs->s_dev;
                 __entry->glnum          = gl->gl_name.ln_number;
                 __entry->gltype         = gl->gl_name.ln_type;
                 __entry->status         = gl->gl_lksb.sb_status;
@@ -333,7 +333,7 @@ TRACE_EVENT(gfs2_pin,
         ),
 
         TP_fast_assign(
-                __entry->dev            = bd->bd_gl->gl_sbd->sd_vfs->s_dev;
+                __entry->dev            = bd->bd_gl->gl_name.ln_sbd->sd_vfs->s_dev;
                 __entry->pin            = pin;
                 __entry->len            = bd->bd_bh->b_size;
                 __entry->block          = bd->bd_bh->b_blocknr;
@@ -449,7 +449,7 @@ TRACE_EVENT(gfs2_bmap,
         ),
 
         TP_fast_assign(
-                __entry->dev            = ip->i_gl->gl_sbd->sd_vfs->s_dev;
+                __entry->dev            = ip->i_gl->gl_name.ln_sbd->sd_vfs->s_dev;
                 __entry->lblock         = lblock;
                 __entry->pblock         = buffer_mapped(bh) ?  bh->b_blocknr : 0;
                 __entry->inum           = ip->i_no_addr;
@@ -489,7 +489,7 @@ TRACE_EVENT(gfs2_block_alloc,
         ),
 
         TP_fast_assign(
-                __entry->dev            = rgd->rd_gl->gl_sbd->sd_vfs->s_dev;
+                __entry->dev            = rgd->rd_gl->gl_name.ln_sbd->sd_vfs->s_dev;
                 __entry->start          = block;
                 __entry->inum           = ip->i_no_addr;
                 __entry->len            = len;
diff --git a/fs/gfs2/trans.c b/fs/gfs2/trans.c
index 88bff2430669..b95d0d625f32 100644
--- a/fs/gfs2/trans.c
+++ b/fs/gfs2/trans.c
@@ -158,7 +158,7 @@ static struct gfs2_bufdata *gfs2_alloc_bufdata(struct gfs2_glock *gl,
 void gfs2_trans_add_data(struct gfs2_glock *gl, struct buffer_head *bh)
 {
         struct gfs2_trans *tr = current->journal_info;
-        struct gfs2_sbd *sdp = gl->gl_sbd;
+        struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
         struct address_space *mapping = bh->b_page->mapping;
         struct gfs2_inode *ip = GFS2_I(mapping->host);
         struct gfs2_bufdata *bd;
@@ -224,7 +224,7 @@ static void meta_lo_add(struct gfs2_sbd *sdp, struct gfs2_bufdata *bd)
 void gfs2_trans_add_meta(struct gfs2_glock *gl, struct buffer_head *bh)
 {
 
-        struct gfs2_sbd *sdp = gl->gl_sbd;
+        struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
         struct gfs2_bufdata *bd;
 
         lock_buffer(bh);
diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
index 2714ef835bdd..be806ead7f4d 100644
--- a/fs/nfs/delegation.c
+++ b/fs/nfs/delegation.c
@@ -113,7 +113,8 @@ out:
         return status;
 }
 
-static int nfs_delegation_claim_opens(struct inode *inode, const nfs4_stateid *stateid)
+static int nfs_delegation_claim_opens(struct inode *inode,
+                const nfs4_stateid *stateid, fmode_t type)
 {
         struct nfs_inode *nfsi = NFS_I(inode);
         struct nfs_open_context *ctx;
@@ -140,7 +141,7 @@ again:
                 /* Block nfs4_proc_unlck */
                 mutex_lock(&sp->so_delegreturn_mutex);
                 seq = raw_seqcount_begin(&sp->so_reclaim_seqcount);
-                err = nfs4_open_delegation_recall(ctx, state, stateid);
+                err = nfs4_open_delegation_recall(ctx, state, stateid, type);
                 if (!err)
                         err = nfs_delegation_claim_locks(ctx, state, stateid);
                 if (!err && read_seqcount_retry(&sp->so_reclaim_seqcount, seq))
@@ -411,7 +412,8 @@ static int nfs_end_delegation_return(struct inode *inode, struct nfs_delegation
         do {
                 if (test_bit(NFS_DELEGATION_REVOKED, &delegation->flags))
                         break;
-                err = nfs_delegation_claim_opens(inode, &delegation->stateid);
+                err = nfs_delegation_claim_opens(inode, &delegation->stateid,
+                                delegation->type);
                 if (!issync || err != -EAGAIN)
                         break;
                 /*
diff --git a/fs/nfs/delegation.h b/fs/nfs/delegation.h
index a44829173e57..333063e032f0 100644
--- a/fs/nfs/delegation.h
+++ b/fs/nfs/delegation.h
@@ -54,7 +54,7 @@ void nfs_delegation_reap_unclaimed(struct nfs_client *clp);
 
 /* NFSv4 delegation-related procedures */
 int nfs4_proc_delegreturn(struct inode *inode, struct rpc_cred *cred, const nfs4_stateid *stateid, int issync);
-int nfs4_open_delegation_recall(struct nfs_open_context *ctx, struct nfs4_state *state, const nfs4_stateid *stateid);
+int nfs4_open_delegation_recall(struct nfs_open_context *ctx, struct nfs4_state *state, const nfs4_stateid *stateid, fmode_t type);
 int nfs4_lock_delegation_recall(struct file_lock *fl, struct nfs4_state *state, const nfs4_stateid *stateid);
 bool nfs4_copy_delegation_stateid(nfs4_stateid *dst, struct inode *inode, fmode_t flags);
 
diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index 38678d9a5cc4..4b1d08f56aba 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -166,8 +166,11 @@ nfs_direct_select_verf(struct nfs_direct_req *dreq,
         struct nfs_writeverf *verfp = &dreq->verf;
 
 #ifdef CONFIG_NFS_V4_1
-        if (ds_clp) {
-                /* pNFS is in use, use the DS verf */
+        /*
+         * pNFS is in use, use the DS verf except commit_through_mds is set
+         * for layout segment where nbuckets is zero.
+         */
+        if (ds_clp && dreq->ds_cinfo.nbuckets > 0) {
                 if (commit_idx >= 0 && commit_idx < dreq->ds_cinfo.nbuckets)
                         verfp = &dreq->ds_cinfo.buckets[commit_idx].direct_verf;
                 else
diff --git a/fs/nfs/filelayout/filelayout.c b/fs/nfs/filelayout/filelayout.c
index b34f2e228601..02ec07973bc4 100644
--- a/fs/nfs/filelayout/filelayout.c
+++ b/fs/nfs/filelayout/filelayout.c
@@ -629,23 +629,18 @@ out_put:
         goto out;
 }
 
-static void filelayout_free_fh_array(struct nfs4_filelayout_segment *fl)
+static void _filelayout_free_lseg(struct nfs4_filelayout_segment *fl)
 {
         int i;
 
-        for (i = 0; i < fl->num_fh; i++) {
-                if (!fl->fh_array[i])
-                        break;
-                kfree(fl->fh_array[i]);
+        if (fl->fh_array) {
+                for (i = 0; i < fl->num_fh; i++) {
+                        if (!fl->fh_array[i])
+                                break;
+                        kfree(fl->fh_array[i]);
+                }
+                kfree(fl->fh_array);
         }
-        kfree(fl->fh_array);
-        fl->fh_array = NULL;
-}
-
-static void
-_filelayout_free_lseg(struct nfs4_filelayout_segment *fl)
-{
-        filelayout_free_fh_array(fl);
         kfree(fl);
 }
 
@@ -716,21 +711,21 @@ filelayout_decode_layout(struct pnfs_layout_hdr *flo,
                 /* Do we want to use a mempool here? */
                 fl->fh_array[i] = kmalloc(sizeof(struct nfs_fh), gfp_flags);
                 if (!fl->fh_array[i])
-                        goto out_err_free;
+                        goto out_err;
 
                 p = xdr_inline_decode(&stream, 4);
                 if (unlikely(!p))
-                        goto out_err_free;
+                        goto out_err;
                 fl->fh_array[i]->size = be32_to_cpup(p++);
                 if (sizeof(struct nfs_fh) < fl->fh_array[i]->size) {
                         printk(KERN_ERR "NFS: Too big fh %d received %d\n",
                                i, fl->fh_array[i]->size);
-                        goto out_err_free;
+                        goto out_err;
                 }
 
                 p = xdr_inline_decode(&stream, fl->fh_array[i]->size);
                 if (unlikely(!p))
-                        goto out_err_free;
+                        goto out_err;
                 memcpy(fl->fh_array[i]->data, p, fl->fh_array[i]->size);
                 dprintk("DEBUG: %s: fh len %d\n", __func__,
                         fl->fh_array[i]->size);
@@ -739,8 +734,6 @@ filelayout_decode_layout(struct pnfs_layout_hdr *flo,
         __free_page(scratch);
         return 0;
 
-out_err_free:
-        filelayout_free_fh_array(fl);
 out_err:
         __free_page(scratch);
         return -EIO;
diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c
index d731bbf974aa..0f020e4d8421 100644
--- a/fs/nfs/nfs42proc.c
+++ b/fs/nfs/nfs42proc.c
@@ -175,10 +175,12 @@ loff_t nfs42_proc_llseek(struct file *filep, loff_t offset, int whence)
 {
         struct nfs_server *server = NFS_SERVER(file_inode(filep));
         struct nfs4_exception exception = { };
-        int err;
+        loff_t err;
 
         do {
                 err = _nfs42_proc_llseek(filep, offset, whence);
+                if (err >= 0)
+                        break;
                 if (err == -ENOTSUPP)
                         return -EOPNOTSUPP;
                 err = nfs4_handle_exception(server, err, &exception);
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 693b903b48bd..f93b9cdb4934 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -1127,6 +1127,21 @@ static int nfs4_wait_for_completion_rpc_task(struct rpc_task *task)
         return ret;
 }
 
+static bool nfs4_mode_match_open_stateid(struct nfs4_state *state,
+                fmode_t fmode)
+{
+        switch(fmode & (FMODE_READ|FMODE_WRITE)) {
+        case FMODE_READ|FMODE_WRITE:
+                return state->n_rdwr != 0;
+        case FMODE_WRITE:
+                return state->n_wronly != 0;
+        case FMODE_READ:
+                return state->n_rdonly != 0;
+        }
+        WARN_ON_ONCE(1);
+        return false;
+}
+
 static int can_open_cached(struct nfs4_state *state, fmode_t mode, int open_mode)
 {
         int ret = 0;
@@ -1571,17 +1586,13 @@ static struct nfs4_opendata *nfs4_open_recoverdata_alloc(struct nfs_open_context
         return opendata;
 }
 
-static int nfs4_open_recover_helper(struct nfs4_opendata *opendata, fmode_t fmode, struct nfs4_state **res)
+static int nfs4_open_recover_helper(struct nfs4_opendata *opendata,
+                fmode_t fmode)
 {
         struct nfs4_state *newstate;
         int ret;
 
-        if ((opendata->o_arg.claim == NFS4_OPEN_CLAIM_DELEGATE_CUR ||
-             opendata->o_arg.claim == NFS4_OPEN_CLAIM_DELEG_CUR_FH) &&
-            (opendata->o_arg.u.delegation_type & fmode) != fmode)
-                /* This mode can't have been delegated, so we must have
-                 * a valid open_stateid to cover it - not need to reclaim.
-                 */
+        if (!nfs4_mode_match_open_stateid(opendata->state, fmode))
                 return 0;
         opendata->o_arg.open_flags = 0;
         opendata->o_arg.fmode = fmode;
@@ -1597,14 +1608,14 @@ static int nfs4_open_recover_helper(struct nfs4_opendata *opendata, fmode_t fmod
         newstate = nfs4_opendata_to_nfs4_state(opendata);
         if (IS_ERR(newstate))
                 return PTR_ERR(newstate);
+        if (newstate != opendata->state)
+                ret = -ESTALE;
         nfs4_close_state(newstate, fmode);
-        *res = newstate;
-        return 0;
+        return ret;
 }
 
 static int nfs4_open_recover(struct nfs4_opendata *opendata, struct nfs4_state *state)
 {
-        struct nfs4_state *newstate;
         int ret;
 
         /* Don't trigger recovery in nfs_test_and_clear_all_open_stateid */
@@ -1615,27 +1626,15 @@ static int nfs4_open_recover(struct nfs4_opendata *opendata, struct nfs4_state *
         clear_bit(NFS_DELEGATED_STATE, &state->flags);
         clear_bit(NFS_OPEN_STATE, &state->flags);
         smp_rmb();
-        if (state->n_rdwr != 0) {
-                ret = nfs4_open_recover_helper(opendata, FMODE_READ|FMODE_WRITE, &newstate);
-                if (ret != 0)
-                        return ret;
-                if (newstate != state)
-                        return -ESTALE;
-        }
-        if (state->n_wronly != 0) {
-                ret = nfs4_open_recover_helper(opendata, FMODE_WRITE, &newstate);
-                if (ret != 0)
-                        return ret;
-                if (newstate != state)
-                        return -ESTALE;
-        }
-        if (state->n_rdonly != 0) {
-                ret = nfs4_open_recover_helper(opendata, FMODE_READ, &newstate);
-                if (ret != 0)
-                        return ret;
-                if (newstate != state)
-                        return -ESTALE;
-        }
+        ret = nfs4_open_recover_helper(opendata, FMODE_READ|FMODE_WRITE);
+        if (ret != 0)
+                return ret;
+        ret = nfs4_open_recover_helper(opendata, FMODE_WRITE);
+        if (ret != 0)
+                return ret;
+        ret = nfs4_open_recover_helper(opendata, FMODE_READ);
+        if (ret != 0)
+                return ret;
         /*
          * We may have performed cached opens for all three recoveries.
          * Check if we need to update the current stateid.
@@ -1759,18 +1758,32 @@ static int nfs4_handle_delegation_recall_error(struct nfs_server *server, struct
         return err;
 }
 
-int nfs4_open_delegation_recall(struct nfs_open_context *ctx, struct nfs4_state *state, const nfs4_stateid *stateid)
+int nfs4_open_delegation_recall(struct nfs_open_context *ctx,
+                struct nfs4_state *state, const nfs4_stateid *stateid,
+                fmode_t type)
 {
         struct nfs_server *server = NFS_SERVER(state->inode);
         struct nfs4_opendata *opendata;
-        int err;
+        int err = 0;
 
         opendata = nfs4_open_recoverdata_alloc(ctx, state,
                         NFS4_OPEN_CLAIM_DELEG_CUR_FH);
         if (IS_ERR(opendata))
                 return PTR_ERR(opendata);
         nfs4_stateid_copy(&opendata->o_arg.u.delegation, stateid);
-        err = nfs4_open_recover(opendata, state);
+        clear_bit(NFS_DELEGATED_STATE, &state->flags);
+        switch (type & (FMODE_READ|FMODE_WRITE)) {
+        case FMODE_READ|FMODE_WRITE:
+        case FMODE_WRITE:
+                err = nfs4_open_recover_helper(opendata, FMODE_READ|FMODE_WRITE);
+                if (err)
+                        break;
+                err = nfs4_open_recover_helper(opendata, FMODE_WRITE);
+                if (err)
+                        break;
+        case FMODE_READ:
+                err = nfs4_open_recover_helper(opendata, FMODE_READ);
+        }
         nfs4_opendata_put(opendata);
         return nfs4_handle_delegation_recall_error(server, state, stateid, err);
 }
@@ -2645,6 +2658,15 @@ out:
         return err;
 }
 
+static bool
+nfs4_wait_on_layoutreturn(struct inode *inode, struct rpc_task *task)
+{
+        if (inode == NULL || !nfs_have_layout(inode))
+                return false;
+
+        return pnfs_wait_on_layoutreturn(inode, task);
+}
+
 struct nfs4_closedata {
         struct inode *inode;
         struct nfs4_state *state;
@@ -2763,6 +2785,11 @@ static void nfs4_close_prepare(struct rpc_task *task, void *data)
                 goto out_no_action;
         }
 
+        if (nfs4_wait_on_layoutreturn(inode, task)) {
+                nfs_release_seqid(calldata->arg.seqid);
+                goto out_wait;
+        }
+
         if (calldata->arg.fmode == 0)
                 task->tk_msg.rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_CLOSE];
         if (calldata->roc)
@@ -5308,6 +5335,9 @@ static void nfs4_delegreturn_prepare(struct rpc_task *task, void *data)
 
         d_data = (struct nfs4_delegreturndata *)data;
 
+        if (nfs4_wait_on_layoutreturn(d_data->inode, task))
+                return;
+
         if (d_data->roc)
                 pnfs_roc_get_barrier(d_data->inode, &d_data->roc_barrier);
 
@@ -7800,39 +7830,46 @@ static void nfs4_layoutget_done(struct rpc_task *task, void *calldata)
                         dprintk("%s: NFS4ERR_RECALLCONFLICT waiting %lu\n",
                                 __func__, delay);
                         rpc_delay(task, delay);
-                        task->tk_status = 0;
-                        rpc_restart_call_prepare(task);
-                        goto out; /* Do not call nfs4_async_handle_error() */
+                        /* Do not call nfs4_async_handle_error() */
+                        goto out_restart;
                 }
                 break;
         case -NFS4ERR_EXPIRED:
         case -NFS4ERR_BAD_STATEID:
                 spin_lock(&inode->i_lock);
-                lo = NFS_I(inode)->layout;
-                if (!lo || list_empty(&lo->plh_segs)) {
+                if (nfs4_stateid_match(&lgp->args.stateid,
+                                        &lgp->args.ctx->state->stateid)) {
                         spin_unlock(&inode->i_lock);
                         /* If the open stateid was bad, then recover it. */
                         state = lgp->args.ctx->state;
-                } else {
+                        break;
+                }
+                lo = NFS_I(inode)->layout;
+                if (lo && nfs4_stateid_match(&lgp->args.stateid,
+                                        &lo->plh_stateid)) {
                         LIST_HEAD(head);
 
                         /*
                          * Mark the bad layout state as invalid, then retry
                          * with the current stateid.
                          */
+                        set_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags);
                         pnfs_mark_matching_lsegs_invalid(lo, &head, NULL);
                         spin_unlock(&inode->i_lock);
                         pnfs_free_lseg_list(&head);
-        
-                        task->tk_status = 0;
-                        rpc_restart_call_prepare(task);
-                }
+                } else
+                        spin_unlock(&inode->i_lock);
+                goto out_restart;
         }
         if (nfs4_async_handle_error(task, server, state, NULL) == -EAGAIN)
-                rpc_restart_call_prepare(task);
+                goto out_restart;
 out:
         dprintk("<-- %s\n", __func__);
         return;
+out_restart:
+        task->tk_status = 0;
+        rpc_restart_call_prepare(task);
+        return;
 out_overflow:
         task->tk_status = -EOVERFLOW;
         goto out;
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index da73bc443238..5db324635e92 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -1481,7 +1481,7 @@ restart:
                                         spin_unlock(&state->state_lock);
                                 }
                                 nfs4_put_open_state(state);
-                                clear_bit(NFS4CLNT_RECLAIM_NOGRACE,
+                                clear_bit(NFS_STATE_RECLAIM_NOGRACE,
                                         &state->flags);
                                 spin_lock(&sp->so_lock);
                                 goto restart;
diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
index 7c5718ba625e..fe3ddd20ff89 100644
--- a/fs/nfs/pagelist.c
+++ b/fs/nfs/pagelist.c
@@ -508,7 +508,7 @@ size_t nfs_generic_pg_test(struct nfs_pageio_descriptor *desc,
          * for it without upsetting the slab allocator.
          */
         if (((mirror->pg_count + req->wb_bytes) >> PAGE_SHIFT) *
-                        sizeof(struct page) > PAGE_SIZE)
+                        sizeof(struct page *) > PAGE_SIZE)
                 return 0;
 
         return min(mirror->pg_bsize - mirror->pg_count, (size_t)req->wb_bytes);
diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index ba1246433794..8abe27165ad0 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -1104,20 +1104,15 @@ bool pnfs_roc(struct inode *ino)
                         mark_lseg_invalid(lseg, &tmp_list);
                         found = true;
                 }
-        /* pnfs_prepare_layoutreturn() grabs lo ref and it will be put
-         * in pnfs_roc_release(). We don't really send a layoutreturn but
-         * still want others to view us like we are sending one!
-         *
-         * If pnfs_prepare_layoutreturn() fails, it means someone else is doing
-         * LAYOUTRETURN, so we proceed like there are no layouts to return.
-         *
-         * ROC in three conditions:
+        /* ROC in two conditions:
          * 1. there are ROC lsegs
          * 2. we don't send layoutreturn
-         * 3. no others are sending layoutreturn
          */
-        if (found && !layoutreturn && pnfs_prepare_layoutreturn(lo))
+        if (found && !layoutreturn) {
+                /* lo ref dropped in pnfs_roc_release() */
+                pnfs_get_layout_hdr(lo);
                 roc = true;
+        }
 
 out_noroc:
         spin_unlock(&ino->i_lock);
@@ -1172,6 +1167,26 @@ void pnfs_roc_get_barrier(struct inode *ino, u32 *barrier)
         spin_unlock(&ino->i_lock);
 }
 
+bool pnfs_wait_on_layoutreturn(struct inode *ino, struct rpc_task *task)
+{
+        struct nfs_inode *nfsi = NFS_I(ino);
+        struct pnfs_layout_hdr *lo;
+        bool sleep = false;
+
+        /* we might not have grabbed lo reference. so need to check under
+         * i_lock */
+        spin_lock(&ino->i_lock);
+        lo = nfsi->layout;
+        if (lo && test_bit(NFS_LAYOUT_RETURN, &lo->plh_flags))
+                sleep = true;
+        spin_unlock(&ino->i_lock);
+
+        if (sleep)
+                rpc_sleep_on(&NFS_SERVER(ino)->roc_rpcwaitq, task, NULL);
+
+        return sleep;
+}
+
 /*
  * Compare two layout segments for sorting into layout cache.
  * We want to preferentially return RW over RO layouts, so ensure those
diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h
index 78c9351ff117..d1990e90e7a0 100644
--- a/fs/nfs/pnfs.h
+++ b/fs/nfs/pnfs.h
@@ -270,6 +270,7 @@ bool pnfs_roc(struct inode *ino);
 void pnfs_roc_release(struct inode *ino);
 void pnfs_roc_set_barrier(struct inode *ino, u32 barrier);
 void pnfs_roc_get_barrier(struct inode *ino, u32 *barrier);
+bool pnfs_wait_on_layoutreturn(struct inode *ino, struct rpc_task *task);
 void pnfs_set_layoutcommit(struct inode *, struct pnfs_layout_segment *, loff_t);
 void pnfs_cleanup_layoutcommit(struct nfs4_layoutcommit_data *data);
 int pnfs_layoutcommit_inode(struct inode *inode, bool sync);
@@ -639,6 +640,12 @@ pnfs_roc_get_barrier(struct inode *ino, u32 *barrier)
 {
 }
 
+static inline bool
+pnfs_wait_on_layoutreturn(struct inode *ino, struct rpc_task *task)
+{
+        return false;
+}
+
 static inline void set_pnfs_layoutdriver(struct nfs_server *s,
                                          const struct nfs_fh *mntfh, u32 id)
 {
diff --git a/fs/nfs/read.c b/fs/nfs/read.c
index ae0ff7a11b40..01b8cc8e8cfc 100644
--- a/fs/nfs/read.c
+++ b/fs/nfs/read.c
@@ -72,6 +72,9 @@ void nfs_pageio_reset_read_mds(struct nfs_pageio_descriptor *pgio)
 {
         struct nfs_pgio_mirror *mirror;
 
+        if (pgio->pg_ops && pgio->pg_ops->pg_cleanup)
+                pgio->pg_ops->pg_cleanup(pgio);
+
         pgio->pg_ops = &nfs_pgio_rw_ops;
 
         /* read path should never have more than one mirror */
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 388f48079c43..72624dc4a623 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -1351,6 +1351,9 @@ void nfs_pageio_reset_write_mds(struct nfs_pageio_descriptor *pgio)
 {
         struct nfs_pgio_mirror *mirror;
 
+        if (pgio->pg_ops && pgio->pg_ops->pg_cleanup)
+                pgio->pg_ops->pg_cleanup(pgio);
+
         pgio->pg_ops = &nfs_pgio_rw_ops;
 
         nfs_pageio_stop_mirroring(pgio);
diff --git a/fs/nsfs.c b/fs/nsfs.c
index e4905fbf3396..8f20d6016e20 100644
--- a/fs/nsfs.c
+++ b/fs/nsfs.c
@@ -142,7 +142,8 @@ static int nsfs_show_path(struct seq_file *seq, struct dentry *dentry)
         struct inode *inode = d_inode(dentry);
         const struct proc_ns_operations *ns_ops = dentry->d_fsdata;
 
-        return seq_printf(seq, "%s:[%lu]", ns_ops->name, inode->i_ino);
+        seq_printf(seq, "%s:[%lu]", ns_ops->name, inode->i_ino);
+        return 0;
 }
 
 static const struct super_operations nsfs_ops = {
diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
index 46b8b2bbc95a..ee5aa4daaea0 100644
--- a/fs/ocfs2/dlm/dlmmaster.c
+++ b/fs/ocfs2/dlm/dlmmaster.c
@@ -1439,6 +1439,7 @@ int dlm_master_request_handler(struct o2net_msg *msg, u32 len, void *data,
         int found, ret;
         int set_maybe;
         int dispatch_assert = 0;
+        int dispatched = 0;
 
         if (!dlm_grab(dlm))
                 return DLM_MASTER_RESP_NO;
@@ -1658,15 +1659,18 @@ send_response:
                         mlog(ML_ERROR, "failed to dispatch assert master work\n");
                         response = DLM_MASTER_RESP_ERROR;
                         dlm_lockres_put(res);
-                } else
+                } else {
+                        dispatched = 1;
                         __dlm_lockres_grab_inflight_worker(dlm, res);
+                }
                 spin_unlock(&res->spinlock);
         } else {
                 if (res)
                         dlm_lockres_put(res);
         }
 
-        dlm_put(dlm);
+        if (!dispatched)
+                dlm_put(dlm);
         return response;
 }
 
@@ -2090,7 +2094,6 @@ int dlm_dispatch_assert_master(struct dlm_ctxt *dlm,
 
 
         /* queue up work for dlm_assert_master_worker */
-        dlm_grab(dlm);  /* get an extra ref for the work item */
         dlm_init_work_item(dlm, item, dlm_assert_master_worker, NULL);
         item->u.am.lockres = res; /* already have a ref */
         /* can optionally ignore node numbers higher than this node */
diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c
index d0e436dc6437..3d90ad7ff91f 100644
--- a/fs/ocfs2/dlm/dlmrecovery.c
+++ b/fs/ocfs2/dlm/dlmrecovery.c
@@ -1694,6 +1694,7 @@ int dlm_master_requery_handler(struct o2net_msg *msg, u32 len, void *data,
         unsigned int hash;
         int master = DLM_LOCK_RES_OWNER_UNKNOWN;
         u32 flags = DLM_ASSERT_MASTER_REQUERY;
+        int dispatched = 0;
 
         if (!dlm_grab(dlm)) {
                 /* since the domain has gone away on this
@@ -1719,8 +1720,10 @@ int dlm_master_requery_handler(struct o2net_msg *msg, u32 len, void *data,
                                 dlm_put(dlm);
                                 /* sender will take care of this and retry */
                                 return ret;
-                        } else
+                        } else {
+                                dispatched = 1;
                                 __dlm_lockres_grab_inflight_worker(dlm, res);
+                        }
                         spin_unlock(&res->spinlock);
                 } else {
                         /* put.. incase we are not the master */
@@ -1730,7 +1733,8 @@ int dlm_master_requery_handler(struct o2net_msg *msg, u32 len, void *data,
         }
         spin_unlock(&dlm->spinlock);
 
-        dlm_put(dlm);
+        if (!dispatched)
+                dlm_put(dlm);
         return master;
 }
 
@@ -1776,7 +1780,7 @@ static int dlm_process_recovery_data(struct dlm_ctxt *dlm,
                                      struct dlm_migratable_lockres *mres)
 {
         struct dlm_migratable_lock *ml;
-        struct list_head *queue;
+        struct list_head *queue, *iter;
         struct list_head *tmpq = NULL;
         struct dlm_lock *newlock = NULL;
         struct dlm_lockstatus *lksb = NULL;
@@ -1821,7 +1825,9 @@ static int dlm_process_recovery_data(struct dlm_ctxt *dlm,
                         spin_lock(&res->spinlock);
                         for (j = DLM_GRANTED_LIST; j <= DLM_BLOCKED_LIST; j++) {
                                 tmpq = dlm_list_idx_to_ptr(res, j);
-                                list_for_each_entry(lock, tmpq, list) {
+                                list_for_each(iter, tmpq) {
+                                        lock = list_entry(iter,
+                                                  struct dlm_lock, list);
                                         if (lock->ml.cookie == ml->cookie)
                                                 break;
                                         lock = NULL;
diff --git a/fs/seq_file.c b/fs/seq_file.c
index 263b125dbcf4..225586e141ca 100644
--- a/fs/seq_file.c
+++ b/fs/seq_file.c
@@ -372,16 +372,16 @@ EXPORT_SYMBOL(seq_release);
  *      @esc:   set of characters that need escaping
  *
  *      Puts string into buffer, replacing each occurrence of character from
- *      @esc with usual octal escape.  Returns 0 in case of success, -1 - in
- *      case of overflow.
+ *      @esc with usual octal escape.
+ *      Use seq_has_overflowed() to check for errors.
  */
-int seq_escape(struct seq_file *m, const char *s, const char *esc)
+void seq_escape(struct seq_file *m, const char *s, const char *esc)
 {
         char *end = m->buf + m->size;
-        char *p;
+        char *p;
         char c;
 
-        for (p = m->buf + m->count; (c = *s) != '\0' && p < end; s++) {
+        for (p = m->buf + m->count; (c = *s) != '\0' && p < end; s++) {
                 if (!strchr(esc, c)) {
                         *p++ = c;
                         continue;
@@ -394,14 +394,13 @@ int seq_escape(struct seq_file *m, const char *s, const char *esc)
                         continue;
                 }
                 seq_set_overflow(m);
-                return -1;
-        }
+                return;
+        }
         m->count = p - m->buf;
-        return 0;
 }
 EXPORT_SYMBOL(seq_escape);
 
-int seq_vprintf(struct seq_file *m, const char *f, va_list args)
+void seq_vprintf(struct seq_file *m, const char *f, va_list args)
 {
         int len;
 
@@ -409,24 +408,20 @@ int seq_vprintf(struct seq_file *m, const char *f, va_list args)
                 len = vsnprintf(m->buf + m->count, m->size - m->count, f, args);
                 if (m->count + len < m->size) {
                         m->count += len;
-                        return 0;
+                        return;
                 }
         }
         seq_set_overflow(m);
-        return -1;
 }
 EXPORT_SYMBOL(seq_vprintf);
 
-int seq_printf(struct seq_file *m, const char *f, ...)
+void seq_printf(struct seq_file *m, const char *f, ...)
 {
-        int ret;
         va_list args;
 
         va_start(args, f);
-        ret = seq_vprintf(m, f, args);
+        seq_vprintf(m, f, args);
         va_end(args);
-
-        return ret;
 }
 EXPORT_SYMBOL(seq_printf);
 
@@ -664,26 +659,25 @@ int seq_open_private(struct file *filp, const struct seq_operations *ops,
 }
 EXPORT_SYMBOL(seq_open_private);
 
-int seq_putc(struct seq_file *m, char c)
+void seq_putc(struct seq_file *m, char c)
 {
-        if (m->count < m->size) {
-                m->buf[m->count++] = c;
-                return 0;
-        }
-        return -1;
+        if (m->count >= m->size)
+                return;
+
+        m->buf[m->count++] = c;
 }
 EXPORT_SYMBOL(seq_putc);
 
-int seq_puts(struct seq_file *m, const char *s)
+void seq_puts(struct seq_file *m, const char *s)
 {
         int len = strlen(s);
-        if (m->count + len < m->size) {
-                memcpy(m->buf + m->count, s, len);
-                m->count += len;
-                return 0;
+
+        if (m->count + len >= m->size) {
+                seq_set_overflow(m);
+                return;
         }
-        seq_set_overflow(m);
-        return -1;
+        memcpy(m->buf + m->count, s, len);
+        m->count += len;
 }
 EXPORT_SYMBOL(seq_puts);
 
@@ -694,8 +688,8 @@ EXPORT_SYMBOL(seq_puts);
  * This routine is very quick when you show lots of numbers.
  * In usual cases, it will be better to use seq_printf(). It's easier to read.
  */
-int seq_put_decimal_ull(struct seq_file *m, char delimiter,
-                        unsigned long long num)
+void seq_put_decimal_ull(struct seq_file *m, char delimiter,
+                         unsigned long long num)
 {
         int len;
 
@@ -707,35 +701,33 @@ int seq_put_decimal_ull(struct seq_file *m, char delimiter,
 
         if (num < 10) {
                 m->buf[m->count++] = num + '0';
-                return 0;
+                return;
         }
 
         len = num_to_str(m->buf + m->count, m->size - m->count, num);
         if (!len)
                 goto overflow;
         m->count += len;
-        return 0;
+        return;
+
 overflow:
         seq_set_overflow(m);
-        return -1;
 }
 EXPORT_SYMBOL(seq_put_decimal_ull);
 
-int seq_put_decimal_ll(struct seq_file *m, char delimiter,
-                        long long num)
+void seq_put_decimal_ll(struct seq_file *m, char delimiter, long long num)
 {
         if (num < 0) {
                 if (m->count + 3 >= m->size) {
                         seq_set_overflow(m);
-                        return -1;
+                        return;
                 }
                 if (delimiter)
                         m->buf[m->count++] = delimiter;
                 num = -num;
                 delimiter = '-';
         }
-        return seq_put_decimal_ull(m, delimiter, num);
-
+        seq_put_decimal_ull(m, delimiter, num);
 }
 EXPORT_SYMBOL(seq_put_decimal_ll);
 
diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
index 634e676072cb..50311703135b 100644
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@ -467,8 +467,8 @@ static int userfaultfd_release(struct inode *inode, struct file *file)
          * the fault_*wqh.
          */
         spin_lock(&ctx->fault_pending_wqh.lock);
-        __wake_up_locked_key(&ctx->fault_pending_wqh, TASK_NORMAL, 0, &range);
-        __wake_up_locked_key(&ctx->fault_wqh, TASK_NORMAL, 0, &range);
+        __wake_up_locked_key(&ctx->fault_pending_wqh, TASK_NORMAL, &range);
+        __wake_up_locked_key(&ctx->fault_wqh, TASK_NORMAL, &range);
         spin_unlock(&ctx->fault_pending_wqh.lock);
 
         wake_up_poll(&ctx->fd_wqh, POLLHUP);
@@ -650,10 +650,10 @@ static void __wake_userfault(struct userfaultfd_ctx *ctx,
         spin_lock(&ctx->fault_pending_wqh.lock);
         /* wake all in the range and autoremove */
         if (waitqueue_active(&ctx->fault_pending_wqh))
-                __wake_up_locked_key(&ctx->fault_pending_wqh, TASK_NORMAL, 0,
+                __wake_up_locked_key(&ctx->fault_pending_wqh, TASK_NORMAL,
                                      range);
         if (waitqueue_active(&ctx->fault_wqh))
-                __wake_up_locked_key(&ctx->fault_wqh, TASK_NORMAL, 0, range);
+                __wake_up_locked_key(&ctx->fault_wqh, TASK_NORMAL, range);
         spin_unlock(&ctx->fault_pending_wqh.lock);
 }
 
@@ -1287,8 +1287,10 @@ static struct file *userfaultfd_file_create(int flags)
 
         file = anon_inode_getfile("[userfaultfd]", &userfaultfd_fops, ctx,
                                   O_RDWR | (flags & UFFD_SHARED_FCNTL_FLAGS));
-        if (IS_ERR(file))
+        if (IS_ERR(file)) {
+                mmput(ctx->mm);
                 kmem_cache_free(userfaultfd_ctx_cachep, ctx);
+        }
 out:
         return file;
 }
diff --git a/include/acpi/button.h b/include/acpi/button.h
index 97eea0e4c016..1cad8b2d460c 100644
--- a/include/acpi/button.h
+++ b/include/acpi/button.h
@@ -3,7 +3,7 @@
 
 #include <linux/notifier.h>
 
-#if defined(CONFIG_ACPI_BUTTON) || defined(CONFIG_ACPI_BUTTON_MODULE)
+#if IS_ENABLED(CONFIG_ACPI_BUTTON)
 extern int acpi_lid_notifier_register(struct notifier_block *nb);
 extern int acpi_lid_notifier_unregister(struct notifier_block *nb);
 extern int acpi_lid_open(void);
@@ -20,6 +20,6 @@ static inline int acpi_lid_open(void)
 {
         return 1;
 }
-#endif /* defined(CONFIG_ACPI_BUTTON) || defined(CONFIG_ACPI_BUTTON_MODULE) */
+#endif /* IS_ENABLED(CONFIG_ACPI_BUTTON) */
 
 #endif /* ACPI_BUTTON_H */
diff --git a/include/acpi/video.h b/include/acpi/video.h
index e840b294c6f5..c62392d9b52a 100644
--- a/include/acpi/video.h
+++ b/include/acpi/video.h
@@ -24,7 +24,7 @@ enum acpi_backlight_type {
         acpi_backlight_native,
 };
 
-#if (defined CONFIG_ACPI_VIDEO || defined CONFIG_ACPI_VIDEO_MODULE)
+#if IS_ENABLED(CONFIG_ACPI_VIDEO)
 extern int acpi_video_register(void);
 extern void acpi_video_unregister(void);
 extern int acpi_video_get_edid(struct acpi_device *device, int type,
diff --git a/include/asm-generic/memory_model.h b/include/asm-generic/memory_model.h
index f20f407ce45d..4b4b056a6eb0 100644
--- a/include/asm-generic/memory_model.h
+++ b/include/asm-generic/memory_model.h
@@ -73,7 +73,7 @@
  * Convert a physical address to a Page Frame Number and back
  */
 #define __phys_to_pfn(paddr)    ((unsigned long)((paddr) >> PAGE_SHIFT))
-#define __pfn_to_phys(pfn)      ((pfn) << PAGE_SHIFT)
+#define __pfn_to_phys(pfn)      PFN_PHYS(pfn)
 
 #define page_to_pfn __page_to_pfn
 #define pfn_to_page __pfn_to_page
diff --git a/include/asm-generic/qspinlock.h b/include/asm-generic/qspinlock.h
index 83bfb87f5bf1..e2aadbc7151f 100644
--- a/include/asm-generic/qspinlock.h
+++ b/include/asm-generic/qspinlock.h
@@ -111,8 +111,8 @@ static inline void queued_spin_unlock_wait(struct qspinlock *lock)
                 cpu_relax();
 }
 
-#ifndef virt_queued_spin_lock
-static __always_inline bool virt_queued_spin_lock(struct qspinlock *lock)
+#ifndef virt_spin_lock
+static __always_inline bool virt_spin_lock(struct qspinlock *lock)
 {
         return false;
 }
diff --git a/include/kvm/arm_vgic.h b/include/kvm/arm_vgic.h
index d901f1a47be6..4e14dac282bb 100644
--- a/include/kvm/arm_vgic.h
+++ b/include/kvm/arm_vgic.h
@@ -35,11 +35,7 @@
 #define VGIC_V3_MAX_LRS         16
 #define VGIC_MAX_IRQS           1024
 #define VGIC_V2_MAX_CPUS        8
-
-/* Sanity checks... */
-#if (KVM_MAX_VCPUS > 255)
-#error Too many KVM VCPUs, the VGIC only supports up to 255 VCPUs for now
-#endif
+#define VGIC_V3_MAX_CPUS        255
 
 #if (VGIC_NR_IRQS_LEGACY & 31)
 #error "VGIC_NR_IRQS must be a multiple of 32"
diff --git a/include/linux/backing-dev.h b/include/linux/backing-dev.h
index 5a5d79ee256f..d5eb4ad1c534 100644
--- a/include/linux/backing-dev.h
+++ b/include/linux/backing-dev.h
@@ -13,6 +13,7 @@
 #include <linux/sched.h>
 #include <linux/blkdev.h>
 #include <linux/writeback.h>
+#include <linux/memcontrol.h>
 #include <linux/blk-cgroup.h>
 #include <linux/backing-dev-defs.h>
 #include <linux/slab.h>
@@ -252,13 +253,19 @@ int inode_congested(struct inode *inode, int cong_bits);
  * @inode: inode of interest
  *
  * cgroup writeback requires support from both the bdi and filesystem.
- * Test whether @inode has both.
+ * Also, both memcg and iocg have to be on the default hierarchy.  Test
+ * whether all conditions are met.
+ *
+ * Note that the test result may change dynamically on the same inode
+ * depending on how memcg and iocg are configured.
  */
 static inline bool inode_cgwb_enabled(struct inode *inode)
 {
         struct backing_dev_info *bdi = inode_to_bdi(inode);
 
-        return bdi_cap_account_dirty(bdi) &&
+        return cgroup_on_dfl(mem_cgroup_root_css->cgroup) &&
+                cgroup_on_dfl(blkcg_root_css->cgroup) &&
+                bdi_cap_account_dirty(bdi) &&
                 (bdi->capabilities & BDI_CAP_CGROUP_WRITEBACK) &&
                 (inode->i_sb->s_iflags & SB_I_CGROUPWB);
 }
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 708923b9b623..99da9ebc7377 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -584,7 +584,7 @@ static inline void queue_flag_clear(unsigned int flag, struct request_queue *q)
 
 #define list_entry_rq(ptr)      list_entry((ptr), struct request, queuelist)
 
-#define rq_data_dir(rq)         (((rq)->cmd_flags & 1) != 0)
+#define rq_data_dir(rq)         ((int)((rq)->cmd_flags & 1))
 
 /*
  * Driver can handle struct request, if it either has an old style
@@ -1368,6 +1368,26 @@ static inline bool bvec_gap_to_prev(struct request_queue *q,
                 ((bprv->bv_offset + bprv->bv_len) & queue_virt_boundary(q));
 }
 
+static inline bool bio_will_gap(struct request_queue *q, struct bio *prev,
+                         struct bio *next)
+{
+        if (!bio_has_data(prev))
+                return false;
+
+        return bvec_gap_to_prev(q, &prev->bi_io_vec[prev->bi_vcnt - 1],
+                                next->bi_io_vec[0].bv_offset);
+}
+
+static inline bool req_gap_back_merge(struct request *req, struct bio *bio)
+{
+        return bio_will_gap(req->q, req->biotail, bio);
+}
+
+static inline bool req_gap_front_merge(struct request *req, struct bio *bio)
+{
+        return bio_will_gap(req->q, bio, req->bio);
+}
+
 struct work_struct;
 int kblockd_schedule_work(struct work_struct *work);
 int kblockd_schedule_delayed_work(struct delayed_work *dwork, unsigned long delay);
@@ -1494,6 +1514,26 @@ queue_max_integrity_segments(struct request_queue *q)
         return q->limits.max_integrity_segments;
 }
 
+static inline bool integrity_req_gap_back_merge(struct request *req,
+                                                struct bio *next)
+{
+        struct bio_integrity_payload *bip = bio_integrity(req->bio);
+        struct bio_integrity_payload *bip_next = bio_integrity(next);
+
+        return bvec_gap_to_prev(req->q, &bip->bip_vec[bip->bip_vcnt - 1],
+                                bip_next->bip_vec[0].bv_offset);
+}
+
+static inline bool integrity_req_gap_front_merge(struct request *req,
+                                                 struct bio *bio)
+{
+        struct bio_integrity_payload *bip = bio_integrity(bio);
+        struct bio_integrity_payload *bip_next = bio_integrity(req->bio);
+
+        return bvec_gap_to_prev(req->q, &bip->bip_vec[bip->bip_vcnt - 1],
+                                bip_next->bip_vec[0].bv_offset);
+}
+
 #else /* CONFIG_BLK_DEV_INTEGRITY */
 
 struct bio;
@@ -1560,6 +1600,16 @@ static inline bool blk_integrity_is_initialized(struct gendisk *g)
 {
         return 0;
 }
+static inline bool integrity_req_gap_back_merge(struct request *req,
+                                                struct bio *next)
+{
+        return false;
+}
+static inline bool integrity_req_gap_front_merge(struct request *req,
+                                                 struct bio *bio)
+{
+        return false;
+}
 
 #endif /* CONFIG_BLK_DEV_INTEGRITY */
 
diff --git a/include/linux/ceph/ceph_features.h b/include/linux/ceph/ceph_features.h
index 4763ad64e832..f89b31d45cc8 100644
--- a/include/linux/ceph/ceph_features.h
+++ b/include/linux/ceph/ceph_features.h
@@ -107,6 +107,7 @@ static inline u64 ceph_sanitize_features(u64 features)
          CEPH_FEATURE_OSDMAP_ENC |              \
          CEPH_FEATURE_CRUSH_TUNABLES3 |         \
          CEPH_FEATURE_OSD_PRIMARY_AFFINITY |    \
+         CEPH_FEATURE_MSGR_KEEPALIVE2 |         \
          CEPH_FEATURE_CRUSH_V4)
 
 #define CEPH_FEATURES_REQUIRED_DEFAULT   \
diff --git a/include/linux/ceph/libceph.h b/include/linux/ceph/libceph.h
index 9ebee53d3bf5..397c5cd09794 100644
--- a/include/linux/ceph/libceph.h
+++ b/include/linux/ceph/libceph.h
@@ -46,6 +46,7 @@ struct ceph_options {
         unsigned long mount_timeout;            /* jiffies */
         unsigned long osd_idle_ttl;             /* jiffies */
         unsigned long osd_keepalive_timeout;    /* jiffies */
+        unsigned long monc_ping_timeout;        /* jiffies */
 
         /*
          * any type that can't be simply compared or doesn't need need
@@ -66,6 +67,7 @@ struct ceph_options {
 #define CEPH_MOUNT_TIMEOUT_DEFAULT      msecs_to_jiffies(60 * 1000)
 #define CEPH_OSD_KEEPALIVE_DEFAULT      msecs_to_jiffies(5 * 1000)
 #define CEPH_OSD_IDLE_TTL_DEFAULT       msecs_to_jiffies(60 * 1000)
+#define CEPH_MONC_PING_TIMEOUT_DEFAULT  msecs_to_jiffies(30 * 1000)
 
 #define CEPH_MSG_MAX_FRONT_LEN  (16*1024*1024)
 #define CEPH_MSG_MAX_MIDDLE_LEN (16*1024*1024)
diff --git a/include/linux/ceph/messenger.h b/include/linux/ceph/messenger.h
index 37753278987a..b2371d9b51fa 100644
--- a/include/linux/ceph/messenger.h
+++ b/include/linux/ceph/messenger.h
@@ -238,6 +238,8 @@ struct ceph_connection {
         bool out_kvec_is_msg; /* kvec refers to out_msg */
         int out_more;        /* there is more data after the kvecs */
         __le64 out_temp_ack; /* for writing an ack */
+        struct ceph_timespec out_temp_keepalive2; /* for writing keepalive2
+                                                     stamp */
 
         /* message in temps */
         struct ceph_msg_header in_hdr;
@@ -248,6 +250,8 @@ struct ceph_connection {
         int in_base_pos;     /* bytes read */
         __le64 in_temp_ack;  /* for reading an ack */
 
+        struct timespec last_keepalive_ack; /* keepalive2 ack stamp */
+
         struct delayed_work work;           /* send|recv work */
         unsigned long       delay;          /* current delay interval */
 };
@@ -285,6 +289,8 @@ extern void ceph_msg_revoke(struct ceph_msg *msg);
 extern void ceph_msg_revoke_incoming(struct ceph_msg *msg);
 
 extern void ceph_con_keepalive(struct ceph_connection *con);
+extern bool ceph_con_keepalive_expired(struct ceph_connection *con,
+                                       unsigned long interval);
 
 extern void ceph_msg_data_add_pages(struct ceph_msg *msg, struct page **pages,
                                 size_t length, size_t alignment);
diff --git a/include/linux/ceph/msgr.h b/include/linux/ceph/msgr.h
index 1c1887206ffa..0fe2656ac415 100644
--- a/include/linux/ceph/msgr.h
+++ b/include/linux/ceph/msgr.h
@@ -84,10 +84,12 @@ struct ceph_entity_inst {
 #define CEPH_MSGR_TAG_MSG           7  /* message */
 #define CEPH_MSGR_TAG_ACK           8  /* message ack */
 #define CEPH_MSGR_TAG_KEEPALIVE     9  /* just a keepalive byte! */
-#define CEPH_MSGR_TAG_BADPROTOVER  10  /* bad protocol version */
+#define CEPH_MSGR_TAG_BADPROTOVER   10 /* bad protocol version */
 #define CEPH_MSGR_TAG_BADAUTHORIZER 11 /* bad authorizer */
 #define CEPH_MSGR_TAG_FEATURES      12 /* insufficient features */
 #define CEPH_MSGR_TAG_SEQ           13 /* 64-bit int follows with seen seq number */
+#define CEPH_MSGR_TAG_KEEPALIVE2    14 /* keepalive2 byte + ceph_timespec */
+#define CEPH_MSGR_TAG_KEEPALIVE2_ACK 15 /* keepalive2 reply */
 
 
 /*
diff --git a/include/linux/cgroup-defs.h b/include/linux/cgroup-defs.h
index 4d8fcf2187dc..8492721b39be 100644
--- a/include/linux/cgroup-defs.h
+++ b/include/linux/cgroup-defs.h
@@ -473,31 +473,8 @@ struct cgroup_subsys {
         unsigned int depends_on;
 };
 
-extern struct percpu_rw_semaphore cgroup_threadgroup_rwsem;
-
-/**
- * cgroup_threadgroup_change_begin - threadgroup exclusion for cgroups
- * @tsk: target task
- *
- * Called from threadgroup_change_begin() and allows cgroup operations to
- * synchronize against threadgroup changes using a percpu_rw_semaphore.
- */
-static inline void cgroup_threadgroup_change_begin(struct task_struct *tsk)
-{
-        percpu_down_read(&cgroup_threadgroup_rwsem);
-}
-
-/**
- * cgroup_threadgroup_change_end - threadgroup exclusion for cgroups
- * @tsk: target task
- *
- * Called from threadgroup_change_end().  Counterpart of
- * cgroup_threadcgroup_change_begin().
- */
-static inline void cgroup_threadgroup_change_end(struct task_struct *tsk)
-{
-        percpu_up_read(&cgroup_threadgroup_rwsem);
-}
+void cgroup_threadgroup_change_begin(struct task_struct *tsk);
+void cgroup_threadgroup_change_end(struct task_struct *tsk);
 
 #else   /* CONFIG_CGROUPS */
 
diff --git a/include/linux/clockchips.h b/include/linux/clockchips.h
index 31ce435981fe..bdcf358dfce2 100644
--- a/include/linux/clockchips.h
+++ b/include/linux/clockchips.h
@@ -18,15 +18,6 @@
 struct clock_event_device;
 struct module;
 
-/* Clock event mode commands for legacy ->set_mode(): OBSOLETE */
-enum clock_event_mode {
-        CLOCK_EVT_MODE_UNUSED,
-        CLOCK_EVT_MODE_SHUTDOWN,
-        CLOCK_EVT_MODE_PERIODIC,
-        CLOCK_EVT_MODE_ONESHOT,
-        CLOCK_EVT_MODE_RESUME,
-};
-
 /*
  * Possible states of a clock event device.
  *
@@ -86,16 +77,14 @@ enum clock_event_state {
  * @min_delta_ns:       minimum delta value in ns
  * @mult:               nanosecond to cycles multiplier
  * @shift:              nanoseconds to cycles divisor (power of two)
- * @mode:               operating mode, relevant only to ->set_mode(), OBSOLETE
  * @state_use_accessors:current state of the device, assigned by the core code
  * @features:           features
  * @retries:            number of forced programming retries
- * @set_mode:           legacy set mode function, only for modes <= CLOCK_EVT_MODE_RESUME.
- * @set_state_periodic: switch state to periodic, if !set_mode
- * @set_state_oneshot:  switch state to oneshot, if !set_mode
- * @set_state_oneshot_stopped: switch state to oneshot_stopped, if !set_mode
- * @set_state_shutdown: switch state to shutdown, if !set_mode
- * @tick_resume:        resume clkevt device, if !set_mode
+ * @set_state_periodic: switch state to periodic
+ * @set_state_oneshot:  switch state to oneshot
+ * @set_state_oneshot_stopped: switch state to oneshot_stopped
+ * @set_state_shutdown: switch state to shutdown
+ * @tick_resume:        resume clkevt device
  * @broadcast:          function to broadcast events
  * @min_delta_ticks:    minimum delta value in ticks stored for reconfiguration
  * @max_delta_ticks:    maximum delta value in ticks stored for reconfiguration
@@ -116,18 +105,10 @@ struct clock_event_device {
         u64                     min_delta_ns;
         u32                     mult;
         u32                     shift;
-        enum clock_event_mode   mode;
         enum clock_event_state  state_use_accessors;
         unsigned int            features;
         unsigned long           retries;
 
-        /*
-         * State transition callback(s): Only one of the two groups should be
-         * defined:
-         * - set_mode(), only for modes <= CLOCK_EVT_MODE_RESUME.
-         * - set_state_{shutdown|periodic|oneshot|oneshot_stopped}(), tick_resume().
-         */
-        void                    (*set_mode)(enum clock_event_mode mode, struct clock_event_device *);
         int                     (*set_state_periodic)(struct clock_event_device *);
         int                     (*set_state_oneshot)(struct clock_event_device *);
         int                     (*set_state_oneshot_stopped)(struct clock_event_device *);
diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h
index 430efcbea48e..dca22de98d94 100644
--- a/include/linux/cpufreq.h
+++ b/include/linux/cpufreq.h
@@ -127,9 +127,14 @@ struct cpufreq_policy {
 #define CPUFREQ_SHARED_TYPE_ANY  (3) /* Freq can be set from any dependent CPU*/
 
 #ifdef CONFIG_CPU_FREQ
+struct cpufreq_policy *cpufreq_cpu_get_raw(unsigned int cpu);
 struct cpufreq_policy *cpufreq_cpu_get(unsigned int cpu);
 void cpufreq_cpu_put(struct cpufreq_policy *policy);
 #else
+static inline struct cpufreq_policy *cpufreq_cpu_get_raw(unsigned int cpu)
+{
+        return NULL;
+}
 static inline struct cpufreq_policy *cpufreq_cpu_get(unsigned int cpu)
 {
         return NULL;
diff --git a/include/linux/devfreq.h b/include/linux/devfreq.h
index ce447f0f1bad..68030e22af35 100644
--- a/include/linux/devfreq.h
+++ b/include/linux/devfreq.h
@@ -65,7 +65,10 @@ struct devfreq_dev_status {
  *                      The "flags" parameter's possible values are
  *                      explained above with "DEVFREQ_FLAG_*" macros.
  * @get_dev_status:     The device should provide the current performance
- *                      status to devfreq, which is used by governors.
+ *                      status to devfreq. Governors are recommended not to
+ *                      use this directly. Instead, governors are recommended
+ *                      to use devfreq_update_stats() along with
+ *                      devfreq.last_status.
  * @get_cur_freq:       The device should provide the current frequency
  *                      at which it is operating.
  * @exit:               An optional callback that is called when devfreq
@@ -161,6 +164,7 @@ struct devfreq {
         struct delayed_work work;
 
         unsigned long previous_freq;
+        struct devfreq_dev_status last_status;
 
         void *data; /* private data for governors */
 
@@ -204,6 +208,19 @@ extern int devm_devfreq_register_opp_notifier(struct device *dev,
 extern void devm_devfreq_unregister_opp_notifier(struct device *dev,
                                                 struct devfreq *devfreq);
 
+/**
+ * devfreq_update_stats() - update the last_status pointer in struct devfreq
+ * @df:         the devfreq instance whose status needs updating
+ *
+ *  Governors are recommended to use this function along with last_status,
+ * which allows other entities to reuse the last_status without affecting
+ * the values fetched later by governors.
+ */
+static inline int devfreq_update_stats(struct devfreq *df)
+{
+        return df->profile->get_dev_status(df->dev.parent, &df->last_status);
+}
+
 #if IS_ENABLED(CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND)
 /**
  * struct devfreq_simple_ondemand_data - void *data fed to struct devfreq
@@ -289,6 +306,11 @@ static inline void devm_devfreq_unregister_opp_notifier(struct device *dev,
                                                         struct devfreq *devfreq)
 {
 }
+
+static inline int devfreq_update_stats(struct devfreq *df)
+{
+        return -EINVAL;
+}
 #endif /* CONFIG_PM_DEVFREQ */
 
 #endif /* __LINUX_DEVFREQ_H__ */
diff --git a/include/linux/init_task.h b/include/linux/init_task.h
index d0b380ee7d67..e38681f4912d 100644
--- a/include/linux/init_task.h
+++ b/include/linux/init_task.h
@@ -25,6 +25,13 @@
 extern struct files_struct init_files;
 extern struct fs_struct init_fs;
 
+#ifdef CONFIG_CGROUPS
+#define INIT_GROUP_RWSEM(sig)                                           \
+        .group_rwsem = __RWSEM_INITIALIZER(sig.group_rwsem),
+#else
+#define INIT_GROUP_RWSEM(sig)
+#endif
+
 #ifdef CONFIG_CPUSETS
 #define INIT_CPUSET_SEQ(tsk)                                                    \
         .mems_allowed_seq = SEQCNT_ZERO(tsk.mems_allowed_seq),
@@ -57,6 +64,7 @@ extern struct fs_struct init_fs;
         INIT_PREV_CPUTIME(sig)                                          \
         .cred_guard_mutex =                                             \
                  __MUTEX_INITIALIZER(sig.cred_guard_mutex),             \
+        INIT_GROUP_RWSEM(sig)                                           \
 }
 
 extern struct nsproxy init_nsproxy;
diff --git a/include/linux/irq.h b/include/linux/irq.h
index 6f8b34066442..11bf09288ddb 100644
--- a/include/linux/irq.h
+++ b/include/linux/irq.h
@@ -110,8 +110,8 @@ enum {
 /*
  * Return value for chip->irq_set_affinity()
  *
- * IRQ_SET_MASK_OK      - OK, core updates irq_data.affinity
- * IRQ_SET_MASK_NOCPY   - OK, chip did update irq_data.affinity
+ * IRQ_SET_MASK_OK      - OK, core updates irq_common_data.affinity
+ * IRQ_SET_MASK_NOCPY   - OK, chip did update irq_common_data.affinity
  * IRQ_SET_MASK_OK_DONE - Same as IRQ_SET_MASK_OK for core. Special code to
  *                        support stacked irqchips, which indicates skipping
  *                        all descendent irqchips.
@@ -129,9 +129,19 @@ struct irq_domain;
  * struct irq_common_data - per irq data shared by all irqchips
  * @state_use_accessors: status information for irq chip functions.
  *                      Use accessor functions to deal with it
+ * @node:               node index useful for balancing
+ * @handler_data:       per-IRQ data for the irq_chip methods
+ * @affinity:           IRQ affinity on SMP
+ * @msi_desc:           MSI descriptor
  */
 struct irq_common_data {
         unsigned int            state_use_accessors;
+#ifdef CONFIG_NUMA
+        unsigned int            node;
+#endif
+        void                    *handler_data;
+        struct msi_desc         *msi_desc;
+        cpumask_var_t           affinity;
 };
 
 /**
@@ -139,38 +149,26 @@ struct irq_common_data {
  * @mask:               precomputed bitmask for accessing the chip registers
  * @irq:                interrupt number
  * @hwirq:              hardware interrupt number, local to the interrupt domain
- * @node:               node index useful for balancing
  * @common:             point to data shared by all irqchips
  * @chip:               low level interrupt hardware access
  * @domain:             Interrupt translation domain; responsible for mapping
  *                      between hwirq number and linux irq number.
  * @parent_data:        pointer to parent struct irq_data to support hierarchy
  *                      irq_domain
- * @handler_data:       per-IRQ data for the irq_chip methods
  * @chip_data:          platform-specific per-chip private data for the chip
  *                      methods, to allow shared chip implementations
- * @msi_desc:           MSI descriptor
- * @affinity:           IRQ affinity on SMP
- *
- * The fields here need to overlay the ones in irq_desc until we
- * cleaned up the direct references and switched everything over to
- * irq_data.
  */
 struct irq_data {
         u32                     mask;
         unsigned int            irq;
         unsigned long           hwirq;
-        unsigned int            node;
         struct irq_common_data  *common;
         struct irq_chip         *chip;
         struct irq_domain       *domain;
 #ifdef  CONFIG_IRQ_DOMAIN_HIERARCHY
         struct irq_data         *parent_data;
 #endif
-        void                    *handler_data;
         void                    *chip_data;
-        struct msi_desc         *msi_desc;
-        cpumask_var_t           affinity;
 };
 
 /*
@@ -190,6 +188,7 @@ struct irq_data {
  * IRQD_IRQ_MASKED              - Masked state of the interrupt
  * IRQD_IRQ_INPROGRESS          - In progress state of the interrupt
  * IRQD_WAKEUP_ARMED            - Wakeup mode armed
+ * IRQD_FORWARDED_TO_VCPU       - The interrupt is forwarded to a VCPU
  */
 enum {
         IRQD_TRIGGER_MASK               = 0xf,
@@ -204,6 +203,7 @@ enum {
         IRQD_IRQ_MASKED                 = (1 << 17),
         IRQD_IRQ_INPROGRESS             = (1 << 18),
         IRQD_WAKEUP_ARMED               = (1 << 19),
+        IRQD_FORWARDED_TO_VCPU          = (1 << 20),
 };
 
 #define __irqd_to_state(d)              ((d)->common->state_use_accessors)
@@ -282,6 +282,20 @@ static inline bool irqd_is_wakeup_armed(struct irq_data *d)
         return __irqd_to_state(d) & IRQD_WAKEUP_ARMED;
 }
 
+static inline bool irqd_is_forwarded_to_vcpu(struct irq_data *d)
+{
+        return __irqd_to_state(d) & IRQD_FORWARDED_TO_VCPU;
+}
+
+static inline void irqd_set_forwarded_to_vcpu(struct irq_data *d)
+{
+        __irqd_to_state(d) |= IRQD_FORWARDED_TO_VCPU;
+}
+
+static inline void irqd_clr_forwarded_to_vcpu(struct irq_data *d)
+{
+        __irqd_to_state(d) &= ~IRQD_FORWARDED_TO_VCPU;
+}
 
 /*
  * Functions for chained handlers which can be enabled/disabled by the
@@ -461,14 +475,14 @@ static inline int irq_set_parent(int irq, int parent_irq)
  * Built-in IRQ handlers for various IRQ types,
  * callable via desc->handle_irq()
  */
-extern void handle_level_irq(unsigned int irq, struct irq_desc *desc);
-extern void handle_fasteoi_irq(unsigned int irq, struct irq_desc *desc);
-extern void handle_edge_irq(unsigned int irq, struct irq_desc *desc);
-extern void handle_edge_eoi_irq(unsigned int irq, struct irq_desc *desc);
-extern void handle_simple_irq(unsigned int irq, struct irq_desc *desc);
-extern void handle_percpu_irq(unsigned int irq, struct irq_desc *desc);
-extern void handle_percpu_devid_irq(unsigned int irq, struct irq_desc *desc);
-extern void handle_bad_irq(unsigned int irq, struct irq_desc *desc);
+extern void handle_level_irq(struct irq_desc *desc);
+extern void handle_fasteoi_irq(struct irq_desc *desc);
+extern void handle_edge_irq(struct irq_desc *desc);
+extern void handle_edge_eoi_irq(struct irq_desc *desc);
+extern void handle_simple_irq(struct irq_desc *desc);
+extern void handle_percpu_irq(struct irq_desc *desc);
+extern void handle_percpu_devid_irq(struct irq_desc *desc);
+extern void handle_bad_irq(struct irq_desc *desc);
 extern void handle_nested_irq(unsigned int irq);
 
 extern int irq_chip_compose_msi_msg(struct irq_data *data, struct msi_msg *msg);
@@ -627,23 +641,23 @@ static inline void *irq_data_get_irq_chip_data(struct irq_data *d)
 static inline void *irq_get_handler_data(unsigned int irq)
 {
         struct irq_data *d = irq_get_irq_data(irq);
-        return d ? d->handler_data : NULL;
+        return d ? d->common->handler_data : NULL;
 }
 
 static inline void *irq_data_get_irq_handler_data(struct irq_data *d)
 {
-        return d->handler_data;
+        return d->common->handler_data;
 }
 
 static inline struct msi_desc *irq_get_msi_desc(unsigned int irq)
 {
         struct irq_data *d = irq_get_irq_data(irq);
-        return d ? d->msi_desc : NULL;
+        return d ? d->common->msi_desc : NULL;
 }
 
 static inline struct msi_desc *irq_data_get_msi_desc(struct irq_data *d)
 {
-        return d->msi_desc;
+        return d->common->msi_desc;
 }
 
 static inline u32 irq_get_trigger_type(unsigned int irq)
@@ -652,21 +666,30 @@ static inline u32 irq_get_trigger_type(unsigned int irq)
         return d ? irqd_get_trigger_type(d) : 0;
 }
 
-static inline int irq_data_get_node(struct irq_data *d)
+static inline int irq_common_data_get_node(struct irq_common_data *d)
 {
+#ifdef CONFIG_NUMA
         return d->node;
+#else
+        return 0;
+#endif
+}
+
+static inline int irq_data_get_node(struct irq_data *d)
+{
+        return irq_common_data_get_node(d->common);
 }
 
 static inline struct cpumask *irq_get_affinity_mask(int irq)
 {
         struct irq_data *d = irq_get_irq_data(irq);
 
-        return d ? d->affinity : NULL;
+        return d ? d->common->affinity : NULL;
 }
 
 static inline struct cpumask *irq_data_get_affinity_mask(struct irq_data *d)
 {
-        return d->affinity;
+        return d->common->affinity;
 }
 
 unsigned int arch_dynirq_lower_bound(unsigned int from);
diff --git a/include/linux/irqdesc.h b/include/linux/irqdesc.h
index 5acfa26602e1..a587a33363c7 100644
--- a/include/linux/irqdesc.h
+++ b/include/linux/irqdesc.h
@@ -98,11 +98,7 @@ extern struct irq_desc irq_desc[NR_IRQS];
 
 static inline struct irq_desc *irq_data_to_desc(struct irq_data *data)
 {
-#ifdef CONFIG_IRQ_DOMAIN_HIERARCHY
-        return irq_to_desc(data->irq);
-#else
-        return container_of(data, struct irq_desc, irq_data);
-#endif
+        return container_of(data->common, struct irq_desc, irq_common_data);
 }
 
 static inline unsigned int irq_desc_get_irq(struct irq_desc *desc)
@@ -127,23 +123,21 @@ static inline void *irq_desc_get_chip_data(struct irq_desc *desc)
 
 static inline void *irq_desc_get_handler_data(struct irq_desc *desc)
 {
-        return desc->irq_data.handler_data;
+        return desc->irq_common_data.handler_data;
 }
 
 static inline struct msi_desc *irq_desc_get_msi_desc(struct irq_desc *desc)
 {
-        return desc->irq_data.msi_desc;
+        return desc->irq_common_data.msi_desc;
 }
 
 /*
  * Architectures call this to let the generic IRQ layer
- * handle an interrupt. If the descriptor is attached to an
- * irqchip-style controller then we call the ->handle_irq() handler,
- * and it calls __do_IRQ() if it's attached to an irqtype-style controller.
+ * handle an interrupt.
  */
-static inline void generic_handle_irq_desc(unsigned int irq, struct irq_desc *desc)
+static inline void generic_handle_irq_desc(struct irq_desc *desc)
 {
-        desc->handle_irq(irq, desc);
+        desc->handle_irq(desc);
 }
 
 int generic_handle_irq(unsigned int irq);
@@ -176,29 +170,6 @@ static inline int irq_has_action(unsigned int irq)
         return irq_desc_has_action(irq_to_desc(irq));
 }
 
-/* caller has locked the irq_desc and both params are valid */
-static inline void __irq_set_handler_locked(unsigned int irq,
-                                            irq_flow_handler_t handler)
-{
-        struct irq_desc *desc;
-
-        desc = irq_to_desc(irq);
-        desc->handle_irq = handler;
-}
-
-/* caller has locked the irq_desc and both params are valid */
-static inline void
-__irq_set_chip_handler_name_locked(unsigned int irq, struct irq_chip *chip,
-                                   irq_flow_handler_t handler, const char *name)
-{
-        struct irq_desc *desc;
-
-        desc = irq_to_desc(irq);
-        irq_desc_get_irq_data(desc)->chip = chip;
-        desc->handle_irq = handler;
-        desc->name = name;
-}
-
 /**
  * irq_set_handler_locked - Set irq handler from a locked region
  * @data:       Pointer to the irq_data structure which identifies the irq
diff --git a/include/linux/irqhandler.h b/include/linux/irqhandler.h
index 62d543004197..661bed0ed1f3 100644
--- a/include/linux/irqhandler.h
+++ b/include/linux/irqhandler.h
@@ -8,7 +8,7 @@
 
 struct irq_desc;
 struct irq_data;
-typedef void (*irq_flow_handler_t)(unsigned int irq, struct irq_desc *desc);
+typedef void (*irq_flow_handler_t)(struct irq_desc *desc);
 typedef void (*irq_preflow_handler_t)(struct irq_data *data);
 
 #endif
diff --git a/include/linux/jump_label.h b/include/linux/jump_label.h
index 7f653e8f6690..f1094238ab2a 100644
--- a/include/linux/jump_label.h
+++ b/include/linux/jump_label.h
@@ -21,8 +21,8 @@
  *
  * DEFINE_STATIC_KEY_TRUE(key);
  * DEFINE_STATIC_KEY_FALSE(key);
- * static_key_likely()
- * statick_key_unlikely()
+ * static_branch_likely()
+ * static_branch_unlikely()
  *
  * Jump labels provide an interface to generate dynamic branches using
  * self-modifying code. Assuming toolchain and architecture support, if we
@@ -45,12 +45,10 @@
  * statement, setting the key to true requires us to patch in a jump
  * to the out-of-line of true branch.
  *
- * In addtion to static_branch_{enable,disable}, we can also reference count
+ * In addition to static_branch_{enable,disable}, we can also reference count
  * the key or branch direction via static_branch_{inc,dec}. Thus,
  * static_branch_inc() can be thought of as a 'make more true' and
- * static_branch_dec() as a 'make more false'. The inc()/dec()
- * interface is meant to be used exclusively from the inc()/dec() for a given
- * key.
+ * static_branch_dec() as a 'make more false'.
  *
  * Since this relies on modifying code, the branch modifying functions
  * must be considered absolute slow paths (machine wide synchronization etc.).
diff --git a/include/linux/mm.h b/include/linux/mm.h
index fda728e3c27d..91c08f6f0dc9 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -20,6 +20,7 @@
 #include <linux/shrinker.h>
 #include <linux/resource.h>
 #include <linux/page_ext.h>
+#include <linux/err.h>
 
 struct mempolicy;
 struct anon_vma;
@@ -1214,6 +1215,49 @@ long get_user_pages_unlocked(struct task_struct *tsk, struct mm_struct *mm,
                     int write, int force, struct page **pages);
 int get_user_pages_fast(unsigned long start, int nr_pages, int write,
                         struct page **pages);
+
+/* Container for pinned pfns / pages */
+struct frame_vector {
+        unsigned int nr_allocated;      /* Number of frames we have space for */
+        unsigned int nr_frames; /* Number of frames stored in ptrs array */
+        bool got_ref;           /* Did we pin pages by getting page ref? */
+        bool is_pfns;           /* Does array contain pages or pfns? */
+        void *ptrs[0];          /* Array of pinned pfns / pages. Use
+                                 * pfns_vector_pages() or pfns_vector_pfns()
+                                 * for access */
+};
+
+struct frame_vector *frame_vector_create(unsigned int nr_frames);
+void frame_vector_destroy(struct frame_vector *vec);
+int get_vaddr_frames(unsigned long start, unsigned int nr_pfns,
+                     bool write, bool force, struct frame_vector *vec);
+void put_vaddr_frames(struct frame_vector *vec);
+int frame_vector_to_pages(struct frame_vector *vec);
+void frame_vector_to_pfns(struct frame_vector *vec);
+
+static inline unsigned int frame_vector_count(struct frame_vector *vec)
+{
+        return vec->nr_frames;
+}
+
+static inline struct page **frame_vector_pages(struct frame_vector *vec)
+{
+        if (vec->is_pfns) {
+                int err = frame_vector_to_pages(vec);
+
+                if (err)
+                        return ERR_PTR(err);
+        }
+        return (struct page **)(vec->ptrs);
+}
+
+static inline unsigned long *frame_vector_pfns(struct frame_vector *vec)
+{
+        if (!vec->is_pfns)
+                frame_vector_to_pfns(vec);
+        return (unsigned long *)(vec->ptrs);
+}
+
 struct kvec;
 int get_kernel_pages(const struct kvec *iov, int nr_pages, int write,
                         struct page **pages);
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index b791405958b4..d2ffeafc9998 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -507,6 +507,7 @@ static inline void napi_enable(struct napi_struct *n)
         BUG_ON(!test_bit(NAPI_STATE_SCHED, &n->state));
         smp_mb__before_atomic();
         clear_bit(NAPI_STATE_SCHED, &n->state);
+        clear_bit(NAPI_STATE_NPSVC, &n->state);
 }
 
 #ifdef CONFIG_SMP
diff --git a/include/linux/ntb.h b/include/linux/ntb.h
index b02f72bb8e32..f798e2afba88 100644
--- a/include/linux/ntb.h
+++ b/include/linux/ntb.h
@@ -522,10 +522,9 @@ static inline int ntb_mw_clear_trans(struct ntb_dev *ntb, int idx)
  * @speed:      OUT - The link speed expressed as PCIe generation number.
  * @width:      OUT - The link width expressed as the number of PCIe lanes.
  *
- * Set the translation of a memory window.  The peer may access local memory
- * through the window starting at the address, up to the size.  The address
- * must be aligned to the alignment specified by ntb_mw_get_range().  The size
- * must be aligned to the size alignment specified by ntb_mw_get_range().
+ * Get the current state of the ntb link.  It is recommended to query the link
+ * state once after every link event.  It is safe to query the link state in
+ * the context of the link event callback.
  *
  * Return: One if the link is up, zero if the link is down, otherwise a
  *              negative value indicating the error number.
@@ -795,7 +794,7 @@ static inline int ntb_peer_db_set(struct ntb_dev *ntb, u64 db_bits)
 }
 
 /**
- * ntb_peer_db_clear() - clear bits in the local doorbell register
+ * ntb_peer_db_clear() - clear bits in the peer doorbell register
  * @ntb:        NTB device context.
  * @db_bits:    Doorbell bits to clear.
  *
diff --git a/include/linux/ntb_transport.h b/include/linux/ntb_transport.h
index 2862861366a5..7243eb98a722 100644
--- a/include/linux/ntb_transport.h
+++ b/include/linux/ntb_transport.h
@@ -83,3 +83,4 @@ void *ntb_transport_rx_remove(struct ntb_transport_qp *qp, unsigned int *len);
 void ntb_transport_link_up(struct ntb_transport_qp *qp);
 void ntb_transport_link_down(struct ntb_transport_qp *qp);
 bool ntb_transport_link_query(struct ntb_transport_qp *qp);
+unsigned int ntb_transport_tx_free_entry(struct ntb_transport_qp *qp);
diff --git a/include/linux/phy.h b/include/linux/phy.h
index 962387a192f1..4a4e3a092337 100644
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
@@ -19,6 +19,7 @@
 #include <linux/spinlock.h>
 #include <linux/ethtool.h>
 #include <linux/mii.h>
+#include <linux/module.h>
 #include <linux/timer.h>
 #include <linux/workqueue.h>
 #include <linux/mod_devicetable.h>
@@ -153,6 +154,7 @@ struct sk_buff;
  * PHYs should register using this structure
  */
 struct mii_bus {
+        struct module *owner;
         const char *name;
         char id[MII_BUS_ID_SIZE];
         void *priv;
@@ -198,7 +200,8 @@ static inline struct mii_bus *mdiobus_alloc(void)
         return mdiobus_alloc_size(0);
 }
 
-int mdiobus_register(struct mii_bus *bus);
+int __mdiobus_register(struct mii_bus *bus, struct module *owner);
+#define mdiobus_register(bus) __mdiobus_register(bus, THIS_MODULE)
 void mdiobus_unregister(struct mii_bus *bus);
 void mdiobus_free(struct mii_bus *bus);
 struct mii_bus *devm_mdiobus_alloc_size(struct device *dev, int sizeof_priv);
@@ -742,6 +745,7 @@ struct phy_device *phy_device_create(struct mii_bus *bus, int addr, int phy_id,
                                      struct phy_c45_device_ids *c45_ids);
 struct phy_device *get_phy_device(struct mii_bus *bus, int addr, bool is_c45);
 int phy_device_register(struct phy_device *phy);
+void phy_device_remove(struct phy_device *phydev);
 int phy_init_hw(struct phy_device *phydev);
 int phy_suspend(struct phy_device *phydev);
 int phy_resume(struct phy_device *phydev);
diff --git a/include/linux/pm_opp.h b/include/linux/pm_opp.h
index cab7ba55bedb..e817722ee3f0 100644
--- a/include/linux/pm_opp.h
+++ b/include/linux/pm_opp.h
@@ -34,6 +34,7 @@ bool dev_pm_opp_is_turbo(struct dev_pm_opp *opp);
 
 int dev_pm_opp_get_opp_count(struct device *dev);
 unsigned long dev_pm_opp_get_max_clock_latency(struct device *dev);
+struct dev_pm_opp *dev_pm_opp_get_suspend_opp(struct device *dev);
 
 struct dev_pm_opp *dev_pm_opp_find_freq_exact(struct device *dev,
                                               unsigned long freq,
@@ -80,6 +81,11 @@ static inline unsigned long dev_pm_opp_get_max_clock_latency(struct device *dev)
         return 0;
 }
 
+static inline struct dev_pm_opp *dev_pm_opp_get_suspend_opp(struct device *dev)
+{
+        return NULL;
+}
+
 static inline struct dev_pm_opp *dev_pm_opp_find_freq_exact(struct device *dev,
                                         unsigned long freq, bool available)
 {
diff --git a/include/linux/sched.h b/include/linux/sched.h
index a4ab9daa387c..b7b9501b41af 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -762,6 +762,18 @@ struct signal_struct {
         unsigned audit_tty_log_passwd;
         struct tty_audit_buf *tty_audit_buf;
 #endif
+#ifdef CONFIG_CGROUPS
+        /*
+         * group_rwsem prevents new tasks from entering the threadgroup and
+         * member tasks from exiting,a more specifically, setting of
+         * PF_EXITING.  fork and exit paths are protected with this rwsem
+         * using threadgroup_change_begin/end().  Users which require
+         * threadgroup to remain stable should use threadgroup_[un]lock()
+         * which also takes care of exec path.  Currently, cgroup is the
+         * only user.
+         */
+        struct rw_semaphore group_rwsem;
+#endif
 
         oom_flags_t oom_flags;
         short oom_score_adj;            /* OOM kill score adjustment */
diff --git a/include/linux/security.h b/include/linux/security.h
index 79d85ddf8093..2f4c1f7aa7db 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -946,7 +946,7 @@ static inline int security_task_prctl(int option, unsigned long arg2,
                                       unsigned long arg4,
                                       unsigned long arg5)
 {
-        return cap_task_prctl(option, arg2, arg3, arg3, arg5);
+        return cap_task_prctl(option, arg2, arg3, arg4, arg5);
 }
 
 static inline void security_task_to_inode(struct task_struct *p, struct inode *inode)
diff --git a/include/linux/seq_file.h b/include/linux/seq_file.h
index adeadbd6d7bf..dde00defbaa5 100644
--- a/include/linux/seq_file.h
+++ b/include/linux/seq_file.h
@@ -114,13 +114,18 @@ int seq_open(struct file *, const struct seq_operations *);
 ssize_t seq_read(struct file *, char __user *, size_t, loff_t *);
 loff_t seq_lseek(struct file *, loff_t, int);
 int seq_release(struct inode *, struct file *);
-int seq_escape(struct seq_file *, const char *, const char *);
-int seq_putc(struct seq_file *m, char c);
-int seq_puts(struct seq_file *m, const char *s);
 int seq_write(struct seq_file *seq, const void *data, size_t len);
 
-__printf(2, 3) int seq_printf(struct seq_file *, const char *, ...);
-__printf(2, 0) int seq_vprintf(struct seq_file *, const char *, va_list args);
+__printf(2, 0)
+void seq_vprintf(struct seq_file *m, const char *fmt, va_list args);
+__printf(2, 3)
+void seq_printf(struct seq_file *m, const char *fmt, ...);
+void seq_putc(struct seq_file *m, char c);
+void seq_puts(struct seq_file *m, const char *s);
+void seq_put_decimal_ull(struct seq_file *m, char delimiter,
+                         unsigned long long num);
+void seq_put_decimal_ll(struct seq_file *m, char delimiter, long long num);
+void seq_escape(struct seq_file *m, const char *s, const char *esc);
 
 void seq_hex_dump(struct seq_file *m, const char *prefix_str, int prefix_type,
                   int rowsize, int groupsize, const void *buf, size_t len,
@@ -138,10 +143,6 @@ int single_release(struct inode *, struct file *);
 void *__seq_open_private(struct file *, const struct seq_operations *, int);
 int seq_open_private(struct file *, const struct seq_operations *, int);
 int seq_release_private(struct inode *, struct file *);
-int seq_put_decimal_ull(struct seq_file *m, char delimiter,
-                        unsigned long long num);
-int seq_put_decimal_ll(struct seq_file *m, char delimiter,
-                        long long num);
 
 static inline struct user_namespace *seq_user_ns(struct seq_file *seq)
 {
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 2738d355cdf9..2b0a30a6e31c 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -179,6 +179,9 @@ struct nf_bridge_info {
         u8                      bridged_dnat:1;
         __u16                   frag_max_size;
         struct net_device       *physindev;
+
+        /* always valid & non-NULL from FORWARD on, for physdev match */
+        struct net_device       *physoutdev;
         union {
                 /* prerouting: detect dnat in orig/reply direction */
                 __be32          ipv4_daddr;
@@ -189,9 +192,6 @@ struct nf_bridge_info {
                  * skb is out in neigh layer.
                  */
                 char neigh_header[8];
-
-                /* always valid & non-NULL from FORWARD on, for physdev match */
-                struct net_device *physoutdev;
         };
 };
 #endif
@@ -2707,6 +2707,9 @@ static inline void skb_postpull_rcsum(struct sk_buff *skb,
 {
         if (skb->ip_summed == CHECKSUM_COMPLETE)
                 skb->csum = csum_sub(skb->csum, csum_partial(start, len, 0));
+        else if (skb->ip_summed == CHECKSUM_PARTIAL &&
+                 skb_checksum_start_offset(skb) <= len)
+                skb->ip_summed = CHECKSUM_NONE;
 }
 
 unsigned char *skb_pull_rcsum(struct sk_buff *skb, unsigned int len);
diff --git a/include/linux/spi/spi.h b/include/linux/spi/spi.h
index 269e8afd3e2a..6b00f18f5e6b 100644
--- a/include/linux/spi/spi.h
+++ b/include/linux/spi/spi.h
@@ -34,7 +34,7 @@ extern struct bus_type spi_bus_type;
 
 /**
  * struct spi_statistics - statistics for spi transfers
- * @clock:         lock protecting this structure
+ * @lock:          lock protecting this structure
  *
  * @messages:      number of spi-messages handled
  * @transfers:     number of spi_transfers handled
diff --git a/include/linux/sunrpc/xprtsock.h b/include/linux/sunrpc/xprtsock.h
index 7591788e9fbf..357e44c1a46b 100644
--- a/include/linux/sunrpc/xprtsock.h
+++ b/include/linux/sunrpc/xprtsock.h
@@ -42,6 +42,7 @@ struct sock_xprt {
         /*
          * Connection of transports
          */
+        unsigned long           sock_state;
         struct delayed_work     connect_worker;
         struct sockaddr_storage srcaddr;
         unsigned short          srcport;
@@ -76,6 +77,8 @@ struct sock_xprt {
  */
 #define TCP_RPC_REPLY           (1UL << 6)
 
+#define XPRT_SOCK_CONNECTING    1U
+
 #endif /* __KERNEL__ */
 
 #endif /* _LINUX_SUNRPC_XPRTSOCK_H */
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index 08001317aee7..a460e2ef2843 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -885,4 +885,6 @@ asmlinkage long sys_execveat(int dfd, const char __user *filename,
                         const char __user *const __user *argv,
                         const char __user *const __user *envp, int flags);
 
+asmlinkage long sys_membarrier(int cmd, int flags);
+
 #endif
diff --git a/include/linux/thermal.h b/include/linux/thermal.h
index 037e9df2f610..157d366e761b 100644
--- a/include/linux/thermal.h
+++ b/include/linux/thermal.h
@@ -92,23 +92,19 @@ struct thermal_zone_device_ops {
                      struct thermal_cooling_device *);
         int (*unbind) (struct thermal_zone_device *,
                        struct thermal_cooling_device *);
-        int (*get_temp) (struct thermal_zone_device *, unsigned long *);
+        int (*get_temp) (struct thermal_zone_device *, int *);
         int (*get_mode) (struct thermal_zone_device *,
                          enum thermal_device_mode *);
         int (*set_mode) (struct thermal_zone_device *,
                 enum thermal_device_mode);
         int (*get_trip_type) (struct thermal_zone_device *, int,
                 enum thermal_trip_type *);
-        int (*get_trip_temp) (struct thermal_zone_device *, int,
-                              unsigned long *);
-        int (*set_trip_temp) (struct thermal_zone_device *, int,
-                              unsigned long);
-        int (*get_trip_hyst) (struct thermal_zone_device *, int,
-                              unsigned long *);
-        int (*set_trip_hyst) (struct thermal_zone_device *, int,
-                              unsigned long);
-        int (*get_crit_temp) (struct thermal_zone_device *, unsigned long *);
-        int (*set_emul_temp) (struct thermal_zone_device *, unsigned long);
+        int (*get_trip_temp) (struct thermal_zone_device *, int, int *);
+        int (*set_trip_temp) (struct thermal_zone_device *, int, int);
+        int (*get_trip_hyst) (struct thermal_zone_device *, int, int *);
+        int (*set_trip_hyst) (struct thermal_zone_device *, int, int);
+        int (*get_crit_temp) (struct thermal_zone_device *, int *);
+        int (*set_emul_temp) (struct thermal_zone_device *, int);
         int (*get_trend) (struct thermal_zone_device *, int,
                           enum thermal_trend *);
         int (*notify) (struct thermal_zone_device *, int,
@@ -332,9 +328,9 @@ struct thermal_genl_event {
  *                 temperature.
  */
 struct thermal_zone_of_device_ops {
-        int (*get_temp)(void *, long *);
+        int (*get_temp)(void *, int *);
         int (*get_trend)(void *, long *);
-        int (*set_emul_temp)(void *, unsigned long);
+        int (*set_emul_temp)(void *, int);
 };
 
 /**
@@ -364,7 +360,7 @@ static inline struct thermal_zone_device *
 thermal_zone_of_sensor_register(struct device *dev, int id, void *data,
                                 const struct thermal_zone_of_device_ops *ops)
 {
-        return NULL;
+        return ERR_PTR(-ENODEV);
 }
 
 static inline
@@ -384,6 +380,8 @@ static inline bool cdev_is_power_actor(struct thermal_cooling_device *cdev)
 
 int power_actor_get_max_power(struct thermal_cooling_device *,
                               struct thermal_zone_device *tz, u32 *max_power);
+int power_actor_get_min_power(struct thermal_cooling_device *,
+                              struct thermal_zone_device *tz, u32 *min_power);
 int power_actor_set_power(struct thermal_cooling_device *,
                           struct thermal_instance *, u32);
 struct thermal_zone_device *thermal_zone_device_register(const char *, int, int,
@@ -406,7 +404,7 @@ thermal_of_cooling_device_register(struct device_node *np, char *, void *,
                                    const struct thermal_cooling_device_ops *);
 void thermal_cooling_device_unregister(struct thermal_cooling_device *);
 struct thermal_zone_device *thermal_zone_get_zone_by_name(const char *name);
-int thermal_zone_get_temp(struct thermal_zone_device *tz, unsigned long *temp);
+int thermal_zone_get_temp(struct thermal_zone_device *tz, int *temp);
 
 int get_tz_trend(struct thermal_zone_device *, int);
 struct thermal_instance *get_thermal_instance(struct thermal_zone_device *,
@@ -419,6 +417,10 @@ static inline bool cdev_is_power_actor(struct thermal_cooling_device *cdev)
 static inline int power_actor_get_max_power(struct thermal_cooling_device *cdev,
                               struct thermal_zone_device *tz, u32 *max_power)
 { return 0; }
+static inline int power_actor_get_min_power(struct thermal_cooling_device *cdev,
+                                            struct thermal_zone_device *tz,
+                                            u32 *min_power)
+{ return -ENODEV; }
 static inline int power_actor_set_power(struct thermal_cooling_device *cdev,
                           struct thermal_instance *tz, u32 power)
 { return 0; }
@@ -457,7 +459,7 @@ static inline struct thermal_zone_device *thermal_zone_get_zone_by_name(
                 const char *name)
 { return ERR_PTR(-ENODEV); }
 static inline int thermal_zone_get_temp(
-                struct thermal_zone_device *tz, unsigned long *temp)
+                struct thermal_zone_device *tz, int *temp)
 { return -ENODEV; }
 static inline int get_tz_trend(struct thermal_zone_device *tz, int trip)
 { return -ENODEV; }
diff --git a/include/linux/tick.h b/include/linux/tick.h
index 48d901f83f92..e312219ff823 100644
--- a/include/linux/tick.h
+++ b/include/linux/tick.h
@@ -147,11 +147,20 @@ static inline void tick_nohz_full_add_cpus_to(struct cpumask *mask)
                 cpumask_or(mask, mask, tick_nohz_full_mask);
 }
 
+static inline int housekeeping_any_cpu(void)
+{
+        return cpumask_any_and(housekeeping_mask, cpu_online_mask);
+}
+
 extern void tick_nohz_full_kick(void);
 extern void tick_nohz_full_kick_cpu(int cpu);
 extern void tick_nohz_full_kick_all(void);
 extern void __tick_nohz_task_switch(void);
 #else
+static inline int housekeeping_any_cpu(void)
+{
+        return smp_processor_id();
+}
 static inline bool tick_nohz_full_enabled(void) { return false; }
 static inline bool tick_nohz_full_cpu(int cpu) { return false; }
 static inline void tick_nohz_full_add_cpus_to(struct cpumask *mask) { }
diff --git a/include/linux/wait.h b/include/linux/wait.h
index d3d077228d4c..1e1bf9f963a9 100644
--- a/include/linux/wait.h
+++ b/include/linux/wait.h
@@ -147,8 +147,7 @@ __remove_wait_queue(wait_queue_head_t *head, wait_queue_t *old)
 
 typedef int wait_bit_action_f(struct wait_bit_key *);
 void __wake_up(wait_queue_head_t *q, unsigned int mode, int nr, void *key);
-void __wake_up_locked_key(wait_queue_head_t *q, unsigned int mode, int nr,
-                          void *key);
+void __wake_up_locked_key(wait_queue_head_t *q, unsigned int mode, void *key);
 void __wake_up_sync_key(wait_queue_head_t *q, unsigned int mode, int nr, void *key);
 void __wake_up_locked(wait_queue_head_t *q, unsigned int mode, int nr);
 void __wake_up_sync(wait_queue_head_t *q, unsigned int mode, int nr);
@@ -180,7 +179,7 @@ wait_queue_head_t *bit_waitqueue(void *, int);
 #define wake_up_poll(x, m)                                              \
         __wake_up(x, TASK_NORMAL, 1, (void *) (m))
 #define wake_up_locked_poll(x, m)                                       \
-        __wake_up_locked_key((x), TASK_NORMAL, 1, (void *) (m))
+        __wake_up_locked_key((x), TASK_NORMAL, (void *) (m))
 #define wake_up_interruptible_poll(x, m)                                \
         __wake_up(x, TASK_INTERRUPTIBLE, 1, (void *) (m))
 #define wake_up_interruptible_sync_poll(x, m)                           \
diff --git a/include/media/videobuf2-memops.h b/include/media/videobuf2-memops.h
index 9f36641a6781..6513c7ec3116 100644
--- a/include/media/videobuf2-memops.h
+++ b/include/media/videobuf2-memops.h
@@ -15,6 +15,7 @@
 #define _MEDIA_VIDEOBUF2_MEMOPS_H
 
 #include <media/videobuf2-core.h>
+#include <linux/mm.h>
 
 /**
  * struct vb2_vmarea_handler - common vma refcount tracking handler
@@ -31,11 +32,9 @@ struct vb2_vmarea_handler {
 
 extern const struct vm_operations_struct vb2_common_vm_ops;
 
-int vb2_get_contig_userptr(unsigned long vaddr, unsigned long size,
-                           struct vm_area_struct **res_vma, dma_addr_t *res_pa);
-
-struct vm_area_struct *vb2_get_vma(struct vm_area_struct *vma);
-void vb2_put_vma(struct vm_area_struct *vma);
-
+struct frame_vector *vb2_create_framevec(unsigned long start,
+                                         unsigned long length,
+                                         bool write);
+void vb2_destroy_framevec(struct frame_vector *vec);
 
 #endif
diff --git a/include/net/flow.h b/include/net/flow.h
index acd6a096250e..9b85db85f13c 100644
--- a/include/net/flow.h
+++ b/include/net/flow.h
@@ -35,6 +35,7 @@ struct flowi_common {
 #define FLOWI_FLAG_ANYSRC               0x01
 #define FLOWI_FLAG_KNOWN_NH             0x02
 #define FLOWI_FLAG_VRFSRC               0x04
+#define FLOWI_FLAG_SKIP_NH_OIF          0x08
         __u32   flowic_secid;
         struct flowi_tunnel flowic_tun_key;
 };
diff --git a/include/net/inet_timewait_sock.h b/include/net/inet_timewait_sock.h
index 879d6e5a973b..186f3a1e1b1f 100644
--- a/include/net/inet_timewait_sock.h
+++ b/include/net/inet_timewait_sock.h
@@ -110,7 +110,19 @@ struct inet_timewait_sock *inet_twsk_alloc(const struct sock *sk,
 void __inet_twsk_hashdance(struct inet_timewait_sock *tw, struct sock *sk,
                            struct inet_hashinfo *hashinfo);
 
-void inet_twsk_schedule(struct inet_timewait_sock *tw, const int timeo);
+void __inet_twsk_schedule(struct inet_timewait_sock *tw, int timeo,
+                          bool rearm);
+
+static void inline inet_twsk_schedule(struct inet_timewait_sock *tw, int timeo)
+{
+        __inet_twsk_schedule(tw, timeo, false);
+}
+
+static void inline inet_twsk_reschedule(struct inet_timewait_sock *tw, int timeo)
+{
+        __inet_twsk_schedule(tw, timeo, true);
+}
+
 void inet_twsk_deschedule_put(struct inet_timewait_sock *tw);
 
 void inet_twsk_purge(struct inet_hashinfo *hashinfo,
diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
index 063d30474cf6..aaf9700fc9e5 100644
--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h
@@ -275,7 +275,8 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt,
              struct nl_info *info, struct mx6_config *mxc);
 int fib6_del(struct rt6_info *rt, struct nl_info *info);
 
-void inet6_rt_notify(int event, struct rt6_info *rt, struct nl_info *info);
+void inet6_rt_notify(int event, struct rt6_info *rt, struct nl_info *info,
+                     unsigned int flags);
 
 void fib6_run_gc(unsigned long expires, struct net *net, bool force);
 
diff --git a/include/net/ip6_tunnel.h b/include/net/ip6_tunnel.h
index b8529aa1dae7..fa915fa0f703 100644
--- a/include/net/ip6_tunnel.h
+++ b/include/net/ip6_tunnel.h
@@ -32,6 +32,12 @@ struct __ip6_tnl_parm {
         __be32                  o_key;
 };
 
+struct ip6_tnl_dst {
+        seqlock_t lock;
+        struct dst_entry __rcu *dst;
+        u32 cookie;
+};
+
 /* IPv6 tunnel */
 struct ip6_tnl {
         struct ip6_tnl __rcu *next;     /* next tunnel in list */
@@ -39,8 +45,7 @@ struct ip6_tnl {
         struct net *net;        /* netns for packet i/o */
         struct __ip6_tnl_parm parms;    /* tunnel configuration parameters */
         struct flowi fl;        /* flowi template for xmit */
-        struct dst_entry *dst_cache;    /* cached dst */
-        u32 dst_cookie;
+        struct ip6_tnl_dst __percpu *dst_cache; /* cached dst */
 
         int err_count;
         unsigned long err_time;
@@ -60,9 +65,11 @@ struct ipv6_tlv_tnl_enc_lim {
         __u8 encap_limit;       /* tunnel encapsulation limit   */
 } __packed;
 
-struct dst_entry *ip6_tnl_dst_check(struct ip6_tnl *t);
+struct dst_entry *ip6_tnl_dst_get(struct ip6_tnl *t);
+int ip6_tnl_dst_init(struct ip6_tnl *t);
+void ip6_tnl_dst_destroy(struct ip6_tnl *t);
 void ip6_tnl_dst_reset(struct ip6_tnl *t);
-void ip6_tnl_dst_store(struct ip6_tnl *t, struct dst_entry *dst);
+void ip6_tnl_dst_set(struct ip6_tnl *t, struct dst_entry *dst);
 int ip6_tnl_rcv_ctl(struct ip6_tnl *t, const struct in6_addr *laddr,
                 const struct in6_addr *raddr);
 int ip6_tnl_xmit_ctl(struct ip6_tnl *t, const struct in6_addr *laddr,
@@ -79,7 +86,7 @@ static inline void ip6tunnel_xmit(struct sock *sk, struct sk_buff *skb,
         struct net_device_stats *stats = &dev->stats;
         int pkt_len, err;
 
-        pkt_len = skb->len;
+        pkt_len = skb->len - skb_inner_network_offset(skb);
         err = ip6_local_out_sk(sk, skb);
 
         if (net_xmit_eval(err) == 0) {
diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
index a37d0432bebd..727d6e9a9685 100644
--- a/include/net/ip_fib.h
+++ b/include/net/ip_fib.h
@@ -236,8 +236,11 @@ static inline int fib_lookup(struct net *net, const struct flowi4 *flp,
         rcu_read_lock();
 
         tb = fib_get_table(net, RT_TABLE_MAIN);
-        if (tb && !fib_table_lookup(tb, flp, res, flags | FIB_LOOKUP_NOREF))
-                err = 0;
+        if (tb)
+                err = fib_table_lookup(tb, flp, res, flags | FIB_LOOKUP_NOREF);
+
+        if (err == -EAGAIN)
+                err = -ENETUNREACH;
 
         rcu_read_unlock();
 
@@ -258,7 +261,7 @@ static inline int fib_lookup(struct net *net, struct flowi4 *flp,
                              struct fib_result *res, unsigned int flags)
 {
         struct fib_table *tb;
-        int err;
+        int err = -ENETUNREACH;
 
         flags |= FIB_LOOKUP_NOREF;
         if (net->ipv4.fib_has_custom_rules)
@@ -268,15 +271,20 @@ static inline int fib_lookup(struct net *net, struct flowi4 *flp,
 
         res->tclassid = 0;
 
-        for (err = 0; !err; err = -ENETUNREACH) {
-                tb = rcu_dereference_rtnl(net->ipv4.fib_main);
-                if (tb && !fib_table_lookup(tb, flp, res, flags))
-                        break;
+        tb = rcu_dereference_rtnl(net->ipv4.fib_main);
+        if (tb)
+                err = fib_table_lookup(tb, flp, res, flags);
+
+        if (!err)
+                goto out;
+
+        tb = rcu_dereference_rtnl(net->ipv4.fib_default);
+        if (tb)
+                err = fib_table_lookup(tb, flp, res, flags);
 
-                tb = rcu_dereference_rtnl(net->ipv4.fib_default);
-                if (tb && !fib_table_lookup(tb, flp, res, flags))
-                        break;
-        }
+out:
+        if (err == -EAGAIN)
+                err = -ENETUNREACH;
 
         rcu_read_unlock();
 
diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h
index 9a6a3ba888e8..f6dafec9102c 100644
--- a/include/net/ip_tunnels.h
+++ b/include/net/ip_tunnels.h
@@ -276,6 +276,8 @@ int iptunnel_pull_header(struct sk_buff *skb, int hdr_len, __be16 inner_proto);
 int iptunnel_xmit(struct sock *sk, struct rtable *rt, struct sk_buff *skb,
                   __be32 src, __be32 dst, u8 proto,
                   u8 tos, u8 ttl, __be16 df, bool xnet);
+struct metadata_dst *iptunnel_metadata_reply(struct metadata_dst *md,
+                                             gfp_t flags);
 
 struct sk_buff *iptunnel_handle_offloads(struct sk_buff *skb, bool gre_csum,
                                          int gso_type_mask);
diff --git a/include/net/route.h b/include/net/route.h
index 414beadc619f..d1bd90bb3187 100644
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -257,7 +257,7 @@ static inline void ip_route_connect_init(struct flowi4 *fl4, __be32 dst, __be32
                 flow_flags |= FLOWI_FLAG_ANYSRC;
 
         if (netif_index_is_vrf(sock_net(sk), oif))
-                flow_flags |= FLOWI_FLAG_VRFSRC;
+                flow_flags |= FLOWI_FLAG_VRFSRC | FLOWI_FLAG_SKIP_NH_OIF;
 
         flowi4_init_output(fl4, oif, sk->sk_mark, tos, RT_SCOPE_UNIVERSE,
                            protocol, flow_flags, dst, src, dport, sport);
diff --git a/include/rdma/opa_port_info.h b/include/rdma/opa_port_info.h
index 391dae1931c0..a0fa975cd1c1 100644
--- a/include/rdma/opa_port_info.h
+++ b/include/rdma/opa_port_info.h
@@ -294,8 +294,8 @@ struct opa_port_states {
 
 struct opa_port_state_info {
         struct opa_port_states port_states;
-        u16 link_width_downgrade_tx_active;
-        u16 link_width_downgrade_rx_active;
+        __be16 link_width_downgrade_tx_active;
+        __be16 link_width_downgrade_rx_active;
 };
 
 struct opa_port_info {
diff --git a/include/scsi/scsi_common.h b/include/scsi/scsi_common.h
index 676b03b78e57..11571b2a831e 100644
--- a/include/scsi/scsi_common.h
+++ b/include/scsi/scsi_common.h
@@ -61,4 +61,9 @@ static inline bool scsi_sense_valid(const struct scsi_sense_hdr *sshdr)
 extern bool scsi_normalize_sense(const u8 *sense_buffer, int sb_len,
                                  struct scsi_sense_hdr *sshdr);
 
+extern void scsi_build_sense_buffer(int desc, u8 *buf, u8 key, u8 asc, u8 ascq);
+int scsi_set_sense_information(u8 *buf, int buf_len, u64 info);
+extern const u8 * scsi_sense_desc_find(const u8 * sense_buffer, int sb_len,
+                                       int desc_type);
+
 #endif /* _SCSI_COMMON_H_ */
diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h
index 50c2a363bc8f..fe89d7cd67b9 100644
--- a/include/scsi/scsi_device.h
+++ b/include/scsi/scsi_device.h
@@ -196,34 +196,13 @@ struct scsi_device {
         struct execute_work     ew; /* used to get process context on put */
         struct work_struct      requeue_work;
 
-        struct scsi_dh_data     *scsi_dh_data;
+        struct scsi_device_handler *handler;
+        void                    *handler_data;
+
         enum scsi_device_state sdev_state;
         unsigned long           sdev_data[0];
 } __attribute__((aligned(sizeof(unsigned long))));
 
-typedef void (*activate_complete)(void *, int);
-struct scsi_device_handler {
-        /* Used by the infrastructure */
-        struct list_head list; /* list of scsi_device_handlers */
-
-        /* Filled by the hardware handler */
-        struct module *module;
-        const char *name;
-        int (*check_sense)(struct scsi_device *, struct scsi_sense_hdr *);
-        struct scsi_dh_data *(*attach)(struct scsi_device *);
-        void (*detach)(struct scsi_device *);
-        int (*activate)(struct scsi_device *, activate_complete, void *);
-        int (*prep_fn)(struct scsi_device *, struct request *);
-        int (*set_params)(struct scsi_device *, const char *);
-        bool (*match)(struct scsi_device *);
-};
-
-struct scsi_dh_data {
-        struct scsi_device_handler *scsi_dh;
-        struct scsi_device *sdev;
-        struct kref kref;
-};
-
 #define to_scsi_device(d)       \
         container_of(d, struct scsi_device, sdev_gendev)
 #define class_to_sdev(d)        \
diff --git a/include/scsi/scsi_dh.h b/include/scsi/scsi_dh.h
index 620c723ee8ed..85d731746834 100644
--- a/include/scsi/scsi_dh.h
+++ b/include/scsi/scsi_dh.h
@@ -55,11 +55,26 @@ enum {
         SCSI_DH_NOSYS,
         SCSI_DH_DRIVER_MAX,
 };
-#if defined(CONFIG_SCSI_DH) || defined(CONFIG_SCSI_DH_MODULE)
+
+typedef void (*activate_complete)(void *, int);
+struct scsi_device_handler {
+        /* Used by the infrastructure */
+        struct list_head list; /* list of scsi_device_handlers */
+
+        /* Filled by the hardware handler */
+        struct module *module;
+        const char *name;
+        int (*check_sense)(struct scsi_device *, struct scsi_sense_hdr *);
+        int (*attach)(struct scsi_device *);
+        void (*detach)(struct scsi_device *);
+        int (*activate)(struct scsi_device *, activate_complete, void *);
+        int (*prep_fn)(struct scsi_device *, struct request *);
+        int (*set_params)(struct scsi_device *, const char *);
+};
+
+#ifdef CONFIG_SCSI_DH
 extern int scsi_dh_activate(struct request_queue *, activate_complete, void *);
-extern int scsi_dh_handler_exist(const char *);
 extern int scsi_dh_attach(struct request_queue *, const char *);
-extern void scsi_dh_detach(struct request_queue *);
 extern const char *scsi_dh_attached_handler_name(struct request_queue *, gfp_t);
 extern int scsi_dh_set_params(struct request_queue *, const char *);
 #else
@@ -69,18 +84,10 @@ static inline int scsi_dh_activate(struct request_queue *req,
         fn(data, 0);
         return 0;
 }
-static inline int scsi_dh_handler_exist(const char *name)
-{
-        return 0;
-}
 static inline int scsi_dh_attach(struct request_queue *req, const char *name)
 {
         return SCSI_DH_NOSYS;
 }
-static inline void scsi_dh_detach(struct request_queue *q)
-{
-        return;
-}
 static inline const char *scsi_dh_attached_handler_name(struct request_queue *q,
                                                         gfp_t gfp)
 {
diff --git a/include/scsi/scsi_eh.h b/include/scsi/scsi_eh.h
index 8d1d7fa67ec4..dbb8c640e26f 100644
--- a/include/scsi/scsi_eh.h
+++ b/include/scsi/scsi_eh.h
@@ -4,6 +4,7 @@
 #include <linux/scatterlist.h>
 
 #include <scsi/scsi_cmnd.h>
+#include <scsi/scsi_common.h>
 struct scsi_device;
 struct Scsi_Host;
 
@@ -21,14 +22,9 @@ static inline bool scsi_sense_is_deferred(const struct scsi_sense_hdr *sshdr)
         return ((sshdr->response_code >= 0x70) && (sshdr->response_code & 1));
 }
 
-extern const u8 * scsi_sense_desc_find(const u8 * sense_buffer, int sb_len,
-                                       int desc_type);
-
 extern int scsi_get_sense_info_fld(const u8 * sense_buffer, int sb_len,
                                    u64 * info_out);
 
-extern void scsi_build_sense_buffer(int desc, u8 *buf, u8 key, u8 asc, u8 ascq);
-
 extern int scsi_ioctl_reset(struct scsi_device *, int __user *);
 
 struct scsi_eh_save {
diff --git a/include/target/iscsi/iscsi_target_core.h b/include/target/iscsi/iscsi_target_core.h
index 0aedbb2c10e0..373d3342002b 100644
--- a/include/target/iscsi/iscsi_target_core.h
+++ b/include/target/iscsi/iscsi_target_core.h
@@ -62,6 +62,8 @@
 /* T10 protection information disabled by default */
 #define TA_DEFAULT_T10_PI               0
 #define TA_DEFAULT_FABRIC_PROT_TYPE     0
+/* TPG status needs to be enabled to return sendtargets discovery endpoint info */
+#define TA_DEFAULT_TPG_ENABLED_SENDTARGETS 1
 
 #define ISCSI_IOV_DATA_BUFFER           5
 
@@ -517,7 +519,6 @@ struct iscsi_conn {
         u16                     cid;
         /* Remote TCP Port */
         u16                     login_port;
-        u16                     local_port;
         int                     net_size;
         int                     login_family;
         u32                     auth_id;
@@ -527,9 +528,8 @@ struct iscsi_conn {
         u32                     exp_statsn;
         /* Per connection status sequence number */
         u32                     stat_sn;
-#define IPV6_ADDRESS_SPACE                              48
-        unsigned char           login_ip[IPV6_ADDRESS_SPACE];
-        unsigned char           local_ip[IPV6_ADDRESS_SPACE];
+        struct sockaddr_storage login_sockaddr;
+        struct sockaddr_storage local_sockaddr;
         int                     conn_usage_count;
         int                     conn_waiting_on_uc;
         atomic_t                check_immediate_queue;
@@ -636,7 +636,7 @@ struct iscsi_session {
         /* session wide counter: expected command sequence number */
         u32                     exp_cmd_sn;
         /* session wide counter: maximum allowed command sequence number */
-        u32                     max_cmd_sn;
+        atomic_t                max_cmd_sn;
         struct list_head        sess_ooo_cmdsn_list;
 
         /* LIO specific session ID */
@@ -764,6 +764,7 @@ struct iscsi_tpg_attrib {
         u32                     default_erl;
         u8                      t10_pi;
         u32                     fabric_prot_type;
+        u32                     tpg_enabled_sendtargets;
         struct iscsi_portal_group *tpg;
 };
 
@@ -776,12 +777,10 @@ struct iscsi_np {
         enum iscsi_timer_flags_table np_login_timer_flags;
         u32                     np_exports;
         enum np_flags_table     np_flags;
-        unsigned char           np_ip[IPV6_ADDRESS_SPACE];
-        u16                     np_port;
         spinlock_t              np_thread_lock;
         struct completion       np_restart_comp;
         struct socket           *np_socket;
-        struct __kernel_sockaddr_storage np_sockaddr;
+        struct sockaddr_storage np_sockaddr;
         struct task_struct      *np_thread;
         struct timer_list       np_login_timer;
         void                    *np_context;
diff --git a/include/target/iscsi/iscsi_target_stat.h b/include/target/iscsi/iscsi_target_stat.h
index 3ff76b4faad3..e615bb485d0b 100644
--- a/include/target/iscsi/iscsi_target_stat.h
+++ b/include/target/iscsi/iscsi_target_stat.h
@@ -50,7 +50,7 @@ struct iscsi_login_stats {
         u64             last_fail_time;         /* time stamp (jiffies) */
         u32             last_fail_type;
         int             last_intr_fail_ip_family;
-        unsigned char   last_intr_fail_ip_addr[IPV6_ADDRESS_SPACE];
+        struct sockaddr_storage last_intr_fail_sockaddr;
         char            last_intr_fail_name[224];
 } ____cacheline_aligned;
 
diff --git a/include/target/iscsi/iscsi_transport.h b/include/target/iscsi/iscsi_transport.h
index e6bb166f12c2..90e37faa2ede 100644
--- a/include/target/iscsi/iscsi_transport.h
+++ b/include/target/iscsi/iscsi_transport.h
@@ -9,7 +9,7 @@ struct iscsit_transport {
         int priv_size;
         struct module *owner;
         struct list_head t_node;
-        int (*iscsit_setup_np)(struct iscsi_np *, struct __kernel_sockaddr_storage *);
+        int (*iscsit_setup_np)(struct iscsi_np *, struct sockaddr_storage *);
         int (*iscsit_accept_np)(struct iscsi_np *, struct iscsi_conn *);
         void (*iscsit_free_np)(struct iscsi_np *);
         void (*iscsit_wait_conn)(struct iscsi_conn *);
diff --git a/include/target/target_core_backend.h b/include/target/target_core_backend.h
index 1e5c8f949bae..56cf8e485ef2 100644
--- a/include/target/target_core_backend.h
+++ b/include/target/target_core_backend.h
@@ -93,4 +93,6 @@ bool	target_lun_is_rdonly(struct se_cmd *);
 sense_reason_t passthrough_parse_cdb(struct se_cmd *cmd,
         sense_reason_t (*exec_cmd)(struct se_cmd *cmd));
 
+bool target_sense_desc_format(struct se_device *dev);
+
 #endif /* TARGET_CORE_BACKEND_H */
diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
index 17ae2d6a4891..ac9bf1c0e42d 100644
--- a/include/target/target_core_base.h
+++ b/include/target/target_core_base.h
@@ -6,6 +6,7 @@
 #include <linux/dma-mapping.h>
 #include <linux/blkdev.h>
 #include <linux/percpu_ida.h>
+#include <linux/t10-pi.h>
 #include <net/sock.h>
 #include <net/tcp.h>
 
@@ -426,12 +427,6 @@ enum target_core_dif_check {
         TARGET_DIF_CHECK_REFTAG = 0x1 << 2,
 };
 
-struct se_dif_v1_tuple {
-        __be16                  guard_tag;
-        __be16                  app_tag;
-        __be32                  ref_tag;
-};
-
 /* for sam_task_attr */
 #define TCM_SIMPLE_TAG  0x20
 #define TCM_HEAD_TAG    0x21
@@ -444,6 +439,9 @@ struct se_cmd {
         u8                      scsi_asc;
         u8                      scsi_ascq;
         u16                     scsi_sense_length;
+        unsigned                cmd_wait_set:1;
+        unsigned                unknown_data_length:1;
+        bool                    state_active:1;
         u64                     tag; /* SAM command identifier aka task tag */
         /* Delay for ALUA Active/NonOptimized state access in milliseconds */
         int                     alua_nonop_delay;
@@ -455,11 +453,8 @@ struct se_cmd {
         unsigned int            map_tag;
         /* Transport protocol dependent state, see transport_state_table */
         enum transport_state_table t_state;
-        unsigned                cmd_wait_set:1;
-        unsigned                unknown_data_length:1;
         /* See se_cmd_flags_table */
         u32                     se_cmd_flags;
-        u32                     se_ordered_id;
         /* Total size in bytes associated with command */
         u32                     data_length;
         u32                     residual_count;
@@ -477,7 +472,6 @@ struct se_cmd {
         struct se_tmr_req       *se_tmr_req;
         struct list_head        se_cmd_list;
         struct completion       cmd_wait_comp;
-        struct kref             cmd_kref;
         const struct target_core_fabric_ops *se_tfo;
         sense_reason_t          (*execute_cmd)(struct se_cmd *);
         sense_reason_t (*transport_complete_callback)(struct se_cmd *, bool);
@@ -497,6 +491,7 @@ struct se_cmd {
 #define CMD_T_REQUEST_STOP      (1 << 8)
 #define CMD_T_BUSY              (1 << 9)
         spinlock_t              t_state_lock;
+        struct kref             cmd_kref;
         struct completion       t_transport_stop_comp;
 
         struct work_struct      work;
@@ -509,8 +504,10 @@ struct se_cmd {
         struct scatterlist      *t_bidi_data_sg;
         unsigned int            t_bidi_data_nents;
 
+        /* Used for lun->lun_ref counting */
+        int                     lun_ref_active;
+
         struct list_head        state_list;
-        bool                    state_active;
 
         /* old task stop completion, consider merging with some of the above */
         struct completion       task_stop_comp;
@@ -518,20 +515,17 @@ struct se_cmd {
         /* backend private data */
         void                    *priv;
 
-        /* Used for lun->lun_ref counting */
-        int                     lun_ref_active;
-
         /* DIF related members */
         enum target_prot_op     prot_op;
         enum target_prot_type   prot_type;
         u8                      prot_checks;
+        bool                    prot_pto;
         u32                     prot_length;
         u32                     reftag_seed;
         struct scatterlist      *t_prot_sg;
         unsigned int            t_prot_nents;
         sense_reason_t          pi_err;
         sector_t                bad_sector;
-        bool                    prot_pto;
 };
 
 struct se_ua {
@@ -598,7 +592,6 @@ struct se_ml_stat_grps {
 };
 
 struct se_lun_acl {
-        char                    initiatorname[TRANSPORT_IQN_LEN];
         u64                     mapped_lun;
         struct se_node_acl      *se_lun_nacl;
         struct se_lun           *se_lun;
@@ -685,7 +678,6 @@ struct se_lun {
 #define SE_LUN_LINK_MAGIC                       0xffff7771
         u32                     lun_link_magic;
         u32                     lun_access;
-        u32                     lun_flags;
         u32                     lun_index;
 
         /* RELATIVE TARGET PORT IDENTIFER */
@@ -751,7 +743,6 @@ struct se_device {
         atomic_long_t           write_bytes;
         /* Active commands on this virtual SE device */
         atomic_t                simple_cmds;
-        atomic_t                dev_ordered_id;
         atomic_t                dev_ordered_sync;
         atomic_t                dev_qf_count;
         u32                     export_count;
diff --git a/include/target/target_core_fabric.h b/include/target/target_core_fabric.h
index 18afef91b447..7fb2557a760e 100644
--- a/include/target/target_core_fabric.h
+++ b/include/target/target_core_fabric.h
@@ -5,6 +5,19 @@ struct target_core_fabric_ops {
         struct module *module;
         const char *name;
         size_t node_acl_size;
+        /*
+         * Limits number of scatterlist entries per SCF_SCSI_DATA_CDB payload.
+         * Setting this value tells target-core to enforce this limit, and
+         * report as INQUIRY EVPD=b0 MAXIMUM TRANSFER LENGTH.
+         *
+         * target-core will currently reset se_cmd->data_length to this
+         * maximum size, and set UNDERFLOW residual count if length exceeds
+         * this limit.
+         *
+         * XXX: Not all initiator hosts honor this block-limit EVPD
+         * XXX: Currently assumes single PAGE_SIZE per scatterlist entry
+         */
+        u32 max_data_sg_nents;
         char *(*get_fabric_name)(void);
         char *(*tpg_get_wwn)(struct se_portal_group *);
         u16 (*tpg_get_tag)(struct se_portal_group *);
@@ -152,6 +165,7 @@ int	transport_generic_handle_tmr(struct se_cmd *);
 void    transport_generic_request_failure(struct se_cmd *, sense_reason_t);
 void    __target_execute_cmd(struct se_cmd *);
 int     transport_lookup_tmr_lun(struct se_cmd *, u64);
+void    core_allocate_nexus_loss_ua(struct se_node_acl *acl);
 
 struct se_node_acl *core_tpg_get_initiator_node_acl(struct se_portal_group *tpg,
                 unsigned char *);
diff --git a/include/trace/events/thermal_power_allocator.h b/include/trace/events/thermal_power_allocator.h
index 12e1321c4e0c..5afae8fe3795 100644
--- a/include/trace/events/thermal_power_allocator.h
+++ b/include/trace/events/thermal_power_allocator.h
@@ -11,7 +11,7 @@ TRACE_EVENT(thermal_power_allocator,
                  u32 total_req_power, u32 *granted_power,
                  u32 total_granted_power, size_t num_actors,
                  u32 power_range, u32 max_allocatable_power,
-                 unsigned long current_temp, s32 delta_temp),
+                 int current_temp, s32 delta_temp),
         TP_ARGS(tz, req_power, total_req_power, granted_power,
                 total_granted_power, num_actors, power_range,
                 max_allocatable_power, current_temp, delta_temp),
@@ -24,7 +24,7 @@ TRACE_EVENT(thermal_power_allocator,
                 __field(size_t,        num_actors               )
                 __field(u32,           power_range              )
                 __field(u32,           max_allocatable_power    )
-                __field(unsigned long, current_temp             )
+                __field(int,           current_temp             )
                 __field(s32,           delta_temp               )
         ),
         TP_fast_assign(
@@ -42,7 +42,7 @@ TRACE_EVENT(thermal_power_allocator,
                 __entry->delta_temp = delta_temp;
         ),
 
-        TP_printk("thermal_zone_id=%d req_power={%s} total_req_power=%u granted_power={%s} total_granted_power=%u power_range=%u max_allocatable_power=%u current_temperature=%lu delta_temperature=%d",
+        TP_printk("thermal_zone_id=%d req_power={%s} total_req_power=%u granted_power={%s} total_granted_power=%u power_range=%u max_allocatable_power=%u current_temperature=%d delta_temperature=%d",
                 __entry->tz_id,
                 __print_array(__get_dynamic_array(req_power),
                               __entry->num_actors, 4),
diff --git a/include/uapi/asm-generic/unistd.h b/include/uapi/asm-generic/unistd.h
index e016bd9b1a04..ee124009e12a 100644
--- a/include/uapi/asm-generic/unistd.h
+++ b/include/uapi/asm-generic/unistd.h
@@ -709,15 +709,19 @@ __SYSCALL(__NR_memfd_create, sys_memfd_create)
 __SYSCALL(__NR_bpf, sys_bpf)
 #define __NR_execveat 281
 __SC_COMP(__NR_execveat, sys_execveat, compat_sys_execveat)
+#define __NR_userfaultfd 282
+__SYSCALL(__NR_userfaultfd, sys_userfaultfd)
+#define __NR_membarrier 283
+__SYSCALL(__NR_membarrier, sys_membarrier)
 
 #undef __NR_syscalls
-#define __NR_syscalls 282
+#define __NR_syscalls 284
 
 /*
  * All syscalls below here should go away really,
  * these are provided for both review and as a porting
  * help for the C library version.
-*
+ *
  * Last chance: are any of these important enough to
  * enable by default?
  */
diff --git a/include/uapi/linux/Kbuild b/include/uapi/linux/Kbuild
index 70ff1d9abf0d..f7b2db44eb4b 100644
--- a/include/uapi/linux/Kbuild
+++ b/include/uapi/linux/Kbuild
@@ -252,6 +252,7 @@ header-y += mdio.h
 header-y += media.h
 header-y += media-bus-format.h
 header-y += mei.h
+header-y += membarrier.h
 header-y += memfd.h
 header-y += mempolicy.h
 header-y += meye.h
diff --git a/include/uapi/linux/lwtunnel.h b/include/uapi/linux/lwtunnel.h
index 34141a5dfe74..f8b01887a495 100644
--- a/include/uapi/linux/lwtunnel.h
+++ b/include/uapi/linux/lwtunnel.h
@@ -21,8 +21,6 @@ enum lwtunnel_ip_t {
         LWTUNNEL_IP_SRC,
         LWTUNNEL_IP_TTL,
         LWTUNNEL_IP_TOS,
-        LWTUNNEL_IP_SPORT,
-        LWTUNNEL_IP_DPORT,
         LWTUNNEL_IP_FLAGS,
         __LWTUNNEL_IP_MAX,
 };
@@ -36,8 +34,6 @@ enum lwtunnel_ip6_t {
         LWTUNNEL_IP6_SRC,
         LWTUNNEL_IP6_HOPLIMIT,
         LWTUNNEL_IP6_TC,
-        LWTUNNEL_IP6_SPORT,
-        LWTUNNEL_IP6_DPORT,
         LWTUNNEL_IP6_FLAGS,
         __LWTUNNEL_IP6_MAX,
 };
diff --git a/include/uapi/linux/membarrier.h b/include/uapi/linux/membarrier.h
new file mode 100644
index 000000000000..e0b108bd2624
--- /dev/null
+++ b/include/uapi/linux/membarrier.h
@@ -0,0 +1,53 @@
+#ifndef _UAPI_LINUX_MEMBARRIER_H
+#define _UAPI_LINUX_MEMBARRIER_H
+
+/*
+ * linux/membarrier.h
+ *
+ * membarrier system call API
+ *
+ * Copyright (c) 2010, 2015 Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+/**
+ * enum membarrier_cmd - membarrier system call command
+ * @MEMBARRIER_CMD_QUERY:   Query the set of supported commands. It returns
+ *                          a bitmask of valid commands.
+ * @MEMBARRIER_CMD_SHARED:  Execute a memory barrier on all running threads.
+ *                          Upon return from system call, the caller thread
+ *                          is ensured that all running threads have passed
+ *                          through a state where all memory accesses to
+ *                          user-space addresses match program order between
+ *                          entry to and return from the system call
+ *                          (non-running threads are de facto in such a
+ *                          state). This covers threads from all processes
+ *                          running on the system. This command returns 0.
+ *
+ * Command to be passed to the membarrier system call. The commands need to
+ * be a single bit each, except for MEMBARRIER_CMD_QUERY which is assigned to
+ * the value 0.
+ */
+enum membarrier_cmd {
+        MEMBARRIER_CMD_QUERY = 0,
+        MEMBARRIER_CMD_SHARED = (1 << 0),
+};
+
+#endif /* _UAPI_LINUX_MEMBARRIER_H */
diff --git a/include/uapi/linux/target_core_user.h b/include/uapi/linux/target_core_user.h
index b67f99d3c520..95c6521d8a95 100644
--- a/include/uapi/linux/target_core_user.h
+++ b/include/uapi/linux/target_core_user.h
@@ -42,10 +42,6 @@
 #define TCMU_MAILBOX_VERSION 2
 #define ALIGN_SIZE 64 /* Should be enough for most CPUs */
 
-/* See https://gcc.gnu.org/onlinedocs/cpp/Stringification.html */
-#define xstr(s) str(s)
-#define str(s) #s
-
 struct tcmu_mailbox {
         __u16 version;
         __u16 flags;
diff --git a/init/Kconfig b/init/Kconfig
index 02da9f1fd9df..c24b6f767bf0 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -1602,6 +1602,18 @@ config PCI_QUIRKS
           bugs/quirks. Disable this only if your target machine is
           unaffected by PCI quirks.
 
+config MEMBARRIER
+        bool "Enable membarrier() system call" if EXPERT
+        default y
+        help
+          Enable the membarrier() system call that allows issuing memory
+          barriers across all running threads, which can be used to distribute
+          the cost of user-space memory barriers asymmetrically by transforming
+          pairs of memory barriers into pairs consisting of membarrier() and a
+          compiler barrier.
+
+          If unsure, say Y.
+
 config EMBEDDED
         bool "Embedded system"
         option allnoconfig_y
diff --git a/kernel/Makefile b/kernel/Makefile
index d4988410b410..53abf008ecb3 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -100,6 +100,7 @@ obj-$(CONFIG_CRASH_DUMP) += crash_dump.o
 obj-$(CONFIG_JUMP_LABEL) += jump_label.o
 obj-$(CONFIG_CONTEXT_TRACKING) += context_tracking.o
 obj-$(CONFIG_TORTURE_TEST) += torture.o
+obj-$(CONFIG_MEMBARRIER) += membarrier.o
 
 obj-$(CONFIG_HAS_IOMEM) += memremap.o
 
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 2cf0f79f1fc9..2c9eae6ad970 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -46,7 +46,6 @@
 #include <linux/slab.h>
 #include <linux/spinlock.h>
 #include <linux/rwsem.h>
-#include <linux/percpu-rwsem.h>
 #include <linux/string.h>
 #include <linux/sort.h>
 #include <linux/kmod.h>
@@ -104,8 +103,6 @@ static DEFINE_SPINLOCK(cgroup_idr_lock);
  */
 static DEFINE_SPINLOCK(release_agent_path_lock);
 
-struct percpu_rw_semaphore cgroup_threadgroup_rwsem;
-
 #define cgroup_assert_mutex_or_rcu_locked()                             \
         RCU_LOCKDEP_WARN(!rcu_read_lock_held() &&                       \
                            !lockdep_is_held(&cgroup_mutex),             \
@@ -874,6 +871,48 @@ static struct css_set *find_css_set(struct css_set *old_cset,
         return cset;
 }
 
+void cgroup_threadgroup_change_begin(struct task_struct *tsk)
+{
+        down_read(&tsk->signal->group_rwsem);
+}
+
+void cgroup_threadgroup_change_end(struct task_struct *tsk)
+{
+        up_read(&tsk->signal->group_rwsem);
+}
+
+/**
+ * threadgroup_lock - lock threadgroup
+ * @tsk: member task of the threadgroup to lock
+ *
+ * Lock the threadgroup @tsk belongs to.  No new task is allowed to enter
+ * and member tasks aren't allowed to exit (as indicated by PF_EXITING) or
+ * change ->group_leader/pid.  This is useful for cases where the threadgroup
+ * needs to stay stable across blockable operations.
+ *
+ * fork and exit explicitly call threadgroup_change_{begin|end}() for
+ * synchronization.  While held, no new task will be added to threadgroup
+ * and no existing live task will have its PF_EXITING set.
+ *
+ * de_thread() does threadgroup_change_{begin|end}() when a non-leader
+ * sub-thread becomes a new leader.
+ */
+static void threadgroup_lock(struct task_struct *tsk)
+{
+        down_write(&tsk->signal->group_rwsem);
+}
+
+/**
+ * threadgroup_unlock - unlock threadgroup
+ * @tsk: member task of the threadgroup to unlock
+ *
+ * Reverse threadgroup_lock().
+ */
+static inline void threadgroup_unlock(struct task_struct *tsk)
+{
+        up_write(&tsk->signal->group_rwsem);
+}
+
 static struct cgroup_root *cgroup_root_from_kf(struct kernfs_root *kf_root)
 {
         struct cgroup *root_cgrp = kf_root->kn->priv;
@@ -2074,9 +2113,9 @@ static void cgroup_task_migrate(struct cgroup *old_cgrp,
         lockdep_assert_held(&css_set_rwsem);
 
         /*
-         * We are synchronized through cgroup_threadgroup_rwsem against
-         * PF_EXITING setting such that we can't race against cgroup_exit()
-         * changing the css_set to init_css_set and dropping the old one.
+         * We are synchronized through threadgroup_lock() against PF_EXITING
+         * setting such that we can't race against cgroup_exit() changing the
+         * css_set to init_css_set and dropping the old one.
          */
         WARN_ON_ONCE(tsk->flags & PF_EXITING);
         old_cset = task_css_set(tsk);
@@ -2133,11 +2172,10 @@ static void cgroup_migrate_finish(struct list_head *preloaded_csets)
  * @src_cset and add it to @preloaded_csets, which should later be cleaned
  * up by cgroup_migrate_finish().
  *
- * This function may be called without holding cgroup_threadgroup_rwsem
- * even if the target is a process.  Threads may be created and destroyed
- * but as long as cgroup_mutex is not dropped, no new css_set can be put
- * into play and the preloaded css_sets are guaranteed to cover all
- * migrations.
+ * This function may be called without holding threadgroup_lock even if the
+ * target is a process.  Threads may be created and destroyed but as long
+ * as cgroup_mutex is not dropped, no new css_set can be put into play and
+ * the preloaded css_sets are guaranteed to cover all migrations.
  */
 static void cgroup_migrate_add_src(struct css_set *src_cset,
                                    struct cgroup *dst_cgrp,
@@ -2240,7 +2278,7 @@ err:
  * @threadgroup: whether @leader points to the whole process or a single task
  *
  * Migrate a process or task denoted by @leader to @cgrp.  If migrating a
- * process, the caller must be holding cgroup_threadgroup_rwsem.  The
+ * process, the caller must be holding threadgroup_lock of @leader.  The
  * caller is also responsible for invoking cgroup_migrate_add_src() and
  * cgroup_migrate_prepare_dst() on the targets before invoking this
  * function and following up with cgroup_migrate_finish().
@@ -2368,7 +2406,7 @@ out_release_tset:
  * @leader: the task or the leader of the threadgroup to be attached
  * @threadgroup: attach the whole threadgroup?
  *
- * Call holding cgroup_mutex and cgroup_threadgroup_rwsem.
+ * Call holding cgroup_mutex and threadgroup_lock of @leader.
  */
 static int cgroup_attach_task(struct cgroup *dst_cgrp,
                               struct task_struct *leader, bool threadgroup)
@@ -2460,13 +2498,14 @@ static ssize_t __cgroup_procs_write(struct kernfs_open_file *of, char *buf,
         if (!cgrp)
                 return -ENODEV;
 
-        percpu_down_write(&cgroup_threadgroup_rwsem);
+retry_find_task:
         rcu_read_lock();
         if (pid) {
                 tsk = find_task_by_vpid(pid);
                 if (!tsk) {
+                        rcu_read_unlock();
                         ret = -ESRCH;
-                        goto out_unlock_rcu;
+                        goto out_unlock_cgroup;
                 }
         } else {
                 tsk = current;
@@ -2482,23 +2521,37 @@ static ssize_t __cgroup_procs_write(struct kernfs_open_file *of, char *buf,
          */
         if (tsk == kthreadd_task || (tsk->flags & PF_NO_SETAFFINITY)) {
                 ret = -EINVAL;
-                goto out_unlock_rcu;
+                rcu_read_unlock();
+                goto out_unlock_cgroup;
         }
 
         get_task_struct(tsk);
         rcu_read_unlock();
 
+        threadgroup_lock(tsk);
+        if (threadgroup) {
+                if (!thread_group_leader(tsk)) {
+                        /*
+                         * a race with de_thread from another thread's exec()
+                         * may strip us of our leadership, if this happens,
+                         * there is no choice but to throw this task away and
+                         * try again; this is
+                         * "double-double-toil-and-trouble-check locking".
+                         */
+                        threadgroup_unlock(tsk);
+                        put_task_struct(tsk);
+                        goto retry_find_task;
+                }
+        }
+
         ret = cgroup_procs_write_permission(tsk, cgrp, of);
         if (!ret)
                 ret = cgroup_attach_task(cgrp, tsk, threadgroup);
 
-        put_task_struct(tsk);
-        goto out_unlock_threadgroup;
+        threadgroup_unlock(tsk);
 
-out_unlock_rcu:
-        rcu_read_unlock();
-out_unlock_threadgroup:
-        percpu_up_write(&cgroup_threadgroup_rwsem);
+        put_task_struct(tsk);
+out_unlock_cgroup:
         cgroup_kn_unlock(of->kn);
         return ret ?: nbytes;
 }
@@ -2643,8 +2696,6 @@ static int cgroup_update_dfl_csses(struct cgroup *cgrp)
 
         lockdep_assert_held(&cgroup_mutex);
 
-        percpu_down_write(&cgroup_threadgroup_rwsem);
-
         /* look up all csses currently attached to @cgrp's subtree */
         down_read(&css_set_rwsem);
         css_for_each_descendant_pre(css, cgroup_css(cgrp, NULL)) {
@@ -2700,8 +2751,17 @@ static int cgroup_update_dfl_csses(struct cgroup *cgrp)
                                 goto out_finish;
                         last_task = task;
 
+                        threadgroup_lock(task);
+                        /* raced against de_thread() from another thread? */
+                        if (!thread_group_leader(task)) {
+                                threadgroup_unlock(task);
+                                put_task_struct(task);
+                                continue;
+                        }
+
                         ret = cgroup_migrate(src_cset->dfl_cgrp, task, true);
 
+                        threadgroup_unlock(task);
                         put_task_struct(task);
 
                         if (WARN(ret, "cgroup: failed to update controllers for the default hierarchy (%d), further operations may crash or hang\n", ret))
@@ -2711,7 +2771,6 @@ static int cgroup_update_dfl_csses(struct cgroup *cgrp)
 
 out_finish:
         cgroup_migrate_finish(&preloaded_csets);
-        percpu_up_write(&cgroup_threadgroup_rwsem);
         return ret;
 }
 
@@ -5024,7 +5083,6 @@ int __init cgroup_init(void)
         unsigned long key;
         int ssid, err;
 
-        BUG_ON(percpu_init_rwsem(&cgroup_threadgroup_rwsem));
         BUG_ON(cgroup_init_cftypes(NULL, cgroup_dfl_base_files));
         BUG_ON(cgroup_init_cftypes(NULL, cgroup_legacy_base_files));
 
diff --git a/kernel/cpu_pm.c b/kernel/cpu_pm.c
index 9656a3c36503..009cc9a17d95 100644
--- a/kernel/cpu_pm.c
+++ b/kernel/cpu_pm.c
@@ -180,7 +180,7 @@ EXPORT_SYMBOL_GPL(cpu_cluster_pm_enter);
  * low power state that may have caused some blocks in the same power domain
  * to reset.
  *
- * Must be called after cpu_pm_exit has been called on all cpus in the power
+ * Must be called after cpu_cluster_pm_enter has been called for the power
  * domain, and before cpu_pm_exit has been called on any cpu in the power
  * domain. Notified drivers can include VFP co-processor, interrupt controller
  * and its PM extensions, local CPU timers context save/restore which
diff --git a/kernel/fork.c b/kernel/fork.c
index 7d5f0f118a63..2845623fb582 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1149,6 +1149,10 @@ static int copy_signal(unsigned long clone_flags, struct task_struct *tsk)
         tty_audit_fork(sig);
         sched_autogroup_fork(sig);
 
+#ifdef CONFIG_CGROUPS
+        init_rwsem(&sig->group_rwsem);
+#endif
+
         sig->oom_score_adj = current->signal->oom_score_adj;
         sig->oom_score_adj_min = current->signal->oom_score_adj_min;
 
diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
index 6e40a9539763..e28169dd1c36 100644
--- a/kernel/irq/chip.c
+++ b/kernel/irq/chip.c
@@ -83,7 +83,7 @@ int irq_set_handler_data(unsigned int irq, void *data)
 
         if (!desc)
                 return -EINVAL;
-        desc->irq_data.handler_data = data;
+        desc->irq_common_data.handler_data = data;
         irq_put_desc_unlock(desc, flags);
         return 0;
 }
@@ -105,7 +105,7 @@ int irq_set_msi_desc_off(unsigned int irq_base, unsigned int irq_offset,
 
         if (!desc)
                 return -EINVAL;
-        desc->irq_data.msi_desc = entry;
+        desc->irq_common_data.msi_desc = entry;
         if (entry && !irq_offset)
                 entry->irq = irq_base;
         irq_put_desc_unlock(desc, flags);
@@ -372,7 +372,6 @@ static bool irq_may_run(struct irq_desc *desc)
 
 /**
  *      handle_simple_irq - Simple and software-decoded IRQs.
- *      @irq:   the interrupt number
  *      @desc:  the interrupt description structure for this irq
  *
  *      Simple interrupts are either sent from a demultiplexing interrupt
@@ -382,8 +381,7 @@ static bool irq_may_run(struct irq_desc *desc)
  *      Note: The caller is expected to handle the ack, clear, mask and
  *      unmask issues if necessary.
  */
-void
-handle_simple_irq(unsigned int irq, struct irq_desc *desc)
+void handle_simple_irq(struct irq_desc *desc)
 {
         raw_spin_lock(&desc->lock);
 
@@ -425,7 +423,6 @@ static void cond_unmask_irq(struct irq_desc *desc)
 
 /**
  *      handle_level_irq - Level type irq handler
- *      @irq:   the interrupt number
  *      @desc:  the interrupt description structure for this irq
  *
  *      Level type interrupts are active as long as the hardware line has
@@ -433,8 +430,7 @@ static void cond_unmask_irq(struct irq_desc *desc)
  *      it after the associated handler has acknowledged the device, so the
  *      interrupt line is back to inactive.
  */
-void
-handle_level_irq(unsigned int irq, struct irq_desc *desc)
+void handle_level_irq(struct irq_desc *desc)
 {
         raw_spin_lock(&desc->lock);
         mask_ack_irq(desc);
@@ -496,7 +492,6 @@ static void cond_unmask_eoi_irq(struct irq_desc *desc, struct irq_chip *chip)
 
 /**
  *      handle_fasteoi_irq - irq handler for transparent controllers
- *      @irq:   the interrupt number
  *      @desc:  the interrupt description structure for this irq
  *
  *      Only a single callback will be issued to the chip: an ->eoi()
@@ -504,8 +499,7 @@ static void cond_unmask_eoi_irq(struct irq_desc *desc, struct irq_chip *chip)
  *      for modern forms of interrupt handlers, which handle the flow
  *      details in hardware, transparently.
  */
-void
-handle_fasteoi_irq(unsigned int irq, struct irq_desc *desc)
+void handle_fasteoi_irq(struct irq_desc *desc)
 {
         struct irq_chip *chip = desc->irq_data.chip;
 
@@ -546,7 +540,6 @@ EXPORT_SYMBOL_GPL(handle_fasteoi_irq);
 
 /**
  *      handle_edge_irq - edge type IRQ handler
- *      @irq:   the interrupt number
  *      @desc:  the interrupt description structure for this irq
  *
  *      Interrupt occures on the falling and/or rising edge of a hardware
@@ -560,8 +553,7 @@ EXPORT_SYMBOL_GPL(handle_fasteoi_irq);
  *      the handler was running. If all pending interrupts are handled, the
  *      loop is left.
  */
-void
-handle_edge_irq(unsigned int irq, struct irq_desc *desc)
+void handle_edge_irq(struct irq_desc *desc)
 {
         raw_spin_lock(&desc->lock);
 
@@ -618,13 +610,12 @@ EXPORT_SYMBOL(handle_edge_irq);
 #ifdef CONFIG_IRQ_EDGE_EOI_HANDLER
 /**
  *      handle_edge_eoi_irq - edge eoi type IRQ handler
- *      @irq:   the interrupt number
  *      @desc:  the interrupt description structure for this irq
  *
  * Similar as the above handle_edge_irq, but using eoi and w/o the
  * mask/unmask logic.
  */
-void handle_edge_eoi_irq(unsigned int irq, struct irq_desc *desc)
+void handle_edge_eoi_irq(struct irq_desc *desc)
 {
         struct irq_chip *chip = irq_desc_get_chip(desc);
 
@@ -665,13 +656,11 @@ out_eoi:
 
 /**
  *      handle_percpu_irq - Per CPU local irq handler
- *      @irq:   the interrupt number
  *      @desc:  the interrupt description structure for this irq
  *
  *      Per CPU interrupts on SMP machines without locking requirements
  */
-void
-handle_percpu_irq(unsigned int irq, struct irq_desc *desc)
+void handle_percpu_irq(struct irq_desc *desc)
 {
         struct irq_chip *chip = irq_desc_get_chip(desc);
 
@@ -688,7 +677,6 @@ handle_percpu_irq(unsigned int irq, struct irq_desc *desc)
 
 /**
  * handle_percpu_devid_irq - Per CPU local irq handler with per cpu dev ids
- * @irq:        the interrupt number
  * @desc:       the interrupt description structure for this irq
  *
  * Per CPU interrupts on SMP machines without locking requirements. Same as
@@ -698,11 +686,12 @@ handle_percpu_irq(unsigned int irq, struct irq_desc *desc)
  * contain the real device id for the cpu on which this handler is
  * called
  */
-void handle_percpu_devid_irq(unsigned int irq, struct irq_desc *desc)
+void handle_percpu_devid_irq(struct irq_desc *desc)
 {
         struct irq_chip *chip = irq_desc_get_chip(desc);
         struct irqaction *action = desc->action;
         void *dev_id = raw_cpu_ptr(action->percpu_dev_id);
+        unsigned int irq = irq_desc_get_irq(desc);
         irqreturn_t res;
 
         kstat_incr_irqs_this_cpu(desc);
@@ -796,7 +785,7 @@ irq_set_chained_handler_and_data(unsigned int irq, irq_flow_handler_t handle,
                 return;
 
         __irq_do_set_handler(desc, handle, 1, NULL);
-        desc->irq_data.handler_data = data;
+        desc->irq_common_data.handler_data = data;
 
         irq_put_desc_busunlock(desc, flags);
 }
diff --git a/kernel/irq/handle.c b/kernel/irq/handle.c
index b6eeea8a80c5..de41a68fc038 100644
--- a/kernel/irq/handle.c
+++ b/kernel/irq/handle.c
@@ -27,8 +27,10 @@
  *
  * Handles spurious and unhandled IRQ's. It also prints a debugmessage.
  */
-void handle_bad_irq(unsigned int irq, struct irq_desc *desc)
+void handle_bad_irq(struct irq_desc *desc)
 {
+        unsigned int irq = irq_desc_get_irq(desc);
+
         print_irq_desc(irq, desc);
         kstat_incr_irqs_this_cpu(desc);
         ack_bad_irq(irq);
diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h
index eee4b385cffb..5ef0c2dbe930 100644
--- a/kernel/irq/internals.h
+++ b/kernel/irq/internals.h
@@ -194,7 +194,7 @@ static inline void kstat_incr_irqs_this_cpu(struct irq_desc *desc)
 
 static inline int irq_desc_get_node(struct irq_desc *desc)
 {
-        return irq_data_get_node(&desc->irq_data);
+        return irq_common_data_get_node(&desc->irq_common_data);
 }
 
 #ifdef CONFIG_PM_SLEEP
diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c
index 0a2a4b697bcb..239e2ae2c947 100644
--- a/kernel/irq/irqdesc.c
+++ b/kernel/irq/irqdesc.c
@@ -38,12 +38,13 @@ static void __init init_irq_default_affinity(void)
 #ifdef CONFIG_SMP
 static int alloc_masks(struct irq_desc *desc, gfp_t gfp, int node)
 {
-        if (!zalloc_cpumask_var_node(&desc->irq_data.affinity, gfp, node))
+        if (!zalloc_cpumask_var_node(&desc->irq_common_data.affinity,
+                                     gfp, node))
                 return -ENOMEM;
 
 #ifdef CONFIG_GENERIC_PENDING_IRQ
         if (!zalloc_cpumask_var_node(&desc->pending_mask, gfp, node)) {
-                free_cpumask_var(desc->irq_data.affinity);
+                free_cpumask_var(desc->irq_common_data.affinity);
                 return -ENOMEM;
         }
 #endif
@@ -52,11 +53,13 @@ static int alloc_masks(struct irq_desc *desc, gfp_t gfp, int node)
 
 static void desc_smp_init(struct irq_desc *desc, int node)
 {
-        desc->irq_data.node = node;
-        cpumask_copy(desc->irq_data.affinity, irq_default_affinity);
+        cpumask_copy(desc->irq_common_data.affinity, irq_default_affinity);
 #ifdef CONFIG_GENERIC_PENDING_IRQ
         cpumask_clear(desc->pending_mask);
 #endif
+#ifdef CONFIG_NUMA
+        desc->irq_common_data.node = node;
+#endif
 }
 
 #else
@@ -70,12 +73,13 @@ static void desc_set_defaults(unsigned int irq, struct irq_desc *desc, int node,
 {
         int cpu;
 
+        desc->irq_common_data.handler_data = NULL;
+        desc->irq_common_data.msi_desc = NULL;
+
         desc->irq_data.common = &desc->irq_common_data;
         desc->irq_data.irq = irq;
         desc->irq_data.chip = &no_irq_chip;
         desc->irq_data.chip_data = NULL;
-        desc->irq_data.handler_data = NULL;
-        desc->irq_data.msi_desc = NULL;
         irq_settings_clr_and_set(desc, ~0, _IRQ_DEFAULT_INIT_FLAGS);
         irqd_set(&desc->irq_data, IRQD_IRQ_DISABLED);
         desc->handle_irq = handle_bad_irq;
@@ -121,7 +125,7 @@ static void free_masks(struct irq_desc *desc)
 #ifdef CONFIG_GENERIC_PENDING_IRQ
         free_cpumask_var(desc->pending_mask);
 #endif
-        free_cpumask_var(desc->irq_data.affinity);
+        free_cpumask_var(desc->irq_common_data.affinity);
 }
 #else
 static inline void free_masks(struct irq_desc *desc) { }
@@ -343,7 +347,7 @@ int generic_handle_irq(unsigned int irq)
 
         if (!desc)
                 return -EINVAL;
-        generic_handle_irq_desc(irq, desc);
+        generic_handle_irq_desc(desc);
         return 0;
 }
 EXPORT_SYMBOL_GPL(generic_handle_irq);
diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
index 79baaf8a7813..dc9d27c0c158 100644
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -844,7 +844,6 @@ static struct irq_data *irq_domain_insert_irq_data(struct irq_domain *domain,
                 child->parent_data = irq_data;
                 irq_data->irq = child->irq;
                 irq_data->common = child->common;
-                irq_data->node = child->node;
                 irq_data->domain = domain;
         }
 
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index ad1b064f94fe..f9a59f6cabd2 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -192,7 +192,7 @@ int irq_do_set_affinity(struct irq_data *data, const struct cpumask *mask,
         switch (ret) {
         case IRQ_SET_MASK_OK:
         case IRQ_SET_MASK_OK_DONE:
-                cpumask_copy(data->affinity, mask);
+                cpumask_copy(desc->irq_common_data.affinity, mask);
         case IRQ_SET_MASK_OK_NOCOPY:
                 irq_set_thread_affinity(desc);
                 ret = 0;
@@ -304,7 +304,7 @@ static void irq_affinity_notify(struct work_struct *work)
         if (irq_move_pending(&desc->irq_data))
                 irq_get_pending(cpumask, desc);
         else
-                cpumask_copy(cpumask, desc->irq_data.affinity);
+                cpumask_copy(cpumask, desc->irq_common_data.affinity);
         raw_spin_unlock_irqrestore(&desc->lock, flags);
 
         notify->notify(notify, cpumask);
@@ -375,9 +375,9 @@ static int setup_affinity(struct irq_desc *desc, struct cpumask *mask)
          * one of the targets is online.
          */
         if (irqd_has_set(&desc->irq_data, IRQD_AFFINITY_SET)) {
-                if (cpumask_intersects(desc->irq_data.affinity,
+                if (cpumask_intersects(desc->irq_common_data.affinity,
                                        cpu_online_mask))
-                        set = desc->irq_data.affinity;
+                        set = desc->irq_common_data.affinity;
                 else
                         irqd_clear(&desc->irq_data, IRQD_AFFINITY_SET);
         }
@@ -829,8 +829,8 @@ irq_thread_check_affinity(struct irq_desc *desc, struct irqaction *action)
          * This code is triggered unconditionally. Check the affinity
          * mask pointer. For CPU_MASK_OFFSTACK=n this is optimized out.
          */
-        if (desc->irq_data.affinity)
-                cpumask_copy(mask, desc->irq_data.affinity);
+        if (desc->irq_common_data.affinity)
+                cpumask_copy(mask, desc->irq_common_data.affinity);
         else
                 valid = false;
         raw_spin_unlock_irq(&desc->lock);
diff --git a/kernel/irq/proc.c b/kernel/irq/proc.c
index 0e97c142ce40..e3a8c9577ba6 100644
--- a/kernel/irq/proc.c
+++ b/kernel/irq/proc.c
@@ -39,7 +39,7 @@ static struct proc_dir_entry *root_irq_dir;
 static int show_irq_affinity(int type, struct seq_file *m, void *v)
 {
         struct irq_desc *desc = irq_to_desc((long)m->private);
-        const struct cpumask *mask = desc->irq_data.affinity;
+        const struct cpumask *mask = desc->irq_common_data.affinity;
 
 #ifdef CONFIG_GENERIC_PENDING_IRQ
         if (irqd_is_setaffinity_pending(&desc->irq_data))
diff --git a/kernel/irq/resend.c b/kernel/irq/resend.c
index dd95f44f99b2..b86886beee4f 100644
--- a/kernel/irq/resend.c
+++ b/kernel/irq/resend.c
@@ -38,7 +38,7 @@ static void resend_irqs(unsigned long arg)
                 clear_bit(irq, irqs_resend);
                 desc = irq_to_desc(irq);
                 local_irq_disable();
-                desc->handle_irq(irq, desc);
+                desc->handle_irq(desc);
                 local_irq_enable();
         }
 }
diff --git a/kernel/locking/qspinlock.c b/kernel/locking/qspinlock.c
index 337c8818541d..87e9ce6a63c5 100644
--- a/kernel/locking/qspinlock.c
+++ b/kernel/locking/qspinlock.c
@@ -289,7 +289,7 @@ void queued_spin_lock_slowpath(struct qspinlock *lock, u32 val)
         if (pv_enabled())
                 goto queue;
 
-        if (virt_queued_spin_lock(lock))
+        if (virt_spin_lock(lock))
                 return;
 
         /*
diff --git a/kernel/membarrier.c b/kernel/membarrier.c
new file mode 100644
index 000000000000..536c727a56e9
--- /dev/null
+++ b/kernel/membarrier.c
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2010, 2015 Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+ *
+ * membarrier system call
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <linux/syscalls.h>
+#include <linux/membarrier.h>
+
+/*
+ * Bitmask made from a "or" of all commands within enum membarrier_cmd,
+ * except MEMBARRIER_CMD_QUERY.
+ */
+#define MEMBARRIER_CMD_BITMASK  (MEMBARRIER_CMD_SHARED)
+
+/**
+ * sys_membarrier - issue memory barriers on a set of threads
+ * @cmd:   Takes command values defined in enum membarrier_cmd.
+ * @flags: Currently needs to be 0. For future extensions.
+ *
+ * If this system call is not implemented, -ENOSYS is returned. If the
+ * command specified does not exist, or if the command argument is invalid,
+ * this system call returns -EINVAL. For a given command, with flags argument
+ * set to 0, this system call is guaranteed to always return the same value
+ * until reboot.
+ *
+ * All memory accesses performed in program order from each targeted thread
+ * is guaranteed to be ordered with respect to sys_membarrier(). If we use
+ * the semantic "barrier()" to represent a compiler barrier forcing memory
+ * accesses to be performed in program order across the barrier, and
+ * smp_mb() to represent explicit memory barriers forcing full memory
+ * ordering across the barrier, we have the following ordering table for
+ * each pair of barrier(), sys_membarrier() and smp_mb():
+ *
+ * The pair ordering is detailed as (O: ordered, X: not ordered):
+ *
+ *                        barrier()   smp_mb() sys_membarrier()
+ *        barrier()          X           X            O
+ *        smp_mb()           X           O            O
+ *        sys_membarrier()   O           O            O
+ */
+SYSCALL_DEFINE2(membarrier, int, cmd, int, flags)
+{
+        if (unlikely(flags))
+                return -EINVAL;
+        switch (cmd) {
+        case MEMBARRIER_CMD_QUERY:
+                return MEMBARRIER_CMD_BITMASK;
+        case MEMBARRIER_CMD_SHARED:
+                if (num_online_cpus() > 1)
+                        synchronize_sched();
+                return 0;
+        default:
+                return -EINVAL;
+        }
+}
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 3595403921bd..2f9c92884817 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -621,18 +621,21 @@ int get_nohz_timer_target(void)
         int i, cpu = smp_processor_id();
         struct sched_domain *sd;
 
-        if (!idle_cpu(cpu))
+        if (!idle_cpu(cpu) && is_housekeeping_cpu(cpu))
                 return cpu;
 
         rcu_read_lock();
         for_each_domain(cpu, sd) {
                 for_each_cpu(i, sched_domain_span(sd)) {
-                        if (!idle_cpu(i)) {
+                        if (!idle_cpu(i) && is_housekeeping_cpu(cpu)) {
                                 cpu = i;
                                 goto unlock;
                         }
                 }
         }
+
+        if (!is_housekeeping_cpu(cpu))
+                cpu = housekeeping_any_cpu();
 unlock:
         rcu_read_unlock();
         return cpu;
@@ -2666,13 +2669,20 @@ unsigned long nr_running(void)
 
 /*
  * Check if only the current task is running on the cpu.
+ *
+ * Caution: this function does not check that the caller has disabled
+ * preemption, thus the result might have a time-of-check-to-time-of-use
+ * race.  The caller is responsible to use it correctly, for example:
+ *
+ * - from a non-preemptable section (of course)
+ *
+ * - from a thread that is bound to a single CPU
+ *
+ * - in a loop with very short iterations (e.g. a polling loop)
  */
 bool single_task_running(void)
 {
-        if (cpu_rq(smp_processor_id())->nr_running == 1)
-                return true;
-        else
-                return false;
+        return raw_rq()->nr_running == 1;
 }
 EXPORT_SYMBOL(single_task_running);
 
@@ -5178,24 +5188,47 @@ static void migrate_tasks(struct rq *dead_rq)
                         break;
 
                 /*
-                 * Ensure rq->lock covers the entire task selection
-                 * until the migration.
+                 * pick_next_task assumes pinned rq->lock.
                  */
                 lockdep_pin_lock(&rq->lock);
                 next = pick_next_task(rq, &fake_task);
                 BUG_ON(!next);
                 next->sched_class->put_prev_task(rq, next);
 
+                /*
+                 * Rules for changing task_struct::cpus_allowed are holding
+                 * both pi_lock and rq->lock, such that holding either
+                 * stabilizes the mask.
+                 *
+                 * Drop rq->lock is not quite as disastrous as it usually is
+                 * because !cpu_active at this point, which means load-balance
+                 * will not interfere. Also, stop-machine.
+                 */
+                lockdep_unpin_lock(&rq->lock);
+                raw_spin_unlock(&rq->lock);
+                raw_spin_lock(&next->pi_lock);
+                raw_spin_lock(&rq->lock);
+
+                /*
+                 * Since we're inside stop-machine, _nothing_ should have
+                 * changed the task, WARN if weird stuff happened, because in
+                 * that case the above rq->lock drop is a fail too.
+                 */
+                if (WARN_ON(task_rq(next) != rq || !task_on_rq_queued(next))) {
+                        raw_spin_unlock(&next->pi_lock);
+                        continue;
+                }
+
                 /* Find suitable destination for @next, with force if needed. */
                 dest_cpu = select_fallback_rq(dead_rq->cpu, next);
 
-                lockdep_unpin_lock(&rq->lock);
                 rq = __migrate_task(rq, next, dest_cpu);
                 if (rq != dead_rq) {
                         raw_spin_unlock(&rq->lock);
                         rq = dead_rq;
                         raw_spin_lock(&rq->lock);
                 }
+                raw_spin_unlock(&next->pi_lock);
         }
 
         rq->stop = stop;
diff --git a/kernel/sched/wait.c b/kernel/sched/wait.c
index 272d9322bc5d..052e02672d12 100644
--- a/kernel/sched/wait.c
+++ b/kernel/sched/wait.c
@@ -106,10 +106,9 @@ void __wake_up_locked(wait_queue_head_t *q, unsigned int mode, int nr)
 }
 EXPORT_SYMBOL_GPL(__wake_up_locked);
 
-void __wake_up_locked_key(wait_queue_head_t *q, unsigned int mode, int nr,
-                          void *key)
+void __wake_up_locked_key(wait_queue_head_t *q, unsigned int mode, void *key)
 {
-        __wake_up_common(q, mode, nr, 0, key);
+        __wake_up_common(q, mode, 1, 0, key);
 }
 EXPORT_SYMBOL_GPL(__wake_up_locked_key);
 
@@ -284,7 +283,7 @@ void abort_exclusive_wait(wait_queue_head_t *q, wait_queue_t *wait,
         if (!list_empty(&wait->task_list))
                 list_del_init(&wait->task_list);
         else if (waitqueue_active(q))
-                __wake_up_locked_key(q, mode, 1, key);
+                __wake_up_locked_key(q, mode, key);
         spin_unlock_irqrestore(&q->lock, flags);
 }
 EXPORT_SYMBOL(abort_exclusive_wait);
diff --git a/kernel/sys_ni.c b/kernel/sys_ni.c
index 03c3875d9958..a02decf15583 100644
--- a/kernel/sys_ni.c
+++ b/kernel/sys_ni.c
@@ -245,3 +245,6 @@ cond_syscall(sys_bpf);
 
 /* execveat */
 cond_syscall(sys_execveat);
+
+/* membarrier */
+cond_syscall(sys_membarrier);
diff --git a/kernel/time/clockevents.c b/kernel/time/clockevents.c
index 50eb107f1198..a9b76a40319e 100644
--- a/kernel/time/clockevents.c
+++ b/kernel/time/clockevents.c
@@ -97,20 +97,6 @@ EXPORT_SYMBOL_GPL(clockevent_delta2ns);
 static int __clockevents_switch_state(struct clock_event_device *dev,
                                       enum clock_event_state state)
 {
-        /* Transition with legacy set_mode() callback */
-        if (dev->set_mode) {
-                /* Legacy callback doesn't support new modes */
-                if (state > CLOCK_EVT_STATE_ONESHOT)
-                        return -ENOSYS;
-                /*
-                 * 'clock_event_state' and 'clock_event_mode' have 1-to-1
-                 * mapping until *_ONESHOT, and so a simple cast will work.
-                 */
-                dev->set_mode((enum clock_event_mode)state, dev);
-                dev->mode = (enum clock_event_mode)state;
-                return 0;
-        }
-
         if (dev->features & CLOCK_EVT_FEAT_DUMMY)
                 return 0;
 
@@ -204,12 +190,8 @@ int clockevents_tick_resume(struct clock_event_device *dev)
 {
         int ret = 0;
 
-        if (dev->set_mode) {
-                dev->set_mode(CLOCK_EVT_MODE_RESUME, dev);
-                dev->mode = CLOCK_EVT_MODE_RESUME;
-        } else if (dev->tick_resume) {
+        if (dev->tick_resume)
                 ret = dev->tick_resume(dev);
-        }
 
         return ret;
 }
@@ -460,26 +442,6 @@ int clockevents_unbind_device(struct clock_event_device *ced, int cpu)
 }
 EXPORT_SYMBOL_GPL(clockevents_unbind_device);
 
-/* Sanity check of state transition callbacks */
-static int clockevents_sanity_check(struct clock_event_device *dev)
-{
-        /* Legacy set_mode() callback */
-        if (dev->set_mode) {
-                /* We shouldn't be supporting new modes now */
-                WARN_ON(dev->set_state_periodic || dev->set_state_oneshot ||
-                        dev->set_state_shutdown || dev->tick_resume ||
-                        dev->set_state_oneshot_stopped);
-
-                BUG_ON(dev->mode != CLOCK_EVT_MODE_UNUSED);
-                return 0;
-        }
-
-        if (dev->features & CLOCK_EVT_FEAT_DUMMY)
-                return 0;
-
-        return 0;
-}
-
 /**
  * clockevents_register_device - register a clock event device
  * @dev:        device to register
@@ -488,8 +450,6 @@ void clockevents_register_device(struct clock_event_device *dev)
 {
         unsigned long flags;
 
-        BUG_ON(clockevents_sanity_check(dev));
-
         /* Initialize state to DETACHED */
         clockevent_set_state(dev, CLOCK_EVT_STATE_DETACHED);
 
diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c
index d11c55b6ab7d..4fcd99e12aa0 100644
--- a/kernel/time/tick-common.c
+++ b/kernel/time/tick-common.c
@@ -398,7 +398,6 @@ void tick_shutdown(unsigned int cpu)
                  * the set mode function!
                  */
                 clockevent_set_state(dev, CLOCK_EVT_STATE_DETACHED);
-                dev->mode = CLOCK_EVT_MODE_UNUSED;
                 clockevents_exchange_device(dev, NULL);
                 dev->event_handler = clockevents_handle_noop;
                 td->evtdev = NULL;
diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
index 3319e16f31e5..7c7ec4515983 100644
--- a/kernel/time/tick-sched.c
+++ b/kernel/time/tick-sched.c
@@ -290,16 +290,17 @@ static int __init tick_nohz_full_setup(char *str)
 __setup("nohz_full=", tick_nohz_full_setup);
 
 static int tick_nohz_cpu_down_callback(struct notifier_block *nfb,
-                                                 unsigned long action,
-                                                 void *hcpu)
+                                       unsigned long action,
+                                       void *hcpu)
 {
         unsigned int cpu = (unsigned long)hcpu;
 
         switch (action & ~CPU_TASKS_FROZEN) {
         case CPU_DOWN_PREPARE:
                 /*
-                 * If we handle the timekeeping duty for full dynticks CPUs,
-                 * we can't safely shutdown that CPU.
+                 * The boot CPU handles housekeeping duty (unbound timers,
+                 * workqueues, timekeeping, ...) on behalf of full dynticks
+                 * CPUs. It must remain online when nohz full is enabled.
                  */
                 if (tick_nohz_full_running && tick_do_timer_cpu == cpu)
                         return NOTIFY_BAD;
@@ -370,6 +371,12 @@ void __init tick_nohz_init(void)
         cpu_notifier(tick_nohz_cpu_down_callback, 0);
         pr_info("NO_HZ: Full dynticks CPUs: %*pbl.\n",
                 cpumask_pr_args(tick_nohz_full_mask));
+
+        /*
+         * We need at least one CPU to handle housekeeping work such
+         * as timekeeping, unbound timers, workqueues, ...
+         */
+        WARN_ON_ONCE(cpumask_empty(housekeeping_mask));
 }
 #endif
 
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index f6ee2e6b6f5d..3739ac6aa473 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -1614,7 +1614,7 @@ static __always_inline void timekeeping_freqadjust(struct timekeeper *tk,
         negative = (tick_error < 0);
 
         /* Sort out the magnitude of the correction */
-        tick_error = abs(tick_error);
+        tick_error = abs64(tick_error);
         for (adj = 0; tick_error > interval; adj++)
                 tick_error >>= 1;
 
diff --git a/kernel/time/timer_list.c b/kernel/time/timer_list.c
index 129c96033e46..f75e35b60149 100644
--- a/kernel/time/timer_list.c
+++ b/kernel/time/timer_list.c
@@ -225,7 +225,7 @@ print_tickdevice(struct seq_file *m, struct tick_device *td, int cpu)
                    (unsigned long long) dev->min_delta_ns);
         SEQ_printf(m, " mult:           %u\n", dev->mult);
         SEQ_printf(m, " shift:          %u\n", dev->shift);
-        SEQ_printf(m, " mode:           %d\n", dev->mode);
+        SEQ_printf(m, " mode:           %d\n", clockevent_get_state(dev));
         SEQ_printf(m, " next_event:     %Ld nsecs\n",
                    (unsigned long long) ktime_to_ns(dev->next_event));
 
@@ -233,40 +233,34 @@ print_tickdevice(struct seq_file *m, struct tick_device *td, int cpu)
         print_name_offset(m, dev->set_next_event);
         SEQ_printf(m, "\n");
 
-        if (dev->set_mode) {
-                SEQ_printf(m, " set_mode:       ");
-                print_name_offset(m, dev->set_mode);
+        if (dev->set_state_shutdown) {
+                SEQ_printf(m, " shutdown: ");
+                print_name_offset(m, dev->set_state_shutdown);
                 SEQ_printf(m, "\n");
-        } else {
-                if (dev->set_state_shutdown) {
-                        SEQ_printf(m, " shutdown: ");
-                        print_name_offset(m, dev->set_state_shutdown);
-                        SEQ_printf(m, "\n");
-                }
+        }
 
-                if (dev->set_state_periodic) {
-                        SEQ_printf(m, " periodic: ");
-                        print_name_offset(m, dev->set_state_periodic);
-                        SEQ_printf(m, "\n");
-                }
+        if (dev->set_state_periodic) {
+                SEQ_printf(m, " periodic: ");
+                print_name_offset(m, dev->set_state_periodic);
+                SEQ_printf(m, "\n");
+        }
 
-                if (dev->set_state_oneshot) {
-                        SEQ_printf(m, " oneshot:  ");
-                        print_name_offset(m, dev->set_state_oneshot);
-                        SEQ_printf(m, "\n");
-                }
+        if (dev->set_state_oneshot) {
+                SEQ_printf(m, " oneshot:  ");
+                print_name_offset(m, dev->set_state_oneshot);
+                SEQ_printf(m, "\n");
+        }
 
-                if (dev->set_state_oneshot_stopped) {
-                        SEQ_printf(m, " oneshot stopped: ");
-                        print_name_offset(m, dev->set_state_oneshot_stopped);
-                        SEQ_printf(m, "\n");
-                }
+        if (dev->set_state_oneshot_stopped) {
+                SEQ_printf(m, " oneshot stopped: ");
+                print_name_offset(m, dev->set_state_oneshot_stopped);
+                SEQ_printf(m, "\n");
+        }
 
-                if (dev->tick_resume) {
-                        SEQ_printf(m, " resume:   ");
-                        print_name_offset(m, dev->tick_resume);
-                        SEQ_printf(m, "\n");
-                }
+        if (dev->tick_resume) {
+                SEQ_printf(m, " resume:   ");
+                print_name_offset(m, dev->tick_resume);
+                SEQ_printf(m, "\n");
         }
 
         SEQ_printf(m, " event_handler:  ");
diff --git a/lib/iommu-common.c b/lib/iommu-common.c
index ff19f66d3f7f..b1c93e94ca7a 100644
--- a/lib/iommu-common.c
+++ b/lib/iommu-common.c
@@ -21,8 +21,7 @@ static	DEFINE_PER_CPU(unsigned int, iommu_hash_common);
 
 static inline bool need_flush(struct iommu_map_table *iommu)
 {
-        return (iommu->lazy_flush != NULL &&
-                (iommu->flags & IOMMU_NEED_FLUSH) != 0);
+        return ((iommu->flags & IOMMU_NEED_FLUSH) != 0);
 }
 
 static inline void set_flush(struct iommu_map_table *iommu)
@@ -211,7 +210,8 @@ unsigned long iommu_tbl_range_alloc(struct device *dev,
                         goto bail;
                 }
         }
-        if (n < pool->hint || need_flush(iommu)) {
+        if (iommu->lazy_flush &&
+            (n < pool->hint || need_flush(iommu))) {
                 clear_flush(iommu);
                 iommu->lazy_flush(iommu);
         }
diff --git a/lib/rhashtable.c b/lib/rhashtable.c
index cc0c69710dcf..a54ff8949f91 100644
--- a/lib/rhashtable.c
+++ b/lib/rhashtable.c
@@ -187,10 +187,7 @@ static int rhashtable_rehash_one(struct rhashtable *ht, unsigned int old_hash)
         head = rht_dereference_bucket(new_tbl->buckets[new_hash],
                                       new_tbl, new_hash);
 
-        if (rht_is_a_nulls(head))
-                INIT_RHT_NULLS_HEAD(entry->next, ht, new_hash);
-        else
-                RCU_INIT_POINTER(entry->next, head);
+        RCU_INIT_POINTER(entry->next, head);
 
         rcu_assign_pointer(new_tbl->buckets[new_hash], entry);
         spin_unlock(new_bucket_lock);
diff --git a/lib/string_helpers.c b/lib/string_helpers.c
index 54036ce2e2dd..5939f63d90cd 100644
--- a/lib/string_helpers.c
+++ b/lib/string_helpers.c
@@ -59,7 +59,11 @@ void string_get_size(u64 size, u64 blk_size, const enum string_size_units units,
         }
 
         exp = divisor[units] / (u32)blk_size;
-        if (size >= exp) {
+        /*
+         * size must be strictly greater than exp here to ensure that remainder
+         * is greater than divisor[units] coming out of the if below.
+         */
+        if (size > exp) {
                 remainder = do_div(size, divisor[units]);
                 remainder *= blk_size;
                 i++;
diff --git a/mm/Kconfig b/mm/Kconfig
index 6413d027c0b2..0d9fdcd01e47 100644
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -677,3 +677,6 @@ config ZONE_DEVICE
           mapping in an O_DIRECT operation, among other things.
 
           If FS_DAX is enabled, then say Y.
+
+config FRAME_VECTOR
+        bool
diff --git a/mm/Makefile b/mm/Makefile
index 56f8eed73f1a..2ed43191fc3b 100644
--- a/mm/Makefile
+++ b/mm/Makefile
@@ -80,3 +80,4 @@ obj-$(CONFIG_PAGE_EXTENSION) += page_ext.o
 obj-$(CONFIG_CMA_DEBUGFS) += cma_debug.o
 obj-$(CONFIG_USERFAULTFD) += userfaultfd.o
 obj-$(CONFIG_IDLE_PAGE_TRACKING) += page_idle.o
+obj-$(CONFIG_FRAME_VECTOR) += frame_vector.o
diff --git a/mm/early_ioremap.c b/mm/early_ioremap.c
index 23f744d77ce0..17ae14b5aefa 100644
--- a/mm/early_ioremap.c
+++ b/mm/early_ioremap.c
@@ -15,6 +15,7 @@
 #include <linux/mm.h>
 #include <linux/vmalloc.h>
 #include <asm/fixmap.h>
+#include <asm/early_ioremap.h>
 
 #ifdef CONFIG_MMU
 static int early_ioremap_debug __initdata;
diff --git a/mm/frame_vector.c b/mm/frame_vector.c
new file mode 100644
index 000000000000..cdabcb93c6a6
--- /dev/null
+++ b/mm/frame_vector.c
@@ -0,0 +1,230 @@
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/err.h>
+#include <linux/mm.h>
+#include <linux/slab.h>
+#include <linux/vmalloc.h>
+#include <linux/pagemap.h>
+#include <linux/sched.h>
+
+/*
+ * get_vaddr_frames() - map virtual addresses to pfns
+ * @start:      starting user address
+ * @nr_frames:  number of pages / pfns from start to map
+ * @write:      whether pages will be written to by the caller
+ * @force:      whether to force write access even if user mapping is
+ *              readonly. See description of the same argument of
+                get_user_pages().
+ * @vec:        structure which receives pages / pfns of the addresses mapped.
+ *              It should have space for at least nr_frames entries.
+ *
+ * This function maps virtual addresses from @start and fills @vec structure
+ * with page frame numbers or page pointers to corresponding pages (choice
+ * depends on the type of the vma underlying the virtual address). If @start
+ * belongs to a normal vma, the function grabs reference to each of the pages
+ * to pin them in memory. If @start belongs to VM_IO | VM_PFNMAP vma, we don't
+ * touch page structures and the caller must make sure pfns aren't reused for
+ * anything else while he is using them.
+ *
+ * The function returns number of pages mapped which may be less than
+ * @nr_frames. In particular we stop mapping if there are more vmas of
+ * different type underlying the specified range of virtual addresses.
+ * When the function isn't able to map a single page, it returns error.
+ *
+ * This function takes care of grabbing mmap_sem as necessary.
+ */
+int get_vaddr_frames(unsigned long start, unsigned int nr_frames,
+                     bool write, bool force, struct frame_vector *vec)
+{
+        struct mm_struct *mm = current->mm;
+        struct vm_area_struct *vma;
+        int ret = 0;
+        int err;
+        int locked;
+
+        if (nr_frames == 0)
+                return 0;
+
+        if (WARN_ON_ONCE(nr_frames > vec->nr_allocated))
+                nr_frames = vec->nr_allocated;
+
+        down_read(&mm->mmap_sem);
+        locked = 1;
+        vma = find_vma_intersection(mm, start, start + 1);
+        if (!vma) {
+                ret = -EFAULT;
+                goto out;
+        }
+        if (!(vma->vm_flags & (VM_IO | VM_PFNMAP))) {
+                vec->got_ref = true;
+                vec->is_pfns = false;
+                ret = get_user_pages_locked(current, mm, start, nr_frames,
+                        write, force, (struct page **)(vec->ptrs), &locked);
+                goto out;
+        }
+
+        vec->got_ref = false;
+        vec->is_pfns = true;
+        do {
+                unsigned long *nums = frame_vector_pfns(vec);
+
+                while (ret < nr_frames && start + PAGE_SIZE <= vma->vm_end) {
+                        err = follow_pfn(vma, start, &nums[ret]);
+                        if (err) {
+                                if (ret == 0)
+                                        ret = err;
+                                goto out;
+                        }
+                        start += PAGE_SIZE;
+                        ret++;
+                }
+                /*
+                 * We stop if we have enough pages or if VMA doesn't completely
+                 * cover the tail page.
+                 */
+                if (ret >= nr_frames || start < vma->vm_end)
+                        break;
+                vma = find_vma_intersection(mm, start, start + 1);
+        } while (vma && vma->vm_flags & (VM_IO | VM_PFNMAP));
+out:
+        if (locked)
+                up_read(&mm->mmap_sem);
+        if (!ret)
+                ret = -EFAULT;
+        if (ret > 0)
+                vec->nr_frames = ret;
+        return ret;
+}
+EXPORT_SYMBOL(get_vaddr_frames);
+
+/**
+ * put_vaddr_frames() - drop references to pages if get_vaddr_frames() acquired
+ *                      them
+ * @vec:        frame vector to put
+ *
+ * Drop references to pages if get_vaddr_frames() acquired them. We also
+ * invalidate the frame vector so that it is prepared for the next call into
+ * get_vaddr_frames().
+ */
+void put_vaddr_frames(struct frame_vector *vec)
+{
+        int i;
+        struct page **pages;
+
+        if (!vec->got_ref)
+                goto out;
+        pages = frame_vector_pages(vec);
+        /*
+         * frame_vector_pages() might needed to do a conversion when
+         * get_vaddr_frames() got pages but vec was later converted to pfns.
+         * But it shouldn't really fail to convert pfns back...
+         */
+        if (WARN_ON(IS_ERR(pages)))
+                goto out;
+        for (i = 0; i < vec->nr_frames; i++)
+                put_page(pages[i]);
+        vec->got_ref = false;
+out:
+        vec->nr_frames = 0;
+}
+EXPORT_SYMBOL(put_vaddr_frames);
+
+/**
+ * frame_vector_to_pages - convert frame vector to contain page pointers
+ * @vec:        frame vector to convert
+ *
+ * Convert @vec to contain array of page pointers.  If the conversion is
+ * successful, return 0. Otherwise return an error. Note that we do not grab
+ * page references for the page structures.
+ */
+int frame_vector_to_pages(struct frame_vector *vec)
+{
+        int i;
+        unsigned long *nums;
+        struct page **pages;
+
+        if (!vec->is_pfns)
+                return 0;
+        nums = frame_vector_pfns(vec);
+        for (i = 0; i < vec->nr_frames; i++)
+                if (!pfn_valid(nums[i]))
+                        return -EINVAL;
+        pages = (struct page **)nums;
+        for (i = 0; i < vec->nr_frames; i++)
+                pages[i] = pfn_to_page(nums[i]);
+        vec->is_pfns = false;
+        return 0;
+}
+EXPORT_SYMBOL(frame_vector_to_pages);
+
+/**
+ * frame_vector_to_pfns - convert frame vector to contain pfns
+ * @vec:        frame vector to convert
+ *
+ * Convert @vec to contain array of pfns.
+ */
+void frame_vector_to_pfns(struct frame_vector *vec)
+{
+        int i;
+        unsigned long *nums;
+        struct page **pages;
+
+        if (vec->is_pfns)
+                return;
+        pages = (struct page **)(vec->ptrs);
+        nums = (unsigned long *)pages;
+        for (i = 0; i < vec->nr_frames; i++)
+                nums[i] = page_to_pfn(pages[i]);
+        vec->is_pfns = true;
+}
+EXPORT_SYMBOL(frame_vector_to_pfns);
+
+/**
+ * frame_vector_create() - allocate & initialize structure for pinned pfns
+ * @nr_frames:  number of pfns slots we should reserve
+ *
+ * Allocate and initialize struct pinned_pfns to be able to hold @nr_pfns
+ * pfns.
+ */
+struct frame_vector *frame_vector_create(unsigned int nr_frames)
+{
+        struct frame_vector *vec;
+        int size = sizeof(struct frame_vector) + sizeof(void *) * nr_frames;
+
+        if (WARN_ON_ONCE(nr_frames == 0))
+                return NULL;
+        /*
+         * This is absurdly high. It's here just to avoid strange effects when
+         * arithmetics overflows.
+         */
+        if (WARN_ON_ONCE(nr_frames > INT_MAX / sizeof(void *) / 2))
+                return NULL;
+        /*
+         * Avoid higher order allocations, use vmalloc instead. It should
+         * be rare anyway.
+         */
+        if (size <= PAGE_SIZE)
+                vec = kmalloc(size, GFP_KERNEL);
+        else
+                vec = vmalloc(size);
+        if (!vec)
+                return NULL;
+        vec->nr_allocated = nr_frames;
+        vec->nr_frames = 0;
+        return vec;
+}
+EXPORT_SYMBOL(frame_vector_create);
+
+/**
+ * frame_vector_destroy() - free memory allocated to carry frame vector
+ * @vec:        Frame vector to free
+ *
+ * Free structure allocated by frame_vector_create() to carry frames.
+ */
+void frame_vector_destroy(struct frame_vector *vec)
+{
+        /* Make sure put_vaddr_frames() got called properly... */
+        VM_BUG_ON(vec->nr_frames > 0);
+        kvfree(vec);
+}
+EXPORT_SYMBOL(frame_vector_destroy);
diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c
index 7b28e9cdf1c7..8da211411b57 100644
--- a/mm/kasan/kasan.c
+++ b/mm/kasan/kasan.c
@@ -135,12 +135,11 @@ static __always_inline bool memory_is_poisoned_16(unsigned long addr)
 
         if (unlikely(*shadow_addr)) {
                 u16 shadow_first_bytes = *(u16 *)shadow_addr;
-                s8 last_byte = (addr + 15) & KASAN_SHADOW_MASK;
 
                 if (unlikely(shadow_first_bytes))
                         return true;
 
-                if (likely(!last_byte))
+                if (likely(IS_ALIGNED(addr, 8)))
                         return false;
 
                 return memory_is_poisoned_1(addr + 15);
diff --git a/mm/migrate.c b/mm/migrate.c
index c3cb566af3e2..7452a00bbb50 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -1075,7 +1075,7 @@ out:
         if (rc != MIGRATEPAGE_SUCCESS && put_new_page)
                 put_new_page(new_hpage, private);
         else
-                put_page(new_hpage);
+                putback_active_hugepage(new_hpage);
 
         if (result) {
                 if (rc)
diff --git a/mm/mmap.c b/mm/mmap.c
index 971dd2cb77d2..79bcc9f92e48 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -612,8 +612,6 @@ static unsigned long count_vma_pages_range(struct mm_struct *mm,
 void __vma_link_rb(struct mm_struct *mm, struct vm_area_struct *vma,
                 struct rb_node **rb_link, struct rb_node *rb_parent)
 {
-        WARN_ONCE(vma->vm_file && !vma->vm_ops, "missing vma->vm_ops");
-
         /* Update tracking information for the gap following the new vma. */
         if (vma->vm_next)
                 vma_gap_update(vma->vm_next);
@@ -1492,13 +1490,14 @@ SYSCALL_DEFINE1(old_mmap, struct mmap_arg_struct __user *, arg)
 int vma_wants_writenotify(struct vm_area_struct *vma)
 {
         vm_flags_t vm_flags = vma->vm_flags;
+        const struct vm_operations_struct *vm_ops = vma->vm_ops;
 
         /* If it was private or non-writable, the write bit is already clear */
         if ((vm_flags & (VM_WRITE|VM_SHARED)) != ((VM_WRITE|VM_SHARED)))
                 return 0;
 
         /* The backer wishes to know when pages are first written to? */
-        if (vma->vm_ops && vma->vm_ops->page_mkwrite)
+        if (vm_ops && (vm_ops->page_mkwrite || vm_ops->pfn_mkwrite))
                 return 1;
 
         /* The open routine did something to the protections that pgprot_modify
@@ -1638,12 +1637,6 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
                  */
                 WARN_ON_ONCE(addr != vma->vm_start);
 
-                /* All file mapping must have ->vm_ops set */
-                if (!vma->vm_ops) {
-                        static const struct vm_operations_struct dummy_ops = {};
-                        vma->vm_ops = &dummy_ops;
-                }
-
                 addr = vma->vm_start;
                 vm_flags = vma->vm_flags;
         } else if (vm_flags & VM_SHARED) {
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 2d978b28a410..7f63a9381f71 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -175,7 +175,7 @@ static bool sane_reclaim(struct scan_control *sc)
         if (!memcg)
                 return true;
 #ifdef CONFIG_CGROUP_WRITEBACK
-        if (memcg->css.cgroup)
+        if (cgroup_on_dfl(memcg->css.cgroup))
                 return true;
 #endif
         return false;
diff --git a/net/atm/clip.c b/net/atm/clip.c
index 17e55dfecbe2..e07f551a863c 100644
--- a/net/atm/clip.c
+++ b/net/atm/clip.c
@@ -317,6 +317,9 @@ static int clip_constructor(struct neighbour *neigh)
 
 static int clip_encap(struct atm_vcc *vcc, int mode)
 {
+        if (!CLIP_VCC(vcc))
+                return -EBADFD;
+
         CLIP_VCC(vcc)->encap = mode;
         return 0;
 }
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 4d56e593faad..25644e1bc479 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -2311,12 +2311,6 @@ int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
         if (!conn)
                 return 1;
 
-        chan = conn->smp;
-        if (!chan) {
-                BT_ERR("SMP security requested but not available");
-                return 1;
-        }
-
         if (!hci_dev_test_flag(hcon->hdev, HCI_LE_ENABLED))
                 return 1;
 
@@ -2330,6 +2324,12 @@ int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
                 if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
                         return 0;
 
+        chan = conn->smp;
+        if (!chan) {
+                BT_ERR("SMP security requested but not available");
+                return 1;
+        }
+
         l2cap_chan_lock(chan);
 
         /* If SMP is already in progress ignore this request */
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index b4d858a18eb6..03661d97463c 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -1006,7 +1006,7 @@ static int br_ip4_multicast_igmp3_report(struct net_bridge *br,
 
         ih = igmpv3_report_hdr(skb);
         num = ntohs(ih->ngrec);
-        len = sizeof(*ih);
+        len = skb_transport_offset(skb) + sizeof(*ih);
 
         for (i = 0; i < num; i++) {
                 len += sizeof(*grec);
@@ -1067,7 +1067,7 @@ static int br_ip6_multicast_mld2_report(struct net_bridge *br,
 
         icmp6h = icmp6_hdr(skb);
         num = ntohs(icmp6h->icmp6_dataun.un_data16[1]);
-        len = sizeof(*icmp6h);
+        len = skb_transport_offset(skb) + sizeof(*icmp6h);
 
         for (i = 0; i < num; i++) {
                 __be16 *nsrcs, _nsrcs;
diff --git a/net/ceph/ceph_common.c b/net/ceph/ceph_common.c
index 69a4d30a9ccf..54a00d66509e 100644
--- a/net/ceph/ceph_common.c
+++ b/net/ceph/ceph_common.c
@@ -357,6 +357,7 @@ ceph_parse_options(char *options, const char *dev_name,
         opt->osd_keepalive_timeout = CEPH_OSD_KEEPALIVE_DEFAULT;
         opt->mount_timeout = CEPH_MOUNT_TIMEOUT_DEFAULT;
         opt->osd_idle_ttl = CEPH_OSD_IDLE_TTL_DEFAULT;
+        opt->monc_ping_timeout = CEPH_MONC_PING_TIMEOUT_DEFAULT;
 
         /* get mon ip(s) */
         /* ip1[:port1][,ip2[:port2]...] */
diff --git a/net/ceph/crypto.c b/net/ceph/crypto.c
index 790fe89d90c0..4440edcce0d6 100644
--- a/net/ceph/crypto.c
+++ b/net/ceph/crypto.c
@@ -79,10 +79,6 @@ int ceph_crypto_key_unarmor(struct ceph_crypto_key *key, const char *inkey)
         return 0;
 }
 
-
-
-#define AES_KEY_SIZE 16
-
 static struct crypto_blkcipher *ceph_crypto_alloc_cipher(void)
 {
         return crypto_alloc_blkcipher("cbc(aes)", 0, CRYPTO_ALG_ASYNC);
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index e3be1d22a247..b9b0e3b5da49 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -163,6 +163,7 @@ static struct kmem_cache	*ceph_msg_data_cache;
 static char tag_msg = CEPH_MSGR_TAG_MSG;
 static char tag_ack = CEPH_MSGR_TAG_ACK;
 static char tag_keepalive = CEPH_MSGR_TAG_KEEPALIVE;
+static char tag_keepalive2 = CEPH_MSGR_TAG_KEEPALIVE2;
 
 #ifdef CONFIG_LOCKDEP
 static struct lock_class_key socket_class;
@@ -176,7 +177,7 @@ static struct lock_class_key socket_class;
 
 static void queue_con(struct ceph_connection *con);
 static void cancel_con(struct ceph_connection *con);
-static void con_work(struct work_struct *);
+static void ceph_con_workfn(struct work_struct *);
 static void con_fault(struct ceph_connection *con);
 
 /*
@@ -276,22 +277,22 @@ static void _ceph_msgr_exit(void)
                 ceph_msgr_wq = NULL;
         }
 
-        ceph_msgr_slab_exit();
-
         BUG_ON(zero_page == NULL);
         page_cache_release(zero_page);
         zero_page = NULL;
+
+        ceph_msgr_slab_exit();
 }
 
 int ceph_msgr_init(void)
 {
+        if (ceph_msgr_slab_init())
+                return -ENOMEM;
+
         BUG_ON(zero_page != NULL);
         zero_page = ZERO_PAGE(0);
         page_cache_get(zero_page);
 
-        if (ceph_msgr_slab_init())
-                return -ENOMEM;
-
         /*
          * The number of active work items is limited by the number of
          * connections, so leave @max_active at default.
@@ -749,7 +750,7 @@ void ceph_con_init(struct ceph_connection *con, void *private,
         mutex_init(&con->mutex);
         INIT_LIST_HEAD(&con->out_queue);
         INIT_LIST_HEAD(&con->out_sent);
-        INIT_DELAYED_WORK(&con->work, con_work);
+        INIT_DELAYED_WORK(&con->work, ceph_con_workfn);
 
         con->state = CON_STATE_CLOSED;
 }
@@ -1351,7 +1352,16 @@ static void prepare_write_keepalive(struct ceph_connection *con)
 {
         dout("prepare_write_keepalive %p\n", con);
         con_out_kvec_reset(con);
-        con_out_kvec_add(con, sizeof (tag_keepalive), &tag_keepalive);
+        if (con->peer_features & CEPH_FEATURE_MSGR_KEEPALIVE2) {
+                struct timespec now = CURRENT_TIME;
+
+                con_out_kvec_add(con, sizeof(tag_keepalive2), &tag_keepalive2);
+                ceph_encode_timespec(&con->out_temp_keepalive2, &now);
+                con_out_kvec_add(con, sizeof(con->out_temp_keepalive2),
+                                 &con->out_temp_keepalive2);
+        } else {
+                con_out_kvec_add(con, sizeof(tag_keepalive), &tag_keepalive);
+        }
         con_flag_set(con, CON_FLAG_WRITE_PENDING);
 }
 
@@ -1625,6 +1635,12 @@ static void prepare_read_tag(struct ceph_connection *con)
         con->in_tag = CEPH_MSGR_TAG_READY;
 }
 
+static void prepare_read_keepalive_ack(struct ceph_connection *con)
+{
+        dout("prepare_read_keepalive_ack %p\n", con);
+        con->in_base_pos = 0;
+}
+
 /*
  * Prepare to read a message.
  */
@@ -2322,13 +2338,6 @@ static int read_partial_message(struct ceph_connection *con)
                         return ret;
 
                 BUG_ON(!con->in_msg ^ skip);
-                if (con->in_msg && data_len > con->in_msg->data_length) {
-                        pr_warn("%s skipping long message (%u > %zd)\n",
-                                __func__, data_len, con->in_msg->data_length);
-                        ceph_msg_put(con->in_msg);
-                        con->in_msg = NULL;
-                        skip = 1;
-                }
                 if (skip) {
                         /* skip this message */
                         dout("alloc_msg said skip message\n");
@@ -2457,6 +2466,17 @@ static void process_message(struct ceph_connection *con)
         mutex_lock(&con->mutex);
 }
 
+static int read_keepalive_ack(struct ceph_connection *con)
+{
+        struct ceph_timespec ceph_ts;
+        size_t size = sizeof(ceph_ts);
+        int ret = read_partial(con, size, size, &ceph_ts);
+        if (ret <= 0)
+                return ret;
+        ceph_decode_timespec(&con->last_keepalive_ack, &ceph_ts);
+        prepare_read_tag(con);
+        return 1;
+}
 
 /*
  * Write something to the socket.  Called in a worker thread when the
@@ -2526,6 +2546,10 @@ more_kvec:
 
 do_next:
         if (con->state == CON_STATE_OPEN) {
+                if (con_flag_test_and_clear(con, CON_FLAG_KEEPALIVE_PENDING)) {
+                        prepare_write_keepalive(con);
+                        goto more;
+                }
                 /* is anything else pending? */
                 if (!list_empty(&con->out_queue)) {
                         prepare_write_message(con);
@@ -2535,10 +2559,6 @@ do_next:
                         prepare_write_ack(con);
                         goto more;
                 }
-                if (con_flag_test_and_clear(con, CON_FLAG_KEEPALIVE_PENDING)) {
-                        prepare_write_keepalive(con);
-                        goto more;
-                }
         }
 
         /* Nothing to do! */
@@ -2641,6 +2661,9 @@ more:
                 case CEPH_MSGR_TAG_ACK:
                         prepare_read_ack(con);
                         break;
+                case CEPH_MSGR_TAG_KEEPALIVE2_ACK:
+                        prepare_read_keepalive_ack(con);
+                        break;
                 case CEPH_MSGR_TAG_CLOSE:
                         con_close_socket(con);
                         con->state = CON_STATE_CLOSED;
@@ -2684,6 +2707,12 @@ more:
                 process_ack(con);
                 goto more;
         }
+        if (con->in_tag == CEPH_MSGR_TAG_KEEPALIVE2_ACK) {
+                ret = read_keepalive_ack(con);
+                if (ret <= 0)
+                        goto out;
+                goto more;
+        }
 
 out:
         dout("try_read done on %p ret %d\n", con, ret);
@@ -2799,7 +2828,7 @@ static void con_fault_finish(struct ceph_connection *con)
 /*
  * Do some work on a connection.  Drop a connection ref when we're done.
  */
-static void con_work(struct work_struct *work)
+static void ceph_con_workfn(struct work_struct *work)
 {
         struct ceph_connection *con = container_of(work, struct ceph_connection,
                                                    work.work);
@@ -3101,6 +3130,20 @@ void ceph_con_keepalive(struct ceph_connection *con)
 }
 EXPORT_SYMBOL(ceph_con_keepalive);
 
+bool ceph_con_keepalive_expired(struct ceph_connection *con,
+                               unsigned long interval)
+{
+        if (interval > 0 &&
+            (con->peer_features & CEPH_FEATURE_MSGR_KEEPALIVE2)) {
+                struct timespec now = CURRENT_TIME;
+                struct timespec ts;
+                jiffies_to_timespec(interval, &ts);
+                ts = timespec_add(con->last_keepalive_ack, ts);
+                return timespec_compare(&now, &ts) >= 0;
+        }
+        return false;
+}
+
 static struct ceph_msg_data *ceph_msg_data_create(enum ceph_msg_data_type type)
 {
         struct ceph_msg_data *data;
diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c
index 9d6ff1215928..edda01626a45 100644
--- a/net/ceph/mon_client.c
+++ b/net/ceph/mon_client.c
@@ -149,6 +149,10 @@ static int __open_session(struct ceph_mon_client *monc)
                               CEPH_ENTITY_TYPE_MON, monc->cur_mon,
                               &monc->monmap->mon_inst[monc->cur_mon].addr);
 
+                /* send an initial keepalive to ensure our timestamp is
+                 * valid by the time we are in an OPENED state */
+                ceph_con_keepalive(&monc->con);
+
                 /* initiatiate authentication handshake */
                 ret = ceph_auth_build_hello(monc->auth,
                                             monc->m_auth->front.iov_base,
@@ -170,14 +174,19 @@ static bool __sub_expired(struct ceph_mon_client *monc)
  */
 static void __schedule_delayed(struct ceph_mon_client *monc)
 {
-        unsigned int delay;
+        struct ceph_options *opt = monc->client->options;
+        unsigned long delay;
 
-        if (monc->cur_mon < 0 || __sub_expired(monc))
+        if (monc->cur_mon < 0 || __sub_expired(monc)) {
                 delay = 10 * HZ;
-        else
+        } else {
                 delay = 20 * HZ;
-        dout("__schedule_delayed after %u\n", delay);
-        schedule_delayed_work(&monc->delayed_work, delay);
+                if (opt->monc_ping_timeout > 0)
+                        delay = min(delay, opt->monc_ping_timeout / 3);
+        }
+        dout("__schedule_delayed after %lu\n", delay);
+        schedule_delayed_work(&monc->delayed_work,
+                              round_jiffies_relative(delay));
 }
 
 /*
@@ -743,11 +752,23 @@ static void delayed_work(struct work_struct *work)
                 __close_session(monc);
                 __open_session(monc);  /* continue hunting */
         } else {
-                ceph_con_keepalive(&monc->con);
+                struct ceph_options *opt = monc->client->options;
+                int is_auth = ceph_auth_is_authenticated(monc->auth);
+                if (ceph_con_keepalive_expired(&monc->con,
+                                               opt->monc_ping_timeout)) {
+                        dout("monc keepalive timeout\n");
+                        is_auth = 0;
+                        __close_session(monc);
+                        monc->hunting = true;
+                        __open_session(monc);
+                }
 
-                __validate_auth(monc);
+                if (!monc->hunting) {
+                        ceph_con_keepalive(&monc->con);
+                        __validate_auth(monc);
+                }
 
-                if (ceph_auth_is_authenticated(monc->auth))
+                if (is_auth)
                         __send_subscribe(monc);
         }
         __schedule_delayed(monc);
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index 50033677c0fa..80b94e37c94a 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -2817,8 +2817,9 @@ out:
 }
 
 /*
- * lookup and return message for incoming reply.  set up reply message
- * pages.
+ * Lookup and return message for incoming reply.  Don't try to do
+ * anything about a larger than preallocated data portion of the
+ * message at the moment - for now, just skip the message.
  */
 static struct ceph_msg *get_reply(struct ceph_connection *con,
                                   struct ceph_msg_header *hdr,
@@ -2836,10 +2837,10 @@ static struct ceph_msg *get_reply(struct ceph_connection *con,
         mutex_lock(&osdc->request_mutex);
         req = __lookup_request(osdc, tid);
         if (!req) {
-                *skip = 1;
+                pr_warn("%s osd%d tid %llu unknown, skipping\n",
+                        __func__, osd->o_osd, tid);
                 m = NULL;
-                dout("get_reply unknown tid %llu from osd%d\n", tid,
-                     osd->o_osd);
+                *skip = 1;
                 goto out;
         }
 
@@ -2849,10 +2850,9 @@ static struct ceph_msg *get_reply(struct ceph_connection *con,
         ceph_msg_revoke_incoming(req->r_reply);
 
         if (front_len > req->r_reply->front_alloc_len) {
-                pr_warn("get_reply front %d > preallocated %d (%u#%llu)\n",
-                        front_len, req->r_reply->front_alloc_len,
-                        (unsigned int)con->peer_name.type,
-                        le64_to_cpu(con->peer_name.num));
+                pr_warn("%s osd%d tid %llu front %d > preallocated %d\n",
+                        __func__, osd->o_osd, req->r_tid, front_len,
+                        req->r_reply->front_alloc_len);
                 m = ceph_msg_new(CEPH_MSG_OSD_OPREPLY, front_len, GFP_NOFS,
                                  false);
                 if (!m)
@@ -2860,37 +2860,22 @@ static struct ceph_msg *get_reply(struct ceph_connection *con,
                 ceph_msg_put(req->r_reply);
                 req->r_reply = m;
         }
-        m = ceph_msg_get(req->r_reply);
-
-        if (data_len > 0) {
-                struct ceph_osd_data *osd_data;
 
-                /*
-                 * XXX This is assuming there is only one op containing
-                 * XXX page data.  Probably OK for reads, but this
-                 * XXX ought to be done more generally.
-                 */
-                osd_data = osd_req_op_extent_osd_data(req, 0);
-                if (osd_data->type == CEPH_OSD_DATA_TYPE_PAGES) {
-                        if (osd_data->pages &&
-                                unlikely(osd_data->length < data_len)) {
-
-                                pr_warn("tid %lld reply has %d bytes we had only %llu bytes ready\n",
-                                        tid, data_len, osd_data->length);
-                                *skip = 1;
-                                ceph_msg_put(m);
-                                m = NULL;
-                                goto out;
-                        }
-                }
+        if (data_len > req->r_reply->data_length) {
+                pr_warn("%s osd%d tid %llu data %d > preallocated %zu, skipping\n",
+                        __func__, osd->o_osd, req->r_tid, data_len,
+                        req->r_reply->data_length);
+                m = NULL;
+                *skip = 1;
+                goto out;
         }
-        *skip = 0;
+
+        m = ceph_msg_get(req->r_reply);
         dout("get_reply tid %lld %p\n", tid, m);
 
 out:
         mutex_unlock(&osdc->request_mutex);
         return m;
-
 }
 
 static struct ceph_msg *alloc_msg(struct ceph_connection *con,
diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
index 4a3125836b64..7d8f581d9f1f 100644
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -1300,7 +1300,7 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
                 ceph_decode_addr(&addr);
                 pr_info("osd%d up\n", osd);
                 BUG_ON(osd >= map->max_osd);
-                map->osd_state[osd] |= CEPH_OSD_UP;
+                map->osd_state[osd] |= CEPH_OSD_UP | CEPH_OSD_EXISTS;
                 map->osd_addr[osd] = addr;
         }
 
diff --git a/net/core/dev.c b/net/core/dev.c
index 464c22b6261a..323c04edd779 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -4723,6 +4723,8 @@ void napi_disable(struct napi_struct *n)
 
         while (test_and_set_bit(NAPI_STATE_SCHED, &n->state))
                 msleep(1);
+        while (test_and_set_bit(NAPI_STATE_NPSVC, &n->state))
+                msleep(1);
 
         hrtimer_cancel(&n->timer);
 
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index bf77e3639ce0..365de66436ac 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -631,15 +631,17 @@ static int dump_rules(struct sk_buff *skb, struct netlink_callback *cb,
 {
         int idx = 0;
         struct fib_rule *rule;
+        int err = 0;
 
         rcu_read_lock();
         list_for_each_entry_rcu(rule, &ops->rules_list, list) {
                 if (idx < cb->args[1])
                         goto skip;
 
-                if (fib_nl_fill_rule(skb, rule, NETLINK_CB(cb->skb).portid,
-                                     cb->nlh->nlmsg_seq, RTM_NEWRULE,
-                                     NLM_F_MULTI, ops) < 0)
+                err = fib_nl_fill_rule(skb, rule, NETLINK_CB(cb->skb).portid,
+                                       cb->nlh->nlmsg_seq, RTM_NEWRULE,
+                                       NLM_F_MULTI, ops);
+                if (err)
                         break;
 skip:
                 idx++;
@@ -648,7 +650,7 @@ skip:
         cb->args[1] = idx;
         rules_ops_put(ops);
 
-        return skb->len;
+        return err;
 }
 
 static int fib_nl_dumprule(struct sk_buff *skb, struct netlink_callback *cb)
@@ -664,7 +666,9 @@ static int fib_nl_dumprule(struct sk_buff *skb, struct netlink_callback *cb)
                 if (ops == NULL)
                         return -EAFNOSUPPORT;
 
-                return dump_rules(skb, cb, ops);
+                dump_rules(skb, cb, ops);
+
+                return skb->len;
         }
 
         rcu_read_lock();
diff --git a/net/core/filter.c b/net/core/filter.c
index 96bd962c292d..60e3fe7c59c0 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -478,9 +478,9 @@ do_pass:
                                 bpf_src = BPF_X;
                         } else {
                                 insn->dst_reg = BPF_REG_A;
-                                insn->src_reg = BPF_REG_X;
                                 insn->imm = fp->k;
                                 bpf_src = BPF_SRC(fp->code);
+                                insn->src_reg = bpf_src == BPF_X ? BPF_REG_X : 0;
                         }
 
                         /* Common case where 'jump_false' is next insn. */
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index 49b599062af1..b4c530065106 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -1478,6 +1478,15 @@ static int of_dev_node_match(struct device *dev, const void *data)
         return ret == 0 ? dev->of_node == data : ret;
 }
 
+/*
+ * of_find_net_device_by_node - lookup the net device for the device node
+ * @np: OF device node
+ *
+ * Looks up the net_device structure corresponding with the device node.
+ * If successful, returns a pointer to the net_device with the embedded
+ * struct device refcount incremented by one, or NULL on failure. The
+ * refcount must be dropped when done with the net_device.
+ */
 struct net_device *of_find_net_device_by_node(struct device_node *np)
 {
         struct device *dev;
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 6aa3db8dfc3b..8bdada242a7d 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -142,7 +142,7 @@ static void queue_process(struct work_struct *work)
  */
 static int poll_one_napi(struct napi_struct *napi, int budget)
 {
-        int work;
+        int work = 0;
 
         /* net_rx_action's ->poll() invocations and our's are
          * synchronized by this test which is only made while
@@ -151,7 +151,12 @@ static int poll_one_napi(struct napi_struct *napi, int budget)
         if (!test_bit(NAPI_STATE_SCHED, &napi->state))
                 return budget;
 
-        set_bit(NAPI_STATE_NPSVC, &napi->state);
+        /* If we set this bit but see that it has already been set,
+         * that indicates that napi has been disabled and we need
+         * to abort this operation
+         */
+        if (test_and_set_bit(NAPI_STATE_NPSVC, &napi->state))
+                goto out;
 
         work = napi->poll(napi, budget);
         WARN_ONCE(work > budget, "%pF exceeded budget in poll\n", napi->poll);
@@ -159,6 +164,7 @@ static int poll_one_napi(struct napi_struct *napi, int budget)
 
         clear_bit(NAPI_STATE_NPSVC, &napi->state);
 
+out:
         return budget - work;
 }
 
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index e5452296ec2f..474a6da3b51a 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -3047,6 +3047,7 @@ static int rtnl_bridge_getlink(struct sk_buff *skb, struct netlink_callback *cb)
         u32 portid = NETLINK_CB(cb->skb).portid;
         u32 seq = cb->nlh->nlmsg_seq;
         u32 filter_mask = 0;
+        int err;
 
         if (nlmsg_len(cb->nlh) > sizeof(struct ifinfomsg)) {
                 struct nlattr *extfilt;
@@ -3067,20 +3068,25 @@ static int rtnl_bridge_getlink(struct sk_buff *skb, struct netlink_callback *cb)
                 struct net_device *br_dev = netdev_master_upper_dev_get(dev);
 
                 if (br_dev && br_dev->netdev_ops->ndo_bridge_getlink) {
-                        if (idx >= cb->args[0] &&
-                            br_dev->netdev_ops->ndo_bridge_getlink(
-                                    skb, portid, seq, dev, filter_mask,
-                                    NLM_F_MULTI) < 0)
-                                break;
+                        if (idx >= cb->args[0]) {
+                                err = br_dev->netdev_ops->ndo_bridge_getlink(
+                                                skb, portid, seq, dev,
+                                                filter_mask, NLM_F_MULTI);
+                                if (err < 0 && err != -EOPNOTSUPP)
+                                        break;
+                        }
                         idx++;
                 }
 
                 if (ops->ndo_bridge_getlink) {
-                        if (idx >= cb->args[0] &&
-                            ops->ndo_bridge_getlink(skb, portid, seq, dev,
-                                                    filter_mask,
-                                                    NLM_F_MULTI) < 0)
-                                break;
+                        if (idx >= cb->args[0]) {
+                                err = ops->ndo_bridge_getlink(skb, portid,
+                                                              seq, dev,
+                                                              filter_mask,
+                                                              NLM_F_MULTI);
+                                if (err < 0 && err != -EOPNOTSUPP)
+                                        break;
+                        }
                         idx++;
                 }
         }
diff --git a/net/core/sock.c b/net/core/sock.c
index ca2984afe16e..3307c02244d3 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -2740,10 +2740,8 @@ static void req_prot_cleanup(struct request_sock_ops *rsk_prot)
                 return;
         kfree(rsk_prot->slab_name);
         rsk_prot->slab_name = NULL;
-        if (rsk_prot->slab) {
-                kmem_cache_destroy(rsk_prot->slab);
-                rsk_prot->slab = NULL;
-        }
+        kmem_cache_destroy(rsk_prot->slab);
+        rsk_prot->slab = NULL;
 }
 
 static int req_prot_init(const struct proto *prot)
@@ -2828,10 +2826,8 @@ void proto_unregister(struct proto *prot)
         list_del(&prot->node);
         mutex_unlock(&proto_list_mutex);
 
-        if (prot->slab != NULL) {
-                kmem_cache_destroy(prot->slab);
-                prot->slab = NULL;
-        }
+        kmem_cache_destroy(prot->slab);
+        prot->slab = NULL;
 
         req_prot_cleanup(prot->rsk_prot);
 
diff --git a/net/dccp/ackvec.c b/net/dccp/ackvec.c
index bd9e718c2a20..3de0d0362d7f 100644
--- a/net/dccp/ackvec.c
+++ b/net/dccp/ackvec.c
@@ -398,12 +398,8 @@ out_err:
 
 void dccp_ackvec_exit(void)
 {
-        if (dccp_ackvec_slab != NULL) {
-                kmem_cache_destroy(dccp_ackvec_slab);
-                dccp_ackvec_slab = NULL;
-        }
-        if (dccp_ackvec_record_slab != NULL) {
-                kmem_cache_destroy(dccp_ackvec_record_slab);
-                dccp_ackvec_record_slab = NULL;
-        }
+        kmem_cache_destroy(dccp_ackvec_slab);
+        dccp_ackvec_slab = NULL;
+        kmem_cache_destroy(dccp_ackvec_record_slab);
+        dccp_ackvec_record_slab = NULL;
 }
diff --git a/net/dccp/ccid.c b/net/dccp/ccid.c
index 83498975165f..90f77d08cc37 100644
--- a/net/dccp/ccid.c
+++ b/net/dccp/ccid.c
@@ -95,8 +95,7 @@ static struct kmem_cache *ccid_kmem_cache_create(int obj_size, char *slab_name_f
 
 static void ccid_kmem_cache_destroy(struct kmem_cache *slab)
 {
-        if (slab != NULL)
-                kmem_cache_destroy(slab);
+        kmem_cache_destroy(slab);
 }
 
 static int __init ccid_activate(struct ccid_operations *ccid_ops)
diff --git a/net/dccp/minisocks.c b/net/dccp/minisocks.c
index 30addee2dd03..838f524cf11a 100644
--- a/net/dccp/minisocks.c
+++ b/net/dccp/minisocks.c
@@ -48,8 +48,6 @@ void dccp_time_wait(struct sock *sk, int state, int timeo)
                         tw->tw_ipv6only = sk->sk_ipv6only;
                 }
 #endif
-                /* Linkage updates. */
-                __inet_twsk_hashdance(tw, sk, &dccp_hashinfo);
 
                 /* Get the TIME_WAIT timeout firing. */
                 if (timeo < rto)
@@ -60,6 +58,8 @@ void dccp_time_wait(struct sock *sk, int state, int timeo)
                         timeo = DCCP_TIMEWAIT_LEN;
 
                 inet_twsk_schedule(tw, timeo);
+                /* Linkage updates. */
+                __inet_twsk_hashdance(tw, sk, &dccp_hashinfo);
                 inet_twsk_put(tw);
         } else {
                 /* Sorry, if we're out of memory, just CLOSE this
diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c
index 76e3800765f8..c59fa5d9c22c 100644
--- a/net/dsa/dsa.c
+++ b/net/dsa/dsa.c
@@ -634,6 +634,10 @@ static void dsa_of_free_platform_data(struct dsa_platform_data *pd)
                         port_index++;
                 }
                 kfree(pd->chip[i].rtable);
+
+                /* Drop our reference to the MDIO bus device */
+                if (pd->chip[i].host_dev)
+                        put_device(pd->chip[i].host_dev);
         }
         kfree(pd->chip);
 }
@@ -661,16 +665,22 @@ static int dsa_of_probe(struct device *dev)
                 return -EPROBE_DEFER;
 
         ethernet = of_parse_phandle(np, "dsa,ethernet", 0);
-        if (!ethernet)
-                return -EINVAL;
+        if (!ethernet) {
+                ret = -EINVAL;
+                goto out_put_mdio;
+        }
 
         ethernet_dev = of_find_net_device_by_node(ethernet);
-        if (!ethernet_dev)
-                return -EPROBE_DEFER;
+        if (!ethernet_dev) {
+                ret = -EPROBE_DEFER;
+                goto out_put_mdio;
+        }
 
         pd = kzalloc(sizeof(*pd), GFP_KERNEL);
-        if (!pd)
-                return -ENOMEM;
+        if (!pd) {
+                ret = -ENOMEM;
+                goto out_put_ethernet;
+        }
 
         dev->platform_data = pd;
         pd->of_netdev = ethernet_dev;
@@ -691,7 +701,9 @@ static int dsa_of_probe(struct device *dev)
                 cd = &pd->chip[chip_index];
 
                 cd->of_node = child;
-                cd->host_dev = &mdio_bus->dev;
+
+                /* When assigning the host device, increment its refcount */
+                cd->host_dev = get_device(&mdio_bus->dev);
 
                 sw_addr = of_get_property(child, "reg", NULL);
                 if (!sw_addr)
@@ -711,6 +723,12 @@ static int dsa_of_probe(struct device *dev)
                                 ret = -EPROBE_DEFER;
                                 goto out_free_chip;
                         }
+
+                        /* Drop the mdio_bus device ref, replacing the host
+                         * device with the mdio_bus_switch device, keeping
+                         * the refcount from of_mdio_find_bus() above.
+                         */
+                        put_device(cd->host_dev);
                         cd->host_dev = &mdio_bus_switch->dev;
                 }
 
@@ -744,6 +762,10 @@ static int dsa_of_probe(struct device *dev)
                 }
         }
 
+        /* The individual chips hold their own refcount on the mdio bus,
+         * so drop ours */
+        put_device(&mdio_bus->dev);
+
         return 0;
 
 out_free_chip:
@@ -751,6 +773,10 @@ out_free_chip:
 out_free:
         kfree(pd);
         dev->platform_data = NULL;
+out_put_ethernet:
+        put_device(&ethernet_dev->dev);
+out_put_mdio:
+        put_device(&mdio_bus->dev);
         return ret;
 }
 
@@ -762,6 +788,7 @@ static void dsa_of_remove(struct device *dev)
                 return;
 
         dsa_of_free_platform_data(pd);
+        put_device(&pd->of_netdev->dev);
         kfree(pd);
 }
 #else
diff --git a/net/dsa/tag_trailer.c b/net/dsa/tag_trailer.c
index d25efc93d8f1..b6ca0890d018 100644
--- a/net/dsa/tag_trailer.c
+++ b/net/dsa/tag_trailer.c
@@ -78,7 +78,7 @@ static int trailer_rcv(struct sk_buff *skb, struct net_device *dev,
 
         trailer = skb_tail_pointer(skb) - 4;
         if (trailer[0] != 0x80 || (trailer[1] & 0xf8) != 0x00 ||
-            (trailer[3] & 0xef) != 0x00 || trailer[3] != 0x00)
+            (trailer[2] & 0xef) != 0x00 || trailer[3] != 0x00)
                 goto out_drop;
 
         source_port = trailer[1] & 7;
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 61ff5ea31283..01308e6e6127 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -113,6 +113,8 @@
 #include <net/arp.h>
 #include <net/ax25.h>
 #include <net/netrom.h>
+#include <net/dst_metadata.h>
+#include <net/ip_tunnels.h>
 
 #include <linux/uaccess.h>
 
@@ -296,7 +298,8 @@ static void arp_send_dst(int type, int ptype, __be32 dest_ip,
                          struct net_device *dev, __be32 src_ip,
                          const unsigned char *dest_hw,
                          const unsigned char *src_hw,
-                         const unsigned char *target_hw, struct sk_buff *oskb)
+                         const unsigned char *target_hw,
+                         struct dst_entry *dst)
 {
         struct sk_buff *skb;
 
@@ -309,9 +312,7 @@ static void arp_send_dst(int type, int ptype, __be32 dest_ip,
         if (!skb)
                 return;
 
-        if (oskb)
-                skb_dst_copy(skb, oskb);
-
+        skb_dst_set(skb, dst);
         arp_xmit(skb);
 }
 
@@ -333,6 +334,7 @@ static void arp_solicit(struct neighbour *neigh, struct sk_buff *skb)
         __be32 target = *(__be32 *)neigh->primary_key;
         int probes = atomic_read(&neigh->probes);
         struct in_device *in_dev;
+        struct dst_entry *dst = NULL;
 
         rcu_read_lock();
         in_dev = __in_dev_get_rcu(dev);
@@ -381,9 +383,10 @@ static void arp_solicit(struct neighbour *neigh, struct sk_buff *skb)
                 }
         }
 
+        if (skb && !(dev->priv_flags & IFF_XMIT_DST_RELEASE))
+                dst = dst_clone(skb_dst(skb));
         arp_send_dst(ARPOP_REQUEST, ETH_P_ARP, target, dev, saddr,
-                     dst_hw, dev->dev_addr, NULL,
-                     dev->priv_flags & IFF_XMIT_DST_RELEASE ? NULL : skb);
+                     dst_hw, dev->dev_addr, NULL, dst);
 }
 
 static int arp_ignore(struct in_device *in_dev, __be32 sip, __be32 tip)
@@ -654,6 +657,7 @@ static int arp_process(struct net *net, struct sock *sk, struct sk_buff *skb)
         u16 dev_type = dev->type;
         int addr_type;
         struct neighbour *n;
+        struct dst_entry *reply_dst = NULL;
         bool is_garp = false;
 
         /* arp_rcv below verifies the ARP header and verifies the device
@@ -754,13 +758,18 @@ static int arp_process(struct net *net, struct sock *sk, struct sk_buff *skb)
  *  cache.
  */
 
+        if (arp->ar_op == htons(ARPOP_REQUEST) && skb_metadata_dst(skb))
+                reply_dst = (struct dst_entry *)
+                            iptunnel_metadata_reply(skb_metadata_dst(skb),
+                                                    GFP_ATOMIC);
+
         /* Special case: IPv4 duplicate address detection packet (RFC2131) */
         if (sip == 0) {
                 if (arp->ar_op == htons(ARPOP_REQUEST) &&
                     inet_addr_type_dev_table(net, dev, tip) == RTN_LOCAL &&
                     !arp_ignore(in_dev, sip, tip))
-                        arp_send(ARPOP_REPLY, ETH_P_ARP, sip, dev, tip, sha,
-                                 dev->dev_addr, sha);
+                        arp_send_dst(ARPOP_REPLY, ETH_P_ARP, sip, dev, tip,
+                                     sha, dev->dev_addr, sha, reply_dst);
                 goto out;
         }
 
@@ -779,9 +788,10 @@ static int arp_process(struct net *net, struct sock *sk, struct sk_buff *skb)
                         if (!dont_send) {
                                 n = neigh_event_ns(&arp_tbl, sha, &sip, dev);
                                 if (n) {
-                                        arp_send(ARPOP_REPLY, ETH_P_ARP, sip,
-                                                 dev, tip, sha, dev->dev_addr,
-                                                 sha);
+                                        arp_send_dst(ARPOP_REPLY, ETH_P_ARP,
+                                                     sip, dev, tip, sha,
+                                                     dev->dev_addr, sha,
+                                                     reply_dst);
                                         neigh_release(n);
                                 }
                         }
@@ -799,9 +809,10 @@ static int arp_process(struct net *net, struct sock *sk, struct sk_buff *skb)
                                 if (NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED ||
                                     skb->pkt_type == PACKET_HOST ||
                                     NEIGH_VAR(in_dev->arp_parms, PROXY_DELAY) == 0) {
-                                        arp_send(ARPOP_REPLY, ETH_P_ARP, sip,
-                                                 dev, tip, sha, dev->dev_addr,
-                                                 sha);
+                                        arp_send_dst(ARPOP_REPLY, ETH_P_ARP,
+                                                     sip, dev, tip, sha,
+                                                     dev->dev_addr, sha,
+                                                     reply_dst);
                                 } else {
                                         pneigh_enqueue(&arp_tbl,
                                                        in_dev->arp_parms, skb);
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 26d6ffb6d23c..6c2af797f2f9 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -1426,7 +1426,7 @@ found:
                             nh->nh_flags & RTNH_F_LINKDOWN &&
                             !(fib_flags & FIB_LOOKUP_IGNORE_LINKSTATE))
                                 continue;
-                        if (!(flp->flowi4_flags & FLOWI_FLAG_VRFSRC)) {
+                        if (!(flp->flowi4_flags & FLOWI_FLAG_SKIP_NH_OIF)) {
                                 if (flp->flowi4_oif &&
                                     flp->flowi4_oif != nh->nh_oif)
                                         continue;
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 79fe05befcae..e5eb8ac4089d 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -427,7 +427,7 @@ static void icmp_reply(struct icmp_bxm *icmp_param, struct sk_buff *skb)
         fl4.flowi4_mark = mark;
         fl4.flowi4_tos = RT_TOS(ip_hdr(skb)->tos);
         fl4.flowi4_proto = IPPROTO_ICMP;
-        fl4.flowi4_oif = vrf_master_ifindex(skb->dev) ? : skb->dev->ifindex;
+        fl4.flowi4_oif = vrf_master_ifindex(skb->dev);
         security_skb_classify_flow(skb, flowi4_to_flowi(&fl4));
         rt = ip_route_output_key(net, &fl4);
         if (IS_ERR(rt))
@@ -461,7 +461,7 @@ static struct rtable *icmp_route_lookup(struct net *net,
         fl4->flowi4_proto = IPPROTO_ICMP;
         fl4->fl4_icmp_type = type;
         fl4->fl4_icmp_code = code;
-        fl4->flowi4_oif = vrf_master_ifindex(skb_in->dev) ? : skb_in->dev->ifindex;
+        fl4->flowi4_oif = vrf_master_ifindex(skb_in->dev);
 
         security_skb_classify_flow(skb_in, flowi4_to_flowi(fl4));
         rt = __ip_route_output_key(net, fl4);
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index bac205136e1c..ba2f90d90cb5 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -685,20 +685,20 @@ void reqsk_queue_hash_req(struct request_sock_queue *queue,
         req->num_timeout = 0;
         req->sk = NULL;
 
+        setup_timer(&req->rsk_timer, reqsk_timer_handler, (unsigned long)req);
+        mod_timer_pinned(&req->rsk_timer, jiffies + timeout);
+        req->rsk_hash = hash;
+
         /* before letting lookups find us, make sure all req fields
          * are committed to memory and refcnt initialized.
          */
         smp_wmb();
         atomic_set(&req->rsk_refcnt, 2);
-        setup_timer(&req->rsk_timer, reqsk_timer_handler, (unsigned long)req);
-        req->rsk_hash = hash;
 
         spin_lock(&queue->syn_wait_lock);
         req->dl_next = lopt->syn_table[hash];
         lopt->syn_table[hash] = req;
         spin_unlock(&queue->syn_wait_lock);
-
-        mod_timer_pinned(&req->rsk_timer, jiffies + timeout);
 }
 EXPORT_SYMBOL(reqsk_queue_hash_req);
 
diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c
index ae22cc24fbe8..c67f9bd7699c 100644
--- a/net/ipv4/inet_timewait_sock.c
+++ b/net/ipv4/inet_timewait_sock.c
@@ -123,13 +123,15 @@ void __inet_twsk_hashdance(struct inet_timewait_sock *tw, struct sock *sk,
         /*
          * Step 2: Hash TW into tcp ehash chain.
          * Notes :
-         * - tw_refcnt is set to 3 because :
+         * - tw_refcnt is set to 4 because :
          * - We have one reference from bhash chain.
          * - We have one reference from ehash chain.
+         * - We have one reference from timer.
+         * - One reference for ourself (our caller will release it).
          * We can use atomic_set() because prior spin_lock()/spin_unlock()
          * committed into memory all tw fields.
          */
-        atomic_set(&tw->tw_refcnt, 1 + 1 + 1);
+        atomic_set(&tw->tw_refcnt, 4);
         inet_twsk_add_node_rcu(tw, &ehead->chain);
 
         /* Step 3: Remove SK from hash chain */
@@ -217,7 +219,7 @@ void inet_twsk_deschedule_put(struct inet_timewait_sock *tw)
 }
 EXPORT_SYMBOL(inet_twsk_deschedule_put);
 
-void inet_twsk_schedule(struct inet_timewait_sock *tw, const int timeo)
+void __inet_twsk_schedule(struct inet_timewait_sock *tw, int timeo, bool rearm)
 {
         /* timeout := RTO * 3.5
          *
@@ -245,12 +247,14 @@ void inet_twsk_schedule(struct inet_timewait_sock *tw, const int timeo)
          */
 
         tw->tw_kill = timeo <= 4*HZ;
-        if (!mod_timer_pinned(&tw->tw_timer, jiffies + timeo)) {
-                atomic_inc(&tw->tw_refcnt);
+        if (!rearm) {
+                BUG_ON(mod_timer_pinned(&tw->tw_timer, jiffies + timeo));
                 atomic_inc(&tw->tw_dr->tw_count);
+        } else {
+                mod_timer_pending(&tw->tw_timer, jiffies + timeo);
         }
 }
-EXPORT_SYMBOL_GPL(inet_twsk_schedule);
+EXPORT_SYMBOL_GPL(__inet_twsk_schedule);
 
 void inet_twsk_purge(struct inet_hashinfo *hashinfo,
                      struct inet_timewait_death_row *twdr, int family)
diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c
index 29ed6c5a5185..84dce6a92f93 100644
--- a/net/ipv4/ip_tunnel_core.c
+++ b/net/ipv4/ip_tunnel_core.c
@@ -46,12 +46,13 @@
 #include <net/net_namespace.h>
 #include <net/netns/generic.h>
 #include <net/rtnetlink.h>
+#include <net/dst_metadata.h>
 
 int iptunnel_xmit(struct sock *sk, struct rtable *rt, struct sk_buff *skb,
                   __be32 src, __be32 dst, __u8 proto,
                   __u8 tos, __u8 ttl, __be16 df, bool xnet)
 {
-        int pkt_len = skb->len;
+        int pkt_len = skb->len - skb_inner_network_offset(skb);
         struct iphdr *iph;
         int err;
 
@@ -119,6 +120,33 @@ int iptunnel_pull_header(struct sk_buff *skb, int hdr_len, __be16 inner_proto)
 }
 EXPORT_SYMBOL_GPL(iptunnel_pull_header);
 
+struct metadata_dst *iptunnel_metadata_reply(struct metadata_dst *md,
+                                             gfp_t flags)
+{
+        struct metadata_dst *res;
+        struct ip_tunnel_info *dst, *src;
+
+        if (!md || md->u.tun_info.mode & IP_TUNNEL_INFO_TX)
+                return NULL;
+
+        res = metadata_dst_alloc(0, flags);
+        if (!res)
+                return NULL;
+
+        dst = &res->u.tun_info;
+        src = &md->u.tun_info;
+        dst->key.tun_id = src->key.tun_id;
+        if (src->mode & IP_TUNNEL_INFO_IPV6)
+                memcpy(&dst->key.u.ipv6.dst, &src->key.u.ipv6.src,
+                       sizeof(struct in6_addr));
+        else
+                dst->key.u.ipv4.dst = src->key.u.ipv4.src;
+        dst->mode = src->mode | IP_TUNNEL_INFO_TX;
+
+        return res;
+}
+EXPORT_SYMBOL_GPL(iptunnel_metadata_reply);
+
 struct sk_buff *iptunnel_handle_offloads(struct sk_buff *skb,
                                          bool csum_help,
                                          int gso_type_mask)
@@ -198,8 +226,6 @@ static const struct nla_policy ip_tun_policy[LWTUNNEL_IP_MAX + 1] = {
         [LWTUNNEL_IP_SRC]       = { .type = NLA_U32 },
         [LWTUNNEL_IP_TTL]       = { .type = NLA_U8 },
         [LWTUNNEL_IP_TOS]       = { .type = NLA_U8 },
-        [LWTUNNEL_IP_SPORT]     = { .type = NLA_U16 },
-        [LWTUNNEL_IP_DPORT]     = { .type = NLA_U16 },
         [LWTUNNEL_IP_FLAGS]     = { .type = NLA_U16 },
 };
 
@@ -239,12 +265,6 @@ static int ip_tun_build_state(struct net_device *dev, struct nlattr *attr,
         if (tb[LWTUNNEL_IP_TOS])
                 tun_info->key.tos = nla_get_u8(tb[LWTUNNEL_IP_TOS]);
 
-        if (tb[LWTUNNEL_IP_SPORT])
-                tun_info->key.tp_src = nla_get_be16(tb[LWTUNNEL_IP_SPORT]);
-
-        if (tb[LWTUNNEL_IP_DPORT])
-                tun_info->key.tp_dst = nla_get_be16(tb[LWTUNNEL_IP_DPORT]);
-
         if (tb[LWTUNNEL_IP_FLAGS])
                 tun_info->key.tun_flags = nla_get_u16(tb[LWTUNNEL_IP_FLAGS]);
 
@@ -266,8 +286,6 @@ static int ip_tun_fill_encap_info(struct sk_buff *skb,
             nla_put_be32(skb, LWTUNNEL_IP_SRC, tun_info->key.u.ipv4.src) ||
             nla_put_u8(skb, LWTUNNEL_IP_TOS, tun_info->key.tos) ||
             nla_put_u8(skb, LWTUNNEL_IP_TTL, tun_info->key.ttl) ||
-            nla_put_u16(skb, LWTUNNEL_IP_SPORT, tun_info->key.tp_src) ||
-            nla_put_u16(skb, LWTUNNEL_IP_DPORT, tun_info->key.tp_dst) ||
             nla_put_u16(skb, LWTUNNEL_IP_FLAGS, tun_info->key.tun_flags))
                 return -ENOMEM;
 
@@ -281,8 +299,6 @@ static int ip_tun_encap_nlsize(struct lwtunnel_state *lwtstate)
                 + nla_total_size(4)     /* LWTUNNEL_IP_SRC */
                 + nla_total_size(1)     /* LWTUNNEL_IP_TOS */
                 + nla_total_size(1)     /* LWTUNNEL_IP_TTL */
-                + nla_total_size(2)     /* LWTUNNEL_IP_SPORT */
-                + nla_total_size(2)     /* LWTUNNEL_IP_DPORT */
                 + nla_total_size(2);    /* LWTUNNEL_IP_FLAGS */
 }
 
@@ -305,8 +321,6 @@ static const struct nla_policy ip6_tun_policy[LWTUNNEL_IP6_MAX + 1] = {
         [LWTUNNEL_IP6_SRC]              = { .len = sizeof(struct in6_addr) },
         [LWTUNNEL_IP6_HOPLIMIT]         = { .type = NLA_U8 },
         [LWTUNNEL_IP6_TC]               = { .type = NLA_U8 },
-        [LWTUNNEL_IP6_SPORT]            = { .type = NLA_U16 },
-        [LWTUNNEL_IP6_DPORT]            = { .type = NLA_U16 },
         [LWTUNNEL_IP6_FLAGS]            = { .type = NLA_U16 },
 };
 
@@ -346,12 +360,6 @@ static int ip6_tun_build_state(struct net_device *dev, struct nlattr *attr,
         if (tb[LWTUNNEL_IP6_TC])
                 tun_info->key.tos = nla_get_u8(tb[LWTUNNEL_IP6_TC]);
 
-        if (tb[LWTUNNEL_IP6_SPORT])
-                tun_info->key.tp_src = nla_get_be16(tb[LWTUNNEL_IP6_SPORT]);
-
-        if (tb[LWTUNNEL_IP6_DPORT])
-                tun_info->key.tp_dst = nla_get_be16(tb[LWTUNNEL_IP6_DPORT]);
-
         if (tb[LWTUNNEL_IP6_FLAGS])
                 tun_info->key.tun_flags = nla_get_u16(tb[LWTUNNEL_IP6_FLAGS]);
 
@@ -373,8 +381,6 @@ static int ip6_tun_fill_encap_info(struct sk_buff *skb,
             nla_put_in6_addr(skb, LWTUNNEL_IP6_SRC, &tun_info->key.u.ipv6.src) ||
             nla_put_u8(skb, LWTUNNEL_IP6_HOPLIMIT, tun_info->key.tos) ||
             nla_put_u8(skb, LWTUNNEL_IP6_TC, tun_info->key.ttl) ||
-            nla_put_u16(skb, LWTUNNEL_IP6_SPORT, tun_info->key.tp_src) ||
-            nla_put_u16(skb, LWTUNNEL_IP6_DPORT, tun_info->key.tp_dst) ||
             nla_put_u16(skb, LWTUNNEL_IP6_FLAGS, tun_info->key.tun_flags))
                 return -ENOMEM;
 
@@ -388,8 +394,6 @@ static int ip6_tun_encap_nlsize(struct lwtunnel_state *lwtstate)
                 + nla_total_size(16)    /* LWTUNNEL_IP6_SRC */
                 + nla_total_size(1)     /* LWTUNNEL_IP6_HOPLIMIT */
                 + nla_total_size(1)     /* LWTUNNEL_IP6_TC */
-                + nla_total_size(2)     /* LWTUNNEL_IP6_SPORT */
-                + nla_total_size(2)     /* LWTUNNEL_IP6_DPORT */
                 + nla_total_size(2);    /* LWTUNNEL_IP6_FLAGS */
 }
 
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index f7afcba8b1a1..6bab84503cd9 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2036,6 +2036,7 @@ struct rtable *__ip_route_output_key(struct net *net, struct flowi4 *fl4)
         struct fib_result res;
         struct rtable *rth;
         int orig_oif;
+        int err = -ENETUNREACH;
 
         res.tclassid    = 0;
         res.fi          = NULL;
@@ -2144,7 +2145,8 @@ struct rtable *__ip_route_output_key(struct net *net, struct flowi4 *fl4)
                 goto make_route;
         }
 
-        if (fib_lookup(net, fl4, &res, 0)) {
+        err = fib_lookup(net, fl4, &res, 0);
+        if (err) {
                 res.fi = NULL;
                 res.table = NULL;
                 if (fl4->flowi4_oif) {
@@ -2172,7 +2174,7 @@ struct rtable *__ip_route_output_key(struct net *net, struct flowi4 *fl4)
                         res.type = RTN_UNICAST;
                         goto make_route;
                 }
-                rth = ERR_PTR(-ENETUNREACH);
+                rth = ERR_PTR(err);
                 goto out;
         }
 
diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c
index c6ded6b2a79f..448c2615fece 100644
--- a/net/ipv4/tcp_cubic.c
+++ b/net/ipv4/tcp_cubic.c
@@ -154,14 +154,20 @@ static void bictcp_init(struct sock *sk)
 static void bictcp_cwnd_event(struct sock *sk, enum tcp_ca_event event)
 {
         if (event == CA_EVENT_TX_START) {
-                s32 delta = tcp_time_stamp - tcp_sk(sk)->lsndtime;
                 struct bictcp *ca = inet_csk_ca(sk);
+                u32 now = tcp_time_stamp;
+                s32 delta;
+
+                delta = now - tcp_sk(sk)->lsndtime;
 
                 /* We were application limited (idle) for a while.
                  * Shift epoch_start to keep cwnd growth to cubic curve.
                  */
-                if (ca->epoch_start && delta > 0)
+                if (ca->epoch_start && delta > 0) {
                         ca->epoch_start += delta;
+                        if (after(ca->epoch_start, now))
+                                ca->epoch_start = now;
+                }
                 return;
         }
 }
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index e0a87c238882..e4fe62b6b106 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -162,9 +162,9 @@ kill_with_rst:
                 if (tcp_death_row.sysctl_tw_recycle &&
                     tcptw->tw_ts_recent_stamp &&
                     tcp_tw_remember_stamp(tw))
-                        inet_twsk_schedule(tw, tw->tw_timeout);
+                        inet_twsk_reschedule(tw, tw->tw_timeout);
                 else
-                        inet_twsk_schedule(tw, TCP_TIMEWAIT_LEN);
+                        inet_twsk_reschedule(tw, TCP_TIMEWAIT_LEN);
                 return TCP_TW_ACK;
         }
 
@@ -201,7 +201,7 @@ kill:
                                 return TCP_TW_SUCCESS;
                         }
                 }
-                inet_twsk_schedule(tw, TCP_TIMEWAIT_LEN);
+                inet_twsk_reschedule(tw, TCP_TIMEWAIT_LEN);
 
                 if (tmp_opt.saw_tstamp) {
                         tcptw->tw_ts_recent       = tmp_opt.rcv_tsval;
@@ -251,7 +251,7 @@ kill:
                  * Do not reschedule in the last case.
                  */
                 if (paws_reject || th->ack)
-                        inet_twsk_schedule(tw, TCP_TIMEWAIT_LEN);
+                        inet_twsk_reschedule(tw, TCP_TIMEWAIT_LEN);
 
                 return tcp_timewait_check_oow_rate_limit(
                         tw, skb, LINUX_MIB_TCPACKSKIPPEDTIMEWAIT);
@@ -322,9 +322,6 @@ void tcp_time_wait(struct sock *sk, int state, int timeo)
                 } while (0);
 #endif
 
-                /* Linkage updates. */
-                __inet_twsk_hashdance(tw, sk, &tcp_hashinfo);
-
                 /* Get the TIME_WAIT timeout firing. */
                 if (timeo < rto)
                         timeo = rto;
@@ -338,6 +335,8 @@ void tcp_time_wait(struct sock *sk, int state, int timeo)
                 }
 
                 inet_twsk_schedule(tw, timeo);
+                /* Linkage updates. */
+                __inet_twsk_hashdance(tw, sk, &tcp_hashinfo);
                 inet_twsk_put(tw);
         } else {
                 /* Sorry, if we're out of memory, just CLOSE this
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 53ce6cf55598..9e53dd9bfcad 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2893,6 +2893,7 @@ void tcp_send_active_reset(struct sock *sk, gfp_t priority)
         skb_reserve(skb, MAX_TCP_HEADER);
         tcp_init_nondata_skb(skb, tcp_acceptable_seq(sk),
                              TCPHDR_ACK | TCPHDR_RST);
+        skb_mstamp_get(&skb->skb_mstamp);
         /* Send it off. */
         if (tcp_transmit_skb(sk, skb, 0, priority))
                 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPABORTFAILED);
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index c0a15e7f359f..f7d1d5e19e95 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1024,7 +1024,8 @@ int udp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
                 if (netif_index_is_vrf(net, ipc.oif)) {
                         flowi4_init_output(fl4, ipc.oif, sk->sk_mark, tos,
                                            RT_SCOPE_UNIVERSE, sk->sk_protocol,
-                                           (flow_flags | FLOWI_FLAG_VRFSRC),
+                                           (flow_flags | FLOWI_FLAG_VRFSRC |
+                                            FLOWI_FLAG_SKIP_NH_OIF),
                                            faddr, saddr, dport,
                                            inet->inet_sport);
 
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 671011055ad5..0304d1680ca2 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -33,6 +33,8 @@ static struct dst_entry *__xfrm4_dst_lookup(struct net *net, struct flowi4 *fl4,
         if (saddr)
                 fl4->saddr = saddr->a4;
 
+        fl4->flowi4_flags = FLOWI_FLAG_SKIP_NH_OIF;
+
         rt = __ip_route_output_key(net, fl4);
         if (!IS_ERR(rt))
                 return &rt->dst;
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 759d28ad16b7..c8380f1876f1 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -5132,13 +5132,12 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
 
                         rt = addrconf_get_prefix_route(&ifp->peer_addr, 128,
                                                        ifp->idev->dev, 0, 0);
-                        if (rt && ip6_del_rt(rt))
-                                dst_free(&rt->dst);
+                        if (rt)
+                                ip6_del_rt(rt);
                 }
                 dst_hold(&ifp->rt->dst);
 
-                if (ip6_del_rt(ifp->rt))
-                        dst_free(&ifp->rt->dst);
+                ip6_del_rt(ifp->rt);
 
                 rt_genid_bump_ipv6(net);
                 break;
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 418d9823692b..7d2e0023c72d 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -155,6 +155,11 @@ static void node_free(struct fib6_node *fn)
         kmem_cache_free(fib6_node_kmem, fn);
 }
 
+static void rt6_rcu_free(struct rt6_info *rt)
+{
+        call_rcu(&rt->dst.rcu_head, dst_rcu_free);
+}
+
 static void rt6_free_pcpu(struct rt6_info *non_pcpu_rt)
 {
         int cpu;
@@ -169,7 +174,7 @@ static void rt6_free_pcpu(struct rt6_info *non_pcpu_rt)
                 ppcpu_rt = per_cpu_ptr(non_pcpu_rt->rt6i_pcpu, cpu);
                 pcpu_rt = *ppcpu_rt;
                 if (pcpu_rt) {
-                        dst_free(&pcpu_rt->dst);
+                        rt6_rcu_free(pcpu_rt);
                         *ppcpu_rt = NULL;
                 }
         }
@@ -181,7 +186,7 @@ static void rt6_release(struct rt6_info *rt)
 {
         if (atomic_dec_and_test(&rt->rt6i_ref)) {
                 rt6_free_pcpu(rt);
-                dst_free(&rt->dst);
+                rt6_rcu_free(rt);
         }
 }
 
@@ -846,7 +851,7 @@ add:
                 *ins = rt;
                 rt->rt6i_node = fn;
                 atomic_inc(&rt->rt6i_ref);
-                inet6_rt_notify(RTM_NEWROUTE, rt, info);
+                inet6_rt_notify(RTM_NEWROUTE, rt, info, 0);
                 info->nl_net->ipv6.rt6_stats->fib_rt_entries++;
 
                 if (!(fn->fn_flags & RTN_RTINFO)) {
@@ -872,7 +877,7 @@ add:
                 rt->rt6i_node = fn;
                 rt->dst.rt6_next = iter->dst.rt6_next;
                 atomic_inc(&rt->rt6i_ref);
-                inet6_rt_notify(RTM_NEWROUTE, rt, info);
+                inet6_rt_notify(RTM_NEWROUTE, rt, info, NLM_F_REPLACE);
                 if (!(fn->fn_flags & RTN_RTINFO)) {
                         info->nl_net->ipv6.rt6_stats->fib_route_nodes++;
                         fn->fn_flags |= RTN_RTINFO;
@@ -933,6 +938,10 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt,
         int replace_required = 0;
         int sernum = fib6_new_sernum(info->nl_net);
 
+        if (WARN_ON_ONCE((rt->dst.flags & DST_NOCACHE) &&
+                         !atomic_read(&rt->dst.__refcnt)))
+                return -EINVAL;
+
         if (info->nlh) {
                 if (!(info->nlh->nlmsg_flags & NLM_F_CREATE))
                         allow_create = 0;
@@ -1025,6 +1034,7 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt,
                 fib6_start_gc(info->nl_net, rt);
                 if (!(rt->rt6i_flags & RTF_CACHE))
                         fib6_prune_clones(info->nl_net, pn);
+                rt->dst.flags &= ~DST_NOCACHE;
         }
 
 out:
@@ -1049,7 +1059,8 @@ out:
                         atomic_inc(&pn->leaf->rt6i_ref);
                 }
 #endif
-                dst_free(&rt->dst);
+                if (!(rt->dst.flags & DST_NOCACHE))
+                        dst_free(&rt->dst);
         }
         return err;
 
@@ -1060,7 +1071,8 @@ out:
 st_failure:
         if (fn && !(fn->fn_flags & (RTN_RTINFO|RTN_ROOT)))
                 fib6_repair_tree(info->nl_net, fn);
-        dst_free(&rt->dst);
+        if (!(rt->dst.flags & DST_NOCACHE))
+                dst_free(&rt->dst);
         return err;
 #endif
 }
@@ -1410,7 +1422,7 @@ static void fib6_del_route(struct fib6_node *fn, struct rt6_info **rtp,
 
         fib6_purge_rt(rt, fn, net);
 
-        inet6_rt_notify(RTM_DELROUTE, rt, info);
+        inet6_rt_notify(RTM_DELROUTE, rt, info, 0);
         rt6_release(rt);
 }
 
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 4038c694ec03..3c7b9310b33f 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -404,13 +404,13 @@ static void ip6gre_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 struct ipv6_tlv_tnl_enc_lim *tel;
                 __u32 mtu;
         case ICMPV6_DEST_UNREACH:
-                net_warn_ratelimited("%s: Path to destination invalid or inactive!\n",
-                                     t->parms.name);
+                net_dbg_ratelimited("%s: Path to destination invalid or inactive!\n",
+                                    t->parms.name);
                 break;
         case ICMPV6_TIME_EXCEED:
                 if (code == ICMPV6_EXC_HOPLIMIT) {
-                        net_warn_ratelimited("%s: Too small hop limit or routing loop in tunnel!\n",
-                                             t->parms.name);
+                        net_dbg_ratelimited("%s: Too small hop limit or routing loop in tunnel!\n",
+                                            t->parms.name);
                 }
                 break;
         case ICMPV6_PARAMPROB:
@@ -421,12 +421,12 @@ static void ip6gre_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 if (teli && teli == be32_to_cpu(info) - 2) {
                         tel = (struct ipv6_tlv_tnl_enc_lim *) &skb->data[teli];
                         if (tel->encap_limit == 0) {
-                                net_warn_ratelimited("%s: Too small encapsulation limit or routing loop in tunnel!\n",
-                                                     t->parms.name);
+                                net_dbg_ratelimited("%s: Too small encapsulation limit or routing loop in tunnel!\n",
+                                                    t->parms.name);
                         }
                 } else {
-                        net_warn_ratelimited("%s: Recipient unable to parse tunneled packet!\n",
-                                             t->parms.name);
+                        net_dbg_ratelimited("%s: Recipient unable to parse tunneled packet!\n",
+                                            t->parms.name);
                 }
                 break;
         case ICMPV6_PKT_TOOBIG:
@@ -634,20 +634,20 @@ static netdev_tx_t ip6gre_xmit2(struct sk_buff *skb,
         }
 
         if (!fl6->flowi6_mark)
-                dst = ip6_tnl_dst_check(tunnel);
+                dst = ip6_tnl_dst_get(tunnel);
 
         if (!dst) {
-                ndst = ip6_route_output(net, NULL, fl6);
+                dst = ip6_route_output(net, NULL, fl6);
 
-                if (ndst->error)
+                if (dst->error)
                         goto tx_err_link_failure;
-                ndst = xfrm_lookup(net, ndst, flowi6_to_flowi(fl6), NULL, 0);
-                if (IS_ERR(ndst)) {
-                        err = PTR_ERR(ndst);
-                        ndst = NULL;
+                dst = xfrm_lookup(net, dst, flowi6_to_flowi(fl6), NULL, 0);
+                if (IS_ERR(dst)) {
+                        err = PTR_ERR(dst);
+                        dst = NULL;
                         goto tx_err_link_failure;
                 }
-                dst = ndst;
+                ndst = dst;
         }
 
         tdev = dst->dev;
@@ -702,12 +702,9 @@ static netdev_tx_t ip6gre_xmit2(struct sk_buff *skb,
                 skb = new_skb;
         }
 
-        if (fl6->flowi6_mark) {
-                skb_dst_set(skb, dst);
-                ndst = NULL;
-        } else {
-                skb_dst_set_noref(skb, dst);
-        }
+        if (!fl6->flowi6_mark && ndst)
+                ip6_tnl_dst_set(tunnel, ndst);
+        skb_dst_set(skb, dst);
 
         proto = NEXTHDR_GRE;
         if (encap_limit >= 0) {
@@ -762,14 +759,12 @@ static netdev_tx_t ip6gre_xmit2(struct sk_buff *skb,
         skb_set_inner_protocol(skb, protocol);
 
         ip6tunnel_xmit(NULL, skb, dev);
-        if (ndst)
-                ip6_tnl_dst_store(tunnel, ndst);
         return 0;
 tx_err_link_failure:
         stats->tx_carrier_errors++;
         dst_link_failure(skb);
 tx_err_dst_release:
-        dst_release(ndst);
+        dst_release(dst);
         return err;
 }
 
@@ -1223,6 +1218,9 @@ static const struct net_device_ops ip6gre_netdev_ops = {
 
 static void ip6gre_dev_free(struct net_device *dev)
 {
+        struct ip6_tnl *t = netdev_priv(dev);
+
+        ip6_tnl_dst_destroy(t);
         free_percpu(dev->tstats);
         free_netdev(dev);
 }
@@ -1245,9 +1243,10 @@ static void ip6gre_tunnel_setup(struct net_device *dev)
         netif_keep_dst(dev);
 }
 
-static int ip6gre_tunnel_init(struct net_device *dev)
+static int ip6gre_tunnel_init_common(struct net_device *dev)
 {
         struct ip6_tnl *tunnel;
+        int ret;
 
         tunnel = netdev_priv(dev);
 
@@ -1255,16 +1254,37 @@ static int ip6gre_tunnel_init(struct net_device *dev)
         tunnel->net = dev_net(dev);
         strcpy(tunnel->parms.name, dev->name);
 
+        dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
+        if (!dev->tstats)
+                return -ENOMEM;
+
+        ret = ip6_tnl_dst_init(tunnel);
+        if (ret) {
+                free_percpu(dev->tstats);
+                dev->tstats = NULL;
+                return ret;
+        }
+
+        return 0;
+}
+
+static int ip6gre_tunnel_init(struct net_device *dev)
+{
+        struct ip6_tnl *tunnel;
+        int ret;
+
+        ret = ip6gre_tunnel_init_common(dev);
+        if (ret)
+                return ret;
+
+        tunnel = netdev_priv(dev);
+
         memcpy(dev->dev_addr, &tunnel->parms.laddr, sizeof(struct in6_addr));
         memcpy(dev->broadcast, &tunnel->parms.raddr, sizeof(struct in6_addr));
 
         if (ipv6_addr_any(&tunnel->parms.raddr))
                 dev->header_ops = &ip6gre_header_ops;
 
-        dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
-        if (!dev->tstats)
-                return -ENOMEM;
-
         return 0;
 }
 
@@ -1460,19 +1480,16 @@ static void ip6gre_netlink_parms(struct nlattr *data[],
 static int ip6gre_tap_init(struct net_device *dev)
 {
         struct ip6_tnl *tunnel;
+        int ret;
 
-        tunnel = netdev_priv(dev);
+        ret = ip6gre_tunnel_init_common(dev);
+        if (ret)
+                return ret;
 
-        tunnel->dev = dev;
-        tunnel->net = dev_net(dev);
-        strcpy(tunnel->parms.name, dev->name);
+        tunnel = netdev_priv(dev);
 
         ip6gre_tnl_link_config(tunnel, 1);
 
-        dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
-        if (!dev->tstats)
-                return -ENOMEM;
-
         return 0;
 }
 
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 60c565309d0a..a598fe2c0849 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -600,20 +600,22 @@ int ip6_fragment(struct sock *sk, struct sk_buff *skb,
         frag_id = ipv6_select_ident(net, &ipv6_hdr(skb)->daddr,
                                     &ipv6_hdr(skb)->saddr);
 
+        hroom = LL_RESERVED_SPACE(rt->dst.dev);
         if (skb_has_frag_list(skb)) {
                 int first_len = skb_pagelen(skb);
                 struct sk_buff *frag2;
 
                 if (first_len - hlen > mtu ||
                     ((first_len - hlen) & 7) ||
-                    skb_cloned(skb))
+                    skb_cloned(skb) ||
+                    skb_headroom(skb) < (hroom + sizeof(struct frag_hdr)))
                         goto slow_path;
 
                 skb_walk_frags(skb, frag) {
                         /* Correct geometry. */
                         if (frag->len > mtu ||
                             ((frag->len & 7) && frag->next) ||
-                            skb_headroom(frag) < hlen)
+                            skb_headroom(frag) < (hlen + hroom + sizeof(struct frag_hdr)))
                                 goto slow_path_clean;
 
                         /* Partially cloned skb? */
@@ -630,8 +632,6 @@ int ip6_fragment(struct sock *sk, struct sk_buff *skb,
 
                 err = 0;
                 offset = 0;
-                frag = skb_shinfo(skb)->frag_list;
-                skb_frag_list_init(skb);
                 /* BUILD HEADER */
 
                 *prevhdr = NEXTHDR_FRAGMENT;
@@ -639,8 +639,11 @@ int ip6_fragment(struct sock *sk, struct sk_buff *skb,
                 if (!tmp_hdr) {
                         IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
                                       IPSTATS_MIB_FRAGFAILS);
-                        return -ENOMEM;
+                        err = -ENOMEM;
+                        goto fail;
                 }
+                frag = skb_shinfo(skb)->frag_list;
+                skb_frag_list_init(skb);
 
                 __skb_pull(skb, hlen);
                 fh = (struct frag_hdr *)__skb_push(skb, sizeof(struct frag_hdr));
@@ -737,7 +740,6 @@ slow_path:
          */
 
         *prevhdr = NEXTHDR_FRAGMENT;
-        hroom = LL_RESERVED_SPACE(rt->dst.dev);
         troom = rt->dst.dev->needed_tailroom;
 
         /*
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index b0ab420612bc..eabffbb89795 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -126,36 +126,92 @@ static struct net_device_stats *ip6_get_stats(struct net_device *dev)
  * Locking : hash tables are protected by RCU and RTNL
  */
 
-struct dst_entry *ip6_tnl_dst_check(struct ip6_tnl *t)
+static void ip6_tnl_per_cpu_dst_set(struct ip6_tnl_dst *idst,
+                                    struct dst_entry *dst)
 {
-        struct dst_entry *dst = t->dst_cache;
+        write_seqlock_bh(&idst->lock);
+        dst_release(rcu_dereference_protected(
+                            idst->dst,
+                            lockdep_is_held(&idst->lock.lock)));
+        if (dst) {
+                dst_hold(dst);
+                idst->cookie = rt6_get_cookie((struct rt6_info *)dst);
+        } else {
+                idst->cookie = 0;
+        }
+        rcu_assign_pointer(idst->dst, dst);
+        write_sequnlock_bh(&idst->lock);
+}
+
+struct dst_entry *ip6_tnl_dst_get(struct ip6_tnl *t)
+{
+        struct ip6_tnl_dst *idst;
+        struct dst_entry *dst;
+        unsigned int seq;
+        u32 cookie;
 
-        if (dst && dst->obsolete &&
-            !dst->ops->check(dst, t->dst_cookie)) {
-                t->dst_cache = NULL;
+        idst = raw_cpu_ptr(t->dst_cache);
+
+        rcu_read_lock();
+        do {
+                seq = read_seqbegin(&idst->lock);
+                dst = rcu_dereference(idst->dst);
+                cookie = idst->cookie;
+        } while (read_seqretry(&idst->lock, seq));
+
+        if (dst && !atomic_inc_not_zero(&dst->__refcnt))
+                dst = NULL;
+        rcu_read_unlock();
+
+        if (dst && dst->obsolete && !dst->ops->check(dst, cookie)) {
+                ip6_tnl_per_cpu_dst_set(idst, NULL);
                 dst_release(dst);
-                return NULL;
+                dst = NULL;
         }
-
         return dst;
 }
-EXPORT_SYMBOL_GPL(ip6_tnl_dst_check);
+EXPORT_SYMBOL_GPL(ip6_tnl_dst_get);
 
 void ip6_tnl_dst_reset(struct ip6_tnl *t)
 {
-        dst_release(t->dst_cache);
-        t->dst_cache = NULL;
+        int i;
+
+        for_each_possible_cpu(i)
+                ip6_tnl_per_cpu_dst_set(raw_cpu_ptr(t->dst_cache), NULL);
 }
 EXPORT_SYMBOL_GPL(ip6_tnl_dst_reset);
 
-void ip6_tnl_dst_store(struct ip6_tnl *t, struct dst_entry *dst)
+void ip6_tnl_dst_set(struct ip6_tnl *t, struct dst_entry *dst)
+{
+        ip6_tnl_per_cpu_dst_set(raw_cpu_ptr(t->dst_cache), dst);
+
+}
+EXPORT_SYMBOL_GPL(ip6_tnl_dst_set);
+
+void ip6_tnl_dst_destroy(struct ip6_tnl *t)
 {
-        struct rt6_info *rt = (struct rt6_info *) dst;
-        t->dst_cookie = rt6_get_cookie(rt);
-        dst_release(t->dst_cache);
-        t->dst_cache = dst;
+        if (!t->dst_cache)
+                return;
+
+        ip6_tnl_dst_reset(t);
+        free_percpu(t->dst_cache);
 }
-EXPORT_SYMBOL_GPL(ip6_tnl_dst_store);
+EXPORT_SYMBOL_GPL(ip6_tnl_dst_destroy);
+
+int ip6_tnl_dst_init(struct ip6_tnl *t)
+{
+        int i;
+
+        t->dst_cache = alloc_percpu(struct ip6_tnl_dst);
+        if (!t->dst_cache)
+                return -ENOMEM;
+
+        for_each_possible_cpu(i)
+                seqlock_init(&per_cpu_ptr(t->dst_cache, i)->lock);
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(ip6_tnl_dst_init);
 
 /**
  * ip6_tnl_lookup - fetch tunnel matching the end-point addresses
@@ -271,6 +327,9 @@ ip6_tnl_unlink(struct ip6_tnl_net *ip6n, struct ip6_tnl *t)
 
 static void ip6_dev_free(struct net_device *dev)
 {
+        struct ip6_tnl *t = netdev_priv(dev);
+
+        ip6_tnl_dst_destroy(t);
         free_percpu(dev->tstats);
         free_netdev(dev);
 }
@@ -510,14 +569,14 @@ ip6_tnl_err(struct sk_buff *skb, __u8 ipproto, struct inet6_skb_parm *opt,
                 struct ipv6_tlv_tnl_enc_lim *tel;
                 __u32 mtu;
         case ICMPV6_DEST_UNREACH:
-                net_warn_ratelimited("%s: Path to destination invalid or inactive!\n",
-                                     t->parms.name);
+                net_dbg_ratelimited("%s: Path to destination invalid or inactive!\n",
+                                    t->parms.name);
                 rel_msg = 1;
                 break;
         case ICMPV6_TIME_EXCEED:
                 if ((*code) == ICMPV6_EXC_HOPLIMIT) {
-                        net_warn_ratelimited("%s: Too small hop limit or routing loop in tunnel!\n",
-                                             t->parms.name);
+                        net_dbg_ratelimited("%s: Too small hop limit or routing loop in tunnel!\n",
+                                            t->parms.name);
                         rel_msg = 1;
                 }
                 break;
@@ -529,13 +588,13 @@ ip6_tnl_err(struct sk_buff *skb, __u8 ipproto, struct inet6_skb_parm *opt,
                 if (teli && teli == *info - 2) {
                         tel = (struct ipv6_tlv_tnl_enc_lim *) &skb->data[teli];
                         if (tel->encap_limit == 0) {
-                                net_warn_ratelimited("%s: Too small encapsulation limit or routing loop in tunnel!\n",
-                                                     t->parms.name);
+                                net_dbg_ratelimited("%s: Too small encapsulation limit or routing loop in tunnel!\n",
+                                                    t->parms.name);
                                 rel_msg = 1;
                         }
                 } else {
-                        net_warn_ratelimited("%s: Recipient unable to parse tunneled packet!\n",
-                                             t->parms.name);
+                        net_dbg_ratelimited("%s: Recipient unable to parse tunneled packet!\n",
+                                            t->parms.name);
                 }
                 break;
         case ICMPV6_PKT_TOOBIG:
@@ -1010,23 +1069,23 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
                 memcpy(&fl6->daddr, addr6, sizeof(fl6->daddr));
                 neigh_release(neigh);
         } else if (!fl6->flowi6_mark)
-                dst = ip6_tnl_dst_check(t);
+                dst = ip6_tnl_dst_get(t);
 
         if (!ip6_tnl_xmit_ctl(t, &fl6->saddr, &fl6->daddr))
                 goto tx_err_link_failure;
 
         if (!dst) {
-                ndst = ip6_route_output(net, NULL, fl6);
+                dst = ip6_route_output(net, NULL, fl6);
 
-                if (ndst->error)
+                if (dst->error)
                         goto tx_err_link_failure;
-                ndst = xfrm_lookup(net, ndst, flowi6_to_flowi(fl6), NULL, 0);
-                if (IS_ERR(ndst)) {
-                        err = PTR_ERR(ndst);
-                        ndst = NULL;
+                dst = xfrm_lookup(net, dst, flowi6_to_flowi(fl6), NULL, 0);
+                if (IS_ERR(dst)) {
+                        err = PTR_ERR(dst);
+                        dst = NULL;
                         goto tx_err_link_failure;
                 }
-                dst = ndst;
+                ndst = dst;
         }
 
         tdev = dst->dev;
@@ -1072,12 +1131,11 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
                 consume_skb(skb);
                 skb = new_skb;
         }
-        if (fl6->flowi6_mark) {
-                skb_dst_set(skb, dst);
-                ndst = NULL;
-        } else {
-                skb_dst_set_noref(skb, dst);
-        }
+
+        if (!fl6->flowi6_mark && ndst)
+                ip6_tnl_dst_set(t, ndst);
+        skb_dst_set(skb, dst);
+
         skb->transport_header = skb->network_header;
 
         proto = fl6->flowi6_proto;
@@ -1101,14 +1159,12 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
         ipv6h->saddr = fl6->saddr;
         ipv6h->daddr = fl6->daddr;
         ip6tunnel_xmit(NULL, skb, dev);
-        if (ndst)
-                ip6_tnl_dst_store(t, ndst);
         return 0;
 tx_err_link_failure:
         stats->tx_carrier_errors++;
         dst_link_failure(skb);
 tx_err_dst_release:
-        dst_release(ndst);
+        dst_release(dst);
         return err;
 }
 
@@ -1573,12 +1629,21 @@ static inline int
 ip6_tnl_dev_init_gen(struct net_device *dev)
 {
         struct ip6_tnl *t = netdev_priv(dev);
+        int ret;
 
         t->dev = dev;
         t->net = dev_net(dev);
         dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
         if (!dev->tstats)
                 return -ENOMEM;
+
+        ret = ip6_tnl_dst_init(t);
+        if (ret) {
+                free_percpu(dev->tstats);
+                dev->tstats = NULL;
+                return ret;
+        }
+
         return 0;
 }
 
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 118f8fa1a809..6fbf6fdde7e7 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1298,8 +1298,7 @@ static void ip6_link_failure(struct sk_buff *skb)
         if (rt) {
                 if (rt->rt6i_flags & RTF_CACHE) {
                         dst_hold(&rt->dst);
-                        if (ip6_del_rt(rt))
-                                dst_free(&rt->dst);
+                        ip6_del_rt(rt);
                 } else if (rt->rt6i_node && (rt->rt6i_flags & RTF_DEFAULT)) {
                         rt->rt6i_node->fn_sernum = -1;
                 }
@@ -1862,9 +1861,11 @@ int ip6_route_info_create(struct fib6_config *cfg, struct rt6_info **rt_ret)
                         rt->dst.input = ip6_pkt_prohibit;
                         break;
                 case RTN_THROW:
+                case RTN_UNREACHABLE:
                 default:
                         rt->dst.error = (cfg->fc_type == RTN_THROW) ? -EAGAIN
-                                        : -ENETUNREACH;
+                                        : (cfg->fc_type == RTN_UNREACHABLE)
+                                        ? -EHOSTUNREACH : -ENETUNREACH;
                         rt->dst.output = ip6_pkt_discard_out;
                         rt->dst.input = ip6_pkt_discard;
                         break;
@@ -2004,7 +2005,8 @@ static int __ip6_del_rt(struct rt6_info *rt, struct nl_info *info)
         struct fib6_table *table;
         struct net *net = dev_net(rt->dst.dev);
 
-        if (rt == net->ipv6.ip6_null_entry) {
+        if (rt == net->ipv6.ip6_null_entry ||
+            rt->dst.flags & DST_NOCACHE) {
                 err = -ENOENT;
                 goto out;
         }
@@ -2491,6 +2493,7 @@ struct rt6_info *addrconf_dst_alloc(struct inet6_dev *idev,
         rt->rt6i_dst.addr = *addr;
         rt->rt6i_dst.plen = 128;
         rt->rt6i_table = fib6_get_table(net, RT6_TABLE_LOCAL);
+        rt->dst.flags |= DST_NOCACHE;
 
         atomic_set(&rt->dst.__refcnt, 1);
 
@@ -3279,7 +3282,8 @@ errout:
         return err;
 }
 
-void inet6_rt_notify(int event, struct rt6_info *rt, struct nl_info *info)
+void inet6_rt_notify(int event, struct rt6_info *rt, struct nl_info *info,
+                     unsigned int nlm_flags)
 {
         struct sk_buff *skb;
         struct net *net = info->nl_net;
@@ -3294,7 +3298,7 @@ void inet6_rt_notify(int event, struct rt6_info *rt, struct nl_info *info)
                 goto errout;
 
         err = rt6_fill_node(net, skb, rt, NULL, NULL, 0,
-                                event, info->portid, seq, 0, 0, 0);
+                                event, info->portid, seq, 0, 0, nlm_flags);
         if (err < 0) {
                 /* -EMSGSIZE implies BUG in rt6_nlmsg_size() */
                 WARN_ON(err == -EMSGSIZE);
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 17b1fe961c5d..7a77a1470f25 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -2474,6 +2474,7 @@ static int ieee80211_set_cqm_rssi_config(struct wiphy *wiphy,
 
         bss_conf->cqm_rssi_thold = rssi_thold;
         bss_conf->cqm_rssi_hyst = rssi_hyst;
+        sdata->u.mgd.last_cqm_event_signal = 0;
 
         /* tell the driver upon association, unless already associated */
         if (sdata->u.mgd.associated &&
@@ -2518,15 +2519,17 @@ static int ieee80211_set_bitrate_mask(struct wiphy *wiphy,
                         continue;
 
                 for (j = 0; j < IEEE80211_HT_MCS_MASK_LEN; j++) {
-                        if (~sdata->rc_rateidx_mcs_mask[i][j])
+                        if (~sdata->rc_rateidx_mcs_mask[i][j]) {
                                 sdata->rc_has_mcs_mask[i] = true;
+                                break;
+                        }
+                }
 
-                        if (~sdata->rc_rateidx_vht_mcs_mask[i][j])
+                for (j = 0; j < NL80211_VHT_NSS_MAX; j++) {
+                        if (~sdata->rc_rateidx_vht_mcs_mask[i][j]) {
                                 sdata->rc_has_vht_mcs_mask[i] = true;
-
-                        if (sdata->rc_has_mcs_mask[i] &&
-                            sdata->rc_has_vht_mcs_mask[i])
                                 break;
+                        }
                 }
         }
 
diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
index 675d12c69e32..a5d41dfa9f05 100644
--- a/net/netfilter/nf_log.c
+++ b/net/netfilter/nf_log.c
@@ -107,12 +107,17 @@ EXPORT_SYMBOL(nf_log_register);
 
 void nf_log_unregister(struct nf_logger *logger)
 {
+        const struct nf_logger *log;
         int i;
 
         mutex_lock(&nf_log_mutex);
-        for (i = 0; i < NFPROTO_NUMPROTO; i++)
-                RCU_INIT_POINTER(loggers[i][logger->type], NULL);
+        for (i = 0; i < NFPROTO_NUMPROTO; i++) {
+                log = nft_log_dereference(loggers[i][logger->type]);
+                if (log == logger)
+                        RCU_INIT_POINTER(loggers[i][logger->type], NULL);
+        }
         mutex_unlock(&nf_log_mutex);
+        synchronize_rcu();
 }
 EXPORT_SYMBOL(nf_log_unregister);
 
diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
index 66def315eb56..9c8fab00164b 100644
--- a/net/netfilter/nft_compat.c
+++ b/net/netfilter/nft_compat.c
@@ -619,6 +619,13 @@ struct nft_xt {
 
 static struct nft_expr_type nft_match_type;
 
+static bool nft_match_cmp(const struct xt_match *match,
+                          const char *name, u32 rev, u32 family)
+{
+        return strcmp(match->name, name) == 0 && match->revision == rev &&
+               (match->family == NFPROTO_UNSPEC || match->family == family);
+}
+
 static const struct nft_expr_ops *
 nft_match_select_ops(const struct nft_ctx *ctx,
                      const struct nlattr * const tb[])
@@ -626,7 +633,7 @@ nft_match_select_ops(const struct nft_ctx *ctx,
         struct nft_xt *nft_match;
         struct xt_match *match;
         char *mt_name;
-        __u32 rev, family;
+        u32 rev, family;
 
         if (tb[NFTA_MATCH_NAME] == NULL ||
             tb[NFTA_MATCH_REV] == NULL ||
@@ -641,8 +648,7 @@ nft_match_select_ops(const struct nft_ctx *ctx,
         list_for_each_entry(nft_match, &nft_match_list, head) {
                 struct xt_match *match = nft_match->ops.data;
 
-                if (strcmp(match->name, mt_name) == 0 &&
-                    match->revision == rev && match->family == family) {
+                if (nft_match_cmp(match, mt_name, rev, family)) {
                         if (!try_module_get(match->me))
                                 return ERR_PTR(-ENOENT);
 
@@ -693,6 +699,13 @@ static LIST_HEAD(nft_target_list);
 
 static struct nft_expr_type nft_target_type;
 
+static bool nft_target_cmp(const struct xt_target *tg,
+                           const char *name, u32 rev, u32 family)
+{
+        return strcmp(tg->name, name) == 0 && tg->revision == rev &&
+               (tg->family == NFPROTO_UNSPEC || tg->family == family);
+}
+
 static const struct nft_expr_ops *
 nft_target_select_ops(const struct nft_ctx *ctx,
                       const struct nlattr * const tb[])
@@ -700,7 +713,7 @@ nft_target_select_ops(const struct nft_ctx *ctx,
         struct nft_xt *nft_target;
         struct xt_target *target;
         char *tg_name;
-        __u32 rev, family;
+        u32 rev, family;
 
         if (tb[NFTA_TARGET_NAME] == NULL ||
             tb[NFTA_TARGET_REV] == NULL ||
@@ -715,8 +728,7 @@ nft_target_select_ops(const struct nft_ctx *ctx,
         list_for_each_entry(nft_target, &nft_target_list, head) {
                 struct xt_target *target = nft_target->ops.data;
 
-                if (strcmp(target->name, tg_name) == 0 &&
-                    target->revision == rev && target->family == family) {
+                if (nft_target_cmp(target, tg_name, rev, family)) {
                         if (!try_module_get(target->me))
                                 return ERR_PTR(-ENOENT);
 
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 7f86d3b55060..8f060d7f9a0e 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -125,6 +125,24 @@ static inline u32 netlink_group_mask(u32 group)
         return group ? 1 << (group - 1) : 0;
 }
 
+static struct sk_buff *netlink_to_full_skb(const struct sk_buff *skb,
+                                           gfp_t gfp_mask)
+{
+        unsigned int len = skb_end_offset(skb);
+        struct sk_buff *new;
+
+        new = alloc_skb(len, gfp_mask);
+        if (new == NULL)
+                return NULL;
+
+        NETLINK_CB(new).portid = NETLINK_CB(skb).portid;
+        NETLINK_CB(new).dst_group = NETLINK_CB(skb).dst_group;
+        NETLINK_CB(new).creds = NETLINK_CB(skb).creds;
+
+        memcpy(skb_put(new, len), skb->data, len);
+        return new;
+}
+
 int netlink_add_tap(struct netlink_tap *nt)
 {
         if (unlikely(nt->dev->type != ARPHRD_NETLINK))
@@ -206,7 +224,11 @@ static int __netlink_deliver_tap_skb(struct sk_buff *skb,
         int ret = -ENOMEM;
 
         dev_hold(dev);
-        nskb = skb_clone(skb, GFP_ATOMIC);
+
+        if (netlink_skb_is_mmaped(skb) || is_vmalloc_addr(skb->head))
+                nskb = netlink_to_full_skb(skb, GFP_ATOMIC);
+        else
+                nskb = skb_clone(skb, GFP_ATOMIC);
         if (nskb) {
                 nskb->dev = dev;
                 nskb->protocol = htons((u16) sk->sk_protocol);
@@ -279,11 +301,6 @@ static void netlink_rcv_wake(struct sock *sk)
 }
 
 #ifdef CONFIG_NETLINK_MMAP
-static bool netlink_skb_is_mmaped(const struct sk_buff *skb)
-{
-        return NETLINK_CB(skb).flags & NETLINK_SKB_MMAPED;
-}
-
 static bool netlink_rx_is_mmaped(struct sock *sk)
 {
         return nlk_sk(sk)->rx_ring.pg_vec != NULL;
@@ -846,7 +863,6 @@ static void netlink_ring_set_copied(struct sock *sk, struct sk_buff *skb)
 }
 
 #else /* CONFIG_NETLINK_MMAP */
-#define netlink_skb_is_mmaped(skb)      false
 #define netlink_rx_is_mmaped(sk)        false
 #define netlink_tx_is_mmaped(sk)        false
 #define netlink_mmap                    sock_no_mmap
@@ -1094,8 +1110,8 @@ static int netlink_insert(struct sock *sk, u32 portid)
 
         lock_sock(sk);
 
-        err = -EBUSY;
-        if (nlk_sk(sk)->portid)
+        err = nlk_sk(sk)->portid == portid ? 0 : -EBUSY;
+        if (nlk_sk(sk)->bound)
                 goto err;
 
         err = -ENOMEM;
@@ -1115,10 +1131,14 @@ static int netlink_insert(struct sock *sk, u32 portid)
                         err = -EOVERFLOW;
                 if (err == -EEXIST)
                         err = -EADDRINUSE;
-                nlk_sk(sk)->portid = 0;
                 sock_put(sk);
+                goto err;
         }
 
+        /* We need to ensure that the socket is hashed and visible. */
+        smp_wmb();
+        nlk_sk(sk)->bound = portid;
+
 err:
         release_sock(sk);
         return err;
@@ -1503,6 +1523,7 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr,
         struct sockaddr_nl *nladdr = (struct sockaddr_nl *)addr;
         int err;
         long unsigned int groups = nladdr->nl_groups;
+        bool bound;
 
         if (addr_len < sizeof(struct sockaddr_nl))
                 return -EINVAL;
@@ -1519,9 +1540,14 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr,
                         return err;
         }
 
-        if (nlk->portid)
+        bound = nlk->bound;
+        if (bound) {
+                /* Ensure nlk->portid is up-to-date. */
+                smp_rmb();
+
                 if (nladdr->nl_pid != nlk->portid)
                         return -EINVAL;
+        }
 
         if (nlk->netlink_bind && groups) {
                 int group;
@@ -1537,7 +1563,10 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr,
                 }
         }
 
-        if (!nlk->portid) {
+        /* No need for barriers here as we return to user-space without
+         * using any of the bound attributes.
+         */
+        if (!bound) {
                 err = nladdr->nl_pid ?
                         netlink_insert(sk, nladdr->nl_pid) :
                         netlink_autobind(sock);
@@ -1585,7 +1614,10 @@ static int netlink_connect(struct socket *sock, struct sockaddr *addr,
             !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND))
                 return -EPERM;
 
-        if (!nlk->portid)
+        /* No need for barriers here as we return to user-space without
+         * using any of the bound attributes.
+         */
+        if (!nlk->bound)
                 err = netlink_autobind(sock);
 
         if (err == 0) {
@@ -2426,10 +2458,13 @@ static int netlink_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
                 dst_group = nlk->dst_group;
         }
 
-        if (!nlk->portid) {
+        if (!nlk->bound) {
                 err = netlink_autobind(sock);
                 if (err)
                         goto out;
+        } else {
+                /* Ensure nlk is hashed and visible. */
+                smp_rmb();
         }
 
         /* It's a really convoluted way for userland to ask for mmaped
diff --git a/net/netlink/af_netlink.h b/net/netlink/af_netlink.h
index 89008405d6b4..14437d9b1965 100644
--- a/net/netlink/af_netlink.h
+++ b/net/netlink/af_netlink.h
@@ -35,6 +35,7 @@ struct netlink_sock {
         unsigned long           state;
         size_t                  max_recvmsg_len;
         wait_queue_head_t       wait;
+        bool                    bound;
         bool                    cb_running;
         struct netlink_callback cb;
         struct mutex            *cb_mutex;
@@ -59,6 +60,15 @@ static inline struct netlink_sock *nlk_sk(struct sock *sk)
         return container_of(sk, struct netlink_sock, sk);
 }
 
+static inline bool netlink_skb_is_mmaped(const struct sk_buff *skb)
+{
+#ifdef CONFIG_NETLINK_MMAP
+        return NETLINK_CB(skb).flags & NETLINK_SKB_MMAPED;
+#else
+        return false;
+#endif /* CONFIG_NETLINK_MMAP */
+}
+
 struct netlink_table {
         struct rhashtable       hash;
         struct hlist_head       mc_list;
diff --git a/net/openvswitch/Kconfig b/net/openvswitch/Kconfig
index 2a071f470d57..d143aa9f6654 100644
--- a/net/openvswitch/Kconfig
+++ b/net/openvswitch/Kconfig
@@ -5,7 +5,8 @@
 config OPENVSWITCH
         tristate "Open vSwitch"
         depends on INET
-        depends on (!NF_CONNTRACK || NF_CONNTRACK)
+        depends on !NF_CONNTRACK || \
+                   (NF_CONNTRACK && (!NF_DEFRAG_IPV6 || NF_DEFRAG_IPV6))
         select LIBCRC32C
         select MPLS
         select NET_MPLS_GSO
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index aaf5cbd6d9ae..eb759e3a88ca 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -275,13 +275,15 @@ static int ovs_ct_helper(struct sk_buff *skb, u16 proto)
         case NFPROTO_IPV6: {
                 u8 nexthdr = ipv6_hdr(skb)->nexthdr;
                 __be16 frag_off;
+                int ofs;
 
-                protoff = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr),
-                                           &nexthdr, &frag_off);
-                if (protoff < 0 || (frag_off & htons(~0x7)) != 0) {
+                ofs = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr,
+                                       &frag_off);
+                if (ofs < 0 || (frag_off & htons(~0x7)) != 0) {
                         pr_debug("proto header not found\n");
                         return NF_ACCEPT;
                 }
+                protoff = ofs;
                 break;
         }
         default:
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index 2913594c5123..a75828091e21 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -951,7 +951,7 @@ static int ovs_flow_cmd_new(struct sk_buff *skb, struct genl_info *info)
         if (error)
                 goto err_kfree_flow;
 
-        ovs_flow_mask_key(&new_flow->key, &key, &mask);
+        ovs_flow_mask_key(&new_flow->key, &key, true, &mask);
 
         /* Extract flow identifier. */
         error = ovs_nla_get_identifier(&new_flow->id, a[OVS_FLOW_ATTR_UFID],
@@ -1079,7 +1079,7 @@ static struct sw_flow_actions *get_flow_actions(struct net *net,
         struct sw_flow_key masked_key;
         int error;
 
-        ovs_flow_mask_key(&masked_key, key, mask);
+        ovs_flow_mask_key(&masked_key, key, true, mask);
         error = ovs_nla_copy_actions(net, a, &masked_key, &acts, log);
         if (error) {
                 OVS_NLERR(log,
diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
index c92d6a262bc5..5c030a4d7338 100644
--- a/net/openvswitch/flow_netlink.c
+++ b/net/openvswitch/flow_netlink.c
@@ -57,6 +57,7 @@ struct ovs_len_tbl {
 };
 
 #define OVS_ATTR_NESTED -1
+#define OVS_ATTR_VARIABLE -2
 
 static void update_range(struct sw_flow_match *match,
                          size_t offset, size_t size, bool is_mask)
@@ -304,6 +305,10 @@ size_t ovs_key_attr_size(void)
                 + nla_total_size(28); /* OVS_KEY_ATTR_ND */
 }
 
+static const struct ovs_len_tbl ovs_vxlan_ext_key_lens[OVS_VXLAN_EXT_MAX + 1] = {
+        [OVS_VXLAN_EXT_GBP]         = { .len = sizeof(u32) },
+};
+
 static const struct ovs_len_tbl ovs_tunnel_key_lens[OVS_TUNNEL_KEY_ATTR_MAX + 1] = {
         [OVS_TUNNEL_KEY_ATTR_ID]            = { .len = sizeof(u64) },
         [OVS_TUNNEL_KEY_ATTR_IPV4_SRC]      = { .len = sizeof(u32) },
@@ -315,8 +320,9 @@ static const struct ovs_len_tbl ovs_tunnel_key_lens[OVS_TUNNEL_KEY_ATTR_MAX + 1]
         [OVS_TUNNEL_KEY_ATTR_TP_SRC]        = { .len = sizeof(u16) },
         [OVS_TUNNEL_KEY_ATTR_TP_DST]        = { .len = sizeof(u16) },
         [OVS_TUNNEL_KEY_ATTR_OAM]           = { .len = 0 },
-        [OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS]   = { .len = OVS_ATTR_NESTED },
-        [OVS_TUNNEL_KEY_ATTR_VXLAN_OPTS]    = { .len = OVS_ATTR_NESTED },
+        [OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS]   = { .len = OVS_ATTR_VARIABLE },
+        [OVS_TUNNEL_KEY_ATTR_VXLAN_OPTS]    = { .len = OVS_ATTR_NESTED,
+                                                .next = ovs_vxlan_ext_key_lens },
 };
 
 /* The size of the argument for each %OVS_KEY_ATTR_* Netlink attribute.  */
@@ -349,6 +355,13 @@ static const struct ovs_len_tbl ovs_key_lens[OVS_KEY_ATTR_MAX + 1] = {
         [OVS_KEY_ATTR_CT_LABEL]  = { .len = sizeof(struct ovs_key_ct_label) },
 };
 
+static bool check_attr_len(unsigned int attr_len, unsigned int expected_len)
+{
+        return expected_len == attr_len ||
+               expected_len == OVS_ATTR_NESTED ||
+               expected_len == OVS_ATTR_VARIABLE;
+}
+
 static bool is_all_zero(const u8 *fp, size_t size)
 {
         int i;
@@ -388,7 +401,7 @@ static int __parse_flow_nlattrs(const struct nlattr *attr,
                 }
 
                 expected_len = ovs_key_lens[type].len;
-                if (nla_len(nla) != expected_len && expected_len != OVS_ATTR_NESTED) {
+                if (!check_attr_len(nla_len(nla), expected_len)) {
                         OVS_NLERR(log, "Key %d has unexpected len %d expected %d",
                                   type, nla_len(nla), expected_len);
                         return -EINVAL;
@@ -473,29 +486,50 @@ static int genev_tun_opt_from_nlattr(const struct nlattr *a,
         return 0;
 }
 
-static const struct nla_policy vxlan_opt_policy[OVS_VXLAN_EXT_MAX + 1] = {
-        [OVS_VXLAN_EXT_GBP]     = { .type = NLA_U32 },
-};
-
-static int vxlan_tun_opt_from_nlattr(const struct nlattr *a,
+static int vxlan_tun_opt_from_nlattr(const struct nlattr *attr,
                                      struct sw_flow_match *match, bool is_mask,
                                      bool log)
 {
-        struct nlattr *tb[OVS_VXLAN_EXT_MAX+1];
+        struct nlattr *a;
+        int rem;
         unsigned long opt_key_offset;
         struct vxlan_metadata opts;
-        int err;
 
         BUILD_BUG_ON(sizeof(opts) > sizeof(match->key->tun_opts));
 
-        err = nla_parse_nested(tb, OVS_VXLAN_EXT_MAX, a, vxlan_opt_policy);
-        if (err < 0)
-                return err;
-
         memset(&opts, 0, sizeof(opts));
+        nla_for_each_nested(a, attr, rem) {
+                int type = nla_type(a);
 
-        if (tb[OVS_VXLAN_EXT_GBP])
-                opts.gbp = nla_get_u32(tb[OVS_VXLAN_EXT_GBP]);
+                if (type > OVS_VXLAN_EXT_MAX) {
+                        OVS_NLERR(log, "VXLAN extension %d out of range max %d",
+                                  type, OVS_VXLAN_EXT_MAX);
+                        return -EINVAL;
+                }
+
+                if (!check_attr_len(nla_len(a),
+                                    ovs_vxlan_ext_key_lens[type].len)) {
+                        OVS_NLERR(log, "VXLAN extension %d has unexpected len %d expected %d",
+                                  type, nla_len(a),
+                                  ovs_vxlan_ext_key_lens[type].len);
+                        return -EINVAL;
+                }
+
+                switch (type) {
+                case OVS_VXLAN_EXT_GBP:
+                        opts.gbp = nla_get_u32(a);
+                        break;
+                default:
+                        OVS_NLERR(log, "Unknown VXLAN extension attribute %d",
+                                  type);
+                        return -EINVAL;
+                }
+        }
+        if (rem) {
+                OVS_NLERR(log, "VXLAN extension message has %d unknown bytes.",
+                          rem);
+                return -EINVAL;
+        }
 
         if (!is_mask)
                 SW_FLOW_KEY_PUT(match, tun_opts_len, sizeof(opts), false);
@@ -528,8 +562,8 @@ static int ipv4_tun_from_nlattr(const struct nlattr *attr,
                         return -EINVAL;
                 }
 
-                if (ovs_tunnel_key_lens[type].len != nla_len(a) &&
-                    ovs_tunnel_key_lens[type].len != OVS_ATTR_NESTED) {
+                if (!check_attr_len(nla_len(a),
+                                    ovs_tunnel_key_lens[type].len)) {
                         OVS_NLERR(log, "Tunnel attr %d has unexpected len %d expected %d",
                                   type, nla_len(a), ovs_tunnel_key_lens[type].len);
                         return -EINVAL;
@@ -1052,10 +1086,13 @@ static void nlattr_set(struct nlattr *attr, u8 val,
 
         /* The nlattr stream should already have been validated */
         nla_for_each_nested(nla, attr, rem) {
-                if (tbl && tbl[nla_type(nla)].len == OVS_ATTR_NESTED)
-                        nlattr_set(nla, val, tbl[nla_type(nla)].next);
-                else
+                if (tbl[nla_type(nla)].len == OVS_ATTR_NESTED) {
+                        if (tbl[nla_type(nla)].next)
+                                tbl = tbl[nla_type(nla)].next;
+                        nlattr_set(nla, val, tbl);
+                } else {
                         memset(nla_data(nla), val, nla_len(nla));
+                }
         }
 }
 
@@ -1922,8 +1959,7 @@ static int validate_set(const struct nlattr *a,
                 key_len /= 2;
 
         if (key_type > OVS_KEY_ATTR_MAX ||
-            (ovs_key_lens[key_type].len != key_len &&
-             ovs_key_lens[key_type].len != OVS_ATTR_NESTED))
+            !check_attr_len(key_len, ovs_key_lens[key_type].len))
                 return -EINVAL;
 
         if (masked && !validate_masked(nla_data(ovs_key), key_len))
diff --git a/net/openvswitch/flow_table.c b/net/openvswitch/flow_table.c
index d22d8e948d0f..f2ea83ba4763 100644
--- a/net/openvswitch/flow_table.c
+++ b/net/openvswitch/flow_table.c
@@ -57,20 +57,21 @@ static u16 range_n_bytes(const struct sw_flow_key_range *range)
 }
 
 void ovs_flow_mask_key(struct sw_flow_key *dst, const struct sw_flow_key *src,
-                       const struct sw_flow_mask *mask)
+                       bool full, const struct sw_flow_mask *mask)
 {
-        const long *m = (const long *)((const u8 *)&mask->key +
-                                mask->range.start);
-        const long *s = (const long *)((const u8 *)src +
-                                mask->range.start);
-        long *d = (long *)((u8 *)dst + mask->range.start);
+        int start = full ? 0 : mask->range.start;
+        int len = full ? sizeof *dst : range_n_bytes(&mask->range);
+        const long *m = (const long *)((const u8 *)&mask->key + start);
+        const long *s = (const long *)((const u8 *)src + start);
+        long *d = (long *)((u8 *)dst + start);
         int i;
 
-        /* The memory outside of the 'mask->range' are not set since
-         * further operations on 'dst' only uses contents within
-         * 'mask->range'.
+        /* If 'full' is true then all of 'dst' is fully initialized. Otherwise,
+         * if 'full' is false the memory outside of the 'mask->range' is left
+         * uninitialized. This can be used as an optimization when further
+         * operations on 'dst' only use contents within 'mask->range'.
          */
-        for (i = 0; i < range_n_bytes(&mask->range); i += sizeof(long))
+        for (i = 0; i < len; i += sizeof(long))
                 *d++ = *s++ & *m++;
 }
 
@@ -475,7 +476,7 @@ static struct sw_flow *masked_flow_lookup(struct table_instance *ti,
         u32 hash;
         struct sw_flow_key masked_key;
 
-        ovs_flow_mask_key(&masked_key, unmasked, mask);
+        ovs_flow_mask_key(&masked_key, unmasked, false, mask);
         hash = flow_hash(&masked_key, &mask->range);
         head = find_bucket(ti, hash);
         hlist_for_each_entry_rcu(flow, head, flow_table.node[ti->node_ver]) {
diff --git a/net/openvswitch/flow_table.h b/net/openvswitch/flow_table.h
index 616eda10d955..2dd9900f533d 100644
--- a/net/openvswitch/flow_table.h
+++ b/net/openvswitch/flow_table.h
@@ -86,5 +86,5 @@ struct sw_flow *ovs_flow_tbl_lookup_ufid(struct flow_table *,
 bool ovs_flow_cmp(const struct sw_flow *, const struct sw_flow_match *);
 
 void ovs_flow_mask_key(struct sw_flow_key *dst, const struct sw_flow_key *src,
-                       const struct sw_flow_mask *mask);
+                       bool full, const struct sw_flow_mask *mask);
 #endif /* flow_table.h */
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 7b8e39a22387..aa4b15c35884 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -230,6 +230,8 @@ struct packet_skb_cb {
         } sa;
 };
 
+#define vio_le() virtio_legacy_is_little_endian()
+
 #define PACKET_SKB_CB(__skb)    ((struct packet_skb_cb *)((__skb)->cb))
 
 #define GET_PBDQC_FROM_RB(x)    ((struct tpacket_kbdq_core *)(&(x)->prb_bdqc))
@@ -2680,15 +2682,15 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
                         goto out_unlock;
 
                 if ((vnet_hdr.flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) &&
-                    (__virtio16_to_cpu(false, vnet_hdr.csum_start) +
-                     __virtio16_to_cpu(false, vnet_hdr.csum_offset) + 2 >
-                      __virtio16_to_cpu(false, vnet_hdr.hdr_len)))
-                        vnet_hdr.hdr_len = __cpu_to_virtio16(false,
-                                 __virtio16_to_cpu(false, vnet_hdr.csum_start) +
-                                __virtio16_to_cpu(false, vnet_hdr.csum_offset) + 2);
+                    (__virtio16_to_cpu(vio_le(), vnet_hdr.csum_start) +
+                     __virtio16_to_cpu(vio_le(), vnet_hdr.csum_offset) + 2 >
+                      __virtio16_to_cpu(vio_le(), vnet_hdr.hdr_len)))
+                        vnet_hdr.hdr_len = __cpu_to_virtio16(vio_le(),
+                                 __virtio16_to_cpu(vio_le(), vnet_hdr.csum_start) +
+                                __virtio16_to_cpu(vio_le(), vnet_hdr.csum_offset) + 2);
 
                 err = -EINVAL;
-                if (__virtio16_to_cpu(false, vnet_hdr.hdr_len) > len)
+                if (__virtio16_to_cpu(vio_le(), vnet_hdr.hdr_len) > len)
                         goto out_unlock;
 
                 if (vnet_hdr.gso_type != VIRTIO_NET_HDR_GSO_NONE) {
@@ -2731,7 +2733,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
         hlen = LL_RESERVED_SPACE(dev);
         tlen = dev->needed_tailroom;
         skb = packet_alloc_skb(sk, hlen + tlen, hlen, len,
-                               __virtio16_to_cpu(false, vnet_hdr.hdr_len),
+                               __virtio16_to_cpu(vio_le(), vnet_hdr.hdr_len),
                                msg->msg_flags & MSG_DONTWAIT, &err);
         if (skb == NULL)
                 goto out_unlock;
@@ -2778,8 +2780,8 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
 
         if (po->has_vnet_hdr) {
                 if (vnet_hdr.flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) {
-                        u16 s = __virtio16_to_cpu(false, vnet_hdr.csum_start);
-                        u16 o = __virtio16_to_cpu(false, vnet_hdr.csum_offset);
+                        u16 s = __virtio16_to_cpu(vio_le(), vnet_hdr.csum_start);
+                        u16 o = __virtio16_to_cpu(vio_le(), vnet_hdr.csum_offset);
                         if (!skb_partial_csum_set(skb, s, o)) {
                                 err = -EINVAL;
                                 goto out_free;
@@ -2787,7 +2789,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
                 }
 
                 skb_shinfo(skb)->gso_size =
-                        __virtio16_to_cpu(false, vnet_hdr.gso_size);
+                        __virtio16_to_cpu(vio_le(), vnet_hdr.gso_size);
                 skb_shinfo(skb)->gso_type = gso_type;
 
                 /* Header must be checked, and gso_segs computed. */
@@ -3161,9 +3163,9 @@ static int packet_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
 
                         /* This is a hint as to how much should be linear. */
                         vnet_hdr.hdr_len =
-                                __cpu_to_virtio16(false, skb_headlen(skb));
+                                __cpu_to_virtio16(vio_le(), skb_headlen(skb));
                         vnet_hdr.gso_size =
-                                __cpu_to_virtio16(false, sinfo->gso_size);
+                                __cpu_to_virtio16(vio_le(), sinfo->gso_size);
                         if (sinfo->gso_type & SKB_GSO_TCPV4)
                                 vnet_hdr.gso_type = VIRTIO_NET_HDR_GSO_TCPV4;
                         else if (sinfo->gso_type & SKB_GSO_TCPV6)
@@ -3181,9 +3183,9 @@ static int packet_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
 
                 if (skb->ip_summed == CHECKSUM_PARTIAL) {
                         vnet_hdr.flags = VIRTIO_NET_HDR_F_NEEDS_CSUM;
-                        vnet_hdr.csum_start = __cpu_to_virtio16(false,
+                        vnet_hdr.csum_start = __cpu_to_virtio16(vio_le(),
                                           skb_checksum_start_offset(skb));
-                        vnet_hdr.csum_offset = __cpu_to_virtio16(false,
+                        vnet_hdr.csum_offset = __cpu_to_virtio16(vio_le(),
                                                          skb->csum_offset);
                 } else if (skb->ip_summed == CHECKSUM_UNNECESSARY) {
                         vnet_hdr.flags = VIRTIO_NET_HDR_F_DATA_VALID;
diff --git a/net/sched/cls_fw.c b/net/sched/cls_fw.c
index 715e01e5910a..f23a3b68bba6 100644
--- a/net/sched/cls_fw.c
+++ b/net/sched/cls_fw.c
@@ -33,7 +33,6 @@
 
 struct fw_head {
         u32                     mask;
-        bool                    mask_set;
         struct fw_filter __rcu  *ht[HTSIZE];
         struct rcu_head         rcu;
 };
@@ -84,7 +83,7 @@ static int fw_classify(struct sk_buff *skb, const struct tcf_proto *tp,
                         }
                 }
         } else {
-                /* old method */
+                /* Old method: classify the packet using its skb mark. */
                 if (id && (TC_H_MAJ(id) == 0 ||
                            !(TC_H_MAJ(id ^ tp->q->handle)))) {
                         res->classid = id;
@@ -114,14 +113,9 @@ static unsigned long fw_get(struct tcf_proto *tp, u32 handle)
 
 static int fw_init(struct tcf_proto *tp)
 {
-        struct fw_head *head;
-
-        head = kzalloc(sizeof(struct fw_head), GFP_KERNEL);
-        if (head == NULL)
-                return -ENOBUFS;
-
-        head->mask_set = false;
-        rcu_assign_pointer(tp->root, head);
+        /* We don't allocate fw_head here, because in the old method
+         * we don't need it at all.
+         */
         return 0;
 }
 
@@ -252,7 +246,7 @@ static int fw_change(struct net *net, struct sk_buff *in_skb,
         int err;
 
         if (!opt)
-                return handle ? -EINVAL : 0;
+                return handle ? -EINVAL : 0; /* Succeed if it is old method. */
 
         err = nla_parse_nested(tb, TCA_FW_MAX, opt, fw_policy);
         if (err < 0)
@@ -302,11 +296,17 @@ static int fw_change(struct net *net, struct sk_buff *in_skb,
         if (!handle)
                 return -EINVAL;
 
-        if (!head->mask_set) {
-                head->mask = 0xFFFFFFFF;
+        if (!head) {
+                u32 mask = 0xFFFFFFFF;
                 if (tb[TCA_FW_MASK])
-                        head->mask = nla_get_u32(tb[TCA_FW_MASK]);
-                head->mask_set = true;
+                        mask = nla_get_u32(tb[TCA_FW_MASK]);
+
+                head = kzalloc(sizeof(*head), GFP_KERNEL);
+                if (!head)
+                        return -ENOBUFS;
+                head->mask = mask;
+
+                rcu_assign_pointer(tp->root, head);
         }
 
         f = kzalloc(sizeof(struct fw_filter), GFP_KERNEL);
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index b7143337e4fa..3d9ea9a48289 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -1186,7 +1186,7 @@ static void sctp_v4_del_protocol(void)
         unregister_inetaddr_notifier(&sctp_inetaddr_notifier);
 }
 
-static int __net_init sctp_net_init(struct net *net)
+static int __net_init sctp_defaults_init(struct net *net)
 {
         int status;
 
@@ -1279,12 +1279,6 @@ static int __net_init sctp_net_init(struct net *net)
 
         sctp_dbg_objcnt_init(net);
 
-        /* Initialize the control inode/socket for handling OOTB packets.  */
-        if ((status = sctp_ctl_sock_init(net))) {
-                pr_err("Failed to initialize the SCTP control sock\n");
-                goto err_ctl_sock_init;
-        }
-
         /* Initialize the local address list. */
         INIT_LIST_HEAD(&net->sctp.local_addr_list);
         spin_lock_init(&net->sctp.local_addr_lock);
@@ -1300,9 +1294,6 @@ static int __net_init sctp_net_init(struct net *net)
 
         return 0;
 
-err_ctl_sock_init:
-        sctp_dbg_objcnt_exit(net);
-        sctp_proc_exit(net);
 err_init_proc:
         cleanup_sctp_mibs(net);
 err_init_mibs:
@@ -1311,15 +1302,12 @@ err_sysctl_register:
         return status;
 }
 
-static void __net_exit sctp_net_exit(struct net *net)
+static void __net_exit sctp_defaults_exit(struct net *net)
 {
         /* Free the local address list */
         sctp_free_addr_wq(net);
         sctp_free_local_addr_list(net);
 
-        /* Free the control endpoint.  */
-        inet_ctl_sock_destroy(net->sctp.ctl_sock);
-
         sctp_dbg_objcnt_exit(net);
 
         sctp_proc_exit(net);
@@ -1327,9 +1315,32 @@ static void __net_exit sctp_net_exit(struct net *net)
         sctp_sysctl_net_unregister(net);
 }
 
-static struct pernet_operations sctp_net_ops = {
-        .init = sctp_net_init,
-        .exit = sctp_net_exit,
+static struct pernet_operations sctp_defaults_ops = {
+        .init = sctp_defaults_init,
+        .exit = sctp_defaults_exit,
+};
+
+static int __net_init sctp_ctrlsock_init(struct net *net)
+{
+        int status;
+
+        /* Initialize the control inode/socket for handling OOTB packets.  */
+        status = sctp_ctl_sock_init(net);
+        if (status)
+                pr_err("Failed to initialize the SCTP control sock\n");
+
+        return status;
+}
+
+static void __net_init sctp_ctrlsock_exit(struct net *net)
+{
+        /* Free the control endpoint.  */
+        inet_ctl_sock_destroy(net->sctp.ctl_sock);
+}
+
+static struct pernet_operations sctp_ctrlsock_ops = {
+        .init = sctp_ctrlsock_init,
+        .exit = sctp_ctrlsock_exit,
 };
 
 /* Initialize the universe into something sensible.  */
@@ -1462,8 +1473,11 @@ static __init int sctp_init(void)
         sctp_v4_pf_init();
         sctp_v6_pf_init();
 
-        status = sctp_v4_protosw_init();
+        status = register_pernet_subsys(&sctp_defaults_ops);
+        if (status)
+                goto err_register_defaults;
 
+        status = sctp_v4_protosw_init();
         if (status)
                 goto err_protosw_init;
 
@@ -1471,9 +1485,9 @@ static __init int sctp_init(void)
         if (status)
                 goto err_v6_protosw_init;
 
-        status = register_pernet_subsys(&sctp_net_ops);
+        status = register_pernet_subsys(&sctp_ctrlsock_ops);
         if (status)
-                goto err_register_pernet_subsys;
+                goto err_register_ctrlsock;
 
         status = sctp_v4_add_protocol();
         if (status)
@@ -1489,12 +1503,14 @@ out:
 err_v6_add_protocol:
         sctp_v4_del_protocol();
 err_add_protocol:
-        unregister_pernet_subsys(&sctp_net_ops);
-err_register_pernet_subsys:
+        unregister_pernet_subsys(&sctp_ctrlsock_ops);
+err_register_ctrlsock:
         sctp_v6_protosw_exit();
 err_v6_protosw_init:
         sctp_v4_protosw_exit();
 err_protosw_init:
+        unregister_pernet_subsys(&sctp_defaults_ops);
+err_register_defaults:
         sctp_v4_pf_exit();
         sctp_v6_pf_exit();
         sctp_sysctl_unregister();
@@ -1527,12 +1543,14 @@ static __exit void sctp_exit(void)
         sctp_v6_del_protocol();
         sctp_v4_del_protocol();
 
-        unregister_pernet_subsys(&sctp_net_ops);
+        unregister_pernet_subsys(&sctp_ctrlsock_ops);
 
         /* Free protosw registrations */
         sctp_v6_protosw_exit();
         sctp_v4_protosw_exit();
 
+        unregister_pernet_subsys(&sctp_defaults_ops);
+
         /* Unregister with socket layer. */
         sctp_v6_pf_exit();
         sctp_v4_pf_exit();
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index b140c092d226..f14f24ee9983 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -297,7 +297,7 @@ static int rpc_complete_task(struct rpc_task *task)
         clear_bit(RPC_TASK_ACTIVE, &task->tk_runstate);
         ret = atomic_dec_and_test(&task->tk_count);
         if (waitqueue_active(wq))
-                __wake_up_locked_key(wq, TASK_NORMAL, 1, &k);
+                __wake_up_locked_key(wq, TASK_NORMAL, &k);
         spin_unlock_irqrestore(&wq->lock, flags);
         return ret;
 }
@@ -1092,14 +1092,10 @@ void
 rpc_destroy_mempool(void)
 {
         rpciod_stop();
-        if (rpc_buffer_mempool)
-                mempool_destroy(rpc_buffer_mempool);
-        if (rpc_task_mempool)
-                mempool_destroy(rpc_task_mempool);
-        if (rpc_task_slabp)
-                kmem_cache_destroy(rpc_task_slabp);
-        if (rpc_buffer_slabp)
-                kmem_cache_destroy(rpc_buffer_slabp);
+        mempool_destroy(rpc_buffer_mempool);
+        mempool_destroy(rpc_task_mempool);
+        kmem_cache_destroy(rpc_task_slabp);
+        kmem_cache_destroy(rpc_buffer_slabp);
         rpc_destroy_wait_queue(&delay_queue);
 }
 
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index ab5dd621ae0c..2e98f4a243e5 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -614,6 +614,7 @@ static void xprt_autoclose(struct work_struct *work)
         clear_bit(XPRT_CLOSE_WAIT, &xprt->state);
         xprt->ops->close(xprt);
         xprt_release_write(xprt, NULL);
+        wake_up_bit(&xprt->state, XPRT_LOCKED);
 }
 
 /**
@@ -723,6 +724,7 @@ void xprt_unlock_connect(struct rpc_xprt *xprt, void *cookie)
         xprt->ops->release_xprt(xprt, NULL);
 out:
         spin_unlock_bh(&xprt->transport_lock);
+        wake_up_bit(&xprt->state, XPRT_LOCKED);
 }
 
 /**
@@ -1394,6 +1396,10 @@ out:
 static void xprt_destroy(struct rpc_xprt *xprt)
 {
         dprintk("RPC:       destroying transport %p\n", xprt);
+
+        /* Exclude transport connect/disconnect handlers */
+        wait_on_bit_lock(&xprt->state, XPRT_LOCKED, TASK_UNINTERRUPTIBLE);
+
         del_timer_sync(&xprt->timer);
 
         rpc_xprt_debugfs_unregister(xprt);
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 7be90bc1a7c2..1a85e0ed0b48 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -777,7 +777,6 @@ static void xs_sock_mark_closed(struct rpc_xprt *xprt)
         xs_sock_reset_connection_flags(xprt);
         /* Mark transport as closed and wake up all pending tasks */
         xprt_disconnect_done(xprt);
-        xprt_force_disconnect(xprt);
 }
 
 /**
@@ -881,8 +880,11 @@ static void xs_xprt_free(struct rpc_xprt *xprt)
  */
 static void xs_destroy(struct rpc_xprt *xprt)
 {
+        struct sock_xprt *transport = container_of(xprt,
+                        struct sock_xprt, xprt);
         dprintk("RPC:       xs_destroy xprt %p\n", xprt);
 
+        cancel_delayed_work_sync(&transport->connect_worker);
         xs_close(xprt);
         xs_xprt_free(xprt);
         module_put(THIS_MODULE);
@@ -1435,6 +1437,7 @@ out:
 static void xs_tcp_state_change(struct sock *sk)
 {
         struct rpc_xprt *xprt;
+        struct sock_xprt *transport;
 
         read_lock_bh(&sk->sk_callback_lock);
         if (!(xprt = xprt_from_sock(sk)))
@@ -1446,13 +1449,12 @@ static void xs_tcp_state_change(struct sock *sk)
                         sock_flag(sk, SOCK_ZAPPED),
                         sk->sk_shutdown);
 
+        transport = container_of(xprt, struct sock_xprt, xprt);
         trace_rpc_socket_state_change(xprt, sk->sk_socket);
         switch (sk->sk_state) {
         case TCP_ESTABLISHED:
                 spin_lock(&xprt->transport_lock);
                 if (!xprt_test_and_set_connected(xprt)) {
-                        struct sock_xprt *transport = container_of(xprt,
-                                        struct sock_xprt, xprt);
 
                         /* Reset TCP record info */
                         transport->tcp_offset = 0;
@@ -1461,6 +1463,8 @@ static void xs_tcp_state_change(struct sock *sk)
                         transport->tcp_flags =
                                 TCP_RCV_COPY_FRAGHDR | TCP_RCV_COPY_XID;
                         xprt->connect_cookie++;
+                        clear_bit(XPRT_SOCK_CONNECTING, &transport->sock_state);
+                        xprt_clear_connecting(xprt);
 
                         xprt_wake_pending_tasks(xprt, -EAGAIN);
                 }
@@ -1496,6 +1500,9 @@ static void xs_tcp_state_change(struct sock *sk)
                 smp_mb__after_atomic();
                 break;
         case TCP_CLOSE:
+                if (test_and_clear_bit(XPRT_SOCK_CONNECTING,
+                                        &transport->sock_state))
+                        xprt_clear_connecting(xprt);
                 xs_sock_mark_closed(xprt);
         }
  out:
@@ -2179,6 +2186,7 @@ static int xs_tcp_finish_connecting(struct rpc_xprt *xprt, struct socket *sock)
         /* Tell the socket layer to start connecting... */
         xprt->stat.connect_count++;
         xprt->stat.connect_start = jiffies;
+        set_bit(XPRT_SOCK_CONNECTING, &transport->sock_state);
         ret = kernel_connect(sock, xs_addr(xprt), xprt->addrlen, O_NONBLOCK);
         switch (ret) {
         case 0:
@@ -2240,7 +2248,6 @@ static void xs_tcp_setup_socket(struct work_struct *work)
         case -EINPROGRESS:
         case -EALREADY:
                 xprt_unlock_connect(xprt, transport);
-                xprt_clear_connecting(xprt);
                 return;
         case -EINVAL:
                 /* Happens, for instance, if the user specified a link
diff --git a/net/tipc/msg.c b/net/tipc/msg.c
index 562c926a51cc..c5ac436235e0 100644
--- a/net/tipc/msg.c
+++ b/net/tipc/msg.c
@@ -539,6 +539,7 @@ bool tipc_msg_lookup_dest(struct net *net, struct sk_buff *skb, int *err)
         *err = -TIPC_ERR_NO_NAME;
         if (skb_linearize(skb))
                 return false;
+        msg = buf_msg(skb);
         if (msg_reroute_cnt(msg))
                 return false;
         dnode = addr_domain(net, msg_lookup_scope(msg));
diff --git a/scripts/extract-cert.c b/scripts/extract-cert.c
index fd0db015c65c..6ce5945a0b89 100644
--- a/scripts/extract-cert.c
+++ b/scripts/extract-cert.c
@@ -1,15 +1,15 @@
 /* Extract X.509 certificate in DER form from PKCS#11 or PEM.
  *
- * Copyright © 2014 Red Hat, Inc. All Rights Reserved.
- * Copyright © 2015 Intel Corporation.
+ * Copyright © 2014-2015 Red Hat, Inc. All Rights Reserved.
+ * Copyright © 2015      Intel Corporation.
  *
  * Authors: David Howells <dhowells@redhat.com>
  *          David Woodhouse <dwmw2@infradead.org>
  *
  * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public Licence
- * as published by the Free Software Foundation; either version
- * 2 of the Licence, or (at your option) any later version.
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1
+ * of the licence, or (at your option) any later version.
  */
 #define _GNU_SOURCE
 #include <stdio.h>
@@ -86,7 +86,7 @@ static void write_cert(X509 *x509)
                 ERR(!wb, "%s", cert_dst);
         }
         X509_NAME_oneline(X509_get_subject_name(x509), buf, sizeof(buf));
-        ERR(!i2d_X509_bio(wb, x509), cert_dst);
+        ERR(!i2d_X509_bio(wb, x509), "%s", cert_dst);
         if (kbuild_verbose)
                 fprintf(stderr, "Extracted cert: %s\n", buf);
 }
diff --git a/scripts/sign-file.c b/scripts/sign-file.c
index 058bba3103e2..c3899ca4811c 100755
--- a/scripts/sign-file.c
+++ b/scripts/sign-file.c
@@ -1,12 +1,15 @@
 /* Sign a module file using the given key.
  *
- * Copyright (C) 2014 Red Hat, Inc. All Rights Reserved.
- * Written by David Howells (dhowells@redhat.com)
+ * Copyright © 2014-2015 Red Hat, Inc. All Rights Reserved.
+ * Copyright © 2015      Intel Corporation.
+ *
+ * Authors: David Howells <dhowells@redhat.com>
+ *          David Woodhouse <dwmw2@infradead.org>
  *
  * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public Licence
- * as published by the Free Software Foundation; either version
- * 2 of the Licence, or (at your option) any later version.
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1
+ * of the licence, or (at your option) any later version.
  */
 #define _GNU_SOURCE
 #include <stdio.h>
diff --git a/security/device_cgroup.c b/security/device_cgroup.c
index 73455089feef..03c1652c9a1f 100644
--- a/security/device_cgroup.c
+++ b/security/device_cgroup.c
@@ -401,7 +401,7 @@ static bool verify_new_ex(struct dev_cgroup *dev_cgroup,
         bool match = false;
 
         RCU_LOCKDEP_WARN(!rcu_read_lock_held() &&
-                         lockdep_is_held(&devcgroup_mutex),
+                         !lockdep_is_held(&devcgroup_mutex),
                          "device_cgroup:verify_new_ex called without proper synchronization");
 
         if (dev_cgroup->behavior == DEVCG_DEFAULT_ALLOW) {
diff --git a/sound/arm/Kconfig b/sound/arm/Kconfig
index 885683a3b0bd..e0406211716b 100644
--- a/sound/arm/Kconfig
+++ b/sound/arm/Kconfig
@@ -9,6 +9,14 @@ menuconfig SND_ARM
           Drivers that are implemented on ASoC can be found in
           "ALSA for SoC audio support" section.
 
+config SND_PXA2XX_LIB
+        tristate
+        select SND_AC97_CODEC if SND_PXA2XX_LIB_AC97
+        select SND_DMAENGINE_PCM
+
+config SND_PXA2XX_LIB_AC97
+        bool
+
 if SND_ARM
 
 config SND_ARMAACI
@@ -21,13 +29,6 @@ config SND_PXA2XX_PCM
         tristate
         select SND_PCM
 
-config SND_PXA2XX_LIB
-        tristate
-        select SND_AC97_CODEC if SND_PXA2XX_LIB_AC97
-
-config SND_PXA2XX_LIB_AC97
-        bool
-
 config SND_PXA2XX_AC97
         tristate "AC97 driver for the Intel PXA2xx chip"
         depends on ARCH_PXA
diff --git a/sound/pci/hda/hda_tegra.c b/sound/pci/hda/hda_tegra.c
index 477742cb70a2..58c0aad37284 100644
--- a/sound/pci/hda/hda_tegra.c
+++ b/sound/pci/hda/hda_tegra.c
@@ -73,6 +73,7 @@ struct hda_tegra {
         struct clk *hda2codec_2x_clk;
         struct clk *hda2hdmi_clk;
         void __iomem *regs;
+        struct work_struct probe_work;
 };
 
 #ifdef CONFIG_PM
@@ -294,7 +295,9 @@ static int hda_tegra_dev_disconnect(struct snd_device *device)
 static int hda_tegra_dev_free(struct snd_device *device)
 {
         struct azx *chip = device->device_data;
+        struct hda_tegra *hda = container_of(chip, struct hda_tegra, chip);
 
+        cancel_work_sync(&hda->probe_work);
         if (azx_bus(chip)->chip_init) {
                 azx_stop_all_streams(chip);
                 azx_stop_chip(chip);
@@ -426,6 +429,9 @@ static int hda_tegra_first_init(struct azx *chip, struct platform_device *pdev)
 /*
  * constructor
  */
+
+static void hda_tegra_probe_work(struct work_struct *work);
+
 static int hda_tegra_create(struct snd_card *card,
                             unsigned int driver_caps,
                             struct hda_tegra *hda)
@@ -452,6 +458,8 @@ static int hda_tegra_create(struct snd_card *card,
         chip->single_cmd = false;
         chip->snoop = true;
 
+        INIT_WORK(&hda->probe_work, hda_tegra_probe_work);
+
         err = azx_bus_init(chip, NULL, &hda_tegra_io_ops);
         if (err < 0)
                 return err;
@@ -499,6 +507,21 @@ static int hda_tegra_probe(struct platform_device *pdev)
         card->private_data = chip;
 
         dev_set_drvdata(&pdev->dev, card);
+        schedule_work(&hda->probe_work);
+
+        return 0;
+
+out_free:
+        snd_card_free(card);
+        return err;
+}
+
+static void hda_tegra_probe_work(struct work_struct *work)
+{
+        struct hda_tegra *hda = container_of(work, struct hda_tegra, probe_work);
+        struct azx *chip = &hda->chip;
+        struct platform_device *pdev = to_platform_device(hda->dev);
+        int err;
 
         err = hda_tegra_first_init(chip, pdev);
         if (err < 0)
@@ -520,11 +543,8 @@ static int hda_tegra_probe(struct platform_device *pdev)
         chip->running = 1;
         snd_hda_set_power_save(&chip->bus, power_save * 1000);
 
-        return 0;
-
-out_free:
-        snd_card_free(card);
-        return err;
+ out_free:
+        return; /* no error return from async probe */
 }
 
 static int hda_tegra_remove(struct platform_device *pdev)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index a75b5611d1e4..afec6dc9f91f 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4188,6 +4188,24 @@ static void alc_fixup_disable_aamix(struct hda_codec *codec,
         }
 }
 
+/* fixup for Thinkpad docks: add dock pins, avoid HP parser fixup */
+static void alc_fixup_tpt440_dock(struct hda_codec *codec,
+                                  const struct hda_fixup *fix, int action)
+{
+        static const struct hda_pintbl pincfgs[] = {
+                { 0x16, 0x21211010 }, /* dock headphone */
+                { 0x19, 0x21a11010 }, /* dock mic */
+                { }
+        };
+        struct alc_spec *spec = codec->spec;
+
+        if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+                spec->parse_flags = HDA_PINCFG_NO_HP_FIXUP;
+                codec->power_save_node = 0; /* avoid click noises */
+                snd_hda_apply_pincfgs(codec, pincfgs);
+        }
+}
+
 static void alc_shutup_dell_xps13(struct hda_codec *codec)
 {
         struct alc_spec *spec = codec->spec;
@@ -4562,7 +4580,6 @@ enum {
         ALC255_FIXUP_HEADSET_MODE_NO_HP_MIC,
         ALC293_FIXUP_DELL1_MIC_NO_PRESENCE,
         ALC292_FIXUP_TPT440_DOCK,
-        ALC292_FIXUP_TPT440_DOCK2,
         ALC283_FIXUP_BXBT2807_MIC,
         ALC255_FIXUP_DELL_WMI_MIC_MUTE_LED,
         ALC282_FIXUP_ASPIRE_V5_PINS,
@@ -5029,17 +5046,7 @@ static const struct hda_fixup alc269_fixups[] = {
         },
         [ALC292_FIXUP_TPT440_DOCK] = {
                 .type = HDA_FIXUP_FUNC,
-                .v.func = alc269_fixup_pincfg_no_hp_to_lineout,
-                .chained = true,
-                .chain_id = ALC292_FIXUP_TPT440_DOCK2
-        },
-        [ALC292_FIXUP_TPT440_DOCK2] = {
-                .type = HDA_FIXUP_PINS,
-                .v.pins = (const struct hda_pintbl[]) {
-                        { 0x16, 0x21211010 }, /* dock headphone */
-                        { 0x19, 0x21a11010 }, /* dock mic */
-                        { }
-                },
+                .v.func = alc_fixup_tpt440_dock,
                 .chained = true,
                 .chain_id = ALC269_FIXUP_LIMIT_INT_MIC_BOOST
         },
diff --git a/sound/soc/au1x/psc-i2s.c b/sound/soc/au1x/psc-i2s.c
index 38e853add96e..0bf9d62b91a0 100644
--- a/sound/soc/au1x/psc-i2s.c
+++ b/sound/soc/au1x/psc-i2s.c
@@ -296,7 +296,6 @@ static int au1xpsc_i2s_drvprobe(struct platform_device *pdev)
 {
         struct resource *iores, *dmares;
         unsigned long sel;
-        int ret;
         struct au1xpsc_audio_data *wd;
 
         wd = devm_kzalloc(&pdev->dev, sizeof(struct au1xpsc_audio_data),
diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c
index 4972bf3efa91..268a28bd1df4 100644
--- a/sound/soc/codecs/rt5645.c
+++ b/sound/soc/codecs/rt5645.c
@@ -732,14 +732,14 @@ static const struct snd_kcontrol_new rt5645_mono_adc_r_mix[] = {
 static const struct snd_kcontrol_new rt5645_dac_l_mix[] = {
         SOC_DAPM_SINGLE("Stereo ADC Switch", RT5645_AD_DA_MIXER,
                         RT5645_M_ADCMIX_L_SFT, 1, 1),
-        SOC_DAPM_SINGLE("DAC1 Switch", RT5645_AD_DA_MIXER,
+        SOC_DAPM_SINGLE_AUTODISABLE("DAC1 Switch", RT5645_AD_DA_MIXER,
                         RT5645_M_DAC1_L_SFT, 1, 1),
 };
 
 static const struct snd_kcontrol_new rt5645_dac_r_mix[] = {
         SOC_DAPM_SINGLE("Stereo ADC Switch", RT5645_AD_DA_MIXER,
                         RT5645_M_ADCMIX_R_SFT, 1, 1),
-        SOC_DAPM_SINGLE("DAC1 Switch", RT5645_AD_DA_MIXER,
+        SOC_DAPM_SINGLE_AUTODISABLE("DAC1 Switch", RT5645_AD_DA_MIXER,
                         RT5645_M_DAC1_R_SFT, 1, 1),
 };
 
@@ -1381,7 +1381,7 @@ static void hp_amp_power(struct snd_soc_codec *codec, int on)
                                 regmap_write(rt5645->regmap, RT5645_PR_BASE +
                                         RT5645_MAMP_INT_REG2, 0xfc00);
                                 snd_soc_write(codec, RT5645_DEPOP_M2, 0x1140);
-                                mdelay(5);
+                                msleep(40);
                                 rt5645->hp_on = true;
                         } else {
                                 /* depop parameters */
@@ -2829,13 +2829,12 @@ static int rt5645_jack_detect(struct snd_soc_codec *codec, int jack_insert)
                         snd_soc_dapm_sync(dapm);
                         rt5645->jack_type = SND_JACK_HEADPHONE;
                 }
-
-                snd_soc_update_bits(codec, RT5645_CHARGE_PUMP, 0x0300, 0x0200);
-                snd_soc_write(codec, RT5645_DEPOP_M1, 0x001d);
-                snd_soc_write(codec, RT5645_DEPOP_M1, 0x0001);
         } else { /* jack out */
                 rt5645->jack_type = 0;
 
+                regmap_update_bits(rt5645->regmap, RT5645_HP_VOL,
+                        RT5645_L_MUTE | RT5645_R_MUTE,
+                        RT5645_L_MUTE | RT5645_R_MUTE);
                 regmap_update_bits(rt5645->regmap, RT5645_IN1_CTRL2,
                         RT5645_CBJ_MN_JD, RT5645_CBJ_MN_JD);
                 regmap_update_bits(rt5645->regmap, RT5645_IN1_CTRL1,
@@ -2880,8 +2879,6 @@ int rt5645_set_jack_detect(struct snd_soc_codec *codec,
                 rt5645->en_button_func = true;
                 regmap_update_bits(rt5645->regmap, RT5645_GPIO_CTRL1,
                                 RT5645_GP1_PIN_IRQ, RT5645_GP1_PIN_IRQ);
-                regmap_update_bits(rt5645->regmap, RT5645_DEPOP_M1,
-                                RT5645_HP_CB_MASK, RT5645_HP_CB_PU);
                 regmap_update_bits(rt5645->regmap, RT5645_GEN_CTRL1,
                                 RT5645_DIG_GATE_CTRL, RT5645_DIG_GATE_CTRL);
         }
@@ -3205,6 +3202,13 @@ static const struct dmi_system_id dmi_platform_intel_braswell[] = {
                         DMI_MATCH(DMI_PRODUCT_NAME, "Celes"),
                 },
         },
+        {
+                .ident = "Google Ultima",
+                .callback = strago_quirk_cb,
+                .matches = {
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Ultima"),
+                },
+        },
         { }
 };
 
diff --git a/sound/soc/codecs/wm0010.c b/sound/soc/codecs/wm0010.c
index f2c6ad4b8fde..581ec1502228 100644
--- a/sound/soc/codecs/wm0010.c
+++ b/sound/soc/codecs/wm0010.c
@@ -577,7 +577,6 @@ static int wm0010_boot(struct snd_soc_codec *codec)
         struct wm0010_priv *wm0010 = snd_soc_codec_get_drvdata(codec);
         unsigned long flags;
         int ret;
-        const struct firmware *fw;
         struct spi_message m;
         struct spi_transfer t;
         struct dfw_pllrec pll_rec;
@@ -623,14 +622,6 @@ static int wm0010_boot(struct snd_soc_codec *codec)
         wm0010->state = WM0010_OUT_OF_RESET;
         spin_unlock_irqrestore(&wm0010->irq_lock, flags);
 
-        /* First the bootloader */
-        ret = request_firmware(&fw, "wm0010_stage2.bin", codec->dev);
-        if (ret != 0) {
-                dev_err(codec->dev, "Failed to request stage2 loader: %d\n",
-                        ret);
-                goto abort;
-        }
-
         if (!wait_for_completion_timeout(&wm0010->boot_completion,
                                          msecs_to_jiffies(20)))
                 dev_err(codec->dev, "Failed to get interrupt from DSP\n");
@@ -673,7 +664,7 @@ static int wm0010_boot(struct snd_soc_codec *codec)
 
                 img_swap = kzalloc(len, GFP_KERNEL | GFP_DMA);
                 if (!img_swap)
-                        goto abort;
+                        goto abort_out;
 
                 /* We need to re-order for 0010 */
                 byte_swap_64((u64 *)&pll_rec, img_swap, len);
@@ -688,16 +679,16 @@ static int wm0010_boot(struct snd_soc_codec *codec)
                 spi_message_add_tail(&t, &m);
 
                 ret = spi_sync(spi, &m);
-                if (ret != 0) {
+                if (ret) {
                         dev_err(codec->dev, "First PLL write failed: %d\n", ret);
-                        goto abort;
+                        goto abort_swap;
                 }
 
                 /* Use a second send of the message to get the return status */
                 ret = spi_sync(spi, &m);
-                if (ret != 0) {
+                if (ret) {
                         dev_err(codec->dev, "Second PLL write failed: %d\n", ret);
-                        goto abort;
+                        goto abort_swap;
                 }
 
                 p = (u32 *)out;
@@ -730,6 +721,10 @@ static int wm0010_boot(struct snd_soc_codec *codec)
 
         return 0;
 
+abort_swap:
+        kfree(img_swap);
+abort_out:
+        kfree(out);
 abort:
         /* Put the chip back into reset */
         wm0010_halt(codec);
diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
index e3b7d0c57411..dbd88408861a 100644
--- a/sound/soc/codecs/wm8960.c
+++ b/sound/soc/codecs/wm8960.c
@@ -211,28 +211,38 @@ static int wm8960_put_deemph(struct snd_kcontrol *kcontrol,
         return wm8960_set_deemph(codec);
 }
 
-static const DECLARE_TLV_DB_SCALE(adc_tlv, -9700, 50, 0);
-static const DECLARE_TLV_DB_SCALE(dac_tlv, -12700, 50, 1);
+static const DECLARE_TLV_DB_SCALE(adc_tlv, -9750, 50, 1);
+static const DECLARE_TLV_DB_SCALE(inpga_tlv, -1725, 75, 0);
+static const DECLARE_TLV_DB_SCALE(dac_tlv, -12750, 50, 1);
 static const DECLARE_TLV_DB_SCALE(bypass_tlv, -2100, 300, 0);
 static const DECLARE_TLV_DB_SCALE(out_tlv, -12100, 100, 1);
-static const DECLARE_TLV_DB_SCALE(boost_tlv, -1200, 300, 1);
+static const DECLARE_TLV_DB_SCALE(lineinboost_tlv, -1500, 300, 1);
+static const unsigned int micboost_tlv[] = {
+        TLV_DB_RANGE_HEAD(2),
+        0, 1, TLV_DB_SCALE_ITEM(0, 1300, 0),
+        2, 3, TLV_DB_SCALE_ITEM(2000, 900, 0),
+};
 
 static const struct snd_kcontrol_new wm8960_snd_controls[] = {
 SOC_DOUBLE_R_TLV("Capture Volume", WM8960_LINVOL, WM8960_RINVOL,
-                 0, 63, 0, adc_tlv),
+                 0, 63, 0, inpga_tlv),
 SOC_DOUBLE_R("Capture Volume ZC Switch", WM8960_LINVOL, WM8960_RINVOL,
         6, 1, 0),
 SOC_DOUBLE_R("Capture Switch", WM8960_LINVOL, WM8960_RINVOL,
         7, 1, 0),
 
 SOC_SINGLE_TLV("Right Input Boost Mixer RINPUT3 Volume",
-               WM8960_INBMIX1, 4, 7, 0, boost_tlv),
+               WM8960_INBMIX1, 4, 7, 0, lineinboost_tlv),
 SOC_SINGLE_TLV("Right Input Boost Mixer RINPUT2 Volume",
-               WM8960_INBMIX1, 1, 7, 0, boost_tlv),
+               WM8960_INBMIX1, 1, 7, 0, lineinboost_tlv),
 SOC_SINGLE_TLV("Left Input Boost Mixer LINPUT3 Volume",
-               WM8960_INBMIX2, 4, 7, 0, boost_tlv),
+               WM8960_INBMIX2, 4, 7, 0, lineinboost_tlv),
 SOC_SINGLE_TLV("Left Input Boost Mixer LINPUT2 Volume",
-               WM8960_INBMIX2, 1, 7, 0, boost_tlv),
+               WM8960_INBMIX2, 1, 7, 0, lineinboost_tlv),
+SOC_SINGLE_TLV("Right Input Boost Mixer RINPUT1 Volume",
+                WM8960_RINPATH, 4, 3, 0, micboost_tlv),
+SOC_SINGLE_TLV("Left Input Boost Mixer LINPUT1 Volume",
+                WM8960_LINPATH, 4, 3, 0, micboost_tlv),
 
 SOC_DOUBLE_R_TLV("Playback Volume", WM8960_LDAC, WM8960_RDAC,
                  0, 255, 0, dac_tlv),
diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
index b4eb975da981..293e47a6ff59 100644
--- a/sound/soc/codecs/wm8962.c
+++ b/sound/soc/codecs/wm8962.c
@@ -2944,7 +2944,8 @@ static int wm8962_mute(struct snd_soc_dai *dai, int mute)
                                    WM8962_DAC_MUTE, val);
 }
 
-#define WM8962_RATES SNDRV_PCM_RATE_8000_96000
+#define WM8962_RATES (SNDRV_PCM_RATE_8000_48000 |\
+                SNDRV_PCM_RATE_88200 | SNDRV_PCM_RATE_96000)
 
 #define WM8962_FORMATS (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S20_3LE |\
                         SNDRV_PCM_FMTBIT_S24_LE | SNDRV_PCM_FMTBIT_S32_LE)
diff --git a/sound/soc/davinci/davinci-mcasp.c b/sound/soc/davinci/davinci-mcasp.c
index add6bb99661d..7d45d98a861f 100644
--- a/sound/soc/davinci/davinci-mcasp.c
+++ b/sound/soc/davinci/davinci-mcasp.c
@@ -663,7 +663,7 @@ static int mcasp_common_hw_param(struct davinci_mcasp *mcasp, int stream,
         u8 rx_ser = 0;
         u8 slots = mcasp->tdm_slots;
         u8 max_active_serializers = (channels + slots - 1) / slots;
-        int active_serializers, numevt, n;
+        int active_serializers, numevt;
         u32 reg;
         /* Default configuration */
         if (mcasp->version < MCASP_VERSION_3)
@@ -745,9 +745,8 @@ static int mcasp_common_hw_param(struct davinci_mcasp *mcasp, int stream,
          * The number of words for numevt need to be in steps of active
          * serializers.
          */
-        n = numevt % active_serializers;
-        if (n)
-                numevt += (active_serializers - n);
+        numevt = (numevt / active_serializers) * active_serializers;
+
         while (period_words % numevt && numevt > 0)
                 numevt -= active_serializers;
         if (numevt <= 0)
@@ -1299,6 +1298,7 @@ static struct snd_soc_dai_driver davinci_mcasp_dai[] = {
                 .ops            = &davinci_mcasp_dai_ops,
 
                 .symmetric_samplebits   = 1,
+                .symmetric_rates        = 1,
         },
         {
                 .name           = "davinci-mcasp.1",
@@ -1685,7 +1685,7 @@ static int davinci_mcasp_probe(struct platform_device *pdev)
 
         irq = platform_get_irq_byname(pdev, "common");
         if (irq >= 0) {
-                irq_name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "%s_common\n",
+                irq_name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "%s_common",
                                           dev_name(&pdev->dev));
                 ret = devm_request_threaded_irq(&pdev->dev, irq, NULL,
                                                 davinci_mcasp_common_irq_handler,
@@ -1702,7 +1702,7 @@ static int davinci_mcasp_probe(struct platform_device *pdev)
 
         irq = platform_get_irq_byname(pdev, "rx");
         if (irq >= 0) {
-                irq_name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "%s_rx\n",
+                irq_name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "%s_rx",
                                           dev_name(&pdev->dev));
                 ret = devm_request_threaded_irq(&pdev->dev, irq, NULL,
                                                 davinci_mcasp_rx_irq_handler,
@@ -1717,7 +1717,7 @@ static int davinci_mcasp_probe(struct platform_device *pdev)
 
         irq = platform_get_irq_byname(pdev, "tx");
         if (irq >= 0) {
-                irq_name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "%s_tx\n",
+                irq_name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "%s_tx",
                                           dev_name(&pdev->dev));
                 ret = devm_request_threaded_irq(&pdev->dev, irq, NULL,
                                                 davinci_mcasp_tx_irq_handler,
diff --git a/sound/soc/fsl/fsl-asoc-card.c b/sound/soc/fsl/fsl-asoc-card.c
index 5aeb6ed4827e..96f55ae75c71 100644
--- a/sound/soc/fsl/fsl-asoc-card.c
+++ b/sound/soc/fsl/fsl-asoc-card.c
@@ -488,7 +488,8 @@ static int fsl_asoc_card_probe(struct platform_device *pdev)
                 priv->dai_fmt |= SND_SOC_DAIFMT_CBM_CFM;
         } else {
                 dev_err(&pdev->dev, "unknown Device Tree compatible\n");
-                return -EINVAL;
+                ret = -EINVAL;
+                goto asrc_fail;
         }
 
         /* Common settings for corresponding Freescale CPU DAI driver */
diff --git a/sound/soc/fsl/fsl_ssi.c b/sound/soc/fsl/fsl_ssi.c
index 8ec6fb208ea0..37c5cd4d0e59 100644
--- a/sound/soc/fsl/fsl_ssi.c
+++ b/sound/soc/fsl/fsl_ssi.c
@@ -249,7 +249,8 @@ MODULE_DEVICE_TABLE(of, fsl_ssi_ids);
 
 static bool fsl_ssi_is_ac97(struct fsl_ssi_private *ssi_private)
 {
-        return !!(ssi_private->dai_fmt & SND_SOC_DAIFMT_AC97);
+        return (ssi_private->dai_fmt & SND_SOC_DAIFMT_FORMAT_MASK) ==
+                SND_SOC_DAIFMT_AC97;
 }
 
 static bool fsl_ssi_is_i2s_master(struct fsl_ssi_private *ssi_private)
@@ -947,7 +948,7 @@ static int _fsl_ssi_set_dai_fmt(struct device *dev,
                                 CCSR_SSI_SCR_TCH_EN);
         }
 
-        if (fmt & SND_SOC_DAIFMT_AC97)
+        if ((fmt & SND_SOC_DAIFMT_FORMAT_MASK) == SND_SOC_DAIFMT_AC97)
                 fsl_ssi_setup_ac97(ssi_private);
 
         return 0;
diff --git a/sound/soc/intel/haswell/sst-haswell-ipc.c b/sound/soc/intel/haswell/sst-haswell-ipc.c
index f6efa9d4acad..b27f25f70730 100644
--- a/sound/soc/intel/haswell/sst-haswell-ipc.c
+++ b/sound/soc/intel/haswell/sst-haswell-ipc.c
@@ -302,6 +302,10 @@ struct sst_hsw {
         struct sst_hsw_ipc_dx_reply dx;
         void *dx_context;
         dma_addr_t dx_context_paddr;
+        enum sst_hsw_device_id dx_dev;
+        enum sst_hsw_device_mclk dx_mclk;
+        enum sst_hsw_device_mode dx_mode;
+        u32 dx_clock_divider;
 
         /* boot */
         wait_queue_head_t boot_wait;
@@ -1400,10 +1404,10 @@ int sst_hsw_device_set_config(struct sst_hsw *hsw,
 
         trace_ipc_request("set device config", dev);
 
-        config.ssp_interface = dev;
-        config.clock_frequency = mclk;
-        config.mode = mode;
-        config.clock_divider = clock_divider;
+        hsw->dx_dev = config.ssp_interface = dev;
+        hsw->dx_mclk = config.clock_frequency = mclk;
+        hsw->dx_mode = config.mode = mode;
+        hsw->dx_clock_divider = config.clock_divider = clock_divider;
         if (mode == SST_HSW_DEVICE_TDM_CLOCK_MASTER)
                 config.channels = 4;
         else
@@ -1704,10 +1708,10 @@ int sst_hsw_dsp_runtime_resume(struct sst_hsw *hsw)
                 return -EIO;
         }
 
-        /* Set ADSP SSP port settings */
-        ret = sst_hsw_device_set_config(hsw, SST_HSW_DEVICE_SSP_0,
-                                        SST_HSW_DEVICE_MCLK_FREQ_24_MHZ,
-                                        SST_HSW_DEVICE_CLOCK_MASTER, 9);
+        /* Set ADSP SSP port settings - sadly the FW does not store SSP port
+           settings as part of the PM context. */
+        ret = sst_hsw_device_set_config(hsw, hsw->dx_dev, hsw->dx_mclk,
+                                        hsw->dx_mode, hsw->dx_clock_divider);
         if (ret < 0)
                 dev_err(dev, "error: SSP re-initialization failed\n");
 
diff --git a/sound/soc/mediatek/mtk-afe-pcm.c b/sound/soc/mediatek/mtk-afe-pcm.c
index d190fe017559..f5baf3c38863 100644
--- a/sound/soc/mediatek/mtk-afe-pcm.c
+++ b/sound/soc/mediatek/mtk-afe-pcm.c
@@ -549,6 +549,23 @@ static int mtk_afe_dais_startup(struct snd_pcm_substream *substream,
         memif->substream = substream;
 
         snd_soc_set_runtime_hwparams(substream, &mtk_afe_hardware);
+
+        /*
+         * Capture cannot use ping-pong buffer since hw_ptr at IRQ may be
+         * smaller than period_size due to AFE's internal buffer.
+         * This easily leads to overrun when avail_min is period_size.
+         * One more period can hold the possible unread buffer.
+         */
+        if (substream->stream == SNDRV_PCM_STREAM_CAPTURE) {
+                ret = snd_pcm_hw_constraint_minmax(runtime,
+                                                   SNDRV_PCM_HW_PARAM_PERIODS,
+                                                   3,
+                                                   mtk_afe_hardware.periods_max);
+                if (ret < 0) {
+                        dev_err(afe->dev, "hw_constraint_minmax failed\n");
+                        return ret;
+                }
+        }
         ret = snd_pcm_hw_constraint_integer(runtime,
                                             SNDRV_PCM_HW_PARAM_PERIODS);
         if (ret < 0)
diff --git a/sound/soc/pxa/Kconfig b/sound/soc/pxa/Kconfig
index 39cea80846c3..f2bf8661dd21 100644
--- a/sound/soc/pxa/Kconfig
+++ b/sound/soc/pxa/Kconfig
@@ -1,7 +1,6 @@
 config SND_PXA2XX_SOC
         tristate "SoC Audio for the Intel PXA2xx chip"
         depends on ARCH_PXA
-        select SND_ARM
         select SND_PXA2XX_LIB
         help
           Say Y or M if you want to add support for codecs attached to
@@ -25,7 +24,6 @@ config SND_PXA2XX_AC97
 config SND_PXA2XX_SOC_AC97
         tristate
         select AC97_BUS
-        select SND_ARM
         select SND_PXA2XX_LIB_AC97
         select SND_SOC_AC97_BUS
 
diff --git a/sound/soc/pxa/pxa2xx-ac97.c b/sound/soc/pxa/pxa2xx-ac97.c
index 1f6054650991..9e4b04e0fbd1 100644
--- a/sound/soc/pxa/pxa2xx-ac97.c
+++ b/sound/soc/pxa/pxa2xx-ac97.c
@@ -49,7 +49,7 @@ static struct snd_ac97_bus_ops pxa2xx_ac97_ops = {
         .reset  = pxa2xx_ac97_cold_reset,
 };
 
-static unsigned long pxa2xx_ac97_pcm_stereo_in_req = 12;
+static unsigned long pxa2xx_ac97_pcm_stereo_in_req = 11;
 static struct snd_dmaengine_dai_dma_data pxa2xx_ac97_pcm_stereo_in = {
         .addr           = __PREG(PCDR),
         .addr_width     = DMA_SLAVE_BUSWIDTH_4_BYTES,
@@ -57,7 +57,7 @@ static struct snd_dmaengine_dai_dma_data pxa2xx_ac97_pcm_stereo_in = {
         .filter_data    = &pxa2xx_ac97_pcm_stereo_in_req,
 };
 
-static unsigned long pxa2xx_ac97_pcm_stereo_out_req = 11;
+static unsigned long pxa2xx_ac97_pcm_stereo_out_req = 12;
 static struct snd_dmaengine_dai_dma_data pxa2xx_ac97_pcm_stereo_out = {
         .addr           = __PREG(PCDR),
         .addr_width     = DMA_SLAVE_BUSWIDTH_4_BYTES,
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index f4bf21a5539b..ff8bda471b25 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -3501,7 +3501,7 @@ static int snd_soc_dai_link_event(struct snd_soc_dapm_widget *w,
 
         default:
                 WARN(1, "Unknown event %d\n", event);
-                return -EINVAL;
+                ret = -EINVAL;
         }
 
 out:
diff --git a/sound/soc/soc-utils.c b/sound/soc/soc-utils.c
index 362c69ac1d6c..53dd085d3ee2 100644
--- a/sound/soc/soc-utils.c
+++ b/sound/soc/soc-utils.c
@@ -101,6 +101,15 @@ static struct snd_soc_codec_driver dummy_codec;
                         SNDRV_PCM_FMTBIT_S32_LE | \
                         SNDRV_PCM_FMTBIT_U32_LE | \
                         SNDRV_PCM_FMTBIT_IEC958_SUBFRAME_LE)
+/*
+ * The dummy CODEC is only meant to be used in situations where there is no
+ * actual hardware.
+ *
+ * If there is actual hardware even if it does not have a control bus
+ * the hardware will still have constraints like supported samplerates, etc.
+ * which should be modelled. And the data flow graph also should be modelled
+ * using DAPM.
+ */
 static struct snd_soc_dai_driver dummy_dai = {
         .name = "snd-soc-dummy-dai",
         .playback = {
diff --git a/sound/soc/spear/Kconfig b/sound/soc/spear/Kconfig
index 0a53053495f3..4fb91412ebec 100644
--- a/sound/soc/spear/Kconfig
+++ b/sound/soc/spear/Kconfig
@@ -1,6 +1,6 @@
 config SND_SPEAR_SOC
         tristate
-        select SND_DMAENGINE_PCM
+        select SND_SOC_GENERIC_DMAENGINE_PCM
 
 config SND_SPEAR_SPDIF_OUT
         tristate
diff --git a/sound/soc/sti/uniperif_player.c b/sound/soc/sti/uniperif_player.c
index f6eefe1b8f8f..843f037a317d 100644
--- a/sound/soc/sti/uniperif_player.c
+++ b/sound/soc/sti/uniperif_player.c
@@ -989,8 +989,8 @@ static int uni_player_parse_dt(struct platform_device *pdev,
         if (!info)
                 return -ENOMEM;
 
-        of_property_read_u32(pnode, "version", &player->ver);
-        if (player->ver == SND_ST_UNIPERIF_VERSION_UNKNOWN) {
+        if (of_property_read_u32(pnode, "version", &player->ver) ||
+            player->ver == SND_ST_UNIPERIF_VERSION_UNKNOWN) {
                 dev_err(dev, "Unknown uniperipheral version ");
                 return -EINVAL;
         }
@@ -998,10 +998,16 @@ static int uni_player_parse_dt(struct platform_device *pdev,
         if (player->ver >= SND_ST_UNIPERIF_VERSION_UNI_PLR_TOP_1_0)
                 info->underflow_enabled = 1;
 
-        of_property_read_u32(pnode, "uniperiph-id", &info->id);
+        if (of_property_read_u32(pnode, "uniperiph-id", &info->id)) {
+                dev_err(dev, "uniperipheral id not defined");
+                return -EINVAL;
+        }
 
         /* Read the device mode property */
-        of_property_read_string(pnode, "mode", &mode);
+        if (of_property_read_string(pnode, "mode", &mode)) {
+                dev_err(dev, "uniperipheral mode not defined");
+                return -EINVAL;
+        }
 
         if (strcasecmp(mode, "hdmi") == 0)
                 info->player_type = SND_ST_UNIPERIF_PLAYER_TYPE_HDMI;
diff --git a/sound/soc/sti/uniperif_reader.c b/sound/soc/sti/uniperif_reader.c
index c502626f339b..f791239a3087 100644
--- a/sound/soc/sti/uniperif_reader.c
+++ b/sound/soc/sti/uniperif_reader.c
@@ -316,7 +316,11 @@ static int uni_reader_parse_dt(struct platform_device *pdev,
         if (!info)
                 return -ENOMEM;
 
-        of_property_read_u32(node, "version", &reader->ver);
+        if (of_property_read_u32(node, "version", &reader->ver) ||
+            reader->ver == SND_ST_UNIPERIF_VERSION_UNKNOWN) {
+                dev_err(&pdev->dev, "Unknown uniperipheral version ");
+                return -EINVAL;
+        }
 
         /* Save the info structure */
         reader->info = info;
diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c
index eb51325e8ad9..284a76e04628 100644
--- a/tools/perf/builtin-script.c
+++ b/tools/perf/builtin-script.c
@@ -768,8 +768,8 @@ static int process_exit_event(struct perf_tool *tool,
         if (!evsel->attr.sample_id_all) {
                 sample->cpu = 0;
                 sample->time = 0;
-                sample->tid = event->comm.tid;
-                sample->pid = event->comm.pid;
+                sample->tid = event->fork.tid;
+                sample->pid = event->fork.pid;
         }
         print_sample_start(sample, thread, evsel);
         perf_event__fprintf(event, stdout);
diff --git a/tools/perf/tests/sw-clock.c b/tools/perf/tests/sw-clock.c
index 1aa21c90731b..5b83f56a3b6f 100644
--- a/tools/perf/tests/sw-clock.c
+++ b/tools/perf/tests/sw-clock.c
@@ -34,6 +34,8 @@ static int __test__sw_clock_freq(enum perf_sw_ids clock_id)
                 .disabled = 1,
                 .freq = 1,
         };
+        struct cpu_map *cpus;
+        struct thread_map *threads;
 
         attr.sample_freq = 500;
 
@@ -50,14 +52,19 @@ static int __test__sw_clock_freq(enum perf_sw_ids clock_id)
         }
         perf_evlist__add(evlist, evsel);
 
-        evlist->cpus = cpu_map__dummy_new();
-        evlist->threads = thread_map__new_by_tid(getpid());
-        if (!evlist->cpus || !evlist->threads) {
+        cpus = cpu_map__dummy_new();
+        threads = thread_map__new_by_tid(getpid());
+        if (!cpus || !threads) {
                 err = -ENOMEM;
                 pr_debug("Not enough memory to create thread/cpu maps\n");
-                goto out_delete_evlist;
+                goto out_free_maps;
         }
 
+        perf_evlist__set_maps(evlist, cpus, threads);
+
+        cpus    = NULL;
+        threads = NULL;
+
         if (perf_evlist__open(evlist)) {
                 const char *knob = "/proc/sys/kernel/perf_event_max_sample_rate";
 
@@ -107,6 +114,9 @@ next_event:
                 err = -1;
         }
 
+out_free_maps:
+        cpu_map__put(cpus);
+        thread_map__put(threads);
 out_delete_evlist:
         perf_evlist__delete(evlist);
         return err;
diff --git a/tools/perf/tests/task-exit.c b/tools/perf/tests/task-exit.c
index 3a8fedef83bc..add16385f13e 100644
--- a/tools/perf/tests/task-exit.c
+++ b/tools/perf/tests/task-exit.c
@@ -43,6 +43,8 @@ int test__task_exit(void)
         };
         const char *argv[] = { "true", NULL };
         char sbuf[STRERR_BUFSIZE];
+        struct cpu_map *cpus;
+        struct thread_map *threads;
 
         signal(SIGCHLD, sig_handler);
 
@@ -58,14 +60,19 @@ int test__task_exit(void)
          * perf_evlist__prepare_workload we'll fill in the only thread
          * we're monitoring, the one forked there.
          */
-        evlist->cpus = cpu_map__dummy_new();
-        evlist->threads = thread_map__new_by_tid(-1);
-        if (!evlist->cpus || !evlist->threads) {
+        cpus = cpu_map__dummy_new();
+        threads = thread_map__new_by_tid(-1);
+        if (!cpus || !threads) {
                 err = -ENOMEM;
                 pr_debug("Not enough memory to create thread/cpu maps\n");
-                goto out_delete_evlist;
+                goto out_free_maps;
         }
 
+        perf_evlist__set_maps(evlist, cpus, threads);
+
+        cpus    = NULL;
+        threads = NULL;
+
         err = perf_evlist__prepare_workload(evlist, &target, argv, false,
                                             workload_exec_failed_signal);
         if (err < 0) {
@@ -114,6 +121,9 @@ retry:
                 err = -1;
         }
 
+out_free_maps:
+        cpu_map__put(cpus);
+        thread_map__put(threads);
 out_delete_evlist:
         perf_evlist__delete(evlist);
         return err;
diff --git a/tools/perf/ui/browsers/hists.c b/tools/perf/ui/browsers/hists.c
index cf86f2d3a5e7..c04c60d4863c 100644
--- a/tools/perf/ui/browsers/hists.c
+++ b/tools/perf/ui/browsers/hists.c
@@ -1968,7 +1968,8 @@ skip_annotation:
                                           &options[nr_options], dso);
                 nr_options += add_map_opt(browser, &actions[nr_options],
                                           &options[nr_options],
-                                          browser->selection->map);
+                                          browser->selection ?
+                                                browser->selection->map : NULL);
 
                 /* perf script support */
                 if (browser->he_selection) {
@@ -1976,6 +1977,15 @@ skip_annotation:
                                                      &actions[nr_options],
                                                      &options[nr_options],
                                                      thread, NULL);
+                        /*
+                         * Note that browser->selection != NULL
+                         * when browser->he_selection is not NULL,
+                         * so we don't need to check browser->selection
+                         * before fetching browser->selection->sym like what
+                         * we do before fetching browser->selection->map.
+                         *
+                         * See hist_browser__show_entry.
+                         */
                         nr_options += add_script_opt(browser,
                                                      &actions[nr_options],
                                                      &options[nr_options],
diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c
index d51a5200c8af..c8fc8a258f42 100644
--- a/tools/perf/util/evlist.c
+++ b/tools/perf/util/evlist.c
@@ -124,6 +124,33 @@ void perf_evlist__delete(struct perf_evlist *evlist)
         free(evlist);
 }
 
+static void __perf_evlist__propagate_maps(struct perf_evlist *evlist,
+                                          struct perf_evsel *evsel)
+{
+        /*
+         * We already have cpus for evsel (via PMU sysfs) so
+         * keep it, if there's no target cpu list defined.
+         */
+        if (!evsel->own_cpus || evlist->has_user_cpus) {
+                cpu_map__put(evsel->cpus);
+                evsel->cpus = cpu_map__get(evlist->cpus);
+        } else if (evsel->cpus != evsel->own_cpus) {
+                cpu_map__put(evsel->cpus);
+                evsel->cpus = cpu_map__get(evsel->own_cpus);
+        }
+
+        thread_map__put(evsel->threads);
+        evsel->threads = thread_map__get(evlist->threads);
+}
+
+static void perf_evlist__propagate_maps(struct perf_evlist *evlist)
+{
+        struct perf_evsel *evsel;
+
+        evlist__for_each(evlist, evsel)
+                __perf_evlist__propagate_maps(evlist, evsel);
+}
+
 void perf_evlist__add(struct perf_evlist *evlist, struct perf_evsel *entry)
 {
         entry->evlist = evlist;
@@ -133,18 +160,19 @@ void perf_evlist__add(struct perf_evlist *evlist, struct perf_evsel *entry)
 
         if (!evlist->nr_entries++)
                 perf_evlist__set_id_pos(evlist);
+
+        __perf_evlist__propagate_maps(evlist, entry);
 }
 
 void perf_evlist__splice_list_tail(struct perf_evlist *evlist,
-                                   struct list_head *list,
-                                   int nr_entries)
+                                   struct list_head *list)
 {
-        bool set_id_pos = !evlist->nr_entries;
+        struct perf_evsel *evsel, *temp;
 
-        list_splice_tail(list, &evlist->entries);
-        evlist->nr_entries += nr_entries;
-        if (set_id_pos)
-                perf_evlist__set_id_pos(evlist);
+        __evlist__for_each_safe(list, temp, evsel) {
+                list_del_init(&evsel->node);
+                perf_evlist__add(evlist, evsel);
+        }
 }
 
 void __perf_evlist__set_leader(struct list_head *list)
@@ -210,7 +238,7 @@ static int perf_evlist__add_attrs(struct perf_evlist *evlist,
                 list_add_tail(&evsel->node, &head);
         }
 
-        perf_evlist__splice_list_tail(evlist, &head, nr_attrs);
+        perf_evlist__splice_list_tail(evlist, &head);
 
         return 0;
 
@@ -1103,71 +1131,56 @@ int perf_evlist__mmap(struct perf_evlist *evlist, unsigned int pages,
         return perf_evlist__mmap_ex(evlist, pages, overwrite, 0, false);
 }
 
-static int perf_evlist__propagate_maps(struct perf_evlist *evlist,
-                                       bool has_user_cpus)
-{
-        struct perf_evsel *evsel;
-
-        evlist__for_each(evlist, evsel) {
-                /*
-                 * We already have cpus for evsel (via PMU sysfs) so
-                 * keep it, if there's no target cpu list defined.
-                 */
-                if (evsel->cpus && has_user_cpus)
-                        cpu_map__put(evsel->cpus);
-
-                if (!evsel->cpus || has_user_cpus)
-                        evsel->cpus = cpu_map__get(evlist->cpus);
-
-                evsel->threads = thread_map__get(evlist->threads);
-
-                if ((evlist->cpus && !evsel->cpus) ||
-                    (evlist->threads && !evsel->threads))
-                        return -ENOMEM;
-        }
-
-        return 0;
-}
-
 int perf_evlist__create_maps(struct perf_evlist *evlist, struct target *target)
 {
-        evlist->threads = thread_map__new_str(target->pid, target->tid,
-                                              target->uid);
+        struct cpu_map *cpus;
+        struct thread_map *threads;
+
+        threads = thread_map__new_str(target->pid, target->tid, target->uid);
 
-        if (evlist->threads == NULL)
+        if (!threads)
                 return -1;
 
         if (target__uses_dummy_map(target))
-                evlist->cpus = cpu_map__dummy_new();
+                cpus = cpu_map__dummy_new();
         else
-                evlist->cpus = cpu_map__new(target->cpu_list);
+                cpus = cpu_map__new(target->cpu_list);
 
-        if (evlist->cpus == NULL)
+        if (!cpus)
                 goto out_delete_threads;
 
-        return perf_evlist__propagate_maps(evlist, !!target->cpu_list);
+        evlist->has_user_cpus = !!target->cpu_list;
+
+        perf_evlist__set_maps(evlist, cpus, threads);
+
+        return 0;
 
 out_delete_threads:
-        thread_map__put(evlist->threads);
-        evlist->threads = NULL;
+        thread_map__put(threads);
         return -1;
 }
 
-int perf_evlist__set_maps(struct perf_evlist *evlist,
-                          struct cpu_map *cpus,
-                          struct thread_map *threads)
+void perf_evlist__set_maps(struct perf_evlist *evlist, struct cpu_map *cpus,
+                           struct thread_map *threads)
 {
-        if (evlist->cpus)
+        /*
+         * Allow for the possibility that one or another of the maps isn't being
+         * changed i.e. don't put it.  Note we are assuming the maps that are
+         * being applied are brand new and evlist is taking ownership of the
+         * original reference count of 1.  If that is not the case it is up to
+         * the caller to increase the reference count.
+         */
+        if (cpus != evlist->cpus) {
                 cpu_map__put(evlist->cpus);
+                evlist->cpus = cpus;
+        }
 
-        evlist->cpus = cpus;
-
-        if (evlist->threads)
+        if (threads != evlist->threads) {
                 thread_map__put(evlist->threads);
+                evlist->threads = threads;
+        }
 
-        evlist->threads = threads;
-
-        return perf_evlist__propagate_maps(evlist, false);
+        perf_evlist__propagate_maps(evlist);
 }
 
 int perf_evlist__apply_filters(struct perf_evlist *evlist, struct perf_evsel **err_evsel)
@@ -1387,6 +1400,8 @@ void perf_evlist__close(struct perf_evlist *evlist)
 
 static int perf_evlist__create_syswide_maps(struct perf_evlist *evlist)
 {
+        struct cpu_map    *cpus;
+        struct thread_map *threads;
         int err = -ENOMEM;
 
         /*
@@ -1398,20 +1413,19 @@ static int perf_evlist__create_syswide_maps(struct perf_evlist *evlist)
          * error, and we may not want to do that fallback to a
          * default cpu identity map :-\
          */
-        evlist->cpus = cpu_map__new(NULL);
-        if (evlist->cpus == NULL)
+        cpus = cpu_map__new(NULL);
+        if (!cpus)
                 goto out;
 
-        evlist->threads = thread_map__new_dummy();
-        if (evlist->threads == NULL)
-                goto out_free_cpus;
+        threads = thread_map__new_dummy();
+        if (!threads)
+                goto out_put;
 
-        err = 0;
+        perf_evlist__set_maps(evlist, cpus, threads);
 out:
         return err;
-out_free_cpus:
-        cpu_map__put(evlist->cpus);
-        evlist->cpus = NULL;
+out_put:
+        cpu_map__put(cpus);
         goto out;
 }
 
diff --git a/tools/perf/util/evlist.h b/tools/perf/util/evlist.h
index b39a6198f4ac..115d8b53c601 100644
--- a/tools/perf/util/evlist.h
+++ b/tools/perf/util/evlist.h
@@ -42,6 +42,7 @@ struct perf_evlist {
         int              nr_mmaps;
         bool             overwrite;
         bool             enabled;
+        bool             has_user_cpus;
         size_t           mmap_len;
         int              id_pos;
         int              is_pos;
@@ -155,9 +156,8 @@ int perf_evlist__enable_event_idx(struct perf_evlist *evlist,
 void perf_evlist__set_selected(struct perf_evlist *evlist,
                                struct perf_evsel *evsel);
 
-int perf_evlist__set_maps(struct perf_evlist *evlist,
-                          struct cpu_map *cpus,
-                          struct thread_map *threads);
+void perf_evlist__set_maps(struct perf_evlist *evlist, struct cpu_map *cpus,
+                           struct thread_map *threads);
 int perf_evlist__create_maps(struct perf_evlist *evlist, struct target *target);
 int perf_evlist__apply_filters(struct perf_evlist *evlist, struct perf_evsel **err_evsel);
 
@@ -179,8 +179,7 @@ bool perf_evlist__valid_sample_id_all(struct perf_evlist *evlist);
 bool perf_evlist__valid_read_format(struct perf_evlist *evlist);
 
 void perf_evlist__splice_list_tail(struct perf_evlist *evlist,
-                                   struct list_head *list,
-                                   int nr_entries);
+                                   struct list_head *list);
 
 static inline struct perf_evsel *perf_evlist__first(struct perf_evlist *evlist)
 {
diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
index c53f79123b37..5410483d5219 100644
--- a/tools/perf/util/evsel.c
+++ b/tools/perf/util/evsel.c
@@ -1033,6 +1033,7 @@ void perf_evsel__exit(struct perf_evsel *evsel)
         perf_evsel__free_config_terms(evsel);
         close_cgroup(evsel->cgrp);
         cpu_map__put(evsel->cpus);
+        cpu_map__put(evsel->own_cpus);
         thread_map__put(evsel->threads);
         zfree(&evsel->group_name);
         zfree(&evsel->name);
diff --git a/tools/perf/util/evsel.h b/tools/perf/util/evsel.h
index 298e6bbca200..ef8925f7211a 100644
--- a/tools/perf/util/evsel.h
+++ b/tools/perf/util/evsel.h
@@ -98,6 +98,7 @@ struct perf_evsel {
         struct cgroup_sel       *cgrp;
         void                    *handler;
         struct cpu_map          *cpus;
+        struct cpu_map          *own_cpus;
         struct thread_map       *threads;
         unsigned int            sample_size;
         int                     id_pos;
diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
index 41814547da15..fce6634aebe2 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -1438,7 +1438,7 @@ static int process_nrcpus(struct perf_file_section *section __maybe_unused,
         if (ph->needs_swap)
                 nr = bswap_32(nr);
 
-        ph->env.nr_cpus_online = nr;
+        ph->env.nr_cpus_avail = nr;
 
         ret = readn(fd, &nr, sizeof(nr));
         if (ret != sizeof(nr))
@@ -1447,7 +1447,7 @@ static int process_nrcpus(struct perf_file_section *section __maybe_unused,
         if (ph->needs_swap)
                 nr = bswap_32(nr);
 
-        ph->env.nr_cpus_avail = nr;
+        ph->env.nr_cpus_online = nr;
         return 0;
 }
 
diff --git a/tools/perf/util/intel-bts.c b/tools/perf/util/intel-bts.c
index ea768625ab5b..eb0e7f8bf515 100644
--- a/tools/perf/util/intel-bts.c
+++ b/tools/perf/util/intel-bts.c
@@ -623,7 +623,7 @@ static int intel_bts_process_event(struct perf_session *session,
         if (err)
                 return err;
         if (event->header.type == PERF_RECORD_EXIT) {
-                err = intel_bts_process_tid_exit(bts, event->comm.tid);
+                err = intel_bts_process_tid_exit(bts, event->fork.tid);
                 if (err)
                         return err;
         }
diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c
index bb41c20e6005..535d86f8e4d1 100644
--- a/tools/perf/util/intel-pt.c
+++ b/tools/perf/util/intel-pt.c
@@ -1494,7 +1494,7 @@ static int intel_pt_process_event(struct perf_session *session,
         if (pt->timeless_decoding) {
                 if (event->header.type == PERF_RECORD_EXIT) {
                         err = intel_pt_process_timeless_queues(pt,
-                                                               event->comm.tid,
+                                                               event->fork.tid,
                                                                sample->time);
                 }
         } else if (timestamp) {
diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c
index d826e6f515db..21ed6ee63da9 100644
--- a/tools/perf/util/parse-events.c
+++ b/tools/perf/util/parse-events.c
@@ -287,8 +287,8 @@ __add_event(struct list_head *list, int *idx,
         if (!evsel)
                 return NULL;
 
-        if (cpus)
-                evsel->cpus = cpu_map__get(cpus);
+        evsel->cpus     = cpu_map__get(cpus);
+        evsel->own_cpus = cpu_map__get(cpus);
 
         if (name)
                 evsel->name = strdup(name);
@@ -1140,10 +1140,9 @@ int parse_events(struct perf_evlist *evlist, const char *str,
         ret = parse_events__scanner(str, &data, PE_START_EVENTS);
         perf_pmu__parse_cleanup();
         if (!ret) {
-                int entries = data.idx - evlist->nr_entries;
                 struct perf_evsel *last;
 
-                perf_evlist__splice_list_tail(evlist, &data.list, entries);
+                perf_evlist__splice_list_tail(evlist, &data.list);
                 evlist->nr_groups += data.nr_groups;
                 last = perf_evlist__last(evlist);
                 last->cmdline_group_boundary = true;
diff --git a/tools/perf/util/parse-events.y b/tools/perf/util/parse-events.y
index 591905a02b92..9cd70819c795 100644
--- a/tools/perf/util/parse-events.y
+++ b/tools/perf/util/parse-events.y
@@ -255,7 +255,7 @@ PE_PMU_EVENT_PRE '-' PE_PMU_EVENT_SUF sep_dc
         list_add_tail(&term->list, head);
 
         ALLOC_LIST(list);
-        ABORT_ON(parse_events_add_pmu(list, &data->idx, "cpu", head));
+        ABORT_ON(parse_events_add_pmu(data, list, "cpu", head));
         parse_events__free_terms(head);
         $$ = list;
 }
diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile
index 050151144596..cfe121353eec 100644
--- a/tools/testing/selftests/Makefile
+++ b/tools/testing/selftests/Makefile
@@ -6,6 +6,7 @@ TARGETS += firmware
 TARGETS += ftrace
 TARGETS += futex
 TARGETS += kcmp
+TARGETS += membarrier
 TARGETS += memfd
 TARGETS += memory-hotplug
 TARGETS += mount
@@ -15,12 +16,12 @@ TARGETS += powerpc
 TARGETS += ptrace
 TARGETS += seccomp
 TARGETS += size
+TARGETS += static_keys
 TARGETS += sysctl
 ifneq (1, $(quicktest))
 TARGETS += timers
 endif
 TARGETS += user
-TARGETS += jumplabel
 TARGETS += vm
 TARGETS += x86
 TARGETS += zram
diff --git a/tools/testing/selftests/exec/Makefile b/tools/testing/selftests/exec/Makefile
index 6b76bfdc847e..4e400eb83657 100644
--- a/tools/testing/selftests/exec/Makefile
+++ b/tools/testing/selftests/exec/Makefile
@@ -1,6 +1,6 @@
 CFLAGS = -Wall
 BINARIES = execveat
-DEPS = execveat.symlink execveat.denatured script
+DEPS = execveat.symlink execveat.denatured script subdir
 all: $(BINARIES) $(DEPS)
 
 subdir:
@@ -22,7 +22,5 @@ TEST_FILES := $(DEPS)
 
 include ../lib.mk
 
-override EMIT_TESTS := echo "mkdir -p subdir; (./execveat && echo \"selftests: execveat [PASS]\") || echo \"selftests: execveat [FAIL]\""
-
 clean:
         rm -rf $(BINARIES) $(DEPS) subdir.moved execveat.moved xxxxx*
diff --git a/tools/testing/selftests/ftrace/Makefile b/tools/testing/selftests/ftrace/Makefile
index 0acbeca47225..4e6ed13e7f66 100644
--- a/tools/testing/selftests/ftrace/Makefile
+++ b/tools/testing/selftests/ftrace/Makefile
@@ -1,7 +1,7 @@
 all:
 
 TEST_PROGS := ftracetest
-TEST_DIRS := test.d/
+TEST_DIRS := test.d
 
 include ../lib.mk
 
diff --git a/tools/testing/selftests/lib.mk b/tools/testing/selftests/lib.mk
index 97f1c6742066..50a93f5f13d6 100644
--- a/tools/testing/selftests/lib.mk
+++ b/tools/testing/selftests/lib.mk
@@ -12,13 +12,10 @@ run_tests: all
         $(RUN_TESTS)
 
 define INSTALL_RULE
-        @if [ "X$(TEST_PROGS)$(TEST_PROGS_EXTENDED)$(TEST_FILES)" != "X" ]; then                        \
-                mkdir -p $(INSTALL_PATH);                                                               \
-                for TEST_DIR in $(TEST_DIRS); do                                                        \
-                        cp -r $$TEST_DIR $(INSTALL_PATH);                                               \
-                done;                                                                                   \
-                echo "install -t $(INSTALL_PATH) $(TEST_PROGS) $(TEST_PROGS_EXTENDED) $(TEST_FILES)";   \
-                install -t $(INSTALL_PATH) $(TEST_PROGS) $(TEST_PROGS_EXTENDED) $(TEST_FILES);          \
+        @if [ "X$(TEST_PROGS)$(TEST_PROGS_EXTENDED)$(TEST_FILES)" != "X" ]; then                                        \
+                mkdir -p ${INSTALL_PATH};                                                                               \
+                echo "rsync -a $(TEST_DIRS) $(TEST_PROGS) $(TEST_PROGS_EXTENDED) $(TEST_FILES) $(INSTALL_PATH)/";       \
+                rsync -a $(TEST_DIRS) $(TEST_PROGS) $(TEST_PROGS_EXTENDED) $(TEST_FILES) $(INSTALL_PATH)/;              \
         fi
 endef
 
diff --git a/tools/testing/selftests/membarrier/.gitignore b/tools/testing/selftests/membarrier/.gitignore
new file mode 100644
index 000000000000..020c44f49a9e
--- /dev/null
+++ b/tools/testing/selftests/membarrier/.gitignore
@@ -0,0 +1 @@
+membarrier_test
diff --git a/tools/testing/selftests/membarrier/Makefile b/tools/testing/selftests/membarrier/Makefile
new file mode 100644
index 000000000000..a1a97085847d
--- /dev/null
+++ b/tools/testing/selftests/membarrier/Makefile
@@ -0,0 +1,10 @@
+CFLAGS += -g -I../../../../usr/include/
+
+TEST_PROGS := membarrier_test
+
+all: $(TEST_PROGS)
+
+include ../lib.mk
+
+clean:
+        $(RM) $(TEST_PROGS)
diff --git a/tools/testing/selftests/membarrier/membarrier_test.c b/tools/testing/selftests/membarrier/membarrier_test.c
new file mode 100644
index 000000000000..535f0fef4d0b
--- /dev/null
+++ b/tools/testing/selftests/membarrier/membarrier_test.c
@@ -0,0 +1,118 @@
+#define _GNU_SOURCE
+#include <linux/membarrier.h>
+#include <syscall.h>
+#include <stdio.h>
+#include <errno.h>
+#include <string.h>
+
+#include "../kselftest.h"
+
+enum test_membarrier_status {
+        TEST_MEMBARRIER_PASS = 0,
+        TEST_MEMBARRIER_FAIL,
+        TEST_MEMBARRIER_SKIP,
+};
+
+static int sys_membarrier(int cmd, int flags)
+{
+        return syscall(__NR_membarrier, cmd, flags);
+}
+
+static enum test_membarrier_status test_membarrier_cmd_fail(void)
+{
+        int cmd = -1, flags = 0;
+
+        if (sys_membarrier(cmd, flags) != -1) {
+                printf("membarrier: Wrong command should fail but passed.\n");
+                return TEST_MEMBARRIER_FAIL;
+        }
+        return TEST_MEMBARRIER_PASS;
+}
+
+static enum test_membarrier_status test_membarrier_flags_fail(void)
+{
+        int cmd = MEMBARRIER_CMD_QUERY, flags = 1;
+
+        if (sys_membarrier(cmd, flags) != -1) {
+                printf("membarrier: Wrong flags should fail but passed.\n");
+                return TEST_MEMBARRIER_FAIL;
+        }
+        return TEST_MEMBARRIER_PASS;
+}
+
+static enum test_membarrier_status test_membarrier_success(void)
+{
+        int cmd = MEMBARRIER_CMD_SHARED, flags = 0;
+
+        if (sys_membarrier(cmd, flags) != 0) {
+                printf("membarrier: Executing MEMBARRIER_CMD_SHARED failed. %s.\n",
+                                strerror(errno));
+                return TEST_MEMBARRIER_FAIL;
+        }
+
+        printf("membarrier: MEMBARRIER_CMD_SHARED success.\n");
+        return TEST_MEMBARRIER_PASS;
+}
+
+static enum test_membarrier_status test_membarrier(void)
+{
+        enum test_membarrier_status status;
+
+        status = test_membarrier_cmd_fail();
+        if (status)
+                return status;
+        status = test_membarrier_flags_fail();
+        if (status)
+                return status;
+        status = test_membarrier_success();
+        if (status)
+                return status;
+        return TEST_MEMBARRIER_PASS;
+}
+
+static enum test_membarrier_status test_membarrier_query(void)
+{
+        int flags = 0, ret;
+
+        printf("membarrier MEMBARRIER_CMD_QUERY ");
+        ret = sys_membarrier(MEMBARRIER_CMD_QUERY, flags);
+        if (ret < 0) {
+                printf("failed. %s.\n", strerror(errno));
+                switch (errno) {
+                case ENOSYS:
+                        /*
+                         * It is valid to build a kernel with
+                         * CONFIG_MEMBARRIER=n. However, this skips the tests.
+                         */
+                        return TEST_MEMBARRIER_SKIP;
+                case EINVAL:
+                default:
+                        return TEST_MEMBARRIER_FAIL;
+                }
+        }
+        if (!(ret & MEMBARRIER_CMD_SHARED)) {
+                printf("command MEMBARRIER_CMD_SHARED is not supported.\n");
+                return TEST_MEMBARRIER_FAIL;
+        }
+        printf("syscall available.\n");
+        return TEST_MEMBARRIER_PASS;
+}
+
+int main(int argc, char **argv)
+{
+        switch (test_membarrier_query()) {
+        case TEST_MEMBARRIER_FAIL:
+                return ksft_exit_fail();
+        case TEST_MEMBARRIER_SKIP:
+                return ksft_exit_skip();
+        }
+        switch (test_membarrier()) {
+        case TEST_MEMBARRIER_FAIL:
+                return ksft_exit_fail();
+        case TEST_MEMBARRIER_SKIP:
+                return ksft_exit_skip();
+        }
+
+        printf("membarrier: tests done!\n");
+        return ksft_exit_pass();
+}
diff --git a/tools/testing/selftests/mqueue/Makefile b/tools/testing/selftests/mqueue/Makefile
index 0e3b41eb85cd..eebac29acbd9 100644
--- a/tools/testing/selftests/mqueue/Makefile
+++ b/tools/testing/selftests/mqueue/Makefile
@@ -1,8 +1,8 @@
-CFLAGS = -O2
+CFLAGS += -O2
+LDLIBS = -lrt -lpthread -lpopt
+TEST_PROGS := mq_open_tests mq_perf_tests
 
-all:
-        $(CC) $(CFLAGS) mq_open_tests.c -o mq_open_tests -lrt
-        $(CC) $(CFLAGS) -o mq_perf_tests mq_perf_tests.c -lrt -lpthread -lpopt
+all: $(TEST_PROGS)
 
 include ../lib.mk
 
@@ -11,8 +11,6 @@ override define RUN_TESTS
         @./mq_perf_tests || echo "selftests: mq_perf_tests [FAIL]"
 endef
 
-TEST_PROGS := mq_open_tests mq_perf_tests
-
 override define EMIT_TESTS
         echo "./mq_open_tests /test1 || echo \"selftests: mq_open_tests [FAIL]\""
         echo "./mq_perf_tests || echo \"selftests: mq_perf_tests [FAIL]\""
diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c
index a004b4cce99e..770f47adf295 100644
--- a/tools/testing/selftests/seccomp/seccomp_bpf.c
+++ b/tools/testing/selftests/seccomp/seccomp_bpf.c
@@ -1210,6 +1210,10 @@ TEST_F(TRACE_poke, getpid_runs_normally)
 # define ARCH_REGS      struct pt_regs
 # define SYSCALL_NUM    gpr[0]
 # define SYSCALL_RET    gpr[3]
+#elif defined(__s390__)
+# define ARCH_REGS     s390_regs
+# define SYSCALL_NUM   gprs[2]
+# define SYSCALL_RET   gprs[2]
 #else
 # error "Do not know how to find your architecture's registers and syscalls"
 #endif
@@ -1243,7 +1247,8 @@ void change_syscall(struct __test_metadata *_metadata,
         ret = ptrace(PTRACE_GETREGSET, tracee, NT_PRSTATUS, &iov);
         EXPECT_EQ(0, ret);
 
-#if defined(__x86_64__) || defined(__i386__) || defined(__aarch64__) || defined(__powerpc__)
+#if defined(__x86_64__) || defined(__i386__) || defined(__aarch64__) || \
+    defined(__powerpc__) || defined(__s390__)
         {
                 regs.SYSCALL_NUM = syscall;
         }
@@ -1281,17 +1286,21 @@ void tracer_syscall(struct __test_metadata *_metadata, pid_t tracee,
         ret = ptrace(PTRACE_GETEVENTMSG, tracee, NULL, &msg);
         EXPECT_EQ(0, ret);
 
+        /* Validate and take action on expected syscalls. */
         switch (msg) {
         case 0x1002:
                 /* change getpid to getppid. */
+                EXPECT_EQ(__NR_getpid, get_syscall(_metadata, tracee));
                 change_syscall(_metadata, tracee, __NR_getppid);
                 break;
         case 0x1003:
                 /* skip gettid. */
+                EXPECT_EQ(__NR_gettid, get_syscall(_metadata, tracee));
                 change_syscall(_metadata, tracee, -1);
                 break;
         case 0x1004:
                 /* do nothing (allow getppid) */
+                EXPECT_EQ(__NR_getppid, get_syscall(_metadata, tracee));
                 break;
         default:
                 EXPECT_EQ(0, msg) {
@@ -1409,6 +1418,8 @@ TEST_F(TRACE_syscall, syscall_dropped)
 #  define __NR_seccomp 277
 # elif defined(__powerpc__)
 #  define __NR_seccomp 358
+# elif defined(__s390__)
+#  define __NR_seccomp 348
 # else
 #  warning "seccomp syscall number unknown for this architecture"
 #  define __NR_seccomp 0xffff
@@ -1453,6 +1464,9 @@ TEST(seccomp_syscall)
 
         /* Reject insane operation. */
         ret = seccomp(-1, 0, &prog);
+        ASSERT_NE(ENOSYS, errno) {
+                TH_LOG("Kernel does not support seccomp syscall!");
+        }
         EXPECT_EQ(EINVAL, errno) {
                 TH_LOG("Did not reject crazy op value!");
         }
@@ -1501,6 +1515,9 @@ TEST(seccomp_syscall_mode_lock)
         }
 
         ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog);
+        ASSERT_NE(ENOSYS, errno) {
+                TH_LOG("Kernel does not support seccomp syscall!");
+        }
         EXPECT_EQ(0, ret) {
                 TH_LOG("Could not install filter!");
         }
@@ -1535,6 +1552,9 @@ TEST(TSYNC_first)
 
         ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FLAG_FILTER_TSYNC,
                       &prog);
+        ASSERT_NE(ENOSYS, errno) {
+                TH_LOG("Kernel does not support seccomp syscall!");
+        }
         EXPECT_EQ(0, ret) {
                 TH_LOG("Could not install initial filter with TSYNC!");
         }
@@ -1694,6 +1714,9 @@ TEST_F(TSYNC, siblings_fail_prctl)
 
         /* Check prctl failure detection by requesting sib 0 diverge. */
         ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog);
+        ASSERT_NE(ENOSYS, errno) {
+                TH_LOG("Kernel does not support seccomp syscall!");
+        }
         ASSERT_EQ(0, ret) {
                 TH_LOG("setting filter failed");
         }
@@ -1731,6 +1754,9 @@ TEST_F(TSYNC, two_siblings_with_ancestor)
         }
 
         ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &self->root_prog);
+        ASSERT_NE(ENOSYS, errno) {
+                TH_LOG("Kernel does not support seccomp syscall!");
+        }
         ASSERT_EQ(0, ret) {
                 TH_LOG("Kernel does not support SECCOMP_SET_MODE_FILTER!");
         }
@@ -1805,6 +1831,9 @@ TEST_F(TSYNC, two_siblings_with_no_filter)
 
         ret = seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FLAG_FILTER_TSYNC,
                       &self->apply_prog);
+        ASSERT_NE(ENOSYS, errno) {
+                TH_LOG("Kernel does not support seccomp syscall!");
+        }
         ASSERT_EQ(0, ret) {
                 TH_LOG("Could install filter on all threads!");
         }
@@ -1833,6 +1862,9 @@ TEST_F(TSYNC, two_siblings_with_one_divergence)
         }
 
         ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &self->root_prog);
+        ASSERT_NE(ENOSYS, errno) {
+                TH_LOG("Kernel does not support seccomp syscall!");
+        }
         ASSERT_EQ(0, ret) {
                 TH_LOG("Kernel does not support SECCOMP_SET_MODE_FILTER!");
         }
@@ -1890,6 +1922,9 @@ TEST_F(TSYNC, two_siblings_not_under_filter)
         }
 
         ret = seccomp(SECCOMP_SET_MODE_FILTER, 0, &self->root_prog);
+        ASSERT_NE(ENOSYS, errno) {
+                TH_LOG("Kernel does not support seccomp syscall!");
+        }
         ASSERT_EQ(0, ret) {
                 TH_LOG("Kernel does not support SECCOMP_SET_MODE_FILTER!");
         }
diff --git a/tools/testing/selftests/seccomp/test_harness.h b/tools/testing/selftests/seccomp/test_harness.h
index 977a6afc4489..fb2841601f2f 100644
--- a/tools/testing/selftests/seccomp/test_harness.h
+++ b/tools/testing/selftests/seccomp/test_harness.h
@@ -370,11 +370,8 @@
         __typeof__(_expected) __exp = (_expected); \
         __typeof__(_seen) __seen = (_seen); \
         if (!(__exp _t __seen)) { \
-                unsigned long long __exp_print = 0; \
-                unsigned long long __seen_print = 0; \
-                /* Avoid casting complaints the scariest way we can. */ \
-                memcpy(&__exp_print, &__exp, sizeof(__exp)); \
-                memcpy(&__seen_print, &__seen, sizeof(__seen)); \
+                unsigned long long __exp_print = (unsigned long long)__exp; \
+                unsigned long long __seen_print = (unsigned long long)__seen; \
                 __TH_LOG("Expected %s (%llu) %s %s (%llu)", \
                          #_expected, __exp_print, #_t, \
                          #_seen, __seen_print); \
diff --git a/tools/testing/selftests/vm/Makefile b/tools/testing/selftests/vm/Makefile
index d36fab7d8ebd..3c53cac15de1 100644
--- a/tools/testing/selftests/vm/Makefile
+++ b/tools/testing/selftests/vm/Makefile
@@ -1,6 +1,6 @@
 # Makefile for vm selftests
 
-CFLAGS = -Wall
+CFLAGS = -Wall -I ../../../../usr/include $(EXTRA_CFLAGS)
 BINARIES = compaction_test
 BINARIES += hugepage-mmap
 BINARIES += hugepage-shm
@@ -12,8 +12,11 @@ BINARIES += userfaultfd
 all: $(BINARIES)
 %: %.c
         $(CC) $(CFLAGS) -o $@ $^ -lrt
-userfaultfd: userfaultfd.c
-        $(CC) $(CFLAGS) -O2 -o $@ $^ -lpthread
+userfaultfd: userfaultfd.c ../../../../usr/include/linux/kernel.h
+        $(CC) $(CFLAGS) -O2 -o $@ $< -lpthread
+
+../../../../usr/include/linux/kernel.h:
+        make -C ../../../.. headers_install
 
 TEST_PROGS := run_vmtests
 TEST_FILES := $(BINARIES)
diff --git a/tools/testing/selftests/vm/userfaultfd.c b/tools/testing/selftests/vm/userfaultfd.c
index 2c7cca6f26a4..d77ed41b2094 100644
--- a/tools/testing/selftests/vm/userfaultfd.c
+++ b/tools/testing/selftests/vm/userfaultfd.c
@@ -64,17 +64,9 @@
 #include <sys/syscall.h>
 #include <sys/ioctl.h>
 #include <pthread.h>
-#include "../../../../include/uapi/linux/userfaultfd.h"
-
-#ifdef __x86_64__
-#define __NR_userfaultfd 323
-#elif defined(__i386__)
-#define __NR_userfaultfd 374
-#elif defined(__powewrpc__)
-#define __NR_userfaultfd 364
-#else
-#error "missing __NR_userfaultfd definition"
-#endif
+#include <linux/userfaultfd.h>
+
+#ifdef __NR_userfaultfd
 
 static unsigned long nr_cpus, nr_pages, nr_pages_per_cpu, page_size;
 
@@ -430,7 +422,7 @@ static int userfaultfd_stress(void)
         struct uffdio_register uffdio_register;
         struct uffdio_api uffdio_api;
         unsigned long cpu;
-        int uffd_flags;
+        int uffd_flags, err;
         unsigned long userfaults[nr_cpus];
 
         if (posix_memalign(&area, page_size, nr_pages * page_size)) {
@@ -473,6 +465,14 @@ static int userfaultfd_stress(void)
                 *area_mutex(area_src, nr) = (pthread_mutex_t)
                         PTHREAD_MUTEX_INITIALIZER;
                 count_verify[nr] = *area_count(area_src, nr) = 1;
+                /*
+                 * In the transition between 255 to 256, powerpc will
+                 * read out of order in my_bcmp and see both bytes as
+                 * zero, so leave a placeholder below always non-zero
+                 * after the count, to avoid my_bcmp to trigger false
+                 * positives.
+                 */
+                *(area_count(area_src, nr) + 1) = 1;
         }
 
         pipefd = malloc(sizeof(int) * nr_cpus * 2);
@@ -499,6 +499,7 @@ static int userfaultfd_stress(void)
         pthread_attr_init(&attr);
         pthread_attr_setstacksize(&attr, 16*1024*1024);
 
+        err = 0;
         while (bounces--) {
                 unsigned long expected_ioctls;
 
@@ -579,20 +580,13 @@ static int userfaultfd_stress(void)
                 /* verification */
                 if (bounces & BOUNCE_VERIFY) {
                         for (nr = 0; nr < nr_pages; nr++) {
-                                if (my_bcmp(area_dst,
-                                            area_dst + nr * page_size,
-                                            sizeof(pthread_mutex_t))) {
-                                        fprintf(stderr,
-                                                "error mutex 2 %lu\n",
-                                                nr);
-                                        bounces = 0;
-                                }
                                 if (*area_count(area_dst, nr) != count_verify[nr]) {
                                         fprintf(stderr,
                                                 "error area_count %Lu %Lu %lu\n",
                                                 *area_count(area_src, nr),
                                                 count_verify[nr],
                                                 nr);
+                                        err = 1;
                                         bounces = 0;
                                 }
                         }
@@ -609,7 +603,7 @@ static int userfaultfd_stress(void)
                 printf("\n");
         }
 
-        return 0;
+        return err;
 }
 
 int main(int argc, char **argv)
@@ -618,8 +612,8 @@ int main(int argc, char **argv)
                 fprintf(stderr, "Usage: <MiB> <bounces>\n"), exit(1);
         nr_cpus = sysconf(_SC_NPROCESSORS_ONLN);
         page_size = sysconf(_SC_PAGE_SIZE);
-        if ((unsigned long) area_count(NULL, 0) + sizeof(unsigned long long) >
-            page_size)
+        if ((unsigned long) area_count(NULL, 0) + sizeof(unsigned long long) * 2
+            > page_size)
                 fprintf(stderr, "Impossible to run this test\n"), exit(2);
         nr_pages_per_cpu = atol(argv[1]) * 1024*1024 / page_size /
                 nr_cpus;
@@ -637,3 +631,15 @@ int main(int argc, char **argv)
                nr_pages, nr_pages_per_cpu);
         return userfaultfd_stress();
 }
+
+#else /* __NR_userfaultfd */
+
+#warning "missing __NR_userfaultfd definition"
+
+int main(void)
+{
+        printf("skip: Skipping userfaultfd test (missing __NR_userfaultfd)\n");
+        return 0;
+}
+
+#endif /* __NR_userfaultfd */
diff --git a/tools/testing/selftests/x86/entry_from_vm86.c b/tools/testing/selftests/x86/entry_from_vm86.c
index 9a43a59a9bb4..421c607a8856 100644
--- a/tools/testing/selftests/x86/entry_from_vm86.c
+++ b/tools/testing/selftests/x86/entry_from_vm86.c
@@ -116,8 +116,9 @@ static bool do_test(struct vm86plus_struct *v86, unsigned long eip,
         v86->regs.eip = eip;
         ret = vm86(VM86_ENTER, v86);
 
-        if (ret == -1 && errno == ENOSYS) {
-                printf("[SKIP]\tvm86 not supported\n");
+        if (ret == -1 && (errno == ENOSYS || errno == EPERM)) {
+                printf("[SKIP]\tvm86 %s\n",
+                       errno == ENOSYS ? "not supported" : "not allowed");
                 return false;
         }
 
diff --git a/tools/testing/selftests/zram/zram.sh b/tools/testing/selftests/zram/zram.sh
index 20de9a761269..683a292e3290 100755
--- a/tools/testing/selftests/zram/zram.sh
+++ b/tools/testing/selftests/zram/zram.sh
@@ -1,15 +1,7 @@
 #!/bin/bash
 TCID="zram.sh"
 
-check_prereqs()
-{
-        local msg="skip all tests:"
-
-        if [ $UID != 0 ]; then
-                echo $msg must be run as root >&2
-                exit 0
-        fi
-}
+. ./zram_lib.sh
 
 run_zram () {
 echo "--------------------"
diff --git a/tools/testing/selftests/zram/zram_lib.sh b/tools/testing/selftests/zram/zram_lib.sh
index 424e68ed1487..f6a9c73e7a44 100755
--- a/tools/testing/selftests/zram/zram_lib.sh
+++ b/tools/testing/selftests/zram/zram_lib.sh
@@ -23,8 +23,9 @@ trap INT
 check_prereqs()
 {
         local msg="skip all tests:"
+        local uid=$(id -u)
 
-        if [ $UID != 0 ]; then
+        if [ $uid -ne 0 ]; then
                 echo $msg must be run as root >&2
                 exit 0
         fi
diff --git a/tools/virtio/Makefile b/tools/virtio/Makefile
index 505ad51b3b51..39c89a5ea990 100644
--- a/tools/virtio/Makefile
+++ b/tools/virtio/Makefile
@@ -6,7 +6,7 @@ vringh_test: vringh_test.o vringh.o virtio_ring.o
 CFLAGS += -g -O2 -Werror -Wall -I. -I../include/ -I ../../usr/include/ -Wno-pointer-sign -fno-strict-overflow -fno-strict-aliasing -fno-common -MMD -U_FORTIFY_SOURCE
 vpath %.c ../../drivers/virtio ../../drivers/vhost
 mod:
-        ${MAKE} -C `pwd`/../.. M=`pwd`/vhost_test
+        ${MAKE} -C `pwd`/../.. M=`pwd`/vhost_test V=${V}
 .PHONY: all test mod clean
 clean:
         ${RM} *.o vringh_test virtio_test vhost_test/*.o vhost_test/.*.cmd \
diff --git a/tools/virtio/asm/barrier.h b/tools/virtio/asm/barrier.h
index aff61e13306c..26b7926bda88 100644
--- a/tools/virtio/asm/barrier.h
+++ b/tools/virtio/asm/barrier.h
@@ -3,6 +3,8 @@
 #define mb() __sync_synchronize()
 
 #define smp_mb()        mb()
+# define dma_rmb()      barrier()
+# define dma_wmb()      barrier()
 # define smp_rmb()      barrier()
 # define smp_wmb()      barrier()
 /* Weak barriers should be used. If not - it's a bug */
diff --git a/tools/virtio/linux/export.h b/tools/virtio/linux/export.h
new file mode 100644
index 000000000000..416875e29254
--- /dev/null
+++ b/tools/virtio/linux/export.h
@@ -0,0 +1,3 @@
+#define EXPORT_SYMBOL_GPL(sym) extern typeof(sym) sym
+#define EXPORT_SYMBOL(sym) extern typeof(sym) sym
+
diff --git a/tools/virtio/linux/kernel.h b/tools/virtio/linux/kernel.h
index 1e8ce6979c1e..0a3da64638ce 100644
--- a/tools/virtio/linux/kernel.h
+++ b/tools/virtio/linux/kernel.h
@@ -22,6 +22,7 @@
 
 typedef unsigned long long dma_addr_t;
 typedef size_t __kernel_size_t;
+typedef unsigned int __wsum;
 
 struct page {
         unsigned long long dummy;
@@ -47,6 +48,13 @@ static inline void *kmalloc(size_t s, gfp_t gfp)
                 return __kmalloc_fake;
         return malloc(s);
 }
+static inline void *kzalloc(size_t s, gfp_t gfp)
+{
+        void *p = kmalloc(s, gfp);
+
+        memset(p, 0, s);
+        return p;
+}
 
 static inline void kfree(void *p)
 {
diff --git a/virt/kvm/arm/arch_timer.c b/virt/kvm/arm/arch_timer.c
index 76e38d231e99..48c6e1ac6827 100644
--- a/virt/kvm/arm/arch_timer.c
+++ b/virt/kvm/arm/arch_timer.c
@@ -200,6 +200,14 @@ int kvm_timer_vcpu_reset(struct kvm_vcpu *vcpu,
         timer->irq = irq;
 
         /*
+         * The bits in CNTV_CTL are architecturally reset to UNKNOWN for ARMv8
+         * and to 0 for ARMv7.  We provide an implementation that always
+         * resets the timer to be disabled and unmasked and is compliant with
+         * the ARMv7 architecture.
+         */
+        timer->cntv_ctl = 0;
+
+        /*
          * Tell the VGIC that the virtual interrupt is tied to a
          * physical interrupt. We do that once per VCPU.
          */
diff --git a/virt/kvm/arm/vgic-v3.c b/virt/kvm/arm/vgic-v3.c
index afbf925b00f4..7dd5d62f10a1 100644
--- a/virt/kvm/arm/vgic-v3.c
+++ b/virt/kvm/arm/vgic-v3.c
@@ -288,7 +288,7 @@ int vgic_v3_probe(struct device_node *vgic_node,
 
         vgic->vctrl_base = NULL;
         vgic->type = VGIC_V3;
-        vgic->max_gic_vcpus = KVM_MAX_VCPUS;
+        vgic->max_gic_vcpus = VGIC_V3_MAX_CPUS;
 
         kvm_info("%s@%llx IRQ%d\n", vgic_node->name,
                  vcpu_res.start, vgic->maint_irq);
diff --git a/virt/kvm/arm/vgic.c b/virt/kvm/arm/vgic.c
index 9eb489a2c94c..6bd1c9bf7ae7 100644
--- a/virt/kvm/arm/vgic.c
+++ b/virt/kvm/arm/vgic.c
@@ -1144,26 +1144,11 @@ static void vgic_queue_irq_to_lr(struct kvm_vcpu *vcpu, int irq,
                 struct irq_phys_map *map;
                 map = vgic_irq_map_search(vcpu, irq);
 
-                /*
-                 * If we have a mapping, and the virtual interrupt is
-                 * being injected, then we must set the state to
-                 * active in the physical world. Otherwise the
-                 * physical interrupt will fire and the guest will
-                 * exit before processing the virtual interrupt.
-                 */
                 if (map) {
-                        int ret;
-
-                        BUG_ON(!map->active);
                         vlr.hwirq = map->phys_irq;
                         vlr.state |= LR_HW;
                         vlr.state &= ~LR_EOI_INT;
 
-                        ret = irq_set_irqchip_state(map->irq,
-                                                    IRQCHIP_STATE_ACTIVE,
-                                                    true);
-                        WARN_ON(ret);
-
                         /*
                          * Make sure we're not going to sample this
                          * again, as a HW-backed interrupt cannot be
@@ -1255,7 +1240,7 @@ static void __kvm_vgic_flush_hwstate(struct kvm_vcpu *vcpu)
         struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;
         struct vgic_dist *dist = &vcpu->kvm->arch.vgic;
         unsigned long *pa_percpu, *pa_shared;
-        int i, vcpu_id;
+        int i, vcpu_id, lr, ret;
         int overflow = 0;
         int nr_shared = vgic_nr_shared_irqs(dist);
 
@@ -1310,6 +1295,31 @@ epilog:
                  */
                 clear_bit(vcpu_id, dist->irq_pending_on_cpu);
         }
+
+        for (lr = 0; lr < vgic->nr_lr; lr++) {
+                struct vgic_lr vlr;
+
+                if (!test_bit(lr, vgic_cpu->lr_used))
+                        continue;
+
+                vlr = vgic_get_lr(vcpu, lr);
+
+                /*
+                 * If we have a mapping, and the virtual interrupt is
+                 * presented to the guest (as pending or active), then we must
+                 * set the state to active in the physical world. See
+                 * Documentation/virtual/kvm/arm/vgic-mapped-irqs.txt.
+                 */
+                if (vlr.state & LR_HW) {
+                        struct irq_phys_map *map;
+                        map = vgic_irq_map_search(vcpu, vlr.irq);
+
+                        ret = irq_set_irqchip_state(map->irq,
+                                                    IRQCHIP_STATE_ACTIVE,
+                                                    true);
+                        WARN_ON(ret);
+                }
+        }
 }
 
 static bool vgic_process_maintenance(struct kvm_vcpu *vcpu)
diff --git a/virt/kvm/coalesced_mmio.h b/virt/kvm/coalesced_mmio.h
index 5cbf190d238c..6bca74ca5331 100644
--- a/virt/kvm/coalesced_mmio.h
+++ b/virt/kvm/coalesced_mmio.h
@@ -24,9 +24,9 @@ struct kvm_coalesced_mmio_dev {
 int kvm_coalesced_mmio_init(struct kvm *kvm);
 void kvm_coalesced_mmio_free(struct kvm *kvm);
 int kvm_vm_ioctl_register_coalesced_mmio(struct kvm *kvm,
-                                                                                                                                                                struct kvm_coalesced_mmio_zone *zone);
+                                        struct kvm_coalesced_mmio_zone *zone);
 int kvm_vm_ioctl_unregister_coalesced_mmio(struct kvm *kvm,
-                                                                                                                                                                struct kvm_coalesced_mmio_zone *zone);
+                                        struct kvm_coalesced_mmio_zone *zone);
 
 #else
 
diff --git a/virt/kvm/eventfd.c b/virt/kvm/eventfd.c
index 9ff4193dfa49..79db45336e3a 100644
--- a/virt/kvm/eventfd.c
+++ b/virt/kvm/eventfd.c
@@ -771,40 +771,14 @@ static enum kvm_bus ioeventfd_bus_from_flags(__u32 flags)
         return KVM_MMIO_BUS;
 }
 
-static int
-kvm_assign_ioeventfd(struct kvm *kvm, struct kvm_ioeventfd *args)
+static int kvm_assign_ioeventfd_idx(struct kvm *kvm,
+                                enum kvm_bus bus_idx,
+                                struct kvm_ioeventfd *args)
 {
-        enum kvm_bus              bus_idx;
-        struct _ioeventfd        *p;
-        struct eventfd_ctx       *eventfd;
-        int                       ret;
-
-        bus_idx = ioeventfd_bus_from_flags(args->flags);
-        /* must be natural-word sized, or 0 to ignore length */
-        switch (args->len) {
-        case 0:
-        case 1:
-        case 2:
-        case 4:
-        case 8:
-                break;
-        default:
-                return -EINVAL;
-        }
-
-        /* check for range overflow */
-        if (args->addr + args->len < args->addr)
-                return -EINVAL;
 
-        /* check for extra flags that we don't understand */
-        if (args->flags & ~KVM_IOEVENTFD_VALID_FLAG_MASK)
-                return -EINVAL;
-
-        /* ioeventfd with no length can't be combined with DATAMATCH */
-        if (!args->len &&
-            args->flags & (KVM_IOEVENTFD_FLAG_PIO |
-                           KVM_IOEVENTFD_FLAG_DATAMATCH))
-                return -EINVAL;
+        struct eventfd_ctx *eventfd;
+        struct _ioeventfd *p;
+        int ret;
 
         eventfd = eventfd_ctx_fdget(args->fd);
         if (IS_ERR(eventfd))
@@ -843,16 +817,6 @@ kvm_assign_ioeventfd(struct kvm *kvm, struct kvm_ioeventfd *args)
         if (ret < 0)
                 goto unlock_fail;
 
-        /* When length is ignored, MMIO is also put on a separate bus, for
-         * faster lookups.
-         */
-        if (!args->len && !(args->flags & KVM_IOEVENTFD_FLAG_PIO)) {
-                ret = kvm_io_bus_register_dev(kvm, KVM_FAST_MMIO_BUS,
-                                              p->addr, 0, &p->dev);
-                if (ret < 0)
-                        goto register_fail;
-        }
-
         kvm->buses[bus_idx]->ioeventfd_count++;
         list_add_tail(&p->list, &kvm->ioeventfds);
 
@@ -860,8 +824,6 @@ kvm_assign_ioeventfd(struct kvm *kvm, struct kvm_ioeventfd *args)
 
         return 0;
 
-register_fail:
-        kvm_io_bus_unregister_dev(kvm, bus_idx, &p->dev);
 unlock_fail:
         mutex_unlock(&kvm->slots_lock);
 
@@ -873,14 +835,13 @@ fail:
 }
 
 static int
-kvm_deassign_ioeventfd(struct kvm *kvm, struct kvm_ioeventfd *args)
+kvm_deassign_ioeventfd_idx(struct kvm *kvm, enum kvm_bus bus_idx,
+                           struct kvm_ioeventfd *args)
 {
-        enum kvm_bus              bus_idx;
         struct _ioeventfd        *p, *tmp;
         struct eventfd_ctx       *eventfd;
         int                       ret = -ENOENT;
 
-        bus_idx = ioeventfd_bus_from_flags(args->flags);
         eventfd = eventfd_ctx_fdget(args->fd);
         if (IS_ERR(eventfd))
                 return PTR_ERR(eventfd);
@@ -901,10 +862,6 @@ kvm_deassign_ioeventfd(struct kvm *kvm, struct kvm_ioeventfd *args)
                         continue;
 
                 kvm_io_bus_unregister_dev(kvm, bus_idx, &p->dev);
-                if (!p->length) {
-                        kvm_io_bus_unregister_dev(kvm, KVM_FAST_MMIO_BUS,
-                                                  &p->dev);
-                }
                 kvm->buses[bus_idx]->ioeventfd_count--;
                 ioeventfd_release(p);
                 ret = 0;
@@ -918,6 +875,71 @@ kvm_deassign_ioeventfd(struct kvm *kvm, struct kvm_ioeventfd *args)
         return ret;
 }
 
+static int kvm_deassign_ioeventfd(struct kvm *kvm, struct kvm_ioeventfd *args)
+{
+        enum kvm_bus bus_idx = ioeventfd_bus_from_flags(args->flags);
+        int ret = kvm_deassign_ioeventfd_idx(kvm, bus_idx, args);
+
+        if (!args->len && bus_idx == KVM_MMIO_BUS)
+                kvm_deassign_ioeventfd_idx(kvm, KVM_FAST_MMIO_BUS, args);
+
+        return ret;
+}
+
+static int
+kvm_assign_ioeventfd(struct kvm *kvm, struct kvm_ioeventfd *args)
+{
+        enum kvm_bus              bus_idx;
+        int ret;
+
+        bus_idx = ioeventfd_bus_from_flags(args->flags);
+        /* must be natural-word sized, or 0 to ignore length */
+        switch (args->len) {
+        case 0:
+        case 1:
+        case 2:
+        case 4:
+        case 8:
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        /* check for range overflow */
+        if (args->addr + args->len < args->addr)
+                return -EINVAL;
+
+        /* check for extra flags that we don't understand */
+        if (args->flags & ~KVM_IOEVENTFD_VALID_FLAG_MASK)
+                return -EINVAL;
+
+        /* ioeventfd with no length can't be combined with DATAMATCH */
+        if (!args->len &&
+            args->flags & (KVM_IOEVENTFD_FLAG_PIO |
+                           KVM_IOEVENTFD_FLAG_DATAMATCH))
+                return -EINVAL;
+
+        ret = kvm_assign_ioeventfd_idx(kvm, bus_idx, args);
+        if (ret)
+                goto fail;
+
+        /* When length is ignored, MMIO is also put on a separate bus, for
+         * faster lookups.
+         */
+        if (!args->len && bus_idx == KVM_MMIO_BUS) {
+                ret = kvm_assign_ioeventfd_idx(kvm, KVM_FAST_MMIO_BUS, args);
+                if (ret < 0)
+                        goto fast_fail;
+        }
+
+        return 0;
+
+fast_fail:
+        kvm_deassign_ioeventfd_idx(kvm, bus_idx, args);
+fail:
+        return ret;
+}
+
 int
 kvm_ioeventfd(struct kvm *kvm, struct kvm_ioeventfd *args)
 {
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index a25a73147f71..8db1d9361993 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -66,8 +66,8 @@
 MODULE_AUTHOR("Qumranet");
 MODULE_LICENSE("GPL");
 
-/* halt polling only reduces halt latency by 5-7 us, 500us is enough */
-static unsigned int halt_poll_ns = 500000;
+/* Architectures should define their poll value according to the halt latency */
+static unsigned int halt_poll_ns = KVM_HALT_POLL_NS_DEFAULT;
 module_param(halt_poll_ns, uint, S_IRUGO | S_IWUSR);
 
 /* Default doubles per-vcpu halt_poll_ns. */
@@ -2004,6 +2004,7 @@ void kvm_vcpu_block(struct kvm_vcpu *vcpu)
         if (vcpu->halt_poll_ns) {
                 ktime_t stop = ktime_add_ns(ktime_get(), vcpu->halt_poll_ns);
 
+                ++vcpu->stat.halt_attempted_poll;
                 do {
                         /*
                          * This sets KVM_REQ_UNHALT if an interrupt
@@ -2043,7 +2044,8 @@ out:
                 else if (vcpu->halt_poll_ns < halt_poll_ns &&
                         block_ns < halt_poll_ns)
                         grow_halt_poll_ns(vcpu);
-        }
+        } else
+                vcpu->halt_poll_ns = 0;
 
         trace_kvm_vcpu_wakeup(block_ns, waited);
 }
@@ -3156,10 +3158,25 @@ static void kvm_io_bus_destroy(struct kvm_io_bus *bus)
 static inline int kvm_io_bus_cmp(const struct kvm_io_range *r1,
                                  const struct kvm_io_range *r2)
 {
-        if (r1->addr < r2->addr)
+        gpa_t addr1 = r1->addr;
+        gpa_t addr2 = r2->addr;
+
+        if (addr1 < addr2)
                 return -1;
-        if (r1->addr + r1->len > r2->addr + r2->len)
+
+        /* If r2->len == 0, match the exact address.  If r2->len != 0,
+         * accept any overlapping write.  Any order is acceptable for
+         * overlapping ranges, because kvm_io_bus_get_first_dev ensures
+         * we process all of them.
+         */
+        if (r2->len) {
+                addr1 += r1->len;
+                addr2 += r2->len;
+        }
+
+        if (addr1 > addr2)
                 return 1;
+
         return 0;
 }